Jack on "Folding in Consumer Apps" @ ZK Hack Meetup in Athens, 12 April 2024

Transcript

all right hi everyone uh my name is Jack Gilcrest uh I'm going to be sharing some thoughts on uh using folding in consumer facing applications uh specifically here at ZK Summit 11 with uh ZK Summit folding so just jumping right into it um I'm not a math chat Galaxy brain uh this is all being done with very basic stuff um we're using Nova which is essentially the most basic folding scheme avail able uh and we're using circom uh which is no coion I'll get into that it's a really cool Tool uh but just really quickly um folded proofs themselves are not

actually zero knowledge um all they are are just incrementally verifiable computations saying that the sequential computations are constructed correctly the way you actually get zero knowledge in a folding scheme uh for instance Nova is that you take something like Spartan and you wrap the entire folded proof and verify that in zero knowledge So eventually uh folded schemes become zero knowledge but initially they are not so uh talking about Nova Scotia uh I've got the QR for the repository up there uh if you have used circom at all ever uh it would probably take you 15 minutes to

get something working it's an incredibly easy repository to use um basically the only thing you need to think about and I'll show it uh briefly in a second is the public inputs which uh are just step in and step out uh and basically for some instance n in your chain of the IVC uh the step in for n is going to be the step out for n minus one so uh going into um ZK Summit folded I'm not going to go over everything that was already talked about but uh briefly you've got the cards uh which produce baby JJ ecdsa signatures uh there's a bunch of different groups there's speakers

attendees talks and these all have Merkel trees uh and the base circuit which we're working from checks the validity of the signature and then checks the membership of public key that produced that signature uh checks that it's in the tree so the folded circuit just takes one more step and essentially uh at the very beginning we pass into inputs which are uh the tree route so let's say we're doing uh the speaker tree that would be the root of the speaker tree and uh num verified which is always zero at the start and as you step through verifying uh more and more memberships you've met more and more speakers in this case uh it's going to pipe through um the tree route make sure

that you're always using the same tree roote every single time and it's going to make sure that n verified is incrementing once each iteration and if you know anything about uh Nova you're probably wondering why we have num verified uh when you're verifying the proof you have to pass the number of instances folded uh and the reason we do that is actually a consequence of the decision to not do full Nova actually uh we clocked Spartan at around 3 minutes to generate a proof uh which maybe we were doing something wrong but even even if it was a minute you know that's that's tough to swallow um so uh and not not only that there's also already a large overhead of a public

parameters file we need to download that would double uh cuz the verifying key is around the same size so uh and and one other thing is that uh not necessarily applicable to this application but in a lot of cool ways to use this scheme um it would actually break the iidc to uh wrap it in the final zero knowledge proof so if you wanted to continue to build uh proofs later you can't really do this so uh before I explain that uh one one other interesting thing uh as enrio mentioned is that uh PSI uh FH requires uh zero knowledge proofs uh of the correctness of the inputs um as I understand it the inputs each are are

one proof so what we could potentially do in uh or considering exploring in the future is actually folding all of these proofs of correctness reach each of the inputs together and and just having a single proof instead of having to do a ton of different proofs to do this so going back to the decision to skip out on uh traditional zero knowledge um we actually have uh proposed with uh it coming from mostly uh Barry White hat but us doing a lot of the work and actually um messing around with it uh something that we're calling a cha step uh and so essentially I'm I'm not going to go into all the specifics

but uh every single fold is basically taking the current witness that you're trying to fold in as well as some sort of accumulation of all the previous Witnesses um and if we wanted to pass folds between different clients or we wanted to rely on Final folding proof for some reason that's very unsafe so the solution is that we are going to mutate our circuit a little bit to actually include a chap step and all we're doing here is basically just putting in random data so in in circom what this looks like is we just have a multiplexer which checks if it's a chaff step and if it is a cha step all the constraints that we're doing are just

kind of ignored um and all the computation is still done so we're still getting all of that random witness data uh but functionally uh we result in uh this proof that has a witness a running witness that is pretty difficult if not impossible to meaningfully extract any sort of data from uh and and this is a little experimental um we have talked to a lot of people uh a lot more familiar with folding than ourselves and and no one yet has said no you can't do this but we're not sure yet so you know if you have the ability to offer a contrary opinion or even contest what we're saying here that would be uh very

valuable so um but consequentially uh why would you do this uh first off again let's say we wanted to retain the IVC property and continue building we can pass proofs between different clients by doing a cha step every single time and that means that even if they know even previous Witnesses they're going to have a very hard time actually figuring out what you did in your iteration of the circuit uh we can also um use the uh correctness of like the fold the folding proof itself uh instead of an ual zkp to verify uh our actual computation and this is still succinct it's not necessarily as fast as

the actual zkp but there are a lot of other places where it makes it a lot more expedient which might make it worth it and finally uh you could even potentially let's say you really don't want to deal with Spartan but you still want it uh you could use this chap step to uh maybe send it out to an untrusted third party who has a lot more computational resources uh and verify it there without uh worrying about them extracting any witness information so from here on out it's mostly just kind of focused on the actual application Level um Nova Scotia is driven by rust so you uh will need to wasen pack all your code uh which is really pretty easy with the library

there's there's really no issues there uh it also is uh totally compatible with wasen ven Ron which is super useful it's basically multi-threading using web workers uh and will make your proof at least twice as quick um and uh another really obvious uh and intuitive but important thing to think about is that uh the prams file is pretty huge so you can just junk it up and compress it and download that a lot quicker um and finally uh we wanted to kind of Hide Away uh the actual cost of proving from the user so uh what we did is is we used various uh different web workers to uh make it either go in parallel so in the

case of like verifying the proofs uh there are a couple of proofs and it's all done at the same time uh or uh maybe more importantly is that as this app is going in the background you constantly running uh folding proofs as you get more signatures in a synchronously so it's totally possible that you'll get to the end of the app and not have done it all um and in which case you are going to be sitting there but depending on how much time your user is actually spending in your app you can get away with hiding a lot of the pain of proving just by putting it underneath so the conclusions um some good some bad um first off uh there's

definitely a high overhead on the data uh there's this huge prams file and this caused definitely some issues with uh accessibility during Z Summit with uh limited Wi-Fi and a ton of people trying to hit the wi-fi at the same time it wasn't perfect um and uh while you're definitely going to get some really quick speeds on you know any M series Mac or something like that um poor devices this computer for instance takes uh like 10 seconds uh it kind of sucks um mobile devices are not great uh takes longer than 2 seconds um but on the other hand uh We've also kind of demonstrated that we can recur with privacy potentially between multiple

clients uh and we can do this with Nova which is uh pretty primitive in the grand scheme of things and we'll get a lot better with other uh folding schemes uh We've demonstrated that we can hide away a lot of the cost of proving just by stuffing in web workers um and yeah uh again this this is uh pretty easy to um again so I guess I would say that the the the window of uh like tapping and then kind of closing the foam doesn't present a huge opportunity for proving a ton of operations in the background but for instance if this was a web app it would be uh likely that you would get

through pretty much everything in the background uh especially if you're not closing the tab or you have something else that you're going into uh your user would probably never notice this so before I go into uh the ending thoughts um again this computer's kind of trash so I recorded this on MacBook uh you're also totally able to go do this on your phone which I'll talk about in a second but I'm just going to run through um so yeah it's just going through sequentially uh each one of these is a a membership circuit this one's taking a little bit um it'll just go through fold one membership fold two memberships F

three memberships uh and members ships um I'm not going to go through all of it uh get through all of your different proofs that you have uh and eventually you're going to post these proofs um right now Nova Scotia doesn't go on chain but I will talk about uh cycle fold in the second um and yeah you can just verify it uh the work is pretty similar for the verifier and the approver honestly it's still synct again because you're combining a lot of this uh but it's not instant takes a second um yeah so if you haven't if you have the app and you haven't tried to make a

proof yet uh you can go into the app go to proofs and there's a giant Banner right there that you can use uh and yeah it will take a second cuz you're proving everything from the start potentially um but yeah definitely worth trying out um the big thing that we're really exploring here is the tra steps uh if those end up being a valid way to construct iidc uh with privacy uh we think that that's going to unlock a lot of use cases where um you're kind of recursing between different clients uh and finally uh this again this is all done with Nova Scotia which is a fantastic library but it isn't quite state-ofthe-art at this point um

psse has um I think they just renamed it it used to be folding schemes um but they have a folding Repository that has a circum front end that is like a day away from being merged in and it also has a solidity verifier which is a little bit further out but uh gives a lot more functionality so uh if you are interested in messing around with folding uh it's only getting easier and easier to use so it's definitely worth exploring um especially in the coming month so yeah that's that's it [Applause] any questions yes um do you think it

would be worth while to explore using webgl to probably yeah uh this was built on a very short time frame um like a week maybe a little more so uh I guess we did the circuits earlier but the rest of it the actual implementation uh was all in a week so I think that that would be very worthwhile uh and ever okay I'd love to talk to about all right we'll definitely follow up cool no okay question what kind of homogen is needed between the different like can we extend chap steps to do more to add more

different types of competion do they all have to have uh they do have to have uh some kind of they they have to be the same shape like uh at least in Nova um I think that there are other ones that allow you to do different shapes um I don't know if that's CCS or what but uh specifically with this you have to uh have the same kind of circuit so if you want different things that you're doing you're basically using a multiplex or Computing all of it and choosing the signal you want but this is only with Nova and I I think in um later schemes you probably could do what you want to do cool let's give a second round of

applause to Jack [Applause]