A survey on SNARKs
Carla Ràfols

Elliptic Curve Cryptography, Bochum, December 3rd

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

What are ZK Proofs?
2

5
2

8
3

1
3

9

6

7

1

6

2

7

5 4

1 9

9
2
1

4
8
1
9
5
6
7
2
3

6

3
8
9

8
4
7

7
6

x=“Unsolved Sudoku”

2
5
3
7
4
8
9
6
1

6
7
9
1
3
2
4
5
8

5
2
4
3
7
1
6
8
9

7
9
6
8
2
4
3
1
5

1
3
8
5
6
9
2
4
7

3
1
2
6
8
7
5
9
4

9
4
7
2
1
5
8
3
6

8
6
5
4
9
3
1
7
2

w=“Solved Sudoku”
Proof

Accept or Reject

Victor: x

Peggy: ( x, w)

A process in which a prover probabilistically convinces a verifier of the correctnessof a mathematical proposition, and the verifier learns nothing else.
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

What are ZK Proofs?
ww = ( p, q)

x = CircuitSat = (There exists w s.t. C (w) = 1)
x = (There exist ( p, q) s.t. N = pq)
x= (I know sk)

sk

x is true (x ∈ L)
Accept or Reject

Victor: x

Peggy: ( x, w)

A process in which a prover probabilistically convinces a verifier of the correctnessof a mathematical proposition, and the verifier learns nothing else.
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Applications

Proof that > 18

Movie DB

Movie
Mixingin E-voting

Anonymous
Credentials

Anonymous
Financial Transactions

In a dream world zero-knowledge solves all your privacy concerns: keep your dataand prove you have played by the rules.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Applications: Verifiable ComputationÆF (data) =??

y = F (data) + proof,

Check correctness of computation without downloading data.
In some applications “Proof”(not Zero-Knowledge) sufficient (the case whenskPeggy = ∅.)Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

What is a “good” ZK Proof
Performance measured in different parameters.
πb ∈ {0, 1}

Victor: x

Peggy: ( x, w)

Expressivity.
Prover complexity/ Verifier complexity.
Proof size.
Weaker/ Stronger Computational assumptions.
Need for a trusted Setup.
Amount of interaction.
Of Knowledge.
Private vs Public Verification...

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

What is a “good” ZK Proof
Performance measured in different parameters.
πb ∈ {0, 1}

Victor: x

Peggy: ( x, w)

Expressivity.
Prover complexity/ Verifier complexity.
Proof size.
Weaker/ Stronger Computational assumptions.
With/without Common Reference String.
Amount of interaction. Non-interactive.
Of Knowledge.
Private vs Public Verification...

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Properties of ZKProofsπb ∈ {0, 1}

Victor: x

Peggy: ( x, w)

Completeness. If Peggy and Victor behave honestly, the proof will be
accepted.
Soundness. Peggy cannot prove false statements.
Zero-Knowledge. Victor learns nothing beyond the truth of the statement.
Of Knowledge. Victor is conviced that the prover knows a witness for thestatement being true.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Formalizing Zero-Knowledge in the CRS modelππb ∈ {0, 1}

b ∈ {0, 1}

Peggy: (CRS, x, w)

Victor: (CRS, x )Simulator: (CRS, x, τ )Victor: (CRS, x )Setting: Common Reference String setting, Non-Interactive.
In the (trusted) Setup phase, the common reference string CRS is generated
with a trapdoor τ.
Real and simulated setting indistinguishable.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Expressivity: Specific Statements

Until recently “practical ZK”was limited to non NP complete languages.

t

st a

Po

ls

Mixingin E-voting

Encryptionx = (( g, g a , gb , gc )is a DH tuple )x = (C1 and C2 have same plaintext)

Carla Ràfols

ZKProofs

DigitalSignaturesw = ( a, b)
w = (r1 , r2 )Elliptic Curve Cryptography, Bochum, December 3rd

Expressivity: General Languages until 2009

CircuitSat naturally encodes computation. It is also the “standard”NP complete problem
for ZKProofs.

Proof size is always (at least) linear in the witness size.
except proofs that use PCP Theorem, non-interactive in the RO([Kilian92],[Micali00]..)Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

PCP-based proofs: General Proof Strategy(very simplified)

Theorem (PCP Theorem)
NP = PCP(O(1), O(log n)) (probabilistically checkable proofs with O(1) queries
and log n randomness).

Commit to Π
i1 , . . . , i k
π i1 , . . . , π i kAccept or Reject
Victor: x

Peggy: ( x, w)
It was not a practical approach, but proofs were succinct.
Non-interactive in RO [Micali00].
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

The Hunting of the (practical) SNARK
Succint Non-Interactive Arguments of Knowledge

We have sailed many weeks, we have sailed many days,(Seven days to the week I allow),
But a Snark, on the which we might lovingly gaze,
We have never beheld till now!
L. Carroll
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

ZK Proofs History: The Hunting of the SNARK
1989 – Interactive Proof-Systems [GMR89]– (...)
2010 – Groth. Succinct argument without PCPs (42 bilinear group elements)
2013 –

QAPs: ZK friendly characterization of NP, linear CRS [GGPR13]
Implementation: Pinocchio: Nearly Practical Verifiable Computation” [PGH2014 – ZeroCash
2016 – Groth. Most efficient zk-SNARK (3 bilinear group elements).... – and so much more...
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARKs: Technical core

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Overview (not so far from PCPs, after all)Information Theoretic Step.
Circuit, ~aRank 1 Constraint
System

→L, R, O s.t.
~a satisfies circuit~a> L ◦~a> R = ~a> O→

Quadratic Arithmetic
Programt( x ), {vi ( x ), wi ( x ), yi ( x )}i s.t.
~a satisfies circuit ⇔ t( x ) divides(∑i ai vi ( x )) (∑i ai wi ( x ))− ∑i ai yi ( x )Computational Step.

Quadratic Arithmetic Programt( x ), {vi ( x ), wi ( x ), yi ( x )}i

Carla Ràfols

ZKProofs

SNARK
Compiler−−−−−−→

CRS, πElliptic Curve Cryptography, Bochum, December 3rd

Examplea6

×a5
a5 = (2a2 )( a3 + a4 )

×
×2

+
a1

a2

Carla Ràfols+
a3

a6 = ( a1 + a2 ) a5
a4

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Examplea6

×a5
a5 = (2a2 )( a3 + a4 )

×
×2

+
a1

a2

 
a1
 a2 
 
 a3 
~a = 
 a4  , L =  a5 
a6+

a6 = ( a1 + a2 ) a5

a3

a4

 a5
0
 2

 0

 0

 0
0

a6 
1
1 

0 
 ,R=
0 

0 
0

 a5
0
 0

 1

 1

 0
0

a6 
0
0 

0 
 O=
0 

1 
0

 a5
0
 0

 0

 0

 1
0

a6 
0
0 

0 

0 

0 
1

~a> L ◦~a> R = ~a> O ⇐⇒ (2a2 , a1 + a2 ) ◦ ( a3 + a4 , a5 ) = ( a5 , a6 )Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Example~a> L ◦~a> R = ~a> O ⇐⇒ (2a2 , a1 + a2 ) ◦ ( a3 + a4 , a5 ) = ( a5 , a6 )v1 (r1 )..
L=
.
v6 (r1 )
v1 (r2 )w1 ( r 1 )


..
..
, R = .
.


w1 ( r 2 )

..

.

v6 (r2 )w6 ( r 2 )O=

y1 (r1 )..
.

w6 ( r 1 )
y1 (r2 )..
.

y6 (r1 )y6 (r2 )~a> L ◦ ~a> R = ~a> O ⇐⇒(∑ ai vi (r1 ), ∑ ai vi (r2 )) ◦ (∑ ai wi (r1 ), ∑ ai wi (r2 )) = (∑ ai yi (r1 ), ∑ ai yi (r2 ))⇐⇒ (∑ ai vi ( X ))(∑ ai wi ( X )) − (∑ ai yi ( X )) is divisible by ( x − r1 )( x − r2 )Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

QAP
Definition
A quadratic arithmetic program consists of some polynomials{vi ( x )}in=0 , {wi ( x )}in=0 , {yi ( x )}in=0 and t( x ). A vector ~a is accepted by the QAP
iff


 

t( x ) divides v0 ( x ) + ∑ ai vi ( X ) w0 ( x ) + ∑ ai wi ( X ) − y0 ( x ) + ∑ ai yi ( X ) .

We have seen how to construct a QAP such that ~a is accepted if and only if
it satisfies the circuit.
Polynomials can be computed from circuit description.
Degree of the polynomial: number of gates, number of polynomials: input +gates.
Idea for succinctness: check equality at a single evaluation point!!

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Bilinear map or Pairing

Implicit notation: [ a]i = aPi .

Definition
G1 , G2 , GT cyclic groups of order p where DLOG is hard, P1 , P2 generators of
G1 , G2 respectively, e : G1 × G2 → GT is a non-degenerate bilinear map (orpairing) if
for all ([α]1 , [ β]2 ) ∈ G1 × G2 ,e([α]1 , [ β]2 ) = e(P1 , P2 )αβ (Bilinearity),e([α]1 , [ β]2 ) 6= 1GT (Non-degeneracy)

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd(Bilinear) groups: What can we efficiently do?
(Recall: Implicit notation: [ a] = aP , group of order p).
Essentially all we can efficiently do: given [ x1 ], . . . , [ xn ], computecombinations with known linear coefficients ci ∈ Z p :∑ ci [ xi ] .
In particular, given some element [ p(s)] a polynomial p( X ) with known
coefficients ci ∈ Z p , and [1], [s], . . . , [sq ]:If p( X ) is divisible by t( X ): [ p(s)/t(s)] easy to compute.
h( X ) := p( X )/t( X ),[ p(s)/t(s)]1 = ∑ hi [si ].

If p( X ) is not divisible by t( X ): [ p(s)/t(s)] hard to compute (q-Strong Diffie
Hellman type of assumption).

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARK construction (an abstraction of[ParGenHowRay13])
Setup: Chooses s ← Z p , evaluates t(s), {vi (s), wi (s), yi (s)}i and appends[t(s)]1,2 , [vi (s)]1 , [wi (s)]2 , [yi (s)]1 , [si ] to CRS.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARK construction (an abstraction of[ParGenHowRay13])
Setup: Chooses s ← Z p , evaluates t(s), {vi (s), wi (s), yi (s)}i and appends[t(s)]1,2 , [vi (s)]1 , [wi (s)]2 , [yi (s)]1 , [si ] to CRS.
Prover (CRS, ~a): Samples δ1 , δ2 , δ3 ← Z∗p , combining elements of CRS computes:
V = [∑ ai vi (s)+δ1 t(s)]1

W = [∑ ai wi (s)+δ2 t(s)]2 ,Y = [∑ ai yi (s)+δ3 t(s)], and1

2

A proof H that divisibility relation holds at point s.
1H=[(∑ ai vi (s))(∑ ai wi (s)) − ∑ ai yi (s)+(δ1 δ2 − δ3 )t(s) ]1 ,t(s)A proof Π that V, W, Y are well formed, in “span” of {vi (s)} (resp. {wi (s)},{yi (s)} for same witness.)

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARK construction (an abstraction of[ParGenHowRay13])
Setup: Chooses s ← Z p , evaluates t(s), {vi (s), wi (s), yi (s)}i and appends[t(s)]1,2 , [vi (s)]1 , [wi (s)]2 , [yi (s)]1 , [si ] to CRS.
Prover (CRS, ~a): Samples δ1 , δ2 , δ3 ← Z∗p , combining elements of CRS computes:
V = [∑ ai vi (s)+δ1 t(s)]1

W = [∑ ai wi (s)+δ2 t(s)]2 ,Y = [∑ ai yi (s)+δ3 t(s)], and1

2

A proof H that divisibility relation holds at point s.
1H=[(∑ ai vi (s))(∑ ai wi (s)) − ∑ ai yi (s)+(δ1 δ2 − δ3 )t(s) ]1 ,t(s)A proof Π that V, W, Y are well formed, in “span” of {vi (s)} (resp. {wi (s)},{yi (s)} for same witness.)

Verifier (CRS, H, V, W, Y):
1 Checks divisibility at point s using pairings.
?

Carla Ràfols

1e( H, [t(s)]2 ) =e(V, W )e(Y, [1Elliptic]2 )−Curve. Cryptography, Bochum, December 3rd
ZKProofs

SNARK construction: Security

Perfect Zero-Knowledge: Randomization! (proof distribution is uniform
conditioned on being accepted by Verifier.)
Soundness:
1

Extract a “witness candidate”~a from proof of well formedness, i.e.
V = ∑ a i v i ( s ),2

W = ∑ a i wi ( s )Y = ∑ a i y i ( s ),If adversary breaks soundness, p( X ) = (∑ ai vi ( X ))(∑ ai wi ( X )) − (∑ ai yi ( X ))not divisible by t( X ), but adversary has computed p(s)/t(s) in the exponent!!

Step 2 is standard (q-Strong DH type). Step 1?

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARK construction: Security II
Proof that V (resp. W, Y) is in the span of {vi (s)} (resp. wi (s), yi (s))
include in CRS : {[αvi (s)]1 }, [α]2Prover: V 0 = αV
Verifier:?

e(V, [1]2 ) = e(V 0 , [α]2 ).

Definition (q-Power Knowledge of Exponent Assumption)
For every PPT A which, on input [1]1 , [s]1 , . . . , [sq ]1 and[α]1 , [α]2 , [αs]1 , . . . , [αsq ]1 , outputs V, αV ∈ G1 , there exists a PPT extractor
which outputs a1 , . . . , aq ∈ Z p such that V = ∑ ai si .
Non-falsifiable Assumption. Black-box extraction is information theoretically
impossible, would also mean the SNARKs contradict known impossibility results(e.g. [GenWic11])

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Remarks

Construction generalizes to case where some a1 , . . . , a` are public (provercomputes the secret part of U, V, W, verifier computes public part.)
Simulation: given s ∈ Z p , we can simulate any proof by dividing by t(s)!!
Best zk-SNARK construction by Groth 2016 based on similar ideas.
n Circuit size, ` public inputs,
Prover computation O(n log n).
Verifier’s computation 3 Pairings + O(`) exponentiations.
Size of Common Reference String linear in n.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARKs and Verifiable Computation: A dream come true?

ÆF (data) =??

y = F (data) + proof,

The problem of Verifiable Computation

Pinocchio: First nearly practical solution

PROOF is very short, superefficient to verify
Succinct = independent of F’s size.
Not much faster than local computation, but pays off in applications where
Zero-Knowledge is necessary.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

ZeroCash [BenChiGarGreMieTroVir14]

2014 First cryptocurrency to use ZK-SNARKs to provide anonymity with
zk-SNARKs.
Bitcoin with a privacy layer, allowing shielded transactions.
Essential to have very fast verification.
Really important push towards practical zero-knowledge.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

ZCash Circuit1

A circuit of roughly 2 million gates, encoding complex cryptographic
operations (like hashing, opening commitments, etc.)
JubJub a curve specially designed to be “circuit friendly”: exponentiation in
curve described as quadratic constraints (≈ 4,2) for bit of the exponent.
1 Slide from E. Tromer,
http://www.cs.tau.ac.il/ tromer/istvr1516-files/lecture12-verified-computation.pdf
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Industrial Interest and Other Applications

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Open Problems and Research
Directions

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Main Weaknesses of SNARKs

Setup: Trusted and Circuit Dependent.
Very long common reference string.
Slow prover.
Very strong assumptions.
Models computations as circuits.
Only known instantiations in bilinear groups (not postquantum).

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

In the CRS generator we trust...

Z. Wilcox (ZCash) on his knees destroying a computer after parameter generation.

SNARKs require a trusted party to generate the parameters.
Knowledge of randomness to generate parameters: complete failure.
Solution: distribute trust.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARKs: Improving Parameter Generation[GroKohMalMeiMie18]
a

b

c

d

a

c

b

Multiparty Computation ModeldUpdatable Model

Generate an updatable common reference string phase.
Updatable Model: for soundness it suffices that one party is honest, and CRS
can always be updated NI.
In [BowGabMie17]: after a trusted setup phase to generate [s], [s2 ], . . . , [sq ],circuit dependent setup is updatable.
Single phase updatability??
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

The Single Phase Updatability Race
a

b

c

d

a

b

Multiparty Computation ModelcdUpdatable Model

Groth et al. Crypto 2018
Maller et al. Sonic (ACM CCS 2019).
Marlin.
AuroraLight
Plonk
Supersonic...

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

SNARK Alternatives2

Bulletproofs interactive proofs with logarithmic round complexity based on
DL, Hyrax and Libra build on double efficient IP of [GolKalRot08]; Ligero,Stark, Aurora: hash-based.
No Setup = public or transparent setup.
Even asymptotically, far from SNARKs in proof size and verification.
2 Table from Xie et al. Libra: Succinct Zero-Knowledge Proofs with Optimal Prover,
Crypto’19.
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd¿Succintness with standard
assumptions?

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Succinct Arguments under Standard Assumptions

Can we find NIZK Arguments for CircuitSat (proving that there is somesecret w such that C (w) = 1),
or Arguments for proving that C (w) is the correct evaluation of C at somepublic value w,
which are non-interactive, publicly verifiable, based on standard assumptions(no Random Oracle, nor knowledge of exponent type)with efficient verifier? (more efficient than evaluating C)
with “small” proof?

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Arguments under Standard Assumptions
Can we find NIZK Arguments for CircuitSat (proving that there is somesecret w such that C (w) = 1), NP Complete.
or Arguments for proving that C (w) is the correct evaluation of C at somepublic value w, in P.
which are non-interactive, publicly verifiable, based on standard assumptions(no Random Oracle, nor knowledge of exponent type)with efficient verifier? (more efficient than evaluating C)
with “small” proof?
When w is secret, best to expect: O(|input|) !!!

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

NIZK Proofs under Standard Assumptions
Until recently3 , all such NIZK proofs for CircuitSat are linear in number of all
wires.
Except trivial solutions using FHE (where verifier evaluates the circuit).
Commit to input and all wires, for each gate show that one quadratic
equation is satisfied.
Gap with best to expect: O(|input|).

When input is public (as in verifiable computation), no known scheme (withpubl. verif., standard assumptions, NI, sublinear verification4 )3 Katsumata et al. at Crypto’19 give proofs of O (|input |) for Circuits in NC .
1
4 Except concurrent work of Canetti et al. (eprint IACR) using some form of FHE, Kalai et al.

STOC’19. for general computations.
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Our Results5
A proof for Correct Arithmetic and Boolean Circuit Evaluation of O(d), d
depth (≈ 8d bilinear group elements).
A NIZK proof for boolean CircuitSat of size O(n + d), n input lengt(≈ 2n + 8d bilinear group elements),
Building on SNARK techniques, but removing falsifiable assumptions (plusother technical challenges).

5 A. González and C. Ràfols. Shorter Pairing Based Arguments under Standard

Assumptions. Asiacrypt’19
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Our Results: Starting point
Strategy for achieving linear size: Commit to input and all wires, for eachgate show that one quadratic equation is satisfied.
Can we use SNARK techniques to aggregate some of these proofs?

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Revisiting SNARK Techniques
An abstraction:
SNARK techniques allow you to prove compactly many degree 1 relations (aflat circuit).
Given that you have some advice or knowledge of the witness that adversaryused.
In SNARKs this knowledge comes from knowledge assumption, how can wemove it to standard assumptions?

a5 = (2a2 )( a3 + a4 )×Carla Ràfols

×

• • •

×

ZKProofs×..
.

Elliptic Curve Cryptography, Bochum, December 3rd

Overview: Circuit Level Slicing
Slice circuit into different levels.
In level i we prove many quadratic equations on variables which are theouputs of previous levels.
Main idea: get the knowledge from knowledge of previous levels of the circuitand not from knowledge assumption.

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Quadratic Aggregation with Input Knowledge

Assume we know input assignment used by prover (e.g. Verifiable
Computation, proof of knowledge)
Them, we know consistent assignment at each level.
Idea: when prover evaluates inconsistently, reduction uses honest opening
knowledge to break hard problem.
The proof of soundness has two steps: quadratic knowledge transfer, linear
knowledge transfer (much harder).
Only knowledge of input is necessary!!

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Quadratic Aggregation with Input Knowledge
Proof of O(d) when input is public.
Proof of O(|input| + d) under standard assumptions when input is boolean(e.g. Lifted ElGamal is extractable for plaintexts m ∈ {0, 1}).
Security/efficiency tradeoff for SNARKs: use extractable commitments underknowledge assumptions only for input.
Main weakness: circuit dependent CRS.

Input extracted from extractable commitments when secret, or public.
Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd

Thank you!

Carla Ràfols

ZKProofs

Elliptic Curve Cryptography, Bochum, December 3rd