Greg Zaverucha

Principal Software Development Engineer at Microsoft Research in the Security and Cryptography group, where he works on applied cryptography, cryptographic primitives and systems, and helping product teams use cryptography securely.

Language-Agnostic Analysis Finds 15 Vulnerabilities in ZKP Projects

Arman Kolozyan of the Max Planck Institute for Security and Privacy argues that many zero-knowledge proof bugs arise from a mismatch between what a prover’s computation can produce and what a verifier’s constraints will accept. Presenting the paper “Language-Agnostic Detection of Bugs in Zero-Knowledge Proof Programs,” he describes a formal model, the Domain Consistency Model, and a static-analysis tool, CCC-Check, designed to detect those mismatches across ZKP languages. The work reports two-orders-of-magnitude speedups over SMT-based approaches on benchmarks and 15 previously unknown vulnerabilities in six ZKP projects, most of them outside the reach of existing models.

Microsoft ResearchMay 7, 202610 min read