Fiat-Shamir 攻擊不是誤用，是協議本身不安全

核心論點 · 點時間戳可跳到原聲

原話 · 已逐字校驗

And when I told people about this, their typical reaction was, "Well, you know, our real protocols don't do anything stupid that would break them."

當我把這件事告訴別人時，他們的典型反應是：「我們的真實協議不會做那種會把自己搞崩的蠢事。」

Ron Rothblum13:09

So it's worth noting that this is just a mitigation, so we can't demonstrate the attack, but we also don't know if it doesn't exist.

值得注意的是這只是一個緩解措施：我們演示不出這個攻擊，但我們也不知道它是否真的不存在。

Ron Rothblum17:09

The reason people want to use GKR is that it allows for less data to be captured. Of course. That is, you seem to be recording less data, but you are implicitly confirming it without necessarily actually recording it. And this is a feature of GKR. This is the reason why you want to use GKR. Mhm. And it was this feature that made it possible to carry out our attack.

人們想用 GKR 的原因是它允許記錄更少的數據。也就是說，你表面上記錄的數據更少，但你隱式地確認了這些數據，而不必真的記錄它們。這是 GKR 的一個特性，也正是你想用 GKR 的原因。而正是這個特性讓我們的攻擊成為可能。

Ron Rothblum18:10

It could be the function H itself. Oh. H, so think about it, if M is the function H itself, then M of M is just H of H. And H of M is also H of H, so they're the same.

它可以是函數 H 本身。想想看，如果 M 就是函數 H 本身，那麼 M(M) 就是 H(H)，而 H(M) 也是 H(H)，所以它們相同。

Ron Rothblum22:10

I claim that, you know, it's night outside, even though it's actually day, and I can give you proof that my false claim is true, and you'll accept it with probability one.

我聲稱外面是黑夜，儘管實際上是白天，而我能給你一個證明說我這個假命題為真，你會以概率一接受它。

Ron Rothblum23:10

So, Plonk correctness generally means that if you have a false statement, no one should be able to convince you to accept it. Good. Yes? In particular, neither Snark.fast nor Snark.faster nor Snark.fastest—no one should be able to convince you of something that is false.

Plonk 的可靠性大體上意味著：如果你有一個假命題，沒有人應該能說服你接受它。特別是，無論是 Snark.fast、Snark.faster 還是 Snark.fastest，都不應該有人能讓你相信一件假的事情。

Ron Rothblum44:12

I thought it was pretty obvious that using such massive crowdsourcing AI would yield better engineering than what we had with our agent and a small number of tokens. And I was expecting, you know, 10-20% or something like that. They actually achieved two and a half or three times better results.

我原以為很明顯，用這種大規模眾包 AI 會比我們自己的 agent 加少量 token 做出更好的工程結果。我預期是 10-20% 之類的提升。他們實際上做到了 2.5 到 3 倍更好的結果。

Ron Rothblum45:12

What it means is that all computations in the world become verifiable. Anything that anybody, your agent, anybody else's agent, anything that anybody does -- yeah, that you can compare to a baseline to very cheaply verify that it was done correctly.

它意味著世界上所有計算都變得可驗證。任何人、你的 agent、別人的 agent、任何人做的任何事，你都能以極低成本對照基線驗證它是否被正確完成。

Ron Rothblum59:15

數字與實體

術語

Fiat-Shamir菲亞特-沙米爾變換

把交互式協議變成非交互式的變換，用哈希函數替代驗證者的隨機擲幣。

GKRGKR 協議

一種用於證明電路正確性的交互式協議，因允許少記錄數據而被廣泛使用。

diagonalization對角化

讓程序把自身作為輸入嵌套運行、從而構造出滿足特定等式輸入的技巧。

polynomial commitment scheme多項式承諾方案

用極小的承諾捕獲大多項式，之後可證明對該多項式的計算，是 SNARK 的核心組件。

sketched code草圖碼

先對消息取短摘要、只對摘要做 Reed-Solomon 編碼的糾錯碼，編碼更快。

binary fields二進制域

以 0/1 為元素的有限域，Binius 推動其用於證明系統，Nvidia GPU 已加入支持。

收聽指南