Відео

3:38 I know the example is a simplification but it seems like peggy is trusting victor to shuffle the cards. because if she is the one shuffling the cards and handing them to victor then, victor is trusting that that peggy is not just handing him 1 to 9 cards that don't necessarily come from the row.

There was a question at the end of the talk about the point at which the PCIe bandwidth becomes the limiting factor. Here's a quick back of the envelope. PCIe can push approx 12,000,000,000 bytes/sec. A scalar is 32-bytes (256-bits). So we can push 375M scalars over a second. It takes us 7 cycles to process a scalar (7 windows per CU and 1 cycle per window on each CU). So that would mean the PCIe would only become the limiter at 7*375MHz = 2.6 GHz, which is far beyond the capabilities of the card. In other words, the PCIe bandwidth is not an issue.

Its not a proof, its a probabilistic claim

I really don't get why everyone is so hot on this, it's literally useless. By definition it serves no purpose, what's the point of proving something that can't be reviled, the idea of proving something is to assert if it's true or false. And if we prove that something that we don't know, is either true or false is by definition meaningless because we have no idea what we are proving. Not to mention that this form of verification is really heavy in terms of computations for something trivial, for example we are trying to prove that we are the user that wants to gain access to a certain machine, with zkps we need to have constant open connection so both can attest to the claim and eventually agree that me the anonymous person has access to the account. And since no sound system that uses authentication can make any sense without some sort of account identifier after authenticating it means that after the handshake we already know the id of the person authenticating, allowing for tracking through session ids to build profiles. There are so much better solutions than this, that are completely decentralized without the use of computation, for example EVM signatures, we take a statement, we sign it and anyone can prove that it was done by us. It seems like the latest crypto buzz word to defraud investors, big words no meaning and lack of any practical (key word) implementation.

Link to slides here please. I cannot access X :)

Massively helpful. Thanks for sharing your knowledge Hadar 🙏

🥳

🙏🙏🙏

This is amazing, thank you Hadar 🔥

This is a great video. Good run down of sumcheck.

Xuy

nice ingfo

Did I miss that or Peggy didn't prove that each cell contains the same number for each color and this way can craft proofs very widely?

nice

Nice

nice information

hi Alidneder

good

Good porzit

Thanks for having me!

I don't understand why web3 devs aren't talking about ZAMA yet:)

wouldn't it be better said, as, obfuscated conditional proofs, rather than zero knowledge, as you are giving some understanding away but not enough to discern the information your trying to obfuscate.

Love the Sudoku solution

Superb quality video! Deserves way more views. You have done an amazing job covering in a short video key ideas of a complex subject. The amount of work that went into this video is huge, but the result is worth it.

Ok

This panel got heated :D

gm nice presentation :)

i'm not convinced ... you can easily argue that a giraffe is really just a horse with a long neck but i'm not convinced ... because zero knowledge can't transmit knowledge

Do you have a paper?

🤩

The music is not helping. Please avoid adding music to these videos

Go Robert!

Wow very good video

The ZKP Sudoku solution protocol is really cool, but, I'm not yet convinced that it 100% guarantees that Peggy found a correct solution. It seems that there is a very high likelihood that Peggy found a correct solution given that all the shuffled columns, rows and boxes contain each number from 1 to 9, but is there not the possibility that after shuffling, all the rows, columns and boxes seem correct, yet Peggy gave a bogus solution. Maybe I've not thought about it hard enough, but I don't see why there's not a (really) small chance that Peggy can give an incorrect solution yet after Victor shuffles and checks, the 'solution' appears correct. EDIT: Sorry I seem to have commented too early, at 7.03 you begin to talk about how there is a low probability of accepting a false positive! Nonetheless, my question still remains, is it possible to construct a non-solution which becomes a solution after some random shuffling?

The sudoku example only works assuming Victor is not interested to know the solution. Because before he shuffles the piles, they contain the solution. I know it's a toy example but I wish it demonstrated how real privacy could be accomplished.

But you can quite easily construct a fake proof for the sudoku with what you described if you can put non-matching numbers in the same place. Proving that numbers match would require knowledge either inspecting and watching it be placed, or inspecting certain tiles. It is only valid because you can check the other numbers under the known numbers. But that wasn’t made explicit

His first example fails. Peggy touches the stacks of cards during the setup. No, not allowed. Then Victor touches the cards before they are shuffled. No, not allowed. An infallible and honest intermediary is required for these tasks, however the idea that a computer is an "honest intermediary" cannot be proven since computers are hacked or infected constantly and no software can be proven to be bug-free.

There is a much simpler way of doing this - if you know the sudoku solution then hash it and ask someone else to hash their solution and see if the hashes match.

Okay, you don't want me to know any details of any of your proofs, but want me to know you have proved them. Great, you can prove it with a zero knowledge proof. Now, how do knowledge proofs work, again?

I thought your whole explanation was just going to be: trust me it's possible haha

The music is very distracting. It is a very interesting concept, and I am sure I would enjoy the video much more if the background music wasn't present, or was barely present.

Thank you all for the feedback and support! 🙏 We're amazed by the number of views and excited to see how many of you are interested in the topic. So, what would you like to see in our next video? We've got some options lined up: 1. History of Zero-Knowledge Proofs (ZKP) 2. Arithmetizations 3. Elliptic Curves & Pairing Functions 4. Lookup Arguments Explained 5. Fully Homomorphic Encryption (FHE) Comment below to let us know 💬

One use of this is authentication of nuclear emergency action message codes. The codes are verified in a manner very similar to the one shown. Nobody knows exactly the content means but the syntaxes used for a valid code are known. This allows for exclusion of false codes.

in the video it's stated that we can claim pegi knows the solution because she sent to the verifier E(p(s)), E(q(s)), y, z and we can check that the following equation holds: E(q(s)) E(s - y) = E(p(s) - y) E(1) we can even rewrite it as: E(q(s)) (E(s) - E(y)) = (E(p(s)) - E(y)) E(1) and given that E(s) is known as the second element of the vector [ E(1) , E(s), E(s²), E(s³), … ] we can actually verify the solution it is not explained at all why is that incorrect solutions do not match since this equation was not derived in any way from the correct solution. we assume a vector of "right" coefficient exists for the polynomial p(x) to be the exact solution. BUT it's not apparent how our way of checking if pegi knows the solution or not actually take into a count the solution itself.

Why should Victor be satisfied that the set of questions and answers yielded by the Fiat-Shamir transformation are an appropriate and sufficient set of questions? Actually, I'm confused how the Fiat-Shamir transformation lets Victor discern between valid and invalid proofs. Isn't it essentially "With this commitment, you will get this list of questions and answers" - but how does Victor know that the answers are correct?

That escalated quickly lol Thanks for the explanation, but how do we build upon this?

More please. I would like a longer video or a series that spends a bit more time on each aspect you showed here because it was a bit much.

really good video! though I lost it when the polynomials kicked in, I'll make sure to come back and rewatch it

Im shocked that such a small channel is able to give such a good video on this topic. Loved the video

🎯 Key Takeaways for quick navigation: 00:00 🧩 Zero-Knowledge Proofs (ZKPs) allow proving information without revealing its content. 01:12 🕵️ ZKPs have applications in privacy, like proving citizenship or financial capacity without revealing sensitive data. 03:01 🃏 A simplified ZKP example involves Peggy proving a solved Sudoku to Victor without revealing the solution's location. 05:08 🌐 SNARKs (Succinct Non-Interactive Argument of Knowledge) are a powerful branch of ZKPs allowing efficient, non-interactive proofs. 10:40 🔐 Polynomial commitments are a key concept in SNARKs, providing a way to compactly represent complex information. 12:59 🔢 SNARKs use arithmetization, commitment schemes, cryptographic techniques, and transformations to create efficient proofs. 15:34 🧪 SNARKs involve mathematical complexity, including polynomial evaluations and cryptographic operations. 18:08 🔍 Polynomial commitment schemes like KZG enable efficient commitments and proofs of polynomial properties. 22:18 🎩 ZK SNARKs use polynomial commitments, allowing small proofs for complex statements, ensuring security and efficiency. 22:59 🔢 Trusted setup involves a secret number chosen by a third party and encrypted powers of it, forming a foundation for SNARKs. 23:53 📊 Peggy constructs an 80-degree polynomial to represent her Sudoku solution, with coefficients solved from linear equations. 24:21 🧩 Peggy proves that her solution matches the Sudoku problem by proving values of her polynomial at starting locations. 25:03 🕵️ Peggy adds proofs and commitments to ensure the solution obeys Sudoku rules for rows, columns, and blocks. 25:59 💼 Peggy sends the proof to Victor, who can verify the commitment, solution, and rules element by element, confirming her knowledge of the solution. Made with HARPA AI