MatteoFrigo

5 ms·

1.
by MatteoFrigo 4mo ago
A true giant. His algorithm for Pythagorean addition, which computes sqrt(a^2 + b^2) without taking square roots, is a wonderful gem. Fun anecdote about early Matlab. In the '80s, while in high school, I "acquired" the sour
2.
Age verification, child protection and economic power(cyberverso.net)
4 points by MatteoFrigo 6mo ago|0 comments
3.
by MatteoFrigo 7mo ago
ZKP is integrated in Google Wallet and has been running in production for a few months. We (Google) released the ZKP library as open source last year (this is the library used in production). Announcement: https://blog.google&#x
4.
by MatteoFrigo 8mo ago
Here is one way: https://eprint.iacr.org/2024/2010 Our (Google) implementation: https://github.com/google/longfellow-zk An independent implementation by the Internet Security Research Group: http
5.
by MatteoFrigo 9mo ago
Yes. The whole trick is a delicate balance between 1) committing to enough information that uniquely pins down the solution, assuming that one can open all the lock boxes, and 2) not opening too many lock boxes so that the verifier does no
6.
by MatteoFrigo 9mo ago
Yes. However, at some point there needs to be some unforgeable piece of hardware that prevents copying the document. I am a big fan of yubikeys and I wish everybody used them, but the reality is that people lose them way more often than t
7.
by MatteoFrigo 9mo ago
This post is restricted to the context of the European Union and is intended to be factual. The EU age verification app is intended to be a pilot to the EU Digital Identity Wallet (EUDIW), which EU law requires to be deployed everywhere in
8.
by MatteoFrigo 9mo ago
Another excellent question. The current answer in the EU seems to be "you need a phone". My preferred answer (despite being one of the Google guys who designed the ZKP mechanism) would be that the government sends you some sort
9.
by MatteoFrigo 9mo ago
I am someone with "deep knowledge", but HN is not the proper place for this discussion. See https://people.cs.georgetown.edu/jthaler/ProofsArgsAndZK.htm... for the gory details. Here is a hopefully simple ex
10.
by MatteoFrigo 9mo ago
Excellent question. More generally, what prevents me from copying the credential and giving it to somebody else? The currently favored approach works like this. The DOCUMENT contains a device public key DPK. The corresponding secret key
11.
by MatteoFrigo 9mo ago
FWIW, not that it matters, the proper acronyms are EUDI (EU Digital Itentity) and EUDIW (EUDI Wallet). DIW is not used.
12.
by MatteoFrigo 9mo ago
This is, of course, very technical, but here is how it works at a high level. In the non-ZKP presentation, the "holder" (phone) sends the credential to the relying party (website), and the RP executes some verification algorithm.
13.
by MatteoFrigo 9mo ago
https://ageverification.dev/av-doc-technical-specification/d...
14.
by MatteoFrigo 1y ago
I don't dispute your general sentiment that the ZK terminology is abused. However, at least one serious attempt exists to deploy a real ZKP system. Specifically, our system [1] is available as open source [2] and work is underway to i
15.
by MatteoFrigo 1y ago
See https://github.com/google/longfellow-zk
16.
by MatteoFrigo 1y ago
Great question. The current thinking, at least in high level-of-assurance situations, is this. The identity document is only usable in cooperation with a hardware security element. The relying party picks a random nonce and sends it to t
17.
by MatteoFrigo 1y ago
You got it. There are a few nuisances, e.g. the "theorem statement" must be hashed as well so that proving that name=Mickey has a different oracle than proving that name=Goofy, but your basic understanding is correct.
18.
by MatteoFrigo 1y ago
No. ZK has a technical definition I don't want to get into, but note that the described system is deterministic and it always produces the same proof for Alice on a given day, and the proof for a later day can be derived from the proo
19.
by MatteoFrigo 1y ago
See https://github.com/eu-digital-identity-wallet/eudi-doc-archi... for a reference to the nuances on all these topics, at least in the context of the European Union. Other locales have different problems and differen
20.
by MatteoFrigo 1y ago
As the Google guy who did the system, I really don't want to engage in this discussion. I'll just say that the b-systems solve a different problem, and for the problem solved by our system there is currently no other solution avai
21.
by MatteoFrigo 1y ago
The government gives a signed document to natural persons, and the ZK system proves that the document is signed by the government. Bots don't have passports or driver's licenses. How does the government guarantee that the natural
22.
by MatteoFrigo 1y ago
The problem that needs to be solved is, how can a government give you an identity document in a way that you cannot give the document to somebody else. Whether or not this problem needs to be solved is a political question, but it seems li
23.
by MatteoFrigo 1y ago
You are correct. The property that the colluding website and DMV still cannot identify you is called "unlinkability" and as far as I can tell cannot be achieved without zero-knowledge proofs. See https://github.com&#x
24.
by MatteoFrigo 1y ago
The credential ("driver's license") contains a public key whose secret key is stored securely in a hardware secure element. The standard assumption is that the SE is in the phone, but it could be a yubikey or similar device.
25.
by MatteoFrigo 1y ago
> I don't however think this is really the big debate. Rather it's about ensuring SD-JWT and related non-private solutions do not get used. To the extent that this work helps show it's possible, and the tradeoffs are desir
26.
by MatteoFrigo 1y ago
The role of the secure element is only to "bind" the credential to the device, so that if you copy the credential somewhere else then the credential is useless. Concretely, the secure element produces a ECDSA signature that must
27.
by MatteoFrigo 1y ago
Actually I meant blockchain qua blockchain, that is, ledger and consensus. There is no ledger and consensus at all in this system. If people want to redefine blockchain to mean zero-knowledge, and they want to redefine zero-knowledge to me
28.
by MatteoFrigo 1y ago
Jokes aside, I really believe that once all is said and done our system is way simpler than BBS. How are you going to check the document expiration date in BBS? Yes I know about range proofs, I know about the quaternion norms and the four
29.
by MatteoFrigo 1y ago
I hear you. The main problem is how to prevent you from giving your document to somebody else, and things have converged on certified smartphone with security key plus biometrics.
30.
by MatteoFrigo 1y ago
On the contrary, any undergraduate can understand our solution. In contrast, I don't know anybody who can explain the bilinear pairing in BBS.

More ›