S3 - ZKP Basics

Transcript

Hello. Okay. So, let's wait. Okay.

What are you doing? We will just wait a bit before starting of course. Uh and any check um yes because Melissa was not available uh yesterday um for personal reasons. So just we rescheduled today. to participate into the Aatan era. It's going to be super big.

I'm not ready. Um, [clears throat] it's in two weeks. Yeah, more than two weeks. But let's >> [snorts] >> Um, let me check who's Did you appreciate last time the break

break out rooms? I don't know the term. I think it's breakout room. It was the first time I activate that. So was an experience for all of us. Ah hello [laughter] hello you are not ejected this time. >> No fortunately I was afraid now but that's okay. [laughter] >> No even like I was afraid for you that the fact that I ejected you one time by mistake of course you can't reenter for other other days you know.

>> Yeah. Okay. But it's okay. So that's fine. >> Yeah, because I use my phone like directly, not my not my not my computer. But uh No, no, it's okay. It's okay for now. At least I can follow. So it's good. >> Okay. Okay. Perfect. Perfect then. All right. So Melissa just told me she is coming. So perfect. Okay. She's here. [laughter] All right. So yeah, we will wait like two three minutes before starting. So actually we were supposed to have the session yesterday. So sorry for the light change but um we are leading this one today and then tomorrow the other

session but other for upcoming day upcoming weeks it's going to be like always Tuesday uh Thursday um but during the vioding boot camp we will don't have zen progressive boot camp like it's from third to to 7 we will not have anything. Uh but after the aceton we will have a session with Lugos. So just to let you know all right. Um so I put a message on telegram uh and also on uh Google classroom about decision.

So if you also have any question about past decision etc. don't hesitate like before starting to more [laughter] more and more uh things concepts. So yeah. All right. So feel free to let me know when you want to start me. Hope everything is okay for you. [laughter] >> Yeah. Yeah. Yeah. Thank you so much. Um yeah. Sorry. apologies for postponing the session from yesterday for for to today. It was uh completely um my own doing. So thank you Seline for

cooperating and you guys for um taking up uh the time uh for today as well for the the session. But we had some urgent legal matters that could not wait. >> Yeah. >> Yeah. So, [sighs] uh, Seline, when do you think we could start? Just let me know. >> I think like, um, usually people are arrive around 10. So, I think we will be like 25 30. Um, but has we postpone? Uh, I don't know [laughter] for this time. Uh, let me check on calendar. Uh, how many say they will be there? Um, yes, 21 people reply. Yes, for for this day and for other days it's

like 60 60 people who said yes. So maybe they didn't get the notification at all. I don't know. But oh I saw couple of them was not available on this time but okay I think we can start over. >> Okay. Um first of all are there some um questions from the past sessions. [snorts] >> Good question. [laughter] >> Yeah.

>> Uh I asked them is they they like um break house rooms because it was completely new like I mean split between people. Um >> cool. Super cool. I'm so glad I like it. All right, let's um let's start with the new lesson then. >> Yeah. >> So, hello everyone for um everyone that is joining for the first time. My name is Milita. I'm Zik privacy lead for Dev3 pack and I'm doing PhD research in zero knowledge proofs. Um so for the past two sessions we went through uh cryptography

we went through hash functions and uh some of the basics we needed for a zero knowledge proofs um but today we're going to um head um towards multi-party computation um KCG commitment schemes we're going to see uh the prover the verifier and the witness which are the foundations for the the zero knowledge proofs and we're going to organize some hands-on exercises as well. Um yeah, so for the last time we had the defy helman key exchange uh we had um yeah like um uh we have covered those basics that we're

going to need in the future and uh and that are connected to these lessons. Uh please feel free to um jump in with questions anytime. um you you deem uh um as necessary uh or if not um you can always uh contact us. Um so let's um let's see uh the foundations of zero knowledge proofs. So why do we have ZKPS? Um so there was a need um that uh none of uh other methods were was um was ready to answer uh in cryptography.

um so far until 1980s when we got um zero knowledge proofs as a paperwork and uh one of the things is that zero knowledge proofs that they have that magic that they can prove without revealing. Um one of the things and like it's but it's very difficult concept to dive deep in if you look at like how can you prove something without revealing it. And it's quite um it's quite a good concept for both privacy and scalability. Uh we're using it in blockchain and zk rollups for for example and um in and other

proving mechanisms that are either used for privacy or for scalability that they can attach a proof that all the transactions are valid. Um so how to prove something without revealing? So my favorite example is um safe box with a key. So if you look at this uh uh this presentation in the bottom right corner you will see a safe box right and um for example like you want to prove that you have a key um to this box without uh without showing me the key but I'm

not certain that you know it and um there is um a little h a hole for the letter to be put in. [snorts] Um so through that one I can uh I can send you a message or uh um any kind of paper that uh you can read from that message that only I was aware of and I have it handwritten through. So through that slot you can uh you or me or anyone else can um can send it. And the way you would prove that you have a key is not by showing the key. So that would be revealing of the secret

but uh by reading that message. Uh that way you have something we call an interactive proof. So for example, I could say that you were just lucky that I have um slit some message and you have guessed it. But it's fairly unlikely after a certain time uh after certain um number of attempts that you are so lucky like the chances are chances are diminishing and plummeting every time um I send a new message um due to probability. But um that is uh one example how you can uh say that you do have access to that say box without uh

showing anyone else the key or the combination on the say box or uh however it is locked. Um does anyone have any questions around this? >> Don't hesitate to talk like to take the mic. >> Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. This is this is actually the the basics uh when it comes to interactive proofs. So it's quite important that you understand this part so that we will uh so that we can dive later in um >> equations and >> they all put like um a heoi um like a good emoji. So that's fine.

>> Yeah. Let's see. Let's see. I got a private message. Can you repeat please? Yeah, sure we can. Um so we have a safe box that is locked and one person has a me has an access to it either through um safe box safe box combination or uh with a key and that person is for example you and uh you want to convince me that you have that secret combination but you don't want to reveal the numbers to me.

What I can do is I can uh um slit a message to the slot, some um handwritten message um that only I know what is written. And with you reading that message back to me, that would prove that you had access to that safe box because you would not be able to retrieve that message, that paper uh without um shattering the box or having access to the box. [snorts] Let's see if there are questions around this.

Okay, so Panchi said got it. Thanks. Super cool. All right, let's go further then. Let's look at building blocks for zero knowledge proofs. So now we had played prover and the verifier. Um so you in this case you were the proer with this safe uh box combination and I was the verifier saying like okay that is the message that I have uh slid through that um say box slot and um I have compared the strings and said like that is the valid message that I have set that I have sent um then we have

witness we have statement we have relation between them and Um we'll see and especially when we start looking at um commitment schemes how are they all related since this is um very simple example we'll um and and and we're going to use u polomial commitment schemes and uh and other math tools um this is something like broader concept that you need to to go through [snorts] so it's really important important that if you have questions and if you are puzzled uh we are debunking it um in in the beginning.

So what is um relation it's um does the witness matches the statement. So zero knowledge proofs uh is saying like okay let's prove that um the statement is u matching without revealing the the witness. In this case um we had um we had safe box combination we had the secret um we had the secret message and um and we had prover and verifier. Okay so you guys we uh you guys remember hashes right? And um uh we're going to make since you loved breakground breakout rooms, we can make it again,

right, Seline? And uh we can uh role play uh with the demo. So how is that going to look like? Um so in this case um you are going to prove that you know a secret number that hashes four and the verifier would say like prove it but don't tell me the number exactly. So the prover would show valid number that is hashing um to four and verifier should be convinced without learning the witness. And why is that?

because um our uh um our hash would be um something that is um available both the prover and the verifier. Uh the secret uh thing is a number that the prover has and why would we not reveal it directly? Because we would uh we would lose this zero knowledgeness. But uh what we can do is um uh adding to our secret number uh we can we can add or subtract um um modulus to it. So for example, if the if the modulus is um is 10, we're going to end multiplications of 10 or

subtracting it so that uh and sending that to the verifier without revealing the the number that we have. But yeah, real zero knowledge proves using commitments. Okay, let's um let's try it out. Let's first let's see >> let me know when to create a breakout room. >> Yeah, let's yeah let's let's create breakout rooms. >> Okay. >> Uh if uh someone has actu a question you can u ask it in everyone uh part of meeting chat but let's try you have um here you have um

uh how it should look like. You can play with it. You can uh provide your own hash and your own modulus and check it with the verifier. Uh I'm creating the room actually. >> Yes. Perfect. >> Okay. Uh just there's someone I I can put uh Yula, are you there? Maybe you can stay here. Ah, no. Sebastian just joined. So maybe uh I will attribute

her name. Okay. Maybe Sebastian and Yura. You can do it here itself. Sorry. >> Oh. >> Uh there is an exercise uh actually. So Yula and you you can stay here uh for doing it or let me open another room [snorts] to add other new room. Okay. So yes, but I I can't um I know I think to

Okay, I just assign you to a room. Okay, fine. Uh, Robert, I will put you in room four. Oh, they ask. Oh, we can see the task.

Um, you you mean uh actually >> it should be it should be it's sharing. Yeah, it's sharing. >> It's about reproducing the example. >> Uhhuh. Okay. Let me say role play here. Going to see a role play. >> Uh wait. Um Mi is asking uh for help on room five. So I don't know if you can ask.

>> Can you Yeah. I can jump in if you want to add me to that room. Hi.

>> Hi. Uh, >> wait. Uh, I I need to manage the >> the other rooms. >> Yeah. Uh, okay. Could you come back into the main room because Mica can help. >> Okay. So the breakout has ended. >> U not really but just if you need help just come back here. >> Oh okay. Okay I get you. Thank you. >> Hi Selene. We have a question.

>> Yes. Tell me. [laughter] >> I mean we don't understand what we're supposed to do and we can see the screen with the text what we're supposed to do >> because actually Ma was here but a room asked for help. So she jumped into the room and so basically the screen >> Oh, I see that. Okay. >> Yeah. >> What can do? >> So we we will wait for Melika that is coming back [laughter] because yes, we need to to uh to scissor.

>> Let's wait. Um, is Kevin here as well? >> No, he's at Google Next. >> Yeah, Google Next is crazy right now. It's like thousands of people. >> Wow. He's moving every time. >> My mom, you know. >> Yeah. >> [laughter] >> What? What's your age, >> Sebastian? What's your age? How old are you?

>> Three. >> Three. He's three. >> Oh, really? Three? Wow. Very young. >> Oh, no. Remember Shelene? You met her last year at Khan? >> Yeah. Before you are moving to grass, I guess. No, you you were there. Are you going to Prague? >> Uh, no, no, no, no. Uh, because I have to manage the Agatan and [clears throat] so if I'm moving at the same time. >> Yeah. >> Are you going are you going to New York? >> Yeah, I will be in New York in June.

>> Yes. And you too? >> Yeah. I'm I'm hoping I submitted for a talk. So like if if my my talk gets accepted. Yeah. I'll I'll definitely >> for it come. >> Yeah. >> Wow. Nice. Okay. Yes. With >> and everyone else and Elix, they are showing you a Pokemon. Sebastian is showing you >> Salamesh. >> You know the name. >> I know. Yeah. >> Oh my god. >> There's so many of them. [laughter] >> Yeah. It was my favorite one.

>> That That's his favorite. Yeah. >> Okay. Yeah. I I really like also Pikachu. Like people call me Pikachu >> because I'm like in the electric [laughter] >> because you're so cute. >> Yes. And it's so cute. >> Yeah. [laughter] >> So just a bunch of people. Sebastian also knows that it's Charizard and Charmander. Oh, sorry. It's too many Pokemon. Yeah.

Um so uh yes wer actually we are just waiting for uh Milica to come back uh [laughter] on on the call. Uh wait let me do one thing. I will just end breakout room bitter I guess. Uh breakout room. So close our room in 60 seconds. Yes, Kevin just sent me a message. By the way, >> by the way, I think people need more time in breakout rooms. Just a bit more.

>> Uh yeah, just because I wanted to tell you that everyone uh actually is coming back here because they don't know what to do. [laughter] >> Okay. Okay. We're going to repeat it. Yeah, >> that's why. And and as you go into the room, finally, we can't see the screen anymore. >> Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. The Zoom didn't show me this warning that um share screen is going to be lost. But then as soon as I clicked it, I remember it from the last time that I was not able to do screen sharing. So yeah, let me do one thing and that is I will I will put our presentation in Google classroom this

one. [snorts] What do you think? >> Yes. Yes. Better I guess >> and if needed I can share as backup because I'm staying here, you know. So >> Oh yeah. Yeah. Yeah. Yeah. That's great. Let's see. Okay. There's also kids who are taking a session today.

>> It's all right. >> Kids are taking session today. >> Kids? >> Yeah, there's a kids. [laughter] >> Let me see. Right now I'm attaching this so I'm not sure. Oh, I see Eugenia [laughter] [laughter] learning KG from from very early age.

Technical technical. Yeah. [laughter] But I remember uh for the last DK privacy boot camp, we even had to create an extra session about KG because it was very for everyone to understand everything. So, >> yeah, I um we're going to have a KCG uh for tomorrow as well when everyone is here. >> Uh since it's um >> okay, >> people are getting tired with with multiple concepts and I remember we had to divide it into a couple of sessions.

So I got this um additional KG lesson when I got remarkable um e paper. So so then uh we got that additional one but yeah >> okay I have the presentation >> the material is shared and it's going to be shared here as well. such as WS which page is it is

>> it should be the fifth one if I'm not mistaken let me see yes fifth slide [snorts] >> okay yes got it so if you want I can share my screen >> yeah Yeah. Yeah. And then I can jump into breakout rooms whenever needed. >> So if you can uh just um give >> repeat everything. >> Yeah. Sure. So the idea here is to play prover and the verifier as if we are doing um real zero knowledge proof example um that is interactive one. So if you are if you have chosen the role of

approver you will need to work more right but it pays off and the verifier is just checking whatever the provers so on the prover side you would be the person who would say like I know a secret number that being the witness uh that's um that hashes to certain number then the verifier is saying prove it but don't tell me the number. The prover then is um adding a modulus of um let's say if uh the modulus is 10 that we're using. I think in this in this example we're using modulus 7 then we're

going to add or subtract uh multiple times seven from our witness and uh then we're going to send that to the verifier. The verifier would be satisfied because the verifier would check it and the hash would be four as well and then the verifier would be convinced without learning the witness um ever. So he wouldn't know your secret number but you have uh proved um that um you know a number that hashes to certain value.

So the roles are proverifier. Provers and is proving to the verifier that he knows a secret without revealing it by adding um certain number uh of of a modulus. Um I'll I'll show um exactly the slide with it. Just want to uh first um clarify these roles and then we're going to have back and forth from verifier and prover. We can have like multiple checks for example where if I where if I could say okay may prover you may be lucky send me another

number and then prover would send another number and yeah let's see >> uh >> okay we can do it yeah we can do it without break rooms as well if you want just pick your favorite person and send them a private message. [snorts] Here here is the ex uh the example. So just um in this uh uh example we we're going to have a witness that is um x that is 25. Then we're going to have modulus of four modulus

sorry of seven and our statement in the end would be four. >> [snorts] >> So damn someone like on on Zoom. >> Yeah. Yeah. So you're sending for example in five you'll be sending 32 or 39 and the statement will always be four and um that way you are hiding your witness and you're not revealing your your

secret uh but you're proving um that uh you actually have a number that is uh correlating to what you have stated. The thing is with um with with functions you would you would do it with pairings, you would do it on a curve. Um you would get challenges if um if you know um certain value of um of a function for example in um where x is zero for example and then you if you know it you won't have fractions but you will have rounded numbers.

Uh but um yeah, in this example, we're just um trying to see how uh prover and the verifier work together so that um you know how does the interaction look like? Yeah, we can use x mod 7. We can use uh you can you guys can use some other function as well. [snorts] The verifier is checking if if um for example 32 module 7 gives

four. That is the only work that verifier does. We are here if you can hear us. Uh

we are doing an exercise now for hash pre-image example uh role play of um prover and a verifier here for any questions you guys have. Hi. Uh, please I have a question.

>> Yeah, sure. Go ahead. >> Okay. After picking the number from the approver, how is the interaction between the approver and the verifier meant to be after afterwards for this class? >> Sorry, can you please repeat the question? I think something is breaking a bit. >> Okay. Um my question is let's say I've picked a secret value and I've sent it to the verifier. What is the how is the communication between prover and verifier supposed to be till I can prove uh the accuracy of my statement.

Mhm. So in this example, this is not used in um this is not widespread used. Um this is just for you guys uh to have a sense how does interactive proofs work um as a prover and the verifier. But what you have as [clears throat] as a prover you have a secret sending um hash um of that secret to the verifier. The verifier says like okay like um don't reveal the secret but send me some number um that is also hashing um to that uh number. Um in this case it

should be uh four and then um what does uh the prover says he's sending uh different numbers [snorts] that they're using the same hash function module 7 and uh then the prover checks okay saying like okay you know how to do it [snorts] that is it um I've seen the question this uh is the scheme like two persons know the secret no no just one person knows the Uh sorry.

Do I get it right that both uh persons must know the secret? >> No. No. Just one person knows the secret. But both people they know a statement. They know hash. We'll see when uh once um we touch the ground with KZG um how it actually looks like. Um you will see the quotient

of a polomial. You will see the polomial. Uh both of them are committing to um the the provers the polomial. Then the verifier does not know the polomial. He would be revealed some um commitment of the quotient and then everything will fall under the right place. But for all of that to be uh to work out in your favor, you need to um you need to go through this basic concepts first because once you see that one, I don't want for you to be as complicated as it could uh once you see the first time.

But um that's why we're doing this preparation. uh maybe if we see formulas we can better understand what is meant. Yeah. Yeah. Yeah. Yeah. I have shared a full presentation with all the formulas um in in this one presentation. Uh we're going to walk through uh all of the equations um tomorrow on paper. Prepare please do guys prepare pen and paper for all of our sessions. Um, most of the time you would need it.

Okay, I think um, Selene, I think we can be certain that everyone went through this exercise that we can continue with the next one. What do you say? >> Yes. Yes. I I feel that's good. All good. We can do that. >> Okay. Okay, let's uh take a look at um some other examples and some other concepts. Um what do we have um is non-interactive proof. So, so far we have seen um interactive proofs meaning that we're going to have challenges between prover and the verifier

and with non-interactive proofs that we going to see in tomorrow's lesson. Uh we will see that they're using one message only and uh not uh back and forth uh proving that you know something and that you are um away from this margin of error that you're just lucky like um in this example that we had um let's say um maybe Yura and Eugenia they have played it and at some point one could convince the other um they know a certain hash.

But then the other would say maybe you're just lucky. But let's look at the chances of being lucky every time. Every time is um even if you are guessing yes or no, the chances are 50/50 that you're right. And every next time like the chances are diminishing um to 25% then 12.5 and then um somewhere in the ballpark of zero. So it's important to have um non-interactive proofs as well.

Um multi-party computation. Um we're going to see how we're using that in um the trusted setup. Um so um what does multi-party computation um mean? It means that different parties or people or machines can compute a function without revealing all of its inputs. And we're going to have um an interactive exercise about that. Um what is important is that inputs stay private but everyone learns only the result. So um I could uh I could say with um some

certainty that most of us have worked in certain company and um then in most companies you know salaries are secret but everyone wants to know you know if um they are somewhere around average above average or under average salary but um it's um in some contract it's legal to uh reveal your uh um your salary. So with multi-party computation we can um compute the median salary and uh without revealing all of our inputs um to that computation.

So let's try it. Um if you don't have um if you don't have the example um there is always this uh particular presentation is being shared to your Google classroom. Um so yeah what we can do is um have exercise with our um uh with our ages. Um so we can um say like what is the average age of this classroom group? um how should it start? So because we want everything to be a secret, we need to if I for example if I would send my age for example to Eugenia, Eugenia

would know my age. Next person would not know uh what uh our age is because Eugenia would add her age to my age but she would actually be the one who would know what my age is. Uh what would that mean is that we are in the beginning we're adding something called offset. Um so for example um I could add uh some number I don't know 100 something and send it to Eugenia and Eugenia would not know what number have I added as an offset. that when everyone in the group adds their um age um to the number that

they have been sent to then um they will bring that final number to me. I will subtract uh the offset and then we can uh uh uh we can compute the average age um judging by the number of participants in our room. Okay. Um, so I will uh um let's see uh how many of you guys want to take part in this.

Who reveals the random offset? No one. Okay, I will send number to Eugenia and then Eugenia will add her own age and send it to Mi. Then Miiali will send will add her own age and send it to Subhansi in private messages. Okay, Eugenia. You got the number.

So once you receive um once you receive uh the the number you add it you add your age and send it to the next person that said plus one in the chat. >> [snorts] >> No, don't say it out loud, Sebastian.

Is there someone else who wants to take part? Another you are the last one if I'm not mistaken or Sebastian is the last one. Sebastian, do you want to take part in it? I don't see the last one. Okay, I see more people. Okay. Yes. Eugene sends to Mi to Subanchi.

Subhanchi to Rohima. Yes. Then who would be next? Yura on Wapo. Then I'm not sure if Sebastian is taking part. Mhm. So we reached Yura right now. Uh Hadasa, can you please uh explain uh what do you mean we're adding one

If you want, you can take the mic. It's easier. Oh. Yeah. Um, Yoshiki asked the first person is

also responsible subtracting in addition of random number after the final person. Exactly. and realing in the result. Otherwise, um we would be uh we would learn something uh of um of that um offset if we know it. So after LJ we should have Abin Bola

then Maria then Akshhatasa and then Sebastian. Mhm. After LJ, it's Aimbolo. Oh, Lucas, where are you? Which point? Sebastian. >> Sorry, what? Um, I didn't see you in Aimbola sending to Maria.

Oh, the ride's done. This is um um multi-arty computation.

This is not KCG, but it's going to prepare us for it. We need it for trusted setup, which is part of KCG. Uh, looks like

>> we could properly Okay, Rhino, it's okay. You can you can talk. Mhm. Okay. So, so Lucas is in the end. All right. And then Lucas to send result to me. That's 14 people plus offset.

Okay, now I got number. Let's divide it. Okay, so our average age is 31.

28 57. Tada. We got our average age. Brow everyone who participated. Uh do do you think this is right? Um, right. If Sebast didn't put uh what did you put 85? So this is a this is where every part [clears throat] is taking um a a part in in uh computation and then without revealing um everyone else's age we can find out um the median age or

average uh age or for example the salary. Um but it's just it would be just in a different uh ballpark um not uh within this one. But this is how we do multi-party computation. Super cool. Let's see the time we have. Cool. Yeah, [laughter] Lucas is under the average. Yes. Super cool.

So we have seen how does the group hide inputs but is revealing the result and um with um with zero knowledge proofs it's important to um hide the witness and to reveal the statements and both of them are privacy preserving computations um with multi-party computation where is important is we're going to have it in trusted setup. And one of the famous trusted setups uh is with um Zcash where you still have some video online that they

have even burnt uh machines that have taken part um in it and um and that way no one can tell anything about uh the trusted setup. Let's see. Yes. uh what we did is um is multi-arty computation multiarty computation is being used for trusted setup as well uh for uh KZG that we're going to see later let's see okay um let's take a look at uh properties of zero proofs and there are

three key properties um of uh Z case that uh we need to fulfill in order for something to be called zero knowledge proof. Uh one is completeness then we have soundness and zero knowledgeness. Um if we see completeness um that means that if the statement is true the honest prover will always uh convince verifier about um it his statement. But if false um cheating would always fail. Um with zero knowledgeness um that means that the verifier is going to know nothing um about witness or about the secret that

we have um on the prover side. Um so why do we need um uh why do we need commitments and commitment schemes uh that we're going to see in next le lesson um we need to commit to certain function in our first example we have seen that we have committed to a safe box so we know that both parties are going to lean on that safe box in order to uh communicate with messages that would uh uh that would uh later um serve as a proof that the provers

safe uh combination. Um but um what we have in case gene zero knowledge proof is uh binding to a polomial and um we have zero knowledge profits that is the binding hiding and we are going to have also the succent verification. So uh for example what we had uh with the hash pre-image is that uh we didn't have to do a lot of work as a verifier um just uh doing one uh modulus uh example and nothing else.

Um always always is um this weight of uh of calculation is always on approver but the verification is always um minuscule or success. Um and why is binding? Well, um as we seen in the first example, we need to commit this to certain uh function or in our example an object and also we have um hiding properties uh which is the the whole um um philosophy of zero knowledge proof is to have something that we are hiding. Uh one of the famous examples that I've seen that's every used everywhere is like proving that you're

um um not underage. um uh without revealing all of your documents that you're um over 18 years old and uh without um telling um some entity um sharing your passport details or your identity card details uh with all your uh addresses or um your name even just um to let's say buy I don't know cigars or something like that that is all only for uh people who are over the certain age. So the seller doesn't need to know your name, your nationality, your um address and just um they just need that um simple check if

you are over a certain age or not. And that is why in that case zero knowledge proof is ideal to use um for uh for a later uh lesson we're going to have um KG I have uh sent you this uh presentation and we're going to walk through it uh for uh for the next um um for tomorrow's lesson. But um what you will see is that we're going to use polomial commitments um but not with pairings. We're going to have other example that we can go through. So please do prepare your um

pens and paper uh for uh for uh for you to um take part as well. But uh for now I don't think um we're going to be uh in the mood of going for through another example that would take for around one hour. But this is um something we're going to see tomorrow. [snorts] Let's jump to the slides. Yes. So guys, if you have any questions around this, tomorrow we're going to see um KZG as an example, um I will uh I

will walk through uh I walk through that and uh we're going to Okay, let's see messages. So what we just did is trust now. Okay. Yeah. Yeah. Yeah. one of the ZK cash founders and and Sebastian said that they burned their computers. Yes, exactly. How can I prove that I'm under the average without revealing my age?

[laughter] Yes, Goldberg. Yeah, Shaffy Goldberg is everywhere in cryptography and in KZG as well. She is the G of KZG. Okay. Um Seline, we're going to continue the uh presentation, the lesson tomorrow uh for KCG and everything else we have prepared for tomorrow. >> Sure. It was an intense session for people or not? [laughter] Yeah. Well, we had what three two three exercises if I remember well and

I don't think um we need we need fresh pair of eyes for KCG. >> Okay. Yes. [laughter] All right. >> Yeah, we're Yeah, Sebastian, we're going to record it for tomorrow and >> Yes. >> Everything will be shared. >> Yeah. Uh I will put it after the session on YouTube indeed. Um All right. So, see you tomorrow then at the same hour. Um, as usual, [laughter] >> see you and thank you so much. Bye-bye.