A Layperson's Guide to ZK - TOKEN2049 Singapore 2024

All right, good morning everyone. How you guys going? Uh today I'm going to give a talk on a layperson's guide to ZK. Um and what I found today is that the term ZK has become primarily a buzzword. ZKAI, ZKML, verifiable systems, I don't think most people really know what it means.

So, I want to give you guys some knowledge today. I hope if you give me your next 15 minutes, uh that you can leave here and know more about ZK than maybe 45% of people or maybe 95% of people that you'll meet for the rest of the conference. So, let's start. Uh I'm Damien. I lead growth at the StarkNet Foundation.

Um I was previously the head of BD at Drift Protocol on Solana. Um and I used to be a practicing M&A lawyer. Um and let's go back to the beginning, where the genesis of ZK really began. In 1985, Shafi Goldwasser put together this paper, The knowledge complexity of interactive proof systems. Shafi actually, interestingly, is also a scientific advisor to StarkWare.

Uh but this paper is seen as the genesis of where ZK systems are today. It's a new area and it opened up new research in the intersection between mathematics, cryptography, and computer science. And then shortly, 33 years later, we had a brand new article. This one's by Eli Ben-Sasson. Eli Ben-Sasson is the co-founder and CEO of StarkWare, and he wrote scalable, transparent, and post-quantum secure computational integrity.

This is one of his seminal works, and it's the foundation of what the proving system STARKs is based on. To give you a little bit of background information, uh this is Eli. He's a kind of my boss. Uh he's the founder and CEO of StarkWare, and he's the chairman of the StarkNet Foundation board. He's a professor at one of the top universities in Israel and he was a founding scientist at a project you guys will remember called Zcash.

He's also the co-inventor of a lot of the foundational ZK proving systems today. Uh and that's him, right? He co-invented Starks and then he founded StarkWare which is a company. And then StarkWare created a product called StarkEx which is powered by Starks. And then we had the public blockchain, StarkNet.

This is where I help work at a core contributor towards. And Starks also power StarkNet. And finally, StarkWare and the StarkNet Foundation are core contributors to the public network StarkNet today. So, quick labels. StarkNet, StarkEx blockchains, Starks proving technology, StarkWare StarkNet Foundation entities.

All right, now that we have that underway, we'll go back to this 2018 paper, right? This was a breakthrough in proving systems and they're battle-tested today. They've been in production, they've been used to scale blockchains, and they've been used by many different companies outside of ourselves. But the vision to use zero-knowledge systems to scale to scale computer systems with limited throughput began much earlier than 2018. In fact, this is Eli again.

Uh I really like him. Uh this is him in 2013 at a Bitcoin conference, right? Bitcoin uh San Jose. Uh this is the first Bitcoin conference uh in the United States and the first that was hosted by the Bitcoin Foundation. And this is Eli speaking at the Bitcoin conference talking about how ZK-Snarks and PCPs could scale Bitcoin and enable private transactions.

Just to put it into perspective about how early this was, right? We had in 2008, the Bitcoin white paper released. We had in 2009, the Bitcoin Genesis block. We had in 2011, Satoshi's final communications. And then we had in 2013, Eli speaking at the Bitcoin conference about scaling Bitcoin using zero-knowledge systems.

This was 2 years before Ethereum's mainnet launch. And in fact, it's about, I think if I'm doing my math right, 8 years before the launch of the first optimistic roll-up. I'm choosing Arbitrum here because Arbitrum launched before Optimism did. But that's how early zero-knowledge systems were conceived to scale limited systems as it was. So, the vision didn't stop there.

Bitcoin for many reasons didn't apply ZK-SNARKs and PCPs. And then we had this little thing called Ethereum launch on 2015. And Ethereum's great, right? Uh Eli's paper was released uh in March of 2018, and then we had this period of explosive growth in scaling systems. StarkWare was established 2 months later the paper in May.

And then in July, 2 months later again, StarkWare received the largest grant to date from the Ethereum Foundation to build out StarkNet infrastructure. This is their tweet back then, July 16th, 2018. Uh they're very excited about a big grant they received. Uh and they received $4 million, right? In a grant series where the next largest grant was 400,000.

And if you can recognize some names, uh Uniswap was in the same batch. Um so, there was a lot of faith, right? There was a lot of faith and trust that STARKs could be the vision to scale Ethereum even as early as 2018. Um and that's exactly what they said they would do. They said they would massively scale uh with transparent privacy and post-quantum security.

So, just putting this into perspective of everything else that has happened in the last 5 years or so. This was before the mainnet for any L2 had launched. This is before the discussion of L2s had even began. This is before the debate between validity and optimistic roll-ups. This is before the distinction between ZK and validity roll ups.

Um and this is before a lot of zero knowledge roll ups are even on mainnet today, right? We now have a Cambrian explosion of innovation. We have Aleo, Polygon Miden, Risc Zero. We have all of these new companies uh building on zero knowledge technology that StarkWare had already seen the value of back in 2018. So, let me go through some actual core concepts now to help everyone's understanding, right?

I've talked a lot about proofs, STARK proofs. I've talked a lot about STARKs, and I've talked about a lot about using STARKs to scale Ethereum. What does that really mean? So, a proof is essentially any system that can prove to another party, that party being the verifier, that the statement they are saying is true without revealing anything else other that than the fact that it's true. They also need to prove that statement beyond a reasonable doubt.

That's a that's a legal concept. Uh and STARKs are a type of proving system. They stand for scalable transparent arguments of knowledge. But they're not the only proving system on market. There's also SNARKs.

SNARKs are succinct non-interactive arguments of knowledge, and these were the predecessor of STARKs. So, why would you use proving systems, right? I've talked a bit about privacy, and I've talked a bit about scalability. Protocols can want both, right? You have a Zcash or Monero, and they use zero knowledge systems for private transactions.

Or you have a StarkNet, or you have a Polygon Miden, and they'll use zero knowledge systems for scale, because they need higher throughput, cheaper transactions, and they still need to be secure. Whether or not the system has a prefix with ZK in front of it, that usually gives you a hint, right? Are they using ZK for the privacy-preserving aspect, or are they just using the proving system for what it is? Now, different proving systems have different trade-offs. It's similar to blockchains, right?

Ethereum versus Solana versus Bitcoin. Your design choices impact what you offer to your end user. And so, the size of your proofs, the time it takes to generate them, the time it takes to verify them, these all impact the end product you can give to your user. And so, STARKs, we believe, are the best way to scale any system with limited compute. They're post-quantum secure.

They have larger proof sizes. It takes longer to generate the proof, but it's actually faster to verify the proof on the base layer. So, once again, different blockchains use different uh use the case systems for different reasons. And these are the different iterations that are available today on market, right? You have STARKs that are used by StarkEx, StarkNet, w Zero, Polygon Zero, etc.

You have, I guess, on your guys's right-hand side, uh the four different implementations of SNARK proofs. These are all technically SNARKs, but they have slight modifications that make them uh slightly different proving system. So, how do proving systems actually scale Ethereum? Why is this valuable in any way? Well, if we conceptually think about what a blockchain is, a blockchain is really just a ledger of public information or public data that's been stored on chain, and it's immutable and verifiable because it's decentralized, right?

You can go onto a blockchain and you can see from the genesis block every transaction that has happened, and you can rerun all transactions to arrive at the exact same state. That's how you know it's immutable. But usually when you have something that's immutable and everyone can verify it and it's decentralized, it's a little bit slow, right? I've just sort of explained the blockchain trilemma here. Um and so, if you think about the blockchain trilemma, really security means immutability.

Not everyone can go in and just change the ledger, right? That's what security means. Decentralization means verifiability. Not a single Oh, sorry. Any single person can go in and they can verify the network.

And then finally, scalability, everyone knows to mean speed. So, how do proving systems help the system? This is how Ethereum does it today, right? If you want to propose a new block in the blockchain, uh a block producer will bundle a bunch of transactions into a block, and that block will say, "Hey, the new state is 42." And then every validator on the network has to do the same thing, and then they rerun all the transactions, and then they say, "Boom.

The new state is 42." And then that new block is part of the blockchain. How proof scale Ethereum is that off-chain, so on StarkNet, we run all of those transactions. Those transactions are bundled into a smaller a smaller proof. That's that extra little half rectangle or half square you see there.

And then on Ethereum, all you have to do, or all the validators have to do, is verify that smaller proof. And all those proving systems I showed you a minute ago, these all impact how big or how small that proof is, or how fast or how slow that proof can be generated, or how fast or slow that proof can be verified. And that's exactly how proofs end up scaling Ethereum, because the blocks can fit more space. The blocks only have to process the proof, and the proof themselves represent a much larger batch of transactions that has happened on a different environment. And so, it's still scalable because it reduces the amount of computation Ethereum needs to do.

So, it's much faster, right? And it's much cheaper. Uh but it still retains the same amount of security because STARKs and SNARKs and proving systems boil down to complex mathematical algorithms and the whole the definition of proofs require them to be unable to fraudulently convince an honest verifier. So, if a verifier is operating in the way it should be, a fraudulent proof cannot convince it otherwise. And so, it maintains the security that Ethereum achieves.

I was missing another one. It's still it's still verifiable. Anyone that runs a verifying contract on mainnet can verify those proofs. So, where to from here? I really believe, right, in this next 1 to 3 years, we'll have the long tail of proving systems come to light.

The genesis and the academia of this technology came around in 1985. And since 1985 to perhaps, I would say, 2018, most of the breakthroughs and innovation in this space has been in academia. And the reward has been, I guess, academia of academic accolades and to some degree reputational. But in this next 1 to 3 years, any breakthrough will translate to a direct improvement in performance. And that will translate to what's possible on your chain and that will translate to a better user experience and that will translate to a larger bottom line and a higher valuations.

And so, these are the things I'm excited about. Uh we chose STARKs because we believe STARKs are the most scalable zero-knowledge proving system. They're the end game. They're post-quantum secure. They scale with adoption, which means the more transactions they bundle, the cheaper they become.

And they can scale anything, including Bitcoin. Post Bitcoin's OP_CAT uh soft fork, STARKs will be verifiable on the Bitcoin network. And that will mean StarkNet will become the first blockchain that can simultaneously settle on both Ethereum and Bitcoin. And the Bitcoin settlement, what that really means is you'll have a solution existing natively on the Bitcoin network that can lock your Bitcoin assets without trusting any sort of centralized party, without trusting any custodian, just secured by math, secured by STARKs. And thirdly, I believe we can scale anything faster.

The underlying math to all of these proving systems is improving every day. And earlier this year, we made a breakthrough in STARK technology, and we have circle STARKs now, which is braced off of a new prime number in in the field of numbers that that they utilize. And what that's meant is we've been able to put together a new verifier, the STARK verifier. And the STARK verifier, the STARK prover, has in testing environments been able to take us up to a thousand times in proving speeds. And this is happening across the industry.

Well, I guess specifically across STARKs. And so, STARKs are kind of going through this Cambrian explosion right now, and its own version of Moore's law, where the technology is improving every year, and the systems will improve every year. So, if you want to chat more about this off stage or online, I'm always available. You follow me on Twitter, I'm @thedemodav, and that's my Telegram handle. Yeah, and that's it for today.

I hope you guys learned something a little bit about zero-knowledge proving systems, and uh thank you very much.