- Author: Nicolas IOOSS
- Date: 2022-03-04
- Puzzle: https://www.zkhack.dev/puzzleM1.html, https://github.com/kobigurk/zkhack-there-is-something-in-the-AIR
Alice implemented a Semaphore protocol to collect anonymous votes from her friends on various
Alice implemented a Semaphore protocol to collect anonymous votes from her friends on various
It is a well-known fact that
1+1=2
. Recent work by Alice von Trapp (et al) suggests that under special conditions in the Swiss Alps,1+1+1+1=1
. Alice has been unable to prove this statement over the BLS12-381 scalar field. The primary difficulty appears to be the fact that1
is not equal to4
. Alice's proving system can write a proof for every statement(x,y)
wherex
andy
are BLS12-381 scalars, andx+x+x+x=y
. The proving system easily outputs a proof for the statement(1,4)
showing1+1+1+1=4
, but seems unable to produce a proof for the statement(1,1)
showing1+1+1+1=1
. >
Shallan recently found a proof system (see below) that enables proving that two Pedersen commitments commit to the same message (but with potentially different randomness). She employes this in her private cryptocurrency to show that two committed coins have the same value. However, soon after deployment, she receives a message from a self-proclaimed hacker. The message contains two Pedersen commitments and their openings, and a proof of message equality for these commitments. The proof is valid, but there's a twist: the openings contain different messages! How can this be? Reproduce the attack and help Shallan diagnose the problem in her system.
The puzzle is described in GitHub repository https://github.com/kobigurk/zkhack-hidden-in-plain-sight:
The puzzle consists in a Rust project available on https://github.com/kobigurk/zkhack-double-trouble. When running it, the following message is displayed:
#!/usr/bin/env python3 | |
"""Solve zkHack puzzle #2 (https://www.zkhack.dev/puzzle2.html) | |
On https://github.com/kobigurk/zkhack-trusted-setup there is a Rust program | |
which displays: | |
Alice has computed a trusted setup for a Groth16 proof scheme. | |
She decided to use a 128-bit long secret, and she swears that she does not | |
know the secret s needed to get this setup. | |
The trusted setup is constructed as follows using two additional scalars α |
The puzzle consists in a Rust project: