The Future of Zero-Knowledge Applications and Noir as the Rust of ZK

Transcript

All right, Georgios, uh, great to have you. Um, here to ask you a couple questions about Noir. So, first, uh, I wanted to ask you, um, what is the coolest, uh, programmable cryptography application you've seen recently, uh, using Noir or otherwise? Yeah. For me, the most exciting use cases, well, zoom zooming out, um, crypto is great because it allows transfer of value on the web like the internet allowed for transfer of information, but crypto becomes so much more useful if you can do two things. A private transfer of value. There's no world where you can do global scale crypto without privacy involved in it and attestations. Secondly, attestations

to either real world information um for example credentials. Say you have a passport, an identity card and you want to use that to do on identity. Um and two um web proofs like things where I can show to you that I'm logged into my JP Morgan account and I have at least this much uh value logged in. So to me I think privacy is of course like something that's like very well discussed but to me the most exciting use cases come around the real world at the stations. So one very clear use case and application that I care about a lot is the ZK passport um angle uh because it lets me solve two things. I can do a account recovery if I've lost access to

my wallet or to any other kind of credential. Two I can implement civil resistance systems with it. For example, I can say that only a user that has scanned a password can access this app and I can use this to geoblock users or I can use this to target them. Um, and the third thing I can do with such technologies, I can do selective information disclosure about private information which means that I can show to you that I'm say above 21 um without giving you uh full access to my information. So all of these things that take real world information, let you make cryptographic at the stations to them are really interesting. Uh and to me I think the Zika passport or the Zika identity uh use case is just so crisp uh and like obvious uh to people.

So this all seems like it fits into maybe uh Paradigm's broader thesis. Um so maybe it'd be helpful to understand how you see Noir's progress um rel relative to that um and where uh maybe crypto infra and apps are heading with with Noir especially tying into that. Totally. So what is Noir, right? So noir is a programming language that to me is the Rust of ZK and it empowers developers similar to how Rust empowers developers to write efficient and secure um systems code. I think that Noir empowers normal developers to write efficient and secure um ZK code. Um,

five years ago I was writing cryptographic circuits using the arcworks uh set of libraries. I think we've gone so so far from that and these days we can write pretty powerful software. For example, the ZK passport work that I mentioned earlier it's like only few lines of noir uh these days whereas if you wanted to do that a long time ago um that would have been probably many people a lot of time also be pretty slow. So the most important thing to me about Noir is the developer experience and the developer experience comes downstream of a lot of the work that we've done at Paradigm. For example, the Foundry project. If you look Noir has a similar software updator, the Noir up or the BB up um

software which you use to manage the version of Noir. And I think that's just so important being able to like oneclick install the library. Um and then the second thing is of course the CLI and the tooling that goes around you writing a new smart contract a program or whatever you want to call it. So when you get these two things right then comes into the experience of okay how do you further integrated and I think that what's going to be really exciting for noir apps is the co-design of a noir and a solidity or like an EVM an SVM or other kind of repository. So imagine that you have a monor repo where you write some of your circuits but then you also have like some onchain verification

code that you want to run whenever some proof is generated against the circuits. I think that getting that developer experience done really well and having great feedback loop on iterating. I think that's going to be important and then going a step further than that I think that that's going to be the local flow. I think there's going to be a lot of work that people should do to figure out how to productionize these apps which means okay I have my noir program running how can I deploy it on a chain um is it like on Ethereum is it on Aztec uh natively how do I get a if I'm not deploy if I'm not deploying it on Aztec um test net or mainet natively how um do I set up provers for it is there room for a versell like service uh which does proof generation for others uh is there

a lambda API uh that you can do a serverless like API which like makes proof generation really easy. Um so I think there's like a big infrastructure blue ocean around proofs. Uh and some people are doing proof marketplaces, others I think we're going to do centralized things. I think you know jury is out on what wins there. And finally um I think the most potent uh area for integration of noir programs I think will be wallets personally um whether it is again for account recovery, privacy, credentials, all of that. So I think they've just touched a blue ocean of things that people haven't been doing for such a long time because the access to ZK was hard and Noir democratizes or empowers like the

average dev to do all of these uh in a way that I think is just um new and that's super exciting. So you mentioned a few things uh identity verification, selective disclosure, this broader blue ocean of infrastructure. What would you build today with noir? What do you think is the most needed and maybe uh missing in the ecosystem that Noir uh and this fast client side proving that wasn't uh there 5 years ago um uh needs? I would turbo productionize methods for account recovery. Um I think that the most important thing that loses users today is that there is no equivalent of forgot your password button in wallets. Um I've been thinking a lot about wallets

lately. We've been building a wallet library called Porto and we want to integrate things like um recovery of accounts assisted by ZK proofs because it's so important to be able to give the user a forgot your password equivalent. And the way to think about it is that many people are moving to pass key wallets which means that you can use your iPhone's biometric uh information and the iCloud uh sync uh feature to have access to your account across all devices. If you lose your device, you can recover access via the cloud. But many times people lose access to their cloud accounts. Maybe they want to log in to devices that they don't have access to your cloud account. Like the list goes on. So you really need a super crisp way to add your account uh to add

a new account to add a new signer to your existing account using some backup method. I think the backup framing is like cute but it's not like um like it's it's not like expressed to the user in a way that's like safe and nice and cozy. So I think the framing around credential manager credential like the the identity framing I think is really important. So what I would do on Noir is like figure out the best way to integrate identity into wallets um and either integrate it as a service into a bunch of wallets or build my own wallet around that.

The second part is like private payments, but I think there's like many ways to go about that. There's a lot of nuance. It's like really hard to get private payments right. Maybe you need like a full-on Aztec like system to make it work versus I think for the identity part is like pretty tangible for people that aren't, you know, privacy gurus to make it work. Yeah, the identity part I really think ZK Passport and what they're building with Obsidian uh their wallet on Aztec is like kind of the first incarnation of that. Maybe building off of of that um since Noir maybe uh makes makes writing circuits uh simple even elegant what would you say is the next major hurdle for deploying impactful zcaps at scale for developers who are listening today is it like

proving times da tooling what do you think is the main like like thing that these teams need to figure out yeah I think the first thing that you need to figure out always well all of these things that you did that you just said firstly are important so the three things that you said is a production deployment for reliability, two performance where it might be hosted or client side, three developer developer experience, security, all of that. So what we learned from building Foundry was that when you give people fast local testing, people start doing all sort of crazy things that they weren't able to do before. So to me, being able to have the Foundry of Noir type experience where you can fuzz your circuits and be

able to even differentially test your circuits against native um native generations. So let's say I have like a Python version of my code and a Noir version of my code and I want to differentially test it to check that they always give the same thing because let's say I have like a good RSA library in Python, but I don't have like a great one. I know Zach has written a great one in in Noir, but let's say let's use that as an example. I think that's super important. So being able to fuzz and compare different implementations because compiler circuit compiler bugs are really nasty and I think it's really important to be able to like convince yourself that the thing that you wrote is secure. So a the first thing I would get really right is security and

developer iteration speed, which means that the noir compiler must be fast. The testing process must be extremely fast. The testing process must be extremely deep. The testing process must have debugging, fuzzing, tracing, the ability to see everything that's happening in a noir program really deeply. Um once you have that, that means that you've nailed the local development flow, which means that you can go deploy. And when it comes to deployment, um you need to think about two things. Am I proving ultimately client side or server side? And I think that depends on the use case. So most of the when do you do client side proving you do it when you want to pre preserve the user's privacy right because if you do server side proving uh it's very likely that you're going to leak a bunch of your

information the server I know there's work to maybe make it such that there's like a little bit of local work that you do and maybe you outsource the rest of the proving the server I also think that might be a business on its own so some kind of business where you generate the big meaty part of the proof server side but like client side there's like a light part that's done. Again, that's very similar to how the AEXZK um approach works where you do a private transaction locally, you client side prove it, and then the roll up aggregator uh collects everything together and that's a more expensive operation. Um for client side proving for the wallet use case, I actually don't think that it needs to be super fast. Um Remco Blurman from Worldcoin one time told me like of this very clear

UX pattern where you want your UX to be instant or loading bar or spinner. Um, and there's like different ways to think about that. And I think for account recovery, the loading bar UX where you know, you leave your phone aside, you scan your passport, and you leave your side your phone on the side. You go prepare an orange juice and then you come back and it's done. I think that's great. I think that's totally fine. Um, because what the recovery is going to do, it's going to add a new pass key to your wallet, for example. Um but if the other way to think about it is let's say you're in a coffee shop um and you want to make a payment um and you have a person behind you waiting um you surely cannot be waiting for the loading bar to

complete right so that's like when I think of myself in the place of the user um the user is kind of like in stress they have other people behind them they cannot really wait um they're not going to use your app again if if like it's going to be slow because the person behind them gave them a traumatic experience so what you want there is you want to either be spinner or instant UX and that's where the client side proving performance really matters. Uh what so what does that mean? It means that if you're doing some kind of like payments use case and you cannot delegate um the expensive part to a server then client side proving performance is going to be super super super important. Now what I know is that some people are experimenting with maybe I can do a TE um like a serverside trusted execution

environment that I can privately post them my public data. The server never the server kind of learns about the data but it's not ever exposed to anyone observing the server and the server generates a zk proof about that data and forgets then whatever data I send it. I think that is a very very solid solution. And I think Cello uh Cello's self project might be doing something similar to that. Um so I think these are all very credible ways to go about it. And then when you think about the server side deployments, I think that the biggest use case for serverside deployments of ZK are generally verifiable applications some work that was doing recently or ZK rollups. Um I think that's like also a blue ocean of

things that we just don't know where it will go. You know people were very excited about machine learning uh in ZK obviously you know that has like three four orders of magnitude overhead but who knows like maybe in a few years maybe the overhead is going to be uh almost zero because some kind of like super pipeline thing works and you don't feel the zk overhead. So I think there's like many things to get right. Um but the first thing I would get really right is like the the security and the developer experience. And then two be really clear about the use case. I'm targeting because that informs a lot about uh you know do I need to be fast client side maybe I don't need to be fast client side if I need to be fast client side where are my bottlenecks where do I optimize and so on so I think

that was going to be really hard uh really important to figure out and again imagine a client side usually means mobile side if you're doing mobile side improvement that means that you need to take account all of the possible devices out there what GPUs do they have access to how much memory they have access to if they don't have access to much memory many uh fry based zk schemes are just fry based um proof systems are just not not that like convenient to use uh and you need to do like smart things to limit memory usage. So there's like a lot of things to get done right when you get into client side proving um so maybe like server side like with a TE might be like a good option for like some people.

So I think it's like just so early um and so many things to explore that whoever figures it out and like just runs with it uh I think that could be really exciting for them. Yeah, this so all of these ways of thinking about these technical bottlenecks and that this tie into UX I'm especially interested in. So I'm curious. So what do you think is like the critical realization for these teams that are building in Noir hack now for their project to really get adoption. So it seems like a lot of the technical bottlenecks that you mentioned ultimately tie back to UX. Um that's like a core principle. But if there's any core principles around adoption uh for these teams that are in these blue oceans or really trying to get uh actual

users. Yeah. Well, I I'll maybe push back on it. So, let's use the TLS analogy, right? So, TLS was not adopted early on because it was too slow. And even in my university, like when I was studying, which was not too long ago, they our book it was saying that it was like written like maybe in the early 2000. was saying that you shouldn't use TLS to secure your connection because it's going to be too slow and your experience is going to be bad and then TLS uh where I said like got like fast enough um and people just defaulted to using that right and also of course like certificates became easier to give around uh and people started adopting it so I think there's like two things to get right a it is like really the performance like if if the thing that you're building is slow um that's just

not going to get adopted u and two it is make the thing that you're building really easy to integrate. Um so if it takes a lot of like code to integrate more than few lines like stripes like model with like seven lines to like get a payment right. Um many people are saying oh one line import to like get drop in replacement to get like blah blah blah blah. So if you don't make it really easy to integrate and make it obviously better than before which means that the user gets access to something new that they really really need. you know, if it's like nice to have the user kind of they just won't care, right?

Because ZK to me like as a technical person means slower and more expensive u just because there's like more things going on. Verifiability does not come for free and privacy does not come for free. So a the value prop needs to be extra clear and you as an appdev or a noir dev must make as much work as possible to hide all that work pipeline that work made it happen in the background showcase like fun things to the user the user clicks something immediately you dispatch the zk proof generation and the user still needs to do other things such that while they're doing the other things there's like a background proof being computed so it's so important to get the integration Right? And if you cannot make it fast

enough, make the user busy with other things while the proof is being generated because no user wants to wait unless they're in this like account recovery thing where I said earlier where the user, you know, the user is trying to get back in their account and that is likely faster than them calling support or them you know um doing forgot your password over like a multiffactor authentication flow. I really like the analogy of TLS um and especially with TLS progressing and becoming faster. If ZK approving became 10 times, let's say 100 times faster, what new possibilities open up for you that excite you and what would you build or see people building then? Yeah, I'm not sure that a 100 times faster is

enough um right uh to you know make it like available to everyone. uh because you I I think realistically you know you the world where like ZK just becomes like invisible Justin Drake had talked about this a long time was like let's say you have a chip uh it's like that's like say 100 nanometer chip and like one nanometer of that chip is like the native compute and then 99 nanometers of it is like the ZK part of it and anytime you do a step in the one nanometer processor that triggers the ZK proof in the 100x like die overhead of of it. Uh, and that way maybe you can get to something that looks like a real time proof that gets calculated in a per CPU

step which like a true like actually verifiable like real-time verifiable app. I think that's going to be super exciting. I think that's like super far away. I think if we go like two orders of magnitude away like I think basically private payments and ZK identity stuff become like just default which I think is super exciting. I don't think we get you know um private machine learning verifiable machine learning like you know at scale like you know to be trivial cost that might require the thing I said earlier but the very least with like two orders of magnitude I do think you know that we get like you know few like sub millisecond private payment sub millisecond at the station to any credential I'm sure everyone on the noir hack hackathon saw Google adding uh the

private the uh proofs from ECDSA paperwork uh in the Google wallet I that stuff is just going to get everywhere. Apple is going to integrate it like Google is going to integrate. It's going to be in every device. Um so yeah, I think it means like ubiquitous access to ZK for applications and identity or at the stations which I think is super exciting. Um I know that people talk a lot also about like at the stations to like TLS connections. I think these are like a bit trickier to get right because um they involve usually I think fundamentally they invol they involve a trusted third party which is either a proxy or an NPC network or some kind of like weird mechanism or a TE or something and I think these are kind of like you know the ZK stuff that we're

talking about does not involve a trusted third party whether it is one many decentralized centralized whatever you want to call it so I'm not talking about these specifically because I think the threat model in these it it kind of deolves evolves into a non-luding uh party assumption which if you can do that you might as well I think do like a te based approach. Um and I have one one uh last question for you. Um I think you're you're well known for going into some very interesting like technical or conceptual rabbit holes. Um I'm curious um what you're exploring now and how uh noir might potentially play a role there in any other places that you have explored more recently or just in general. Yeah,

so to me the the hardest so when I'm thinking about how do I add ZK to a JavaScript app? Uh I think the thing that nobody has looked into is like how do I make the bundle size really small? So you know when you're building a web app like the web app loads and it needs to like call a bunch of JavaScript. if like I'm loading a big wom blob uh to make that work or or whatever, right? So I might be saying something wrong on a deep level here. Um if you're loading a bunch of data and that takes a while and makes the page load slower, again, nobody's going to use it. So there's like some nuances around how do you really architect that really smartly to either either like there's some like noir engineering magic that you can do to you know pull the the Wasmo files or

like whatever else like in in pipeline ways such the user doesn't feel it or there's like some real ways to make that really small. Uh I think that's like one super interesting rabbit hole from the user side. Um and then you know there's all sorts of like cryptography things that you that you might want to do like you know better recursion mechanisms like much more flexible ways you know to let's say there's like um like a a low power device um to there's a low power device where they have like lower memory or lower GPU. Can I do like some kind of like web GPU deployment that is like very flexible and can detect what device it's on um and accelerate accordingly? Um browser support. I think there all of the

hardest problems are kind of like closer to the user and and basically I have like full trust in our cryptography expertise on the lower level stuff, right? So I'm kind of like past the stage where I worry about getting the cryptography stuff right. Maybe there are some errors along the path, but I think like people are going to figure that out. The things that really concern me right now and are really interesting rabbit holes is like the packaging like how do you make that like really really simple to the user. Um rabbit holes that I find very exciting postquantum cryptography always um depending on who you ask I think that's like super interesting. um accelerating of like non-native field arithmetic I think is

like extremely extremely extremely um uh important. I know like Zach has done a bunch of work on that. I know people have like opinions on how that should work. I don't know enough about that topic anymore. Um hardware acceleration of ZK proofs is like one of the most exciting things uh for me whether it is with specialized hardware or making work on existing things. Um yeah I think these are just some of the thing. Oh, and finally of course like the security component where um you know until we have like a good way to know that like is this program constrained appropriately or not. I I I think like that is like probably like one thing that like really needs to go well, right? Because I've done like security of circuits like many years ago

again on Arcworks and wasn't beautiful. It required like a lot of like you know getting deep into the nitty-gritty things and you know a compiler bug in Viper a few years ago could have costed like millions of dollars. The worst thing is like in ZK if you're doing private payments especially there might be bugs around infinite mints that you cannot detect and so on. So these are like you know that these are the real problems that I have no conceptual understanding of how to approach. Yeah this is a good uh good portrait of some of these uh these areas. Um I think like what I what you had said about blue oceans maybe one last question also want to be uh understanding your time. Um but

uh yeah do you have um some time still or should I say that again? Uh are you okay on time? Yeah. Okay. Cool. Um I guess I would love for you to expand a bit more into some of the blue oceans that you had mentioned. If there's maybe some hierarchy uh or some areas that like if you uh were to start today in the space just literally building uh which one you would preference and prioritize. Yeah. Well, again I think that crypto first and foremost like does transfer of value. Um I think like one very exciting thing is like a like figuring out like a a wallet where its entire policy engine is like a snark. Um and the rules are

completely verifiable by a program hash. I think that's just so interesting as a blue ocean. Um I think anything again private I I I don't know like I'm a simple man. If I can like get like my identity in a way that I can like make claims about it and I can bring other real world like credentials on the system and then I can also make payments or call smart contracts. I think that's just such an exciting bundle. Um and you know people might want to nerd snipe you with like things that are like super far out but like this this stuff like has so much meat like to explore. um that yeah I think that honestly my honest take is that like people should just focus on

these things get them really right um because crypto needs this to get the next level right if you go to I don't know if you're a do user if you go to do or like in the do app and if you go to Dune Dune has a do dashboard and I can go and like type giorgios in it and I can see all of my transfers that means anyone can do it uh there's no world where crypto grows we can do global scale crypto without that so I think that's, you know, people should really focus on getting that part right. Um, and we can talk about, you know, uh, super crazy, you know, ziki things like down the line. Um, obviously, you know, there's institutional levels that you can do, uh, institutional level things that you can do with dark pools. Um, you can do like fun games. So last year uh

in our conference frontiers we did a very cool demo with the cursive team where uh we we did kind of like a privacy preserving uh not a dating app but like a recruitment system where let's say I'm a recruiter and you're a person that is looking for a job uh but you don't want your employer to know that you're looking for a job you would configure in your profile locally your settings um and I locally would have like my settings configured on ambul looking for people with such and such profile. We would meet, we would tap our badges to each other's phones and we would do private set intersection uh on these and figure out hey is there a match between these and then you the candidate could say oh I opt in to

revealing to the recruiter that I want to be recruited which is a good way of thinking of how ZK facilitates safety um beyond just financial safety you know um I think that applies to like any kind of like information that you want to share with someone where you might be too embarrassed to share or you might feel unsafe about sharing. So you can imagine all sorts of like social games that you can create around that um or you know literally coordination techniques that are you can hide information about like really important things like public places and only the people that you have opted in can find that information. So that's that's all sorts of like interesting things that you can do with that.

There's a cool uh app that was built in the hackathon that is a dating app with NPC where you can uh share like certain private things that you like with others kind of in the same way. Um maybe one uh last question actually maybe actually last question. Um but uh I was curious since you mentioned like um uh this kind of potential areas that people don't focus on enough. Uh maybe there's areas that people focus on too much uh and get trapped in like I think YC has this term tarpit ideas. Maybe are there any like tarpit ideas or areas that you see a lot of people focus too heavily on in ZK or with noir? um and what those might be

and how teams can avoid being stuck in that. Maybe they're too technical complex or so you heard me only talk about apps, right? Um I wish that people focus on apps and I I'm glad we went through the rollup phase. Uh I I feel like the rollup tech is like really mature personally. Um so I don't want like I think we should polish the existing stuff a lot but I think we have figured out like the right abstractions and all the ways to approach it whereas I feel that you know like spending time on the marginal rollup improvement like on a new stack or something I I I would be sad like to to work on it

personally. Um I think that the Aztec like stack is like you know killer because it's like built from the ground up for that. But, you know, if you were to do like another like standard validity rollup, um I don't think that's like uh as interesting. I think it could be interesting if you were to pair it with like let's say um a perplex uh where liquidations are verifiable or you can have like some kind of like very extreme rules about it. So, let's say you did a prepex where liquidations are private and verifiable or people's balances are not private. Some things around that I think they're like pretty interesting.

Um yeah, so like that's another app that I would invite people to build actually some kind of like DEX that has uh that allows liquidations in a privacy preserving way. I don't know how tractable that is. But yeah, if you're just building a validity rollup uh on Noir or on anything else like without any like real privacy innovation uh beyond the stuff that we've talked about, I think I wish people spend more time on other areas. So I guess the principle there like with the perex is that it it solves like an actual problem through like Yeah. Yeah.

Yeah. Exactly. Yeah. But again, like somebody's working on that, don't let me deter you. I'd still, you know, I I'd still talk to that person. Cool. Well, awesome. Thank you, George. I'll uh stop the recording here.