Carl Beekhuizen & Trent van Epps: Ethereum Foundation – EIP-4844 & KZG Ceremony #478

Transcript

welcome to epicenter the show which talks about the Technologies projects and people driving decentralization and the blockchain revolution I am Frederica ANZ and today I'm speaking with Carl and Trent um who both work for the ethereum foundation and coordinate the ceremony for a trusted setup that is needed for eip4844 that's proto-dank sharding before I talk with Kyle and Trent about the kcg commit ceremony let me tell you about our sponsor this week our sponsors Omni it is your new favorite multi-chain Mobile Wallet Omni supports more than 25 protocols um and you can manage all of your assets in one place across all major EVMS layer choose ZK sync and starnet coming soon

in non-evms but what's really special about omnis that you can do all the most important things in web3 directly within the wallet itself want to get ill Omni allows you to get the best apis with zero fees in three tab speeds taking liquids taking lending Landing via other I hear why it's why again need to exchange usdc on eth to atom on Cosmos Omni Aggregates on major Bridges and dexes so you can bridge and swap across all supported networks in one transaction directly in your wallet love nfts Omni offers the broadest nft support of any wallet so you can collect and manage your favorite nfts across all chains all in one place Omni truly is the easiest way to use web 3 and most

importantly omnis 40 safe custodial meaning you never have to trust anyone with your assets other than yourself if you want you can even use omni's Ledger integration so all of your funds stay on your Hardware wallet join 10 tens of thousands of users on this next Generation wallet by downloading it today um it's available on iOS or Android at omni.app call and Trend it's a pleasure to have you on thank you thank you for having us so you both work at the ethereum foundation um but maybe let's talk about um yourselves uh first um your backgrounds and

um how you ended up at the foundation so my background is actually originally in architecture and design which is very different from crypto and in this entire ecosystem that's what I went to school for and did that for a few years and then found ethereum in 2016 and started getting deeper and deep into the ecosystem engaging with core development mostly just adjacent to it really obsessed with it um worked at a couple different companies and then ended up at the ethereum foundation doing coordination work um having having a ton of fun while doing it I I initially was was studying um and a friend of mine told me how he was making

crazy amounts of money out of this whole crypto thing which piqued my interest um and so I also started looking into it and uh the more I looked into it the more excited I got about the like actual Tech and seeing what's what's happening under the hood and uh so my role sort of well my interest very quickly changed from from that side of things into the actually like wanting to know what's happening and getting more involved um and uh then at the time staking on ethereum was going to be 1500 eth which I did not personally have so I came up with a whole complicated mechanism for like splitting it up and staking with friends and whatever and it turns out solving many of the same problems that need to be solved at the consensus level so uh but so I ended up transitioning from uh doing that and

working on my own little project to doing the same thing but uh for uh ethereum proof of stake and being a researcher working on the protocol ever since super nice and you brought it down to 32 eth so uh yeah we still have solutions to do it together with friends right so basically it's like uh yeah fantastic so what you're currently working on is um you are working behind the scenes to make dank sharding happen so more specifically Pro to dank sharding also known as Shard blob transactions as per eip4844 um we had the eponymous Democrat on the show a while ago I think must have been

about two years ago and to talk about the ethereum skating roadmap um but let's recapitulate you know all of the various flavors of uh sharding please so basically what sharding what's dank shotting what's Proto dank sharding and where are we at the the word shining comes I believe from the database side of things but the idea is splitting up something that's too big to be handled on one machine across many and so in the early ethereum road map sharding was this idea of having taking the the work that had to be done uh and and the amount of data that had to be processed on on ethereum and splitting

up a bug's multiple in this case it was chains so we'd have multiple concurrent chains running next to each other um and together they will tell you the um the sum of what's happening on ethereum but we quickly realized that this has a lot of problems where the data becomes sort of siled in these various Shard chains and making sure the consensus Works amongst all the short chains and transferring their data and there's lots of concerns about interoperability between them at long times to finality etc etc so while it was a technical solution that was going to solve a lot of problems for ethereum scaling it was one that was quite ugly in terms of breaking

up the fungibility of ethereum into multiple pieces to what we're calling at the time quote-unquote short chains um subsequent to that the idea of Doug sharding came about uh as you mentioned named after dunkrat the idea here being that instead of having multiple chains running simultaneously we have one chain with like crazy amounts of data available available to it but to make processing as feasible for homesteakers and reasonably sized machines uh we can we can split up the data that everyone's responsible for so it's not separate Chains It's one chain but you're you're not responsible for everything on this one chain you're only responsible for a

small amount as a validator and this greatly opened up the the design Paradigm um and also helped a lot with Roll-Ups who were trying to figure out mechanisms for speaking between these Shard chains um that would be um transparent to the user but uh um weren't at the time so now by by having this one large amounts of data that everyone has access to um it's no longer something that each individual um uh roll-up would have to worry about it's now this massive blob which everyone can see from the transition from sharding to dank sharding we kind of lost the compute on the charts right so basically

the shards now exclusively store data yeah um but this is also this is uh a bit of a design philosophy change which we've had over the years as well which is changing from this idea of having one monolithic structure to separating out the roles the the important components uh for consensus here so initially we had um the the part of the role of validating was going to be uh watching for all sorts of different types of computation there were going to be different ways of computing but roll up simplified this by saying someone else does all the computation and um then you don't need to worry about that and then on the other on the other side

charting is going to gonna handle the data so a simple way of thinking about this the the the the prototank shotting vision of scaling ethereum or the deck shotting vision of scaling ethereum rather is to um the the compute the scaling compute needs those are handled by rollups and the data that these Roll-Ups are going to need this is handled by uh protodankshotting dank sharding and Proto dank sharding now um well as usual uh it's it comes down to a bit of evolution here so uh tank shotting initially is this very complicated proposal which is going to be

in essence very hard to to to to implement the the full dank shotting requires a lot of complicated things to happen at the networking level uh plus more cryptographic things um basically because we require validators to to look off the extra roles which are checking that this data really is available with cryptographic techniques there was there's sampling involved all sorts of things like this but looking at this this would ultimately take years and years to implement so in the interest of having a scaling solution for ethereum now we have protodank charting which is a simplified version so it strips out some of the extra nice to halves and limits the amount of data we can scale to but still provides like

dramatic increases in the amount of data that that is available to Roll-Ups and is something we can ship in the short term um to to to alleviate uh data constraints right now and we're doing it in a way that's upgradable so we can move on to full dank charting in the future um incorporating what we've we've done already this is the basis so um one of the things that's being addressed by Deng sharding is also the size bloat um so this is somewhat counterintuitive because we just learned that um basically there'll be massive Blobs of data that will be um on the network somehow um so but they're only being kept around

for a limited amount of time right yeah that's the idea um I think everyone knows that uh uh state is one of the hardest things about running if they're invalidated requires a lot of space and so this was a limitation to how much we could scale so the idea behind uh dank charting is to make someone else responsible it's no longer the validators role to store this data in perpetuity so each uh the VA as a validator you you get assigned some data to look after uh you must download it and you make it available for everyone else and then the various l2s are going to go look at this data download the portions that they

need and then after two weeks or so this data gets thrown away by the validators so you have a rolling window of two weeks um for what's available and whether it be like archival notes to kind of you know store all the blob data uh yes um it now becomes like a super uber archival node there's like another level of of archiving if this is something you care about um but the the the the important thing here is that individual validators don't don't worry about it because the the current way we handle stating ethereum is a bit ridiculous you pay a one-time fee to add some to to to add some storage and then the blockchain

promises to keep it around for forever which is a little bit insane and if we add so much scaling this just gets more and more insane so we now shift the responsibility onto the people who actually care about the data so um L2 sequences are going to worry about this and and they'll obviously want to know the state of everything so they're going to run that they're going to store the data they care about locally that's relevant to to to a given roll up and you as a user for example may wish to also if you're keeping your stuff on Altus also download that data for yourself which contains your own transactions if you don't trust your sequencer uh but it's just shifting the responsibility onto who's who who actually cares about the data any sort of gay with the tank shot so basically if I if

I deploy a new L2 can I just can I just send all my data there or is this is this um this is something that needs to be approved uh no there's uh it's all very open um as per normal ethereum things we we try handle this via economic uh systems so you can submit a a transaction there's a new transaction type um and this transaction type basically refers to data that comes along in a blob um and the blob's not a part of the Block it's on in what we call a side cards it's like external thing adjacent to the block and you can say like hey um I like I here's my transaction and

I'm referring to some data here that you can find uh on the on in the side car and then validators when they're validating a block go look for this data on the side but no no one's regulating that and it's actually something where it's gonna be a bit funny when we when we when 4844 launches is that there currently isn't enough usage in l2s to even fill up all the space so there's basically going to be free temporary storage in these in these blobs so I expect all sorts of creative things to to start happening again and going back to the old days of people trying to store like full images and that kind of thing in these in these blobs because it's going to be so cheap and there's no constraints to whatever's uh to what gets put in there well how did you guys um come up with

um the two weeks window so is this why is this The Sweet Spot in terms of trade-off between storing unnecessary data for too long and keeping data around for just long enough ah so that's actually an interesting one um and that's that I'm actually sure it's two weeks uh the I've uh because I've been focusing so much on the ceremony stuff we'll get to in a moment um I've I've lost track of exactly what the latest constants are um but the the the the trade-off here is basically between uh having it being a practical uh length of time to have everyone be able to look for the data check it's available download it if they care about it um and having it not be too long that we blew up the storage uh for validators to

to to keep but exactly what that constant is right now I'm not not exactly sure yeah I think it's still under discussion but it's a it's roughly around there cool so you guys work on the kzg ceremony um before we talk about the ceremony itself what is kzg so the um the dark trotting requires a commitment scheme a way of saying like the because the blocks themselves that we see on the ethereum blockchain the validators look into don't actually have the full data um that data is available in this this

blob side car uh we need a way of referring to that data so the standard way we do this in blockchains right now um is just hashes so uh ethereum uses catch up three for all attaching um to point to the data but this doesn't meet our needs and requirements uh for for um for the solution so the reason that's not true is that inside of a roller for example we your robot needs to be able to point to the data so um in the in in a block the normal ethereum block it would only have a reference to the data and you need a when when you're

referring to it you need to provide the full data that you care about alongside alongside that transaction if you're trying to do a fraud proof for example um but we run into problems here where the uh standard hashes black black lecture three or catch up are very expensive to to do computations around in CK relapse for example so it would make things virtually impossible for for ZK roll ups um so we need to look to to other means um and this also has some really nice um some really nice additional features uh which you can make use of uh because of the second thing we're doing which is

to when you can when there's a blob of data um we take this data and we extend the amount of daily data that's available we we double this the the length of this data so after after we have the the transactions that are in this this blob uh we extend this uh the size of this blob and we put a polynomial through it and this polynomial allows us basically to do um error encoding on this this data so we can recover some of it later if say 10 is lost and by doing this uh the the system um the the patches would be a like very inconvenient system because hashes

aren't an algebraic structure um so the when we do this extending it would have to be a separate mechanism and it would have to have separate proofs about how this mechanisms working whereas when we fit this polynomial kcg is a system which uh level leverages some of the arithmetic that's available inside of um uh elliptic curves and this just happens to be the same math we use for extending these polynomials so there's this like Synergy of the the commitments coming for free um and and and linking back there the short the short version of the responses kzg stands for it comes from the names of the authors for this

specific commitment uh Kate or is it Kate zaverucha and Goldberg yeah there we go but yeah that's that's that's my contribution there but Carl got the the technical bit out of the way so basically to kind of to to paraphrase this um basically there's different ways of um compressing data and that we've used before and they don't need a trusted setup but for various reasons they're unsuitable for this job so basically we have um we have decided to move to a different one which as a drawback has the trusted setup right

that's that's a pretty accurate summary good so um let's talk about how the so you said um the kzg commitment kind of um compresses the data basically it kind of runs it through a polynomial so I assume there's a limit to how much you can compress with one with one transaction so so I think uh compressors here is not quite the right word um or unless you want to interpret as a very lossy compression yeah it's a very lossy compression yeah okay it really it really is a commitment scheme here but but the the thus we do have limits on

how large this polynomial can be um and that's actually like a fundamental limit on um like how large you said this this polynomial to be affects how much data we can commit to um which affects like how big the trusted setup that we're going to run needs to be it's like this this long compounding thing so it's like a very important parameter so how have you set this parameter so the the answer is sort of we have and sort of we haven't but I'll get into that in a sec um so the the um that the idea is basically taking what the limits are to two nodes in terms of networking and storage currently uh to validators and nodes and to use this as

sort of a um uh an upper bound on on where we can we can set um the the the amount of data requirements and to sort of work backwards from there um of course we don't know how to do this without uh well I mean we don't know there's no data collection so there have been some experiments run um to to try understand where all of this is but the the long and short of it is uh We've settled on this number of 4096 um of these points um and that will be then the the the the the maximum side of a maximum size of a single blob but because we haven't fully decide like that that's what you decided now and

those are the numbers that will be in 4844 but in the future we don't actually know what it could be particularly with full tank charting down the line and so we this the ceremony we're running is actually Four sub-ceremonies um but it's it's opaque to use a participant but they're actually like four little ceremonies inside where you calculated with several lengths of this polynomial so 496 92 uh anyways double that all the powers of two up to basically two to the 16 uh total points um the idea being by having multiple ceremonies we have uh we we can change this as ethereum needs scale down the line and as we have Foster internet

connections um and and more more cheap storage for validators so you can you can accommodate up to three orders of magnitude larger than what we currently what we're gonna deploy you know as a first instance yes yes ah so super cool trusted setups it's it's a it's a fascinating topic isn't it so basically the first time I I I kind of came across this was um Morgan Peck's telling of the zcash ceremony which I linked to in the show notes just because it is so entertaining um so basically people met up in this rundown motel and they kind of they they

kind of disconnected everyone everything and then they kind of use brand new uh cash wood hardware and destroyed it afterwards and it it's it's um uh when you listen to it um it sounds crazy but at the same time it also sounds very irrational um so since then um it's been a while so what has happened in trusted setups since uh there's been quite a few obviously Z cash was pioneering and that's part of why their ceremony was so exciting and so I I've listened to the same story

last year when I was you know doing my research and getting caught up on this stuff and it was really I don't feel like they dramatized much it was a really incredible story um and that's what a lot of people think of when they when they hear trusted setups or you know set up ceremonies um but there's been many many setups especially I mean in crypto is what we're focused on um and I think most of them have been powers of Tau of varying sizes uh filecoin did a pretty large one um cello did one uh a couple different organizations within ethereum have done trusted setups um for a number of different things

um so there have been quite a few um Carl you can jump in if I'm forgetting any um but I think one thing that's been consistent over time is that people are more and more comfortable understanding there's there's greater education as more and more of these ceremonies take place and people understand the mechanics and why they're important and and how they operate and um I think ccash also because they were so early they they didn't have the benefit of what we have now of is just like like I said the awareness the education and the Mechanics for doing these sorts of things I don't know the specific technical bits but zcash had a had to do quite a few things manually um given they were doing they were doing

a lot of this for the first time uh but we're fortunate to be a couple years down the road and we can build on a lot of what they've done in the past yeah I mean basically if you can at all help it you never want to do a trusted setup uh truster setups add attack surface and complexity in the the Z cash instance there were concerns about whether it had gone correctly the first time uh due to due to all sorts of fun and interesting things um and then we learned later down the line that even the more the the that even so there was a bug in the the the the zika setup um which which they had to address

um in in some interesting ways and they have this Turn Style and this this whole upgrade process um to to handle this um and so you ultimately want to avoid it what I think is uh what's what's different here is the uh from that and the reason less concerned about that is the complexity of the setup um they are the computations and the amount of data you have to handle were gigabytes large you had to keep the secret around for a while there's the trusted setup is about establishing a secret and there was a secret that everyone had to keep around for a while uh while doing these computations um and ultimately it only scaled to at least six people in the in their first in their first setup which means that it was a very small and very trust us kind

of thing and the over time we've seen this transition to a simplifying what's needed out of trusted setups so that you don't need to depend on a small group of people and just scaling out to make make this easier to contribute um so that the trust the trust base is a much larger group of people so now it's 2023 um when you design a ceremony uh these days um what kind of parameters um can you tweak or basically what what what are the design decisions that go into the ceremony so I can give a higher level overview but we're fortunate um in that we were we have the ability

to use parameters which are pretty low requirements um like Carl mentioned for the zika ceremony it was gigabytes for file coin ceremony I know it was it was tens or maybe even 100 gigabytes these are you know not trivial to pass around especially between different countries if it's going to somewhere with uh some sort of national firewall um it's really hard to pass around that amount of data we're fortunate to uh have a very very small ceremony and sort of everything follows from from the very lightweight requirements we don't have a ton of data that needs to be passed around the computation is pretty light um it can be browser-based you know

we're we're lucky in a sense that we can work from such very light requirements um yeah but basically what became lighter so I I myself took part in the edge Tech ignition ceremony um and you had to download the docker image and run it and basically check the check the checksum and kind of make sure you're running the right thing and then it took it still took like 10 hours to run on a top of the line MacBook um so what's become easier so I mean it's not it's not that ceremonies have become easier to run it's that our particular use or what what we need out of it is very simple um so we need the the most basic thing

which is uh which mostly ceremonies generate sometimes uh called a phase one um and that's powers of Tau so as I mentioned earlier this commitment thing relies on polynomials and uh if you think of a polynomial there's some term X and you have x squared x cubed whatever up to higher Powers these are the the piles of tile that we'll be referring to later there's some secret and we need to know the secret the secret squared cubed Etc um and fundamentally we just require very few um points here we only require as mentioned earlier 4096 points for the the base 4844 setup which is pretty nice uh from complexity standpoint so that's

that's really helped scale things down as that file is now tiny and then the second thing is that because we only need these Powers so we don't need further computation um and uh there's some some additional principles that basically come in because the requirements of of kcg are lower than that or some of these these other ZK setups that it just allows us to have this this very basic uh computation there's like for example in lots of trusted setups you do the trusted setups and then you prove with the zero knowledge proof that all the computation you did was correct uh which adds many what is the magnitude of complexity on top of what can already be a lot of compute to do um where in this case it's so simple

that we don't even need to do a zero knowledge proof or I mean you could view it as a bespoke is very knowledge proof but you basically need to verify a few pairings um dude to check that this is all correct I took part in the test ceremony earlier this morning to kind of just to see what it's like and I can't I can confirm that it is really easy you kind of you type in like a couple of characters you move your mouse a bit you kind of sign an ethereum message um and you're done um it literally takes 30 seconds um so what how many people are you aiming to have participate in this ceremony

uh we'd like to have at least 10 000 I think Carl's goal is something related to the the powers or you can be more specific there but yeah we we want it to be the we're hopeful that it'll be the largest a setup ceremony of this kind again it's not anything special that we're doing we're just very fortunate to have very low requirements in terms of compute and bandwidth um and uh yeah we're so we're we're hoping that it will be the largest ceremony of this kind 10 000 is sort of our happy case and maybe it'll be even more we'll see we've got two months to to fill that up but Gekko what was it related to um number of powers or something you want

to be higher than I I have the silly the silly notion where I would like there to be more people who've participated than the total number of powers in the ceremony like the the number of points we need to calculate and this is not for any particularly meaningful uh it doesn't have a cryptographic benefit or whatever it's just it's it's such a ridiculous idea to me that we have this whole trusted setup that there's all this computation for and in the end like it's the the file that just refers to the people who've contributed is going to be bigger than the like actual output of the ceremony like there's more like the list of people who've who've joined or longer than the output we care about it's purely a vanity metric

absolutely but there is a reason that's important right is that um the the reason that this name that the name trusted setup exists is that you need to trust that this was done correctly and that um this the secret hasn't been stored because uh if the secret has been kept around then you can do things like breaking the ceremony um you can in a ZK setup you can often prove things that aren't true and in our case you could commit and reveal to data that uh that wasn't initially agreed upon so you could change the data that the Roll-Ups see so that's really bad and what you need to trust is that this ceremony went correctly and though the way these trust assumptions look is that you need at

least one person to have honestly done their job and honestly here means you need to have uh generated some some Randomness uh done this the computation and then thrown away the randomness without storing it or without publicizing it um and so in the initial black in Z in the zika setup there if you only have six people then this was really hard to uh to convince others if you have such a limited set so by having more and more people it's like you don't need to trust one person or some some limited number of people we have thousands of thousands of people and you just need to like hopefully have one of them that you can trust or maybe a few of them where maybe you don't trust any individual but you trust them all of all of them a little

bit kind of kind of idea and this is where we build up the security assumption which is why we care so much about having many people participate so short of everyone colluding at once and kind of storing the secrets and kind of revealing the you know the the mega secret um what needs to go wrong for it to break so uh well I can I can talk a little bit about like the bigger picture stuff um so like Carl said we want as many people as possible participating in this um because these things are because they only require a single honest participant once you're past that point like if you've contributed and you're like okay I'm one of 10 people I

know for sure that I didn't uh I'm not behaving maliciously um once it gets to one out of 100 or one out of a thousand it um it becomes degrees of you're improving The credibility of the ceremony in degrees so there's no like threshold you need to reach it's just more is better so the more the merrier um really at the end of the day these are like many things in blockchain these setup ceremonies are um coordinated they're they're public rituals about building consensus um and that means it's consensus around the how the ceremony was operated whether it was openly accessible

um whether the output of the ceremony seems credible all of these things go into making a successful ceremony like I said after that after you get uh your participation included or you know a reasonable number of people the the security assumptions there's no like binary threshold we need to cross over it's about convincing both the people who participated in the ceremony and then the future uh users or protocols that will Leverage The kcg commitments in the future so it's not that we're just convincing you know know the single person who participated but it's also you know 10 20 years whenever we do another setup

if we do another one in the future that block of time has to have significant and sufficient credibility to all of these people participating that the ceremony was conducted openly people could participate how they saw fit and um it really is about convincing everybody together that okay are we do we agree that this was this was good enough okay we'll use the output of the ceremony yeah and that's that's where the the reference to trust comes in maybe a little bit different than the original original conception um because a lot of people hear trusted setup and they think of you know this this romantic cyberpunk zcash story which is amazing um but it really was a trusted setup in

that case we're trying to and like I've touched on before we're fortunate to have a small setup where we don't have to rely on such a small group of individuals but the trusted setup is a bit of a misnomer in this sense that we don't have to trust anybody because it's it's very very accessible you know it takes like you said 30 seconds in the browser um you don't have to even download software if you don't want to um obviously there will be many different Avenues to do this but uh it is a there is a bit of an education uh deficit that we have to help people catch up with and that you know this isn't six people in a hotel room this is tens of thousands of people around the world uh who can do the computation in

under a minute in their browser um so they're obvious in the same family in terms of setups but they they do have significant departures from how they actually get implemented so for us we've been using summoning ceremony uh because we're you know summoning this this random output this random number um trusted setup is still what a lot of people know though they that's the term they're familiar with but yeah we've we've definitely leaned on summoning ceremony to communicate how this is you know broad participation with the intent of producing this public ritual in the form of a ceremony that goes for a few months cool so

um there is one entity called the sequencer that kind of um that kind of moves you know uh from one uh that that kind of moves from participant to participant in a way uh so they kind of see the contribution and they the uh the sequences the contribution and verifies that it's still a correct State um that does give them an unrivaled inside view you know at the state um after every uh commitment is that somehow exploitable no um the the the the sequences roll

um like its name kind of suggests is literally just to decide who's next so um if we have so many people trying to contribute and everyone's like tries to participate how do we decide that it's Alice instead of Bob who's whose turn it is now to to contribute because this is like a fundamentally um sequential thing it's not parallelizable so the sequencer uh you ask the sequencer like hey can I can I participate now um and if the there's a free slot the sequence will be like yeah sure here's the file um and then you go off with your own with the father sequence I just sent you you do a bunch of calculations um it combines your Randomness with the

randomness of the people that came before you and then you send your file back to the sequencer and then the sequencer uh checks that you didn't like try to lead someone else's secret or do other uh funny uh funny things there and if so then we'll send your um you'll file on to the next person so the output that the sequencer has is um they can basically see what the ceremony looked like after your contribution but the funny thing is is that this is what everyone sees so there's it's not like the sequencer has more access to more data that could be used to break it uh all this data gets ultimately stored and you can there's another the sequence will just give it to you for everyone's

like for the entire history of this the ceremony and part of it's required to verify that the ceremony ran correctly after the fact so the sequencer doesn't have any more insight into this information what the sequencer does have is a little bit more uh control in deciding who goes next uh or they could it could theoretically prevent someone from going next so you could say like hey can I have a turn now and they can be like no someone's busy and they could just lie to you and prevent you from uh participating or um counter to that you could do all your computation you get the file all's happy you send it back to the sequencer when you're done and the sequence was like oh sorry you made a mistake and it just rejects your

um your output so that's sort of the additional part of the sequencer has which sounds like the the this is not great we don't like having single entities uh in in decentralized systems which like have more power than others um but in this case it's a little uh it's a little different and that's the uh if the sequencer does something like this their fault is attributable so if they say like oh your file wasn't correct they'll send you the message saying your file wasn't correct back and this message is signed by the sequencer so you can then take this and say like you can provide this to someone else and they'll be convinced that the sequencer was falsely rejecting your your file or

if if the sequences like saying that won't let you participate in the first place then you can do something like um use the the way you prove who you are to the sequences you you sign in with ethereum so using an ethereum account to say like hey this is me I am in my case called Big Daddy um the maybe the sequencer tries to censor me so I could just take another ethereum account and try to do the same thing and and and sign in there um something that's not tied to my identity such of the secrets are concern to me so if you're worried about these kinds of things they're like are ways of getting around um in and and and ultimately if if these are concerns that we see then we want to

stop the ceremony investigate why this went wrong and start the whole thing again if if these are major concerns that we see when people start complaining that you know they can't participate um I mean obviously they might be vocal about this and basically they erase uh scrutiny yeah so it it depends what what that that looks like right if it's uh some some crazy person trying to show their coin over ethereum and thinks their theorem needs to burn then that's a whole other thing but like if it's someone who we can say is a reasonable claim to making this this true or we see it from a few a few trustworthy people um or they can uh particularly if they can provide these these these certificates which prove the sequences

being being lying or cheating then we really like need to investigate what's gone wrong here um in in practice the way we're trying to avoid all of this is that we are like we've we've put the sequencer through some extensive audits um we we had the the ceremony itself audited uh uh once before and then like the sequences sequences specifically audited um to try like hopefully find that there are none of these uh these edge cases and that could happen um but ultimately it's only going to be by actually running it or do we find out that that this it has gone the way we intended okay so basically now the sequences as uh for little kids your turn um and I do the maths it's really

difficult to talk about complex maths without uh a Blackboard or you know slides um maybe let's let's can I give you um a uh a way of describing what I think I have to calculate and you tell me whether that's correct so basically um basically I I generate Randomness somehow in my browser by kind of moving my mouse and entering some characters and and so on uh and it's a number right and then basically I take that number two different powers and put it into an elliptic curve and then basically the four thousand whatever

I mean that's kind of the powers of tower that you were talking about earlier right so basically those four thousand numbers that's the thing that I pass back to the sequences is that correct yeah that's that's pretty much correct um the the stage you described as putting it into an elliptic curve what you're doing there is you're mixing it in with the people who previously participated so the sequencer is going to give you 4096 elliptic curve points uh the first one represents like the uh the secret to the power of zero secret to Power of One etc etc um in increasing powers and then you you generate your own secrets and calculate these and then you just multiply them and that's like that that's how you

combine your secret with the other ones and that's that's what your contribution looks like plus an additional point which basically just proves that you did all this correctly allows people to verify that um you updated from the previous secret to your secret correctly super um so I love how how Zen powers of our powers of tower Sounds by the way I think it's uh sorry it's nicely named it's very cool but that that kind of leaves the question how do I then destroy my Randomness right because you guys rely on the fact that people afterwards get rid of their Randomness because basically if it's stored locally on like 10 000 computers um obviously that that's a nightmare

so there's a couple different ways yes of course we we want people to not keep their Randomness um one way to safeguard against that happening is by having many many participants which weren't able to because it's a small ceremony size but um we do yes we want to prevent people from or strongly encourage them to not keep this around because that could uh compromise the ceremony if you know somebody spins up some Bots and and tries to influence the credibility of the ceremony so there are three um Randomness components that go into this which are combined two of them which you mentioned you're moving your mouse around and the browser is taking snapshots of where the mouse is at

certain bits of time you're also typing something into a little text field um and we we suggest that the users include some some random characters and uh we don't show this to people so it's it's mask like kind of how you would enter a password so those are the two two that the user inputs um and then the final third one is uh the browser generates Randomness on its own locally uh and then all three of these are combined and uh that's what that's what's used as the entropy that's what you do the computation over um so if somebody were to record all three of these well first

they'd have to they'd have to be digging into the browser and extract that randoms the other two um are maybe a little more cosmetic uh because the users are entering it themselves and we already have this browser Randomness as a backup um but you know they they do add add a little bit of uh entropy themselves but at the end of the day it's backstop by this browser Randomness that you'd have to try pretty hard to to dig into and actually extract from the browser itself how is it deleted afterwards though because in principle you could you could probably save it you could um and that's again where like that that's what we Define as participating

honestly is that you you don't try save it but I think like ultimately your browser just like as soon as you've handled the file back to the sequencer if you're participating via um the the the the client at ceremony.etherium.org um if if you do that when you hand back the file the the browser will just delete it itself so it's a little bit different to like I this this like we need one honest person but it's like in order to do this we need if we have 10 000 participants we need 10 000 people to like open up their their their uh their browser like take apart the code figure out how to get the browser to

like save the secret for them uh and then save that secret then they all need to get together and like publicize or communicate their secret with each other such that the the the Uber secret can be calculated so it's like we require like a pretty decent amount of technical competence um and Malice on the part of literally every participant in order for for this to be an issue you at least you need at least one honest or lazy or stupid person to participate hopefully all three the other thing which maybe we'll get into later is we will be running a special contribution period

um where we'll have maybe more elaborate participation uh mechanisms and ways of generating and and storing Randomness um maybe we can get into that but there will be a verifiable or like more documentation as to how they generated and then destroyed their secret um but that'll that's a separate from the general contribution period okay and the general contribution period is at first come first serve or do I kind of have to book a slot so yeah typically with larger ceremonies it because there's this significant data that they have to pass around and you want to fit as many contributions as you can into a limited

time period whether it's month or two months um yes you would have to slot you'd have you'd have to choose a slot sign up in advance they would send you some sort of token and then you would check into whatever hosted interface is passing you the latest version of the computed data um we do not have slots we have a general Lobby and then people are or accounts are picked at random from the lobby um so it it's it's a little bit nicer that you just show up the trade-off is that you don't know exactly when you're going to get included so the lobby could have thousands of participants and we'll just tell you maybe you should come back another time but the good thing is it'll

go for at least two months so hopefully you know if the lobby is full for two months with thousands of participants that's both you know that's a good problem I guess because we're going to have you know I think we'll definitely get to uh many many tens of thousands but um some people may not be able to fit in so maybe we'll get to that problem when we get there but it's just a Lobby Carl you probably have some more specifics on what the lobby actually is and how it's implemented yeah so it's basically uh you you check in with the sequencer first you're like hey I'm Carl or Federico whatever the sequences like oh welcome and then you're like oh hey can you give me the file and the sequence was like nope sorry someone else is busy with it and

you're just like everyone's just asking like hey it's like what about now is the file ready uh and then as soon as someone's like as soon as the file is available the sequencer is like oh yeah sure here you go so it has this like random element uh where it's just like if if you keep asking the sequencer like hey can I have the file now um eventually the file will be free and you'll uh you'll get allocated so the this is quite different in terms of if you don't have time slots you have to meet um it's also like one of the the things is that there are time slots or it does take like if you have a queuing mechanism that queue is six hours or ten hours like is your computer still going to be on then or like all sorts of

additional questions where here we can sort of avoid all of those because if you're asking like your computer's asking hey can I have the file now um and that means your computer is online and ready to do these computations so it like works really well from both the like simplifying things standpoint and from just like allowing many many people to to contribute what about the special contingent that you just alluded to Trent the special contribution period yeah so given we we only need to trust one person this is um or we only need a single honors participant this is one way that we can take the uh the sort of theatrics and the public perception of the ceremony to another

level um so we're running we're running a grants round which will support people who want to either write their own implementation but as you mentioned uh do some sort of unique or special contribution um one of the famous ones is I believe it was for the first zcash ceremony they took a an artifact like a piece of cloth from Chernobyl they took it up into an airplane and used the geiger counter to measure the radiation that was coming off of it recorded that and because they were in an airplane you know it's I don't know how you would uh compromise the the data they're recording while they're in the airplane 3000 feet in the air um but this is sort of the elaborate

um fun data contribution that we would like to see in the future maybe not obviously not everybody in an airplane everybody is not going to be able to get uh radioactive material from Chernobyl but this special contribution period will happen after uh the the first two months will take a bit of a break turn off the the hosted interface and have people who you know um they want to use some sort of special event that they planned with their local ethereum community or someone who is uh they have a specific Niche interest outside of crypto that they can somehow incorporate these are the kinds of things we're looking for and uh so yeah applications for this are now open and we're we're

giving grants for people who have interesting ways of generating uh entropy and then storing it and like I mentioned earlier this is also part of this this part of the project is recording it and or documenting it not recording the secret but documenting the entire process of okay here's here are the steps I went through to generate the randomness um here's the way I discarded it and here's the way you know it destroyed the computer or something but the the average member will just contribute through an interface they won't have you know it'll just be in the browser but we'll have these very elaborate um fun contributions that we can then

see you know we have a documentation for actually how they planned it how they set it up how they generated and recorded and discarded the secret super cool I look forward to kind of seeing what kind of entertaining things people come up with one last thing about kzg equipments they are quantum vulnerable right so if I had a quantum computer I could break it yeah so what what happens when we build one it's a matter of scale uh right now most most of the cryptography we use in the blockchain context is is quantum vulnerable um we have many um components we can swap out um the like if you you take some some

cryptographic scheme that's that that would be broken and you can replace it with one that wouldn't and the same would be true for for kcg setups um unfortunately the like all these really nice properties I was that I alluded to earlier those those Fall Away um that's like we don't have any post Quantum solutions that allow us to like really easily prove these inside of snarks or etc etc but I guess an additional problem is that most knocks well snocks will break as well because also rely on these arithmetic assumptions so like they're like many cascading levels of problems and then ultimately we would have to like switch to a uh a hash based system to to provide these commitments um so like there are

mechanisms we could we we could put in place but they would be very ugly um and uh yeah possible but uh hopefully we still have a few years before we reach that point yeah I I I think it's it's the like 20 years in the future so but I mean it's always good to kind of think about these things ahead right so how soon so I mean kzg is only um a part of 4844 so there's different things that also have to go into it so I assume it's a prerequisite but as soon as it's done for 844 might not be done so um how long after the ceremony is over do you think for eight for four will be

live oh I had unmuted to answer the question but actually I don't I don't know if I can answer that specifically I rough rough deadline possibly or like a what people expect um so let's see so we're hoping to start very soon um as you said it's prerequisite uh but it'll be done let's just say I'm pretty confident that it'll be done to our satisfaction before 4844 is ready um hopefully sometime mid-year maybe that's is that General enough or specific enough uh that's that's probably as as specific as I would guess

roughly around that time the like it basically comes down to uh the how much time devs have to work on implementing 4844 um so like where are we on all of this testing uh there are withdrawals the withdrawal Fork which is obvious which is going to be shipped beforehand um and that's that's the the next upgrade um and then after that uh will be 4844 and the question like the the it's very hard to answer exactly when there will be but as Trend said something like the middle of this year I think is a a reasonable answer and then the idea is to have the ceremony um done

um we've mentioned those two month time frame which is where we have like lots of contributions um and like the idea there is that's long enough for everyone to to participate and it's about as reasonably short as we could expect people to uh like that doesn't expect 4844 to ship in some like magic world where somehow we have infinite Dev power and whatever it would I think look something like that uh realistic L that that's not what what the world looks like but we want to be prepared for that in case um after those two months we'll have the general contribution period where we'd like have all these fun weird wacky contributions special special contributions special sorry special special contribution we have all these weird wacky contributions and then after that uh we will just go back to allowing

normal contributions again um until 4844 is ready to ship because this is like the kind of thing where we can say okay cool like 4844 is ready to ship in a month so there's like in a week's time we'll shut down the ceremony kind of thing it's all rough timelines by the way but like something like that you're like say okay cool we like now 4844 is ready so we can shut down the ceremony um and ultimately like the ceremony can run as long as 4844 is in progress um participate as possible yeah exactly so um how can people learn about all of this so we see if people want to build a client for the ceremony or just participate in the ceremony or you know be a special contributor and video

themselves where do they go to find out about all of this easiest place to start is probably ceremony.etherium.org that'll be sort of the the home base for a lot of different bits of information and then the hosted interface can also be gone through there we'll also have some ipfs versions but yeah that's that's where I would direct people if they're interested in writing an implementation there are some links out from there uh you can also go directly to the ethereum org blog that has the post and the explanation of what sort of contributions or what sort of um Grant applications we're looking for whether you're writing your own implementation or doing a special contribution yeah cool and what's what's next for the two

of you once uh this is all you know gone smoothly and 4844 was deployed I don't actually have a reasonable answer to that uh this is uh this has been fulfilling so much of my time just like trying to like ensure that this this runs really smoothly and that that this is this is all secure um but I don't know what my next project is I kind of specialize in doing these um research projects which are very much related to the core protocol of ethereum but also a little bit adjacent um and so I will probably see what the next the next uh project is along alongside the theorem that needs to be done for me it's probably

um I mean there's there's always the the general coordination work of getting people stakeholders engaged in network upgrades and uh helping people understand how the network is evolving or where it should go so that that work is like always ongoing so I'll probably just keep doing that but another major project is uh protocol Guild which is a collective of individuals who are working to fund the core protocol outside of traditional funding sources um that's a probably what I'll start to focus on once this is done or at least you know kicked off that sounds super interesting uh where can I find out more about the product I get

the Twitter handle is protocol Guild so that's probably a good place to start there's some links you can dive into and then I could probably just I'll message you some stuff after this good fantastic thank you both for coming on I look forward to participating in the real ceremony and let's see whether I can find you know a special enough way to kind of get through the grants process yes definitely um we we would love to have you apply and maybe do something fun um thank you for hosting us I really appreciate it uh that we get to share this project we've been working on for so long since like mid last year and um finally it's it's almost ready by the time this comes out I don't know what

your editing turnaround is but the ceremony will probably be live oh it'll be out this week oh okay maybe not depending what part of the week but um it'll be very close uh either way this is great for just getting the word out there and um letting us share sort of the frame framing of the ceremony and sort of the stuff that went into it so thank you again I appreciate you having us