Thread
This has some interesting similarities to what we're doing in Zsub.
https;//zsubmesh.net/
We use recursive schnorr PoK over pederson commitments and a merkle. So we get verifiable attestation chains without revealing the chain. You get roles too. Without exotic ZPKs, though we may do bulletproofs later. (We still haven't decided. It is possible to support range proofs more simply.)
Replies (1)
Interesting, do you have more info on this?
This seems more expressive and composable, probably with larger proof size.
There's a new paper "Anchored Merkle Range Proofs for Pedersen Commitments" (ePrint 2025/1811, October) which might stay within your existing primitives, maybe more suitable than bullet proofs for you.
How would you handle key compromise in the middle of the chain? Are the roles attached to the chain position?
