Advanced security for SNARKs: A survey with Quang Dao
Source: YouTube · a16z crypto · published Sep 20, 2024 · 52:15
Standard SNARK security properties like knowledge soundness and zero knowledge are insufficient for real-world deployments due to malleability attacks, where malicious provers can modify proofs without knowing the witness 4:02. Simulation extractability, a stronger property, prevents such attacks by ensuring every new proof corresponds to a valid witness, enforced via weak unique response 6:12. UC (Universal Composability) security offers even stronger guarantees by ensuring SNARKs remain secure when composed with arbitrary protocols, though it requires straight-line extractors and simulations, which are not yet fully realized in practice 32:23.
Key Takeaways:
• Standard SNARK security properties are insufficient for real-world use due to malleability attacks 4:02
• Simulation extractability prevents malleability by requiring every new proof to have a valid witness, enforced via weak unique response 6:12
• Weak unique response ensures proofs cannot be modified at any point, relying on polynomial commitment schemes and unpredictable queries 21:00
• UC security provides stronger composability guarantees but requires straight-line extractors and simulations, not yet widely achieved in deployed SNARKs 32:23
Modern SNARKs like Groth16, Bulletproofs, and Plonk satisfy simulation extractability, but many deployed SNARKs lack formal proofs, and achieving UC security remains challenging due to reliance on rewinding and non-straight-line simulations.
Sources:
- 4:02 Malleability attacks undermine standard SNARK security in real-worl
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: CISSP Domains. Commonly maps to: Security and Risk Management, Security Architecture and Engineering, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
all right so for the last talk of snark week I'm excited to introduce Quang who's a PhD student at Carnegie melon and our intern for the summer here at a16z so he's uh already produced many strong results in uh both theoretical and applied cryptography and today he's going to tell us about the security properties of snarks that you really want when you deploy them in actual applications and how to show that they have those security properties I'm very honored to be talking here today at the end of snar quiek which has been very exciting for me personally and I hope for you as well so my talk is going to be sort of a survey or overview of the recent Advanced security results for snarks basically uh what sort of security Notions that snarks should satisfy when they're deployed in practice an…