Quote from: Cassius on February 06, 2020, 03:04:20 PM

Good to see another solid project from some old-timers. Sigma protocols sound very flexible for blockchain applications, I'm curious why no one else has done this yet.

Sigma protocols (aka Generalized Schnorr Proofs) are used in some cryptocurrencies. Bitcoin is going to adopt Schnorr signatures (Schnorr sig is as simplest sigma-protocol, the Schnorr protocol turned out into a signature scheme), ZCoin is using its "Sigma Privacy" which actually some specific sigma-protocol for log-sized ring signature.

However, what's Ergo is doing is really unique. It is using composability of sigma protocols and also similarity between statements to be proven with them and boolean predicates. Thus Ergo allows to mix crypto statements and predicates on blockchain state. Simplest example:

((HEIGHT <= 1000) AND PK1) OR ((HEIGHT > 1000) AND (PK1 OR PK2)

where HEIGHT is blockchain height during script evaluation

Then if transaction is trying to spend a coin protected by the script, and height is 2000, after reduction the script is turned into PK1 OR PK2 means "proof (i.e. signature against spending transaction bytes) for a secret key corresponding to public key PK1 or public key PK2 is valid". Composability of sigma-protocols preserve zero-knowledge, thus from the signature it is not know which secret actually was used (corresponding to PK1 or PK2). Thus this is a simplest ring signature.

A lot of work was done to get composable sigma-protocols implementation, papers are silent about that. Thankfuly, a Boston University Prof. helped us to get a working and secure scheme (not rocket science but solid crypto-engineering though).