Community Meetup August 2020: Making Sense of MACI

yeah but hopefully sometime in the future uh there'll be that's that could happen uh um my name is wayzier uh i uh currently work with the ethereum foundation on applied zero knowledge projects um last uh about two years ago uh i came to fkl also to present uh at one of the meetups at the co-working space and i have very fond memories of that trip and um at the time i presented about a zero knowledge proofs for the mastermind block game and at the time that was the beginning of my journey doing zero knowledge things and that's when i was a smart contract and backend developer for consensus singapore today with the applied zkp team we work to bridge the gap between zkp's and application development ontario and so we're always on the lookout for use cases that can benefit from zkp's and also new research directions that can benefit from engineering expertise and in this team i have to build a project called semaphore which is a privacy gadget that lets developers build mixers anonymous login and anonymous voting systems and besides that i also work on trusted setup ceremonies and this is a team comprised of myself barry whitehead colby goodkind and others and my role is mainly as a software developer and also a tiny bit of research and beyond work during the lockdown i have enjoyed doing a lot of reading running walk taking hikes and learning new things so just want to give some credit to the people who made macy possible vitalik came up with the original concept and barry and kobe led the research efforts and also gave a lot of technical advice and kendrick chu chung ying tong and ningtong also did development work for macy today's presentation is uh not technical in nature uh i will cover the concepts around mesia at a more general level but since this is an atm meetup i do assume some basic familiarity with ethereum and smart contracts but i won't get into a lot of technical detail maybe if people are interested i can we can do that at the end of the session maybe if there's a q a but mostly i want to focus on the fundamental nature of the issues that macy tries to solve and also elaborate on the use cases that mesa can benefit um can i just clarify how much time i've allocated for this uh we put it until 9 30. uh but honestly it's remote so as long as people are still awake we can go on okay uh i probably can finish before 9 30 but i would i i'm like super happy to like um do like be there for the q a like do a q a and um if there's any like questions in the middle or at the end please anybody can feel free to chime in and i can just pause any time and clarify or answer questions and maybe during the end of the session like after the presentation we could do a discussion kind of format maybe so it's so it's like more free flow yeah okay so um let's just talk about the the main problem that macy tries to solve and that is bribery uh but specifically bribery in public blockchain voting systems so the reason that driver in these systems is even possible um it's not just that because it's not just that people can be bright or that people are dishonest or greedy or they don't want to play fair the key issue here is that in public blockchain voting systems you can prove that you voted a certain way so if you show your driver your vote they can verify it and then if you had voted for the party or the option that they wanted you to vote for they can pay you the money which is it right so a very very simple example is eve is a driver and she says um alice please vote for party a and i'll give you five e if you do that so ellis says okay and then she votes party a and some kind of on-chain transaction that actually uh votes for party a so uh alice shows if the transaction hash and if looks at it looks at the transaction and and and says okay i can verify that you actually voted for party a so here's your five e and she transfers the bribe to her so that is what i mean by on train um public blockchain phonics systems and it can get even more uh interesting because bribery on smart contract systems can be done through smart contracts so for example there was this smart contract developer who created something called sell out down and it's sort of a bribery layer in between um in between someone and moloch dao which is a public goods funding mechanism on ethereum and the idea is that if as long as someone sends like 0.5 eve to this contract they can get included in the list of voters uh for more lockdown and that is the kind of drive that's made possible by your smart contract and the smart contract logic okay and so that's uh that's for blockchain voting systems but i just want to spend a tiny bit of time to talk about what is the alternative what is non-blockchain voting systems and i think everybody is familiar with that um and so for example um in singapore we don't have e-voting we use paper to vote so what happens is you go to the voting station and you go to a shielded booth like the one in the picture and then you you you cast your vote which is on paper and then the paper votes are counted and that's where the results come from and during this process no one can easily look over your shoulder and there are also bureaucratic and administrative safeguards in place that are meant to heighten secrecy and during the whole process there are also opportunities for local political parties to observe the counting of votes and finally after six months of the release of results all the ballots are destroyed and so this means that um only an extremely resourceful and determined attacker can effectively bribe someone to vote the way they want to as long as these procedures are followed correctly so that's paper voting um and there's also what's known as e-voting e-voting is for example in the at the national level certain countries use machines to vote so you go to a machine you press a button and that's your vote the issue with evoling is that it's a bit of a taboo topic in the security community because there have been like countless reported cases of e-voting systems malfunctioning or being hacked even during the actual voting process so these security problems come from hardware and software and because they can be complicated this complexity compounds the risk and as e-mailing also comes in the form of using your own device to vote but the accessibility issues if this especially if you want to do elections at a town level or city level or national level because not everyone has these devices or access to these devices so this is not to say that paper voting is perfect there are paper-based elections and their integrity in some cases are definitely suspect and this is due to social factors and political factors but there is one advantage that paper voting has over e-voting which is that paper voting is more resilient and evolving can be more fragile so for example um if there's some kind of technical flaw in the e-voting machine it's likely to affect the entire range of machines all the machines are used in this election um but with paper voting if someone finds an issue in one pony station they could they could take action to remedy it and implement some fix but this is much less feasible when it comes to using floating machines or for evolving all right back to macy what i'm trying to say is that macy is not meant to be an evolving solution it is meant to demonstrate a solution to one part of a larger problem and specifically on-chain bribery so um it covers use cases like dowels quadratic funding and on train on chain voting for these for these organizations uh but there's still much work to be done to make macy and macy based systems secure user-friendly and performant uh it also needs an identity solution to prevent severe attacks and like many other cryptocurrency applications users need to have good key management solutions so mesa is just one piece of a larger puzzle and earlier i mentioned that e-voting is sort of a taboo topic and when vitalik wrote about uh wrote about collusion and bribery on uh in blockchains his argument was that it's better to try to solve the problem than give up entirely because a lot of people in the security community say don't use online voting don't use e-voting um but metallic's point is that we should try to solve the problems rather than give up and macy is one example of a best effort attempt to solve part of the problem okay so here's a concrete example of an on-chain voting system where anti-collusion or anti-bribery is really important gitcoin is a start-up and they've been very involved in facilitating funding for public goods on ethereum and they do this in multiple rounds i think people in this meetup have heard of them and there has been cases where projects are seeking funding have kind of like offered quit pro quo uh benefits to people who vote for them and the idea is that there is a funding pool where there are large organizations like the like consensus or the ef uh that would match donations to these projects so let's say i donate one die they could be matched more than one die by those organizations so when the project wants me to vote for them they could say hey what's here please vote for me and i'll give you like special access to my product or i could give you some kind of benefit and that is fun that is what bribery is because if i vote for them they know they don't just get the funds from me they also get match funds from those organizations and this is uh this kind of behavior will render this process very problematic and it's something that people don't want for the good of all projects okay so now now that we've discussed like what exactly macy's trying to try to prevent um let's i mean let me explain how it does so in a very high level way so what does mesa bring to the table um if you take away only one thing from this presentation the idea is that macy allows a voter to cast a vote in such a way that it's impossible to prove to a briber so going back to an example from just now when an alice cast a vote and show e for transaction hash if you use macy eve should have no way to tell which party alice had voted for and there are two reasons for this that macy makes possible first of all the votes are encrypted so ellis could say that she had lost a private key that she had used encrypted but what if alice gives eve the private key that's here comes the second reason that we can prevent bribery in macy ellis can secretly change and probably her change the public key associated with her voter identity before she gives eve the power to vote on her behalf and so any votes that are cast using lss old key will be invalid but eve cannot tell whether it's invalid or valid and so that's how macy um makes it possible for eve to think i have no way to tell if i give five eve to alice uh i have to know i have no way to tell which way alice had had voted therefore the 5e right at its width like it has no effect i have no way to know if it's going to have an effect so i might as well knock right at us and that is the key the key reason that macy does what it's supposed to do maybe this is a good point where if anybody has any quick questions i could pause and answer those questions yeah i have one question um so um allegedly uh some political parties uh in malaysia have uh given sort of bribes to a certain sort of constituents and um in those cases they have no way of knowing that the people who receive the bribes voted for them anyway but we've again allegedly seen that that has happened for many years so would having some sort of on-chain um kind of like not being able to track uh bribery how much impact would it make in a kind of voting situation like i described wow that's a like fantastic question um wow i think the okay i think the difference between on train voting and political voting in on the ground in real life the difference is that in real life there are probably more social connections between the voters and the candidates and they probably have more um kind of like um intelligence on the ground they probably have more ability to to to influence the voters so so they could the notch they give them is not just the pride but also like the the promises and the things they say to them the communication and and and also in the relationships they have with these 50 voters um i think with on-chain voting the situation is different because in the crypto community people are quite spread out all over the world and there isn't necessarily this kind of deep social bonds or or community uh bonds that that people can use to kind of influence other influence folders with so people are more kind of spread out and disconnected from each other so i think that's where um that's where the difference is now yeah i hope that makes sense but then again i i then again it's totally possible let's say eve gives you it gives tells it's totally possible for alice to do what eaves wants uh even if even if alice cannot prove it we can't stop that we can't stop ellis from doing what she wants but all we can what we can do is uh is to make it impossible for her to uh to verify for for eve to verify that alice has done has voted this way and i think that's the that's that's the practical um uh advantage that we have to train to provide anything beyond that is is has to go into into psychology yeah okay uh quentin has a question question you can unmute yourself hi guys thanks wayne i think you should come off and on every two years a treat um and thanks harris for for making it happen and and interesting advice um yeah just a question i lost you a bit um when you were mentioning the example of bitcoin so they implement uh quadratic funding right and uh massey would be something they could implement or are they implementing it already and then i just wanted to make a small observation um regarding just the answer you gave i think to to harry's point uh and to your point we can't stop physical bribery so in the example of uh of elections in a country i think you can't stop a politician from you know you know giving money to his constituents basically because he already doesn't have the proof that they will do so as uh as what he said i think if we had a messi from an election through an uh an online election in malaysia for example the case scenario in the question would be if the if a state controlled commission organizes the election the fact that we implement massey would it mean that even that institution that is holding the election is incapable of knowing who's voted for who okay uh i will let me just take the second question first um so i think generally it's i'm not i wouldn't say that macy is uh is currently at a place where uh is feasible for uh national elections or political elections right now because this is the name of the project is minimal anti-collusion infrastructure so it's really an mvp software project and i think any kind of e-voting system has to go through so much testing and so much development work to be even feasible at national level um so i can't make any claims about like whether it's whether whether this could work um nationally because i think there's so much engineering to do to even make that possible when it comes to whether um to the relationship between bribery and the and the so-called election commission so in macy i'm going to explain a bit more later um there is a coordinator the code and we assume that the coordinator is trusted and this is an assumption that's built into the system and it's something we can't really avoid so um i'll explain quite later but when it comes to macy we we assume that the coordinator is trusted but um even so we only trust that they don't collude with vote with revivers we don't assume that they can we don't we know that they cannot censor the votes and we know that they cannot miscount the votes all we assume is that they is that uh they won't bribe they won't uh they won't be bright or colluded with other people um and as for your question about bitcoin uh bitcoin as far as i know has not uh used macy yet uh but there is another project that i'll mention later called clear fund that are building a public goods funding mechanism using macy and i think it's still early days to see companies do early days so hopefully we can get adoption for this project uh from from many sources yeah i hope that answers the questions very much so thank you thank you very much all right should i should i keep going yeah should be good all right awesome um i will send the link to these slides to arith and and i do have a recorded presentation that does a full technical d-dive uh and you can find this on youtube it will search for minimum anti-collision infrastructure um but without the technical explanation um i just do a very very very basic uh overview of how this works um so it's almost it's very similar to in real life uh there are a few steps first the users have to sign up and then they can cast their votes and at the end of the voting period the coordinator processes the votes and tallies or the votes and by talia means counter counter votes and then they can publish the results to say that party a got this number of votes and party b got a dismal vote um the we only trust the coordinator to not collude with others and we also trust that they won't withhold or delay the message processing and vote tallying because the only the only party that knows the contents of other votes is the coordinator so when i encrypt my vote and send it to the coordinator only i and the and they can can decrypt the they can decrypt it and see what i voted for and no one else can see that so we know that they have access to all the votes and they are the only person who can count the votes because only they know all the votes but they cannot process or tally the votes incorrectly and they cannot censor the votes so the reason that they cannot censor the votes is very simple we use an etf smart contract to store the encrypted votes uh not really store encrypted votes but we submit the votes to the as a transaction to the smart contract so you can't censor that and they cannot um process or tell the votes incorrectly because you use something called a zero knowledge proof uh the coordinator must provide a proof that they have tallied the votes correctly and this proof is verified by the smart contract and they cannot proceed if the proof is invalid they must provide the valid proofs all the way until the end of the tally process and because all the proofs are valid then we know that they telling it correctly there's no way for the tally process to happen if there are invalid proofs so the ones they can do is to not tally the votes but that's not really but we assume that they are gonna do that yeah but we definitely know that they can't miss tally um and so why do why do we know that the coordinator can be bright but they cannot cheat so this just this slide is just a summary of what i mentioned um we know that the uh coordinator can decrypt all the votes so they in theory could be bright and so we have to assume that the coordinator is trustworthy um but we know that they cannot cheat because we use a smart contract where votes are sent as transactions which are unsensible and we use even knowledge proofs to ensure that the tally is correct so i think i want to just spend a tiny bit of time to explain what goes on you know zero knowledge proof so the idea is that um the idea is that you can show that you did some kind of formula without showing the contents of the inputs or the uh or some of the inputs so let's say that i have a list of numbers and a hash of the list of numbers and let's assume that everyone agrees that the hash is correct but they don't know d they don't know what the numbers are and i want to show that i know the second number so i could uh so the formula is to is to hash all the numbers and check whether it's equal to the to the hash that people agree on um i want to hide the first number and the last number but i want to show the second number so um for this proof the public data is the second number and the hash and the private number is the first and last numbers um and then the formula is just to hash all three numbers and check that it's the same and the proof basically says that i have executed this formula correctly and the proof does not show uh the private data so i can i can make a i can make a claim about some kind of computation without showing the contents of the data and for macy we want to make a claim that we counted these rules correctly but we don't want to show the votes themselves and zero knowledge proves allow us to do that um and i think because uh yeah because i don't want to go into too much technical detail that's the kind of the basic uh overview of what this is maybe i should pause here if anybody has any questions before i keep going do you have like a like an example of a zero knowledge um truth or like a metaphor for zero knowledge yeah yes so um let's say uh an example is let's say i have uh let's say i have let's say i have like some a balance of oh have you heard of a tornado cache okay so for example i i use tornado cache as a mixer uh i mean i don't but if someone uses tornado cache as a mixer uh if i did i wouldn't say right so they what they do is that they deposit some even to this into this box and then um let's say that all the balls let's say let's say you put some coins in the jar okay so these coins are e for tokens and all the coins have different colors you put in all these multi-colored coins in the jar and each person puts in one coin okay um what the zero knowledge proof does is make all the coins the same color so when you take out the coin you only need to prove that you put in a coin in first place but because it's the same color um you can't tell the difference between all the coins and you can't link your original coin to the coin you took out um another example is um let's say that you have a bank uh this is like a super simple example it's it's very it's not super it's not very accurate but let's say you have some money in the bank and you want to prove that you have less than uh ten thousand dollars but more than uh five thousand dollars a zero knowledge proof would hide exactly how much you have but it will help you to show that you have some amount between these two numbers yeah okay um hi guys so say i wanted to be able to uh build a voting app okay i wanted to be able to so like each person casts a vote we need a proof that each per i need to be able to prove that firstly the person is eligible to vote and secondly that they haven't already voted could you do that um so in macy well we don't use the zero knowledge proofs for those two cases in macy we when the user signs up to vote what happens is that they register the public key with the system and when they when they cast a vote they could use a different ethereum account and no one would know uh who the original uh folder was but that's not why we use the zero knowledge proof uh the reason we use zero knowledge proof is to ensure that the votes are tallied and counted are processed and tell it correctly um would you mind repeating the second question yeah i mean basically what i what i wanted wanted to prove two things firstly that that the person the person is eligible to vote and secondly that they have only cast one vote i see i see okay so in macy we we don't use zero knowledge proofs to prove eligibility because that is done uh in a public fashion in macy we can the developer can implement some kind of smart contract logic to uh to allow or deny some any address from signing out and that has nothing to do with the zero knowledge proofs and we don't have a limit on the number of we don't have a hard limit on the number of votes a user can cast so in fact you can cast multiple votes um so we we don't use zero knowledge proofs too to prove that they had cast only one vote or they had never casted before that so yeah i i apologize for any confusion with the examples uh in the example of a mixer you need to prove that you had made one deposit and that hasn't been withdrawn yet but in see we use zero knowledge proofs for something entirely different is there a reason why uh with macy we're not um using zero knowledge proof to check uh that they voted uh multiple times or that we don't have a maximum cap is that like on purpose or just technical keeping it simple okay so it's on it's both on purpose and technical um the reason that we don't have uh i mean there is a there is a cap on the number of messages and that's the uh but it can be set to quite a high number but practically speaking you could vote 10 times 20 times depending on the way of the system is configured uh then the limit is not very low it depends on the on the uh on the capacity that we set inside macy and that's a setting so it's not unlimited but but it can be quite high um and the reason that we allow people to vote mobile multiple times is that let's say that eve writes alice okay so what alice does to prevent e from bribing her is first she casts a vote for uh that what she does is first she uh casts a vote and this vote is kind of a special vote it works on nobody but it changes her key to a new key and then she uses her o key to vote for the party that eve wanted her to vote for and then she shows if the transaction and eve has no way to tell that that vote is actually invalid and then alice uses her her new key which is valid to cast a valid vote for a different party that she wants so we can so alice can vote many times and each vote can be invalid it can be valid and we use the invalid votes to kind of fool the driver because they have no way to tell whether it's valid or not yeah but at the end of the day all the votes are counted and aggravated by the coordinator so it's different from a political election where you only have one piece of paper you could in this election you could have like five pieces of paper and two of them are sort of like invalid and you you only show the driver these two invalid ones and the other three they don't see it but another day is all counter okay uh should i keep going um ray asked in the chat uh oh yeah only one of the five votes are valid how do you guarantee that only one vote is valid so the logic that checks whether a vote is valid or not is part of the zero knowledge system that we use to tally the votes if uh if the coordinator counts of invalid vote is valid then the zero knowledge proof will not be valid and so we can so it's impossible for them to miscount it i should look at the chat room but i don't know how to see it are there any more questions i should take i can't really access the chat room yeah it's not from the chat i'll i'll share if there's any from the chat oh okay there's a horizontal bar you can kind of like see then there's the one of them has a more and you can click chat but i think you you can just go ahead and we'll let you know if there's any questions okay thank you so uh all right so as previously mentioned um as you use the zero knowledge proofs to ensure that the counting is done correctly and we also and the secondary function is that um there's some level of secrecy um there are also a lot of technical considerations around zero knowledge proofs this is a bit out of scope for this presentation but we use this thing called zika snacks and zika snacks are uh the most commonly the most widespread way to do uh zero knowledge proofs on ethereum they do require something called a trusted setup ceremony and we have not done this from ac yet but we have tools at our disposal that can make this possible and we are and we have run trust trusted setups uh for other circuits before and this can be done for macy when the time comes and so there's also future work to be done with macy first of all there is one major major flaw which is that what happens if when you sign up you take the driver's public key and sign up with that public key basically signing out with a public key that doesn't belong to you but belongs to the driver that is where we need something beyond macy which is some kind of identity proving system that uh allows you to where you have with where some other people can when other people can verify that you truly uh own the public key you're signing up with and that's that's um a whole new project in itself there is a there is some resources about this that retaliate has written about and i think there are some other um uh projects that try to do this but it's really beyond the scope of ac but hopefully in the future these things can can work together um there's also future work in terms of setting up user interfaces and one interesting use case that we are that we are thinking about is something called a quadratic dollar home page or quadratic million dollar home page um so this is when like early on in the earlier days of the internet someone made a website where they sold each pixel for one dollar and there were one million pixels and he sold all one million pixels for to up to random people online and this is how he earned one million dollars uh it's called a million dollar home page um so the idea here with macy is that let's say we have a bunch of images on the home on the website and people can vote using macy on these images and the images will change will increase in size quadratically depending on the number of votes they get um so that's one of the use cases you're thinking about that's beyond quadratic funding and it's a kind of experiment that we are thinking about doing and we are also like very happy to hear for hear about like any other use cases that can come up um this is clear fun pure fun is a team that is building on top of macy and i encourage people to check them out and there's also more resources about macy we started off with this uh with uh uh started off with the if research post and then we work on the specification and finally we work on the source code for the mvp and that's it for this presentation and i'm please ask any questions uh i'm happy and let's have a discussion yeah and thank you so much for having me again i have a question guys like i want to know like how you uh how you are actually managing the signature aggregation oh we don't do signature aggregation we do what i mean aggregation i mean counting of the other votes so let's say i vote for party a in one vote using one vote and then with a party in a different transaction the vote telling will count both of these votes and the end of the day it knows that i voted for these two parties okay uh i do have one question so in order to use macy is it necessary to um sorry uh in order to use messy uh i suppose it's on uh ethereum blockchain so you are relying on the term to do like the transparency of the votes right uh the integr the unsensitive ability yeah yeah so so you can't use mesi outside ethereum uh uh i rewrote mesa using solidity and uh and we rely on the solution contracts to do uh the the logic and also the uh and also the zk snap verification um i'm sure that there are other systems that use that support the evm so technically it could be possible so to use other chains as long as the evm compatible you can use mesi yeah exactly because uh evm uh as long as the the the system supports the istanbul the istanbul headphone which is the current the current the version of the evm yeah that supports ziggy stacks as well okay thanks yeah um we had a question on the multi-party trusted setup uh yes without being going into as if possible without being technical could you explain um why there is a need for a multi-party trusted setup yes um so the way that zk snacks works is that um is that you can do this kind of um cryptography sort of magic using zika snacks and and uh in order for that to be possible you need to do something called a trusted setup ceremony before you deploy the system and in this ceremony what we are doing is we are generating some secret numbers and these secret numbers have to do with the uh with the uh cryptographic keys that are used for the for the zk stacks um so yeah we can generate these keys but during this process um you also generate this thing called toxic waste and toxic waste is a piece of data that if you don't discard this data and someone else gets their hands on this data they can create they can start proofs that are valid but are fraudulent so they could create fake proofs and they could make a treat at the system so we need a way to generate all these zika stock keys while secretly discarding this piece of data and what a multi-party trusted setup is is that it you have a bunch of people and it takes turns to to do this key generation not really key generation but they to do some kind of like computation and uh where they generate this the the the the numbers that needed to to to produce the keys and they take turns one by one they they uh it's like a like a chain and as long as one of them discards the secret number then no one can create any fake proofs so as long as one person does that discuss it then the whole thing is safe um and the reason that we do it as a multi-party uh competition is that we want as many people as possible because the more people the lower the chances of all of them uh keeping the secret number as long as one person discuss it then it's safe that's why we need as many people as possible um and so that's kind of something that cash did to uh to and and i would encourage people to check it out so what they did is that they had they opened up this ceremony to the public and they could sign up to to do to do this and someone there's someone from the states what he did was uh he took a piece of a channel built radioactive material uh from chernobyl which is the old soviet nuclear reactor that exploded and then he used a geiger counter to take the random data from this from the radioactive decay of this piece of piece of material and then he plugged it into his laptop and he and his friend went on a plane and they flew around for a while just to see if no one's following them and they generated the numbers using the laptop in the sky from a piece of radioactive material and then they landed and then submitted this submitted the contribution to the ceremony and z cash has more than 70 of these contributions but not all of them are as fancy as that one but but the point is that the more people do this the more likely that the whole thing is safe and you could you could do it in very special ways they're quite interesting so uh if i put it another way if i was like some sort of paranoid maximalist that's saying that you know this thing can't be trusted uh as long as one person out of the whole like n um does it right then it's it's safe it does it right meaning that they don't keep they don't get into the secret so any kind of so anybody who doubts the system should participate because as long as you you know you didn't keep it you can trust yourself right yeah so definitely we want to encourage participation uh we have we have two ceremonies going on for other projects uh and anybody who wants to try this out can please get in touch with me and i will and and i'll get you uh included uh maybe you can explain on these two other um ceremonies that's running um what it is and how to participate the first one is for semaphore which is a which is a privacy gadget that we developed for applied zkp at the ef and semaphore is something that you can use to implement different kinds of privacy focused applications on ethereum such as mixers or anonymous voting or anonymous login and the idea is that you can use semaphore to prove that you're part of a group of people without showing your original identity so for example for example if you are part of a dow and you want to vote and this is not basic okay so this is a one percent one vote system and collusion is possible so it's not it's it's just a very simple kind of voting uh you could uh have a system you could use semaphore to uh to vote for some kind of proposal in a dow without and let's say 10 people vote on these proposals on a proposal but you won't know who voted for for whom or you won't know who voted for what you only know that at the end of the day there are 10 people and that's here's a result um sample allows you to do that and we are doing a trusted setup ceremony for semaphore that process can takes less than 20 minutes for on the laptop and we have uh and the instructions online that i can i can point you to to do that um the second ceremony that we're doing is called the perpetual powers of tao ceremony so what is this um the idea here is that for zika snacks uh for any kind of when you want to do a trusted setup ceremony uh you have to do two actually it's two phases phase one and phase two uh for summer fall is phase two and perpetual powers of tower is phase one but any project that does dk stacks on ethereum can benefit from the phase one perpetual power software ceremony so this ceremony you can take this output and use it for your projects phase two and any anybody can can can use this output for their own project to do a phase two so we are saving everybody the time and effort to do a phase one and the more people do that the more secret is for everybody i can also send some blog posts to explain the whole thing and one more thing is that the phase one takes like more than a takes about a day to complete and it's very intensive uh on your on your computer you can take uh 18 to 24 hours to run and requires uh a total of gigabytes of bandwidth so there's a you may download 47 gigs and upload 1997 gigs so it's quite intense and about so far we have like 40 plus people who have done it since last year um and um for for example with mesi and semaphore and perpetual powers of tao could you like use all three of them together or like a combination um so the semaphore trusses setup the phase two uses part of the perpetual powers of tower so phase one perpetual power supply phase two summer fall and for macy we take perpetrator powers of towel and then we do a macy phase two i mean i mean like if you want to run some sort of voting um election or some sort of voting process would you be able to combine like the fact that macy allows the bribie um the briber not to know uh the what the bribie is voting on and how semifault allows like no one else knows who votes for what would that be able to be combined um i think so it may see only the coordinator knows who voted for what um if you want to combine it such that even the coordinator doesn't know who voted for what uh you have to think about it yeah something that to think about i haven't really but that's a very interesting interesting idea uh that to add anonymization to macy uh i it's i think it's possible but i have to have to do more research yeah i think that's also i think kobe girl khan who is part of the team has written something about it but uh i haven't uh really gone into that myself okay um so like going back to macy just now what kind of help um or input which you need from the community as a whole so that you can make it get more advanced so commonly we are looking for uh developers who can who can spend like a few weeks uh full-time or part-time uh to do some tasks uh to enhance to implement some features into macy and uh so that's one way that you can can contribute yeah uh because uh there are some features that sort of like would make would may see version 1.5 or even version 2 that we could we encourage people to uh contribute to but we that we are still looking for for folks to uh to take on these bounties so these are these are compensated uh mini projects that we hope to find people to do what kind of um skills are you looking for sorry uh solidity smart contract development uh understanding uh yeah to be able to write solidarity code and and to have a basic understanding of uh of uh how macy works yeah which is something they can learn learn about doing yeah and so uh so earlier you mentioned like um for uh um an election as a whole uh macy's only plays one part there's other other parts that need to be developed like identity key management like yeah i guess getting some sort of privacy from the coordinator are there other other parts as well that need to be developed simultaneously user interfaces is one and that's currently being worked on when you say ui sorry when you say ui like um is it any different than any kind of like um let's say there was an online voting website right now like would there be any difference between that and this it would have to be three so after we went three and right now right now we have to be rep three because we have to do transactions to 18 to the smart contract to cast a vote or to sign up [Music] that's yeah but yeah some work has to be done in that area um i think something that is also quite uh important to touch on is the key management because uh for zk snack applications like macy some of our even group ring and tornado cache these applications all use a different kind of key than your atm key your html key is called the ec dsa key but for zk snaps a lot of these applications use e-d-d-s-a keys and uh and currently there's very limited support for for metamask or other wallets to support that um so uh developers for of the ui have to have to kind of get around that and use and use other methods to store keys and to do key management which is quite difficult yeah i think that's something that not just from macy but also for other projects that do zk stacks for privacy or scalability we'll have to have to figure out from the user point of view is that a reason or a a huge difference between the different types of wallets uh from the user point of view um your your etlm key is your is is something you use to create your atm address but and then you can send tokens and ether to the address but your zk snap related key the edds8 key it's not necessarily something you use to send and receive funds um for example in macy's only used for voting but in other applications like uh zk grow up uh you might use that key to receive funds on the layer two uh in the layer two roll out so it really depends and i think there's a lot of user education to be done to clarify this okay and um last question for me i i don't know if others have other questions um on my end um so other than what you mentioned earlier about getting help to develop the software i guess um what steps can we as a community take to help it get applied by like real world or you know outside of crypto i think crypto has to uh has to i think has to oh wow um i think i think macy's is i think we have to first unders like find the solution to get crypto adoption in general before we can even talk about doing messy stuff because it's it's too early yeah um but it's not impossible like i think for crypto adoption uh i've heard of like crypto based games getting very popular even for people who don't really aren't already involved in crypto yeah i so it's not like impossible i think that's some there's a it's a good chance that slowly it will happen i guess if i if i if i flip the question slightly um how can we get it to be applied more by crypto entities like dao's and and other people wow [Music] um hm i think uh i think there has to be um a good track record of macy solving bribery problems currently a lot of bribery there's some uh collusion that happens with the bitcoin grants and this has been flagged up by bitcoin themselves and they are very aware of it and they talk about it i think um if we can if if the teams who are working on quadratic funding with macy can can can succeed and demonstrate that they have this mechanism that's working i think that's when we get interest to further develop on on different use cases um so i think that is the answer is a combination of two things which is a need and the track record there has to be a need to prevent collusion uh and there has to be a track record of me see working okay cool um yes if anyone else has any questions um otherwise widget like if you um for any discussions like what were kind of points that you would like to say get any input on yeah i would like to hear about um besides quadratic funding i'm quite interested in in applications for dows if anybody is part of a dow and they are aware about collusion or if anybody is like in the crypto community is like aware of like other instances of collusion um i would uh love to hear about those uh those experiences and those stories and i would also love to hear any kind of like out of the box like applications for voting that could that could be used for macy um um yeah so i think i think that's that's something i would love to hear but i was so open to any other questions um i i guess when you say collusion um sorry i'll just mention this quick um and this is not ethereum obviously but you hear about how this sort of depots um delegated proof of stake chains um have these kind of uh i don't name names but like um eos is uh largely mentioned is how the consensus pretty much um has become like a one country um dominated um another accounts collusion but that would probably be one good if we can get stories from them wow that will be quite interesting to think about an amazing context yeah so if anyone is from eos or is active from in that space they can share anyone watching this video later um rahman has his hand out for a while so uh go ahead roman yeah sure uh yeah thanks for the presentation uh one of the i still i still have a kind of a bit confusion around your um voting you said that the voter can cast several votes and some of them can be uh valid and some can be invalid right yeah so like how in the end do you ensure that only one vote like the last vote is being accounted for if you want to introduce that constraint uh oh we we currently count all the valid votes so not just the last vote and let's say my first vote uh spends my first vote is five points for party a and second vote is two points for party b and and my third vote is invalid but costs like three points for party c at the end of the day only the first two votes will count why wait so you casted four votes didn't you just now that's that's like cost three votes right okay three votes okay two two valid one invalid right okay so two will will be considered valid right yes but okay so is there a way to just like say you're voting uh uh like the same way you vote in elections right you don't vote by points you just like pick one option right out of different uh candidates right so like yeah how do you in like how do you recreate that scenario like how do you ensure that um there is you know in the end on the one vote that has been counted for one of these um candidates so only one vote so you can only choose one candidate is that the idea yeah yeah yeah so uh we have to modify the uh modify the may see logic to make it happen but it's but you only need to do that and um so this is a kind of a kind of folding that is also possible to do with macy as long as you modify macy macy's like from this from like the version that we have that we currently have is the quadratic volume version we the single vote version we haven't done that but it's possible to do as well uh it's moderately difficult because you have to modify uh some of the off-chain uh off-chain vote counting logic and also modify the zero knowledge uh zk snacks circuit uh which uh it which takes some time and takes some understanding that is possible with some daddy with some effort yeah cool okay and i'll be happy to like uh give anybody uh any pointers on how to how to get started with doing that which is like zero knowledge uh circuit coding in general all right um we have some questions in the chat we asked for who is to decide how many votes i cast and how many would then need to be valid and if i purposely invalidate my proofs will i be penalized um you can cast as many votes as you want however there is a the limit comes in the as as a setting in the system and uh basically there's a merkle tree of votes a multitude of encrypted votes and the capacity of the tree is what commonly limits the uh commonly limits may see [Music] and so uh for for if you so as for invalid proofs uh invalid truths can so that only the coordinator is in charge of creating proofs and they don't get penalized for publishing invalid proofs um and this there's like no reason for them to be penalized because if they because if because they then they can themselves check whether this the proof is valid before they submit their transaction so no one would ever submit something that would penalize themselves um the idea is that this the accounting process can only proceed as long as the proof is valid so let's say um let's say there are 1000 votes and we count the votes in batches of 100 each so they have to provide 10 vote uh sorry write 10 proofs and each proof must be valid in a chain and the train was in the correct order and then and then you count it 100 by 100 at the end of the day you have the result of all 1000 votes and you can you get stuck if you don't provide the next proof so as long as the code and evil we assume that they provide all the proofs in order and the smart contract ensures that they'll be valid and the smart contract ensures that they put that it is in order and they can't do anything else except not do it at all they can only do it one shot or correct or they can just dig or they could like just do nothing but we assume that they won't do nothing um ray asks um are votes anonymous or are they tied to a voter id slash key yeah vote each folder is tied to a to a voter's uh key so they're commonly not anonymous but they're only only the coordinator so only the coordinator knows the the key the public key but other voters don't know because it's encrypted okay so since you mentioned out of the box ideas and we're three minutes before 9 30. i think it would be a good time to kind of just end it um well soon um there were some ideas mentioned by the um meetup attendees before the meetup so maybe just over the top of your head just give your take on whether it applies or not so um one of them asked uh if we can somehow use bc in some in a in uh voting to decide the next defcon location wow wow would that be practical yeah i think it's i think it's practical because because it's uh um because the people who vote are scattered around the world and it's hard for them it's hard to do like in person uh collusion and it's a very simple kind of yes not yes no but it's a very simple kind of vote it's just here's a list of locations um i think that the challenge would be how do you how do you who's eligible to vote uh how do you how to define that and i guess you can do like quadratic funding quadratic voting to make sure that the rich whales don't have like huge power to shift it in one direction uh yeah that's one way we don't want we could use that to uh to you we could use quadratic funding to uh to not make which will scale the vote but we all could also could use other mechanisms like for example you go to defcon or other etv uh hackathons there's this thing called the poke token it's an nft that you physically receive from the poap team and you scan it and you redeem your nft and then you could if you own an nft you could you could be eligible to vote for example which by the way in case people haven't been checking the chat um we are giving uh pop um badges uh nfl for anyone attending as long as they want to because i think you right now you have to pay the guest fees yourself so i can send you the unique code and you can claim it um later oh nice um just saying that before i forget um rahman asks um shouldn't all defcon ticket holders be eligible to vote i think that's that's related to what uh ouija was saying like if you've been to one event before or even not just defcon by other events and you have let's say a pure ap nfp then you can use that um as some sort of um qualifier to be allowed to vote yeah at defcon they gave out the pope tokens too so you could use that i guess i guess people can still like farm the tokens and then create multiple addresses to work from uh but yeah just these people will get right you have to trust a trusted pope team to only give one pers one token per person yeah all right guys that's enough shielding of our guest stuff yeah uh and then so one idea uh is also and i don't know if this is relevant um whether it makes sense but let's say for prediction markets uh because in some ways it's sort of a vote on what will happen um would there be any reason to use macy there or not uh it sounds like a very interesting idea uh because if let's say the prediction is about some person and that person could try to influence the the market using bribery yeah maybe maybe this is a good use case sounds interesting okay i never i never thought of it myself but that's fascinating okay and then um okay sorry 9931 but i think just just um last one at least for me is like um what do you what is your most out of the box idea that either you came up with or you've heard of so far uh wow mine i i think the quadratic dollar home page uh i assume the most out of the box idea i've heard uh it's up to you today i think today the the most interesting idea that was actually the definition market idea i yeah i i should spend more i would love to think more about that okay yeah all right spread it to etl for anyone watching yeah um thank you so much yeah yeah no worries um i guess thanks to the community uh does anyone have any final questions or or comments matthew says thank you yeah a bunch of people are saying thank you um if not i guess uh yeah thanks uh wager for uh coming um dialing in for our meetup here and as krenten said earlier um you feel free to come again i'm sure there's many other topics you can share on and hopefully we can share input on as well um yeah so um thanks vijay and um anyone who wants um the pope token uh if i have your telegram already um just ping me on telegram otherwise chat drop a message in the chat and then i will get your telegram and send it to you um yeah only if you want to um otherwise yeah any final words razer yeah thank you so much for having me uh it's a it's a really great pleasure to to be able to present and hopefully when all this when the pandemic blows over we can see each other again in person yeah cool for sure uh come up the border and not have to wait 14 days yeah yeah yes yeah okay uh so yeah everybody feel free to say thank you to aj in the chat and i hope raja you can figure out the chat because otherwise uh she can't see what you guys are i'm saying anyway i can't say that okay thank you sir um yeah and before we go off uh since jason's here um uh like like i mentioned at the start of the meetup um the south east asia d5 week number two uh is happening from the 10th to 18th um so if you guys are interested feel free to sign up on eventbrite which i will share in the telegram group and if you're not intelligent group let me know i can add you in there um and there's a bunch of talks by d5 projects um and i think it's uh once a day so yeah feel free to check it out otherwise we will see each other um next month on the first thursday uh the let me know what topics you guys might be interested in discussing right now i i'm looking at uh either discussing yield farming since that's hot um or um blockchain slash iot so of course johnson says actually okay also iot uh all right uh yeah otherwise thanks guys for coming it's 9 34.

um i think it's a good time to end and thanks again regen um see you guys bye guys see you thank you