Zac Williamson I Privacy is Sooner Than You Think | Pragma Paris 2023

foreign [Music] this is our last interview for today and we'll get into some networking with our photo 2. Zach Williamson from Aztec hello I know he's here to get started Zach we've known each other for a long time yep and uh and uh we've seen or I have seen the full evolution of what Aztec was and what it is now so I thought it'd be best to use the next 30 minutes to actually talk about the evolution of how things came to be and all the interesting things that came from that transition it's a it's a good moment for us to make this the last talk because interestingly everything that we talked about today earlier on ended up referencing some of the work you've done in in their projects uh and uh and people may not realize it but when you look at just different schemes around just efficiency plan whether it's on polygon matter Labs some enhancements from even star core and Halo from from zcash all those things are very inspired by a lot of the things that have come out the cryptography team at Aztec but before we kind of get to that conclusion or or just the the influence you've had in this space I want to have you sort of talk about what the first ever version of what Aztec was and uh what was your goal back then yeah very happy to and thank you for the glowing introduction yeah back in the day so we started as Tech what became Aztec in 2017 so you know we're we're old assets kind of a pretty Old-Timers by the standards of web 3. and at the time we were called creditments we were called as Tech and we weren't doing privacy the goal of the company was to do basically tradify on web3 um enable like Syndicate very large corporate loans and settle them trade them efficiently uh very very different Mission and mandates what we have now but that's how we got started me and my then co-founder Tom um but we real but back in 2017 we were rather ignorant about uh how privacy worked on chain and we were like oh it's fine we'll just we'll get privacy by just obfuscating transactions you know it'll be fine it wasn't fine and we realized we needed a cryptographic guarantees around our pride about to protect you our users and so we started looking into how on Earth to do that and um you know five five six years ago it was kind of a bit of a Dark Age where you had zikash being the real pioneers and there was Monero and there was not much else outside of that so yeah we started looking to how on Earth do you do something like Port Z cash ethereum and that led us down the road of becoming Aztec so what was the actual limitation back then so we talked about just okay it was impossible but are we talking about it was just expensive or just not possible not really well practically not possible so what we originally wanted to do um when we so when we started doing ZK research was we wanted to create this concept of composable business logic so you could you could kind of just Define um developers could Define custom types of transactions that all had some kind of privacy reserving guarantees a bit like an exceptionally primitive version of a smart contract because back then that was all the crypto all like that's all state of the art crypto could really do um unless you used a ZK snark but back then ziki snarks physique stocks every single um circuit that you created this not required I trusted setup and if you want customizable mini programs that doesn't work because then every single developer needs to run across a setup ceremony which is just crazy so we fell back there's some older technology called Sigma protocols in 2018 to build the first version of what then became Aztec one uh and yeah we did our best but the tech back then was so so primitive it uh it didn't last very long and we we kind of knew we were building a bit of a stinker but it it helped us uh develop the technology that we needed to then you know create better things in the future so not having to do a trusted setup every time somebody's doing a brand new use case of a smart contract obviously there's a big hurdle uh and um seems like the the solution was we need anywhere from a just trustless ceremony setup or a universal snark that just requires trusted setup once is that is that the fair yeah that was basically the the desire so um yeah the time they were called Universal snarks they were snark circuits where you only needed to do one trusses set up and then you could write any program you wanted which seemed like a bit of a pipe dream uh back in 2018 but then in 2019 uh the Sonic paper was was published by um Mary Malla and some of the Z cash folks I believe uh and um uh that that basically was the inciting is incident for all of our future research efforts because the Sonic paper even though it's not really used anymore it was one of these very traditional pieces of tech where it did describe a universal snark when we didn't need to pass out the secretary setups it described techniques for how to do that they were just really slow and not practical but but the fact that it was like they actually had a method was exceptionally interesting and that's what Led Led Led me and and Ariel and well um and and like down the path of um figuring out what then became the plonk universal snark so let's let's just dive right into it uh we're going to try our best to keep it informative but also still high level what is planck What specifically was the insight there and what are the benefits of the protocol yeah what is plunk other than a bad dream so okay so let's go back to what the heck is a z case knock uh zika suckers what you want to do with the snark is you want to take some high level computer program and prove that you've run the program successfully without um having to get other people to run the program uh and and you can also hide some information as well uh but at a lower level what what your what these snack Protocols are doing is they're converting an imperative computer program into algebraic statements I think algebra um some equation that is equal to zero which is rather hard and abstract and a bit of a mind tease and um so you you can't do that um but you can't practically um write programs that way you know by by crafting your own algebra that's not what we do when we design circuits we we layer abstraction layers on top uh and the the basic abstraction layer is something called an arithmetic circuit where you have um instead of a program you have gates with wires coming into and out of the gates and the gates will do it's um algebraic operations like add values together multiply values together and then you can wire your gates up together we need kind of wires and output wires and that kind of you can use that to describe a quasi-train compute computer program uh and then we have ways of transforming arithmetic circuits into ZK snark algebra which can then prove and verify and the the core Innovation for Planck was well the cool problem that Planck solved was we didn't really have a good way of verifying that all the wires in a circuit were connected in the way that they needed to be for a specific circuit um showing and proving that was was very hard that was the thing that the universal snarks could not do really um uh and uh that's what yeah that was the innovation of Planck basically finding a very efficient way of proving the those wires y connections um um were correct effectively can we try let's see how if we lose people here but how do you actually prove that yeah um uh something called the permutation arguments where you you um you you you you try and create some how do I how the hell do I put describe this um uh you see quality to zero will be the analogy I think you've used in the past yeah you you create a giant polynomial where the polynomial is equal to zero when evaluated at points that are mapped to um permutation Cycles no I'm really not going to be able to explain it with words I'm sorry so okay so plot came out uh that led you to do aspect 2.0 what was asset 2.0 and and uh kind of what changed in terms of your goals at that time yeah so so it was around November 2019 I think we were all sitting in a hotel doing an offsite we were like let's take one kind of sucks we all know this what can we do to fix it and by then we had plonk um so we had the fact some some Q Tech where we're like actually now we cannot well now we can do really like the kind of complex stuff that we wanted to do um preventing one because by that point we pivoted we were like the original predom ideas is interesting but being a uh infrastructure layer that just provides private like privacy web free is way more in like that like just just a better use of time uh and uh um uh just something that like yeah we just really wanted to do quite strongly uh so we pivoted and we were like okay well now we have this snot technology we still wanted the full concept we will the Holy Grail was programmable smart contracts but we knew at the time we didn't have the tech to pull that off uh plunk wasn't good enough but what do they did enable us to do was create a private troll up well like Let's do let's make a private sale too one where you can Shield tokens you can send them around to one another you know deposit withdraw that'll be that'll be useful you know we can do it with today's Tech and it'll be a stepping stone for greater things and yeah that's what we built how did that go how did it go well we pulled it off um but it was it wasn't easy and we um yeah it's actually so maybe maybe a better question for me to ask would be that was the interesting insight and kind of from doing one one-to-one transfers from Aztec one to doing a private roll-up uh two uh this was kind of point where you sort of diverted your attention towards scaling ethereum yeah and uh my question is uh what was the the relevance around this being a private roll-up instead of just let's just get the throughput up for the entire space and get people to build apps so so the the fundamental thesis of Aztec has always been that privacy is really the missing Keystone for web3 to become mainstream uh that without privacy you you don't have identity on chain in a meaningful way and without identity you cannot really link what happens in the on on web3 with what happens in the real world and therefore basically the revenue Universe of everything that happens on chain all boils down to basically the value of a Network's consensus token or dollar amp stable coins and pretty much nothing else basically if it went to zero everything with ethereum go to zero except usdc and tele so and maybe tell the word um so yeah we've always previously first but we always but also you scaling is also an important part of making a practical mainstream um you know transactions ecosystem so we wanted both and you have some unique unique challenges in um with achieving both because if you have a private transaction system a user's transaction is not an instruction to be executed on a blockchain it's a proof of correctness of of a of a transaction that you want to execute and some encrypted State changes so basically you're saying like change some encrypted numbers in your encrypted database and here's a proof that what I'm doing is following the rules of your blockchain and that means that if you want to create a roll up once you're rolling up you're rolling up zero almost proofs which means you develop you need you need a roll up ZK snack circuit that verifies a bunch of user transaction proofs and so that concept is basically is roughly just captured as recursion um which we we abuse nomenclature in in smart quilt recursion is basically just verifying a zero knowledge proof inside another serial is proof and that is a a rather uniquely hard problem why is it hard yeah well it's hard fickle for personal access heart because in a snock circuit you you reduce everything down to arithmetic Gates um where they're basically additions and multiplications and other custom stuff but it's all all your operations are all basically they're modulo Prime field uh so they're they're all evaluated um all your numbers wrap around to some large Prime which makes math a little hard if you want to do accounting because there's no such thing as a negative number in that world but more importantly if you want to verify a snark proof um you need to do elliptic curve you need to basically do elliptical arithmetic inside your stock circuit and the way elliptic curves are structured is that if you're the the um in order to do that you need to inside your snark circuit you need to perform um Prime field arithmetic over a different Prime modulus to the one that you're that is natural to your circuit so basically all your operations are more P but you need to do more computations than a mod queue that's very hard um and and it is is it possible to do but it's it it has an enormous amount of slowdowns to your proving system because you basically have to emulate an integer number system using your weird prime number system and then use your emulated integer number system to emulate another weird prime number system and so those two layers of abstractions just meta performance uh and so there's been a lot of research that has been going into solving this problem and it is largely solved these days but back in 2019 uh it really hadn't been and I mean over the last six years seems like recursion was that Insight how how hard was this as a as a problem for you to uh to kind of get here yes so I think so I'll be doing this for six years and I probably have a solid two years of that if I want to add it all up would have been solely trying to work on recursion um because it's if it's kind of existential of what we're doing with privacy is and what we're doing with smart contracts so the new version of Azteca building is like the new aspect Network which actually is properly programmable now uses an enormous amount of recursion um to to basically compose uh transactions you want composability in a smart contract contrast only contract contracts if every contract is basically represented as a collection of snark circuits that functionally requires you to do to have snack circuits that prove other snark circuits we'll verify other stocks I'll get proofs and that all has to be done client-side on a user's device in order to not leak secrets and typically you're probably going to be doing that in a personal web browser because if your dapp's running in a web page which means you're basically Computing a bunch of exceptionally complex recursives in order proofs in like webassembly and JavaScript so um making this performance has been a um something which he has spent an enormous amount of time on uh and I think it's working too because uh obviously a lot of improvements around just what Planck has accomplished a lot of those flavors have sort of been now worked on yeah and contributed back towards the rest of the community using it and it's actually it's kind of amazing that uh we kind of come this far and uh we've kind of been pretty good on those type lights um one interesting thing that that's been uh that's been a pattern for the rest of the day today has been people talking about what does it mean to have uh composability on their platforms uh you famously chose to not to as EK VM uh why and uh and kind of attitude we think about what matters here as you think about privacy or scalability through ZK so for for Aztecs a ZK event was never really on the cards because um we once privacy which means basically you can write to Smart contracts where some of these storage variables in that contract are not visible to everybody they're encrypted and effectively owned by individuals and they're encrypted values are on chain but um and you can you can execute transactions that perform Logic on the underlying data but only people with the decryption keys can send those transactions and see what's going on this adds a lot of complexity to your protocol architecture because your state model changes um in a profound way compared to how ethereum works because in a fully privacy preserving world it's not just that your information needs to be encrypted but you cannot be like you you cannot modify encrypted information on a blockchain as in if you have a literal database with a specific value with like an index in that database containing some encrypted value you never want to send a transaction which modifies that value because people can see that and they can see by seeing what encrypted things you're modifying they can build up the transaction graph and so the state model is different in the Privacy preserving World which means that the entire semantics around the ethereum virtual machine and how it works just don't work for privacy therefore you cannot create a private a fully private evm as EK VM so we're like we're going to build a learn architecture from scratch so does that mean everybody else who's claiming to make this private in the future will not be able to do this well they're gonna they're gonna have some I'm never gonna claim they can't just that they're they're going to have to chew glass for a very long period of time I mean you can think about you can think of Aztec effectively as attempting to make ethereum private viral layer 2.

it's taken off six years it's not easy um and also effectively any any kind of zke VM layer 2 that wants privacy is going to have to take the same approach where you can add a privacy layer onto aziki evm Azalea 3 but actually making the core functionality private I'm very skeptical that can be done I would love to be proven wrong well I guess we'll find out very soon um I think one thing will be also extremely helpful is something you just touch it upon which is how contracts would be different in this world can you give us another Intuition or another more concrete example of how should we think about a private contract and what either a use case flow would look like or how it would be different from what we know right now yeah definitely so in a private smart contract on Aztec you have functions like in a regular within a smart contract but your functions are private or they're public private functions modify private hidden State and the proofs of these functions are generated client-side public functions modify regular public account State like you do on ethereum and and so um we wanted both sides of this because that way you can create these complex hybrid applications where some information can be private but for things like decentralized exchanges um you also need public State uh for example like the what's your total liquidity Supply um but to give an example of how of what something could look like in Aztec or in a private transaction world let's take account abstraction like that's that's um one of the Keystone technologies that we're hoping will um solve all of the the user experience problems with with blockchain where you users have public private keys and you use a private key you're screws it's a mess horrible a catastructure can solve this so let's now say okay so you've got a contract which verifies a Apple touch ID signature so if you have you know um if you're using Apple touch ID what's happening is a secure Enclave in your device on your computer is signing a sec p256 R1 signature According to some public he wishes to find by Apple um and there's no reason why you can't have a smart contract which verifies this flow or smart contract that verifies a Google authentication sign in or one that verifies a login via um a GitHub signature uh and so this is extremely powerful because it means that you can use these relatively trusted um web 2 authorization flows and and connect them into web3 and so instead of having to make web too much to be to the web free drum we make it very very easy to onboard web 2 style products and services and user flows however imagine a world where okay so you can now you've got you've got some um you've got imagine you've got venmo but using ethereum to settle in in a stable coin it's super cheap super easy except that well every time you use it not only can everybody see what you're playing but they can see that you're doing it through a specific Apple ID um that that would be problematic I could uh and but that was where where an Aztec private smart contract comes in where the your account contract is private if a contract which is verifying a specific Apple authorization flow for a specific use Apple ID but when you transact with that contract that contract can afford your call to you know whatever whatever wherever you want it to go but an observer looking to blockchain doesn't know any of this they don't know that you've talked to your specific like your specific Apple ID contract they don't know that contract contains your Apple ID it's all encrypted um and uh so effectively is like zero information is leaked um uh and you know because that if that contract is calling other private contracts no information selected it's calling public contracts then it's going to map your Apple address Apple ID to some like an ens address or some some public web 3 address which will be completely it's not not remotely not at all linkable to your web 2 identities this is not only just no information it's leaked you can also partially actually in this case Grant access to certain things and not just everything or nothing exactly that's amazing um is that kind of specific to Noir I guess what for for the audience what's Noir and uh how does that fit into all of this yeah so Noir is the ZK programming language so it's it's the final it's one of the final pieces of this abstraction layer that we use from turning programs into algebra it's one way you write your right right programs in a rust-like syntax and it then gets compiled down to an intermediate representation which is not friendly and can then be consumed by a cryptography backend to compile um into a stock printing verification key and we we know as we're adding smart contract syntax and semantics in order to turn it into a fully fleshed small culture programming language um and so yeah that's that's that's more amazing um I also want to kind of just talk about a few other things too um maybe you've been here for six years and working on Aztec and scalability and privacy what's what's something you've been wrong about or surprised with over the last few years on building everything that you're doing yeah um so yeah I guess I guess I'll reveal reveal my mistakes so um several things so I guess the most the most um disappointing one for for the company was we were we were so when we we launched we upgraded Aztec Two to something connect where you could talk privately layer on D5 protocols um and do so relatively cheaply and we were we were targeting 1 billion tvl in Aztec connect contracts that was that was our goal um then then the crypto winter happened and then the tornado cache happened and and the sanctions and both combined uh somewhat somewhat eliminated those aspirations but we're very wrong about those um I was also I mean let's think um I didn't think it would take us six years to build a private smart contract platform I thought it would take about two or three uh and I guess when it comes to other things in the ecosystem um I didn't think that I thought that so jordy's polygons UK evm I thought that would take at least another year to build um you know so I'll eat Humble Pie on that one I think the fun part is that I asked Jordan this question about an hour ago and he said I was also surprised that it took us only this long to build the ZK video um well let's let's try to get towards the end of this uh this uh transition from Aztec what it was to what it is now um you're now at Aztec 3.0 and working hard towards that goal what is asset 3.0 what are the goals now and what is uniquely enabled by 3.0 yeah so we've decided to reset it's just Aztec now because if you've Sunset everything up so what is it so it is a layer two that's um fully privacy preserving and programmable so you can write a smart contract in Noir deployed to the Assa Network and that's much as I said has has private and public functions so not only can you Can you capture all of the functionality of Any of of a small contract layer 2 that exists today but you can also add in this like the ability to work on encrypted State and um like completely hide your identity hide information about what you're doing and selectively reveal it um to either other smart contracts or to other other individuals if you need to and so you can do things like um you know shielded tokens and transfers you could do private identities you can like do web 2 sign inflows without leaking information you can do private governance private voting endows yeah basically the plan is that uh explode the design space of what you can do in a decentralized network by giving developers access to this critical primitive of hidden private state um and yeah like where where um building on Alexis ethereum we're planning on eventually going like having having portals to into the Aztec network from pretty much any any um L1 oil to that can support it and the goal is from launch on day one to be fairly decentralized and permissionless so no centralizations of sequences of you know of block Builders any of that it's an ambitious goal uh what's the timeline yeah because of the ambition skills autonomers are not as fast as on as the usual one of three so we are planning mainnet's end of next year um but we will hopefully be releasing the Aztec sandbox uh in next month which will basically be a local version of the network that developers can deploy to a local machine um that will produce blocks they can deploy contracts to they can write contacts in order to deploy them to the the sandbox Network and then produce blocks and send transactions to test so that's basically the the first shippable um piece of uh of the other Aztec Network um the goal is basically just to get feedback around the semantics of the the Noir language and how and the architecture of the network can see if it basically satisfies the needs of the developer community amazing um last question we're we're going to try to make a couple predictions about the feature of scalability here for for ethereum what do you think this looks like two years from now yeah two years from now I mean I'm not very good with uh with crystal ball predictions so this will likely be wrong um I think like one of one of the interesting Trends I think lately has been there's been this year has been a year very much of kind of um uh consolidation I think when it comes to layer twos with not that where like the pace of innovation at the very gracious layer of new products coming up at least my opinion is it's kind of it's it's decelerating a little bit but what you're seeing is a lot of these layer two projects that have been building for some time are starting to actually get into production something to like to fulfill the original ambitions so I suspect what's going to happen in the next few years is that that theme is going to accelerate specifically right now pretty much all their twos are heavily centralized either like they they have the ability to like there are multi-syncs on their L1 smart contracts to upgrade the network or emergency help fix things and uh like the sequences are largely centralized I think we're going to start to see more steps towards centralization uh Isis towards decentralization or towards Central oh decentralization okay um but I think it's going to be harder than than um is like generally expected from the community I think there are some relatively unsolved problems when it comes to sequencing layer twos um where there's an interesting trade-off space uh between um like that that's not quite the same as in layer ones and particularly you got this this coordination this needs to coordinate sequences on layer one and that is relatively and like the more the more uh you want to protect your liveness guarantees the more the more expensive a coordination becomes and the worst latency becomes and if you want to produce blocks say every second that can be a problem so I think we're gonna we've been I suspect some people are going to run into these problems fairly soon and but uh I imagine in two years they will largely be solved I hope they will be because we're planning on launching within two years and we need to solve them amazing Zach thank you so much for taking the time today and uh hopefully we all get to see Aztec Network live very soon thank you very much [Applause]