Announcing Halo: Recursive Proof Composition without a Trusted Setup

This is big for both Zcash and the emerging decentralized internet. The full details are available on our blog: Halo: Recursive Proof Composition without a Trusted Setup - Electric Coin Company

21 Likes

Amazing work, @ebfull, @str4d & @daira!

I thought it was interesting to see one of the code examples is a recursive proof of Bitcoinā€™s proof of work. It isnā€™t mentioned explicitly in the paper, but presumably this can be used as a succinct proof of proof of work (useful for SPV)? In which case, it would also be interesting to understand the complexity of deployment within existing smart contract systems such as Ethereumā€™s EVM, and whether or not the gas cost would be prohibitively expensive to verify a proof.

7 Likes

Yeah, weā€™re working on a PoC for that example right now. I think at the very least it seems like an interesting alternative to checkpoints (in Bitcoin) when you donā€™t trust most of your peers to be feeding you the correct blockchain. Unfortunately the verification costs involve at least two large multi-exponentiations so Iā€™m not sure that our existing protocol will be ideal for Ethereum. Maybe future, improved protocols based on our ideas will though.

7 Likes

What are the benefits of ZCASH and how are they planned to be put into practice?

2 Likes

No trusted set up and scalability! Boom :boom:

source

5 Likes

tenor

Any idea how long it will take to integrate it into Zcash? It might help us determine funding levels for the next 4 years.

2 Likes

(It is cool but I kinda liked the trusted setup, dont @ me)

2 Likes

cool work. follow it !

1 Like

So if Iā€™ve understood this correctly, a new wallet wont need the blockchain, just a proof for its initial state.

No heavy download, fits on a phone, good to go almost immediatly. Holy cow!!

Edit: Hoping we get a ā€˜muggle versionā€™ of the paper at some point, even if its just a list of ā€˜things it can enableā€™.

4 Likes

Could you please link me what youre reading? I am no cryptography expert but I do have a batchelors in math and a masters in cs I might be able to handle itā€¦

1 Like

Here yā€™go, youā€™ll know what an aneurysm feels like when youā€™re half way through - its heavy stuff.

2 Likes

Thank you very much I probably wont be able to handle it since I havent been working in my field after finishing uni and that was like a little over 10 years ago, but Im optimistic by nature.

2 Likes

Can someone explain the difference between Spartan and Halo please? Im not too sure.

https://eprint.iacr.org/2019/550

Okay, I am a bit better informed now. I thought this was separate work. from spartan, which I guess it kind of is. but it builds upon it. nice work.

nope read more. confused again. oh well.

1 Like

Spartan is an example of a SNARK (in theory) though it has large constants so Iā€™m unsure if it will work well in the recursive context. Halo is an attempt to take proving systems (Sonic built over the inner product argument, for example) that arenā€™t necessarily succinct but still achieve recursive proof composition with them.

9 Likes

Iā€™am not that euphoric yet until there is some audit and/or itā€™s clear how security plays out with HALOā€¦

ā€¦
In other words, the miners will be responsible for both the proof generation and verification of the final ZK-SNARK. This resembles the case where one plays the roles of both the player and judge in the field simultaneously. It is also not clear how the subsequent protocol (if there is any) built on Halo would attempt to resolve this issue. Neither the Coda team nor any existing academic work provides any security argument to justify this action. Bitcoin can legitimately claim its blockchain resists 51% attack. Whatā€™s the security level of the recursive proof framework when most of the miner computing power are dedicated to proof generation instead of verification? 1%? 0.1%? One cannot simply just trust the protocol developer without the support of any formal argument. I thought the whole point of blockchain is ā€œin math we trustā€?
ā€¦

1 Like

This post appears to misunderstand both the application of recursive validation, and the Coda blog post it is referencing. If the miners are the ones creating recursive chain proofs, then it should be obvious those proofs arenā€™t solely going to be verified by themselves:

  • If the recursive proofs are part of the consensus rules (forcing miners to create them), then they will be verified by other full nodes as well (necessarily, otherwise the chain they have canā€™t be valid).
  • If the recursive proofs are not part of the consensus rules (e.g. if they were only used for light client bandwidth improvements with an SPV-style security model), then thereā€™s no difference between a miner generating these proofs, and some other entity (e.g. a wallet provider) doing so. And depending on what the recursive circuit covers, you could in fact have stronger security properties than SPV (because the proofs could themselves bundle in proofs that the block contents are valid).
7 Likes

Are there scheduled plans yet for an audit? If so when will this occur?

Weā€™re a while away from audits; we are still in the R&D process, and thereā€™s little point in auditing something we arenā€™t certain will be used. Halo is still in development (in particular, there are various optimisations being implemented), and there is so much progress being made in the field at the moment that there are likely to be useful improvements made over the coming months.

11 Likes

Hey Iā€™m just curious about current progress of Halo. Is there any roughly estimated timeline? I presume it would take several years at least for implementation of a totally trustless MPC in zcash main network?

2 Likes