Why ZKPs Will Be Key to Web3 User Experience with Evan Shapiro

All right, cool. Hey, thanks. Hey, everyone. So, I'll be talking about zero knowledge proofs and web 3 and Mina protocol. So, let's get into it.

I'm one of the co-founders of Mina. Currently, I'm CEO of the Mina Foundation. Here's what we're going to talk about. Uh, first, like I think it's good to just kind of zoom out for a second and just think about web 2, web 3. What is the advantages?

What are we bringing to the table here? Uh, we'll also then talk about zero knowledge proofs themselves. like what really is a zero knowledge proof? We've heard about them already today for ZKEVMs, but they're really a much more powerful general purpose uh cryptographic construction than just that. We'll talk about how you can start building with zero knowledge proofs and ZK apps uh in particularly Mina's architecture that makes that possible.

We'll talk about SnarkyJS, Mina's uh TypeScript programming language. It just is TypeScript. It's like a library for building ZK apps. And then we'll talk about where to learn more, including uh there's going to be a uh live coding with ZK apps and Snarky.js tomorrow uh here at 9:00 a.

m. So come back for that if you want to just start building with the stuff. More of an intro. So just zooming out for a second, I think it's like important to think about where we are today with web 2, what web 3 might be able to accomplish, where we were originally with web 1. And I I I think if we look at things like it's pretty clear like originally things were very kind of user centric, userowned but kind of ownorous because of that.

Uh and quickly that became a place where there was so much advantage for the user experience and the uh way to build out applications with building centralized products and services that that became web 2. And now we're in this place where okay, there was probably some some ways to improve on that. And we're back at web three where we can probably improve upon some of the centralized aspects of web two and make something that's more userowned and more user respecting and and different model for how we can build these kinds of applications in general. Uh there's like two particular properties that zero knowledge proofs are very important and related to uh both privacy and verified computation. So I think it's just going to take a second to like remember why these are useful.

If we want to build feature complete user respecting applications, we probably need privacy. There's lots of applications that want to work with sensitive data and you just can't build them without privacy. As well as lots of applications where you probably also just don't want to be exposing all that sensitive data uh because you want to respect users and you don't want to just put all their stuff out there for anyone to see as part of them using your application. We also have verified computation. We have this property of decentralization.

this property that everyone knows what's going on and can verify and can check and authenticate and you know make sure that the system is working as expected and for that verified computation becomes extremely important whether that's checking all the blocks in a blockchain or whether that's using something like zero knowledge proofs. So zero knowledge proofs. Um these are this cryptographic object that let you you know have a program and I can prove to you what the output of that program is without revealing all the details of the inputs that I gave to the program and with you being able to check the output very very quickly much faster often than if you had run the program yourself because we can make a proof of huge amounts of information and computation data and put that into a single quickly checkable proof. Uh so this has a lot of useful use cases. So you can build ZK roll-ups with this.

Both app specific CK rollups, ZK app chains and ZKVMs. You can do private transactions with this. You can do private voting with this. You can do private identity things with this. You can also just verify large computations in general.

ZKML is one thing where you can verify the outputs of large neural networks being explored right now in that domain. So there's all these kind of cool properties that you get um from these zero knowledge proofs and you can see these are pretty useful if you actually want to build a web3 application that uses privacy that has large amounts of compute. Uh by pulling in all these properties you get to be able to actually uh do those things. So I think it's also helpful to just like pause for a second and say what even is like like what is the API for zero knowledge proof? This is how I usually think about zero knowledge proofs like in kind of in the abstract is really they're just an API like it's the same as any other cryptographic object.

You have a hash function. You give it a string. It gives you another string that is hashed. You have public key signatures. It's a family of two functions.

Now you can sign something and you get a signature. You can then verify the signature actually came from the public key created with the private key that corresponds to that public key. uh zero knowledge proofs are just another you know kind of same idea in this set of ideas now we have three programs one you actually give a whole computer program to so you give you know in some form we're not going to go into in detail but in some mathematicized form your program and it compiles that into a fixed size verification string verification key you can then as a prover that if you run the program with a a set of public inputs and private inputs, the program outputs. Yeah, true. That was like, you know, called the program in a way that was valid and someone else can come along and then verify that if I was to have called that program with the public inputs and some hidden private inputs that I don't actually get to see, that it actually will verify to true that actually the program said that those were valid inputs and public and private inputs.

What's really cool about this is it does take a while to actually create the proof. Uh but you can often create the proofs in parallel using some techniques and then you can also uh verify in O of one like constant time. So I can make a proof of you know uh some like you know hundreds gigabytes of information uh many you know compute hours or days of compute and then you know you can check it in like a millisecond using this really quick verification technique that zero knowledge groups have. So that's like super cool on that side. And also you have these things on private inputs.

The program can say I want to make sure your private input is signed by this authority that I trust plus the number that was signed is greater than 18 showing that you are e older than 18. And the private input that you know my exact age doesn't make it into the proof that's being verified later. Peter goes to sleep. Um but uh still as a verifier you know that that was actually part of the private input that you actually the private input was greater than 18. So I I think if you're like programming with this is like a good mental model to have in mind for what's actually going on.

Uh so Mina is this layer one that is built on zero knowledge proofs. It has a couple cool things about that. For one um the smart contract language is zero knowledge proofs. uh everything you make in the smart contracting language is always being compiled down to a zero knowledge proof and because of that the programming language for it sankjs has a native functionality for privacy native functionality for large amounts of compute and other properties like recursion we'll go into in a second also has this property that the whole thing is a zero knowledge proof uh in that every time um a block is added to Mina really what's happening is it's updating a zero knowledge proof of Mina. And so you can actually verify all of Mina consensus information and uh the actual uh transactions including smart contracts in a single zero knowledge proof that's very very small and easy to check.

This has a couple cool outcomes. For one, it means that you can verify Mina on phones and browsers wherever as you would with a full node but in only a few kilobytes of information. But also uh it means that we have very good interoperability with other chains because you can then verify Mina inside of a smart contract running on another platform and there's a lot of work going on right now to put that Mina proof on top of EVM on Ethereum in particular so that you can program with ZK apps and get access to the private privacy and the verifiability technology and then bring that over to Ethereum. So if you're building a web3 application on Ethereum, you can still get access to native privacy and uh scalable verifiability through zero knowledge proofs on Mina uh through this like very secure bridging some more like kind of dive in the details on these things. Uh so ZK apps are just Mina's smart contracts.

Uh we have an example on the top right that just is TypeScript, but it's an example that uh you know uh is going to get compiled down to a lot of cryptographic um to a cryptographic proof that then will correspond to a verification key for the program. Uh it's general purpose. This isn't just like ZKVM. You could build a virtual machine using this technology, but it's really a kind of a step back to doing general purpose things with zero knowledge proofs like privacy, like scalable verification. It's also all written in Typescript, which is very cool.

uh it's not like typescript like it just is typescript you can uh stick with all the tooling you like all your you know it has really good visual studio we'll go through later um as well as npm and all the that stuff and so you know it's it's very easy to get started with and use it also this is a little under the hood but it has full support for zero knowledge proof recursion and composability uh these are like kind of more advanced features of zero knowledge proofs in these kinds of systems but the way the munic system is designed is that you can have zero knowledge proofs that verify each key to both how Mina itself is uh succinct and easy to verify but also very useful if you're trying to build a ZK rollup or construct a lot of proofs in parallel that then uh get merged up together and you can uh achieve some cool scalability properties that way. It's also powered by uh this this open source uh proof system that o labs one of the mina mina proto ecosystem companies have developed called kimchi which is like a very powerful proof system in general. So I mentioned before in this briefly what Mina's doing is every time you make a block it updates a recursive zero knowledge proof that says the previous blockchain was valid and when I add on this new block the uh new transition information matches the correct program it's supposed to and it matches you know it verifies out with all the inputs and outputs match up all the consensus information is correct etc and uh extends the blockchain that way while still the proof itself is is very small and succinct and size, but it goes back all the way to Genesis through the recursion. And yeah, it gives you this phone verifiability on both phones and browsers. And it also gives you this very secure ZK bridging, which is cool because then you can do the ZK app thing I mentioned earlier.

Okay, so let's dive in a little bit deeper now to Mina and ZK apps. So first like let's just like take a look at what even EVM is doing on Ethereum. You have some EVM code. It lives on chain. It has some gas associated with it.

you call that function and all the nodes on the Ethereum network evaluate calling that EVM code with the input you gave it. So this is every node of the network runs the function which means you have gas which means that because you have to actually share the information it's not necessarily private. Alternatively, uh what ZK apps does is you instead share a proof of a zero knowledge proof program and then all the nodes on the network don't actually run that program. They just check to make sure that what you've provided, the proof you've provided verifies with respect to the verification key on chain that you are attempting to call. So this is pretty cool because again you have that privacy property.

uh your proof can hide in pieces of information about the underlying program call you made. There's no gas because the proofs are the same size check every single time. You get composability so you can have like atomic transactions where ZK apps are all calling each other. And we have uh some cool scaling properties because you can construct these ZK roll-ups in parallel uh to the main chain and then commit the results of those ZK rollups back. And it's all very you don't have to be a cryptographer to like do that.

You just use the TypeScript language to build your ZK rollup. Uh, and you also get this cool interoperability. We want Mina's zero knowledge proofs to be something that is useful and available to Ethereum and is able to like be something that people that are building awesome applications can then pull in all this great privacy and scale verification stuff when they're building their application. Uh, it's not yet, but there's a tutorial going on on exactly how to do that so that uh to make it super easy to to do crosschain stuff. Uh, so here's like a very simple proof of what you can do with this.

It's like very specific. Let's say I prove I want to have greater than $100 on bank account uh and I don't want to reveal the exact amount or any other information about me. I can then construct a proof and that proof can be brought on chain to Mina and check to make sure it verifies respect to the verification key of the program that's actually doing the logic around this check and then that can be bridged then to other chains like Ethereum. So you kind of saw this before in the coding part of the API part I showed earlier. But really when you write in snarkyjs which is this programming language of typescript I mentioned compiles into two artifacts.

For one is a prover function uh which you run locally on your own device. You know I run it on my phone that like regenerates a proof and then a verification key and this is what gets stored on chain verifies the correctness of the execution of that uh proof. uh when you deploy a smart contract to Mina, what you're really doing is you're putting a verification key on chain which says ah so the account that you've attached this verification key to now you can only uh update that uh ZKOP account if you provide proofs which pass with respect to the verification key. The moment you've done this now things are all connected up and uh you can only update the account if verification key gets valid proofs. Uh so yeah, you can set these transactions to Mina and Mina will check if they're valid or invalid.

Um little more detail here on this smart contract methods on Mina work as follows. You pass in method arguments, contract state, some values from the state of the worlds and the outputs are updates to the state of the worlds and the state of the smart contract. Uh and the uh Mina itself is checking to make sure things match up. for example, the state of the smart contract is what it's supposed to be going into when the proof is submitted to the network before the update is made. Uh it's also just normal TypeScript code.

So when you write, you know, your UI code in React or whatever and just import uh the logic for your ZK app and you can even code them all in the same same project, same, you know, compilation environment and import things back and forth from each other. uh very convenient for when you're building a you know a UI that lives in a browser on a phone or whatever. It's all part of the same uh sim programming experience on snarkyjs. I mentioned some things about this so this should make sense. It's TypeScript library.

It's a smart contract language from Mina. Uh everything is in Typescript as I mentioned. So you get all these awesome tools that you're used to using uh just available. It's not some new programming language, new semantics or whatever. It's just stuff you're used to using.

It's also very easy to learn. I don't know how easy this actually looks, but this is an example of fully recursive zero knowledge proofs that you could use to build a recursive ZK rollup, for example, in Typescript. And you notice that like, you know, you don't you don't have to define a bunch of like cryptographic objects and understand the implementation details of things. You get access to like the abstraction of of great I have these proofs. I want to verify them.

I want to produce new proofs. I want to assert things in those proofs and I want to uh then verify the outputs of those proofs. So this is this isn't like pseudo code. This is just literally what it looks like for building a in this case a recursive zero knowledge proof which produces proofs that a um a uh a number is from a valid Fibonacci sequence where you can check that in O of one instead of having to actually go back and compute the Fibonacci sequence to get to like the nth uh nth number. It's also very powerful.

So um you know I mentioned things like recursion but the underlying proof system itself also is like uh has a lot of other bells and whistles you know besides being easy to to use the whole thing is a trustless setup. So there's no there's no trusted setup it's all trustless uh there's also like a a very cool uh property around how you can kind of plug in new low-level primitives into how the proof system works kind of on the fly dynamically. I think I think there's like a metaphor ZK CPU we're playing with that uh uh recently there's like a blog post on that describes more how you can kind of just add new components that are very fast and efficient uh and ZK native onto this thing uh through the way the proof system is designed live which I think is you know it's like super cool um and yeah so we'll take some questions here's some places to learn more uh this is a link to like a hello world tutorial where like you will go through building a um ZK app using SnarkyJS from scratch. And here's also a link to ZK Ignite cohort one. Like ZK apps, all this stuff, zero knowledge proofs unlock so much new ways of building things.

New ways of building ZK rollups, new ways of building with privacy, new ways of building web 3 applications. We're currently running this like 12week long um uh like cohort where people are thinking of ideas, they're collaborating uh and there's a funding there's funding opportunities at the end. there's like good VC involvement to help get projects funded uh that are looking for that at the end of this. Uh so check this out if you're interested in learning more about what ideas people are thinking of building with zero knowledge proofs as well as like collaborating in a community that's that's starting to think about okay what does it look like to actually deploy some of this stuff into the real world with real applications and as I mentioned at the beginning of the talk back here at 9:00 a.m.

we will be live coding with zero knowledge proofs in SnarkyJS. So if you just want to come and join and and see what it's like to build with some of this stuff with zero knowledge proofs with Typescript, uh that's going to be here tomorrow. So come back for that. And with that, I think I have one minute left and I will take questions if anyone has any. I think that is okay, right?

Yeah. Okay. So one minute. Anyone has questions? Hi, thanks for the presentation.

I'm I'm just curious in in terms of gaming, what kind of use cases or applications for gaming you've seen people working inside Mina or that you would like to see? Yeah. So, so there's actually a couple particular cool ones here. I I think one is fully verifiable private poker. um where if you have online poker, you have this question of someone is seeing the full state of this game and they could potentially be using that.

The person running the server could be using that to um you know communicate with someone on the side and effectively cheat on an online poker game with zero knowledge proofs. I think there's some work being done experimenting on this also. Um you can build fully verifiable private um poker so you can avoid uh you know that kind of dynamic in things like online poker. So that's at least one. There's a bunch of other ones, but yeah, good question.

Thanks. And I think that's it also on time. So, thanks everyone and uh we'll see you all later in the conference. Bye.