Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   Universal means many circuits

   The SRS is not specialised to one arithmetic circuit. Specialising is a later, cheaper step. The expensive ceremony is not repeated for every application.

2. Claim 02 · Paper model

   Updatable means one honest contributor

   The string can be improved by new randomness. The soundness story is that a single honest update denies the toxic waste to everyone else. A ceremony with no honest participant is still a broken setup.

3. Claim 03 · Paper model

   Holography is the technique

   The verifier is fast because the statement is presented in an encoded form. That encoding is part of the protocol, not a compression trick you can skip.

4. Claim 04 · Paper model

   Still a SNARK

   Proofs are constant size. The prover does the heavy work. A universal setup does not move the work onto the verifier.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 Universal means many circuits

   Observation

   What the study says

   The SRS is not specialised to one arithmetic circuit. Specialising is a later, cheaper step. The expensive ceremony is not repeated for every application.

   Model

   What has to hold

   The implementation uses the preprocessing for the circuit it claims to prove.

   Falsifier

   What would retire it

   Is the SRS universal, and was it updated?

2. 02 Updatable means one honest contributor

   Observation

   What the study says

   The string can be improved by new randomness. The soundness story is that a single honest update denies the toxic waste to everyone else. A ceremony with no honest participant is still a broken setup.

   Model

   What has to hold

   At least one SRS contributor was honest if you are relying on updatability.

   Falsifier

   What would retire it

   Is the proof system Marlin, PLONK, or Groth16?

3. 03 Holography is the technique

   Observation

   What the study says

   The verifier is fast because the statement is presented in an encoded form. That encoding is part of the protocol, not a compression trick you can skip.

   Model

   What has to hold

   Public inputs are the statement. A proof does not make private inputs true to the world.

   Falsifier

   What would retire it

   What is the public statement, as opposed to the witness?

4. 04 Still a SNARK

   Observation

   What the study says

   Proofs are constant size. The prover does the heavy work. A universal setup does not move the work onto the verifier.

   Model

   What has to hold

   Public inputs are the statement. A proof does not make private inputs true to the world.

   Falsifier

   What would retire it

   Is the SRS universal, and was it updated?

03 Sequence

One action, as an operating tape

1. 01Participants generate and optionally update a universal SRS.
2. 02A circuit is preprocessed against that SRS.
3. 03The prover produces a constant-size argument for a satisfying witness.
4. 04The verifier checks the argument, using the encoded statement, in time that does not replay the computation.
5. 05Zero knowledge hides the witness if the protocol is used in that mode.

04 Load-bearing

The argument, and where a pitch drops it

1. Compare setups, not logos

   The cut

   Against Groth16, the question is whether you can bear a per-circuit ceremony. Against STARKs, the question is whether you accept a structured string at all. Marlin sits between them. Putting it in either other box is a mistake.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A universal SRS is still a structured string. Losing the assumption means losing the proof system.

2. The model is part of the result

   The cut

   The tightest efficiency claims are in the algebraic group model, which Sonic also used. A reader who needs a different assumption has to read the paper's alternative, not the abstract's timing table.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A universal SRS is still a structured string. Losing the assumption means losing the proof system.

05 Register

What has to be true

• Adversary · Not re-measured

  At least one SRS contributor was honest if you are relying on updatability.

• Model · Not re-measured

  The implementation uses the preprocessing for the circuit it claims to prove.

• Model · Not re-measured

  Knowledge assumptions or the algebraic group model, as in the theorem being cited.

• Cryptography · Not re-measured

  Public inputs are the statement. A proof does not make private inputs true to the world.

06 Divergence

What happened after the paper

Marlin is the 2019 citation for a universal updatable SRS, beside Sonic and before PLONK became the system most applications actually shipped. PLONK is a different paper with a different proving strategy.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Is the SRS universal, and was it updated?
2. Kill test 2Is the proof system Marlin, PLONK, or Groth16?
3. Kill test 3What assumption does the cited theorem use?
4. Kill test 4What is the public statement, as opposed to the witness?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Universal SRS

A structured reference string that is not tied to a single circuit.

Updatable setup

A ceremony any later party can contribute to, sound if one contributor was honest.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• PLONK · 2019

  PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge

  A SNARK with a universal and updatable structured reference string. One setup can serve many circuits. The proofs are larger than Groth16, and there is still a setup.

• Groth16 · 2016

  On the Size of Pairing-based Non-interactive Arguments

  A pairing-based argument in three group elements. The proofs are tiny and cheap to verify. Each circuit needs its own setup, and a leaked setup can forge proofs.

• Halo · 2019

  Halo: Recursive Proof Composition without a Trusted Setup

  Recursion for inner-product arguments, without a structured setup. A proof can attest that another proof was checked. That is how a chain can fold a long history into one object. Halo 2 is a later system.