A zero-knowledge (ZK) proof guarantees that the result of a computation is correct while keeping part of the computation details private. Some ZK proofs are tiny and can be verified in short time, which makes them one of the most promising technologies for solving two key aspects: the challenge of enabling privacy to public and transparent distributed ledgers and, enhancing the scalability limitations of distributed ledgers. Most practical ZK systems require the computation to be expressed as an arithmetic circuit that is encoded as a set of equations called rank-1 constraint system (R1CS). In this paper, we present \circom, a programming language and a compiler for designing arithmetic circuits that are compiled to R1CS. More precisely, with \circom, programmers can design arithmetic circuits, and the compiler outputs (i) a file with the R1CS description, (ii) \wasm and \cpp programs to efficiently compute all values of the circuit. We also provide an open-source library called \circomlib, with multiple circuit templates. Moreover, \circom can be complemented with \snarkjs, a tool for generating and validating ZK proofs from R1CS. Altogether, our software tools abstract the complexity of the proving mechanisms and provide a friendly interface to model low-level descriptions of arithmetic circuits.
We propose and study a new class of polynomial voting rules for a general decentralized decision/consensus system, and more specifically for the proof-of-stake protocol. The main idea, inspired by the Penrose square-root law and the more recent quadratic voting rule, is to differentiate a voter’s voting power and the voter’s share (fraction of the total in the system). We show that, whereas voter shares form a martingale process that converges to a Dirichlet distribution, their voting powers follow a supermartingale process that decays to zero over time. This prevents any voter from controlling the voting process and, thus, enhances security. For both limiting results, we also provide explicit rates of convergence. When the initial total volume of votes (or stakes) is large, we show a phase transition in share stability (or the lack thereof), corresponding to the voter’s initial share relative to the total. We also study the scenario in which trading (of votes/stakes) among the voters is allowed and quantify the level of risk sensitivity (or risk aversion) in three categories, corresponding to the voter’s utility being a supermartingale, a submartingale, and a martingale. For each category, we identify the voter’s best strategy in terms of participation and trading. Funding: W. Tang gratefully acknowledges financial support through the National Science Foundation [Grants DMS-2113779 and DMS-2206038] and through a start-up grant at Columbia University. D. D. Yao’s work is part of a Columbia–City University/Hong Kong collaborative project that is supported by InnoHK Initiative, the Government of Hong Kong Special Administrative Region, and the Laboratory for AI-Powered Financial Technologies.
Peg solitaire is a very popular traditional single-player board game, known to be NP-complete. In this paper, we present a zero-knowledge proof of knowledge for solutions of peg solitaire instances. Our proof is straightforward, in the sense that it does not use any reduction to another NP-complete problem, and uses the standard design of sigma protocols. Our construction relies on cryptographic commitments, which can be replaced by envelopes to make the protocol physical. As a side contribution, we introduce the notion of isomorphisms for peg solitaire, which is the key tool of our protocol.
Abstract We use a simplified version of the framework of resource monoids , introduced by Dal Lago and Hofmann, to interpret simply typed λ-calculus with constants zero and successor. We then use this model to prove a simple quantitative result about bounding the size of the normal form of λ-terms. While the bound itself is already known, this is to our knowledge the first semantic proof of this fact. Our use of resource monoids differs from the other instances found in the literature, in that it measures the size of λ-terms rather than time complexity.
A key component of blockchain technology is the ledger, viz., a database\nthat, unlike standard databases, keeps in memory the complete history of past\ntransactions as in a notarial archive for the benefit of any future test. In\nsecond-generation blockchains such as Ethereum the ledger is coupled with smart\ncontracts, which enable the automation of transactions associated with\nagreements between the parties of a financial or commercial nature. The\ncoupling of smart contracts and ledgers provides the technological background\nfor very innovative application areas, such as Decentralized Autonomous\nOrganizations (DAOs), Initial Coin Offerings (ICOs) and Decentralized Finance\n(DeFi), which propelled blockchains beyond cryptocurrencies that were the only\nfocus of first generation blockchains such as the Bitcoin. However, the\ncurrently used implementation of smart contracts as arbitrary programming\nconstructs has made them susceptible to dangerous bugs that can be exploited\nmaliciously and has moved their semantics away from that of legal contracts. We\npropose here to recompose the split and recover the reliability of databases by\nformalizing a notion of contract modelled as a finite-state automaton with\nwell-defined computational characteristics derived from an encoding in terms of\nallocations of resources to actors, as an alternative to the approach based on\nprogramming. To complete the work, we use temporal logic as the basis for an\nabstract query language that is effectively suited to the historical nature of\nthe information kept in the ledger.\n
A key component of blockchain technology is the ledger, viz., a database that, unlike standard databases, keeps in memory the complete history of past transactions as in a notarial archive for the benefit of any future test. In second-generation blockchains such as Ethereum the ledger is coupled with smart contracts, which enable the automation of transactions associated with agreements between the parties of a financial or commercial nature. The coupling of smart contracts and ledgers provides the technological background for very innovative application areas, such as Decentralized Autonomous Organizations (DAOs), Initial Coin Offerings (ICOs) and Decentralized Finance (DeFi), which propelled blockchains beyond cryptocurrencies that were the only focus of first generation blockchains such as the Bitcoin. However, the currently used implementation of smart contracts as arbitrary programming constructs has made them susceptible to dangerous bugs that can be exploited maliciously and has moved their semantics away from that of legal contracts. We propose here to recompose the split and recover the reliability of databases by formalizing a notion of contract modelled as a finite-state automaton with well-defined computational characteristics derived from an encoding in terms of allocations of resources to actors, as an alternative to the approach based on programming. To complete the work, we use temporal logic as the basis for an abstract query language that is effectively suited to the historical nature of the information kept in the ledger.
Abstract We introduce the probabilistic two-agent justification logic $\textsf {IPJ}$, a logic in which we can reason about agents that perform interactive proofs. In order to study the growth rate of the probabilities in $\textsf {IPJ}$, we present a new method of parametrizing $\textsf {IPJ}$ over certain negligible functions. Further, our approach leads to a new notion of zero-knowledge proofs.
Attribute-based cryptography becomes one of the hot topics in cryptography, since it can provide fine-grained access control and good privacy. Σ-protocol is a 3-move public-coin honest verifier zero-knowledge proof protocol, and has important applications in many fields of cryptography. Firstly, combining the concept of attribute-based cryptography with the zero-knowledge proof, a notion of attribute-based Σ-protocol is introduced with its formal security model. Secondly, based on the standard Σ-protocol, the trapdoor samplable relation and the smooth secret sharing, a general construction of decentralized attribute-based Σ-protocol and corresponding scheme are proposed with the proofs of its securities. Finally, as the applications of decentralized attribute-based Σ-protocol, general constructions of decentralized attribute-based signature and decentralized attribute-based two-tier signature are presented by Fiat-Shamir transformation, respectively. Some concrete schemes are also presented. Performance analysis shows that the proposed attribute-based two-tier signature scheme has obvious advantages in both sizes and computation costs compared with existing schemes.
This paper investigates the usage of logic and logic programming in the design of smart contracts. Our starting point is the logic-based programming language for smart contracts used in a recently proposed framework of quantum-secured blockchain, called Logicontract (LC). We then extend the logic used in LC by answer set programming (ASP), a modern approach to declarative logic programming. Using ASP enables us to write various interesting smart contracts, such as conditional payment, commitment, multi-party lottery and legal service. A striking feature of our ASP implementation proposal is that it involves post-quantum cryptographic primitives, such as the lattice-based public key encryption and signature. The adoption of the post-quantum cryptographic signature overcomes a specific limitation of LC in which the unconditionally secure signature, despite its strength, offers limited protection for users of the same node.
In critical systems, failures or errors can cause catastrophes, such as deaths or considerably losses of money. Model checking provides an automated way to prove the correctness of programs' requirements. It is a convenient technique to use in systems that need reliability. Propositional Dynamic Logic (PDL) is a formal system designed to reason about programs. This work presents a compiler implementation from a subset of the C language and also for the Smacco model, both to the PDL language, and after that to the language of the nuXmv model checker. This implementation is linked with a Blockchain model generation system to model and reason about smart contracts.
Elliptic curves with a bilinear map, or pairing, have a rich algebraic structure that has been fundamental to develop practical Non-Interactive Zero-Knowledge (NIZK) proofs. On the theoretical side, we explore how efficient can NIZK proofs be under weak complexity assumptions. Specifically, we reduce the cost of proofs of satisfiability of quadratic equations, we define a new commitment scheme that is compatible with other pairing-based NIZK arguments, and we construct a simulation-sound argument that results in a new a signature of knowledge with communication sublinear in the circuit size under standard assumptions. Additionally, we study how to reduce the cost of verification in one of the most widely deployed NIZK arguments in practice.
Modern mathematics is built on the idea that proofs should be translatable\ninto formal proofs, whose validity is an objective question, decidable by a\ncomputer. Yet, in practice, proofs are informal and may omit many details. An\nagent considers a proof valid if they trust that it could be expanded into a\nmachine-verifiable proof. A proof's validity can thus become a subjective\nmatter and lead to a debate, which may be difficult to settle. Hence, while the\nconcept of valid proof is well-defined, the process to establish validity is\nitself a complex multi-agent problem.\n We introduce the SPRIG protocol. SPRIG allows agents to propose and verify\nsuccinct and informative proofs in a decentralized fashion; the trust is\nestablished by agents being able to request more details in the proof steps;\ndebates, if they arise, must isolate details of proofs and, if they persist, go\ndown to machine-level details, where they are automatically settled. A\nstructure of bounties and stakes is set to incentivize agents to act in good\nfaith.\n We propose a game-theoretic discussion of SPRIG, showing how agents with\nvarious types of information interact, leading to a proof tree with an\nappropriate level of detail and to the invalidation of wrong proofs, and we\ndiscuss resilience against various attacks. We then analyze a simplified model,\ncharacterize its equilibria and compute the agents' level of trust.\n SPRIG is designed to run as a smart contract on a blockchain platform. This\nallows anonymous agents to participate in the verification debate, and to\ncontribute with their information. The smart contract mediates the\ninteractions, settles debates, and guarantees that bounties and stakes are paid\nas specified.\n SPRIG enables new applications, such as the issuance of bounties for open\nproblems, and the creation of derivatives markets, allowing agents to inject\nmore information pertaining to proofs.\n
Abstract A smart contract is a program executed on a blockchain, based on which many cryptocurrencies are implemented, and is being used for automating transactions. Due to the large amount of money that smart contracts deal with, there is a surging demand for a method that can statically and formally verify them. This tool paper describes our type-based static verification tool Helmholtz for Michelson, which is a statically typed stack-based language for writing smart contracts that are executed on the blockchain platform Tezos. Helmholtz is designed on top of our extension of Michelson’s type system with refinement types. Helmholtz takes a Michelson program annotated with a user-defined specification written in the form of a refinement type as input; it then typechecks the program against the specification based on the refinement type system, discharging the generated verification conditions with the SMT solver Z3. We briefly introduce our refinement type system for the core calculus Mini-Michelson of Michelson, which incorporates the characteristic features such as compound datatypes (e.g., lists and pairs), higher-order functions, and invocation of another contract. Helmholtz successfully verifies several practical Michelson programs, including one that transfers money to an account and that checks a digital signature.
Abstract We condense the theory of UTxO blockchains down to a simple and compact set of four type equations (Idealised EUTxO), and to an algebraic characterisation (abstract chunk systems), and exhibit an adjoint pair of functors between them. This gives a novel account of the essential mathematical structures underlying blockchain technology, such as Bitcoin.
Many important cryptographic primitives offer probabilistic guarantees of\nsecurity that can be specified as quantitative hyperproperties; these are\nspecifications that stipulate the existence of a certain number of traces in\nthe system satisfying certain constraints. Verification of such hyperproperties\nis extremely challenging because they involve simultaneous reasoning about an\nunbounded number of different traces. In this paper, we introduce a technique\nfor verification of quantitative hyperproperties based on the notion of trace\nenumeration relations. These relations allow us to reduce the problem of\ntrace-counting into one of model-counting of formulas in first-order logic. We\nalso introduce a set of inference rules for machine-checked reasoning about the\nnumber of satisfying solutions to first-order formulas (aka model counting).\nPutting these two components together enables semi-automated verification of\nquantitative hyperproperties on infinite state systems. We use our methodology\nto prove confidentiality of access patterns in Path ORAMs of unbounded size,\nsoundness of a simple interactive zero-knowledge proof protocol as well as\nother applications of quantitative hyperproperties studied in past work.\n
We present "Gasper," a proof-of-stake-based consensus protocol, which is an idealized version of the proposed Ethereum 2.0 beacon chain. The protocol combines Casper FFG, a finality tool, with LMD GHOST, a fork-choice rule. We prove safety, plausible liveness, and probabilistic liveness under different sets of assumptions.
We propose a sociotechnical, yet computational, approach to building decentralized applications that accommodates and exploits blockchain technology. Our architecture incorporates the notion of a declarative, violable contract and enables flexible governance based on formal organizational structures, correctness verification without obstructing autonomy, and a basis for trust.
We put forth a new framework for building pairing-based non-interactive zero-knowledge (\(\mathsf {NIZK}\)) arguments for a wide class of algebraic languages, which are an extension of linear languages, containing disjunctions of linear languages and more. Our approach differs from the Groth-Sahai methodology, in that we rely on pairings to compile a \(\varSigma \)-protocol into a \(\mathsf {NIZK}\). Our framework enjoys a number of interesting features:
conceptual simplicity, parameters derive from the \(\varSigma \)-protocol;
proofs as short as resulting from the Fiat-Shamir heuristic applied to the underlying \(\varSigma \)-protocol;
fully adaptive soundness and perfect zero-knowledge in the common random string model with a single random group element as CRS;
yields simple and efficient two-round, public coin, publicly-verifiable perfect witness-indistinguishable (WI) arguments(ZAPs) in the plain model. To our knowledge, this is the first construction of two-rounds statistical witness-indistinguishable arguments from pairing assumptions.
More details: https://shivarthu.reaudito.com/ Democracy is about fair and equal treatment of everyone in a country. But itbecomes unrealistic to achieve when political parties have their conflict of interest,and leaders don’t have the expertise to make evidence-based policies and neitherhave the skill and manpower for solving problems that surround our society andecosystem. The new fair democracy provides an elegant way of governance thatseparates the representative responsibility according to their specialization and cangrow into any complexity. The governance is divided into various departments, andeach department is supervised by representatives with expertise in the field. Votersneed to have enough knowledge about the departments and their problems, in orderto vote for the selecting representatives of a department. The selection process ofrepresentatives is difficult in and easy out, which allows only serious and utilitarianactors to hold the responsibility, weeding out frivolous ones.
In Bitcoin, if a miner is able to solve a computationally hard problem called proof of work, it will receive an amount of bitcoin as a reward which is the sum of the fees for the transactions included in a block plus an amount inversely proportional to the number of blocks discovered so far. At the moment of writing, the block reward is several orders of magnitude greater than the sum of transaction fees. Usually, miners try to collect the largest reward by including transactions associated with high fees. The main purpose of transaction fees is to prevent network spamming. However, they are also used to prioritize transactions. In order to use the minimum amount of fees, users usually have to find a compromise between fees and urgency of a transaction. In this paper, we develop a probabilistic logic model to experimentally analyze how fees affect confirmation time and miner’s revenue and to predict if an increase of average fees will generate a situation when the miner gets more reward by not following the protocol.
Kakuro is a popular logic puzzle, in which a player fills in all empty squares with digits from 1 to 9 so that the sum of digits in each (horizontal or vertical) line is equal to a given number, called a clue, and digits in each line are all different. In 2016, Bultel, Dreier, Dumas, and Lafourcade proposed a physical zero-knowledge proof protocol for Kakuro using a deck of cards; their proposed protocol enables a prover to convince a verifier that the prover knows the solution of a Kakuro puzzle without revealing any information about the solution. One possible drawback of their protocol would be that the protocol is not perfectly extractable, implying that a prover who does not know the solution can convince a verifier with a small probability; therefore, one has to repeat the protocol to make such an error become negligible. In this paper, to overcome this, we design zero-knowledge proof protocols for Kakuro having perfect extractability property. Our improvement relies on the ideas behind the copy protocols in the field of card-based cryptography. By executing our protocols with a real deck of physical playing cards, humans can practically perform an efficient zero-knowledge proof of knowledge for Kakuro.
Bojan Marinković, Paola Glavan, Zoran Ognjanović, Thomas Studer
Abstract In this paper we provide a strongly complete axiomatization of a temporal epistemic logic in which non-rigid sets of agents are allowed. Using this framework, we prove a number of properties of the blockchain protocol with respect to the given set of axioms and premises.