EthCC 2: Zachary Williamson

all right how everyone I think we're ready to start see ya hello thanks so much for such a wonderful privilege to be able to present this the asset protocol basically hi I'm Zack and we are a privacy solution for theorem I have to say it has been an absolutely wonderful conference and it is so exciting to see so many actual real-world implementations of zero logic cryptography based applications on aetherium I think that one of the one of the key critical things that has to happen for a three overcome some of its scaling problems in the short in the in the short and medium term is application specific effectively side-chains and coded up as as either case not because okay Stark based crypto systems and it is fantastic to see some of that work actually yeah being implemented is wonderful to see so I want to I start I just want to make us less like this disambiguation between scaling solutions and privacy assic is a privacy provider so we are enabling confidential transactions transfers of value on the theorem mania as a layer one solution and we are not focusing on scaling and so I this talk is really about about privacy so yes I'm just gonna give a little bit about kind of what is aztec how does it do what it does and what are some other kind of the problems I think is this this are our industry faces in actually delivering into the hands or Vella pers and consumers workable practical privacy or main net with the infrastructure that we have today and then just go over a little bit about how implementation what our roadmap is and how are you how to get working with a Sutekh today because this is not some kind of theoretical planned solution this has been working since November and if you if you want you can cut up a confidence also can using our spec today and deploy it on domain nodes so private transactions on aetherium it seems like a little bit of a bit of a an oxymoron it's kind of like having your cake and eating it how can we benefit from the consensus guarantees of the public a theorem network and the liquidity advantages of it being a universal and kind of settlements platform while still enjoying privacy that we get either from traditional web to type services or from private blockchains it seems a little bit impossible because obviously if you want to every single theorem know to validate the integrity of the state of a Sirians blockchain and then how on earth she heats none of that state private and hidden from these validators so this can be done through the rather esoteric branch of mathematics known as zero knowledge cryptography sir can I can I get a show of hands for Piggott here this herd is Iran's cryptography that's fantastic yeah like normally like two people it's brilliant so yes you can use your logical talk of peace privacy but there is an enormous gap between the vision and the reality because a theory I'm already today has massive UX problems which were like moats the people here are familiar with and once you start to add advanced highly kind of custom bleeding-edge cryptography onto the ends of the mix then it presents a massive massive problems they're hard to use they present a massive they present difficulties with like managing new private keys and new new secrets construction these proofs verifying them broadcasting them it's it's really quite it's it's a massive challenge and how do we actually bridge the gap between technical vision and reality how do we get privacy on main net today with the tools that we have and with the technology that we have and so this is what I think are kind of some building blocks for a confidential ecosystem it like if we want if you want confidential digital assets to be a reality on ethereum where it is a an actual we're developers builders people like people in this in this in this in this audience chamber can actually code up confidential bit of assets and deploy them as easily as you would deploy any other twenty second what has to happen and I think I'll just go through this list basically I think this is something which is going to become more more relevant and more apparent as that customizable confidential transaction semantics are going to be an absolute necessity for private digital assets the reason why we're all here the reason why a theorem is that a powerful technology is because its designers did not try and envision all of the potential use cases for a theorem instead because of the because of a smart contract platform we developers builders can decide how we act we can add value using a blockchain and that flexibility must be extended in in in the realm of privacy if I'm building a like a private version of a token or I can creating like a financial summit like a private loan or a bond I must be able to define my my my asset semantics like any all the edge cases an extra little bits of logic that I needed to actually fought for for my for me to be for my transaction to be legitimate I need to be able to customize that in the same way that I can customize in the RC 20 token confidential assets also need interoperability with one another it's it's it's one thing to be able to create like a private representation of you know of an asset of a token and send that around privately so that nobody can see what was like the value that I'm sending these two people or how much I hold but one of the theorem strings is that a settlement platform it's it's the fact that we can settle trades between different cattle buyers in different assets like a pretty much immediately and so if you're creating some kind of framework for private digital assets you also need to you need interoperability you should be able to build zero knowledge gaps that can interact with zero knowledge assets and set of instructions and the same way that you can send an EOC 20 token instruction and I think obviously this is obviously relevant like the felt developer friendly tooling like right now zero illogical photography is really bears entry are absolutely massive you have to be extremely literate in this stuff you have to know the intricacies about how it's like to construct a zero knowledge proof about that either constraint systems as how inside how is that case not works and how to how to minimize the number of constraints you need to have this enormous like corpus of knowledge which is not sustainable in in in the medium term or long term because it massively and does adoption I think I like if if if if a sec if it fills this mandate everybody in this audience chamber should be able to like this time next year be able to very easily very efficiently spin up confidential assets without having to know anything about cryptography or really how it works under the hood and finally you need extremely proof construction of verification this is more relevant for layer one solutions that obviously like validate verifying zero knowledge cryptography is cost a ton of gas and if you're if you're zeros crews aren't extremely efficient then it is quickly unworkable given the scale given the given the throughput constraints of block chains today and also proof of construction is a problem I mean on the small end of the scale that can present a UX challenges you have to wait several it's like a few seconds the constructor proof and consume if you kinds of gigabytes of RAM but on there on that on the top end it's like some of the problems that we experience him as ok snarks is that if you want to define any kind of meaningful complicated piece of logic the actually construct proofs for the stock circuits just starts to blow through the roof and so for private internal assets as a layer one solution you need extremely proficient proof construction and verification ideally so that you can actually construct this proofs on a like on the hardware wallet and so with that in mind that's what those were kind of the the the considerations that I had when I developed what became the as a protocol a method of basically dump of it's not a general-purpose protocol food-like general-purpose computation it's quite specific it's for private transactions if resettling private transactions and so we use some very very bespoke custom grade like cryptography tailored for a specific use case to do this and the result of that is extremely efficient to verify and it's extremely efficient to construct these proofs we use like a bespoke encryption function that integrates the extremist vision range proof if you people familiar with the space what kind of range proofs are kind of one of the Achilles heels of xenon script geography if you want to do anything meaningful in a holomorphic in crypto system you need range proofs and they need to be efficient to verify otherwise your verification code courses start to blow up and the second part of it is that we use zero knowledge based signal protocols so these are kind of a signal protocols that are a slightly older tech then a lot of the other like zero knowledge improving systems out there and yeah it's kind of a bit out of favor recently but for the kind of stuff that we're trying to do through very simple statements you know I want to send Bob or Alice you know 50 died and I don't want them to see how much I'm sending assuming protocols are extremely efficient and they work extremely well for poutine because they really because I'll go into and win it interoperate promote interoperability between different different assets because they don't have different digital assets and so in order to have so have problems trusting one another because they don't have to like make assumptions about how that how these these assets their trust to set off so Ron and I go to that in a bit basically at the core of a Sutekh how do we actually put in Abel confidential transactions today is the joint split transaction so this is somewhat similar to how Z cash transfers value confidentially essentially we represent value as X to type objects like in Bitcoin not like how a theorem represents like ownership balances the idea being you can take ERC 20 tokens and through ours here a lot of protocol you can convert them into a stick as your knowledge notes and that note will contain will be continuing an encrypted value and that value is a claim on the tokens that you deposited um and you can combine these notes around you can split them up together make them bigger make them smaller and obviously you can they can have different owners and that's how you send fattie if I want to send somebody if I have like 100 zeros Dino just in 70 50 I take my note I split it into two notes about 50 and give the give one to my to the recipients and I can prove in zero knowledge that the sum of the values of the output notes equals as sum of the values of the impedance it's really basic logic but that's that's all you need to make confidential transactions of reality because if you can make that if you can prove that that that kind of that balancing relationship then the smart contract is verifying the legitimacy of this transit doesn't need to know what's inside those notes and that's how we like encrypt value and enable encrypted value transfers so on Shane what you see in a note is it has an ethereal address of its owner it has a public key and some metadata that that can be used by its owner to recover the the viewing key and decrypt the note and the private ace is obviously the stuff you don't broadcast only one is the note value its viewing key no spending key we made a very deliberate choice to split split apart viewing in spending keys because it means that you can give viewing keys to people for example like institutions like an auditor or regulator if you need to you can also give your viewing keys to relays third-party services that can construct zero-knowledge proofs on your behalf but they don't have any kind of privileges or permissions to spend any of the notes that you're giving them you in keys to and so yeah that's that's our the fundamentally like the crux of how we how we represent value how we transfer it around we just just to make something like unambiguously clear what a stick does is it's it's enables me to send somebody some value where nobody knows what's like the actual values being transferred and values that ownership values are encrypted the owners of a stick notes this normally is not hidden and the existence of a nasty note is not hidden so we did this very deliberately to promotes interoperability between different assets it makes it a lot easier to create like a confidential token standard where like multiple confidential tokens can actually track with one other because if the notes are kind of in the clear like if you if you actually if these contracts actually knew about the existence of other notes then it makes it a lot easier developer logic we also add anonymously into the essay protocol by a with using a stuff that just protocol I think it was originally developed by Manero and effectively using a self-addressed wallets you can you can generate accounts etherium addresses and accounts that are completely unlink people or untraceable to any other like aunty an identity and if somebody if I want to send somebody some value confidentially and I know that person has a stuff wallet I can use the kind of the public keys from that wallet stuff for them in a non interactive manner derive an ethereal account that only they have the private key for and so that's that that's how we an anonymity into a stick so um this is this is uh mathematics basically I want to very briefly go into some of the mathematics behind how Isaac does the stuff that it does and so I'm I am I apologize so much in advance to some people if if this gets a little bit too easy to check but I think it's quite important because what we claim is quite you know is quite a big thing basically we have an extremely efficient range proof the whole reason why a sec is efficient to verify is because of this magical range proof how the hell do we have an efficient range proof this has been kind of in a kit like something that's been intensely sought after for a while and traditional ways of doing a range proof like proving that your number smaller than another number is you decompose your number into bits basically if you want a 32-bit number you have 32 like encrypted representations of bits and you send a zero almost proof there every single bit is either one or zero and then you combine them all together and there are like multiple ways of making this a lot more efficient but the proofs is one of them which makes but the proof sizes of logarithmic but it's still an extremely like a computationally intensive thing to do so how do you how do we how do we how do we actually create range proofs well the answer to that is we don't recreate lazy range proofs effectively when you send in a sec transaction that requires a range proof you don't prove that you have satisfied like that a number that you have is within a within a relevant range all you do is you prove that somebody else has already validated that effectively we ever tries to set up where a set of signatures are created these called born and Boyer signatures where Y is the trust a set of toxic waste and this K value here is is the kind of the one of the integers that is tolerated within our range so you have one signature power interested in the range and you can use these signatures to create commitments like a pedis equipment like a like a basic encrypt it's a basic encryption function where you can encrypt an integer and simultaneously it prove that whatever integer you have it was signed by by the treasure set up and so yes and so basically what we can what we can use do with that is there are a lot like there are also Sigma protocols out there like zeroes proofs that prove really interesting relationships that are quite useful but the problem is they all don't have range proofs and therefore that kind of use useless for for like setup like for variance purposes but you can basically take these Sigma protocols as they are I don't do anything else with them and basically just tack on this like little extra step using our using our asset commitment function and validate any range we if you want so I'm you know what you know what maybe that's a little bit too I'll go back to the nature of people what people want to go through it basic and that basically yeah ah we spent a lot of time trying to develop a sales protocol that was tailored for the current weaknesses of etherium this this commitment function the use of range proofs this higher zeros protocol that we put together was designed specifically for aetherium for the limitations that we have how can we make a proof extremely efficient to verify and then how can we actually give people that customizability I mentioned at the start this um this whole like a customized what competition a second semantics so I was talking about this this thing called the join split transaction but that doesn't look very customizable isn't every custom but the thing about Sigma protocols is I mentioned that trust is set up at the start but you can create an a multitude of single protocols that prove different things like they can have nice logic that you might need for certain kinds of assets so for example if I'm trait if I'm you might want to have traders prove that they don't they have they own less than 10% of the assets total supply for regulatory reasons you might have an interest-bearing asset that you're 3% per quarter and you need to give your consumers a way of claiming that interest in zero knowledge they don't really owe their holdings these are all zero knowledge proof um custom bespoke siRNAs proofs that we've created specifically for the kind of statements that you need when dealing with financial instruments and financial assets and the valuable thing about Sigma protocol like what we're doing with them is you don't need to perform any other additional and extra trusted setups you can you can keep continuously add and develop extra proofs that that prove more more elaborate or more interesting and more like niche statements depending on what use cases arrive and you don't need to do any kind of like extra work where the set up which means that you don't have any problems with having to get existing consumers to trust some liked if you want to extend the protocol you don't need you don't need to kind of ask your consumers to trust you as you perform another trust setup where you perform your you generate some other extra secrets and it's this flexibility and extensibility which I think makes you have protocols so quite useful today and yeah because are the the statements aren't particularly expressive because it solves is basically around value transfer they're quite simple they're really efficient to construct proofs I haven't actually run any benchmarks because the proof constructions on the order of like milliseconds has really not been a meet being relevant and similarly proof verification is extraordinarily efficient it costs at the moment today with current gas schedules of costs about 800,000 gas to verify an Aztek confidential transfer so if you want to use the asset protocol to send somebody is some value confidentially it'll run you 800,000 gas which is which is enormously if efficient when compared to some of the some of the other ways of creating this kind of system and with planned protocol upgrades coming in the near future hopefully with some VIP is to reduce the costs of these pre-compose smart contracts that'll drops about 200,000 gas and then that's actually like really starts to become something it can be used on quite a regular basis for a large number of use cases and I think that is what is so powerful about what about like private transactions in general is that once they once the gas costs for performing these kinds of transactions falls below like like a threshold where they're where where where they can be commonplace then it enables an enormous number of use cases for on a theorem that currently can't exist because you you can't be competitive with like traditional financial systems where people expect privacy by default if you can't provide privacy I'm so this is a kind of how it all fits together imagine you have some ERC 20 tokens you want to compare them internets you user interfaces in IPS to construct some mastic zero-knowledge notes that are equal to the amount of tokens you're binding and then you construct this joint split transaction where basically you say hey look I have some alpha notes and I have some input tokens and I want to prove to you that these happen is equal that like they're some of the upper notes equal to tokens are putting in the more you can also add extra notes into these kind of transactions if you already have some which help solve this case things in a greater privacy and kind of complicate the transaction graph obviously this does this review a bit of information everybody can see what you're putting in they just can't see what you're getting out and so once you actually you use the the privacy benefits that you enjoy stuff and multiply significantly once you start trading and transfer notes inside the inside this crypto system and then yeah if you want sir if you want to send somebody some value you just assign another user to earn one of these notes using you have a like a secret sharing protocol which means you can very easily construct you in keys for these people for these people without having to actually transfer any secrets secrets around and yeah I might this should probably mean Penix are going to in a bit but basically if you actually this is um if you actually want to use this stuff we have some local JavaScript libraries that you can run attach to construct these proofs and a list of deploy smart contracts which you can use to actually perform the verification of this stuff this is all culminating on what recording the Aztek cryptography engine so private transactions in general like I've talked about modular proofs and being able to use difference here in large protocols blah blah blah but how does this all fit together because like if you want if I if somebody here wants to create like a zero knowledge version of any RC 20 token they shouldn't have to be intimately familiar with like modular pre-construction or any other stances so what we are creating is this Aztec cryptography engine it is a suite of smart contracts whose job it is is to validate our family of zero knowledge proof and and essentially converts the signals proofs into you into instructions for for digital assets that subscribe to the cryptography engine so if you give one of the if you give this a proof to valid it'll say okay yes this proof is valid you need to destroy these notes you need to make these notes and you need to probably omit this event you know and here you go and so this is kind of the version of one of our proof family we have a lot more on the boil but we kind of want to focus the core stuff first to just get this out into production the basic transaction a bilateral swap if you want to do trading between two different two different zero knowledge assets dividend computation if you want to if you want to validate that like one note is a percentage of nama notes for interest repayments or things like that there's some range groups because they're really efficient and cheap to do using a stick and they're quite quite they're quite useful if you do two reasons you might want to add some range proofs for some custom logic that you have in just my contract and so the idea is using that you don't have to know what goes on under the hood for these inside these proofs you can just use them you can use your own interface and go okay if I'm building some kind of weird confidential asset with some some custom stuff I can I need a joint split transaction and then on top of that I want to be doing computations and I want maybe some range groups and then it's constructing interfaces to actually like validate all of this is extremely easy because you'd have to understand anything about what's actually going on inside under the hood that's the logic at least and so this is all common alighted in ERC or 170 for this is a confidential token standard for zero knowledge assets it has an ER C 20 in like interface so hopefully it should we we designed it purposefully to be quite like familiar intuitive to developers and if you construct any RC 1724 SS then according to this interfaces compared with all the other ERC's 24s so if you have some zero knowledge stamps that interface with the standard then you also can will by default be compatible just like with the RC 20 tokens and so this thing is a laser pointer doesn't it mmm I'm gonna turn things off by a so yeah so the kind of the crux of what's going on here is this company from transfer method and there's confidential transfer front method you can see we've kind of deliberately abstracted away all the generals proofs office this one bytes arguments are AP ice will construct for you and it's this this this method competitive transfer from which is not I think apparent it's not intuitively apparent why why that method is so valuable because normally with this journalist proof they have to obviously be custom-made by by humans because they require knowledge of secrets however it is absolutely imperative I think for any kind of system of confidential settlements that other smart contracts can trigger transfers on behalf of users I mean one simple example would be an escrow account that only an axe a trade of certain conditions have met another one would be a decentralized confidential exchange there only fulfills orders if certain conditions would be met and so by providing this interface we actually enable other smart contracts to do that zero-knowledge snaps or if they're in today and we're trying to create an ecosystem of dams basically it's focused around constructing private digital assets that can all trade with one another that we'll understand each other's kind of like those emails proofs that are going on and that they all subscribe to the same cryptography engine to validate those Iran's proofs and this is really the crux of why this system is workable on aetherium on main net today and that's because all of these gaps and all these assets that are all using they're all require the like a time journalist briefs they all query the same engine to validate proofs and so this is important because a lot of generals proofs that we have are kind of super sets of other proofs so imagine that zero knowledge Knapp is a confidential decentralized exchange it needs using our bilateral swap proofs it can it can it can validate that an order is received as legitimate if there needs to send confidential is instructions to the to assets is trading it says you know you need to make these notes and destroy these other notes get to it please but these assets they have no clue about that that's decayed app contract they can't trust it if this thing gives them an extraction how do they know it's legitimate so normally those assets those ekr c 20s would have to have they they would require their own zero knowledge proof like to validate their own transaction semantics and so to have this network of one zero knowledge adapt issuing like a trade against you asses he would need to validate three zero knowledge groups and traditionally like that could like I could raise e blue to the block less service however the cryptography engine knows full well that that bilateral swap proof I mentioned already satisfies that kind of the balancing relationships that are that are required in that inside the joint split type transaction and so if these ekr c twenty contracts they can query the sensually go hey i was given an instruction by the staff since it validated this weird proof like is this instruction legitimate and the co-creation can just go yes it is I've already did it get to it and it doesn't you don't need to perform any additional redundant computation this is this kind of sharing of relevant zero knowledge proof which makes it so efficient this kind of trading system where transaction could easily normally like blow you through the block gas limit if you wanted to do this all in zero knowledge this costs about like what 800,000 gas for this entire interaction at least in the like in the context of validation that cryptography not for like changing state variables but that's like exceptionally efficient and I mean it's workable today and so this is combinations to to ie IPS that when I mentioned before with the confidential asset and another one which is the just the specification for our cryptography engine because we you are cryptography that we've developed uses as tech notes but we try to make it quite generic so if you want to let you use other kind of journals proving mechanisms to make a cryptography engine you can it's just that we picked I say because it's the for our purposes it's the most efficient and so this is not some plans imagine future technology it's it's it's working today we deployed 0 and launched version of the die token in November and started trading it around confidentially and we've been kind of iterating and develop and developing the ever since right now our focus is on providing the high quality tooling and resources that developers need to actually make confidential tokens and so yes we have a kind of a medium some some blog posts written by my colleague Paul and actually how to how to actually today build the confidential token on a theory I'm using our technology so you can do that right now if you want to we've also partnering with some some other some other like protocol providers and developers so probably partnering with Republic protocol to help settle their trades in their dark pool I think this is going to become more of a relevant problem if you're building some kind of scale side chain or scanning solution that is that values privacy that that has previously integrated inside of its well what happens when you need to resolve your trays with the main net because the main it is going to be the ultimate record of value if that's all public then you aren't a privacy preserving solution and so but however what we do what we need is that you can you can settle confidential trades and confidential interactions happening within some kind of side chain or dog pool you can settle them confidence with your main net with a spec and and label your privates like your private little side chain to like extend its privacy guarantees to maintenance so this is all conversing you're not a sec mono Reaper so the packages that we had there publishes NPM modules for asset to J's for our JavaScript pre-construction libraries and our protocol module for template templates of smart contracts so templates of EOS each was EKU 20 tokens that can be a great confidential access and so yeah that's kind of a state of play at the moment this is our roadmap for version want me to the full release of a stick what's really on our plate at the moment is we want to release our MVP choreography engine with all of it all the bells and whistles thrown onto it and the complete ask like up complete proof construction API now we've integrated three proofs we have a couple more we want to add in before we consider that ready we also are implementing our trust to set up multi-party computation so I mentioned before we do have a trust to set up however it's extremely similar to Z cache where and their powers of tau ceremony where it can have multiple participants and if any like hundreds of participants that can scale indefinitely and if any one participants acts honestly only one of the maximum listening destroys their toxic waste then the entire protocol is secured under conventional discrete logarithm assumptions and so this trust said it was actually it's so similar to Z cache that it's like we require the same source and setup that as a case knock based solutions or theorem requires so I think there's that yeah this is all like the this this multi-party computation is already kind of being in the works from other from other protocol providers and something that we we'd like to get them often and also form a verification of a smart consciously think of that or a need or use case before making verification this would be it this is highly custom bespoke zero-knowledge cryptography and we've formally proven mathematically that the protocols are sound so you can't fake a proof but we also want to extend that guarantee to four but to prove that our code is a faithful expression of the mathematics that we've created and then after and we're slated for a production grave release in q3 we do need our SSL are finished with before we can really move into production and actually tell people yes you can use this on like all of us on mania today we also we have this our ecosystems deployed on to test nets if you want to actually start like developing this stuff and taking and working with it and then we want to focus quite heavily on integrations and zoodles words one final thing so I know it's been quite a quite a long has it been one second yeah we have one of the focuses of Astec has been well we want we want acetate working today there are a lot of planned and slated protocol improvements to a series that will make one work a lot easier there what makes your ins cryptography or easier but as developers on top of aetherium we have limited agency over how quickly those improvements get integrated into the protocol and so we want to focus on what what can you do today to make this all faster to make this all cheaper and so what one of this one of these one of our side projects is a combination in something we call via strudel because it performs elliptic curve with MIT to control how Strasse curves specifically there's a case not curve so what about the precompose this is a smart contract but it is quite substantially more gas efficient and then the pre-compiled smart contract you normally traditionally have to use for them to curve multiplication so it's going to reduce our verification costs by 20% but any kind of crypto system that uses that curve can benefit from this and so we plan to kind of roll this out a bit more and distributed a bit more widely so that's really it for my presentation thank you so much for listening and it's been a real pleasure very happy to answer any questions [Applause] yeah thank you very for assault can you compare your decisions with other in other ways to do this for example let do start where or with yeah of course so what what we wanted to focus on with a sec was crushing down the cost of verifying an individual zero knowledge proof because a lot of other solutions so for example stock where and Zig it's not based solutions they are most best suited for batching validating a large batch of transactions with Zeki snarks you kind of you have one issue is like when the second sack trust a setup involved but unless you use a sonic stars like a stock you need and what like one different if you have customizable semantics you need one setup for each asset and then they all can't really intuitively trust each other and you can't have that kind of cooped ography engine strike which will like validate like a set of proofs and ever have assets that can intuitively trust those proofs so that's why we couldn't really use as a case not because it stands as sonic let me straight up wasn't around when we developed this and it's also again it's much it's much better for bash for additional transactions because it's quite expensive divided into single proof similarly with stocks they're kind of the size of a stark proof is logarithmic with their like kind of the number of constraints in the stocks at Starks Eckert so you wouldn't want to use as a case start to validate a single proof the reason we didn't focus on batch validation was because we wanted those customizable semantics we wanted people to be able to adjust like what they consider to be a valid like transfer for therefore that confidential assets and so we couldn't use batch validation techniques the other alternatives were bullet proof which is being implemented by Dan the bonus you my thing and people buy ins ether which is not usable at police just purely because of verification costs there are proofs are they're the size of a bullet proof is logarithmic with this but with the like the amount of kind of complexity in its proof statement but the amount of computation you still have to do is linear and so if you want to validate a bullet-proof range for 32-bit integer I think I might be might be I might be wrong and some of the numbers say but I think it cost about 64 scalar multiplications there are some ways of speeding it up but ultimately you never it's always going to be like 40 messages today that's always going to be a bit too expensive and so yeah that's kind of I think that's a bit of an overview well thank you very much for this brilliant presentation I already appreciate it so my question is what if I were if I understood well Aztec are not intended to be like generic DK piece there are do you hear me now yeah yeah well Aztec are not intended to be like generic zkp is not for a thematic circuit there are more usable in for event post so for example the confidential transactions well they're worse for example the Greg Maxwell and proof but this used like ink signatures and then Podesta commitments for a very bit and then there is the bulletproof my question is in terms of verification how do you compare the bulletproof and the Aztec for the confidential transaction protocol like the one used in nimble winnable or in Monell as you have mentioned and for money as well so they are used in confidential transaction as well with State address so you are doing pretty much the same so would it be interested interesting to change the range proof in Moneo annoying City money Oh with the Aztec so this is my first question and my second question is well you are leveraging on Ponyboy and signatures so what happens when if we can take a look at the so the K is the integer you want to hide so what happens if the K is equal to the secrets why so this one is one out of there now well what happens if K is equal to Y why is your trusted set up your secret and yeah is the one you had so in bonny boy and signature for example they change the signature with the secret element but in this case it's make it will make which will create a vulnerability because you have to check if K is equal to Y and Y is the secret key in your trusted setup so doesn't this make any vulnerability like branch prediction so I'm gonna start by soda because I you might saw you might ask some of the other questions again because I think I've forgotten about in terms of like the volunteer what does cares why if why we use a zero knowledge proof basically if you want to use an app if you want to commit to announcing that you have to create a zero knowledge commitment to K you need to know what it is essentially and so because Y is ideally hung like why is the trust of some talk so it has to be destroyed for this particular to secure so you shouldn't be able to create one of these Aztec commitment to pools where K is why because you won't be able to provide the journals of truth that opens this open open his commitment to Y but what happens if the K turns out to be the Y yes that's what I'm saying like you you have to you have to commit to K so what I haven't actually hang on how you comparing the commitment commitment ah oh yeah here we go so imagine you have oh yeah so this is your Aztec commitments you have to you have this kind of a little cut point gamma in Sigma and you have these scalars K and a so what is equal to Y well the very first step of the essence in orléans proof is you need to one of the first proof to statement is I know a value K a scalar an integer decay that opens to this commitments you basically have to it's like a signature of knowledge basically you commit a blinding scalar so first of all you generate some random random scalars so call them BK MBA for blindness scalars so they are just random integers in the prime field that elliptic curve and then you commit your blindness scalar which is going to be this gamma to the BK h to the be a let's step one actually is there a board eraser no dears not okay it'll mine so basically it's like a it's like a circle purple goes like a three-step proof the first one is you kind of commit your blinding scalar we then create a challenge variable which is going to be a hash so H is our hash function we use K actually five six of your commitments so sorry gamma super blinding blinding factor thank you so this renting out a space already so basically you create this challenge challenge variable using the fear show me heuristic if you're gonna use this in it as an interactive protocol the challenge variable would be random and then what you have to do is you have to create effectively signatures for K and a so you create a representation of KK moles blood by C plus the blinding scalar and then for a as well and you have to what you do in a sec is you validate as like it record it one of the zero knowledge proof is the verification spot construct checks that you've created an accurate commitment okay so what it's going to do is it's going to validate it's going to compute this gamma to the K bar with HT a bar and then kind of divide this by that Sigma coordinates explained cheated by it sorry by the chance variable and that should be equal to the blending scalar so the blending factor and what what the small concert will then do is it will then recompute it will compute that challenge variable itself using the blind scale that is recovered and if you have not faithfully made a commitment to that scalar K then that scale it will not equal the original blending scalar blowing factor and that the Hatters won't match and so effectively step one advanced of an asset proof is you have to prove I know a scalar okay that is equal that is equal to some integer and you cannot do this if K is equal to Y because you do not know what Y is and so that's what that's how we avoid a situation of like malicious proof of trying to commit to like to the set of K Y and break the bone and biosignature notations to be very happy if we can take some time to discuss this more in detail yes sir and regarding the wire Steudle the smart contract is it working now for the edges cases like the when you add in points are the infinity or in that when you are adding points at the infinity for example if you are using average class curve so the point is in the projective coordinate so it's working with wire Stoddard so because last time I saw the guitar because it is sorry my hearing is really not very very good I think using it just very little work points to infinity no not yet we don't use various strudel to verb that I appreciate kind of that's more of a side project like let me have time we'll get all ready thank you very much and it would be a pleasure if we can talk this one detail yeah thank you very much [Applause]