Detailed explanation of the application of zk-SNARKs in the Filecoin network

zk-SNARKs provide the ability for one party to prove to another party that they know a secret without revealing the secret itself, allowing secure, private interactions with unknown and untrusted parties in the blockchain.

Written by: Dayou IPFS Research Institute

zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge), provide one party with the ability to prove to another party that they know a secret without revealing the secret itself. zk-SNARKs allow secure, private interactions with unknown and untrusted parties in the blockchain.

**The Filecoin network currently generates 6-7 million zk-SNARK proofs per day, each containing more than 100 million arithmetic constraints. **In order to achieve this goal, we - Protocol Labs improved and heavily optimized the existing snark generation tool, allowing it to scale to meet our unprecedented needs.

**Filecoin is the largest zk-SNARK network to date. **

several aspects:

• Filecoin's trusted setup supports circuits up to 2^27 = ~134M constraints.
• Filecoin has a > 100M limit for large individual circuits.
• To meet Filecoin's security requirements, some proofs bundle up to 10 individual zk-snarks into one large proof.
• Filecoin also extends and deploys research into zk-SNARK aggregations to allow the compression of thousands of individual proofs into a single proof.

All of this contributes to Filecoin's ability to prove more information in production.

The Power of Tau and Building Trust

In order to support the limited amount required for Filecoin, we ran a new Tau Power Ceremony that increased the amount of support by 64 times the amount Zcash ran. This enables us to generate proofs of over 100 million constraints, limited only by the parameter size of the distribution.

To support our second-stage (circuit-specific) trusted setup for large circuits, we implemented techniques to significantly reduce RAM usage, allow parallelism, and reduce I/O overhead - in order to allow parties using practical hardware Participate within 7 weeks of the ceremony.

Use the GPU-based prover

The generation of the zk-snark quickly becomes a bottleneck, so the expensive part is implemented on the GPU using OpenCL and CUDA. Since the core operations supporting proof generation are highly parallelizable, we leverage modern general-purpose GPU computations to offload them from the CPU.

**This allows for higher throughput while also creating economic efficiency. **By offloading parallelizable work to relatively cheap parallel processors, we can keep main memory and CPU free for the high-order and memory-intensive work used to create data miners.

Low-level domain algorithms underlie most operations performed when generating and verifying zk-snarks. **The blst library implements critical sections in assembly and C to get the last performance out of the CPU. **To ensure that these optimizations do not compromise security, the code (even assembly language!) is being formally verified by Galois.

Stronger batch validation

To improve the verification speed of multiple zk-snarks, batch verification is implemented. This is a technique described in Appendix B2 of the Zcash specification, but is not yet in use. This allows to reduce the number of Miller loops (the most expensive operation in the validation process) that need to be performed, thus greatly reducing when looking at multiple validations at once.

While batch verification helps, we needed faster verification, so we implemented SnarkPack. This allows us to aggregate many zk-snarks into a combined proof. **This optimization not only reduces verification time by more than 10x at scale, but also reduces chain bandwidth by reducing the average number of bytes per proof that must be submitted to the chain. **

To achieve this, we built upon an internal product justification and worked with the authors to extend it to support our needs without requiring a new trusted setup. We achieved this by adapting the technique to apply securely using two existing trusted settings of power of Tau. **This is a great example of the obstacles we have historically had to overcome to achieve breakthrough scale. **

Dayou IPFS Research Institute will continue to pay attention to the latest news surrounding the Filecoin project.

Whether you are a novice or a senior practitioner, Dayou IPFS Institute will provide you with innovative perspectives and in-depth analysis. We uphold the spirit of openness and tolerance, and welcome you to join us to learn and grow together.