Quote from: n0nce on January 30, 2022, 02:14:30 PM

You can generally reduce a ton of stuff to a ZK proof. As for amount of data required, it really depends. I would guess it's too much to publish on the blockchain; but then again, you can obviously store a hash of it and publish the actual proof on GitHub, forum(s), website etc. and people can verify that they match.
Your proof will need to include some kind of timestamp though; if you rely solely on the blockchain for timestamping, you could also upload an old proof and pretend the server is still returning something that it doesn't anymore. So you need ZK proof of knowledge and time and merely use the blockchain as a persistent storage mechanism.

Also, if only a hash is persistently stored on the blockchain, while the data isn't, you could take down the data and the proof would be basically gone. So I don't really see the application of blockchain here. It's too expensive to store the proof and not suited to prove knowledge at time x (in your scenario -- because it's not you proving, not the server, but you're the one uploading the proof, right), so there's no real benefit of using it.

Ok, so let's look at a more concrete example closer to what I have in mind:

1. I host an open source program online that reads a proof and outputs whether it is valid or invalid for a given protocol. The program then publishes a succinct proof of what was done to the Bitcoin blockchain, including the nonce of the last block as a timestamp.

2. I take a photo with a camera that uses an open source protocol for generating images that are provably unaltered. Images and proofs are again timestamped with the nonce of the latest block at the time the picture was taken. Proofs can be arbitrarily long.

3. I send the image to an open-source image classifying algorithm I host online. It outputs the contents of the image along with a timestamped proof to my program from step 1.

4. Program from step 1 validates the input proof, and publishes a succinct proof along with some aggregate signature that identifies each protocol used including its own to the blockchain.

5. Someone can later verify that at the time corresponding to the specified block, an unaltered image was taken that showed content X, only needing to trust the validity of the open-source protocols and nothing else, even if the original image and intermediate proofs no longer exist.

Is this feasible? What are my security risks (besides the magical camera in step 2)?