zkBitcoin | David Wong, zksecurity.xyz | ETHTaipei 2024

all right uh hi everyone can you hear me yeah uh so yeah this is uh this is me this is David Wong I play this person online on the internet um usually I tell you to follow me on Twitter at the end of the talk but you're free to follow me on Twitter now if you want uh these days what do I do I I'm the founder one of the co-founder of ZK security we do audits of ZK systems and we're hiring so if you're interested in uh learning about ZK or getting more into ZK and security you should talk to me uh I also do some uh uh research advising at archetype uh ABC and uh you might also know me as the author of real world cryptography a book to learn about cryptography and uh the next uh engineer at Mina and uh and Libra /dm so anyway um oh yeah and by the way this is sort of joint work uh ZK security does like audits but we also do research we also do development and this this is sort of a part of the research that we've done uh and and this is Joint work with some other company called Sigma zero so anyway um I was I was with a friend uh called Ivan and we're talking about how ZK has change the landscape of all the crypto we we know about so if you look at the I don't know if if that's the top 10 or U or I don't know some of the the top coins and we've seen that zi has completely changed everything there and and we know that in ethereum like all of the top projects these days are like ZK projects and everybody's talking about ZK and and so on um but when we look at the OG projects uh so Bitcoin we don't really see any ZK there like nothing's really happening and so we were yeah we wondering why like we we had this question of uh what's going on and so especially we wanted to just deploy some Z stuff on bitcoin and and we just couldn't do it like there's nothing so we looked at the we looked at Bitcoin and I guess this is more of an ethereum audience so you can see the up Cod of Bitcoin as like the evm of Bitcoin and this is sort of what Bitcoin has and if you want to write like smart contracts I guess Bitcoin this is what you get um and it's not it's not very powerful you can't really do much with it and so verifying a proof is sort of uh impossible so something came up re somewhat recently called BVM and BVM is the idea that we can maybe use fraud proofs to uh extend what uh the Bitcoin script language can do and the whole idea of these front proofs is that whenever you want to run a circuit to to spend some funds or something like that uh instead you're just going to spend the funds and then if someone disagrees with you then they'll basically create a fra proof and they'll send it to the network and they will punish you like you lose some money for uh having lied to the network uh the idea behind BVM is that you can write a circuit uh some sort of binary circuits of your of the program you want to encode and if there is fraud and someone wants to prove that there is fraud they'll break your circuits which is made of binary Gates into as many transactions as gates in your circuit and they'll basically sort of execute your circuit on chain going through the circuit gate by gate sending these transactions on chain until something actually doesn't work and we see that the circuit was badly run uh and then the the the person can be punished uh oh by by the way is should I talk closer to the microphone can you hear me in the back yeah so the problem with BVM is that um or the problem with fra proofs these kind of protocols in general is that you need to leave time for people to create a fraud proof so whenever you do something because you haven't really done the thing you need to leave time for for people watching the network to create this for prooof and here we're talking about Bitcoin and Bitcoin is you know pretty slow uh there is like an hour confirmation time and so you can imagine that verifying something like a a proof or if I lie about verifying a zero knowledge proof someone would take quite some time to create a fro proof on the network and we're talking about like a pretty huge circuit with many many many transactions uh and it's not clear exactly how long that would take to to to uh to do these kind of things um the other thing so so yeah so it's very combersome it's very slow if you have a fra proof fortunately usually you're you're in the happy path where you don't really have frauds and it's fine but even then you need to lock your fonts because you need time for people to create these FR proofs um and maybe last thing I can say about that is that usually you're in the happy path and so you don't really exercise the creation of fraud proofs and so because it's slow and it's hard and it's kind of crazy like for the size of circuits that we use you don't really exercise this in production and so you're not even sure that it's going to work if if you have an actual fraud uh at some point so when we looked at that we were like okay this is kind of a dead end uh we don't think this really it's like the hack of the hacks uh to make it work on bitcoin and like it doesn't really make sense um so so we looked at what people did and basically all the projects were waiting for an up code to be added to bitcoin to verify proofs more easily uh usually stock proofs and if we know about the history of Bitcoin we know that they're pretty slow at for at upgrading the protocol and so we don't really want to hold our breath uh we don't think that's going to happen anytime soon uh and so we're looking for something else and uh recently there's a chainway that came out came out with craa which is a uh I believe a ZK rollup that uses BVM but it's not really clear how practical this is but uh this is interesting to note so okay so uh we thought really hard with my friend Ivan and we're like okay every blockchain is basically a reduction to consensus whatever you're doing in a blockchain you can use ZK you can use signatures you can use hash functions doesn't matter or F or NPC doesn't matter what you do you always reduce the security of your problems to at least a consensus problem and now actually we can maybe we can try and reduce the verification of zero knowledge proofs to a consensus problem the second thing is that that doesn't really tell us how to to make it work for Bitcoin and basically the answer is that we can use NPC to make it work with Bitcoin and I'll sort of explain that and that gives us ZK Bitcoin which is sort of a way for us to verify Pro proofs on bitcoin we're not really verifying proofs on bitcoin but we believe this is sort of the best thing we can do and this didn't exist yesterday so we're happy that you know today you can like go on the test Nets of Bitcoin and you can actually deploy um like these applications and use zero knowledge proofs to spend funds so uh we think it's pretty cool so the first thing we came out with was this idea of stateless ZK app the ZK app is ZK application and okay that kind of sucks it's supposed to come out uh bit by bit so kind of ignore the the rest let's look at the first one uh and okay don't try to read too much into it you listen to my voice uh the first idea is that we're going to use a Comm a committee that controls a wallet using a threshold signature scheme that's you know pretty basic idea of um just controlling a wallet nobody has the private key it's a committee and then we can let people lock fonts by is sending a transaction to the public key of that committee and uh if they want to unlock funds they will just submit a Zer proof uh to do that and that's the whole idea behind that's that's the thing we're trying to unlock uh with the stateless zabs um so in more details what you do is that you're sending a transaction that lcks some funds to the zcoin public key and the circuit or the compiled circuit uh is basically added as metadata uh in the transaction next if you want to unlock some fonts you just send a request to that committee you send the proof you send the actual circuits or the the verifier key and the committee basically every member of the committee verifies the proof verifies the transaction makes sense and that it's tied to the proof and then they will all sign the transaction so okay so what what does that unlocks basically the first thing that it unlocks is to uh have more complex uh circuits or more complex Logic on bitcoin and the second thing that we're unlocking is privacy of data that's thanks to the zero know Edge proofs uh and so today you can use stateless Z apps to basically control the wallets using um your SSO login like your you know log to Facebook or Google if you want to use the ZK login protocol or you can use zkl that came out somewhat recently also to control a wallet using proofs that you received emails or maybe you can use something like ZK pass You just prove that you own a passport and you can control a wallet with that um okay so if you didn't get what I was trying to explain maybe some visual example example of the same stuff might help to deploy a Zab basically you uh you create a transaction on the Bitcoin Network where here on the left you have the inputs and remember we're in this utxo model and here on the on the right hand side you have the outputs the utxo that you're creating and one of them is basically uh utxo to the zkb coin public key with what whatever amount that you want to lock and one of them is the verifier key so the the compiled circuit that you want to use to lock your fonts and we use the up return trick in Bitcoin to to expose that data on chain basically at this point a ZK app can be referred to as that topple of transaction ID and which outputs uh so the first one here in the transac transaction um contains the Z app and know if you want to use the ZK app if you want to unlock the funds you just refer to the utxo the ZK app and um as long as you pay a fee you can do whatever you want in that uh transaction and so this is what the committee will see and they will verify a proof they will make sure that the proof verifies for the circuit that you embedded here in your transaction and if the proof verifies they'll agree to sign the the transaction okay and basically we expect so for now it only works with circom uh we can we can try to support different types of proof systems or Frameworks uh but for now we only support shc come and so you can assume that we're going to expect a circuit that looks like this uh where one there's one public input and it's the transaction ID and we do this because we need to make sure that nobody can steal your proof to um unlock funds in their own transaction right so we need to strongly tie your transaction with the proof If you don't know ccom just ignore this thing there's just one public input and it's the transaction ID okay so we're thinking about that and we're like okay what we did is pretty simple we just lock fonts and it's like a onetime you know consumption one time use how about the idea of smart contracts like we have them on ethereum and so we call this stateful ZK apps so ZK apps with State and the whole idea is pretty simple if you understood the previous state L caps there there isn't much uh more here we just when we deploy we deploy something with some initial States and when we use we sort of preserve the ZK app and we do a state transition and uh I'm going to show you a diagram because I think it's easier to understand on a diagram but this is basically the same diagram that I had previously except that uh here we not only have a compiled circuit um engraved in the transaction we also have the initial States and when I use when I I want to use that ZK app that stateful ZK app um there's two new Fields compared to the stateless zaps uh the Pres so here we preserve the zap right we didn't consume it it's still here it's still here with the same circuits but with a new States because we have a state transition and so you can imagine that here your smart contract is basically um uh every time you use it it Chang address and the the circum circuit that we expect still has this truned transaction ID this transaction ID but it also has uh the previous States and the new state as output so you want to verify State transition and we also have amount out and amount in and these are basically um if you want to like withdraw uh some of the funds locked here or if you want to deposit some funds uh you have to Pro it in the zero knowledge proof but yeah basically this is the main template and then you can do the sky the limit you can sort of have whatever zero knowledge proofs you want whatever circuit you want uh so this is ZK Bitcoin 1.0 so we we just wanted something to be able to like deploy these things and verify Zer proofs on bitcoin so we built it uh you can use it or you can go on the repo today and check it out um and you can use it we have a CLI that you can use to deploy these things today on the test net um and now I want to learn I want to tell you more about some insights that we learn uh and then I'll tell you about the future of of zkb coin um so the first Insight that we learned is that when we implemented this thing we realized that the committee doesn't need to know about Bitcoin it's very blockchain agnostic the protocol that we wrote requests are very uh self-contained as I say here and so when committees see a request coming they only see a transaction a proof and a circuit and everything is contained in the transaction itself so they just have to check the transaction and they know that they can sign it and I think I wrote here that even if the transaction is invalid or if the transaction is trying to double spend something um it it doesn't matter from the committee point of view because Bitcoin will catch it later so they they don't care they will just sign whatever as long as the pro verifies the first benefit of that design is that if you want to run a node it's actually very cheap is uh we run our nodes for like $4 a month but we can probably run them like on a laptop like it's it's very very easy to to run them the second benefit that will talk about uh in a few slides is that we can maybe generalize dats and maybe ZK Bitcoin is just one example of of uh these kind of protocols okay so um just to mention what we're doing right now for ZK Bitcoin we've received a lot of questions from different people actually a lot of ZK rollups are trying to build on bitcoin and so we've um we're talking to a number of projects that maybe want to use the ZK ZK Bitcoin protocol to uh make their rollup work their ZK rollup work and so the questions we sort of had were like okay how can we Implement these erc20 types of tokens how can we implement ZK rollups uh how can we try and figure out these multi-user applications especially as the ZK app change address every time you you're using them and uh we have two proposals for that that we're going to publish and we're looking for comments actually so if you're interested you can check the repo and and we'll be posting the two proposals there the first proposal is basically um called fungible ZK apps or utxo aware ZK apps and it's something that we're adding on top of ZK Bitcoin and second one is called tataa for token as data in apps and it's a redesign of ZK Bitcoin but basically what we're trying to do is to use the utxo model and to make it work with the utxo model and I'm not going to talk more about that because right now I want to talk about Beyond ZK Bitcoin uh and yeah so okay so as I said ZK Bitcoin is a pretty simple application as a member of the committee you don't really need to know about Bitcoin you're just um you're just uh okay let actually let me summarize it where ZK Bitcoin is basically thisle which is a request predicate and NPC artifact uh I just made it up uh maybe there there's a better naming scheme here um but from a Committee Member you just look at a request so you just need to know how a request is defined um in zkb coin a request is just a transaction and a proof and a circuit uh you need to know how to validate it so that's the predicate so how do how do you validate it well you just check that the the transaction makes sense that the circuit is contained in the transaction and that the proof verifies with that circuit and then you produce an artifacts using NPC and so in our case we just produce a threshold signature but you could think of more complex NPC circuits um where we could produce maybe different types of artifacts and so the idea now is that since the the hard part of ZK Bitcoin is not really the protocol itself but it's coming up with a committee that will you know not cheat and that if the committee cheats we can we can U punish the committee and these kind of things so maybe we're thinking about some sort of layer one or or something like that that could provide um this kind of like these kind of like tople applications and ZK Bitcoin would only be like a very simple or like one application built on top of a network like that um so yeah so so we started with ZK Bitcoin we just wanted to verify Z ZK proofs on top of Bitcoin and know we ended up with something that we think is more General than that and could be useful for uh a lot of different use cases on a lot of different chains especially as it's completely chain agnostic uh currently cool so I think this is my last slides um resources you can check out the repo here uh on the repository you will find a white paper you will find a lot of videos that we recorded on what the white paper contains what's on the repo how the protocol Works how to use it if you're developer uh so check that out and we have a bunch of issues if you're interested in contributing to the protocol we've had a lot of contribution so far so we are very thankful to the contributors and yeah this is joint work between Z zik security and sigma zero as I said um specifically me and Ivan and yeah and again you should follow me on Twitter if you're not already doing that uh I need more followers uh and I think that's my last slide yeah this is [Applause] it so now it's our five minute Q&A time does anybody have questions for David thanks for the talk David uh just curious so these are really simple proofs right now they're essentially just um I guess I'm just curious what what are the cost of generating proofs right now and um Can can you say that again the cost of generating proofs just curious about uh kind of the complexity of them right now it seems like a really straightforward circuit and then kind of where you imagine these these going in the future as you get to applications like ZK login and ZK pass okay so he was kind of kind of hard to hear you but you're saying the cost of verifying a proof or generating a proof just wonder the cost of generating these proofs right now oh yeah so Co cost of during the proofs uh basically is the cost of during you know circum proofs with like snark JS and uh so um depends on the side of size of your circuits basically yeah and yeah we're not too we're just reusing Frameworks So currently we're using circum and sjs uh but we might want to we we're trying to talk to risk zero to like verify their proofs and starware to verify their proofs um basically there's no verifying proofs is pretty light so there's no real reason reason for us not to support different proof systems at this point so you could see a future where for example you can verify any risks like any risk zero ZK VM proof so people can write whatever application they want let's say using risk Zer VM and then you they can kind of bring that to to bitcoin uh ZK Bitcoin yeah I guess as long as you follow the templates and your public inputs are like the following one in this order then it shouldn't matter yeah cool cool are you do you have a a feature requests yeah I'll get back to you on that I think yeah do we have more questions thank you so much for the talk thank you [Music] [Applause]