Discussing Geppetto solution to aggregate challenges

filecoin-project / rust-fil-proofs

Proofs for Filecoin in Rust

Other

489 stars 314 forks source link

Discussing Geppetto solution to aggregate challenges #186

Closed nicola closed 5 years ago

nicola commented 6 years ago

From Ben: "aggregation just requires setting the field of the second snark to be the order of the curve in the first"

Next steps are:

[ ] set field of second snark
[ ] Write circuit accordingly to Scalable SNARKs paper, SE SNARKs Verifier Gadget, Snarky Verifier Gadget
[x] Check how Geppetto does this

porcuquine commented 6 years ago

@nicola Have we concluded that this is the strategy we will take? If we have decided that, then I think this resolves #157. If we have concluded this, but #157 still requires more investigation into the options enumerated above, can you comment and/or update the issue there to reflect where we are at on the question?

nicola commented 6 years ago

This does not resolve #157 this is one strategy to investigate and step number 1 for both aggregation or recursive composition. We are no further of where we left before, all updates are written on github

porcuquine commented 6 years ago

Got it. Thanks.

lucaniz commented 6 years ago

Hi all,

just talked with Matteo who I knew had to deal with Snarks composition [and then with the problems of sampling the different curves].

He told me he actually did not do it in the end, but talking with Rihad he was pointed to this paper: https://www.shiftleft.org/papers/decaf/decaf.pdf

nicola commented 6 years ago

Adding another pointer here, Dario Fiore at IMDEA mentioned Geppetto

nicola commented 6 years ago

technical name for this in geppetto is: bounded proof bootstrapping

nicola commented 6 years ago

Cocks-Pinch method is the one we should use to find the right curve. Luckily Scippr-lab has an implementation here: https://github.com/scipr-lab/ecfactory/tree/master/ecfactory/cocks_pinch

nicola commented 6 years ago

I am a bit unclear on what the inputs to the Cocks-Pinch algorithm should be:

k = embedding degree = 12? (from zcash blog)
do we want the group order of the second curve to be the prime q=4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559787 ?

nicola commented 5 years ago

Zcash is thinking about his too! https://github.com/zcash/zcash/issues/3425#issuecomment-428011202

nicola commented 5 years ago

r = 52435875175126190479447740508185965837690552500527637822603658699938581184513

dignifiedquire commented 5 years ago

closing this, @nicola please open in a research repo if this still needs work