Fireside Chat I Eli Ben-Sasson and Kartik Talwar I SNARKs n’ STARKs | Pragma Paris 2023

foreign [Music] so next up is our second interview for the day you've probably all heard of Starboard by now and there's a lot of things that have happened the last five years especially in the field of cryptography and we're going to talk about kind of how that's changed how that's evolved and how we've kind of come close to productizing it and to do that I want to bring on Ellie from stockware to share all of his thoughts so without further Ado please welcome Ellie on stage hello everyone hi welcome thank you thanks for having me you've been in the field of cryptography for quite some time most people know you in this room from your contributions to cryptography uh but also a cryptocurrency worlds but also there's been a lot more than that and what I want to do is kind of just get context from you on how did you get more involved in the world of crypto and kind of espi from founding zcash to starkware what's what's the history been in how did you get started yeah so um I was a mathematician in theoretical computer scientist so I was writing white papers about math theorems and um around 2008 I started actually uh dabbling and implementing some of those systems um with no good purpose in in sight but I thought it's a fun project in 2013 I went to the conference of Bitcoin in San Jose and there um that was the place where I was red pilled and realized that the research I was doing has a lot of applications to blockchains in particular to two specific areas one is privacy and the other is scalability so the first thing we did was write a an academic paper that was the precursor to Z cash we were seven academic co-authors all of us along with the zcash engineering team co-founded zcash that was around 2015. but always I had passion for a different branch of and that was using um something called the ZK snarks a particular version of them based on the ggpr protocol for those who know and I was still more passionate about things that are based on a different branch of math that is better in many cryptographic and mathematical senses and that's what led to Starks around 2018 and um then we found that starkware with the purpose not of solving privacy but more scalability and when we started this thing this was already five years ago no one was talking about scalability and no one was talking about scalability using proofs except for us so we've been at it for five years and uh I mean now I think a lot of the world is talking about these things and very good that's amazing for so we're going to actually we're gonna in a way try to figure out what is the right balance of going super deep and super high level but let's kind of start with some high level stuff what made you think about the concept of starks and could you also contrast that with what is the difference between snark and a stark here so the way uh first of all there's a lot of overlap between what is a stark and what is a snark and some things could be both but broadly speaking when people talk about snarks they usually have in mind something that uses uh a branch of cryptography that is uh known as elliptic curved cryptography and it has some advantages the main one is that the proof that comes out is around 200 bytes long or you know around a kilobyte long in certain versions but there are a lot of uh caveats to this approach it requires what's known as a trusted setup someone that you trust or some process that you trust has to generate parameters for this thing you need to work necessarily over pretty large domains that slow down computation and it's prone to attacks by quantum computers and other problems there's this other way to build proof systems which is you uses more math you need to work harder on the math side and prove stuff but then you get things that are more generic robust and uh safer so they're not attackable by quantum computers you can instantiate them over any finite field they don't require any setup so overall they're better the one area where they don't match up to the snarks is uh in proof length so instead of being let's say one kilobyte they're in the area of like 50 to 100 kilobytes um so anyways but I think Starks are a safer more future proof way to build systems and they're also more efficient so and mostly out of my curiosity um is is what you kind of just said a comments on the current versions of What Starks are or this is like just at the end this is the the boundaries here and we can make that better like we can think about reducing proof sizes over time or kind of thinking about recursion here or can other optimizations yeah there's there's ongoing research all the time you can definitely reduce some of these things and expand them and generalize them I mean we've shown recently how initially you needed to pick your finite fields in a very particular way we showed how you can do it over any finite Fields the um amount of security that you can prove with math has been increasing over time so overall things are getting better whether using that approach you can go down to the um size of a single snark I'm not sure but the thing that matters most for scalability is actually amortized cost the question is how many you know if you think about proof length you want to ask how many you take size of a proof and then you want to divide it by the amount of computation that it proves and covers and according to that metric already today in production Stark's drastically out of perform Snorks because the capacity and the amount of transactions that they can cover is much bigger we in production can submit today proofs using recursion of upwards of I think 10 million mints of nfts so if the proof is a hundred kilobytes long but you've proved 10 million nfts it means that each nft cost you whatever is uh the answer when you divide a hundred thousand by uh 10 million it's a small number but I don't know of a dollar percent uh thousands of a kilobyte so maybe it's a byte so maybe it's one byte per uh if if we got the math right so I mean that's that's massive I mean it's multiple orders of magnitude um are there things that are uniquely enabled by just Starks in the sense of kind of new applications of these proving systems that you get to you know and not get from um not just Nars but just like overall looking at just another smart contract code or different properties of blockchains what proof systems allow you to do is uh massively scale I mean basically if you think of the blockchain as this really trusted platform that has a lot of Integrity um it operates at a certain if you think of it as some kind of a computer a really trusted computer it operates at a rather low rate or capacity compared to the demand and that's why you have these huge uh um costs when you submit a transaction it's congested because everyone wants it well if you use a proof system and and Starks are best in terms of scalability you basically take this computer that is let's say ethereum and you ask it to run the verification process of verifying a stark when you do that the amount of computation being attested to and and verified by ethereum jumps exponentially so you can have the same uh running time for ethereum or the same you know block capacity and gas but assert Integrity over a much greater scale this can be done in both systems in many flavors of proof systems um currently and probably for a very long time the most scale will be given by various things from the family of starks I think this will be a an ongoing theme and the other aspect you can get is various shades of privacy you can have full-blown zero knowledge which means that mathematically speaking nothing is revealed by the proof but also you can have layer threes and fractal scaling where a single operator is working offline processing a lot of transactions and then and then the blockchain doesn't have any way to know what has gone on in those transactions so effectively you have now a lot more opportunities to actually make things more accessible but the properties they kind of the same and you know when guaranteed and that allows you to do the same thing more yeah so um so you know Stark net is is live it just went last week through a very dramatic increase in its throughput and there's going to be more increases in the throughput it has a modern ergonomic and safe programming language called Cairo that is rust inspired those of you who are participating in the hackathon I strongly encourage you to look into doing your projects over Cairo testing it out it's a very pleasant experience you know for instance Moody Salem from from uniswap has left uniswap founded an amm startup that is going to deploy on starknet he says that he picked the Cairo up in a small number of weeks and it's actually today his preferred uh language for writing smart contracts irrespective of the scale and cost benefits given by starknit so I strongly encourage you to look into developing over Cairo and um the kind of applications that are now spawning off on on top of uh start net are very very interesting first of all all of the Native wallets there because darknet has account abstraction at the core level there's no eoa versus smart contracts everything is more contracts all of the accounts so the two uh leading wallets over starknet which are Argent and braavos have very pleasant ux for their users even for first-time users an account abstraction is really picking up there are on chain gaming projects that are going to be announcing deployment as soon as tomorrow or over the next few weeks and there's a lot of excitement so on-chain gaming is something that's going to be really really dramatic on Stark net it cannot be done any place else and that's just the beginning uh this actually fits really well into one of the questions I had which is can I as you can introduce a system like uh like like Starks here and you can already talked about Cairo uh you kind of had to make a different decision around what people had access to which is being able to deploy solidity code immediately or be able to kind of learn anything um what kind of was the framework around making that choice of hey instead of thinking about compatibility in different ways or bridging we have to kind of enforce a new way to let them come up with a paradigm for programming yeah so I guess this question refers to so on starknet you program using a new programming language rust inspired called Cairo then the question is in most of the other projects trying to scale ethereum using validity proofs or calling themselves ZK evm the word ZK is a bit of a misnomer because it's not about privacy it uses validity proofs but anyways and what they're promising developers is you know you just take your solidity code you press a button and it automatically works just a much higher scale well the issue well there's several issues with this first of all there's fine print and if you read the fine print even in that approach you'll see that it's not as easy as pressing a button I'll unclog you know unclick like double click what what is meant by this fine print um in the evm ketchups are very very cheap so you use them everywhere however they are extremely expensive to prove so you have this option either you go with something that is very very slow and very costly and actually you lose pretty much all of the scale that uh validity roll-up could give you or as a developer you need to start modifying your code and replace that now if you start modifying your code things start breaking you need to fix them a lot of the texting tools and so on and so forth don't work as well now ketchik is an extreme example but there are many many other cases where if you just want to press a button and have it working then it doesn't and then you have to also deal with the fact that if you know your solidity code on ethereum assumes a monolithic state of ethereum but whenever you move to a layer two that's you know you need to know what kind of state you're talking about so any which way you're going to need to modify your code but the bigger issue is that if you really want to maximize this scale out of your proving technology you probably are going to be better off using a language that is suited for that by analogy um I don't know of anyone using compilers or transpilers from python or rust into solidity even though someone could write a compiler and arguably rust or you know python are more documented and probably better programming languages for General computation than solidity why isn't anyone doing this well because if you're going to build a smart contract on ethereum you are best off if you use the native language for that it's the exact same thing for uh validity Roll-Ups and you know when we started starkware we said scaling the right way to do it is with this technology proof technology and the best technology in that class is Starks and when we said that five years ago everyone either didn't believe that it's a problem or said there's no way that validity proofs would work and if they agreed that validity proofs would work they said it's not going to be Starks now when we came out with Cairo and starknet the initial statement was oh this is going to be such a big deterring factor No One's Gonna Come like everyone's going to stay with solidity well the numbers are out and it's completely the opposite so if you go to the yearly developer report by Electric coin Capital you'll see that the largest ecosystem that has seen any positive growth in full-time developers over the past year is um Stark net according to their reports uh 38 which tracks all the GitHub commits and everything open source yeah yeah yeah so so like um the and and you know I talked to many many people from the ecosystem the statements that say oh it's going to be hard to convince developers to come and learn Cairo has not panned out people are very excited about it you know I mentioned Moody Salem from unusual but many many other teams are very eager to deploy their Cairo contracts it's an amazing language again those of you in the hackathon contemplate or explore deploying on it you won't be disappointed so maybe they're not a curiosity do you do you think that other scalability approaches that are trying to get to evm compatibility are just taking a wrong approach or is there just there's multiple ways to to kind of solve this and you just think yours is long-term more scalable several years ago I said almost all scaling Solutions are going to be Stark based I think today it's panning out so you know I saw that Alex zukovski was here earlier they just announced that they're moving to bujum which is Stark system all of the polygon systems Hermes polygon zero might then are Stark based risk zero is Stark based of course Stark net is everyone's going there I'm saying now I've been saying this for a while everyone's gonna adopt Cairo and if not they will have virtual machines that follow the same route so what is that route let's call it algebraic extreme reduced instruction set right risk stands for reduced instruction set the philosophy behind Cairo is you go for something that is extremely reduced instruction sets so that the constraints that Define a step of computation are very very simple and minimal and then you start building from there so I have no doubt that either folks will adopt Cairo as is because it will be like solidity it will have all of this amazing tooling Foundry was announced yesterday coming on starknites already deployed that's option one and if not they will go down the same route they will say here's a uh you know risk algebraic risk kind of uh virtual machine Let's Build for it so in this case do you consider ethereum as an ally or a competitor or kind of how does this connect with ethereum the the ecosystem ethereum is the base security layer that starknet cannot live without so right ethereum is the most trusted decentralized broadest layer one that allows General computation right Bitcoin is also amazing but Bitcoin just doesn't allow General computation so we cannot deploy Starks on it today so ethereum we need it for its broadness and for the security so certainly Stark net is not a competition to ethereum it is something that enhances the amount of computation and the range of things that ethereum can do and what is most missing right now is again more developers to build either infrastructure or just cooled apps that will be harnessing all of this uh computation on ethereum as somebody's digging more into that are there any kind of particular things you want to see in uh in the Stark net ecosystem or things that you think are missing but critical to the growth um first of all there's a lot of stuff missing uh for instance decentralization has not yet turned on right now the sequencing is done in a Central Way in the proving um this will be changed we'll move to something tender mint based that has both the proving and the sequencing decentralized under open source code for both approver and the sequencer another thing that is missing is like so so Paris is the epicenter of starknet all of the amazing projects and teams are here but we need more of that in other cities and places in the world um the starknot foundation that is now up and running and is already giving grants to developer Advocates and to parties that are doing hackathons and meetups and so on is eagerly looking to expand so so we need even though the developer ecosystem is big and growing very very fast there's so much more that can be done in many other areas of the globe so please reach out if you have thoughts on or you want to run a meet-up or something or a hackathon in your location especially if it's not Paris Paris is covered that's the only way to get everybody to use Cairo then right um over the past few years of kind of running starkware and going from kind of Academia to kind of company building and being part of this ecosystem what are kind of some of the things you've been wrong about just largely have learned yeah what have I been wrong about a lot first of all I should say um well one thing I've always been wrong about and probably still am wrong about is like uh the time frames that take for things to happen so I'm very optimistic and like uh and I make projections like this is gonna happen you know within a year half a year and then these things take longer both in terms of development and in terms of uh adoption so I think directionally a lot of the stuff that we said was directionally correct but it takes often more time than you think so it's definitely wrong and the time scales um what else what about company building overall um well I have like uh I I guess I saw three examples so I start I I try to uh found the company which we closed pre-funding in like 2015 then I saw zcash and Then star core so and maybe now the foundation I get to see it so so it's not a lot of uh I don't have like a broad view um I would say that uh what I'm very proud of that all of us achieved in in starkware and it's uh is this Spirit of uh Excellence but also magnanimity and like being able to say you know that guy there is way smarter than me um and he's you know or she is better at doing this thing and uh that's I think the thing I'm most proud of and um I mean people a lot talk about other different I think we have this image of whatever the Elon Musk or something like this or the Steve Jobs that's like uber whatever uh talented but very uh dominating uh thing so I definitely start wearing Stark net are the opposite of that they're very sort of a decentralized internally very merit-based very non-hierarchical and it's uh uh I mean speaking of wrong and things like that have been sort of outvoted and viciously downplayed and you know frustrated for you know not being able to convince um folks on a variety of topics and then the the pleasant thing is that a few months later I I can come back and say you know I was I was wrong uh it's a very healthy thing actually yeah so maybe as my final question uh from what you just said should we revise the next two-year estimate for everybody using Cairo no this time I'm gonna be right on this uh uh I think the direction is what matters that's fair so so I'll kind of close off with this uh which is um any predictions for how we think the world of just scalability looks like a couple years from now do we think we have solved it if so how would you how would you measure that scalability is largely solved and let's get to building applications uh what would you say there um okay we certainly have not solved it um hopefully we're in the right direction and I think the right direction is using validity proofs preferably Starks but you can support all sorts and kinds and flavors and with things that everyone's talking about but haven't been implemented yet and these are like this is the fractal scaling that Stark were introduced you know proudly um so where you have layer threes and layer fours and uh this is really the way to uh to if you ask yourself how can we reach a situation where people buy their cups of coffee or pay you know a micro Cent for viewing a web page using blockchain technology it it cannot be one layer two it it has to be like uh fractal scaling that will there will be sort of you know National and Regional uh you know mini blockchains specific two different actually a nap chains and so on that sort of all of them feed into the layer one at the top awesome well Billy thank you so much for taking the time and uh finding for any other questions later thanks [Applause]