Comments (10)
yes public_witness and public inputs are the same thing, and it's not encrypted, in your example the raw result of the hash is used as public input, it's not encrypted or anything
from gnark.
I see. So it's just a matter of encoding and decoding.
Thanks a lot for your time. I'm new to gnark and this has been bugging me a lot. I didn't find any example or unit test ensuring this check, so it was hella confusing.
Thanks again 😀
from gnark.
The public witness contains exactly the values designated as public
. How they are incorporated into the verification process depends on the proof system, but in general it involves something similar to a "homomorphic" commitment scheme (Pedersen in the case of Groth16, and KZG for PlonK.)
from gnark.
Hi, not sure if I understand your issue correctly, is your question about 1) how does groth16 deal with public inputs in general or 2) do you want to know how to bound a hash to public values inside of a circuit ? In the case of 1) the proof simply doesn't pass if the public inputs are not related to the proof. For 2), you could instead of having a lot of public inputs, hash them, make the hash public, make the public inputs private, and prove inside of the circuit that the now public hash corresponds to the hash of the private (formerly public) inputs
from gnark.
@Tabaie @ThomasPiellard thanks for the replies. Let me rephrase my question again.
Inputs 1: data-1, Hash 1
Inputs 2: data-2, Hash 2
First inputs will generate zkProof-1, and second will generate zkProof-2.. but how do the verifier can differentiate between them? That zkProof-1 is indeed of Hash-1 and zkProof-2 is indeed of Hash-2?
@Tabaie answer does give the idea but I don't have much background in crypto graphy. So it would great if there is any high level code example or libraries I can refer.
Thank you.
from gnark.
ok so it was my option 1) I think, so the verifier works by doing a succint computation (namely some pairings in the case of plonk and groth16) on a tuple (public inputs, proof, verification key). A proof contains different components, a part P1
that depends on all the inputs (public and private) and a part P2
that depends only on the private inputs. To verify a proof, the P2
part needs to be completed by the verifier using a set of public inputs and the proof passes only if the P2
part is completed with the public inputs that were used in the computation of P1
. As @Tabaie said in plonk and groth16 P2
is a KZG commitment to the private inputs, and at some point in the verification process we need a commitment to all the inputs, so the verifier computes on its own a commitment to the public inputs PI
and obtains the commitment to all the inputs by adding P2
and PI
. If 'PI' is wrong, the whole commitment is wrong and the proof doesn't pass, if you look at the plonk verifier for instance PI
is computed in the scope here https://github.com/Consensys/gnark/blob/master/backend/plonk/bn254/verify.go#L115
from gnark.
"so the verifier computes on its own a commitment to the public inputs PI.."
I think this answers my questions. Does the public_witness play it's part here?
If the public_witness is encrypted data of public data( homomorphic hidings or something), can a verifier check if the public_witness is indeed of the given Hash (public data).
Sorry if I'm being confusing. I am new to ZK stack. I just want to know how can the verifier differentiate between Valid zk-proofs of same circuits at HIGH LEVEL.
If the method was something like this
groth16.verify(proof, vk, Hash (or whatever public data), It would be way clearer..
from gnark.
yes the public_witness plays its part in the computation of PI. But I don't understand the last remark, the signature of Verify is Verify(proof Proof, vk VerifyingKey, publicWitness witness.Witness, opts ...backend.VerifierOption)
so you have the public witness part involved
from gnark.
At a HIGH level,
Problem statement:
Someone (proover) is claiming that he knows certain Data ( secret input) that hashes to Hash-1 (public data)
The prover sent ZkProof, public witness to me (verifier)
I run the groth16.verify(zkProof, public witness, vk) and can be assured that the proof is indeed right.
But whether if it's the zkProof or public Witness, they are more some encrypted data. It could be any valid inputs ( valid data that hashes some valid Hash).. but How can I make sure it is not some random valid inputs but the Hash-1 ( the one I'm expecting).
from gnark.
Or simply,
Can I independently construct public_witness knowing the public inputs of the circuit or vice versa ?
from gnark.
Related Issues (20)
- How does gnark start GPU acceleration? HOT 1
- bug: BN254 mpcsetup "phase2Evaluations" file not encoded properly
- bug: document clearly that the hash function in `std/recursion` is not collision-resistant when inputs are of different length
- mpcsetup.InitPhase2 fails with 'panic: Number of constraints is larger than expected' HOT 1
- bug: use cryptographically strong hash function for checking if non-native element has to be width-constrained
- bug: describe in emulated `Reduce` method that the result may be either `x` or `x+p`
- bug: emulated `Exp` and `ModExp` take exponents as field elements
- bug: NAF decomposition doesn't enforce checks on adjacent values HOT 2
- chore: check rotation length in `uints` package method `Lrot`
- bug: subtraction padding in variable-modulus non-native arithmetic does not enforce underflow protection
- bug: restrict nbDigits in `std/math/bitslice` `Partition` method
- feat: allow avoiding commitments in non-native arithmetic using constant points for Schwartz-Zippel lemma HOT 5
- bug: AttachDebugInfo() contributes to most memory usage regardless of debug.Debug flag value
- feat: make `std/algebra/native/twistededwards` to implement `std/algebra.Curve` interface.
- Enable solidity scan on blockscout
- bug: Icicle integration is out of date HOT 1
- Question : Is to possible to read the Message field in human readable format inside the circuit
- Question : Is to possible to read the Message field in human readable format inside the circuit HOT 5
- Is there an implementation for ed25519 signature verification circuit? HOT 1
- https://github.com/Consensys/gnark.git HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gnark.