Zero Knowledge Scholars Assembly 2024 (Day 1)

Okay. So I think uh actually these QR codes will give you some hint for about the actually the QR codes what you have right now. Let's see. Is it the same? No, they're different.

Yeah, it's different. Thank you. This is a hint about you guys are having that maybe yeah it's just like so let's go uh provide the introduction um okay I I believe that the uh reason is so important for all of us about actually what we are doing uh here for this day. So I would love to introduce actually my uh reason that I studied uh the crypto related works from 2017. Um because 2017 was a really a big um uh had a really big impact in my life that uh I had two things at the time.

The first one is about the officers and the second is about the yeah let's say about the officers first. So by the way uh I was a kind of a serial entrepreneur and I actually started found this startup in 2012 with my friends and there's kind of a uh basic uh classification algorithm using support vector machine with the machine learning which is say uh and actually that was acquired by another AI startup in 2014 because there was a big quantum job in deep in machine learning via deep learning in 2013 and I uh in that company because I was kind of a acquired uh person. So um it was pretty weird that it was big company like we had like 50 people there and for to me it seemed like nobody works there. There was no hunger at all. So I was curious, oh why people are just spending their young days years.

They are all talented people but they're just not working. I mean they're not just say putting themselves into some tough situation etc. So uh I was actually uh I struggled a lot there because um I I really couldn't understand and I realized that the incentive model is totally different uh my case and them because if we actually found a startup uh we can imagine like hey if you are the kind of a founder and I am the 10th member of your company then what about the how was the gap between your incentive and me a very big gap yeah how how much times how many times uh maybe 100 times yes exactly because founder will have a kind of a 50% of the shares and the 10th member will have kind of a 0.5 less than 1%. So it's exactly 100 times but founders actually should motivate people and should keep three talks and uh we should motivate like oh we can make a bright future together but actually I'm making a 100 times incentive to you compared to you.

So uh people started to realize there's actually big uh incent incentive gap between the shareholders and the employees uh employ and and I thought that was a main some reason uh the I couldn't understand why people are working there. Um and during that time I just discovered a wonderful community the officers community and about the latest because I was actually trying I actually I develop a some operating system for which is learn uh run by something like trap at the time. a based based on language model made an open source based a operating system and it was the main reason why I got into the open source community at the time and it was so amazing because people just uh the culture is so different I mean let's think about we have two projects project A and project B and if you do a company does it make sense that when they compet with each other. Uh doesn't make sense that project A I mean company A helps company B. It's a stupid thing.

It doesn't doesn't make sense at all. But in open source culture actually if there are two different libraries and people and actually they help each other. So I just saw that oh actually this is something a rather positive something start and also um if you think about the top 20 companies in the world then 20 years ago it was all about the energy companies but right now all of the software companies and it implies that software source code is a one of the powerful means of production and open source is something kind of communities in there. I mean people are so like donating and uh making the means of production is a public goods. Actually it's different with the with this uh community model but it is really fascinating to me because um I mean I'm not saying that uh the capitalism based model is is bad.

I mean these two models are different with each other and I just uh it was just so fascinating for me because it was too different because I was kind of burnt out uh during this uh game just competing and just putting my 100 200% into the game etc. So yeah, that was my uh big moment for me in 2017. And another big moment was about this guy. Yeah, because interestingly I just saw the documentary in 2017. I actually were aware of the what happened, but I just saw the documentary.

Uh yeah, I'm not sure it was via Netflix, but I just saw the documentary in 2017 and actually uh it was kind of a mindblowing moment for me. So maybe many of us are aware of who is Edward Snowden, right? But yeah, just quickly sharing um he revealed a secret project uh from the intelligent uh a as an intelligent agent in US that uh the US was actually I think they will still they might still doing that. So actually before before address this uh end to end encryption movement actually it was pretty common to access to htt http without the secure communication. So we we we just access to some uh website with http without https actually it's not an encrypted thing.

means that actually we can uh extract some values when you communicate with some servers and uh via the undersea cables the US um intelligence NSA and CIA actually they are uh monitoring them and label every information of each individual. there was a uh that project and what Edward Snowden did was actually um just collecting some evidence of actually what the US is actually doing under the sea I mean and then he revealed uh actually we are living in the real dystopia and because of that actually he's starting the end to end movement And uh it was also huge um moment for me at the time. And these two combination I mean the open source community and the cyber punk community uh where these two things are combined was a it community at the time for me. So I started to work uh as an independent researcher just to solve uh this kind of problems from there. Um and this maybe have you heard of this story?

No, this is do you know do you have any hint what it is? It is about the post quantum computation. So if you have enough quantum computing power then everything that we are communicating is based on the electric cryptography and then actually they might be able to be get decrypted then the in the future actually I can say that we are actually living in dystopia for right now but we may live uh in a attempt to stop here until we have a solution for the postquantum cryptography because um with the advance of the AGI and AI then it'll be able to process all the communication real time uh by decryting them using quantum computation and enable them and store them it's possible it's say I think it's not the far from here like maybe in 10 years it will be able to get label everyone with post computation in AI definitely so it's a real threat uh so privacy is a a one of the really important human right it's also uh declared uh human rights by the uh UN And if you think about the percentages of we are spending uh in the digital world then it's definitely we are on the trend that uh we are migrating our work to the digital world comparing to our parents generation and grandparents generation. Uh actually it's the trend is so obvious that we are spending more and more time in the digital world then uh so we can say that we are migrating our lives to a new territory then and we are kind of a all the pioneer of this uh exploration and what do you see in this new territory? What does it look like?

For actually for me it's kind of a uh really it's so wild. There are so many criminal activities. There are so many cyber bulls and in the dark web actually we can see a lot of some um prevalent uh criminals like Yeah. Then how can we prevent this? What do you mean?

How can we prevent Yeah, actually um don't say the answer but yeah the uh easiest way is actually definitely doing adding some regulations like for example cyber bullying. Uh we can add some regulations but actually the word actually works like that. So here's another example that this is a uh some event last year happened in South Korea. Uh some people actually drew some painted on a palace wall and actually they got caught in a day because in soul there are all the CCTVs around there and it's really easy to find people and Korean people actually do not think about do not think this is as a problem. We are so used to this situation and we have a trust that this system will work correctly in in the right way.

So it's something kind of a trusting the authority. But what what happens if the if the police and the the authorities are compromised then it's it's actually really easy to get shifted to a some trustworthy looking authority to a big brother. Um so as one con said we actually have a solution to resolve this kind of problem. So what I mean is it's about the programmable um cryptography. I can say something a an example like when we uh if you have some jacking clocking jacket that actually uh you can do many things there then but actually uh this is actually adding you the privacy but while you are just getting clogged then you can prove yourself that you are doing any harmonious activities while you're wearing this jacket.

with programmable cryptography. This is something what we can do. I I I want to give you a more detailed example like uh when we have a when we send some messages via Instagram then let's say it's a full of cursor then how can we prevent that maybe letting Instagram censor that and block it is the dystopian approach it is a dystopian approach the utopian approach is that we encrypt the message and then maybe you can give some proof to the Instagram that it doesn't have any harm for content inside of it. But what if the uh because it means that you know the algorithm because you are proving yourself. So it's kind of a zero knowledge but actually you know the algorithm.

So it might be easy to actually tweak the content a little bit until it says true. It's kind of a basic actually uh attack scenario of the zero knowledge and to resolve this problem. Maybe we can also use a a little bit different approach. So you encrypt your message and send it to Instagram and then Instagram will actually uh put this into a machine learning model which can be worked also in a homorphically encryped for then it should able to output the result uh without actually decryting the message. This is a actually how we can use fully homorphic encryption to the real world use case that frame can block some sensitive or harmful content without actually uh checking the exact content of the message.

So this is the uh way where we can use the cryptography. But this is something kind of a man project. Um yeah, it's a really sadly uh all the founders are now in jail. actually they are also a uh our friends and they are also the pioneers of this new territory. And what I want to say is that uh when we deal with the privacy technology and cryptography, cryptography is a weapon weapon to protect ourselves in the digital world.

This is kind of the only a new weapon that we can use and then it also it's a tool. It it's definitely double-ended. So when you think about the um anonymity, it can be used in a uh dark way too because tornado cache was the main channel for Lazarus for their money laundering from North Korea. And in in the dark web there's so many the criminal content in the dark web. So if you think about the responsibilities then uh the actually resources are completely free from the responsibility.

I think it's really difficult to say we are completely free because we know the potential and actually if we know that we need to find a better solution that we can resolve all the problems. This is the way how we can use this weapon in a safer way and making our utopia in a much more safer uh world. So yeah. Um but yeah actually as the history uh repeats uh as the open was charged and the founders of the 20 are also getting charged for the for yeah still going on right already in the jail for the catch people are they already in the jail they uh in jail for one of the because um my project uh the reason why I started working at the PSC was building a uh private transaction protocol on top of Ethereum. is kind of a implementing Zcash as a layer 2 on top of Ethereum.

So we all were aware of these situations and uh yeah people the toner cash people they bravely actually executed the um their plan and um now are getting charged. Yep. Uh okay so this is my uh thoughts for about the privacy and ethereum and the I mean Ethereum is our new territory uh where actually yeah I just thought introduce a little bit some interesting idea here that Ethereum is a universe and that is the reason why we can migrate our lives into Ethereum there which means that um the universe actually has a potential to have a universe with a alive cat or a dead cat and the quantum physics decide that the determinism is actually by the quantum physics and in ethereum uh the cryptographic inventions like proof of work or proof of consensus actually alternate the determinism there. So if you don't have the determinism that actually I cannot send any some transaction there because there's no way that I can uh determine a future that actually my some $10 goes to the goes to model. Yeah.

So determinism is the one of the most important feature of the unique universe and because Ethereum is offering the determinism by the cryptographic invention we can migrate to the Ethereum as a um really a digital universe. So uh yeah so these are my thoughts and my uh introduction that why I am doing all of these things and etc. And I think that uh the cryptographic cryptographics like uh zero knowledge and multiply computation and polymorph encryptions actually they will play crucial roles uh to save us from the current dystopia. So this is the mission and I think that many people's mission is pretty similar here that saving ourselves from the kind of a dystopian approaches or uh dystopian reality or etc. So uh yeah there was my introduction and okay [Applause] then yeah let's go back to actually you don't need to take a QR this is about the cur that I showed first uh do you did you get any hint what it is did you get is it in the bite It's a not a private key.

Uh yeah, yeah, maybe. Whoever is first gets the Sorry. Whoever's first gets the Yeah, you you you actually I put only a bit of a 0.01. Yeah, you say it it'll cover your like some cups cups of coffee.

Yeah. So, let's see uh actually who can drain that either there. Yeah. So, yeah, we're going to we're going to move for our first part. Okay.

Sorry, I have a question. Yes. The does this QR code has to do with that QR code? I'm confused what you need to figure out. I need to figure out okay great.

Um actually today's session will be uh consisting like I do I do explain the main concepts and we're going to have a breakout groups. We're going to have a four to five breakout groups and in the breakout group you need to explain that by yourself to others. Yeah. So actually if if you cannot explain yourself it's something that you are not knowing exactly. So you we should be able to explain something by yourself definitely.

And uh yeah so it starts from the just place it will be something kind of a speed run. I hope that we can cover all the things for the next three days and yeah let's see quick question are we going to get the link to the slides we're going to I'm going to give you the link uh after having this uh explanation it'll be kind of your reference for the when you try to explain something by yourself Okay, let's go. Yep. Uh, what does it look like? This is encrypted, right?

Yeah, it's a definitely encrypted. What does it look like? I I It's I would you please try to decrypt that. Any hint? Any hint?

The QR code was a kind of a hint. [Music] Yeah, it was kind of actually it has a hint inside of it. [Music] Try that. No. Uh, you mean the QR code?

Yeah. Is this number? No. You mean the correct one? This one?

This one? No, it's not. Maybe I can give you a hint. And yeah, the the title of the part one is a hint. I guess it is Caesar.

It's even the your name. Tell us what's the answer. But it's not the same. Group group. Yeah.

Is that group? Yeah. 24%. Yeah. Actually, it's a it's actually gross.

Um Yeah. And actually it was a Caesar cipher. Yeah. So maybe uh who's not familiar with the Caesar cipher? It's just a shifting actually it's a having a map that shifts like uh in in our case a shifting 24 right?

Yeah. So for example, let's say hello. Then let's say we have a shift uh with one and I f M P is a new encrypted form of a hello. Then uh actually we can learn many things from Caesar cyber there. because um scissor cipher is actually a group I mean I will going to explain actually what is group exactly so group is a set so cipher has a set with all of it so group is a set but actually it's something that you can do some argumentations inside of it and or maybe we actually say that as a binary operation.

So for example uh let's say you are um combining not combining let's say each of the uh alphabet corresponds to number from 1 to 26 is correct we have 26 letters right so 1 to 26 and then uh let's say that we are shifting that uh for example Let's say a shifting A should be B. A shifting B should be C like this. So it's all about okay we have a group and we are doing some binary operations of picking a two elements from the group and making a result and then what is the constraint for group the result should be also an element for the for the set. So uh if you say like a and shift something like b and it becomes a uh some Korean word u it actually it's not a group because it's not closed inside of that. So the closure is one first feature of the group one constraint for a group and actually there exist You can just think about the number and the addition that we have a associivity and identity and the inverse just like uh addition operation with uh number with integers.

Is it necessary to have only binary operations operations only binary operation? Yeah. Okay. So this is a definition of a group. Uh and here's a uh some simple questions.

Now let's think about those cases. So the bold z uh actually says the old set of all integers and then the Q star is a all nonzero rational numbers. Then um is are they group? So integers and plus is that is that group? Yes.

Okay. What about integers and multiplication? Yes. Yes, that's true, right? Yes.

Okay. Yeah. And about uh nonzero rational numbers and uh multiplication do they have a non zero non zero so they are actually uh satisfying all these four conditions then we can say them as a they are in a group Okay, they they are a set. Okay. And then let's think about the CI.

Actually, I already told this cipher is a group, but yeah. uh CPY is a really interesting example of how to express a cipher uh with a the relation with the abstract algebra because elliptical how the elliptical cryptography works is exactly how this cycle works because we all just handling the pros Um I'm going to explain a little bit more in detail that let's say C side but the alphabet is corresponding to number there then uh we are defining an encry encryption operation as a just plus n modularize it with the size of the group set and and then definitely because the all the results is closed and we have the uh associivity identity inverse. So actually the scissor cipher uh can be called as a because it's just a we are modular and then having a addition operation there. Let's see actually what exactly happens there. This is uh how the scissor cycle works.

So a + h mod 26 is correct. Yeah. So uh yeah I think it's correct. It's correct. Yeah.

Great. But you know it's a you we can easily isn't it? Yes. And it's pretty easy to declare the cipher. And how can we make it in a more difficult version?

Increase the increase the size of the increase the size. I think instead of being definitely so actually if we try to define a multiplicative thing and it might be much more difficult than just so let's see uh actually I picked I picked a prime number two there and uh the the number is 29. And because I needed a little bit more some uh other uh characters, I just added another uh alphabet letters there. And let's try to uh define our mapping from alphabet uh I mean uh let's try to define the encryption operation as below. So we are actually um mapping the alphabet using the G.

So uh G to the A actually becomes a mapped uh number. For example, then uh we are defining an encryption operation just like below that um a encryption k is a g to the 8 times g to the k and modularize that with 29 prime number 29. Let's see actually what happens there. Okay. So yeah, I speak a generator G to 19 there and then 1921 mod 29 is actually maps to S and then 19 B to 29 to M.

Actually you can see that it's a much more uh typical to think about the patterns here right but actually we can define the final operation actually we are just designing that we don't need to think about what is addition or what is multiplication addition and multiplication is just a concept that actually we know for right now and we are just designing binary operation that's all Why did you take 29? Uh actually it is related to theory and the prime numbers makes the modular modular circle. So but then we only have a 26. So I'll be repeating ABC. Oh actually.

So because of that I I added a new letters there. Oh okay. Yeah I added some new letters like I don't know actually but sorry I was just thinking actually it's a multiplicative pro then so essentially we are just treating the What you're saying is instead of treating it as a multiple group, you're treating it as some set with just some operation that in this case allow us to map a value to so this sort of like in real life when we're trying to message either just or let's say alpha numeric right so I don't think I don't think any of those are necessarily prime numbers so if we add like let's say we use this encryption scheme and we add more letters to it does it increase like vulnerabilities in terms of like it's easy to observe like dummy letters yeah um I mean actually if you do not use a prime number it will be able to be actually factorized and it becomes a problem. But this still can be likeed by actually. Yeah, this is still can be decrypted pretty because the generator 19 is kind of very small.

So, but actually if the generator 19 is really big then actually it will be uh it will start to be more difficult. Yeah. So this is how we can increase the security uh and the difficulty. I just have a question. Can you explain the difference between uh not But just can you uh help me explain that generator generator?

So g of g to the power x is just like what would be the group? Addive verb is actually in when you try to u define the binary operation for scar. Actually in this case we are having a some mapping first and then uh like having a g to be something to x and then using that we uh run some uh multiplication in the uh integer milk and then actually remap the result into the alphabet. So we have some processes Yeah. So uh yeah we are seeing that we are designing map here.

We are designing our own map. So we have some elements and designing and defining binary operation is actually what we are doing and actually we are checking okay what kind of characteristics of this new designed operation actually uh looks like this is the abstract so this is the abstract so we are designing a new some mathematics for for our own Uh and here comes a new concept the generator and in this case when we try to define the multiplicative group there is to say some um special element uh generator. So once for some of a element in that group can actually uh should be able actually should make the all the elements of the group. So for example in this case uh generators for editive group G actually satisfy a scalar uh multiplication. It's scalar multiplication should be able to express all the elements of the group.

Uh are we maybe let's try to say we have a group in one two three four five then uh actually 1 + 1 = 2 and uh 2 + 1 3 3 + 1 4 + 1 5 + 1 actually let's say that we are modularizing it so it becomes one and then plus 1 + 2 and 2 + 2. So in additive group actually any of these element can be some kind of a generator in this case. And what about the multiplication group for example uh let's say we pick a one as a generator and actually it returns only one. So it can be the generator. What if like if it just two one the two to the three four five actually It will if you modularize that actually it will express all the elements of this one two then actually we can say that okay two can be a generator of this group for example.

So uh in the multiplicated group some of the elements uh can be generator and some of the elements cannot be generated and there is some algorithm to pick a some effective generators and it's smoothly rel uh using the powers of two. to present powers of a 17 minus powers like this. Yeah. Uh 10 n is the set of integers, right? 10.

Yes. Is it always the whole set of integers or um actually it's a it should be interpreted as a how many How many times you repeated the operation? N is actually N and can be done you know from one the size of the group. Oh okay. and G actually um they are exist maybe generated without which is not required and G is just an element of paper.

So yeah question regarding any group let's say I choose two as a generator element um technically the resulting group is not going to be a group with all integer value group all even numbers right if it's a to true right yeah true so because it's a rep and is a repetition of aha the operations so so oh no actually because we are modularizing with ah so actually oh yeah it will repeat yes right circle Yeah, right. It's actually there are some interesting characteristics of a how to pick the generator or something. But uh yeah the only thing we need to remember here that generator should be able to express all the elements of the okay and then this is a um the most famous uh kind of Why? Actually we are uh defining a uh the set of all integers and then uh if you modularize it with a prime number then actually it becomes a uh actually it shows a pretty interesting characteristic. What happens?

Actually, we we have seen a little here. Actually, we already seen it uh in the scoop, right? So, it's a actually we can make it as a cyclic group. So we can make it finite. We can we can limit the number of the size of the group and we can make it cyclic.

So like the answer will be random but still inside the group right inside the product. So there is a bit of predictability but there is not a bit of so like there is a like predictility added to it but not really like you cannot guess. Uh [Music] Yeah, we say it becomes difficult. It Okay, actually we cover the all the important characteristics of the operation we are defining. So it should be a little bit difficult to know from of the operation from the result uh to the actually what uh Yeah.

So the end is very hard to find, right? But we should be able to compute the result easily. But uh if we want that uh actually the what kind of element we are adding or multiplying inside of it and uh it should be cyclic and have a finite size. And this is a uh the all the important characters that you want to talk about. So in this case the is both G and Q the secret key or actually Q is public right?

Q is public G is public and we actually let's see the name in this case. What do you think about the private key here? I actually we can we can we can see this case first. It's the it's the shift, right? The shift shift is the right shift.

How much like how many letters you're moving forward or backwards? I think that's the generator. Oh yeah. It's the generator. So when you think about that, the first one, what do you think?

The first one, it's pretty easy, right? It's a Yeah, it's a hello world. [Laughter] It's easy, right? And yeah maybe uh okay we can just if you know the generator in this case it's really easy to decre it right and why was the second one I going to give you the generator but it's really difficult to know what it is right then actually what's the thing that we want to keep here as a the plain text actually hello world right so it's something like G to the H G to the E G to the L G to the L is something like that I mean so we are actually trying to hide what it's in in the uh the power for for the generator so it's And this is actually called a discrete lower problem because if you define that y actually g to the uh power x and modularize that with prime number then actually it is difficult to know that using y actually what is x there? So this is called the discrete problem and the reason why you were uh difficult to uh decry the multiplicative version of cipher was because of this discrim.

If it is easy then actually uh our whole encryption will defy there's also the K so even that can be right or actually it's not actually K because it's constant multiplication so Let's see it. Actually, it's been a while that I made this slide, so I can remember exactly what was Ked. In this case, K is technically the generator. In this case, we take G A * GK, right? G.

So, G to power K is technically the generator. But to find out what K is is harder than adding addition, right? Because you need multiply and depending on how many times you multiply times a certain amount of K, it's hard to find what K is. I guess there is a says G. Yeah.

Let's go to the definition. I think we have to go back. Yeah. So GK is the generator I suppose. Sorry.

I mean, yeah. Um other things I think yeah actually I think that it has a little bit of a error inside this example to exactly uh explain the multiplicative graph with the scissor cyer case but I think uh the purpose of this thing is just getting a sense of what's this over and getting a sense of what's multiplicated And maybe I think we need to define and design it in a much more some exact way. But yeah, you was kind of experimentally I just try to define Caesar cipher the multiplicative version of Caesar Cer. So we need to polish a little bit more. It still works.

It's still hard to find what K is actually. Yeah. I mean, okay, I maybe you can try to brute force it, but it's still harder than Okay, done. Now it's a time to go to the next part. is actually just for the uh abstract algebra of the group.

How is it? Are you all actually can explain why ask questions if you have asked them you will get a chance later right? Okay. uh then we're going to try to define another group and uh that is an electric curve point or the group actually we are trying to define here. So to define a electric current uh we need to know a little bit more about the another concept field.

It's also just uh similar to how to define group but has a little bit more characteristic compared to group that uh we call that if the if it has a the binary operation is a commutativity we call that as a commutative group or a valantian group and field is analian group. So if actually Caesar cipher I think scissor cipher is a valid I think because we anyway define it in addition multiplication so it should be commutative so uh and uh field is actually usually denoted as a b f And these actually should be defined with a two different binary operations. And we usually say that one is a we usually denote that one as a a addition and the other one is multiplication. So field has two characteristics. One is a a bellian group for addition and another one is a bellian group for nonzero element for multiplication.

And then if that we should be able to define the distributive load there using the addition and multiplication which means if we have some points of the elliptic curve then we should be able to add those two points. What does that mean? We're going to have another new point and also we should be able to multiply actually points points are not the field. So I'm just if the points are the field then if we multiply two points then we're going to have another point that is the uh how we define the field is but Don't confused. Don't be confused.

Uh her points are not field. Yeah, I think we can just try try to go to the how to define the addition of a electric current point. Um before we go there actually the reason why I explain the field is that we should define the electric curve on the field. Yeah. So which means that elliptic curve means you have a xaxis and y axis and x-axis and yaxis actually.

So um okay we're going to visit a [Music] It doesn't work. Let me just type it. Um I think this uh website is a kind of a provides a best introduction regarding to the cryptography. So uh in this cryptography we uh find the addition in the uh geometric method. So this is a uh how the electric current looks like.

And then if there is two points P and Q then actually we are um defining that the result of the P + Q as actually where the intersection intersected point and reverse it to the Y-axis because we love to say we we write like P + Q + R should always will be zero and then uh we can move it to the right hand side then plus Q it becomes minus R and then we are saying that P and Q and R on the uh same line. So we are just uh defining them geometric approach. So here two points and what we need to do is say finding the intersection point here and then reverse it is the how to get the uh result of the two addition of the two points. Then uh let's say let's try to find the point by ourselves. So let's say we have this current and P is here and Q is here and then uh let's say P actually it's X X of P like this.

Then we have a the standard form of this uh is this correct? Yes. Expect Yeah, we can take it. Then actually uh how can we find this intersection? Simply we actually define a line here.

Yeah. And then we can just comput this M and K and then putting it here again we can compute the resulting x and then we can also compute the y here that we're going to have a xq and yq then we just reverse the y-axis this is how we can compute the uh resulting point okay so we actually define a new set that we are trying to think as a number so this point This is corresponding to number in our in our head and we uh actually define a new addition uh operation uh using this geometric part. Then why actually it will uh introduce us some something similar to this logarithm problem. Actually the reason why we are doing this is just to make it say some it difficult right let's see actually what happens here so this website also provides us a visualization tool yeah uh so we have a P and Q and R here And uh actually we can uh define a another some interesting stuff which is called scale multiplication. It's something like it it says how many times you did the addition.

So let's say P + P and 2 P and the scaler here is 2 P + P + P will be N * P and then actually our mission is that okay if you have this scalar multiplication our mission is that okay uh it's letting it uh be difficult to know actually what is n here this is our mission And let's see actually what happens in this uh visual tool that we are actually defining the addition in the uh real number field and then uh yeah we can let's see how the multiplication will look like. So I'm going to increase the number here and one actually should and two actually means P plus P goes to Q and three P plus P like this but you know it'll be a um it's in a real number. So it's not discrete. So it's a it has a infinite uh number of size. The size is infinite.

And if we define that on the field, if we define this curve on the field, let's see actually what happens here. So we have a uh discrete uh number of a elements here. So here let's see what is the uh this curve it says this curve has a 100 points 100 point then um let's try to add here is a one p so it becomes a little bit difficult to see the pattern here. But uh let's try to see what how the multiplication works. Then uh here we choose P is 33 [Music] uh six here.

Here's where the P is and then uh because if you multiply by one it should be equal to P and multiply by two become it becomes like 80 comma 10. So 3 4 5 6 7 Do you see some uh pattern here? Okay. Right. Yeah.

So actually this is how we construct a sub because you know you can see here that how many points we have here 100 and how uh large the size of the subgroup we try to make here. It was five. Yeah. So do you have any hint here? Yeah, the subgroup actually it's a uh the size of subg group is actually a factor of this it's kind of model group.

Yeah. So in this case actually for us it will be difficult to use the group with these 100 points because uh we're going to have five different answers right I know five not five we're going to make 20 different answers right so because of that to make it more usable it is the The easiest way make it the order to find that then we can use this directly I mean uh let's try to define another thing uh what is for example three yeah the generator has 96 points here type. Okay, this uh has 90 points five 91 points. It will have a it will have a no sub right then we can use it directly and you can see that this is actually defined in the field uh in a prime field where p is 97 but the number of the electrical points here is both are prime and this is actually uh if you try to build something uh for zero thing then you may encounter there exist fqr etc right so um basically fq is used for generally the the prime of the field and r is used for the size of this square both are prime. So in this case r becomes 91 and q becomes 97 because this curve is defined on a prime field where prime is 97 and actually it has 91 points.

So if we actually let I I share that our mission is that making and the making it hard to find this scalar from some different points. Then in this case this scalar the it belongs to 0 to uh right so you're going to have a 91 point and the scalar the range of the scaler is from 0 to 90 for this case. So from what I understand looking at definition of curves just I mean for each different type of curves that you define um I mean for example the setp 256 k they have a certain set of parameters which fits into this curve formula or curve polomials and that also includes the generator. Does the generator affect the size of the group created? Um actually depends on so there are different types of actors and actually we sometimes we intentionally using subgroups because a some of a subgroup can be interpreted into a much simpler form and we're going to cover that a little bit.

Yeah. Why do we use such? Because if we define a curve with this standard form and then actually some sometimes it has a subgroup and then if we use the subgroup then we can convert the points into a corresponding another easier form of another part that actually it uh makes us much easier to compute the additions or scal multiplications because Let's say that uh how how do we compute this uh n * p in a easier manner? For example, we have a let's say this p is a generator. Let's say g we have a generator.

It's an elliptical point and we are doing a scalar multiplication and doing kind of a 10 times of g might be pretty easy. But what happens this n actually really big number to the to 53 53 bits then I can do that we cannot do that like to three times right so actually we are doing a uh some uh double and add approach because yeah let's Okay. Double is something like this. So let's say uh 10 1 0 in a in a binary right and then actually we can do 10 of G in a way that okay I'm going to add G and G + G becomes 2 G. And then 2 G + 2 G 4 G and 4 G + 4 G and this is a 8 G and this is a 2G 4G one G.

Yeah, this is how how we do the double. Then in case of 253. Actually, if we just repeat this 253 time, then we can compute the result without doing this two to 25 times. Yeah, this is how how the line. So, this is pretty effective.

But actually there might be another some more efficient way to compute these things. So this is this is one of the um most represented algorithm to compute the scalar multiplication of the generator and actually it is important uh for the performance wise how does this actually we got to cover that type so we have few right like the crown 97 And then we have the 91 right. And then for subgroup we just make different that can have the number of elements in group that is like can divide the the whole the number of elements in sub. So yeah will be slower than Because yeah of the order of the same model. Yeah.

So it will be lower but then we get like I was going to quickly ask what the size of the only depends on the generator or also depends on generator because because am will decide the actually the number of the at points and also the field where the uh is every generator use on the curve. Um yeah, every generator should actually definitely be able to express all the elements and then the subgroup generator will express only the subgroup elements. Okay. But the subgroup operator still one of the Yeah. Okay.

Because it's a subgroup. Um Yep. You mentioned that faster like it's a it's a it's a double. No, you say there's another way that's faster than this. Uh there is a is a faster way.

What? Uh so I think we go I meanh I mean I'm actually I'm sorry there's not an alternative double net but actually that's a need to exactly compute this addition. It's all um okay so let's try to see that uh it's really difficult to know here I mean we have a cube here and if you don't see this number then this P and Q. Uh can you imagine actually what the N here is? It's pretty difficult.

Yeah. So it's a it is called elegarithm assumption that we are assuming that this is difficult to solve but using quantum algorithm it it will be easy to solve what the end is here. So called this curve discrete operator assum it's another operator but actually the this uh definition of disc problem started from the multiplicative group we are trying a try to make a pretty similar thing with the scala multiplication using the add in in the additive group actually it should be it should work in the same way when we uh have when we use the multiplicative group so Multiplicative group it's a difficult to know what exact power from the result and in this additive group it should be difficult to know the scalar multiplication scaler from the output so it's kind of a so sometimes um if we have generator G The discrete logarithm assumption uh is actually g to the x but in our case we are using that x times g and uh actually they are expressing the equivalent uh problem that it's difficult to know this x when you have these generators. So sometimes uh people just uh use this notation and sometimes people use this but do they mean the same thing? Um technically theoretically they are different but they have the same characteristics.

So when you just write this multiplicative form many of them just can be rewritten in this editive form. I'm going to I'm going to actually cover uh what's the difference in the in the parent. Yeah. So the g to the x is just multiply what quote multiplying two points right instead. Okay.

Yeah. But actually inside of it we can we going to like uh express this is multiplication and uh x3 + y is a multip is an addition and it going to be like this a little bit different but works pretty similar. Which one is easier to comput? Which one is easier to comput? Yeah, addition is a definite because we can think like addition is free always.

Scalar addition is free but scalar multiplication is not free. It's an expensive computation. Okay, then we have covered pretty pretty much and then we're going to see actually how where we can use this uh characteristic the left curve this lower. Let's go to let's go back to the slides. Okay, I just explained that uh with the white um also explain the double net.

Yeah. And um so the basic case is the DP hormone key exchange. So if you use the disco logarithm assumption the hormone can be expressed like okay we have a uh element a which is a g to be small a and also an element b which is g to the small b and we're going to use that large a capital a as a public key and uh small a as a private key. Does it make sense? Because it is difficult to know the small a from large a if you have the disclo problem right then we can use large a as public key and then the we're going to make a it's a basically what we are using when we use the https so we have a server and I have my own client and I would love to uh access to the server and communicate with the server and then we're going to make a secret key that we can share with each other only the server and my client.

So server will have a public key large a which is a uh the TLS and then yeah Chris and and B okay B is my client's uh uh public key then the share key will be something like this G2 A then a third party when Uh maybe can he know actually what is the what the G to the AB here is? I mean because to to know that uh some of you need a small A or small B right. So server A actually if the server has a uh small A then server can create the shared key by the multiplying the small a to the client's public key and and the client will can do that vice versa. So they know the two parties if they know each other the shared key there. So this is a how the D common exchange works and basically this is how we are you generally expressing in the multiplicative form but we can do the same thing exactly in the additive form too.

I can't explain. I didn't get it. Okay. Uh yeah, let's say uh when you come uh can you come here? Sure.

So uh would you please pick your priv some private key? Small number small number. Small number private key. Yeah. Five.

Yeah. And okay. Let's say the generator is a 17 here and 17. Is that too big? Like three.

Let's say generator is three. Let's say three. Okay. Can you please compute your public key? Uh no.

Yeah. Let's two3. Thank you. Okay. Public key, right?

Yeah. 253. Is there public key? Right. Okay.

And I'm gonna I'm gonna pick a and let's say um 243. Oh, sorry. I'm going to pick seven for my private key and then say 243. Yeah. Say my key will be like uh But you know let's try to this is not as some right case but we we can actually model right but anyway let's say this is my public key and this is my public key then we going to we're going to we're going to actually uh comm communicate with each other.

So we're going to create a shared key with and me and yeah share key here two 43 times you're taking his public he doesn't know your private so he doesn't know my private cover. Yes. Oh, this is getting very huge. Actually, this is this should be enough. Yeah, we don't we don't need the exact number.

This should be enough. Okay. Yeah. And then Okay. Welcome.

Thank you so much. I'm going to compute my sh2. What is your what is the Okay, your two for three. And then I'm going okay I know your public key and I know my secret key but I'm going to completely explain my secret key. So let's let's compare actually uh they each other this is actually how we exchange good am public key.

We don't need actually will never reveal his private key because this is my private key and this is what only knows and I actually shared my public key and to compute the shared key use my onetop public key and use W's private key. Oh, okay. And I am using W's public key and I use my private key. You the same check key. Yeah.

And then the result will be the same because actually any of you uh doesn't know the private keys of income in mind. See, you might not be able to uh get the same key here unless you know what unsubscri Yeah. All right. You don't mind. So this is the difficult one.

And actually we can do the same thing using uh the additive and scala multiplication form. because let's say uh yeah but for for the uh ECD the efficient efficiency and the computation will be much smaller for yeah usually actually this is much efficient compared to these multiplications but the security is still the same security this one's uh this is smaller and with the same security I mean yeah if if if it has the same size the security of this addition multiplication will be much better uh actually not much better um not much better I am I'm referring the uh security model of the RSA and the ECDSA. But actually this is not a uh exact comparison here. I think it's computationally. Yeah, it's cheaper to compute but I think it's so say a little more secure because we see we usually work with modular group so it's hard to predict where it will go to whereas this has a almost an infinite size.

Um okay uh yeah and actually we have another examples like uh encryptions but actually I don't think we need to cover this to understand how the electric works too because we TP hormone is the most simplest example and uh let's maybe let's think about the signature here theor signature is the easiest form of the electric current signature uh stuff and uh ECDSA is a tweaking a little bit so we need to um a little bit more equations to understand how the CDSA works but I think this general signature pretty uh enough to understand how the electric signature works. So in this case we have some parameters we have private key small K and then the public key is large P. So uh K times G will become the public key P here and then I'm going to sign a message using my private key. So here I will say the challenge is small e which is kind of a hash of the messages for example uh and then making it as a uh modularize with the size of the uh scalar order of this group of this part groups then uh let's try to make the signature using e * k because I am the only person that I I know that K is small K. So maybe I might be the only one who can make the signature E * K, right?

And let's see what happens there. You share your signature then people know the challenge. So dividing will give you the private key problem, right? And how can we prevent this problem? Maybe we can try to add salt.

All right. So, we are adding a choose a randomness small R here and then uh we're going to share this signature and add some salt to this signature. Then the signature will be something like K E plus uh random salt R. And then um to verify that signature is valid, people should know the verifier should also be aware of the information of nons in a different form. If you share the nons or you can just subtract and then you're going to you're going to give the private key.

So we going to give the nons in a public form with a electric point that will become the uh large r which is a all times of a general energy and then you are sharing your signature with small s and signature and public notes. Maybe uh we can actually easily verify that right? I mean yeah can you verify that? Can you verify that verify the signature? Verify that the signature is from the public.

Can you verify that? compare take a bit R and add it to the uh following. Yeah. Right. So this is already you have this information s and you're going to actually uh multiply generator with this s and the result should equal to r * g plus k e and you know kg the public key and you know challenge right you know the public key Right side.

Okay. Um, you gave me the wa gave me the signature S and also uh WA's hobling noise. And then I'm going to check that America signed uh using signature regarding to a uh some challenge E uh some let's say E is a uh hash of the transaction for example and then I'm going to check that when signature is valid for this challenge E how to verify I going to multiply uh with to the generator with the scalar s and then actually it should equal to okay we can actually you public p because public time because actually this signature should be a n plus challenge times minus private key then it will be like this E* G actually this is actually the the public key and this is actually the * K and RG is the big R So checking this should be enough to check when signature is valid for this choice. This is the simplest form of a signature. Uh okay now I think it's a time to go to the uh breakout sessions.

Okay, I'm going to I'm going to share the uh link for this slide and then uh let's try to scheme through the concept and let's try to explain with each other there and let's see that we are actually understanding this all of these concepts. Okay. And if you have any questions then we're going to and me uh just hopping around and we'll help you understand. No, that's it. still random actually $5 each.

Yeah, one cup of coffee for each coffee. Okay. Okay. Thank you everyone for following up. Uh let's actually I think the prank two is the most u the boring print of the all the three all the things for the three days.

But uh yeah it will be a kind of foundational ideologist to go through the other things and actually uh around from 3 p.m. you're going to have a really fun thing from there. To do that, you need to understand actually uh how the electrical cryptography work in a little bit more detail. Uh let's so yeah maybe I think we've already covered this uh in the breakout groups.

So is there anyone who can try explain that. Yeah, maybe uh each group can send one person uh for each question there. So, group one group one explains the growth. Yeah. the other groups as well.

Just send one people out. Whoever you are call [Music] By the way, the notes you have is over there. You just need to come up here, talk about your notes. You can come, you can come up together as a group if you want to. Yeah.

All together. You can come all together. Yeah. What does everyone do? Two one raise.

Yeah, we are. We have forgotten your group. So, he's trying to get I already got it. Yeah, actually I brought some foods from Korea. So, please let me give you the the as a gift.

I I'm going to bring that tomorrow. Oh, yeah. Thank you. Okay. And anyway, before we then start to talk about the group, maybe Can you please explain what you have done?

You trained that before. Yeah. Yes. Please. It's mostly that explain.

But I kind of know the process. Yeah. Yeah. Yeah. Sure.

One sec. CK ZK. Wait, did someone already drain it? Yeah. the text.

We have a lot of coffee. Yeah. So the cipher text uh to decrypt the cipher text we need to do scissor shift cer with a shape of seven. So if we know what the text is talking about and the text gives an instruction that's saying that we need to find a pol that has decreases. So the first step we need to do is find a polomial.

Then once you got that we have to evaluate it. Evaluate the polom value of value. Once we've done that, we need to take the result to modular and do modular arithmetic module. So that's it. That's how you get the private key.

So X and Y is for the polomial but there's some steps in the first and second X and Y is the is the point that used to Yeah. So we are given with 1 from the right or maybe let me before that we need to explain how we actually find the pol. So to to do that we have one method called the branch uh interpolation. Yeah. And to do that you need like at least multiple points of maybe at least three or more to get an accurate result but we only given one point but if you not even if you not notice this everyone actually given different point so you need to collect like yeah so every has different how did you collect do you steal like someone on the table this is actually found by Nazi.

Yeah. So, my friends sit beside me and yeah around like there's a there's a lot of different social engineering. This one and can I ask GBTL to do it? says I I need to at least find a degree six I need at 7. So once I g that so all of the puzzle pieces have been collected and I just with the help of AIT to help me calculate the result and yeah so so by going through all this process I received one just integer a very long integer and They convert it to tax and that's the price actually maybe when you were doing the lock actually the value might be too big to handle to be handled inside of your computer.

Maybe how can we do that? So it's a kind of a this field was kind of a 254 bit size. So it's kind of six. So the number is something kind of a 200,200 like this big number. This is something cannot be computed inside.

How did you do that? No, no, he he didn't. Yeah, he gave the answer, but he did not tell how to do that. [Music] Maybe some data around. Thank you so much.

We're going to visit how we can uh how can handle this kind of big numbers inside of computer later after we uh actually recall the concepts we have visited in the morning. the group one and then you explain what the group is. [Music] What is group fresh? So the group is a set of uh elements that follow certain rules in simple terms and these rules are photos, closure, associivity, identity element and universe element. Yeah.

Yeah. It's pretty simple, right? Yeah. And should you explain what is these four? Yes, please.

Okay. The closure is product of any two element of the set will be in the set itself. Mhm. For example, if we get the set of let's say numbers inteious and uh two and three if they're a set the product of them will be five. So it is also in the set that's closure.

Okay. Okay, associivity is uh order doesn't matter in simple terms. For example, if we add 2 + 3 is 5, 3 + 2 is also five. [Music] No, should be like let's say you have three numbers. It doesn't matter whether you do operation on the first two number first or relate to the order.

Oh yeah. Sure. Sorry. Sorry. Identity element is an okay operation with identity element uh will result in the element itself.

That's identity element. For example, if you are addition it's zero. You add zero it will be the element itself. If it's multiplication it's one multiply it will be the element itself. inverse element.

Okay, it's an element that can undo the operation you did in simple build. Is it simple? For example, if we shift in the cipher text in the Caesar cipher by four if that was an operation and the inverse element will be minus four to undo it. Yeah. That's it.

Yeah. Uh technically uh the image should output the identity always. Identity. Yeah. So in for addition identity is zero.

So for addition the inverse of four should be minus four because it returns zero. For multiplication the identity is one and the inverse is kind of divor like uh yeah four then say 0.25 is a the real number. Oh okay great then uh group two can you explain that was that was easy for the that was that one was the easiest [Music] Don't be shy. Don't be shy.

Okay. So basically few is sets of numbers. So the numbers will contain the original set of number and then they will also have the multiplicative inverse of the numbers. So if they only have the numbers like 1 2 3 4 and they do not contain their multiple inverse which is like one the multiple inverse of one is a boundary inverse of two is going to be a quarter which is two over one. So if it doesn't contain it's going to be a ring and then if it a contains going to be a field.

So basically what a field has it has two binary operations. First one is going to be addition and second one is going to be uh multiplication. And then normally the the if it's for multiplication it's not going to be zero. It's not going to contain zero. And then the one of the things you're going to have is uh it's called the ability group.

So a billion group means that um if elements a to b a to b is going to be b to a. That's going to be the definition for an albian group. So for all fields is going to all of them are going to be in. And then the other thing is there's something called distributive law. So a uh as an example the elements a b c when a * b plus c when b plus c is vector so it's can it can be break down into a * b plus a * that's going to be the distributed for for the basically right and because we now have this field actually there was the main reason why we could use interation in an easier with the field because if we do if we just uh do the computation in the real number and then actually modularize that which is uh these five at the end of the computation actually it's too big.

So we can do the all the computations in the field. That is actually how the labation can be conducted in much uh cheaper way because we modularize uh every time. So the intermediate result will be closed in the field. So we are not actually handling a two big number there. And we can do the same with and before we do it multiple times.

Yeah. Right. So basically uh if you have some arithmetizations actually we can consist of additions and multiplications actually the result always should be same if we just do the same thing in the in the field. Thank you. And then group three.

Sorry. Yeah. Scal multiplication of BCC please anyone. It's okay. We can just try to give a general explanation.

No, go for the scar. Okay. Okay. Yeah. So, I guess the understanding of scar modification of curve is that curve you have a set of points.

So when you are doing style modification on let's say one of one of the points on the curve is you are just doing addition on the on the point let's say so when you are doing addition on point the result of doing that addition is generate another point that is on as well. So if you do this a lot of times um and if the scal value is very large it becomes hard for the anyone to what's the scal value just by looking at the output of the um of the addition of the scalation. So in the context of public key value and public key of SC because let's say you can if you only look at the output of the scala multiplication which you're looking at just a point on the curve. If you if you want to know the secret value which is a scalar value it's not possible to do it. You can go for it but if n is very large then it wouldn't be visible.

I guess that's why no we didn't really discuss these two questions just now. [Laughter] Can you go through the how to create a series using ECDH? [Music] in support. Yeah, okay. So for creating a sh will need first a which is the public key.

I'll just write public is equals to the generator G to the power A where a is the private key of the party A. Same for B and to sh to have a shared key [Music] you know multiply this together. So get to be a mathematical formulation of this. So this is the general how about the easy how about the easy we have the generator it depends on it depends on the first the previous so in going back to what group we said the scaling is essentially the secret right so now basically then we instead of having ga we have a um modified by the generator and then So in this case is a perfect. So we have a really good sense of the uh why we are using a lot of curve for the uh disc function.

So uh we're going to go a little bit deeper of the how the curve actually looks like. So it's a little bit boring but actually after that we're going to handle a really interesting topic after this. So this is the basic form the bias transform uh y^ 2 = x + x + b is saying something kind of we are defining this electric curve on the field on the field. Um and actually this polomial this elliptic curve actually um uh satisfies the uh overall uh complex group load here. So um this works right.

Um yeah actually we simply uh talked about in the in the morning section uh actually it contains some role. So abstract algebra is all about that we are designing our own rule. So in this case we are actually defining the elements with this point and we are defining the addition rule but uh this bas transport actually has some active cases. For example uh what about p uh actually what about this line does not meet any other points. For example, actually the line can look like this.

For example, it will never meet another point, right? So for those edge cases actually, we have a special rule for addition. So this is the limitation of the Y. So um yeah, anyway, we're going to take a look at the uh real use the SCP uh 256K1 the prime number p actually looks like that so it's a 256 bit value and the a is uh minus 0 and yeah = 7. Yeah.

Okay. And and actually we have a generator there and the uh order of these electric curve is actually also the 256 bits. So the order of five build sizes different. We all know that right? So I think we don't have that left current.

Not sure. Yeah, that correct. Yeah. And the second question I guess is does it matter whether P and N is about the same size? Yes, it matters because uh mostly actually the order is pretty uh similar to the order of the P and uh the actually we're going to we're going to handle that when we uh talk about the folding schemes inside.

Yeah. Because for example, let's say that we have a um some elliptical things and let's say the output has some order with n and actually if the order is exactly same with the field size then actually we can do we can actually put them inside of the another thing so we can make it something recursively prove something in the future so actually in that point of view the p actually and order the prime build and the order of the scaler uh actually matters. Um yeah and let me uh explain about the co vector a little bit more. So let's say that we define a electric curve on a finite field. So we have let's say we have a actually a uh discrete uh 10 points for for example and actually I try to pick a point here let's say P and one P is this one and two P is this one and actually three P is this one and four P is this one for example these event these two points actually uh consisting a subgroup with order of two.

So this subgroup order is two but actually the order of this polypic curve is 10 and the co vector here is five mean the size actually p and 2 p actually is a subgroup of a this bigger elliptic curve and the order of this subgroup is two I mean the size and order of this subgroup is 10 and Co- vector here h is five and co-actor when the co-actor equals to one it means that okay actually uh it does not have any subgroup. Okay then uh We have another part 256R1. Can I ask? Yes. So just to kind of recap what a sub is that you pick a generator.

So for this example right that generator will just Yeah. Right. This generator P is only the generator of this subgroup because actually it outputs only these two points. Okay. But actually for example if we actually pick pick this elliptical point and actually oh interestingly actually we can express all the point with this one for example.

Yeah then actually Q is the generator of these this square. So P is the generator of this subgroup and Q is generator of this identical point. If the order is prime then there's no such sub. So if the order of these points is prime then actually we going to have a unique sub which is exactly equivalent to this graph. Yeah.

So yeah, this is how the SEC curve works and uh we can change the number a little bit. So this is the another curve with SCP 256 R1 which is being used for face ID. Yes, etc. Uh actually I don't about the name for K1 and R1 but yeah maybe J hopeless. Yeah.

So we have a another prime p and actually you can find that we are actually choosing a prime with a combination with the linear combination of the powers of two here because if we just make the prime number with the combination linear combination powers of two actually it has a pretty some good characteristics uh because we can express them in by uh bit wise like expression and then so how to pick the prime number is something like uh do some linear combinations and do some primary primary test that checking it's prime or not it's how to how to pick the number and then there we pick another a and b and generator in order say is also But as I actually uh shared with you uh it has some sort of a uh edge cases because of that uh which means we need to define uh the actually flow control when when we write some program. So when we try to uh implement this in programming then let's say okay I'm going to add point one and point 2 and then uh using the flow control we're going to check the condition say oh is it is it in edge case then actually use this algorithm is in this this case and actually we're going to use this kind of some uh geometric plots etc which means it's kind of a computing overhead so in the curve it is pretty uh important to have a simple role instead of a kind of a some complex design. So actually long curves actually help us uh doing a much simpler um simpler approach because actually this can be converted to a network curves form vice versa with each other which means uh need to see actually how the Edward curves looks like. Let's go here. This is how the curves looks like.

So let's try to think about only the uh first three terms x² + y² = 1. What is that circle right? And we are adding a one more term which is a plus d x² y square and then actually it will look like uh the right figure it still actually looks like a circle which means that we can use the oiler equation. Yeah. Uh maybe should we remind all the equation?

Okay. okay. We have circle. If we express circle in a complex plane then and with a unit circle let's say the angle is theta here. then the point x comm y can be expressed uh in a way that uh I'm done actually let's say the point uh coordinate is x comm y uh e to the i theta equals to right and then actually using this older equation we can easily compute the e to I actually for example like A plus B and then because um uh it's just say multiplying those two values then actually we're going to we're going to get the a plus b and geometrically let's say this is alpha and this is beta and actually this is gamma and if the gamma equals alpha plus beta then we can get the final result just using multiplying these two values here.

So this is how we can utilize the oil equation when we compute this kind of base circulate uh geometry stuff. So you know actually when we compute the dynamic alpha plus beta actually we can compute this pretty easily like this one correct right I think this is correct maybe yeah I my my memory is so we can utilize does the same thing for the other cards. So it does not have any edge case. All right? So we can have only one simple rule to compute the addition of two values.

If we define the addition as a addition of the angles. This is how we define the electric point addition. curves. And actually if we we can also twist this a little bit to the to a twisted adverse curve like uh multiplying a another scalar value to the term x² then it will look like uh before we go to that uh this is the how we can compute the exact uh the result of the point addition in Edward's curve And if we twist this by multiplying a little bit of a scalar x² term then uh we going to have a uh curve uh and then is slightly uh with a slight different term uh with multiply by scalar And actually this adverse curves formed can be uh has a biational equivalence relationship between the monomeic form of target uh bational equivalence. So we can we can convert this twist adverse form of curve to these types of a uh where is these types of a monome.

We can actually we can also convert this monary form to a Okay. So, uh it's kind of mapping. So, actually one point can be interpreted in a mome and also one point in the momeic curve can be interpreted into a curve for so Not the same as the number like one relation with each other. Is it one to one or one? It is a one to one relation but actually it should use the subgroup of the mobile with yeah with some factor.

So actually we can choose how what kind of torque to compute the point uh by our demands like uh sometimes actually using mobile form is efficient and sometimes just twist form is efficient. Okay. And actually this is the uh one of the most famous for that we are using. It's a uh Edward course 255 19. Yeah.

And actually when you when you uh in your terminal maybe recently the default uh algorithm that created your own public key to to communicate to some uh TLS then maybe it might use this one and then actually we are doing the ECDH with the server. For example, uh you can create uh some public key on this card and then you are actually registering your public key to GitHub. There you can clone your private repo in your laptop via this ECDH verification. Um question about is it specific to a single generator generator and actually we have covered the signature But actually we can also cover the DCDSA here. Um actually I would love to leave this for the breakout group session right so we can just try to go and try to understand actually how it works.

It's a little bit different with this signature but actually doing the same thing. Yeah. already know how the sher signature works. It's a simple scale element. I think like the first two steps are similar.

Yeah. The fourth step is just like we are dividing it by yeah the yeah actually that is where the different yeah difference actually comes out. So you can understand that can be inverse of your inverse of the randomness. Yeah. Then now time to visit the pairing based cryptography.

Okay. Um so let's recall about the ECDH which is we have color. This is not actually a real world example so it's not used in this way. But let's think about the case that uh we have Ellis, Bob and Carl and Ellis is actually has her own public key and private key and also Bob also has his own public private key and they are actually communicating using ECDH data and there is call and call wants to check that they're communicating actually correctly. This is not a real example let's to say that car wants to check actually they are communicating correctly then how can check uh they are doing correctly there do you think that's possible here to do that without knowing the secret key A and B maybe Yeah.

So you're Yeah. Uh yeah, actually we can do that, right? Yeah. I mean, isn't it seem difficult to do that with the knowledges that we just need cover during the morning time? We haven't covered any concern to do that.

How about sending message using message using [Music] uh message actually uh Ellis and Bob both actually uh don't know about the sharing secret key small a but it's a really good and Bob still don't know about the small A. They know A and they only know B. Yeah. Paul also doesn't know. But you said that car needs to know if they both get.

Yeah. So they but they don't have to know both A and B to know. Actually let's say that um they have a share secret K in A and B actually this is also a both actually share secret only for Alice and Bob and it's so it's not a real example but actually call uh actually now checks that call knows K the large K and Carl wants to know that K is derived from small A and correctly from which is more key is a a * b but what happens if the shared secret key gets to the public shared secret key this will the large K break the encryption yeah it breaks it breaks the encryption so I can I can I can see actually what you're doing so it should be only shared with right So yeah, only actually this is not a real world example. Yeah. And Pearl doesn't know small A, doesn't know small B and doesn't know the small AB only know these three points.

Cor wants to know how you get small K. That's the question, right? just wants to car already knows the already got a share key. Yeah. He wants to check if it's from A and B.

Oh, big A and B like A and B. He knows. Okay. For example, let's say Carl is a hacker and actually car exploited this shared key. Okay.

And uh if Carl wants to decrypt something using this shared key, it's so expensive. So call needs to check these actually hacked key is correctly computed from these two public keys. This is the case. So either he needs to get a private key or private key Carl actually without knowing the ace private key private key. Carl only knows these three public key then there's no then there's no yeah actually for right now we don't have that tool until now but this is what the pairing does.

Yeah this is what the pairing does. uh we can check that K is exactly derived from these two values if we use pairing. Let's let's uh try to go more. So pairing is about actually doing a uh by linear mapping means We're going to actually uh map this public key to a some different set with the same size. So it's a kind of a elliptic curves but actually we're going to define a another set which is actually exactly another group uh which sides equal to this number of these uh yeah the the electrical points then uh how can we say let's say a is mapped to Um for example like can let's say a a star and b is actually meant to be star and there exist a way to multiply both of them and actually it will output some value which is c star and then if there exist the algorithm that this output is exactly same with K then actually we can check okay we can map this one and we can map this this to another another group and there exist some uh operation to multiply them which outputs the same result to K that actually we can check these actually K is derived from large and large large B Uh let's see a more detailed example.

Okay, this is the kind of a more detailed definition of the pairing. Okay. Uh so you can check that there uh exist a uh binary mapping operation E is a it outputs a element in the group uh target group GT if we input two different values of the group one and group two. So in this case we going to actually a and b are both in the group one actually uh there is a one to one corresponding uh if we find another group two which has a same uh sides with the group one then actually okay let's say that we have a b in group two and being in group two can be actually expressed in form of like this uh like this. Let's say that we are just using the multiplicative form just to understand easily.

Actually, it's still in the editive form and a existing group one. So, actually it should look like this. Then there exist a pairing function E and the parameters we have we accept two parameters. One is for for an element in the group one G to the G G sub one to the A and the second parameter is G sub 2 to the B and then it will output some value in the target group and actually the value should return something like this. But the G target has completely like shifted the space right.

So we are working on G now um to compare when you compare it. Yeah. And then okay uh in this case to cor to check this key is computed correctly car actually this is also exist in the group one. This is for all of these values are actually group one for right now. But we need to send this large K to target group.

Yeah. And then it will be look like uh this. Yeah. And how to actually make this how to send this to this target group? What about this like uh three sub one to the small k we know this value and then three sub two and yes and then actually it will return something like this right I I didn't get what you did after okay so we know this one but we would love to get this one how to comput how to good is that we have this parenting function and pairing function actually have some characteristics like this.

So if you uh actually receive two parameters from two different groups then it will return an element in the target group which satisfies that G sub one to the A and G sub two to the B uh maps to G target uh to the AB. Yeah. So just uh simply map a an element from the group one to target group is actually uh using a the generator of the uh group two. Yeah. Because then yeah it makes sense right.

We can we can simply send this to the target group and then what we're going to do is that okay uh we're going to check this is kind of a k uh send to the target group then we're going to check the pairing result of these two values. Yeah. C there C uh actually there is another some characters in the biolinear that uh this is a carrying result and also this is a pairing result. So we can multiply two pairing results then it will return a pairing result that just like the distributed load. Okay.

Yeah, it's like a property. Yeah, it's a property kind of a distributed load. So if you use this property then actually we can uh see that The uh pairing of P1 plus P2 and two actually can be uh distributed into P1 June time and P2 here. So what does that say? So the target group actually is not on a point.

Target group is another group that we define. So actually the target group uh has actually uh yeah this is actually this operation is defined uh for the target group specifically defined for the target group. actually uh um as far as I know actually for the first that actually satisfy the pairing function. Um actually I don't know the project of the elliptic curve. Yeah.

Can you explain what what is that operation doing? Uh the operation doing so. So it's a just a binary operation actually just what we have um defined when you try to define the group just like C. This is a group target group. Target group has a binary operation like that.

And if we do the binary operation in the primary group with these two element in the in the primary group actually it satisfies this equation. So what is the first? Yeah. This is first group, second group and actually this result is a target group. So we are using three different groups.

So actually for one pairing function we use just one group element from group one element from group two and its result is in the group target group GT and GT also has its own binary operation just like we have defined in So if we do a binary operation with these two elements in the target group and then actually each should equal to you know it's it's say closed. So it will return another element in the target group which actually satisfying this condition. So it's a if we actually uh write this in a multiplicative form it will look like this and if we write this in a additive form it will look like this. So the third line is Q is a second group yeah and this is in the target group the result of the parent is in the target group. So we define another new another group which is not so operation for group.

Yeah just just yeah just like CP we define it's another binary operation or only target group. Okay. Can I so I'm going to use that the B by linear relationship to try to explain the car example. So what could do is that car could take a point plus b point to get the k point. Wait, wait, no, not plus multiply.

No, no, he needs to put a point and b point into this e mapping to get the point in the t but then also put the um the k that you got in field one and generate generator in group two and then check that the Maybe shall we uh try to write in the uh pairing board for the checking Alison and Bob's case. Okay, let's do this again. Okay. Uh we know call those lices uh public key. Yes.

Ah and then actually to check that we need to send this to target group. Okay. We need to send this to target group. How is it? Maybe uh like this.

Yes. Okay. [Music] Okay. No, no, no. I'm sorry.

I'm sorry. Uh because we know K. Yeah. So we we know A and B actually we are sending this B to to the group two. Yeah.

So B actually let's say uh B star is is in group two. Okay. So actually it's a there is a one to one uh correspondence between group one and group two. So I'm going to compute its pairing result and then it's a let's say okay it's let's say C for example and then Actually C is in target place right? A is in group one.

B star is in group two and then okay actually car exploited their shared key RHK and then car wants to uh send this to the target group by just doing this one. Yeah. then it will be something kind of a k actually this is in group target and then we are just checking K k K prime and C and then if they actually equal to each other then it means like okay uh K is something kind of G to A and A is G to D A is G to B exactly same should be in the if we get K star K prime or C then how is going to break be able to decode and get the I We actually this large key itself is a shared private key. Yeah. Yeah.

So crawl is actually just checking that this shared private key is the right is the right one because oh so it's kind of like generating the proof that it is derived from A and B. Right. Right. This is just a getting a proof that okay because uh here are kind of some assumption is that uh decrypting is super expensive for example. So before you run this program like maybe let's say it needs you need to uh rent a really a big amount of some cloud resources which is very expensive to run this algorithm.

So you need to check before actually this is a computed correctly for example then yeah I found an real I found a real example is there always like is there always is there always sorry that can do this or Uh always you mean we can send any element of this cori uh yeah we can is it not only uh limited to pairing friendly curves only to parent friendly curves. Yeah. Uh one question I have is so the E here is it is it a pairing check between G1 and G2 or is it just saying that E is an operation between two different groups and then doing this operation will result in a target. Yeah, it's a it's a function that results the target group element. Okay, got it.

Thank you. Yeah. How do we move B to second group? Uh B to the second group actually. Um do another pairing.

[Music] Is it you is it usually that you would instead of computing B in the first group, you would just compute A in the first group, B in the second group and you attempt to check a third value um via the target group. I would say is it usually like this or do we have to move B from the first group? Um share the same generation you are mapping it actually if you know the secret small B then you should be able to compute the compute that yeah in the in the in the second group too but actually I I don't think that we can easily transform an element in group one to group two you don't have to right if we know the secret key we don't need But in the case we really don't know the the secret key then actually I I think uh actually we need to check I think there's no algorithm to easily convert the element in group one to group two. We need to know the secret value. Yeah.

So because of that in many case uh when we when we are using pairings then uh we try to compute and share something in group two as kind of a shared values shared public values. Uh maybe you might heard some kind of a uh trusty set of stuffs or something. So we share something uh in this We have trust is set up and we share something in a some group two element. So we are using only those values and we don't need to send some value to group two usually. So we only use a group one and using some given values from the group two and compute the pairing function and output say some target group element.

Are we getting some sense of how the pairing works? Great. Great. Okay. Um actually there are multiple types of funions.

Okay. There's no saying that isn't the same that you cannot have two elements separately. I forgot why I [Music] maybe yeah let's revisit later maybe tomorrow or yeah we have some ideas on that by the way actually we have a multiple types of pairing functions uh and And actually there are uh two very famous uh different pairing curves. Uh one is a BM curve and the other one is BLS curves. Um actually I also put some optional uh information here to uh check how the par works.

But actually I think to go deeper for those information. Okay. But let's just go through the the applications. We are very user apparent. [Music] So the first example is the BLS signature.

Uh yeah, let's see. I need to revisit this again. So we have a private key small X. Uh yeah, it's a scaler and the public key. We compute the public key using the group two scaling doing a scaling multiplication.

uh using the generator of the group two then it be it will become a public key and then uh we're going to sign that using our private key to sign that actually we're going to uh actually convert some hash of the message into a form of uh group element. So for example, let's say you have a some message and then actually we can uh encode this message into a group element of the first group. So here actually small h is a small h is in group one. This is a actually uh you computed this from like hashing your messages and you're making a uh some hash of the message into a form of a elliptic curve group elliptic curve element. Now how we sign that it's pretty simple.

uh you have this one and doing a scaler multiplication using your private key small x that's that's all they should be the your signature then how to check that then okay verifier actually has your signature and your signature is actually will look like this and then okay Let's try to use pairing here. You made a public key, right? You made a public key. Uh I mean to the x. No, I mean h to the x h to the x.

And then um we're going to use a group two generator here, right? Then it should equal to uh group two generator and h correct. I think it's correct because actually uh in pairing you can think like we can move this exponent uh from the first parameter to the second parameter easily. Even if the picture is not even because H is Oh yeah. Yeah.

Right. Because it just small t something. Yeah. Right. Okay.

Actually uh one interesting stuff is that uh this should equal to this or this. Yeah. So checking these should be enough uh to verify the signature in using par. It's so simple, isn't it? It's actually very simple.

So is small x one to minus one like the square bracket is the closed interval from the small in the set of square brackets. That's one two small You mean like small it's from the interval up to small like what does that square say? Uh that means from 0 to from zero 2 - one but actually we should take zero. We should not zero. Yeah.

Just a moment. Actually that means from one to two minus one. Exactly. That notation means 1 to 2 - one. How do we determine the hash function?

Um actually the how how to make you mean how to make this message is What kind of properties? Yeah, but this one. Yeah. Um it doesn't matter. I think it doesn't matter that much.

But actually the outputs should uh feed for the finite field where we are defining this fieldless curve or BM curve because how make this uh the point is the u hash and then actually checking that using that value as your uh x value and then check actually there exists some point there for example if there doesn't exist a point therefore you need to uh hash that one more time until you find the point So we have the subject key two the signing function uh not the sign sorry function then the private key private key is a scalar field scalar field of the group one and the group two should have a have the actually same size with the group So the BLS curve and the BN curve actually uh uh have the the same size of groups for the roboting group too the target groups. So the verification is checking the signature which is in group one against group one and then the result of running the function hm which is in group one against the public key in group two. I don't quite get um why that like why the second check or why the second uh E function it's calling on an operation on G1 to G2 but the first one is G1 to G um is G the target group here or G is the generator for generator actually I'm sorry this is a group two generator ah okay got it thank you also yeah G2 Okay. Okay. I should actually note here.

So in this convention is the second parameter always. Yep. Correct. Yeah. The first parameter is always a group one.

Second parameter is always in group two. function of X. We can just do a scaler multiplication using the group to generator because you know the private key. Okay. So you can easily create the public key in group two.

Okay. Then I I'm going to give you this for the breakout from session two. So let's try to understand how the aggregation of a signature works. It's not it's not actually difficult because it's a how it's a pretty good example to understand uh the properties and characteristics of how the pairing functions. So uh let's try to uh dig into the aggregation uh in our breakout group session and then we're going to visit the KGJ polomial.

Yeah, the the font for storage. The phone for storage. Um Let's say there is a prover P and uh the prover wants to prove that I mean let's say I'm a prover I want to prove that I have a polomial uh here f ofx and my polomial the evaluation of my polomial at value x1 is actually y1 one. So for example actually you have computed the uh polomial right and then you evaluated that at value nine and actually you are uh you show that you have a private key but okay then uh we're going to we're going to show that without actually revealing what your polomial exactly is you want to prove that oh I have a secret key without actually showing that draining by draining you you you can actually prove that oh I have a private key actually this is exactly derived from the polomial that I computed by collecting seven points but actually I don't want to share what the polomial exactly is with others this is actually what you want to Okay. Then actually to prove that uh when Kong is a verifier.

So W actually okay uh Rick asked me to prove that. So to help me prove it, uh wa actually picks a random number small r and uh actually gives a set of a point which is a scala multiplication of the powers of r there. So it will look like G and to the R and to the R square to the R 3 and the R minus one. Actually uh we should have this bracket but that's uh and then uh when request me to compute okay actually you have those values so you should be able to compute this one G2D F of R without knowing what the random R is does it make sense just it's it's not about pairing it's just about the what we have done in the electric ECDA stuff because we can actually share those values but I still don't know this more Right. I know the coefficients of the polomial.

Mhm. Let's say uh the polomial that zk computed from the uh seven points actually looks like a z a1 x a2 a6 And then actually ZK doesn't want to share exact value of this polomial but in this case actually mank numbers small R and ZK doesn't know what the R is but ZK still can compute G to the F of R by actually G to the let's say uh G2D uh A Z because ZK does know A Z and and then multiply that with G to the A1 R. Actually when actually Z can compute this one because we come here G to the R, right? And then comput to the A2 R square because also C can compute that because when share G to the R square does it make sense. So actually ZK can compute the result of the G to the F of R without knowing what the random R is here.

3 to the A6 because it should equal to G to the R square actually what compared and then anyway ZK does not know the coefficient is treating R as the as the X value or as the unknown right in this case the variable yeah Okay. Uh yeah, let's visit the case again. So ZK has his own polomial, right? And then um we going to test that in a uh random number. And then actually if ZK computes the polomial correctly then actually it will be on the polomial right so the polomial looks like this polomial looks like this and then uh we're going to pick a random R here and requesting to ZK that would you please give me point actually reaches on your polomial.

Then what if the ZK actually uh cheats on us? For example, for example, ZK is not sharing this polomial. Exactly. And actually sharing another point, a random point uh a random value here for example. For example, then uh if actually we are checking that zk is sharing the value of the polomial or not.

This is actually what we want to do. This is what we want to do. Um so okay so figure out whe yeah this is what we want to do. This is what we want to do. If you have set of points um that's true but actually so because of that if you share too many information then uh your polomial will get revealed so you can't share only if you information okay and Um actually yeah this is how we make the uh commitment and using this commitment actually we were trying to check actually uh ZK is sharing the polomial is on the polomial correctly using this um commitment but um ZK should be able to create made this commitment right without knowing the exact the small R here is so this is a yeah so f of r will be a kind of a in the scalar field but actually zk doesn't know what this exact value is because zk doesn't know small r but still can comput G to the F of R because MON already shared G to the R and G to the R square and G to the R to the 6 and then because ZK actually knows the coefficients then ZK can compute like okay I'm going to do the scala multiplication uh to the G to the R and the G to the R square and G to the R to six and then we'll combine them all together like this and actually it will return this value.

So does that mean in a set of ceremony basically what we're trying to get is that set of thing and then actually we are not doing a setup actually uh wing this in interactive form that wan is just uh setting some random number r here. Okay. Yeah, in a in a non-interactive form, the R is generated beforehand in that. Yeah, I say we're going to handle the how to make it in a non-interactive form. Yeah.

Evaluating the pol. Yeah. But actually wan uh doesn't want to also share the small R. It's a secret value. Small R is a secret value.

So instead of a sharing small R when actually sharing it's kind of a public values as a form of a G to the powers of R small R. So G to the R G to the R square G to the R cube and G to the R to the 6 here. So when I share the seven actually six points. Yeah. Okay.

Then we going to actually prove that ZK is sharing uh the uh value correctly uh using Y1 is a 10 secret key which is evaluated at nine the recon polomial then actually it will satisfy this condition. That's correct. So f ofx minus y1 uh can be express uh in the form of x - x1 times a quote because if you put x1 here it will it should zero it should become zero right and then it means that We have a kind of some it's a we have the factor with x - x1 this pol because it's a root of this equation x1 is a root this equation what makes it zero so it has a vector with x - x1 and it means that we going to have another quotion polomial Q of X. Okay, let's say that um we have a polomial X share plus 4x + 3. Then if we put minus one here, it becomes zero, right?

So actually we can rewrite that x + 1 * x + 3. In this case, this is the x1 minus x1. Exactly. And this is the quotion because if you put minus one here, it becomes zero. When you put x1 here, minus one to the x1 So we should be uh able to understand the relation of this factor and this pol does it make sense pol because actually we're going to check uh the quotient pol computed correctly at the random value is more hard like if x1 is the root of f1 then the should be a pol then the should then x is basically the like equation with one degree Yes.

Yes. In this case in this case polomial is a polomial a one degree less than the f of x. So if in this case in in our case the polar should be has a degree five okay should be five because the polomial reconstructed was a six and this is one yeah okay sorry can you explain a little bit what's x1 and y1 X1 is X1 here is nine and Y1 was a secret key. You wanted to put X1. Then actually if you rewrite the f of x in this equation then the if if we compute everything correctly the left hand side and right hand side should output the same value.

Why do we need to use parent to comput this? Can't we just because um this is about the polomial the equivalent relation. So for example uh Z would you please share me a value with your polomial minus the value actually the secret key but actually you don't want to share the exact value. So you're going to share that with me in a in in group for example. So you're going to you're going to share everything with me and then also actually you if you gave this value exactly then actually if you compute this value it should equal to the left hand side.

So I am letting you that okay would you please compute these two things separately the first term and the second term separately and would you please give me that in a group form so here using parents means using small the reason we need to use pairing is because we want to multiply these two terms Who's doing step or uh actually um both because the prover needs to give us the G2 and also prover needs to give us a G2 and then verifier we'll check that Using the bar is already X1 is N actuallyense. Can I take a step back? So yes on step three when the verifier requests know what is the prover is prover doesn't know what is but still g because share those values but does the verifier know the polifier should not be able to know the polomial very [Music] using these two powers of R in the I have I know G. Okay. So I know where G is.

How do I go from actually because you know the coefficient pro knows the coefficients. just like ECD prove or knows the coefficients. um in this case um so looking at number five right if you're thinking about using pairing to check equivalency of both sides um I'm assuming that's what we're doing we need to use pairing to check if they're equivalent right so in this case um will y1 and x1 be in um group two let's say um and because r we know everything associated with r is computed on group one or as in as in FR. So one one part of it probably SR and QR will be in group one, right? Mhm.

And then um I guess the question is in that equation what part of it is in group two and what part of it is in group one. So that we can do this pairing comparison. in this case. Next one. Yes, but they are scalar that we can put inside the proven.

Yeah, the proven R is here to be fair. FR is also a scaler question is is I guess we have only defined one group so actually it's a easy to understand if the group one and group two are same it's easy to understand because actually we actually don't uh need to separate group one group two but technically we should separate them but uh there's actually it doesn't matter that group one equals to group two when we think about that. So let's say that we have only group one group and only one target group. Okay. Right.

Yeah. because the property actually same. Anyway, I guess um even if you think about it in different groups, if you take the if you multiply QR into both um or both uh into the brackets, right? Um you can technically just separate it like separate either things into a group in a sense I guess. Yeah, we need to think.

So it will become E FR minus Y. So, E F R Y1 equals to E R QR X1, right? And you can just put one of them into, in this case, we can put the Y1 and X1 into the or X1 QR into a group two and then the first statement into group one cuz it doesn't matter. I mean, you're just checking equivalency. So I guess as long as you are doing this equivalency check and putting the first thing into group one and the second thing into group two, you should achieve the the result you want.

I guess um assuming every step until like everything you calculated it's not in a group. um we can put it in the group right by yeah in a way um if they are not in already in the group can I think about it like that actually I didn't get that exactly your point uh so so here we are not exactly saying that um what or what is in a group right so we are just trying to compare fr - y1 = r - x1 * qr. Mhm. So that that's the thing that we want to compare but we are not explicitly passing in like a generator with a with a specific um power or specific numbers of operation here at least on number five. Yeah.

So based on that what I understand is that we can choose selectively choose um what part of that we want to compute in group one or what part of that we want to compute in group two and just does do the equivalency check. Right. Yeah. And then in step two but actually it's pretty simple that there doesn't exist group two. can help you with step five.

We'll need a verifier step and why would a verifier that we have right actually uh the verifier is that anyone should be able to do that small rally we haven't used pairing adding those terms the same as so number five doesn't say if I do gives you that * ging that is the same as g when you add when you add those powers up is the polit [Music] okay let me let me actually go through Okay. Yeah, let's go. Go through Let me go through again. I I'm very sorry. Let me go through them again.

Okay. Okay. Okay. Ready? Okay.

I'm very sorry. ZK actually has a number uh that uh nine point uh 211 something. This is x1 and this is y1. Uh and we would love to let uh actually um before check this uh hey zk would you please make some commitment for your polomial? Okay.

Would you please? Okay. Please give me an evaluation uh at a random number R but I won't let you know exact random number are there. Instead of giving you a random number I'm going to give you a the random num the powers of the random number uh in the electric point or so. Okay, here's the generator and here are seven elliptic curve points.

And you should be able to compute G to the F of R because it's a G to the A 0 + A1 R + A2 R 2 + A6 R 6 and then you know it's something kind of this one Right? And you know you can compute these just like we did in ECDH because you if you know the coefficients if you know this coefficient value I already show these values. So you can you should be able to compute them using just like CDH. Okay. And then okay ZK gave me a commitment which is a 3 to the f of r.

Let's say this something kind of a uh looks like a elliptical point. This okay you gave me a commitment that I'm going to test you that actually this is actually in your polomial that I I I'm going to test that you are cheating on me or not by sharing this secret I mean sharing this point is on your polomial or not. This is what I want to do. So to test that because you have your polomial f ofx then if we subtract your polomial with the value you have shared with us that actually it will return zero. Let's say this polomial is p1 of x.

This pol we made a new polomial piece sub one of x and this polomial will return zero if we evaluate that at x1 which is nine. Does it make sense? Okay. So this is actually kind of a virtual polomial in our mind and then okay you then you need to uh create t1 of x by yourself. And then actually because uh it vanishes on x1 it should be able to express in a form of like this.

Does it make sense? Because it should have a factor with x minus x x of one right and then okay you should be able to comput this quotient polomial because you know the polomial because you have the coefficients then okay uh would you please give me the quotient polomial evaluated at small small random number R. So Ezeki should be able to give me a 3 to the cube of R. You're going to give me that. Okay.

Okay. Now, me as a verifier. I have this one. And actually, I have a uh this one. You also have the right.

You also have the R, right? I know the R. Yeah, you know the Yeah, I know the R. Yeah. Um and then let's check that actually Zuk is is cheating on me or not.

How to check? Okay, if if this is correct then I'm going to create another polomial P2 of X P2 of X P2 of X will look like this. This is actually me as a verifier. Actually I create a new polomial which looks like this and then I can compute substitute this one like r - x1 times like this but actually because I don't know exact value of this q of y I only knows the uh in the group form So I'm going to make this one. This is what I'm going to do.

Okay. Yeah, this is actually what I did. Uh and actually if ZK didn't cheat on me, this evaluation of P sub 2 of X at R should equal to P sub one of X and P sub one of X actually I can also make it like okay G to the P sub 1 + R should be G to the f minus y because z actually share this for the commitment and what I am doing. Okay, the evaluation of p1 and random number r should equal to evaluation of polom p2 at random number r. If they uh stay then it means that actually this exactly actually uh vanishes on x1 because zk should could be able to share the quotient polomial.

It means that okay it will vanish uh at x1 piece sub one this this one will vanish at x1 which means that f of x1 equals y. So we could prove that zk is not cheating on us. So this is something kind of a what what we did here. ZK would you please commit your polomial and actually I querying that would you please evaluate your polomial at 9 and give me the value evaluation value with a proof the proof here is a quotient polomial evaluation of the quotient polomial in a group form that's the proof simple so zk meta commitment for the polomial that Z has and I am calling that evaluation at a some value X1 and gave I got the number and then also got the proof and you can actually check this using pairing the P GCP one or equals GP2. Actually here what we need to visit is the security of this assumption.

Is there any some potential that uh ZK is actually sharing a some uh cheating value but still actually it satisfies the uh pairing equation. Actually if the size of the uh pair I mean the size of the group is small then actually there is exist some potential for example let's say that we have only three elliptical points that we have a one actually third of a random uh some potential possibility that z actually cheating on us but actually still uh satisfying this pairing condition. So this is called the soundness. The soundness is actually depends on the size of your group and uh one over the size of your group in this case is the actually no not exactly this. It depends on the degree of the polomial because actually here sharing a polomial and what is the potential that uh the polomial uh I mean that this p1 of x vanishes uh to zero because if this degree of this p sub one of x is six then we're going to have a how many roots do we have six roots right so we have a we can actually have a some chance to randomly uh pick a the root accidentally.

Then the soundness of this protocol is something like degree. If we say the degree is d then d over the actually it should be a kind of a uh field I mean the size of group should be the size same to the size of the field prime field of the scale field but let's say let's write this in this form So the things you should I mean it's not really up for you to pick right because the if you're making a commitment you need that many degrees to store that many numbers store that many numbers right like if I have I want to make a commitment that has that I want to commit six numbers then my poly number has to be at least seven Um actually if you have a polomial with a small degree then your polomial will get leaked pretty easily. So if but if you have a polomial with kind of a very large polomial it's okay to share some values. So it's okay for you is sharing d points for example. Oh yeah the polomial should be actually less than the degree of the the shared powers of the random mark.

So If you have that set then the number is then you know that it is small I mean the small of the polifi and then you know yeah so if the polomial yeah r should enough a degree of the random is there so Step five here. Step five. Uh now let's see the exact pairing equation here. Uh actually uh comes here because we know actually two different piece of piece of code And this is the piece of one. And this is the piece of two.

But actually we don't know exact piece of two. We only knows two one situation. But we can compute the result uh of this not in uh the field but in the target using par because it's kind of multiplication of the two uh field elements. So we should be able to compute the exact same thing in that we have this one and we have this one separately and we should be able to compute the multiplication of these things in terms of two. So this is why we um no it's something like a uh we visited a case that wants to check the shared key is exactly from Lisa.

So this is a and this is small this is small A this is small B but actually we know what the small A is but actually it's okay that small we only know the large A and we know large B but actually we can check that um this is a large K but actually this is small K but we should we only know the large K. We know large k large a large b. You can do the same thing what you have done with when car wants to check the hack. In this case the y1 value is still um only known by the prover or does the prover also provide why is publicly y1 is public? X1 or x1 and y1 is public.

Okay. Okay. And even we have R actually even if don't know what the R is we can actually uh comput because of that because we know that in the proport X1 and we to the R. Oh, okay. Because yeah, so we can still compute this uh in the group form.

So it becomes a large and anyway share the second thing the quotient the same thing you did. Yeah. It's the same. It's the same thing. So we are preparing two different polomials and checking these two polomials are equal by examine that at a random value or so.

So this is called the public coin protocol. Public coin protocol when actually pick a random. So public coin means that it's a kind of a creating a random number with a kind of a binary random stuffs. So if Wong actually flips the coin 254 times, we can create a 254 bits of a random number. So with the public public problem is that uh when I actually picks a random number by fl uh flipping a coin and then actually picks a random number r and using that random number we are examining that two different polomials are exactly a same polomial and the potential possibility that it's accidentally same is the degree t over size of the field and this is the this is called a super simple number.

What is this one sub protocol? Public coin protocol. Coin. Yes. Public coin protocol.

So actually those actually the terms are something you might heard of. So what we are sorry just on the previous slide the reason that R has R is tax R is actually chosen by verifier. But the mustation rat they can carefully select values to lie and make the equation that they can cheat from the step. Actually yeah that's a good question actually I I just forgot the step where we can cheat uh when we know the random number but uh the actually the scenario how to check that is that uh uh zk actually sharing a commitment first but if zk knows what the random r is then zk should be able to create a fake uh proof with a some some point which is not on the polomial and actually if ZK knows what R is actually he should be able to do that. Yeah actually we can if we just say uh rightations then we may find how to do that somewhere.

So because of that keeping R secret is pretty yeah these are something that you might coin protocol is that why Ren Kong is flipping coin creating a random number and checking the two different polomials at a at a random Random point is a public coin protocol and here the commitment what actually ZK shared with us the GTD FOR works as a random oracle. The random oracle is here that uh ZK should be able to make some commitment using the random public protocol from the public protocol and then it will be a reference that we can send some queries. So you can you can just understand Oracle is just kind of an API. So using the oracle we should be able to query something to that oracle in here the f of r gd f of r works as a oracle as a reference and then um when you query something evaluation and then zk will share the evaluation with the proof and the proof the possibility the soundness of the proof actually depends on the super probability. Yeah.

So super yeah what I explain here the number of roots and when you just pick some random number and it can be sometimes accidentally a root. Okay. Actually satisfies this situation. Yeah. So for example P sub one of X will look like this.

And P sub 2 of X will actually look like this. And then uh in X1 actually no this mean actually this is a case when the P1 and P2 are different. So this is kind of a fraud. Yeah, this is kind of a problem and actually when can pick a random number here and random number here but actually accidentally P1 and P2 are equal to each other. So that's what the supervis is.

Yeah, actually P1 and P2 should equal, right? But this is a case cheating P1 when the case P1 and P2 are different and when actually evaluating these P1 and P2 at a random number R here and in this case because the evaluation values are different. So we can know that oh this is cheating but for these roots it this there we have a six in intersections here then there is a possibility that we accidentally just pick these intersections for the random number. So the probability is missing something right. The probability of this if f of x1 is not uh you f yeah f of one x is not exactly y1.

Right. Yeah. Right. Yeah. I made a mist mistake there.

So it should be it's just missing one more statement of f of x1 is not equal to x1 is not y1 f of x1 is y1 then Yeah. Okay. And I think uh we have covered what the pairing based cryptography and what actually what the polomial commment is. Here this is the K polinomial commitment as we haven't covered the tri setup but yeah this is the one the case polomial and uh here the thing how we make it non-interactive is that I mean to prove the uh oracle query actually wcom needed to choose the random nons by the public protocol or but actually there exists a way to create a random number in a multi-arty computation set because uh let's think about the case when we the ECDH Ellis and Bob actually can make a shared key but they still don't know the more AB but they can compute the G to the AB right yeah this is actually how to do the multipartic computation then trust itself so how to how to do that is yeah actually initiated the public uh the trusty setup protocol so wcom sh G2D G and G to the R and G2D R² let's say this R1 actually when comes uh random number and then I participate in here and when actually doesn't share what the R r1 is and actually I using those uh the first set of the generators actually I'm going to to do. I'm going to make this one.

I can I can make this one because if I do this, I can I can just exponentiate that. I should be able to make this one. And actually I also will not share my random mark too with anyone. And then actually Adrian comes in and we're going to make this thing then actually if we do not share no one will know the what the small R1 R2 and small R3 is. So if you want to use this protocol in a safe way, just participating in it and then not sharing makes you safe.

Yeah, this is a kind of a making it a real a 100% trust setup for you. trust list set for you and if you don't participate in this setup then actually you are trusting others are not sharing and actually uh the potential that people some people actually know the uh what the R1 R2 R3 is that uh the multiplication potential that people are sharing their values. So if any of one is not sharing the value then we should be safe and if that is me 100% safe for me not for you but say for me at least because I didn't share that with people um okay we have covered the par bas and the KG and then let's try a bit of some break time to cool down our brain and try let's try to uh have the breakout session for this. Sure. Okay.

Oh yesa MLS signature aggregation and KG polinomial scheme. Mhm. This is what we're going to do. Okay, let's go. Okay.

Yeah. Maybe shall we start the breakout session from 3:30? Yeah. Sounds great. Yeah.

Let's take some uh fresh air.