Fiat–Shamir heuristic

So I hope, you know, so when I, when that negative result came, I was like, this is terrible.

I'm trying to impress Adi instead I'm breaking his, his, but, but actually that paper was the paper that led us to successfully proving positive results about the Fiat-Shamir.

And since then, we proved a lot of positive results, actually, that the skins that are used today are secure.

But to that, we needed to tailor our effort to certain types of proof systems for which the Fiat-Shamir does

work.

And this was pre-elliptic curve method, so you were maybe working with discrete logs at the time?

So you're right, it isn't tied to any specific implementation.

Right, so okay, good.

And in this episode, we had a lot to cover with him.

We discussed the Fiat-Shamir attack he worked on, his polynomial commitment work with Blaze, TensorSwitch, and Bolt, as well as Vail, a native hash-based way to add zero knowledge back to Succinct proofs.

We covered his most recent work on Flock, including its role in the Ethereum Foundation's move away from Poseidon.

We then explore Snark.fast, a collaboration with Eigenlabs, Succinct, the EF, and Espresso.

let me talk a little bit about the negative evidence, because I think maybe prior to our work, people weren't super aware of this, but...

For quite a while before, even before our work with this, I'm referring to work from last year with Lev Suhanov and Dmitry Korotovich.

So even before that, we know of examples of secure interactive protocols that have the feature or bug that if you apply Fiat-Shamir to them, the result is totally broken.

Okay, so we had examples of such protocols.