2

Note: This might be similar to this question.

I'm thinking about a hypothetical cryptocurrency where the blockchain doesn't store any transactions. The balance of an address would be stored by the owner, and the blockchain would only contain the root hashes for Merkle trees with hashes of "{address}{balance}". Each block would also contain a list of invalidated hashes. The "miner" nodes would execute a transaction by invalidating the previous hash for an address, send both parties the new Merkle tree leaf nodes for the updated balances, and create a new block with the root hash. It would also be a proof-of-stake algorithm.

I would like to know if there's some way to generate a zero-knowledge proof that your address contains more than 0, and at least x? (x can be an integer, since this hypothetical cryptocurrency has a fixed number of decimal places.)

This would allow people to send transactions without disclosing their actual balance. They could also provide a sequence of verified transactions to prove that their address contains the original amount, minus x, y, z, etc.

I've read some of the other zero-knowledge answers on here, so I'm pretty sure that the answer is "yes". I found this paper, and I've also found some answers like this. However, I would love to see an answer that is relevant to this specific case. I would also find it easier to understand some code examples (any language, or even pseudocode.)

EDIT: I forgot to mention something: the implementation must also include a nonce, otherwise it would be very easy to bruteforce balances for some addresses. For example, if there was no nonce, then it would be easy to find a list of all addresses that have a specific balance of 1.00000000. So the range proof / verification must also consider a secret nonce (or salt).

ndbroadbent
  • 233
  • 1
  • 11
  • I've found this paper, but I can't find a way to read it for free: https://link.springer.com/chapter/10.1007/978-3-642-02882-3_15 – ndbroadbent Dec 07 '17 at 06:38
  • I don't know an explicit answer, but can you look in the direction of the Millionaire's problem ? https://en.wikipedia.org/wiki/Yao%27s_Millionaires%27_Problem – entrop-x Dec 07 '17 at 06:49
  • Thanks very much! I remember reading about that a long time ago. I wonder if you can leak some information (i.e. the value of b), without also giving away the value of a. – ndbroadbent Dec 07 '17 at 07:10

1 Answers1

4

What you want is usually called a range proof: proving in zero-knowledge that some value (committed, or encrypted) is in a given public range. I had written a detailed answer on existing techniques for range proofs where answering this question.

I'm not sure I understood exactly how your scenario would work, but one possible issue with standard solutions is that they are based on algebraic primitives (like, commitments over abelian groups), while you seem to look for a proof related to something hashed in a Merkle tree, without any specific (algebraic) structure. Such statements are harder to prove, but this can be done, using techniques based on garbled circuits to prove knowledge of a satisfying assignment for a given boolean circuit (in your case, this boolean circuit would first check that the input is in the correct range, then hash it the way you want). The most relevant techniques are the recent protocols ZKBoo and Ligero.

One last thing: if you want access to a specific paper that seems relevant to you, but that is behind a paywall, you can contact me by MP (my institution gives me access to the database of most editors).

Geoffroy Couteau
  • 19,919
  • 2
  • 46
  • 68
  • Thanks very much for your answer! Unfortunately I am just a programmer, and I’m not a mathematician or a cryptographer, so I’m still struggling to figure out an algorithm that could implement a NI-ZK range proof. But you’ve given me a lot to read about, and now I know what to search for! Thanks very much for the offer to provide the paper. That one I mentioned has actually been criticized in another paper, and it turns out that it had some flaws. – ndbroadbent Dec 07 '17 at 12:59
  • Also, with regards to the proof of something hashed in a Merkle tree, I can see why that would be a big problem. If the hash includes the balance, then you can’t really verify the hash if you don’t know the balance. I will have to read up on boolean circuits. I might also rethink the implementation and use some algebraic structures instead of hashes in a Merkle tree. (Of course, I have no idea what I’m talking about, so this comment is probably nonsense.) Anyway, thanks very much for your help! – ndbroadbent Dec 07 '17 at 13:07
  • Alright, I understand garbled circuits now (this was very helpful: http://web.mit.edu/sonka89/www/papers/2017ygc.pdf) However, these only keep the values secret from either party, so I’m not sure how these could be used to prove the authenticity of the values. That why I was thinking about using a Merkle tree hash stored in an immutable blockchain. But you can’t verify a hash without knowing the actual amount that was used to generate the hash. Note that I don’t want to verify the amount before generating the hash. This needs to happen afterwards, and before the next transaction is made. – ndbroadbent Dec 07 '17 at 13:55
  • I think I finally understand what you mean by "this boolean circuit would first check that the input is in the correct range, then hash it the way you want". If I understood you correctly, you're saying that this could be computation where the inputs are a public address and a balance integer, and the outputs could be one bit for the range check, and 256 bits for the final SHA256 hash. An untrusted party could then run the computation and compare the final hashes, without ever knowing the actual balance. That's really amazing! – ndbroadbent Dec 08 '17 at 19:40
  • You also wouldn't need any oblivious transfers since the other party isn't sharing any secrets, so I guess this could be called a "non-interactive zero-knowledge proof". The only thing I've been wondering is: Does a garbled circuit still provide security if only one of the inputs is a secret? I'm assuming that it does, because if Bob tells Alice his secret, then of course he still doesn't know Alice's secret. So this technique must still provide some security, even if only one of the inputs is a secret. – ndbroadbent Dec 08 '17 at 19:49
  • The Ligero paper also clearly states that this is possible: "For instance, for verifying a SHA-256 preimage in zero knowledge with 2^-40 soundness error, the communication complexity is roughly 44KB". Thanks again for your help! – ndbroadbent Dec 08 '17 at 19:52
  • Will answer to all of that during the week-end when I have time :) – Geoffroy Couteau Dec 08 '17 at 20:10
  • Haha sorry, this is all really interesting! I've realized that Zcash is doing something very similar with their zero-knowledge proofs.

    I'm guessing that their zk-SNARKs can be much smaller because they introduce a public/private keypair, so they did this computation ceremony to destroy the private key parts. Perhaps my implementation could skip this step since clients would be generating their own circuits, and the hashes are verified against an immutable blockchain. (But I really have no idea)

     – ndbroadbent Dec 08 '17 at 20:29