ZKP on the Client-Side: Challenges and Use Cases | Song Z - OpenID3

[Music] thanks for coming in a snow day uh let's talk about CP on the Clans side today so brief introduction for myself I'm usually go by IC do I'm the chief cry cryptographer at open ID3 and have been a web stre cryptographer since 2017 um and a little bit of open distry so we do two things major majorly so we we do zkp for proof of humanity basically to identify unique human beings we also do zkp to prove of Social account ownership there are many use cases associate with the uh we can do proof of social influence as well as proof of Social account ownership leading to Z logins for wallets and privacy decentralizations and building GD U is kind of like the core value that we deliver our stuffff so a little bit background of TP is and class secp in general so practical and modern TP has only been popularized since gr 16 since uh 2016 and that means we are still pretty young in the space in general and majority of the current use case are around ZK evm power layer tools so we are more or less not so imaginative of what what we can do with the technology so CL secp is basically now exist uh there are a little bit of use case associated with it but it's not widely used or widely protocolized or framework made for building things like that but Clans needs to be there for two specific reasons first the CLI side ckp on the C side has much better use case than what we have with just ckm power layer tools and is supposed to be lightweight and deliver the initial promise of zkp from the very beginning beginning so for those who don't know zkp that much just a brief introduction is what zkp are trying to do um so the knowledge prover proves the correct execution of a certain program over set of certain inputs and um it can usually be thought of like four core components so there's the circuit the witness the approver and the verifier um so the circuit is a program that you are trying to prove if you try to think about one instance of think about like sh 256 or if you're trying to think like Kar Haring functions or um verify ecdsa signature that's a typical type of circuits that we are looking at the witness is just the input of the circuit it can be either public or private you can think about the Public Public witness as kind of like the output of the program in a weird way um so these are like the two main functions over there and also there's the prover and the verifier so the prover is the heavy lifting software that just generate proof with consume a loss of energies with um heavy memory usage heavy CPU usage the wifire on on the other side is usually just a smart contract on a chin that verify the you know validity of appr proof very quickly so if you think about zp on the clan side all of these components going to be challenged for the circuit it really needs to have very minimum dependencies it cannot take like you know like just impose everything inside it's not it's just not going to work um and the weakness always need to be Blended so that you know like private data never leave the user phone before you know they got sent over to others the Prov needs to be very fast and efficient we are talking about 100 times more Improvement than we already have and the verifier needs to be extremely cheap on gas again like why do we care about Clans AKP and I just going to talk about what we do and just give you guys an idea of why this is actually important so for us with open with open 83 for the first time in human history we are fully able to prove who we are to others just by ourself ourself alone so among all components we do there are two shared you know like features we have so out winess always get Blended they got taken in a way before they got sent over to others um including ourself so your private data never really leaves your phone and the prover takes about 10 to 30 minutes to on your device and they're usually publicly verifiable for you know the guys V equivalent to a swap call um which is about $1 on ler to so the first thing we do is we do proof of Social account ownership we do this through like Social account o plugins um there are some previous people trying to do the same thing and it usually involve for you to just pull something on to Twitter send an email to a weird address things like that but for us it's just the old you know like sign with Google bottom you see everywhere on the web um that's all it that's how it required to you know get the verification started so for now the first thing we have really live on lots of the minets is that we do the anti-al attack mitigations for two major layer tools which is linear and scroll um so that you know like whenever you are trying to participate in bunch of their you know like events air drops you're going to first compete complete like some modifications done by us also because we are able to decentralized prove Social account reputations uh we are working with Rex which is also consensus product to build a 100% onch reputation system um and we are one of the major taxation provider on it so at the same time if you think about you are able to prove yourself prove your Social account ownership and if you want to log in with Google just directly into your wallet there's actually no need to do on PC or any kind of middle middle layer conversion of a private key it's very possible for you to directly verify the ZK proof inside of the smart contract so that you know like you use no one but yourself you generate a proof yourself you send a proof over to the contract and do Fone transfer yourself um so one of the partners we're working with is M app um and the link is right there in the middle of the screen if you haven't used it yet um so we are working with them on like bringing social accounts and py logins to it so that you know like you can directly have an experience of trading with each other sending asset to each other with no private Keys involved so if you if you're on there connect me with that I see. Mizu so that I can send you some test tokens and then we talk about DK devices so we do this through passport NFC chips um for those who don't know actually all of the passports with electronic chips enabl into it you're able to verify by itself against your issuing authority public keys of like um including your name for sure your your nationalities gender age date of birth passport issuing date expiration date even passport pictures uh but we haven't used much of the passport photos yet um but you know like think about running some zml over it and um just facial recognization of the of the person to be who they claim they are okay so why is it hard to do zkp first thing first circuits they're pols operations we have been taken for granted for so long they are just not simple anymore say just the simple bulling operations they're going to be like a crazy pols imagine like tens and thousands of is getting composed together it's just going to be a nightmare for the approver to go and the fixure size we haven't heard much discussion of the fixures yet but um because you know most the gaps run on server side these days the trust setups which is used by majority of the ZK um you know like K based commitment system they they can be multiple gigabytes of a file to be download for U Circuit of over size also the pro Keys a typical Halo to Pro keys can be of our size can be like about 15 GB um if you use circum to compile wasum circuit that's about 100 megabytes large for the client to do a zkb proof they just need to download all of these before they can start doing anything for the verifier is very depends um it can be about you know like the swap call is gas Fe of just as slow as that the craziest verifier we have seen is just taking 1 billion guys fees which is is about 15 times the block limit of ethereum so it's just going to it's just not going to work and we are talking about why zkp on the CL side is even harder than that than potentially building a ZK evm so the prover needs to be extremely efficient um always remember that you are most likely going to run a prover inside of the browser or on the user mobile device so we cannot burn the user's phone um on the server side we can just squeeze every inch of like compute power out of the CPU you can run like 20 30 different strats but on the client side we are saying like two or three strats maximum we cannot use a lot of memories um for some of the circuits we have it's just going to take like 30 GB of memories on the server but it's just going to burn the user's phone on the on the client side and we don't expect a bunch of like patient users so if the prover takes 30 seconds there it's going to we're going to lost a lots of users uh we canot have huge features for you know like it's a classic engineering definitions of like the CLI side networking is unstable and you know it's supposed to be slow by definition so we cannot download huge pictures um for us we have a fixure about 2 megabytes and that's the maximum that is acable by us and the verif verifier cost so if you run any Z row apps uh the state verification is going to be shared by thousands of users at extremely low frequency but if you run TP on the client side it's just going to be shared by a few users uh possibly just a few users over a few seconds of time at extremely high frequency so um the verif verifier cost is just going to be so obvious compared to ler TOS so why are we doing this now well in 2024 ckp is finally mature enough to build circuits that is run efficiently on the client side and the user case are so obvious right now like you know they Dax trying to be more kyc regulated in a way to protects and that's the only way for Dax to be allowed to treade you know like real world assets natively on there and someone going to do it so we're going to take the job of just get it done and finally talk about like our Solutions of you know cracking the issues so there are actually Three core components of how we are we are getting this done on the client side is going to run a pl2 circuit which is if based polinomial commment schema going think think about it as a ZK Stark in a weird way so it's doesn't require any um Pro keys or trusty setups and just going to generate a was some binary of like about 2 megabytes large um but the proof generated on this St it's going to be extremely hard to be verify on CH it's going to take the one billion I was talking about so next step we just do a server aggregations imagine like given a certain period of time say five user just finish the Clans side proof um and our Ser server is just going to Aggregate and verify each proof in under half a second and by the way on this step after the user finish the first app all their private data is already Blended so no one can see them no more um they're already inside of the zkp on the first step um and on our second step on the server aggregation side we're just going to build all the public inputs Genera on the first app into a merro tree so that they can be put on the smart contract then finally which is you know like one part to make it efficiently to be verifi onch we're going to do something called a snarfy with gar by consensus basically we're going to convert the if based plud proof to a Kate based um sark proof that you know like it's much easier to be verif chain and that's when you can push the proof to chain for about 250 250,000 gas um which is slightly above a swap call with some overheads of like writing the story slot to include the harsh the Mer tree route for the for the clients to prove for the clients to claim one of the T Station they have they just need to some M Mar proof and just no they can involve everything has been done and this is my my my favorite chart of like just flexing about the performance we have um we have a circuit of 150,000 Gates which is already about 10 times smaller than the previous industry state state of the art the client Pro time currently runs about 20 to 30 seconds but we are looking to like lower that down to about 10 seconds with you know like big integer um optimization for the client side binaries for now is about 2 megabytes which is small enough we will do a tree shaking of the dependencies to make it about 1.5 megabytes and remember we don't have any trit setups there's no Pro Keys that's the only thing the user need to download to get the prover started um and the aggregation time is just half a second the sari time is currently about two minutes two minutes and a half um but we haven't introduced the GPU accelerations accelerations yet so it's very likely it's going to be go under one minute after after a while and the badge verification cost is very low and for each user to split split this cost they're going to reach a point of like it's almost free for them to do a verification so for now there are about half a billion test station we have already done on linear and scroll and we still counting on more to come in the coming month so what's next for for us for now the major part is just replace the plank2 IOP to a hyper plunk so there's no fft involved and so it's a constant time approver it's going to it's going to give the performance boost we need from 20 seconds on the client side to 10 second um we haven't introduced the GPU accelerations yet it should be you know like boost about five times performance on the snar K5 service um so we haven't made the proof of passport app generally available yet but once we do it's going to be an easy way for you to just scan your password takes about 30 seconds on the CLI side and then you are already K on every single chain over there and we have a large range of kyc Partners we haven't integrate with uh we're going to work really hard with that to make sure you know like it's very easy for us to transition into like a more kyc on change with privacy World also finally we haven't buil the social ground for the verify accounts yet they are already inside inside of the contract we just haven't buil an indexer on the front end of doing so and that's about it that's our contact informations if you have any questions or wants to talk more just jop us a message and I think we got about three minutes left so we are happy to take any questions if you have any