Zisk: zkProving in Real Time | Jordi Baylina - Polygon

[Music] wow what a great morning of great talks uh that's it for me on this stage uh but you still have a full afternoon of s tier speakers my name is Jane Harold uh I'm from coand you can uh you can find me on Twitter and telegram uh next up we have zis ZK proving in real time with Jordie balina from poon hello everybody I'm Jord valina uh co-founder of polygon and I want to present today zisk zis is a a common good it's an open source project and mainly is uh software it's uh ZK BM uh 64bit R5 uh proving system okay it's a system that's very much optimize for generating uh for proving in real time it's using in the that you can write any program in Rust and you can write circuits in Rust and then you compile and you generate that the difference I mean the big the big advantage of uh well you can try it here I mean it's fully available right now still some Audits and mean some improvements that still in the backlog a lot of things to to do but right now it's fully working it's fully proving you can write a Ras program and it already proves and you can try it here anybody that wants to I mean have any dobs please don't hesitate to contact us okay um as I as I was telling uh the main goal of Z is uh minimize the latency being able to build proofs as fast as you can here why we may sacrifice a little bit of the price of the cost the cost are already very low uh but and what we want to do is generate proofs fast ideally and we we see the how we can do it uh ideally to for example to uh prove blocks ethereum blocks or uh rollups blocks in real time why is this important well that's important uh for example for when you have many rollups and you want to transfer funds from one to the other uh when you have two chains that are not um that you don't really I mean when the one of the chains can be malicious um in order for one chain to be sure that can use the fonts of the other chain well you need that the other chain is committed so that the other chain is final that cannot go back and needs also to check that the other chain is correct you can do that in two ways you can do that by following the other chain maybe spinning up some servers and following the other chain but this does not scale well I mean if you have a lot of Chains It's Not Practical to spinning up servers every time that a new chain is created or each chain is moved okay so the way is that each chain generate a a proof that the uh that uh validates the correctness of that state and then the other chains can just use that uh proof in order to validate the chain without having to spin up all the chains that's why it's important this tech for um um aggregating uh in the aggregation layer for aggregating uh different uh rollups it's also important to mention for example that in the ban chain in in ethereum uh everything is based on this uh uh proving block really fast and doing a lot of proof and that's all the consensus that they are building on there so it's important to have this uh technology uh in place this is well it's a little bit more that does this gkbm actually this gkbm is built on top of a proving system a full proving system uh this proving system has a full language it's a language for arithmetization and it's a proving system that can be used for any pro I mean for build up uh Z kbm but can be used also to build other processors this is very much using all the technology that uh we already develop inside polygon with u uh inside Hermes and plony 2 and plony 3 so all the all the knowledge all the knoow is already there I mean all the security um mean all the security uh knowledge the back bounties having that in production I mean all the learnings and all the knowledge is inside uh this uh this product okay and on top of that there is also a small piece that that's a recursor that allows you also to aggregate proofs uh on that in a simple in a simple in a simple way pill to language I'm not going to extend to that but it's uh it has been I mean in in the ckvm we use it pill did was did g this gave us a very good results so pill do is an extension on that and it allows very much um uh to support what we call the vat cops okay the the idea of the vops is that instead of having a huge monolitic proof as we had for example in the zkm the idea is that we can split this proof in small sub proofs mean small pieces okay this allows us to scale um horizontally so we can send all all all of these pieces all these estate machines in uh different servers we can configure the sides of these pieces so we can have a decentralized system where each part is building one of these parts of the servers and then with the recursion technology we aggregate all them together in order to build a single proof and uh I mean all the design architecture of this is uh uh on that I mean it's uh trying to decentralize I mean trying to um split the work as much as you can okay we will see then in the last slide how we split the timings on this on this slide okay well I'm not going tot understand but the the proving system is very much you write this arithmetization and you write uh the witness computation and with all that that's only the only thing you need to build with all that you have a full proving system that can work in your in a single machine or can work in a in a in a service okay um going to jump this uh little fast this I mean when you when you're building a this what you do well mainly this is the workflow you do you just take a you just write a program in in Rust you compile in Rust uh using RIS five uh 64 bits so you generate an elf okay and uh then this with this elf you just send it to the approver together with uh an input I mean in general is some input file you want to prove something okay so you have a program and you have an input that some data that you want to process okay and the pro will generate just the proof and the public input that you can verify okay the program also you can hash it so that the verification you can you are sure that you are verifying against exactly this uh EXA program so it's as simple as generating as creating a normal uh Ras program the internal so one of the key Technologies as I told you is this division of the of the pieces okay uh and uh um the most important I mean and idea is that all these pieces they communicate to one each other what we call a kind of a boss okay a kind of a boss very much what it says is for example in the main processor uh you are uh instead of you you may do for example a multiplication or a division or you're doing some operations okay so instead of doing the operations in the main processor what you do is you in the main processor mainly what you do is you assume that this multiplication is correct without proving it okay and then we add that to the bus and in another state machine in another piece that's more specialized State machine for example in arithmetic you just take and you prove that concrete multiplication or division or or addition okay then you substract from the boss so the the idea at the end is that um uh when you have different state machines you sum up all these bosses this sums is with some random numbers so that you cannot um you you you can I mean you cannot trick it and the IDE is at the end all the assumes needs to be zero so everything that's assumed for some State machine is somehow proven in the other state machine so this allows us for example to do some uh interesting things like like like this for example in in in this you have some operations um for have a multiplication and you will have for example an arithmetic that will substract from the bo so in the in the processor we add and arithmetic substract but if it's an arithmetic for example that's a very common arithmetic for example is 1 * 1 or 2+ two instead of using an arithmetic that's proving you can have maybe some precomputed operations that you know that are Bid that are in another state machine so who's subtracting from the W is maybe another state machine so this allows us to be very very flexible for example in the 62 bits for example operations that are in in 64 bits they can be you proven in a in a state machine that's a little bit more expensive if they are 32 bits maybe they are proven in the 32 bits arithmetic and and and so on okay there is also um for the memory for the memory align so in general the processor when he doing on a memory operation I mean they send it to the boss and the memory just ANS but the memory is just for memory aligned operations if it's not memory align maybe we have another intermediate uh machine that what's doing is solving this um non-alignment so the idea is that okay you verify that one is correct but at the same time you are assuming that there is two reads maybe that uh needs to be done and these are the ones that the this re alignments these are the ones that are solved by the by the by the memory a similar trick can be doing for example for continuations it is you may have a processor I mean the state machine of a processor that's executing a code okay so if you want to split that in different chunks okay uh I mean you need some continuation so the state of the previous one needs to be transferred to the state of the next one so we do that also with the bus so so we add that in in we add the state to the bus and the next estate machine they subtract that to the so this allows us for example to do continuations uh um uh with the bus so with continuations there is another other interesting tricks is that um so we have two kinds of continuations these continuations that you do it inside the same proof okay that you have these two proofs and you agre that to same proof but you have also the recursor the recursor allows you to have different proofs and um uh aggregate them together okay and the trick here is that uh all these proof are well packed so here we have a technique that does not uh we don't uh I mean we don't we don't waste um cells inside the pr uh for these remaining things so we can connect different proofs and generate that in parallel without memory requirements and connect them together okay as I mentioned a lot of disadvantages I want to mention especially while it's uh there is a CPU accelerated is really fast and it's a fully open source so anybody can build I mean it's not a system I mean just a code that you can download and you can run it I mean it's an open source system that you can uh run uh on top of that this is the timings that we are having right now so at the at the total for example for proving a a block uh uh ethereum block we are proving that in real time in less than 12 seconds Okay so and here you see the parts where we are spending the time first we have a I mean if you want to prove an execution we need to execute that okay and because the risk five we need to somehow emulate this risk five and it's not only that it's not only execution we need what we call a minimal tra we need to something else okay so this is the part that's difficult to uh parallelize actually there are some tech tricks that we have in the the backlog that we can improve that but currently it's a single processor and this processor right now it's running at 300 MHz more or less okay so this is an this is um I mean it's a time that you will have always in there okay then we have the windows computation Windows computation very much is building all the polinomial this step is already done in parallel because we have different machines it this this can be done in in in absolute and parallel the same that the the sub proof building itself I mean this is the core part okay so this is where the real proof is generated I mean these is are very much metalizations and then and entities it's interesting that these 5 Seconds we can choose what we want they if we choose a small number that means that the proofs are going to be a smaller and it's going to be much more proofs okay so we probably will need much more servers in order to have this this timing but this architecture allows us to configure how how much we want to spend in each of the faces and of course if we have a smaller pieces then we pay it in the aggregation we need to aggregate them together here is important and this is one of the big characteristics is that the we right now we are currently only at one 0. 15 seconds for doing an aggregation okay so taking two proofs and aggregating in a single proof this is just uh uh uh 150 milliseconds which is really really small of course this if you have a lot of su proof for example you may have thousand 1,000 2 thousands of difference of proof that you want to aggregate you need to multiplic it multiply that by l n the number of uh sub proofs that you are doing so in 2,000 then you need to multiply multiply that by 11 okay so 12 so this is this with this around two seconds but as you see all together is uh less than 10 seconds so we can really prove uh ethereum blocks in in in in real time okay backlog I mean uh a lot of things GPU is at this point is uh I mean it's not public yet but probably next week or in two weeks is going to be uh already public I'm very excited on that and there is a bunch of things in the backlog that can be optimized and a lot of these numbers can be can be lowered very much in the upcoming the upcoming in the upcoming times okay prove it test it check it it's here okay uh any dobs anything things please contact us uh we are happy we want this to be used not only uh inside polygon we want this to be used for any project that have uh uh interest in building uh ZK proofs that's it thank you very much and if you have any question just don't don't H to to talk to me