Eli Ben-Sasson: StarkWare – Productizing zk-STARKs to Provide Blockchain Scalability & Privacy #310

Transcript

[Music] hi welcome to epicenter my name is Steve I think with you and my name is sunny occur hey sunny how's it feel to be back in the US after DEFCON pretty good my trip was cut a little bit short in Japan due to the typhoon I decided to jump out of there as fast as possible but yeah yeah you made it in the nick of time I think right like your plane was like it's just I was imagining you were like flying out and like the plane like flying out and just like the hurricane like coming up behind it I was just just

like flew it into the clouds like in the movies or the typhoon rather yeah I know a bunch of people who left a few hours even a few hours after me they were there their plates are grounded that do make it through luckily Osaka wasn't the the brunt of the damage which is mostly more towards Tokyo but yeah still quite a bit of like rain and wind and stuff would have put a damper on any vacation yeah so how was that fun Def Con is pretty good there's a bit like weird and a little bit it felt very unlike other past stuff cons in a lot of ways keep mine I've only been to one Def Con before which was DEFCON 3 in Mexico City but which was cool I mean I think there was a lot of talk about e 2.0 and

whatnot I would say my overwhelming thing I would just say is it felt less like a Def Con and more like Osaka blockchain week yeah in the sense that it wasn't very ethereal it didn't have the same aetherium focus as it normally does like we walk into the main venue there's no where's the rainbows and unicorns gone and where's the eat logos and where's the all the mainstage talks or like non aetherium stuff and whatnot why do you think that is I think there's this interesting question of what is the etherium community is it the core etherium technology that specific chain or is it this community of people who are interested in

decentralized applications and web 3 and defy and whatnot and so if it's the latter does that mean that other layer 1 platforms that are also trying to push forward that same movement are also part of the etherium community or not and I think that was kind of the general debate where it seemed the etherium foundation seems to think that those are and then a lot of the or portions of the eath community tend to think that or not I'm so I think that's kind of where some of the debate comes in I mean I wasn't there but I've heard a lot of similar

things from people who were I heard on another podcast someone say that increasingly you know other projects that are trying to launch their own layer one solutions in order to grow communities need the kind of buy-in from the etherium community and that being at this conference and presenting the ideas there and sort of like showing good faith and sort of that Bluff I don't know if you could say that in English it is a way to gain credibility in order to launch a like new layer one solutions yeah I mean exactly and I think that's kind of a little bit of what I meant as well where it's like you know there is this DAP community and they're all

currently mostly in aetherium and most of the it's gonna be very difficult for like new al wants we're trying to solve a similar problem to ethereal but maybe using different technology or different consensus protocol or different staking mechanism or whatever but if they're so solving the same problem of being an l1 smart contracting system if all the smart contract developers are working on a theorem already the only way to get get them is to poach them if you want to be cynical or attract them if you're you know want to be more we need yeah that's that's interesting it would be interesting to see how these ecosystems grow and what synergies will exist between them in the future

you know for the ones that will remain because I presume a lot of a lot of these other layer one solutions that are being proposed it might find their own niche applications or might even you know just disappear in a couple years luckily for cosmos what's nice is I we're able to make a pitch more not just on technological changes but there I think are some deeper ideological and like structural differences between cosmos and aetherium which is why I think there's a little bit less of a I think it's a little bit more complimentary than like much more positive some then you know cosmos we don't really believe in like or we're not focused on layer one like true and

complete smart contracting systems for example and so right now I kind of get that complimentary aspect as well I feel that if you're a man cause most are more complimentary than say other platforms cool I'm glad you it had a good time and I'm gonna see you soon because we're gonna be at SF watching week which we'll get to in a few minutes but first I want to introduce our guest for today our guess is le Ben Sasse on who's the co-founder and chief scientist in the East at Stark where yeah so Stark where has actually two chief scientists one in the east and one in the West which is crazy and as this goes to show the amount of the amount of crazy research that's going on in that company so prior to founding stark where le was a professor at Technion the Israeli

Institute of Technology and he held positions at MIT Harvard Princeton and his research focuses on theoretical computer science and proofs and computations and he's particularly interested in how you can apply these proof systems to applications and decentralized applications and cryptocurrencies so if you're a longtime listener of the podcast you'll remember Brian and mayor's interview with Ellie in 2016 this was long before there was even an idea for stark where in fact it would be another two years before the release of the Starks paper which ellie co-founded and he was also the co-founder of this little cryptocurrency privacy-preserving critter currency called z cash which we've also talked about a lot in the podcast so I really

enjoyed this conversation because it was we sort of broke down the types of zero knowledge schemes which this today explaining the differences between Starks and snarks and bulletproof and all these terms that we've been hearing more and more lately and generally I thought it was a really good refresher on on zero knowledge proofs I mean I know you spent a lot of time researching these things but for me it was a good way to sort of get up-to-date on or what the state of all these things are at and in a moment where as he describes it there's sort of a Cambrian explosion in this your knowledge space it's a useful conversation to have to have a better idea of like where we're coming from where things are at and where we're going what did you think of the

conversation with Ellie I think that especially in the last few months this whole Cambrian explosion thing has been you know I I try to look my best to like keep up with what was going on in zero knowledge a little bit I'm you know I'm not the best cryptography expert but you know I would try to keep in at least keep in my head up like okay these are the trade-offs between these different types of your knowledge implementations like okay this is how snarks impaired to bulletproof Stu Starks but now in the last few bonds it's like oh man there's sonic and supersonic and clunk and this and that and that and I've just even stopped keeping track at this point and so it's good that there are some very smart people who are focused on like you know mapping all of this stuff out and

like pushing that field forward it's really cool that you know this is a company that isn't really focused on they don't have a chain or a project like you know they have some projects that they've worked on but they're really more of sample projects to show off a technology and its really a sort of a company it's really more of a research team that's been structured as a company and so that was kind of interesting yeah I like their approach and I'm curious to see what will come out of it like what are these products that that will be released I know that they're working on one product to help scale exchanges and so we talked about this Starck decks which they've built which

is really sort of a proof of concept to demonstrate the abilities of these future products but you know yeah this this will be a b2b company servicing companies in the crypto space and not so much servicing sort of like crypto users at least for now that seems to be the direction and yeah you mentioned all these other projects yeah I mean that's also an interesting aspect of what's going on at the moment this is just as so many things going on and you know we're looking at having a lot of those folks on the podcast as well I think we'll probably get the meet a lot of them at NSF so yeah before we go to the interview let's talk about SF washing week it's coming fast there's lots going on and so let's break it down in don't fast forward this one because I'm gonna

tell you how you can get free tickets to the main event conference so first and foremost if you're going to SF you know if you want to meet with me and Sonny we're gonna be having a casual drinks meet up on the evening of the 29th it'll be after date two of Cesc so we'll have it in Berkeley close to the venue I know that we've got a pretty big audience in SF so I hope to see many of you Bay Area listeners come and hang out with us drinks are on us and you can register at epicenter dot rocks / SF meetup I'll be and I think you too Sonny will be at CSC on the 28th and 29th and then the main event SF blockchain week epicenter on the 31st and first I'm

super excited to be emceeing the epicenter conference which is quite fitting because they have the same name as this podcast they're organized by decrypt capital and sunny you're also going to be speaking at this conference yeah I'll be moderating some panels and I'll be speaking at the Cesc event which Cesc by the way is also it's being organized primarily by boxing at Berkeley which is an organization I co-founded a couple years ago cool and you're you're also putting on an event tell us about that yeah so I'm kind of also helping put on another two events actually but one of them is this macro WTF event so basically back in Osaka the day before

Def Con there was this awesome event called defy WTF and it was just like a one day conference where they invited a bunch of D Phi speakers and it was a really good conference like all the speakers were really great the vibes were really good they had this like cool aesthetic which I know I really liked and so it was really good event and so after the event I was hanging out with them and I was just telling we were chatting about you know I want to see more one I was like okay we should turn this like WTF thing into like into a thing like it's like let's do another event and I've been reading a lot mostly on macroeconomics lately and so I want to do something where we put crypto in the context of macroeconomics and so that's what we were doing on the

Wednesday of sf' watching week so the day between Cesc and epicenter we'll have a our own little event and on the 30th yes and if anyone's interested in speaking we're still actively looking for speakers and so just feel free to message me on Twitter or on telegram my handle is sunny 897 on both of those so that's macro WTF for more details so yes those tickets are still available for CSC and the epicenter conference if you want to get tickets you can go to epicenter rocks /s f VW tickets and enter the code epicenter 2x for 20% off and here's how you can get free tickets as if they've got to deal with eToro

which were guests last week Yanni SCO is on the podcast and so if you create an account with eToro and deposit $50 you'll get a free ticket to the epicenter conference I mean that's a pretty good deal right like 50 bucks deposit on eToro you know so to get in on this deal you just need to go to SF blockchain week dot io / eToro and the details are there I think you need to do it before the 28th which is fitting because that's when the conference starts then we're also going to the defy hackathon over the weekend sunny tell us about the sakkath on and why people should be excited about it yeah so cosmos is one of the lead sponsors of the of the hackathon but you know it so I'm really excited to kind of show off

some of the stuff that we've been working on on cosmos and why it's a really cool platform for building called defy applications some of which I've been working on over the past couple of months you don't have to build on cosmos for the hackathon you can build on anything you want and it'll be really interesting just to see a hackathon that's really focused on defy products yeah I mean there's there's a $50,000 prize pool in atoms for winning teams so that's a that's a good reason to attend you know it's gonna be super defy focus I mean you could you could build like a lending platform you could build like a stable coin on cosmos for example and I think I'd be see yeah IBC will be ready

by then so you can also interoperate with the existing cosmos ecosystem so that there's all sorts of possibilities here that opens up yeah that's one of the most exciting things will be the first time IBC is kind of ready for people to play with and so a lot of people are gonna be coming in and like I know for example cava is for their project they're working on and I an IBC demo of like moving atoms and stuff on to the cava test that and collateralizing them to create sample coin so now that's super cool I'm like really excited about that to register for the D Phi hackathon which is organized in part by cosmos our sponsor go to epicenter dot rocks /sf cosmos and be sure to let them know that you heard

about it on epicenter I'd also like to tell you about our other sponsors for today's episode so recently I started reading the Bitcoin standard by The Economist safety amis and he spends a considerable amount of time at the beginning of the book talking about the history of metals as money and throughout the years throughout the centuries copper silver and gold have been used as money but what has remained consistent is gold's position as the most stable and trusted source of stability as money and to some extent that remains true today in fact as he describes it central banks are still buying and stockpiling gold in

great amounts so if you're holding crypto and you'd like to buy gold there's no better way to do that then at vault Ericom volt or is a leading gold to crypto exchange and they've just released their brand new v2 platform which looks and feels great you can create your account in just a few minutes and once you're verified you can transfer bitcoin or - on to your vault or account and start trading gold what I love the most about vault Row is that you're not buying some gold derivative or some asset which is backed by gold you're buying real hard gold man it is protected by Brinks stashed in vaults deep in the Swiss mountains and if you'd like I mean you'd have to be a little crazy but you can have that gold

delivered to you at epicenter we've been friends and customers of altoro for many years we've held a portion of our crypto assets in gold and we've always been happy to have that stability whenever the markets were really volatile so to start trading go to vault arrow calm and create your account and when you do do me a favor on the bottom right of the website there's a little yellow support icon click on it and in the message box just say I heard about you on epicenter that would make me really happy we'd like to thank voltar for those support of the podcast I'm also really excited to tell you about our new sponsor this week and that is b9 lab and if you don't know about b9 lab they are the premier blockchain

developer academy on the market I've been following them for many years in fact their co-founder Elias Haase is at about every blockchain conference in Europe so we bumped into each other many times over the years and it's been great to see this company grow from a small team and just a handful of courses to now over 15 people with professional instructors and a breadth of courses that spans just about every blockchain protocol on the market so they have a theorem developer courses courses for Korda and hyper ledger Sawtooth and fabric and they're adding new courses all the time and one of those courses that they're adding is the brand new certified solidity and smart contract

auditor course it's an eight-week program it's a part-time course and it's for experienced a theorem developers who want to expand their skill set and become smart contract auditors this course will introduce you to the current state of the smart contract security ecosystem and you'll learn through exercises which pull from vulnerabilities that were found in the wild and it provides advice for those who are looking to enter this market so if you're in a theorem developer just think about what an eight-week smart contract auditing course could mean for your hourly rate or the salary that you can ask for in an interview I mean chances are you can ask for much more if you have this skill set so b9 lab have partnered with solidified a smart contract auditing platform and they're

offering three paid internships at the end of this course and the possibility to join their auditor pool the course starts on November 18th and there are only 100 seats available so if you're interested in this course register quickly because these seats are gonna go fast to sign up go to solidified b9 lab comm the link will be in the show notes and use the code epicenter a check out to get five percent off the course price and this code is valid on all the courses on benign lab comm so you can get that five percent discount on anything that you see there that you find interesting we'd like to thank benign lab the blockchain education specialists for their support of epicenter so at that

here is our interview with Elly Benson we're here with Ellie Benson son who is a return guest on the podcast he's been here before it was almost four years ago and Ellie has been gracious enough to give us some of his time while he's on vacation and it's very late at night where he is in Israel Ellie thanks for coming back on the show thanks Sebastian and sunny always a pleasure to be on this show well it's a pleasure to have you back and yeah so as I mentioned I was looking before we start recording last time you're on was in 2016 this was long before I think there was even an idea to do something like stark where back then

you were a professor at Technion you know talk about your trajectory since then what's it been like to go from the academic life to full-on startup mode a lot of fun in one line yeah the trajectory I think started years earlier and my Eureka moment was in 2013 May 2013 in the Bitcoin conference in San Jose where it sort of dawned on me that the research I was doing about scalable proof systems that that could be that that stuff can be very useful for block chains and that was my turning point and then 2016 I was still doing research as a professor you know advancing the

science and technology of a very particular brand of proof systems that I think we'll talk about later then I believe it was at the end of 2017 that that sort of we realized that it might be time to try and commercialize this stuff this was a right after we were ready to publish work on ZK Starks that we'll talk about later on and we started this company almost two years ago so it was around the end of 2017 and you know it's been a lot of fun since then very exciting before working on Stark where

you were also one of the cofounders of Z cache right yes where's E cache already going on when we when when you were on last time or was that something that you got started with afterwards I was definitely involved in Z cache in 2016 I think that coin launched at the end of 2016 so I guess around the same time I was doing the interview with you but I was definitely involved with Z cache then because the company has been working I mean was working on it for a while since then yeah so back then I was also involved in Z cache which is also a very exciting project that I'm very proud of you know having contributed to along with my other founding scientists

on that thing but yeah since then we we sort of moved on to other technologies and other endeavors and with one of the other co-founders at Z cash with the other Center chesa now you guys are both chief scientists at Stark where so can you tell us a little bit about the origin story of how you guys decided to how start where I came into being yeah so I guess for me the origins go a very long way back to the days I started my postdoc in 2001 at MIT and I was doing research with Madhu Sudan one of the leading figures in the development of the PCP theorem and it

was this trajectory of you know reducing both making systems a bit more efficient but also reducing stuff more and more towards practice and this is something that was our passion for a very long time so so again this for me it started maybe in 2001 I started collaborating with Alice and Loki as and around 2010 shortly after my collapse of our third co-founder also started working with us and advancing this both the science and the technology of this thing and we could load me our CEO and fourth

co-founder so he's been a close friend of mine for more than 30 years and also almost as many years was was my business mentor and he certainly was following everything in helping us out with already easy cash and other things so at some point when it was clear that this particular technology can can benefit from a dedicated company so you know the four of us sort of joined team joined forces and that's how it started towards the end of 2017 which is about two years ago cool we met a couple weeks ago in in Tel Aviv star choir organizes fantastic

conference which is called star core sessions we've mentioned it a few times on the podcast since then and during your keynote talk you gave you you gave this description of the zero knowledge space as going through a Cambrian explosion you describe what you meant there and talk about the unique time in which we live with regards to how Z K peas are evolving so this notion of the Cambrian explosion that was this era about half a billion years ago where from this primordial soup of microbes or things like that all of a sudden in a very short span of time a lot of the

more advanced creatures that that we see today you know various plants and insects and other forms of life also you know spawned off in a very short time and with cryptographic proof systems commonly referred to as the key Peas although not not all of them are formerly as your knowledge proof systems there's a big family of them so these proof systems they've been researched in theory since 1985 since this beautiful discovery by Gould Vasa McCauley a knockoff of interactive proofs and they've been pretty much confined mostly to theoretical works and then around

sort of starting in 2005 to 2010 suddenly we see this emergence of more practical stuff and over the past decade there's been a proliferation of different forms of proof systems based on all kinds of different assumptions and it seems that the speed of release of new kinds of proof systems is sort of increasing almost exponentially or very rapidly and just over the like past three or four months we've we've heard about plunk in Sonic and supersonic and dark and fractal in Marlin and you know by the time we'll end this interview maybe

a couple more will be released so it's really quite remarkable and where do you think this is all heading you know if we're now in the Cambrian explosion and and you you sort of equate that to the the real Cambrian explosion that happened and with regards to life you know where can this all lead us knowing that there's just so much more ahead to discover hard to say okay one thing I think is for sure that we'll see a lot of systems deployed and and you know integrated into products that's one thing I think Stark where is leading with in you know this particular adoption of a particular form of proof

systems and bringing them into live products that will help scaling so we'll see a proliferation not just of academic research but also of dedicated product ization and you know robust code bases that will be used I think at the same time we'll also see a better understanding of the different building blocks by which you can compose and build different proof systems we're already seeing this so this will continue and you know at some point we'll we'll come to some decent understanding and the most exciting stuff is that often with with research you know some some completely unexpected new discoveries or challenges or open

problems might be discovered but but that you know one cannot predict what they will look like that's maybe the scientists the most exciting aspect to me do you think it's a matter of like we're gonna be finding the perfect proof system that like kind of satisfies most of the use cases or are gonna get into a ecosystem where we have like many different proof systems each of that maybe are good for specific use cases I think that when the dust settles they'll probably be a very small number of proof systems that are actually used at scale because you know they're built in different principles and mixing them is not as efficient as sticking with one or two of

them and I'm biased of course but you know my bet is on Starks for reasons that I could describe later so that's what I it's just a little bit like you know if you look at other kinds of infrastructures for in in the computer science world so there is an abundance of communication protocols or ways to build operating systems or programming languages but at the end of the day there is a very small number of them that actually stick around and they're used by everyone so I think it will be a little bit like like that maybe not one but but I think there'll be a small number so not all that the school research will be necessarily adopted as

infrastructure by all systems so how would you say like we should go about like thinking about the trade-offs and comparisons between different proof systems what are some of the parameters who should be looking at like the ones that come to up that I'm aware of are things like prover time verification time and proof size what are some other things that are we should be looking at yes oh definitely prove her verifier and and prove size I would say that especially if you look at scaling it's far more important to look also at the amortized costs which means you know for a certain batch you take let's say

prover timing and you divide it by the number of statements or transactions that this proof covers and the same thing with verification time or gas cost same thing with proof length that's far more important in terms of scaling one other set of parameters that was I think a bit overlooked and we were very interested in is the cryptographic assumptions on which you're building these systems and a way to think of it is in terms of future proofing your systems so the more your assumptions are sort of fundamental have been around for

a while and the more other stuff is is built on them it sort of implies that they're a little bit more future proof than more exotic assumptions that have been around for a shorter amount of time and scrutinized by fewer peers so that's another dimension that that was slightly overlooked in evaluating these systems so I think this is a good with segue into the world of Starks now before we dive deep into Starks I think it'd be helpful to get a brief refresh on zero knowledge proof so that just everyone's on the same page can you summarize very succinctly what is a zero knowledge proof

so zero knowledge proof there's a mathematical definition it is one that covers privacy basically informally as your knowledge poof is is a proof think of it as some sort of beef tough grocery receipt that when you look at it you're completely certain that the say the total sum that you need to pay is correct but you learn nothing other than this fact so it's a privacy-preserving technique a magical one at that the term zkp by the way by now has been sort of borrowed to cover a much larger range of proof systems that that I like to refer to as either cryptographic proofs in general or sometimes as proofs of

computational integrity and both of these terms are terms that are not mathematically and formally defined so you could sort of loosely use them to define a very large range of proof systems including ones that mostly care about scalability in our privacy so you have this sort of receipt that tells you that a very large computation or a very large batch of transactions has been processed correctly without needing to pay the cost of checking each and every one of these transactions so this larger domain of cryptographic proofs or proofs of computational integrity there's a variety of technologies that allow you

to scale systems up and assert their correctness and computational integrity and also to do so in a privacy-preserving manner okay thanks that's that's a very clear explanation and so what are Starks and how do they fit in this broader context so within the variety of proof systems out there a proof system that satisfies basically two important parameters will be called a stark and these important parameters are one that it is scalable which means that as the number of transactions you're processing goes to infinity proving time scales with it nearly linearly so it's almost the same

cost to just compute the stuff as it is to generate a proof for it and at the same time verifying a proof scales exponentially smaller than the amount of computation so a system that is scaleable that's the essence torque and also transparent which means that there is no trusted set up and all the the only ingredient that you need in order to make the system secure is its public source of randomness or you need to assume that the universe has some entropy in it so systems that are scalable and transparent are called Starks and there's a very natural way of

constructing such Starks that that leads to systems that are also post quantum secure and have very efficient proved her and verifier in concrete terms so I I knew that the T in Stark meant the transparent but I actually didn't know I thought that the S stand for scalable because in starch the S stands for sustained and so can you explain like what's the reasoning behind that difference there does the Starks not have this like succinct nest property that's present in snarks yeah well the the mathematical definition of six inked in in a snark is one that sort of involves a security parameter and talks

about a constant size proof that is constant but sort of allowed to be polynomial in this security parameter so sort of I mean I don't want to get bogged into very technical details one could say that the term succinct refers aren't the only to one part of scalability which is you want to verifier to be very efficient but that's not not enough for scalability you need something more and that is that you need the proving time to scale really well and the reason this is important is because we know theoretical constructions for instance the PCP theorem where you can get amazingly succinctly rafin time but at a horrendous cost the proving time so

succinctness is not enough for scalability it's necessary but not sufficient you also need this other aspect which is super efficient proving time so when we coined the definition of a Stark we wanted to make sure that we're also capturing that aspect as well which is why we think it's better to use scalability as this sort of two-pronged definition both efficient proving time and efficient verification time so when it comes to snarks I think one of the things that sometimes a little bit confusing and correct me if I'm wrong here but the term snark it you know it refers to this idea of something that's

a succinct non interactive argument of knowledge and then the term ZK snart also at the same time refers to like a very specific construction is that true and if so is that also the same thing for starks is that is it also referring to a specific construction or is it a just a general term so both today the term snark and ZK snark and the same thing with Stark and ZK Stark these are general definitions that that could cover potentially a very large variety of proof systems but it is true that both of these terms have been sort of associated with with very specific systems so when people talk about snarks they usually mean a very specific kind

of a ZK snark that is used by Z cash and I guess that when people talk about Starks they usually refer to the flavour of systems that that is based on IOPS and uses things like I mean the fry protocol for a low degree testing so so I guess this is inevitable that you have these general mathematical terms that then sort of get associated with very particular proof systems but that's you know it is what it is so could you uh now walk us through a little bit of what are the trade-offs between you know the ZK snarks that are used in C cash versus the Starks that you guys are working on

versus some of the other family such as like bulletproof yeah sure so let's let's talk about these three things again the the snarks of Zee cash this starts that we're building acknowledging that there are other kinds of snarks and Starks and there will be other kinds but let's just you know associate snarks with the stuff of Zee cash Starks with the stuff that that we're building and there is bulletproof snarks have famously very short proofs make around 200 bytes bullet proofs have longer proofs around let's say 2 kilobytes or so and Starks have longer proofs around 20 kilobytes so you go one order of magnitude increase moving from Starks

the bullet proofs and then distorts in terms of verification time snarks and Starks are pretty similar they're very very fast Starks are a little bit faster and verification but you know 10 milliseconds in Starks vs. I don't know 8 milliseconds relation starts and then bulletproof sir or less so big cause verification time in bulletproof scales actually linearly with the amount of computation not so bullet proofs are not scalable according to our definition of the term that's in terms of verification time proving time is fastest and starts then about one order of magnitude slower in snarks and

bulletproof and I think the most important difference is in sort of this other dimension of future proofing the systems or what kind of assumptions you're using so Starks require only the existence of some collision resistant hash function which implies that they are possibly post quantum secure and they require very lean cryptography bulletproof require assumptions regarding the discrete log over elliptic curve groups which is a slightly more exotic problem but it's been around for like to get decades or so and then snarks require things called knowledge of exponent which are even more recent

and slightly more exotic so I guess that's sort of a comparison along the four dimensions of proof length proving time verifying time and future proofing the system okay so just to summarize in terms of proof size there's a clear difference between bulletproof snarks and Starks sort of one order of magnitude for more than the previous four for every system however in the verification time where Starks have a much larger proof the verification time will be lower than snarks and bulletproof s' so will have faster verifications and then in terms the real

differentiating factor is it Starks is relies upon cryptographic assumptions that have been around since the 70s so these are collision resistant hash --is which means that they're a quantum resistant and very lean and presumably future proof because of this quantum resistant feature that summing up correctly yes I think that's a good summary and also there's a fourth axis which is the proving time which is again fastest which starts and we get the quantum resistance because there's no sort of like public key cryptography or pairings or anything like that right quantum computers are known to be pretty

good at solving problems related to hidden subgroups and then you know factoring in discrete log and things like that but they're not known to be able to break all cryptography and in particular there's a wide held belief that most hash functions will be secure against quantum quantum computers which is why Starks or so so if Starks relies on cryptographic assumptions that have existed since the 70s why did it take so long for them to come into existence where are there other things that needed to be invented before Starks could exist or did we just need you to figure it out that's a good question so so a lot of

the more practical cryptography in recent years has revolved around sort of a number of theoretic assumptions and elliptic curves and so on so there's so there there's this very wide class of researchers that are sort of somewhere between theory and practice that are very familiar who are very familiar with cryptography that uses elliptic curves and you know RSA and Arthur things and the branch from which starts emerge from which is known as computational complexity or the PCP theorem and things like that has been you know this sort of playground mostly of the theoreticians and mathematicians and very few

practitioners are more practical oriented researchers have ventured into it another factor was that some of the earlier constructions of things like Starks were not as efficient and and you know we needed this sort of tighten and and invent some some new stuff like you know the the Fry protocol fast reed-solomon io P P and and the IOP model and so the the IOP models don't work with rasaan dopiaza and Nick Spooner the the Fry protocol is his joint work with Michael adaptive and Udo bent of in you know and Horsch and then

then we've done some some further improvements to fry that also made things a bit tighter like deep fry that most recently emerged which is joint work with yo gold built from Starke where and two of our scientific advisors swastika party and shebang nice olive so there's a little bit of advancement that needed to be done and so you know new mathematical stuff that needed to be invented but there's it's I think it's also this cultural thing that the class of folks that can build things like Starks used to include a very small set of people and and those that are more familiar with the techniques around snarks are bulletproof sir other things

is is a wider set of researchers okay interesting think about some of the newer stuff that's coming out as well especially within the IOP family things like aurora and stuff there's a wide variety of systems that are similar to Starks in requiring only the existence of a hash function so I've always one there's a Zika boo League evil and then there's a more recent I believe it's a fractal and Marlene that at least one of them doesn't really require you know anything but for collision resistant hash and

they're all very similar in some of their techniques which uses basically interactive Oracle proofs and low-degree testing algorithms so they're similar I mean in particular Aloha is not scalable because it's verifier scales linearly with the size of the input it's more geared towards a you know circuits of unknown structure that the verifier must process whereas Starks have scalable verification or this exponential speed-up that's the main difference between a roar and start there are other systems out there that are also similar like Leggero that that has square root

proof length its verification times actually again linear in the size of the computation and there's others so looking at this broad set of zeros that we've described are there specific applications that are better suited for say Starks or snarks or bullet proofs how do they distinguish each other in how they're implemented yeah I mean that's a great question I think that so from my point of view there I think we're not that far from from the optimum at least with respect to Starks and let me explain why there are some mathematically proven lower bounds that were not that far off from

so for instance if your computation is scaling parameters let's use T for that parameter so as T goes to infinity we know that verifier time must increase at least like the logarithm of T and we know that the prover time must scale at least like T now the Starks that we have right now Coover timescales almost linearly in T there's really like one fast Fourier transform there and improving in the fast Fourier transform cost T times logarithm of T and improving on the FFT is this long standing open problem in all of you know math and an algorithm so so I think it's

very safe to assume that you know it would require a very major breakthrough in order to do something that's better than T log T that's my belief then in terms of verification time again Starks already have log of t2 very small power so you could reduce that power up a little bit but you're very close to theoretical limits and in terms of cryptographic assumptions again there's I'm not aware of many assumptions that are weaker than assuming the existence of a collision resistant hash so long almost any of the parameters that you look at there's just very little you know fat that you can hope to trim in in the future so I mean that's part of the

reason that we are so optimistic about you know the use of of Starks but that's a really good question I mean you know when you get close to theoretical limits you know that you're pretty safe I would say recently star war announced two products or initiatives that they were working on stark decks and start pay both of these make use of what we call ZK roll-ups which we'll get to in a little bit can you talk about how these two products fit into the broader mission of stark where yes so there's this principle of

blockchains that that I'd like to call inclusive accountability which means that everyone using their laptop is invited to sort of monitor the health of all of the system and verify everything that's going on but once you impose this principle of inclusive accountability on a financial system like Bitcoin or aetherium then two things get compromised first one is privacy because everyone verifies everything and the second one is scalability because if you wanna grow your system 10x then you need everyone who wants to monitor the system to sort of go and buy ten laptops instead of one or increase their

bandwidth 10x which is unrealistic and if you do that you'll be sort of throwing out a whole lot of folks from monitoring the health of the system so what you really want to do and this is where something like stars come in is you would like to use the scalability aspect and have one entity generate the proof for ever-increasing batches and use this magical aspect of Starks where verification time scales exponentially smaller than batch size in order to maintain inclusive accountability still everyone can check everything and make sure that the system is ok but you don't need to replace your laptop every time the system goes up 10x now we started

asking ourselves where can we deploy this functionality the scalability in the best way and we looked around a little bit and it seemed to us that the most simplest and fastest way to address a real problem seen by the world today is in the area of basically transacting that's payments and also trading because currently due to the low throughput of blockchains essentially if you want to use them either as payment systems or you want to trade them using the principles of inclusive accountability and you know trust no one so on and so forth you can't really do that so you have a wide variety of players you know the

custodial exchanges that tell you okay you know what send your bitcoins or Theor here park them with us will maintain the keys and and then you know you'll do all your trading on our books and similar things happen with payment providers where basically they sort of tell you you know leave your payments with us at the end of the month we'll sort of you know check out all the books and send one big payment to the various merchants and so on and we thought that would be really good to you Starks to show the world how you can maintain inclusive accountability not need to trust or hand over custody of your funds your payments at any point and still scale the system even within its existing parameters

without waiting for no plasma or aetherium 2.0 on the existing aetherium we can already you know that settle and batch pay tens of thousands of transactions which is you know two to three order of magnitudes more than aetherium can do natively so that's how we got to this line of products that's really cool and I was really excited to hear about this at Starke where sessions when you first talked about it publicly how do you arrive at this the scalability of tens of thousands of transactions per block in a theorem and how are you making use of

Starks to do that that's a great question Sebastian so remember that the s in the Starks stands for scalability which means that as T where T is now the number of trades that you're settling as T goes to infinity proving time which is done you know on the cloud or on some huge server scales almost linearly with T so you can reach very large batch sizes at the same time verifying a batch of T trades does not take you know does not scale linearly and T it scales actually like the logarithm of T which means that each time you go 10x on on the number of transactions you want to

settle you're only you know doing +1 on the amount of gas that you're paying on the chain so using this kind of you know math allows you to take for instance a batch of 32,000 trades generate the single proof that they settled correctly and that single proof can be verified within the gas limit of a single etherion block so this gives you an advertised gas cost of around 200 gas per trade that is settled so you are using the scalability the exponential speed-up and verification in order to

exponentially reduce the gas cost of settlements and why didn't you choose to focus on scalability rather than privacy for instance which is what I think most people associate to zero knowledge systems so back in the day when we thought about which of the two aspects of Starks should we pursue first is it privacy or scalability our thinking was something along these lines okay there are a lot of technologies that for the single shielded transaction are pretty good you have the snarks of Z cache you had already back then bulletproof switch

again for a single shielded transaction works pretty well and a bunch of other technologies but there was this huge need in scalability solutions I mean there still is and there was no real technological alternative to the efficiency of Starks in this respect and I think there still is if this goes back to your question about you know how far are we from you know the optimal proof system so even today with all these newest systems if you look head to head at huge batches of computations stark still outperform all of them and I think this you know it's it's likely to

continue in this way so it was very clear to us that scalability is an area where this technology can be applied to very in a very unique way and it's a very big need so that's why we addressed it first we will add privacy have no doubt but I think it will come later so one thing that's happening here is in this model you're batching with in a block but it's still so you you amortize only what's going on in a single block we can compare this to things like coda for example or like things that make use of recursive snarks where not only do

you amortize the computation within a block but you amortize the computation over the entire system would it be possible to recurse the Starks because then if so you only really have to publish the proof on to aetherium the data but you don't actually have to run the verifier on aetherium until someone actually wants to exit so would that be possible to be done with the Starks so whenever you have a proof system in which verification scales sub linearly with computation size you can compose it incrementally so this this notion was

first described in this beautiful paper by Paul valiant and it's called incrementally verifiable computation so whenever you have a proof system in which the verifier running time scales sub linearly with the computation size you can use it for chopping up a computation in two steps and doing them one after the other and proving that you ran a verifier that ran a verifier that so on and so forth so you could do that with Starks as well you know quite efficiently whether for a given problem this is your best line of attack I'm skeptical I think that for most applications you're better off just

using a start will be more efficient or you might want to use limited recursion that starts let's say you know one level of recursion which I mean you prove that you checked a bunch of proofs that's where you went not that you check proofs that check proof this check proofed and so on and so forth so just to summarize you can do a recursive start I think that practically for most problems that you'll face you are better off not using it even though you can let's say in the stark Dex let's say users only exit their coins once every hundred blocks let's say right mm-hmm it then if we use the recursive

Stark instead of having to run a verifier every single block we can only have to run the verifier once every really only we only need to verify the state to prove the state to aetherium when someone is actually trying to exit so how many blocks for example would that have to be that makes it worth it to use the recursive system I don't know but like you could still if you want to prove that you checked a hundred proofs sequentially it would still only be one level of recursion your statement would be I saw a sequence of a hundred proofs one after the other

this is not a hundred levels of recursion 100 levels of recursion would be I want with each block to verify you know that verify run by the previous block which checked the verify run by the previous one so on and so forth ad infinitum that this thing worked and that's a very different construction that is also you know it's a security analysis is sort of much more tricky to do and if you really want to do it the right way then you know various parameters blow up very quickly so even for the use case that you're giving which is a very practical one you're probably better off with just having one level of recursion you know every a hundred blocks you have a verifier

proving to you that it's saw sequence of 100 proofs and it checked all of them this is still one level of recursion and you could have you know one for every hundred blocks and you do then you could have a daily proof with all blocks of the day all blocks of a week and so on and so forth so this is an example of a use case that I think you're better off using just one level of recursion rather than the notion of infinite recursion oh I see okay yeah that makes sense and so would it be possible to sort of like compose these like things together so let's say you know it's 150 blocks we can take one up a hundred and then one or fifty and we can put these together researcher what I'm trying to think

through here is is there a way to offload the verification gas cost on to the users the user who wants to exit rather than on the people who are submitting the proofs well the way it works right now is that the gas cost is not on the provers the provers are working very hard to generate the proof but the gas cost is is sort of uh-oh sorry you write the prover is submitting the proof and is paying with gas to this sort of network to sort of check this thing I think that if you don't have any proof out there for a while then you're risking all kinds of attacks right how

do you know that the system is actually evolving correctly until someone 100 blocks later comes and says oh I need to you know take my money out maybe by then someone ran off with it and you know no proofs are provided so so I'm not sure I think you still need proofs pretty frequently I believe that from what you guys wrote up it's that you're including for the solve data availability you're still pushing the data on to aetherium of all the trade data and so couldn't this proof data also be pushed on in the same way that the rest of the data availability is done but just not actually run the verifier yeah you could do that but again I think you're risking

so if the main network doesn't really you know see or check the proof then someone could start deviating from you're just not putting proofs as they should and now I think you're sort of going away from this notion of maintaining at all times a system that is has integrity to one that requires something like a watchtower or fraud proofs or something just right until you reach that that check point a hundred bucks later this startx demonstration that you've built I believe it's live on aetherium main net is that correct no it's not it was just the demo that was run for

sometime on Rob's 10 test net okay what's the barrier to run this on main net and are there further optimizations that you could make in order for it to be even more scalable yeah so I mean to run it on main net first of all you have to sort of run a whole bunch of audits and then we add a lot of functionality for instance it was only in the maker Taker model and basically and sorry if you want to put on and maintenance other kinds of order types limit orders you know partial fulfillment cancellations whatnot you also needed to be integrated so this was sort of a settlement engine that has to be integrated with some exchange so you

would need to integrate it with with some relayer if it was to be over 0 x over some other protocol so there was a lot of work that still needed to be done and could still be done if we you know if real Ayres come up and want to work with us and definitely you can improve the functionality of it and that's precisely what our team has been doing pretty impressively since the launch of that that thing so now we have a system with far greater functionality and scale then what appears in that demo alpha are there any improvements that could be made if there were any pre-compile that you were allowed to add yeah I mean you would lower the gas cost basically

that's what would happen but we found ways to make everything work within the existing aetherium system and without asking for any precompile so we can work pretty efficiently even over the existing aetherium and i mean we're very proud and happy with that that's another aspect of the efficiency of Starks I mean if you compare this to what happened with snarks for instance so so you know without the pre compiles they you couldn't really run them nearly at all on theorem so that's why theorem went ahead and added some pre compiles but with Starks they're already efficient enough without any changes to

a theorem so basically those numbers that you mentioned earlier it's like how many transactions per second we could get with 8 million gas the so the limiting factor is no longer the gas limit for the verifier the limiting factor is now the proving time for the prover the gas limit per block is still a limiting aspect but we can sort of still put a lot of proofs out there so we reach the 32,000 trades that we can send settled in a single block maybe we could we could push it also to 64 K I should say with the once ýstanbul turns on with the AP 2028 that we're very proud to have helped to push forward then the only factor that will limit us

is exactly what you said it's the amount of compute that we can generate off chain but practically almost you know I can't even compute what the limit will be but it will probably in the many many millions if not maybe billions of trades that's impressive thank you so let's let's move on to Stark where the company because you guys have built these these demonstrations Stark decks and there's another initiative that came out recently called Stark pay which we didn't even have a to talk about but what is the goal of stock where the company and what problems is it trying to solve and for which types of customers

so our long-term vision is to help start technology become prevalent and used as infrastructure and a whole variety of blockchain uses and then also in uses outside of blockchains just in the standard world but you know we're so we only have 32 engine you know folks right now and we need to move cautiously one thing at a time so our first product is you know I emphasize something here is not a Dix so we are not currently building a deck so we are building scalability solutions for standard exchanges you know the

kinds that are known as centralized exchanges so just a week ago our team announced at DEFCON 5 that by early 2020 we'll be launching the stark exchange engine which is not a Dex and it will be serving diversify which again is not a Dex itself it is a you know an exchange that is sort of you know operates like Phoenix or a Phoenix with similar liquidity pools but against which you trade without ever handing custody over your assets to the exchange operator that's the big difference so very

similar to like the Xerox model very similar in the sense that you do not transfer custody over your assets to anyone while you're trading but in other ways it's very different they think 0x is this basic protocol that is used as a you know a layer that that others are supposed to build on or as we are building a service that will be serving a particular customer in this case diversify even though we would very much like to offer this service of generating proofs to other exchanges as well so it's a different business model and different sort of

system that we're building but it is similar in allowing self custodial trading and I believe you used the term prove or as a service a little bit earlier in the conversation to describe part of what stuck where does what is a prove as a service and why is that useful starker is a for-profit company famously we have not done an IC o---- we do not have a coin so we're sort of bound by the laws of physics or of economics and business we have to sort of find ways to generate profits and then sustain ourselves and main you know you know

remain you can't just be burning our money and so we need to think about business models that that make sense while we're advancing this technology and infrastructure and the notion of prover as a service is a very natural one just like you have software as a service and other service providers you know it's this thing that as long as you're using you're sort of paying it but if you know you could turn it off whatever you want so our model currently the one that we're using first as bit is proven as a service so the exchanges and and various companies that will be working with us will be some one way or another renting or paying for these

services and it's it makes a lot of economic sense on both sides would you be licensing out the prover software or would you be actually writing the proofs yourself so in the prover as a service model you don't license it out you run the servers and you know basically you get for instance will be getting batches of settlements from diversify and then generating a proof for that batch and sending it to the verifier contract on the main chain that's the current model but I want to emphasize that it's not the only one that we're considering and definitely down the line things like licensing or freemium and maybe you know in three to five years maybe selling

hardware or other things like that or all viable options that you know we'll be exploring so hearing this it sounds that it sounds like you will have service running a server and that service will be receiving transactions from an exchange and then you'll be generating a proof and sending that to the etherium chain or whatever whatever blockchain is being used I suppose to the uninformed ear that would sound like you guys are essentially centralizing that service talk about the liveness issues that this could cause and how are you ensuring that exchanges don't have to rely solely on you being available how do you reduce that this dependency

so the first answer is that just like other service providers we actually expect and you know embrace and welcome competition which means you know just like if you're looking at your cloud provider you don't need to you can't be censored by let's say Amazon you can just move it to you know Google cloud or something like that so over time we're sure that there'll be other proofer as a service competitors out there which is one answer another answer is that you know till then and even when that happens it's very important to allow customers and the end users to be able to control and get their funds even in

catastrophic events were let's say star core is hacked and and the exchange itself is hacked so just emphasize in both these cases no one I mean if you hack into star core you can't really take the users funds because they are being traded self custody' at least so only the users can now do that but someone can hack star core and try to shut down its service in order to you know prevent anything from happening so we've built a bunch of sort of the emergency hatches that you could I mean that are automatically invoked when when folks want to take their funds out of the system and and it just doesn't service them and in order to then do

that we will be you know launching a variety of data availability solutions that will ensure that users have redundancy in their access to the information they need to extract their funds if stark where or the exchange is ever catastrophically hacked cool so is there anything you want to share that you know is coming soon to start wearing uh you know what's what's on the roadmap and where can people find you and get involved yeah so we we're talking to a whole lot of exchanges and custodians and and traders and services around exchanges and in this area because we want to first of

all serve as many exchanges as they're willing to use this technology and second we would like to ensure that traders and and users have a seamless experience when they're using our technology and we'd like it to be of use to anyone who offers services to end users be it a custodian service or an OTC desk or a trading firm and so on and so forth or broker so we're holding a lot of discussions and and we see a lot of enthusiasm for integrating with this technology so meta mask announced that you know we were the first team to use their new API in order to allow traders

to use or trade on our systems using meta masks and were currently integrating our technology into ledger so that again traders can sort of seamlessly use it and were I expect we'll be announcing a whole lot of other collaborations and integration projects so that everyone can use this thing at the same time we're also talking to a lot of exchanges you know big ones and small ones and I think we'll see a few others joining diversify in in this move to a larger liquidity pool for trading and a self custodial way and this is very important for a variety of reasons

first of all it's safer for traders which is good for a business it's also good for the exchanges you know the insurance cost and security overhead is much lower another thing is that you can sort of move in and out of your issues across exchanges much more seamlessly and that's very important for again streamlining and making blockchain ecosystem a bit more like the traditional one and and lastly there's a lot of fragmentation of liquidity between different exchanges due to a variety of reasons you know geofencing and geographic locations and regulatory stuff and technological differences and we believe that our technology can

enable you know a defragmentation process of this liquidity pool and a lot more market efficiency which is why I think the folks we're talking to are also very enthusiastic about this cool well Ellie I want to thank you once again for coming on the show and for being so gracious with your time I know you're on vacation so I wanna thank you again and I look forward to having you again in the future maybe not in four years but at some point Thank You Sebastian and thank you Sonny this is as usual a very delightful experience thank you for joining us on this week's episode we released new episodes every week you can find and

subscribe to the show on iTunes Spotify YouTube SoundCloud or wherever you listen to podcasts and if you have a Google home or Alexa device you can tell it to listen to the latest episode of the epicentre podcast go to epicenter TV slash subscribe for a full list of places where you can watch and listen while you there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other podcast listeners you can follow us on Twitter and please leave us a review on iTunes helps people find the show and we're always happy to read them well thanks so much and we look forward to being back next week [Music] [Music]