Episode 389 - Stateful ZK Identity with Ian Miers

Transcript

Welcome to Zero Knowledge. I'm your host, Anna Rose. In this podcast, we will be exploring the latest in zero knowledge research and the decentralized web, as well as new paradigms that promise to change the way we interact and transact online. This week, Nico and I once again chat with Ian Meyers, assistant professor of computer science at the University of Maryland. After our episode with him last fall, where we spent time revisiting his ZK research over the years and the foundational role he played in shaping the trajectory of the ZK ecosystem, we realized there was so much more to cover. So we brought him

back to dive into his latest work, ZK promises, ZK cookies, and cryptographic personas. Together, these projects explore how ZK can be used to maintain integrity, reputation, and identity in a new class of social networks, specifically those that can operate without a centralized database while preserving strong user privacy. We explore how these proposed tools can work together, allowing developers to build forums that can ban bad actors without knowing who they are, building completely private group chats with rules and reputation that can be set by the moderator, and self-s sovereign identities that evolve over time without being forgeable or reset. Ian also connects this research to real world challenges like stolen accounts,

managing trolling and abuse, age verification, and more. These are definitely tools for the frontier of ZK applications. Yes, I hope you enjoy. For this episode, we once again have a bonus segment which we will be sharing exclusively with paid ZK Mesh Plus subscribers. This bonus segment has Ian sharing his thoughts on Zcash, a project he co-founded, the renewed cultural focus on privacy, and his recent research on reducing Zcash's nullifier state size without relying on traditional pruning. It's a nice add-on to this episode. So, consider becoming a ZK Mesh Plus paid subscriber if you'd like to hear it. For those of you who aren't yet aware of ZK Mesh Plus, it's our new unified subscription space

bringing together the communities of the Zero Knowledge podcast, ZK Hack, our events, our newsletters, and other initiatives, and then offering extra perks for those who join the paid tier. The ZK Mesh Plus paid subscribers will get access to bonus podcast segments like the one we have with Ian, early access and discounts for events like ZK Summit and ZK hack and subscriberonly content including the state of ZK report and its addendums. If that sounds interesting, head over to the Substack linked in the show notes to choose the paid tier on ZK Mesh. Help support the show. Now, here's our interview with Ian.

Today, Nico and I are here once again with Ian Meyers, assistant professor of computer science at the University of Maryland. Welcome back to the show, Ian. >> Hi. Thanks for having me again. >> Hi, Nico. >> Hey, Anna. Hey, Ian. >> So, we are very excited to have you back on. We did an episode with you back in September this past year. It was episode 378 and we'll add the link to this in the show notes. In that we had a chance to do a full journey through your backstory from your initial work on Zerocoin and Zero to Zcash founding basically the project papers that started it all and we went all the way up to somewhat recent work ZK promises.

But I think Nico and I both felt that we speed ran the last part of that episode. Basically just being like, "Okay, and then what about this thing and this thing?" And so and so we thought it really made sense for you to come back for a part two. And in the meantime, we saw that you'd been publishing all of this new work. So you have something called ZK cookies that we're going to get a chance to dive into >> and something on like anonymous personas as well as like a Zcash note note on notes I want to talk to you about. But yeah, so there's some cool stuff going on and I think yeah, it's a it's a good time to have you on for part two.

>> Yeah, so as I said, thanks for having me and it is interesting. We started with this history of, you know, how do you use ZKox for blockchains and covered the history of Zeroach, Zerocoin, spinning up Zcash as a company and that's payments. And then the next thing cryptocurrency wise was okay well by the time we got Zcash up, Ethereum was a thing. So how do we make that private? How do we make private smart contracts? And that's all in commercial use. There's Alio, Aztec, number of other folks building building that a huge amount of venture funding. But the real question I think is well where do we go from there? Because the interesting thing in terms of the industrial usage of the stuff to date is even for smart contracts, all we've really seen get traction is payments, stable coins

specifically with uh compliance. That's where a lot of the interest is. And to me, this was a little unsatisfactory as a researcher cuz I genuinely didn't know what else to use these things for when we were building these these primitives. And finally, like a year or two ago, I think it finally clicked of, oh, this is what we had, which I'll get to in a second. This is what we can do with it. And it turns out the key insight for all of these techniques is we can keep sort of stateful programs, right? where you have integrity guarantees even if you don't trust the person holding it even though you know nothing about them and they don't have to reveal anything >> by it when you say you don't trust the people holding it you mean the state of the program >> yeah the state of the program so you can

think of this as sort of self-s sovereign data right you are going to hold all the data about you for whatever domain it is and I will know nothing about it except that you did valid operations on it >> and in particular you can't tamper with it you can't roll back to a previous state Right. So, for those of you who have ever played video games, right, you know, everyone knows the quick save, see if I screwed up, go back. >> Yeah. >> Right. That turns out to be a a thing you can do in real life with programs. And for a lot of things you might want to do on the internet about reputation, identity moneyaundering prevention banning trolls, that is a fundamental problem.

>> Cuz for example, let's say I had an anonymous social network. I could quick save for a moment make some incredibly spicy trolling comment and then when I get banned for it I go takes a backaxis and roll back so it's as if I never made that >> wasn't me >> of course >> the actual post is still out there I've still flamed whoever it is I wanted and I can still but because I rolled back I can go on and act as if I didn't on the forum >> and that is the key thing that you can prevent right normally in a forum or something the way you do this you stole all the state on the server, but that means you know exactly who the person is and what they're doing. If you move it onto the client, well, how do you how do

you know that save file, so to speak, is wellformed? How do you know that the person isn't rolling it back? >> And for those of you who saw the last podcast or know anything about uh the history of of cryptocurrency or even e-cash before that, >> well, what this actually is is a double spend problem. >> Mhm. >> You you talk about roll back, but isn't like in an anonymous social media, wouldn't what they do is just create a new account? Like isn't it more like you just create a new version of yourself? You sort of talk about roll back but like Yeah. >> Ah so there are two different things going on here. One of them was let's say you have the same account. Let's say god forbid you had to register with your actual stateisssued ID card and you only got one account

>> right? You could still have a system where you're anonymous. It's not linked to your ID. Nobody knows who that is. >> But you will get banned in various things. So that is one version of this. So that is like a thing you could do with ZK promises out of the box. ZK promises being a paper we recently put up and the assumption would be you couldn't make a new account. Okay, so that's one way to do it. Even in that you have to prevent someone from pretending they didn't make a comment. Even if the account's hard to make, they can pretend they make and keep going. But where this gets really interesting, I think this is like the next 20 years of of cipher punk interests of identity and how we interact as a community online is you don't have to do that. And

in fact, by the way, as a civil liberties point, you should not tie everyone's comments on the internet to a single ID that could be revoked, right? Even if it's a if it's private, there's a massive free speech from there. >> The interesting thing you can do is you can have sort of this ambient notion of of identity of I have say a Gmail account that's been around for 20 years or an Uber ride server history or any number of other things. You may have seen these demos for uh ZKTLS systems, right? where you can go prove you have something some resource on a server without revealing it. And those are costly to create. They're free to use as honest. So you can use one to make an account or two accounts or three accounts. But if you get banned, you've burned that resource. You can't use it

again. You have to move on to, well, my Gmail history is gone. Now I move on to my Uber history. Now I move on to my lift history. Now I'm done. Right? So I get to make three incendiary comments on some forum and I'm I'm out. >> Right? And so the interesting thing there is that the stateful techniques that we have from ZK promises dating back to actually dating back to whatever allow you to start programming these kind of systems >> and the state of ZK proofs unlike when I started doing this stuff in 2011 and then with snarks in 2014 is that these are actually programmable. We have working ZKTLS demos you can actually spin up and run. We have ZKVMs.

>> They're not the fastest but they work and it's pretty clear they will get fast. And you can actually have people program these kind of applications to sort of do whatever they want. >> And that's the key insight is we can keep state. >> Is this why why you're producing so much research right now? Is it like the ideas are flowing because a lot of the you know optimizations have happened. You don't have to focus on that lower level of like does it even work and now you can start thinking about these kind of architectures and concepts almost. >> It's two things. one it's yes the the software has gotten better though in particular most of my lab has still been using arcworks which Patus Mishra and others maintain which has been an amazing framework for for academics because

>> in academia you both need to like write code reasonably well with >> incredibly bright but maybe not that experienced software engineers uh and also you need to occasionally optimize the actual underlying ZK plumbing when you find out it's not fast enough but yes one of them is that's gotten to that and we have all these techniques and the other one is conceptually We my grad students I actually figured out what else we can do with sort of smart contracts in not a blockchain setting or in a blockchain setting for identity as well and we just start running with this. So the first thing we used this state for this ability that you can't you know fork your save file or go back was to keep track of everything you've done and actually have this notion of callbacks. This is what Senzke promises.

So if you make a a incendiary forum post, well if the forum knows who you are, it's very easy for them to ban you. But if they don't, how do you get banned? >> Okay, >> it it doesn't make any sense. The forum by definition doesn't know who you are. They don't know who to apply the ban to. They don't even have your data, right? The the save file, so to speak, is on my computer. >> How how does that bit of band get set? And so what we there have been a long line of of papers trying to do this and what's called anonymous block listing systems. But what we realize is the way to do this fundamentally is to in the save file keep a list of like the random ids for every post you've made because it's anonymous everything has to be

random and periodically you will go check hey was this individual post back marked as banned >> right and we call that a call back so like when you make a post you give them capability so to speak that when they post that back with ban this guy or whatever other arguments they want to apply to the function you will at some point in the future and this is configurable go and look through all of those events that have happened and is this mine? Is this mine? Is this mine? Is this mine? No. Okay. Yes, I have to apply it. >> Okay.

>> Um, and in particular, you don't have to do a linear search through all the things. You can do a very quick lookup. >> And this is all ZK promises just for the listeners. Like this is ZK promises, which is work that we touched on at the end of last episode. was ZK promises like is banning the sort of use case the first use case or is that sort of is it like ZK promises can do banning but it can also do other things like was that the problem you aimed to solve or did it just sort of become solved as you develop this >> ah so it's the basic simplest way to describe the features zk premise is the programmable thing right you have an object think of it literally as like an object for those of you know python java or solidity rather smart contract is an

object and somebody can make callbacks that alter the state. You can write this as look here are these list of functions and someone else can run them. State is the simplest one. The actual problem we started out trying to solve this with and then have ongoing work on how to apply it was ironically money laundering. So back to this the only thing we know how to do with these techniques is payments and now all this stuff is commercialized out of my work. It's like well some bad people occasionally use this. Can we build a permissionless privacy respecting way for people to program things that like can get you reputation or as a scammer or as a thief or something to freeze funds and techniques for that?

>> But ZK promises was not built to enable money laundering. It was it was built to prevent or like spot money laundering. I guess >> the original research problem was how do we have tools? So if we identify somebody as problematic in an anonymous payment system, can we decrement their reputation or block them, freeze them as a tool against money laundering? This is not actually where we ended up writing the paper. It's a standalone thing. But that's where I started thinking about is how do you deal with adaptive adversaries? >> And which system was in your mind when you did that? Was it Zcash or was it some of these like Zexi? Was it or like Alio? Was it Aztec's model? Was it something like I'm just kind of curious what you like where you envisioned this

being used. >> It was the Zexi. So it's it's the model that is in both Alo and Aztec, right? Everyone's gone and added a little bit for what the programming model is like whether you can do how you do public and private smart contracts. But the state model with this object where where you can do manipulations that is fundamentally the model for Alio, Aztec, Miden, I'm probably leaving someone else off. Um, and it was in that model. Um, because you can't quite do this in Zcash without extensions. Though, ironically, Zexi came out of exactly how do you do those extensions in Zcash, >> but that's a story for the last blog, last podcast.

>> Um, >> okay. Okay. So, it started as preventing money laundering >> and then I mean and then it evolved like would you say it has evolved into a how to ban someone in social media or is it how to exclude is it the block list like what what is the current kind of problem space as like fully >> so it it ended up being again it's a general technique you can do whatever you want with it as far as I've been in thinking about it the callbacks are for identity and reputation right how do you express things about your identity but not have it be a static attribute because real world like when we think about how people we know and people online it's not I had some credentials at one point in time it's I have a

reputation in some loosely defined sense based on what I've done and there was a notion of consequence to that >> and so this is the set of tools where you can program that the reason I said this is the next sort of cipher thing for 10 or 20 years is what you want to program that is the way you want those rules to work is an open Right? There are any number of things you can do here in terms of you want to program a system where it's a simple ban, that's easy. You want to program a system where there's a timeout or a cooling down period or ramp up period, that's a different thing. I actually have no idea how old your listeners are, but depending on how old they are, they might have used Stack Overflow at some point.

>> Probably. Yeah, >> probably. >> They've gotten older, too. Like this show's been around since 2017. >> Yeah. >> 2018. So, yeah. the the thing that AI killed and we don't have to use anymore. Right. So, Stack Overflow had this interesting same problem about like like you said, if you ban an account, well, you can just go make a new one. >> Yeah. >> Right. So, what Stack Overflow did, and I'm sure other people have too, but this is the one that this documented discusses it. >> When you started, you did not have that many much ability to post. You couldn't post any links in your in your answers because it was >> spam prevention. And so, you had to earn it.

>> But you built it up. You built up the capability. And then the point was if you then decided to be a jackass and got banned, well, you went back, you had to make a new goose egg account and spend the time grinding. >> Yeah. >> Um, and so using ZK promises, you can program something like this, >> but with the additional feature that the user is completely anonymous. >> Yes. >> Across all of Stack Overflow or in fact, and this will duct tail into the other paper, cryptographas, though it's a little bit premises, you could have different pseudonyms. You don't have to present the same exact notion of I am who I am across different settings.

>> But the system itself could ban you if you are acting as a bad actor, but anonymously like all cryptographically, not because there's a person they're checking, >> right? They could ban you. They could ban you from certain forums. They could they could make you go on a on a temporary ban for a couple of weeks. They could give you like three strike rules. All these things without ever knowing who you are and never learning, right? This isn't a system where you go to some NPC FHE Enclave thing and say, "Hey, now I want to deanmize this person." They never learn. They just get the point that they've set your your save file, the state, so to speak, that you can't post. So the next time you try to post, you're supposed to produce a proof that your save file says you can post and you can't.

>> And of course, it can't. Similar to the way that in in Zcash, you can't prove that you have $50 when you don't. It's like you're broke, you can't post. >> Reputation broke, so to speak. Your rep got set to zero, you cannot post. It's good that your example with Stack Overflow also highlights these can be like positive callbacks like you gain reputation and you gain things, right? >> Yeah. And you can add, this is thing we actually forgot until we got to personas. You want to do badges like people have achievements, you can do that. You want to have qualification criteria for, hey, I I'm an expert in this. I have these credentials like credentials in like I have a diploma. I worked at somewhere for x number of years. I have this many commits on GitHub. You could do that. It's a programmable system. I'm not sure that's

a good idea depending on which forum you're doing and why, but you can. >> And it almost feels more ZK credsy. >> Yes. >> If you're starting to prove things about like your GitHub or whatever. >> Yeah. Well, I mean, the real thing to think about it is your identity is just a piece of state. >> Mhm. >> Right. And so you can build up and I I even phrased this this way in the the talk we presented for ZK credits at reward crypto like you just build up various identity signals, some of which are static credentials, some of which are conduct and reputation. And it's a stateful thing of, hey, I have this thing from the DMV. I have this thing from the US Passport Office. I have this diploma, right? I have these many publications. I have these many comments on the internet that you know are mine.

I have other ones that you don't. But there were callbacks on whether people thought they were good or bad or or flaming, right? We could have multi-dimensional pieces of reputation of like, are you an Are you smart? Are you manipulative? Right? Like and you can imagine filtering things based on different things like yeah you can participate here but you have to be a very high like scrupulously nice to everybody. >> You have a you have a good Uber ride rating. >> Yeah. >> Yeah. >> Interesting. >> So I guess all this makes your local state and the software that manages it like the one most important thing you have.

>> Yes. So the interesting point though is it's because of the way this stuff works there's no uh need for it to be secret. Like you can have this be open source, everybody can see it. You don't need proprietary hardware on your system that you can't see and interpect with. It's just a proof. And so provided everyone agrees the software is secure, >> it doesn't matter. It can run on a Mac, it can run on an iPhone, it can run on a on a well, it won't run on a Raspberry Pi proof, so not that fast yet, but it can run on your your weird open Linux phone graphing thing. >> And it won't have to have like the Play Store doing introspection or Apple doing verification of boot. Mhm.

>> Because actually, by the way, this is the thing that a bunch of people don't realize. A whole bunch of things on on the internet, right? When you see people complaining that, oh, I can't run something on graphine or like my banking app won't allow or rooted devices. >> Y >> that's actually because mobile phones under the hood are doing this weird monitoring of like is your device sketchy? What's going on? Who are you? as a security measure to try to to keep bad actors out and it has some unintended consequences. But like that kind of thing is a problem and to I'm exaggerating here to a very limited degree you can think of this as a way of moving away from that in terms of having different notions of indicators of of history and non-mpromise.

>> So you just mentioned ZK what you're talking about here is ZK creds that is something we did dig into in the last episode. So if people are not familiar with that work, please do listen to that and we'll add links in the show notes. And yeah, this sort of feeds into the ZKTLS work and this bringing together of ID from all of the internet. So yeah, so what are other tools in that sort of tool set around making it possible for you to work in these private systems without centralized databases without people without someone needing to see what you're doing?

>> Yeah. So that I guess we can go to cryptographic personas which is an application of those tools. >> Okay. >> So ZK promise has built up this notion of we're going to keep state and have callbacks and we have pseudonyms but it's but what do you do with that and reputation and and forums is one thing but one of the things we started thinking is what does it look like to have a set of social forums where you want to be able to control what you're saying about yourself. >> Mhm. So, for example, a really useful thing if you are living in in somewhere where the security services of your your country may go look through your your group chat is you might want to have a like a signal group or something where everybody in it is anonymous so there are no names on it. You might have some

idea of who's posting things. Uh but if someone just looks at the chat, they're not they don't. But of course, if you did that, one of your fans might abuse it. One of them might troll something. So, like you still need this ability to ban people even though you honestly don't know who they are. You might have a suspicion but you don't know right. Similarly speaking example we use in the paper. So I'm I'm a professor. I have to go to faculty meetings and f academic my department's quite good but academia notoriously particularly in like the biological sciences has these hierarchies of of whether you're tenured or not and how senior you are and you have to be really careful about what you say in those departments >> and so it is very useful to have a way to speak truth to power general comment

right however everybody who's ever been in a faculty chat or even been in a work meeting knows that if you let everybody in the group speak truth to power anonymously with no way to moderate them like say you made a WhatsApp group. >> Um, >> there's bullying. >> There's bullying or just trolling and you know everyone has the guy they wanted to to shut up for sure or girl. Let's let's let's be gender neutral here. And like but if it's anonymous and you actually don't know who they are, the only thing you can do is shut down the group. >> And so it sort of never works. >> Yeah. >> But what if you as a group of people wanted to self-organize a thing where like it really is anonymous? Nobody has any notion of who it is. There's no one to subpoena, no one to curse, no way to

do this. But you can all still democratically or if you appoint a moderator decide this person is talking too much. We want to either ban them. >> Yeah. Yeah. >> Temporarily ban them or just rate limit them. So like yeah you can only post once an hour dude. >> And so cryptographic personas started with that idea. >> And then we started thinking about well what if you had different pseudonyms? You know how like you have the anonymous leopard and various other people when you're editing a Google doc and Google doesn't know who it is. I mean Google knows who it is but they're not telling you their name. Well, what if you you could create like a temporary persona to put on some comment and you could respond in that thread that way and then you could throw it away and never use it again or if it worked out and you

realized the group did actually like you and I like the opinion say actually, hey, that was me. You take off the hat, so to speak, right? And this is this is a thing that people have done historically, right? Like the Federalist papers were done this way with people discussing things synonymously. And I'm not absolutely certain anyone ever like later claimed it though I think we do know who some of those some of the federalist personas are. I have heard though I have not read this that like similarly the old cipher punk mailing list like how Finny used to play exactly this thing where he'd synonymously put up an idea >> because he wanted to be evaluated as if it came from from a rando and not him and then or he wanted to prank people.

>> Again back to moderation question. Uh and then you know he would sometimes reveal that it was him sometimes not. This is why one of the suspicions about who Satoshi Nakamoto is is that it was Heleni. And so this kind of like how do you use this as a tool versus an actual useful social thing, right? Z promises was the programming techniques, but this is this notion of what do we do there? How does it work? What are the interesting ways to think about configuring your social groups? And it's it's still exactly programmable. So we're just sort of suggesting different ideas people could build there. Was it a straightforward application or was there a lot of work and massaging to do to get it to fit?

>> It's a very straightforwards application. We then did a fair amount of massaging just to make it a bit faster. >> So we have some pretty straightforwards if you know the weeds of it folding techniques in the paper to do the basically you're looping through all of the posts you've made to see if they're yours. In ZK promises we just had one graph 16 circuit in Arc Works. In this it's a folding thing, >> right? So an incremental proof every time. It's an incremental proof and actually just for your readers who are into the details, one really useful technique there which is mentioned in the NOVA paper but I think is underappreciated by practitioners is you don't have to do a finalized proof. You can just rerandomize things and that's way cheaper. So if you're ever trying to use folding for a real application where

it's intermittent computation I'm going to do a huge amount of stuff and it's just done so I don't care the advertised cost. If you ever write a point and you find out that oh this is way too slow which actually happened to some collaborators of mine on a paper called alpaca the actual answer is don't do that do the rand fold in a randomized instance >> not our technique mentioned in in nova like absolutely not ours but like nobody noticed how useful it was so we did that and then we did some other stuff to to make it like you can do batching which requires us to grab old cryptography from privacy passes and all things developed by George Takersley Filipe Veloda and some other people at Cloudflare uh Nick Sullivan and I'm missing the actual grand student who was on the paper. Sorry, grand student.

Nick, I can't remember. Um he was an intern. It was his idea and I'm naming everybody else. That's the horrible thing I should not do as a faculty member. Uh you know what? That's bad enough. I'm going to go pull this up and do this myself. Uh so it was Alex Davidson, Ian Goldberg, who was the professor. Uh Nick Sullivan, George Tankers Philippa. >> Okay. So wait, who is the grad student? >> Alex Davidson. >> Okay, credit given. >> Yeah. Nice. You sort of started this with this idea of doing like a private signal group where you would have like a smaller subset of people. What kind of tool is that? I mean, you're building your own chat environment, I'm assuming, or you'd have a chat, I don't know, a chat software product that you could then deploy yourself in these small

instances. Yeah. How do you can you kind of elaborate on what that would actually look like? And actually, I just it it kind of inspired me. I was like, "Wow, that would be so interesting if you had like a very small group of anonymous people like where you you do know who everyone who's in the group, but like do people go >> haywire when when they like if it's five people, would one of us still go off the rails?" I wonder. Anyway, that's more of like a psychological experiment, but yeah, talk about the technology of it. >> Well, just a second. Actually, that's a very good point that this anonymity is a smaller group than I'm an anonymous stranger on the internet was really the entire thing that motivated personas. It was exactly that interest. The technical stuff was actually sort of a like well I

mean we're technologists we will do technology thing but that exact idea is exactly what we want. And if anyone on this listening to this has the requisite background in bonafites to show that you're not completely a rando I'm really happy to talk to people and work with them on this because I exactly want to see these things exist. >> Cool. >> So how do you do it? So the paper if I recall correctly I haven't read this paper in months. We had about three different ways you could prototype it. Cryptography is all the same. It's the exact same stuff from Z get promises and bits and version one is you take signal or something else and you modify it slightly so that you can send messages which don't have a sender.

>> Okay. >> Uh and it turns out that signals cryptography is almost there. Actually the cryptography is literally there. They have a thing called sealed sender which does not reveal who sends the thing. But the way the software is configured it's actually a little hard to literally leave out the uh the name. And they probably do that to avoid like spam and stuff like this, right? >> Yeah. A couple of different reasons like that. But they have they have an anonymous credential to avoid spam, which is linked to your phone, not linked to your phone number, so to speak. But it's it's within the limit of you might be able to vibe code it. I actually have a vibecoded file somewhere for lib signal that maybe does this. But then you'd use that and you'd integrate it into your own version of signal and run it. And you then everybody would see

all the messages. they'd see the the callbacks and basically they'd sort of run their own it wouldn't be a blockchain but since everybody sees the messages they could get this list of all the ordered things that is what you'd see on chain metaphorically speaking and you could run it. So that's version one that doesn't involve a server. So that's the way you put it in a chat app if you wrote it from scratch. Maybe the other way to do it which we have prototype code that will go up when we update the paper is you have a proxy server and the proxy server say talks to signal or slack. Right now we have it doing Slack because Slack has a NEST API, nice API and you send your anonymous message anonymously to the proxy server with the ZK proof that you're authorized and all the other callback stuff. And then it

says checks this and forwards the message on your behalf to uh Slack as it's coming from a bot with no name on it because the server doesn't know who it's from. >> And then you know if enough people like react with a negative emoji uh it will ban you. >> Interesting. >> That's another way to do it. And so these are these are lightweight just software engineering. It managed to be a little annoying. But if anyone's looking at this going, "Oh, it's intimidating cryptography." No, the intimidating cryptography is factored away at a library that I mean grad student code. It's not the bro library, but it's it's just a library like you you don't the integration bits are actually quite straightforwards.

>> In this case though, you're sitting on existing chat interfaces. So you're just sort of like >> yes >> hacking some of their features to be able to >> to send these anonymous >> and then have some sort of call back. So you can actually like send information backwards banning or >> but you can use the the chat channel itself as as the callback but you just it gets posted in there and it maybe it doesn't render it doesn't display but it's text in there that someone knows as an event which is the same way like the emojis happen right when you when you click on a message in Slack and respond with emoji or in a message and signal what actually happens is a message gets sent right back to the group >> but it's it's you know it's meta it's a meta message right it doesn't render as

a message it's the client sees it and goes oh I know that I should alter my local state to have it have a plus emoji >> and just the exact same thing here where you see that message. Oh, I should alter my local state to have change my save file or change the whether I'm banned or reputation or whatever it is. By the way, actually in this case local state, what are we maintaining? Cuz you said earlier like with ZK promises, I'll make a post people can upvote down votes and then that affects my state. in personas is the thing that people upote down vote my persona or the specific comments made through that persona or actually both.

>> It's programmable. It can be both. >> Okay. >> Like personas is basically some rapper ideas on exactly Ann or what you got. I'm glad you mentioned that point of what is an in a small group bring because that really is the >> the framing is we have this notion. It's almost an anthropological question of if you have these tools what can you do with them? The tools are literally the ones from ZK promises with some performance improvements. >> I hope this comment doesn't come back to bite me when I get reviewers who's who have read this podcast um listen to this podcast. But that's the honest answer of it. It's like here's some cool applications and then here's some performance improvements on the exact same techniques and they're basically unrelated.

But I still feel like this needs to be out in the world somehow to see what people do with it. Or I mean or can we imagine what people would actually do with it? Because I feel like there's definitely like a dark side to I mean any technology you release. There's the there's the positives like oh you could actually create these anonymous groups. You could share information. You you could you could say something that you are scared to say but should be said etc. But like I sort of mentioned before there's like the bullying phenomenon. There's the kind of shit-talking like being really mean to people like >> Yep.

>> I I remember there was this app many years ago. I think it was just called Secret and not I'm not talking about the blockchain. It was like something before that. I think it was just called Secret or something. It was like it went around the VC world in like 20134. This I'm I'm possibly slightly off with my dates, but it was in the regular tech world, but it just became a cesspool of abuse, right? like it just became this absolute abusive environment and that I think is what these like fully private things can offer. You now have this feature of well we can ban somebody if they're talk if they're you know really rude or whatever but who decides that >> right right >> who decides it and then like could that be weaponized as well and this is the

part I I feel like we need to see it out in the wild to see like how people actually use it. >> The last bit is exactly the question. So again, it's a programmable thing. So you can program any moderation version you want. You want to do a democracy where everyone gets to vote. >> You want to do a managed democracy where five people get a vote. You want you want to do a benevolent dictator for life in the sort of like network state model of well, if you don't like this form, go to your next one. All of those have actually been successful in in non-technical means and various things. They've also had horrible problems. >> Yeah. >> And it is it's very important to understand that like this thing enforces the rules. the rules themselves, if they're set up correctly, can set up

incorrectly, can be a form of abuse by bullying and abused, right? Anybody who's dealt with, you know, real petty politics at work or anything knows that you can do that. I mean, hopefully you didn't experience firsthand, but like, and hopefully you weren't the one doing it. But yeah, rules can be abused. >> Yes. >> Right. This is a cryptographic system for defining the rules you want. You can define objectionably bad rules, or you can divide rules that are just not good and they get abused and you didn't intend it, but it's a problem. >> Yeah. Yeah. And what these are and how they work is actually a really interesting question. And again, because this is programmable, you can at fairly low effort without having to go find a bunch of cryptographers and define a custom P protocol. Try various things.

>> Run these experiments sort of in real time. >> Yeah. >> Some Yeah, it would be fun to do that and then maybe write about it to share what it looks like in something like this. >> One thing that multiple people I have mentioned this to wanted to do and I've been thinking about it myself is of course the modern version of Secret or whatever it was. is called Blind. >> Okay. >> Which is this app in the valley where people go post, hey, I'm an employee at Meta or Amazon or whatever. Here's all this stuff. And it exactly has both some useful things in it and also toxicity. >> Just imagine the type of abuse there.

Like you just don't like your manager and you say something like horrific about them or I can just imagine these like careers could get hurt by these things too, especially if you're like claiming like an illegal act or something. >> Mhm. One of the things there having talked to some of the people who are created blind is that one of the things that that it's very hard to do to get blind to take off because it wasn't I think the first app that did this >> is like you need to very carefully figure out what voices you want people to have like which things you want to populate up to the front page versus don't.

>> Yeah. >> Uh and the cool thing here is because these techniques are programmable in in Blind's case. I don't know how they did it in our case, right? Again, it's a state. can you can sort of have a an amplification feature if you wanted of like look like this post you can make we're not rate limiting you or anything but it's not going to be as highly >> displayed as other things because like you're just like bragging on your manager >> and if you wanted the form to be about something else you could you could sort of steer it that way >> um again these things themselves can be abused they need to be done with transparency and and a bunch of other problems there so that gets into some tricky questions but the techniques exist >> I wonder if like the future future of

moderation is also just like AIS cuz like you could have if the content is actually understood like so far you'd have to do like keywords or you know swear words or something pictures that are inappropriate blah blah blah but like if context can be understood by some other agent that doing the moderation that isn't human although I do think that could be completely screwed up for people too cuz like things could be misinterpreted etc etc but yeah >> it could be but actually a really interesting point there is that one the way to think about this is it's contractual anonymity right like you have zk promises you have this code which contracts both how you can express yourself and how people can apply moderation events to you or anything

else right the callbacks can do anything you want but in the context of moderation so one thing you could do is you can restrict and this is in the in the system you can restrict who can make that call back by default it is there's a key >> right but that key instead of being held by a person can be held by an enclave that for example is running a moderation algorithm. So you'd say I will only let people let myself be moderated downvoted, upvoted or banned, whatever by this enclave running this language model with this prompt. >> Yeah.

>> And the context has to be this. >> Wow. >> And that is a thing you can do. You could have agents moderating people. You can also apply the reputation to agents itself. That's a separate discussion. But you can play with all these things. So it's a really interesting laboratory for doing this. that idea of an agent participating in one of these anonymous environments. Is that something that factored into your research or is like you've created the systems, you've thought about some of the architectures, but yeah, do you imagine what happens if there's like these nonhuman things inside there?

>> Yeah, definitely. Now, like uh when we started this, agent AI was was less of a more of an illdefined buzzword than just a thing that very clearly just oh it's it's just a ripple loop with a agent that can make calls to other things. Very clearly that exists like yeah, it's cool. Um so yes, the answer is yes. And it doesn't really seem to change anything. If anything, it might just make this like even more impactful because like now you you have questions of well is this a well-trained agent? Is it well behaved? Because >> nobody can really do verifiable trading, right? That doesn't scale. you don't necessarily know who these things are, but you might want to know whether they have good conduct or not. And so we actually go start going all the way back to like if anyone knows any of the

prisoners dilemma stuff where they used to have agents competing and that's how we did some of the equilibria studies. You can think of it that way of like reputation and and iterated games but with anonymous users. So as we said all this like ZK promises cryptographic persona stuff sort of lives on the fact that creating a new identity is expensive, right? So this is sort of this the cyble resistance or cyble like attack problem. Is the solution purely ZK creds and getting a bunch of different signals in or do you have more there? We have more there. It's nice two things. First of all, signals are expensive. When you have reputation and the ability to do down votes and banning those signals get burned. So that's the

particular really important part, right? It's like you as an attacker consumed these resources to make an account. you had some set of tactics and dates and procedures. The good guys figured that out. They burned your account. Now you have to go uh make a new account and it it ups the cost of whatever it is they're doing. Be it spam, be it pig butchering scams, be it disinformation when they get detected and interdicted by however that is. Now they have to go create a new whole new Uber ride share history or a whole new Gmail history or hack and steal it or steal a passport or whatever it is, >> right? Because these signals are only usable once. I cannot create multiple accounts on which I put ZK signals.

These signals are anonymous, right? How do you know that I'm reusing it? >> Yeah, you have to do dduplication there and that is a whole can of worms, right? >> Um, as some various folks found out the hard way. So like Aztec deployed a system that unfortunately had a little bug where they leaked that you registered because they dupdation for their uh sale. That is a question, but there are techniques to do it and I think in fact we can we can create better ones. My group is working on that. But yeah, you have to do the duplication somewhere. So that's point one and I guess point two. Point three is we actually have techniques for making sure you can't share accounts and use them too many times across multiple uh instances and like share the resources and that maybe is actually a good transition to what ZK cookies is

>> which we wanted to talk about. ZK cookies. Did we even mention that on the last one? >> I think we alluded to the problem of having to continuously authenticate. So let's say with systems like world like you scan your eyeball once. Sure, but to make sure you haven't installed your account or something, we need to scan periodically and we're saying this doesn't scale and so that's where we left it. Is that the problem tackled by ZK cookies? >> I believe so. Um I'd have to like Yeah, I think that's about right. There might be a little gap there, but yeah, the question in ZK cookies is how do you once someone's given this evidence, built up this stateful credential? How do you make sure it's not doesn't get stolen >> or shared >> or sold

>> otherwise sold, right? And this is a problem that exists in the traditional non- anonymous credential world like with the Gmail account. And the solution there is a thing called continuous authentication. It goes by multiple names, but that's one of them. And basically it's as you use your account across the web or if it's a single service on a single system, single server, you track how it's used. You track the IP addresses that are logged into you track the attributes of the browser, right? So browser fingerprinting for example, various other things. A lot of these end up being kind of sketchy to give you an indication of if the account suddenly jumps from one place to another, it's like, oh, you shared your account. Oh, your account was broken into.

>> Right? And you've all probably seen this because if you for example travel a fair distance and you try to log in to a bank account, they will sometimes prompt you for additional authentication. >> Yeah. >> Uh creepily sometimes they won't either because the system is bad or because actually they're tracking all your credit card payments so they know you bought the flights and the hotel and they already know you're there so they don't care. >> I think YouTube does that too actually. Like there's more there's like banks maybe being very serious but there's also like Google accounts I think do that a little bit. Yeah. And and gaming accounts, it's a common thing. You have to have these kind of active things to detect against protect against threats because the reality is that people's accounts get compromised. Passwords get leaked. People type fishing attacks. And

so you still as a as a service provider have to prevent prevent this. >> There's another example of this that was more recent, which is like people with Twitter accounts with a number of followers that were impersonating people. >> They seemingly were kind of like renaming and moving around. So they they they would all of a sudden be a new person, but they were keeping. What was interesting is this. I'm not seeing it so much now, but they were like keeping the number of followers somehow. >> So it's like either being passed along, repurposed, and somehow not banned, not getting caught.

>> Yeah. >> I'm not really sure how they did that, but anyway. But yeah, it's sort of a similar thing here where like you build up some sort of credibility and then you sell, but like you can't just geot track cuz sometimes you are traveling. So you need some way of like proving that it is you. I guess >> you could do a number of things and and again ZK cookies is this programmable framework that's the same program framework we're talking about specific applications. So one of the things we did suggest actually is you you do geo tracking >> but instead of the server tracking you because that's obviously privacy invasive you track yourself right so if you're using something like Apple private relay the entry node sees who you are and so they can sign that as your IP address and then you store it

locally. Similarly, if you're paranoid or not good at privacy and you're just willing to trust that the server isn't going to log the IP address, or more importantly, if you're the server side of this and you want to track stuff, but you've got GDPR requirements and you don't want to have IP addresses, you could sign it and give it to the user to store. >> Mhm. And then we're back to the local state and I emit proofs about my local state >> that my IP is always in the same region. Right. >> Right. And nobody has the whole history of of of your IP. And then there was this question of what function do you prove over it and what do you do when you're outside of say the geographic radius and the answer is you ask for more authentication. Maybe now you have to do it to a factor. Maybe now you have

to go use your UB key. It's an open question but this kind of tracking fingerprints and usage and all these other things >> is a thing you can do locally in a privacy respecting way >> because the server doesn't have this whole history of what you're doing. You do and you're just showing a thing about it when you go to the server. say I'm not going to tell you anything about my P address history. I'm going to say it's signed by the Apple private relay entries or signed by you but you didn't log it and it's within this distance radius or if it isn't I did the extra authentication checks. Similarly, you could show that the browser fingerprints are consistentish across things.

>> We would need some kind of signature right from the browser. >> Yeah. So I was going to say for those of you who are thinking adversarial security, you're going well how the hell do you trust that? The answer is even in traditional web where this is a very effective technique. It's not perfectly secure security by obscurity. It's like there's obuscated JavaScript that might work to measure and it's hard for someone to reverse engineer but it's not a hardbound. It's it's like sort of funny that it works but it it it does in practice. >> How does this actually prevent people from selling their identity? Cuz like you talk about this list, but if they have this, can't they just transfer that? You can transfer it, but if you transfer this, so it prevents theft more effectively than transfer. It prevents sharing very effectively for the same

reason. Straight up transfer, you'll see some anomalies because the usage pattern shifts from one thing to another. And there's this sort of notion that when you do that, you might want to, for example, then ask for more authentication, like say redo your passport proof. And of course, if you've sold the account but not the passport, you got a problem. >> It's downgraded somehow. It's like not verified to the same level anymore, >> right? And so one of the things that this becomes really important I think is anonymous credentials are no longer this hypothetical. Two years ago, three years ago, even when we did ZK credits, there was this notion, well, maybe they're practical. And then, oh god, the regulatory landscape changed because one, people are really worried about deep fakes and bots on AI. Yeah.

>> And there's immense pressure there. And then in a lot of the world there are these serious requirements for age verification on the internet now for access both to actual pornography but more broadly anything that's violent or extremist right so this spans the whole of red state of the US on the pornography bit to the EU and people on violence and extremism um with all the cultural and political biases of which one they think is more important >> but as a consequence of this you need on the internet there are actually legal requirements for this in a number of states and countries and everybody raises for the bad thing from a privacy standpoint. So we are now getting these notions of identity where you do a ZK proof and this is for example Google's longfellow proposal

where they're doing a ZK proof just about your passport. >> Yeah. >> And that's very cool. I think actually you're going to need a more general version of that where you do zks and if you look in zks and zk cookies is a nice and zk specifically is a nice overview of of how these all techniques fit together. >> Oh cool. The thing that maybe nobody realized when they're reading the proposals from Google and similarly things that Apple is building is that the way they stop theft of credentials because this is a real problem. Now, if you try to do this for age verification for access to let's specifically do adult content for a second, you run into two problems really fast. One, people will share their credentials, right?

>> To let underage folks in or to let whatever. And two, people will use this for click fraud because like there's a whole advertising ecosystem here and you get the same problems, right? So the way this is being done is for both high-end phones there is a secure hardware element in here and when you register your password or your digital driver's license that gets bound to the secure element in your phone >> and then what you actually give in long fellow and I believe the systems Apple is building you give a proof that I have a signed pass signed ID from the DMV and a signature from the hardware >> and the ZK proof anonymize all this from a privacy standpoint there was nothing wrong here from a openness of the internet standpoint if you deploy this widely the only two people who can do

this are Apple and Google or Google/ Samsung whoever owns a large enough portion of the mobile phone market to have a secure hardware and be able to do the integration and so that's Apple >> actually probably not even really Google because pixel phones are not that widely used sorry Google folks I like you but and Samsung or whoever and that that's the death of the open internet right you've just gated everything on proprietary platforms And so how do you get around that is you need these kind of ZK stateful software architectures to do those kind of tracking and techniques in a privacy position way but without being locked into specific hardware.

>> Yeah. >> And this is this is really actually important that we get this right. It's a such a kind of longstanding push and pull of this like >> the proprietary offering like it's almost like the open systems creating an idea, the proprietary ones taking it in doing it really well, >> getting it into a lot of hands and then sort of this open-source version or like new open source paradigms coming and trying to push and pull. Do you feel like this is sort of a larger question, but do you feel like in the last 20 years have we gone more proprietary or more open source or do you think it's the same maybe just a different breakdown of like what's where?

>> I think I'll define the question more broadly than open source because I think that's maybe less relevant. It's where the data has lived. >> Okay. >> Right. We move from web one to web two to web if we think web three is a thing. Right? But increasingly the data is siloed on a server. And the thing I'll say is the very good reasons for this ignoring the unfortunate business or whatever stuff is that like that's how you got trust and integrity, >> right? Like like there is honestly no way apps and techniques like what I've developed for Google to do this kind of don't share your credential without either storing the data on the service which obviously has tracking things that they don't want uh like really they actually don't want in this particular case which is surprising or relying on trusted hardware. And so we really need

new techniques to make sure this stuff we have integrity in an open open system where anyone can participate. >> And blockchain is a one answer to that. But the problem with blockchains is everything is public. It's Twitter for your bank card. It's all exposed which you clearly don't want for payments or for your identity on the internet to access age restricted content. >> Uh so we need new techniques to get an open system where you can do all of this stuff and hopefully we're moving in that direction. >> Yeah. Do you feel like we are like in that push and pull scenario? Where are we at? Are we in a place where there's more power given to certain organizations or do you feel like there's this upswing of this really cool new technology and and it's getting adoption and that could take over.

>> I think definitely the power lies with those organizations a part because the tech didn't really exist to not have it. We now have options and it remains to be seen >> whether everybody wants to use those options or not. Mhm. >> Um for identity specifically is interesting because there's no money in identity. Having talked to these folks, nobody actually really wants to build these things in the profit center. They just kind of have to to like enable their other businesses like say YouTube. So there is a real possibility that if if you got the right techniques and got it would be quasi open because like there's actually no incentive to close it >> because they don't need to own it. They don't like there's no benefit to just like owning that system.

>> Yeah. And actually they're real detriments because you now if you own that system and we start using it for not just adult content but like speech because we want bot prevention now you have the problem of someone's going to come to you and say hey we want you to not allow this kind of speech off your platform and you might not want that on the other maybe you do maybe you like control and you can monetize it. >> Yeah. Yeah. Being the moderator is is a double-edged sword. >> Yeah. >> On some level it feels good and on some level there's a lot of pressure to get it right and it's kind of impossible. So, >> so if we move to having local state for kind of everything, do you foresee some kind of standard of what local state looks like or is there like one

canonical piece of software that everyone's going to be using to maintain their state and prove things? >> I don't know. There have been some interesting ideas where you sort of view the browser as a sandbox for this and there sort of already is local state in the browser. It's just authenticated and so I could see that happening. there's some like almost blog post internal not notes from one of the Google teams that's up online where they sort of start talking about some of the work they did in this sort of broader concept but their work doesn't actually enable this concept they're like hey this is an interesting idea so I could see that happening definitely for web 3 it sort of by definition happens because you have standards for smart contracts and and interoperability on whatever system you're on of course in this case we need

to move to ZK web 3 uh and so that's a question of which one of the various competing projects using Zexi wins but They all have standards. So, it'll be one of them. It'll be multiple. Uh I don't know, >> but definitely I think it it will happen to to some degree. >> Can we return to the map? You sort of mentioned this like all of the different tools and how they work together because I I mean I just I love thinking in that way like I'd love to see you. Is it actually a like a vis visual thing that exists? >> No, I should actually literally visualize it. It's two paragraphs, but that's actually a very good idea. I should do. Please message me in a week.

Remind me of that. >> Maybe we can get it before the show airs. That would be great. >> Yeah. Yeah. Yeah. That that would be really good. Okay. So, everybody has been making better and faster ZK proofs. >> Yes. >> And when we did the, as far as I know, literally the first proofs about passports in ZK creds, right? The point wasn't, hey, we can do a fast proof about a passport. The idea was we have this signals that come in ZK supporting documentation we call paper and then you can compose those into a larger identity. And what everyone did after that was just went, "Okay, we want faster passport proofs." And so Google built this amazing fast proof called Longfellow. And actually, when I say fast, I'm doing it a disservice because the main thing it did was it had low memory requirements, which means it can

run not just on a new Android phone, but on a 5-year-old Android phone because that's Google and they really have to deploy it. >> This is the one that's based on Learo, right? This is like all >> the combination of Leo and >> GKR. >> Yeah. GKR and whatever the Abby Shalot paper that was uh doubly efficient whatever and I forget the name of it. Hierrex. >> Oh Hrex. Yeah. >> Yeah. Yeah. And we we actually just a quick note we had them on the show the but we were speaking specifically about the Google ID at the time. Longfellow has come out since. What is Longfellow again? Is it just >> Longfellow is literally the proof system for that idea?

>> Okay. They just named it. I think at the time they didn't have like a cool name. >> Correct. >> Okay. Got it. >> So these are the same exact thing, right? So this is this amazing fast proof. The trick is a great proof and I wish we had had it to use it in NZKRS. In fact, you literally can use it as the proof in ZK creds because like you you prove you have a passport and you then put that attributes into the credential. The thing that everybody misses is that you need more than just what's in a passport, right? You need other pieces of identity information like say your address or like for any of these things where you have pseudonyms or rate limits, you need a secret key that is known only to you. Mhm.

>> And the problem is that if you have a passport, all the data in the passport is known to the issuer. So you can't go use that data to have pseudonyms that are unlinkable to you >> on the internet or rate limits that are on like because the authority to issue your passport, the US state department, the Russian government, the Chinese, whoever it is has the same data. They could figure out who you are. And so the entire thing in in ZK creds is how do you compose all these various things together and take the proofs about your passport or your driver's license or whatever and put them together into a single identity document, single credential, a self-s sovereign thing and add IDs into it. So these are all sort of techniques that work together to build up this notion of stateful identity, right? So ZK creds is the

initial static state where you build it up the thing when you issue it and it doesn't mutate. And then when we went to ZK promises we can have it mutate with reputation based on what you did. And we look at ZK kills we can have it mutate based on how you're using the credential so that we can track you could track rather whether it's moved from one place to another on how and give indications of how likely this been stolen or shared and therefore do you need to reauthenticate uh with a UB key or something with a password. Do you need to redo some of your identity documents cuz maybe it's not used enough that now we need you to use your new your passport again? Right? So like maybe you made a thousand posts, right? Nobody else knows this but you do. You made a

thousand post and like oh okay you should probably check you still have that passport and you didn't just buy it off someone when you were on vacation >> and don't have it. And so that's the way these things all fit together. And ZKTLS fits into that too. Um though to be fair to the ZKTLS guys, I think they actually knew that when they were working on it. They're like, "Yeah, this is a way to get identity off of legacy things onto a chain uh or some other system." >> For sure. Cool. So, we've just covered like the work that's out there, published, but last time we had you on, you hinted at future work. I'm assuming you're thinking about lots of things still today. So, what are you working on? What kind is it like still in that sort of map of all of these

authentications and and ZK powered identity stuff or are you exploring other topics? >> Yeah. So there is definitely more work on the on the ZK bits and on and these sort of stateful architectures for statekeeping and and identity and reputation. >> One of them ano as you mentioned is this question of how do you safely dduplicate all this ZK social uh ZK supporting documentation proofs about who you are. >> Mhm. Hopefully we'll have some results there. One of them which hopefully we should actually put up the paper in about a month is taking ZK cookies and ZK promises and quite doing what happens if the state in my local save file is secret even to me like if the reputation

score is hidden nobody can see it. >> So this involves techniques for multi-party computation. This is a thing we are calling private compute tokens and hopefully that should be up on e-rint soon. >> Cool. >> What does that unlock? Uh, so what if you wanted to have are you a spammer scores, right? So the problem with spam systems is that you don't want to reveal to the spammer that they got detected because then they adapt their techniques, >> but you do want to be able to have this. So you could have anonymous version of that. You could have anonymous version of are you a pig butchering scammer, right? Where like you get to see that like your reputation is good or bad, but you don't get the little minutia of how the algorithm is is scoring you.

>> This gets a bit tricky technically. And also back to this who writes the rules question. Uh >> you can write things here that are interesting and totally above board. You can also have things that like maybe we shouldn't deploy. So it's a generalized technique for for sort of anonymous two-party computation. So that's one thing. The other one is these dup duplications. More broadly, we're starting to look at the intersection of these things in AI. How do you start detecting bots? How do you start doing I've done some work on watermarking actually like the first uh main paper on it watermark for large language models at ICML. And we're looking at now how do how do some of these techniques interact together. So that's another direction of how do you deal with bots and AI on the internet. And then Paul Grubs and I have

some work on looking at his follow-up to some work I did on smart block and anonymous banning uh with folding that was a called alpaca uh and how those kind of things could be applied to make better versions of uh zk promises. >> So that that's a paper that I have no idea when it's up because we haven't finished it yet. So I think that's Oh, and then like there's again still the this interest of of of how do you do moneyaundering prevention and state keeping and such for like private stable coins and such in a way that isn't just give everyone a view key. So that's a that's a long-term ongoing piece of research. And for those of you who haven't read it, there is this paper Peter van Balkenberg and I wrote Peter is a coin center has some long title that starts with tear down

this wall something something. You can guess that that was Peter's title. He's far better at at these kind of things, but looks at this whole notion of what is identity composed identity and reputation scoring look like for moneyaundering prevention with the aim of don't standardize and build a system where you just give view keys to elliptic or ch analysis or TRM. >> Yeah. >> Um and this is actually one of these things where living in DC and working at the University of Maryland which is inside the DC beltway you know I actually Yes. I just realized that. Okay. Crazy. You're right in the center of things. I literally work approximately halfway between Treasury and the National Security Agency if you plot the line on distance.

>> And that means you have the people who have to deal with the North Koreans and the hack hacking operations and you have the people who have regulations about this. And so like how do these techniques intersect with those level of policies is an active thing that Peter and Coin Center and I are working on me on on the technical sense of it. Oh, and then the SEC is is over that way. And there was that whole SEC roundt while Hester was talking about Matt and I's work. Pastor Pierce is the SEC commissioner. Um, >> yeah, Ian, thank you so much for coming back on the show. >> Thank you for having me again. Look forward to doing it another time. >> Yeah, always great to talk about all this this stack that's being built and I'm curious to see what listeners of this podcast will come up with or if

we're going to see experiments with these things at the next ZK hack, for example. >> Yeah, I definitely want to try that like weird like small group anonymity. I really wonder what would happen, especially if you like trust everybody. Yeah, if if anyone wants to play with this, right, you really can. Frankly, you can rewrite pretty good toy version of it in in Cir or or ZKVM if you wanted to. These are not hard things once you have the concepts and you have the recipe to build it. That's really what's in the paper. >> So, run with and if you want to come talk to me and and you have some info that's not I'm a rander on the internet.

I I really want to see this done. All right. As long as I get, you know, some credit for the ideas, like I it's great. If only the ZK cred if only people could anonymously already prove something about themselves. >> Maybe they can. >> Yeah. How do you prove you're not just a rando on the internet would actually be a really interesting question because the t's there but what's the proof? What is it you wanted inputs? >> True. All right. So I want to say thank you to the podcast team, Rachel, Henrik, Tanya, and Hector. And to our listeners, thanks for listening.