ETHTaipei 2024 Workshop：Linea - Build Lightning Fast SNARKs with gnark

I'm going to be completely transparent here this is a bit of a rug I'm not a cryptographer so everything I'm going to tell you today about 3K circuits and gar is pretty much the extent of my knowledge uh but if you have extra questions at the end I can always point you towards the right people anyways let's get go ahead and get started um we're going to find out what Gard is um so like starting off oh I guess this is my slide to tell you my disclaimer is the beginning um anyways what is gar right so this is going to be um it's a DK circuit library is a framework for developing snark so this is actually how we write our circuits at Linea oh wait let me stop do we all know what Linea is here yes no I can't tell no okay cool wow I just assume everyone knows what I do but that's false okay so we'll start from the beginning right so Linea is a ZK rollup we are a layer to bootstrapped by consensus right so uh what does that mean in a nutshell well for the first part ZK right so we are secured by math um we are aiming for a type 2 ZK evbm meaning we going for 100% coverage of pre- compiles op codes all these different things such that for developers your experience building on Linea is no different from ethereum right so it looks exactly like the EDM um I think when we talk about bootstrap from the consensus side that is basically saying we are able to leverage the full power of the consensus ecosystem system and so by that I mean like for example metamask is part of consensus so there's a lot of areas for Synergy between metamask and Linea we are a default Network there's a lot more to come in terms of how it can work together which is super cool and then I think the one last thing that I think is really important that people don't realize is Linea is the only multi client L2 that exists so it's because of the way we're built but essentially if you want to run a node you can do gu we can do bzu we can do nether mine um lot of this is also because bezu which is a minority client um I think it's the third most common client use uh it's actually built inhouse at consensus as well so there's a lot of really cool advantages you get when you have a client team in house um alongside just like expertise you can think of it as 100% support for uptime and things like that um and in a world if gu blows up at least we have other options but that's Linea in a nutshell I hope does that cover everything yes Okay cool so anyway so Lydia is a ZK rle right what does that mean is we use ZK proof to prove that the data that we're posting on ethereum is correct right and how do we do that we do that in a lot of different ways U which I'll get to in another slide but today I was going to talk specifically about Gart so starting over from the beginning right so Linea writes it circuits using this open-source Library called Gnar um so what is Gar so ganar is I keep saying this an open source circuit Library um there's a really a few cool things about it so unlike other kind of circuits uh gar is a go package so that means you have no domain specific language um you get all the benefits of using goang um like testing debugging logging Etc that you kind of get um out of the box um because of this you can version your circuits uh unit test them put them in cicd workflows um which is really awesome um so it can kind of do everything that you need in terms of like generating proofs and verifying Keys you can use it as a smart contract verifier for6 plun Etc we have the full SCH um but actually I'm going to mention this piece because I get this question a lot good n okay well let's let's roll back right so how many of you guys think of ZK proofs and you think privacy okay maybe it's just me but I get a lot of questions about ZK proof of privacy right so there's a lot of different libr for writing DK proofs like Noir soril Etc gar is one of them um I would say gar the way it's buil is very suitable for performance right so when we talk about why we use DK proofs for rollups it's because the data that we compress and verify we want it to be as small as possible cuz that is the cost that we're incurring on the L1 so for gar specifically it has the property of being able to be incredibly succinct incredibly fast right and so all those are really great for Speed and Performance reasons hi sorry that's my friend uh this is Daniel from scroll um also doing really smart stuff uh but regardless anyways where was I yeah so Berard is really good for performance-based applications so I don't know how many people in this room are trying to build rollups if you are you will make a lot of money uh and you should use canar I think it's kind of the the takeaway here um it's really good for parallelization um and I guess like Hardware right so when you head the next slide too the other thing that GAR offers is actually profiling which is really interesting for those of you riding circuits so as you can see right here this is basically like a graph of all the different pieces that are happening and like on the linear side of we' been able to do with this is note like hey a lot of like time energy whatever you call it is being taken place at like the middle part of this and then that's how we can kind of refine um as the circuit as we move along right um and to kind of talk about gar in real life uh if you guys know things like ckb CK Cellar Bridge um other things like we're heavily used we're actually also used in viip for a44 which is really interesting um but yeah I I I guess along those lines too like I said before Noir is really great for privacy because they have a JavaScript library making it very easy to implement gar does not have that feature however if you do want to use thear circuits for ajs like application you can um but that's beside the point we're actually going to talk about what it looks like to use a ZK like a proof in um an actual rollup so this is kind of the process of the linear approver right so first off um kind of going down this line right so uh I don't know what the expertise how many of you guys know what like Ari ation and all of this is yes no kind of okay so I'll start over I just made assumptions about everyone that I was wrong completely so that's completely fine um so basically in the steps of the approver right so this is on the layer two side right arithmetization kind of hand waving it away is kind of the process of turning execution traces into like math that the prover can understand right cuz ZK proofs are ultimately polinomial evaluation so they are like math words I guess you could say um and so there's a few ways to do this right um and with linear specifically the way we do it is we have inner and outer proofs that we aggregate together so what do I mean by that so kind of in the middle section here you see a wizard IOP and a lattice proof so this is actually our first proof that we create um it is I guess you could say the thing that sets us apart specifically it's because translating fre compiles into I guess the math is really difficult um and it's not very snark friendly um so there's a trade-off between I guess you could say proofs that are snark friendly versus arithmetization Friendly so for us specifically we use wizard IOP um which creates proofs that are actually too big to put on ethereum right um so the way we get around it is we use this to basically do the proofs but we use gar to prove the correctness of it right so when we're talking about I guess like rollups in general are you guys familiar with like fraud proofs with optimistic rollups yes right fraud proofs do not have the same property as ZK proofs where ZK proofs they're math so you can prove proofs of proofs of proofs of proofs of proofs recursively shrinking them down proving correctness and other things that's actually what we do here and that gives ZK rollups like a lot more opportunity for scale in the future than you can get with an optimistic rollup for example anyways so here specifically like we came up with what we call Alpha V2 uh maybe like a month ago um and it introduced a few things that I guess like help speed things up right the first being um proof aggregation which is basically taking all these different proofs and pulling it together into one and then the other piece being data compression so again like I said putting that data back onto ethereum and doing that proof is the most expensive part that you're incurring so with compression we make it as small as possible so what does that look like here right so on the top side here uh if you look at the the top side I guess the first yellow box at the uh man I keep staying on top dude I'm so out of my right now I'm sorry but any so what we have here is actually the decompression or sorry yeah so we are basically doing a proof of the decompression of the data that is going to be put on ethereum right so that's the top level you see we actually also use gar at the bot B and that's because the wizard IOP needs uncompressed data they cannot take that they cannot prove that right so what we do there is we actually send a proof that we're sending the correct data into the wizard IOP it does magic there um and like I said at the end of it the wizard IOP proof is not succinct enough to put on ethereum so the next step we have here is actually we prove the correctness of the proof and that's where the gar clock proof 2 comes in and at the very end we have everything together we prove it all together and we post it one time to athere um I think I talked around a lot of things if it didn't make sense it's okay it didn't really make sense to me neither all that matters is things are cheap and fast or scaling the unless you actually want to build a roll it then we can talk about this afterwards anyways why do we use G right um this is actually just I guess a few slides for me to show what gar is uh we actually are the fastest snarks out there uh so if you look at these different things um I I guess over here snarks are faster than snarks but we aren't using snarks but any gar is the fastest snark um and oh I think I I wanted to say this I didn't use the title gar actually won the prize for the fastest circuits on mobile I will say we don't use them actually for mobile because there's additional annoying things that go from using like go to mobile don't make sense but kind of like you can think in a future World um we have the ability to get to that stage anyways so getting started with thear um I will also say this is a rug because I tried to write a more complex circuit and then I gave up so we're going to do the most basic circuit there is and cry together afterwards but anyway so like this is how basically um it works so the easiest way to get started actually is uh a playground called. play. ark.io which is pretty fun because it's a playground uh and basically the setup of a uh circuit is essentially we have a struct here and by default these variables so this is like your private and your public key your it's by default private you have to mark it as public right and then here Define is actually just the where you define the circuit so in this a very simple example it's basically doing a cubic function so it's saying hey if I multiply these three times and add five assert that this is true right that's the definition of the circuit um and there are different examples here if you want to get into like more complex situations like rsas and these different signatures and things like that um but this is like a way to explore the different types of circuit definitions there are there and you can also like mess around with the code here and then run it I'll be like oh it's wrong and now it's correct cool um so that is basically the way to write a circuit you actually want to get into building one um and proving it I have the code right here uh simple circuit right so as in here when we saw in the playground right so we had the I think it was a cubic function this is the structure of it and then if you actually the main function so running it looks a little bit like this I'm sorry I'm not live coding cuz this is a lot that I'm going to like what you call it accidentally push like copy paste incorrectly um but as you can see you basically just compile the circuit you can set it up you can use pong for Dra 16 um and then you create the witness and the verification right right here and so in this case oops run cool and that is actually saying it's correct and the really nice thing like I said about using go is you're able to use go L packages or go Ling testing so there's actually a test package that we have right here for you um very simple stuff you have all the normal like assertion functions here so Pro or failed Pro succeeded those aren I test wait no no it should not have passed right unless I accidentally type in the correct number no way this is so embarrassing okay um okay cool I think that failed unless it's telling me my command I don't know what's happening guys I don't huh may you want to add the dash for Rob oh yeah I don't think you're supposed to yeah okay yeah yeah but this is wait why is it failing why is it passing if I do this one will God damn it is proving I'm not AI okay okay so oh yeah okay okay yes you're right that makes sense it it makes total sense okay so if this was 3 and 35 there you go then they should fail yes you're right like yes huh yes I can Doom in too much thank you so much P sir um yeah so I'm getting anyways that is all I have this is my fault for not writing something more I add that there is a more complex tutorial if you want to go through it but um I feel like this is unnecessary for understanding how to write a circuit but yeah that's the primary like way you just Define your public and private Keys um in this case we're verifying the correctness of a EDSA ver fire circuit um in the same way we have different ways of asserting things so where was I what's next for gar are you guys interested in what's coming up on a road map sure okay cool well actually I'm just going to tell you what happened recently and then I'll then we'll talk about what's coming in so this is really exciting like I said we worked on proof aggregation recently um the uh other thing that we're doing is yeah there're just performance uh improvements so proof of decompression this is the part where I'm talking about specifically the data availability part where we are able to squeeze it down and post it back but actually if you care about what's coming up again more aggregation is coming more compression is coming um it is partially audited so we expect to see the full audit by summer um and yeah it's very fast uh you how many of you guys are hacking in the hack Bon one person hey you if you're hacking the hackathon we do have a bounty you can build whatever you want I'm judging I'm very partial to frogs so hint anyways okay cool so that's everything that we have here are the docks um if you want to get connected with me specifically en joy that uh this is the chat where like a lot of our team is in so if you have more questions about gar and like everything they're probably your best betet we talking to like the cryptographer specifically um like I mentioned at the beginning for all these people who came in later this is me stretching the boundaries of my knowledge but uh I hope all of that sort of made sense um but yeah any questions I hope I conveyed the coolness of it at least yes you talked about maybe using as a background for Noir yeah is that something that's already like play yeah yeah yeah so um not on Noir specifically I think somebody else created their own like GitHub where you can build.js with gar circuits in the background so if you guys use things like cnry as well cnry you can choose between the different types of circuits so you can choose Noir circuits you can choose circum is it circum or circum I don't know but uh yeah I hope this was interesting for you guys if not don't tell me okay cool did you have a question yeah so when I write Circle I use all these static analysis tools to uh check my constraints right and if we're using narc as a go API uh do we have any comparative tools yeah I mean so I think if you actually this right yeah is this helpful is this answering your question you can like download all the you can also deug I was wondering under Tools to check that I'm putting into my constraints oh under uh my answer is yes but my answer is I don't know how to do it so I will should asking to do yes yeah cool any other questions fantastic at 3 minutes thank you so much for coming guys