<p>Here's <a href="https://github.com/zcash/mpc" rel="nofollow noreferrer">Zcash's multi-party parameter calculation code</a>, which...</p>

<blockquote>
  <p>... used a multi-party computation protocol with the property that the resulting parameters are secure unless <strong>all</strong> of the participants were dishonest or compromised during the ceremony.</p>
</blockquote>

<p>By the way, you might find <a href="https://crypto.stanford.edu/bulletproofs/" rel="nofollow noreferrer">Bulletproofs</a> more interesting which is newer and doesn't require a trusted setup.</p>

CC BY-SA 4.0
2018-08-28T14:34:06.073Z
Thank you, Do you mean **Bulletproofs** is an alternative to **zk-SNARK** ? And is there any usage of **Bulletproofs** in **Blockchain** ? Thanks
Questioner
CC BY-SA 4.0
2018-08-28T14:37:32.563Z
Yes, it's an alternative. It can be used everywhere snarks can be used. It's currently only on Monero testnet.
MCCCS
CC BY-SA 4.0
2018-08-28T15:17:56.290Z
Bulletproofs can be used for any purpose where zkSNARKs are used, though it has very different size/performance tradeoffs. Bulletproofs are larger than zkSNARKs, and for anything but the simplest statements, also slower to verify. However, they aggregate well (verifying multiple at once can be faster), and most importantly, they have no trusted setup at all.
Pieter Wuille
CC BY-SA 4.0
2018-08-28T14:14:12.107Z
2018-08-28T14:14:12.107Z
MCCCS
<p>Normally, in <code>zk-SNARK</code>, we need to generate two public keys: one for <code>prover</code> and one for <code>verifier</code>. However, the input parameter of this generator algorithm must be secret, meaning that it must be hidden for both <code>prover</code> and <code>verifier</code>. </p>

<p>And because of this, the process of those public generation is done by a <strong>trusted third party</strong>. </p>

<p>Since using a <strong>trusted third party</strong> is <strong>not desirable</strong> for <strong>decentralized</strong> blockchain, I am looking for a <strong>decentralized</strong> approach of those public key generation. Is there ? or it's impossible to have a <strong>decentralized</strong> <code>zk-SNARK</code> ?</p>

<p><strong>P.S.</strong> More information about <code>zk-SNARK</code> is found here: <a href="https://media.consensys.net/introduction-to-zksnarks-with-examples-3283b554fc3b" rel="nofollow noreferrer">https://media.consensys.net/introduction-to-zksnarks-with-examples-3283b554fc3b</a></p>

<decentralization><trust><zero-knowledge>
Is there a decentralized zk-SNARK (zero-knowledge Succinct Non-Interactive ARgument of Knowledge)?
Questioner
# Is there a decentralized zk-SNARK (zero-knowledge Succinct Non-Interactive ARgument of Knowledge)?

(Asked by: username_0 on 2018-08-28)

Normally, in `zk-SNARK`, we need to generate two public keys: one for `prover` and one for `verifier`. However, the input parameter of this generator algorithm must be secret, meaning that it must be hidden for both `prover` and `verifier`.

And because of this, the process of those public generation is done by a **trusted third party**.

Since using a **trusted third party** is **not desirable** for **decentralized** blockchain, I am looking for a **decentralized** approach of those public key generation. Is there ? or it's impossible to have a **decentralized** `zk-SNARK` ?

**P.S.** More information about `zk-SNARK` is found here: <https://media.consensys.net/introduction-to-zksnarks-with-examples-3283b554fc3b>

**Tags:** decentralization, trust, zero-knowledge


---

## 1 answers

### Answer by username_1 on 2018-08-28. Score: 1 | Accepted answer

Here's [Zcash's multi-party parameter calculation code](https://github.com/zcash/mpc), which...

> ... used a multi-party computation protocol with the property that the resulting parameters are secure unless **all** of the participants were dishonest or compromised during the ceremony.

By the way, you might find [Bulletproofs](https://crypto.stanford.edu/bulletproofs/) more interesting which is newer and doesn't require a trusted setup.

> **Comments:**
> **username_0**: Thank you, Do you mean **Bulletproofs** is an alternative to **zk-SNARK** ? And is there any usage of **Bulletproofs** in **Blockchain** ? Thanks  
> **username_1**: Yes, it's an alternative. It can be used everywhere snarks can be used. It's currently only on Monero testnet.  
> **username_2**: Bulletproofs can be used for any purpose where zkSNARKs are used, though it has very different size/performance tradeoffs. Bulletproofs are larger than zkSNARKs, and for anything but the simplest statements, also slower to verify. However, they aggregate well (verifying multiple at once can be faster), and most importantly, they have no trusted setup at all.  

---

