Hodor: Open Source zkSNARKS Library by Matter Labs

[Applause] laughs because it's upset which might explain all parents work for those people or not tell them well King requires us back there yeah we'll really explain you need this very morning I can just be more loud so first for those who was not unintelligible King we will use it as a short story of how stars party what are you saying absolutely alright she's bright attractive for a liberal for estimating and will instead like instead of showing the codes we wanted to show some publications precise atomic State Building this target which is unfortunately not the star without the humidification and also the negative is here we can quickly discuss education for medians when you start start for VDS venture competition starts but at the end of the presentation which was burning we must humanist which you can make out of the fried and potential improvements to it and difficulties Wiseman but just now you will make so the level will be quite enhance so just be prepared for it'll be worth can something will lead to presentation mainly what answers the question says something happens as a format as if you don't understand something like you really won't ask the question it should price it handed we should stop and ask your question okay thank you for coming as Alex told we won't speak about our implementational stars called order because of recent appearance of new proof system such as born and because of our commitment skills we decided to give the motivation of our dog of course it has its roots its source in starts and we'll start from the definition of juggs show how they were born and then I will try to show how some components of its charge when they define this chapter fry can be combined or even for example blown to achieve for just around times extinction snack next one hello there are not with the following reminder stars I will briefly described all the steps because organization called air and a second and justify itself then I will speak about one second okay Jimmy's gait commitment which I still mostly use now and how we can build you commitment scheme from from tried and then I will try to speak about possible applications of commitment scheme to to make food transparent snacks okay so let's begin this is the formal definition of algebraic intermediate representation it's might look quite weird but I will just explain what the board what what does it exactly mean and you will see that it's pretty simple okay [Music] okay and is just kind of register machine so you choose your parameters F which is just a finite field which should be a residue field some applied fields and other words and W is a number of registers so just keeps them and they'll tell them empty is just going trace is the number of steps that your program just executes and a cherry stem we just modify the contents of every registered don't plant the program is encoded as a matrix of size T cross W but the question is how can what's the possible ways to modify the content and in fact is how as jack box there is some kind of restrictions on how to modify the values on each step we should apply the same set of polynomial functions random called the trace constraints what they call them P 1 P 2 up to P key and they should be applied at every step every such polynomial is a function in to W variable the first atomic particles is just all the state of registers and the next one is the new state of registers and the most simple example wedding many of you have shown at my chance came on as a sequence so the first register is just 1 - in a second it's 1 2 3 and so on so the UM second register is just the sum of the various employees registers and the function in to the variables is x1 plus x2 minus is equal to 0 what is x1 is y/x I call them all together producers to be next and then you will have letters to be Y so I think this is X and this is y it's one - why - just apply the sum function and the new value of y is just the previous value max and the same set of functions is applied at every step but sure in real applications or summer weeks in which the previous well it's the previous well and why's the new welcome and the same set of function applied at every step and of course just here captures many functions but in reality you try to call some weird to service you will have phenomenal relations which can be cupid or tragically general imagine and you can mix the x and y variables as you wish and the main the main thing here I want to stress is the difference from around one caste system when they try to encode some gadget in tasty services for example hash function and then when they try to use it to use service several times you will need to pay every time you use your hash function so if your stop it contains three instances on the same path percentage function then you will have a triple number of kids and the difference in this situation with just by different was just encode your guard upon the ones and then you may use of a billion but you need to have some bunch of provisions so the sensitive trains should be applied at every pair of steps or for example each every the decent between the services should be able to one or two but this would be some kind of a bejeweled party so guess how many of you are familiar with miss Frances he was in the campaign doesn't make any sense yeah and the witness the witness is just the particular instance of matrix the bells of the matrix are just I taken saw that those relations will revolt that's it by the way I have only spoken of tradesmen strengths another thing is how to embed bubble inputs and this is junk by boundary constraints there are just two bowls of coordinates and well the first coordinate is just at the step and we two to a boil boundary gas trade the next quadrant is the Nano greatest strength and the value by one so the body constraints just says that the value of these self matrix is ever this is bicycle I think the next one go back with this guy that's nice this is an excellent can you go back yeah just simple sentence you in your constraints constraint should be satisfied and because E is a function every element of is it is a functioning in two double variables and the first half variables is the previous are all matrix and the next one is the next row this is what is original it was like any questions okay the next one as well over the best way to encode any proof systems is to reduce them to reduce even the witness to animals now we have just the boundary constrains in the chest and the trains constraints presented in form of polynomials but our witness is just is just mattress and then we need to somehow transform our representation into the form which is most suitable to oldest just chance itself and we need the kind of regime the roti means that we want to blaze the valence of our matrix which is a witness in turn into engine code into integral normal again this is just the definition in its books weight and now I will explain what can be done in the see what is relative there some some difficulties but you know it never nevertheless the main the main thing is the following we choose two groups I have just our files view and would take two groups Juwan and the tomb to do inside their multiplicative sir group must build us a group of our field and the first one should be of size T in the second one should be of size W so in practice we want to who want to be the one our field to have a lot to a decision so invest its multiplicative group multiplicative group is divided by light power - and our trace length and the number of our editors to be a positive tone so if it is not the case we're going to simply exchange more practice with it then and when do you want be the junior age of the first group and Jesus the first group and nu is the generator sexual and we just really rate our seven the size of a matrix with elements generated by these two groups at least self-adjust Shaban 1 raised to to him and so on and this will just use the variable so the cell with index I J when I waited with G hi you might know this your hitch the idea and then then then I will take the function f on the domain g1 plus g2 to have this varies in L and the where they are on three I minus 1 J minus 1 would be just a well then see how to whom and this is this will be our witness yeah just just for this is very for this is a very formal definition of presence and once you do some practical application of this and just understand how this works its formal definition it just says take every row contain a simple together and do the interpolation over the multiple kids have group in a prime fell it's just very simple well you can see you can see the same structure in many systems where you want to encode you witness so you literally place your witness values you think is ever existed witness political and I want to require all this as witness bullying develop on certain points to be pulled to my witness volumes here use the same just take your video to continue can fit the needs of all together you get to pull remember you do you get set up Wallace which is size T by W so you just need to salute which is T by double size and just do a simple manipulation which is that just a fast Fourier transformation it's from some practical perspective and less the formal information even this one doesn't shows old essence well this one is too complicated explanation or actually how it works the simplest one this is just two interpolation Ginga Adriatic always points it treats an old visit like while used as a point this is a point and while the previous matrix contains evaluated at this point is this view requirement for polynomial and you strictly defined simple integral of GP t by W minus one developed by double point success and optimization optimized applications I don't think you can put an eight all together because this is going to be a large single fifteen you can say I will have not one but W witness bullet or else this doesn't change a start and you see my witness polynomial number one it's just for register number one so you do larger number of interpolations but each of those is going my smaller size is this a solid immunization which is used everywhere which is used by Stanford bias by the Rings guys like this is an efficient way to have implemented but here we don't do too much about optimizations because the right through many of them we really we just tried to explain them as essence of the start you notice the superstar itself is this common typical sympathises of one eternal and then to have relationships about the polynomial incentive relationship model bloggers and concerti will explain the narrative for say the last loan equation comes from why to own just encode this way remember that every trace phenomenal supply to every pair of of constraints then just what would happen if rotate we'll take our mask to be just the consecutive values of the group of the second group I'll just write it down and new 1x be X yes up to the last one just the previous set of registers and the numinous two 1s [Music] once we're at X okay so the first form of these album level is into double variables at first until central where is that we just put it eponymous air the consecutive pairs of elements of the second group x x and next we just take the same function and multiply not only the elements of our first row but also by the generator of the first row but then what what would happen if Project X to be just unity then to be just unity you just filled one apparently these fellows will be the first row of our matrix these will be the second row of our matrix so which a X to the 1 then we just quote our constraint on tech transparence it would take X to be tirant of the first group dream then we encode the second pair and then I could take the rest to square them this way would be encoded there third the third pair of rows and so on so this this equation will hold for all elements of hottest group and just written back mas challenging those parameters our constraint on normal is the same is the second level check it from every state and with representation and our domain our domain is just as I said Oh finalmente first group and so our domain remember you will be just the project X - - every element and we know that this element for my second rule so this will be used region is a single form its t minus five and this is very important this is very bad effects that our group has such that a magical complex representation was being calculated efficiently yeah so exploit the storage of solution with one exception here this vulnerable to open every game except the last one yeah in information from here so it should we truly Elsa Colin's this one but there is nothing after but we're in a cyclic group so who literally it believes the last role was the first one where relationship as default we have to pick at one week our desert but they're still efficiently template or another was abused during sentient race yeah this gives you a diminish over it's going to talk about the tail yeah just to just for some well this is three the condition of course just for intuitions estate Creek was used by Zachary and Larry all episode name's Eric want proof system that you can multiply the argument of the bull by the generator internets in certain cases and this keeps you bike like at displacement at time displacement or just innovation is places let's go back to few panache example with 1 1 1 2 3 i will only work in them like on this part of these 2 rows just for now by definition to do with this whole interval over X and let's say I use it Omega is the generator or we get a force equal to 1 because they have four elements here by definition this one blue pieces so one movie this one it's another one well representative but carry and this one is too so I just didn't read to them one by one by community so why it's called rolling against its allows you to navigate in space if I never would sell in terms they reach a certain time by selections of thanks now you will one adds a real application of have separated raided witnesses for separate registers who love me to the beginning space still need to navigate in time so what this is the diffusion function of over X what happens if I look it's a function of X multiplied by Omega squared s will actually leave me and say rises oh my goodness nervous oh it's 1:1 here Omega squared it will give me one this will give us a song if I take my modified function at Omega the first power give me two so I will displace high time by one step this way is called the wrong with him if any one I choose to live but the easiest example to see too many ones here I think you do the same for next period for us will be my representative cause it just allows you to navigate this is why it's multiple yes and for Z's you just everything you want a practical perspective well you can transform polynomial in this form over X into polynomial displaced one by very simple and efficient reliable information which it takes a week you're not gonna multiplication this is all three okay yeah so this what you would have in the practical implementation of as optimization you don't need to negate in space even while in the original papers everywhere it say you take only witness put it all together is one witness bullet or note in order to practice so you only need to the beginning spacing everything else falls to be precise it is not from the original but by the next one which sports the operation so here they say you for all these in every field it to work oh no it's for all X for which the other major lunar node is equal to zero so where he has money to go in our memory but I mean it's a part of the next so it's not recycle Li that the stage of not there are some technical tears just second come out of domain which I don't want to speak about just sorry who from chuckwei but what's going on remember from the previous slide the previous slide but if X is a rotten tomato then should be the root of the slide construction and he these large construction is taken as a numerator and so on on every such and every X from our domain which is just the elements of the first group this fraction should be phenomenal yeah and we just take random petitions from the verifier in order to combine all those functions into one mr. so that to keep I saw what they mean by fraction you actually care just explain less so you season one help cupid internal is punishing my personal question yeah but if you can space full direction I mean business practice music for a witness since it means that for every X for which light we chose the simple example it is equal to 0 and Q political is equal to 0 to be divided one way or another because it captures people literally at this point admit that if you do this division and this construction is not a rational function but it's a polynomial of degree which you can predict by the tracker system just for those technical perspective Duke wants to have this has raised to the low degree so this will internal which will be part of surprise Fulop drove to very large search County few constraints like small number of constraints large degree you would rather prefer to break in constraints we should agree to well 3 is not good because you're always part of work is multiple to so by 2 or 4 and the large from optimization expand here's just a question why you can't / desperation when you have polynomial which is that wasn't right but not some function because you can define it as a function but you will then see or but your ass will not be able to see it you well your mouth piece and put it on constraints check announced now we just go state XY as to next steps but you say well I replaced my x1 by the people which is perfectly possible Q is just to punish people in general it just defines you where it gets very cold just if you want to fold them there you go since the last one is well kept yeah this is a definition y equals I think it's used everywhere even though the grocery see brothers good money but I think might be available and once again I want to stress that it does not they let protocol and to the region the paper but it's nevertheless the main idea install our only produced to the poet went to show that a function g GX is not a rational function by a polynomial a polynomial of degree which is the same that the order of the first group and when it's a tool to august to check this efficiently the next one yeah and the problem which we are trying to solve is vaccine suggesting or just having some access to function f I mean Oracle access that means that you might only compare with some values so just to verify as well as from the function and the probe just get stipulation at some points and we want to and the reply was to know that this function is indeed a degree let's talk about the fishes so you want to have the twelve you could have this way so well you can trigger the proofs of G of X is a lot of the people available for example uses a permit because it's actually gives you C to be found is very alternative to what you want to do today is efficiency between communication between premiere [Music] so you don't want an to check this relationship everywhere you need also values and do like linear network television so you this why it's called Oracle accent first of all the approver tells I know some set of bogeys and then commit to them so we mentioned it's just to those numbers which you break the part number by number and give it to someone you can ask for certain for those numbers one by one and the service will not be changed in principle you can ask frozen but then you do have some work pitches in norms that you can take one by one and the small number of others which will peak from this trusted source and in in relatives is trusted sources and marriages those to the pulse will be not for you to say alone whether all those those qualities came from sample in our milk all those as well as together with some truth which you again will count as a work from the pool internal which was small degree or unlikely to be spawning yahoo proceeded was a form apart from talking of innocence yeah there's no need to equate in other words okay next one so that new handsome Austin as Alex told to query all the vendors follow function them ID but to know the domain is real legit it'll be enormous number of queries and this is the theme we were trying to avoid and the question is that one candies we achieved with what algorithmic number of queries Reggie is remember is the degree of power with the self the answer is yes this is really ingenious protocol the formal definition of so the problem we're trying to solve by working in interactive or growth model anybody is familiar with internal growth model okay okay explain direct interactive host I think everybody knows this B is a promoter the the Bruce data the Provos data is not saying just as a little piece of information they send in terms of Oracle's edge tables and the verifier never fire when he received this table with edge table he can only query a small number of points this is called easily model and interactive or growth model it just combines those to go those two goals this internet protocol from which every message from the prover is a kind of Oracle like table from which the provider queries on the small Mart feeds in response and the next answer from Chloe is a gated table and Wednesday wouldn't think about interactive Oracle proof of activity the first message format for months should be an hour Oracle to the function and we want to prove that it is a polynomial of degree Kendall in fact once every every every other Oracle will also publish a function be the case all right so just think of them ideal you have two functions F and G any functions not animals and they can service and then just count the number of points in which they are different an example is two and I just take the relative time distance or divide this number by its estimate so that my metric will be between zero and one and this is just geometric it has all properties of matrix symmetry that dragon in water yeah fry fry oxide with them in the next one these are the parameters of Prai and it's exactly takes logarithmic number of queries but what I want to stress here is the sounds service uses some parameter Delta our initial function our initial function which will provide all the Oracle to throw coracle for each can it may not be a polynomial it may be some function some function f which is which has some distance from the space of reed-solomon codes and fry is unable to distinguish precisely the functions which are accessible normals and the functions which which has some distance from the space over summer coats just the other night I think here we will do another solid example men okay so friend initially problem the kind of bull remember was promised let's just say we have a full animal it was immoral collect we gathered some problems of birth so for for a capital it will be a polling of like we happy already knows as a suitable I don't know just to show you how to fireworks and we get its so from the main we get a simulation so let's meditate with our domain this mole is just four elements are 1 2 3 & 4 as I think of a function for a small inner is just some function for is this well 1 2 3 4 wasn't away the stress by looking at and I'll say I know that degree of this pulling our goal and say is equal to 0 so I will just have this a lot at once and it have a look horrible access to lives to that taste is a different like this so when your opponent multi grew honest I thank you for your ability to enjoy teacher those are my invisible Oracle exercises I would can assimilate him with some people where I can particular volume so what would I do and what I'm willing again as a result was a primary I can treat all the boxes ones because if I would I would just interpolate this locally by myself trusted source and get the master wizard but it was well as they got or from the Greek literally just from some honey so if I would get this in full I will interpolate this and see well this is indeed a bulletin which we 0 just because it for is this one I would do the same work and I will get degree which is more of the cereal but I can I have an excess terrorism - I can cook together sweet answer so I can only get an answer with some probability which is sums and for a delta parameter the other parameters will the Delta pressure will tell me how many points I want to be sure that this polynomial doesn't deviate from sample not just from exact one but from sample interval t0 other others the same work also exists to emulations or to Oracle safety v8 in one hand so in this case my Delta u1 or so let's say I want to distinguish between two cases where it's exactly is a polynomial certain degree after certain degree or when is one course closed so it seemed only different than one point and why is this case but those first so not into points I am okay was one and for this so I fixed my promise of the Delta which will tell me how many steps of practically I have to run which ends end of the different practical perspective will tell you what is the process and then his name but let's say I want to be lessons sir McKay was knell to be one cop so I will allows someone to keep evolving is not exactly from the polynomial but from some function we made in two cells here that my delta is larger and the property of the primarily as to certain conditions which we won't hear it out we'll give you a larger sound so you prove size will potentially be smaller for and if you want to be if I want to be sure is that this is only different in one cell with slit a country bits of security my firm is going to be like here that meeting gauge if I want to be sure that it's different Dante mama at maximum took two cells was the same everything it's a security instead of Delta parameter supportive will show why it's important to letter steps but all the improvements of relative a vertical at least for now the order to improves the sound so we improve the second term in this minimum function and LC say what it's like what is your delta up to which you can even use a prayer but we will not touch this is too much Delta question so how can you tell me how you met the number of point that these four intervals delayed to the beat of security oh well I mean this is the songs error it basically tells you what is the chance that you were cheated if you want to explain to claim all the parameters here that they're all the deep is important and they think that on the camera is the Delta we decide we decide how much according to this prior to Delta Alex told it means how how much year are we can take so this is face of Islamic odds and this is just the job to boom in this base does the circle of radius Delta and this is a function which is just in those Delta blowing for this function with parameter Delta who was right of course doesn't mean that this function toggle I want to stress not yes why not why this is not important for forced jobs as I have said we sure that some functions of we this function is a corner but if normal notice the prover is able to honest to pass fry them just this means that he knows some function which is in this Delta reduce by this multiple normal and the only honest witness for drugs is a phone number but that may have decoding algorithms such as sujin decoding algorithm or bullsh velcome algorithm algorithm we just gives us the proof of knowledge there just addition to normal and for the main say if just prove hakuna was not only local but the function itself if he is able to provide any part which is closed then you just use those algorithm decoding and you need therapists people number which will satisfy the condition but yeah this is the true Yahoo actually says this is a at least D for life practical so yeah here everything will take you before was about employer girls I mean we assumes and approvals honest we just need coats at regional problem the essentially this is a purple easy food so what we want to say is let's say the verifier is satisfied with follows the conditions and like all the checks will put here it means that certain values from the Oracle and in principle criminals or hopefully many resources to pronounce an Oracle hope so he has access to all the valleys locally he can do whatever he wants business if he satisfies degree mark even if the vertical was not executive while this is a polynomial but they we just closed and there is an algorithm for the proven himself to take those values decode a polynomial from them and this polynomial will be the true business so the bullet even even used to prevent even knows a business but he Possible's checks with also enormous number of bits of security he in principle would be able to take all those values and finds it through weakness easily in a polynomial time so in principle this is a proof of knowledge and if permit has satisfied the rain fire then he can get the knowledge of Toledo's this is not raining tweeting to speed up a little bit so there's limitations but quite common used I think it's most important when concise system and there are many tools libraries to encode programs in the Muslim country systems and there are not so many tools record in stock air so I think this just penetration as I have told the property of air saw that John is just both well on the poor which mathematicians and the proof sizes large special where we can pay each term stocks where the proof is of constant size but the final part of juggs is really ingenious and maybe we can apply some other primitives as mainly what try shows us that some function is a polynomial may be able to apply the strong properties of right or other related problems and we try to do this with nominal commitment this is a definition and just what is going on Prabhu has phenomenal but he wants to know - over this point of us he just always just guesses the commitment to the small number so we as verify may be sure that played to this donor won't be changed well verify silicon he only knows that the brewer has sadly known the mind and moreover the polynomial is of degree the degree of autonomy was bounded by some parameter chicken is a top phase then the latest Epps protocol with us at the brewer to open the committee polynomial at some point and verify just opens a revelation of a polynomial and also send us some proof of correctness so that relate to my chair that this openness is these days related to the conditional normal self so it's possible we was thinking about to commence or something I think I don't have much time so he took our kingdom each month which is just that main protection schemes unity and using no protocols but what what's the main point here first of all why isn't some kind of Russian and the fractional movies is the main thing that fries Franco squeeze which shows that funding is not really really really ever spoken you cannot just keep this part same thing which is which wasn't quite right which basically tells listen same as a bullet on all feet and even the okapi is the true politics going on at this point and this well if you still practice and you will get to zero waste points because it is ilithyia narrator and if it's the booth defenses numerator has a good at this point that you can divide it and get another collateral which is just making you less so you can do this is very easy this is and relation be exploited by commitment and else it begins as a set of space you can implement to how what does it agree is a blonde with me - you can be questioners your initial commitment was actually political after certain degree and after to you this is official you cannot you cannot commit saturation function unless broken down as if your crypto use this and then later and opening space you Elsa not face the proof and say this my commitment is my sample uses my proof if everything passes and was a factor of utility it was to do all of this other information committed at this point otherwise yes some of the main thing that this furniture are a is not should not be known neither for committee approval and all for verifying and there are many zeros schemes such as long or as a novice taken sewing the only the only one team because the only one reason they require the just a setup ceremony is it was their ways to keep management and so you were able to replace it commitment with something that requires only as far as the child or against a child then those commitments Keynes those zero schemes will be transparent by my design okay this is just the main the main I might want to call the fry based an old countries much I just want to explain what is going on first first the commitment at an interface we want to be sure we as a verified one to be sure that the function under commitment is a phone number not soundest random random set of wireless and the commitment here is again Naruto as in Pride and so we run one it has a fry at commit phase to be sure that the function of the commitment is a polynomial and then around another instance of private over face but this time with respect to the August fraction and again we're trying to show that this abdominal I think we'll skip the proof this is the main idea why why oh why this this book but there's one one important thing between the gate commitment beyond the private and schemes as told some in second fry is unable to distinguish between Domino's and functions which are close to them with respect to of having waitress so if we are not sure that our function can it stays is not even a polynomial which function will open later and the deal is this is our space with some goals or just who do you promise this is our function of which the brewer gives no access to this is just just the circle of function f and the Westham intersect at several numbers the fact this now commitment scheme will only show that the opening the opening which will be done at open-face will be the weather of almost one of these polymers at intersection and there is one special case when Delta is chosen is chosen to be the Ichiko tech writers parameter in this case if there are any intersection between our function and the space of problem proponents of our degree the intersection will contain only one point and this particular case okay just may think that facial commitment at approval was not to the function but to that one one point of intersection but when we're trying to apply our commitment schemes - it's real protocols such as born for example we apply them to witness Panama's inform scheme the verifier us approval to cope and available with us phenomenal and we may think that any of the possible detection available with stone Demasi it doesn't really matter but there is one one positive the next one this group idea was stupid for now this is the relaxed version was intelligent reduce and her last question where the dissection contained more than one point and he will show that the opening is related to their to the one of inventor section and another theme in porn indicate commitment is not used on the is not yet only to open the various of witness panels their commitment is also used for speed-up calculation of custody what I mean about the jacinto jacinto animal and causes our problem this is a phenomena that have known for both a proven and the verifier but it is a very less degree and then the blue asked developers they preferred to send to send the opening of this constraint bernama at some point because hidden you don't want to do a huge amount about to be late my degree and women speak about it commitment but know that you can even is received then the open of the camel or the commitment is specific specifically normal and we just share that the commitment is just is related to the content or normal but in this case in this case there are several other animals to which no to which the office may provided and when I speak about constrictor enormous this means that the prover might send the open to Nauticus a phenomena which means that he sent the answer to another constraint system to another problem this is the difference between with the spa animals and potato animals and so the goal is problem evolution problem because there was no significant number this is the polynomial which is known for both sides and for which the verifier wants to get the opening just to speed up to reduce his complexity and and so on and the solution to the problem is the following this is our space again we [Music] now we're just the total number to the variable normal so this is inside our space little Jake the parameter Delta and there were some other polynomials with these generators but that is East at Starbase the bundles are small for both of us at the start of protocol and so all other one of most of the points the circle are known to both sides at once so we just change some what you want with such property that the bearer of our equal number is different from the relevance of other animals in this zone and this will be 0 our constraint phenomenal and also just 1/2 and if I want such a poet such a f0 of my one if not equal to Phi Phi 1 4 4 very provide greater we hope that one that make sense and this is this is the replacement of the search of such a rebel said sorry don't resent much this some kind of just as a child this list very huge decoding the photos of animals may change my amount of time the socialist point is also a Sun God but this is which was the German it was and this is food just as a child and there was no need for some secret parameters as journal in kid commitment and here here he previous protocols which just opening people open schemes we divide by just one life function and here I was just the point which okay so tell face and I too is just the point which the verifier is not open the very edge and you as you us is a function that just interpolation but wanted to publish the function of those points with respect to various that one NZ to once again the chaplains the weather of zero at seven a point which we try to open and develop prior to failure of opening and do it is known a difference from committee from American to scheme any questions I think here I actually summarized it a little bit differently so it also counts as a problem of the political relationship everyone knows that your article lemma which tells them if you want to satisfy relation like if you care for their own a certain degree that has a random points and this is a great word as around the point a probabilities and people have a people has a root is negligible in a large amount you like as a fancy price right just approve because this particles exist yeah so well in principle if you go back to go all the way back to the start principle let's say we can heavily this is deep a life particle which we didn't cover but there is away from beginning to sleaze check is around employ and share you Curia good I mean his around the points everything here you knows the degrees out front so you can just check and guess so you can make the check this enormous soundness and to bring a small price if you do it mess around the point let's go and you can do this the problem is as Costa says we worked was in the frying pan dulce parameter Delta and if you help a small you prove sizes large if you did building is larger for a same summer your first size is smaller assume really want to work with a large Delta in starts it's not the problem you take a large now life you got that right there was some lubrication exited that's given you take large Delta so you can see you have this intersection to the principal as a random point you can actually take any of those polynomials and pull the volume for this one of those as a random point and you can do it for everything becomes with this equation well up to something certain example and the best is how we can satisfy this equation at a random point as well from a polynomial have this oceans is around the point for another one you have this option like this setup options and you can pretty simply gets some espera persistence like it will depend on another average size for each volunteer know like how many others you can feed from these intersections and the number of polynomials / fuel size this is very simple but it's dark it doesn't matter because even while we pulled all those volumes you actually set this by every constraint biggest constraints known is a very fire as a set up space so in start a fire literally check having expanded this is quite hard to mutations my kept optimizing constraints capture chasm efficiently computable in narcs which don't work was layered circuits like Ross 16 everything missions of Parowan CS plonk with an us organization sonic is an us organization your APIs are be three circuits so you have to encode your problems a cow becomes if you're a fire otherwise very fire to do so safely apply because paint which is when you're working or adjustable a temp large degree collateral which is still with your work but if we do it namely we cannot use this just mainly use this kit for constraining polynomials because they're different so your content and if you allow these kids in principle let's say one of those points but nothing stops the prober delicious burger from competing all other constraint pull animals and make you for one of those actual witness for a solution is trivial it just settles there so you cannot stop this you cannot predict it up front so in my commitment schema can only allow this case because you cannot allow the prover to she was just not peeking from some set of Wally's but actually to begin another problem so for a commitment scheme may you apply it you would have to limit the Delta to this case and this Delta is equal to roughly one-half minus something this is not too large its own us first some certain sounds your process would be larger than if you would allow predicate so now we have to eliminate well now we want to try to to increase the Delta so let's say we need to work with this case we need some kind of second chapter in this case which says it go back on distinguishing well in this case we what we have to do is we need to second boundary so with those our second one there is a set up as satellite in principle since the problem is nobody was prepared the great fire weekend highs reduces three with completing all of those full animals which are its intersection and like begins a wall is a wall unit field whereas they're all different so we can use this in reality we will not with us will pigs around the point this is small number compared to the fill itself so so chances there 80 of those two has the same volume as a random point is still eligible so we can be quite sure that we'd be twelve and proven cannot now change the problem and after this we're okay possesses help back to this case because we knows that problem now so the power constraints are fixed as a set up space where a cave is preferred having some freedom of choice from set up Wallaces around the point but still at the end of the day he will not be able to satisfy sums but we know a relationship well similar to start the pockets difference is much simpler the end of the day you still will be limited by particular truss analysis this part is nonlinear problem where she got dissolved we got to know people versus soundless aerosol particle which was for which we optimized about additionally so now we can have a larger Delta potentially limitless on the right part and this will gives us a smaller approved for a safe sound with you which you think ever was it allows you to have full benefits of sobriety but for every pro system which just uses and demands of yeah a lot the last thing down here gestures I said the colonel Kaminsky with the sternum for witnessed animals the relation scheme with Jasper as a child for character animals and it will be blind for some zero-knowledge schemes we caught both a witness polynomials and their content on memo and then their witnesses in constraints enormous polynomials and then just wear the veil is at some point and check some novel relation between them as used schwarzy bill this is just exactly bond where are they for example that constraint polymers for banca those electrical members cube collect you write multiple multiplication so on and he just sending random various is for assimilation of interaction but the final step of protocol is a checksum relationship between animals upon which our customer normals and fixed at the chocolate which are called our just problem and with this phenomenal possibly CJ our constraints will be just the other and he advanced areas particularly if this relation holds if it doesn't called attack at one point them with a random probability then called at the sweater at the space so we just need to check this relational point and for this we use the chemical scheme to open the values of witness polynomials at some point C of our choice and use the relation scheme to open the world at the same point see just to speed up the calculation of Earth prom terrifies point of view and then to just check the relation and the siege it seems like to be in a full the last one it seems to achieve our goal which is a system which is for just balance okay the chakras is logic but the search for the Point C but nevertheless topology it's exchangeable at Wonka 716 and as we replace our chemical scheme by fry which works in interactive Oracle link module which is just caches a song there were two commercial constructions it is quantum resistance resistance so that's that's it any questions yeah you forget to mention mentions of this in principle because I get definitely there was when we are not bound by any year parameters and just too tough so main when we take as many levels of recursion as we need for our aims all purposes [Music] first of all it's we don't try to make the grow system it can be okay it just allows you to take into proof system which is masculine or commitments and we shall send codes constraints or as a program itself as a colon or no and all supplies the city well you can call it food restaurant if I mean yeah you you think the Blanc is a fungus well it's a pro system it tells a decision and just the east based and the fact that you can commit to someone will have interpreted as a random point and then obviously it's a random point it's out of a system where you have in mind or not trying to apply so long and to replace the kids management which requests as a child by new commitments and relations in fact that we need to our vacation time is even to operate I mean sugar girls are I would it be run time recognition approving well for now for you do progressing exactly just twice lowers inverse but should be should be optimized to the same level yeah yeah it should be to be the same speed because here or fried particularly capital order extensions of the module so which means that you just take the point of degree M and you have to calculate equity of like sixteen pound which is like which is a large to share but there's only like now it's already less than 30 percent sons of work so the rest doesn't work is just actually a little petty but can you still look free it it's fast it's still not free so yeah it should be on par for replication we will see what what will be there it's a pasta - oops I mean now it's Elsa freedom of choice if you want to be transparent plus repairs it you can do this or you can use this if you're don't need recursion and I mean if you've already has a transit setup in terms of powers of towel for a cape commitment you can just take those and if your beeps good very problem you can use it it's not a freedom of choice I'm not even talking about like exotic instructions where you can use the transparent parts of transparent one is like water levels of recursion and then you can do the final one with kid commitment because now you don't have a problem with curve cycles for sarsen like that very friendly curse because here you everything wants to build as already departed for fill the sky - in DC - which is already a requirement for every scene for polynomial relationship and this approach systems over a parameter what do you mean it does been just rented means you don't even trust setup then four key commitments of the curve yeah well key commitments so small is outreach the unknown so entry to deserve an agreeable so you have to produce yourself out there are wait I'm not we know there are ways and efficient ceremonies uses and it's still commercial it's not per circuit facets but because there's only can you come in with this universe on it just requires it's linear in the size of the circle so if you want to do a really huge circuit like I'm able to for all these parameters the constants I said yeah well just for simple means well now you have a freedom of choice or to fill so you can get your multiple domain of the enormous enormous size after some limit of course but here is there as well through certainly is a practical limit on the size of the key commitment or oil to a chicken to me most in terms of the storage is a parameter and if your penis in a framework example of metal of relationships usually you also found advisor multi could give several sites like for a number of recipients so totally fine by the way human place kid commitment to even born like systems by darkness but to the same thing yes because its commitment coming its commitments team service and for all the depends on accessibility if you take 100 beliefs with another so it's just a retinal trace now it just should be 16 if you want to work with at least was was the Syrian smart contract this great fire yes there was an idea of like for the proof sizes yeah for original commitment scheme where we wouldn't allow where we would require some uniqueness I see estimated for 228 : a role for some types 16 80 kilobytes without some strong optimizations for relax brother for a unique liquid in Vegas restrictions should be 68 in a kind of worst case without documentation I cannot give a number of a septum ization because I kept trying to imitate yeah for indication if we can use this to request evaluation scheme for set up along normals it should be reused like five to six times 20 kilobytes limit without optimization by the way maybe there was even no need to find such points set or ablation schemes we maybe we may just say that this is kind of swansea impossible suits the set up a transfer ability argument here on this side for Allah right for recursion there's only six it matters is this circuit size if you have a plastic very fire biggest with it it's only staffers will be publicly verified for everything else you have your pro sizes in within the private living so well it's very fire serving it will depends of them choose the cache functional so like how you make the transcript or principle procedure but by assuming like two twenty three to four pull internal what it should be what smaller well recursion gives you such trade-off between society okay I think it's just time but because it was a long session you should cover your brain [Applause]