Learn Noir in an Afternoon

Transcript

Cool. So yeah, learn in not really afternoon mornings. Yeah. Um yeah. So you're actually not learning in a room. Okay. Can learn one morning in one means get our money back. Uh I mean to be here uh so yeah learn in one minute it's just one the the preposition here. So basically this is like teacher in hackathon they're like hey you know rest

and yeah you also need to say you are you can do it but that's right cool thank you see you tomorrow. Okay. But if I if you don't know Rust, then you're like, um, well, no, great thing. I didn't know Rust, so I had to I had to learn more and ask. But basically, this is it. Like it's mostly a mental model. Like it's not necessarily the language. It's not that hard. Like languages are easy. You just ask Chipdr you have no program. It's more about like what you're trying to do. Um, yeah. So can they be exactly the same?

Not really the some small things but again the front end is not the problem. The problem is the mental model. So let's go with the agenda like I'm first I'm going to rant for one hour about how ZKVMs are on Z that and then just talking about ZK for ZK's and then why why like why why do we talk about N so much if our business is on like if we're trying to deliver blockchain why the [ __ ] so why do we why do why do we talk was not so much.

Um, and then yeah, just uh just as a at the end like last 10 minutes we're going to solve global piece and half. But that's the afternoon one, right? Yeah. In so they sort of encountered in the hour you get a full hour for the rest and then an extra 10 minutes of global piece. Yeah. Yeah. Yeah. That's basically so for the case. Uh if you're like me, you don't know anything. So um basically Yeah. moment. Let's just let's just uh go through some of I'm going to explain ZK for you, right? It's very simple. You don't know ZK not going to be a problem.

Just stuck with the basics like you get this equation. No problem, right? You can I think I think people can see what this is like probably. So if you're following you're like oh yeah yeah definitely I'm definitely following this then you can very easily observe that this is also true and that's the problem like you you get most of the most of the ZK the papers are like that oh you cannot you start reading like oh I can get this and then suddenly it's like pinch him out and it's been nice that's when you give

Um so I'm doing this to you so you still how how it was for us for the last eight years to uh understand z because you you could actually write the circuits like bare bones they are basically circuits like you can you can do like circum stuff like can connect wires and everything um this is what we did after after some time it's like um but then you get like this guy like you actually don't not where it's just so much stuff when when you deal with things at the bit level. Um so that's why we came up with noir. So noir is meant to just abstract all the so yeah you know how resources are like they

they always want to show that they they like the math we create are totally not like that we we hide the math like that's that's the point of just hide everything just expose uh easy an easy language. Yeah. So like programming in general like it's quick pretty quick to pick up where bottlenecks and so forth so forth are but when there's a load of mathematical abstraction underneath. So things that are simple in normal you know I read arithmetic yeah and which look simple and and then simple in your code might actually be really complex under that is there any way to like uh see through to see like whether what

you're doing is like hugely wasteful for example um yes there is a way like when you compile into circuit you get the you get the the which has all the op codes and you could actually see which one of them will do in the back end and you can actually optimize them very well with with that. So there there's definitely I'll talk a bit about that in a in a second about how just being easy doesn't mean it's going to always be efficient. If you ask an art devel team developer, I had once a discussion with one of them and he was like, "No, it always has to be the most efficient even if you write shitty code." And I was like, and that's a nice way to see it. That's not true. Like if you write shitty code, like it's just

like any other programming language. You can't expect the the compiler to always have your back and make it as efficient as possible. If you write shitty code, you're going to have shitty like shitty uh execution. and similar. So, um yeah, there's definitely a way where you can go into the depths of it and try to optimize it on the back end. Yeah. So yeah like if you see the big numbers for example, that's a quote, you can barely understand what what's it what's on the like it it is but the guy just rose really really goes at the uh the most optimized way of doing things because he knows how the math works behind. So that's why he he wrote a very very

efficient no big non library and yeah so yeah why uh so zk is cool oh not telescope uh telescope is cool um the case is cool uh you can um you can well we were here because we like CJ we want we are interested in knowing how can you prove big competitions using a small proof or how to how do you prove big competition in a small proof and retain some of the privacy and large sign in um but um it's also hard like um yeah we get this circuits thing we're trying to

kind of reframe circuits into programs um I get the idea of circuits dice but in the end because you could actually think of them as like a circuits and quantum quantum computing also This is so amazing. Um, so we can Yeah, we did we did something better. Uh, Kev, which is the the original gangster for for now is like, yeah, Rust is cool. Even though he's a Python guy, he was like, I like R. So he he just copies us. Um, then not after three years, almost like three years, I would say. Um, yeah, it's really cool. Now we're Yeah. um it's almost like magic and I'll show you. So

NAR is the def facto ZKBSO uh the specific language now it's not like I could I couldn't say this a year ago for sure it wasn't now it is so just being honest you like uh no one in their right mind will do any ZK for privacy using other language because there was there's only like two or three more there's definitely like the risk five everything but those are not zero knowledge. They're not privacy. They're just execution, which is cool, but it's not really the same thing I've so you want something that is fast. You want something that is powerful

and has actually quite kind of go usability of the things that is cool. Just some examples of how easy it is like just a simple guessing game. I'm thinking of the number I I will prove it you didn't guess by number this little example you define the inputs you decide which ones are public because privacy is normal. So you only only care about the private in the public inputs. to say which one to upload. Um, and then you use this assert which is probably one of the small differences between and rest because rest doesn't have this keyword

assert. Uh, assert will just do that. Just the circ which asserts that X is different from Y. Um, so the verifier will only know Y. They will never know X. they they don't need Y to verify the circuit but they they won't need or they they they can just text them and they can know yes if they text um a pre-image knowledge proof this is um proving that you know a password without revealing which password it is so actually you would use pose hash this not hash is more optimized uh recently um but yeah you I'm thinking of a password I can disclose what's the hash

of the password right like it's a hash everyone can know it's not at all so you can put your hash on change yeah um and basically what you have is in the zero knowledge program you are proving that if if I if I was to hash my password it would be the same as the hash of the non hash uh but I do that without revealing what the password is so it's kind of black magic thing is that's that's the magic that's the alien thing of of you can prove something without actually you can prove that hashing hasher will go to a will first represent a public hasher hash without uh relaying the

actual payment then it's a seven for which is a a primitive let's call it primitive it's like proving that you are a member of the real human group and I'm saying real human because that's exactly what world ID does. They they have a number of humans in a semfort. Um semaphore is a merkel tree and basically you can prove that you are one association of the merkel tree without revealing who you are. So if you don't want know don't know what a Merkel tree is just a tree like you have one it's a you have a bunch of leaves would be the identities and basically you hash two of the leaves and then it hash two of the hashes and so on until get to a root and

basically what you can do with is proving that you are in this tree without revealing who you are it's prove that you are there that's the that's the principle of of sem um supreme as a UF PSC team is building sim for contributors to that. But thanks, but is it fast? Like that's that's like I always get triggered by that because like I don't even know and I don't care like if it's fast. Most of the times it is faster than most alternatives but I don't care. I'm going to tell you why.

Um first as it depends on the back end. So it if you use a GR 16 back end there is no reason why it wouldn't be faster like it grass 16 is faster than what so if that makes the difference for you then go ahead like again world ID they use grass 16 because they want something that's fast and it's cheap to verify on chain so they can use it they still use no they just use a different package yeah so that they come with different different trade-offs for example no is universal you you don't have to have um uh if you use a a plunk uh turn this off. Um if you if you you

don't have to use um if you use a plunk plunkish like paratenber uh back end you only have one trusted setup for all the circuits that you may want. With world ID they use 16. So they actually have to have one trusted setup for that specific setup. If the changes are good, they have to do another trusted which is a pain but that's fine for them. Can you zoom out a little bit on how you'd like plug in different brackets as improvements? I'll show you in a second what level do.

Yeah, I I'll show you. This is what what I meant like your program the way you code it. It definitely depends like if you if you if you code it if you know what's going on in the back end then you can improve it. So that depends on the speed as well. Then finally it's like you girl do you really care because yes you can you I mean for example for semord you if you have different trees for different depths like different number of members in your tree it lives in your in your tree you actually don't know that and when you know it it's then you're going to download um a specific verification

key for that specific circuit. This could be like it could be from 14 to 80 300 megs at like on your phone, you're waiting, you're not even doing anything. You're just waiting for it to download 300 megs. Is that good enough? Probably not. So and exit for example with ZK passport they use noir because they use barenbury they use noir because there is there is a hund there is a ton of different passwords in the world different different codes different different hashes uh different signature types. So you would would actually scan your like scan your passport and then wait until it downloads that specific verification

key depending on what passport you have kind of a pain right maybe you don't care about it being fast you care about it being usual so yeah actually nobody cares like it's um most most of us don't care okay I'm not saying that 16 you shouldn't use it you should definitely use 16 if you care about speed if speed um big deal for you but you get all the trade-off as well. Um actually so the the easiest way of using go 16 is probably not even using mark it's maybe circums probably the best best choice but again you can use you can use your go 16 back end inval you can you can say sh that's the wrong

sure no problem soon so it's us only usabled yeah the this idea of like abstract racting uh complex circuits into code is not even new. This I mean you have punch cards and people I mean you could actually go and code in machine machine code. Nobody does that like everyone abstracts that way into a language that actually compiles a different machine machine code depending on the CPU you have. So it's not even new everyone has been doing this forever forever right. Um yeah talking about 16. Yeah, definitely if you want to assume that's in it could be usable for

you but most well most of the times you would like backend that works for everything. Oh. Uh, yeah. The gas thing which is like some people are like, "Yeah, you should use ultra honk like which is the latest iteration of the Bretonberg prover." Um, if you use ultra honk, it will take 1.2 million or 1.5 million gas to verify. Yeah, sure. Definitely with go 16 you can get 300k. Are you paying source? 300k gas on layer one totally not like nobody does that in um and then it's the mobile uh usability

thing. This is a big deal that most of the traffic is on mobile. So you want something like ZK password you scan and then you do the proof on your device as the transactions will be done on mobile phones because otherwise if the if if your private needs to go to a server somewhere it's not private anymore. So it needs to be accommodation needs to be done on your on your device and so yeah you want something that is mobile friendly can be used on mobiles. Cool. Achieving bubble piece in afternoon. Yeah, I'm going to skip that for that another day. Just kidding. Um, yeah, but it could be done.

So, let's uh J is going to be very easy. Just going to see some moduling, install some tooling, then writing some code, and then proving it and showing it like maybe Remix, something like that. Cool. So the norm score if I join the discord this is the um documentation website no online we don't have a website have and this is the workshop resources you can scan this QR code or just visit link tree and uh you're going to find under resources um yeah This is where you're going to land.

Here you have two things. One is the code space. So if you don't want to install anything locally, you can actually use code space and this will go will lead you to a a code space uh which is like a a VS code session that runs on the cloud that already has no BP. So you can skip the first part of the workshop because that's already installed. If you want to install stuff locally, you can use this cheat sheet which will click here and I'm going to tell you or give you code space if you want and then manually you have these two commands you could copy this and I'm going to run them with you. So yeah, just just feel

free. Uh any questions so far? Cool. Just trust me, bro. What are we installing with Nago? Sorry. What are we installing with Nago? Probably with Nago is you know cargo for Rust. Anago is like the packet manager and the runner for um running the first command will install you in our okay so it's just like you have rust up uh which installs rest or in this case it go install cargo

nup will install nargo okay so after running you after downloading app you just run up and the ver the cool thing is that you can easily change between versions with no you can you can put /v and then put the version that you want you can leave it just just nothing and install the latest in okay latest stable version which should be no version 1.0.0/ba6 Z / beta.6. So yeah, we're getting we're like open AI level naming you know like P three call three plus pi guess things are a bit slow here it will

so your narrow will uh let you run tests uh run compiles execute generate witness stuff like this after this after installing you can go up And it should tell you what's the latest version that you have installed which I said would be 1.0.0/b better.6 after this you need a back end because as I said n is just a front end it will compile it will test it will do some things but it won't actually prove and you want to prove but so to prove you need a back end. Uh so for this case we'll obviously install Baratimer which

is I guess the only usable prover except for the MD one that I actually never tried it. Um and also the one that powers Aztec. So B is the C of the the brains of Aztec. Everything is done client side is done with so for that you install the second command. This would be here. Copy it. And this will install bbup. So same thing as nor installs nargo. BB up installs B. BB stands for Per.

So after installing just the same as you did with N you run BB up. BB up will get the latest NO version that you have and install the correct backup for that. So it will match already because they can sometimes mismatch but be will take care of that. So we'll say yes. The version for this version of M the best version is Burn version 84. So it install version 84. Sorry. Could you show the reper again? It's not an L tree.

Um it's like ch is that that's Yeah, it's go to the chit. Okay. There's instruction in the one. Okay. As just one. Yeah. And there's like installing manually. You can use the code space. And if you use code space, you should already have open up and BB up. Uh you could just run them. Um so yeah, DB it's still downloading 16%. So, okay, this is just running and we can get keep going because we only need PDF

now in horror. Cool. So, there's the commands that we're going to be using as well. So, if you if you get lost at some point, you can always use this um just like we walk through the next block because I did that and it just uh uh you mean this it doesn't create valid code and jump. Sorry. So when I uh did not go execute the value passed for X is invalid. You need to fill in the values. Yeah. I mean it's meant to be mostly if you lose part of the workshop you can always use those commands just also for me because sometimes I forget.

So cool. So nargo yeah get ngo version. If you just run an argo, it will tell you which community do it has. 20. And so the ones that I actually care now it's new. I'm going new pass the name will be workshop and the name of the folder that you it will create workshop. So here we have it's just some um some examples I have to show you afterwards. And so this is the default project and the default project is actually I don't know if you can see it. Yeah. with this post um screen. Um the default project is actually the this guessing game I was I was telling you about right have an X

have an I Y is going to be public so I do know X is private. Yeah you're you you're asking like oh what if I can just change X when I prove that you didn't get my number. Of course, this is just an example which not meant to be production ready. So I'm going to CD into that and let's run this Naro test so I can show you couple is so narrow test actually if you installed the narrow extension extension I think it will prompt you and say you already installed the nar extension otherwise you can go into the extensions and just uh search for uh but if you have it then it will

basically like you you have this little thing that you can run just as test or different tests if you So you can have your own actual test suite. You can actually have a test suite that is meant to be to fail. So it's just create a test that is meant to be fail to fail. It's just like test should fail. And actually actually I can like copy this whole thing and just make it supposed to supposed to f test. Uh I can do like what happens if Oh if what happens if one is equal to one it should fail right like my circuit is proving that X is different from Y. So if I my inputs are the same then it

should fail. So I can actually run test both of tests fail. Can you make it fail and commenting the test fail like because then it's not working for me. We may just make it fail. You should pause. Oh, it just failed. Yeah, one f you guys got something wrong because that's passing for me. I have some clues. That's weird. But yeah, I don't care what to every single one of us and take care. So yeah. Okay, but this is our just this is to something to test something real quick without having to change. If they have going to the back end, this will be much faster than actually proving every

single thing. If you want to actually have something that is able to be proven, you want two things. First one is you want the intermediate representation because this is just code and just as you can just put C++ code into a machine, it won't know what it is. You need to compile it. But here it's just the same thing. you need to compile it into a a representation that the back end can understand. So wow. So you do that by running n compile. Okay. And now we'll compile create a target folder in this case and we'll show you this less uh JSON uh trying to get it to pred

which just tells the back end which nor version it is list and then there's just an AI and say oh the B code represents this and this and this and this. Um just like in Ethereum you have like channel by code and then you have an API to to tell the to tell the interpreter how which how how how big is each of the fields of it. So and I don't have the bite code which is the actual the base 64 encoder stuff which is basically obsc. So you could you could have some fun decoding this if you want. So it's in the control shift P menu by format document. Sorry to format the JSON.

Uh yeah, I think it should like JSON format. Um format document. Yeah, I think for shift I sh for not for document. Oh, there are multiple. Okay. Yeah, no problems. You got this. You don't actually have to look at this. I'm just show showing you how does it how how does the thing work in behind the scenes. What you want now is to prove. So to prove so I said that it took to in order to um send this to the back end one two thing. The first is the compiled circuits. So again the back end can understand it and the second one is the witness. Witness is something that you always need in any ZK language

like witness is absolutely necessary. Witness is the solution of your server. you basically it you're it's it's the it's saying yeah I know what are the inputs that will make this thing solve it's like you can think of an equation right it's the uh the witness will be like the paths that you need to go in order to get to the to the end of the equation so to generate the witness first we're going to go with a check so it creates a new nice uh proofer tommo the witnesses uh required to generate a proof approach. Yeah. Yeah. In every ZK project, you need the Windows it's just a solution of of the the program.

Mhm. So in this case our program by running argo check it will create this provert file and this is where you're going to put the inputs that you'll use to you'll be using to prove. So the verifier doesn't know this. Okay. This is just on your machine. Okay, you can later even remove all this just to show you. So, so to prove my inputs to my circuit for my proof are going to be one and two because it needs to be different otherwise it will happen. Oh yeah. So now what I want is to go and go execute.

So narrow executor will execute the circuit and generate the witness and that's it. Like the witness is here. It's unreadable because it's it's compressed. But yeah, here's the witness. This is what you're going to feed into the background. So two things, the circuit and the witness. They serve different purposes. The circuit is just for the back end to understand what it needs to prove and the witness is for the for the prover to say I know the solution. I'm just gonna prove it. And this file name that's hardwired in Nago is it the sorry the file name that's just how do we call it forgo?

Yeah. Yeah. uh you can use then use the JS uh so there's a workshop later on I think at the end of the day when it's on the open and he's going to show you how to use this in JS in the browser u which is more interesting but yeah just showing you basically the basics of R and then in the front end or back end whatever on the browser just it's the same thing same concept so we have some knowledge on that very Um, so at this point I hope BB has installed.

Okay. Hope I have it installed. You have BB goes. So you should have BB version itself. Now it will tell you what version is this case. That's fine. That's number one. Version 84. Good. Cool. So we're ready to use the back end in this case. So this is where you would say now it's just not not okay. So do you this is where do I have the choice of blood here the same different way I don't see where BB is specified.

Um you sorry I don't see where BB is specified as a quiz. um it's a different binary so you just install it and it's completely different. So let's say you want to use a a world the world uh let's say that the world ID uh proverb is called world for example. So this is also would be like a binary completely different thing but in this file structure which is like a project for this wormshock and see where I had chosen. Yeah but if I install two, how do they know which one to use? For example, um you just use the priority that you want. And if you if there's a there are

two different backends at this point, you can choose which one you want to use. Yeah, what we're saying is in which file or whatever would I choose which one I'm using? Where is that command? I see how we have to I don't I don't get it. You can hear it. We have different I think I I think like this code piles to check an acres and then the back ends know how to read Okay.

So, whatever it was only like that No, this is the worst thing. I don't see Tom. It says that just to check and get back, right? But if again I can see that is that folder within

already folder. Do you have any in projects? No. in the solar tower not so good and can you go now is the same create a witness. Oh yes. And now we can Is it Is it even code space or the code?

Can you try code space just Yeah, sure. So you can follow just Can we go? Can I engineer? So now we have the winners. We have we need a proof, right? This is where we enter with the back end. Is that clear about the back end about the Yeah. So because you're running a particular binary to prove.

Yes. Which we haven't done yet. That's why we haven't done yet. But so we install it. It's BB. The BB binary is the back end. So we chose to use that one. It is none. So cool. In order to do that, we just go with BB. So BB is pretty easy actually. You go BB approved and actually sync here. So can I go over each one of them? So it's easy to standard here. So BB it's still binary. So you can actually go BB help or BB help and see everything that you can do with BB.

uh in this case what I want is to close so barenberg proof this circuit so I'm pointing to the binary that's why it's slashb from binary byte code not by code I'm pointing to that by code which is within target self not probably use actually self drop workshop but and then target workshop. Okay, this is the witness as I said the back end is to know both what it's proving and what is the solution what it's building is then I'm pointing to /

which is says where I want the proof to be which is going to be / targets I want the same folder as as this one target and then I want for this particular case because we're going to be doing this in solidity I want output to be format bytes and fields and there's different output formats bytes and fields is just like it creates um for the proof it will generate another another uh file with just the public output public input which is cool for for DC verification because by default Brightonberg actually appends the public inputs to the proof which is can be a little confusing but

no problem right and then I'm going to pass the oracle hash which going to be hijack you're like why what is this orable hash it's just the way that you generate the the the what was it the w hash and in this case you want it to be kak because I'm going to verify this on ethereum and ethereum is more optimized for kak hashes then if you just don't pass oracle hash it will just proide which is nice for zk for like verifying within another circuit for example um but not really very interesting for solid verification and so the oracle hash is a hash of the code that the group is running

I I don't know exactly what is the oracle hash and honest uh but yeah so you want kak because it's the most efficient for you in this case again really depends on what you're trying to do so now I'm going to go with this is just because the smart contract like a smart contract that will toify that's also not a strict requirement like as most no will not use the kak for sure because kak is the worst thing possible for for zir it's just it's just bad because it's use a ton of multip multiplications which are quite

expensive in general so you want to avoid that so yeah as I could not use track will avoid could type like like the devil was as exclusive to them or were it also ASC is just its own chain so we could we could choose to use whatever uh primitives are most efficient yeah so we use like um signatures over the M254 and we use like hashes so we try it's like it's our own execution like we can use the best for for for our devices okay in this case the best for your device is to use something that's sticky friendly So we we just try to use this. Yeah, there will be kak cautious on on a you

can use kach cautious and in and markets too expensive to make s. Yeah. Okay. Um so this is where everyone goes crazy a lot like how is like it's in this case it's a very simple circuit so of course it's fast but if you have a big circuit this could take a while. I have a question. I actually get an error like I said I did import is not large enough. Uh maybe you're not putting the correct um so you need to point to to the correct JSON and uh and weight loss. I'm pretty sure that you say that it's not large enough. It's not error message.

Yeah. When you target and just paste on it and yeah. So now you should have a proof. You have because we chose to have three as bytes and fields cubes. You actually have four for um have proof as byes then proof as fields and then as bites and okay was there okay? So we check now we have now we have a proof. Let's imagine that I I'm Pedro.

That's my name. I was I was think of the number one and Alice is think number two. And I want to prove that when she says your number is so I'll send you a [ __ ] basically. So what you I want to say that you failed. I want to tell her like that she fell but my number is actually one. Uh so let's imagine that I am no Alice just like I can put my collection can put my code there. Nice and I'm now another person. So if I'm another person I actually only have the truth right mean. So I'm going to delete everything else.

If I am Alice I try to guess that the number is two and Pedro this guy told me I fell. I want to verify that what he's claiming is true. So I'm deleting Google. I would I wouldn't have this, right? I wouldn't have any of this. I wouldn't have the witness. So you said Pedro knows you failed. But yes. So if I'm Alice, I I try to guess the number. I said you can two. So Pedro says to Alice, you failed. Yes. Okay. Pedro says, "Yeah, you failed. My number was actually not two." And yours proof.

Okay. So So what Alice has is just a proof and both people. So actually Alice also doesn't have the the compiled circuit and only only thing that Alice has is this is the circuit itself but you can actually serve the compile circuit. there's no problem. There's no information. Most most problems, especially on the web, they also need to come back to that uh quickly. The the proof here would just show like I'm not really into ZK so the proof would just show that the the inputs one and two from the basically from the prover.

Mhm. That that they're not equal. Yes. That's all. without revealing without revealing one but like what numbers yes only revealing the public inputs which yeah fine in this case would be two but the number Pedro was thinking is not leaked it's private but so the Y is then public yeah the Y is public at least we've chosen it to be public okay yes um so as Alice I don't know anything I I'm no Alice I'm going to open a new terminal and I'm going to compile this.

I know the circuit circuit needs to be the same. So I'm going to compile it. I will compile. So all good. I have the w I have the the thing here. I don't need the witness to verifies. But what I want to do is now prove that uh verify this proof, right? verify that my guess was fast or verify that Pedas claimed that my guess was wrong. So I need the verification key and you can derive the verification key just from the circuit the compile. So I'm going to write write DK which is um here I have it filled down and I say I'm going to write the

verification key for this circuit. So only thing I need for this is the the compiled segment. So I can I just compile it. I have this workshop.json which doesn't reveal anything about the private input. So as Alice, I've never seen the number at I will never see it. So I'm pointing to this uh JSON. I'm also uh specifying the real hash because I need to delete and then pointing where I want the verification key to be written.

verification key is very important because otherwise I can just blindly verify it because it's proof because I need to know what I'm verifying. So it's necessary. That's why it's a key and you don't again you don't need the public input. So you don't need you don't need anything to generate the notification key. It's unique to each surfing. If I change the ser if I change anything your notification key would be different. You can but is it unique on each run each? No it's each time I do write it as a yes it's the same and you think of of it as a sort of kind of almost like a signature of the ser. So I know exactly that the proof I'm verifying is from this

circuit. Right? This is necessary, right? So if two circuits have the same BK, then they're equivalent. But yes, they have the same DK, they are the same. You have to use the same compiler version to Yeah, the same use the same and we we've been like no compiler has been changing very clean. So yeah, I don't Yeah, same version. But but I same keys. That's one that's the reason why the JSON comes with another version. So you you are sure to use the same at least you can be sure I don't know if it fail maybe maybe it fails if you use a different PB that I don't know oh no it doesn't so you're saying two equivalent secrets could have a different key but not yeah the things

they they could have depending on the the version is by equivalent circuits I mean they're just doing the same checks like kind of the equivalent program there so yeah there's there's this uh some intended well sub intended idea that you have um the same compiler version. So now I'm going to go BB verify I need to specify this key I don't need to be to specify the scheme so I need to by default it's going to be ultra and I'm going to verify the proof. So I'm going to verify um direct I don't think this will pass it probably will

need makes the should need the proof it's yeah stupid slashp that's fine it just assumes that proof is in this folder but I'm going to target proof and it like proof is verified and that's basically it now you're like what if I want to put this in a solid contract. So there is no interaction between Alice and Pedro and I can just put and I have a circuit that that says um yeah just verify this proof on uh Pedro can actually send this to a smart contract doesn't need to to verify the circuit. So you can do

that by generating BB right solidity verifier. So uh I'm just specify all contract but you can actually also specify the key the notification key and you can also specify the witness. It just assumes that everything is in the target folder. But I can go verification key and say um target BK and then I can go wait to find the B code and say also target workshop. Yeah, JS no problem.

Yeah right. Oh, some the workshop was not displayed. Yeah, I need to. So yeah, now I have a a soy control. I can deploy this today. So I can go on Red side. So I'm moving a bit faster because I'm going kick getting kicked out. So when when it started post 12:15 Oh, okay. So we're at Sorry. Yeah, we're basically I got a little time after cuz it's lunch after mine. So like super step it up.

Be faster. So this could create an empty project. 10 minutes get quicker to this and create the whatever so it's on take this so the contract going to copy it and you you would use this in how to usually regret going to compile this going to put some optimization here so it's so much paragraph then I'm going to deploy this you administ uh which one all these are libraries I just know that the only one that is not is this comp and deploy this contract

and you see it asks me for the proof and the book inputs so as you can see no privacy leak here I'm going to take the proof proof is here it's kind of hard to read so I'm going to there's a there's an shield there the proof feels yeah but those fields. That's a no it's a different decoding. So in the [ __ ] sheet there's actually a nice way to get the proof here. This will give me the proof in a in some which is what contracts.

Uh this could actually be nicer than is I think we can just buy crypto sleep copy. Yeah. Yeah. I'm just yeah I'm just copying manually like old school old school copy. Yes. So in Rubik I go just put the put here I think it's a zero weight at the beginning and then both inputs and uh I have it here see so nice just can copy h that's why I use this uh proof of equally. So is it like I should call it and this should work. Yeah it did. Nice.

So I can see here like this thing actually. You see that I wasted like 1.7 million guys using you can we can get this down at some point. Um but yeah, basically I'm what I'm doing here is like I'm proving to a smart contract that um and that yeah that the so this I am proving that someone else failed to cast final does the gas cost scale badly if you do something more complex so the baseline is high it's baseline is about this if you add public inputs then it get slightly more expens so it really depends We call

honey because it's just the call data that we need to pass into the contract but is going to be about this. We're going to optimize this at some point like to be less than one million guys at least. Yeah. So mostly scales we call day. Yeah. Well, the long is very we don't care too much about the cost of the the gas cost at this point because um yeah we yeah we care mostly about about um Aztec and Aztec will be very expensive but there's only one proof that will go into a so and that proof will contain thousands of transactions so it's like not really something that we care too

much about right now but yes maybe later we're going the masters or the box has been ethereum ethereum usage which is not the main usage for now. If I was caring about gas if you're sending the call data rather than the actual circuit size or uh call it the secret really tiny it's mostly about the execution execution. So you rather use another L2 or another back end. I would say if it's a big deal, I'll go to one of the other stuff. It's very cheapification on SL using Gaga.

Um so yeah, you can go into the L condition. I'm using for G for for stock very cheap. That's a good sol. I should start using this examples any stuff in this foot. No. Oh, thanks. Thank you.