Scalability with zkSNARKS by Jordi Baylina

[Applause] okay well let's let's start well I'm totally marina and the technical lead of Legacy Project and if the project is an identity project that tries to solve self sobriquet identity in a scalable manner in an accessible manner so that's available for the users once that everybody be able to be a certification authority Phi itself and we want to do that in a privacy by default my design that's the main goal of IV 3 in these when we talk about the stability of these 1 1 is to system to be a skill we have a piece we call it the trusted trusted relay here mainly is a piece that puts a lot of claims and we need that is earlier what you don't have to trust it so that you can achieve ok and following this hour later we we are using what we have to use the technology that's mainly the the sycamore button ok so we decided in item free to implement also the Z Carolla because most of the pieces are exactly the same ok so in this presentation maybe I'm gonna talk about the second rule of hoho we work how we work recommendation that we are building right now and explain some of the details surface okay so let's start well this is just a little bit of a spoiler this is the results that people are possible with this system it's important important to see that this is just a theory of 1.0 is we are not talking of here and the theorem 2.0 we can talking about anything just is just using if you see one of 0 in the lower layer ok so let's see how we achieve these results what's the general idea of the roll-up idea here is sidechain like plasma if some of you have been using in sidechain we have our database of balances all these balances is Naaman sustained all these states to create like a merging true American tree and we have a rule we have a hypothesis States it is a state we have a set of transactions that we were that we correct that we put in a batch and in each much we create new estate so we process a set of transactions for each for each batch and the thing here is that in the in the blockchain in general we just put this state okay so impossible for example this is how we warranty that this estate is valid pramana tina these sanctions are processes in the right order in the right way that there is no dollar spendings that everything more it's exactly in feeds so you + mother is this gaming a staff in zero latency that's not in sync Aurora maybe what we do is besides just the needs next step besides the next state we also put proof that this state is bombed this is a zero knowledge proof okay so here is the keep is the key technology that makes this enable this is the sickest Norris the important part here is the s that's just from succeed that means that we can generate the proof that maybe 1,000 or even 31 million transactions are valid from one state to the other so we have one 256 bytes just a hot summer state we go to the next state when the 56 points and we can have the proof that proof that's one and this proof it can take long in to generate but in order to verify its time constant in 10 milliseconds don't matter how many transactions we are processing in 10 innings or in 10 milliseconds we can verify that that proof and that's the key part of all those it the roll-up stuff ok here we the system is like perfect but there is an important problem that needs to be solved here and it's what happened if this operator can be decentralized that then we receive home or it's but what happen if this operator just compute a new estate that's actually upon the state with some my transactions but what happened if these transactions are not a viable nobody knows what are those transactions this is what's called the data reliability problem that I'm sure many of you have been hearing so the idea is that we need to warranty that this data is available in this case is implementation first is data can be put in in many places but ABC presentation what it does is put the minimal data of this information the from - and the amount let's say we put it that in the same chain so we put it in the data the data field of a transaction we are putting a set of all the transactions that are putting there that's a lot of data there but that's when we will see the calculus and we will see that that's not that much okay so that's amazing of course we are trying to compress a lot is this this data in order to have more transactions okay so let's go a little bit in the pail of all these silly worries but I mean secretly who we should write this proof is proof self it mainly is when he sees a deterministic program it's a program that put an input without the computation it has an output in this case is the new rule and we prove that actually 10 good matches their matches the output okay so this is it does it prove a zero much maybe the secret has a novice and all pro of transaction so we cover the route processing section we have you any new route rasul'allah conundrum have a new route and maybe I don't know two thousand transactions and then we can have the new anymore okay so let's swimming in one of those transactions processors what we have here so here in to my name pieces of these of these silly first we have a signature verification this is very important because by design of this simply we don't need to store the signature on change the signature is a very big piece of data then we need to put plan verifying that is the signature can be of chain the transactions can be included but by design they will not be valid if there is no it's not a signature that if does not exist in a single tube that's valid for that transaction but if it's finally it happens and if it is so we don't need to store this another so this is important okay then we have of course we need to modify the state of the center of the state of the receiver of the receiver and so we have this process of vertical tree process sources that we are mainly what we are just updating this miracle tree with different states we need to have two of them from the center of rotary silver saber and of course we have all the logic of the transaction processing hearings we were a teen and there is no global spans that we have enough money into sand and all that logic so that's made pretty much the picture of the same thing you see here it's important to see that input that there are of course there is public it was like the output 3 some parts of fan that are also public is affirmed to an amount as a minimum part that needs to be available for computing the new estate and then there is a lot of private simple the current state that the only needs to be is very to be verified with the rope so let's see who is rollout move boy what kind of transactions imagine that we are start on new Rolla we have a man deal we have an empty moment the first thing that we can do is no deposits so mainly how it will work you will send you will take a token system words in many in any token so can this multi popping system so you can even send the tokens if either or whatever to a smart contract the Ola will create the special transaction that's a deposit or not that mainly what it does is creates a new leaf in the in the in the state with the initial amount that you are sending out here and so you would people would just move either to the to the to that to the side chain okay then we have the normal of chains and sanctions that are mainly just transferring from one account to the other account or this will be the same coin now all the hormones here and then we have the next election words next it may mean it is just sending the money to 0 X 2 - 0 X 0 so you send the money to the 0 address and this wheel maybe one thing will do is this will create like another tree for each body we have like a separate tree of exits so you are sending them to that to that tree so we are disrupting this tree of exits so with this from the smart contract sign again in the main chain we can withdraw we prove that when you have a leaf in this exit tree we mark it with raggedness are with Rowan and we get all done and we get the money back so here we see the full picture for we deposit we move inside and then we exit the stuff of course we can do we can do other you know can mix things we can mix between one chain of chain transactions for example we can force a no change man we can force a transfer from on a chain transaction this is very convenient for example if a smart contract wants to do a transfer inside the other chain and the last one probably the most difficult one is that we can so we can deposit on top of another error or McCown that's inside and maybe doing that transferring the same as you can see here there is always two there is always two medical trade processors in general is from the sender and from the receiver but you are using accordingly depending on the transaction that that we have okay so we explained earlier we go home would exit mechanism works ready so let's talk about the operator okay who's forging these batches who's writing this was creating these proofs well well Google here is and we have a lot of blocks we find that the slot is a number of blocks let's say for example 20 blocks and when you find an era that's maybe a census allotment and say maybe 10 10 slots ok so here you works very much like a proof of mistake so you set up you just put some state in you just put mistakes and you will be able to forge some of the graphs so when you put a state you will start so you would register for either Roscoe so fruit were dressing from okay and furniture and the recent raffle okay the raffle happens like one year before okay oh the raffle is done but the roughly is is the random number the way of generating the random number mainly is well operators they commit so then they crack is designed they decorate this line while these chaining of clashes so I click the hash of the hash of the hash of the cartridge I commit to the last one and then for every four for every block that's that's forge it reveals the last one so then just the frame is one the previous one the previous one so uh needs to be matches with the next one so it's sempre they're present it's it's our many committed random number and the raffle is made with hash of all the of all these committed random numbers from all the blocks in in each in each era so it's quite random open this so here is [Music] the chances that you are assigned to a specific slot to get to be able to forage blocks are according to that quantity of the state that you're in actually it's a little before complex's maybe it's just like a square or it's like a hex - they're 1.1 1.2 we'll see this is a proportional part maybe we want that the people that concentrates but it's not the same for example it's not the say for example having one sticker with 110 stickers with one inch or one is taken with a meter actually the chances would be the same but in one you would read just and ethers in the other which reads just what is there so we are compensating the accumulation with the people that's staking more we'll have an extra just for accumulating data we are doing that but just creating these this effective State on one arm oh yeah one important thing once you are assigned +1 in that swab the operators can mine can forge as many as many batches as they want so that's an interesting thing because they can if they are having the power to generate bunches that's good for them so the something same things that's going on there another important characteristic here is the kind of pipelining so the idea is that the blocks are not Forge so the blocks kept so the for the knocks can don t needs to be committed before a specific time in the salon so in the last part of the slot you cannot commit the new rocks you can forge blocks that are committed previously in the beginning of the slot but you cannot commit the new boss this allows to the next operator the one that's coming in the best one to start to start mining to start computing the proof for for furnace okay the proof is very very parallelism pombaline in two ways one is that measure that I have a processor that's computing a proof well if I have stayed here I can start computing the proof but maybe in the reading the proof I can forge another block and start computing maybe in another processor the proof that's one way of paralyzing but another way of paralyzing is just the proof computation just by itself is very parallel example itself so maybe it's more convenient to put all the four processors just to help in the same proof that would be like the last one this will have the advantage that the finalization of our list the finalization of the of the batch would be fast will be faster but of course require more investment ok swashing whether you slashing where many who are looking for those things first the the operators needs to forge a block from me to forge a bunch in each aslam if they go for to batch they are sloshed just who's asleep and the other is if they come in to a to a bra and they are not forged and they do not forage that come in they are so smashed number two things that they are as much with okay here you see the format of that that viability this is the part of the transaction that we need to reconstruct the from the statement needs to be a vitamin and we're putting these on chain okay this is why so sure we have only three bytes from the front three bite from the two here you see the deposit when you're doing the deposit are assigning a number so you can't like you're doing a kind of logging here so you get a very very short address here and so don't shut the address inside then twice is a floating-point style number so in two bytes we can put almost any three decimal number three and a half decimal numbers from zero to two to the very big number okay so that's that's very important because this is what allows acid was many transactions in this in this system okay well here is the all the hashes would work see all the transactions that we need to hash see the ching hai's you know ching hai's because when you are doing a well you are forcing on a cycle first and imagine that you want to force an exit if you want to force an exit you will - agilent chain this will force the operator to mine that transaction transactions that are for switch that are born on chain are forced they are the operator er have the obligation to force that so in that such as there are more in the community a cumulative cumulative cash and for the that availability park is just an sha-256 of the other than them fees fees are you know it soggy it's a dictator what's important because they want to process a lot of transactions so I hope you calculate the fees we cannot the operator or an orange chain in the chain we cannot put a lot of logic there so we need a more simplistic manganese so what it does here is that the operator chooses a field and then it's able in that block will only be possible to my transactions that user is willing to pay more than that fee so then computing how much fee the operator gets through Watts is just multiplication and these people and resourcefully there is only fifteen fifteen as well so you can select fifty different coins which field you want to pay for each coin and then only transactions of that kind will be mind [Music] signature verification here in Theresa I think here the result of investigation to where we're using V BSA in baby job we're using the Poseidon function it's a function that's still not well it's safe what's very new and right now I know that that is the foundation and our people are running some competitions in trying to break this this new cryptographic futures but they are very efficient and it works very very well maybe it's possible to kampachi inside the eyes inside the sword normal batching of a media say would require to work with model with a modular math that's not exactly the one that starts so it's not as easy as it looks like but there is some investigation there but mainly what we're doing is just a normally media say for each transaction and this is right now one of the most important consuming in the number of constraints that were having okay here is we already talked about the chamber instructions yeah another important thing that the system have is atomic tommix watts atomic forces are transactions just but without adding anything will change just you can sign the data section that Eastern instruction will be only minded if these other transactions happen and the same in the other transaction so this allows to do atomic swaps this is for example for exchanges which is very convenient for doing this is kind of a public option this is just like the next row field that's silent when you are creating the of chain transactions and this is on without adding in any extra cost in their own chaining part well here I want to talk a little bit about the improvements that we are doing right now and we have a full implementation of the proof generation code nine GPUs and again the N 128 very small random numbers it's like in Allen saying this is a very wrong numbers because they are still optimizing and we are still working but in a soup 10k hard work we can compute 2048 transaction proof in about 10 minutes that's our the numbers that we are working right now so there are their starting point what there are still some optimizations that we can do here we are wising maybe is working with FPGAs and other technologies can be improving here some matter of speed cost complexity this is very much the parking very much oh oh okay here is a numbers as you see the first line is how much cost well first the number of transactions that we're having in February now is about 32 transactions here I'm talking just about normally 13 transfers so we have 10 millions divided by 21 K this is 32 transactions per second divided by 15 we get 32 files such as per sector that we have right now normally three transactions just to have a reference if we implement a system in the only change Nancy is now the cost of putting all these data valuable chain is this quite high you see 2048 researchers times 8 bytes per transaction I'm size 68 Gasper right that's a total number of 1 mil more than 1 million for 2000 rands actions okay so that means that we would be able to put five batches in a block so that's that would be the if the the relative number of about 682 transactions per second which is not bad okay but in the after the Istanbul where the proofs of these data bytes in chain plus the reduction cost of the of the proof verification okay this reduced doing the same numbers we would be able to put 15 Manchester walk and then the number the theory can be beat of the transaction we're talking always about the DN 128 card just without doing any special things we could go both these reasons of course what we are working with is number of transactions your stuff having other problems I need to process to thousands of sections that are such a cool song getting more complex over there you have other people tease and these to be soft but that's but a lot of the technical numbers were here some of you may think that okay Gavin you have to put this expensive hardware in order pinion okay but yes yeah the cost of the hardware should be less if you do division is less than 1 1 1 sin okay so here are a set of terms of our working in in 93 we have a circle simcha bleep many of you are here Aires coolness arts other things is working is going in this place of course we are still working there any deeper hole this is just a specific part of any problem I don't know if you have seen here but we are running this game for just verifying or this cannon of trust and network you see some some papers here if you want to play the game that's up to you that's a nice fun game to play and say yeah we want to release the road to release also we want to release all the other API for the idea we are working very hard on the wall and we hope that the next week's we believe in essence that's very much [Applause]