educative · zk

zkHack x zkSecurity (Whiteboard Session) - What is Zero-Knowledge (like, actually)?

ZK/SEC October 04, 2024 1 min

What is Zero-Knowledge (like, actually)?

zkSecurity is helping zkHack kick off a new season of zkHack whiteboard sessions!

In this module, Nicolas Mohnblatt and David Wong from zkSecurity dig into the term “Zero Knowledge” and discuss what this property actually is, when it is being used (or not) and what characteristics some systems need in order to be considered truly ZK. They then highlight the different types of ZK (perfect, statistical, and computational), discuss the distinction between dishonest and honest verifiers, and the preference for adaptive models over non-adaptive ones. Additionally, they explore methods for generating hiding commitments from techniques such as KZG, Pedersen, and hashes, and conclude with an overview of the zero-knowledge analysis of PLONK.

watch it on youtube or on the zkhack.dev page

What's in it? Check the timestamps:

00:00 – Introduction 01:03 – ZK, SNARKs, Proving… High-level overview 04:53 – Defining ZK and the concept of Simulator 08:41 – A concrete example of a Simulator with the Schnorr Identity Protocol 14:06 – Honest vs. dishonest Verifier 19:28 – Non-interactive to interactive protocol with Fiat-Shamir 24:50 – The 3 flavors of ZK 29:52 – Application to the PLONK protocol 46:37 – Managing KZG and its trusted setup 50:00 – The ZK flavor of PLONK 57:02 – Summary

Keep reading

Latest

Fiat-Shamir Bugs: How One Missing Line Breaks a Proof System

This blog post looks at Fiat-Shamir from a practical security perspective: it explains why something that seems simple in theory can become surprisingly easy to get wrong. By using vulnerabilities found in real-world projects, we give developers and reviewers a better way to think about Fiat-Shamir when designing, implementing, and auditing proof systems.

Giap Vu, David Wong · September 19, 2026

Better Codes - and how they can be worse if you're not careful

An exploration of how an AI tried to work around a security feature to handle a theorem that was hard to prove.

Kobi Gurkan · September 14, 2026

The Year Finding and Exploiting Bugs Became Cheap, and What to Do About It

The economics of security have changed. AI has made finding and exploiting bugs cheaper, including in cryptographic and zero-knowledge code, while validation and remediation remain slow. Here is our view of what happened, what comes next, and how teams should change the way they secure their stack to defend against AI-assisted attackers.

Stefanos Chaliasos · September 07, 2026

Recommended

zkBank: you think you have what it takes to work at zkSecurity?

Join us as we dive into the world of ZK through an exciting challenge called zkBank! Whether you're a bug-hunting enthusiast or just curious about zero-knowledge projects, this is your chance to test your skills and learn across various areas. Think you can crack it? Check out the details and see if you have what it takes.

ZK/SEC · February 27, 2024

zkBitcoin: Use Zero-Knowledge Applications (zkapps) on Bitcoin

We're excited to introduce zkBitcoin, a new tool that lets you create zero-knowledge applications on Bitcoin using a minimal layer 2 protocol. This innovation opens up a world of complex, privacy-focused apps by enhancing Bitcoin's scripting capabilities. We're currently on testnet, so you can jump in and explore the possibilities. Check out our whitepaper or watch some videos for a deeper dive. It's an exciting time for Bitcoin development, and we can't wait to see what you'll build!

David Wong · January 31, 2024

Introducing bugs.zksecurity.xyz a knowledge base for ZK bugs

We're thrilled to introduce our new site, [bugs.zksecurity.xyz](https://bugs.zksecurity.xyz/), a hub for exploring past vulnerabilities in ZK circuits. Dive into our growing catalog of documented bugs and learn how we've reproduced some with comprehensive scripts. Discover evaluations of prominent security tools like Circomspect and Picus, and see where they shine or stumble. We're calling on the community to join us in expanding this invaluable resource, whether by adding bugs, reproducing them, or improving our platform. Let's collaborate to elevate ZK security together!

Stefanos Chaliasos · February 17, 2025

More to explore

Soundness Failures in LaBRADOR Implementations from NTT -Friendly Rings

Post-quantum cryptography is making its way into production libraries, and correct implementation is far from trivial. We reviewed several LaBRADOR implementations on GitHub and found three of them broken, with soundness collapsing as far as a single bit, because of parameter choices that look perfectly reasonable in many lattice-based protocols; a power-of-2 modulus, a composite modulus, or NTT-friendly rings for efficient ring multiplication. The post goes through how each of those choices undermines the protocol's soundness argument, and why NTT-friendliness, of all things, turns out to be the wrong instinct if not handled carefully.

Georgios Raikos · April 30, 2026

Why does FRI work?

This blog post explains the security intuition behind the FRI protocol, which proves that a function is close to a valid Reed-Solomon codeword. It introduces the "prover message graph," a layered structure that visualizes how correct and incorrect folds affect verification. We conclude that if too many folds are inconsistent, the verifier will likely reject, but if most are correct, the initial function must be close to a proper codeword.

Nicolas Mohnblatt · October 30, 2025

Improving the Security of the Jolt zkVM

We recently explored a16z’s Jolt zkVM to bolster its security, discovering significant bugs in the process. Our findings revealed vulnerabilities that could allow malicious provers to forge proofs, highlighting the crucial role of manual reviews in catching these issues. Jolt, with its unique approach using the Lasso lookup technique, aims to improve prover efficiency and system scalability. With these bugs now fixed, this work underscores the importance of thorough audits in ensuring the reliability of advanced zkVM technology. Stay tuned as we continue to delve into zkVM security insights.

Suneal Gong, Imam Al-Fath · November 19, 2024