Episode 270: FHE and ZKPs with Sunscreen's Ravital Solomon

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online [Music] this week I chat with ravatal Solomon the founder of sunscreen we chat about her interest in lattice based cryptography how this led to her work on fhe first at new Cipher and then with her own company sunscreen we explore the challenges of building with fhe the

power in the combination of zkp's and fhe as well as the early emergence of lattice based zero knowledge proofs now before we kick off the episode I do want to direct you to the CK jobs board there you can find jobs from Top teams working in ZK so if you're looking for your next job opportunity be sure to check it out and if you're a team looking to find great talent feel free to add your job to the jobs board as well I've added the link in the show notes now Tanya will share a little bit about this week's sponsor foreign polygon ZK evm is here this performance ZK powered open source evm equivalent rollup launched its main net beta last month polygon ZK evm is making scaling truly frictionless fast finality and evm equivalence means devs can do everything

they can do with the evm only cheaper but a network that really wants to extend ethereum's block space needs ethereum's infrastructure this infra needed to Port build and Deploy on zkevm oracle's RPC nodes apis and tooling are already on board two years ago polygon Labs bet big on ZK technology collaboration among polygon ZK teams and a built in public ethos has resulted in a big Leap Forward together ethereum users will discover what ZK can do to connect to polygon ZK evm visit polygon.technology so thanks again polygon and now here's our episode [Music] today I'm here with ravatel Solomon the

founder of sunscreen welcome to the show revital thank you Anna I'm glad to be here so today we're going to be diving back into the topic of fhe fully homomorphic encryption um but before we do that let's learn a little bit about you and also I just want to sort of figure out when exactly did we first meet so I know you're a speaker at CK Summit 4 and ZK Summit 6 online but yeah was CK Summit for the first time we met I don't think so so like I had just joined new Cipher and I had gone to ZK Summit three but it was I believe tuck speaking so I was just in attendance there oh cool so yeah maybe start from you joining new Cipher I want

to hear a little bit about your story here what were you studying before what were you working on there yeah so I think my story when it comes to cryptography starts a lot earlier than new Cipher so I went for my undergrad I did it in math I took my first cryptography course as a junior at Berkeley and I heard about this new emerging area of cryptography called lattice cryptography it wasn't very popular at the time there were no courses about it at either the undergrad or graduate level so I tracked down this math professor and I was like I really want to learn more about lattice cryptography I really want to work in this area so he agreed to work with me and start learning about lattices that

really started my journey in cryptography and I really loved it and wanted to continue I assumed to pursue cryptography you really had to be an academic so oh my gosh I have to get PhD the only way I'm going to get to do this is being a professor but for reference both of my parents are academics or ex academics they didn't have a lot of good things to say about Academia yeah so I was like what should I do um should I should I go get a PhD like should I see if I even like researched so I found a more research-based master's program and that was in the UK I went there I did more stuff in lattice cryptography I did a lot of space group

signatures and I confirm that I absolutely loved lattice cryptography I absolutely loved research but I hated Academia so I was looking around at the time and I was like well I really want to do lattice cryptography but how am I going to do this like is anyone going to pay me to work on this area and I was super open-minded I was like anything to do with lattice cryptography I am open to and I was lucky to stumble across new Cipher on Hacker News since they're a YC company and they were hiring at the time so I reached out to them the first person I remember meeting was tucks there and that's how I really started in the blockchain and web 3 space cool it's interesting you talk about lattice

cryptography maybe can you define what that is and is that the basis of fhe so you can think of lattice cryptography as um a generalization of some of the math you've done and probably middle school or high school when you're graphing points on some planes you think of like an X and Y my access they're both on the real line lattices can be thought of as some sort of subset of these points in the space so instead of taking arbitrary kind of decimal points like you can think for the X and Y coordinate maybe you have 1.001 you have 2.001 we're going to restrict it in the simplest case to just integer points so you can think of it as

some sort of discrete space sitting inside some kind of real space oof that is that's tricky it's hard to follow but um like what general area is lattice cryptography is it close to like elliptic curve cryptography is it a totally different world yeah yeah so a lot of scriptography is totally different from the other other areas of cryptography what differentiates lattice cryptography from elliptic curve-based cryptography is that it's post Quantum so it's secure against attacks from a quantum computer and I would say if you want to think about what area of math lattice cryptography falls under it probably can

be thought of as linear algebra on like steroids so instead of thinking about linear algebra and like matrices and vectors with numbers you're instead thinking about polynomials oh cool so you're saying this is the sort of basis like fhe is built around lattice cryptography yes is there other types of math in fhe that one should also be aware of or is if you have a good understanding of lattice can you like lattice cryptography can you do a lot if you have a good understanding of lattices you can do fhe for whatever reason the only known fhe schemes are based on lattice cryptography no one has been able to successfully construct an fhe scheme using other types of

cryptography yet cool all right so you were at new Cipher tell me a little bit about what kind of work you were doing there what projects were you getting into to yeah so I joined the company to really explore if fully homomorphic encryption could make sense for solving some of the Privacy problems in web 3. it wasn't directly related to new Cipher's main work but the founders were super interested in seeing how fully homomorphic encryption could fit into the web 3 space I have to say when I joined U Cipher I was not very optimistic about lattice cryptography making any sense for web3 in general it has a pretty negative

perception when it comes to efficiency but I was surprised to see in terms of the existing privacy Solutions in the web 3 space fhe could actually be quite performant and could make sense for quite a few applications were you also watching how quickly like it's almost like these cryptographic Concepts had been around for a long time you had seen the progress go in that sort of Academic Way slow and sure but maybe a little bit Niche once you started to connect it to these like highly incentivized networks and throw a lot of funding at it it started to obviously accelerate really quickly did that give you hope too were you kind of like maybe we don't have to worry about some of these inefficiencies

because it could actually be accelerated faster no so I Am Naturally a super pessimistic person and I hate this idea I hate the idea of like relying on somebody else to build Hardware accelerators to solve like my problems oh so to me it was like is there an fhe scheme that makes sense right now as is to solve some of the problems in the space I am biased I obviously think the answer is yes but no I I wasn't looking like with optimism or hope towards people building accelerators okay but when I say acceleration I don't actually mean Hardware acceleration I mean just like the acceleration of research and Technology I mean even in your experience you've now been in this I

mean if you're saying you were at CK Summit three that was in 2019 I think and you were definitely a CK Summit for so yeah in that time you've seen a lot of the proving systems be kind of optimized and like become faster and smaller and quicker like all these things have happened do you feel like in that time have you seen fhe also or did you see similar growth in the on the fhe side absolutely not so definitely not when it comes to like Theory improvements I was really hopeful I had the same kind of expectation when I was thinking about fhe and compatibility with zero knowledge proofs certainly in this long long time frame there will be

like a better zero knowledge proof system that's compatible with fhe there's so many people working on this but the answer is there weren't many improvements and fhe has a lot fewer people working in it than I think zero knowledge proof so it's just it's been a slower time we haven't been here as long fhe's been here I think since 2009 zero and all troops have had a huge Head Start they're from like the late 80s so it'll take us a little bit of time to catch up but when you say this it also makes me think that this is actually a really interesting time to start looking at FHA so it's a bit behind on the zkp front but like it seems like there's a lot of space for

improvement definitely so that's why I'm really excited to work in this space I think this is the really early stages of fhe when it comes to usability and applications and if you're working in a space right now you get to really Define what the feature of fhe will look like versus I think zero knowledge proofs some people have already defined what that landscape is going to look like cool all right so you were working at new Cipher you were working on this cool thing that would maybe or maybe not sort of fit into the company's Mission but then you've spun out to create sunscreen tell us a little bit about that yeah so at some point it became clear that to really pursue this mission of bringing

fully homomorphic encryption to web3 a lot of resources were needed and quite a bit of work needed to happen and did it make sense for the new Cipher team to really pivot from whatever they were working on to like working on this brand new mission maybe maybe not but McLean and Michael were super encouraging of me kind of going off starting my own Venture finding people to work on these problems so that's exactly what happened cool so today tell us a little bit about what sunscreen is actually building yeah so sunscreen's mission is to bring Advanced privacy technology to web3 engineers and we're working on SDK that packages together fully homomorphic encryption and zero knowledge proofs to make

privacy accessible to developers I did an episode with the CEO of Zama and we talked a little bit about some of the ideas that they had around you know putting computation into this private space like what what is actually what kind of fhe are you talking about like what would somebody use that space for is it almost like this Enclave that's like totally cryptographic where you can do private computation are you thinking about it in a different way there's quite a few applications of fhe and it depends like how you imagine fhe fitting into web3 so one thing a lot of people are interested in is private smart contracts so the idea that we can do computation directly on encrypted

data in this case the workflow would roughly look like the following the user encrypts their data using an fhe scheme they produce some zero knowledge proofs verifying conditions on their encrypted data then the validators of the system they check the proofs and they use the homomorphic properties of the fhe scheme to perform the computation on the user's encrypted data and update the state but there are other applications of fhe we've seen quite a bit of interest in in the last few months and some of those have to do with addressing Med issues that use case it's not quite as clear if you need zero knowledge proofs for it but roughly speaking you can think of

wanting to perform some sort of field bid auction and you would need to combine fhe with some other tools you'd be looking at maybe threshold fhe where you can imagine the trust is distributed between a few different parties and they would come together to decrypt things and you'd run an auction you'd order a bunch of bids and you'd only reveal the winning bid that may or may not need zero knowledge proofs it's not quite as clear you just said threshold is it threshold or threshold he uh in this case we'd be looking at threshold fhe threshold he is something a little bit different so when you talk about homomorphic encryption it may only support one type

of operation on encrypted data so maybe you could add encrypted data together or multiply encrypted data together but you definitely can't do both when you talk about threshold fhe you want to be able to do both types of computations on encrypted data and when you talk about threshold fhe though what's the fully what does that actually stand for in this the the fully part still kind of is attached to the the homomorphic encryption part so you can imagine there's fhe and there's like this new um word that goes in front of it that says threshold and the reason you want that is that for some of these use cases with people thinking about auctions you don't want to entrust one party with all

of the data so in some sense you can ensure that if we run this auction and we have a bunch of different bids some parties have to come together to only decrypt the first bid otherwise we might be trusting one party to potentially not decrypt everyone's fits tell me a little bit more about like the exact use case then of sunscreen what are you guys doing is there some sort of use case that you're like very very focused on yeah so right now we're exploring I would say three major use cases we really view ourselves as building privacy tools for other protocols and other people okay rather than like we are going to go out there and necessarily solve all of these problems

as a company for the three major applications we're very interested in private smart contracts um that we've already spoken a little bit about for the Second Use case we're interested in doing some sort of sealed bid auction using a variant of fully homomorphic encryption called threshold fully homomorphic encryption the idea with threshold fully homomorphic encryption is that you're going to take your keys and you're essentially going to break them up into little pieces that you're going to distribute out to a number of different parties so encryption still works the same you take like the public key you encrypt it with respect to the the key but decryption Works a little bit differently where

these different parties now have to come together have some sort of interaction in some sense to decrypt whatever the encrypted data is so you can imagine it's useful when you don't want to entrust one party with all of your data there's two other acronyms that came to my mind as you described it one was like a dkg and a MPC is either of these related to what you just said yeah I say they're pretty similar you are kind of breaking up the keys and sharing it and many times um this version of fhe which is sometimes also referred to as multi-party FHA oh okay there we go party computation so you're correct all right is it of hybrid then is it sort of using similar ideas or is it just

actually just providing the same benefits but it's completely different under the hood Maybe it's using some of the same ideas from the other spaces so you want to distribute trust you want to have parties interact to do a computation but you still want the homomorphic properties of that encryption scheme you still want somebody else able to perform computation on some kind of encrypted data got it what's the third use case so far you said private smart contracts and auctions yes so there's a closely related one to auctions and we've seen quite a bit of interest in people building dark pools so the idea here is can we match we'll say orders together in some sort of place that is not open

to the regular Market using fhe when you gave the talk at CK Summit six this was online you talked a lot about like the Mev use case like is that does that have something to do with the auctions you just described or is that actually a different a different construction completely it is completely different okay so for my previous talk at one of those ZK Summits it was really this idea that we want to protect users against front running and specifically we're interested in protecting users against sandwich attacks so for a lot of these attacks on amms it had to do with the fact that you could see the user's orders so the idea here was could we use fhe to hide the user's orders and protect them against front running and

sandwich attacks the use case with the auctions is a little bit different so here we're interested in essentially bidding for Block space so helping Searcher bid for Block space how might they do that maybe they want to participate in some sealed bit option and the winner of that auction it will be prioritized in terms of the block maybe a way of doing that is using fhe for this auction so everybody encrypts their bid with respect to some threshold fhe scheme we order all the bids and we only open up the revealing bid so you can imagine then that everyone else's bids are still hidden you really can't correlate their behavior from auction to

auction so maybe for example we know Anna always gives really bad bids so we're not even going to bother with hers threshold fhe we would never reveal the losing bid so there wouldn't be some sort of linking or tracking of your behavior across auctions we wouldn't have like a profile of how you behave it's it's interesting I actually just did an episode which I think is going to come out just before this one on auctions so we have a whole episode where we talk all about auctions I don't know that we talked about an fhe case though we did have some ZK ideas around auctions that were floated but um this was kind of new to me I want to just go like one step back to the Mev case and I

know this is not a use case that sunscreen's focused on but you had presented this sort of fhe approach and I'm realizing this I think that was the first time that I heard that problem space being solved with something like fhe more recently what I've heard more about is stuff like threshold decryption as a solution which I is a different technique I guess they're they're unrelated right they are similar oh they're so um okay yeah so you can think of threshold encryption as like a weaker form or you could maybe alternatively threshold fhe is an extension of threshold encryption or you can now do computation on encrypted data as well okay okay so it is actually related so this but but would you say what you had

actually presented then was it like more of an intense like full-fledged version and now you need you don't need such crazy privacy so you can actually like allow for a simpler construction no Okay so in the med space this is more about Searchers kind of bidding for Block space whereas when I was talking about just fhe more generally in that previous DK Summit it was for protecting users so very very different kind of use cases and applications meant for different people in the space one is researchers one is for like end users who just want to exchange some token okay how

developed are these tools at this point if there was a developer out there listening and they wanted to actually use some of this fhe stuff how in the weeds do you have to be is there anything that's kind of like are there any libraries that somebody could already try using or would you say we're still ways off from that we're still quite a ways off so I wouldn't say that it's easy for most developers to use fhe in any web3 application there are a lot of challenges with fhe performance you need to be I would say some kind of cryptography expert to set up an fhe scheme correctly not so much for security almost entirely to get decent performance okay the other issue is that for most applications in web 3 you can

imagine that if you encrypt data but you're not really sure ahead of time of how many computations you might want to do on that encrypted data and that makes selecting parameters really difficult if not impossible in many situations the other issue is that to really make use of encrypted data in web3 since we're working in a trustless setting we need to verify conditions on our fhe encrypted data and it turns out that that is very very difficult and generally very inefficient with the current zero knowledge proofs available what do you mean by that checking conditions yeah so let's imagine that you're feeding encrypted data into an

application I'm feeding encrypted data into an application we don't trust each other and we don't trust anyone else in the space how can anyone else verify that your encrypted data meets the conditions of that application let's say for example that maybe this application requires your account balance to be above a certain value if your account balance isn't encrypted and only you have the key how can the rest of us verify if that condition is met we can't so Ural knowledge proofs need to come into play here that way you'd be able to prove to the rest of us that your account balance is above a certain value without revealing what exactly your account balance is the challenge here is that fhe uses something called lattice

based cryptography while the most efficient zero knowledge group constructions definitely don't use lattices so how do you combine these two and get good performance that is actually a really really hard problem and much more difficult than making usable why are they hard to combine like are you trying to put a zkp into fhe or vice versa like I'm kind of trying to understand what's the interaction point between these two things like what it sounds like is you're creating a proof on one side and then you're just like adding it to encrypted data why is that hard yeah so there's a number of conditions you're

likely going to want to prove about your fhe encrypted data if we're thinking about just private transactions and we're working in the account model maybe some conditions you want to prove is that the amount you're sending to somebody is positive you're not trying to deduct money off of someone else's account you might want to prove stuff like you have enough balance in your account to make this transaction those are pretty cheap and pretty easy to prove with General ZK snarks the difficulty here is about proving that you have a well-formed ciphertext so you're not just giving somebody garbage because we need to prove something about lattices if we try to turn it into a circuit using many of the current CK snarks you

end up with things with millions and millions of gates so the performance is really bad you need either a lattice based proof system which will allow you to more efficiently prove things about lattices or you need to find some sort of clever hack of how might you connect a lattice encryption scheme with some non-lattice based proof system in the work that you're doing do you have to actually also think about or even like experiment with building zkps differently or are you just like that's how zkps are we're only going to work figure out how to work with them it's a little bit of both so we had to

investigate quite a bit into zero knowledge proof systems both what's used currently in the web 3 space and then also what's being done in Academia also on like the lattice based side so yeah I I would say that we're doing both research and we're also trying to make use of existing zero knowledge crew systems where we can is there work being done for like maybe this is going to sound totally insane but like lattice based zkps like does that is that a possibility yeah yeah so there's actually quite a bit of work in lattice based ekps especially on like the academic side the the challenge with lattice based zero knowledge proofs is that while like proofer time and verifier time might be

really fast the proof sizes are terrible they're definitely not acceptable for web3 so when I say not acceptable we're often talking for this kind of use case megabytes in size for proofs so it doesn't seem feasible right now to use a lattice bass proof system in the web 3 space is there any work on like then using recursion to try to like compress that down do you need the output to still be like lattice friendly somehow yeah I would say so so there are some of the more modern lattice space crew systems do make use of recursion like you're saying but the challenge here is it's not quite clear what the proven

verifier time will be like when you start introducing recursion into these proof systems and the current works are super academic there are no implementations of any kind so it's very difficult to get a sense of performance got it I'm trying to also understand if when you describe the need for like a lattice based zkp does using lattice cryptography under the hood does it like fundamentally change how a verifier is working like or is it yeah I'm trying to sort of picture what uh what the difference would be and if you need sort of a different kind of output so you could never use some of the techniques that have been used in existing snarks

because it's so very different no so I would just kind of like off off kind of whatever we're saying they have made use of a lot of the techniques since Marks and lattice base proofs what we've kind of figured out in terms of what we're working on is that it almost certainly doesn't make sense to use a lot of space proof system there is this actually very very strange ugly proof system that turns a lattice based relation into something with elliptic curves and that really allows you to get better performance than working with regular ZK snark and better proof sizes than using something lattice based because there's no way anyone's okay with megabyte proof sizes okay so that's basically the direction that you've

chosen then yeah is it sort of like is it compiling or is it transforming what where like yeah how does that connection happen yeah so there's a transformation you're taking a lattice based relations which you can think of as some sort of Matrix vector equation and then it's transforming it into a Pederson commitment and doing something that looks a lot like bulletproofs with that commitment and that allows you to get pretty decent performance and much better proof sizes than working with a lattice bass proof system interesting is that like the kind of systems that you're then building yeah that is what we're currently looking at because we think it offers the best trade-offs with regards to proof time and proof size but

maybe in the future there would be like a better lattice base crew system in which case we'd be happy to move to that but in that case if you're just kind of compiling to make it zkp friendly would you say then like are there zkps that are still better to use for this like do you feel like there's particular proving systems that you feel like are yeah are the right choice or would you say actually any proving system could be used once you've made this transformation so this transformation does something that looks like bulletproofs but it's not quite bulletproofs and no you would want to work with this very very specific protocol we haven't seen anything better

come up for proving ciphertext or well-formed than this particular proof system so far how far out do you think we are then on the fhe front like and even with all the work around zkps yeah how far out do you think we'd be it depends for which application for like private smart contracts probably a year out oh okay I would say for some of those auction use cases particularly for Searchers that might only be a few months to six months out before they're usable by Engineers or but like like implemented and there's libraries and stuff I would say usable by Engineers oh wow okay so are you and you're building these libraries right

now yeah we are working on some of this stuff nice sunscreen then like a tooling company is it almost like a company that would build something akin to like Arc works yeah I would definitely say so we do view ourselves as a tooling company will you have a DSL or do you just see it as like people can build that themselves to interact with this there will be a DSL for some of our zero knowledge proof stuff unfortunately I guess because it's a new system and it's gonna need totally new language to interact with yeah damn what about the fpg part though is there such a thing as like dsls for fhe I don't really think so and for what we've done at least with our fhe compiler we just want a

developer to write a regular Russ program we we don't want them to think about like DSL oh I see but how does one actually plug into any of this like so you'd have basically a DSL that can like write the zkp side of things but then how are you actually using fhe like how would you as a developer interact and choose something to like you know set the parameters or make it yeah I'm just kind of trying to picture like how do people touch it yeah so I imagine you'd interact with both the fhe compiler and the zero knowledge proof compiler at the same time we envision that these two need to be packaged together in terms of what the interaction would look like I would say we're still kind

of exploring what the API should look like it is a bit challenging in terms of exposing some of the zero knowledge proof stuff to the developer the stuff is a lot easier to expose you're really just asking the engineer like what kind of computation are you trying to run what's going to be encrypted what's not going to be encrypted okay and that's really it we can figure out the parameters for you we can set up all these weird fhe circuits that that's a problem our compiler and hopefully other people's compilers as well will fix are there some use cases that you've heard presented for fhe that are really really compelling but you think are kind of impossible given that you're so deep in it and

because you said you're a pessimist what what do you think is like maybe almost over hyped in the fhe world but you don't think or is like really feasible um I don't know if there's things I don't think are feasible I would say there's things I don't think are feasible right now or for the next one or two years the use case that lots of people will ask me about and engineers get really excited about is the intersection of fully homomorphic encryption with machine learning can we do private training can we do private inference and I always feel horrible when I have to break people's hearts and say that I don't think fhe in combination with machine learning is really viable at

this point in time when you think about the overhead from using fhe it's pretty bad so data blow up will be ten thousand hundred thousand X the overhead in computation is ten thousand hundred thousand acts can you explain to like web tube companies yeah we're gonna blow up your database size by a hundred thousand X the computation will be a hundred thousand X slower oh my God okay with you and I guess you get privacy but I guess there you really get to see if it's worth it wow that's crazy though are there sort of like lighter use cases where maybe it could work where like obviously I think when you look at ml

like obviously there's a huge range you could do really really sophisticated things but you could also do really simple things do you think there's like simpler examples that maybe could already be used in that yeah yeah I definitely think for very very simple machine learning models fhe could make sense but trying to combine fhe with modern day machine learning the super deep neural networks I don't think that's viable right now when do you think it could be like given the current speed 10 years five years that's a good question I think for this blow up in terms of size maybe it'll be acceptable at some point in time if companies decide privacy is important

enough or there needs to be like actual improvements to the theory behind fhe for the performance side maybe with some of the work in Hardware accelerators the performance will be good enough I would say for that I know some companies are working on Hardware acceleration for fhe both very large companies and startups maybe in the next three to five years oh cool she said it here she's like no I don't want to predict yeah what's kind of next for you guys though like in turn you sort of mentioned that there's tooling that you're going to be releasing at some point people are actually going to be able to start engaging with it tell us a little bit about where where you're at and what you see coming up in the next

six months or so for us we will be likely adding support for other fhe schemes and our fhe compiler right now we only support one particular scheme that we think is well suited to a number of web free applications what's it called the BFB scheme okay so the advantages of that scheme is that it supports fairly fast arithmetic on encrypted data and quite a bit of precision so if you're looking to do 32 64-bit computation this is probably the scheme for you in terms of the other pieces we're working on the Zero knowledge proof compiler is going to take a little bit longer than the fhe compiler we need to glue together some proof systems figure out what the API is going to look like

there and combine it with our fhe compiler and there's another part that I haven't told you about but for fhe ciphertext they're actually quite large and it's not clear if developers are going to be okay storing those ciphertext directly on Shane so we're investigating some sort of storage solution for that could you store the ciphertext somewhere else and some reference or hash to the ciphertext directly on chain can you explain that a little bit further yeah yeah so very very roughly speaking instead of storing an fhe ciphertext on chain what if you were to Hash the site for text store the hash on chain which is very very small yeah and

then when somebody make the fhe ciphertext they go retrieve it from another location maybe you would store the fhe ciphertext on something like ipfs R weave and you would have to figure out how the validators and users are going to go retrieve it so I'd say this is more of an engineering problem like how do you quickly upload download things that sort of stuff it's like I guess it's taking it partly off chain yeah would you ever imagine that being a roll-up kind of situation like where it has its own off-chain action and there's like some and this is the connection point on chain you could do roll-ups in combination with fhe but it would be super super inefficient at this point in

time I don't know like what the timeline is there is there I would say I'm even less optimistic for the combination of Roll-Ups and fhe than I am for like machine learning and FHA okay I will say this for me this is a kind of a space that I haven't had that much of a chance to think about and even like all of the characteristics that fhe enables is still a little bit fuzzy for me I guess like I'm I'm still trying to figure out like what an application looks like in this would there be an application built on top of this or would it be something like you sort of talked about like fhc smart contracts but I'm I'm

trying to picture what like what's a user-facing thing that lives on top of this that like we would use I mean I guess I mean I understood like the auctions idea but I'm even thinking like maybe closer to like uh like a user sitting at the computer like dealing with an interface not even like a developer user you know what I mean ideally they wouldn't even know they're using fhe this is so far away from them this is completely hidden behind the scenes that maybe they just know that they're getting privacy somehow so we're just clicking a button yeah it could be like encrypted chats or something like that exactly exactly the user just gets privacy they don't need to know about it they don't need to know the details they

don't need to know there's fhe and serial knowledge groups hiding behind the scenes what kind of thing though could you imagine like an end user somehow interacting with this on though like could it what would they be giving yeah I'm just sort of I'm trying to go even like further up the stack so I think for a private version of an exchange ideally there would be very very little from the user's end it would just be like toggling something to execute a private order maybe there's a slightly higher fee but that that would be it in terms of interaction but under the hood there would be like this private space where computation is it's all encrypted somehow yeah exactly that would be one example um in the smart contract example though

like how would somebody like do you have any ideas for types of smart contracts where this would actually be used I know it's funny because like zkp people have definitely like had ideas around this but I'm just wondering if the FAQ use cases are different so I'm not sure like how well I can answer this question I know it's very vague barely yeah it's like fairly also early stages for us because we're still trying to figure out what like the API will look like on the zkp side so it's a little hard to say like what exactly will the user experience be like there yet where would you like to see like more research I mean you've talked about sort of that interaction between zkps and fhes and maybe the lattice based zkps would be a place but yeah is there is

there a specific part of like the research landscape right now that you would love to see more of that would really help you guys yeah definitely that kind of interaction or intersection of zero knowledge proofs and fhe we really need better zero knowledge proof systems for proving things about lattice based relations and fhe so other people want to join us here that would be amazing and we would love to have you cool so ravatel thank you so much for coming on the show and sharing with us the story of sunscreen as well as exploring again it was amazing to join you and I want to say thank you to the ZK podcast team Henrik Rachel and Tanya and tour listeners thanks for listening [Music]