Boost Your ZK Proofs Using Aggregation

Transcript

developer from ethereum foundation with a topic boost your zkp using aggregation Workshop it's given a round of applause guys hello everyone I work at privacy and screening exploration everybody's doing foundation and today I'll be talking about ethical aggregation that is how do you take a bunch of proofs so right now how do you generate a growth 16 or a prompt proof is in strong chairs so first you perform a set of ceremony and then you run the commands now.js

setup and then group and then verify and then optionally you can generate so already called Data so that you can separate on chain for verification bye when you actually submit a proof on sheet or verification what does it cost so basically the first cost is the call data cost and the second cost is the execution cost for growth 60 for one proof the execution cost is 231 210 000 gas units the call data cost if you have zero public invoice it's 128 bytes for Blanc the accusation cost is around 300 000 units and the call did a cost

again for zero public inputs is 400 bytes and needless to say if you want to verify 50 Graphics improves or 15 long proofs on chain everything would be times 50. so the gas cost becomes 10.6 billion and the call data cost becomes 6400 bytes but what if I told you that will have to live in that world anymore what if you could verify 50 wrong proofs at the cost of one and I do that using aggregation basically

you can take a bunch of proofs and then aggregate them into a single group and that is what you call education and how do you do it right now you can use a tool called maze which is here I told to allocate a bunch of block groups into a single proof [Music] and why should you use it so the yeah so when you actually ideate a bunch of block groups if you're single proof the call data cost is always constant so it doesn't matter how many proves you aggregate 30 40 50 100 they call it a cost would always remain four three two

zero bytes and the same goes for the execution costs so execution cost would always would also be constant and that will be approximately around 600 000. so um let's try it out [Music] yeah so to aggregate a bunch of blog proofs you first need a prompt circuit you you first need a circuit for which you will be aggregating the proofs and forwards you'll be building the aggregation circuit using maze so we'll be using smart JS a focus on JS to generate long proofs and then we'll use maze to actually build an

aggregation circuit for those problems so I would first wait here we are I've got a circum circuit and I've already generated the necessary files for for these circum circuits as you can see over here I've got the awesome file for the circuit and the rest of the files likes R1 CS Sim and CK key foreign as you can see over here there is a new

uh command added called long set of Base you're not even see it now is everyone able to see it wrong setup maze right so what this does is it actually helps you um it helps you generate the necessary files for building circuit using base so you'll be using this specific command to Output files that you will actually use in mail cli2 so let's just use this command [Music] prompts setup hands and it needs input.json file which would

contain array of inputs for which will generate the proof circuit or version file which we actually generate using circuit compiler circuit.zk file which is the wrong proven key which will previously which you can generate using uh long setup sorry wrong setup right here and then this command without Point proves or Json public segments.json and the verification key so we would need these three files for Maze foreign [Music]

foreign which contains the proofs on these inputs so you've got two endpoints and we've got two groups over here public signals files and the verification key now we will use these three files to actually build an aggregation circuit for proving uh for aggregating these proofs so and for that we'll use maze so let's just call Maize and help so it's okay so you can see over here

that you've got um is it visible yeah you've got a bunch of commands over here the first command is mock setup so what mock Center does is that it will take the grooves build an aggregation circuit and run a mock over on it is uh sort of simulating improving [Music] generation takes 50 minutes it will do it in five minutes for you and sort of verify that everything is correct you've got generally even verifier which generates the Ebu verifier for the

aggregation circuit that you're building you've got to verify proof you can verify the generated proof you've got uh Alien verified proof what it does is that it will simulate every verification of the aggregated proof so for the demo purposes I'll be sticking to mock setup because generating a real uh generating a generating a proof for aggregation circuit is pretty competitionally expensive and it might take for like it might take 20 30 minutes to actually generate a single proof so I'll just stick to more approval for now but you can sort of use the same command to the rest of the rest of e-commaster you can see over here so let's see what are the input files

that boxer needs uh X is so as I said before for building yeah as I said before for building navigation circuit Unity proves and public segments so I'll simply Supply those files over here so yeah it's almost done [Music] thank you

[Applause] so at First Dates the file builds the admission circuit for two proofs and is and right now it is running mock over on the ignition circuit so it might take 20 seconds or 10 seconds to actually show you whether everything went correctly or not and yeah let's just uh wait for it okay yeah there you go so it was a success it actually used so what is k k is number of rows so 2 to the power 21 rows were required for 20 aggregation circuit and it took 26 seconds to actually run

the model proverb on top of it so this is how you build an aggregation circuit using base and of cruise generated using Snapchats Okay so all this is good you are able to generate rules and building build a negation circuit but like how does it work so basically a blonde Groove a single prone proof consists of two parts the first part is the cheap part and that is performing computations to actually do the final part that is the expensive part and the expensive part is the pairing check of the values completed in the cheap part [Music]

in the aggregation circuit the trick is that you verify the Jeep part within the circuit and then accumulate within the circuit the expensive part that is the values for the pairing check into it fire and accumulator and then you actually expose the final accumulator as the public input to the proof of the aggregation circuit now what you verify does is it is that it will verify the proof of the aggregation circuit that means the cheap part of all the problem proof is valid and then it will perform a single pairing check on the fire accumulator so if you actually reduce the expensive

part into a final single expensive part which is outside improve which happens alongside the proof verification and that's it so to verify now is satisfied that all the proofs that were aggregated are valid [Music] so we were able to sort of aggregate like 50 proofs he can even extended to 70 Pros or 100 views but we are actually trading something off over here the point is that aggregating groups is very expensive so as you can see over here for 25 proofs it takes 27 minutes on a pretty beefy machine it's a peak Ram of 107g to build an engagement circuit for 50 proofs it

takes an hour so it's it's like it's still an expensive thing and yeah that's it if you want to check out mails you can actually scan this QR code or visit the get up your profile if you want to actually contact me by Twitter account and you can call me anytime okay uh any questions thank you any questions hello does this maze get used in production uh so basically these circuits the exclusion circuit is an audited so we wouldn't recommend you to actually use a

production but you can actually try it and we would love to try it out because that would actually tell us whether it is useful for people or not and are there any use cases like particular use cases that you envisage it being really suitable for Yeah so basically uh the the initial concept behind Maize was that uh you've got a lot of circum circuits you've got a lot of circum developers right so they write uh circuits and circle and then they've got and the limitation in that case is that they can only sort of prove one proof at once so how about like enable them to ask if an aggregation circuit automatically form circumference

as you can see over here we're using we were using snack JS right so we're trying to actually bridge the gap between sanjays and building aggregation circuit and mazebo is one of the ways but yeah there might be better ways and if there are new ideas about it do let us know cheers thank you hello everyone um I am very interested in uh with is our topic and I see that uh July is similar to some something that uh is Facebook and similar to a health

person and you use it to keep to serve application and I have a question that is there any terrorist proof that that the not affect the security level a bit okay yeah so if I if I get a question correctly uh you're asking that whether it is like what's the uh sorry uh are you missing any security when you're aggregating proofs um so for that that maze uses it is based upon

something called incrementally uh incrementally verifiable proof oh sorry um yeah so the answer is that there's a paper out there on this not on Maize but the concept that we've used and if you want to share the paper afterwards but the ketchup is that you can actually accumulate the expensive part of different scales into a final accumulator and if you can verify it outside so you verify the accumulation within the circuits and then you perform the expensive part of the education outside the expensive part that is into a single one so that's that's how it works

the circuits for males are in order so I'm not sure like we aren't sure whether this is completely secure or not but the scheme mentally in the entire system is the second [Music] uh so it's very similar to something like a vacancies yeah so I'm not sure what's the theoretical difference between English but the concept is that it is sort of the same thing because once you verify the a it's a proof you

recursively verify each and everything which was aggregated to the group right so for example you had always freeze for which you actually generated an aggregated proof right once you verify that improve your recursively verifying all the final rules right so yeah that's how I think about it and that's how I imagine it but I'm not sure about it theoretical difference other questions [Music] I think that's pretty much it thank you and yeah let's give him a round of applause

thank you