Halo and more: exploring incremental verification and SNARKs without pairings | Hacker News Reader

Halo and more: exploring incremental verification and SNARKs without pairings

vitalik.ca

42 pointsabecedarius5 comments

All of the math goes over my head, frankly, but one of the cryptocurrencies I'm interested in is implementing something similar to this afaik (https://minaprotocol.com/). They have a recursive zkSNARK scheme for constant sized proofs of their entire blockchain, so you only ever need to store around 22kb(!) to verify transactions. It sounds like very useful technology, instead of blockchain ledgers only ever increasing in size over time and making full nodes harder to run.

I see that their article[1] about the size of their blockchain uses "kb" and "kB" almost interchangeably, but, for the record, they mean "kilobytes" (i.e. 22000 bytes).

That's still an impressively small number, of course, and it is below what I'll call the Watson-Gates Limit of 3200 kB, which is the amount of data apocryphally needed by all the computers in the world.

[1] https://minaprotocol.com/blog/22kb-sized-blockchain-a-techni...

Think all this does is push the problem to the edge. Someone still has to run archival nodes to store all the state so that the nice fancy zk proofs actually have real data for verification. Supporting light or stateless clients isn't a problem for pretty much any reasonable blockchain network.

As someone who has spent the last year or so trying to make Ethereum more stateless I strongly disagree that it is an easy problem to solve :)

(Disclaimer: I hold Mina.) There is no need for Mina archival nodes to exist outside of running services like block explorers (which are admittedly nice to have). The Mina SNARK proof proves two properties at once: a) the state transitions from the previous block to this one are valid (they don't create money from thin air, etc.) and b) the previous block used in (a) itself carries a valid proof. The contents of previous blocks do not necessarily need to be kept at all, because of the "zero-knowledge" part of zero-knowledge proofs. Much like Yao's millionaires[1] don't have to reveal their net worths, the latest block's proof doesn't have to "reveal" the entire history that came before it.

[1]: https://en.wikipedia.org/wiki/Yao%27s_Millionaires%27_Proble...

Reply on news.ycombinator.com