mailman-lists-archive/pipermail/zapps-wg/2017/000015.html

521 lines
28 KiB
HTML

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<TITLE> [zapps-wg] Powers of Tau Ceremony Proposal
</TITLE>
<LINK REL="Index" HREF="/pipermail/zapps-wg/2017/index.html" >
<LINK REL="made" HREF="mailto:zapps-wg%40lists.zfnd.org?Subject=Re%3A%20%5Bzapps-wg%5D%20Powers%20of%20Tau%20Ceremony%20Proposal&In-Reply-To=%3CCACRwLSN%3DHQWra4ZeCY3U-gKyMUWpyVz4_OKJNinxn3W3Chkp0w%40mail.gmail.com%3E">
<META NAME="robots" CONTENT="index,nofollow">
<style type="text/css">
pre {
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
}
</style>
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="000014.html">
<LINK REL="Next" HREF="000016.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[zapps-wg] Powers of Tau Ceremony Proposal</H1>
<B>Matt Drollette</B>
<A HREF="mailto:zapps-wg%40lists.zfnd.org?Subject=Re%3A%20%5Bzapps-wg%5D%20Powers%20of%20Tau%20Ceremony%20Proposal&In-Reply-To=%3CCACRwLSN%3DHQWra4ZeCY3U-gKyMUWpyVz4_OKJNinxn3W3Chkp0w%40mail.gmail.com%3E"
TITLE="[zapps-wg] Powers of Tau Ceremony Proposal">matt at drollette.com
</A><BR>
<I>Sat Nov 11 22:24:30 EST 2017</I>
<P><UL>
<LI>Previous message (by thread): <A HREF="000014.html">[zapps-wg] Powers of Tau Ceremony Proposal
</A></li>
<LI>Next message (by thread): <A HREF="000016.html">[zapps-wg] Powers of Tau Ceremony Proposal
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#15">[ date ]</a>
<a href="thread.html#15">[ thread ]</a>
<a href="subject.html#15">[ subject ]</a>
<a href="author.html#15">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>I'd like to be added to the queue. Happy to go after Cody unless there are
others already lined up.
---
*Matt Drollette*
On Sat, Nov 11, 2017 at 4:31 PM, Sean Bowe via zapps-wg &lt;
<A HREF="/mailman/listinfo/zapps-wg">zapps-wg at lists.z.cash.foundation</A>&gt; wrote:
&gt;<i> Thanks Jared! Awesome! I've verified the contribution and put your
</I>&gt;<i> response file up on the transcript repository.
</I>&gt;<i>
</I>&gt;<i> Can you submit a PR here to fill in more information (including a
</I>&gt;<i> signed attestation):
</I>&gt;<i> <A HREF="https://github.com/ZcashFoundation/powersoftau-">https://github.com/ZcashFoundation/powersoftau-</A>
</I>&gt;<i> attestations/tree/master/0003
</I>&gt;<i>
</I>&gt;<i> Cody Burns is going next.
</I>&gt;<i>
</I>&gt;<i> Sean
</I>&gt;<i>
</I>&gt;<i> On Sat, Nov 11, 2017 at 1:35 PM, Jared Tobin &lt;<A HREF="/mailman/listinfo/zapps-wg">jared at jtobin.io</A>&gt; wrote:
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Hi all, here's my report:
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Powers of Tau Operational Writeup
</I>&gt;<i> &gt; =================================
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Round: 3
</I>&gt;<i> &gt; Date: 2017-11-12
</I>&gt;<i> &gt; Name: Jared Tobin
</I>&gt;<i> &gt; Location: Auckland, NZ
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Challenge:
</I>&gt;<i> &gt; e712fa22f1d027a0b4ce3ef698f26d5cab07c3380e4c24a479a914c85617
</I>&gt;<i> fd1a2960b386cceb5c94718979010a1b7ed8b6145da872f0744e06503bd664fe7283
</I>&gt;<i> &gt; Response:
</I>&gt;<i> &gt; cb48afb82ab4c476ae741633c3eb6643e7700dc7b2b4701af91e3cc93227
</I>&gt;<i> 0b96c375e5f3a5c20c96fac6c9b40a5bba6c956d66f223f090c545c277aa05427757
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Preparation Steps
</I>&gt;<i> &gt; =================
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Being somewhat pressed for time and hardware, I recruited several
</I>&gt;<i> &gt; geographically-distributed volunteers that I know well and trust
</I>&gt;<i> &gt; completely to help me out. In the end, the following volunteers were
</I>&gt;<i> &gt; able to get back to me in time:
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; * Shawn Tobin (RSA Canada)
</I>&gt;<i> &gt; * Fredrik Harryson (Parity Technologies)
</I>&gt;<i> &gt; * Jason Forbes (Kraken Sonar Systems)
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; I set up a private Keybase team with the above volunteers, distributed
</I>&gt;<i> &gt; the challenge to them over KBFS, and gave them instructions over the
</I>&gt;<i> &gt; team chat on how to proceed. Each was to add entropy and compute the
</I>&gt;<i> &gt; response locally using whatever mechanisms they preferred (report not
</I>&gt;<i> &gt; required), then return their response/hash pairs to me over KBFS. Each
</I>&gt;<i> &gt; member was to use the code in Sean's powersoftau repository as of commit
</I>&gt;<i> &gt; 9e1553c437183540392a7231d0788318a19b18a3 to perform the computation.
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Procedure
</I>&gt;<i> &gt; =========
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; I computed a response locally in rather mundane fashion using rustc
</I>&gt;<i> &gt; 1.21.0 on an early-2015 model Macbook Air running Sierra. Eventually
</I>&gt;<i> &gt; the volunteers managed to upload their response/hash pairs to KBFS, and
</I>&gt;<i> &gt; I randomly selected one of the resulting four responses to submit for my
</I>&gt;<i> &gt; piece of the MPC.
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; I uploaded the resulting response via the handy app Sean provided me
</I>&gt;<i> with.
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; Side channel defences
</I>&gt;<i> &gt; =====================
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; I used broad geographical distribution and randomness to mitigate the
</I>&gt;<i> &gt; possibility of successful side channel attacks. Shawn was located in
</I>&gt;<i> &gt; Vancouver, Canada, Fredrik was located in Malm&#246;, Sweden, and Jason was
</I>&gt;<i> &gt; located in St. John's, Canada.
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; I selected the response to upload by pre-determining a correspondence
</I>&gt;<i> &gt; between names and numbers, and then walking outside and asking the first
</I>&gt;<i> &gt; stranger I saw to pick a number between one and four.
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; - jared
</I>&gt;<i> &gt;
</I>&gt;<i> &gt;
</I>&gt;<i> &gt; On Sat, Nov 11, 2017 at 12:25:33AM +0000, Jason Davies via zapps-wg
</I>&gt;<i> wrote:
</I>&gt;<i> &gt;&gt; Hi all,
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Here is my report:
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Powers of Tau Operational Writeup
</I>&gt;<i> &gt;&gt; =================================
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Round: 2
</I>&gt;<i> &gt;&gt; Date: 2017-11-10
</I>&gt;<i> &gt;&gt; Name: Jason Davies
</I>&gt;<i> &gt;&gt; Location: London, UK
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Challenge: 467bc84f6eb98ff956eaf12a1b7ef4dc0aff1093c7a0d5c1dfbdb85bbfff
</I>&gt;<i> b20a43965d0daefee3fec6c1a47af69100e117b44b74371824ac8af1e33b6f91add5
</I>&gt;<i> &gt;&gt; Response: 2f728af894524f55bda7a3e2c2e2db6a57a992811e90ed57456d62aead51
</I>&gt;<i> 06cdc5c97c86532d14b5185cc74d169f1b0c2c0ef1e582231ffa7936da55047c0cb2
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Preparation Steps
</I>&gt;<i> &gt;&gt; =================
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Git repository: <A HREF="https://github.com/ebfull/powersoftau">https://github.com/ebfull/powersoftau</A>
</I>&gt;<i> &gt;&gt; Commit hash: 9e1553c437183540392a7231d0788318a19b18a3
</I>&gt;<i> &gt;&gt; Compiler: rustc 1.23.0-nightly (d6b06c63a 2017-11-09)
</I>&gt;<i> &gt;&gt; Build: cargo build --release --features=u128-support
</I>&gt;<i> &gt;&gt; b2sum(./target/release/compute): be42f68b07c5c857bb6561a9ac2967
</I>&gt;<i> d671ef412a71c87c2fb31776a6ab38c756736de66e554553021e129ecab4
</I>&gt;<i> 5d922092873df8b71bd9a775ec05f189485198
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; I used a brand new 16GB USB stick and loaded ubuntu-17.04-desktop-amd64.iso;
</I>&gt;<i> b2sum: 6a1c975b25b4e7f2dbf4fda84fe8b5de3ed6f4532b8c4f17e533ed11a0a8
</I>&gt;<i> b5b9ad9fb83e8e4b89447c3a427be73f77a5f7c71b7f733fcc4bebf346e9c5c0de43.
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; I reformatted a second brand new 16GB USB stick to ext4, then copied the
</I>&gt;<i> &gt;&gt; `challenge` file and the `target/release/compute` binary.
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Sidechannel Defences
</I>&gt;<i> &gt;&gt; ====================
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; First of all, I lined a large cardboard box with aluminium foil in
</I>&gt;<i> order to
</I>&gt;<i> &gt;&gt; make a rudimentary faraday cage. Then, I assembled an airgap compute
</I>&gt;<i> node
</I>&gt;<i> &gt;&gt; using some relatively cheap parts, putting them all inside the box:
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; * Motherboard: Asus H81 Pro BTC (no radio, bluetooth or speakers AFAIK)
</I>&gt;<i> &gt;&gt; * CPU: Intel G1840
</I>&gt;<i> &gt;&gt; * Ram: 2x cheap 1GB sticks
</I>&gt;<i> &gt;&gt; * PSU: EVGA SuperNOVA 1300 G2
</I>&gt;<i> &gt;&gt; * Monitor: old Dell TFT display
</I>&gt;<i> &gt;&gt; * Keyboard: generic USB keyboard
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; No other peripherals or cables were connected. I placed the compute
</I>&gt;<i> node in my
</I>&gt;<i> &gt;&gt; cellar (~6ft below ground level) and I remained with the node during
</I>&gt;<i> the entire
</I>&gt;<i> &gt;&gt; time it was computing, without using any other devices in the vicinity
</I>&gt;<i> (no
</I>&gt;<i> &gt;&gt; mobile phone etc.) The only cables coming out of the box were the two
</I>&gt;<i> power
</I>&gt;<i> &gt;&gt; cables, one for the PSU and one for the monitor.
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Image: <A HREF="https://pbs.twimg.com/media/DOT55KUXUAEV44-.jpg:large">https://pbs.twimg.com/media/DOT55KUXUAEV44-.jpg:large</A>
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Procedure
</I>&gt;<i> &gt;&gt; =========
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; I booted the node, with &quot;Try Ubuntu&quot; (Live CD mode). Then, I inserted
</I>&gt;<i> the
</I>&gt;<i> &gt;&gt; challenge USB stick and ran `./compute` in the USB media directory,
</I>&gt;<i> entering
</I>&gt;<i> &gt;&gt; some additional entropy as requested by typing randomly on the
</I>&gt;<i> keyboard. The
</I>&gt;<i> &gt;&gt; box lid was only partially opened to allow use of the keyboard and to
</I>&gt;<i> view the
</I>&gt;<i> &gt;&gt; monitor at this point. After 60 minutes had passed, I looked inside
</I>&gt;<i> the lid
</I>&gt;<i> &gt;&gt; and saw that the computation had completed, so I wrote down the BLAKE2b
</I>&gt;<i> hash,
</I>&gt;<i> &gt;&gt; and unmounted and removed the USB stick, and then powered the node down.
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; Postprocessing
</I>&gt;<i> &gt;&gt; ==============
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; I took the USB stick and transferred the response file to my laptop,
</I>&gt;<i> and then
</I>&gt;<i> &gt;&gt; uploaded it using the laptop to S3 via Sean Bowe's transcript site.
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; I did not destroy the compute node but I'm unlikely to use it or plug
</I>&gt;<i> it in for
</I>&gt;<i> &gt;&gt; some time.
</I>&gt;<i> &gt;&gt; --
</I>&gt;<i> &gt;&gt; Jason Davies, <A HREF="https://www.jasondavies.com">https://www.jasondavies.com</A>
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;
</I>&gt;<i> &gt;
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt; On 10 Nov 2017, at 22:11, Sean Bowe via zapps-wg
</I>&gt;<i> &lt;<A HREF="/mailman/listinfo/zapps-wg">zapps-wg at lists.z.cash.foundation</A>&gt; wrote:
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; Thanks Andrew! That's a great start.
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; Now it's Jason Davies' turn.
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; The entire transcript will appear here throughout the process:
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; <A HREF="https://powersoftau-transcript.s3-us-west-2.amazonaws.com/index.html">https://powersoftau-transcript.s3-us-west-2.amazonaws.com/index.html</A>
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; We can make a more formal announcement once we're in the groove and
</I>&gt;<i> &gt;&gt; &gt; everything looks good. We're getting a repo up with attestations soon
</I>&gt;<i> &gt;&gt; &gt; also.
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; Sean
</I>&gt;<i> &gt;&gt; &gt;
</I>&gt;<i> &gt;&gt; &gt; On Fri, Nov 10, 2017 at 12:53 PM, Andrew Miller &lt;<A HREF="/mailman/listinfo/zapps-wg">soc1024 at illinois.edu</A>&gt;
</I>&gt;<i> wrote:
</I>&gt;<i> &gt;&gt; &gt;&gt; OK, I'll go first. Below is my report:
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Powers of Tau Operational writeup
</I>&gt;<i> &gt;&gt; &gt;&gt; =================================
</I>&gt;<i> &gt;&gt; &gt;&gt; Round: 1
</I>&gt;<i> &gt;&gt; &gt;&gt; Date: 2011-11-10
</I>&gt;<i> &gt;&gt; &gt;&gt; Name: Andrew Miller
</I>&gt;<i> &gt;&gt; &gt;&gt; Location: Champaign, Illinois
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Challenge: (genesis)
</I>&gt;<i> &gt;&gt; &gt;&gt; ce00f2100dd876fdff8dd824f55307bcb72d724f29ff20b9e0760f3a65e5
</I>&gt;<i> 588a65eaed57cbc61697111ae1f4cc7da2e62a85311c2ae683a041fb872b891c68dc
</I>&gt;<i> &gt;&gt; &gt;&gt; Response:
</I>&gt;<i> &gt;&gt; &gt;&gt; 15729e0edc4201dc5ee6241437d926f614cb4214ff1b9c6fbd73daf40163
</I>&gt;<i> 9f7a4238cf04bc94edac9f2ad037003daab9a4408ba7c62a4413dc2a0ddd683bd719
</I>&gt;<i> &gt;&gt; &gt;&gt; ./response-2017-11-10-amiller
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Preparation steps
</I>&gt;<i> &gt;&gt; &gt;&gt; =================
</I>&gt;<i> &gt;&gt; &gt;&gt; I used Sean&#8217;s powersoftau rust repo, commit
</I>&gt;<i> &gt;&gt; &gt;&gt; 9e1553c437183540392a7231d0788318a19b18a3
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; I followed instructions online for building portable rust binaries,
</I>&gt;<i> &gt;&gt; &gt;&gt; and so I ran
</I>&gt;<i> &gt;&gt; &gt;&gt; ```
</I>&gt;<i> &gt;&gt; &gt;&gt; cargo build --target=x86_64-unknown-linux-musl --release
</I>&gt;<i> &gt;&gt; &gt;&gt; --features=u128-support --bin=compute
</I>&gt;<i> &gt;&gt; &gt;&gt; ```
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Compiler: rustc 1.23.0-nightly (02004ef78 2017-11-08)
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; I copied the resulting binary to a freshly formatted USB stick I had.
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; b2sum:
</I>&gt;<i> &gt;&gt; &gt;&gt; 9059a0a64f5021c36df630ca48ac40674862b2fea14f4843ff2150256b95
</I>&gt;<i> 162ac4d6d1621d2dd3f5d0d1c604ad8e581c0ff449d2449140380eab075a9b83c960
</I>&gt;<i> &gt;&gt; &gt;&gt; ./target/x86_64-unknown-linux-musl/release/compute
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; I also rummaged through my shelf of several USB sticks, and found one
</I>&gt;<i> &gt;&gt; &gt;&gt; that happened to be a Linux Mint 18 USB bootable disk, so I used that
</I>&gt;<i> &gt;&gt; &gt;&gt; for my operating system.
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Sidechannel defenses
</I>&gt;<i> &gt;&gt; &gt;&gt; ====================
</I>&gt;<i> &gt;&gt; &gt;&gt; I used an airgap compute node, a Dell Inspiron that I&#8217;ve had for
</I>&gt;<i> about
</I>&gt;<i> &gt;&gt; &gt;&gt; a year now (Actually this is a computer I bought last year for
</I>&gt;<i> &gt;&gt; &gt;&gt; dress-rehearsals in the Zcash Sprout param generation ceremony).
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; I unplugged all the computer&#8217;s hard drives, and detached its
</I>&gt;<i> &gt;&gt; &gt;&gt; wifi/bluetooth radios. I booted the computer from the Linux Mint
</I>&gt;<i> &gt;&gt; &gt;&gt; livecd usb stick, and then also copied the binaries into RAM. The
</I>&gt;<i> &gt;&gt; &gt;&gt; compute node was located in my bedroom, and I attended it for the
</I>&gt;<i> ~1hr
</I>&gt;<i> &gt;&gt; &gt;&gt; duration of the compute process.
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Image: <A HREF="https://pbs.twimg.com/media/DOSZz4FXkAEKC7N.jpg:large">https://pbs.twimg.com/media/DOSZz4FXkAEKC7N.jpg:large</A>
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; Postprocessing
</I>&gt;<i> &gt;&gt; &gt;&gt; ==============
</I>&gt;<i> &gt;&gt; &gt;&gt; After compute was finished, I took a cell phone picture of the
</I>&gt;<i> blake2b
</I>&gt;<i> &gt;&gt; &gt;&gt; hash of the response. I then copied the response file to the USB
</I>&gt;<i> stick
</I>&gt;<i> &gt;&gt; &gt;&gt; containing the binaries, and then I unplugged the compute node. Using
</I>&gt;<i> &gt;&gt; &gt;&gt; my personal laptop, I posted the blake2b hash to the #mpc chat and
</I>&gt;<i> &gt;&gt; &gt;&gt; uploaded the response file to s3.
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; The repsonse file is hosted here for now, though I expect we'll
</I>&gt;<i> &gt;&gt; &gt;&gt; mirror it elsewhere later:
</I>&gt;<i> &gt;&gt; &gt;&gt; <A HREF="https://s3.amazonaws.com/socrates1024_a/response-2017-11-10-amiller">https://s3.amazonaws.com/socrates1024_a/response-2017-11-10-amiller</A>
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; I did not destroy the compute node and do plan to use it again,
</I>&gt;<i> &gt;&gt; &gt;&gt; although I'm going to leave it unplugged for several days.
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; On Wed, Nov 8, 2017 at 10:19 PM, Sean Bowe &lt;<A HREF="/mailman/listinfo/zapps-wg">sean at z.cash</A>&gt; wrote:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; Note that the `response` file contains a hash of the `challenge`
</I>&gt;<i> file
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; that was used as input for the compute tool. As a result, only the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; hashes of the `response` files need to be published; a hash chain is
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; formed through all participants. The initial challenge file is
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; deterministic. (You can use the `new` tool on the repository to
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; construct it.)
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; The initial challenge file has BLAKE2b hash:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; ce00f2100dd876fdff8dd824f55307bcb72d724f29ff20b9e0760f3a65e5
</I>&gt;<i> 588a65eaed57cbc61697111ae1f4cc7da2e62a85311c2ae683a041fb872b891c68dc
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; It doesn't hurt to post hashes of everything though. Hash all the
</I>&gt;<i> things.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; Sean
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt; On Wed, Nov 8, 2017 at 4:51 PM, Andrew Miller &lt;<A HREF="/mailman/listinfo/zapps-wg">soc1024 at illinois.edu</A>&gt;
</I>&gt;<i> wrote:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; Thanks Sean!
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; My idea is to use an ad hoc and publicly visible process. &quot;Get in
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; contact with [sean]&quot; could be as simple as posting in public to
</I>&gt;<i> this
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; thread. Unless we're overrun by trolls, a public mailing list can
</I>&gt;<i> be
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; an informal way to agree on who goes next. Whoever posts and says
</I>&gt;<i> &quot;Me,
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; me! I'd like to go next&quot;, should, by convention, go next. Any
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; aberrations (parties taking too long or dropping out, posting
</I>&gt;<i> invalid
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; data, etc., can be dealt with as needed).
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; I believe it's also the case that
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; a) The &quot;response&quot; file from each person is roughly the same as the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; &quot;challenge&quot; file for the next participant, and
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; b) The response/challenge files are safe to be published at any
</I>&gt;<i> time,
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; not private at all.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; So, by convention, we should post the hashes of those files here
</I>&gt;<i> right
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; away, and make a best effort to mirror them publicly (each one is
</I>&gt;<i> like
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; a gigabyte, I think).
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; What does the initial challenge file consist of? Could you post the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; hash of it here?
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; Cheers,
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; On Wed, Nov 8, 2017 at 3:04 PM, Sean Bowe via zapps-wg
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; &lt;<A HREF="/mailman/listinfo/zapps-wg">zapps-wg at lists.z.cash.foundation</A>&gt; wrote:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Ariel Gabizon, Ian Miers and I have just published a new paper
</I>&gt;<i> detailing a
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; multi-party computation (MPC) protocol for constructing zk-SNARK
</I>&gt;<i> public
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; parameters.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; <A HREF="https://eprint.iacr.org/2017/1050">https://eprint.iacr.org/2017/1050</A>
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; The highlights are:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; * It allows for a single, gigantic ceremony to take place for all
</I>&gt;<i> possible
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; zk-SNARK circuits within a given size bound. The results of this
</I>&gt;<i> ceremony
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; are partial zk-SNARK parameters for the entire community. We call
</I>&gt;<i> this
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; communal ceremony the Powers of Tau.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; * If you want to use zk-SNARKs in your protocols, you still have
</I>&gt;<i> to do an
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; MPC for your circuit. But because of the Powers of Tau ceremony,
</I>&gt;<i> your
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; ceremony is much cheaper to perform and the costs per-participant
</I>&gt;<i> scale
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; linearly with respect to the circuit complexity.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; * The best part is that the Powers of Tau and these
</I>&gt;<i> circuit-specific MPCs
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; can scale to hundreds/thousands of participants. As the number of
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; participants grows, it becomes unrealistic that all of them could
</I>&gt;<i> be
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; compromised.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; So, let's do the Powers of Tau ceremony! The Zcash Foundation is
</I>&gt;<i> excited to
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; participate in the process. The Zcash Company is particularly
</I>&gt;<i> excited in
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; starting soon because we want to leverage it for our next MPC for
</I>&gt;<i> the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Sapling upgrade of Zcash.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; The MPC protocol for this ceremony only requires that one
</I>&gt;<i> participant
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; successfully destroy the secret randomness they sample during
</I>&gt;<i> their part. We
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; intend to give participants total flexibility in deciding how to
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; participate; we don't mind what software, hardware or OS you use.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; I have written some Rust software for participants to run:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; <A HREF="https://github.com/ebfull/powersoftau">https://github.com/ebfull/powersoftau</A>
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; In order to simplify auditing, I won't be making any more changes
</I>&gt;<i> to the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; code unless absolutely necessary. You don't have to use this
</I>&gt;<i> software, but
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; there are no alternative implementations at this time. I think it
</I>&gt;<i> should be
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; feasible to write a C version of the code using the RELIC
</I>&gt;<i> toolkit, which has
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; implemented BLS12-381. I am very confident in the Rust code,
</I>&gt;<i> though, and I
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; believe in its stability/correctness.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; I have some opinions about the ceremony:
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; 1. I disagree with processes that don't improve security of the
</I>&gt;<i> ceremony.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Having a small surface area of code and process increases the
</I>&gt;<i> chance that
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; bugs will be discovered by auditors because there are fewer
</I>&gt;<i> things that can
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; go wrong. Remember that there is already quite a bit for the
</I>&gt;<i> public to
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; check: the transcript correctness, the code correctness, the
</I>&gt;<i> randomness
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; beacon, the cryptographic proof, code dependencies, etc.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; 2. It needs to start soon so that it can be useful for the
</I>&gt;<i> Sapling MPC.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; 3. It needs to have lots of reputable participants by the time we
</I>&gt;<i> start the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Sapling MPC.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Given the above, I would like to suggest that we start the
</I>&gt;<i> ceremony now
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; using my existing code, which supports circuits up to 2^21 gates.
</I>&gt;<i> This means
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; people would just get in contact with me if they want to
</I>&gt;<i> participate and
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; I'll schedule them in. I'll try to prioritize reputable people,
</I>&gt;<i> but I'll
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; allow pretty much anyone I have time to. Everything that I do is
</I>&gt;<i> publicly
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; verifiable (there is a transcript at the end of the ceremony
</I>&gt;<i> which people
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; can check).
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Andrew Miller has a few interesting ideas for a more distributed
</I>&gt;<i> process for
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; scheduling &quot;who goes next&quot; but there are some disadvantages and
</I>&gt;<i> risks
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; involved IMO. In any case, the process can be changed later
</I>&gt;<i> without
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; affecting anything, so I don't see a purpose in delaying the
</I>&gt;<i> start of the
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; ceremony on such things.
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; I'd like to hear from others about this plan so we can begin soon!
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Sean Bowe
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;&gt; Zcash Company
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; --
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; Andrew Miller
</I>&gt;<i> &gt;&gt; &gt;&gt;&gt;&gt; University of Illinois at Urbana-Champaign
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt;
</I>&gt;<i> &gt;&gt; &gt;&gt; --
</I>&gt;<i> &gt;&gt; &gt;&gt; Andrew Miller
</I>&gt;<i> &gt;&gt; &gt;&gt; University of Illinois at Urbana-Champaign
</I>&gt;<i> &gt;&gt;
</I>&gt;<i> &gt;
</I>&gt;<i>
</I>
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message (by thread): <A HREF="000014.html">[zapps-wg] Powers of Tau Ceremony Proposal
</A></li>
<LI>Next message (by thread): <A HREF="000016.html">[zapps-wg] Powers of Tau Ceremony Proposal
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#15">[ date ]</a>
<a href="thread.html#15">[ thread ]</a>
<a href="subject.html#15">[ subject ]</a>
<a href="author.html#15">[ author ]</a>
</LI>
</UL>
<hr>
<a href="/mailman/listinfo/zapps-wg">More information about the zapps-wg
mailing list</a><br>
</body></html>