Subject: Re: [bitcoin-dev] ZeroSync: Introducing Validity Proofs to Bitcoin

From: Robin Linus <[email-masked]>
Date: Fri, 12 May 2023 18:03:06 +0200

Hi Weiji,

> Could you please expand more on how you plan to "implement a SNARK verifier on Bitcoin’s base layer"?
First, I should clarify that I see this as a long-term option, which will take years. If Simplicity gets activated, we could use it to implement a SNARK verifier on Bitcoin's base layer. But for now, we just plan to experiment with Simplicity on the Liquid sidechain when it gets activated.

> For your information, I happen to be the one proposing a new opcode OP_ZKP to enable the Bitcoin network to verify zkp proofs. My proposal requires a soft fork. You may find more information from the email archive here: https://www.mail-archive.com/[email-masked]/msg12601.html <https://www.mail-archive.com/[email-masked]/msg12601.html>
I've seen it; however, I suppose it is hard to establish consensus over some particular kind of op_snark_verify opcode because there are so many competing proof systems with different trade-offs. For example, STARKs are great for a chain state proof as they are scalable and allow for processing huge circuits; however, I would not favor STARKs for an on-chain verifier because there are other proof systems, such as Plonky2, with much smaller proof sizes.

A nice thing about SNARK verifiers is that once we have any verifier, we can use it to wrap other proofs. E.g., we could "compress" the size of a STARK by verifying it in a Plonky2 proof.
Still, Simplicity offers much more flexibility and allows to update verifiers as the research advances.

> We might be tackling similar issues and probably could benefit from each other. 

Sounds good! Please join our Telegram group, if you would like to chat about SNARKs on Bitcoin https://t.me/zerosync_chat <https://t.me/zerosync_chat>

Cheers,
Robin