Episode 273 - History of Plonk, Noir, and the building of Aztec 3

Transcript

foreign [Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online [Music] this week I chat with Zach Williamson from Aztec we cover the history of Planck from the start of the idea all the way up to his recent work Goblin plunk we chat about Noir the zkdsl as well as other advancements in the field

all of which have made a path for Aztec to release Aztec 3 their planned private programmable L2 we also do a quick catch up on the state of ZK applications folding schemes and what's on the horizon in our space now before we kick off I do want to direct you to the ZK jobs board there you'll find jobs from Top teams working in ZK so if you're looking to jump into the field professionally be sure to check it out and if you're a team looking to find great talent be sure to add your job to the ZK jobs board as well I've added the link in the show notes now Tanya will share a little bit about this week's sponsor [Music] Elio is a new layer 1 blockchain that achieves the programmability of ethereum the privacy of zcash and the scalability

of a roll-up if you're interested in building private applications then check out Elio's programming language called Leo Leo enables non-cryptographers to harness the power of zkps to deploy to centralized exchanges hidden information games regulated stable coins and more visit developer.alio.org to learn more for questions join their Discord at elio.org forward slash Discord so thanks again Elio and now here's our episode [Music] I want to welcome you back to the show Zach hey there this is your fourth time on the show and in prep for this I was digging through the archives to figure out like

when did we first meet what were you talking about then what were the other episodes so I'm going to give a little round up awesome in May 2019 you came on to talk about Aztec which you are still doing and we will talk about today in January 2020 you introduced Planck with Ariel which we were we will also be talking about today in April 2021 you introduced this concept of the ZK ZK roll up because I was doing a series at the time of like all about roll-ups and yours was the zkzk one would you say is Aztec still a ZK ZK role oh absolutely yeah I mean we are definitely ZK ZK roll up

um with the option of supporting ziki Roll-Ups within Aussie case you could roll up so you possibly possibly multiple zks uh we'll see wow and yeah and then in June or July 2022 so last year I actually had some of your teammates on the show Joe and Charlie came on to talk about Aztec connect ZK money and then told they they sort of teased this idea of Aztec 3 and I think that's what we're going to be talking about today yeah very happy to to show last week three for as long as I can cool cool there's a bunch of things I want to talk about but I know that I want to start on the Aztec front and get a catch up from you especially because like even since that interview last year I mean ZK money and

like I don't know if that's still a focus so I think we should hear what's going on with Aztec connect what's going on with ZK money so very happy to talk about that um should we should we go back to the start because because we first we first met and started talking about this back when you know the world was in black and white and it was a long time ago uh because yeah it's been it's been several years um but there was there is a narrative here which is basically like when when I got started with zero launch cryptography the goal was always to try and create um like private smart contracts basically uh you know take take a solidity like language and add private state to it as a first class primitive and then just have an ability to just pack around

um with building defy building apps but where you can hide information uh originally this came out because we needed that for a very specific application so I think maybe when you when we first met I was I was the co-founder of a company called creditment because we uh we minted credit whoa whoa yeah times have changed and were you actually question here because I know you spoke at like ZK Summit four but had you been I wasn't ZK Summits too you were at CK did you also speak at the early ones in Berlin I think you did actually I I don't think I spoke at two but you might have spoken at three I remember that you were the only person in One in the breakout room who'd used the like the flip chart remember this that was plonk that was me trying to explain the permutation

argument with poplunk and failing wow no episode then okay okay um BP before plonk before plonk I think you make a good point let's go even further back let's do a little bit of the the story from the start so yeah like originally I got into web three because uh I met my co-founder Tom and he wanted to do private like um corporate debt to just basically stratify on ethereum um you know bring a real world assets to ethereum and I thought about this is this is 2017 and I thought this is the uh like the only actual meaningful use of blockchain that I that I at the time was aware of because you know 2017 was all just you know um junky tokens and

memes and not a lot of actual useful stuff at least from the outside uh so that's what I started working on with him but then we realized very quickly well if you're going to try and do you know bring real world assets on chain you need privacy otherwise you're leaking quite a lot of information about about people and and about what they own and actually it makes sense that it was like sort of the business use case it was the first to like be made clear yeah I mean that was always very clear to me as well the fact that like how how could you run a business if everything is transparent like every salary every supplier's deal and stuff like that yeah well I mean turns out that you can also just do it if you're some 16 year old and on Twitter uh that also works but uh

but for some parts of the economy you do need proper privacy and so yeah so I came to this from a very commercial perspective and I guess like I basically got ZK pills later on Wow because we needed we needed privacy um for what we were doing and at the time 20 2017 2018 like the the only private Tech app that really was Z cash uh which whilst incredible was also not programmable but it wasn't any privacy on ethereum or similar programmable chains yeah and so um I started looking into CK proofs because I'm like well we need this for the business I don't want to go back to my boring old job this is too much fun so uh um so I started reading about cryptography and um learning about it learning trying to figure out if we could Port the zcash

protocol to ethereum wait I'm just I just realized what were you doing what was your background actually I always thought you were a cryptographer oh hell no what I feel like you might have even told me this on an earlier episode but I completely have like no I'm very much I'm very much uh yeah self-taught when it comes to cryptography uh but I I'm my background is as a failed particle physicist so I did a PhD in experimental and tuna physics um because back in the day I had delusions of grandeur about to be a scientist you know spending all my time sketching out equations on whiteboards which you kind of do now yeah yeah you could say you could you could take the academic answers of Academia but you can't take out Academia out of the Academy I see but um yeah okay but yeah I figured uh that didn't

work out I realized actually I didn't really like research because it was a bit too ephemeral you know trying to measure the existence of particles that last for a billionth of a billionth of a second it's it's interesting for a time but I felt like I was I was basically speedrunning a midlife crisis um uh and I wanted to do something more real with my life so became a programmer for a couple of years to kind of sort myself sort my life out finished my thesis and then that's then I met Tom um and he's like I'm doing a startup do you want to join I'm like well yeah I'm not doing anything interesting let's do this and then that Segway into needing privacy which segued into me reading about cryptography which then segued into falling down a crypto rabbit hole because early on though you had created

like I remember like you were using a different kind of zkp yes what was it again a sigma protocol okay uh so so before plonk to get privacy we I put together like a Frankenstein cryptography protocol using older Primitives than Z case Knox because basically we wanted programmable business logic and we didn't want to have to do um trusted setups for every kind of um like uh effectively circuit we were writing uh because we wanted it to be programmable and so uh at the time all stocks require trusted setups per circuit so in the given the lack of other options I I knocked together it's very primitive cryptography protocol which sort of did what we needed but it was very expensive in terms of computational costs in today's figures

probably cost about a hundred dollars to do a transaction on ethereum uh in terms of gas um but originally basically I I became like fascinated by ZK cryptography because it was a new new area for me I didn't know it existed the idea that you can prove statements about encrypted data was just radical um yeah and and I kind of realized very quickly wow you combine this with distributed Ledger technology you know you had the ability to actually create you know completely um ledgers were like the protocol is transparent and trusted but the actual information trading across it is private that that could change a lot of things in this world so I became a bit obsessed with it um my basically one of my first introductions to cryptography was I did

I did something which I later turned out I later found out was was a massive stereotype which is that I um I got introduced to um a an actual cryptographer Jens Groth and one of the OG folks you know he's um created the gross16 snark he's been in this space for a long long time he's been on the show yeah yeah he's he's uh I I owe a lot to him because basically I got introduced to him so I walked up to his office and I'm like hey Jens I've got this like amazing new cryptography protocol it's like no I'm not I don't I'm not a cryptographer I'm self-taught you know but trust me this one works just great it's going to change things um and then like you know he read it in about five minutes he's like yeah it's broken um so yeah that was that that was my my

extremely stereotypical introduction to cryptography it's funny because it's like the don't roll roll your own crypto yeah but then you did then I kept going yeah exactly I'm like I I uh you know what's what's that the definition of insanity is trying the same thing over and over and it's taking different results well you did get a different result though well I did because Jens was was exceptionally good-natured and kind of um spent time advising my startup and basically mentoring me and how to actually do cryptography wow and so that's what then with his help that's where what then produced the original Aztec critical which was this Sigma vertical thing that I was mentioning stain but then so even on that one you had gotten something sort of functional yeah where does Planck come in plunk

comes in 2019 uh so we knew when we were building the original Aztec protocol with this junky segment protocol we we kind of we're in a bit of a difficult spot because we knew that what we were building wasn't actually very good and we didn't have the technology to build what we really wanted to build which is not a good place to be uh quite demoralizing and so I was basically spending order of 2019 and and a bit of 2018 based studying furiously everything about ziki stocks trying to figure out if it's possible to create um a universe what does now like called a universal snark which is one way you don't need per circuit trusted setups where you could just make do one trusted setup or ideally no no choice of service but at most OnePlus I set up for your entire crypto system and then you can

program in any any arbitrary circuit you want and you don't need to do any more trusted setups and at this point there was like Sonic's had been was that out well that was the inciting incident because okay Sonic was published in 2019 I believe or late 2018 I can't quite remember the date um so it was uh like Mary Muller's PhD thesis I think it had Sean Beau on it from Z cash and a few others and sorry I can't remember the full author list I think we we may have covered that at some point on the show too in detail I remember doing a study Club on that actually and it was the first actual Universal snark um that was like remotely practical although not really erasable yeah so so it improved it showed something it

showed you could do this Universal trusted setup but it didn't necessarily like hadn't figured out the Sweet Spot yeah because the prover was extraordinarily slow so you wouldn't have been able to use it in practice but it it showed techniques where it should hate this is possible and so I looked I saw the paper and I'm like I have to I have to figure out your secrets um and see if see if there's something that can be evolved out of it um which wasn't the easiest thing to do because uh I I do not wish to throw shade um I have an enormous amount of respect for the Sonic authors they've contributed in immensely to the field of cryptography there was a butt though and that butt is at the paper is not the most is not the easiest to read um particularly if you're not kind of um

completely up to up to speed with the linger of cryptography with a with a with a syntax of it and the Sonic paper is split into two components there's the component where they they describe a snark that's Universal but it requires an untrusted third-party helper who has a lot of computational resources to help make the proof and then there's the part where you don't need that untrusted third party but the prover is extremely slow and that second part was the one I was interested in but it was also the part that was kind of not really described that well because it was it wasn't the main focus of the paper it was kind of an aside oh by the way you can do this but this split you just described this isn't the split does not correspond to like the polynomial IOP and the polynomial commitment schema I

think this but you're talking about something else this is like it's different um okay because they both had two like both of the modes had two different polynomial I appears I believe yeah I I spent uh there was a couple of couple of weeks where I basically camped out at a little little bougie Artisan Cafe that's right next that was next to the flat that I was living I camped out there with it with a with a supply of iced mockers and a notepad and the Sonic paper and I went through it line by line and basically grinded throat until I understood how the damn thing worked wow it sounds like it was because you needed something like this yes for Aztec to actually work yes and this what we're talking about here is it's still Aztec one or is this Aztec Aztec one Aztec one

because you had created something but it did it not work well so Aztec one was it was it didn't have any scalability so the idea was what it enabled was conf like private-ish value cryptocurrency transfers on ethereum but like the values were hidden but the identities weren't and it wasn't scalable as in if you like each each transaction required a verification on ethereum and that cost a lot of gas about 800 000 guests so okay okay it clearly wasn't a sustainable long-term solution and we needed something better we had a better Tech and that bad attack did not really exist and that was causing an existential crisis for me so so you're sitting in this Cafe yeah you're figuring it out um had Arielle already joined Aztec No

so at the time I barely knew Ariel like I met him once at a z cash conference like we shared a cab ride uh but we didn't really know each other that well okay and so that came a little bit later about a month afterwards so I once I cracked the Sonic paper under cell work I'm like right okay is there a way of making this fast and I was basically a drawing blanks there uh it was like how do I make this fast well I don't know did you go to Ian scrot again and ask him I didn't because at the time so he had to stop being our advisor because he joined dfinity and so there was a slight conflict of interest they they poached him oh yeah and yeah he couldn't so he couldn't help but his papers did um because the basically the part that was

on before bumped into Ariel and actually had the uh the inciting incident which put it all together there's a there's a kind of a trifecta of papers that were coming that have come out over the last couple of years that were really they whilst they didn't codify it explicitly they were using this this kind of General construction of of creating ZK protocols using a polynomial interactive Oracle proof and a polynomial equipment scheme they weren't succinct they weren't snarks not really but they were um Felix general purpose compute and not German but so special purpose computations but they were kind of written by his grass Jonathan bootle that kind of crowd and I was kind of devouring these papers because you know I had a kind of like intuition that there was something there that you could

combine this with something some of the stuff in Sonic and somehow get something working but I didn't really know how to do it and that's kind of where Ariel came into the scene um because I met him at some some crypto conference in London I'm afraid I cannot remember the name of the place it was um the the company hosted it has since gone under but um at the time I was working on a problem where I was trying to create a bespoke ZK circuit for verifying uh Poseidon hashes wow so very specific and it was more of a toy at the time I didn't really have a good use case for it but I was like yeah besides a fun pass function can you make a like a very specific kind of like ZK protocol using these these polynomial IOP ideas

um to to do it and I got to the point where I I almost got something working but there was this one minor legaling little issue which is a basically like the way these polynomial I appears work is generally you know your user commitment scheme to encode a vector as a polynomial and then you'll you'll perform some arithmetic over your vectors and use a and basically Define some kind of polynomial expression that checks the correctness of that arithmetic and the problem that I had is for my Poseidon protocol work I needed a shift basically I needed to get a encoder Vector as a polynomial and also encode its shifted form as a polynomial and verify that those two were identical and I didn't know how to do that using the the representations that I was using which was uh at the time this this whole

like LaGrange basing which is in plunk so long story short basically around to Ariel I'm like hey you're a brain you know how this works um what do you know how cryptography Works uh like do you know how to do this the shifting um Ariel to his credit she spent a lot of time talking with me that day because I was struggling to explain the problem because because I I was I was speaking in kind of a bit of a like a butchered language or cryptography because I'm not formally trained yeah yeah but he yeah he listened he he listened to me he translated you he translated me yes he was the plonk Whisperer and he was like well think about this I went away um end of the conference I was hacking around on my netbooks and that evening I realized hang on a minute this problem

like if you can get this this kind of this equivalent of a shift in a polynomial form uh in this kind of lagrange-based idea if you can do this and you can create a universal snark then you could make Sonic fast like kind of it triggered it it clicked in my mind and I remember it quite clearly because the um I had an Apple Watch at the time and it uh it started beating at me um saying hey you're not doing an exercise but your pulse is like 120 are you okay because I was like my heart was panicking so I'm like oh my God there's something here whoa but I thought this shifting problem because I I just wasn't familiar with the attack like how to solve it I was like oh it's probably it's probably impossible you know this is a this is a pipe dream move

on and then the next day at the conference I turned up and you know I was walking past aisle and he just whipped his head around and he's like oh yeah by the way I've solved that problem you mentioned yesterday oh that's so cool yeah I actually I want to say we we interviewed Arya last year about a little bit the history of Planck on his side so I will actually try to dig that up and add it in the show notes but I love that so you guys you you connected and you weren't working together still this was just like people you knew each other sort of preferably and this was the point where you started to work together it was on Planck not even well ish I mean basically we were there just for one conference so I was moving was traveling around and so we we basically

at that conference we hashed out a way where you could possibly create a universal stock but it was still very very foggy in our minds um because what became the mutation argument I was when Ariel told me like there's this thing you can do that you can solve this problem I'm like dude like do you know what this means um and so we basically hit off in a side room and I explained to him Sonic's permutation arguments because uh not many people that would had at the time had really like dug into the sonics permutation argument part because it wasn't somewhat inscrutable so like I wasn't teaching implementations I knew all about permutation networks like they've been around for donkeys years but it had to get Universal stocks out of them was relatively new ish and so anyway but but once once that clicked with him he's

like oh yeah well there's something here and then we had to split because you know we had our own lives to live yeah yeah but then we a couple of weeks later we met at an airport um waiting to board a plane to go to a z cash conference and I looked at him and I'm like dude this idea that we haven't he's like yeah I'm like do you should be write a paper about it and he was like yeah I was thinking that too let's write a paper and then eventually that that became plunk did you know when you were doing this how influential Planck would be I knew it was going to be a thing um because it's I mean it's it's took over so many systems like people who were developing their own proving systems sort of sometimes threw them away just

to use Planck and it's evolved there's like all the variations on Planck there's even like plonkish it's like an adjective now so like yeah did you did you have any sense I mean I had a sense that it was going to be quite valuable for the for the reasons why I wanted to use it for Aztec because yeah because a universal stock that's fast enough to put into production systems was completely new at the time and yeah I knew it was going to get used um it's kind of why I gave it a silly name because it'll be funny uh but I didn't I didn't quite realize just how much it would take off and and also just how much the community would Embrace and adopt it because the plunk-ish arithmetization it's um how do I put

this yeah it would have been very easy for quite for several groups or um you know companies institutions researchers to basically just name their protocols whatever they wanted as and if they they use ingredients from Planck um but it doesn't mean you need to name it after plonk but they've been quite they've been quite a good nation and kept the theme and so it's it's helped uh the concept of plonk kind of a worm its way into the into the wider cryptosphere to stay alive yeah well actually tell me a little bit about like the Planck work you've done maybe even since you first introduced Planck on the show back in 20 20. yeah like because I mean even then I mean or at least the last time you were on I think we were hearing about like you know there was a hyperplunk there

was an ultra plonk yeah there's a turbo Plum yeah there was an octoplank no but I think I misheard somebody and then I started that might be an alternative in the future but not right now actually I asked when I was interviewing Darren strad I think I mentioned this octo Planck also as a probably not real thing and um I think they did actually have a vision for what octoplank could be interesting so I think it should exist yes it's going to be like the Cryptid of of cryptography protocols you know it's the one you hear about but it's never you can never really you can't find it anywhere don't find it yeah yeah but okay so from there we just mentioned

this like plunk of Sharif arithmetization arithmetization yeah um that you find in Halo 2. do you find it in plonky too as well yep okay what else do you find it in where does a punk Edition worms weigh in yeah everywhere I mean but everywhere well anything that isn't almonds yes or a stark like air is basically plunkish um because if you want don't want to do a circuit trusted setup um the the tricky part about doing a snark circuit is proving that your wires are correctly feeding into the relevant Gates um properly basically that you're wires are copied where they need to be copied um and the way that you do that canonically like that what Planck showed is that you can do this really efficiently with a permutation argument and so that permutation argument is core

to a ton of protocols but but more I guess more more broadly in that plonkish arithmetization is a way of taking arithmetic that you want to express over vectors so like imagine you're iterating over elements of a vector and you're applying some arithmetic statement to the elements of that Vector it's a very nice transformation I guess at its core it's a way of um if you have vectors of information and you want to iterate of your vectors and apply some arithmetic operation it's a mathematic expression over those vectors the longest mathematization is a very efficient way of converting that into arithmetic over polynomials and it's cool um combined with a way of um correctly checking that copy that basically certain elements within those

vectors are copies of one another it's kind of Taken taken hold of it because it's it's very expressible and customizable is and you can you well like back in 2019 I was talking about the side of custom Gates where basically instead of doing additions and multiplications which is the general way you you create gates in a stock circuit you can do like weird funky custom arithmetic that's going to help your program be a bit more efficient things like range checks bitwise arithmetic elliptic curve operations one of the bigger innovations iterations that we did was in 2020 we published which was yes yes it's how to do lookup tables inside a plonkish type snark which changed the game a little bit in terms of how like the complexity of

programs you can encode it's it's difficult to do complicate complex arithmetic in Ezekiel stock because all your arithmetic is over these Prime Fields it's all modulo big primes and so if you want to do if you want to represent a computer program is this knock circuit you're faced with a fundamental problem which is well computer programs use imperative programs that use binary arithmetic you know there's lots of logic statements lots of bitwise and arithmetic and it's very hard to translate that into Prime field arithmetic without like a relatively large blow up in the number of kind of like constraints that you you need and lookup table saw this by basically being lazy and cheating instead of doing the computation you just look it up from a table instead and yeah what really inspired me was a couple of things one of them was early microcomputing in the

1980s so when when the home Computing Revolution exploded in the 80s um programs have to be very creative because these machines were very very primitive to give an example like the common CPU chip at the time couldn't multiply uh you had to like add repeatedly to multiply it could multiply it couldn't divide it couldn't even do proper bit shifts you could shift left over to the right by one bit but so we're talking like unbelievable primitive and so what programmers did was they well they used lookup tables to store computations instead of doing them like multiplication tables wow and so I was like there must be a way of doing this in a snack too and there was uh so yeah and that's the lookup arguments basically look up tables we actually asked that question on the latest CK

Summit Forum what is the lookup argument oh actually what is the difference look up table lookup argument well I mean I'm not going to claim some invented lookup arguments um generally because they go back a ways but um so click up was just a way up was a way of doing them very efficiently in a plonkish arithmetic type circuit so what's the difference between look up table and lookup argument lookup argument is a way of proving that you've correctly read from a lookup type table okay got it we talked just now about like the ways that plonkish arithmetization has been used and it's how it's showing up and some of these other techniques but what about on your front like since we spoke even maybe like in 2021 what kind of Planck variants or developments have we have

you done yeah so so quite a bit because um you know I mentioned at the start like one of the key driving forces behind Aztec is we want to do private smart contracts and uh plunk on his own isn't enough it's good it's not good enough uh so we we always need more speed and more power um make things faster it's just what I've been trying to do um well you know in town with a lot of people in this in this space over the last well several years and so part of that has been improving Planck so adding lookup tables adding custom Gates creating these new weird variants like turbo Planck and Ultra plonk and then something else which kind of changed the game a little bit flip the board over was uh hyperplunk um which you didn't do I didn't do nothing that was Benedict that was

Benedict and the espresso systems yes yes see they picked us to the to publication on that one um had you had something like that so yeah so so we we had um so hyperlongata score is plunk with using uh something called a some check protocol and uh it stems from a paper from 2020 I think Benedict was also was an author on that but I can't quite remember so the 2020 paper about how to like do some checks with um uh something called tensor codes uh and it was quite clear for me the paper this could be adapted to plunk relatively straightforward one thing though if this adding some check or making it some check was the change what was it before so zero check yeah yeah so the idea is if you have some arithmetic

over your polynomials you encode your vectors of information such that the resulting polynomials they vanish on some um subgroup yes and this was the vanishing polynomial yes so the idea is you check arithmetic a zero modulo The Vanishing yeah and that's what the yeah so yeah zero checks question computations so you can place it with a some check protocol where you basically instead of encoding things um over in a univariate polynomial you incur them as a multilinear polynomial the idea is if you have a vector of size n you take log n um variables and you encode your data as a polynomial and there's variables where when you evaluate those those login variables at zero and one

each combination of zeros and ones gives you one of the elements in your vector so basically you you encode your data as the elements of a Boolean hypercube an n-dimensional building hyperkeeping which I love saying um well yeah yeah it's it's kind of it's kind of a weird crossover between Zero's cryptography and psychological horror novels but yeah hyperplunk I think we had I think Benedict gave that presentation as actually zk8 yeah potentially um so it's pretty it's like a six months ago yeah yeah um yeah so we we had very similar ideas but we took our sweet time putting it together paper our paper is normally published uh for a couple of reasons but we're nearly there um so yeah they they picked us to the post and uh yeah pretty

pretty awesome work and very grateful that they kept with the Planck theme you recently released Goblin plonk but this is not this work right this is something else yeah so the thing I was just talking about at least the one that we're we're internally recording it honk uh oh that's honk Okay so you just skip the hyperplunk and just went straight to hunk yeah um cut out all the middle letters yeah yeah so so it stands for highly optimized plunk uh with a few silent letters um very good but yeah slightly different to Goblin plunk okay but why would you keep working on hunk if hyperplunk already exists like will you be yeah hunk should be adding some several additions to hyperplunk because the the

hyperplunk paper treat is is a is a very general description of how did you clunk when you encode things over billion hypercubes so my take on it is that the authors they wanted to create a like a a general description which means that they treat the various cryptographic subpracticals you need as black boxes um and the paper doesn't describe particular schemes you can use and therefore all the particular ugly engineering hacks and tricks you can use to make it fast um and so things like cyclic shifts are expensive and if you choose specific ski like multilinear commitment schemes they don't they become very very cheap and so there's yeah there's also tricks you can do and so I guess our paper is a it's a collection of the tricks but B is also it's it's got a new multi-linear polynomial commitment scheme which

should be more efficient than the other stuff and uh what's it called there's no name yet oh but it's what would it be replacing okay no it's it's it uses case to use the sub components it can be replacing something called Gemini um oh okay so Gemini is a folding scheme where you basically you have a like an abstract multilinear polynomial but you you use a folding scene to represent it eventually like to provide a mapping to map that maps to a univariate polynomial commitment that you can then open with kcg is this at all like playing on on the Nova no no I've used the word folding it but it's folding in a different way um yeah but most most of zika crypto is basically it's fully excuse me polynomials that it's cool I think uh and yeah it's just a different way of

Performing different kind of context okay so that's honk yeah now tell us about Goblin Goblin plunk uh oh yeah um you were also just describing you had to explain some Zen what is it Generation Z Generation Z slang to help me understand why you decided on this name okay so it's wider context is um one of the things that's obsessing uh me is the cost of recursive proof composition um to do something like Aztec 3 with private smart contracts it helps immensely if you can have if you have recursive stocks as a very very cheap primitive you can use where you know you can just check the credits for proof within a proof um and that not add much overhead to the prover uh we care

greatly about this because if we can do client-side recursion um quickly so you know previous constructed in a web browser or you know an old computer with not a lot of memory if you can do that then it makes um it makes it possible to represent snark based smart contracts in a manner that's very intuitive for developers where it allows you to abstract a lot more away and so I've been I've been assessing around fast recursions for ages and Goblin plunk is a recursion scheme uh that I believe uh We've not finished implementing it yet but I believe it's going to be exceptionally performance and have very very low proof costs and it's called Goblin clunk because it's it's when a recursion goes Goblin mode and Goblin mode is lazy greedy and sloths that's what you were

telling me before exactly yeah okay and the reason I call it that is because the recursion scheme it's very lazy in that uh when you when you're recursing over elliptic curves uh one of the big problems is you need to do something called non-native field arithmetic where you need to do lots and lots of arithmetic modulo a modulus which is not the native modulus that your circuit is using so there generally that's a very expensive thing to do which slows down previous and the best way of doing it so far is is the the Halo 2 um curved cycle scheme which I would consider block Goblin plump to be very much an iteration of because it still uses curved Cycles but the reason why but basically it's the main Innovation is that when you're actually doing your recursion um instead of Performing all these take

the expensive computations you need to do instead of Performing them or evaluating them you cheat you present a a lookup table which just magically has the results you're looking for oh uh and and then you worry about proving the correctness of that look up table later on in the in the protocol this seems to be a trend though this idea of like you push the proving of something to later yeah this is this like Halo 2's doing it or rather Nova starts to do this I think and this is where this is where it sort of sounds again familiar yeah so so it's it's a good Trend because because it's some you know it's always it's always nice to make something somebody else's problem and but isn't it still your problem just later yes so true but but it's well there's two ways of why why

deferred computation is valuable one of them is it genuinely is somebody else's problem the idea is you like you have two previous one has a very weak computational resources one has lots of computational resources but it's perhaps not trust you did um he wants to basically yeah like minimize the computation that you're weak prove it does um and defer as much as you can to the strong River without leaking information to the strong people interesting and that's kind of what Halo 2 is doing with these curve Cycles um and similarly I think I think it's what Nova is doing as well I'm not not the expert on that so okay mischaracterizing the critical um golden block is slightly different where it is still all your problem um as a proverb uh but the the idea is

that what you can do is is as you're recursing you're basically building up a giant lookup table that contains all of these elliptic curve operations you need to do um that are over a foreign field and then at the very end of your um once you've actually computed all your casa proofs here at the very end and you some somebody needs to approve the correctness of this um transcript and one way of doing that is basically you use these curved Cycles so you commit to the same information over your over your cycle curve which basically translates the problem from uh doing this foreign field of particular doing native field arithmetics so it reduces the complexity of the problem by about a factor of a thousand um and then you you prove the quality between these two equipments so basically you have commitments to your elliptic curve operations over your main

curve you have commitments to your lip to cover operations over your cycle curve if they are equivalent if you can prove their equivalent then the problem becomes very very easy because then you just create custom snug Circuit of your cycle curve to evaluate the correctness of the transcript turns out that actually it's not not very hard to do that equivalence check uh so I I stole this from eip4844 because they have a similar issue where you you take your cycle curve commitments you just open them using the inner product argument or whatever commitment scheme is useful for you at some random point and then what you want to do is use a snark Circuit of your main curve to iterate so you take your transcript commitments over your main curve um and you you incorporate them into a snack circuit where the commitments

become uh Collins in a circuit and then for each row you're basically iterating over the coefficients of your polynomial and you use foreign field arithmetic to evaluate the polynomial at the same random point that you opened your cycle curves on using the field of your cycle curve and so long story short it translates the problem of doing a non-native elliptical scale multiplications into the problem of doing native elliptical scale multiplications which are very cheap and five non-native field multiplications um where if you only do five that's also very cheap especially in the koblin scheme you can basically create a custom circuit that just does not into field moles so doing five of those is actually about the same cost as doing a native elliptic curve multiplication

and my my kind of back on the envelope napkin math is that the this should be exceptionally previous efficient as in possibly something like 8 000 plunkish constraints all into recurse um recursively verified proof which would be if it's if I'm right it will be ordered like at least one order of magnitude I think of an improvement over the existing stuff so that what does that mean sort of like in terms of speed is it like half as long or no like about 10 10x if it genuinely is 10x less fewer constraints um and so yeah so basically the idea is then you can just use it as a cheap commodity primitive and recursion no longer becomes like a difficult problem wow which would be really nice is it solved or is it like work in progress so

we're implementing it um because we're implementing lots and lots of things at once um and uh so yeah we're we're doing our best but um ah I see one of I mean one of the things that I did with goblinplunk was um uh I just published it as soon as as soon as I had the idea I just read it up and thrown into the world because I figured you know the more the more eyeballs on it the more people can break it improve it Etc um but you have to implement it to really know yeah exactly yeah until then I'm just bullshitting it's just basically me with a megaphone saying I've got this amazing idea you know um but but she goes to the go to the school next door and you can't see her topic of Noir yeah to this conversation about Planck because

Noir is it Aztec specific or is it plonk specific neither neither okay so Noir is a DSL this is a CK a domain specific language and this was released when like eight months ago or so 10 months ago yeah yeah about that yeah and we've we actually hosted a workshop for uh ZK hack3 where we got to actually see Noir in action um it's a like I think there's a lot of people who are very excited about it I always thought it was like the Planck native okay tell me tell me then what is normal okay so so Noah is it's our attempt to create a very generalized EK programming language where the idea is it exposes a a very high level premium language that's rust-like that the ideas

that are composed down to ZK circuits but we deliberately made it platform agnostic um because we didn't want this to just be you know the Aztec thing or the plunk thing because well it's an open source project and we want we want as many people to use it as possible is it like favor plunk is it more like usable with plonk is there any benefit to like or is there any connection I mean I would say it's faster with plunk because Planck is is the fastest death fertilization scheme like that but that's my advice uh so it's we want it to basically be the llvm of snox um where it compiles it doesn't compile to circuits or constraints it compiles to an intermediate representation uh called this abstract circuit intermediate representation where the idea is then once you have an essay program then you can take any

cryptography backend that you like and convert that as CR into constraints for that back-end specific preview system so it's basically equivalent to how computer programming languages in general are constructed the idea is you have a language front end like rust or C plus plus or I don't know Haskell where you you know you have your your front and the actual Sim like language you code in with its semantics as rules Etc and then the language compiler doesn't turn your program into machine code generally what it will do is it will turn it into well llvm IR low level virtual machine intermediate representation it turns it into into a basically a kind of Proto assembly but for an imagined virtual machine that doesn't really exist

um so that's what the language content does and then the language backend takes that intermediate representation and actually turns it into machine code for a specific computer architecture okay and this is how you can have a program that you write once and it compiles to Mac to Windows to if pad to iPhone to you know to to tons of different CPU architectures and so we're taking the same approach with ZK languages so Noir is a language front end for a sip um so it has its own special must like syntax like compiles programs to this is say representation but that's that's where kind of Noah stops um and then it's somebody else's job to take the Acer and turn it into an actual ZK circuit what would it work with then would it work with artworks yeah I think so would that would artworks be the

second part of that yeah yeah exactly so so Arcos would be the back end I think I'm not sure we either have or are working on an archworks integration we have a ganark integration as well as as well as the the Aztec one yeah the genark one was that's the consensus yeah okay and but is Noir than on the same level as circom is circum doing the same thing as Moira does it also compile down it's doing a similar thing but circum is a bit more I believe it's a bit more um integrated in that uh circum has a almond CS back end and a plonked back end but they're they're tightly integrated in the language itself so it's not it doesn't really give you an intermediate representation that you can then compile using some other kind of proving system so it's a bit less

abstract in that way and less modular I see I see but like so actually yeah what you're saying though is because it has this intermediate representation where does the plonk part start is that like after that after okay so you can your backend can take this that ir and turn it into r1cs constraints and then compile those into a circuit or can turn it into plonkish constraints and go but let's do a plunk circuit could it do something in like the maiden error kind of context as well yeah I mean it might not be the fastest because you're you're seeing a program and converting it into VM code for like you're taking the IR for nor and then turning it into polygon widen assembly which is again another form of ir yeah and then that gets turned into a VM circuit so it so you

could do it absolutely uh it might not be the fastest but you could do it I see I see at the recent CK hack I know a few people's you know started to work on Noir news Noir is Noir meant to be the language that like a hacker could build a little ZK project with 100 or is it okay so it really is because it like that's what's sort of unclear like the way you described it though like you're still sending it into this intermediate representation context like if you just use Noir you still need to use that second part don't you you do but the the idea is yeah okay so so an actual build of Noir okay version of Noah will choose a specific crypto backend to use and so the goal is to

present an abstraction layer to the developer where they just write them to our program and they just click a button and it compiles to a circuit with a with a smart contract verify they can deploy to an evm chain underneath exactly they don't need to know about it exactly the idea is the end goal is for it to be TurnKey effectively where you just you just code you're up you're not programming then you just run it and you don't worry about anything that's happening under the hood um I'm not going to claim with that yet but uh we are working we are working very hard to to get the language would Noir then be also used with something else like say say you wanted to create like I don't know some like front-end application that then on its back end not back back end we're not talking

circuit yet but like where it but it's going to be using zkps under the hood would you be using something like solidity on the front end or JavaScript or something and then you have actually wouldn't be solid it would probably be JavaScript so so would you be using something like JavaScript then Noir then like it's automatically using artworks yeah exactly I know what that looks like yeah the release of nor that you're using would would contain either like an integrated August back end or or a mass check back into a knock back end yeah you just have you would have a tool chain I mean we have a tool chain now which does this although it uh yeah for the asterisk packet at least a torture away yeah you just compile the last second it gets turned into a proving key verification key you can make your

proofs and it's relatively um straightforward and yeah we have it we have a JavaScript um wrapper around it all um so that you're building a front-end website that uses Noir that whether the user needs to make a knob proof you can do that all by making JavaScript calls now that we've gotten to this point I'm like Aztec as an entity now we have to dig into it because I have always thought about Aztec as almost like a roll-up right like uh like because we did the ckck roll-up episode yeah and I you know you said it first it was like a smart contract directly on ethereum and then migrated to this like roll-up concept but now what you're describing the fact that it like is Aztec artworks then no

so like sorry to confuse you no no but this is where like I want to ask you is the question basically why why are we doing this with Noah well it's almost like now that we've we've described Planck yeah then we've described Noir and what we haven't really described is like Aztec which brings all of these things together like and yeah that connection point I think I I want to understand sure so the reason we're developing one like this is very much like transparency we have very ulterior motives um uh you have what ulterior motives um so you know in terms of like we want more to be a public good that is open source anybody can use it they can build their own back ends their own front ends they can basically just use it however they want even if it doesn't touch any

other Aztec system and yeah it doesn't doesn't benefit like Aztec as a company directly and well why is that it's because what is the interstate fantastic we are building a z case you can roll up a layer two where the layer two is um effectively we want to recreate the smart contract ecosystem that ethereum has but as a layer two where you have private State as a first class default primitive basically Things become private by default where as a developer you can write your smart contract and then just like just really easily just include private data in your program in your program logic so that needs a lot of disparate components to work you you need an

exceptionally fast EK premium system you need like an architecture that enables all of this that represents programs as EK circuits and then represents for evaluating these the transactions over these programs inside some kind of ZK roll-up architecture um you need you need the entire Layer Two architecture code it up as recursive ZK stocks and you need a language that you program these contracts in okay and this is when comes into the picture because we want like we plan for Noir to be the smart contract programming language for Aztec 3. uh and so we want to very much grow the developer ecosystem for Noir just generally as in it's a positive some win-win game for everybody is in we build Noir as a

general purpose language so that you know doesn't doesn't need to plug into sq3 just master snarks or stocks or whatever you want to basically make it easy to write ZK programs and the bigger that developer ecosystem is the better the better it is for us because then the bigger the stable of developers is that could potentially write S63 programs and smart contracts I kind of want to go back to that description before of like what a developer would do if they're deploying a contract or they're building an application they're sort of like we're using Noir as this middle thing we have JavaScript on one side we have Aztec on the other side let's kind of rewind to like 2021 when we were doing this like series on all these Roll-Ups you had and I think most people listening to the show are probably familiar with it but

like you often have this like batching of transactions or state changes or whatever and then they're writing something to the base chain I always thought of like the snark is just sort of like the the thing that just does the validity you add the ZK part the secret part but now I'm confused about like how does a like if you're writing on top of this snark or you're writing on top of the ZK ZK roll up yeah where is the circuit going like I know there's this second going that's a good thing you could you kind of understand why I'm confused here yeah yeah definitely I mean it's it's it's um it's like I know a lot of the parts of this yeah but the actual way that a smart like an application on this roll up using ZK piece in its fullest form

like for privacy then is also connected to this main chain base chain this is where I get confused okay so so I can try and describe the aztec3 architecture at a at a high level recorder one half hour presentation that describes the full architecture I'll try to find it yeah so every time I release this yeah but uh so I'll try and give it a quicker so the idea is let's just start with let's take a Noir contract okay so um at least once we've added all the functionality we we need into or not then you'll be able to Define your contract as a set of public functions and private functions where a public function can modify public state so it'll be like State as in the kind of state that you have already in a

solidity contract you know variables mappings Etc but there's this state also on the roll-up though the public State on a roller yeah yeah so it's going to be it would be like what optimism has or something yeah yeah it's going to be like part of the part of the l2's state database okay and then your private functions which modify private states where this state will again it'll be part of the product but it'll be encrypted um and it's going to use um the similar abstractions that zcash using as an asset is where you have this idea of a utxo set um unset transaction objects and another fire set where the idea is like when you when you add you can add encrypted data to the to the utxo set and then you can effectively delete it adding its uh nullifier to the nullify set unless you

have the decryption Keys you can't link a nullifier to utxo and therefore if you've deleted a utx so it only only use the deleter know about that um but the challenge of utxos has always been like there's no programmability in it it's just about like transfers well so the way we're representing it is a utx so it's just very abstract as in the state that it encodes is not at the protocol level we don't no or care about it it's not values it's not identities it's just 64 bytes of information okay very much like a storage slot in ethereum uh well the idea is then the nor contract you're writing that's the thing that's defining the rules around when what state that the state is like how

it's encoded how it changes so you can write say a private token contract using a combination of these private and public functions and the idea here is that these functions get converted into snark verification keys and a contract on Aztec 3 is defined as the set of snap verification keys that correspond to all of the functions of that contract private and public yes does each contract then have like a unique way of the interaction between those two like I'm just curious like how do you still keep state if like part of state is private and it's just a blob of data and it's not in any sort of like account system well listen it's in a Merkle tree but it's private and like does those

Noir contract still is it still able to go in and like retrieve information from it yeah uh that's that's hard um but yes so the idea is basically you when you're actually constructing law proofs or simulations and executive Etc you're basically you'll you'll Noir um like the the Aztec client effectively has a private state store and so when you're kind of when you're running a Noir program um to make a proof Etc there's basically the the the Noir intermediate representation has like State read or code State rightop codes and then when you're executing when you're turning those OP codes into constraints then you've got to send requests to a private state store to say hey can I can I read this this information like I've got a storage slot can I get the can I can I

get the utx and the underlying data and then that private state store it has its own permission Security will also say well either yes okay I'm going to give that to you or like no get lost I'm not giving you my secret keys so the idea is that basically inside the layer 2 kind of like State databases we have a contract Merkle tree like when I use medical tree that's in this context it's basically synonymous with database it's just a way of representing a database yeah um so the medical tree contains leaves that represent contracts and each Leaf contract Leaf is its own mini Markle tree that contains all the verification Keys all the functions okay and so that uniquely defines a contract so if you're sending a transaction on the Aztec Network um you basically need to construct a proof over something that we call the

kernel snug so we're very much using the the zexi nomenclature here and this is very much kind of a yeah very much was derived from like sexy with kind of the OG that attempted doing this and what the candlestop will do is well it'll fish out a verification queue from the contracts tree that you're requesting check it exists and then you'll provide the reusable provider proof for the correctness of that function call that will then get verified recursively by the kernel circuit and then the kernel sector is going to do some logic so it's going to basically grab the public input sound of that snark circuit and those public inputs are going to be interpreted according to a contract ABI and so basically so some of the public inputs are going to represent chain State some of them are going to represent State

updates that the user is trying to make except things like that and the kernel circus job is to check the validity of all of that to make sure that you're not lying you know you're not presenting the incorrect chain State the user is not trying to make State reads that don't exist Etc and so one kernel proof basically represents the correct execution of a private function the way we use recursion the problem is that take a take a theory of example one transaction may be constructed out of multiple function calls to different contracts if I'm for example if I'm trading on neuter swap my unisol transaction is going to talk to at least two token smart contracts there's probably other contracts that unisub talks to to do things that get price feeds etc etc and

so what you really need is composability how do you get composability between multiple contracts in a z case snark world with privacy preserving properties and this is where we we add recursions so we have the concept of a cool stack so the kernel circuit contains two data structures um basically arrays like vectors um that resent your private function calls in your public function course and when you start your transaction your private function call stack has one item on it the contract recording but once it's processing that that function call one of the results from that can be that your function call can instruct the kernel circuit to add more function calls to the functional stack and so the idea is what the kennel circuit's doing it's it's a recursor structure where

it's verifying a previous iteration of a previous kernel circuit proof If one exists and then it's popping a function call off the function call stack um processing it and then conditionally adding more function calls onto the function call stack if that is required um and basically what you can then do is by iteratively Computing kernel circuit proofs you can wind your way down to eventually that your function your private function calls like being empty and at that point your proof is ready to be sent to a roll-up uh sequencer a sequencer yes to be to be to be aggregated into the roll-up Block in this case you've used the term recursion but are you talking about recursion in the ZK sense or is it it's smart recursive yeah because the kernel

circuit has to verify the correctness of function proofs which is a snacksack of everything a snack second and also if your transaction is consisting of more than one private function then you have to repeatedly compute kernel sector per square at each iteration your kernel circuit is verifying a proof of the candle circuit at the previous layer which is another layer of chunk of recursion wild I do feel like I'm going to need to see slides yes yes which I think we will see at some point yeah well our architecture documents are finally public we finally got them in a statement where we're happy to show them to the world and so I want to see this I want to walk through like when I get to re-listen to this I'll I want to see it kind of with some imagery so if you can send that my way I'll add it to the show

notes for folks as well how old are you this is fascinating Aztec 3 was teased on the last episode I did with on Aztec with Joe and Charlie but like at what stage is it like yeah are you is it close or is it like or which pieces maybe are already built so we're building it in in Anger uh but it's a very in Anger well oh can I can I swear on your yes I mean ham stands for hard ass oh okay you're you're working hard yeah okay that's what you mean okay yeah well Kobe created like a translator for um

basically like British terms for other people and I feel like we need to use it a little bit with you but okay possibly yes go for it um so you're you're working hard you're working hard on it but it is an exceptionally complex project uh no one's really attempted anything of this scale before at least that's my biased take on it uh so we're planning on a mainlet launch at the end of 2024. okay we don't want to do this thing where we're like overly optimistic with our timelines because this whole industry is very it's got a bit of a bit of a problem with actually correctly predicting launch dates but we are hoping to get a local developer test net out by the end of the quarter so that'll be something where you can deploy the Asics free network to your local machine you can write in our contracts deploy

them to the local network test them run them wait you mean this quarter yes so like Q2 yeah and a Q2 oh wow um 2023 to beach very transparent um this local test net will not have proofers enabled uh the goal is to basically present the the our planned manner of interacting with the with the chain how you write contracts how you deploy them basically presenting users with developers with the developer experience and getting feedback from them about how it works um and then at a at a later points when we're launching our test net We Will We Will integrate our private Tech into it because we're developing everything in kind of in parallel wow I want to ask about um Aztec connect and CK money because these were other products that we did

talk about in the last show yes so you what do we call disbanded them no you uh Sunset Steve Sunset we've sunsetted them yes so so Aztec connect was I mean one way we consider it is basically a bit of a trial run for Aztec 3 as in at the time our Tech wasn't Advanced enough to get general purpose programmability in but we we did have a tech to producers roll up so asset connect goals was really to demonstrate a privacy is useful on chain it's not just a mix so you can do cool things with the light D5 and that is valuable and that a it's possible you can deploy zks you can roll up to production these are things you can build nowadays um and it's almost like a custom application yes for on this very kind of like

not fully fleshed out but like just the proof of concept the MVP I guess exactly yes the idea is that instead of the user's programming circuits we as a as a first party company we we programmed a small set of circuits you can you can interact with on the Aztec connect Network and yeah basically what part of it was also just for us to get experience about building ziki zeros deploying them into production um actually shipping something uh and you know dog fooding or Tech and making sure that we have the experience required to make it work um we would not be able to build our stick 3 without the experience of deploying as they're connected without a shadow of a doubt however we've been having internal debates over several months about what to do with our set connect because it was consuming quite a

lot of resources engineering resources from us uh because it was our first go at doing a zika zika roll-up and so as The Architects I'm very very confident saying that it had some architecture problems it had some you know some issues that we wouldn't do again um that just design choices that uh at the time when you're figuring things out for the first time you know you what we ended up with was a system where you needed an enormous amount of domain knowledge to solve problems that cropped up um or and so we ended up in a place where a lot of our most senior Engineers were basically working full-time troubleshooting keeping the network alive building the Improvement Center make it to improve its stability as it grew and

basically it was it was reached a point where effectively as the company we we had two children we had that said connect and we had our stick three and uh at some point you know we had to make a choice you have to make a choice you know sometimes you've got to take your second most favorite child and take them out behind the shed I'll stop the imagery there okay um uh no I'm I I don't give parenting advice um but uh basically we needed to focus our resources on aztec3 okay um as an organization you know where 50 people which for web 3 is large for everything else it's pretty tiny yeah and we needed to pull our resources and Focus entitled on Aztec 3. got it so that's what we're doing cool

so it sounds like as we speak you have sort of set a bit of a timeline yeah 2024. what are the big building blocks that you still need to reach that do you feel like there's any additional research that's needed or like do you feel like in general the architecture's there it's just implementation now yes um unfairly confident is a pure execution problem now okay a very big one but in terms of the tech honking Goblin plunk ought to be more than good enough um so yeah that's like there's big things we need to execute on like we need to build our sequence of software and our prove a like yeah software because we want to launch this from day one decentralized and there are some unique challenges when you have privacy involved um that um change the architectures of like how

to coordinate sequences and previous yeah so this is a lot of complexity there's also network engineering there's lots of protocol engineering lots of circuit building circuit design um but yeah it's a very challenging execution problem but but the Technologies is all there wow you're one of the judges with me actually at uh the ZK hack Lisbon event that we just did I feel like I mean we just covered Noir and what it's for do you think that and this is I don't want to put you in the spot here but do you think that by the next time we do a hackathon Circa end of 2023 that like people could actually be using Noir to build like these sort of hackathon projects that is the absolute intention even though Aztec 3 is not ready yes so so is there is you

don't need r63 from um Noir compiles straight straight on its own two ZK circuits certification Keys you can deploy verifiers to ethereum uh you know we have a fantastic um team building while you know we've got amazing people like this really a supreme child of uh of Kev um who as close to an RL Anonymous I think you can guess he doesn't he doesn't like he doesn't have much of an online presence but I have tried to get him on the show multiple times oh dude to know success so far yeah um but you'll you'll see you'll see him crop up from time to time in in photographs um when you know if people are taking pictures and he's not he's not aware uh but yeah I mean I think anyone in the space knows about uh like who's like deep in this business

about Kev um yeah we've got an amazing team building this the goal is for it to be something that you can absolutely just do quickly the right programs to deploy hack around with so if we're in a place where November where people are not comfortable using Noir like that is a you can hold me to account to this this is a massive failing on my part okay as as the CEO of Aztec if we can't get no Android state where it can be used like that so by next ZK hack yeah uh in-person hackathon yeah we should be able to build things with Noir maybe you already can yeah you can do it today yeah um yeah I mean there was a couple of hackathon people that did for example not as a product is relatively new and so we we definitely have work to

do on the tool chains and all the tooling but like we've got an entire team now focusing on that and you should be pretty Plug and Play fairly soon like given that like because circom has been out there a lot longer yeah and it has I mean what's crazy is you've seen things like the Xerox Park group just build all these tools around it does Noir need to build the same tools or is there something portable like could you somehow use something so I'm not sure how much of it can be used is because the paradigms are very very different between number one Circle because Noah has its own language its own intermediate representation where we have some very different design goals for Northern circum uh where for Noir we wanted to make sure that most important thing for noise to present an

abstraction layer for developers that's intuitive so what cercom does um is that the Kodi writes to Define your constraints in your circuit and the code you writer to find the witness assignments to those constraints is different um and that can cause a lot of foot guns for new developers and it's it's not a very intuitive way of writing programs what we wanted to do was unify those two um where you know when you're you program your like like a regular language and then the compiler front end is clever enough to figure out both what constraints that turns into and to derive the witness assignments um with that we have been largely successful but it does mean that you know it's a different language the tooling is is not quite the same um we're also more modular which means that uh you know we can't build like the

because the compostable we then you then need a kind of an integration with the back end which adds adds one amount of integration complexity but it means it's well it's it's much easier POS is possible to add like other backends of the printing systems yeah yeah without having to like hard code them I mean it's not really hard code I guess language but like whatever yeah like as in like do a PR into the circle yeah repo you don't have to do that with Noir and so yeah we're very hopeful for the language um we would like to see a lot more back-ends um if we'd love to see every back end like every cryptography like module supporting Noir because I think it could be a way of creating relatively agnostic Apples to Apples benchmarks for all these proving systems yeah that would be good yeah I wanna I think we're

almost a time but I did want to talk to you just about like the general ZK space quickly um where we're at I mean we're recording this about two weeks after or not even uh after this this crazy week of events that remind me my team put together and you were at and actually we're recording here in person at a place where we're going to be seeing more ZK stuff absolutely ZK week at Suzanne yeah so tell me a little bit about like you and I have been in space for a while I think you're you're 2017 like I am so yeah we're I mean when it comes to the ZK we are both we're old we're fossils you know the elders yeah I mean it's it's such an insane it's funny the

cryptographers who made this up in the 80s were kind of like you are not the elders yeah but anyway I know but the thing is Anna we're Cut From a Different Cloth you know those those OG cryptographers there they were the academics yeah in the Ivory Towers but we do something a little different here we do we do cryptography on the street you know yes we don't we don't publish on your Eclipse we write hack and D observations you know and we uh CK hustle absolutely absolutely that's got to be a hackathon project soon if it isn't already Street crypto or Street crypto or ZK hustle I don't know what that is but yeah we'll figure it out it's going to be something um okay so so I guess to the question you asked about like how's the space evolved yeah I think one of the things

that was really really positive to see was just the energy in the last zika hacky organized because really for the first time you had people coming to the space who would complete noobs with like not cryptographers like didn't know much about CK at all and could actually build stuff actually build ZK applications with the tools and um and technology that this community has built and that is really really exciting because we've been trying to do that for years I know and it's always never been ready it's always not been quite good enough or like you've got to like you know you've got to understand cryptography you've got to understand like very very complicated tool chains to do anything um and now things are slowly changing yeah yes uh we're kind of almost there now and now that's really exciting I was just thinking that like last year you

could do things but you would often and if you look at like the programs that existed I mean I think Xerox Park was an amazing example of this where like they got things built yeah but they weren't built in a weekend it was often like someone would set out to build something and then realize that all of this tooling was missing and so then would have to build the tooling and over a few months could kind of create that hackathon project now and I mean those also developed into full comp like full projects and companies and stuff but this past you know this ZK hack was so crazy to see that like in 48 hours people could actually start to do things and it's still hard and I don't think it's like it's oh it's still like

chewing glass yeah yeah it's not I don't think any of us would say it's easy and the tooling is nowhere near as good as you know well established or something yeah languages and platforms um but it's getting there yeah yeah and you're also seeing I mean even this week it was uh eth Tokyo is just happening I think he's just wrapping up now and there's a ton of projects that are using CK we've been seeing that at the East Global events and stuff like more and more ZK use yeah and so yeah I can't I can't wait to see what this year brings in terms of these projects and just like the ideas that can come out of a hackathon these are the things that could like be used by people like and potentially have incredible impact so it's very exciting absolutely Zach

thank you thank you it's been pleasure has been a pleasure and thanks for doing this recap of sort of the history of Planck and pre-plonk and Aztec I think for folks who hadn't heard those earlier episodes or like newer I think this could be really great to add some context most people have like heard about Planck not everyone knows where it came from so this is cool yeah happy to talk about it it's been it's been a long ride when we're not done oh no we barely started cool all right thanks Zach cool cheers I want to say thank you to the podcast team Tanya Henrik and Rachel and tour listeners thanks for listening