Given relation R(x,w) (e.g., "C opens to m,r"), the prover generates:
such that the following properties hold:
Recent protocols—Libra, deVirgo, Orion, Pianist—push proof generation to linear time and sub-kilobyte proofs. These advances enable:
If the statement is true and the prover follows the protocol honestly, the verifier will accept the proof with overwhelming probability.
If the statement is false, no cheating prover can convince an honest verifier to accept the proof, except with negligible probability.
The prover constructs a proof π that demonstrates knowledge of the witness w without revealing any information about w itself.
The verifier checks the proof π against the public statement x to ensure the claimed relationship holds without learning the witness.
A simulator can generate proofs that are computationally indistinguishable from real proofs, ensuring no information leakage.
A user transfer from value v to v' proceeds as follows:
Special thanks to the community members and selfless volunteers who contributed reviews, feedback, and technical insights to make this documentation possible.