Privacy by design in a world with universal SNARKs by Zachary Williamson

[Applause] yeah so thanks for going to be another the 10th of a long day so I'm upset I'm the CTO of the a secret but we are a very soon solution for theorems will be for the tooling resources that may cause people to go private a small types of private records and I want to talk about today is a new piece of technology that we developed in collaboration in clinical labs a new universal way as much as its width around your oh thanks man yeah okay so kind of high level I got to kind of skim in a bit of an interview about you know why it's not to you so why they're important we're trying to deal with them and then go into a little bit about into a rather low level dense about plop this universe as long inspected and try and I guess dispel some of the some of the mysticism behind stocks and actually provides insight into issues by how they work so what's the fuss about stocks imagine everyone is kind of relatively familiar with the with the high level stuff that's you can use starts to effectively make computation free of a theory why just having a proof of computations that are actually requiring every notes to perform computation themselves in addition to that we had mercy because with a snug you can hide the improvements to your proof the apotheosis of this if you find the it was an alpha steel preview but also if you've liked the identities of the people sending transactions and if you hide the actual smart contact code there's been executed unless it can all be achieved with varying degrees of practicality so how does pontifical it's been a rather a snarky summer what you say between a lot of them a lot of a lot of new technologies that have been put out and yeah focus upon a small part of this landscape of tech and so I kind of want to talk about yeah so the intrusions behind it but it does why do you think is useful so it's the universal stock that was kind of designed from the ground up glass to be viable lot of theory but by that I mean showing that the verification run time was fast enough to be gasps a vintage and ethereal and proves to be a destructive relatively complicated circuits on average can seem a bit hot their signals as well presently consumer grade laptops basically and yes inspired by its predecessor sonic like the first universe or something what that was a tactical as it didn't require like a quadratic a size reference tree and some and you know if J different fingers works by control and plan so we published talk about one well half a month and a half ago and we'd be very busy building implementation of a proven verify algorithm this is also very very impressive stuff it's in an advanced my State Department so this is over the BNT FIFO curve so the feather if there has people possible and the relevant graph is the top left this is the certain times for like a selection for cervix but very number of gates and I guess the the take away this is that there were many gates a pre-construction on like a my service probe is under 23 cents and when you get tons of things a particular seventeen gates the group instructions on three things and so this is the entire movie nearly means the synostosis was practical for databases on a theory we estimate that typical like a private transaction stock will run even about a hundred twenty eight thousand two eleven to twelve thousand twelve gates and yeah this is the theme of the library we've been building has been a source of iterations very welcome feel free to tinker around it so that's the final stuff so why don't we kind of get to the guts of house as well and what's going on with them second and so we use polynomial commitments meters long so being hands upon with Sonic and monitor contemporaneous previous system and then we sum all these polygons conveyances because it's a very efficient way of achieving is a sickness it was not an assistant effectively we know how to use the simply commit to pollen Ethel so you can take of polynomial with a very health degree which is because an enormous amount of information and represented within a single elliptic curve point and you can then have if you can represent your snarks template bias polynomial identity involving other neighborhood commitments then a verification algorithm Contessa's polynomial identity by testing it at a random evaluation point and have confidence over they were whelming probability if you're if you're kind of snot description holds it randomly points of a lot of everyone this also interesting divorces plot from the underlying there's characteristics that are used in sensitive the planning commitment skin you can run not a solid two curves just I published at BU closer essentially did over the in commitment skin that uses a tractor coral proves even possibilities as reliability groups Christine so actually okay so you think will not make the list of a wish list of what you need to make Universal to make it's not obviously me wants a way of constructing turning a program integrity for knowledge and services totally done with addition to multiplication games that are stitched together to the former self because this is a relatively natural way of representing problem statements when your underlying when you actually do that when you're testing these proofs of knowledge in using persistence that you have used a filter of particular we want them you know pheromone running effectively constant time animals Universal so we want there to be any want us to set up to be to each other system and then you can include arbitary programs as snot circuits without additional 50 subs in at a that wealth human creator to set ups but then you miss philosophers shoe sizes which is a little bit of a problem for it there so you notice last he doesn't is not familiar with the concept of a gate in the context of stars okay so basically the games has ended and the wires and so ok so basically you have is basically that the the the primitive hazardous collaborations that he wants a parameter in the same way that you can take any computer paramount and decompose it into a sequence of mandates accessible successional CPU ship you can take you can also take in computer into a sequence of additions and multiplications and so that's what we're doing when we create start snack seconds we're actually taking these things equals premise of gates and thus additionally together to make the representation for more complicated public permanent consent and we have issuance of educates and they will have given us another bite and you can make a circuit by stitching in this case together we're like the ordering of can see personal where's Weiss will be completely Donnelly in a rather he also probably created by the compiler with human and you know pretty you have satisfied Sanders has evolved Co to prove that all the Y values are what they they ought to be acting on interface so you know when you're stitching together all of these gates you have to kind of you you you whenever you make you connection which of your gates are your federal city two wires together together as you can have that possible but minor physical otherwise and then you've got to kind of validate that's if you sell odds that you've actually that you've run the program opportunity in favor to the circuit and all of the whites have the current values and they should have at you acting constant so fundamentally if you want to represent a program as the quantities to the College you only have to do two things you have to perform an a little asthmatic so you need to check that the announced metric relationship that every single Gators been satisfied that the two o'clock whites either soft and multiplied together is you must be on the wire and there is a point global consistency you need to validate that the wires are correctly citing all of the gates so that if one Apple artisans are like several other wise of other games that that's actually done correctly from the first check is reasonably easy to do this the Secretary has been the bane of unisys not sisters for quite some time that was something which we think there now we've made some brother huge of some huge family so I'll start the little check because that's the relative easy part one second and I like to think about snap circuits and using vectors assembled angles is polynomial so what abstracting public that little bit unintuitive factors almost as soon as well and then we can map the effectiveness later on so in song we have one we want we want one a let expression what about gates whether they can also pick a traditional Gators is suffice the verification and so you can do this with a positive selector factors so if W a help them depart on the vector say look at the first man acquires the gates into a circuit then by taking dot products with these vectors and selector vectors that kind of defines when you've compiled the circuit because so they they they face it by the circuit very or not be that not be improved constructor then you can either turn over other multiplication people in addition games for one of these indices so this you kind of clarify if you want so it's one of these rooms to be a multiplication native make sure that the QL value at that you are 1936 Ponderosa Center serum that I have complications and civility perdition's you would simply the multiplication will get sir to deserve you can also use these selector vectors to scale up or down values of the wire speaking to this case necessary and you also have invented a constant coefficients of doing it so this is a kind of example to help that vitalik the dominant in his blog never would be healthy to go through the kindest elucidate a little bit what it looks like to actually represent programís episode so this is a small example where you have a circuit where you have some input value x1 check that the amplifier is executors sexual spoken and so you have their first multiplication gate to the left of my wires are going to be feeding X into the gates of the album should be AB squared and then in the second gate people that wasn't planning place square by X well I'll get X cubed because then having that together with X and then finally having yeah that 5 just one small caveat actually you don't need that much multiplication table because you can feed five hits and constant to this game until miss ball and then the object should be certified and then you verify is to check that that's the that you have actually supplied the correct y-values thanks ed let's watch the tape if X is so a little bit more of each so might be talking about vectors but we actually want to be asking like verify personales using polynomial per fitting so how I treat Matt protectors of polynomials well the the solutions to use something go to the brand base where is any pick so it's a special set of points on the x-axis so you have a vector of Telamon tentative something ten points on your x axis so we use the reserve unity for a further from the range of reasons but they don't need to be this toy example another gospel a negative was being polynomial web and one of the special points will evaluate to 1 and all the rest it will evaluate to 0 it's effectively a delta function and you can use these two even code so to tender-back materials because you take you map each vector index to the special points that you're using to be funny reversible inhibits and then you particularly in a song so you're multiply each vector element by success key to the launch mother-in-law and they are something together and you will have a polynomial where at those special x-coordinates a certain advanced Y values will be the values of your vector words this is a relatively convenient way of representing vectors as polynomials because it preserves effects represent and that's three important thing so mr. Scheffer don't look here so this disciplinary series community and if you're on the mathematics this'll be equal to you that the my fruits in unity in Li X will be barman at the G through some than any other words we use is equal to zero so we can now take four more vectors and turn them into polynomials so we're taking those linear some submissions earlier we take elements on the meticulous on you this will these the selector polynomials and that uniquely defines a circuit whose mark and then you do that for the Y values which define sir one of the good must satisfy exam to yourself if any of this is that you can take the vector arithmetic that used to describe your gauge equations and directly matter to polynomial realtor is if you have effective identity which is equal to 0 everywhere then the resulting polynomial identity will be equal to 0 modulus this simple fashion polynomial to give some intuition about why this is if we consider like one of the special points that people that we used to encode these polynomials so say a peon first like the second is vectors if we you'd like you the resulting for neighbors that you're crazy let me set the second unity your polynomials will have the will be a value evaluates to the invitation for vectors which means that if you take a vector identity was equal to zero then there was a common a validity or physical polynomial where and that immunity would also be zero which means a if the specter identity holds then the resulting polynomial will be zero at all of the recipients special axis once they introduce you in advance and so the banishing polynomial is the lowest to be polynomial that is also equal to zero at all the rest of unity so you know that if you have a satisfying assignment you're a second then this polynomial is he will always be divisible by that vanishing to the number and you can test for that so check that you've correctly [Music] by the way feel free to ask such a question settle anything imagine you have any questions it's suspected not than he was so if you have you met review the bill now now we've talked about great you can you can check their every case in your circuit isn't currently evaluated but have you technically battery miserable - together well that's a little bit tricky because all you need to do effectively is if you have a look at an apple wire from one day that leads to multiple amplifiers in the polychaetes each fx50 check that that wire values being copied correctly that's something like that's a little bit odd nonlinear and the way that we achieve is applause with the permutation check and so limitations somewhat the Heights event brother they're rather terrifying this to moments but I will find this trying to dense down the intuition behind why do you some permutations effectively what we're doing is if you take all of the wire that wire values in your circuit you can map them to us into a car market you deform in space you take the the value of the wire and remember to look at unique a unique value on right senses and there isn't been the results that actually have set up once one for each of the items you can then perform the same mapping but instead you map your you map your Y values to different form but in such a way that for example if you have three values that need to be the same because they're they're copies of each other then you want to effectively map those three wires into the single net space visited form order and what I mean by this is for example imagine you have three wires in your circuit and they need to be the same values then you can and kind of create two vectors where you're you're basically your first vector is you map your wires into this corner space and then your second vector is your mapping the same wires into so if you're mapping that we want B to be three like three wires into it so I can turn this so let's say that we assign if you have three wires like the first few artistic imagine they need to be the same and then you can assign indices gb is what I see and say okay fine I'm gonna map the first words at one the second one to the third one two three yeah then you also know you to do meditation so you say okay now get them at my first wire to coordinate three my second wire to coordinate to my first by the coordinate one you now have two paths you have two collections of coordinates where those do sets they need to they if the the Y's continuing opposite each other in those coordinates will be the same but in different order and that's what that's why we why we call it to permutation the reason we do this problem Conda to think to go to me to check the copy registers because we know how to do with annotations succinctly and efficiently that was one of the innovations of plum effectively a policy that choose the two vectors identical top reputation what you do is you inject some randomness and you look into your into your measurements so take around a meter for example and you then multiply pizza by the index of your that rectum so you take a 1 you have me to Telegraph it to me to 80 you have 3 meters a 3 we then take your fields and you multiply give what you add 3 means to B 1 B 2 B 2 a 2 is 2 B 3 and so well this is trying to capture is that those this pieces they are that they appear exactly once in both of these 3 and 3 sets but in different orders from so for example the only way a 1 plus Peter and consumers mean look thank you they wanted speech B 2 plus B so musically the same and then that may be the case if a 1 equals B 2 and you can make it around this permutation checker you know effectively if these three says form s equals it by equals of the other birds to eat coordinates then in case one of the enemy or that's the same thang so until the Oscars is not there today the normal 70 the set of a bonus once you have those around the meter times will be the same as the B points and then so here the final step is defend the people that will prove to you is that you if you with just adding one random element into your kind of collectibles that was able to prove that you have two sets of coordinates that have asset management in a corner but you've not yet proven that that those those corner tables are in the correct or they need to genuinely so he had a second recording um mm this effectively we take each one of them is coordinates two more second craters family man and commissars and then we take the product of them and so the point of this is effectively we've met we've met our Y values in between corner spaces where the these sets of owners need to be the same but they will be in a Verity the different jumbled up order and so the way to check that is what we just take the product on them and if the products the same then we have a mapping which means that your wires have incredibly copied which means that you've correctly a songster stuff otherwise no second yes yes it should be sorry it was like that so because it's okay into an asset today so I just won so what we ask you since most of all what's the purpose I mean assistance we think is pretty cool technology but without the use case is just a toy and we aren't the we haven't or that aspect though the SS missile is to do other payments to do private odysseas elytis loans effectively worth all of the traditional financial services that you do today in which where you expect it by default where you might want to use the consensus of a public gloating because you might not foster care about this but you don't want to give it and for in your salaries being publicly you don't even that isn't publicly don't miss assume you plan to focus if they're public in my training decisions in public because that massive competitive disadvantage you're looking to sell and exit from the last position so aspect as we has Oconee stance but we have a kind of a collection of proves that were in a supportive manner this isn't plot this is a slightly older technology were using the smokers breathing quite recent they're going to be a recipe to go to interesting so now we kind of have a suite of three receivers Emmys generals troops that allows you to basics financial transactions where the values in our group so sense folks incumbents and that and so it doesn't fall for a finished where everyone get onto is that this issue this is astok trusted senator yeah I mentioned that the stuff on needs adjuster seller in teams one and that one trust ourself is going to be happening pre immediately after death so we are going to sign ups to be a bit has meant to the sermon everyone's as many people as possible we're going to be my ignition for with month and anybody can take parts of these then feel free to stop the idea is this program is drinkability even 31 participants in our ceremony tax policy and destroys the toxic waste that they generate and a similar into Z cash the entire scheme the the the results material system will be secured the traditional pair of assumptions so he thought this would be a common good that will be able to be used by a lot of different projects on ethereum Elsa that was essentially his succinct proving systems further reduces and so - what we look like we have a front end that even she needs you to see fuse before we discern in a given time and see if I thought your theory doesn't you if you sign on the New Sun so yeah I believe that is true thank you very much [Applause] you