You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: report/src/sections/02-background.tex
+51-49Lines changed: 51 additions & 49 deletions
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
\section{Background}\label{sec:background}
2
-
In this section, we provide the necessary background information on Ethereum and a specific attack it is vulnerable to, the Curdleproofs protocol~\cite{Curdleproofs}, and the Whisk protocol~\cite{Whisk2024}
2
+
In this section, we provide the necessary background information on Ethereum and a specific attack it is vulnerable to, the Whisk protocol~\cite{Whisk2024}, and the Curdleproofs protocol~\cite{Curdleproofs} used in Whisk.
3
3
4
4
The notation used throughout this paper can be seen in~\autoref{tab:notation}.
Given a finite, multiplicative cyclic group $\mathbb{G}$ of prime order $p$, the decisional Diffie-Hellman problem is defined as follows: Given $(g^a,g^b,g^c)\in\mathbb{G}$, where $g$ is a generator of $\mathbb{G}$ and $a,b,c\in\mathbb{Z}_p$, decide whether $c=ab$.
Before explaining the protocol, we must mention that Curdleproofs, and hence also Whisk, is a~\gls{zkp} system.
66
+
It is a system that allows a prover to convince a verifier that they know a secret without revealing the secret itself.
67
+
Within the context of Ethereum, it could be the ability to convince someone that a transaction is valid without revealing information about the transaction such as the value of it.
68
+
Whisk uses Curdleproofs to prove the validity of a shuffle.
69
+
70
+
\begin{definition}[Zero-Knowledge Argument of Knowledge]
71
+
An argument $(Setup, P, V)$ is a zero-knowledge argument of knowledge of a relation $\mathbb{R}$ if it satisfies completeness, knowledge-soundness and is honest-verifier zero-knowledge.
72
+
\end{definition}
73
+
74
+
Definitions for knowledge-soundness, completeness, and~\gls{hvzk} can be found in Appendix~\ref{sec:appendix}.
75
+
76
+
Also, two of three proofs that make up Curdleproofs are~\glspl{ipa}.
77
+
These are also~\glspl{zkp}, and will be the focus of this paper.
78
+
Hence, we provide a definition on~\glspl{ipa}.
79
+
80
+
\begin{definition}[Inner Product Argument]
81
+
The argument takes as input two binding vector commitments $C=\mathbf{c}\times\mathbf{g}\in\mathbb{G}$ and $D=\mathbf{d}\times\mathbf{g'}\in\mathbb{G}$ to the vectors $\mathbf{c},\mathbf{d}\in\mathbb{Z}_p^n$ and $z\in\mathbb{Z}_p$.
82
+
The goal is to prove that $z=\mathbf{c}\times\mathbf{d}$.
83
+
The argument has logarithmic communication by halving the dimensions of $\mathbf{c}$ and $\mathbf{d}$ in each iteration.
Ethereum uses a proof-of-stake consensus mechanism, which allows users to validate transactions and create new blocks by staking their Ether (ETH) tokens.
66
-
The Proof-of stake protocol works in epochs of 32 slots, where each slot is 12 seconds long.
87
+
Ethereum uses a~\gls{pos} consensus mechanism, which allows users to validate transactions and create new blocks by staking their~\gls{eth} tokens.
88
+
The~\gls{pos} protocol works in epochs of 32 slots, where slots are 12 seconds long.
67
89
In each slot a proposer is chosen to propose a block thereby allowing the network to reach consensus on the state of the blockchain.
68
90
69
-
The proposer~\gls{dos} attack is a type of attack that targets the block proposers making them unable to propose blocks.
91
+
The proposer~\gls{dos} attack is a type of attack that targets the block proposers, making them unable to propose blocks.
70
92
An adversary can use the proposer~\gls{dos} attack to prevent a proposer from receiving rewards, gotten from proposing a block, and increase their own rewards~\cite{EthereumSSLE2024}.
71
-
As a response to the proposer~\gls{dos} attack, Ethereum has proposed a new protocol called Whisk~\cite{Whisk2024} as an attempt to mitigate the attack.
93
+
As a response to the proposer~\gls{dos} attack, Ethereum proposed a new protocol called Whisk~\cite{Whisk2024} as an attempt to mitigate the attack.
72
94
An attack on the Ethereum network that was discovered by Heimbach et al.~\cite{heimbach2024deanonymizingethereumvalidatorsp2p} is the deanonymization attack on validators.
73
-
In our preliminary work~\cite{ouroldpaper}, we have shown that the attack is still possible to perform on the Ethereum network, and using the attack, a proposer~\gls{dos} can be performed.
95
+
In our preliminary work~\cite{ouroldpaper}, we show that the attack is still possible to perform on the Ethereum network, and using the attack, a proposer~\gls{dos} can be performed.
74
96
75
97
76
-
Whisk is a~\gls{zk}~\gls{ssle} system that uses a~\gls{zk} argument called Curdleproofs~\cite{Curdleproofs} to verify the correctness of a shuffle without revealing the input or output~\cite{10.1145/3419614.3423258}.
98
+
Whisk is a~\gls{zk}~\gls{ssle} system that uses a~\gls{zk} argument called Curdleproofs~\cite{Curdleproofs} to verify the correctness of a shuffle with size $\ell$without revealing the input or output~\cite{10.1145/3419614.3423258}.
77
99
Whisk works by selecting a list of 16,384 validator trackers and shuffles them over 8,192 slots ($\sim$1 day).
78
100
Then 8,192 proposers are selected from the shuffled list to propose blocks for the next 8,192 slots while a new list is being shuffled.
79
101
This way a new list of proposers is created every day.
The prover first constructs a commitment to the permutation,$\sigma()$, by saying $M=\sigma(1,2,\dots,\ell)\times\mathbf{g}$.
137
-
Then, using the Fiat-Shamir transformation, a challenge,$\mathbf{a}$, from public inputs is constructed, and a new commitment is made from that, $A=\sigma(\mathbf{a})\times\mathbf{g}$.
138
-
The~\gls{sameperm} proof now consists of convincing the verifier that the same permutation was used for constructing commitment$A$ and $M$.
158
+
The prover first constructs a commitment to the permutation,~$\sigma()$, by saying $M=\sigma(1,2,\dots,\ell)\times\mathbf{g}$, where~$\ell$ is the number of shuffled trackers, and $\mathbf{g}$ is a vector of cryptographic generators.
159
+
Then, using the Fiat-Shamir transformation, a challenge,~$\mathbf{a}$, from public inputs is constructed, and a new commitment is made from that, $A=\sigma(\mathbf{a})\times\mathbf{g}$.
160
+
The~\gls{sameperm} proof consists of convincing the verifier that the same permutation was used for constructing the commitments$A$ and $M$.
139
161
To do this, the two commitments are used to construct a polynomial equation.
140
162
Then Neff's trick~\cite{10.1145/501983.502000} is used, which observes that two polynomials are equal iff.\ their roots are the same up to permutation.
141
163
142
-
To prove that, the protocol makes use of a grand product argument.
143
-
To prove that argument, Curdleproofs compiles it down to an~\gls{ipa} by expressing each multiplication of the grand product as its own equation.
144
-
This~\gls{ipa} stems from the protocol originally proposed by Bootle et al.~\cite{cryptoeprint:2016/263,Curdleproofs}
164
+
In order to show this, the protocol makes use of a~\gls{grandprod} argument.
165
+
To prove that argument, Curdleproofs compiles it down to a~\gls{dlipa} by expressing each multiplication of the grand product as its own equation.
166
+
The proof of the~\gls{dlipa} then stems from the protocol originally proposed by Bootle et al.~\cite{cryptoeprint:2016/263,Curdleproofs}
145
167
146
-
Hence, the~\gls{sameperm} proof is done if the prover can prove the~\gls{ipa}.
168
+
Hence, the~\gls{sameperm} proof is done if the prover can prove the~\gls{dlipa}.
147
169
148
170
149
171
The second proof is a~\gls{samemsm} argument.
150
-
The prover should by now have proven the existence of the permutation.
151
-
Now, the goal of the~\gls{samemsm} argument is to prove that the output ciphertext set was constructed with the same permutation, here called multiscalar, committed to in commitment $A$.
152
-
As the multiscalar is a vector this argument is an~\gls{ipa} by nature, contrary to the~\gls{sameperm} argument.
172
+
The prover has proven the existence of the permutation.
173
+
Now, the goal of the~\gls{samemsm} argument is to prove that the output ciphertext set was constructed with the same permutation, $\sigma$, here called multiscalar $\mathbf{v}$\footnote{Denoted as $\mathbf{c}$ in the Curdleproofs paper but changed for readability}, committed to in commitment $A$.
174
+
Note, therefore, that $A$ in~\gls{sameperm} and~\gls{samemsm} is the same commitment, where $\mathbf{v}=\sigma(\mathbf{a})$
175
+
As the multiscalar is a vector, this argument is an~\gls{ipa} by nature, contrary to the~\gls{sameperm} argument.
153
176
154
177
The third proof is a Same Scalar argument.
155
178
To mask the ciphertexts, each prover, besides permuting the set, multiplies all ciphertexts by a scalar, $k$.
156
179
This is for randomization purposes, making it harder for adversaries to track the ciphertexts~\cite{Whisk2024}.
157
180
Also, all validators are still able to open their commitments if they are chosen as block proposers, even after several randomizations.
158
-
So, the goal of the Same Scalar argument is to prove the existence of the scalar,~$k$, such that the commitment of the permuted set is equal to the commitment of the pre-permuted set multiplied by $k$.
181
+
Therefore, the goal of the Same Scalar argument is to prove the existence of the scalar,~$k$, such that the commitment of the permuted set is equal to the commitment of the pre-permuted set multiplied by $k$.
Curdleproofs is a~\gls{zkp} system, which means that it allows a prover to convince a verifier that they know a secret without revealing the secret itself.
164
-
Within the context of Ethereum, it could be the ability to convince someone that a transaction is valid without revealing information about the transaction such as the value of it.
165
-
In Whisk, it uses Curdleproofs to prove the validity of a shuffle.
166
-
167
-
\begin{definition}[Zero-Knowledge Argument of Knowledge]
168
-
An argument $(Setup, P, V)$ is a zero-knowledge argument of knowledge of a relation $\mathbb{R}$ if it satisfies completeness, knowledge-soundness and is honest-verifier zero-knowledge.
169
-
\end{definition}
170
-
171
-
Definitions for knowledge-soundness, completeness, and~\gls{hvzk} can be found in~\autoref{sec:appendix}.
172
-
173
-
Two of the three proofs in Curdleproofs are~\glspl{ipa}.
174
-
These are also~\glspl{zkp}, and will be the focus of this paper.
175
-
Hence, we provide a definition on~\glspl{ipa}.
176
-
177
-
\begin{definition}[Inner Product Argument]
178
-
Takes as input two binding vector commitments $C=\mathbf{c}\times\mathbf{G}\in\mathbb{G}$ and $D=\mathbf{d}\times\mathbf{G'}\in\mathbb{G}$ to the vectors $\mathbf{c},\mathbf{d}\in\mathbb{Z}_p^n$ and $z\in\mathbb{Z}_p$.
179
-
The goal is to prove that $z=\mathbf{c}\times\mathbf{d}$.
180
-
The argument has logarithmic communication by halving the dimensions of $\mathbf{c}$ and $\mathbf{d}$ in each iteration.
181
-
\end{definition}
184
+
In Chapter 6 of Curdleproofs~\cite{Curdleproofs} they explain that the proof has size~$18+10\log(\ell+4)\mathbb{G}$, $7\mathbb{F}$, where $\mathbb{G}$ is a cryptographic group point, and $\mathbb{F}$ is a field element.
In Chapter 6 of Curdleproofs~\cite{Curdleproofs}, they explain the efficiency of the protocol, including also the size of the proof.
185
-
They specifically mention that the proof has size~$18+10\log(\ell+4)\mathbb{G}$, $7\mathbb{F}$.
186
-
As the proof size is dependent on the size of the shuffle,~$\ell$, an interest in the possibility of reducing this parameter arises.
187
-
The current proposal of Curdleproofs only works on shuffles, where the size is a power of 2.
188
-
The reason is that the underlying proofs, such as the~\gls{ipa}, need to fold recursively down to 1, by halving the size in every round.
187
+
The current proposal of Curdleproofs only works when the shuffle size of Whisk is set to a power of 2.
188
+
The reason is that the underlying proofs,~\gls{dlipa} in~\gls{sameperm} and~\gls{samemsm}, need to fold recursively down to 1, by halving the size in every round.
189
+
With the current shuffling size being 128, being able to choose the size more flexibly could lead to both performance and size gains.
190
+
The problem we study in this article is therefore how to extend Curdleproofs to~$\ell$ values that are not a power of 2.
One of these is Bulletproofs+~\cite{chung2022bulletproofs+} which uses a weighted inner product argument instead of the standard inner product argument to achieve a better performance.
49
49
Bulletproofs+ is also a zero-knowledge proof by itself unlike the original bulletproofs.
50
50
Trying to modify Curdleproofs with the weighted inner product argument introduces complications that would need larger modifications and is therefore not suitable.
51
-
This can be seen in~\autoref{sec:curdleproofs-weighted-inner-product-argument-modification-attempt}
51
+
This can be seen in Appendix~\ref{app:curdleproofs-weighted-inner-product-argument-modification-attempt}
52
52
53
53
A third version of the Bulletproofs protocol is Bulletproofs++~\cite{eagen2024bulletproofs++} which uses a new type of argument called the norm argument to achieve a better performance.
54
54
This comes from the prover only needing to commit to a single vector, rather than two.
If we can reduce the shuffle size used in Whisk and still prove it secure, then we expect to see some reduction in the size overhead on the blockchain.
403
403
404
404
We first set our focus on Curdleproofs, as this is the protocol we have modified directly.
405
-
As mentioned in~\autoref{sec:background-zkps}, the size of Curdleproofs is $18+10\log(\ell+4)\mathbb{G}$, $7\mathbb{F}$.
405
+
As mentioned in~\autoref{subsec:related-work-whisk}, the size of Curdleproofs is $18+10\log(\ell+4)\mathbb{G}$, $7\mathbb{F}$.
406
406
The dependence on the $\log$ stems from the number of recursive rounds that take place in the~\gls{sameperm} and~\gls{samemsm} proofs.
407
407
The addition of four elements in the $\log$ stems from the protocol needing those as blinders.
408
408
Hence, at a proof of size 128, $\ell$ is 124.
409
-
In the proof of theorem 1, we show CAAUrdleproofs to be $\mathcal{O}(\log n)$.
409
+
In the proof of theorem 1, see Appendix~\ref{sec:appendix-thm1proof}, we show that CAAUrdleproofs is $\mathcal{O}(\log n)$, which is the same as Curdleproofs.
410
+
However, as discussed in~\autoref{subsec:approach-CAAUrdleproofs}, CAAUrdleproofs'~\gls{ipa} proofs use $\lceil\log n \rceil$ recursive rounds.
410
411
This means that the size of CAAUrdleproofs must be $18+10\lceil\log(\ell+4)\rceil\mathbb{G}$, $7\mathbb{F}$.
411
412
412
413
CAAUrdleproofs therefore has the same proof size as Curdleproofs.
413
414
414
415
The CAAUrdleproofs modification can still reduce the overall block size overhead, though.
415
-
Using Whisk with CAAUrdleproofs has a block size of $16.656$ KB, when the shuffle size is 128\cite{Whisk2024}.
416
+
By using the overhead calculation described by Whisk on CAAUrdleproofs, it measures a block overhead of $16.656$ KB, when the shuffle size is 128~\cite{Whisk2024}.
416
417
Note that this is the same size as Curdleproofs, as the shuffle size is a power of 2.
417
-
The calculation of the block size comes from the following, where $\mathbb{G}=48$ bytes and $\mathbb{F}=32$ bytes\footnote{\text{As noted in the code on the Curdleproofs GitHub repository: }\\\href{https://github.com/asn-d6/curdleproofs/blob/main/src/whisk.rs}{https://github.com/asn-d6/curdleproofs/blob/main/src/whisk.rs}. Accessed: 26/05/2025}:
418
+
The provided calculation of the block overhead is provided as the following, where $\mathbb{G}=48$ bytes and $\mathbb{F}=32$ bytes\footnote{\text{As noted in the code on the Curdleproofs GitHub repository: }\\\href{https://github.com/asn-d6/curdleproofs/blob/main/src/whisk.rs}{https://github.com/asn-d6/curdleproofs/blob/main/src/whisk.rs}. Accessed: 26/05/2025}:
418
419
\begin{itemize}
419
420
\item List of shuffled trackers ($\ell\cdot96\Rightarrow\text{eg. }124\cdot96=11,904$ bytes).
\item A fresh tracker (two BLS G1 points $\Rightarrow48\cdot2=96$ bytes).
422
423
\item A new commitment $com(k)$ to the proposer's tracker (one BLS G1 point $\Rightarrow48$ bytes).
423
424
\item A Discrete Logarithm Equivalence Proof on the ownership of the elected proposer commitment (two G1 points, two Fr scalars $\Rightarrow2\cdot48+2\cdot32=160$ bytes).
424
425
\end{itemize}
425
-
The majority of the block size comes from the list of shuffled trackers.
426
-
Hence, using CAAUrdleproofs could majorly decrease the block size by allowing~$\ell$ to be chosen at arbitrary length.
426
+
The majority of the block overhead comes from the list of shuffled trackers.
427
+
Hence, as the list size is heavily dependent on~$\ell$, using CAAUrdleproofs could majorly decrease the block overhead by allowing~$\ell$ to be more flexibly chosen as a smaller size than 128.
Copy file name to clipboardExpand all lines: report/src/sections/06-results.tex
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ \subsection{Proving and Verifying Times}\label{subsec:results:provingverifying}
24
24
Though, this seems to not be the case, at least not as aggressively, when increasing $\ell$ from 128.
25
25
We find, however, that the bump is smaller the higher $\ell$ is.
26
26
27
-
Additional to the proving and verifying times, the time used on shuffling is also lower for any $\ell$ that is not a power of 2; see~\autoref{sec:shuffling-results}.
27
+
Additional to the proving and verifying times, the time used on shuffling is also lower for any $\ell$ that is not a power of 2; see Appendix~\ref{sec:shuffling-results}.
28
28
Though, that was to be expected since CAAUrdleproofs uses the same shuffling algorithm as Curdleproofs, but does not have to add additional padding to the non-power of 2 input sizes.
0 commit comments