The Path to Scaling Zcash

Transcript

Hello everyone. I'm Dave Ojha. Today we're talking about scaling encrypted money, aka Zcash. So, where does it start though? And the goal begins with the the very beginning of the industry, Bitcoin 2008, you know, a peer-to-peer electronic cash system. So, we're promised making digital cash. And the goal with Zcash is basically delivering on that dream. Zcash is trying to keep this promise. And being cash needs a few properties. But this is somewhat complementary. So, with Bitcoin, it started with digital cash. It's literally in the white paper.

Now, today you'll find zero people talking about transacting with Bitcoin. It's now just a store of value, digital gold, etc. You know, that's how the narrative changed. But Zcash it started the in the opposite direction. What do you need to be a perfect store of value? And then transition by adding scale to get the digital cash. what does digital cash need aside from scale? Well, it first got to be sovereign, you know, it's a sovereign store of value. That's rule one. I think that's premise. Then you need to be fungible. Well, you need to be durable, meaning that you can just walk away and hold your funds for a decade and or many decades.

And then unique to being cash, it's got to be fast and scale. So, let's walk through the other two parts first. So, fungible, this one's kind of easy. Means one Zec equals one Zec. There's no history to a coin. And you can't just look at something and tell where it was in the past. No serial numbers per coin, etc. And why is this a problem? Well, if Satoshi came back up came back today, he wouldn't be allowed to sell his coins Uh, just even move them. You know, CZ had a tweet uh what a couple months ago about freezing uh digital currency coins as does every exchange.

That's not okay. That's not how you become either a store value or long-term cash. fungibility requires privacy at every layer where you as the holder get to choose what you disclose, nothing's on the ledger. step one is being on-chain using zero-knowledge proofs. So, Zcash very conveniently pioneered how you fully hide all the data uh for like the sender, receiver, and amount that's on-chain. It's encrypted, so just you control this information flow.

That's ZK proofs. But then, what's kind of unique to the stuff Zcash really is paranoid about is the wallet side of how do you have software that like preserves your anonymity? So, there your soft your wallet has to figure out how did you get paid? And so, it uses techniques like private information retrieval to uh you know, discover your balances privately. And then, you got to protect your IP like you know, it's no good if uh everyone your RPCs can see hey, you're in Singapore right now. So, that's where you know, IP protection comes in like Tor, Apple Private Relay, uh DCnet, etc.

cool. Let's have what what's going on fungibility. Then, durability. Can you walk away for a couple decades? And you know, put it in cold storage, come back in 2040. Hey, well, that one's pretty much yes. And you just go Shielded Zec today and it's fully quantum recoverable. If I could edit these slides uh this morning, I would have added in uh this this exact technique that's being done protects you for AI as uh balance as well. You know, there's a new panic today about oh, did A is there some secret uh attack on elliptic curves? We don't have to worry about it. We're quantum recoverable, which means that uh if something happens, we But you freeze the pool and you can migrate your funds without extra risk.

So, you know, in order to be durable, you got to security box. So, well, what goes on, you know, formally verify all your cryptography, all your zero knowledge proofs, etc. Then you go fuzz test your cryptography. So, there's a recent post about how you do this. You go minimize all your supply chains, use all the AI tools in the world like, uh, you know, the frontier models with their, uh, security access, mythos, daybreak, etc. Just keep auditing all the code. So, perfect. And another thing you add here is being able to upgrade quickly. So, Zcash has upgraded three three upgrades in the last 6 months. Uh, the hard fork, uh, Ironwood, and now this next one 97. And then we'll upgrade again in like Jan for tachyon stuff.

So, it can adapt quickly to, you know, concerns. So, now to the core topic of the talk, uh, scale. So, the goal is if you want to be use Zcash, you got to be, uh, ubiquitous. Got to be everywhere. I can't just pay, uh, pay for for $10 for coffee, hey, and then, uh, that blocks you from paying Bob down the street. That doesn't That doesn't make any sense. It doesn't exist in cash. Cash is perfectly parallelizable, so should, uh, your blockchain. what do you need here? Well, thankfully, we already have one reference for digital cash, Visa and Mastercard.

Their capacities are published. So, if you, uh, look at them, they they support around 50k peak TPS, uh, capacity. They average around 15k utilization. So, great. Let's go make the goal 50k. How do we get there? Uh, well, conveniently, uh, on this stage last year, actually, co-founder of Zcash, Shawn Baugh, talked about one of the cryptographic breakthroughs that get us there, tachyon. And what the idea of tachyon is you take this hard problem of how do you scale a blockchain and then you use recursive recursive zero knowledge proofs and several clever tactics to reduce the scaling problem from you know how do you scale a node to have terabytes of data etc. to

instead you just have to scale consensus and the mempool like this the P2P side because the we only the chain will just have to check one recursive zero knowledge proof. And then all the overhead for like history and privacy gets pushed client side but it's not intense for the phones because they can talk to like archive nodes. If people are familiar with like stateless blockchain proposals this is doing that for Zcash. So cool. After Tachyon then scaling is a relatively simple bandwidth equation.

When we go when average transactions fully post quantum private it costs about 2 kilobytes a transaction. You have you want 50k TPS? Great. Go make consensus have 100 megabytes per second of bandwidth. So uh perfect target. Let's go do that under pure proof of work. Solana is actually already at 100 megabytes per second uh of throughput under POS. So how do you do the same thing in proof of work? What's it going to take? Well a lot of faster block propagation. You you know you you erasure code your blocks gossip them around whatever your high speed blockchain does focus on too much time on that. Um similarly pre-gossip transactions mempool and get all of your recursive aggregation very fast even when you go

to post quantum STARKs. How does this actually get delivered? Well go through a bunch of upgrades over the next year each doubling sends us throughput. We need a lot of doublings and turns out the first 100x is kind of easy mode. Cool. What are we using to get there? There there's a new node being made called Zakura. This is like joint work with Shambala Tachyon and Valor Group which basically is tackling a bunch of the hard problems needed for this. How do you get high-speed block propagation? How do you get high throughput despite uh preferred block times? Something people may not realize is that in proof of work your 1% of blocks are super fast. So, if you have an average of 25-second blocks, 1% will be 250

milliseconds, around the time it takes to talk around the world. And 2% will be 4x longer. So, it would be like 100 seconds or more. So, you have to decouple gossiping data quickly in independence of uh consensus finalizing and or, you know, adding proof of work that uh on top of this stuff. Then, we need to work on one other item, which is cash needs to be really fast. So, you need to get pre-confirmations, like you need to be convinced your transaction will be included for small-value transactions faster than block time.

Cuz, you know, you want to go pay for a cup of coffee, be done in a sub-second, not uh hours. And then, uh we're doing some other stuff on how you aggregate transactions, mental, etc. there's one other part uh privacy that's actually the real bottleneck, not consensus. And this is how does your wallet learn it got paid? Cuz a private transaction has no data visible on the chain. No one knows who it's from, who it's to, or how much was in it. So, how does an RPC help you find your balance?

Uh and it turns out it doesn't. Uh uh Normally, in every other blockchain, like Solana, Ethereum, Bitcoin, your wallet just gives a server all of your addresses. So, it links, even if you have multiple seeds or multiple accounts, it'll leak all of them to a server that there's all you to ask, "Hey, what's the balance for each?" So, the server learns exactly who you are. The other alternative is you download every single transaction history. So, how do you solve that uh there's no to help you? Don't index, download everything.

And, uh, that's what Zcash does today, and has, because at any given point, Zcash will always choose, uh, maintain user privacy, and maintain fungibility at all costs. that doesn't work though if you want to get to 50K TPS. So, if you just work backwards, uh, you know, there's a difference between pre-quantum and post-quantum because, uh, post-quantum encryption is a bit bigger. And if you your phone would have to be downloading 8 terabytes of data a day at 50K TPS. instead, we do another trick.

We are pioneering deployment of a cryptographic technique called private information retrieval. So, that transforms 8 terabyte overhead to, uh, per day to just being less than 10 megabytes of querying every time you open up the wallet if you want to get your latest state. Query servers, uh, with 10 megabytes of, uh, upload download, and you're, uh, connected. It almost sounds too good to be true. So, how does it happen? How do we build this like private indexer? And effectively, you're making a private key to value lookup. It's a imagine a key value database, and now, uh, make it private. So, how do I do this?

You as a client homomorphically encrypt your query, and you send this encrypted query to a server. The server does a massive matrix vector multiplication, and then sends you back the encrypted response, and as a client, you decrypt your answer to find your balance. turns out the server's basically doing a massive matrix vector multiplication where the matrix is the size of your database. Very conveniently, uh, the AI folks have made this incredibly cheap for us. Uh, you know, all of your, uh, lovely, uh, AI model inference is just GPUs computing big matrix vector moles. So, we do that. Homomorphically encrypt, server matrix moles, and you get the answer back.

So, and importantly, because all homomorphically encrypted, a server doesn't learn what you ask for. And uh spoiler, everything we talked about is already happening in Zcash right now. in one of the main wallets, uh ZK provings like massively gone massively faster. So, at 140 milliseconds of proving, sub-second latencies are now a real thing. Every single uh every single wallet in Zcash is using PIR for voting. And now, uh in Viser, it's being used for extra privacy protection on every single uh query in the wallet. So, instead of doing this whole uh download the whole blockchain, 8 terabytes overhead, you use PIR to bypass that entirely. And very soon, this is coming

into Viser for scale. So, on the chain side, it there's an upgrade scheduled for November 5th, uh you know, what, 28 days, where consensus span width is getting 3x, block time's going from 75 seconds to 25, which means the UX of using Zcash, the snappiness of everything, should be getting 3x faster. Here, uh so uh huge news, and all this block processing gets way much faster as well. So, uh this is how we deliver on the dream, peer-to-peer electronic cash, uh as and as a sovereign store of value.

So, thanks everyone for your time, and uh try out private wallets like Viser.