Home

When the Bulletproofs protocol appeared, it made some kind of revolution in the ZK world, especially in anonymous transactions, where range proofs are the most complicated and important part of validating a correct transfer. Today, many protocols rely on Bulletproofs or Bulletproofs+ (a more advanced version) to enable range proofs. Additionally...

File download: Dark White Here, I’m not going to describe the general definition of a zk-SNARK or any related terms. Instead, I’ll try to help the reader understand the underlying math of one of the first popular and novel zk-SNARK protocols, called the Pinocchio protocol, which appeared in 2013. Special thanks to Anton Levochko a...

Commitment Vortex has much in common with Ligero (frankly speaking, it has been built using Ligero’s idea). So, imagine we have a list of polynomials $f_0,\dots,f_{k-1}$. We want to commit to them and evaluate them at the same point at the same time. We describe each polynomial as a vector $a_i$ where \[f_i(x) = \sum_{j=0}^{n-1} x^j\cdot a_{i,...

To commit to an $\ell$-variate multilinear polynomial $f(x)$, we represent it equivalently as a list of elements where each element at position $i$ is equal to $f(\tilde{i})$ and $\tilde{i}$ represents a bit string equivalent to the value $i$. Then, we reorganize this list into a matrix $M$ of size $2^{\ell_0} \times 2^{\ell_1}$ in such a way th...

Using KoalaBear field Linea and Gnark aim to operate over the KoalaBear field (over the prime modulus 2^31 - 2^24 + 1). The use of this field as the proving field (outer field) in modern proving backends may require implementing a field extension that increases the field size to ~128 bits. The goal they aim to achieve is to enable the use of...

Recently, I’ve realized that it is not so trivial to find a precise but still quite understandable definition of the RSA cipher and the underlying math problem. So, here it is: The RSA problem Given $n = pq$, where $p$ and $q$ are large prime numbers, and an integer $e$ such that $e$ is coprime with $\phi(n) = (p-1)(q-1)$ (Euler’s totient fun...

Twisted Edwards curves1 have the form $ax^2 + y^2 = 1 + dx^2y^2$ (for fields with characteristic not 2) where the curve order 2 can be represented as $l \cdot 2^c$, where $c$ is a natural number and $l$ is a big prime number. So, it is obvious that our elliptic group has two subgroups, and for cryptographic purposes, we may always select the gro...

Imagine Alice has $n$ values $m_i$, and she wants to share one of these values with Bob. Note that Bob does not want to reveal exactly which value he has selected. The solution to this problem is called “oblivious transfer.” There exists a well-known protocol that leverages an encryption scheme $E,D$ that has a commutative property: \[\forall k...