Fiat-Shamir 攻击不是误用，是协议本身不安全

核心论点 · 点时间戳可跳到原声

原话 · 已逐字校验

And when I told people about this, their typical reaction was, "Well, you know, our real protocols don't do anything stupid that would break them."

当我把这件事告诉别人时，他们的典型反应是：「我们的真实协议不会做那种会把自己搞崩的蠢事。」

Ron Rothblum13:09

So it's worth noting that this is just a mitigation, so we can't demonstrate the attack, but we also don't know if it doesn't exist.

值得注意的是这只是一个缓解措施：我们演示不出这个攻击，但我们也不知道它是否真的不存在。

Ron Rothblum17:09

The reason people want to use GKR is that it allows for less data to be captured. Of course. That is, you seem to be recording less data, but you are implicitly confirming it without necessarily actually recording it. And this is a feature of GKR. This is the reason why you want to use GKR. Mhm. And it was this feature that made it possible to carry out our attack.

人们想用 GKR 的原因是它允许记录更少的数据。也就是说，你表面上记录的数据更少，但你隐式地确认了这些数据，而不必真的记录它们。这是 GKR 的一个特性，也正是你想用 GKR 的原因。而正是这个特性让我们的攻击成为可能。

Ron Rothblum18:10

It could be the function H itself. Oh. H, so think about it, if M is the function H itself, then M of M is just H of H. And H of M is also H of H, so they're the same.

它可以是函数 H 本身。想想看，如果 M 就是函数 H 本身，那么 M(M) 就是 H(H)，而 H(M) 也是 H(H)，所以它们相同。

Ron Rothblum22:10

I claim that, you know, it's night outside, even though it's actually day, and I can give you proof that my false claim is true, and you'll accept it with probability one.

我声称外面是黑夜，尽管实际上是白天，而我能给你一个证明说我这个假命题为真，你会以概率一接受它。

Ron Rothblum23:10

So, Plonk correctness generally means that if you have a false statement, no one should be able to convince you to accept it. Good. Yes? In particular, neither Snark.fast nor Snark.faster nor Snark.fastest—no one should be able to convince you of something that is false.

Plonk 的可靠性大体上意味着：如果你有一个假命题，没有人应该能说服你接受它。特别是，无论是 Snark.fast、Snark.faster 还是 Snark.fastest，都不应该有人能让你相信一件假的事情。

Ron Rothblum44:12

I thought it was pretty obvious that using such massive crowdsourcing AI would yield better engineering than what we had with our agent and a small number of tokens. And I was expecting, you know, 10-20% or something like that. They actually achieved two and a half or three times better results.

我原以为很明显，用这种大规模众包 AI 会比我们自己的 agent 加少量 token 做出更好的工程结果。我预期是 10-20% 之类的提升。他们实际上做到了 2.5 到 3 倍更好的结果。

Ron Rothblum45:12

What it means is that all computations in the world become verifiable. Anything that anybody, your agent, anybody else's agent, anything that anybody does -- yeah, that you can compare to a baseline to very cheaply verify that it was done correctly.

它意味着世界上所有计算都变得可验证。任何人、你的 agent、别人的 agent、任何人做的任何事，你都能以极低成本对照基线验证它是否被正确完成。

Ron Rothblum59:15

数字与实体

术语

Fiat-Shamir菲亚特-沙米尔变换

把交互式协议变成非交互式的变换，用哈希函数替代验证者的随机掷币。

GKRGKR 协议

一种用于证明电路正确性的交互式协议，因允许少记录数据而被广泛使用。

diagonalization对角化

让程序把自身作为输入嵌套运行、从而构造出满足特定等式输入的技巧。

polynomial commitment scheme多项式承诺方案

用极小的承诺捕获大多项式，之后可证明对该多项式的计算，是 SNARK 的核心组件。

sketched code草图码

先对消息取短摘要、只对摘要做 Reed-Solomon 编码的纠错码，编码更快。

binary fields二进制域

以 0/1 为元素的有限域，Binius 推动其用于证明系统，Nvidia GPU 已加入支持。

收听指南