Intro to SNARKs 1: What are SNARKs?

Transcript

so can now try to share screen now where's the share screen button I appear to have lost the share screen button okay let let me leave and rejoin

oh yeah screen okay me hopefully you can also see my y see in here perfect okay so I think we should be good to go now it's N9 pass we've given some more Str time to come in let's just go to the course and open this up give it a moment to

load there's also apologies for all the technical errors this thought it was going to be more straightforward but uh apparently not okay so this is the snark fundamentals course we did give a very brief intro on Monday if you were there kind of unexpectedly but just a recap um so this course is it's sort of designed to try and hit this sweep spot intermediate spot to help people with no background or tool in zero knowledge to uh D and to by the end of they should be able to engage in conversations about ZK snarks and have a basic understanding of

how they worked so that's going to be ideal for people who are looking to become developers because after this course you'll have a good idea of what's actually going on and you can go onto more advanced courses or entrepreneurs or anybody who wants to work at all related to the ZK space so you have a basic understanding about how to discuss the topic about where these this tool can be used and what its limitations are um so this is a four-part course and now and half each each session um yeah I think those are the the main things we want to share there is going to be some Associated homework but it's not checked it's it's designed to just support your learning as much as possible and I'll touch on that at the end um and a bit of a background as well so I I've been doing zero knowledge

rated topics for the past several years I have a mathematical background and I went and I did I did research and then development and snarks and I did a lot of education related um stuffff and so yeah this is something we're quite interested to see I wrote all the content with K Chong it was been a very nice process and now we're looking forward to sharing this content in more of an interactive format online and seeing how well it translates um I don't know if Keon wants to say something about himself as well but he works at the PSC and has been um kind of the main person who made this course possible um I believe K Jong spoke on Monday and uh doesn't need to speak

today so I think we're just going to get going also thank you to the um there no need to speak from thank you to the uh Kenyan Community for organizing this and and joining you guys had a lot of energy and we're looking forward to to sharing this with you so we did the introduction just to reiterate in a bit more detail what to expect like I said um we we want you to know why snarks are valuable ultimately any discussion about the use of Z snarks relates to why they're valuable and what problems it solves um we're also going to give a bit

of detail as to like how it provides those those valuable traits and whether all the valuable traits that the technology provides are always necessary are always used um which is kind of a funny topic actually and then also we're going to the style we're doing is aside from this General learning we're going to take a single proof system called plunk and we're kind of looking when we talk about how it works we're actually talking about how plunk itself works plunks the purpose of this is It's kind of more effective teaching method that rather than like see everything in the space because blockchain sorry um zero snarks they're designed in very

different way and it's very hard to try and look at them all at once and it works a lot better if you just take one system and kind of understand it much better from bottom to top and then Translating that knowledge to understand other snarks gets a lot easier and plon we've chosen specifically because it's just a bit more intuitive in how to think about it some of the other ones are yeah aspects of them just aren't particularly intuitive and people complain about them nonstop in terms of what the different SE what cover in the different sessions this first one is what does this technology do and actually the the core bit of learning about what snark does is going to happen in the first half of this session and that knowledge that we're going to cover is I think the kind

of Base knowledge that anybody who's going to do anything with this technology should know everything past there is getting more details into the inner workings a little bit and also seeing a few other types of snarks or snark systems in the second session so that on Monday we're going to look at some of the mathematical objects we use in these in these systems in the third session of week today on Thursday we are going to look at how we combine the mathematical tools from the second session to make Contraptions and then in the fourth session uh Monday after next we're going to see how those Contraptions from session three are put together in plon and then have a brief look at a few

other proof systems out there so that's the Over All um outline and yeah make sure to stop me along the way if you have any questions I can see the chat I've got on my screen so um you don't have to put your hand up you can just um drop them in there so section one Let's uh get going the the purpose here of really this first section but in particular the first half is we're going to try and understand this image because this image represents all the basic things we'll want to know about snarks um so right now you can see several steps we go from the value idea to an idealized circuit to a circuit to

a witness to a proof to checking the proof um and by the end of the first half this picture is going to make a lot of sense to you um and there kind of distinctions for different parts okay so our learning aim is to be able to understand this picture and such that you can even draw it yourself in memory because it just the flow makes sense to you we're going to start off with the idea of mathematical guarantees so math is is is built sort of on on the shoulders of giants when we prove something in math it's we can then use it in future 100% um and we started this system with a few rules that we called axioms these

axioms were never proved or anything we just said if we assume these rules to be true what will happen so in math we have a few axioms that we assume to be true and then we can Define some objects and then we can just play around with the objects and see patterns of behaviors that will turn into theorems um so I'm going to explain the relevance of that but I'm going give an example a particularly interesting example to start with and there's this book called yukids elements I don't know if any of you have heard of this book before but it was um okay someone's asking if we've lost audio I don't know if that's just oang or um anybody else as

well okay okay so I'm gonna assume that's on on the other person's end just for one person so I'm going to continue so uclid elements is actually a particular fascinating book in like I know the history of all science and stuff so it was written around 2,300 Years Ago by somebody called uid there's a bit of discussion to whether it was he wrote it all himself or whether he combined um the learnings of the time but it the it's lots of people say it is the kind of foundation of modern mathematics and science itself and that's because it follows this system I just spoke about before it lists a few

axioms to start with just simple rules and then it makes some definitions and then it just plays around with them and sees patterns of behavior and defines theorems and this is the kind of scientific process right you you build on the work of prev um previous scientists and bit by bit you grow this huge Corpus and database and I put this uh chat gbt screenshot in there primarily just to show you that um I didn't tell CH gbt what to tell uh to tell me it just mentioned this book's Name by itself um so up until the like 1800s it's kind of interesting if you were a learned person if you had learned anything in mathematics or philosophy or things like that you had almost

definitely read this book because this book would so perfectly dis displayed that the process of defining some rules and then growing everything in a very logical and consistent way so we're going to look at a single example from there so this book is actually it's not mathematics in general it was geometry only and it had seven axioms um one example of those is that things that are equal to the same are also equal to each other so there several words there but it's actually fairly straightforward if you have um one like if a equals c and b equals c then a equals B like if you have two

things and they're the um two equalities you can transfer the property property over so if if I'm you know 70 kilg and somebody else is 70 kgs and our weight are the same as a third person then the first two people's weights are the same um you know like it's it's almost so simple that it's hard to describe like if two if you have two equalities then the equality transfers and then from this we can derive a proposition proposition one in the book so on a given finite straight line if you have a straight line that's not infinite it's just finite it's possible to construct an equilateral triangle and you can can see in this

image on the right is a a visual proof of this if AB the line between the points A and B is the line you start with you can draw a circle around a and a circle around B and those circles have the same radius as the the length ab and then you see that point C is dotted in because it's on the intersection of the two curves um but because these are radius to the edge of a circle the line AC is the same length as the line BC um and we also know that AB is the same length so then we can use this axium and show that all three of these lines are the same length and that we

have an equilateral triangle so I know for lots of people geometry is kind of like School maths things people didn't like as much but we don't need to know this rule I'm just trying to demonstrate the principle we start off with a basic rule we then Define some things like we had to define a line and a triangle Le and a circle but once we have them we can play around with them and demonstrate this property that if you have a straight line you can always get an equilateral triangle now once we have that we can just use that again and again in the future as we please and this is very simple but what we're going to do is we going build from simple things build up a more complex thing but the complex thing we can just use instantly without have to think about it

again so the main reason I wanted to to emphasize this is that we've been doing mathematics for you know thousands of years and we've built up a huge database of things we know about and they're kind of quite complex mathematics a lot of the stuff used in snars um okay we have another person who can't hear anything but unless more people say I'm just going to continue a lot of the maths used in snarks is is quite complex um you know group Theory which is something we have um which is a big part of snarks wasn't discovered until like the 1800s you know it took two over 2,000 years to even discover these objects um and they're we're going to be

using them in snars so some of the underlying stuff isn't directly straightforward and it's going to take some time because we are really we had thousands of years of mathematicians and scientists figuring out all this stuff and then we're kind of making use of it quickly but we're supposed to learn it all in a few months what took you know centuries to figure out so uh don't expect to do it too quickly and you've got to keep with it in order to make progress but also the the the the more understanding you have with the underlying ideas the easier the more complex stuff is so we can get going with proof systems and firstly I just want to talk about uh the naming we use um so you know I say snars a lot but we always

write z snarks in in in the um presentation and and the book so it it's just easier to say snarks than z k snarks um you know a a snark it technically would be either zero knowledge or not zero knowledge but we just use it as a as a shorthand um and are proof systems and snarks the same thing they're not a a snark is an example of a proof system so there are other types of proof systems but to be honest if they're not snarks we're not particularly interested in them because their properties aren't particularly valuable but I'm going to use proof system and snarks essentially as the same um in this course so so be aware of that you're probably aware that the proof systems create a proof and what

does the proof actually tell us what the proof tells us is a kind of very clear thing it says with 99.9999% you know going onwards likelihood statement X is true and what different proofs have are like different statements so here's some straightforward ones Alice is over 18 years old we can get a proof that with 99.99999% likelihood is true um Alice is over 18 years old or ell if knows a secret key or David is eligible to vote right we have very clear statements and what the proof says is actually that

this statement is true okay so anytime you get a proof what it says saying is some statement is true and we're going to look and see how we Define those statements um also to note a distinction um in math when we prove things we prove 100% with that equilateral triangle thing I said before it's 100% once you have a straight line 100% you can always get a an equilateral triangle from it in anything that's not prop like deep mathematics you don't prove absolutely so I mean gravity is it's technically just a

theory there's so much evidence that it's you know true correct Etc that we don't give any um thought that the idea that it's not actually right okay the the proofs the statement on the previous page it didn't say with 100% likelihood right it said with 99.999 and so on um so it's not a mathematical proof it's actually a probabilistic proof it's statistical it's just saying the chance that this proof could have been faked is so small um that we can essentially treat it as as true and how small is that error term we decide when we make the proof we pick some parameters and we

have you know um we have standards in cryptography where we expect the error error to to be so small that it will essentially never happen generally speaking when people look at investigate this it would take the world's best supercomputers Millions if not billion billions of years of processing to try and find um a a fake proof so we can really just trust these to be 100% one of the best ways to cement your understanding of snarks is through something called um verifiable computation it's a much better

perspective on what we're actually doing um so of course verifiable computation is kind of says um but can we check that a computation was done correctly so if I add a bunch of numbers together and I giv you the sum how do you check that I did the computation correctly we know we can always naively check you can just add together all the numbers again and see if you get the same answer as me so that's not particularly interesting but what an interesting question is is there a way for you to check what I've done without repeating all the

work because then that would be particularly interesting and an example of this in the real world a very helpful analogy is either a Rubik's Cube or a Sudoku if you give me a Rubik's Cube and I solve it and I give it back to you um you can check that I did my computation correctly because you can see that the cube is done correctly you know you didn't have to redo the Rubik's Cube in order to check whether I done it correctly di with the Sudoku you H me a sud Sudoku and I I fill in all the things and I hand it back to you and you check that it was done correctly you know I did my my part correctly but you don't have to redo the work okay so one thing I want to

emphasize there is this idea of succinctness so in in these two examples um like I said your checking is is very quick you know in the Rubik's Cube example um it's almost instant you just look at it and then like you're just like yeah it's it's right or or not and you know the the what the the world record I think for check check finishing a Rubik's Cube is like 6 seconds or 4 seconds or something so all of you can check that a Rubik's Cube was done correctly faster than the fastest we've ever finished a Rubik's Cube um so that's the idea a part the

idea of su synness so in snark the S stands for succinct um and the fact that you can check the proof way quicker than redoing the computation is half of that property uh the other half is actually that the the proof is much smaller than the computation um so analogies only go so far that in the Rubik's Cube example the size of the proof is kind of not very clear because you know I'm just handing you a Rubik's Cube again and what was the computation to solve the Rubik's Cube well it was like turning the side so how does the proof size compared to the um Rubik's Cube size it's kind of like not a a good easy comparison to really think about but the sudal example

maybe helps a bit there because the computation solving Sudoku is if you've ever done a Sudoku before you just go through all the columns and you go through all the rows and you go through all the boxes checking certain rules to see if you can find a missing number and you just repeat that process again and again and again and again so that process of um that computational work is you know actually a fair amount um but the size of the proof is actually just the nine numbers by nine numbers like 81 numbers in in total is kind of you can hopefully see a little bit that the proof size there is sort of smaller so the sness actually has two aspects that are short short I mean this means like

short or fast um so I mean but I've started off like speaking about different things and it's quite like a large topic we're trying to get um to G grips with so I'm bit by bit going over different parts and trying to add more clarity we're going to do do some drawing for some of parts as well that we're going to get to soon but right now I want to talk about if we're verifying computation what do we actually mean by computation there's a variety of ways in which we could Define it but in snarks we're interested in a very specific type of computation and we're going to do that in in the language of something called circuits so binary circuits you're

you're probably aware the device you're on right now the laptop or phone it's using binary logic it's it's got zeros and ones you know true and false just whizzing around wires and going through Gates um and those gates are and Gates and all Gates not Gates and exclusive or Gates think there's you know four main types and that's like it you know it's quite a straightforward base system zeros and ones going through Gates that do very small operations and yet because of that you can see me on your screen you can hear me your computer does all these other things like even the fact that it controls the screen is kind of strange um but point being like with

this very basic system we can do all this incredible amazing stuff um for binary circuits I've got an example and gate in the presentation and I've got um the four ways in which we can fill out an end gate so the top two arrows represent like the input wires um and the bottom wire is the is the output wire okay so those are the four ways we can use an anate we're actually going to sketch some of these out so I'm not going to dwell on that too much right now so what what do we mean specifically by a binary circuit so in this white image we have five gates put together

with wires connecting them two excl or Gates two end Gates and an or gate um a circuit is just any combination of gates put together a binary circuit we're going to be using binary Gates so you know there's no multiplication or addition here this is just um binary type Gates so we can try and do one quick sketch see if we get this going um so I'm going to be drawing here let me know if it's not clear or the color doesn't particularly work because I don't know what this looks like on on your end or if I should write bigger or smaller binary circuits right so we have like I said

we've got and gate going to have two inputs and an output orgate has two inputs and an output there's the exclusive orgate you don't need to know these Gates I'm just kind of drawing them to show you and we've got the not gate which is actually one input wire and one output y because it just turns a true to false and a false to true so a binary circuit is just whenever we put a bunch of these together right and and inputs inputs and we can draw those outputs going together shouldn't

done into let's say an orgate and then let's just knot it for whatever reason okay so this is a circuit we just put a bunch of gates together um right now we put the gates together but none of the values are decided but maybe in our circuit some of them can be pred decided 0 one we don't need to decide any of these um intermediate wires because once we put in the other values at the top they're going to be decided for US 1

Z 1 Z okay but a binary circuit is just any collection of binary Gates put together and connected wires in in a particular way um and is any is any when we have a gate if we just have a gate by itself let's say an and gate can we put in whatever values we want for all three wires and hopefully you know that's that's not going to be true we can just go to a a sketch again I can just draw draw out the four

and Gates that are actually allowed um I mean I remember when I started with these and I you know um to me it seems clear now that there's only four possible and Gates but when I was learning that wasn't clear so I'll try and make sure these are all all shown there's four possible combinations we can do 0 0 0 1 one 0 and one one and what an andate means is that the output's only true if both of the inputs are true if it's only true if you true and true so if we have false and false well they're not both true so it's zero if we have false and true well they're not both true so we have zero if we have

true and false they're not both true so we have zero and if we have true and true they're both true so we have one okay so when we have an anate we're only are expecting to see one of these four possible combinations but if we ever put in something different we put a one here this particular gate is we'll call it invalid because it doesn't represent what's actually allowed in a binary circuit so that's a gate on its own but if we were to do that here and we put this as a as a

one this whole circuit is invalid invalid circuit yeah if you say you're going to add 2 plus three and you give me four your computation is invalid right so this is going to be particularly important this is actually sort of what we're going to be checking that that um the statement that we're claiming is true that something has been done correctly is very much related to this so binary circuit is just any collection of those Gates together and we're only allowing or we're only going to call it a valid if all the all the gates respect their rule for for their

operations and we we also we call this a truth table and we sketch it out so on the left image you see input one is the X input two is the Y and output is the Zed and those four combinations I just drew out are represented here as well so zero is false one is true um yeah so then we move to ZK circuit so what what's the difference between these two it's just really the the the numbers we use and and the logic so ZK circuits work with different logic to computers it would have actually in any ways been ideal if if we had binary

logic in ZK circuits but it didn't work out that way so we have different logic in our example proof system that I mentioned at the start in plon um which we're going to be assuming the numbers aren't zero and one there're I said positive here but technically it's non- negative because we're going to include zero there just going to be whole numbers whole numbers that are not negative up until some Maximum so 0 1 2 3 four you know all the way up to 10 or to 100 or to whatever we're going to Define it to be and instead of the um binary Gates the and gate or Gates Etc we're going to use addition and multiplication I do one more slide and

we can sketch out what I mean by that so previously with the and gate similar scenario so this example gate here is a multiplication gate and it also has three wires it's got two input wires we generally just call the top left input wire the a in this left image the left wire the top right B the right wire wi and the output wire the the outwire um I don't use that notation here but we will in future sessions um yeah and the values of A and C going through these wires have to be from our set which is you know Z one two three all the way up to whatever we

Define the maximum to be so let's just do a ZK circuits right we're going to take our uh set of numbers and it can be0 1 2 all the way up to U where for example qals 10 okay let just do a small number in in reality we are actually going to have q

be like a huge number um going to equal around 10 to the 70 or 80 um one of those two which if um that's roughly the number of protons in in the universe so it's a very big number um and that's where a lot of our security derives from for the fact that there's so many possible numbers so ZK circuit let's just sketch an example one we might have multiplication an addition and maybe they both go into an addition okay and maybe we'll preset

some of the numbers uh 7 4 1 okay so this is now our ZK circuit the circuit is more about the gates being connected together in a certain way um filling in some of the Y values is important in in some circuits but uh not all and we're going to we're going to come to an example soon that will help demonstrate when you fill in numbers and and why you might do that oops

um similar to the four we can have invalid ZK circuits so in the andate example if you have a zero and a one your output has to be zero it can't be one and oops um same here if we put you know that's a four and a one there if we put six as this output Y for the plus gate you'll just you're not doing addition right it's kind of gibberish you're not talking in a logical way to us if we put a six there this is going to be an invalid ZK circuit right the interesting question where that that has been asked and kind of

answered is is there a way to confirm whether a circuit has been filled out in a valid manner that if I'm given a circuit and I fill in all the Y values can you check that I fill them all out in a valid way so this is a translation from before rather than me solving a Rubik's Cube or finishing a Sudoku which sort of makes sense me filling out the circuit is going to be way more powerful to us even though it sounds a bit abstract and strange in the beginning another way of phrasing that is is there a way to verify the computation that was done that was done by me when I filled in this circuit so

this idea of verifiable computation just as a quick teaser ear earlier on I said that proof say that with 99.999 percentage likelihood statement X is true what the statement actually is is a ZK circuit is that it's filled in in correct way and we're already at a point where we can give you the high level definition of a z SAR so we can put it all together now a ZK snark takes a ZK circuit like the one depicted here in that image the image only has a single gate but it's

still a circuit it's kind of a very boring circuit with only one gate you know usually we're going to be working with very complex circuits but it is still a circuit and it has one of the values pre-filled which um in most cases with the circuits we we will usually have many of the values pre-filled um so AEK SAR takes a circuit it fills in the undecided values um also so this is the prover doing this we talk about the prover the person who fills in the circuit is the prover and the values they fill in the circuit with we call the witness um which is the term you should probably remember because it's one that gets missed a lot but it it it is very very important you fill in the undecided

values and then you make a probabilistic proof from your field in circuit that that's what the prover does and then the verifier takes in the original circuit which in our scenario is this one in the image with a and still still undecided A and C still undecided and the proof and it check whether the proof is valid for the circuit or not the proof says um this circuit was filled incorrectly that's what the proof is claiming okay so we can just go over that in in a Live sketch let's take this

um this circuit we just drew now hang on let me just uh how does this work past so going to get to a new place this is the ZK circuit do blue ZK this is our ZK circuit the pro prover we usually just Shand this is

a big capital P the prover takes this circuit and it fills out with its values uh three 7 4 1 actually Let's do let's uh paste this here so we have the color scheming three now three * 7 is going to be 21 4 + 1 is 5 21 + 5 is 20 six so the witness is those values 3

21 5 25 okay so the Prov taking the original circuit build in their values with something that they we call a witness and we're going to get out a proof and we always shorthand proof is this little Pi symbol the verifier drawing this a little big so it's hard to squeeze it all hopefully the verifier will take in the proof

and the original circuit and they'll check it and they'll either be happy that it's correct or s that it's not correct okay because the proof says this this says or is claiming that the original circuit was filled in correctly okay at the very high level that's what snarks are doing okay so if you have questions here it might

be a good time although it might make sense in two slides we're going to do a um an example that will help explain like give a more clear use case and how that's helpful so the question is witness a random value the witnesses is not a random value in this example it's a random value um but that's because this circuit is kind of meaningless like you know why would you care that I multiplied seven by some number and then added it to five right so in this scenario it's it's random but in two slides when I do a a different example you're going to see

that the value of the witness is actually very important and in fact even in the next slide I'm going to talk about that but it's it's a good question um this is also going to explain um okay so in the previous slide I just said that the proof will say the circuit was filled incorrectly and yet the next thing I'm asking is what does a valid proof actually tell us and all we're doing here is kind of taking a perspective change the proof is about verifiable computation we're checking that you filled out the computation correctly but of a a more interesting

perspective many times is that the person who made the proof knows a valid witness to make the circuit circuit valid okay a different perspective here is not that it's been filled out correctly is that the prover knows how to fill it out correctly and again an example in the next example you're going to see why that perspective changes is important but it also explains the naming of a snark because the arc bit at the end of snark stands for argument of knowledge and so the proof is arguing that this person knows um a witness specifically that's what the argument of knowledge is that the the prover knows a

witness um and also when the verifier checks the proof with the circuit the verifier doesn't learn the witness you know that's not passed on in the information and that's the zero knowledge aspect so in the Sudoku example when I give you the Sudoku answer you you learn the answer but in the Rubik's Cube like if I hand you handed filled in Rubik's Cube you you don't know how I did it I mean like maybe you do but uh you know the point being the how to solve a Rubik's Cube isn't passed on when you see a filled in Rubik's Cube okay so we done the S and the arc from from

snark um for question it's very good asking why we only use addition and multiplication and not division um we're going to cover that properly in the second session um but the short answer now is that because of the mathematical objects we work with you can do a division using a multiplication okay naively right now you can think that instead of dividing by two you can multiply by half so we're going to do something equivalent but like I say we'll do that in more detail next session so we don't

want to dive into too much of the maths in in this first session we just want more the high level overview how of how the system works and so this is the example I wanted to to talk about I'm going to sketch this out so um Z [Music] snu example I am assuming a little bit of knowledge on your end I will try and go over it quickly hopefully you're aware that um if you have met mask any crypto wallet at binance or or wherever um you have two very important things you have

your secret key and you also have your public key okay whenever if if you want someone to send you ethereum or Bitcoin or whatever it is you send them your address your wallet's address that is your public key yeah so hopefully this is all new to you just in case some people don't know it and just to refresh the memory I'm going over it the secret key can be used to make the public key right we can go from the secret key to the public key now the the reason that when you have money in your wallet it's kind of like

associated with that that public key and the only reason why it's your money is because you know the secret key if anybody else knew your secret key they can spend your money that's why why we have to be so careful with our secret Keys it's either just like a long number like a hexadecimal string that you might have written down somewhere as a backup or it might be 12 or 24 words um those words are actually used to make that that long number and that long number is used to make another long number called your public key okay so hopefully you you know that um if we have a a

circuit that does this process um so secret key to public key conversion I'm drawing this as a box of course there's a lot of stuff going on here to make this conversion with a secret key going in and a public key coming out um but this we can represent as a as a zero knowledge gate H sorry not gate in the same way that binary circuits can do everything that your computer can do just ones and zeros and and Gates and Gates we um can make this conversion

from a secret key to a public key using addition and multiplication and numbers between zero and and two okay so if that's our circuit but instead of the public key coming out like right now none of these y values are filled in but I'm going to fill in One V yre value and it's the output yre value if I put that the output is Satoshi satoshi's public key Satoshi Nakamoto probably mostly aware is like the founder of Bitcoin he kind of you know came up with the idea of Bitcoin and made it happen and made it it basically started the whole industry and

there's like loads of money in in his account um right if we have this as our our Z oops this is our Z circuit and let's say I take this circuit I take it and I put in my witness and I get out of proof and then you guys take the

proof and the original circuit and it checks out what you know that was the process of what snarks do if the proof checks out what does it imply well the one of the first things it implies is that I did this computation correctly you know this has been done correctly but the other perspective that I told you about is that it tells you I know something and it tells you I know most interestingly I know the secret key I know satachi Satoshi nakamoto's secret key okay so here a proof is is showing you what I know of course this is a very

bad way to prove that you're Satoshi like um this is still not how you would you would do it um but the value of these proofs relate to the real world and the the important thing is actually what does a proof passing tell you now the fact that I was 14 when the Bitcoin white paper came out probably means I'm not Satoshi right so a more reasonable likelihood a suggestion about me being able to give a a passing proof is that maybe I got this proof from someone else maybe I figured out who Satoshi was and hacked his stuff or whatever and managed to find his secret key or maybe I just

Brute Force you know guessed his secret key that third one is again based on the security levels we take just never going to happen um I mean actually it could happen with quantum computers but we're we're not quite there yet so the value of the proof relates to the real world and I'm probably not Satoshi I probably crack his password so if this scenario happened either I got the proof from somebody else if I didn't make it in front of you or I figured out who it was and manag to um hack hack his stuff or her stuff or their stuff okay so there some more walk through of a

whole um proof example like what the process looks like and then some of these ideas of verifiable computation and that I know something an argument of knowledge and the um to to talk about proofs we usually use idealized circuits th what I just drew this box is an idealized circuit um I'm just drawing a box and saying it does this thing and that makes speaking about circuits Z circuits much easier um because of course an actual Z circuit is like tons and in fact usually

it's millions of addition and multiplication Gates connected together in various ways um you know different proof systems use different um Gates as well so but but we can't talk about millions of gates so we just talk about the purpose of what a circuit is supposed to do um but that also introduces a a small kind of um error as for example people sometimes talk about a circuit that it's just um you can't make it just doesn't actually exist um all that is just overly complex so at the start I give a few examples such as that Alice is over 18 years old what computation can I do that proves or that Alice can do that proves she's over

18 right but you can't do that in a computation you actually can but you've got to add more external stuff what you have to do is you have to get a government agency to make a list of everybody and their ages or a list of everybody over 18 and then Alice will prove that she's in that list or that her age on the list means she's over 18 um but then the computation relates to something that like a government agency did and it gets a lot more complicated but generally speaking we can only make proofs about things that relate to computation and if the thing you want to compute doesn't yet exist maybe there's a way to to get it built um to Fran's question does the verifier receive the witness

um they do not receive the witness that's the zero knowledge aspect the verifier receives um it's just the verifi receives the proof and the original I've drawn it here but when the verify goes they get the proof and they get the original circuit um and the the witness here with all these fill in Wes values doesn't go to the uh verifier um I can I think I can mention this now um you can send the witness what happens if you send the witness is you lose the zero

knowledge okay you can send the the witness but you lose the zero knowledge and one thing I mentioned before uh there Z snarks have two really important properties one is this succinctness what was that one is this succinctness that that checking the proof is really quick and then the proof is quite small so that's really important because you can speed up block time anything that requires lots of computation you can then make much smaller and you also get zero knowledge but there's a lot of real world use cases where because of like consensus designs and design and things like that it's

very hard to get succinctness and zero knowledge so what they do is they'll just use the zero sorry the succinctness property and they'll just reveal it they'll pass the witness they won't maintain the the secrecy um but that's still a very useful way to use the technology unfortunately it's often badly named because these things will be called like the ZK evm or ZK this and zedk that because the technology is called ZK zero knowledge but Zer knowledge is only one of the two properties and the Z KVM doesn't use the ZK property it uses the scaling property um so yeah be cautious of that but in general the verified doesn't receive doesn't need to receive the

witness so I spoke about these idealized circuits and that sometimes we just talk about proofs that we can make you know circuits we can make but they're just unwieldy they'll just take years to prove or like minutes to prove or something or or literally aren't possible or require a government agency to make a list and we don't know anybody in the government um so that's an important aspect of it as well um some more idealized circuits is um on the left we have a a voting circuit you know we take an ID and a signature um we prove that we can vote and then we take our vote option and we combine it into the aggregate result and we get our our vote data this is another

example like how do you prove you're allowed to vote um in order to do that a system like a project called Macy meci minimal antic collusion infrastructure the P psse it uses a smart contract before where everybody can register and sign up on the smart contract and this might be a dow running or something and like you have to have a dow token in order to be able to access the smart contract and put your name on the list of Voters uh and then in the zero knowledge proof you're going to approve that you're on this list and that you you haven't voted before or that you're changing your vote um so these get quite complex and then on the right half is just a transaction circuit so you take the ethereum state you take your ID and you

prove that you have enough ethereum in your wallet to send and then you show that it's valid etc etc but this is an idealized circuit we can now talk about a transaction circuit in in two words as opposed to all the details of what it might need to look like and that way we can figure out whether it's worthwhile to figure out what the circuit should actually look like um and then of the starting image that I showed you we're going to go back to that I think in the next slide or the one after there's one last part um and this is to go from an idealized circuit to a zeron knowled circuit when you're filling out all those Gates this process is called arithmetization

th this is actually for many zedk Engineers this is what they spend most of their time on is turning idiz circuits into actual ZK circuits they spend ages coding in rust or whatever other language they're going to use just putting Gates around to represent the computation they want to use so how do we turn that black box into the literal addition multiplication gates with wires connecting them because if you don't do it correctly yeah you can also use C if you don't do it correctly um the circuit is not going to do what you said it was going to do so you've got to get this right and also if you don't do it correctly it might be possible to break it uh there are some zero program

languages in in C I don't know of any in Python but they they very well might be uh generally speaking that they try and use because proof systems are slow um they generally try and like optimize as much as possible Right circom is uses the proof system called grth 16 um oh is does it use a python back end maybe um that' be a good thing to look into and I'd love to see any link showing um different languages so just a quick recap of everything so where we started I showed you this image and then going over all stuff we we have an idea about something

want to do usually this is kind of the role of the entrepreneurs is to say what if we prove this thing we we make that into an idealize circuit like you have a problem you want to solve and then you say what circuit could we make that would solve that problem you know I I want to um uh buy alcohol because I want to prove them so you're going have to prove that you're over 18 you then take the idealized circuit arithmetization Engineers spend most of their time making those circuits um then approver will take the circuit and add in their valid witness I mean they'll add in their their witness it doesn't have to be

valid because if it's not the proof won't check out and then once the proof has put in their their witness they're going to get out a proof the way they get out of proof is that the the PE people made the proof systems theoretically and then some people coded them and so now you just run a program or a function call that will turn a circuit into a proof and then the verifier will check if the proof behaves they taken the proof in the circuit I should maybe have actually drawn an arrow from the circuit going into the fer proof behav to um make clear that the circuit is also necessary to to check the proof okay but this is the core of it

this is like ultimately what Z snarks are doing is just this kind of relatively straightforward step process um but yeah making circuits is not easy making proof systems is not easy um and finding useful circuits is also not as straightforward as it necessarily seems how we're doing on time so we're like an hour in I've got like a couple more slides and then we're going to take a break and then we're going to come back for the um the much shorter second half um what is the role of entrepreneurs and it in in Z space and it's kind of figuring out what what useful circuits are so some example ones are a

transaction circuit to prove that you have money and can send it and this way you might be able to add in zero knowledge you might be able to add in privacy such that you'll be able to send money now without people knowing it came from your account or how much was sent and things like that also it might make processing transactions quicker because rather than check the transaction they can check the proof which might be a lot quicker similar to like block times not Neary blockch but checking blockchains uh smart contract circuit cool or an evm circuit um the evm like the PSC is doing the Z evm project which is trying to build like a evm compatible

zero knowledge Layer Two um and they have some very big and and complex circuits I would recommend just giving it a BRI brief look online if you if you find find the time okay so we're going to take a a break here before going back to the second half now is a very good time for more questions about anything we've we've covered so far um are there some real world examples for transaction hold on so maybe we should say that we'll have a five minute break and we'll have questions in this meantime but for people who do want to go to the LW whatever I think at 15 past quarter past um we'll start the try and start the the

much shorter second half are there some real world examples for transactions can they be used instead of smart Contra contracts though I'm not entirely sure exactly what the question is but but Aztec is um a project that's trying to build a privacy layer on top of ethereum so it's it's like an L2 that has private transactions so it uses a specifically for that um Alo is is a layer one blockchain that is building uh zero knowledge transactions um and uh there's also kind of two levels

to this to this privacy so the first level is that you you make it invisible so that now rather than when I said send money right now people can see that my account they might not know it's mine but they'll know that this account sent some other account three whatever let's say Bitcoin you can add uh privacy in one layer or two layers if you add it in one layer now people will just see that um a transaction happened they won't know where it came from or where it went or what was sent or how much which is already a lot of privacy um and then you can even add in a second layer of privacy and this is

that on the blockchain you won't even know that it was a transaction that happened you just see that something happened it could be a transaction or a smart contract call or something else um which is pretty insane level of of of privacy um another interesting example there's one of the original privacy coins called zcash design primarily just as like money and and not smart contract functionality they it was like hidden money but uh interesting they had a bug in their in their system so like people could just make free money as much as

they wanted um and like if that happens there's not even a way to check because it's like all private and hidden you can't even see that they made loads of free money in in the system you would be it indirectly by just like more transactions happening and things like that as more of it's being sold so it would sort of that would have an effect that would be noticed but you can't see it directly and that was actually figured out by um one of their people who worked there because it was going to give a talk and he's just looking over the MS again and then he just saw like a it was literally just like one letter difference that was just like a small mistake and he realized that it like completely broke the whole system and

then they had to quietly like message each other signal and try and be like okay how do we how do we get past this and then they had to like figure out how to fix it they had to write the code for it and then they had to get all their all their nodes and stuff to update all their code without telling them that it's broken because otherwise the price would have crashed it would have been you know hugely problem problematic um apologies Rina I can't remember what the recommendation is referring to um if you give me a bit more clarity I could try and repeat what I might have said uh validity proofs validity proofs are a different

technology I haven't looked at validity proofs in sometime I believe they're just a different technology and not related to the K at all even they though they try and achieve the same properties um I would have to check over that again in in more detail any math requisites that would greatly Aid in mastering the content um also mind sharing the languages mostly used implementation of these proof so mathematical prerequisites we're trying to have this be that you can come in with no mathematical background um but that doesn't mean it's not going to take work

on your part I'm sorry it's already qu part we start by now but maybe another five minutes to answer these questions um that doesn't mean it's going to be on your part uh sorry easy for you like the math that we go over in the second and third section like I said at the start of this session we've been figuring out this stuff or not we like mathematicians for centuries and and um Millennia and just built up this huge Corpus of mathematics and we're using some of the complex ideas from math to build an even more complex idea which is a proof system um so the more mathematical maturity you have just Comfort working with numbers and things like that they're better but there's no uh prerequisites per se if you've already

seen things like groups and Fields and polinomial elliptic curves it would be helpful you'd have a understand things a bit better um but we're going to go over the definitions of each of those in the in the in the next section um in a bit of a rush hand wavy manner but hopefully it should be enough for most people to get a basic grasp and for the languages that most people uh used for implementations rust is a very popular language because it's um very nice to work with and very kind of memory safe there were a bunch that were done in the before but it's becoming less popular I believe go is also used um for some of them um circums possibly in Python apparently I can't remember exactly what it's in

um uh those are the most popular ones I would say R rust in particular when and so for the last question when people talk about layer one providing more security this is generally not to do with zero knowledge aspects at all I I I don't believe I mean one of the examples I gave earlier that antech is a privacy layer on on on ethereum so it's a layer two in many senses antec is is more secure because it there you you can do stuff privately um I believe the security relates more to just ability to possibly hack the system and um yeah other General things it doesn't really relate to

revealing data about your transactions okay I'm just going to see if Kong's ask a question and if not I'm going to continue with the the the second half which I said is a is a lot shorter than the first half and also we begin to see a little bit of the of the maths yeah thank you for that Kong Kong shared the the link to the material I didn't share that at the beginning I had assumed that it was available to all of you beforehand but I really should have put that out there um so in this section fortunately the the the mini book we've written has eight subsections and each lesson is two subsections um so the

first two subsections in part one on the on online material is what I've done today and part two the next two lessons is all about the maths so I'm just going to get going so that we don't know run too long with this second half um and the reason why the this first session very unes because we start to get into some of the math it didn't really make sense to split um without finishing the snarks just so that we could have equal time so a lot of what happens in snarks can be viewed through the lens of polinomial um making them and then doing

some things with them and and then checking what we did with them a polinomial it's kind of a scary word but it's actually not too complicated um it's any sum of algebraic terms that have IND power values so again more scary terms let's just quickly sketch that out um okay I I will I'm going to pause just to answer Alex's question because we didn't actually answer the n in the snars it's it it is important but it's just kind of like um almost assumed the n stands for non interactive and what that means is that

you can share proofs and people still believe um the proof for example in in the Sudoku example when I you give me the unfilled out Sudoku or Rubik's Cube and I give it back to you you saw me do it and then give it back to you you know that I have done it but if you hand that to somebody else and say Errol did that they didn't see me do that so they can't actually be sure that it's true and soly the proof the proof of validity just be vanishes but the proofs we make in in in snarks we can share these online and they're still valid so that's what the

end is the fact that you can like share these proofs and you don't have to be present when they're made in order for them to be valid um pols okay so probably like most functions you would have used at school um are pols they're just sum so you know 3x^2 plus 8X minus 5 this is a polinomial because we're adding powers of X and that's kind of it and we can take this as as far as we want you know 7 x

cubed and we can just keep going as big as we want they're going to be as large as we want what we're not allowed to do is use like a square root which is the same as like a half power we can't use any power of X that is not a positive whole number so f ofx = x 1.3 is not a polom neither is f ofx = x minus one which is the same as 1 /x right because this the minus one is negative we have to have positive whole numbers okay and that's kind of it but

we can just keep making them bigger and bigger by extending them with higher powers of X um we can also represent any data as a polinomial so a quick Live sketch again really numbers don't really matter if you have 7 41 180 you know let's just say we have three numbers we can always represent this as a as a polinomial we can get F ofx = 7 + 41x + 180

x^2 yeah and if I we add more numbers you know if that wasn't there um 50 + 50 x Cub we can just keep adding more numbers to our polom right so we can represent data in pols and why we might want to do that is because it gives our list of numbers more like properties we we can play around with and here's one of them and it's going to explain a lot about thisness with a polinomial we can evaluate it at a number so for example we could do we could evaluate this at I should have

chosen some smaller numbers so let's just do two we can evaluate at two in which Cas we get 7 plus 82 plus um 720 + 400 which thumbs to um we got 1120 1200 believe that's 1,29 um you know let's just pretend that is right um we have turned a list of four numbers into a single number right can we go back can we take the single number and go back to the four numbers not really no like um but we've compressed massively this is where a lot

of the succinctness that makes proofs proof so fast comes from this list like I said it can just go on 50 71 5 n we can take tens hundreds thousands millions of numbers put them into a single polom and then we can evaluate that polom and get out one number so we can really compress loads of stuff together and we can't get the numbers back but this number we call a commitment once we do that evaluation it forces us to be stuck with that polinomial and doesn't let us change it and this is really like where a lot of

that succinctness comes from also the The Hiding property the zero knowledge um like we can't go from that number back to the previous numbers so we hide a lot of stuff there yeah well done Fran um so the witness is you know we can think about putting it into a polinomial we're actually going to dive into that now the last thing we're going to do is we're gonna that image we had before I've just extended it with a few more steps rather than go from a valid witness to a proof we now have three steps in between which is to make pols and then commit to them and then query them so we're just going to do this example I think basically

we're done so how do we go from a circuit and a witness to a polinomial is our first step so I'm going to try and draw this out uh 3715 let's just try 7 1 5 and then I think we had a addition below so that's 21 that's a six and that's 27 so when

we when this is our filled out circuit we're going to make three and what in plon what we're going to do is going to make them for the left wires so all the left input wires that's this three this one and this 21 so we call this the I'm going do L of X um it's got the numbers are three 1 21 um and just to bring in the witness you know maybe 7 then actually

21 5 6 basically most of these will be part of the witness but we don't directly like put the witness in a polinomial it's kind of broken up into these different parts so we turn the the left Y is into a polinomial so this is going to be 3 + x + 21x squ we're going to have the right be 7 5 six 7 five and 6 so 7 + 5x + 6 x^2 and then we're going to

do the output Y is six 27 and so this is actually the r of X for the right and this is going to be 21 + 6x + 27 x^2 be the O of X for out output outut wise I just want to talk this bit here here might have been a little confusing because this necessary because um it it could be um H how do we actually know that the

output of this ad wire is the same thing that goes into um Okay add here how do we know that these two wires are actually connected one way we solve this in the proof system is we put them both into um into two different polinomial and we're kind of going to check there that the the values are consistent because you can say you get six out but an actually just Chuck in a seven into the next proof system if if if you're not careful so we've got to account for that somehow but but this is how we uh commit ourselves to uh sorry that's how we make a polinomial from our circuit um

Clinton's why the different coefficients so I G to ask for a bit of clarification 27 is called the coefficient of x squ um but the reason why 21 has no X and 6 has X and 27 has x s distinct position in the polinomial we don't like mix them together but if that wasn't quite your question please um feel free to ask again so we've made our polinomial from our field in circuit and

then we can commit to them so the green what when we commit we'll actually do them at a random number um so in the pr system we have to get a random number from somewhere which isn't something we really cover in this course CU you know there's just so many details of things that have to be there but we get a random number and we put it in and let's say it's l of um four so we get 3 + 4 plus um 16 * 21 320 uh

336 is what 340 343 and these are actually going to be the same number same random number so R of four it's going to get 7 + 20 + 16 by 6 96 sum to 123 and then the last one going to o four yeah it's just getting a bit too big 21 plus 24 plus uh 16 27 you're going to get out a single

number okay um but now we've sort of committed ourselves to this circuit in in many ways in in um in the next session actually in the third session we're going to go over a little bit more detail to this picture here because once we commit and we make these values we're not going to be able to change our circuit here the in particular it's the witness we're not really going to be able to able to change um so we make them we commit to

them and then we actually make some more polins in various ways we might we might go with that a little bit in section four in in the fourth lesson and then we can query them so there's a lot of stuff going on with pols here and you've seen that we can compress a lot of stuff with with pols so you've seen how we can make them and then commit to them the quering it just refers to taking a polinomial and evaluating it somewhere so um yeah the the committing and querying um are kind of quite related okay recap again and I think this might even be the last slide there might be one or two after this we started off with this first picture that we said we were going

want to understand and then we added in a few more steps of polinomial which is that we take our field in circuit and we can make polinomial from it and then we're going to commit to those pols and then we're going to like check that the pols were were valid I can start to describe because there's a lot going on it will get a little bit too um complicated and and and forgetful and then we get out of proof but this first picture is like a very very good high level understanding of what snarks do and how they can be used so then you can start to engage in discussions of like where to use them and what what might be possible of course the more understanding and and

knowledge you have about useful example circuits that are out there or proof systems or what others have done um the more yeah the better it will be um so there is a homework is as well that we can get to but of course now is the best time to stop and see if there are any more questions from that second half or also even the first half just any questions overall that people have and yeah they didn't have to be um you are free of course to come back to the there a channel in in this channel wait in this D in this server uh called snar fundamentals if you

scroll down close to the bottom I believe you'll find it you can always ask questions there and whenever I see them I will get back to them as soon as possible um of course it'll be helpful for you to look through and read the online material in the interim before um the next session if you read it before the session it's like even better of course and we're this is supposed to be 90 minutes we're going over a little bit so I don't want to keep people too long so as questions come up I will answer them but I'm also going to try and get to the the homework when there's a pause in questions and G Chong very helpfully posted the link to

the oh is this a different this a different Channel intro to snars um yeah there's actually in in This Server there's going to be many places to ask questions about snarks um for your homework this is also a little bit experimental um I'm going to ask you to make uh to to download it's free completely free um a software it's free on on computers a software called Anki which is a retrieval practice and space repetition system and I'm just going to go over in a couple minutes why that U why I that is the best thing to do and

it's encapsulated by the bottom sentence here so ignore what the actual task is I'm going come back to that at the end the biggest problem that I see again and again and again when people learn this stuff is that they read the stuff they get it they kind of understand it and then two three days later it's gone like you know your your graph on how well you understand it it's like you kind of got it but the moment like a bit of time goes you're understanding like gone out the window and you come back to another discussion and they'll speak about something that was mentioned last lesson and you just kind of can't follow along so this homework is specifically designed for

the biggest problem to see again and again and the reason why I'm trying to battle that um with this thing called Ani is I'm going to show you the science on this very quickly um this is just uh I'll come back to this afterwards actually this is is what the website looks like anky web.net this is what what it looks like to make a flash card come back to that afterwards but in this top left image is called the forgetting curve like scientist started studying this I think you know early last century this guy I think it was a German guy he just tried to he decided to do an experiment and he decided to try and remember a bunch of gibberish nonsense phrases and then he just tested his his memory like one day later and three days

later and a week later and a year later and stuff like that and he he thought that like within a few days you forget like almost you know most of what you learned like 80% is gone within like three days which is like pretty pretty bad right and so if you're trying to learn a complex topic you can't just look at it once and then you know go to the next lesson it's just it's going to be gone because like I said at the beginning you're supposed to build up your knowledge and if you build it up and then it gets all crumbles and you go to next you can't build supposed to build from where you were but then called space repetition so you you learn something and you forget most of it with a couple days but if you revisit the stuff in this top right image you see

see that you kind of go back up to 100% and each time you revisit the material it takes you longer to forget if you might forget one day but once you see it again it will be three days and then it'll be a week and it'll be a month and you can really uh grow grow your memory um help remember stuff long term and at the bottom is a another study where they gave people four scenarios so like they got them to study something they or they got them to do repeated study or they got them to do concept mapping which is first they studied and then they drew like um mind maps to kind of help solidify their understanding um and then the last one they got them to study and then they got them to like practice retrieval practice which is essentially flash cards which is what these four

columns are now in the left graph it says verbatim questions and these are literal questions this is where people learn um you know what the definition of a snark is like what what the acronym stand for succinct non-interactive argument of knowledge if that's what your flash card is and then they tested them exactly on that question um and you see that retrieval practice is like far ahead of normal study and repeated study and concept Ming like there's really no comparison it's really really far ahead the next one is inference questions and this is that like you learn a and the question isn't about isn't a it's like something that happens because of a you got to like use the knowledge you have to

figure out something else um and you see again that retrieval practice is like still better than the others it's there not as clear as a lead as the other ones before um but it's still like far ahead and compared to just study once like if you just come to this session and then you don't do it again you're going to be in this red graph where like the amount of questions you're going ask after is going to be pretty bad and for people who do practice they're going to do a lot better of course and this third graph is really interesting it's called metacognitive predictions which is really like confusing what it actually is is they ask the people which of these four learning methods do you think will be um the best or the worst and very

ironically people thought retrieval practice was going to be the worst one which is almost insane because the retrieval practice um setting was they had to study and then do retrieval practice and people thought it'd be worse than just study um so like there's a lot of misunderstanding about the effectiveness of retrieval practice okay so that's why I'm the homework I'm trying to give it's specifically for this issue to help you remember as much as possible because we are really building this stuff up and if you come to the next session or sessions and you can't fully remember some of the stuff before it just becomes very hard and very uninteresting to try and follow along so what does it look like to use

anky you make flash cards this is an example of me making a flash card um in on the front of the card I asked what is the gas cost of verifying a plunk proof versus a stock Weare proof on ethereum okay and on the back I put my answer and then um I also put some context for myself in case I forget where I got this from or it's wrong or something I want to go back and change it um when I make that card then when I review it an will just show me the front of the card and I'll have to try and remember the back there's no anky doesn't tell you well done or anything like that it's just about you and how well you decide you remember something so you see the front and you try and remember the back and

then you'll click and it will show you the back and then it'll give you four options one two three four like easy medium easy medium hard or hard and then once you click one of those options an algorithm will decide when to show you this card again should it be tomorrow should it be in 10 minutes should it be in a week should it be in a month and it starts off from like you know 30 minutes and it goes to like a day or four days and then a week and a month so it quickly um the interval goes up very very quickly and these algorithms are scientifically engineered to be as efficient as possible at getting small bits of data into your long-term memory okay so this is going to be one of the best things you can do when we're learning snars particularly in the

beginning to get your head round a lot of these definitions so what is the actual homework aside from downloading it and installing it it's if you can make cards on some of these things it will be very very helpful at the end of the first two subsections we have kind of a glossery like a very short glossery um with lots of the key words we used in in this talk in in that section if you can make card cards on those it would be very very helpful um and then you can add in as many other cards as you want um on any example that you want to try and remember or or things and it's generally best if you write the cards in your own words you can copy and base

bits and pieces but one of the helpful things is that by writing like trying to solidify your answer to a particular question yourself helps you learn it very well um and try not to make cards too big like the example I just showed you with this gas cost is like a very actually straightforward answer you know there's not like three paragraphs explain those of things you can't it's that's like not a small snippet you want like a small snippet of things to remember but you can test yourself to see um how far how how how to make it um if you can if you got lots of time and really want to do this stuff if you make cards in the next section it would be really really good as well and try to do an ideally every day but um you know not

everybody has time for that every couple days two or three days is pretty good as well because again the science is you want to look at this stuff often it doesn't even have to be long you know you can spend 10 minutes um and go through as many as you can and just reinforce that understanding um yeah and just try make cards for any part you really struggled with okay so that concludes our first session thank you very very much for coming I hope you learned um a lot and we're looking forward to any more questions again like I say you can put them in in the stock fundamentals chat

or the intro to snars um link that that K Chong has has dropped there I'll try and answer as soon as I see these uh questions come about and the next session will be on Monday the same time as it was today and in that one we're going to get going with some fundamental mathematical definitions um items objects we're going to be using okay but yeah you've got the core understanding now thank you very much for your time and uh I'll Stick Around for some more time if you want to stay and ask questions as well but if not then have a good weekend by the way if you have any

feedback about um the content in particular but also the online sessions um it will be very helpful you can just ping me directly in Discord um or maybe at the end we'll try and do a a um form or something feedback form but of course we want to improve this material as much as possible hi um I have a few questions I was a little bit late so maybe you did mention it but I wasn't there to hear so um is this does this have anything to do with um Cairo as a programming language because I have been going through a bit

of it and I can tell there's a little bit of similarity is it the same thing or am I just imagining because of similarity in functions and other things and then um what do you think is this is is it possible to liken this to Quant programming when it comes to um I think that would go in with the first question because it would answer if it would answer if only it's actually a programming of the sort so um can we start there and then maybe pick it up from there yeah yeah thank you very much for your question they are particularly relevant topics so Cairo is

implementation language for um uh something called a Z Cas Stark which sounds like a different thing but they're also snarks so a stark is still a proof system and it's also still a snark um Cairo is just an implementation of that so you can code in Cairo if you want to do Starks I think Stark where the ones who um wrote Cairo you can code in circom which uses Groth 16 which is a different proof system um you can code in in Halo 2 or or Nova there's like tons of different languages you can code in and the properties the proofs will will vary a little bit we're going to cover that in in the fourth lesson here one of the key differences as to why people might want

to choose um a stark which actually in my question here in my in my flash card there's a plunk proof and there's a stark wear proof which is um what Cairo should be making is that well one difference is that star wear proof is that is a lot slower clearly because it's like 10 times the gas cost but that's but some people are still choosing use it and that has a very important there's a very important reason for that STS are we say they're plausibly postquantum secure what that means is we haven't yet found a quantum computer algorithm that can break Starks we know as a fact that quantum computers

when they get good enough like to a decent standard will break plonk and they'll break tons of other proof systems and they'll break tons of other online cryptography but in most cases we use non Quantum secure cryptography systems and the reason is quantum secure stuff is a lot slower and quantum computers aren't yet good enough so why would people make the business decision to use slower tools um for no immediate gain as for whether quantum computers will ever be good enough to break this stuff some people will say 5 years some people will say 30

some people will say never so it's kind of Uncertain one important thing to think about there is that um everything that's online now and that is encrypted but it's not Quantum securely encrypted um can then be unencrypted later when quantum computers come about yeah okay so should we then um worry about incorporating the same without having to take away because one thing I know about quantums is that it can help when it comes to predictive algorithms I was seeing some some of the things that the finance Bros were doing a few years ago and that was like way ahead of their time and what can be done

now with the use of AI and I don't know much about this one but I'm thinking if it was hessed together then maybe you would be looking at awesome potential I know it's low but the predictive measure almost um almost always accurate 90 something score that's pretty good the odds are pretty good should we then um look at harnessing both or I don't quite follow the question to to harness quantum computers and proof systems or programming structure yes um possibly I'm not sure I've actually

ever heard someone look into like doing proof system using Quantum logic um I mean we we're barely even at the stage of like having Quantum secure uh uh proof systems as for whether to like do a proof system using Quantum logic there might be gains to be made there but there'll be a lot of like work to figure out if it's even possible and if so what they look like um and at some point it will probably make sense but it's not like a generally speaking where people start off um because you know again they just cont computers aren't really much of a thing yet okay thank you my

pleasure yeah so just sticking around there are more questions feel free and come on the stage or you can just ask in the side chat so confused with this if you have questions about the uh anky software feel free to like Ping me directly in the in the chat

um as Erol or edgd although Errol would better thanksgivi

I'm going to assume that most people here don't have any more questions so I'm going to head off as well have a good weekend everybody thanks for recording Tyler as well oh sorry you had your hand up really

yeah where oh I can't because I can't see it on that one can only see you here uhon can you help oang to the stage maybe the um are the approval request didn't go to him or something what if we cancel it and then he tries

again well we ask him directly invite to speak there we go you're on you are muted though if you are uh all right all right I'm good I'm good right yeah so question um the math the pols will we be using like calculators or something or do we have to like do

the old school um um you know no so when you when you get to some of this more abstract mathematics we we can do worked examples where we'll mult multiply a few things out but generally speaking we're looking at the properties of the mathematical object it's not like school where you just do a bunch of calculations the the uh implemented proof systems will be doing all these computations for us um we we're just going to talk about these things in a more abstract manner so there won't there shouldn't be any need for a calculator but a pen and paper or something to try and sketch out yourself to follow along could be very

helpful we got another hand up that hand up hello so I have a question just can correct me if I'm wrong so the importance of snacks snacks real world importance of snacks is that it helps in scalability of ethereum like in transactions if you want to post them on the layer one it's easier to verify approv in the entire transaction so apart from that I is first of all is that true and then

secondly I want to ask what are some other real world like use cases or importance of this snack technology um yeah so what you first said that that the the value case is that you can verify transaction more quickly is like sort of true so in in fact in this card here quite fortunately you see that the cost for verifying a plunk proof is 300,000 gas on ethereum doesn't actually get much smaller than that for verifying a proof the cost of an ethereum transaction is 21,000 gas though transferring ethereum is

actually quicker sorry cheaper easier um if for but that's for a single transaction the thing is this plunk proof you can have a layer too and this proof can contain thousands you know hundreds or thousands of transactions within it so then the marginal cost of each transaction goes down massively um this these tools are used in a variety of places they can also be used like if you want to sync with the blockchain you have to physically check all all the blocks that came before and whether they're right Etc um but we can eventually find a way to just make a proof checking that like you know the first 10,000 blocks were done and that way you check that proof

which will be very quick and suddenly you're like 10,000 blocks in and then you can you know sync with the chain much quicker there's a variety of use cases I'm only going to know some of them and it'll be very good if you asking some of the other cats around here but anywhere that is limited in some form of computation can probably have snarks applied in a way that provides value on top of that anywhere that could benefit from privacy could probably benefit from snarks I think you also had a second question right yes so at least that answers the

question then secondly if it comes to issue of privacy how in real life how it really ensure privacy because we saying we posting something it's on chain yes yes the verifier might not know but the Prov has revealed the results maybe you could elaborate more how it how it uh example how it ensures privacy right so um it this is a particularly interesting discussion and it's unfortunately not too straightforward so I mentioned that some use cases don't use the zedk property at all and one example is you it's very hard to apply zero knowledge on ethereum

directly to get zero knowledge transactions and the reason is because the way the consensus or like um safety system on ethereum works is that if you want to spend one ethereum people have to check your account and see that you have enough in there um there's not an easy way around that so what they do is they'll just like reveal that data so they lose out the zero knowledge but they gain scalability an example of how that's solved elsewhere there's a uh Z Ange layer one called Alo where I used to work and ethereum uses the account model but Bitcoin and Alo use the unspent transaction output model which means that you don't have like an account with all this money in it there's just like

transactions everywhere and like maybe this one's mine and it has three Bitcoin in it or you know 10 Alo and it's not been spent yet so what I can do is I can make a proof that I own the key to um not to this transaction but to some transaction in the entire list of all transactions and that this transaction is not in the list of spent transactions so now I prove that I have access to some amount of money and that it's not yet been spent and that allows me to spend the money but when people

check the proof they the statement they learn is that I have access to money that's not been spent they don't know whose money it is they don't know which account it belongs to so in that way we can get private transactions but it kind of requires a bit of a change on the consensus level of like how you maintain security so if you designed a blockchain without thinking about how Zer knowledge proofs work it's very hard to and put General proofs at the center of them but if you bear that in mind as you design the blockchain you can get it to work and and allow that privacy okay makes sense sorry last one

before snacks I knew there was a technology there was the stock can you elaborate the difference between the the snu and the Stu a stock is there is an n a Stark that anybody uses that isn't also a snark they try to make the distinction with the T at the end instead of the the K the T stands for transparent um this what that means we're going to cover in in in the next sections but they basically wanted to make a distinction um based on one security property of of proofs and that is for

plunk in order to work with the system you first have to like have everybody set it up and this is like adds in a security assumption um I think star actually came to light kind of after the innovation of snarks because again a stark is just an example of a snark but the best way to think about it is that it's just another proof system that's out there and that you can choose from you can use plon you can use a stark you can use grth 16 you can use Halo you can use Nova um there's Marlin there's tons and tons the proof system to choose from and Starks are just another kind of subcategory of of cool

okay I'm actually heading off now take care everybody bye-bye