EY 🛠 Intro to Starlight - Harikrishnan M

foreign [Applause] [Music] blockchain research and development team today I'm going to be talking about Starlight one of our r d products it's a ZK compiler which allows solitary Developers to generate privacy preserving applications without knowing much about zkp or much about what cryptographic or behind the scenes before I get started I want to just quickly explain what ewilders and what evidence in blockchain space basically so we've been we've been building a lot of blockchain products over the past few years and we are fully focused on open and vocal about our support for public blockchains and everything we built is on public blockchain and not just any public blockchain but on specifically on ethereum uh Global blockchain leader Paul Brody has recently taken a chess seat at ethereum foundation so that kind of shows the collaboration and commitment we have with ethereum Foundation ethereum ecosystem now if you work in a firm like UI you know many people ask me is well you know what what does Eva have to do with the public blockchain and a lot of our clients are banks and accounting firms and you know Enterprises who wants who who doesn't want to put their data into public blockchain and uh very rarely that we get a use case like for example you could have an ESD use case where somebody wants just one Enterprise want to create a carbon offset and they just want to create some nft tokens they put it on in the block sale and that's fine for them because they don't want privacy but more often than not privacy is a very important factor uh for Enterprises to use public blockchain so most of the work that we do in our R D team is based on creating privacy tools to build on ethereum and in our privacy suit we have two solutions one is nightfall Nightfall is a ZK optimistic rollup Solution on light two we have already joined with polygon and it's already interesting uh beta version it allows you to transfer your erc20 erc721 w105 whatever it is under privacy so that's that's one bit of the puzzle right you can transfer privacy you can transfer data in private name the second bit is and this is the most important and mostly neglected one is as what about the business logic when you when you what about when you want to create a business logic in privacy or in other words uh what if you what if you want ethereum to understand privacy right ethereum's brain is it's smart contract smart contracts doesn't really understand privacy it's it's everything you put it on the smart contract is public and everybody can see it and a lot of companies don't want the data to be put in public for example your age medical records all your business agreements you don't want them to be in and the difficult part is it's not like a ZK roll-up solution where you're just transferring a token it's it's very customized and it's very specific to the use case so you can't really quickly have a tool where you can just put it in and then you create a private Network out of it Starlight aims to kind of solve these problems another problem that we ran into when people came out a lot of clients came up to us and asking for privacy to be included in their solution was was it took a lot of time for us to educate our developers on what gkp is how to use this what elliptic curve is what the points are and all these things so out of all this frustration is what stylized was born Starlight kind of tries to solve all these issues it removes the learning time it takes all the burden off developers all we do is all we do is a pretty tremble three steps and you can take enormous smart contract and you can have a fully private smart contact ready so I'll explain the three simple steps which are pretty easy first step is write your solar Dismount contract which you already know right so Step One is check step two is you add certain decorated decorators into smart contracts and what I mean by decorators are like decades are like your keywords that you use in a normal programming language like private protected or anything which the ZK compiler The Starlight compiler understands here we have three decorators which which are smart contract understands uh compiler understands and based on the use case you have to use you have to choose which decorator you have to use third step a favorite and the EC one is just to run the zapify it does everything for you it creates a complete zero knowledge application which circuits with the shield contract and all the backend containers as well ready for you so you don't have to really worry about what goes behind the scenes what happens how to build a circuit and what are the commitments to be used everything is done in the back end for you the use case there are a lot of use cases where this can be applied now that's it it's pretty easy to use right we can start using so but let's let's open the cover a little bit understand what happens under the hood here okay so in Starlight when you run this app if I command three steps happen first step is pass then transform and then generate in pass and this is how the compiler basically Works in past what we do is we take the solidity contract which is decorated now we kind of split them into two halves the first half contains a contract and then we have these decorators the mapping between the two Still Remains and now we take the solid day contract and we convert it into an abstract syntax tree or it basically into its Json form of the code itself all programming languages have this AST which you can have now this AST is a pure solid EST to which we kind of add back the decorators we split it previously that's what happens in the first stage so you do the passing eventually you will get a ASD which is the normal solidity code plus a little bit of what the decorators were added now in step two is the transformation where we take this AST and we convert it into three different abstracts and tax strings one is for generating your circuits which is for your zero knowledge proof generation and stuff second is for your smart contract smart contract basically does the on-chain verification of pros and then we have the third orchestration AST which which is for the backend containers and testing now once we have the three STS ready then we do the reverse of what we did in this first step that is we take the AST and then we create the code from it we take we create the zero knowledge code from the circuit ASD we take create a Serial smart contract from Smart contract AST and we call create kind of an orchestration code which kind of connects all these things together no that's it so we get with the happy with these these three steps now so I spoke about the decorators and how these decorators are right so now let's just look at how the transpiler works so you you can assign that you you have a variable unsigned variable X and that you want to kind of keep Secret in your smart contract it could be your age it could be a phone number it could be anything that you want to hide from your Shield contracts hide from the public now you are a decorator secret is one of the decorators that we have unfortunately we couldn't use private because private is already used so secret is a decorator that we have and then that's the second step where we kind of decorate it third step is running zapify and once you run zapify it creates everything that send out the zap is kind of far form for zero knowledge application it contains the contract circuits and the backend containers circuits are basically built in Socrates in Starlight and these circuits contain your private public input and your information and your kind of the course as well contracts contracts a shield contract it's not really your smart contract The Shield contract is is for your own chain verification the only thing that happens on chain is your verification of your your commitments and in the backend containers we have a blockchain client which could be your you can ask get or anything that you can just configure and connect like you try and connect your device Socrates is the backend that we use to create the generate proofs and to kind of do the setup we have Timber Timbre is another excellent product by our ey team it's it's it's a Merkel tree which stores commitment in a very efficient way so that you don't really have to pass through with too much or you have to reveal the commitment to to you what it is and then finally we have a testing infrastructure which is ready where you can deploy to different test Nets in ethereum and see how it works now we now I spoke about a lot about decorators so let's see uh let's see them now right for the first decorator is secret secret as it names that if you want to keep a variable as secret if you want to keep keep a variable confidential from the information you call it secret now you can have it for State variables you can have it for function parameters we intend to add it for functions but basically whenever you want to have a variable that has to be kept in the circuit which has to be in private State you name it as Secret now I want to focus on the right side here and the yellow bits so you here you have an unsigned integer X which is kept a secret and also a function parameter y in the function add which is secret now what you're basically doing is adding X into X Plus y and I'll get to know in a bit but this is what basically does then the next step we have something called known known uh so so now we can we can do the contract right now now it depends upon we have we have the state variables and all but but what's the use of it if we can't modify it if we can't use it a lot so that's that's that's for the other two decorators come in the first one is called known is when only the owner of the particular smart contract owner of that nullify I can edit it now the second one is unknown where anybody can basically edit the data now I'll get a bit more in detail into how how the known works and it's important to know how the commitment structure of known and unknown works here so known is a H so so when you say a non but it basically means is that only the owner of that particular commitment should be able to edit the data only the order of the particular commitment should be able to increment uh the data X Plus y when somebody else tried to know with the zero knowledge application kind of throws an error so for a known to work for somebody to call the non-function you have to submit a couple of rows the first one is the proof of knowledge of the existence of the old commitment this is this is done without really revealing the commitment by using the timber tree second is providing the knowledge of secret key knowledge of secret key is basically it's related to what the public is and you just have to kind of authenticate who you are and then once you do that you have to nullify the commitment which means that you have to kind of delete the commitment from database and then you add the new commitment so that's what known does it's pretty easy because you only have one state every time you delete the previous commitment and you have only one commitment unknown is a bit different and there are a lot of use cases when you want a lot of people to kind of many people to kind of edit into your secret information for example your balances where you want people who uh who want to transfer your money but you don't want them to debit from your account right so you want the credit to be given by everyone but the debate to be only by one person so this is the case where you know multiple people are trying to edit a particular secret variable and uh at certain situations that's when we use unknown what unknown does is it creates something called Partition variables or partition commitments where you don't have just one single state in previous state we had only one state and we kind of delete the state and we override it with the new state in this one in unknown statement we have a lot of part commitments and these part commitments come together and kind of summation of it is what the whole value is on the example as you can see balance is something that has kept us unknown so anybody who's holding the balances anybody can transfer to my balance so if somebody who's uh who's a sender here it debits from his account and from the unknown the unknown balances is actually of the recipient so it's not his own account but with unknown you can you can kind of edit his secret seat as well next one it's important to know the commitment structured a little bit the commitment the first thing that holds is the state variable ID now solidity has this state variable ID in itself which which is a unique ID that is given to each variable then is a state value State value is the value that it holds it could be a number it could be a string or anything and then the public key of the owner and we have a salt to kind of avoid duplicate commitments or commitments that have duplicates it's pretty easy for a normal State variable because we have a state variable ID that is unique now it's a bit tricky when you have mappings or when you have like arrays where you know you can have one state Bill already and there are a lot of elements related to it in this case what we do is we take the mapping key we take something called a mapping key which could be your address which could be the array index and then that is replaced instead of the state variability so it's basically a hash of the state variable ID and the mapping key that's the first input the rest of the three inputs are pretty same I'll give you an example here of a developer use case and what really happens now we have a secret mapping here of an address to An Answer integer which is the invoice of the people that they are and then we have two functions add invoice and pay invoice what add invoice basically does is that you can add invoice summons account and then pay invoice is you can pay off somebody you know whoever you're earning it now in this case basically what when you call the ad invoice API what happens is it checks for the commitments uh in the database for this particular owner that we have for example if you want to add invoice to the owner it checks the database for this honors database is there or not it can be done by anybody so it checks for that particular honor and then once that check is done you create a new zero knowledge proof using Socrates and you push another database now this proof is then given back to the orchestration file so the orchestrator first calls the Socrates and it creates a shielded proof I mean zero knowledge proof and gives it back to the orchestrator the orchestrator now contacts The Shield contract which is on chain and the on chain proof is verified once the proof is verified we update the states and everything is done now you don't have to know uh all of this to build to build on Starlight all you need to know is to write a solidity smart contract and add these decorators isn't required now something that we understood is that privacy has become a big factor and something that we haven't worked on a lot a lot of Industry applications or general applications require privacy and people to be building on privacy application we believe Starlight is a good tool that can help you build it now you can you can use our repo here this so all our products in r d both Nightfall and starlight are completely open source for people to look at please please have a look and provide feedback and work on it as well and I'll take maybe a couple of minutes for quick questions and then I'll know the mic that's it from any questions so how will it uh so how would how it will integrate with existing tool like hard hat and truffle because uh you know uh basic solidity is like ABI and here you have AST so will those sorry so yeah you can try it on uh infuri we have tested around in Fiora we are just we are deployed on polygon testnet we we usually use ganache uh to kind of test it we have we are deployed we don't get so so it doesn't really matter you can deploy it on any any platform that yours it will it will we haven't tested in hard hat but I'm pretty confident it will work as well