看着
- 一种新的计算形式零知识证明让你运行一个工作量，并收到一个简短的证明程序运行正确。 任何人都可以在毫秒内检查证明，而无需重新运行程序，无需信任运行程序的人，也不需要运行程序的数据。
- 三大挑战阻碍着广泛的收养：迅速提供证据以制作，在没有密码学专门知识的情况下提供给正常程序，并在几十年后仍可信赖的密码学上休息。
- 磁铁在所有三项挑战上都取得了重大进展。 它证明了用Rust、Go或C编写的程序，平均运行速度比以前最快的可比系统快10至39倍，其安全性只建立在标准的散列函数上。 它是在Microsoft研究中进行十多年研究，使零知识证明实用性的最新成果。
一种新的计算形式
计算机产生的每个结果都有一个隐含的问题：程序是否按要求运行并产生正确的输出？今天，回答这个问题往往需要一定程度的信任和核查。 我们相信运营商，供应商，对手，或agent，我们依靠合同，审计和日志来建立这种信任。
零知识证明为建立信任提供了根本不同的办法。 一个程序运行，同时它输出一个简短的证明，一个密码证书，这个程序在这些输入上，产生了这个输出。 证明小而速验。 接收它的人可以确认结果为毫秒而不重运行程序，并且可以将证据传递给需要同样保证的其他任何人。 凭着零知识财产证据中还有揭示没有关于应该保密的投入
这改变了正确性在现实世界的意义。 其结果不再需要信任，因为是谁制作的。 其因随缘而可验。 一个代表某人行事的AI agent可以附上一份证明，证明每项行动都遵守了它给予的政策。 受监管的金融机构可以证明，交易的处理是正确的，而不将其交易公开。 一旦提出证据就有可能了就像运行程序一样
三大挑战
1980年代发明了零知识证明，证明程序执行背后的理念也差不多有那么长时间。 阻碍它们成为一般工具的，是三个挑战，它们未能同时得到解决。
效率。 制作证据在历史上比程序本身的运行需要数百万倍的计算。 多年的研究使这项管理费用下降，但最快的系统通过在其他地方达成妥协而实现了速度。
通用性与可用性。 许多证明系统要求开发人员手动重写他们的程序作为密码电路，这是对该精确计算的一种固定的算术描述。 这需要几个月的时间。 应用程序的每次更改都意味着一个新的电路，而翻译本身也是安全错误的频繁来源。 一个通用的替代品是证明普通处理器的执行，这样任何编译的程序都可以被证明是书面的。 直到最近，这种笼统性在速度或安全方面付出了高昂的代价。
警卫证据只有下面的密码法才有力许多验证系统都依赖于椭圆曲线，这种曲线可以被足够强大的量子计算机打破。 Microsoft正在用其量子安全方案来解决这个问题，该方案将把它的产品和服务转移到量子加密后，这一目标最近加速到2029年。 后量子校验系统已经存在，但有些则依赖于丝带假设，大多数则依赖于为降低证明成本而发明的新加密功能。 这些新的密码学功能并没有受到几十年的严格审查，他们以强烈的假设购买了速度。
邮政服务
十多年的工作历程
十多年来，Microsoft Research一直致力于使零知识证明和可核查的计算实用。 早期的研究遵循两种方法，两种方法都只针对小型方案。 第一个(在新标签中打开)(在新标签中打开)将一个核查者通过使用一个叫做总和检查协议(在新标签中打开)的技术与证明者进行简短对话来检查一个长的计算，但这只适用于具有特定层结构的计算。 第二个(在新标签中打开)(在新标签中打开)使用了椭圆曲线加密法，为几乎所有计算创建非常小的证明。 但是这需要一次信任的设定涉及秘密信息，如果泄露，可能让任何人伪造证据。 这种方法也容易受到量子计算机的影响。
2019年，一个新的名为斯巴达的零知识证明系统恢复了总和检查方法，使其在没有可信设置的情况下为通用程序工作。 斯巴达语也可以用不同的密码构件进行即时化。 这种灵活性是后来仅凭散列功能就可以建立的证据系统。 然后将一系列结果填入其余部分：
- Phalanx(在新标签中打开),2021年，演示了如何利用重复，比如处理器在每个步骤上运行相同的指令周期，以证明计算比斯巴达快一个数量级。 Magnetar的处理器描述就是基于这个想法。
- Nova(在新标签中打开),HyperNova(在新标签中打开),NeotronNova(在新标签中打开),Neo和SuperNeo(在新标签中打开)显示，阻止斯巴达早期的证明，并将部分结果叠加起来，使得以更低的成本证明任何大小的计算都切实可行。
- Brakedown(在新标签中打开)，在2021年，推出是一个快速散列式承诺计划，并将其与斯巴达语合并，赋予了第一个安全依赖于标准散列函数的斯巴达语变体。
- Spice(在新标签中打开),Lasso(在新标签中打开),Nebula(在新标签中打开)，然后Twist和Rout(在新标签中打开)将内存操作作为通用处理器的核心来证明，Jolt(在新标签中打开)显示，将它们与斯巴达语合并可以高效地证明一个完整的处理器的执行。
- 今年早些时候，Vega(在新标签中打开)将这一行应用于数字身份，用不到十分之一秒的时间来证明政府认证的事实。
- 最近，BinarySpartan(在新标签中打开)将斯巴达带到二进制字段，其中可以高效地表达处理器的逻辑和标准散列函数。 二进制Spartan还依赖于Ligerito(在新制表板中打开)，一个刹车式的承诺方案，具有更短的证明，还依赖于环切换(在新制表板中打开)，这使得它能高效地致力于比特的向量。
每一个都解决了一个问题。 磁石是碎片聚集的地方。
磁铁
磁铁是一种零知识的虚拟机，即zkVM，它同时在所有三个挑战上都取得了重大的进展。
这是通用的。 Magnetar证明了RISC-V的执行，这是一个开放的处理器架构，每个主流语言都有成熟的编译器。 开发者在Rust,Go，或C中写一个程序，如常编译，Magnetar以书面证明。 考虑这在实践中意味着什么。 Ethereum虚拟机(EVM)的商业政策、数据管道或解释器只是一个程序，因此，证明不再是一种专门活动。
它比同一类的以前系统要快。 磁铁在笔记本电脑上证明了每秒720万至870万个处理器指令。 在整个15个基准测试程序中，从密码散列到一个小型的EVM解释器内的信号传输，平均比同一机上目前最快的zkVM快10至39倍，比另外两个信号传输的基准测试快300多倍。 一个优化的磁铁证明了每秒950–1280万个周期，使这里报告的每个速度都增加了大约1.3×. 它的证明在大约12毫秒内证实。
它的安全依赖于标准的密码。 磁体依赖于标准散列函数，如SHA-256或SHA-3，这些原始体已经保护了每个组织的系统。 它不需要椭圆曲线，没有纬度，没有特殊用途的散列函数，没有信任的设置，也没有关于错误校正代码的未经证实的猜想。 哈什函数是密码学工具包中研究最透彻的原始人，它们也是NIST将基于无国籍的散列的签名标准化为自身保守的量子后选项的基础。 对于一个在未来几十年仍必须值得信赖的系统来说，仅仅依靠标准的散列函数就可以消除路径图上的密码学迁移。
同样的设计决定也带来第二次红利。 检查磁铁的证明主要包括评价标准散列函数和二进制场算术，这正是磁铁的有效证明。 因此，核实证据是正常的工作量。 这使得Magnetar能够证明任何大小的计算，用片子来证明，然后将片子组合起来。 这也使得Magnetar能够证明一个长期运行的系统，如分类账或块链。
技术文件提供了完整的设计、安全分析和测量。
展望未来
磁铁将零知识证明和可核查的计算推向一个阶段，在组织已经信任的密码学上，由编写正常代码的工程师以能够使用的速度进行。 磁铁使未来成为计算中例行输出的密码证明。 我们期望，技术领导者将不再问执行证明是否切合实际，而是要关注他们希望核实而不是信任哪些结果。
若您有兴趣探索零知识证明如何支持您的使用案例
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
At a glance
- A new form of computing. Zero-knowledge proofs let you run a workload and receive, alongside the result, a short proof that the program ran correctly. Anyone can check the proof in milliseconds, without rerunning the program, without trusting whoever ran it, and without needing data on which the program was run.
- Three grand challenges have stood in the way of broad adoption: making proofs fast enough to produce, making them available to normal programs without cryptographic expertise, and resting them on cryptography that will still be trusted many decades from now.
- Magnetar makes major progress on all three challenges. It proves programs written in Rust, Go, or C, runs 10 to 39 times faster on average than the prior fastest comparable systems, and rests its security only on standard hash functions. It is the latest result of more than a decade of research at Microsoft Research on making zero-knowledge proofs practical.
A new form of computing
Every result a computer produces comes with an implicit question: did the program run as claimed and produce correct outputs? Today, answering that question often requires a degree of trust alongside verification. We trust the operator, the vendor, the counterparty, or the agent, and we rely on contracts, audits, and logs to establish that trust.
Zero-knowledge proofs offer a fundamentally different approach to establishing trust. A program runs, and along with its output it produces a short proof, a cryptographic certificate that this program, on these inputs, produced this output. The proof is small and fast to check. Whoever receives it can confirm the result in milliseconds without rerunning the program, and can pass the proof on to anyone else who needs the same assurance. With the zero-knowledge property, the proof also reveals nothing about inputs that should stay private.
This changes what correctness means in the real world. A result no longer has to be trusted because of who produced it. It can be checked because of what accompanies it. An AI agent acting on someone’s behalf could attach a proof that each action complied with the policy it was given. Regulated financial institutions could prove that transactions were processed correctly without making their transactions public. These become possible once producing a proof is as routine as running the program.
Three grand challenges
Zero-knowledge proofs were invented in the 1980s, and the ideas behind proving program execution have been around nearly as long. What has kept them from becoming a general tool is three challenges that have resisted being solved at the same time.
Efficiency. Producing a proof has historically taken millions of times more computation than running the program itself. Years of research have brought that overhead down, but the fastest systems have achieved their speed by making compromises elsewhere.
Generality and usability. Many proof systems require developers to manually rewrite their program as a cryptographic circuit, which is a fixed arithmetic description of that exact computation. This takes months. Every change to the application means a new circuit, and the translation is itself a frequent source of security bugs. A general-purpose alternative is to prove the execution of an ordinary processor, so that any compiled program can be proven as written. Until recently, that generality came at a steep cost in speed or security.
Security. A proof is only as strong as the cryptography beneath it. Many proof systems rest on elliptic curves, which can be broken by a sufficiently powerful quantum computer. Microsoft is addressing this problem with its Quantum Safe Program, which will move its products and services to post-quantum cryptography, a goal it recently accelerated to 2029. Post-quantum proof systems already exist, but some rest on lattice assumptions, and most rest on new cryptographic functions invented to reduce the cost of proving. These new cryptographic functions have not faced the decades of scrutiny given to the cryptography protecting today’s internet, and some rest on mathematical conjectures about error-correcting codes that have not been proven. They have bought their speed with strong assumptions.
PODCAST SERIES
More than a decade of work
For more than a decade, Microsoft Research has worked on making zero-knowledge proofs and verifiable computing practical. Early research followed two approaches, both practical only for small programs. The first (opens in new tab) (opens in new tab)lets a verifier check a long computation through a short conversation with the prover using a technique called the sum-check protocol (opens in new tab), but this applied only to computations with a particular layered structure. The second (opens in new tab) (opens in new tab)used elliptic-curve cryptography to create very small proofs for almost any computation. But this requires a one-time trusted setup involving secret information which, if leaked, could allow anyone to forge proofs. This approach is also vulnerable to quantum computers.
In 2019, a new zero-knowledge proof system called Spartan returned to the sum-check approach and made it work for general-purpose programs without a trusted setup. Spartan can also be instantiated with different cryptographic building blocks. That flexibility is what later allowed the proof system to be built on hash functions alone. A sequence of results then filled in the remaining pieces:
- Phalanx (opens in new tab), in 2021, showed how to exploit repetition, such as a processor running the same instruction cycle on every step, to prove computations an order of magnitude faster than Spartan. Magnetar’s processor description is built on this idea.
- Nova (opens in new tab), HyperNova (opens in new tab), NeutronNova (opens in new tab), Neo and SuperNeo (opens in new tab) showed that stopping Spartan’s proving early, and folding the partial results together, makes it practical to prove computations of any size at far lower cost.
- Brakedown (opens in new tab), in 2021, introduced a fast hash-based commitment scheme and combined it with Spartan, giving the first Spartan variant whose security rests on standard hash functions.
- Spice (opens in new tab), Lasso (opens in new tab), Nebula (opens in new tab), and then Twist and Shout (opens in new tab) made the memory operations at the heart of a general-purpose processor inexpensive to prove, and Jolt (opens in new tab) showed that combining them with Spartan can efficiently prove the execution of a complete processor.
- Earlier this year, Vega (opens in new tab) applied this line of work to digital identity, proving facts from a government credential in under a tenth of a second.
- More recently, BinarySpartan (opens in new tab) brought Spartan to binary fields, where a processor’s logic and standard hash functions can be efficiently expressed. BinarySpartan also relies on Ligerito (opens in new tab), a Brakedown-style commitment scheme with much shorter proofs, and on ring switching (opens in new tab), which makes it efficient to commit to vectors of bits.
Each of these solved a piece of the problem. Magnetar is where the pieces come together.
Magnetar
Magnetar is a zero-knowledge virtual machine, or zkVM, and it makes major progress on all three challenges at once.
It is general-purpose. Magnetar proves the execution of RISC-V, an open processor architecture with mature compilers for every mainstream language. A developer writes a program in Rust, Go, or C, compiles it as usual, and Magnetar proves it as written. Consider what this means in practice. A business policy, a data pipeline, or an interpreter for the Ethereum Virtual Machine (EVM) is just a program, and the engineers who already maintain it can prove their executions exactly as written. As a result, proving stops being a specialist activity.
It is faster than prior systems in the same class. Magnetar proves 7.2 to 8.7 million processor instructions per second on a laptop. Across 15 benchmark programs, from cryptographic hashing to token transfers inside a small EVM interpreter, it is 10 to 39 times faster on average than the fastest existing zkVMs on the same machine, and more than 300 times faster than two others on a token-transfer benchmark. An optimized Magnetar proves 9.5–12.8 million cycles per second, which increases each speedup reported here by about 1.3×. Its proofs verify in about 12 milliseconds.
Its security rests on standard cryptography. Magnetar depends on a standard hash function such as SHA-256 or SHA-3, the same primitives that already protect every organization’s systems. It requires no elliptic curves, no lattices, no special-purpose hash functions, no trusted setup, and no unproven conjecture about error-correcting codes. Hash functions are the most thoroughly studied primitives in the cryptographic toolkit, and they are the basis of the stateless hash-based signatures that NIST standardized as its own conservative post-quantum option. For a system that must still be trustworthy in many decades to come, relying only on standard hash functions removes a cryptographic migration from the roadmap.
The same design decision pays a second dividend. Checking a Magnetar proof consists mostly of evaluating standard hash functions and binary-field arithmetic, which are exactly the operations Magnetar proves efficiently. Verifying a proof is therefore an ordinary workload for it. This is what allows Magnetar to prove computations of any size, by proving them in pieces and then combining the pieces. This also allows Magnetar to prove a long-running system such as a ledger or a blockchain.
The technical paper gives the full design, security analysis, and measurements.
Looking ahead
Magnetar advances zero-knowledge proofs and verifiable computing to a stage where they can be built on the cryptography that organizations already trust, at speeds that make it usable, by engineers who write normal code. Magnetar enables a future where cryptographic proofs are a routine output of computation. We expect that technology leaders will stop asking whether proofs of execution are practical and focus instead on which results would they prefer to verify rather than taking on trust.
If you’re interested in exploring how zero-knowledge proofs can support your use case, we’d love to hear from you (opens in new tab).
Auto-fetched and translated by AI Atlas. All rights belong to the original author.