HackMoney Summit | Why everyone should know ZKPs

[Music] so uh we have alana coming up um she's going to talk about why everyone should know ck piece um and yeah alana from iron fish thanks so much for joining us come up new and do your thing cool um yeah thank you so much for for having me here um so yeah this is a talk that's going to be about why everyone should know zero knowledge proofs or zkp's for short um and before i get started i kind of wanted to share my my own background and how i got onto crypto because it was actually through going to hackathons like this one um that have led me to this space um so in a previous life i was a software engineer and in about 2017-2018 era um i i started going to uh hackathons um so the first one that i went to was eat waterloo which was uh 2017. um and that was the first youth global uh conference or a hackathon um and it was such an amazing like an amazing environment everybody was there like vitalik was there his dad was there like the maker people were there um den finlay from metamask like helped me debug my project um it was a really special place and i started going to more and more hackathons and doing talks and and conferences um and that was like the you know the 2017-2019 era um and um at the first hackathon i actually uh set myself in a path that led me to discover zero knowledge proof um i'm doing launch proofs which is kind of what i wanted to share with you uh today so the hackathon that i was working on relied on something called video transcoding you don't need to know what video transcoding is just that it is a heavy computation so it's it's really expensive for your for your computer to actually do video transcoding and so i was kind of obsessed with this question of um how do we do honest computation how how do you prove honest computation in a trustless adversarial decentralized environment meaning can i make a system such that i give to a different computer a really complicated task to do like video transcoding they come back with a result and i can very cheaply verify that the result was computed correctly and so i started asking around and finally i discovered zero knowledge proofs and zero knowledge proofs were built for exactly this problem they were built for honest computation now unfortunately the knowledge proofs are way too early to do anything as complex as video transcoding but they were kind of built in ethos for this exact problem so brief kind of history about zero knowledge proofs um what are they they can be used to prove something about hidden data now they were invented in uh in the 80s uh by sharpie goldwasser sylvia mccauley and charles rockoff and some of these names might actually be familiar to you uh somebody mccauley is working on a crypto project um currently jaffe is actually a professor at berkeley um and initially zealous proofs were an interactive protocol um meaning that the verifier and the approver had to have like interaction in order for the proof to to take place so what are zero launch proofs um there are a ton of zero-knowledge proofs um and i'll get to that in in a few in a few slides but what they are essentially is they are a proof that satisfies these three properties um completeness so if this if the statement is true an honest verifier will be convinced by an honest prover meaning that uh you just need the proof uh to verify the statement that you're that you're proving um soundness if the statement is false no tree improver can convince an honest verifier meaning that you have to set up a system such that only the honest proof will be valid um in the system and it has to be zero knowledge meaning that if the statement is true and if the proof is and if the proof is true the verifier learns nothing extra about the statement so again zero launch proofs can be used to prove something about hidden data and so why is that useful uh and why is that useful today so it's useful it's useful for three things so one thing that is useful for is computation meaning that um i can potentially do a fairly expensive computation off chain and then just prove it um or give a proof uh for the final state uh on chain um and so currently i'm kind of really thinking about cross chain transactions uh i think as as a lot of people are um and so in theory you could potentially prove that a certain action has happened on one chain in order for a different action to happen in a different chain scalability um so because your launch proofs are used to prove on honest computation you could actually prove that state transitions happened correctly and all you need to do at the end is provide a single proof and the final state so if you've heard of zero knowledge proof um roll ups for instance um you know this is where the scalability aspect comes from and the other one is privacy so you could prove ownership of something the user wants to keep hidden so i could say you know i like for it for instance if you're familiar with aztec or to no cash uh which i'll get to in a minute um you could use unless priests to say something like look i have a note or i have some you know hidden eath or some hidden asset and i'd like to spend it or move it somewhere um but you don't need to know you know what i've done with it so in 2018 i quit my job as a software engineer airbnb uh to focus on crypto full time and i kind of made this bet that that even if this blockchain thing is going to go away um zero knowledge proofs are here to stay uh and in 2018 zero launch proofs were arcane tribal knowledge it was really hard to understand how they work it was really hard to figure out who to even ask for help there were very few projects working with zero launch proofs and the ones that were you know had people who were academics and phd cryptographers like world-class cryptographers so it was kind of hard to break in um and materials and zealous proofs especially back in the day went from super high level so if you ever looked into what zero knowledge proofs are i think you've all kind of seen this example um of this this cave and then there's like peggy and victor alice and bob when they're running through this game to like prove that they know something so most materials kind of went from this super high level to extremely low level so when dusty and i were working on trying to figure out what zero knowledge proofs are and digging through academic papers we would find statements in the abstract like in the summary of the paper that were as complex as this one for instance one knows that it kind of through the construction that the sextic twist will be the d type which means one doesn't have to count points and lift a curve to check their order um it was really hard to get into disneyland proofs however fortunately today we have plenty of access to really really good material and extremely great tooling to make zero knowledge proof development fun and accessible and easy and fast which i guess is kind of the more important part when you're working on a hackathon project so um i kind of want to go over slightly more history about zeonash proofs um i'm going to highlight some of the evolutions that kind of have happened that led to the geological proofs that we have today so in 2011 um there was a first paper that coined the term zk snarks and ziki snarks just stand for succinct non-interactive arguments of knowledge that paper was authored by alexander kiezen aaron tromer both of whom you might have heard of they were both zcash funny scientists and then in 2013 we had um a paper that made zika snarks uh more more kind of applicable to general computing um meaning that before zoological proofs were again like fairly fairly difficult to use um and then 20 sec in 2016 um johns groth who is a professor at university university college of london um i made a paper in 2016 that actually made jk pretty darn efficient to use and if you guys have heard of cash for instance the sapling protocol of zcash which is the private their main privacy mechanism is based off of across 16 as well as quite a bit of ethereum based or geological zealous proof ethereum um smart contracts are based on across 16 as well so i'm not going to go into exactly how z key snarks work but i do want to give you guys the intuition behind how they work so that you know their limitations um and what they can do um but also so you have the necessary knowledge to go and read up on these concepts on your own so a stark construction has these five steps and um for the first four steps meaning how you go from a computation so like a statement to a quadratic arithmetic program or cap there is actually a great tutorial by stefan demille from eccentric that kind of goes over exactly how computation goes from like a statement like an if statement even um to like a rank one constraint system and for the last uh step of how you actually make a snark um there is quite an amazing tutorial by mcseem um that actually goes over uh the intuition of how polynomials can um can be used to to prove certain information now the most uh the most efficient curve for cros 16 zero launch proofs is bls12381 unfortunately ethereum does not support it despite a lot of eip and a lot of efforts but there is a great article that explains the curve and why it's so efficient so uh kind of a huge overview of how z key snarks work um for uh for snarks we have kind of a predictable way to transform a statement into what's called language of polynomials um and like with any proof system there is a prover that is trying to prove something and a verifier so approver here can be the end user um and a verifier can be a smart contract on ethereum and there is a challenge meaning what is this prover trying to prove maybe this proverb is trying to prove that i have some hidden state in a game or i have you know a note that has some balance that i'm trying to spend and then and the verifier could be a smart contract that actually validates uh those statements um now we do need to make this challenge non-interactive and so um we need to kind of hard code um this common reference string which is part of the trusted setup when you actually uh set up this like a smart contract for instance um you do need to go through the step of setting this up uh and this is so that that the challenge um or the proof that the user gives you can actually be validated now for gras 16 in particular this is kind of done by using elliptic curve pairings which i won't go into today but um not all zero knowledge proofs kind of have this property so i am going to focus a bit on cross 16 um and so why is cross 16 so great now zero knowledge proofs are typically created on three things which is prover time proof size and verification time proven time means how long does it take for me to actually make the proof proof size means how big is the proof which if you are dealing with an ethereum smart contract this is an important part for you to consider and then verification time so given the proof how fast can a validator actually validate the proof um and groth 16 has actually pretty good metrics for all of those three things even on curve uh what was it being uh 124 that ethereum uses um so it has pretty good proover time it has great proof size 192 bytes is really really good and it has constant and fast verification time which again is exactly what we need for a blockchain based uh cryptosystem so the other things that uh zeolite proofs are uh sometimes graded on is again the size of this common reference string um cryptographic assumptions so for instance gross 16 uses elliptical pairings um and that is for instance not quantum secure um and for instance across 16 does have a trusted setup which can lead to some disadvantages so the trusted setup um i have a great tutorial here that kind of explains how it works uh but i do want to put kind of a caveat that we do have kind of tools in place to make this less scary um and less quote unquote trusted for you to set up a system um i'll get into that in a minute so um in 2017 onwards there was this huge huge push in academia as well as uh you know in in in companies and in commercial kind of activity as well to figure out how do we do zero knowledge proofs that don't have this trusted setup and there were a couple techniques that were being kind of experimented with at the time most notably this paper that came out in 2010 sometimes referred to as kcg and i have a great explainer for what that means this paper kind of led a pretty big explosion in activity for discovering user knowledge proofs that don't have a trusted setup and to kind of give you guys uh an idea of how how many zero launch proofs kind of erupted uh that did not have a trusted setup from 2017 um you know we we had like we had several that were published in 2017 we had some in 2018 we had a ton in 2019 um and we had some in 2020 as well so uh for for those of you who might be like overwhelmed by the slide um i want to highlight these three that i would kind of pay attention to um halo 2 is being backed and developed by zcash um i believe their next upgrade is going to be using their privacy their new privacy mechanism is going to be used in halo 2. planck was originally developed by the aztec team um and now like there's more of a community building up to support tooling for planck which is really cool to see and then starks are kind of guided by starkwear and things like moses starkx or starknet which is their layered two solution using uh using starks so that was quite a bit um which ones should you pay attention to today um so again i think gross 16 actually is still one of the best kind of solutions or best approaches for you to use primarily because we have such great great tooling around it it does require trusted setup however i believe this was started by the ethereum foundation um which is this project called the perpetual powers of tau and it's a pr um whenever you do a trusted setup there's actually two two steps to get to that final common reference string um and the first step um can be done through multi-party computation and this project professional powers of tau basically has a system such that anyone at any given point can contribute randomness to the trusted setup such that future projects that use it basically have this the stressors set up that's been organized by i think hundreds of people around the world at this point um and only if only one of those people is honest meaning that they throw away the randomness that was used to create uh this common reference string um then the entire system is honest uh which is i think is a really really cool project because it kind of kind of shows that you know gross 16 and the trusses setup is not that scary because we do have mitigating ways to to reduce uh to reduce risk and the most recommended tool set for doing launch proof smart contract development in my opinion by far is circum they have really great documentation um the project has been developed on for i think three years at this point it started off as a javascript project now they've moved entirely to rust it's really efficient there are implementations that let you generate the proof in the browser which is pretty great for app development um and they also have a smart contract verifier so you can run a command and it kind of uh auto you know generates a smart contract with the verifier in place so you can so you can deploy a smart contract pretty easily with it so i want to kind of point out some notable examples of projects in in the ethereum ecosystem that not only use circum but are also based in cros 16. um one such category is gaming so as we all know ethereum is a public state so if you want to create a game that has like hidden state it's kind of hard like for instance how would you make battleship on ethereum when the state is totally transparent it's pretty hard so one notable example is dark forest i don't know if you guys are familiar with it but if you're not highly highly recommend it it's probably one of the first genuinely fun games that are based entirely in ethereum at least in my perspective i know there's like a ton that have come up recently but um i personally have spent uh an embarrassing amount of time playing dark forest and the idea behind it is you can claim planets on ethereum with the help of zero-knowledge proofs such that your opponents don't know which planet you claimed so it's a pretty cool game mechanic the other uh notable example of things you can do with geological proofs today on ethereum is private transactions um so for instance i mentioned tornado cache earlier tornado cache um is i think one of the biggest zero like a privacy kind of mechanisms for ethereum today um and is based on circum which is pretty cool you can check out our github you can check out their circuits um you can kind of use that code base as an example of a production ready project that runs in the browser and you know uses circumstantial like main circuit generator so the other one that i want to point out is plonk so blanc is another geological system and remember how i said that zero launch proof systems are created on these three metrics which is proven time proof size verification time and so overall planck you know still lags behind cross 16 but not by much and it actually does outperform gras 16 for ethereum based curves for operations like mimc and peter's commitments now plonk does require a universal setup so instead of doing a trusted setup for every time you update your circuit meaning every time you update your geological proof kind of logic um here you don't have to do that so you can uh you can use a universal setup so you can actually use the phase one of the professional powers of tau that i mentioned earlier um you can kind of skip this entire step and the most recommended tool set for this again is circum circum is probably one of my favorite kind of open source uh projects versus launch proof tooling today and you can actually write a smart well like your logic in their dsl which is a domain specific language and then you can choose whether or not you want to use plonk or cross 16 as the underlying improving system which is super cool because that means you can start with cross 16 today to kind of get the benefits of some you know things like proover time improve size but then you know as pawn catches up in popularity or in efficiency you don't have to rewrite your entire circuit you can just still continue using circum and choose planck because the underlying circuit compiler plonk is pretty cool and i kind of highly recommend uh you guys to dig in further um and the best kind of low touch but still efficient you know still thorough tutorial that i found is actually this one by metallic the other tools is to consider is cairo so cairo is based on starks and again it's a domain specific language language or dsl is being developed by starkware however in my personal opinion if you are thinking of building um ethereum zoom launch proof based kind of applications today the most obvious choice is circum um if you want to actually learn a lot more about zero launch proofs um i have i found this great compilation tutorials on zoological proofs and all these slides will be posted later for you to click on these links so that pretty much concludes my overview of zero knowledge proofs i hope you have found this helpful uh in your kind of brainstorming pro of projects to build and before i go i do want to have this shameless plug so if you want to work on a privacy preserving protocol whole time i'm working on something called iron fish iron fish is a layer one with only private smart contracts and our goal is to bridge to ethereum so that we can give every ethereum asset the best available privacy so if you have any more questions let me know all these slides will be posted on my twitter and i highly encourage you if you're curious to learn more about zero launch proofs is to click through some of the links they've provided so you can kind of learn more deeply about how they work and how you can use them today and with that i think that concludes my talk awesome thanks so much elena um yeah i'm definitely going to go check out dark forest now because that looks super cool i started googling it as we were talking um so yeah awesome well thanks for joining us again um and yeah everyone go check out her slides uh where she'll link them cool all right thanks awesome and yeah thank you everyone for joining us for the hack money summit i hope it was very informative and you learned a lot um i certainly did and yeah super excited to now kick off hack money so happy hacking everyone and i'll see you in discord bye