Learn Noir in an Afternoon (or Your Money Back)

Transcript

Uh, I don't know if I should start. Can I start? Yeah, cool. Hey, how are you doing? Nice to see. Nice to see you all. It's been great. I've been learning a even though it's just the first day. Um, yeah, I actually don't know much about what I'm doing here. So, yeah, that's it. Uh, I'm just kidding. I'll just be reading docs and using AI and basically proving that you can do that as well and just be here the same thing. Um but but I I'll still I'll still start with a bit a bit of a presentation of what I've learned and what can you do with m and yeah how can you learn it in an

afternoon even if you're alone and kind of stretching the concept of an afternoon anyway um I will I was thinking I see that there's questions so maybe the best way is if I take questions after I did do this little present presentation and then you can ask questions at any time because this is a long workshop. So you just feel free to interrupt me and say I don't follow I've been getting this error or anything like that. So if this was a round table I'll just go around the table to try to help you if you want to follow along. We have enough time for that. So so yeah.

Yeah. You didn't pay to be here so I'm not going to give your money back. Sorry. Um that's first thing I need to say this for legal reason. I'm kidding. Um but you're going to learn why in one minute actually. So it's not you don't even need um an afternoon for this. Um yeah, of course. Um so basically it's this like you have these two people are like in a um like is it Grock did this? Yeah. um you know hackathon or something and one of them is like you you know rust and the other one says yeah yeah of course he needs to say that he uses arch because I mean that's uh you need to say that if you use arch and yeah just just

write rest and that's it that that's it okay see you thank you uh tomorrow it's a nice day okay no okay but if you don't know rest which is my case actually I I covered very little in rest then you're like okay Um but again if you know it's basically going to be the same thing. You just need to understand the concept of a zero knowledge proof and then everything else is basically the same syntax. If you don't know Rust then just stay around. Um but you're like it can't really be the same right?

So well I'll I'll tell you that indeed it can be the same thing. Um, so first I'm going to start by talking about how ZKVMs aren't ZKVMs. No, I'm kidding. No, I can't I can't do that. No, I I'll be triggered. Um, I'm going to talk about zero knowledge for zero knowledge for privacy. Um, which is quite the big deal. Yeah. And uh then like why do we keep saying like noir? I mean there was like two three talks in this event that seen and why is this such a big deal and then I just easily just achieving

global peace in an afternoon which is also very easy to do and yeah that's it let's start with zero knowledge for pure knowledgers like me and yeah so it's very simple right I I hope you're ready let's Just start with the basics. Here's a little equation. Okay, I I hope you're following this, right? It's very simple, right? Okay, we're like, yeah, good. I I can get this.

So now it's simple, right? Now it's you just need to observe that this is I mean, right? Okay. uh and this is this is a problem in ZK. It's like everyone every single paper starts with oh this is this little equation and everyone is like oh cool I can understand this and then immediately starts immediately goes into PhD PhD level maths and if you're just want to build something you're going to have a bad time and so why am I doing this to you and the reason is because I've tested it we've tested this at at Aztec

since we've been working with ZK Okay. For eight years. So yes, we we were there six. Oh, this slide is is old because it's eight years ago now. And you can actually like you can write your constraint system just using math. Just go write C++ and yeah do it. Um but then people started saying yeah I mean it could be a little bit easier. There could be this kind of circuits so they can understand. So they design zero knowledge um programs as kind of what what we still call circuits these days.

Um but then they become like this like it's a huge mess. It's programs are enormous ex are basically dealing with stuff at the bite at the bit level and yeah sometimes you're like where is my exorgate in with all this mess and and so that's when we we started to think about programs not necessarily circuits pro programs that prove you have programs that that execute that could be a game could be a an app could be a website something like that then you have programs that prove things but for that we need this nice layer of abstraction and that's why noir started.

It is still all the math is still there. It's just you don't see it. So people that are zero knowledgers like me, they can still do zero knowledge. So why why noir? Yeah. Because zero knowledge is cool. You can prove statements, computation. Um yeah, just like Savio said just just now you could basically prove the knowledge of a recite of Coca-Cola and without revealing what the recite is and still say that that it's an original Coca-Cola stuff like that that could be interesting for enterprise even if you're into that. But it's also hard because Yeah.

Yeah. It's um as I said just now like it it very easily goes into PhD level math that you you you may not understand or want to. So Kev which is the the original gangster for like yeah Rust is nice like I like I like Rust. So he copied Rust. He could have done that with any other language. Actually I think he likes Python. So he could could have could have just done that with Python. Just said Rust is cool. Okay. And that's how Noir was born. It's just a language, right? It's just a copy of Rust. The clos the closest it is to Rust, the better job they're doing. That's basically after two years more than that. No, it's

it's very good, right? Um it looks like it looks like kind of blackmagic thing. Now, I'll show you going to be surprised these days. I can I can say that tenoir is the de facto zero knowledge domain specific language. Um I couldn't say that some time ago but I mean the moment that Vitalik tweets about noir is like okay that's it like my job is done right because it is the def facto language everyone is using that. Um so I'm honest I I wouldn't have said this a year ago.

So what do you want when you build something in general? You want something that is fast that won't take 10 seconds of Twitter scrolling to prove, right? You want something that is powerful that you couldn't do any other way. Um yeah, zero knowledge is basically there are some problems that can only be solved with zero knowledge. And you you also want something that can actually be used. Uh, it's not it's not a pain. You don't have to download 400 megs of proving keys on your phone or something to to do. No, it just goes and and just download an app and it's it's done. If you use ZK Passport, that's the

perfect example of an app that just comes with everything inside. You just use it and go on your way. So, some examples of things you can do in just a simple guessing game. I think this is the the the default program that comes just this is it. You just define two variables define one as public the other one just by default privacy because privacy is normal. So that's you get all the all the inputs are private by default. Um if if they are all private that wouldn't make much sense, right? Anyway, um you you need to define which ones are public and and then there is just an assertion that says yeah

that's what the verifier will prove will verify that X is different from Y very I think I can say this is simple right zero knowledge proof so proving that you know a password without revealing what is the password that is really cool example example like for login website you go login on a shady website you don't want you don't know what they're going to do with your password and like you shouldn't right you shouldn't your password is something that is private so you can you could be able to prove that you know what the password is without revealing what the password is so again

another simple secret you can improve you can import the basic hash function these days we would actually use pose not pison pose is more efficient these days with with Barber. Um but yeah, the same thing you just you have a private input which would be the thing that you want to keep private and then a public input which would be the hash like in unleible thing that you can ever guess what it is. And then you just have an assertion that proves that um within the circuit you're you're proving to the verifier that you know a password that when hashed equals the the thing that everyone knows.

So if you want to your um if you want to have your own unicorn, this is it. You can copy it, right? You start from here and then you ask chatpt to do the rest. it will build your company for you the marketing and everything right so yeah if you want to unicorn it's an easy way and then semaphore which is a I would say my pro one of my favorite projects in R which is proving that you are a member of some group actually for this workshop I was like maybe we could use ZK email to prove that you have a ticket to be here and then we could use for voting and stuff like that uh it was was hard because of the ticket came in an attachment so it was not not that easy

to force. Um but yeah I would use something like this like you I would say yeah if you have a ticket you have a nullifier um and then I'll just put nullifier in a huge Merkel tree and then then you would prove that you are a member of um this Merkel tree. So you have a valid ticket. You can make a vote like a voting. Um you could do something some really cool things with people in here. The list of all having a chat of everyone that is in this event are people that have a ticket for this event. Um so yeah, pretty cool.

But is it fast? That's what everyone asks. And and I I I it triggers me to crazy stuff because what do you care? Do you care about proving in 200 milliseconds and having to download a 400 megabytes proving key or do you care about proving things in one second and not having to download anything? You tell me, right? So this is triggers me beyond you can imagine. I don't care if it's fast. If it works and other solutions don't then I would use the one that use that works, right?

So, but still it depends like it depends on your back end like uh in in the case of Noir we tend to use Brazenberg because it's the one that Aztec labs developed. Uh but you could use others you could use uh there's world is is building their own growth 16based back end. Um there are other teams building so you could you could actually change your back end and deal with all the trade-offs that come with them. then a program like yes it's very easy it's very simple you could still improve it right you could still say I mean you could use constraint functions for not constraints certain computation that you could uh uh save and without um yeah

without uh any security problems so yeah you can definitely improve your program and make it be faster and then finally what I was saying it's about a rap like what do you care what do you care you want something that works or something that doesn't but it's fast right so yeah actually nobody care nobody cares and we we start to see this like real world apps that are coming in especially in mobile they use mark because they understand that it's the only solution to deliver a So yeah, it's the only um usable one. Um

yeah, you can write code, not not circuits. Um because like yeah, we're talking about the different back end. This is case of a growth growth 16 back end. Um you can just use the same um verification key for yeah the same verification key uh for the same circuit. Different verification keys are kind of small. You can put them on on a smart contract. But the CRS like the the the the universal setup. It's it's universal for all the circuits. So that's a big thing you want to take into account when you build an app. You don't want to have different circuits for each Merco tree

depth and then you don't even know which one you have to download and when you do it's 200 megs, right? So yeah, the same thing about gas cost. It's like oh but it's it's it's less expensive to to verify some other backends. Yes, it is. Yeah, like from from some situations that that would be useful. But are you also paying 200,000 gas to verify something on L1? Who's who will be doing that? Nobody. So that's the thing. You don't care. You care something that works. Care about something that works.

And then yeah, mobile. Um yeah, mobile is a big one. You want something that works on the phone. because that's where most traffic comes from. You want people use their apps to pay for payments on their phone. They use their apps to use social networks on their phone. So, you want something that works on a phone. So, it's lightweight enough and you don't again you don't have to download a ton of data. You don't um yeah, you don't take a ton of time. You don't have serverside computation which is useless. I mean, if it's server side, then it's not private. So yeah about achieving global pace in an afternoon. Yeah. Um just yeah no I may

have oversold this so I'm just not not do that. Um so about this next uh part of the workshop where we're going to actually build something. We're going to see some NR tooling. Then we're going to write some more code and then prove something um using we'll try to do it all in the CLI using Remix uh IDE for u to be easy but uh maybe we can use AI quite extensively to uh to make things look good like on a browser or something like just to have fun because we have some time today.

So, some links. This is the Noir Discord, which you can join. Um, you can zoom in on phones to to read QR codes. That's is something I I didn't know until Yeah, sorry, I'm done. Yeah, you can you can um join the Noir Discord. This is the Noirang, which is basically everything that I'll be doing today is in the Noirox. So you can say I'm just here reading Marox which is cool. I wrote them as well. So but but you you can pretty much everything will be from there. And then there's this my link tree which has two links at the top. One is um sheet. So it's just like it

has some commands that I'll be running. So if you if you fail in some process and if you take a little longer doing something, you can still catch up with the with the workshop because you can run these commands. So I thought that would be easy. And then there's also I call 40 IQ code space. So if you don't know what code spaces are, they are just um basically uh IDE. It's like an IDE that runs on the browser and on a remote server. So, uh, it comes with noir with BB everything you need to to use. So, if you don't want to install it locally on your machine because you don't care too much, you can use this this code space.

Cool. I don't see phones in the air, so I think everyone has scanned it. Cool. So, first thing, norang.org. Okay. You can go here, read the docs and then second thing you you have an AI that you can ask um stuff. Okay, this AI has knowledge on everything that's in the docs. So you can ask questions here. What's not in the docs? I mean, yeah, good luck. But uh most of it is in the docs. Most of most of the stuff in the codebase is indexed in the docs as well.

So should be fine. uh you have search you have um basically everything that we'll be doing here today and then as I said this cheat sheet with the code space cool so things I won't have to do but I'll I'll show you which which is the first installation of uh noir so if you know uh rust you probably have used rust up which is the easy way to install rust Um, so same thing here. It's like you you install norup. This is the thing.

Uh, you install bbup and then you can run them. No repup bup. So in the cheat sheet you go, you can copy this. I'll do that. Just going to open my IDE. I'm just going to run this. Okay. Then I'm going to run the other one. Okay. Don't forget this sheet is in my link tree which is link tree/ ckp right it's here cheat sheet so I'm going to copy the second command to install bbup and and then I can run both okay and this will install noir up the noir install nargo actually which is the

package manager for it's basically the everything everything binary for noir and then it will install BB. BB stands for Batenburg which is the back end that I will choose to use today also because I don't know anything about the other ones but BB is nice. So, so I can run up here and it will install my Nargo into this binary. So, this should be in your path already. If it does, if it's not then you just close your terminal, create a new one and it will be there.

You know it's there if you go nargo version and you'll see it's going to be 1.0 beta.6 right. Yeah this is some some great great naming almost like uh opening level and then that BB you can same thing you can know BB up you can run BB up and this will install whatever version for BB which is going to be version 84. And then you can know it installed correctly if you go BB version and it will tell you which version you have.

Then as always as with a good binaries command line interfaces you can you can see what they do if they if you go just naro and don't say anything will tell them to tell you what what can you do with it and the same for BB. Oh BB actually needs uh help but it will tell everything here. There is no documentation site for Burtonberg and that's totally my fault because I've I've I've been meant to be doing this for some time. But um the documentation for BB would always just be the the repository at a tech. So you can go tech protocol a packages and then you

have Bernenberg. So the documentation website will just beat this right uh just in a nicer way. So it has it has pretty pretty much uh like everything about BB including how to build it and stuff like you if you're a geek you want to yeah question Batenberg. Yeah it's the proving back end. So when you when you use a zero knowledge program you need to execute the program to generate the the inputs that would be the witness. We call we call it the witness. Um and then and then then you would put this uh par put this witness into a proving back end. So that's the actual thing that will prove. So you always

need two not always but in the case of noir you always need two parts. One that executes and one that uh that proves. We call it the front end and the back end. Front end would be noir back end would be Bratenberg in this case. Yeah. But again you could use different proofing back ends. They all come with their own different trade-offs. Yeah. By the way, we have other questions or not really. No. Yeah. Feel free to just raise your hand and Yeah. I hope I can see.

Yeah. Yeah. Uh, as I said, like if you use like a a proven back end that uses Gro G 16, you definitely get better speeds and less gas um on onchain verification, but then you you get uh one trusted setup for each circuit. So if your circuit happens to be if you just need one circuit and always always going to need that then okay um this is actually a

very good argument. Uh I don't know if you remember Sismo at the time, but I had a I had an argument with the guy and I was like he was saying we don't need it. Like our circuit is done. Like we won't ever change it. So why would we change to a different back end? And he was right. There was no reason. But most of the time you want to keep track of that because maybe you have a bug, you want to fix it or maybe maybe you don't know which you need to. So really it comes with the trade-offs on what you're trying to build. So yeah. Yeah.

Mhm. >> Okay. Yeah. The question so so I'll just repeat the question. The question is why is Brotheenburg using use BN254 as a as a lead curve and not BLS 381? Um I don't know exactly how to answer answer that question. Um, yeah. I I I I really wouldn't know like uh yes, that's that's a good one. But yeah,

I mean you can still do operations on on uh BLS 381, but they are out of curve. So you need to basically do non-native computation, which is slow. So, uh, but yeah, I think I think there's a trade-off there with and and definitely as as you mentioned the the compatibility with with the with the EC up codes uh in Ethereum would maybe be the biggest reason. Uh, I don't know if Savio has more information about that, but I would say that's probably the the the reason. Yeah, but yeah, good question. I just sorry, I don't know the definite answer.

Cool. So yeah, uh at this point you should have BB. You can go BB/H and see what commands do we have here. So to start just going to go nargo new. Okay. So if you see nargo, you can go nargo new and nargo init. Um I'm going to go nargo new because it starts in a new directory. So let's say name uh workshop, right? Uh new slash name.

Okay. Okay. Or workshop. Nice. Cool. So I have a new a new program here. And you can already start with this one. One thing that you will notice which is really cool is that you have tests and also if you're using your own laptop, you're going to notice that you have this little um very nice um language server which will tell you basically it will autocomplete stuff for you. It will I mean it's it's pretty pretty amazing stuff and you can just run this test for example. It will just run one test for you. Um so you could actually have tests that are supposed to

fail. So in this case this is the default program as I said proving that I know a number and that I won't tell you what number is and yeah proving that you have failed to guess my number. Um but I I can actually run a test or write a test that is supposed to fail. So I can get can go like test should fail should fail and then I can go fn test fail and then I can do and I can do like main one one. So and then go to nargo test. Uh actually need to cd into that folder test. And I see that two tests pass,

which is correct. Like one, this one is supposed to fail. Actually, you can have you can always you can even have assertions that are supposed to fail with not the same. And then test fail and then say should fail with um I don't know if the syntax is correct, but you I think you get the the idea. You can actually make it fail with a specific reason, which is good test. Good test practice. Cool. So you're like, okay, I show test remove it now.

But this is just a test. Uh what can I do if I want to actually build a zero knowledge program with this? First you need to execute it to get the witness. As I I was just saying to execute it you just go nargo execute and it will basically oh in this case it needs an um proverl so actually I forgot one nargo check ngo check will just uh just read these and see yeah what are the inputs you need in your program so it will autogenerate this proofer file and here's that's where you put your inputs this if we are Alice and Bob and I Bob and Um I want to prove something. I

obviously I won't reveal this because that will reveal my private input. So this is this is I can get ignore this. Okay. Uh this is just for proving. So now I can actually go and execute and it will hopefully work. Yeah. Now you have two files now. There are one of them is uh just tells you the version and the AI. So I mean you probably know what the ABI is because it's widely used in in Ethereum and you also understand why this touches Aztec because it's an AVI. So and then there's the bitecoin.

This is the actual thing. It's basically for encoded actual thing that we are proving which is actually not very big as you can see. And then there's a witness which I don't think you can even open but that's that's basically the witness is the is the solution for your circuit. So it's the it's what uh yeah it's basically it's the solution uh for the the the thing that you want to prove but not yet proven. So you need to feed the witness into approve. That's where the back end comes in. And this is all about mar like that's done.

Okay. You can uninstall it. No, no, don't don't. Uh, but because Nargo definitely has other things. Um, but yeah, this is all about the the front end. You now have what you need to feed into the back end. So, this is where BP comes in. So, a new project uh basically the same team. No, not the same team, but but yeah, it's a new it's a different project. Um, Barenberg. So Bretonberg you can do cool things like gates get the number of gates of your program and know how big it is. So you can go uh narrow BB gates and this will tell will ask you like um some things about the

number about your program. In this case it will ask me for um I'm in a workshop. So I want to target target workshop JSON will tell me how big is my circuit. This case it has just two ACR op codes. And you you're probably asking what is acier? Acier stands for abstract circuit intermediate representation. And it's the way that Noir communicates with the different backends. So I was kind of scratching the truth when I said that it would work with every back end. It would as long as it can understand a so you may have a translation um process there

which is not big if you see a it's pretty easy um structure. So you you want to care about the circuit size which is 18 which is almost nothing. Okay. uh 18 obviously I mean it's all it does is just proving that something is different from the other one. So it's pretty pretty simple. Uh but this is important if you are tracking how many gates you have in a in a in a so for I don't know zk passport for example they use like I don't know 600,000 gates something like that. So yeah, there's definitely uh um I would say um a scale that you want to take into account on how many gates you have because they would hit the RAM limit on

the phone or on the on the browser especially on froz. Yeah. Yeah. Yeah. The gates are like if you see um if if you can imagine of zero knowledge circuit as a hardware circuit the gates would be the different components. So it could be multiplications additions uh yeah it's all multiplications and additions basically. So the number of gates is the number of um you can think of kind of um operations that need to be done in order to solve the circuit in order yeah to prove the circuit in this case. Yeah. Um so they are not up codes.

I think up codes here would be I don't know just say just an equal whatever. Um yeah but they translate to this and this is what you care about if you use a different back end. This doesn't this is not the same. You can't really translate um gates from one back end to the other one. For example, 18 gates in in a growth 16 back end will be even less than it means for for no like just a different uh way of measuring things. Um so yeah, you care about gates mostly.

How big is your circuit? If you want to prove this, which is what you probably care about. Oh, I already have this because I was doing this project before, but this is in the sheet actually going to the sheet. You can see here the the things the the command that you can run. So, I'm actually going to copy and paste it and then explain what it does. So Brandenberg prove the bite code at this um this location. The witness is at this

location. The output is this location. And then the format of your output. This is just so it's easier for later on for us to plug plug this in into REMIX. So it will split into two two kinds of of uh of files. One is a um binary and the other one is a is a just a number of um finite fields elements. Um so I'll just that's why I pass output format bytes and fields and then the Oracle hash.

You generally don't necessarily need this one oracle hash if you don't want to verify this onchain. If you want to verify onchain, you want to use um a hash that is uh better for onchain operations. And so on case in the case of EVM, Kachak is an easy I mean it's a it's an op code that's used everywhere. So pretty cheap. So you want to use that so as an oracle hash. So use ketchuk. But if if let's say that you want to prove a program and it's not going on chain or using you're using it for Aztec for example you you just don't use kak use which should be the other option and the default I think so this is what this

command all what this command does and it will tell you what the scheme is so ultra honk is the fastest that we have okay um that's it there's there's there's an old one ultra plunk Some of you may may remember that this is the fastest one. Also the most most expensive one chain. Uh one 1.2 million gas. It's yeah it's really expensive. Um and then you have the public inputs what what I was saying that things are being input into into both fields and and binaries which uh yeah like binary stuff. So we we will have to convert

actually this proof into a exodimal. So in this case like you have a proof if we could see this it will tell you nothing about the pro uh private inputs. Um but the public inputs this is um the public input. I mean this would be no problem in revealing actually because it's public but in this case like our prover will say that one is different from x one is different from from two and all I care is to hide the one right the one is a secret so here nor in the proof or anyone anywhere else is I can actually delete proof at this point doesn't doesn't matter

all I want to pro all I want to verify now is that this is correct like this is valid without knowing what the the private input is. So I can do that with BB verify. Uh this will probably fail. Yeah, BB verify. I need to say where it is. Oh, I need to write the verification key. Yeah, verification key is like each circuit you can derive one verification key out of the circuit, right? If we are Bob and Alice and we're playing a game, I'm thinking of the number 42 and you're trying to guess my number and I want to prove to you that your number

is wrong, that you didn't guess 42. Said whatever number without saying, "Yeah, I was thinking 42, you lose." No, it's like you just fail. Okay, that's that's if if that was the case, I would generate the proof on my side. But then you would want to verify using the same program that I used otherwise I could just say whatever right. So the verification key is there exactly for this. So you can have uh the certainty that you are proving you are verifying the same program that was proven. So I can if I am now Alice all I've done until now is Bob and then I've proven that Alice has

failed. And now if I'm Alice I'm going to generate the verification key. So I'll go write VK. And as you can see right writing VK doesn't take into account anything beyond the circuit itself. the the so I can I can delete the proof I can yeah doesn't matter all that Alice needs to know which what is the circuit that I'm that I'm verifying this is especially important if you're verifying onchain because that's what's going to go on chain so uh not circuits it's called what is it called workshop so yeah here's my verification key again

I can't really understand where it is like cat cut or something like that. Yeah. Anyway, um so now that I have verification key, if I'm Alice, I can delete the proof. Uh I won't because will be useful later, but I could delete the proof here. And I could say PB verify and proof of failed. What it failed for you? And that's a new one. Uh what did I do wrong here? I'm check verification. Oh yes, verify um ultra kaka kongk because of the the oracle hash use the oracle hash. So if

you if you use proof and you you you specify the oracle hash to not be kachak in this case you would write the verification key and then you would prove verify it will verify correctly. And in this case because we are using the ketch hash as the oracle hash then you also need to verify with verify ultra kachak which would be the I think it's there. Oh okay that's that's bad but it's there. It's in the documentation but I know why why why you spend this much time because it's not in the

getting started. It is in the solidity verifier. So you need to go be proof and then Oracle. So you did this right with the SL Oracle hash and then BB verify then auto cach. Yeah, you need to use a different one. I think actually that if you go BB verify, you should be able to pass also a scheme article hash same thing. So you can go

verify article hash article hash uh kachak and uh where is this? Um, yeah. I mean, yeah. I don't know. Maybe maybe it's not using the correct scheme. Maybe uh scheme ultra. Well, I don't know. But yeah, definitely just BBB ultra kach this.

What am I doing now? What if I Oh, what am I doing? Let me see the documentation. Read the docs. Yeah, write the VK, which that's one thing I may have missed. And then in this case, well, I can just skip to the to the solid verifier, but yeah, maybe by TK

and then [Music] I'm I'm doing something very stupid because I just did this just before now. And anyway, just Yeah, I'll I'll I'll try to see if this is a problem in the documentation. You said that this pro probably a problem in documentation.

>> Okay. That's probably it >> probably. So I can go see up. So nor up this is will this you want to say BB up for this is installing 84 USA 86. Oh the beta version. maybe beta 4.

Uh the person version will always track this one. So I can I can now do it. So nargo executes um then PB. I think this is it. And then BB right. And then maybe scheme ultra honk check. Nope.

Yeah, there's something that I'm missing here. Maybe the cape, but I'm also sure that's not going to be this. Okay. Yeah, there's something really stupid here. Anyway, let's hope that that the unchained verification works. Um, so yeah, say that imagine this this worked and now you want to do this. How how can I do this on chain, right? How can I if if you're playing like a battleships game, uh, you probably want some

um onrain. I mean you could use some kind of um um channel communication. Uh that that would work. Uh but most of the time you would want this to go on chain so you can verify things without revealing what they are is means that you could shield funds for example without uh um without uh revealing all information about you. You could I mean there's there's just you could vote without revealing your your own information. Yeah, there's a ton of things that um that would involve proving to an immutable ledger that something is true without saying what it is. And my opinion is that it's completely useless if you can do that.

So let's just hope that uh write solidity verifier works uh solidity verifier. So when you write the solita verifier, all it does is the same thing as the verification key. It just puts it in in a smart contract, right? So it's it's it's incredibly it's basically the same thing. And I'll show you if you see the smart contract which is doesn't look very nice but if you can see these all these points uh down here I think those are the ones. Yeah, those

are just the verification key. Right. So this is basically instructions on how to do this um without knowing all the all the information. So you can deploy this and that's what we're going to do. Going to go on remix ID. Going to start a new project. Um going to create a new file. So that's all

going to copy my contract. Uh it will say yeah don't paste. Don't paste. Yeah. Yeah. I'll totally paste it. Just just ignore. Um, and then you can you can compile it. So you'll hopefully compile it in in one go. It will say, "Oh, it's too big." And I say, "Cool." Yeah, that's fine. I know I'm going to pay one 1.2 million gas. So now I'm going to choose which one I want to deploy. If you see all the other contracts are just libraries. So the one one you care about is the honorifier.

So I deploy this one. You have to optimize it usually. Yeah. Yeah. Actually, it may not even work here because of that. But uh let's see. Hey, it doesn't work. If it doesn't work, no, no problem. We know it works because there are projects work using this. So yeah, now like it's just like doing it locally. All you need is the is the public inputs and the proof. So we have those already. The problem with the proof is that it comes in a format that it's not easy to copy and paste. So in

the cheat sheet, I added a little um command that will help you not split the proof. It will just tell you what the proof is. It's a verifier contract. So it will verify your proof without knowing what the private inputs are. The verification key goes into the contract. Yeah, it's hardcoded. Yeah. So one verification key, one contract for one circuit.

No keys totally pro. It's actually you should be able to derive the key from the circuit. If you have the circuit, you should be able to to to um to determine what the verification key is. And this is very important because if we're playing uh a guessing game, if we're playing battleships, for example, I don't know where your ships are. You don't know where my ships are, but I I'm I I'm make a shot and you want to prove that I missed, right? So you basically your proof when I go and verify that proof I want to know that you are using the same circuit that I'm verifying. So I need to get we need to agree on what is the circuit

so we can derive the same verification key and that's the only way we could play. Uh the problem is that how how do you how do we agree on this verification key right? You could go it like on a side on a side channel and say go on telegram or signal and say oh here's notification key here's the circuit and then we could play or you could put that on a smart contract. So that's the biggest unlocker. It's like if if when you're using zero zero knowledge u proofs in this case they are zero knowledge snarks. So non n succeed non-interactive arguments proof of arguments of knowledge. So basically

they are non-interactive. So I can prove to you that I know something without any interaction between between us. You just know what I am approving because you can derive the verification key and then from then on I just send you a proof and with only that proof you can be convinced that I know the my my private private inputs. Yeah, I mean eventually it it doesn't grow with the size of the proof. So it it yes it's expensive is 1.2 million gas or something but always that so it doesn't grow. I think it grows with the number of public inputs because that grows with the call data. Um so I mean but that's expected.

Sorry, it will always be efficient. I mean you can the one of the properties is like you can prove a big computation in a in a very small proof. So it will always be more efficient than pretty much anything. uh but yes if you have a a lot of public inputs then definitely I mean there are more things to verify against so that but they don't grow that much with it just the call data and a little more so yeah but yes you're right like technically you could have so many public inputs that it will be inefficient that's for sure Yes.

You can just apply once and use the same one for everything. You know, it it does a basically it because it takes the public inputs. Uh you can use the same for as long as it's the same circuit, you can use it all the time. Yes. Yes. Because if you change a circuit then the verification key would also be different because again verification key is the only point in contact between who is proving and who is verifying. So yes,

it it it Yes. Yes, it would be possible. Yeah, you could definitely reuse the same contract for for such a thing. Uh yes, you could. Yes. Yeah, actually that that's why some of

some of the parts of the code are libraries. So you could actually deploy them and then reuse them. In this case, we're just deploying everything because it's a workshop. Yeah, we don't we don't work with Ethereum that much uh on on this uh like yeah we don't I would say that this is a a side stuff because we yeah we we care about Ethereum because everything on asset will be verified on Ethereum but we care about one contract on Ethereum that's going to be very very optimized and and this is something that yeah of course of course we want to be a nice language for people to use. But uh yeah, every time I mention that that we that verify

contract that costs like one 1.2 million gas, everyone in the NAR team is screaming at me and say it's not optimized and say did you optimize it? Uh because that's that's the thing. If if we were to put the resources, definitely we could have that much much cheaper. Just like it's definitely not our priority. We care about one contract that's going to be the one that will be verified the then the AIC roll proof. So it's a matter of time. I I wouldn't say the priority. I would say time just just time just like in one two years we're going to definitely put have a much lower uh uh gas cost for for proof definitely. But one thing that's really cool is like Noari's MIT license like

it's yours. It's it's it's literally everyone's. So you you could you could do it. Uh yeah. Yes. Yes. Yeah, that's an amazing question. Um, see with when you have a solidity

contract, you have kind of the same problem, right? Because you have solidity contract, then you compile it and then you don't really know that the compiled circuit is the contract that you are actually executing. Yeah. Yeah. You can exactly the same could be done for noir. That's that's the easiest solution is saying just do the same as Ethereum does. You have a a green check some kind of ether scan or something that that recompiles the noir circuit and says yeah this this bite code corresponds to this contract or you could actually give the contract to be compiled on the client side. And so I think the client side is the mega ultra mega gigap power of zero knowledge proofs because if you

do it client side you can give the circuit to the client and the client will compile it. Now you ask yeah the user still doesn't know how to read rest or no that's true but does it have the all the all the information on on their side they do right you can have an AI explain explain it which you couldn't if you serve the the compiled circuit. There's there's always going to be a point where where they're like the user doesn't know but uh but the the answer will always also always be give everything to be done on the client side the proving verification everything done on the client side. Yeah, it's very powerful.

Cool. Any other questions? Feel free to to to interrupt. We have we have time. Yeah. Mhm. Good question. Um, there is no overhead in verification, but the proving will be expensive. Like you're you're you're you're proving that another proof is true. Um, so it is expensive to the point where you can't do it on a phone

unless you do it on maybe maybe native apps maybe an Android or an iPhone would give you enough RAM to uh to do one such proofs. I I I have I haven't keep track keep keeping track of that. So I'll have to try it myself to to know. Uh definitely on the browser on the laptop it works. I've done it in 2023 in pro crypto and it was fine. I did a Merkel tree with regressive proofs and it was fine on on my laptop. Um so it so it definitely used less than 4 gigs of RAM and it will take on my laptop I believe it was like 30 seconds but this was with ultra long. So the previous generation

with ultra honk is going to be much faster. So so yeah it's a it's there is an overhead. It's annoying enough to not work in a user's phone on a tab on a on a browser tab. Um especially if it's an iPhone because iPhones like Safari will only give you I think 300 megs of RAM to use otherwise they will kill your tab. You know I I used to say that they Safari only gives you the RAM you need to open apple.com. That's that the only thing you need to do with Safari is buy more Safari more more Apple products. So that's that's the only thing they they give you. Um but if you go native with a native app then then you can use more.

So that's what ZK ZK passport use for example. So yeah I there is no definite solution depends on what you want to do. Uh if it's a browser app with most laptops computers will work client side. uh on phones maybe. No, but verification always going to be the the huge amount of 1.2 billion guys. Yeah. Yes. Um

yes you as a Bob you are proving that your opponent your opponent is wrong right so indeed you could you could change and say yeah my the opponent said 42 so now my my private my my number is now is not 42 it's 43 so so they're always wrong yeah you could definitely So usually on you on kind of on a game like this, it would commit to this value as you just said. But then you're like if I commit this value, I need to encrypt it and put it on chain encrypted which becomes even more expensive. And if you go down that line, I'll assure you that you'll reach to Aztec very easily very easily. You're like, "Oh,

cool. A will do this for me." And then you start coding on AIC. That's why we built AIC. It's because no is good but then you're like if you want to have private state then AIC is just a superpower. Yes. and private state on Ethereum is it's okay but uh I mean it will always reveal that like message sender for example there there are a ton of things that you you still don't get the privacy unless you use like relay networks or very complex or yeah complex structures that you need to uh to do. So some people are like can you can you do everything that Aztec does on Ethereum and the answer is probably yes you probably could with just no and Ethereum

you could do everything that Aztec does it will just be very expensive, very complicated and very slow. So yeah, Aztec will just abstract away by using um using just a different execution environment uh that is optimized for zero knowledge. So yeah. Yes. Yeah.

The circuit is in AC format. The um it's an intermediate representation uh and then you use a back end which could be Brettenberg to feed that witness. So the solution of your circuit and and provide a proof and then you could verify this proof offchain by generating a verification key. Do it give verification key or give the circuit to your opponent. The opponent will derive the same verification key and then be able to prove that your proof is correct is valid without knowing your private input. Or you could just put that in a smart contract and have it done for everyone.

Yeah, it it will grow on you. Yes. >> Yeah. Yeah. So, in the cheat sheet sheet, you have this um this little command. This will basically translate that binary format into an exodimal. So I'm going to do that. So can go. Yes, we should.

It was worse actually before because before this before some Yeah. Some some months ago the proof would come with the public inputs. Not even at the beginning you would have to split them but it was like take the first part and split it and ditch it back together and I was like screaming at the cryptography team and say please please accept them separately and they say no. So what they did is like they they made this uh this proof as fields uh thing that will output them in in a separately but yeah so yeah this is the proof as you can see

it's not big right right it's not big this is like if you think that this is the size of the proof of whatever circuit you want that will it will it actually grows a little Yeah, you get auto gas. Maybe you need to um to optimize the the circle. >> Yeah. Yeah. So, so yeah, if you can imagine like the amount of computation that you can do in such small small proof, this is small, right? So, going back into into into Remix, I can actually go and say 0x. I need to put 0x before just going to paste the proof and

then I'm going to paste the public inputs and that's why I put it I put the output as um proof and field so I can um and field so I can just copy this just copy the public input again this is the the magic because you could use a different circuit a different proof with a different uh uh public input actually in most cases you would want the public input to not be in call data like you would want it to be within the circuit. For example, for a mer tree proof, the root is in is in the contract like you don't need to feed it. It wouldn't it wouldn't be trusted. So, as you said, this is probably going to fail with out of gas. Um yeah.

Uh I guess maybe just optimizing the optimizing the contract here. Um, yeah, it should it should work. Yeah. So, I just I just put like two round 2,000 rounds of 2,000 is a bit too much. [Laughter] Yeah. So, I need to redeploy it. Just going to copy the proof so I can reuse it.

Yeah, this is notably hard to to get the first time, so I I won't blame it. Yeah, same thing. Anyway, um maybe I maybe I need I will need some kind of custom gas or whatever, but yeah. Yeah, at the zero. Yeah. Let me see what's going on. No. Yeah, maybe. Yeah. I don't know. I don't know. I just pretend it worked.

Yes. Oh, the right VK also takes the takes the takes the hush. Oh, then that's it. Like by 3K you mean art or hash um attack and then write Yeah, that was it. Um, sorry, I don't

know your name. Um, here. So, Savia just just mentioned the the the reason why it wasn't working. It was I I was forgetting also to put to pass write VK to pass also the Oracle hash. So, that was a the default is Poseidon. So if you do everything in poson it's nice if you're verifying a proof in NASDAQ or offchain because it's faster for ZK but yeah it's poss on on Ethereum for now because I think they're improving yes IP so ah that will be amazing but yeah that that was that was why it

was wasn't working um actually Now, now it could be that I would uh write solidity verifier. Maybe, maybe. No, because it's a different verification key. Maybe now it works. Compile it again. here.

Uh inputs. Oh, yeah. It worked. Yeah, that that was it. I was I was forgetting the oral hash. Ah, this is tricky. I I I I take Yeah, you need Yeah, exactly. You need to recompile. So, the gas cost for this is actually very very high. Let's just see. Gas I can't Yeah. 4 million.

I can't be wrong. Yeah. Yeah. Maybe maybe I can actually try it without it. I mean, if let's let's see instead of trying things Let me see.

Yeah, two two million. Yeah, just looking at 2 million. It's It's more still still more than we thought than I thought. So, yeah, I'm probably do some it that's the thing. It's always going to be too much. Like, it's always going to be a crazy amount of gas. So even if it's 200k, it's always going to be too much. So >> pretty much yeah. So that's but again there's I I I'm not denying that there is a trade-off like if gas cost is an issue then definitely don't use Benberg use a different back end use 16 use uh I mean yeah and that's actually the reason

why why world ID are using um are using grass 16 back end because they they want to prove multiple iris proofs in in one. So they are using their own recursion and their own gross 16. So it's very cheap to do both client side and then verification on chain. Yes, it's that for for gross 16 if you change the circuit you can't really you can't just um use the same you can just derive the verification key. You actually need to run um a trusted setup for that specific circuit. So you need to run just a setup. It's a very annoying thing that

you have to make like a ceremony and that's pretty annoying. I've done it once and it's Yes. So can you imagine doing that for every circuit? I It's fine if it's one circuit that you run once and you're like I'm sure this will never change. It's some simple circuit or it's battle test or something. That's fine. But if you want a different circuits, you probably just want one one trusted setup, which is the first one when when Yeah. When in this case, we're using the ignition uh trusted setup that we didn't in 2017 or something. And that's it. Like it's Yes. Yes. But we did it. You couldn't be

sure that we did it correctly because they they they I think they smashed the laptop or something, right? they they they they did the randomness and then they comm they submitted that and then they they destroyed the laptop. So yeah, you can be you can be sure that that is a trusted a real trusted setup. Yeah, people do crazy things with with with trust setups. They go they go and measure like radioactivity levels in certain places and stuff like that. It's like yeah truly random or almost random and use that and then yeah it's crazy stuff.

Cool. And now you're asking me like this is nice. How can I how can I build an app with this? Right. Uh this is where probably I don't I don't know when I should stop. Uh yeah, in five minutes, right? So, but if you're like, "Oh, cool. Now I want to this is all good in CLI. How can I do this in a in a browser?" Right? And my goal today would actually be to use some AI to build all the front end and then just plug in on top and but uh and there's there's basically um um a tutorial on doing exactly that like building a web app with Maron Bermer in

my experiments just before coming in this exactly what I did. So um I went like uh I think yeah I think V1. So basically I used the uh J the JS packages PBJS and RJS to do this exact same thing but in in JavaScript and because it can do it in JavaScript then you can run this and I can run this save temp1 and I can go um yarn or um node index.js JS this will yeah just return true. Uh you could do this

in a in a in a like in a front end or something. So I could actually just go here and ask chatbd or cursor and say yeah you see this just make a front end that does this. It would do it would work. Okay. And then yeah, I mean yeah could take more than 5 minutes for it to build but you see what I mean. At the point where you have something that works in JS and works on the browser side then all bets are off like you can you can go and all the all the web two process can be you don't need to understand any GS or HTML or CSS you can just ask all the

bulk of the work to be done by an AI and this is all you actually care about this is even AI will still figure this thing out but if it doesn't this is all you need to know. So you need to import two packages and the circuit that you have just compiled. You can actually compile it client side as well which is I didn't do it here. I don't know why you instantiate the noir the front end you instantiate the back end which will be ultra honk back end. This is the minimum age because yeah this circuit is um just an age circuit like proving that you are over this case that you are over minimum age um so the prover will be

like 22 is bigger than 18 but I don't reveal that I am 22 because I am right I'm 22 uh and then yeah the JS thing will do just the same thing just execute then generate the proof and Then verified proof. And here is where you can actually go use VM and I mean generate the solid verifier with like you go backend generate solid. You basically have all the all the same solid solid verifier. Um you actually have all the same the same um commands here.

It'll generate the solid verifier. You could use VM to deploy it then call using VM wm me whatever you want to want to do. It's pretty cool. And so this is what the documentation uh tutorial does here. Um so you can follow it. Yes. And more than being in a browser is a static website like it just runs. Uh so just to give you an example, it it will it will eat a ton of browser memory, but it's not that bad. Depends on what exactly that depends on if you if it's recursive proof, it will eat quite some RAM, but if it's not then so

just to give you an example of things running fully client side, this is a demo I wrote stealthrop. So if you don't know stealth drop, it's a very old project from Zerx Spark uh that will allow you to claim an airdrop without revealing that you are eligible for that airdrop. So you'd use a stealth address to claim to claim an air drop. So So I did this uh this little demo. It needs to use a a plume nullifier, which is a type of nullifier that's different from just the hash of a signature. Um yeah for reasons you can read in this in the CRC it will tell you why. Um so this is run fully like client side like there is no back end for this. You can you can

open here the the sources the network and see that all the all the things that will happen here are going calls on chain like um so I'm saying yeah because no no um wallet supports plume signatures I'm actually doing this not mocking it it's actually signing but um I mean just with a with a hardcoded private key so I'm I'm signing here just this is just downloading the the libraries the STP libraries. So again no back end being done being used here and then I'm like and I'm cleaning claiming and you see this is this is downloading the wasms for um noir the ACVM abstract

circuit virtual machine that will interpret the ACR and the AI wasn't the compiler to understand what the AI does and this is executing it will prove and run. And yeah, so with this you you could claim that you could claim an airdrop that you are eligible to without using that very same address. Could use a different one. Yes, should be possible. Yeah, because

you could you just have to do that. You just would have to do it in a within a circuit. So if it's uh yeah if it's like if it's like arbitrary computation um yes so yeah here's like it's I don't have to here enough to pay for this. But you whole sky is so yeah but you get the

idea here. There is no there is no back end for this app and this is pretty powerful like you can't to me it's still mind-blowing that you could do something like this. Another example would be um yeah, I I'll I can use the memory tab just to give you an idea. Just going to do the first part here.

Um, here I can't really read this. I don't know. I don't I can't really interpret this these values. But uh but yeah, it's um this is enough to run on. So I tried it in her uh Android phone and it works. So, but does it work on my iPhone like on a browser? So, that's that's an example of something that is it's it's it's cheap enough to work on a phone, but it's not cheap enough for Apple to not try to kill you. Um

Oh yeah. I have no idea how to inter I don't know what I'm looking at. Okay, I hope you do. Um, not to go back. No, it's uh No, no, you would have to you would have to know exactly use some kind of like sourcify thing where you would have a third party that would recompile the

same circuit and basically you you would have like some kind of green check saying, "Yeah, this this bite code corresponds to this contract." Or you could serve the contract to the to the clients and the client would compile it client side because you can comply you you can compile it client side as well. Uh, I don't think so. Like looking at

the contract, it's just like it looks like any other contract. Yeah, they they like the the translation between the verification key and the and verification contract is it's it's surprising. If you go into the Brandenburg source code, you can barely find it. It's a template. It's literally a template like a like a solidity template and it just plugs the values in there. So it's like it's crazy. Like the solutive verifier is the verification uh key. It just has instructions on how to use it.

Yeah. Yes. Everything else is reused. Cool. Yeah, they with ultra honk they grow. So the they are not constant. They are like a a big circuit will generate a bigger proof. Yeah, the verification is always small. Uh it doesn't grow in size. I think it's always the same the same size.

uh the verification key doesn't take into account the public inputs because like it's uh it's it's tied only to the circuit. So if it's a big circuit, you have one verification key that's exactly the same size of as one small circuit. That's why the the actual like gas cost of verifying one proof doesn't change. So if you have like a a recursive proof and you want the verification key for that recursive proof, that's always going to be the same size as a circuit like we just did. Uh yes, but I mean you could do it

smaller ones especially if you have two like you have two proofs and you want to prove two proofs in one and that's pretty powerful because you could like for example for voting systems if we were um if you were in an election for example we could vote here And then we could prove the validity of the votes here in this ballot. And then and then basically use this proof and verify within like a regional level uh verify this proof within another proof that then would go at the national level and so on so forth. So you could you could actually have an election that is all based in zero in in a recursive proof like you have two regions uh verified two proofs in one proof and then so on

so forth until you get to one proof. That's how Aztec works actually like you you when you make a transaction all that comes out of your your phone or whatever it's one it's one proof that it's already recursive. It's already folded. So it's not not recursive. It's another thing but it's a it's already like a you can think of it as a proof of a proof and when you send it to the node the node will do that as well like it will just to the prover the prover will do that will just like go and recurse and say this is two proofs of one proof in one proof and then so on so forth until they get to one proof and that's the one that's going on chain. That's how you can verify I don't know hopefully 100 100 like transactions per second in uh

in in one 1.2 million gas or whatever it is. So bit uh I think the the limits of my knowledge is yeah so recurs recursion is like you just you just aggregate points uh curve points and then at the end you just prove that uh yeah basically you prove the the pairing of all these points um so you kind of add them and with folding not Clearly folding you pro you you provide all of them. So so yeah that is as much as I know. Uh they they serve

they definitely serve like different purposes and a funny story is that um one person that was very involved in in uh in folding was Ariel Ariel Gaban um and he was working with with Aztec. Then he became very very interested in folding and so he started his own thing to research on that. So he left uh and then because he was like yeah this is useless for Aztec because you can't fold different different circuits always have to fold the same the same circuit and then they I think they went like to grab a coffee Ariel and Zach and Zach Zach was proving to Ariel that actually could use it with different proof. So he was

like explaining to the guy that invented the the thing that he the thing was actually more powerful than he thought it would and and that's how Ariel came back to Aztec and started working on client. So yeah that's a that's a funny little story about just having fresh eyes on on things like even if you know even if even if you invent something if someone else comes with different eyes different pair of eyes they will see things that you don't know.