Post-Quantum Transaction Signature Breakout #16

Transcript

Antonio Sanso: Matteo. Hi Matteo. Can you guys hear me?

Matteo Vena: Citi Sentiamo Tuccicenti.

Antonio Sanso: Yeah, yeah, good. Alessandro.

Alessandro Baiocchi: I…

Antonio Sanso: Hi, Toma. Today might be a quiet call, but as usual, we start a couple of minutes after. Just in case there's some late joiner. You see my… screen.

Matteo Vena: Yes, we do.

Antonio Sanso: Okay, perfect.

Alessandro Baiocchi: Yes.

Antonio Sanso: It's still not 3 o'clock, we start around… now it's 3, we start around 3.02, as usual.

Matteo Vena: Okay.

Antonio Sanso: I usually put a reminder on Twitter about the call. I mean, the last occurrences I did. Today, I didn't do it on purpose, because it's pretty quiet. There's no presentation, so it might be a bit more quiet than usual. And yeah, I was more looking for more discussions, but It might be a quick one today.

Right, let's start, and I guess that today's gonna really be a quiet one. Welcome to the Post Quantum Transaction Signature Breakout Room number 16. Today is September 30. And, yeah, I, again, I don't have anything in the agenda today, apart the testnet. That's why I didn't put too much noise into the various channels, like Twitter and so on. for the few people that are here, and I think this is more for you, Tomas. Because, the other day, I see Matteo, Matteo, and Alessandro, and Benedikt, they didn't know about it. We launched a testnet. Daisugi. And, yeah, thanks to Giulio, Natira de Riva Labs, and Emil, and the DevOps at EF. We have… launched two versions so far. The first one is version 01, that was.

Non-native account abstraction, so ERC-4337. And, signature, this is some variant of SPHINCS. And. Yeah, we actually managed, again, thanks to RivaLabs and Giulio, new version 0.2 that you can choose at the beginning between ERC-4337 and NATIVE, so frame transaction, there's EIP-8141. That will be Stefano, that will be in Hegota. And now it's here where I was actually looking for help, because we're starting with the next phase, and you basically want to implement 8288, so aggregated… aggregation of the signatures in the mempool. We have a version of, LeanVM and Lean SPHINCS, in… by Emil, and some patch from the RivaLabs people. And,

Yeah, here is where I was planning to have some kind of discussion, and if someone wants to help, so I see a part of the people already helping, I see you, Stefano, and… I don't know if you are interested in giving a help into this effort. And in case we're gonna discuss Stefano left, so it's only us now. Oh, no, it's here, Stefano, or Tomas as well. If you guys are into… Help him to this, we can have a discussion now. Otherwise, I mean, let's discuss about it in any case, right? So I don't know if any of you is familiar with 8288, but- Yes.

Stefano: Sorry, Antonio, sorry, since I was a few, a couple of minutes late, so I missed the beginning of this part. So if you could like briefly summarize what the.

Antonio Sanso: help.

Stefano: Apologies.

Antonio Sanso: No worries, I mean, let's move to the beginning, actually. It's really pretty quick presentation, because I don't have anything in the agenda. I was just, like, introducing the testnet. And again, the credits are of these guys. So far, we had the version number 01 that had non-native account abstraction, so ERC-4337 with some variant of SPHINCS. Then we already deployed Testnet version 02. where you can choose between non-native, so still ERC-4337, and frame transaction, and it's already up and running. And then we are moving toward the third phase, this version 03, but at this point, we are into Virgin territory. We know that we want some kind of aggregation. We have a version of Lean SPHINCS and LeanVM that aggregates signatures, and Emil was so nice that he did a version of LeanVM that aggregates the same parameter we are using Testnet.

So, I'm looking for people that are helping. So far, the people helping here are the Riva Labs guys, they're on the call. Giulio and Emil, if someone else wants to help. On this effort, we can start discussing, actually, now. How this will look like. And, actually, let me try an experiment. Let me open the… for once. Let me try to open the… The whiteboard, and let's try this experiment of discuss stuff here, why not? So… Because, again, it's really… this is really, like, virgin territory. And, So, maybe it might be a good idea to have people help. I don't find a whiteboard here, I don't know why not. Let's let me add it. Whiteboard.

Not sure why the whiteboard is not showing. Really found me. Whiteboard… Usually, there's integrated whiteboards I use all the time. But I don't know why it doesn't show here. Hold on a second. I really have no clue why there is no debt. The whiteboard's here, let's see here… Transcripts…

Hmm.

Stefano: You could always just, point the camera to a Physical whiteboard, then. Yeah, well…

Antonio Sanso: Sure, I mean… Let me find it.

Stefano: That's always the backup low-tech option.

Antonio Sanso: Yeah, yeah.

Gottfried Herold: Yeah, me too. The question is whether others should also be able to write on it, I guess.

Stefano: Oh, yeah, that would be… Yeah, right by remote prompting.

Antonio Sanso: Sugar option docs. I don't know. Let's see what is this. Again, I'm using the whiteboard all the time, so I'm… I'm kind of surprised that Zoom removed it.

Stefano: Actually, I don't see any difference.

Antonio Sanso: Yeah.

Gottfried Herold: Maybe it depends on the Zoom plan. Do you know who is… how you, sort of, set up the meeting?

Antonio Sanso: Depending on the pace.

Gottfried Herold: what kind of tier level of the Zoom plan it is.

Antonio Sanso: Yeah, this is true as well. Let me try this. I think I can add some… So, up, let's see if I have to add this now. Lucid, it doesn't do a scribble. So let me actually do like this. I opened some notes on my computer, the notes app, and I shared that one. So I can only write myself, I guess, in that case. I don't know what to do. I'm still looking to it. Sure. Oh, there's some in the chat. What is that? Oh, oh, thanks, Matteo, let's try that, yeah. So I'll share the screen with that board, I guess. Sure.

Sure.

Matteo Vena: Yeah, you can share the screen, but everybody can also just click on it and you should see it happening.

Antonio Sanso: Yeah. Do you guys see my… Okay.

Matteo Vena: it's.

Antonio Sanso: So how do I start a new one? How do I know? How do I write?

Matteo Vena: You can just grab the pen and start, yeah.

Antonio Sanso: Sure. So, here is the idea. So, you see… you see the screen, right?

Matteo Vena: Yes, we do.

Antonio Sanso: Okay, so the idea is basically like, hold on a second. there is, like, basically, like, you have… you have one… One user, it will have The transaction one… and the signature one You will put, the mempool. And this, yeah, will be here. T1. Signature 1… The same is going to be for another user. That's another signatures. E2… and Signature 2 I will be… oh, too much. Okay, let's see if I can go on. Wolfgang Wagen would be here. D2… And that's 2. So, of course, like, naively, whoever builds a block, and it will be, of course, more than 2 transactions.

Whoever builds the block will take the transaction 1 as signature 1, transaction 2 as signature 2, and yeah, if the size of the key, the signature is too big, like it is in post-quantum case, this is going to be blowing up. the message, sorry, the block. So the idea with this new EIP is that we have a new person, I knew, Role of aggregator. So you will have, like, here, an aggregator. I'm just, like, to be consistent, this is user one. This is user 2. So here you have an aggregator. And basically like when it builds the block, so aggregator and it's a block builder. And this is Virgin territory.

and Things might change, but again, what we're trying to do for version 3 is a form of this. So you have this aggregator. And what it does is Aggregator builds this block. And the block will contain only the part of the T1 without the signatures. The T2 without the signatures. And we'll call… LeanVM. And again, we have… Already, thanks to Emil, a version of LeanVM that has the parameter of the two of… of the… we ship in the… in the testnet, and here we'll have an aggregated signature, we'll call it SA. So, this is the block. And of course, this is going to be the block. Build with the transaction one, the transaction two, the aggregate signature.

And the size of the aggregate signatures, it's actually constant. It doesn't matter if you have 100 transactions, or 10, or 200, this is going to be constant. So, the size of the single signatures has less impact. So, this is one piece of the puzzle. The other piece of the puzzle, of course, we… in the testnet, we have a Nethermind client. And basically, like, we need to fork it, to the verification. At the moment, it's using, of course, ECDSA, But Nethermind will come as well with an embedded version of LeanVM, so it doesn't go through a precompile, but will actually… each client will ship with a version of LeanVM, and it will call the verification of LeanVM, so when the block is going to be validated.

is calling a version of… a version of LeanVM to verify the aggregated signatures. So that's in a nutshell what we are trying to do now. Questions?

Stefano: Yeah, what… Sorry, what do you use for the… What's the plan right now for the aggregation? What is the, yeah, what's the…

Matteo Vicari: For the application, yeah, it is, using Flock, and, WHIR for wrapping up, the proof. In LeanVM repository, you can find all. All, all the code for this.

Stefano: So we are wrapped Flock proof.

Matteo Vicari: Yeah. Yeah, but again…

Antonio Sanso: This is orthogonal, we… Emil provided it, let's say, and I put a link already in the… Into the previous slide, so… And again, we're just users of LeanVM.

Matteo Vicari: Yeah, yeah, yeah, but the main component of LeanVM are these two. Yes. The basic part of LeanVM is using Flock and WHIR for wrapping up, and then all the proofs is…

Stefano: Size of the wrap proof?

Matteo Vicari: I don't remember, sorry, I have to go.

Antonio Sanso: What's the question?

Matteo Vicari: The size of the wrap proof.

Antonio Sanso: They.

Matteo Vicari: it up, yeah.

Antonio Sanso: I think it's about 200K.

Matteo Vicari: Yeah, something like this.

Stefano: Yeah. But that… and that's… yeah, I guess… I guess for sufficiently large signatures, that… that would be worth it.

Antonio Sanso: Exactly.

Matteo Vicari: We need more seniors work together for have an advantage. So this is why, also it's important to… Depends on the state of the chain, give the possibility to. I don't know, like, verify only one signature, if there is not much, but… We…

Antonio Sanso: Yeah, but that's…

Matteo Vicari: Yeah, it's a.

Antonio Sanso: the.

Matteo Vicari: there.

Antonio Sanso: The status of Mainnet is that you easily have signatures in a block. So, I mean, the network is… this will be a problem for a network that no one uses, but that's not the case with you, right?

Stefano: No, of course, no, no, no, I was just wondering, because, I mean, I know roughly what the… what the size of… Flock proofs is for a few thousand or tens of thousands of signatures, but I didn't look at the size of where.

Matteo Vicari: Also the Benz.

Stefano: person.

Matteo Vicari: Time you need to create the proof. Because, you… for now, I think it's, 20 signatures per second on a regular machine. We don't, try it on the, the node, because if the node is more power, it's more potent, so, we can aggregate more signatures per second.

Antonio Sanso: This is a really preliminary… these are really preliminary data.

Matteo Vicari: Yeah, yeah, yeah.

Antonio Sanso: 20 is a number that, of course, will.

Stefano: Sorry, 20 per second is for the Flock stage or for the final wrapping stage?

Matteo Vicari: Kind of wrapping, yeah.

Stefano: Okay.

Matteo Vicari: For the fire dropping.

Stefano: And…

Matteo Vicari: And also, you can do more and more, and… Yeah, bye-bye.

Antonio Sanso: These numbers are to, these numbers are really to be taken with the, with the grain of salt because it's, they're gonna improve by far. I mean, this is, we just started again, like if someone wants to be involved with, I mean.

Matteo Vicari: Yeah, we have a look, for the ethrex part for sure.

Stefano: Alright.

Matteo Vicari: The idea is, all the CHAC is doing on… On the, on the node. Okay, I also open the benchmark.

Antonio Sanso: Okay, thank you. So, tomas, okay, Hello. In ethrex we made a prototype of in-mempool aggregation with LeanVM. Let me open it here. But is that about the block building or the validation, Tomas? So, MetaWeb, I don't know.

Tomás Grüner: Hello? So yeah, we're working on network leverage.

Antonio Sanso: Sorry, De.

Tomás Grüner: the.

Antonio Sanso: I didn't hear too well. Sorry for that. The… the mic is, doesn't work too well. Can you repeat that again? I'm looking at the PR in the meantime. So… So this is the project it tracks. Okay, validation. We were working on mempool aggregation. Okay, so this is the validation. Okay, so, correct me if I'm wrong, you shipped this version of ethrex. One second, Gottfried, I'll answer quick. You shipped for Tomas, you shipped this version of ethrex with LeanVM embedded and used as a validation as well, a LeanVM validation, correct?

In the meantime, Jens, where you got it. So, we are starting… the plan, of course, is to have a recursive aggregation, but we are starting really simple. So… We want to have an end-to-end to start with. Go, and then we'll be more ambitious in the next… weeks, but as long as we have a first version of EIP-8288, And then, any form of validation with the ethrex or Nethermind, we are happy, and then we can be more crazy. Yeah, me.

Gottfried Herold: Makes sense. Makes total sense to start with the easier things first.

Antonio Sanso: So, again, this is virgin territory at the moment. I mean, we have the EIP, but so far, no one really implemented, so… We're trying, we're trying. So, coming back here… So Matteo, correct me if I'm wrong. You're you're there, let me open it. This EIP-8288. Yeah EIP-8288. So, you guys are targeting the… The 7. 7, right? So there are different test cases. And the guys are targeted 7. So, in this case, it means building a wrapper with a dep verify frame mode. So, this will contain… The dep verify frame mode, so we will be a new frame. In the arbitrary, you have this. Yeah.

Matteo Vicari: The idea is this, and now we need to talk with Giulio for, have some clarification about the cross-verification of the other node, I can say, of the. The blocks, and all the rejection part, if something goes wrong during the aggregation. Stuff like this, yeah.

Antonio Sanso: So, but it is like the first frame will have. A triple with the Lean SPHINCS scheme, the message hash, and the public key hash. And then you have a verify. So, you have every 5… I mean, you have many of these How will how will actually work? So, you have one frame that… We'll link to another frame with Verify. Benedictine. Can you write on here how does it look like the frame? Maybe this helps. If you have a…

Matteo Vicari: Sorry, we are starting looking yesterday.

Antonio Sanso: Yeah, sure, sure, sure, but I mean, just, like, how it will look like, right? Just, I mean, we have time. So here we'll have one frame, I will have this triple. And this will be like the first, the version of Lean SPHINCS. Now let's see, let's try to figure out here, it's fun. So you have this triple, then we have message hash and public key hash. This is by verify frame that checks the existence of dependency with the public key hash pulled from its storage and the message hash pulled by using. It's pretty cryptic. I wish Vitalik would be here in the call. A transaction with a single dep verify frame mode frame containing multiple… following passion

I'm pretty confused how the test case one will actually work. Because, like, test case 7 says a scenario with a mempool node, receive multiple transactions, okay, this is fine, this is what we already… Put in the board and wrap with recursive STARK. All right.

Matteo Vicari: Part is done. And then we have, find a way to link the witness of every transaction in the.

Antonio Sanso: Raka.

Matteo Vicari: And the link is the Lean SPHINCS scheme is, I think, is the part of the witness. And the message hash is… the message hash is the witness, the Lean SPHINCS scheme, and the public hash. is the public key hash, I think, is just the public key. We need to work on this. This is a little too early for something like this. We're starting, this process. on the, account abstraction part, that is more easy to understand. And then we try to move on on the lean.

Antonio Sanso: Yeah, this is really good. I was really trying to decode what this means actually. You know, this is clear to me. This is clear. This is like a version of Lean SPHINCS. No problem. What is this? So here's the…

Matteo Vicari: This is the witness of the message, because you have… you need to have something that link the… The aggregation with the witness of the message.

Antonio Sanso: But what would mean in our… you know, we have a really simple use case here, right? What will be the witness? T1 and T2?

Matteo Vicari: I think it's, something that, it's not just T1, T2, it's something you can reconstruct, look inside the proof.

Antonio Sanso: Something…

Matteo Vicari: Yeah, it's something that link the proofs. And the… the message. This is the… the…

Antonio Sanso: You know, then you want to… you want to actually… That SA is the… It's the signatures of… Aggregated signature of T1 and T2. Yeah. That's what you want to prove. So…

Matteo Vicari: But also, you want to have the same anchor, I can say, on the frame. Because then, okay, I can have. This part, that's the part we need to solve better. For example, I refer all the stuff to account abstraction, because for me, it's more easy to understand.

Antonio Sanso: I mean, for me, the kind of abstraction doesn't matter, but I would really like to understand how. This EIP works. I mean, I really understand what this is. Message hash and public key hash. So… verify… okay, triple followed by a verified frame, so at least we know that here there's going to be another frame, right? So let's say this is frame 0. Do you agree this is frame 0 here? Here's frame 0. I said, 0. And here is the framework. Greg.

Matteo Vicari: Yeah.

Antonio Sanso: The disembodied one, right? Frame one. So here's the EIP says that there is a frame. With a single frame containing one of these triple, followed by a verify frame that checks the existence of dependency. With a pub key hash, so this and this are the same. And this and this are the same. pulled by using to extract the transaction. Wow, it's pretty. Yeah, it's pretty cryptic. This test case for transit with a single dep verify frame, not frame, but then multiple. Triples followed by verify frame that checks exist on dependency. Yeah, I think we need to really spend a bit of… maybe… Who is the author of Vitalik and Tomas? Yeah, I need to ask them.

Yep. All right. Anyway, I don't think we will be able to figure out anything here today any more than we already did.

Stefano: Can I just ask a couple of side questions since we're here?

Antonio Sanso: Sure, sure.

Stefano: What… so just to understand the number, because I'm familiar with the… with the size and behavior of the Flock hash proofs for WOTS. But not for Lean SPHINCS. How many… how many signatures? Typically would be aggregated in a block.

Antonio Sanso: is.

Stefano: the.

Antonio Sanso: Let's say… let's say between, I don't know, 200 to 2,000, something like this.

Stefano: Okay, so…

Antonio Sanso: Not like more or less than 1000.

Stefano: To do the 12. Below to do the 12. Below 4,000.

Matteo Vicari: The answer is… depends on the. On the hardware. Because, for example, if you, for aggregate.

Stefano: No, no, I mean for practical use cases. I mean, what is the target? Before we get to the… what is feasible? What would be ideally the number that we'd want to aggregate? Because I didn't look into this. So, a few thousand.

Antonio Sanso: No, no, a few hundreds. I mean, I don't think.

Stefano: 200.

Antonio Sanso: Hundreds, yeah, hundreds.

Stefano: Hundreds. Okay.

Antonio Sanso: No. Okay. I mean, at the moment, if you want to see how many are, you just go to Mainnet, check how many transactions are in a block in average, and that's the the number. And they're in the order of hundreds, less than a thousand.

Stefano: Okay. Fine. So that's subtitle. Okay. And sorry, Matteo, what was the performance on that for the Flock and for the WHIR?

Antonio Sanso: No, I mean, the numbers that are at the moment are not the right one. I mean, at the moment, we see the really Lean SPHINCS will be, I think, 280 per second, with the original version. With the version we forked our 20 per second, so it means nothing, and we're really at the beginning. But at the moment, Lean SPHINCS, the one that is in main. It's about 280 per second.

Matteo Vicari: Events also on the SPHINCS parameter.

Antonio Sanso: the.

Matteo Vicari: Or the things he's doing, depends on. A lot of stuff.

Antonio Sanso: So.

Matteo Vicari: And depends also in the hash function you use for doing aggregation, because Flock has different. different results using Keccak or SHA or Blake. So.

Stefano: So I, for example, look, I'm asking because I know the numbers for the basic WOTS, essentially by heart. So I'm just trying to understand how many orders of magnitude of difference there is between verifying.

Antonio Sanso: Yeah.

Stefano: Bings versus WOTS.

Antonio Sanso: example.

Stefano: So Flock proving for like a million signatures on, sorry, for a few hundred signature on WOTS is around 200 milliseconds.

Antonio Sanso: somehow.

Stefano: A second.

Antonio Sanso: For WOTS, I think the target, I can't remember, Benedikt's on the call, but I think they're targeting 8,000 or 16,000 signatures, I think.

Matteo Vicari: The problem is not the verification, it's the create the proof.

Antonio Sanso: Yeah, but I mean, the target.

Stefano: No, no, I'm saying proving. I'm saying proving, not verification. Proving time for what? A thousand signatures is one second.

Matteo Vicari: For now.

Stefano: 4,000 WOTS signatures is about…

Benedikt Wagner: 1,000 for one second.

Stefano: Yeah.

Benedikt Wagner: Do we have to… Like, these improvements from OTS Golf Auto Research thing, they claim at least, at least Justin claimed something like a 4X improvement?

Matteo Vicari: Yeah, but the BENS also in the hash function do you use because.

Benedikt Wagner: Yeah.

Matteo Vicari: Yeah, there's a lot of.

Stefano: There's about a factor of 2 between Blake3 and SHA, and a factor of 2 between SHA and Keccak. Roughly, one point something.

Antonio Sanso: All right. Quick things. There's a message in the chat by Stefano. Thanks a lot, Stefano. So you're saying that. So, if you go on the chat, you see that Stefano said that, as far as understood, Lean SPHINCS scheme Identifies the signal scheme to use, message hash is the hash of the transaction message being authorized. And public hash and the public key expected to verify that signatures. Hmm.

Matteo Vicari: But the idea is you don't… The problem is you. We can't do the verification, the verifier frame on chain. I can say, because in this case, what you need to do is verify the proof, the Lean SPHINCS proof on chain. And the problem to do this is hard to put on chain the verification. But listen.

Antonio Sanso: see.

Matteo Vicari: proofs.

Antonio Sanso: But let's assume I I know what you mean, but let's assume that you do this, you you had a smart contract that verifies, Lean SPHINCS. I I even don't understand this idea. I mean, how will it work? Like, you have the triple, and then what do you have?

Matteo Vicari: Stefano have the recent answer.

Stefano De Angelis: Hello, guys.

Antonio Sanso: Evan, can you, are you on the board? Can you write on the board? Can you write the, the, how it look like in this, in this simple case of transaction one, transaction two, the frame, the frame, the verify frame, understand.

Stefano De Angelis: I don't have access to the board, Antonio.

Antonio Sanso: So.

Matteo Vicari: There is the link on, I can send you the link.

Stefano De Angelis: Yeah, please, because I joined later, so…

Antonio Sanso: Okay, so just…

Stefano De Angelis: But the… so the high-level idea, as far as I understand, is that you have this dependency, and the dependency is describing the object being authenticated, and the way you authenticate that object, right? And then in the verify frame, you only verify that the dependency is valid. So, what is declared?

Antonio Sanso: WP.

Stefano De Angelis: Pretty expected.

Antonio Sanso: Which public keys? The public key of who?

Stefano De Angelis: I think the public key is what you declare.

Matteo Vicari: one.

Stefano De Angelis: Yeah. With the frame transaction.

Antonio Sanso: But who is the public key of the of who of the of the aggregator or or.

Stefano De Angelis: No, no, no, no, no. It is not confidential.

Matteo Vicari: Wallet, I think, yeah.

Stefano De Angelis: I think, I think so. It's the sender, the authorizer.

Antonio Sanso: Makes sense. And then…

Stefano De Angelis: And then you have this, in the mempool, at the mempool level, you… we have this, aggregation mechanism that is off verification frame prefix. So, the prover that you're running at the mempool is the guy that is getting the, actual, artifact, which is the signature in that case. From the wrapper object, which is not accessed by the frame. And the wrapper object is carrying a reference to the dependency and also the signature itself. And then, since you are running the aggregator, the aggregator will verify that the wrapper object is containing the correct signature with the correct dependency that has been verified by the frame. This is my high level understanding.

Antonio Sanso: Two questions. What is this that, like, in our simple case, what is message hash? It's the hash of what?

Stefano De Angelis: Of the frame transaction. In this case.

Antonio Sanso: Okay, okay. Of the frame transaction. But you know, like what we are missing now is, you see in this case, like here on the, on the, on the screen, Nethermind, we are planning like to have Nethermind, being.

Stefano De Angelis: Yeah.

Antonio Sanso: Shipping with a version that will carry LeanVM or ethrex as well, I mean, Nethermind, any of the client. At the moment we use Nethermind or ethrex because they support Frame. So, but the idea is like to ship. a version of Nethermind or ethrex that they ship LeanVM, and they actually extend the verification from ECDSA to as well checking the LeanVM proof. But I don't see… I don't see without having a precompile or a smart contract how to implement what you described. You know what I mean? Because in your case, it's really kind of required to have a smart contract or a precompile that calls the LeanVM verification. Does this make sense?

Stefano De Angelis: Why you need a precompile for this?

Antonio Sanso: And how is how can the the verification oh, wow.

Matteo Vicari: The smart contract is a proof that run on WHIR. And take a lot of, really a lot of gas. So, This is the problem. I, when we start from.

Stefano: By… off the top of your head, do you know how much gas?

Antonio Sanso: I mean, I didn't check because I'm not too much interested about putting this on chain. I mean, the idea will be to really have a kind of fork of Nethermind that will do this in a native way like you do now for ECDSA.

Stefano: Yeah, sure.

Stefano De Angelis: That's… that's my understanding.

Antonio Sanso: But how can you do frame and having this native? Can you do that?

Stefano De Angelis: I think you can because of this decoupling between frame used for Verification of the syntax structure. And then you have the wrapper, which is an object broadcasted on the network level, that you can access it without, outside the frames.

Antonio Sanso: Stefano, are you an expert? I've seen your name somewhere, but are you an expert of frame transaction? Who do you work for?

Stefano De Angelis: I'm not. I am researcher of Nethermind.

Antonio Sanso: Nethermind. Exactly. Great. But do you work on, on, on, on frames?

Stefano De Angelis: So.

Antonio Sanso: Hello?

Stefano De Angelis: We, so we are being implementing frame transactions, and I am looking into 8288 as next, integration in the client for…

Antonio Sanso: Because at the moment.

Stefano De Angelis: much.

Antonio Sanso: Actually, the testnet, I don't know if you've seen that we're running testnet Daisugi, and actually Giulio is, I mean, did the testnet with Nethermind. So now at the moment, this testnet is running using your stuff. I mean, the frame transaction stuff, basically.

Stefano De Angelis: Great. Great.

Antonio Sanso: And if you have access to the board, and now there is the link on the chat, can you actually… Do an example, if you… at the best thoughts you can, of how you see the situation for these two transactions.

Stefano De Angelis: Try, if I can…

Antonio Sanso: Continue what? On the spotlight. But, I mean, it's just we're just trying to figure out things together. Things may help.

Stefano De Angelis: Yeah, yeah, I'm still under the exploration phase, so… It's okay. I think, Okay, let me try.

Antonio Sanso: So you can cancel my stuff. Let's let me try to cancel it.

Stefano De Angelis: Can you see what I'm doing?

Antonio Sanso: Yeah, I do actually. Yeah. Yeah. You need.

Stefano De Angelis: Okay.

Antonio Sanso: Yeah, okay, so nothing.

Stefano De Angelis: From what I understand. I'm going… Okay, let me open the EIP as well, so I can remember. 8288. Hey, Pete. So we're looking at test 1, right? Test case 1.

Antonio Sanso: extra.

Stefano De Angelis: Lifetime mode…

Antonio Sanso: I mean, seven, but the seven is a wrapper of one, I think.

Stefano De Angelis: So we have this guy here. And then we have… 35. here. Right, and then we have… The dependency? Object. Which is a triple… Was it… Lean SPHINCS scheme.

Antonio Sanso: So it's Lean SPHINCS, Message, and PubKey.

Stefano De Angelis: Message hash.

Antonio Sanso: Yeah.

Stefano De Angelis: Bob click Bob key. This is a triple, right? And then, in parallel to this object. We have another one.

Antonio Sanso: Where's the triple? Because I don't see it. You put… okay, well, how do I… okay, I'll move it. Okay, great, I see that.

Stefano De Angelis: Can you see it?

Antonio Sanso: Yeah, yeah, yeah. Sure. So you have the Lean SPHINCS and the Lean SPHINCS and the message hash and the public key.

Stefano De Angelis: And this is just, like.

Antonio Sanso: Public hash, public hash.

Stefano De Angelis: Yeah, this is just a string, right?

Antonio Sanso: Yeah.

Stefano De Angelis: Then we have this object wrapper 0. it defined, and I don't remember what includes, but I think it includes The message… The public key… Message… Public key, and the actual signature.

Antonio Sanso: Like, what I call sig A above.

Stefano De Angelis: I think so.

Antonio Sanso: I mean, I think I mean, I call this the aggregate signal here sig A, SA. So.

Stefano De Angelis: I guess so, yes. So. What I think is that what happens is that here. Verify that… Dependency. Structure is… Valid. Whatever it means. But doesn't have access to the wrapper and to the signature. Not very, very far. Sync. From wrapper. And this is the frame.

Antonio Sanso: Okay.

Stefano De Angelis: Now we have in the Nethermind. We have another object. Which is a prover. And please, guys, take it as a grain of salt. And then here, we are actually… We have… 8288… Aggregator. And this guy is consuming the wrapper.

Antonio Sanso: Do you call it aggregator or validator? I mean, it will be more validator, no? Because aggregator is very validator.

Stefano De Angelis: is basically running the circuit specified in the EIP. So it's a prover.

Antonio Sanso: But it needs to verify, no? I mean…

Stefano De Angelis: Yeah, yeah, so when you aggregate, you first verify, verify the SPHINCS, and then you're proving that the verification is valid.

Antonio Sanso: Yeah, but they're in two different… I mean, if you go up, there are two different phases. I mean, the aggregation happens more, at the… when the… when the… when the… The builder builds a block. I think that we are already at the phase where you're actually doing the verification, right?

Stefano De Angelis: I don't think it… I don't think it happens, when… only when the builder builds the block. I think it happens every one second, or every X seconds.

Antonio Sanso: Oh, sure, sure, but here, okay, you're still at the previous phase, but I think that we moved away from this phase. I mean, we were already at the verification phase, you know. We're… so what I'm trying to say is, like, that we… for the first version of the testnet, with aggregation, we are not doing it, let's say, every one second. We are happy to do the aggregation once. And… and that's it. And then, like, we're figuring out how to verify.

Stefano De Angelis: Okay.

Antonio Sanso: So we are looking at scenario seven.

Stefano De Angelis: Okay.

Antonio Sanso: This case 7, and the 7 is basically, like. You will have, like, an aggregator that builds a block as well. And you build a block, and you build a block in a way that is a wrapper of test case 1. Okay.

Stefano De Angelis: Okay.

Antonio Sanso: So at the moment we're trying to figure out how to do the verification. In in Nethermind or. Or ethrex, basically, like how to how to fork the client. And what you say so far makes sense to me. So you build a block that is a frame. And, I agree with you that This verifies only the dependency, but then, like, how do you actually do the verification? Without having access to a precompile. Does it make sense? Otherwise, I can explain again the flow here.

Stefano De Angelis: Maybe yes. Because I didn't follow the flow.

Antonio Sanso: Do you see the… do you see the board now? Do you see it?

Stefano De Angelis: Yep.

Antonio Sanso: So basically, like, the flow is this. You have a user 1 and user 2, they have transaction 1 and signature 1, transaction 2 and signature 2. They both go on the mempool. And as you correctly say, there is some some kind every one second there's gonna be some some recursion happening. But we are not doing this for the beginning, we're doing only like you have one aggregator. That is as well as the same as a block builder in our case, that takes the two transactions, T1 and T2, it will put in a block. And we put transaction one, transaction two, and the aggregated signature that we call it SA. And it does in a way that it builds this block with the help of LeanVM.

Stefano De Angelis: Sorry, sorry, what is SA here?

Antonio Sanso: They aggregate the signatures. That is basically the proof of aggregation.

Stefano De Angelis: And how do you compute this proof?

Antonio Sanso: With LeanVM. We have already a fork. Can someone put in the chat the fork? We have a fork of LeanVM.

Stefano De Angelis: Okay, and the proof is proving… is just checking the two transactions. And the signature of each, and then verifying those inside the… LeanVM.

Antonio Sanso: And the spitting SA that is the proof of our.

Stefano De Angelis: Yes. And this is output.

Antonio Sanso: And then the aggregator gives this to the block builder, the block builder builds this block, right?

Stefano De Angelis: Right. Yes.

Antonio Sanso: And then, like, this… this, the block is gonna… is gonna be, like, created, and then, like, we're trying to figure out the verification, how it will work. In our mind, it was, like, Nethermind ships with, again, with the same version of LeanVM, and in a native way. He will, like he's doing at the moment for ECDSA, will verify the block using That the the here the test case 7 and and a version of LeanVM. Okay, okay.

Stefano De Angelis: Now I see. Okay, so you are in the scenario where, you know, the block has been proposed, and then every other Nethermind client is receiving the block, and to verify the block is valid, they want to verify the proofs.

Antonio Sanso: mandatory.

Stefano De Angelis: Verify the proof, we don't know how to do that.

Antonio Sanso: Yes, I mean… Okay.

Stefano De Angelis: Okay.

Antonio Sanso: And this without having neither a precompile or a contract, let's say, in Solidity.

Stefano De Angelis: Yeah, so my answer to this question is that… but this is only my own understanding. Is that we will need to verify the native… to verify this proof natively inside Nethermind. And this is the direction we should take, but this is not available at the moment.

Antonio Sanso: And yeah, but we can fork it. How will it.

Stefano De Angelis: Yeah, yeah, yeah.

Antonio Sanso: brother.

Matteo Vicari: The verification is inside in the animals.

Stefano De Angelis: Yes.

Matteo Vicari: Then what we need is something that, link. The… the frame? And this kind of witness that allow the user to say, okay, this is verifying this way on the client, so it's good to go. and execute the next frame is the execution of the frame of the user. This is the stuff we are missing inside the puzzle.

Antonio Sanso: Stefano, continue your… continue your… your diagram there, right, that I'm showing. How will it be, in your opinion? Of course, it's not prover anymore, because we are missing the verifier, not the prover. How will… how will be a… in your opinion, how will it look like?

Stefano De Angelis: So, what I… what I was drafting here is the… for the one side of the coin, where the transactions come in. Not… so the block is not built yet. That's my… for the second part, I don't think we… I have an answer for now, but I would expect. to have the prover natively inside Nethermind. So we have to integrate it to verify LeanVM proofs inside Nethermind.

Antonio Sanso: other.

Stefano De Angelis: Right. To make it efficient.

Antonio Sanso: But I agree, actually, I don't think we're too far away from what you did. I mean, I think that the first part here stays.

Stefano De Angelis: Hill.

Antonio Sanso: Would be like in, in the prover or verifier, you will have.

Stefano De Angelis: You have…

Antonio Sanso: LeanVM and you verify, you verify that this frame actually is valid.

Stefano De Angelis: I think what you do is something like this. So, this guy here… Aggregate. And this guy here…

Antonio Sanso: But do you agree that actually aggregating we don't need? We already did aggregation before.

Stefano De Angelis: Yes, yes.

Antonio Sanso: Okay.

Stefano De Angelis: But when you say we don't need, you mean we don't need…

Antonio Sanso: Yes, at a verification, because I'm.

Stefano De Angelis: Yeah.

Antonio Sanso: The aggregator is, if you're not an aggregator, I mean, there's only 1 aggregator, you don't need like Thousands of aggregators. You need one.

Stefano De Angelis: Yes.

Antonio Sanso: And do you think this can be done without precompile or contract, or are you actually…

Stefano De Angelis: I would… I hope so.

Antonio Sanso: Alright, let's see. Anyway, we are… in case you are… you want to participate to this effort, we are doing the version 0.3 of the testnet. Again, we are using Nethermind, so… If you're interested, I will add you to the testnet Telegram group.

Stefano De Angelis: Yes, please. Yes, please. Also, because we are scoping for.

Stefano: Yeah.

Stefano De Angelis: know, Implementing all the missing dots. Inside Nethermind, so I would like to… to join.

Antonio Sanso: All right. Have you already seen daisugi.fyi?

Stefano De Angelis: Yes.

Antonio Sanso: Okay. Perfect. And there are, again, we are up to, we're up to frame transaction. Again, we are missing only the, only, I mean. The heavy part. We're missing the aggregation part, so let's wait.

Stefano De Angelis: Okay. Okay.

Antonio Sanso: Alright.

Stefano De Angelis: Great.

Antonio Sanso: Cool. I think we're almost at time. I'm sure we're going to make it. We just need to figure out some details. Maybe in one of the next calls, I will try to bring in Vitalik or Tomas that are the author of the EIP. But hopefully for the next two weeks, we're gonna have more Clear mind on how all this work, yeah.

Stefano De Angelis: I would also be happy to bring for the next call a concrete solution to the problem, having test case 7 as a You know, objectives.

Antonio Sanso: Perfect. Again, let's move to the testnet. Telegram chat, I will add you right after the call, right?

Stefano De Angelis: Nice. Perfect.

Antonio Sanso: Cool. And yeah, and anyone, if anyone else wants to help out on the testnet, let me know. I'm in Telegram, and yeah, I will add you as well. I think we're almost at time, it was a bit different today, sorry for hijacking a bit the call, but yeah, we need to figure out how to bring this further, right? Cool. Thanks a lot for everyone participating, and I'll see you in two weeks.

Stefano De Angelis: Thank you.

Stefano: Santhani.

Matteo Vicari: you.

Alessandro Baiocchi: Thank you. See you, Anthony. See you.

Transcript adapted from ethereum/pm, CC BY-SA 3.0.