Zero Knowledge, Privacy and Verifiable Compute
Introduction
This branch builds from commitments and Merkle membership to arithmetic constraints, witnesses, proof systems, verifier contracts, nullifiers, and a privacy-preserving eligibility example.
Why It Matters
A valid proof establishes only the statement encoded by its circuit and public inputs. Under-constrained circuits, encoding mismatch, setup assumptions, replay, metadata, and off-chain dependencies can invalidate broader security or privacy claims.
Mental Model
Write the statement first. The circuit constrains private/public inputs and a witness over a field; a prover produces evidence; a verifier accepts that evidence under a verification key; application logic binds public inputs, domain, freshness, and nullifier state.
Questions This Branch Answers
- What exact statement does the verifier establish?
- Which values are public, private, committed, or leaked through metadata?
- What prevents proof reuse, verifier mismatch, and under-constraint?
Scope
Commitments/Merkle proofs/fields, circuits/constraints/witnesses, SNARK/STARK/commitment contrasts, Circom/snarkjs, Noir/zkVM contrasts, Solidity verifiers/public inputs/gas, nullifiers/membership, and privacy limits.
Out of Scope
New cryptographic constructions, production ceremonies, claims of anonymity, private real-world identity data, proof-market economics, and treating ZK as a substitute for a threat model.
Dependencies
Hashing and modular arithmetic, EVM verification, negative/property tests, and identity/authorization concepts.
Candidate Note Roadmap
commitments-merkle-proofs-and-fields— Build inclusion proofs and field-safe encodings from first principles.arithmetic-circuits-constraints-and-witnesses— Translate a statement into constrained computation.snarks-starks-and-polynomial-commitments— Compare proof assumptions, size, verification, and setup.circom-snarkjs-pipeline— Compile, witness, prove, verify, and export a Solidity verifier locally.noir-and-zkvm-contrasts— Compare developer models without hiding backend assumptions.solidity-verifiers-public-inputs-and-gas— Bind verifier code, key, domain, inputs, and application state.nullifiers-membership-and-private-eligibility— Prove one-use eligibility without disclosing the member record.under-constrained-circuits-and-privacy-limits— Create invalid witnesses and identify non-cryptographic leakage.
Future Project
A ZK Eligibility Registry with synthetic membership commitments, nullifiers, a generated Solidity verifier, invalid-witness/adversarial-input tests, verifier-binding checks, and a metadata privacy review.
Initial Invariants
Valid members can prove the intended statement; invalid witnesses fail; nullifiers are one-use and domain-bound; verifier/public-input encoding matches the circuit; no private attribute is accidentally public.
Initial Threat Model
Under-constrained circuits, toxic or compromised setup, verifier/key mismatch, malformed field encoding, replay across chains/apps/epochs, front-running nullifiers, side channels and metadata leakage, malicious proving tooling, and unavailable provers.
Primary Sources
Proof-system papers and official Circom/snarkjs/Noir/zkVM documentation, verifier references, and the curated map in SOURCES.md.
Connects to: validity rollups, private authorization, and eligibility/privacy boundaries.