LD Capital: An overview of ZK program all-star projects
first level title
secondary title
1.1 Concept of zero-knowledge proof
Zero-knowledge proof (ZKP) is an important part of modern cryptography,It refers to the ability of the prover to convince the verifier that a certain assertion is correct without providing any useful information to the verifier.zeroIt not only proves what it wants to prove, but also discloses the information to the verifier as"zero"。
Zero-knowledge proof itself involves a relatively complex cryptographic algorithm, but in order to let everyone have a theoretical understanding of zero-knowledge proof, we cite an example of [Looking for Pandas]:
A group of people were looking for a panda in this picture. Little A was the first to discover the panda's location, but he couldn't point it out publicly immediately, because it would ruin other people's game experience.
Is there any way to prove that little A knows where the panda is without letting anyone else know the answer?
So Xiao A found a super large white paper and randomly covered the picture with the panda on it. Then, Little A cut out a small hole in the white paper, so that only the panda could be exposed.
In this way, the location of the panda is protected as the key information, but Little A can still prove that he has found the panda without letting others know where the panda is. This is a zero-knowledge proof.
The verification method of zero-knowledge proof emphasizes thatreliabilityandreliability. The principle of completeness means that the prover can persuade the prover to accept a correct statement; the principle of reliability means that the prover cannot persuade the verifier to accept a wrong statement. But in fact, reliability is still probabilistic, just saying that the probability that the prover will cheat is extremely low.
secondary title
1.2 Evolution of zero-knowledge proof theory
The concept of zero-knowledge proof was first proposed by S.Goldwasser, S.Micali and C.Rackoff in 1985. He introduced "interaction" and "randomness" in his paper, and constructed the early【Interactive proof system】. Interactive proofs require the verifier to continually ask a series of questions about the "knowledge" the prover has. The prover convinces the verifier that the prover does know these things by answering a series of questions"Knowledge". The more questions this generates, the more interactions there will be, but such an approach does not make people believe that both the prover and the verifier are sincere. Still verified.
In the following ten years, many legendary cryptographers made important contributions to the development of the zero-knowledge proof system. For example, M. Blum, P. Feldman, and S. Micali pointed out that "interaction" and "hidden randomness" are not necessary, and then proposed a model based on the public parameter CRS (Common Reference String)[Non-interactive zero-knowledge proof system]. Non-interactive proof means that the prover does not need to interact with the verifier, and a set of public parameters needs to be set in advance in the system, and the transaction is constructed and verified based on the public parameters of the zero-knowledge proof. This also means that the prover can independently generate proofs, avoiding the possibility of collusion between the prover and the verifier.
In 2010, Jens Groth proposed a controversial exponential knowledge assumption (Knowledge of Exponent Assumption), by hiding some secret random values in CRS,Shorten the proof length to a constant level. This process can be understood as creating a secret that only the system "knows", and anyone who knows how to generate the public parameter can forge the proof. This process is [initializing trusted settings]. Although this scheme greatly reduces the length of the proof, it also brings some security risks, because anyone who knows how to generate the public parameter can forge the proof. However, this scheme establishes the most important branch of zero-knowledge proof technology in the next decade.
With the continuous development of zero-knowledge proof theory, cryptographers have begun to conduct in-depth research in the direction of engineering. In 2013, based on the work of Jens Groth in 2010, Rosario Gennaro, Craig Gentry and others made a more optimized improvement plan, which greatly shortened the proof time and reduced the proof length to a smaller constant level. Subsequently, Parno et al. implemented a verifiable computing protocol called Pinocchio on this basis, and continued to optimize and improve it.
secondary title
1.3 Development status of zero-knowledge proof
The combination of zero-knowledge proof technology and Zcash draws people's attention to the huge role it can play in the blockchain field, and it is also an important practice for zero-knowledge proof technology to move from theory to application.
There are currently several schemes for zero-knowledge proof. Each scheme represents a different practice of zero-knowledge proof. Different practices will produce different effects, mainly in terms of security, proof size, calculation speed, and verification speed. .
text
1.3.1 zk-SNARK
SNARK（Succinct Non-Interactive Argument of Knowledge）is an acronym for Concise Non-Interactive Demonstration of Knowledge. The characteristics of this scheme are simplicity, that is, the verification process does not involve a large amount of data transmission and the verification algorithm is simple, which means that the verification time will not increase exponentially with the computing throughput. Second, the non-interactive proof of knowledge is a single piece of information from the prover to the verifier, making the entire verification process more efficient. Groth16 is currently the zk-SNARK with the fastest verification speed and the smallest amount of data, and Zcash is its first widespread implementation. Groth16 is a further optimization based on the Pinocchio protocol. Under the condition of slightly strengthening the security assumption, the proof size is reduced by nearly half.
But the controversial point of the Groth16 plan is that【Initialize trusted settings】, because the hidden random value in CRS usually hassmall groupformulate, so there may betrust issue. Moreover, in theory, if the prover has enough computing power, he can submit false proofs, thus affecting the security of the entire system. This is why quantum computers are thought to threaten such algorithms. Therefore, [initializing trusted settings] is also the core problem that other zero-knowledge proof technologies try to overcome. The PLONK algorithm is also an improvement for trusted settings, and we will discuss the differences between the two algorithms in detail later.
To solve this problem, Stanford cryptographer Benedikt Bünz et al proposedBulletproof(Bulletproof proof) technology, compared to the earlier zk-SNARK,No need to initialize trusted settings, but the calculation and verification time are longer than STARK, but the proof size is much smaller than STARKtext
1.3.2 zk-STARK
STARK（Scalable Transparent Argument of Knowledge）is a scalable transparent proof of knowledge, created as an alternative to SNARKs. Different from the "S" of Succinct in SNARK, the "S" of STARK stands for Scalable (scalable), mainly in the fact that the time complexity of STARK generation proof (Proof) is similar to the complexity of calculation, while the verification proof (Verify Proof) ) time complexity is much smaller than the computational complexity. That is to sayAs the scalability of STARK increases, the proof complexity of STARK does not increase accordingly.
But more importantly, STARKNo initial trusted setup required, because they rely on leaner symmetric encryption via hash function collisions. This is also the [Transparent] part of STARK.
The third improvement of STARK compared to SANRK isAnti-quantum computing, which means that it cannot be cracked by quantum computing. Of course, these improvements also come with sacrifices.Compared with SNARK, STARK is more complicated, the proof size has increased from 288 bytes to several hundred KB, and the Ethereum verification fee consumed is also higher.
1.3.3 Zero-knowledge proof scheme for trusted settings
Although the zero-knowledge proof system based on trusted settings needs to generate public parameters, it has been proved to have its own advantages in terms of computing cost and proof size, so it is still the preferred tool for many privacy-oriented blockchain applications. Trusted Setup The security of zero-knowledge proof systems largely boils down to the security of public parameter generation, while generating these parameters in a trusted, centralized manner is possible, but incompatible with the goal of decentralization. By far the go-to technique used in trusted settings is multi-party secure computing (MPC).
The MPC scheme attempts to ensure that no party can generate or gain knowledge about the underlying mathematical structure of these parameters. It does this by requiring that the generation process be shared among as many independent actors as possible, with only a few (or even one) needing to act honestly in order to keep the setup secure. Obviously, when using MPC, the higher the number of participants, the higher the security of the parameters.
Zk-SNARK is a zero-knowledge proof scheme for trusted settings, but different algorithms have evolved in it. Groth 16 and PLONK are currently the most widely used zero-knowledge proof schemes for trusted settings. The differences between the two are:
Groth16 is the scheme with the fastest verification speed and the smallest amount of data, but because the secret calculation of Groth16 is associated with specific problems, it is necessary to restart a round of MPC trusted settings according to different problems each time. Computing protocols that require multi-party participation are usually extremely cumbersome, which greatly affects the performance of Groth16.
PLONK is an improved version of Sonic with a 5x shorter proof time. Sonic is an updatable global CRS scheme. , the so-called updatable means that the trusted presets can be updated at any time, as long as everyone suspects that the secret has been leaked. The so-called global means that the calculation process is no longer bound to the CRS, and an application only needs to complete one trusted preset to realize different zero-knowledge proof circuit calculations. That is to say, the trusted setting only needs to be set once, except for updating, there is no need to hold a new MPC every time according to different problems. The following figure shows the performance comparison between Groth16 and PLONK:
The PLONK algorithm was completed by Gabizon, a researcher from Protocol Labs, and two researchers from Aztec Protocol, an Ethereum privacy transaction protocol. PLONK was proposed later than Groth16, and has a certain gap with Groth16 in terms of proof size and verification speed. However, based on the feature of updatable trusted settings, PLONK algorithm occupies a place in the field of zero-knowledge proof.
2 Application of zero-knowledge proof technology
Two important features of zero-knowledge proof technology are the main factors that can be applied in the blockchain field: 1) Zero-knowledge proof can protect the privacy of data and prove it without leaking data information; 2) Zero-knowledge proof only needs to generate a proof of a small amount of data to complete the proof of a large amount of data, which can play a great role in compressing the amount of data and improving performance.
Therefore, the two directions in which zero-knowledge proofs work are:
2.1 Privacy protection
Privacy protection has always been an extremely important concept in the blockchain, representing the ability to protect transactions and participants in a distributed network. Although the blockchain has always advocated anonymity, in most transactions, although the transaction participants do not need to use their real names, they can still identify the trader by repeatedly using the hash value of the public key as the transaction identifier, so this type of transaction only has Pseudonymity does not achieve true anonymity. By default, every transaction of a user is public. Once a user's address is locked, one can check the source of funds, calculate positions and even analyze the user's on-chain activities based on the address.
Zero-knowledge proof technology can confirm the validity of the transaction by submitting a certificate that does not disclose any information, and realize the complete anonymity of transaction information. During the development period emphasizing encryption privacy issues, many developers devoted themselves to the exploration of private public chains. The privacy protection and data compression capabilities of zero-knowledge proofs are important reasons for it to become a component technology of public chains. During this period, projects such as Zcash and Monero shined brilliantly.
Taking Zcash as an example, ZCash first adopted the Pinocchio protocol, and switched to the Groth16 proof system in 2019. ZCash wallet addresses are divided into two types: hidden addresses and transparent addresses. Transactions between transparent addresses are no different from Bitcoin transactions: the sender, receiver, and transaction amount are publicly visible; transactions between hidden addresses will also appear on the public blockchain, but the address of the transaction, the amount of funds The amount and remark fields are encrypted, and zk-SNARK proves the validity of the transaction under the network consensus rules; in addition, transactions between hidden addresses and transparent addresses are also possible. While protecting transaction privacy, Zcash is also friendly to auditing and supervision. Both the sender and receiver of hidden address transactions can disclose transaction details to third parties to meet witness, compliance or audit requirements.
2.2 Expansion
The "impossible triangle" is an eternal problem faced by L1 blockchains like Ethereum, and different chains are always looking for a balance between decentralization, security and scalability. Ethereum is more focused on decentralization and security, so it has to face limitations in scalability. The high gas fee and long transaction confirmation time on Ethereum greatly affect its user experience. Therefore, its core development team and community have been exploring various expansion options.
There are two ways to expand the blockchain: 1) To expand the L1 blockchain itself, the method includes increasing the block size, or fragmentation, that is, dividing the nodes in the blockchain network into several relatively independent Sharding, a single shard is responsible for a small processing scale, or even only stores part of the network state, and multiple shards process transactions in parallel, theoretically, the throughput of the entire network will increase. However, this method will bring about the sacrifice of decentralization; 2) Transfer the transactions on the L1 layer network to the L2 layer, and the L2 layer will collect the transactions, and then send them to the L1 layer network for settlement. In this way, each batch of transactions pays a gas fee instead of each transaction. Therefore, all transactions amortize the gas cost, effectively reducing the cost of each transaction. In this way, L1 becomes the settlement layer for all executed transactions on L2. The L2 layer expansion solution can solve the scalability problem of L1 without sacrificing decentralization and security.
Of course, the L2 layer expansion solution has also experienced the evolution from state channel to Plasma and then to Rollup. Currently, Rollup is the most mainstream and most promising L2. Rollup refers to performing complex calculations and state maintenance off the chain, and then calling the data related to state changes through contract calls, using cheaper CALLDATA to save data on the chain, summarizing a large number of transactions into one transaction, and finally Improve TPS under the premise of ensuring [data availability].
The common point of the Rollup scheme is to emphasize the availability of data on the chain, that is, anyone can restore the global state based on the data stored on the chain, thereby eliminating the security risks caused by data availability issues. The point where zero-knowledge proof plays a role is to ensure the correctness of data while compressing the calculation amount on the chain.
The ZK Rollup scheme originated in the second half of 2018. The key to this scheme is ZK. Every state change of it needs to provide a zero-knowledge proof and be verified by the contract on the main chain. Only when the verification passes can the state be changed. That is, the state transition of ZK Rollup strictly depends on cryptographic proofs. (Note: For a detailed explanation of the principle of ZK Rollup, I recommend Li Hua's "One Article to Clarify Layer and Cross-chain Methods")
Of course, there are other rollup solutions, such as Optimistic Rollup, which was formed in the second half of 2019. It does not need to be strictly verified for each state transition. It optimistically assumes that each transition is correct, and then can challenge a certain transition within a certain time limit. If the challenge is successful, it proves that there is a problem with the previous submission and will be punished. Committer and rollback the state. That is, the state transition of Optimistic Rollup depends on economic incentives and games.
The outstanding problem of ZK Rollup is that it is difficult to achieve programmability, but ZkSync's virtual machine and its related design can make programmability land; the most concerned issue of Optimistic Rollup seems to be when the funds return from Layer 2, because the challenge period brings However, there are intermediaries who can provide advance payment services. Therefore, the Optimistic Rollup solution can be implemented faster.
The performance comparison between the two is shown in the figure below:
Compared with Optimistic Rollup, the ZK Rollup scheme is technically very complex and requires a lot of calculations, the transaction delay will be longer, and the calculation cost is higher, but each transaction fee is lower, and the verification is much lower than the calculation cost , such simplicity provides conditions for expansion.
According to the latest data from I2beat.com, the locked assets of the second-tier solution are about 6.7 billion US dollars. Among them, the Optimistic Rollup second-tier expansion solution was proposed by Arbitrum and Optimism and first introduced to the market. It currently accounts for half of the second-tier solution. The asset size locked by the zero-knowledge proof scheme is only about 1.7 billion US dollars. The reason is that the technical implementation is more difficult and the ecological application construction has not yet been implemented.
3 Zero-knowledge proof scheme star project
Although the early zero-knowledge proof projects Zcash and Monero did a good job in privacy protection, they can only be used as a value storage method, and it is difficult to carry other applications. With the efforts of many developers, they are trying to combine zero-knowledge proof with smart contracts to explore the greater potential of zero-knowledge proof technology. The current applications can be roughly divided into the following three categories. In this section, we will introduce some highly anticipated zero-knowledge proof projects, and most of them have not yet issued tokens.
3.1 Mina
Mina was founded in 2017 and used to be called Coda Protocol. Its development team is O(1) Labs, and its team is currently composed of world-class cryptographers, engineers, PhDs, and entrepreneurs.
Mina focuses on building a lightweight blockchain. Compared with the block space of hundreds of GB in Ethereum and Bitcoin, Mina's block size will be maintained at 22 KB, which allows most people to participate and become nodes. The low-threshold node deployment is easier to spread to all kinds of users. Users can easily access nodes and deploy nodes, which will also make the network more distributed, and the security will be improved accordingly.
The core of Mina's ability to achieve a constant block size is the use of [recursive zero-knowledge proof], that is, each time a block is produced, the block is compressed into a single proof using zk-SNARK technology, and each new SNARK proof is Including past SNARK proofs, nodes only need to check this proof, so there is no need to check the entire transaction history.
But this is only the first step. A characteristic of the blockchain is that each block needs to refer to the previous block, because if only SNARK proofs are generated for each block, its overall capacity will still increase linearly. Therefore, Mina will create SNARKs for SNARKs (that is, recursion), and then continue to iterate and nest, and link these SNARK proofs together in a recursive structure, so as to keep the block at a constant size of about 22 KB.
In addition, Mina has built an ecosystem around zero-knowledge proof that can protect data privacy. Its ecological application Snapps (now renamed zkApps) can implement specific business logic for some scenarios, and can also communicate with other companies through a bridge. Chains cooperate to enhance interoperability and make the entire blockchain ecology mutually beneficial and win-win. And with the feature of lightweight nodes, only Mina is currently developing in this field.
Financing background:
In March 2022, Mina announced the completion of a US$92 million strategic financing led by FTX Venture and Three Arrows Capital. These funds will be used to accelerate the adoption of Mina as the leading zero-knowledge proof platform within Web3 by attracting world-class developers.
Prior to this, Mina has conducted four rounds of financing, with a financing amount of about 48.15 million US dollars. The participating investors include Coinbase Ventures, Polychain Capital, Three Arrows Capital, Paradigm, Multicoin and other top institutions. Excellent investment institutions tend to pay more attention to long-term value, and most of these institutions have their own IP traffic, which is very beneficial to Mina's active expansion of the future market.
3.2 ZkSync
zkSync is a project built by the Matter Labs team, which was established in December 2019 with the main goal of scaling Ethereum. zkSync 1.0 is a ZK Rollup (zero-knowledge proof) L2 expansion solution on Ethereum, mainly focusing on payment, and it will be launched on the Ethereum mainnet in June 2020. The SNARK algorithm adopted by zkSync at the beginning is Groth 16. Using Groth 16 not only requires a trusted setting (such as the beginning of zkSync creation), but also requires a trusted setting every time there is a new application upgrade on zkSync. This also creates obstacles for zkSync 1.0 to create an EVM compatible environment, so zkSync 1.0 is only limited to specific applications, such as payment.
zkSync 2.0 is an EVM-compatible L2 solution built on Ethereum, also known as zkEVM, because it recompiles the EVM code and uses zero-knowledge proofs to verify Rollup transactions, allowing developers to use Ethereum's native programming The language builds and deploys decentralized applications in a low-gas, highly scalable L2 environment.
In May 2021, zkSync released the Apha version of zkEVM, and expected the mainnet to be launched in August 2021, but it was delayed due to technical difficulties. In February 2022, the zkSync 2.0 public testnet will be launched. zkEVM has been released, the first EVM-compatible ZK Rollup on the Ethereum testnet.
Financing background:
In March 2021, Matter Labs completed a $6 million Series A round led by Union Square Ventures. Other well-known investors include Placeholder and Dragonfly. What is even more striking about this round of financing is the introduction of a large number of ecological partners, including some of the most well-known companies and founders in the cryptocurrency field.
In November 2021, Matter Labs completed another US$50 million Series B financing led by A16Z. Other strategic investors also include many centralized exchanges (Blockchain.com, Crypto.com, ByBit, OKEx). Shortly after the financing was announced, these exchanges announced that they had reached cooperation with zkSync to support deposit/withdrawal between the exchange and L2.
3.3 StarkWare
The StarkWare team was established in May 2018. Its team is composed of world-class cryptographers and scientists. The core member is the former chief scientist of Zcash. proposed in an academic paper in 2018. The paper's authors went on to create StarkWare.
Like zkSync, StarkWare is a zero-knowledge proof expansion solution player, but StarkWare is based on STARK. The problem with STARK is that its technology is not as mature as SNARK, and if it achieves Turing completeness, it will be difficult to be compatible with EVM. StarkWare created a specific programming language, Cairo, to run autonomous programs powered by STARK. And the StarkWare team is now working with the Nethermind team to create Warp, a transpiler that will seamlessly convert Solidity smart contracts to Cairo so that they are compatible with the EVM.
StarkWare launches StarEx and allows the creation of application-specific ZK Rollups powered by Cairo and STARK. dydx, Immutable, Deversifi are the 3 main applications supported by StarkEx. So far, StarkEx has processed more than 5 million transactions worth more than $250 billion through these applications.
On November 29, 2021, they released the Alpha version of StarkNet's mainnet. StarkNet is a ZK Rollup layer-2 application network and plans to develop its own ecosystem.
Financing background:
StarkWare has conducted a total of four rounds of financing, with a financing amount of more than 160 million US dollars. The participants include many top institutions, such as Paradigm, Polychain, Sequoia Capital, IOSG, etc., and the angel investors include the founder of Ethereum Vitalik Buterin (V God), Favored by the encryption circle.
3.4 Aztec
The Aztec team was established in 2018. Most of its team members are PhDs from world-class universities. The team also includes former Zcash researchers with strong technical backgrounds. Its self-developed PLONK algorithm has been adopted by many projects in the industry.
Aztec also uses ZK Rollup technology to solve the expansion problem of Ethereum. From the establishment of the project to the launch of Aztec2.0, the team has been conducting in-depth research on the PLONK algorithm, and released zero-knowledge proof algorithms such as PLONKUP during this period. Ability is highly praised.
The Aztec network has two main functions. One is to ensure the privacy of user interaction, and the other is that users can provide programmable privacy contracts through Aztec to build completely private applications.
After the launch of Aztec 2.0, the zk.money private transfer application will be launched. Sending and receiving tokens is anonymous. Encrypted transactions are proved through recursive zero-knowledge. No transaction data will be released publicly to protect the privacy of users, but currently only for users Make a deposit transfer. Aztec Connect, as the first private cross-chain bridge, is also currently on the test network.
The development of the Aztec project has roughly three stages: the first stage is Aztec 1.0, which is a privacy trading tool on Ethereum; the second stage is Aztec 2.0, which becomes the second layer of privacy in Ethereum through zk-Rollup. Bring scalable privacy to Ethereum; Judging from the existing disclosures, the third stage in the future is Aztec 3.0, which uses the Noir privacy programming language to realize the privacy smart contract on the second layer of Ethereum. However, the problems faced by most zk-Rollup second-tier projects are EVM compatibility issues. The Aztec network is still not compatible with EVM, which will increase the difficulty and cost of many projects to construct privacy smart contracts. The project party also disclosed that it is improving this problem through technical research.
Financing background:
In November 2018, Aztec raised a $2.1 million seed round led by ConsenSys Labs. In December 2021, Aztec completed a US$17 million Series A financing led by Paradigm and participated by IOSG and others, including angel investor Stani KulecFhov, who is the founder of Aave, a leading lending project. This round of financing will be used to continue to develop the ZK system and continue to improve Aztec Connect. According to its description, the bridge can save up to 100 times the gas fee when conducting private transactions.
3.5 Aleo
The Aleo project was officially established in 2019. The team members are composed of world-class cryptographers from companies such as Google, Amazon, and Facebook, as well as research universities such as UC Berkeley, Johns Hopkins University, New York University, and Cornell University. Composed of engineers, designers and operators.
Aleo shields identities and shields transactions through the zkCloud system built by the structure. The shielded identities can interact directly (such as asset transfer) or programmatically (through smart contracts). In a typical public blockchain, program execution occurs on-chain in a global "virtual machine" (VM) run by each network node. Therefore, every node in the network must recompute (and collectively agree on) every step of a given program. Not only is this inefficient, but it slows things down and increases costs for the end user. zkCloud overcomes these limitations by separating the application runtime from the state maintained by the blockchain (on-chain + off-chain), combined with recursive zero-knowledge proofs, enabling Aleo to achieve full programmability and privacy, as well as higher transaction throughput.
In order to make developers experience better, Aleo built a programming language Leo that is more friendly to zero-knowledge proof application development. Leo is a statically typed programming language inspired by Rust, built for writing private applications. In addition to being friendly to developers, they also launched developer incentive programs and testnet incentives to help Aleo’s initial ecological development.
Financing background:
In April 2021, Aleo completed a $28 million Series A round of financing led by a16z, with participation from Placeholde, Galaxy Digital, Variant Capital, and Coinbase Ventures.
summary
summary
References
References
1. "Zero-Knowledge Proof Technology Development Report", Gyro Research Institute, Ambi Lab
2. "What is Zero-Knowledge Proof?" ｜ZK Popular Science Series (1)", ZK lovers
3. "[Public Due Diligence] In-Depth Report: Mina", First Class Warehouse
4. "The Development of Layer2 and the Rise of zk-Rollup | ZK Popular Science Series (2)", ZK Enthusiast
5. "Clarifying Layer and Cross-chain Methods in One Article", by Li Hua
6. "[Password Column] Super Advanced: PLONK VS Groth16 (Part 1)", Qulian Technology
