libsnark

size of the input there is usually a bound on the number of iterations of a loop. In general the halting problem should stop you from calculating this bound, but in most specific cases I think this would be doable. > none of the good ones are open source or even publicly available at all. I've not used it, but libsnark (https://github.com/scipr-lab/libsnark) seems to have a bunch of utilities to be able to construct programs using various abstractions it provides. But yeah, no compiler. > you are restricted to proving very trivial statements that are of little practical use Agree 100%. I'm more interested in the cool theory behind it (and its ability to compose with systems like Bitcoin) than actual practical uses. This is pretty much my usual attitude towards such things One practical use I can come up with would be to securely sell a decryption key (or really, any kind of key) via Bitcoin. The bitcoin script already lets you do this, however in the process the key would become publicly known. You can use the trick with the pad mentioned at the bottom of the post in conjunction with ZKP. I suspect that writing the verifier for this using something like libsnark wouldn't be too hard, but I don't know for sure. [1]: They work in the sense that it's still possible to prove things using the same algorithm, but it's no longer zero knowledge: many gates will be visited multiple times, so more than one truth table entry will be revealed, which makes it possible to decrypt the gate. The number of times a gate is visited also leaks information.

ctions and even SNARKs will eventually make their way into Bitcoin.

r tried to reproduce them locally for comparison to my own work, but if you are interested in experimenting with verifiable computations, there are two research projects with code available you might want to look at: libSNARK [5,6] and Pepper [7,8]. libSNARK contains a beautifully optimized "backend" for verifiable execution (that is, executing the computation after it's been translated into circuits; see the vnTinyRAM paper [3] for more details). The Pepper project has released a full pipeline (from C program to client/server binaries for verifiable execution) and an independent re-implementation of the TinyRAM and vnTinyRAM systems, but the current execution backend is not as highly optimized as libSNARK's (though this will change in the near future). (Full disclosure: I'm on the Pepper team.) [1] https://eprint.iacr.org/2013/356 [2] https://eprint.iacr.org/2013/507 [3] https://eprint.iacr.org/2013/879 [4] https://eprint.iacr.org/2014/674 [5] http://www.scipr-lab.org/ [6] https://github.com/scipr-lab/libsnark [7] http://www.pepper-project.org [8] https://github.com/pepper-project/pepper/