Non-mathematical view of ZKPs - Errol Drummond

Transcript

um I can get going uh is the recording set up okay thanks uh okay welcome all to the this talk uh non-map introduction to zero knowledge proofs um this is a slight live we do get into some of the maths but I'm just kind of trying to reset the the focus and uh things were highlighting and try and give you intuition for how you can actually apply this technology uh I'm I do some stuff zero stuff at the determination I made some circuits there and I was also involved at the privacy Focus layer one called a Leo so I'm going to dig in so just outlining

what we're going to be doing here I think it's around 45 minutes speaking and then there'll be time for questions at the end and like I said I want to focus on we can do with the technology I want to try and give people the understanding and intuition for like how you can um apply this technology to solving business problems so not just for mathematicians um so also you can this talk is also for people who are experts and are just looking for educatable um analogies and ways to present this this topic to people so I've got some of the quotes here and like you can prove anything with AKP it's some of the messaging I've seen which it's not really very accurate and you know I also have a video on YouTube with this like

basically vital so I'm kind of hypocritical here it's it's kind of fair enough to have a clickbaity title as long as you try and you know write the wrongs of of um how do you find how the technology Works um but then this this second statement is like something that I find so ridiculous you can prove that you can prove that you know something we're revealing that you know um without revealing the thing that you know so this is the statement a lot of us make and this statement is like completely confirmatory rather than explanatory if you tell this statement to somebody who doesn't know about technology I don't think anybody's ever been like oh yeah great that makes so much sense like it doesn't really click for anybody all this statement really

does is tell other people who know about the technology that you also know this technology so it has like value as showing your part of the in group it doesn't actually help explain the technology to people and I want to try and give more explanatory contents um yeah uh the starting place is just like why do people actually care and about this energy the the first main one of course is scalability where you know transactions per second gas costs and just doing more stuff on chain opening up um applications this is also one of the places where we have kind of bad naming of the technology so there's a kbm there's a ZK sync and a bunch of others where the only property they're using

this technology is is the scalability property and not the zero knowledge property so like kind of badly named which is the same thing as that statement I gave before you know you can prove that you know something without revealing the thing that you know like this isn't the case this is like you're giving one property of a generative and then a lot of the big use cases this isn't even the property that we're using technology it's kind of like really bad messaging uh the second one obviously is there an honest privacy aspect where you can hide more information than we did before and this is important for like personal safety International Security and freedom I'm quite interested in politics so these are the kind of things I find very interesting I will also give you an

additional story of how bad things can be when you are lacking privacy now this isn't a digital privacy topic but it's kind of an a very interesting story related to privacy to try and maybe see John knowledge of some of the debate there so okay in the Netherlands in the 1940s the the guy in charge of the statistics there he like the guy like statistics he likes data he wants them to be organized and efficient so he had this plan and he wanted to give every Dutch citizen ID card and then he proposed it to the government and the government said like that goes against our Democratic foundation so we're not going to do that a few later the the Nazis invade and then same guy proposed his idea of the

Nazis and then Nancy like oh yeah great idea give her an ID card and then of course on these ID cards every Jewish person has a j on their card now I can't think of an easier way for a roaming you know Nazi Soldier to identify identify somebody's Jewish just ask for the card there's no questions or anything um then in France when the Nazis invaded France then they uh they asked the French and they said like how many Jewish people live here and where do they live and the French were like if we have no idea how many live here and we definitely don't know where we live because he didn't collect this information uh uh okay someone's asking about the max number of participants by the way I am the champion so if there are questions along along the way

um I can pause uh and answer them um I'm wondering whether I should pause now if like a problem of other people joining the room uh okay sure yes are we at the max capacity for the room though yeah I don't know okay I guess somebody can give confirmation if other people uh okay

okay then I can pause to try and solve this foreign should I pause or should I just kind of continue because I don't know who's solving it and sure sure okay so uh and then in France then the Nazis asked them about this data they didn't have it and they they forced the friend to do a census in 1941 and this is where they go around and collect data from the entire population to work out demographics we we need this

to know how many MPS to dedicate to different areas and stuff like that but they try to sneak in the question to figure out who is Jewish and they asked like who are your grandparents and uh the the Nazis obviously didn't know this but the guy in the French guy in charge of the census was a member of the the French Resistance he used this census to make 20 000 fake identities for people identify people who might have been willing to join the French Resistance and then all this data on who was Jewish and where they were was never even tabulated they didn't even collate it and collect the data uh unfortunately this guy was eventually found out in 1944 sent a dash out and he died shortly before the end of the war um but the the takeaway here is the

Netherlands had the highest death rate of Jews in Europe of um they had 73 of their the Jewish population were were murdered and then in France the popular uh 25 of their Jewish population were murdered now the Netherlands is a smaller country so the statistics can be skewed and there's of course other factors at play here but I I I can't imagine that this one thing where do it um Dutch citizens have to carry around an ID card that has a j on it um didn't contribute massively to this this massive disparity um so there's not really a digital world real Uh current world example of the importance of privacy but it just shows

how bad things can get um and I think it's important to like recognize some of the um things to come see so I wrote some blog posts about this as well but there's just one thing to go and then we're gonna go into the zero knowledge aspects now uh in terms of educational content for zero knowledge mostly it is uh these really basic examples which are super great to get started with and then my jumps all the way to finite field elements and polynomials and all this kind of Hardcore stuff there's not really anything in the middle and this is the the the Gap I'm trying to bridge so the starting analogy is we have idea at a bar this is where you go to a bar you want to have a drink and honestly you have to show your ID

card but it gives away not just that you're old enough to drink but your specific date of birth and your age it gives away your entire name they give away give away your address and the point of this analogy is it just kind of sets the scene for privacy and showing that you're you know you don't have to provide all this data to you the only data that's needed was is um that you're old enough to drink but you know it doesn't really tell you anything about energy so that's one of the starting examples then there's alibaba's cave I'm sure many of you know about most of these so in this one we have uh there's Victor and ready Peggy's the prover we have this cave that's kind of circular and at the end there's this door there's this door here

and it's a magical door and it has a secret uh phrase to go through and Peggy wants to prove that she knows the secret phrase so what happens is Victor looks away and Peggy goes into whichever Corridor of the cave that she wants then when she's in the victor goes and shouts at random A or B if he shouts a Peggy has to come back down parthen shouts B if the guest has come back down path B now if Victor shouts a and Peggy comes back from parthetic then you know maybe she knew the secret passphrase because she was on side B and and went through the door or maybe she just got lucky you know Victor wouldn't be convinced but if you repeat this 10 or 15 or 20 times then you get

like to a scenario where it's basically realistically impossible that that he got lucky that that many times and this is how some uh old zero Notch proof systems worked um it's obviously like less efficient you've got to repeat the process these things were much slower we have better systems now but this is the decent analogy to to show the idea um similar with where's Wally this one um I can prove to you that I know where Wally's age without actually pointing to him so if we want to run together I will um I'll take a phone from one of you at random I'll ask you all to turn around

and look the other one and then I'll take a close-up photo of Wally but with like no surrounding information and then you and so that you can work out where the web page they are and then I get you to turn back around and I show you the image and you can look at the metadata and other stuff as well if you want and you'll basically be convinced that the only way I could take photo is if I actually knew where Wally was on the page so these are like really nice to get like some of the core ideas of the technology the zero knowledge side of things um and they're quite memorable because they're you know they're they're just uh no stories but there's nothing there in terms of like how does a technology actually work and if we have this problem uh business problem that you

want to solve and you're thinking about using xeronauts technology how does it how do you like generalize the knowledge from this analogy to solve that problem it doesn't really work and you have to um get some more data so um what are zero circuits actually do and this is what the focus should be is something called circuit satisfiability so as their eyes proof is some piece of data that proves that that some conditional circuit was filled out correctly so here's the statement we're now going through these definitions and understand those in a bit more detail and then we'll go back to statement and have another look at it and see

what uh uh that it makes sense because right now these are probably like new terms and like less well-defined and then we'll go into some examples for example cases to see how it's applied um okay so for circuits um we're going to start with like normal computers you probably have a rough understanding or idea of what a circuit might be and we're going to start with the gates in the circuit so you may or may not know this but in normal computer gate is a nand gate I think this is true I mean it was true if I'm wrong maybe somebody can correct me but you'll have just nand Gates um before we do a nand game to an and

gate so this is an and gate two in one out excellent one video go in Zed come back comes out arrowser ones or true and false and an and gate just says if both the inputs are true then the out Arrow that's what's in this table here okay these are the only kind of legal combinations of values for this gate uh then for a nand gate it's the same thing but you just take the and thing and then you negate it so an and gate um if it takes in two truths it output's true and is otherwise false so then for a nand gate you're going to take in two

truths of the gut give out false and if not give out truths [Music] okay so this is the game like a normal computer um a nand gate and then we want to put these together into a circuit so you just lay out some of these Gates and you're going to connect up the wires and a circuit is just a collection of gates with wires connected in whatever fashion makes sense he probably had a rough idea of circus but I just want to like touch base and like so we're on the same page um if you want to learn a little bit more about this uh oh okay before that um the thing about what you can do with these computational circuits so obviously you're using computer right now and it's doing all this crazy stuff so clearly you can make these circuits do loads of things but we're going to

want to think about more specific examples related to the real world maybe it's withdrawing money from an account to be analyzing some data and then maybe you can find some other examples too um so I I have a balanced background or I didn't do computer science but I read this book and it's really really good it's for people who don't know computer architecture and the guy really good uh well written popular book he just talks you through like how to actually physically build a computer from scratch um so it's a really shitty computer but it shows you the core things and uh CPU and then a ram and everything else is peripheral um so reading this book was really really helpful to see my honest my understanding of like how a computer works and that I'm not a computer science student and maybe some of you

are similar then in the zero knowledge case we're going to take the idea of gates and circuits modify them for how they work in in our scenario so instead of non-gregation gates one more up so addition takes your name B up at C multiplication takes your name B output C uh what are the wire values so previously we had binary it was the true and false or zeros and ones now we're going to be using numbers now if you really really hate numbers and maths um you can just imagine these as all

whole numbers so 0 5 10 minus five up to you know Infinity a million minus million um and that you know you don't need this stuff to apply the technology as a business person but it is helpful to understand this aspect of things so we're going to briefly touch on on finite fields and I'm sure you probably know this anyway so uh we won't spend too long uh but the starting place the idea is it's like numbers in a clock so if it's 10 a.m and four hours pass then like would say 1400 in Europe some of us but it's also 2 p.m and like how do you know it's 2 p.m well because you know that like well if it's 14 but you just take

away 12 so you end up at 2. okay so this circular wrapping around the numbers is exactly how finite Fields work the only important difference is that uh the total number of numbers in the clock is 12 in a finite field it always has to be a prime number so you know we can't have 12 but we can have 13. okay now fields are they're like there's loads of complexity and loads of theories and lemmas and all this kind of mathematical stuff but you don't need any of that really to to make circuits you just need the idea like the definition of them just a few examples just just to be I've seen some in case they haven't before let's take our Prime

P to be 13 and then I'll just walk through these with you if we have five plus fifteen well twenty but 20 is not between 0 and 12 so 20 minus 13 we get out seven so the answer is seven five times by 9 is 45 um but we need it to be between 0 and 12 so 45 take away 13 is 32 32 take away 30 is uh uh 19 I think I can't rain doesn't work very well right now and 19 take away 13 is six so you kind of you know uh bring it back between 0 and 12. the same as 13 we won't have 13. um because the size of the set is 13 but we don't go from 0 to

13 we go from zero to twelve instead of 13 we have zero because you have 13 minus 13 to get zero and minus one I'm gonna add instead of take away so minus one plus 13 is 12. okay just very briefly I'm sure miss you know this already there's some other ones on there for people to look at later and then this slide just has the answers for people looking at this in the future uh there's also The annotation we use in this image we have a b and c and then this kind of e thing is isn't an element of F and this is mathematical shorthand for a field this F for the double line just means field uh and then again the field equals the number of the set from zero I know this is no but it's supposed

to be a zero up until P whatever our Prime p is in our last example it was 13. uh now this where the square bracket here on the left this means include the number so includes the number zero but the parentheses on the right this means don't include that number so it doesn't go up to P it goes up to P minus one uh and that's like all you need to know about Battlefield really this is also a good time to point out one detail that um about you know how things work in zero knowledge there's there's zero line specific hash functions so Poseidon is the I think the most popular one um and you know why not just use an alma hash function like a sha the reason is

like Shah was designed for the native numbers to be binary to be zeros and ones or true and false so you can do that in a zero knowledge circuit but the numbers aren't natively binary they natively field elements between zero and one of your Prime peers so then you would have to like constrain all these field then fill elements to V binary to be zero one and this takes some constraints you're putting in some gates already so we're already growing the circuit and then to do the binary operations the nand gate or whatever it should be this is going to give it a more gates because it's not like a natural gate per se uh it's not it's not an additional multiplication game so you can emulate normal hash functions in a zero circuit but you have to

emulate it and the cost blows up so uh we ideally want them to be faster so we have zero on our specific functions and these are designed with field elements and with these additional multiplication Gates um zero knowledge technology has just existed for like 30 years or so but it's only just now becoming computationally feasible to make use of it in the past few years and making circuits faster is still a big challenge so this is like an important aspect to keep in mind uh okay then previously the Nan Gates remember we had we had them we're connecting up the wires uh but nand gates are like physical you know in your computer you have actual Gates there

with actual wires connecting them these gates in zero knowledge they're ephemeral they don't really exist they just they exist in our minds by the way we deal with the numbers going on in the computer so if we want to connect with anything to connect so what we do instead is that you see in this example here I've got we've got two gates a demultification and the addition we have a and b go in left wire right wire and the output and then the multiplication gate the input is left wise C and right y d and the output is e obviously I mean these two C's to be the same the way we make them the same in zero knowledge is uh what we'll do is we'll take the

circuit and the Y values and we'll make a copy of it and in the copy we will swap the values that we claim um are the same that are the Y's that are connected okay and then with improve system you kind of like juggle these around and and if they're not actually the same if the Y's aren't actually connected the the proof will fail um but the idea is the same you're just connecting up wires but you know instead of collecting for y you just permute the you just swap the numbers around that you claim to be the same and then you know I've got this dashed line here so you can you can you can uh you can connect as many wires together as possible you know maybe this output Edition gate goes into a hundred other

Gates it can be arbitrary number uh one caveat for the explainer that I'm going through here Xerox proof systems are quite complex and complicated and if we try to just explain everything in the beginning it just like wouldn't we wouldn't go very far with people everybody should be so confused from the beginning it makes a lot more sense to just take one proof system and understand it in vertical in full and I'm doing this with Planck because once you understand one system in much more detail then group systems are quite modular so you can just start learning a new piece and swapping it out and putting it in so it's better just to learn one person properly and then kind

of arch out from there horizontally and I think Planck is like very pedagogically good easy to start with it's also used a lot it's the plunk stuff is using Halo tour Bunch which is used by the ethereum foundation and zedcash and some other places this is a good one to start with uh recap a zero night circuit is just these Gates additional application Gates placed around and connect up with his permutations um I want to emphasize as well that that if you have the same Gates but they're connected even if one wire value is connected differently then these are like different circuits okay so a circuit is very specific it's exactly

all the types of gates and exactly how they're connected uh going back to our original statement like what actually is a zero noise proof well this proof little pie here we usually use pi to denote it is some bit of data and you check it if it's valid or not and if it if the proof is valid then what it says is that you filled in some circuit in a valid way this means that there was already a circuit that existed there were Gates and wires connected half of the way but all the wire values are what you put in place and if you do this in a valid way it means that if you do it have an addition gate and you have a and b go in the only

possible thing that c can be is the addition of A and B and the multiplication game the only possible thing that e can be is the multiplication of c and d so this is what the proof says you fill this this circuit and in a valid way okay and the the value of this is going to be like what circuit says about the outside world uh one other thing is that uh the prover can reveal whichever wire videos they want you know maybe you just tell me the Y value e so then I check your proof and I say this is valid and you get and this way I know that you know three numbers such

that if you add two of them and multiply by the next one you get out e and let's say it's 17. you know I don't really care about that computation right now but it's a it's a dummy computation we're gonna go into some more useful examples soon uh last two points before we go to the examples how do you make a proof what information do you need well you need you need the circuit so you need to know what uh how many gates and what types are they and then how are their wires connected and then you also need to know all the Y values I mean the remember the proof is a statement that you know all the Y values and and it's a valid combination of Y values

and this sometimes refers the proving key so you'll need all this data to make the proof so it's the proving key it's the thing that like helps you unlock it or something uh then that's for proving and then for verifying uh what do you need to know about verifying you need to know you need to know the circuit right because remember the proof is a statement that you filled in the Y values correctly for some circuit so we have to know what circuit that is so how many additional multiplication Gates and how are they connected and then you need to know the public wire values okay that what what y values is that is the prover uh what and then what value is like I said

it's about what are the colors about the outside world the real world for example if if you don't reveal any wire values there aren't any public y values and you give me a proof and when I verify your proof all it tells me is that you've filled in some computation I know what the computation is maybe it was a hash function if you filled in a hash function in a valid way I'd like I don't I don't care you haven't told me anything of value you just put you can put in any number and get out any other number there's no value there because you haven't shared with with me something more specific about the real world you've just solved this this put in some input for that function but if you make a zero proof of this hash function and you tell me what the output

is then I have a proof that you uh know the secret key to this public key I.E I.E you're the owner of this account now that has some value possibly depending on the public key you know maybe it's one with loads of money or something like that so what are the what does the circuit tell us about the the world this is where the value comes from and going the other way um how to use zero noise proves to solve a business problem you've got to figure out what does the circuit have to say about the real world in order for this problem to be solved uh so I think we can dig into the examples now

um so like this this explanation is kind of different to a lot of the other generation I've seen out there that dive into maths and polynomials and how zearnage proofs work I don't think that matters for for the vast majority of people I think uh technology more widely we need like business people and and developers who just understand the interface and not what's happening under the hood the same as the internet like I don't know what the internet's doing or Wi-Fi I like I'm sure most people don't but I know how to use it I know what I can do with it and that's kind of interface Focus that I think people most people should try and take so for our first example um there's the RSA factoring challenge I'm sure of you have heard of um RSA before it's a encryption

communication protocol they've been using for decades online um to for the so that me or you can speak with somebody else online you know maybe you want to speak with your bank online and it helps make a secure line between uh the way it works is that you will come up with around a massive random Prime called p and your bank will come up with another massive Prime called q and then you'll do some exchange mechanism and you'll end up with PQ now any eavesdropper who's trying to listen in they won't find out P or q but p q will be publicly known um again I'm sure most of you know this but I'm just clarifying um if you know PQ you can't find the

factors p and Q uh [Music] you can't find factors p and Q that made PQ now the same particle proof of this but people have been trying for thousands of years and they're like pretty sure that the only way to Factor on those is like The Brute Force but brute force is kind of computationally bounded based on what's what's realistic so if you make p and Q big enough then it's going to be like literally impossible for anybody to to those numbers um as computers get better over time and some of our algorithms get better over time the the size of PQ might have to grow and you know just to get some rough idea of how good we are there's there

are a fan Challenge and what they do is uh I can't remember who who runs it but they just put a bunch of numbers PQ pair values and you have to just try and figure out what p is or what and what Q is okay and for some of them you have a cash prize uh so this is just a screenshot from from Wikipedia there's all these numbers uh you know many of them sold that's one 2020 that the last one 2020 was RSA 250 and 250 decimal digits it's like loads uh but the one we want to focus on for this example is RSA 896 I'm here um cash prize 75 000 really nice uh 270 decimal digits so like you know base 10

and base two and that's like such a big number so the universe has like 10 to the 80 um atoms in it to 270 digits decimal digits it's like having our universe every atom in our universe but every atom in our universe is also a universe and every atom in those universes is also a universe so it's like our universe cubed which I can't even begin to Fathom how large that is it's just like so ridiculous so computationally like very very extremely hard to to solve this kind of stuff uh foreign but you're really skeptical and you're

you're worried that if you tell people they might share they might steal your your results and they'll take your money from you um so what can you you can make a zero knowledge proof okay so what do you want the zero knowledge proof to tell you and we're trying to like think about how to use this to solve problems so if you want to use a zeronautics proof then we kind of want some circuit that proves that we multiply two numbers and get out r a eight nine six okay so it's fairly straightforward circuit right we're just going to have the other way around doesn't matter

output r896 now if you do this and then you make proof and then I can verify the proof and everybody else can verify the proof because what should be that what should be the public y value the Y values that you share um obviously you don't want to reveal p and Q there's exactly the things you're trying to hide but you want to share RSA eight nine six we want to know that the number that you multiplied to get is this public number that people are asking and then I we can all buy it hey congratulations you you solved this problem you get 75 000 but not quite okay so there's gonna be different kind of bugs that you might have in making

zero large circuits compared to like programming in other areas uh this isn't actually quite true because there's another combination to this gate or this circuit where you don't need to know p and Q and maybe you'll probably realize like you can instead of having p and Q you could just have one and RSA 896 because one times by RSA 896 is still RSA 896. so this circuit has to be more than one gate there's a few ways you can do this you can check that both numbers aren't one you can check the both numbers on RSA 896 or you could check that P is neither one or RSA 896 okay so here we want to

um what we want to do is on the left here I've got this p and it goes into this Square gate that says I know and the output is one I mean Square not a circle because it's not actually a gate it's a collection of gates um it's a sub circuit like the Ino means is not one so what this part is doing is it's checking that P is is not one and you know these sub-circuits we usually usually refer to them as gadgets uh these are things that you're gonna what these are like common structures that you're going to want to use in lots of different circuits so checking a number is not one probably like you know you'll have to use it occasionally in other circuits as well so rather than always re-implementing it yourself

you're just going to use a gadget that some other really smart person made no it would cure um and then the output is going to be one and this should also be a public wire value because you know it's not um it just says true or false based on whether it's one or not and you want to check that it is true that it that it's not one so it should output one uh and then we have this dash line remember again that this is the connecting up the wires so these two p-values should be the same repeat the same thing on the other it's on foreign values of these outputted ones and the

rs-896 now we have a proof that says you know two numbers that when you multiply them together you get RSA 896 and neither of these numbers is one so now the only reasonable uh conclusion from this is that you solve the RSA factoring challenge okay so this is like a kind of dancing for example where there's not too much going on in the circuit uh second example let's say that your your Satoshi and you want to prove it there's loads of ways to prove it but we can use zero knowledge proofs because it's an example uh you more specifically

you want to prove that you're the owner of the public key because then maybe you're a Satoshi uh so I'm sure you'll know you derived the public Key by hashing the secret key so if we want to make a proof that does that shows this shows that masutoshi then we want a circuit that that shows that you know the secret key and that the output is the public key so I'm sure many of you can work out that the circuit should be uh again it's a square it's a gadget hash HV and you're gonna take in the secret key and you're going to Output satoshi's public key and the things that should be public

values here which should only be satoshi's public key right you don't want to share anything else so then if people if you see this proof and it's valid and the alpha public key is satoshi's public key then like what the circuit says what the proof says the value in the real world it says that you know the secret key it doesn't say that you are Satoshi you know you could be but it just tells people that you maybe maybe you actually are him uh maybe you got lucky finding him to dark web or something uh maybe you had like figured it out but that should be

computationally impossible otherwise the hash function would be broken okay but so again the the point the one thing I want you to think about is like what is the circuit and the proof tell us about the real world and why is that valuable um okay I'm just gonna check okay I think we've been going for about 30 35 minutes um maybe 10 15 minutes left uh third example ZK VM this is one of the things I mentioned before they're trying to you know turn the area and sort of make all the all the blocks instead of if you want to be a full node and you want to you want to join the entire chain is correct and for every

new block you want to check that it's correct well right now you just have to like read the entire thing and check it's all valid and do everything but you could maybe use a zero knowledge proof instead and maybe I could check the entire block is valid and make a proof that I checked the entire block and then I can share this proof with you and now you can instead of checking the entire block just verify proof and verifying that much faster this is the scalability we had so verifying the block is is much faster by verifying the proof rather than the directly and this is the kind of basis for this evm um you know Scrolls working on this there's a team at the the ethereum

foundation working on this those of other okay sync doing similar kind of things this is one of the things I was complaining about a little bit where we call it zkvm because we're using zero and orange technology but there's not actually our knowledge it's we're just using the scalability property to prevent a double spend in ethereum you you you to um you just have to like ceiling so you have to get rid of the zero knowledge otherwise that you can't apply this technology here um I'm not going to explain the zkvm very well because I've not spent very long looking at it I'm sure others could explain it much better than me in in other places but we'll just touch on it briefly so there's also many reasons for falling as akvm I'm just talking about checking the blocks because it's just a simple a simpler thing to focus on

uh so we've got a circuit that checks that all the evm codes were followed properly you're going to want to check that the block points to a value previous block you're going to want to check that the included transactions are all valid you're going to want to check that all the evm optcodes that are being called are being called because they are from a signed transaction and loads of other stuff this is a very complex circuit or set of circuits that has to be made and you know it's going to take a long time to build all those and make sure they'll function well and don't have any holes in them um but those are no angles there are knowledge it's all just using the scalability property and I'm sure there are many links online that others could

share about digging into this in a bit more detail uh but you know the value of this circuit is that rather than spend all the computational power every single node in the in the network using computational power to check everything they instead verify proofs to save a lot of energy so you've got computational power and just you know allow us to direct resources elsewhere and have producers and things like that um okay I'm going to right I mean I asked this because I do not have margin I did kind of already say half the answer but it's just something for you to think about as well uh I'm gonna skip this example and I'm gonna jump to the last two non-examples

and and then just kind of conclude and then have time for questions so like another example uh I had friends at school really I did definitely I can't do this as much proof you can't just prove anything you want with your eyes proof you've got to choke zero knowledge at it it doesn't work that way uh you know you make you could make a system that does this you know maybe the school they have like a monthly meeting and a consensus meeting where the teachers they all chat and then they're like yeah yeah those two are friends and then they sign a transaction but not on chain and then they do this for like all the kids at the school every month uh and then later on 10 20 years you you've got the stuff on chain and you can prove that you were you know that you had a friend because

it's in there um but I can't do that because that didn't have my school this should clearly never happen at any school uh yeah but you you could actually like build like that but then there's all this consensus stuff that goes on so in that rough scenario where teachers meet how do you know it's actually like safe and secure how do you know it's run well if you've just done at one school like you know it's not going to be very secure all the value of Xerox proof is kind of wrapped up in an external consensus mechanisms as well we we trust the consensus mechanism of blockchains we've got a lot of evidence for it a lot of good arguments but depending on where else you apply zero is proof maybe like external context and um consensus mechanisms that are

important that don't work and uh so you've got to think about those as well okay uh last non-example tornado cash I'm sure we'll know about the what they do is yeah they mix your money and they use it you just do it through tornado cash and then you want to be private but like you know imagine that they just built tornado cash it just goes live you're the first person to put in money you put in one eighth and then nobody else touches the kite for nbls touches the contract you spend that one eighth well now we've just had one incoming transaction and then one outcoming transaction and nothing in between tonight now obviously the only person

the outcoming transaction could be is the person who put the money in there in the first so it's more context and so zero has proven just like everything for us immediately there's still other like real world things that they make use of uh and then there's I'm sure there's loads of other non non-examples uh last two slides uh one of the key takeaways is if you're trying to use the technology to solve the problem you have to find the rights uh like what does what should the circuit do and then what should the proof of that circuit tell you about the real world because if the proof doesn't make it come the real

world then it's essentially useless um so think about what functionality has to happen inside is there like a hash function do you have to check values and numbers do you have to check like Merkel tree inclusion and things like that and then what values do you have to publicly reveal so the the rumor Mercury um the output of hash function uh you probably don't want to reveal that input of a hash function uh yeah and then there's things like knowledge asymmetry so if you want privacy or other zero knowledge aspect then this means that like only the prover should know the certain knowledge and nobody else should probably needs to verify it shouldn't um so when with the system you build where you want to integrate zero

knowledge why would the prover for this knowledge and nobody else would these additional communication mechanisms to make that happen is that feasible um everything else wrapped up there uh and I didn't put this in the slides but there's also like the engineering work involved in making zero circuits it's pretty hardcore it's getting easier as we um build out the landscape where rather than like lay the gates out directly you have things that like build it for you um I can touch on those in another presentation if it makes sense but uh there's like Leo from Alia which will turn your leoco which is javascript-like into a Marlin circuit which is a proof system like plonk uh yeah so there's a lot there's lots to

think about and then final word is about trust and like does everyone just remove the need for trust like no foreign I could verify the entire block but I instead could just verify the proof so by verifying the proof I don't have to check the entire block so it has helped somewhat but then there's still like outside world trust and the voting example I didn't have have time for a good place to see where the outside consensus making them really really does matter for the proof telling us what um the the thing about the real world that

we found important um yeah so those are the main things I want to to give I uh like I said I wanted to make this kind of a pedagogical different route compared to the other content that's out there and I think this is more kind of messaging we should be spreading about zero knowledge because it's it's helpful for people and this is a foundation for actually thinking about how to apply the technology it's not really just about like oh you know here's the polynomials and this is how we commit to them and then we open them later and we combine them this way and you make it faster like vast majority of people don't really care some of us might may find it interesting but if we want to unlock more value from this technology we need to like help it be spread and used in

other places and used effectively and not just as a buzzword that gets the money from VCS uh quick shell uh we're organizing uh conference again here next year in Istanbul a two-day conference two-day hackathon if you're interested in attending or speaking or sponsoring out we'd love to chat with you please get in touch with me and then if you want uh like more a follow-on lecture that purchased more on the details of like things under the hood in in plunk or maybe Halo 2 and some other like zeroid related things and some more examples uh just pester us and pester me and then I can I can try and find some time to to make more of them if you found this helpful uh thank you very much for listening and if there are any questions I guess we can start digging

into those oh thank you that was I thought that was really excellent um thank you I yeah especially when you you know the idea of there being a really big gap between the motivated Learners and uh what's available and trying to help more people understand how how this not just how it works but like why it's useful to you know to me yeah yeah I I think one of the big problems is that like most of the people who are really good with this technology they you know they've got really well-paid jobs trying to like build the stuff and improve the systems they have like less time to to to to make educational content and they're used to explaining

itself to technical people and to VCS and this kind of stuff where they they're really like explaining the details but for other people that isn't the messaging that that we need and but yeah so these people the smart people who can explain it they've written like minus and their their messaging system to explain it at this level but that's the wrong level for us so we've got to spend a bit more time trying to take it in other directions and others do good work in this direction as well I mean you know like it's okay uh it's okay podcast okay hi kind of rose and I'm sure there's plenty others that I've I'm not able to properly credit yeah and we uh so we reached the Discord limit for streaming for the first time that's not us that's the Discord and then on Twitch we had like 16 people

watching so it's pretty popular and people like the YouTube also um so I'm just I just dropped a bunch of links uh to errol's Twitter and some of the things he's written I'm also going to include a survey if everyone could help fill that out um if you're interested in talks like these or hearing more from Arrow um just let us know in the survey and also there's a collecting feedback from for the applied ckp website which you can find the Prototype testing Channel I'll drop the link in there um so now if anybody has any Nations uh you can unmute and ask or type it

into the chat uh thanks if there's other questions on the twitch stream If people could copy that that over that'll be helpful I'll just quickly say this um this blog post that's here from node 101 that I wrote and this is basically just based off this blog post that I wrote I hopefully you know turning it foreign they use uh nullifiers

um it is a very good example I'm like I'm fairly sure of that I'm pretty sure it uses zero knowledge proofs and not just um other other tools maybe somebody else could help elaborate but uh that could actually be a really good thing for example to dig into in much more detail in a talk or or a blog post so that wasn't a very good answer but I think I guess we just give a h okay I didn't quite is that

please repeat that uh yeah let's download that info I would love to we don't have a web yet um I'm okay I I I'm trying to help this grow and build it and get good speakers I'm gonna drop in mind if uh you're interested please just message me and then I will like as soon as things are ready I will send you the website and stuff like that uh we're trying to grow the community here we did like a one day event this past summer but um taking time uh there probably are blog posts for semaphore uh I I haven't seen them I haven't looked at it too much but if someone can find them it might be a good time to

drop it in the in the chat okay I just wait for these last people who are typing to finish and then we'll know whether there's more questions or not foreign I think there aren't any more questions

if there are I will just try and like look in the chat but I think um if not then I uh other people want to head off so thank you all once again for coming uh pesteros if you want more of from me or from others from this uh sorry there's two questions in the chat if the last two questions if you don't mind uh okay there's this question here sorry I didn't hear what people were saying but uh there's asking if there are any constraints on creating circuits some of the stuff I didn't mention that I can expand upon in later on is that um I said there's an additional multiplication gate in plunk it might be quite true

um but first you pick up you can make other type of gates you can Define Gates that do whatever you want you know you don't want to be too complex otherwise it will slow things down um but also that these don't actually exist it's actually just a table just a table of values and it's how you interact with that table that that um you get these properties so I said that the gates where ephemeral didn't really exist they're actually numbers in a table and yeah you can do stuff so there's there's constraints on like what's possible because they have to be you know mathematical things but you can add more complexity and then in terms of creating circuits uh constraints for making circuits is just like there's practical constraints

of like if it's too big um the circuit's too big there's two minutes um and two complex Gates take too long to make so for example with this evm for ethereum uh you need to proof quite quickly you know is it 10 second time I've not climbs for ethereum so you need to make a proof of the block within a second and if you can't do that then you technology can't be applied there so there's lots of like real world constraints about what whether a circuit is fee or not use white paper oh cool thanks uh okay I'll see if there's a follow-up

question [Music] so I think if the post uh links being shared I think they're here forever so if people watch this this later or want to find these links later they can just come back to this chat which is the public chat uh staying the PSE Discord uh and there's some cool links being shared here I mean I want to look through this at some point as well [Music] okay just wait for these last two comments to see if there are yeah oh is this is this link for tornado

cash is it just now ntx CS explainer I made a video on on this now I'm just going to show my video because I put a lot of I use like three balls around for making videos and I put a lot of work in so maybe people will like the vision um so there's only made one of them so I didn't like get the benefits of getting better at me oh so is it okay what's the best place to start from a trusted setup this will be a very good content for the next talk as well it's kind of hard to

summarize too quickly for each gate um let's assume it's a universal one and well that means other time but you need numbers for like you'll go from numbers one up to like 10 10 or 100 million there there is a document uh you know I think you can individually mute people who have left on their mics by accident uh yeah yeah I think it might be better to wait and explain these in more depth and more effectively in others I'm I mean I'm actually just gonna make a quick note of some of these topics for another talk for our next talk

so I think it's a good time to oops leave it there uh yeah thank you once again feel free to reach out to me individually for questions about this or Istanbul and also put questions in the chat and I can ask them for everybody to see too uh yeah cheers thank you have a good day and a good weekend cheers