zcash Sapling升级背后的安全多方计算协议

zcash Sapling 使用BLS12-381椭圆曲线，采用的安全多方计算协议是基于论文《Scalable Multi-party Computation for zk-SNARK Parameters in the Random Beacon Model》及 https://github.com/arielgabizon/sapling-security-analysis/blob/master/secondmpc.pdf

主要分为两个阶段：

1. The Powers of Tau: This phase produces parameters that anyone can use for their projects because they’re agnostic to the circuit. This phase has already completed and was a smashing success! You can read about it here.
   The ceremony used an MPC protocol described in a paper written by Sean Bowe, Ariel Gabizon, and Ian Miers, who are scientists and engineers at the Zcash Company. This ceremony produced a partial common reference string (CRS) for Jens Groth’s pairing-based zk-SNARK scheme — the current state-of-the-art in performance. This CRS supports arithmetic circuits with up to 2^21 multiplication gates.
   The correctness of the proofs which use these parameters require that at least oneparticipant of the Powers of Tau ceremony destroyed some randomness they sampled during their part of the ceremony. The protocol guarantees zero-knowledge of the resulting proofs, even if all participants were compromised.
2. Sapling MPC: We can use some of the results of the Powers of Tau, but we still need to produce the circuit-specific portions of the parameters. This MPC will focus on producing those. 在本阶段中，不再需要FFT计算。

Each of these phases has the property that only one of its participants must be honest for the final parameters to be secure. Each phase is also highly scalable, allowing us to have as many participants as time allows.

1. The Powers of Tau阶段生成的是circuit-agnostic parameter，与circuit无关的参数，可宫其他项目使用（可借助phase2库）。The Powers of Tau ceremony aimed to produce partial public parameters that can be used by all projects that wish to use zk-SNARKs — small and flexible zero-knowledge proofs which require a parameter setup.

Zcash的``The Powers of Tau`阶段自2017年11月至2018年4月，共收到87个贡献者（包括社区成员及密码学专家），可保证只要有一个贡献者是忠诚的，则该该阶段生成的参数是安全的。87个贡献者清单。

zcash在 The Powers of Tau阶段生成的参数及脚本下载，同时可通过该工具进行验证。

2. Sapling MPC中生成的是circuit-specific parameter，应该是专门针对zcash的circuit相关参数。

zcash的Saling MPC阶段吸纳了94名参与方，采用依次轮询的方式来生成计算，收到params，本地执行相应的程序生成新的new_params文件（该文件需上传给主办方，主办方会将该文件给下一个参与方），以及hash值（该值可在做种MPC结束后，验证最终生成的参数中包含本方提供的相应参数）。

zcash在 Saling MPC阶段生成的参数下载，同时可通过该工具进行验证。

摘自 https://electriccoin.co/blog/the-design-of-the-ceremony ：
As we’ve mentioned in a previous blog post, the private transactions in Zcash “Sprout” 1.0 rely on SNARK public parameters for constructing and verifying zero-knowledge proofs. (When we upgrade the Zcash protocol and change the zero-knowledge proofs — which we intend to do within about a year — then we’ll have to generate new SNARK public parameters from scratch.) Generating SNARK public parameters is basically equivalent to generating a public/private keypair, keeping the public key, and destroying the private key.
The problem is, if an attacker were to get a copy of that corresponding private key, they could use it to create counterfeit Zcash. That is the only harm they could do with it — they could not violate anyone else’s privacy nor steal other people’s Zcash.
We call the private key “the toxic waste”, and our protocol is designed to ensure that the toxic waste never comes into existence at all.

In zCash, the circuit (the transaction verifier) is fixed, and thus the polynomials for the QSP are fixed which allows the setup to be performed only once and re-used for all transactions, which only vary the input u.

powersoftau-transcript.torrent文件有100G：

powersoftau.torrent文件有2.3G：