Zero-Knowledge Proofs Simultaneously Ensuring Integrity and Privacy - Tjerand Silde

Zero-Knowledge Proofs: Simultaneously Ensuring Integrity and Privacy - Tjerand Silde ![rw-book-cover](https://img.youtube.com/vi/H8cRnw98q8k/maxresdefault.jpg) 🔗 **Source:** [Zero-Knowledge Proofs: Simultaneously Ensuring Integrity and Privacy - Tjerand Silde](https://www.youtube.com/watch?v=H8cRnw98q8k) > [!note]+ Document Notes > tags: #zero-knowledge-proofs #cryptography #privacy #data-integrity #security #quantum-cryptography #digital-signatures #anonymous-credentials #machine-learning > author: Tjerand Silde > source: YouTube > reference: https://www.youtube.com/watch?v=H8cRnw98q8k > date created: 2024-12-29 09:45 > > # 🏷️ Title: Zero-Knowledge Proofs: Simultaneously ensuring integrity and privacy >  ## 🧰 Action Inbox - [H1] Explore open-source ZKP libraries for educational purposes — 45:23 #cryptography - [H2] Investigate EU digital identity wallet regulations — 35:12 #privacy - [H3] Consider ZKP applications for age verification systems — 08:45 #anonymous-credentials ## 🧭 Table of Contents - [[#📝 Summary]] - [[#📖 Main Content]] - [[#🗒️ Notes]] - [[#📚 References]] - [[#🗣️ Paraphrase]] - [[#📰 Newsletter]] - [[#✅ Action Items]] - [[#🧪 Hypotheses]] - [[#📊 Methodology]] - [[#❓ Questions]] - [[#🔮 Future Research]] - [[#💡 Implications]] - [[#🧠 Learning Styles Assessment]] - [[#📊 Accessibility Assessment]] - [[#🌍 DEIB Assessment]] - [[#✅ Logical Validity]] - [[#🛡️ DARVO Analysis]] - [[#🎯 Conclusion]] ### 🔗 References - [NIST Zero-Knowledge Proof Standardization](https://csrc.nist.gov) - [Baby Snark Educational Library](https://github.com) - [Zcash Implementation](https://z.cash) ## 📝 Summary - Zero-knowledge proofs enable proving statements without revealing underlying data, solving the privacy-integrity tradeoff in digital systems - Applications include quantum-safe signatures, electronic voting, anonymous credentials, and verifiable machine learning - The technology addresses real-world needs like age verification without exposing personal information - NIST and industry consortiums are working on standardization efforts - Open-source educational libraries are available for experimentation ## 📖 Main Content Zero-knowledge proofs represent a breakthrough in cryptography that allows proving the validity of information without revealing the information itself. Traditional cryptographic primitives (public key encryption, symmetric encryption, and digital signatures) provide either confidentiality or integrity, but zero-knowledge proofs achieve both simultaneously. The technology works through interactive protocols between a prover and verifier, with three key properties: correctness (valid proofs are accepted), soundness (false statements cannot be proven), and zero-knowledge (no information about the witness is revealed). This enables applications like age verification where users can prove they're over 18 without sharing birth dates or identity details. Current implementations include quantum-safe signature schemes (FIPS 204 ML-DSA), anonymous cryptocurrency transactions (Zcash), and electronic voting systems. The EU digital identity wallet regulation will likely drive standardization and adoption of zero-knowledge credential systems. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/H8cRnw98q8k?t=0) — [H1] Introduction to cryptographic privacy-integrity tradeoff - Key idea: Traditional cryptography achieves either privacy or integrity, but not both simultaneously - Evidence: "Sometimes we want to have applications where we care about both the privacy of data on one hand, but also to show that or to prove to the world that it satisfies certain properties" #### ⏱️ [02:15](https://youtu.be/H8cRnw98q8k?t=135) — [H2] Current cryptographic primitives overview - Key idea: Three main primitives provide foundation for secure communication today - Evidence: "Public key encryption, symmetric key schemes like AES, and digital signatures give you confidentiality and integrity separately" #### ⏱️ [05:30](https://youtu.be/H8cRnw98q8k?t=330) — [H2] Age verification as motivating example - Key idea: Current systems require oversharing personal information for simple binary verification - Evidence: "We only need this binary value saying if you're below or above 18 years old, but that's the only solution we have for it now" #### ⏱️ [08:45](https://youtu.be/H8cRnw98q8k?t=525) — [H1] Zero-knowledge proof definition and properties - Key idea: Interactive protocols proving statements without revealing witnesses - Evidence: "Three properties: correctness, soundness, and zero-knowledge - the verifier learns nothing about the witness" #### ⏱️ [12:30](https://youtu.be/H8cRnw98q8k?t=750) — [H3] Historical context and theoretical foundations - Key idea: Goldwasser, Micali, and Rackoff laid theoretical groundwork in 1980s - Evidence: "Published in mid-80s and later won Gödel Prize, but quite theoretical and without clear use cases for a long time" #### ⏱️ [15:45](https://youtu.be/H8cRnw98q8k?t=945) — [H1] Quantum-safe signatures using zero-knowledge proofs - Key idea: First standardized quantum-safe signature scheme is actually a zero-knowledge proof - Evidence: "FIPS 204 ML-DSA signature scheme based on lattices is in reality a zero-knowledge proof that you know a secret signing key" #### ⏱️ [20:12](https://youtu.be/H8cRnw98q8k?t=1212) — [H2] Electronic voting applications - Key idea: Zero-knowledge proofs enable privacy-preserving vote validation - Evidence: "Prove that one of these votes, without saying which one, is encrypted in this ciphertext, so this should be counted" #### ⏱️ [24:30](https://youtu.be/H8cRnw98q8k?t=1470) — [H2] Anonymous transactions in Zcash - Key idea: Cryptocurrency transactions can be validated without revealing sender, receiver, or amount - Evidence: "Encrypt your transaction and prove that the sender have this amount available without disclosing who or how much" #### ⏱️ [27:45](https://youtu.be/H8cRnw98q8k?t=1665) — [H1] Anonymous credentials and EU digital identity wallet - Key idea: Digital credentials can prove properties without revealing underlying personal information - Evidence: "Instead of providing the passport, give a zero-knowledge proof that says my date of birth is earlier than one given value" #### ⏱️ [32:15](https://youtu.be/H8cRnw98q8k?t=1935) — [H3] Norwegian contact tracing implementation - Key idea: Real-world deployment used randomized tokens to disconnect identity from contact data - Evidence: "Randomize this token so it could not be tied to you while ensuring it was valid" #### ⏱️ [35:12](https://youtu.be/H8cRnw98q8k?t=2112) — [H2] Verifiable machine learning applications - Key idea: ML models can be trained and evaluated on encrypted data with proof of correctness - Evidence: "Prove without revealing your model that it was actually trained on this data, or evaluated correctly" #### ⏱️ [38:45](https://youtu.be/H8cRnw98q8k?t=2325) — [H1] Succinct arguments and ZK-SNARKs - Key idea: Proofs can be much smaller than the underlying computation or witness - Evidence: "Constant size proofs - no matter what you want to prove, the proof is 1 kilobyte always" #### ⏱️ [42:30](https://youtu.be/H8cRnw98q8k?t=2550) — [H2] Current standardization efforts - Key idea: NIST and industry consortiums working on standardizing zero-knowledge proof systems - Evidence: "NIST currently having a process to collect proof protocols and standardize them for secure implementation" #### ⏱️ [45:23](https://youtu.be/H8cRnw98q8k?t=2723) — [H3] Open source educational libraries - Key idea: Educational tools available for learning zero-knowledge proof development - Evidence: "Baby Snark written in Python specifically to learn about these systems, Aurora works used in Zcash" #### ⏱️ [47:15](https://youtu.be/H8cRnw98q8k?t=2835) — [H2] Integration with other privacy-enhancing technologies - Key idea: Zero-knowledge proofs work synergistically with homomorphic encryption and multi-party computation - Evidence: "Often used in combination where fully homomorphic encryption protects input data and zero-knowledge proofs prove integrity" ## 📚 References - [Goldwasser, Micali, Rackoff Paper on Interactive Proof Systems](https://people.csail.mit.edu/silvio/Selected%20Scientific%20Papers/Zero%20Knowledge/The_Knowledge_Complexity_of_Interactive_Proof_Systems.pdf) - [NIST Post-Quantum Cryptography Standardization](https://csrc.nist.gov/Projects/post-quantum-cryptography) - [Zcash Technical Documentation](https://z.cash/technology/) - [Baby Snark Educational Library](https://github.com/initc3/babySNARK) ## 🗣️ Paraphrase - Zero-knowledge proofs solve the fundamental tradeoff between data privacy and verification by allowing mathematical proof of statements without revealing underlying sensitive information - Real-world applications span from quantum-resistant digital signatures to anonymous voting systems and privacy-preserving machine learning verification - Standardization efforts by NIST and industry groups are making these advanced cryptographic techniques more accessible for practical deployment in identity systems and secure computation ## 📰 Newsletter 🔐 **Zero-Knowledge Proofs: The Future of Privacy-Preserving Verification** Imagine proving you're old enough to access a website without sharing your birth date, or verifying a financial transaction without revealing the amount. Zero-knowledge proofs make this possible by solving cryptography's age-old tradeoff between privacy and integrity. **What's New:** NIST is standardizing these techniques, with the first quantum-safe signature scheme (FIPS 204) already being a zero-knowledge proof. The EU digital identity wallet regulation will drive broader adoption. **Why It Matters:** From anonymous credentials to verifiable AI training, zero-knowledge proofs enable new models of digital trust where users control exactly what information they share. **Get Started:** Explore educational libraries like Baby Snark to understand the fundamentals, or investigate how these proofs could enhance your authentication and verification systems. Resources: [NIST Cryptography Standards](https://csrc.nist.gov/), [Zcash Documentation](https://z.cash/), [Privacy-Enhancing Technologies Guide](https://developer.mozilla.org/) ## ✅ Action Items #### DevRel - Developer education: Create workshops on zero-knowledge proof fundamentals and practical applications - Documentation: Develop integration guides for ZKP libraries in common development frameworks - Community engagement: Host cryptography meetups focused on privacy-preserving technologies #### OSPO - License compliance: Review open-source ZKP libraries for patent considerations and license compatibility - Security management: Establish guidelines for cryptographic library evaluation and adoption - Strategic alignment: Track standardization efforts at NIST and industry consortiums #### Community - Contributors: Support educational ZKP projects and improve documentation for learning resources - Maintainers: Consider privacy-preserving features using zero-knowledge proofs in existing projects - Ecosystem: Foster collaboration between cryptography researchers and application developers #### WordPress - Core: Investigate zero-knowledge proofs for privacy-preserving authentication and user verification - Security: Explore anonymous credential systems for user management without tracking - Privacy: Consider ZKP applications for GDPR compliance and data minimization - Accessibility: Ensure cryptographic interfaces remain usable for non-technical users ## 🧪 Hypotheses - Zero-knowledge proofs will become standard components in identity verification systems within 5 years as EU regulations drive adoption - Educational ZKP libraries will accelerate developer adoption by reducing the cryptographic knowledge barrier - Integration with existing authentication systems will be the primary driver for practical ZKP deployment - Performance improvements in proof generation will make real-time applications feasible for mobile devices ### 📊 Methodology - Analyze adoption rates of FIPS 204 ML-DSA in production systems over the next 2 years - Survey developer communities on cryptographic library preferences and learning barriers - Benchmark proof generation times across different hardware configurations and ZKP schemes ### ❓ Questions - How will ZKP standardization affect existing PKI infrastructure and certificate authorities? - What are the practical performance limits for real-time zero-knowledge proof verification on mobile devices? - How can ZKP education be integrated into computer science curricula without requiring advanced mathematics? ### 🔮 Future Research - Integration patterns between zero-knowledge proofs and existing web authentication standards - Usability studies on ZKP-based credential systems compared to traditional authentication - Cross-platform compatibility and interoperability standards for anonymous credential systems ### 💡 Implications - Practice: Developers need new skills in cryptographic protocol design and zero-knowledge proof implementation - Policy: Regulations like EU digital identity wallet will require ZKP integration in identity systems - Security: Zero-knowledge proofs provide new defense against data breaches and surveillance - Education: Cryptography education must balance theoretical foundations with practical application development - Funding: Investment in privacy-preserving technologies will increase as regulations and user demands grow ### 🧠 Learning Styles Assessment Reading level estimate: Graduate Level (16-18) #### 👀 Visual learners - Present: Mathematical notation and protocol diagrams throughout presentation - Improve: Interactive flow charts showing ZKP protocol steps, comparison tables of cryptographic primitives #### 🔊 Aural learners - Present: Technical lecture format with verbal explanations - Improve: Audio-only summary explaining core concepts, pronunciation guide for technical terms #### 🗣️ Verbal learners - Present: Clear definitions and real-world analogies (ballot box shuffling, passport verification) - Improve: Glossary of cryptographic terms, step-by-step protocol explanations #### 🧩 Kinesthetic learners - Present: References to open-source libraries for hands-on experimentation - Improve: Coding tutorials, interactive ZKP demonstrations, implementation exercises #### 🧠 Logical learners - Present: Mathematical proofs and security property definitions - Improve: Decision trees for choosing ZKP schemes, performance comparison charts #### 🧑‍🤝‍🧑 Social learners - Present: Q&A session and reference to community workshops - Improve: Discussion forums for ZKP applications, collaborative learning projects #### 🧘‍♀️ Solitary learners - Present: Technical paper references and self-directed library exploration - Improve: Self-assessment quizzes, independent research prompts #### 🌿 Naturalistic learners - Present: Real-world application examples across multiple domains - Improve: Use cases in environmental monitoring, ecosystem thinking about privacy technologies ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure and technical term definitions - Improve: Mathematical notation descriptions, diagram alt text for protocol flows #### Keyboard navigation - Present: Standard presentation format allows keyboard control - Improve: Interactive elements for code examples need keyboard accessibility #### Contrast and readability - Present: High contrast slides with clear typography - Improve: Ensure code examples maintain contrast ratios, larger font sizes for formulas #### Text resizing and reflow - Present: Presentation scales appropriately - Improve: Ensure mathematical notation remains readable at 200% zoom #### Media and captions - Present: Video includes spoken content - Improve: Captions for technical terms, transcript with mathematical notation #### Forms and interactions - Present: Minimal interactive elements - Improve: Accessible feedback for code examples and demonstrations #### Standards reference - Mathematical content accessibility follows MathML standards for screen readers ### 🌍 DEIB Assessment #### Cultural breadth - Present: Norwegian contact tracing example provides specific cultural context - Improve: Examples from diverse regulatory environments, global use cases #### Inclusive language - Present: Technical language with clear definitions - Improve: Gender-neutral examples, avoid assumptions about technical background #### Neurodiversity support - Present: Structured presentation with clear sections - Improve: Content warnings for complex mathematical sections, processing time considerations #### Representation - Present: References diverse application domains - Improve: Include perspectives from different stakeholder groups affected by privacy technologies #### Psychological safety - Present: Academic presentation encourages questions --- ## Full Transcript [00:06] Um so I'm going to talk about zero [00:08] knowledge proofs in this session. So [00:10] this is going to be a talk about [00:11] cryptography. [00:13] And kind of new crypto new new [00:15] cryptography. So today [00:18] we all use encryptions and signatures [00:20] and so forth in everyday applications to [00:23] ensure security and privacy. [00:25] But sometimes we want to have [00:28] applications where we care about both [00:30] the privacy of data on one hand, but [00:32] also to show that or to prove to the [00:35] world that it satisfies certain [00:38] properties or is well-formed or have [00:40] some kind of integrity [00:42] to it without revealing the data itself. [00:45] Okay, so it's kind of [00:47] um [00:48] a view into recent research development [00:51] that is coming and that might have some [00:53] interesting applications that you maybe [00:56] can use in your situations organizations [00:58] going forward. [01:00] So I'm going to talk a bit about what [01:01] kind of use cases, how this works, some [01:04] tools you can start playing around with [01:06] for maybe something interesting in the [01:08] future. [01:10] Uh first a few words about myself. I'm a [01:13] social professor at NTNU working in [01:16] cryptology [01:17] and I'm [01:18] leading the the lab we have at NTNU [01:20] working on these topics. [01:22] My own research is about quantum safe [01:25] cryptography that you might hear more [01:27] about tomorrow if you attend my [01:28] workshop. [01:30] Uh I'm also working on different pri- [01:32] privacy applications which is related to [01:34] this topic and also secure [01:36] implementation of these protocols. [01:39] Uh I'm also working part-time as a [01:41] cryptography expert at the startup [01:42] called Biometrics here in Oslo. [01:46] Okay, so as I mentioned we use [01:49] cryptography today and we can roughly [01:51] divide them into three categories. [01:55] So on the top left we have public key [01:57] encryption. [01:58] Okay, so you have some kind of public [02:00] key that is available to everyone in the [02:02] world. [02:03] You can use this key to encrypt the [02:05] message to generate ciphertext and this [02:09] can be sent over insecure channel to the [02:12] owner of the public key and they are the [02:14] only one who can decrypt. [02:17] So this is usually used for key transfer [02:20] today where you want to talk to someone, [02:22] you generate a key and then you send [02:25] this to the recipient and then you can [02:27] use this shared key to communicate [02:29] further. [02:30] So that's the [02:32] middle on the right where you have a [02:33] symmetric key scheme, for example AES, [02:36] where you have a shared key and you want [02:39] to send some application data, some [02:41] messages and you use this to encrypt it. [02:44] Okay, and you can do this because you [02:46] already have the shared key using the [02:49] public key encryption scheme first. [02:51] Yeah, so this is often how it works in [02:53] TLS and Signal and most applications [02:55] today. [02:57] Um so this gives you confidentiality. [03:01] Yeah, you protect the the data itself. [03:04] Um but sometimes we want to know that no [03:06] one messed with our ciphertext or [03:09] changed it or replaced it or [03:12] and also that we know where the data is [03:14] coming from. [03:15] So then we need the primitive on the [03:17] bottom left which is a digital [03:18] signature. [03:20] So there you have some kind of message. [03:21] It could this could be a software [03:23] update, it could be the ciphertext that [03:25] you just sent or something else. [03:28] You hash this down to a fixed size [03:30] string and then you sign this using a [03:33] private signing key. [03:34] Yeah, and there is a public verification [03:37] key that everyone knows and they can [03:39] check that the signature is valid and [03:41] then you are certain that the data that [03:43] you received [03:44] has integrity, so it didn't change and [03:47] you know where it came from because [03:49] there was only one person who could sign [03:51] this. [03:52] Okay, so these are the three most common [03:54] priv- primitives we have available today [03:56] for [03:57] secure communication. [04:00] And there's so many applications that [04:02] use these under the hood and you [04:04] probably either have used or [04:07] know of most of these, but secure [04:09] messaging is [04:11] is a very common application. [04:13] A lot of people use Signal or WhatsApp [04:15] or iMessage for for communicating. [04:18] You have secure connections to websites, [04:20] servers and so forth using TLS or SSL [04:24] SSH or IPsec. [04:26] You have digital authentication. A lot [04:28] of uh uh the community is kind of [04:31] switching over to FIDO for secure [04:33] authentication instead of passwords. We [04:36] have BankID and other services in Norway [04:38] where you want can use this to log in to [04:41] government services and other things. [04:44] And as well as different payment [04:46] systems. Okay, so this is kind of the [04:48] most common things. [04:50] Um but then a natural follow-up question [04:52] is what else is out there? What can we [04:55] do? What kind of research and [04:57] development have taken place and is kind [04:59] of ready-ish for new applications to be [05:03] deployed. [05:05] So we're going to talk about some of [05:06] them [05:08] and you often have this kind of [05:11] relationship between privacy and [05:12] integrity where it seems hard or [05:14] impossible to achieve both at the same [05:17] time. [05:18] So often you have users who have some [05:20] kind of private sensitive information. [05:24] It could be their identity if they have [05:26] authentication platform, it could be a [05:28] vote in a voting system, it could be a [05:31] transaction [05:33] and so forth. So you might have some [05:35] sensitive or private data that you want [05:37] to keep secret from others. [05:40] But you sometimes still want to maybe [05:43] apply this kind of data in some machine [05:46] learning algorithm or to authenticate [05:49] yourself to some server [05:51] and you want to then on the server side [05:54] know that this information is valid, [05:56] it's correct, it's something you can [05:57] trust. [05:59] Okay, so the class gives classical [06:01] example there would be the newly [06:04] discussion about age verification. [06:07] Yeah, so then if you want to log in to [06:09] some system, you need to be say 18 years [06:11] old to access it [06:13] and the server need to know this because [06:15] otherwise they might be penalized or [06:17] fined or something. [06:19] Yeah. [06:20] And the way they do it is often by [06:22] asking you to [06:23] to give over like a passport or identity [06:26] card or something [06:28] which is not just saying that you're [06:30] more than 18 years old, it's also saying [06:32] a lot about you. It might be your birth [06:34] date of birth, it might be your address, [06:37] a lot of sensitive information. Okay, [06:39] and this we don't really want to share [06:41] and it's not really what's asked about. [06:44] We only need this binary value saying if [06:47] you're below or above 18 years old. [06:50] Yeah, then we're not really asking for [06:52] your whole identity, but that's the only [06:53] solution we have for it now. [06:55] So this is a problem that we would like [06:57] to solve where we want to kind of [06:59] achieve some form of data sharing [07:01] without breaking the privacy for the [07:03] user side and also still ensure [07:06] integrity on the server side. [07:08] Yeah. [07:10] So the solution to this is zero [07:12] [clears throat] knowledge proofs. So [07:14] we're going to talk about what these [07:15] what these proofs are and what kind of [07:18] application we can or are already using [07:21] them. [07:24] So when we think about proofs, we [07:27] kind of the first thing that comes to [07:28] mind usually is some kind of [07:30] mathematical proof. You want to ensure [07:32] that some statement is correct. Yeah. [07:35] So you present that well, this is kind [07:38] of the area in this square and so forth [07:40] have some certain relations. So this is [07:43] the Pythagorean theorem. [07:46] Uh and you can kind of prove that this [07:49] figure on the left is equivalent to the [07:51] figure on the right by kind of measuring [07:54] and and swapping pieces and then you can [07:56] convince someone that this statement [07:58] holds. [08:00] Yeah. [08:01] And this is a quite simple this we can [08:03] draw. [08:04] But we also have a lot of more [08:05] complicated statements. For example, [08:08] Fermat's theorem [08:10] where you have this famous equation that [08:11] for some integer X and integer Y and Z, [08:16] this relation does not hold if the [08:18] exponent N is larger than two. [08:22] And we were able to prove this or or [08:24] Andrew Wiles in this photo was able to [08:25] prove this [08:27] some 20 years ago. Yeah. But the proof [08:30] of this statement is so difficult that [08:33] just a handful of people in the world [08:35] can understand it. [08:38] So we kind of we are convinced about [08:40] this truth [08:42] by proxy because we have someone else [08:44] kind of verifying on our behalf that [08:46] this statement is true. [08:48] Yeah. [08:50] Um so [08:52] also in mathematical proofs we kind of [08:54] we write it down. Yeah, there is no [08:56] really private information. It's more [08:58] about you have some statement or or [09:01] something that you claim [09:02] and then the witness or the proof of [09:05] this is by describing, you know, why [09:07] this is true or giving some information [09:11] that you can check that the statement [09:13] holds. [09:16] But in zero knowledge proofs, [09:18] um [09:19] this is also some kind of [09:21] say interactive protocol between two [09:23] parties. You have a prover and a [09:24] verifier [09:26] and you want to convince the verifier as [09:29] a prover that some given statement is [09:31] true. [09:33] Yeah, and you are allowed to communicate [09:35] back and forth. [09:36] Maybe two messages, maybe more. [09:38] And at the end the verifier should be [09:41] convinced [09:42] that the statement hold. [09:45] Yeah, not necessarily by you providing [09:47] the sensitive information that obviously [09:51] shows that this hold, but [09:53] through this communication they should [09:55] be convinced of this claim. [09:59] And for these kind of protocols, we have [10:01] three properties. [10:04] So, the prover publish some statement or [10:08] some claim. [10:09] And we're going to talk about more like [10:11] what kind of concrete claims can be [10:13] made. [10:14] And they keep a secret witness, which [10:17] kind of shows that the claim holds. [10:21] And for this communication or for this [10:23] protocol, [10:24] we want it to be correct. So, if the [10:27] prover actually holds a valid witness, [10:31] say if you have a passport that says you [10:33] are more than 18 years old, [10:36] then you if you follow this protocol, [10:38] then the verifier should accept it in [10:40] the end. [10:42] Yeah? So, you can have some [10:44] pre-kind of described communication. If [10:47] you follow this plan, then you will end [10:50] up with the verifier accepting if you [10:52] hold the witness. [10:55] So, that's a correctness statement. [10:57] And then we have something we call [10:58] soundness, [11:00] which is essentially means it should be [11:01] difficult or basically impossible to [11:04] cheat. [11:05] So, if you don't have this witness, say [11:08] if your passport actually says you are [11:10] below 18, [11:12] you should not be able to convince the [11:13] verifier that you are above. [11:16] Yeah? You should not be able to [11:18] uh convince someone of a false [11:21] statement. [11:22] So, that's the the soundness. [11:25] And finally, in the end of this is the [11:26] privacy property of this uh protocols is [11:29] the zero-knowledge protocol. Yeah? Or [11:32] the zero-knowledge property. [11:34] And this says that if you complete this [11:37] protocol by communicating back and [11:39] forth, [11:40] the verifier is convinced that the [11:43] statement is true, [11:45] but it doesn't learn anything whatsoever [11:48] about the witness that [11:51] proves that it's true. [11:53] So, for example, they they are convinced [11:56] that you are above 18 years old, but [11:58] they don't learn anything about your [12:00] passport. [12:02] Yeah? Only this binary value saying yes, [12:04] you are above. [12:06] Yeah? And nothing else. And this is [12:08] often what we want. We often give a lot [12:11] of extra information [12:12] to convince someone about something, [12:15] which is much more than what they [12:17] actually need [12:18] and what we often would like to provide. [12:22] Yeah? So, this says [12:24] we can design these protocols where this [12:26] information, this bit, [12:28] is the only thing that the verifier [12:30] learns, and that was the goal of the [12:32] protocol, and everything else is still [12:34] secret. [12:37] And this was actually introduced [12:40] uh quite some years ago. So, Goldwasser, [12:42] Micali, and Rackoff published a paper [12:44] about these proof systems in the mid-80s [12:48] and have later won uh [12:51] uh Gödel Prize for this, which is kind [12:53] of like the Abel Prize or or the uh [12:56] Nobel Prize, but in uh theoretical [12:58] computer science. [13:00] So, this kind of laid the foundation for [13:02] achieving these things, but they're [13:04] quite theoretical, abstract, and have [13:07] been without clear use cases for a long [13:09] time. So, we kind of [13:11] we're finally there where we have a lot [13:13] of interesting use cases and [13:14] implementations and applications where [13:17] these might make sense to you start [13:18] being used today. So, that's what I [13:21] want to talk about today and why I I [13:23] kind of submitted this topic because [13:24] it's something out there that is very [13:26] interesting that very few people know [13:29] anything about, and it might open a few [13:31] doors going forward. Yeah? So, let's [13:34] talk about some of these opportunities. [13:38] Well, okay. One final thing about uh [13:40] these proofs is that [13:42] well, [13:43] I draw the picture of a zero-knowledge [13:46] proof where you have a protocol with two [13:48] parties talking. Yeah? [13:50] And [13:52] we might have a protocol that is [13:54] interactive where you're actually [13:55] sending [13:56] messages back and forth, maybe several [13:58] rounds, [13:59] but you could [14:01] uh do it in a non-interactive way as [14:03] well where you just write down this [14:05] zero-knowledge proof once and for all [14:06] and send it. [14:08] But in general, you might have an [14:09] interactive protocol [14:11] where in the mathematical proof, you you [14:13] do always write down, you know, all the [14:15] details about why this is true. [14:18] For soundness, [14:20] um [14:21] well, in a mathematical proof, we would [14:23] like it to just always be true. Like [14:25] either the proof is true and everyone [14:28] can accept it, or it's false and no one [14:30] does. [14:31] In zero-knowledge proofs, we do allow [14:34] for small cheating probability, [14:37] but you can usually control how likely [14:40] it should be to cheat, and you can uh [14:43] basically say that this is, you know, as [14:45] hard to cheat in this protocol as [14:48] breaking AES or breaking the RSA scheme [14:50] that we use in other cryptographic [14:52] protocols. Okay? So, it's not [14:54] impossible. [14:55] It's just as hard as breaking [14:57] cryptography in general. [14:59] And one interesting thing that I'll also [15:01] bring up closer to the end is that [15:05] if you have a mathematical proof, [15:07] you need to describe everything. [15:10] Yeah? You need to be able to follow it [15:11] step by step and understand why this is [15:13] true, and the proof might be very long. [15:18] But in zero-knowledge proofs, you can [15:19] sometimes have proofs, [15:22] you know, in in terms of, you know, byte [15:24] that you're sending, [15:25] that is much smaller than the witness [15:29] for your statement. [15:31] Okay? So, you're actually saving space [15:33] by producing this proof, [15:35] not only giving privacy. [15:38] Yeah. [15:39] So, we'll get back to that. [15:42] Um okay. So, let's talk a bit about [15:44] potential applications of zero-knowledge [15:46] proofs. So, this is something that, you [15:48] know, is already deployed and is out [15:50] there, and you might have uh [15:52] other related applications in mind for, [15:55] you know, your own situation. [15:58] So, one thing is actually quantum-safe [16:01] signatures. [16:03] So, um as you might be aware, we are [16:06] currently transmission or um migrating [16:10] to [16:11] uh from normal digital signatures that I [16:13] mentioned in the start based on [16:15] factoring and discrete log assumptions, [16:17] for example, using the RSA scheme or [16:19] ECDSA. [16:21] These are the most two common digital [16:22] signature schemes today. [16:24] They are not secure against quantum [16:26] computers, [16:28] so we need to replace them with [16:29] something that is. [16:31] And one way to build such uh signature [16:34] schemes is essentially by using or [16:37] building a zero-knowledge proof [16:40] of uh know- that I know a secret signing [16:43] key that corresponds to this public [16:46] signing key. [16:48] And the first standard that we have [16:50] available, FIPS 204, [16:53] which is the ML-DSA [16:56] signature scheme based on lattices, [16:58] this is in reality a zero-knowledge [17:00] proof [17:01] of know- that you know a secret signing [17:04] key, [17:05] um which is uh [17:07] now standardized as a digital signature [17:09] scheme. Okay? [17:11] So, [17:12] um what you can have is this protocol. [17:16] So, I'm not going to go into detail of [17:17] it, but if you're interested, I'm going [17:19] to talk more about this tomorrow. [17:22] But essentially, [17:23] uh you have two vectors [17:26] that are secret and are all the [17:28] coefficients in these vectors are small. [17:31] Think binary. [17:33] And then you have a public matrix, [17:35] and you compute the product between [17:38] these vectors and this public matrix, [17:40] and that's your public signing key. [17:43] And then you're able to sign a message [17:45] by sampling some randomness. So, the [17:47] prover is sampling some other vectors [17:49] and compute matrix vector plus vector [17:52] product. [17:54] Okay? [17:55] It's sent to to the verifier. It gets [17:57] some kind of challenge, which is just a [17:59] random value to kind of challenge the [18:01] prover, [18:02] and then the prover answer with [18:04] something that is related to the [18:06] randomness, the challenge, and the [18:07] secret. [18:09] Yeah? Again, I'm not going to go into [18:11] details, and this is also how discrete [18:14] log [18:15] signature schemes works today. [18:17] Uh and then there is a response in the [18:19] end. There's some back and forth. Yeah? [18:21] That's the goal. And then you check if [18:23] the [18:24] um some equation is verified in the end. [18:28] Yeah? If this equation is verified, then [18:31] you accept this proof. [18:33] If not, you reject it. [18:36] And the goal here is that you are only [18:38] able to produce a valid proof if you [18:41] know these secret vectors S1 and S2. [18:44] If not, you're not able to convince [18:46] anyone about this. [18:48] And we can trans- transfer this into a [18:51] signature scheme by instead of having a [18:54] verifier that sends something back, you [18:56] hash [18:58] everything you would send in the first [18:59] message together with the the message [19:02] that you want to sign. So, this W value [19:05] and the message is being hashed, [19:07] and then you respond with both this hash [19:11] and the response in the last message. [19:14] Okay? And then you have a signature [19:16] scheme, which is only one message [19:18] instead of back and forth, and it's tied [19:20] to a message that you want to sign, for [19:23] example, a code update or a ciphertext [19:26] or something else. [19:27] Yeah? [19:28] So, we can create digital signatures [19:31] from zero-knowledge proofs [19:34] where the statement is I know a secret [19:36] key that corresponds to this public key. [19:40] So, this is actually the most common way [19:43] today to design signature schemes. [19:46] So, this new standard is already in [19:47] application kind of uh under the hood of [19:51] zero knowledge proofs. [19:55] >> [snorts] [19:55] >> Another application is electronic [19:57] voting. [19:58] So, we don't do that in Norway, but a [20:00] lot of other countries have elections [20:02] where you are able to vote from your own [20:05] computer. [20:07] And then we need to know that whenever a [20:10] vote is submitted, that this is correct. [20:14] So, for example, if you [20:18] provide a ciphertext into the voting [20:20] system, [20:21] you need to prove that this is a valid [20:24] vote. [20:26] And then you can use a zero knowledge [20:28] proof saying that here is a ciphertext, [20:32] and here is the list of all possible [20:34] valid votes, [20:36] and you prove that one of these votes, [20:39] without saying which one, [20:41] is encrypted in this ciphertext, so this [20:44] should be counted. [20:47] And then you protect the privacy of the [20:49] user because you don't reveal what this [20:51] specific user voted for, [20:54] while this voting system can be sure [20:56] that this is actually a valid vote, so [20:59] that it's well-formed and it can be [21:00] counted later on. [21:04] Um often we shuffle votes in a voting [21:06] system, so think of the physical ballot [21:09] box, if you, you know, shake it a bit [21:12] to make sure that the order of votes are [21:14] when you pick it up is different from [21:16] the order when it went in, so that you [21:18] cannot make the connection between who [21:20] voted and their vote. [21:23] And we have a digital way of doing this [21:24] as well, where you have a bunch of [21:26] ciphertexts, [21:27] and then you re-randomize them [21:29] essentially by adding an encryption of [21:31] zero to it, [21:32] and then the ciphertext looks different, [21:34] but it's still encrypting the same [21:36] value. [21:37] And then you permute them. [21:39] Yeah? [21:40] And if you do this, we want to ensure [21:43] that no one swapped a vote with [21:44] something else, so then you also need a [21:46] zero knowledge proof, [21:48] which says, I re-randomized them in an [21:51] honest way, and I permuted them, and I [21:53] did not uh replace any of the votes. [21:57] Yeah? Then you get privacy of the [21:59] permutation and the re-randomization, [22:02] and you get integrity of the [22:04] permutation. [22:05] Then everyone else can trust that this [22:08] is still the same voting set. [22:11] And finally, you need to decrypt it, [22:14] and of course, you don't want to give [22:16] out your decryption key to the world. [22:19] Yeah? So, what you do is you decrypt all [22:21] of the ciphertext, and then you prove [22:23] that I used the correct decryption key [22:27] to decrypt all of these ciphertexts, and [22:30] then you can look at the votes yourself [22:31] and count it in the election. [22:34] Okay? So, this is a very important [22:36] building block to ensure both privacy [22:39] and integrity in electronic [22:41] voting systems. [22:44] Yeah. [22:47] Another application is anonymous [22:49] transactions. [22:51] So, for example, you want to pay [22:53] someone, but you don't want anyone else [22:55] to know [22:56] how much you paid or which account it [23:00] went from and which account it went to. [23:03] And this is for example possible in one [23:05] of the cryptocurrencies called Zcash. [23:09] So, what you do is [23:11] you encrypt your transaction, [23:13] the sender, the receiver, and the [23:15] amount, [23:17] and then you prove that [23:19] uh [23:20] the sender, whoever that is, [23:22] have this amount that is not disclosed [23:25] available in their account. [23:28] So, this is a valid transaction, you [23:30] actually do have the funds that you [23:32] you're trying to send. [23:34] And [23:35] uh you prove that these funds are not [23:37] spent, you know, otherwise. [23:40] Okay? So, you want to make sure that [23:41] this is a valid transaction, you're not [23:44] creating money out of thin air, [23:46] you're actually using money that you [23:48] own, and you're sending it to someone [23:50] else. [23:51] Yeah? So, then you get privacy of the [23:53] transaction, but you do get integrity in [23:56] the payment system. [24:03] Uh so, this is how this could be done. [24:04] So, you have this red box, which is like [24:07] all transactions in the network, [24:10] all the addresses, and so forth. [24:13] And then you can have a top layer, which [24:16] then encrypt the transaction, [24:19] prove something about it with respect to [24:21] the public ledger. You might have other [24:23] properties you want to prove as well, [24:25] for example, that this satisfies some [24:28] regulations or something like this. [24:31] And then you can get the both shielded [24:33] address, shield for sending, for [24:36] recipient, and for the amount being [24:38] sent. [24:40] And this is actually implemented and [24:42] used today. [24:45] Okay? And um [24:48] another interesting application, and [24:50] this is was kind of my motivating [24:52] example to begin with, [24:54] uh we want to have what we call [24:56] anonymous credentials. [24:59] Yeah? And one regulation that is coming [25:02] is the EU digital identity wallet, [25:05] where we have a digital wallet [25:08] containing information about us. [25:10] It could be connected to funds or tokens [25:13] in some way, but it's also about our [25:15] identity and properties about us, like [25:19] where we live, nationality, [25:22] um [25:23] date of birth, and so forth. Things [25:25] information about us that might be uh [25:28] you know, interesting to prove something [25:31] about or to show to get access to [25:33] certain applications. [25:36] So, for example, in this setting, you [25:38] would have some issuer, [25:41] which might be the, you know, a passport [25:43] department, uh which in Norway would be [25:45] the police. [25:47] You have some kind of training program, [25:49] university, other public services, like [25:51] your driving license, and so forth, [25:54] um which can issue some credentials on [25:57] your behalf. [25:59] Yeah? So, they need to know who you are, [26:02] but that doesn't mean that they should [26:03] know [26:04] anything about how you use your [26:06] credential. Yeah? That's your business. [26:08] So, you ask for this, you get the [26:11] credential, [26:12] and you hold it. [26:14] And then you might have a lot of [26:16] services that you want to access, [26:19] uh either related to online shopping, [26:21] some bank services, some login, some [26:24] availability, [26:26] some kind of age verification, you know, [26:28] there's a bunch of things where you [26:29] would [26:30] usually provide a copy of your passport [26:33] or similar to get access to, [26:35] where they don't really need all of this [26:37] information. They just need to know that [26:39] you satisfy certain criteria to get [26:42] access to some given resource. [26:45] And then this credential holder can [26:48] then, instead of providing the passport, [26:51] you can give a zero knowledge proof. [26:54] So, this could be, for example, [26:56] I hold a passport, [26:58] which is signed by the Norwegian police, [27:01] that says my [27:03] date of birth is earlier than one given [27:07] value that says I'm above 18 years old. [27:11] Yeah? So, then the verifier learns that [27:14] you are [27:15] meeting the threshold [27:17] without learning anything else about [27:19] you. [27:20] So, we can control what kind of [27:23] information we release. We don't need to [27:26] give it all. [27:29] Uh this was actually in a simplified [27:32] version implemented in the Norwegian [27:34] contact tracing app during the pandemic, [27:37] where we wanted to have a disconnection [27:40] between um [27:43] uh [27:44] the owner of the app, which then [27:47] collected where they had [27:50] who they had met, [27:52] and when they were uploading data to a [27:55] back-end service for notifying the [27:57] people they have met in case of a [27:59] positive test. [28:01] Yeah? So, we thought this was a [28:02] important privacy uh issue that we need [28:05] to solve. We did not want to tie [28:07] everyone to everyone they had met. [28:11] Uh so, then we had an app, which uh [28:14] logged into some verification service. [28:17] So, in this in Norway, this was a [28:19] service that have on a national level [28:21] overview of all positive corona tests. [28:25] And if you had a positive test, you [28:28] would get some token [28:30] um that is a kind of a certificate on [28:34] that the test is positive. So, this was [28:36] important so that no one could, say, [28:39] spam the system by sending warnings to [28:42] people who had not really been in touch [28:44] with someone who tested positive. Yeah? [28:47] So, we wanted to avoid that, so we [28:48] needed some kind of verification. [28:51] But then you would later upload what we [28:53] call these contact tracing keys, which [28:55] are keys that you um [28:58] you negotiated or exchanged with [29:00] everyone that you you were nearby. [29:03] So, you would have some kind of value [29:05] that you could share to a back-end [29:07] service, [29:08] and this service could [29:10] check the certificate you got from the [29:12] verification service, and then warn all [29:14] of the users. [29:16] And basically, by sharing these keys, [29:19] and then you could check locally, do I [29:21] have a copy of this key? [29:22] If yes, then I have been nearby this [29:25] user. If not, I'm okay. [29:29] But what we did then was to randomize [29:32] this token. [29:33] So, this app, it could receive a valid [29:35] signature or a certificate, [29:38] and it could randomize it, but only [29:40] once. [29:42] Yeah? So, you could create one new valid [29:45] token [29:47] when you received this certificate. [29:50] And this token was unlinkable [29:54] to the signature of the certificate that [29:56] you received. [29:57] So you [29:58] one, you knew that it was valid. [30:01] Second, it could not be tied to you. [30:05] And then we had also to use zero [30:07] knowledge proofs to [30:09] prove that, you know, this was a valid [30:11] token and it was signed properly and so [30:14] forth. And this ensured that we could [30:16] get both privacy and integrity in the [30:18] Norwegian contact tracing system. [30:21] So this was a one-time token, but on the [30:24] previous slide, if you have general [30:26] anonymous credentials, [30:28] you could even [30:30] log in to the same service many times [30:33] and always provide proof saying I'm a [30:36] valid user [30:38] without these proofs being linkable. [30:41] Yeah, so you even if you log in to the [30:43] same service 10 times, for the service [30:45] side, it looks like 10 different people [30:48] that are allowed to use this service are [30:51] logging in. [30:52] They cannot tie it to one user. [30:57] Um another interesting application is [31:00] verifiable machine learning. [31:02] So today we are using, you know, more [31:05] and more services are looking into how [31:07] can we learn something from a lot of [31:09] data by using machine learning. [31:11] And then either you need to train it [31:15] and create your model [31:18] or you have a model and you want to [31:20] evaluate something to get the result. [31:23] Yeah? And often the data being involved [31:26] might or be sensitive. For example, if [31:29] we want to [31:30] either train or evaluate health data. [31:34] Yeah? Then we need to care about the [31:35] privacy of the patients and so forth. [31:39] So what we often do is that we have some [31:42] service and you want to know that the [31:44] input data to this service [31:47] is valid. [31:48] Um but often this input data is private, [31:51] so you don't really want to share it [31:52] with, say, Google or some other service. [31:56] While Google or this other service, they [31:59] own the machine learning model and [32:01] that's their IP and they don't [32:03] necessarily want to share their model [32:05] because that's how they make money. [32:07] So you have kind of still have this [32:09] privacy integrity [32:11] challenge where you want to ensure that [32:13] everything was being it was done [32:15] correctly, [32:16] but you still want to both keep the data [32:18] from the service and the model from the [32:21] client. [32:24] So what you could do, for example, is [32:26] that if you have a machine learning [32:28] model, [32:29] you want to convince the world that this [32:32] is trained on specific data so that you [32:34] know that this model is something you [32:36] can use, that it's trained on, you know, [32:39] relevant data. [32:41] Then you can prove without [32:44] um [32:45] revealing your model, you can prove that [32:47] it was actually trained on this data. [32:50] Or you could prove that this model that [32:53] you have, [32:54] this is [32:56] um [32:56] uh evaluated on a specific set of data. [33:00] So it's not garbage that is coming back. [33:02] You actually used your model and that's [33:05] the service that you get paid for. Yeah? [33:07] And this data that you get in could [33:09] potentially even be encrypted so that [33:12] you never actually see the data you are [33:15] either training on or evaluating, [33:17] but you prove that you did it correctly [33:19] without revealing what you did. [33:24] So this these are quite interesting [33:26] applications nowadays because [33:29] for now you basically need to trust [33:31] the the service that are involved in [33:34] either the training or the evaluation of [33:36] the the data. [33:39] Um furthermore, we have what we call [33:42] succinct arguments. So there's a kind of [33:45] a special class of zero knowledge proofs [33:47] which are designed to be specifically [33:50] efficient. [33:52] So this [33:53] this kind of acronym of CK Snark means [33:57] zero knowledge succinct non-interactive [34:00] argument of knowledge where the zero [34:02] knowledge part is what we have talked [34:03] about so far, that you have some secret [34:06] witness that does not leak when you [34:07] produce the proof. [34:10] Then we have the succinctness part which [34:12] means that the proof is very [34:14] fast to verify and very small to send. [34:18] It's non-interactive so you don't need [34:20] this communication back and forth. You [34:22] could just publish the proof online once [34:24] and for all and everyone can verify it. [34:28] And the last two about argument of [34:30] knowledge just means that you you know [34:32] the witness. So it's more like a fancy [34:33] acronym for that. [34:36] And in this case, [34:38] we would like to produce proofs that are [34:40] much smaller than the secret itself. [34:45] So for example, um if you're outsourcing [34:48] some computation, say a machine learning [34:50] model, this might be very computational [34:54] intensive to evaluate. [34:56] Right? We often need computing clusters [34:58] to do this. [34:59] And if [35:01] checking the proof was as intensive as [35:06] doing the whole training yourself, [35:09] this is not something that people in [35:11] general could verify because they don't [35:13] have the resources. [35:15] Or it could be some large complicated [35:17] statement. It could be a [35:19] transaction. It could be some uh [35:22] relation in a voting system. [35:24] It's a lot of data. It might not be [35:26] possible for everyone to validate it. [35:29] And then you would like the proof that [35:31] you check to be much much smaller than [35:34] if you knew everything about the system. [35:37] So often we talk about these proofs [35:39] being very small either logarithmic so [35:42] that it's very small but it does [35:45] increase a bit if the whole system [35:47] increases [35:48] or even constant. And we do have proof [35:51] systems that are constant size which [35:53] means no matter what you want to prove [35:56] in the world, [35:57] the proof is 1 kilobyte. [35:59] Okay, it could be very simple like I [36:01] know the secret key or it could be, you [36:04] know, a very complicated large statement [36:06] about some machine learning model or [36:08] whatever. So no matter what you want to [36:10] prove, [36:12] the proof size is 1 kilobyte [36:14] always. [36:16] And verification has to be much faster. [36:19] So this could be, you know, milliseconds [36:20] even if the proof took hours to produce. [36:24] Um the downside of it, of course, is [36:27] that we're kind of shifting the effort [36:29] to the prover's side. So those who want [36:31] to prove something complicated also need [36:34] to spend more time and and memory of [36:36] actually producing the proof. [36:39] But this means you could have a powerful [36:40] server [36:41] proving some interesting statement while [36:44] you could have a mobile client verify it [36:47] afterwards and the whole system is [36:49] something that they would never even fit [36:51] on their mobile device. [36:52] But they can still verify that something [36:54] was done correctly. [36:56] So this is a interesting kind of [36:59] special [37:01] kind of proof systems that is also [37:02] possible even though at least my [37:05] intuition says that this should this [37:07] should not be possible. [37:08] But we can actually do this. [37:12] Um so where are we today? [37:15] Well, so this has been kind of an [37:17] ongoing research effort for many many [37:19] years and we do have all kind of systems [37:21] out there and I showed you some [37:22] examples. [37:24] Um there is some standardization effort [37:26] now to kind of make this available for [37:29] others so that you can kind of [37:31] use this throughout systems and you know [37:33] what to use in certain applications and [37:35] so forth. [37:37] And NIST is currently having a a process [37:40] about this to kind of collect um proof [37:44] protocols [37:46] and uh try to generalize them and [37:49] standardize them so that we know exactly [37:51] how to implement it in a secure way for [37:53] certain applications. So this is ongoing [37:55] right now. [37:57] There's also some more like industry [37:59] consortium [38:00] which are looking into it for their own [38:02] applications [38:03] um like the CK proof community. There's [38:06] the Ethereum Foundation for the [38:08] blockchain [38:09] applications and so forth. So these are [38:11] kind of all trying to write up [38:14] standards or standard-like documents so [38:17] that [38:18] things are consistent across systems. [38:22] Um but in general there's there's not, [38:25] you know, something ready yet and it's [38:27] kind of a ad hoc as far as we know. [38:31] So this is I think we'll see a lot of [38:33] progress here in the coming years [38:35] especially when the EU wallet regulation [38:38] is is final, then they also will have to [38:41] somehow standardize [38:43] what kind of proof systems you are [38:46] supposed to use for the anonymous [38:48] credential situation. [38:52] So this is coming and it's kind of an [38:53] opportunity now to to get a bit ahead of [38:55] it and see where this can be useful for [38:57] your your work. [39:00] Uh there is a bunch of open source [39:03] libraries out there. [39:05] You will find a lot of the things that [39:07] are actually in [39:09] uh in deployment today. [39:12] Uh [39:13] but they are quite complicated. [39:15] So I tried to find some [39:18] libraries that are open source and [39:20] designed for education purposes. So not [39:23] really for production systems, but to [39:25] kind of play a bit with to get some [39:28] hands-on experience with what these [39:30] proof systems can do and not and how to [39:32] use them. [39:33] Um [39:34] and then there's, yeah, these ones like [39:37] Baby Snark which is written in Python [39:39] specifically to to learn about these [39:41] systems. [39:42] You have Aurora works for example that [39:44] is also used in Zcash among other [39:47] systems, but it's kind of high level and [39:49] should be possible to do something [39:51] interesting without too much effort. [39:54] But in general here are four projects [39:56] and there are more online if you search [39:58] for it or maybe you have a certain [39:59] application in mind you will you might [40:01] find something that fits you. [40:04] But in general all of these systems that [40:06] we [40:07] developed they usually open source. [40:10] So this [snorts] is something that you [40:12] you can look into if you [40:13] if you're interested. [40:15] Um [40:17] and finally I want to say a few words [40:19] about the larger context. [40:21] So zero knowledge proofs is one out of [40:24] several [40:25] privacy enhancing cryptography [40:27] techniques that we have developed over [40:29] the last say 30 years. [40:31] Um so here you can prove things right [40:34] without revealing the secret itself. [40:37] You have other other techniques that are [40:39] also being developed. [40:41] Uh one is fully homomorphic encryption. [40:44] This means that you can encrypt your [40:46] data [40:48] but you can apply functions to the [40:50] cipher text as you would do with the [40:51] data itself. [40:54] Yeah, in general you cannot do this. [40:56] Yeah, so if you have a yes cipher text [40:59] if you flip one bit [41:01] the cipher text is useless. [41:04] Yeah, but you do have systems [41:06] that are built so that if you want to [41:09] compute additions or multiplications or [41:11] other functionalities [41:13] on the data you can actually do it [41:15] directly on the cipher text and the [41:17] function translates to doing this [41:19] function to do this this operation on [41:22] the underlying message. [41:24] So then you can do outsourcing for [41:26] example if you have health data you [41:29] might encrypt everything you can send it [41:31] encrypted to some service that have a [41:33] machine learning algorithm. [41:35] They can evaluate this algorithm on the [41:37] encrypted data [41:39] and you get the result back you can [41:40] decrypt it with only the result. [41:43] And they didn't learn anything about [41:44] your data. [41:47] Of course then this can be [41:49] um [41:50] can be used in uh [41:53] uh both with zero knowledge proofs and [41:55] fully homomorphic encryption so that you [41:57] keep the privacy of all the data while [41:59] it's being computed and you can prove [42:01] that you evaluated the machine learning [42:03] algorithm on the cipher texts. [42:07] So these are often used in combination [42:08] where the fully homomorphic encryption [42:11] protects the input data [42:13] and the zero knowledge proofs [42:15] uh prove that [42:17] the integrity of the process is uh [42:20] is satisfied and also protect the [42:22] machine learning algorithm. [42:26] Another application is or technique is [42:28] multi-party computation. [42:31] In the previous one with fully [42:32] homomorphic encryption you usually have [42:34] two parties. So it's one is kind of the [42:36] data owner and one is doing the [42:37] computation. [42:39] But often you have multiple parties who [42:41] would like to jointly compute some [42:43] function. [42:45] This could be that you all have say [42:47] salary statistics for your company. [42:50] You don't want to share those with [42:52] others, but you would like to generate [42:55] statistics among all of you. [42:58] And then you can without revealing the [43:00] input data to the other parties you can [43:03] all generate some statistics about the [43:06] joint data. [43:09] Again you are often using zero knowledge [43:11] proofs in these systems to ensure that [43:13] everyone is behaving [43:15] honestly in the process. [43:18] So again these are kind of [43:19] techniques that are also go well [43:21] together. [43:25] And that was what I had for today. So [43:28] thank you and I'm happy to take your [43:30] questions. [43:38] Anyone? [43:45] No? [43:46] That's fine. [43:47] If you have anyone [43:48] or want to talk to me I'm still around [43:50] and otherwise I hope to see some of you [43:52] also tomorrow for the sessions about [43:54] quantum safe cryptography. [43:56] So let's end here.  📄 **Full text:** ![[Full Document Contents/Articles/Zero-Knowledge Proofs Simultaneously Ensuring Integrity and Privacy - Tjerand Silde.md|Zero-Knowledge Proofs: Simultaneously Ensuring Integrity and Privacy - Tjerand Silde by YouTube]] ## Highlights - Um so I'm going to talk about zero knowledge proofs in this session. So this is going to be a talk about cryptography. And kind of new crypto new new cryptography. So today we all use encryptions and signatures and so forth in everyday applications to ensure security and privacy. But sometimes we want to have applications where we care about both ([View Highlight](https://read.readwise.io/read/01krbq04d0b9rb64xhwky43maa)) - Tags: 👻 ai highlighted - transaction and so forth. So you might have some sensitive or private data that you want to keep secret from others. But you sometimes still want to maybe apply this kind of data in some machine learning algorithm or to authenticate yourself to some server and you want to then on the server side know that this information is valid, it's correct, it's something you can trust. Okay, so the class gives classical ([View Highlight](https://read.readwise.io/read/01krbq04dg0y6z2fyz46es59rt)) - Tags: 👻 ai highlighted - without breaking the privacy for the user side and also still ensure integrity on the server side. Yeah. So the solution to this is zero [clears throat] knowledge proofs. So we're going to talk about what these what these proofs are and what kind of application we can or are already using them. So when we think about proofs, we kind of the first thing that comes to mind usually is some kind of ([View Highlight](https://read.readwise.io/read/01krbq04e1xa48b7n36wc37cxw)) - Tags: 👻 ai highlighted - something that you claim and then the witness or the proof of this is by describing, you know, why this is true or giving some information that you can check that the statement holds. But in zero knowledge proofs, um this is also some kind of say interactive protocol between two parties. You have a prover and a verifier and you want to convince the verifier as a prover that some given statement is ([View Highlight](https://read.readwise.io/read/01krbq04exzxdhtnx1epay3dy8)) - Tags: 👻 ai highlighted - Okay? So, you're actually saving space by producing this proof, not only giving privacy. Yeah. So, we'll get back to that. Um okay. So, let's talk a bit about potential applications of zero-knowledge proofs. So, this is something that, you know, is already deployed and is out there, and you might have uh other related applications in mind for, you know, your own situation. So, one thing is actually quantum-safe ([View Highlight](https://read.readwise.io/read/01krbq04fxsj2xr2rpcvv0n2xa)) - Tags: 👻 ai highlighted - argument of knowledge where the zero knowledge part is what we have talked about so far, that you have some secret witness that does not leak when you produce the proof. Then we have the succinctness part which means that the proof is very fast to verify and very small to send. It's non-interactive so you don't need this communication back and forth. You could just publish the proof online once and for all and everyone can verify it. And the last two about argument of ([View Highlight](https://read.readwise.io/read/01krbq04q1pg8w197chx7x61wk)) - Tags: 👻 ai highlighted - find something that fits you. But in general all of these systems that we developed they usually open source. So this [snorts] is something that you you can look into if you if you're interested. Um and finally I want to say a few words about the larger context. So zero knowledge proofs is one out of several privacy enhancing cryptography techniques that we have developed over the last say 30 years. ([View Highlight](https://read.readwise.io/read/01krbq04vwspbrftdhhkcwtvax)) - Tags: 👻 ai highlighted - encrypted to some service that have a machine learning algorithm. They can evaluate this algorithm on the encrypted data and you get the result back you can decrypt it with only the result. And they didn't learn anything about your data. Of course then this can be um can be used in uh uh both with zero knowledge proofs and fully homomorphic encryption so that you keep the privacy of all the data while it's being computed and you can prove ([View Highlight](https://read.readwise.io/read/01krbq055wc1z8c8f2ffw5f8nv)) - Tags: 👻 ai highlighted