S4 - ZK Proofs Advanced Systems & KZG

Transcript

Uh, so let me put a message as usual to the chat. Oops. What are you doing?

Let's wait a bit. Oh, we'll be starting 30 minutes late. Okay.

O. All right. Uh so okay so we just put a message um is 30 minutes late. So let's wait 30 minutes Hello everyone.

Hello. Uh just to let you know that we have to wait for Mica uh that is coming in at 30. So that's why in 20 minutes she put a message. So uh you can see the chat maybe when where I put Ma will be late doing 30 minutes. So that's why we are waiting. Uh she has to deal with uh personal things again. So yeah. >> Hello. Hello. >> Hello you.

>> We need to make one one this one this boot camp in Portuguese here in Brazil. Oh yeah. >> I want I want I really want. >> Where where where are you in in Brazil? Brazil. Brazil. How we say Brazil? Brazil. >> Brazil. Brazil. >> Wow. >> Brazil. >> Yes. >> Florinopoulos. >> Oh, nice. >> Yeah. Is one Iceland. >> Yeah. Yeah. Yeah. >> It's not a Brazil. Brazil is a continent.

>> Yeah. one Iceland but but this is but it's a joke. >> Yeah, I know some people who are going there every time. Um there is also like a popup city right city something like this. >> Yeah. Yeah. Yeah. It's my friends. Yeah. >> Ah nice. >> Yeah. >> And you where where you from? >> Uh France. nice. I I am I I participate one one hackathon uh Chile Chile's hackathon, you know, the >> in Yeah. Yeah. Paris. Yeah. I I part I win

the hackathon here in Brazil and and I I won um a travel to to Paris. >> Oh, nice. Congrats. Yeah. Pretty beautiful your your your city. >> It's like it's like it's like the the the films that I I watch in in cute hood about about the the second war. >> Ah yeah. Yeah. >> Oh my god. It's real. >> This building. It's real. It's real. >> Yeah. It's like um the architecture.

Let's let me show my screen. Wait. is yes very old. Let's see. Try this. Um yes, it's like >> some building like this every time indeed like this. I was living in Paris during four years uh for my students to studies. Yes. But there's a Yeah.

Yeah. M is living there actually. Um but it's quite um in Ramisk does the same thing to be honest. Ram is like old all all the bulva all all the buildings are very beautiful too. Um but what's wrong in Paris is um I don't know the crowd uh people are hurry every time so let me push you in the metro.

Yes, we are not so friendly. >> Yeah, Europe is is very very old. Is very very beautiful. Has beautiful buildings here in Brazil. In Brazil, we are very new. Yeah, we have 500 years. Yeah, >> we we don't have uh very old uh centers or cities like just just Rio Janeo and Salvador is the most >> old cities here.

>> Yeah, I I want to plan something in Brazil um around like the carnival in February 2027. Um so yeah, let's see. Let's see. Let's see. Will be great. Yeah, in in last year we organized one one big hackathon on Kopakabana Rio Janeiro for Stellar Mian you know. >> Ah yeah yeah yeah I remember. Yeah. >> Yeah. Yeah. I I organized this academ this educational part. So very >> Yeah. Yeah.

>> Hotels >> really beautiful. >> I remember. Yes. For Marian indeed Stella did did that in Rio and this year where they will go do things. I didn't check at all. >> What what >> where where Meridian will happen this year? Uh it here is in Portugal. >> The first idea is in Qatar but we are >> and they tend to to Portugal.

>> Okay. Um yeah Portugal. Portugal. This is like a big >> Sorry. Sorry. >> No, go ahead. >> I I am of of Stellar. Ah yeah like there is some um people who are ambassador in South America for stellar. Yeah but um you you know actually just stellar I don't know at which point is going to be like sustainable for builders like if you are building a project there uh at which point you are going viral you know.

>> Yeah it's it's a question. So that's why I'm not going to the this ecosystem actually but I understand that in in South America it's the main it's the not the main chain but the main builder ecosystem represented Kinder are very active because they have funds to do that but yeah at term um I'm not sure Stella will perform at all itself so that's why I'm not doing things with stellar actually uh with Dback. Uh I'm not I'm not in into the ecosystem for money. So that's also my issue is I'm I'm just trying to help people. Um and

so yeah, >> nice. Really nice. St has released one one big big >> version now about ZK. Yeah. Now you can run some like zircons or whatever for in in the L1 >> and very very interesting because it's very very cheap. >> Yeah. >> All right. >> For me is >> is more simple and secure like uh any L2 of Ethereum and web 3 EVM is a is a great great player for for this year and the next year.

It's a good technology. >> Okay, good to know. Like I mean, but I'm just to know to know at which point is sustainable, I'm always checking. >> Oh, >> things like this. So I'm like, >> yeah, I don't know. >> Yeah, >> like it's very more VC backed back stellar actually. Um so when the ecosystem like the in in how to say that when the world is not going great VC are are stepping down and you can see it into into the chart but yeah I don't know like um

maybe I should give a try but I I'm very very very selective with ecosystem itself. Uh so that's why like we are doing things with Solano actually uh I was doing things with B uh last year because B is very was very openminded was very into on boarding newcomers in the space etc but not anymore unfortunately. Um so yeah Solana is I think it's here to stay.

>> Yeah. Yeah. Here here in philanop we have one one base of bass. Yeah. >> Oh a beautiful offs. >> Ah yeah yeah I saw it. >> Yeah yeah yeah >> I I saw that. Yeah. >> Nice nice. I have some friends that that work with bass. >> Yeah. Um it's ghee. >> Yeah. Yeah. Gili. >> Yeah. Yeah.

>> Mm- is leading in Latam as well if I'm not wrong right now. >> Yeah. Yeah. Yeah. I I think that that that G is um head head of Latin. >> Yeah. Yeah. I think so. >> The last year he start like uh head of Brazil >> but I that now is Lat. >> Nice guy. >> By roasting like in Brazil. uh to for the Aatan. So it's going to be in Sao Polo and at the garage of Super Team Brazil. So which is nice actually. They have a pretty sick uh space and uh

there's already someone from the back who is here by the way before before but um she's here for Colosum. So actually, yes, they're running. Let me just share my screen again. Touk tuk tuk. Yes, they're running that like a space. >> Yeah, >> that's cool. >> Yeah, I I I I meet these guys, the super team.

>> Yeah. >> In Argentina. Oh, this guy is very very beautiful. Beautiful and and friendly guys. Yeah. Um, I I stay with with with him. We stay in in Argentina for two weeks and oh my god has has have a a great heart. I love these guys. >> Good to know them. Yeah. Uh, I'm speaking with the lead of Super Team Brazil, but not this one. >> All right. Um, so, oh, I have to take to take my charger.

>> Oh, I I I will get one one cough for me. Okay. You You want one one coffee? One Brazilian cough. >> Coffee. >> Yes. >> I'm not drinking anything on my side. Yeah. I'm quite boring. like I'm not drinking alcohol. I'm not drinking um wine. I'm not drinking coffee, tea, all the things. I'm a boring girl, you know. Um so yeah, I'm not smoking.

Yeah. Um you are not boring. >> Yeah. >> Hello. No, you're not. Can confirm. >> Yeah. >> Yeah. We we live together during a week with Mali in France in K. >> Hi. Hi. Nice to meet you. >> Yeah, we've been together and you're not boring. It's not because you're not drinking coffee that you're boring. Absolutely not. So many people, you know, drinking coffee. Very boring. So tell >> Brazil very because everyone drinking coffee. Yeah, it's >> I love coffee too. And especially in Paris, you know, like always with a mug of coffee and so on. Even though like in

my careful market just uh like down in my uh in my flat, I can ask for a for for a for a coffee. I have the butcher in front of me like I can ask for a coffee. I have the the baker always because for me like I'm a coffee coffee addict afficionados almost. But uh that's fine. I need to stop. I mean reduce the you know the amount >> where you from me my Ali. >> Yeah my Ali uh from France. I live in Paris. What up?

>> Paris. >> I will get my my coffee one moment. Okay. >> Okay. One day at an interview like someone um like the the person who who who passed me the interview said at the end fortunately you are not drinking any coffee you will be like a electric pile. Yeah, I think that you don't need you don't need to have that coffee like you're already like uh you know dynamic.

But for me like it's more about the the taste you know especially in the morning. Uh some of people this is the the cigarettes. Not for me but um I mean not the morning but the the coffee like the smell of the coffee is like I don't know. It's I can't I can't explain. It's irrational. Yeah. It's like this. It's like this. >> Yes. Yes. Yes. >> So, let's wait 5 minutes.

>> Yeah. >> Just I will I will approve application. I still have how much? Like 150 almost to take care of. >> Can you do you sleep sometimes? Like this is my question. >> Yeah. You know that um you know I wish time I'm sleeping but I I have time to watch Netflix like every day like during two three hours I'm watching Netflix. >> Lucky you are. Uh wow that that's so that's so cool. I did not watch Netflix since a few days now. I'm currently in a hackathon. I'm still building right now.

But I just uh take a a pose. I mean I'm proud of what I've built by the way. The deadline is the weekend, but I'm proud of what I've built. By the way, it's the first time. So, and I'm like I'm happy that my uh Netflix is bugging. There is something I need to fix and I did not fix on the purpose because otherwise I could be up to be honest. So before because we I want to stay productive at my goals >> and I need to sleep like oh I mean it's okay it's it's okay now it could have been worse but >> no yeah when it's come to be productive

in cut Netflix and myself like I'm starting Netflix around like midnight every time so after working >> and then after yeah sleeping around 3 or that depends. >> Yeah. Yeah. >> But you remember. >> Yeah. Of course. Of course. Now me like now I'm d uh with I'm driven by clothes code rate limits but I'm optimizing because I I uh you know I found the RTK uh implementation to save tokens and reduce it. Yes. I'm going to show you. I'm going to show you because it's very interesting to not burn tokens. so fastly and uh yeah, you

know, this kind of strategy because I only had $20 to spend. >> Yeah, that that's it. And uh you know, but it worked. But uh you know, you need to practice. Sometimes I forget. So I see the token, but it's it's okay. It's okay. I hope for the academy I'm trying to get uh on topic and board like because I'm talking with the startup lead but um like you know as it's a big company that takes time etc. So I'm not sure they will do it on time >> but uh yeah let's see let's see indeed um right now we are super dependent on building with AI like basically

>> of course yes be >> before account was kinder really difference like you you don't have to to pay anything and why know you you have to to pay things uh to make sure you can access like building stuff. Uh so that's so crazy. >> Um and and >> even if I feel it's removing a buyer, it's also adding one for people who are who don't have money. >> Of course.

>> Yeah. people who can't afford sometimes it's a pity because now I see I'm investing you know in the for AI agents for uh for cloud code for API and uh you know like I'm not I'm not going to say like you know my secret source about my what I'm building now but I try um you know uh invest on on some APIs well-known APIs oh my god it's like 500 euro a month I was like oh no no no uh it's It's too much really. >> Yeah.

>> Um I will send an email to everyone to apply for the agentic uh engineering grants. So which is related to get access to code etc. So it's like 200 >> it's for the sonaton. >> So actually they are providing grants only for people who have good ideas etc who can showcase their work. Um so basically it's not open to everyone but I mean you should give a try of >> course. >> Um it's 200. Um so yeah let's see.

>> Yeah. >> No but it's interesting also I saw your opportunity about AWS machine learning opportunities from Amazon or something like that. >> Yeah. >> There's a lot of opportunities but uh still every time to pick up the right one. Yeah, you know, but it's very interesting because their courses are well explained by the way. So, >> yeah. >> Yes, this is um so I will take my charger again.

Uh okay. >> Why people ask me for death pack merch? Sometimes when I'm reading I'm reading message I'm like >> what they they won't merge >> from you like as someone we attend like a summit I think at the end of the in two days they're asking me if we have de park

merch here. No, >> that's so I mean that's interesting. Which means that they still like at least they love what you do like they they do love their three packs but yet the merch like Yeah. >> Yeah. We will maybe open sooner like a mini store online for for death pack merch. But actually uh no we are not doing things >> like the only merch we have done was in

Argentina. Um, yeah. And it cost a lot to be honest. Like, >> yeah, >> I think uh it was 4K. Maybe I put like 4K for 70 people. >> 70. Yeah. And even like the residency, etc. Like I you know in Argentina I spend around like 35 50 35 40k for everyone for a month. So >> Oh yeah.

>> But people don't notice that as it's free for them. >> Yeah. Yeah. Because they don't uh Yeah. They don't notice you know what's behind what's behind. Of course. Yeah. >> Yes. >> So not not everything is three. >> Oh no. Touk. All right. Um, so I will check. Hey, when are you ever where where

or are where do you where do you work me? You work with with coding or design or >> uh business? >> Uh for now like I'm still independent. Uh I'm I'm at home now like uh working remotely >> like me. Uh so this year now I'm uh in the boot camp of de free since the beginning of this year learning about smart contract and solidity and defy and for now zk privacy and at the same time I trying to you know be more experts in AI agency uh AI agents. So uh I'm doing uh some meaningful hackadens uh currently now I'm doing I'm doing so and uh I want to create you know building on

chain this is uh this is my main goal for this year and creating content on on Twitter most of the time so that's it like it's a >> Twitter share your your >> Yeah yeah yeah uh I'll build like I did many vlogs during the ATHCC event uh >> with tennis Yeah, that that was the the funniest one. And you know what? Most of the people they they came to me after and they told me that they they they that was their favorite vlo vlog. So >> like me me doing some with tennis.

>> Yeah. Yeah, that's it. But you know what? I I I felt that I was exactly with the right people to do this like this. It could have it couldn't have been another way. Melik, you uh Jee, >> yes. >> Um >> my friends, >> I mean, everyone is here. Could you >> Yes.

>> Yes. Yes. Here I am. >> Hello. >> Hello. Hello. >> How are you doing? >> I'm signing papers. Well, I'll maybe uh purchasing um my first home. So, it's it's a bit tiring. >> Good luck. >> What? Thank you so much. What you need to go through in order to purchase something. A lot of paperwork and then all the lawyers are so strict with all the rules. They need to check everything. You need to sign >> 20 something papers in one day. I need

to look at all of them and it's >> it's crazy. >> Yeah, it is a bit hectic. Yes. All right. So, yeah, we were talking during 30 minutes about our life. Yes. All right. So, I will give you the stage. >> Okay. Sure thing. Sure thing. Um, okay. I will um share my remarkable screen. Let's see.

You should see it. So again guys, apologies for um for waiting on me. It's um it's a bit lifech changing event for me right now. for signing papers and for buying my first house. Yeah, let me check if this is what I see. Okay, need to share my So, so far um how did you guys like the previous sessions? for something unresolved.

>> I don't hear if anyone is talking. They're chatting. Let me check.

Yeah, I'm trying to share my remarkable page, but it's not working well. Uh yes yeah yeah yeah yeah. Okay okay okay I see your your chat super cool. All right so for everyone that is joining um um after the session my name is Milita I'm Zeke and PR lead for D3 pack and also I'm doing PhD research in zero knowledge proofs. So for today uh we are having Yeah. Thank you so much for congratulations and everything. I'm trying to do the adult thing. Yeah. Um

so for today we should go through >> Yes. >> I'm I'm trying my best. Let's let's try it out. I'll be uh um sharing let's say a new notebook a blank blank one is it's constantly sharing some different notebook.

Okay, let's see if I try with different Wi-Fi network. Would that work? Adult things, right? heard about ZK um sorry KZG and what it is whether you guys know about it and let's see anyone someone

did every did anyone read um slides from the last time um it included It's KCG. >> Yes. No, >> I'm not sure they went through all the slides. >> Okay. All right. Uh, for some reason, uh, remarkable screen share is not working.

And >> maybe you can uh um go back like uh end and go back. Yeah, I'm trying it right now. Share again. It's very weird because um because uh remarkable had some changes in the app supposedly. So it should work well but let's see.

Okay, I should present it now. Obviously not with all the scribbles, but do you see it? Do you see this um markable page? >> Yeah. All good. >> Okay, finally. As as they say, it worked on my machine, but um it's a different uh thing when we're doing something online. So for today we're diving deeper in K ZG and um we're going to use uh um a trusted setup. We're going to see

commitments and evaluation as the last process of KZG. Um so for for those who have gone through uh a bit of the slides I have sent it's uh Kate Zavucha Goldberg uh protocol that has been designed uh for um um exchange and evaluation of uh of um of secrets and uh they're using polomials as a backbone and we'll see we'll use one polomial so that you will be um so that you and uh um try it at home as well. It's going to be a smaller polomial with a lower order. Uh but um

you will see um the power of algebra and the algebraic backbone and um you will see um also uh as well as um trusted setup that has been used um through uh multi-party computation. uh we're going to set that up. Um generators um uh we're going to use uh uh finite fields as well. Uh but uh something that you need to know about KCG is that um in the real world example is using pairings check. Here we're going to use evaluation uh by hand um so that you can see how um the algebraic bank bomb works

uh but um usually it would use elliptic curves and the finite field of the elliptic curve and um pqr and rp prime points on it. Okay. So, so let's um uh let's um start let's see if um so for for everyone this is no you see it commitments commitments scheme y polomial. You will

see that we we're going to have um even our own polomial but um usually you would see um a polomial with elliptic curves that um we're going to see um later on. Okay. So let's start with setup. This is the first step in KCG. Um, by the way, if anything is unclear, you just let me know and we're going to adapt it um to to you. So, for setup, we're going to have uh group group G. Um, you guys, you have pens and

paper so that you can write um as well. Let's see chat. big party for set up something for for run a ziki proof later. Yep. So let's assume that we have a group G that is of order P saying 0 1 2 3 4 5 six. It's going to have a generator one. Um that means that um you can touch every um element of the group by increasing

um with a step one. And we're going to have P of seven that is the order of the group and also a number of elements let's say of the group. See is there some I see some question or something the operation for the field um this is not the field this is a group uh we're going to have field as well uh but um you can touch um this is this is uh setting up for commitment um field is where the polomial operates

so there are two distinct things. Okay. So for us uh we can say that um uh field is a finite um the field we're going to use is a finite field uh of a prime order P. um every time a prime order is used in in KCG um you're going to see it frequently if you start reading the papers that usually prime um uh numbers are used and we have covered what uh they are um last week um also uh we're going to have um FP the finite field

that's finance finite field of order P. All right. And um with G as a group. Okay. We'll say it is a group. groups can be multip uh um they can be um multi multiplicative and uh additive groups. um you can find um we're going to see different uh versions of it and in KG you will see um as well the the possibilities where sometimes you will

multiply it sometimes you would um do the additions but you need to know that there are two versions of it and that they have um uh properties of both groups that they belong to. All right. So we said okay there is the red dot. We love it. We have uh group G and uh that is used for commitments and FP the the finite field of order P that's um that is the field where um our polomial lives.

Okay let's define our group. 1 2 3 etc. until p minus one. Why is this? Because it is of order p. Um okay let me see I have written down the polomial as well but okay we're going to see that later. uh one thing that we need to do is to sample towel that is a secret towel from um from our field um here. So in this example we can say our tow is five for the sake of our

presentation and uh we're going to use it for um for calculation of global parameters and then for our checks but this is something that needs to be deleted after the trusted setup. Let me check. Um okay let's see uh for I have written down the polomial we're going to use uh for x for the sake of calculations later you should write this down only prover will know this polomial let

me just check if there is some nothing that is being uh chatted about in our chat. Cool. All right. So, um on to calculating global parameters. GP means global parameters and GP is calculated this way. H O is G uh times then because it's zero and the order um so zero X to the power of

um zero is going to be one. So G is conjoined with nothing. It's just plain G. Then we have H1 which is toao time G. And then we'll have H2 which is to the power of 2 * G etc. So because we do have in this example we have um only order of two we're going to stop here but uh what would happen is um we need to calculate um global parameters up to the height of polomial uh meaning that um let's say that um

let's say that the is um height of the polomial. That would mean that we would have um h uh d with toao to the power of d times g and it needs to um belong to uh um this field.

Okay. So we have um basic um the basics of uh KZG in the beginning for for our setup. We have um we have that written down. Um so this is something that delete after this step. So after we calculate our global parameters, we should forgot that TOAO existed and we can uh burn um our computer.

Cool. Um yeah so let's um let's go to the next part since we do have to um then um and also if you if you see this sorry um everyone should um write down um this uh polomial that we have because we're going to use it later only provers this Okay, since we're going to um uh we're going to use this polomial for calculating

um uh commitments and um later on with evaluation as well. All right, let's um let's uh calculate our global parameters. Um as we know our g um toao and um also we know um uh we know our polomial. So let's start since I'll write down this f of x is x ^ 2 + 2x -1.

Um so let's start with our gp that h z is one. Why? because we had um only um let's see let's go back we had only G here and nothing conjoined with it. Okay. Then we have H1 and since we got um TOAO * G and TOAO is five it is five.

Then we have H2 which is G * to the power of two and we will have um in our case we will have 25 but because we have to be um within um within the field of seven then we need to do modulus of seven and what would that be? That would be four. Okay. So we will have 1, five and four respectively because we have the height of polomial that is two. Okay.

So um uh to prove to the verifier that the provers the the polomial that we have here um they will make evaluations of the polomial and um then the verifier will send um values and um then we will uh properly calculate every point um of the polomial. and um and we'll see and uh proper example.

Let's see. So uh okay um the group that produces the global parameters they would need to know the height of the polomial as well. Of course um TOAO and um G parameters since um they would need to know how many global parameters they need to produce. They need to know the height of the polomial because of that otherwise um we will not have all the the the all the members so that we can conjoin them with our polomial um later.

All right. So let's start with the commitment. So uh what does um a commitment mean? So it is um our polomial that's um evaluated at secret G and uh but because we do not know um secret G uh then we will use uh global parameters um that being the values um that uh the um MPC or multip multi multi-arty computation has sent. So um let's uh try that out.

Let's see. So since we have um f uh okay um I'll write down um our equation in reverse order because um the global parameters are being produced in um the uh in in escalating order from zero to the height of polomial. So let's start. It's minus one. I'm going to um promote uh to permutate it a bit, but it's going the value is going to be the same.

Okay. So let's let's um calculate the commitment of uh of this function. So, we're going to write it down in this way. F0 time h. Okay. I'm I'm checking if if um if something is interrupted with uh with remarkable school. So, plus f_sub_1 * h1 + f_sub_2 * h2.

So, this is what the prover calculates, right? because they know the polomial and um since uh so these um f0 f_sub_1 and f_sub_2 are values that are conjoined next to the um let's say x to the^ of two has coefficient of one but x to the^ of one has coefficient two and x to the^ of zero has coefficient minus1. So, how does that look like? Um, what we're going to have is see what we're going to have is min -1

times because h0 is 1, it's going to be 1 plus we have 2 uh * h1 is 5 and going to be plus um f_sub_2 coefficient is one um times uh four. This is what we got right here. So we are writing down these values h0, h1 and h2. We are combining them in a commitment with coefficients of the polomial.

All right. So let's calculate what we have. This is minus one uh + 10 not 16 but 10. 10 + 4. What would that give? It would give 13 modulus 7 will result in six. So that would be the commitment um to um this polomial.

So for us to check it we can evaluate um uh we can evaluate um this um this polinomial at the secret tow but that is not uh what the prover should calculate. it's only for us. Um but yeah, let's um let's try. So let's see if this actually works as in producing global parameters with um toao and and g and combining um global parameters with um uh with uh coefficients of our polomial creating commitment. So does

that actually work if we using towel uh in instead? So let's see. So let's um calculate function in towel. Um so let's try it out. So that means it's function in five. Um of course it needs to be within the modulus 7 as well. So that would be um -1 u + 10 + 25 modulus 7.

What would that be? It's um 9 34 um modulus 7. That would be six, right? Okay. So now we are uh ready for the next step of evalation. But we have u proven this connection between uh global parameters and with secret towo um and with commitment uh to the the the polomial.

Uh thing is um TOAO is never used in this step. Um it's just for us to to check it. Uh but um but yeah like I I've seen questions but um I cannot uh um jump every time but like why is it uh why uh why is it called um f of toao? So this is a function in um function in that point uh function in in point toao which is um which should serve as a connection to see if we have um calculated commitment um of uh function properly. So it's only for for us to

check it in the real time scenario towel is being deleted after the trusted setup and no one is looking at it with the global parameters um being set after. All right. So later on later on let me scroll a bit we will have evaluation. So in the process of evalation um the verifier should send um some value and then uh the prover is going to um

calculate uh um commitment. Uh let's try let's see. So you guys remember when we um role played uh pro and verifier with um hashes and um and yes then you were um sending your um sending a proof that you have calculated u hash properly by sending different um uh different numbers that would hash certain value. So this is how um this is very similar how um prover and the verifier talk to say uh by

sending um challenges which prover needs to um answer uh on it. So let's see suppose oh sorry I have touched the wrong button. Let's suppose that you is U is something that um the the the verifier sends to the prover. Okay. So let's say very fire sense sense you.

Okay. So the task of uh the prover is to calculate function in u in point u. So let's start with it. Function in u should result in value v. Um we're going to use this later to find zeros of the polomial. Uh but uh for us what is important is that our verifier is challenging us to find um the root of f uh prime function.

Um so what are we going to do? Since u is root of fprime, uh then uh we're going to calculate it this way. F - v. Then we'll say that x - u um divides f prime. How would we write that down? That's minus V.

And later on we'll see that we're going to have um quotient polomial. That is important for us to write down this. This Q that you see is quotient polomial and FP prime that is here is um going to have its zero in um uh in u here. That is why we have written it like this.

Written it down like this. Uh since it's um it is going to uh be the root uh of uh fp prime. All right. uh further on let's calculate first the function in u so that we can calculate we right here. So first of all we need to put um let's see where is our we need to find okay our polomial is here

I need to write it down from time to time so it's -1 + 2 x + x ^ 2 okay what does that mean for us because we are um trying to find value in a in the point u. We will start with min -1 + 2 * u is because u is 4. Then we will have um 8 + 16.

And since we need to do modulus, we need to be within that um within that field. Um then what would happen is this is 7 + 20 + 16 is 23 modulus 7 um which is two. Okay. So the result of the function and the point u should be we. So this is it.

So we is two. So for today we're having a lot of calculations but everything will come to its place once you try it at home for a couple of times. you will see um how smooth it can become. All right. Um since we do have we now we will say okay f prime and we need to find fprime is f minus v and because we know um this function here then we would say it is -3

because it's function minus2 two. So we see minus one here and we're going to subtract two as well. This is going to become - 3 + 2x + x to the power of two. Let's see. Let's see. Um okay. Yes. Yeah. Yeah. Yeah. Yeah. Yeah. Um u is the the the root of um of that function. um f minus vi which is f prime. You are correct. Yes. Cool.

People are following up what we're doing. Cool. So um now what we need to do is um we need to find quotient polomial um which is not going to be sent uh by the prover or the verifier uh but the evaluation of the quotient polomial will be sent and that's something we'll call witness. Um so since we know that um our fprime function is um quotient polomial times x - u that was previously sent. Um then uh we can and we we can say that our um f

prime is our original polomial minus vi that is being calculated as the value of um of our original function in u then we can write down our witness polomial in um in this way. Okay. So we can say that now this looks like a G q of x * x - u um we can say that due to our previous

um calculation I'm going to slide it down so we see it here. Correct. Since this one is equal to this one, we can write that down. Okay. And we can make um we can write it down like this. Minus through and through minus u. And this is our witness polomial. We have already calculated this one Q of X. It's this one.

So it's uh - 3 + 2x + x ^ 2 of 2. Um and then we have x - 4 that the verifier is sent. And once we deal with this um once we deal with this equation and uh we're going to end up we're going to end up with x + 6 um after modulus applied.

So our quotient polomial will be x x + 6. Um if we want to calculate commitment of um the quotient polomial um that being witness um then we can do evaluation since this one as you see has only height of one. So this is x ^ 1 and this is 6 * x ^ of 0. Then uh we're going to have a height of only uh one. Let's try

it out. Commitment of Q is commitment Q of 0 * H0 + Q1 * H1. So we need to go back to our original values H0 and and H1 let's see okay it's one and five so we will say that since um this one we can say this is the um the constant that is next to x ^ 2.

So this will be 6 * 1 + this is 1. You can we can think of it as as like 1 * x. So it will be uh 1 uh * 5 because h1 if I'm not mistaken is five. Yes. What we would have here is 6 + 5 11 modulus 7 is four.

So commitment in Q is 4. Cool. And what we have here is um witness value. And this is what is sent uh um to the verifier. So the witness value that we have um calculated um is the object that convinces the verifier that um the claimed um evaluation is um the result of the function within the value of um u that

the verifier previously sent and and is consistent with the commitment uh quotient um that we have uh that being Q out of X so the point is and I'm looking at question the point is that um our verifier is going to challenge us if we know if we know the zeros of the polomial in this case And if we do not have it, then we'll have some um partial um partial numbers that could not fit.

Um in the real case G, this is done through um pairings check. But here with us um we need to find zeros of the polomial. Cool. Anything else? H okay. So the global parameters and the trusted setup is being done by multi-party computation. After that you won't be um able to say towo to to know anything about it and have any knowledge

of it. And um neither prover or the verifier should have any knowledge of toao. Um they know only the glo global parameters. And um uh what would uh the prover say is uh I will tell you that I know a secret function that I will prove to you that um I know it and I can do the commitment to it. Um that's why that's that part of binding that we have seen before uh when uh uh we were speaking about zero knowledge proves that binding is um uh very important that we need to commit to

something um to either some um um some object like we did with the safe box um or um um we need to uh commit to certain function Now that we have the polomial. Okay. Um so the the prover is calculating the commitment. Then the verifier is going to send um challenges and um they they would be sending some um you so we're going to see uh to set to send back um uh a result that is fully uh within the

zeros of the polomial. Um but yeah like if um the prover actually does not know that he would send back fractions and not round numbers. But yeah because um KCG is uh meant to be within the elliptic curve um we would not be able to convince the verifier that um that we know it. But if the polinomial evaluates to zero at some point then um that point that we have send divides it exactly without uh fractions that we have um seen.

Okay. Uh uh um all right. So now we should um try Oh um touch something again. Um so we should do evaluation now as well as um if we were the the verifier. Okay. So let's write down the verification.

Um but yeah like one another thing that um um if if our divisions were wrong at any point of time the verifier would catch it because um uh we would have the remainders and the verifier could not verify it. Um yeah so um let's um start with the calculation of verification as well. Let me check it. Okay.

All right. All right. So um as we mentioned before it is always um the weight on the prover to calculate it not on the verifier. Um most of the times you would see the verification is very succent very small. Uh while uh proving is a tedious process like with doing the commitments and um um and proving that to the verifier with challenges but on the uh verifier side it should be it should be uh fairly short.

So let's um let's write that down. So how we're going to um uh how we're going to um check as if the verifier would do. So um we'll we'll in this example we're going to use um towel, but um that is not um how we're going to use it every time. But the towel should be deleted. But let's check uh the um if if it's um algebraically correct.

So if we put tow minus u that the verifier is sent on one side times commitment of q. It should equal commitment of f minus v that is being value in point uh value of a polomial in point u time g. Again, this is not something um this is not how the verifier would um uh check it because the verifier would definitely not know uh tow uh but uh commitment of Q and um but let's um check if this is uh

correct. So our towel was five, you was four. Commitment of Q was also four. Commitment of F was six. uh we was two and g was 1. So it says 1 * 4 is 6 - 2 which is correct.

And at this point of time um this um this equation would be satisfied and the verifier would be convinced that the prover had sent uh proper commitments. Uh but yet again um in in real time in real world this would be done with a pairing check on the elliptic curve. Let's see the the the check.

Yeah. So for uh so unfortunately we don't have um we don't have uh a bunch of time. Um we would need group theory. We would need number theory for um this to be comprehended fully. But what I can recommend you since is this is something that is considered the backbone of zero knowledge proofs that you can understand it. Um um then uh for sure you can um um you can go through this uh multiple times until it gets to you fully. Uh but yeah like I would um I would send you the original paper. Um after this class

you will receive original paper. Um I can send you also the additional materials on how to um study the group theory, the number theory and the fourth thing um I I have prepared as well is an article on um different um zero knowledge uh proof types that you can read on that is a bit more digestive than this math. So what I'm trying to do is to have um some math and then something easier to go through especially that week weekend is in front of us and then uh will be um uh you can read something that is more advanced

zero knowledge proof um as in um uh ZK Snarks and ZK Starks and um and also you can um try this u KZ Matt as well. Um what I would like to see as well is um writings on the paper and posting that in the group so that we have some uh proof that you have done some zero knowledge proof. So guys, what questions do you have?

Please take the mic. I know first time I have seen this it was puzzled. It was puzzling but but yeah like I'm I'm there for you and uh for me what worked is going through this multiple times and seeing um how commitments and um group parameters level parameters and the groups that we have and the the finite field works. So, it's definitely um um big chunk to chew on in um in an hour an hour and a half, but uh for sure it would be um

something that is interesting to go through. Um sorry actually it's quite complicated matter and >> I still don't understand how it works but uh I'm going to read the paper you will give you're going to give >> I hope it will work for me >> yeah sure it's Um there are um there are two things um that you can do is one is going through

this um that's why I asked you guys to write down everything and of course you will have this session recorded as well but um things will get clearer every time we uh every time you go through it um for me it worked that way and um for uh for other people as well. Um I will send you the white paper uh the the paper that is uh behind uh KCG. Uh but uh what I would recommend you first is to going go through these equations a couple of times so that uh you will show up with more understanding of the process. Why

I'm saying this is because um if you take a look at the paper um for me it's a bit uh confusing. Why? Because they have used um different notations in uh uh different parts of the paper. Um I'm um I'm a person that needs consistency in order to understand that. And yeah, but um any questions you have um um I will um I will be there for you and um and ask answer that in the shortest amount of time possible. So don't you worry.

>> Okay. Um please um I understand this a bit dense. Uh so in terms of like the paracite topics I know you mentioned finit feed uh can you give insight into like maybe how much of fit fields you need to understand to like actually implement this or if they under building blocks you need to like fully grasp before going through them. Mhm. So for finite fields um that's why we had um um exercises with modulus and applied it in hash and and and everywhere else. So for finite fields you don't need to understand much uh but um you need to

know that um every time the let's say answer to your um calculation so the result is going off the chart. So you can think of it let me let me share my screen again. Let's see I will uh write that down. Share. Present with screen share. Okay. Okay.

Where is it now? Okay, I will show you how it looks like. The finite fields are they are the for me um interesting but they're very simple.

Let's see. I'm trying to scroll. Okay. So um you know the coordinate system. Let's see. No, you stay here. So, this is X. This is Y. And then um let's say this is finite field and we will work within um let's say hundreds on both sides.

So if we say that anything passing this hund it would need to come back in a way. So let me um so it won't be perfect but um I'll show you one elliptic curve. So let's say that it looks like this. And then you think of it like what happens here, right? Well, it just continues back here and then it continues here.

That's how it works. So, it needs to fall back within this finite field or anything like if you have some point, right? and you want to do addition on this elliptic curve, you would need to find a way to come back because if if you go off the chart to say so, then you would need to come back. So finite field is just we're not working with infinity anymore, but we're working with some space. You can think of it as if um

um you're doing um some sort of um calculations on your computer and then you have a buffer of certain uh value but you cannot go over that buffer but you need to come back to it. Of course, here is zero. Yeah, it's um it's a bit Yeah, it it is a bit complicated, but um you'll get there like um like I did. I was clueless

uh before but as everyone was right but um for us um sure I will um I'm thinking I'll be I'll be providing you um yeah yeah for sure like four to five must read research papers um yes and um then uh then uh having that sent to you um number theory as well group theory But yeah, like it's it is difficult if you didn't study it before. But that's why we're trying so hard with uh all the examples we have um to make it easier for you guys.

Anything else you guys want to add? any question not as as easy session. I remember la last time um we we had to to do more more extensive things. Yeah. Ah question. Uh could you please uh go back to to the place where we um deciding that f of uh f of u minus minus what minus v uh it divides by

divides by what? X minus U, right? >> Mhm. >> Why? Why is that? >> Uh why is that? Because we need um the the challenge is to find zeros of the polomial. That's why we are subtracting that value. >> Uhhuh. >> Mhm. >> Uh but why is it a zero polomial? Um well um it is uh it is easier for verifier to check that way uh because otherwise if we do not know zero of the polomial it will be sending fractions back.

>> Uh you mean that the verifier uh selects uh the number which is a zero. Uh it should be we should find uh with that number um verifier is challenging us if we know um zeros of the polomial or if we can find zeros of the polinomial. So another questions was is this similar to the matted elliptric >> curve?

I'm sorry. Uhhuh. >> How how do we choose that polomial? >> How do we choose a polomial? Um >> yes. >> So yeah. Um so um so it should look something similar to this in most books that I have read. Uh but there are actually um like safe polomials that can be um used uh where it is checked that they don't have uh weak points or um for example that um you can find that you can find um a mirrored dot but um not the tangenta on it. So for example, if um there is a way

to uh calculate certain dots uh by uh reflection of it but um this is for elliptic curve uh cryptography. But um if uh we cannot find them uh by reflections um on the other side of uh the curve then we can do tangents on um on our on our curve and um and yeah it's um then you need to find proper polomial that can satisfy um the the properties of the curve.

I think I need to understand a little curve cryptography first uh because I I understand that this curve is not curve actually but uh it's considered a curve in an abstract way. >> Mhm. Yeah. It's it's a bit it's a bit advanced what we're seeing now, but uh um you guys um deserve a good treatment. So you should you guys should see this as well.

>> Okay. Waiting for your papers. >> Yeah. Yeah. I'll be sending them to you guys. >> Uh I have a question. uh how you encode the data to do the commitments in the in the curve. >> So this is um this is for for what we have seen this is um a polomial commitment scheme um but um later on I'll um send all the papers that are uh explaining um everything else. >> Okay. Okay. But my my question is related to the polomials because I understand the oh I think I understand the math etc.

But how you put that in a real uh environment some how you create the polomials like that kind of stuff. >> Mhm. Okay. I'll um I'll send you um I'll send to all of you guys um pairings uh check and uh um elliptto curve I think you have asked for that yes I think yeah yeah yeah someone asked yeah asked for that so I will um I will send um because it's um it's a bit advanced for everything that we're doing uh but still I will provide that as well no no worries um so one of The things is uh we

are having elliptic curve uh cryptography here. We're having um we're having um polomials that are being selected for for polomial commitment scheme. So um you will have pairings check as well. So it's um it I will um I will send you and uh then you can uh munch on it a bit but um it will take u a couple of hours. Yeah, no worries.

No worries. No worries. Super cool. If uh that is all, I will be preparing materials for you. I'll be sending um uh a bit of zer knowledge um snarks and starks to you guys and um and all the additional materials that you have requested. Um so, buckle up and um be um as hardwork as you are over this weekend.

>> Um Can I ask a question? uh in the beginning uh you show that when you calculate global parameters first uh so in the real examples how big um uh how long are set global parameters >> mhm so you would need um as many global parameters as um the height of your polome ial because you would need to conjoin every um every value um of um constant conjoined with the parts of

your polomial and uh evaluate that with global parameters. So whatever is the height of the polomial you will use as many uh global parameters. Okay thanks. >> No worries. That's all that we had for today. That's all. All right. Uh yeah. Um so we see each other again next week. Then we I think it's just the next week you

are teaching again. Yes. Um like during three weeks so we already done two weeks. So yeah see you see you next week. Yeah, you're going to see circum >> something that's more practical for uh for you guys um better programming and um and yeah then um also uh also we'll set some time apart to discuss a bit uh about what you have read and about KCG as well.

Perfect. All right. So, thanks a lot again, Melissa, for for everything, all the content, all your expertise on that uh teaching to others. Very beautiful. Um, so yeah, let's say see you see you next week. Um, everyone and >> take care. Uh, have a nice weekend. >> See you on Tuesday. >> Just bye. >> Bye. die.