Episode 76: Sean Bowe on SNARKs, Trusted Setups & Elliptic Curve Cryptography
May 8, 2019
auto_awesome
Sean Bowe, engineer at the Electric Coin Company, talks about SNARKs, trusted setups, and elliptic curve cryptography. They discuss the story of Zcash, Powers of Tau trusted set up, SONICs, ZEXE, and the BLS12-381 Elliptic Curve Construction. They also mention the bug in the Zcash proving system and the design and implementation of the BLS 1231 elliptic curve.
Designing the BLS1231 elliptic curve provides improved security and efficiency for elliptic curve pairings.
Multiple implementations are crucial for cryptocurrency security, allowing vulnerabilities to be identified and addressed.
Trusted setups are essential for secure zero-knowledge proofs, but coordinating and securing them pose challenges and potential vulnerabilities.
Deep dives
Designing secure and efficient elliptic curves
The speaker discusses the process of designing elliptic curves, focusing on the development of BLS1231, a popular curve for elliptic curve pairings. The goal was to create a curve that was more secure and efficient than the previous one used in Sprout. By considering different design constraints and the taxonomy of available curves, the speaker devised a curve that satisfied these requirements. The BLS1231 curve offers improved security without sacrificing efficiency, making it a valuable tool for various applications involving elliptic curve pairings.
The importance of multiple implementations
Having multiple implementations is crucial for cryptocurrencies to improve security and reliability. The speaker emphasizes the value of reimplementing academic prototypes to ensure robustness and eliminate potential errors. Academic code often serves as a starting point to demonstrate concepts and does not prioritize real-world security concerns. By replacing academic code and having multiple implementations, vulnerabilities can be more easily identified and addressed, reducing the risk of critical bugs in production systems.
Addressing the challenge of trusted setups and their vulnerabilities
Trusted setups are crucial for secure zero-knowledge proofs, but they come with challenges and potential vulnerabilities. The speaker explains the importance of trusted setups and the need for large-scale multi-party computations to ensure security. They highlight the complexity of coordinating and securing such ceremonies, citing resource constraints and the risk of bugs. The speaker reflects on the daunting responsibility of keeping critical vulnerabilities secret while working towards a fix, emphasizing the need for constant vigilance and rigorous implementation to prevent exploits.
Sonic: A Universal and Updateable Setup
Sonic is a new approach to achieving a trusted setup for ZK SNARKs that aims to create universal and updateable parameters. The goal is to allow different projects to use the same parameters without needing to perform their own ceremony. This would greatly increase the usage of ZK SNARKs in the community. The original universal parameter ZK SNARK was inefficient, with parameter size scaling quadratically with the number of multiplication gates in the circuit. However, Sonic aims to address this issue by developing a linear size parameter that is also updateable. Sonic offers the potential for a continuously evolving ceremony that can scale to a large number of participants, enhancing security and usability.
The BCTV14 Bug and Trusted Setup
During the Zcash trusted setup, a cryptographic bug, known as the BCTV14 bug, was discovered in a paper preceding Zcash. The bug resulted in the construction of elements called bypass elements that allowed for the creation of false proofs arbitrarily. While the trusted setup itself successfully achieved the goal of constructing secure parameters, these bypass elements, which were not necessary for proof construction, broke the soundness of the proving system. Upon discovering the bug, immediate actions were taken to delete the transcript containing the bypass elements and mitigate the issue. This bug highlighted the importance of thorough review and verification in cryptographic protocols.
In this week’s episode, we welcome special guest Sean Bowe. Sean is an engineer at the Electric Coin Company and the author of the Sprout and Sapling Zcash trusted set ups and much of the underlying cryptography of the protocol. We had a chance to chat about his history, what got him into the topic, some of the joys & challenges to working with SNARKs, and what ideas are inspiring him.
Trail of Bits is offering a service for young technology companies who could use expert security support, but aren't quite at a stage to hire their own team. The service includes staffing a #security channel to answer questions, review high risk PRs, and integrate the latest in continuous testing into your build pipeline. Visit www.trailofbits.com for help securing your product.