0xSachinK / zkp-mooc-notes

Notes of Berkeley ZKP MOOC Course

ZKP MOOC Notes

Introduction

Lecture 1: Introduction and History of ZKP

• Classical proofs
• NP Language
• Zero Knowledge Interactive Proofs
  • Interactive Proofs
  • What is Zero Knowledge?
    • Computational Indistinguishability
• Proof of Knowledge
• All of NP is Zero Knowledge
  • 3-colorable is ZKP
• Fiat-Shamir paradigm

Lecture 2: Overview of Modern SNARK Constructions

• Arithmetic circuit
• NARK (Non-interactive Argument of Knowledge)
• Succinct NARK (SNARK)
  • Knowledge Soundness
• Types of preprocessing Setup
• Building an efficient SNARK
• Commitments
• Functional commitment scheme
• Four types of functional commitments
• Polynomial commitment scheme (PCS)
  • Types of PCS
• Interactive Oracle Proof
  • Example IOP
• Types of IOP

Lecture 3: Libraries and Compilers to build ZKP

• This was a more hands-on lecture with live coding. So, I don't have notes for this.
• You can watch the lecture video itself.
• And read the following docs:
  • Circom
  • Wouldn't suggest reading Arkworks and ZoKrates docs. I believe they are not in active development.

Polynomial IOPs

Lecture 4: Interactive Proofs (IP)

• Interactive Proofs
• SNARKs from IP: Outline
• IP design: Technical primitives
  • SZDL Lemma
  • Low-degree and multilinear extensions
  • Langrange interpolation
• The Sum-check protocol
  • Costs of the sum-check protocol
• Polynomial IOP underlying the SNARK
  • Step 1
  • Step 2

Lecture 5: Plonk Interactive Oracle Proofs (IOP)

• KZG PCS
  • Properties of KZG
• Proof gadgets
  • Polynomial equality testing with KZG
  • Important proof gadgets for univariates
  • Vanishing polynomial
  • Zero test
  • Product check
  • Permutation check
  • Prescribed permutation check
• PLONK IOP
  • Step 0 (Witness Generations)
  • Step 1 (Arithmetization)
  • Step 2 (Proving validity of T)
    • Proving 1: T encodeds the correct inputs
    • Proving 2: Every gate is evaluated correctly
    • Proving 3: The wiring is correct
• PLONK is a SNARK
• HyperPlonk
• A generalization: plonkish arithmetization
• Plonk IOP with other PCS

Polynomial Commitments

Lecture 6: Discrete-log-based Polynomial Commitments

• Generic construction of a polynomial commitment
• Background
  • Group
  • Generator of a group
  • Discrete Logarithm (DLOG) Assumption
  • Diffie-Hellman assumption
  • Billinear pairing
    • Example of billinear pairing: BLS Signature
• KZG polynomial commitment
  • Properties
  • Trusted setup ceremony
• Variants of KZG Polynomial Commitment
  • Multivariate poly-commit
  • Achieving Zero Knowledge
  • Batch opening: single polynomial
  • Batch opening: multiple polynomials
• Polynomial commitments based on discrete-log