Research MPC ceremony required for Mainnet deployment

[ChaitanyaKonda]

Research

• Approach for MPC ceremony
• Requirements
• Effort in terms of time line

[ChaitanyaKonda]

Definition of Done

• Evaluate if powers of tau can be used for GM17
  • Implementation effort required to add randomness to GM17 setup in Zokrates
• If powers of tau cannot be done with GM17, then implementation effort required to add randomness to Groth 16 setup in Zokrates
  • If this is too hard, effort required to port all of our code to snarkjs (least preferable because huge changes are required)
  • Implementation effort required for malleability solution inside circuits to use Groth16 and making verifier.sol changes for Groth16 verifier
• Once proof system and library are agreed, what are the exact steps requires to do this MPC ceremony and effort required

PS: Effort to be defined in terms of time required

[dwebchapey]

Submitted feature request to Zokrates to integrate MPC ceremony. The integration of Powers of Tau has to be tightly coupled rather than generating MPC based randomness separately and feed that into setup phase because whoever running the setup would see the final randomness and thus have a backdoor.

[dwebchapey]

Alternatively , snarkjs is another js implmentation of zksnark. It supports Groth16 and plonk but not GM17. snarkjs provides tools for conducting trusted setup multi-party ceremonies: including the universal powers of tau ceremony, and the second phase circuit specific ceremonies.

Testing snarkjs Performed MPC phase 1 and phase 2 ceremony and generated keys For 2^21 constraints , each contribution execution took about 16 minutes.

Listing pros and cons of Zokrates and snarkjs for NF3

Zokrates

Pros

1. Support for GM17
2. NF3 circuits are built in zokrates currently

Cons

1. Implementation of setup phase ( initiated feature request in Zokrates)
2. Browser integration to be tested
3. Currently does not support Plonk proving scheme

Snarkjs

Pros

1. Provide tool for Powers of Tau MPC ceremony
2. Browser integration

Cons

1. No support for GM17 , only G16 and Plonk
2. Rebuilt circuits in circom

Also note that moving to Groth16 from GM17 is better for performance if inherent malleability of Groth16 is handled in NF circuits.

Final notes

Best approach for now seem to be integrating MPC setup to Zokrates

[ChaitanyaKonda]

282 will tracks the recommendations suggested here