ZeonTools
What is a Zero-Knowledge Proof (ZKP)?
A Zero-Knowledge Proof (ZKP) is a cryptographic protocol that allows one party (the Prover) to prove to another party (the Verifier) that a specific statement is true, without revealing any additional information beyond the fact that the statement is true.
The Ali Baba Cave Analogy: Imagine a ring-shaped cave with a magical door blocking the back path. The Prover wants to prove to the Verifier they know the secret password to open the door, without telling the Verifier the password. The Verifier stands outside, the Prover enters the cave (left or right path). The Verifier shouts "Come out the left path!". If the Prover knows the password, they can unlock the door and walk out the correct path 100% of the time. If they don't, they only have a 50% chance of guessing correctly. Repeated trials mathematically guarantee knowledge.
The Three Pillars of Cryptography
For a protocol to be considered a true Zero-Knowledge Proof, it must satisfy three strict mathematical properties:
- 1. Completeness: If the statement is true, an honest Verifier will be convinced of this fact by an honest Prover. (The math always adds up for legitimate users).
- 2. Soundness: If the statement is false, no cheating Prover can convince the honest Verifier that it is true, except with some negligible probability. (Try the "Attack Mode" in the sandbox above to see how forged proofs are caught!).
- 3. Zero-Knowledge: If the statement is true, no Verifier learns anything other than the fact that the statement is true. The public packets (
y, r, s) cannot be reverse-engineered to findxdue to the Discrete Logarithm Problem.
The Schnorr Identification Protocol (Interactive)
The sandbox implements the Schnorr Identification Protocol, a fundamental ZKP relying on the hardness of the Discrete Logarithm Problem.
- Keygen: Prover picks secret
xand publishes public keyy = g^x mod p. - Commitment: Prover picks random ephemeral key
kand sends commitmentr = g^k mod p. - Challenge: Verifier sends random challenge
c. - Response: Prover computes
s = k + cx mod (p-1). - Verification: Verifier checks that
g^s ≡ r × y^c mod p.
The Fiat-Shamir Heuristic (Non-Interactive)
The Schnorr protocol requires the Prover and Verifier to be online simultaneously (Interactive). In blockchain (like Ethereum ZK-Rollups), proofs must be verified asynchronously by thousands of nodes.
The Fiat-Shamir Heuristic solves this by replacing Bob's random challenge c with a Cryptographic Hash function: c = Hash(r, message). Since cryptographic hashes are deterministic and one-way, Alice can generate her own "challenge" fairly. She bundles [r, s] into a single succinct proof string. The Verifier simply re-hashes r to find c, and then verifies the math. Switch the sandbox mode above to "Fiat-Shamir" to simulate this!
zk-SNARKs vs zk-STARKs
- zk-SNARKs (Succinct Non-interactive Arguments of Knowledge): Highly succinct (tiny proofs) and fast to verify. Traditionally require a "Trusted Setup" ceremony. Used heavily by Zcash and most Layer-2s.
- zk-STARKs (Scalable Transparent Arguments of Knowledge): Do not require a trusted setup ("transparent"). Rely on hash functions making them theoretically quantum-resistant. However, proof sizes are significantly larger. Used by StarkNet.