A quick look at zero-knowledge proofs

Amazing article. Will save to explain ZKP to others.

One tiny correction

random.randrange(100) gives 300 possible commitments(3 colors for hundred nonces) After seeing a couple of revealed edges, the verifier can figure out the palette and brute-force all 300 combinations, effectively opening every commitment.

It can be mitigated if we use 128 bits of randomness, e.g. secrets.token_bytes(16).

Also I would use sha256 instead of hash. Python hash is not considered secure as it does not have proper collision resistance.

Not one mention that ZKP depends on servers trusting clients.

The single reason ZKP is not viable for most security is that it relies on you trusting the client to send you true information about data.

With conventional security the user sends their inputs and the server validates it.

Something I notice that is almost never mentioned when people bring up ZKP - it is pretty much only for peer-to-peer when there is no authoritative server. Or when that server trusts the “nodes” (clients).

ZKP is 100% bullshit.

It’s a new word invented by people who don’t know hashing and databases already exist.