Session 8 - Intro to Noir

Transcript

I I I think >> Pedro. >> Oh, Pedro. Okay. Hello. >> Hello. >> Hi. >> Sorry. Sorry I'm late. >> No problem. Welcome. >> I'm I'm Portuguese. If I If I'm not late, I'll lose my citizenship or something. >> Oh, really? >> I didn't know that. >> It's mandatory. >> We Turk's not really punctual, too. So, I feel you. Um, >> sure. >> I think actually we can wait couple of minutes because people are coming in like two minutes maximum two minutes.

So, we can actually >> No problem. >> How are you? >> Need to set up as well. >> Oh, perfect. >> I'm fine. Yeah. >> Yeah. Yeah. I'm good. Yeah. Sorry about today. I had Yeah. Something came up and I really had to to schedule an appointment. >> Oh. could only do at three. I was like, "Oh, like >> we recording it so no one is going to miss I believe." Yeah, don't worry. >> Cool. >> Yeah.

And um let me also share the attendee and after that we can start if you want. >> Sure. uh we had a session with parish and he also show us noir a bit but I believe this session is going to be more detailed so um >> um yeah just the basics of noir >> I don't know how much time do we have actually I didn't ask >> uh I believe like in our plans we have maximum two hours but if you want like more you can continue I believe like I don't know Okay. Okay. I don't think I'll have content for two hours, but

>> Okay, perfect. No worries. Like um I mean sometimes it um all right. I think we can start right now like if you also ready. So floor is yours better. Yeah, >> please just um I need to share my screen. Uh okay, where am I?

Yeah, I think yeah, this No, not this one. What? >> No. >> Uh, >> you don't have a permission or not? Let me check it. >> No, I do have I'm just Okay. Okay. >> Ah, yeah. Right now it's okay. >> Do you see it? >> Yeah. >> Cool. Oh, May the slides. >> Do you still see it or not? Really? No. >> Yeah. Yeah, we see it. >> Okay, cool. >> Full screen. >> Yeah. >> Yeah. So, this is what I call learning one in an afternoon or get your money back. Maybe I shouldn't have these. I don't know if the workshop is playing with it. Anyway, I'm not giving you anything besides

you're going to learn how to write no in an afternoon. But actually, I'm going to do better than that. You're going to you're going to learn in one minute. So, I hope you're hope you're ready. I have told you two hours but if you need only one minute so perfect then >> yeah this was a totally not generated AI image that I took uh in a hackathon and there was some person you see even the like the coke is I don't know why just randomly in a middle of a a table yeah but there was this person that was like yeah do you do you know rest and the other guy was like yeah yeah and of He

had to tell that he uses arch because if you use arch you always have to tell that you use arch. Uh and then she's like cool then write rest and that's it. Like that's how you'll write noir in one minute. So good. Um, okay. I'm joking because you may not may not know all the rest and so if you if you if you don't like I I had at the beginning then maybe you you want to know a little bit more. So it can be exactly the same. Right.

Right. Uh but first let me just like give on the rant about like how ZKVMs aren't actually ZKVMs and because you don't have ZK nor privacy they're just 16. Okay. No no I'm kidding. I could I can spend time on this this rant but I'm going to talk about ZK for zero knowledge. Um, and then yeah, why do we need noir and why is the world thing about noir? And then finally, we're just going to casually achieve global peace in in an afternoon. So, uh, I may be overselling that a little bit. Anyway, DK4 ZK means zero knowledge for zero knowledgers like me and I guess some of you as well at least. um you can

bring your your own imposter syndrome like like I am because I I really I I I have no idea what I'm doing. um at most of the time. But I know that DK is actually very simple. People go like, oh, you have to have a PhD or whatever. That's that's not true because see if if you start with the basics like you have. Um so if you're following and you're like okay sure I I am following.

Uh now you can basically it's very easy just you just can observe that this is also true. Um and so yeah that's the problem. It's like everyone every single article or paper or book on ZK it's always like this. Oh it's very simple. It's just an equation and then very easily you're like PhD maths and you give up because it's just too much. And so why am I doing this to you? So you understand what what are the feeling that prompted so noir to exist like nothing ever was easy. You're like oh there's other languages. Yes I started with using zocrates and and circum but it was never never this simple. Um and

so yeah we were there I mean this not six six years ago it's more like eight years ago where we we started figuring out our own um zero nodes like just like Zach you know um yes we will go and do like the cash right the constraint system ourselves and we did it and we are still alive then there's came this idea of circuits I mean cir comes from circuits I guess I suppose so the idea that you can actually make programs because DK in a way behaves a bit like you can think of it like as a as a electrical circuit. So if you go down that route then you can have these

different gates and components you can attach one to others and they kind of look like circuits. So there was this idea of circuits and then two years ago we were like this is not good enough. uh we wanted something that really abstracts away all the math. Uh you you can write the ZK and don't have to understand the math good if you want to. Um but you don't need it. Um and so that's that's the fundamental idea behind Noir and we've come a long way since since then.

So why noir? This is um no meme slide. I put names in every slide so I promise. Uh so first of all like DK is good. We want to prove statements computation without revealing some of the inputs. This is very important for Aztec. So it's not like we're doing this just because I don't know we have nothing else better to do. We do it's just like Aztec contracts are zero knowledge circuits. So they can be um no programs. So each function is is one large program essentially more than one actually but there anyway uh but ZK is also hard like again the

problem um is like we want to they no matter if you have like this circuit idea it was always going to be you're going to be counting byes and counting bits and moving them and then decide on whether you want to use little Indian or big million bytes or whatever. So, we wanted to do something better and uh so Kev uh Kev likes Rust, which is a famous thing that we do that we say because he really likes Rust. So, he created he created um a language called Noir, which is it's just a copy of Rust. So, Kev was the the OG, the real the guy

that came up with with Noir. Um and yeah, we basically just wanted to copy a nice language and then a nice language uh was rest. So that would be the rest could be any other just like this one. So after three years this is actually very good and to be honest I was preparing for this workshop and I was like okay let's see like what changed in the latest Mar versions and nothing like it's it's insane like it's just faster and it's just faster it's like very much optimized but you don't actually notice in terms of uh having new stuff in the

core language and This is amazing. People are building tooling tools and and libraries and everything outside of the noir team and this this is exactly what we wanted. So the language itself it's fairly uh let's say at syntax level and everything it's fairly uh unchanged since I don't know six months ago. So I'm actually impressed and there's no magic in ZK just math. And it is the the def facto zal standard. I mean I couldn't say this two years ago or last year and yes now I can like most of the zk projects in in the

wild are using uh since I mean from uh world to pay to uh aic itself obviously is using all the way. So I don't think there's anyone in their right mind that will choose another language uh to write their front end because um yeah it's just um yeah I don't think there's any other contenders at at the moment. So what do you want from a zero knowledge language? you want it to be fast because you don't want to spend more than 10 seconds without Twitter like because yeah one thing with with proving on the phone is like you

actually have to stare at it so it's more painful than just waiting you know you're like you actually have to put your phone down and then look look at the world and that's insane like no way I'm going to do that so you also want it to be powerful you can you can say okay it's writer it's passive to write but then it doesn't do much. That didn't make the cut for us. we wanted to be powerful uh more powerful than the languages that were already available and then for them to be usable. Um yeah, so with a good UX something that you could do on a phone um and mobile phone proving is is quite hard to do

because of uh constraints especially in the RAM when you're running stuff on the browser. Uh it it really uh it it makes you suffer especially on on iPhones. Um but yeah, you can do them on like ZK Passport is doing with a native app and then you basically have yeah very very powerful um CPUs on on phones uh that make proof very very fast. So yeah, maybe for for mobile apps, people are more leaning more towards mobile uh native apps than than web apps.

So some examples of the language if you haven't seen them before a simple guessing game. So when you start with a first project, this is the example you get an x and a y. So you have uh an assertion that will say yeah um this program proves that x is different from y. So one thing is important it doesn't it doesn't not only execute it proves so it kind of implies that you know what the result is right it like you know what X and Y is you know that they are different you just want to prove to your opponent in a game for example that they have failed uh that X is your private input that you were

thinking of X and your opponent gave you Y and they failed and you want prove that your x is different from y. So, I mean, you you you can also see why why wouldn't this work? Because I could just change my my number x at any point and just make you fail all the time. So, it's not not this simple, but hopefully this example will give you a hint of the in of the syntax. Um actually you would use this one together with the pre-image knowledge proof where we would say you would commit to a hash of your input and then say I'm proving that I haven't changed my input and then I'm proving that you failed. Uh so that would how a game

would go but it could also go uh with the password hashing for example. Usually when you're doing back end development you are the reg user registers on your website. So it will like um when it register gives you a um password you receive the password in plain text. Yes it's encrypted via HTTPS but you still get like plain text and then you go and hash its salt it hash it then hopefully insult it and hash it. Some people it's like ah just going to start plain text.

uh but yeah if you if good practice is they will salt it and hash it and store it but at some point they had received that uh in plain text and I've seen way too many cases where they just casually log all the passwords that come in uh before before hashing them. So there's many ways where things can go wrong and especially if you are registering in a website you are actually sending your password. This is insane that you're sending your password to someone else and then it's up to someone else to manage it correctly. Uh even not being malicious, it's just it's very easy to make a mistake where your past password is logged. So a better way is using zero

knowledge where you could say I'm proven I know my password and I'm not giving you the password and giving you proof that I know my password. So basically you would hash your password and send the hash with the registration and say my username is zedro and my my hash is 0x123 and then when you want to log in you would just make a zero knowledge proof and say proving that the hash of the password equals 0123 and send that proof to the to to the bucket. This sounds complex but if you see like in noir it's actually very simple. Uh here the example comes with a pendant hash. It's probably not the best best would be like maybe pos but anyway you just hash your

private input and then prove it it is equal to the to the public input. So the public input would be hash. So you would send the public input you would send a hash to the server and say if you receive a proof that someone knows what's the pre-image of this hash then it it must be me. Um so yeah this is just better logging in like than we are used to to do and yeah I guess nobody yet did like some kind of uh oath or so some kind of yeah oath or um O zero or passportjs library

should do this also because maybe they would want to use a different a different hash like by equip or Not no not not just for seven. >> Can I something? >> Yeah. >> Uh sorry. >> Sure. >> Um but if I generate a proof I can use it time, right? >> Like >> Yes. >> So that if someone got that proof, they can also use it. >> Yeah. >> Yeah. >> Yeah. Yeah. Of course. I mean this is you would have to have like when you log in you receive a salt and then prove the salt and then so the verifier would use a salt. So I'm just giving like very simplified examples but uh I see what

you mean of course like you you get something from the from the from the server for before generating the proof. So you know that that's uh an important uh like login session and not something that could be uh reused. Yeah. I see hands in here. Yeah. >> Yeah. Uh Pedro, uh basically I wanted to know if you can put some light more on Pas. I' I've been exploring this, but if you can give give some more information on that be great.

>> Yeah, we don't use petson hash that much these days. We use it which is most efficient in Noir and Blenberg. Person hash is a cool thing. uh if it's a commitment, it's actually homorphic. Uh so it's really cool because you can have like two person commitments uh and then they are encrypted in they are hashed in a way and then you can like make sum those those uh sum up those those numbers and they will get to an encrypted number as well. So you can make homorphic operations.

Uh so we do we do use for some things in in AIC but honestly like most people using it for no circuits we just use Poseidon uh rather than than also like the community prefers poson because it's fastest. So you get a ton of libraries like writing Poseidon in in JavaScript. So you don't have to run our program to see uh what's the output. So there's many um let's say you just go with the flow and as people prefer to use pose then you will likely also prefer to use pose.

So sorry to ask or continue on this. Basically uh we're building a hawker game and uh in that uh we've been exploring Person uh and we kind progress but do you think we should explore the thing I uh the same route or you say suggest for a game like a poker game uh it's better to go the Poseidon way? >> Yeah. Yeah. I I'll just go use Poseidon for everything. So the reason I have Person here is just because I I wrote I made this like this slide some time ago and I just didn't update it. uh because at the time pose island wasn't wasn't in a good position and we improved it because we use it very often in in Aztec

and yeah that's why Pison shows up here but I would totally use Poseidon for unless you actually need Pison for one specific reason I would just use Poseidon >> thanks thanks VR >> yeah cool so more examples semaphore so I don't know if you know sem for this is a uh classic example using ZK where you're member of the real human group and I'm saying this example because you've probably heard about world ID and world ID is exactly uh it's a complex semaphore but is it is semaphore it is no more than semaphore you just have a group of humans and you are proving that

you are a member of that group uh without obviously revealing who you are and So basically you just call this uh computer Merkel root which is already existent actually you probably use a library to to make it even easier and basically you are like proving that you know um in this case an address which would be you with a Merkel path that you also don't reveal at an index that you also don't reveal and the only thing that is publicly known is the Merkel root is the top of the tree and you're basically proving that the root would it it is that you are a member of that that

basically saying yeah I am my leaf my address is in this tree at this index uh for the tree with root whatever and you don't show what the root is we use this very extensively in everything that is I guess any zk project any any zk project has seen and mer tree Merkel trees everywhere. So when people ask me where should I begin if I want to learn more about ZK go and write Merkel trees because Merkel trees are are the core of maybe the core of blockchain in general.

So proving that you are a member of the Merkel tree without revealing who you are which member of the Merkel tree you are this is very very valuable. So this is u as you can see some serore circuit in circum will be like 10 times this size and and 10 times less readable. Um um yeah this is how you do it without an external library in our with an external library. You just import zk kit and then say mt membership and then would be much easier. I can show you ZKit later on, but this is it fast. And then this is where I lose my mind. It's not even true anymore. Uh but people ask me about that

still ask me about that because historically in wire was was a bit slow in the beginning. Uh it triggers me a little bit. In any case, it does depend like depends on which back end you would use. Uh it is backend agnostic. So currently actually the only back end that is using that works I think is is Benberg but there's war world is working on a different back end which is called weird I think weird um and then I heard yesterday there is a team working on a plunky 2 um back end as well. So yeah, basically you write noir and it transpiles to an intermediate language

and then that intermediate language is what will be going to your uh back end backend uh proving back end. So in this case it will be boren in our workshop but theoretically you could use different ones and they have a different trade-off. Some are faster, some are not. So you go choose your poison. Um actually these days with with uh the Zika cash crazy everyone is talking about trusted setups and uh this is an example where you would actually use uh Borenberg because Benberg uses one trusted setup like the like the previous version of Zcash where you have one

trusted setup and then uh that works for every circuit. Um Zcash nowadays doesn't even use um trusted setups. They are like one level. They are the kings of ZK, I guess. So, they they have come with Orchard and the new the new pool doesn't even have a press setup. We're not there yet, but we have one trust setup with with GR 16. You only you you have to actually have one press setup for each circuit, which is kind of a pain and wouldn't be usable for us. Like, we we really need one process setup that works for every single smart contract.

But it uh the speed also depends on your program. Like even if the team doesn't like me to say this, truth is like if you know how the language works, if you know how the proving system works, you will be able to optimize certain things. They were like, "Oh no, the compiler should do should even if you write stupid code, the compiler should get to a best optimal the optimal speed." And that's unfortunately that's not not there yet. Uh but you ask have to ask you how much does speed mean to you? Like do you want to you want to spend two months to to save 15 milliseconds of proving time?

Maybe you don't. Um and that's exactly where I wanted to to go. In the end it's it all you care is about the app that you're building. Uh if you're like using Gross 16 and you have one person setup for every socket, your user doesn't even know what it needs to prove and you're already downloading 300 megs of uh proving key. Uh because each each program has its own Z key and that's that's insane. with noir it's like you download. So ZK pass for example is like 80 megabytes in size because it already comes with the CRS.

So it's like okay um and you don't have to think about that anymore. It's like it's like even the trusted setup wasn't there yet even. So yeah, I'm like everyone that complains that Mark could be, do you have benchmarks? I like I've never heard about I've never heard of someone that is actually serious about building apps and that cares about this 200 milliseconds that you may may get. Um, so yeah, I honestly don't see what the problem is. It's also the only usable ZK ZKSL and I already mentioned

this a little bit. Um, we want you to write code and not circuits. We don't want you think we don't want you to think about math at all. We we want you to write the code as you're used to and then outcomes a proof in the circuit and that's it. We actually we don't say no circuits anymore. We just say no programs. Um again the the idea of the the Z key where like um yeah if you use a a different different back end which is would be the default for circum for example um you you don't you basically need a proving key for for

each circuit. So if your mer tree is one to the eight uh size um in leaves then you need one proving key but if it's just needs to be slightly bigger then you need a different one and that's stuff that your user has to download whether on the browser on the phone uh that takes time no matter if you're I mean you can't rely on that. Um so another thing that people complain is the the gas the fact that noar is like flunk the so the output of the the broadenber proving system is is

expensive and yeah it's more expensive than some of the other proving systems but in most cases that's not something you're going to be worried about. We're more likely to go and use proofs in recursive proofs than actually to uh to pay 200k gas to play battleships or bordal on a on an L1. Um like ZK is always going to be always going to be expensive. Um like 200k gas, it's always going to be expensive for for anything that you're going to do.

So and then finally the the fact that Mar is very very very much mobile friendly. So you're on something that needs super proof mobile flawlessly on a on an app or a website then yeah um then you need these very lightweight um trusted setups and architecture and very very simple things that you can do to prove okay we're not achieving global PC in one afternoon that's not possible so let's just go and see some large buildings and then write some code and then uh proving some stuff. So, here's the stuff I usually show. Here's the

noir discord if you want to uh ask questions, show work, whatever. Uh people are pretty uh helpful there. So, you can visit the nor discord. Nor.org is our new brand new beautiful website. Uh also where you can find the docs. uh docs are very useful if you want to know like all the data structures that you can use arrays slices bounded vectors so I use it myself very often where like I just know don't not know if I have like I was trying to concatenate two arrays just yesterday I was like I don't know I don't remember what the syntax is so I just went there just go to concepts

and get the the slices the arrays and there was a method called concat so And then you can visit this third link uh link tree. Uh that's my link tree. Uh but more more than all it has the workshop resources. So it has like a code space you can run and I didn't double check it if it still works today. But that workspace will it's it's a it's a code space. So it's a virtual machine that is working on somewhere in Microsoft uh with um already comes with uh Bretonberg and by default so you can use it if you don't want to use your own machine right

now to follow the workshop. There's also a sheet really. I'm going to going to be using a lot because I don't I don't remember half of the half of the commands, but I'm going to explain everything that that's going on. Cool. So, I think we're good. Let me just change the screen that I'm sharing if I can find how to do that. Okay, cool. So I'm sharing my >> sorry laptop someone asked something that maybe you haven't seen. Let me just uh tell it to you >> the chat. Oh sorry no I wasn't seeing it. So

>> uh Tina asks >> um >> how does noir compare with provable programming language like Cairo I believe. >> Um yeah. >> Oh I mean the biggest difference between something like noir and carro is that kairo is not zero knowledge. So it it makes very big competitions produce a very small proof. I in case of Starks they're not so small but they are very succinct in comparing with the rest of the the computation. So you can you can prove the computation or very big chunks of data uh in a small proof that can be cheaply verified but that you can't hide anything. uh and

so that's why I tend to say that curry is not zk it's a succinct language and if you go to starket they are very uh clear about that they're like starket is a is a succinct uh it provides succinctness not not privacy and that's that's fair and that's honestly I wish other projects would do the same uh because some most of the VK that you hear in in Twitter is not actually VK Okay. So, >> so more >> discord link has expired.

Yeah. Yeah. I mean not it's this serves different purposes because if you use noir you are producing a snark and not a stark. So that comes with some trade-offs. So there's just like um just going to send the the link or uh okay how how they hey um trying to I sent a a discord invite link. So, so yeah that that's how it differs and actually there's one one cool thing and we we love starknet and and because what they have done is you can actually write your program in cairo and then use noir to provide uh the privacy so basically

we can verify no proofs in cairo using a framework called kaga I'm going to I'm going to write it here and so if you like startnet at cyro you should you should go and and see Gaga. Um it's a big deal. Um they they have done an amazing job. Cool. So going to my terminal here. I hope you see it. Uh no.

>> Yeah. Yeah. >> Hey, you're seeing my my terminal. Are you good? >> Yeah. Let's Okay. Okay. I see my screen now. Okay. Cool. So, just uh move around some windows here. I don't get caught. Okay, cool. So we have a new project and the first thing we want to install is obviously noir. So the way you write you you install noir is not very different from the way that you install rest. So

if you have rest you know that there is a script that installs rustup and rustup will manage all your versions of rust c of and cargo which is the package manager runner tester like whatever everything in rust is goes through cargo and so you install rust up and then that will allow you to install the various versions of car and the same with foundry you you install foundry up and then you run foundry up to install the v various versions of forge and chisel etc. So, no is the same thing.

You install Noir Rupt and then you run Noir Rup if you want to change different versions of Noir. And this is very interesting. So, if you see in the cheat sheet, but since this is a virtual uh workshop, I can actually put here the link to install. So, you can just paste it and then you install. Uh so you can see where my app and you can see here it's like in this uh in this folder.

So so now when I run NUB it will grab the latest version of N uh and uh that would be Nargo. You see rest up installs cargo. So Narup installs Nargo. is nargo cargo. Yeah, I guess Kev really likes rest. So he was like I'm going to use the same. So now you have nargo and you can see nargo version and it will tell you which what is the latest version of NAR that you have. The latest the most stable one is beta 13.

So that's that's what that's what you get. Another thing that you want is a proving back end. So no is just the language you write. You write programs in wire and then uh you have the different um the different back ends you can use. Currently the one I only the only one I use is Bratenberg. So that's what we're going to be using today. Yeah. So yeah. >> All right. Um well in my case I I already installed an Argo uh but my version is uh beta 9. Uh, can you show me the command in order to update

the version, please? >> Yeah. Yeah, I'm I'm showing it on on the screen. I don't know if you're seeing it. Maybe it's not really uh but yeah, just go up. Assuming that you have installed Nargo using Narup, you should just be able to run Narup and it will get the latest version of Nargo. Um, then that's it. I mean what could help what could be is like you have a very old version of noirup and in that case you're going to go and maybe delete this like rf and then delete no then go back and install it again with this

uh with this code command and then yeah it will install again. So after after calling ward up you'll be able to get the nargo version and this should tell you 1.0/ba3. >> Cool. >> Okay. So >> thank you. >> Yeah no problem. So uh as I was saying then we need a back end. So we're going to use Baratenberg. Uh actually there's documentation about the Bretonberg at breenberg.astc.network here if you want. It's very simple and very stupid but we needed to make this

split but um but I mean it's a documentation website just like any other. So but yeah you install it with another curl command and again bbup is again bbup installs bbb bbb stands for batenber. So if I go and I run this command I'm going to get bbbup. So I can see where is BB up and then now I go BB up just call BB up and what it will do is say okay I'm going to get the latest version of NAR go and install you a suitable version of the back end that works with that version of of NAR so

which is not what happened here okay I think I don't know it's installing it here I'm going to I should still have BB app yeah so if I run BB app now. Yeah, I get the version 1.2.0. That's the version for beta 13. Um, yeah. So, that should work. I don't know why it's installed in this NVM version something. I don't know. Uh, but yeah, I don't know. Anyway, you should now have a version of BB. So you can call BB version and see the version 1.0

1.2.0, which is one version that works well with Noir. So that's how it goes. So the flow now is that we're going to write the Noir program. So I've shown you the noir tooling. I've shown you nargo bbup to install nargo and nargo to test and proof and check and do a ton of other things and then we install BB app so we can install BB and BB will proof we'll generate the solidity verifier we'll we'll generate the the verification key with verify we do other things that are like back end related so having these two we can now start

with a new program. So that will be in our gole in it. I'm going to choose a name and call it workshop. And I have a program so we can see how it is. And you've seen this before in the slides, a guessing game, right? I'm proving that X is different from Y. Okay, so we can make this uh more interesting because we have more time. So we can say age verification you say age and then uh minimal age.

So it's it's more interesting. Uh cursor is already telling me that I want to prove that my age is higher than minimum age. This is quite important in the in the in the EU these days where they're using uh age verification for adult content websites. So like you want to prove that your age that your age is higher than okay something show that your age is higher than um okay I'm clicking the debug yes so fields can be compared it tells you what the problem is so you need to cast it to an integer first I'm going to go age as

uh U31 and then min as U32 too. So I was expecting cursor to be more to be more useful here. Usually it does bind with noir but anyway I'm basically casting these two values to uh unsign integers. >> Um because >> could you show again the the command to create the noir project the nargo init? Yes. >> Nago ngo init and then shop. You could just go ngo in it if you want to.

>> Um, so if I was to verify my age, I would say yes, I am 36. I am over uh 18 would be the the the usage for the European Union. So, I want to prove this without revealing anything about my about anything else about me. Again, this is a stupid example because I could just go and change my age, right? I'll just lie. Okay? But uh I'm just trying to be helpful in learning and not doing uh good examples. I guess the you just you in the real world you would just use ZK passport and use your own passport to

prove that your age for that passport with your face is actually uh higher than the minimum age and that's that's much better than whatever we're trying to do here. So you are probably asking also like wondering what is this field thing? uh and field is just a member of uh a like a um a finite field. So it's it's just the way that you represent um numbers in a in a in yeah in a finite a finite field. But you can always cast them to your U32s or anything and it will go and apply some range constraints and some range checks uh which are slightly more

expensive but not really. Um, and so then you can then you can uh compare them. Uh, yeah. So you can't compare fields. That's that's what I that's what I mean. And then there is this test thing. So you don't actually get this in most DKDSLs, but this is very very cool uh in the case of of Noir. Um because see in this example we want the verifier to input the minimum age to be 18. Everyone knows what's the minimum age. What I don't want to reveal is my age.

Um so in this case uh you would go and say minimum age is 18 and my age is 35. So if I run this test and actually you can you can click here to run the test. It will just say that didn't report any output because I didn't I didn't debug anything. I didn't put anything to debug this. You can actually have debugs if you go on the documentation. There's a there's a debug log or something that you can output stuff. But yeah, it didn't output but it did it worked. You can also run this with just narot test.

uh you get this this little thing if you install the noir extension. So you go to the marketplace in VS Code or cursor or something and then install noir and then you get the syntax highlighting and uh and this little really cool stuff where you can run and debug the test. Um but if you run nargo test it will do the same thing. You will also can in your circuit also prove that some test is supposed to fail. So you go you can go test should fail. Uh and then say um

so I'm trying to see I think it should fail. I don't remember but it's but let's try this and see if this works. So this test is supposed to fail. So I'm going to run nargo test. So it's supposed to fail and it did it did indeed fail. So the test passed. Okay. So if you're used to write it to write um test suits, you you know that you want the happy path and then happy path. So you not only want to prove that uh it works with a correct input, but it also works with a with a with an incorrect input. You want it to fail. Prove that it fails. And there's there's even you can also have like

width and then and say an assertion and say invalidate and then put like uh assert here and then put I think uh invalidate. It's been a while since I've written uh so uh I I don't I don't know what the syntax is but the in the docs you're going to find uh the way of passing what exactly you want it to fail with. So, just going to delete this because I'm I'm not I don't have this in my my mind. I don't remember exactly what the syntax is. But you see what I mean?

I'm just going to leave uh whatever. >> Can I ask something? >> Yeah, sure. In the function declaration we just say h but can we also give um parameters type like in the uh following line we say as you know integer or something like that but in the definition can we say that oh this is going to be only integer or something >> um no I mean this will go and be cast to fill what you can do is like just pass a new 32 here and then don't have to have Okay.

>> And then these numbers will be interpreted as as uh >> as integers. So >> yeah, >> whatever. Yeah, >> it's uh it's like rest. It kind of it casts to what makes sense and if if there is no nothing to cast to, it will complain. Uh if if if it can't get what it's supposed to be casting to, it will complain and say you need to cast it to the to the value you want. So if you go uh a just field I don't know if you I don't know if you could even do this uh exactly it will say expected type U32 and you're passing a field so when it when it's just wrong it just tells you so but you also don't have to put as 32 because that already knows that it's

supposed to get a 32. But if it can cast, it will cast. Yeah, it's very smart. But this is just Rust. That's uh I'm saying that Rust is smart. >> What is the What is the extension that you're using in VS Code to get the nice colors? >> It's a noir. You can sell just Okay. >> Yeah. Cool. So this is cool because you can have a circuit and you can have a wall test sweet just for that circuit. So you know that there is no problem in the way

that things are proven which doesn't mean that anything is is actually I mean you actually want to prove not just a test saying that it's correct that would be useless. Uh so to prove we want any kind of proving in any indicate language has two things. You have a witness which you can think of it as a kind of a solution to a circuit and then you have the proof and both are both are private. You don't want anyone to see your witness. Um so not both are private. The the witness is private. You don't want any anyone to see your witness. You want you want people to only see the proof. So what Nir does is generate the witness. It

will compile these into this intermediate language that I'll show you called Acier. Acier uh stands for abstract circuit intermediate representation. Acier. So when you compile this, it will compile to this Acir. Um okay. Yeah, Siri is waking up, you know, like yeah, I say ac and my iPhone thinks I'm saying a Siri. So yeah. Um anyway, so when you compile it, you get into this intermediate language uh and then you can generate the witness and that's what you're going to feed

into the fit into the back end. So to start with you want to go and run nargo check. Nargo check will basically just take this and say provide a file that you can put your inputs in. You're going to say proof and then you have a provermo which is a private file like a file we don't want to send to anyone where you can put both your public inputs and private inputs. I'm going to put my private input which will be 35 and then and um and the public input will be uh 18. So when I prove my program when I execute to generate the witness and when I prove it to generate the proof

my verifier won't be able to change this and my my verifier won't even know what this is. This is private otherwise it will fail. If the if the verifier tries with a different value it will fail. uh in reality in this situation like this you actually make this in the code we'll say not not even have minimum wage just say uh bigger than 18 right but anyway let's just go with this as an example so now you have protol so now you can go nargo execute and this will execute your circuit and it will compile your circuit there's also nargo compile which will only compile but I don't care I want the

compilation and the circuit. So I go with and the witness. So I go with nargo execute. And I have two files showing up in my target folder. One is the the witness which is uh not really useful to see what's in here. So it's gzipped. Uh and then I have the JSON with my program. So, I don't know if this parses it JSON. Uh, yeah, would be cool if it could uh beautify this. Anyway, let's just have a look.

This is what your uh back end will read. Back end will read this file and it will read this file. So it knows what the better what the version is because it needs to know if it's if the the B version supports this version of Noir. Then there's a hash of the circuit which I honestly don't know why is it. And then it's the AI which just tells you exactly what are the parameters, type etc for every single input. In this case just two inputs will be just um h and then and which is private and then a minimum age what will be public uh there is a no return and then it will

have the bite code. So this is what the a series uh this case it's not too big right it's a okay it's not very big because the program is fairly small but this could actually be become big and then there's this file map I don't know what this is so this is what the your bite code is and this is what we're going to be using to prove this is even a debug symbol so the proof is actually small the witness is actually fairly small if you want to you can see nargo execute and there's um there's a way to see yes here but I don't know what what the command is this will be print see and it will tell you like it's a bit

like the you could actually analysis this if you want to learn how zk works is it would tell exactly what expression is and how is they are evaluated uh so this is what is going to go into your back end. Now for the back end. So let's say I am I am Bob and I I want to prove that my age is uh higher than 18. So what did I do here? Oh, I enter the debugging. Oh, okay. Don't want to debug.

Yeah, it works. So let's say that I am Bob. I want to prove to Alice that I'm my age is bigger than 18. So I've generated my witness compile. I generated my witness and now I want to generate my proof. So to do that I'm going to use barber proof. Actually first of all I need to export the verification key. So I need to say whoever is verifying this which will be Alice needs to know that I can't change the circuit like this is it it's it will be like um like instructions on how to verify this circuit. So uh I can't actually go and run and ch and change

the circuit later on. So I do that by by writing the verification key which is not different from writing a verifier verifier contract for insolidity. It's just an instruction like a key on like a a representation of this circuit um and how to something that you need to you need to verify. So, I'm going to go and write that write VK. Um, I'm going to point to my uh JSON. So, I'm going to say targets and say workshop JSON. And then the output of my

verification key would be in target. I'm going to pass this weird parameter called Oracle hash ketch. Um this means that the hash use the hash used to generate this um verification key is kak and this is important because uh for validity verifiers they are more efficient if they use ketch. So you want to use ketch um if you want to use it in a verifi in a solidity verifier which is I'm going to be doing that later on. If you want to verify like just a proof in another machine or uh or using like uh

proofs within proofs for example you just not pass this oracle hash and I have my verification key which is also unrealable and I don't care it's not it wouldn't wouldn't be very interesting as well. So this VK is basically the the the way that you can ensure that your your verifier will use the same circuit because the verifier will also export its own VK uh out of the same circuit and get to the same BK. So now I'm ready to prove I'm going I'm going to go with BB approved and I pass same thing pass the where my witness is

uh where my society is I'm going to pass where my witness is going to be target workshop gz and then my output my proof output so the output is also going to be target okay So also need the Oracle hash. So So I'm signaling that I'm using this hash for my for the for the circuit. So when I go and I run proof, you see it was fairly fast because it's a small program. But you see proof and public inputs. It's

not like you can see a lot of a lot of things here. But uh one way you can add make it like easier to read is to pass output format as well. So you have multiple output formats and one that is useful is bytes and fields bytes at fields. So it it outputs the proof in this weird thing that we're actually going to be using but also puts in fields which could be useful for I don't know um maybe as I don't know how we are using this.

Um so you basically if you want it in a solid verifier or just like remove zero x and just concatenate them we're going to be doing that in an easy way. uh but you also have like your public inputs in this case it's 12 which in exodimal be the 18 so so yeah now we are now we have this proof like this is what Alice will want to to verify so to to summarize she wants to given the same minimum age she can change this but She will prove that Bob

has more than minimum age without knowing what is the actual value of age. She just knows that the proof provides the proof just attests that this age is higher than the minimum age. So let's imagine that now I am I am Alice and I don't have most of what's in here. I don't have I don't have this. I don't have this. I don't have this. And that's it. All I have as Alice. All I have from Bob is the proof and the public inputs which I know what they are, right? I I already know that there are

18. Uh usually in a smart contract, you'll have these public inputs in the contract. So they are public. Uh so if I am Alice, I'm going to go and do the same thing. gonna go nargo compile or nargo execute sorry now go compile because I also don't have proof right I also don't know what stage is so as Alice I'm going to go and now go compile and export the verification key and verification key will have to be the same as Bob uh if it's not then we are not just we are not using the same circuit so we can't actually talk with each other like we I wouldn't be able to verify I

approve for uh a circuit with a different verification key. So I'm going to I am Alice and I'm going to go and say write VK point to the same comp compiled contract and use the same target same oracle hash and I'm going to get the verification key. I can assure you this GK is the same as Bob as okay. Trust me, bro. It's the same one. So now I want to prove uh Bob the Bob's Bob's claim that uh that his age is

higher than 18. So I already have my proof here. So, I'm going to go and say BB verify um I don't know what the parameters are, but I can pass the path to approve the path to approve the path to uh verification key. Uh that's it like and of course oracle hash as well. I'm going to go BB verify BB verify and the proof will be at target.proof. So proof would be what um Bob sent me on WhatsApp, right? Uh or whatever like he sent me just this proof. I don't have anything else. I have the circuit. I

know that we are working with the same circuit. Um and I have this proof. So he has sent me proof. So I'm going to pass pass to the proof and uh I'm going to also pass the verification key which should be um also target VK uh and the public inputs right you need to pass public inputs which will be target public inputs. So this file or this file maybe maybe this one will work as well but they are the same and okay so okay I forgot the Oracle hash

article hash check and now I have having only the proof that Bob created that he's uh older than 18 I can using just that proof and the same circuit I can be sure that he's and I I have su successfully verified. This is already quite cool, right? Uh very very cool. You can have games like this. But most of you are probably here because you want to put this in a in a smart contract. That's where most of the interesting stuff is because if it this

is is non-interactive. So Alice didn't have to ask Bob for anything, right? Alice just went on and just say, "Okay, given what I have, um, this is it." Uh, so there was there was no interactiveness between Alice and Bob. She received the proof, verify the proof. Uh, so people were like, "What if I could put this in a smart contract?" So it's not even another person that is verifying. And that's exactly what we are going to be doing. So basically the the way it works is just take this verification key and put it in the smart contract. And so we do that by writing the solidity

verifier, right? Solidity verifier. Uh let's see what what this takes. It takes the verification key path which will be target. uh the output going to put targets uh h age soft or I don't I don't know if I can pass the name um that's it right so it's a directory uh target contract there cool

contracts soul So now I have a verification contract. This is very complex stuff. Like no way you're going to learn ZK by reading this. Okay. But um the most important part is this is where the verification key is. So that this thing is somewhere here. And then there's like instructions on exactly how to verify this. At the end, you're gonna get what we care about, which is the honk verifier. So, honk, we call it honk because it's a it's a ultra optim ultra optimized honk.

Uh yeah, it's um I don't know, highly optim ultra highly optimized honk. So it's um it's like the third generation of the the proving system plunk which was created by Zach back in I don't know the 17th century. Uh so this is what we're going to we care about. We care about uh a function called verify. I care we care about this interface.

One thing you is cool about this interface, it's a it is view. So you actually only pay the gas if you want to um it's basically guardless. But what's the use if you can't use this in the contract? So if you use it in the contract, then for sure you're going to you're going to pay the full cost. But uh if you just want to verify something really quick, you could totally do that in in solidity without paying gas. So let's see how how we would do about that. Um going to try with Remix. I don't know if you've if you've used Remix. I'm going to share my screen, my other screen.

um share um here. Okay. So, hope you're seeing my remix page. So, I'm going to create a new project. Create a new workspace. Create a basic project. I think even no thing here. never tried it but yeah there is but yeah let's try with a simp a simple um example okay not not basic I want a blank one blank so it has nothing cool so now I want to create a contract

contracts saw going to paste the one that I've just generated say please don't paste code and I say yeah sure that's exactly what I'm going to be Okay. So I can compile this now. So hopefully it will compile. It'll say, "Oh, it's too big and everything." You can uh actually add some optimizations if you want to. Um, and that's probably not not enough yet. And anyway, it it it has

compiled anyway. So, you can now deploy it. So, we want to deploy the harm verifier. Now, deploy that to say that the contract initialization data whatever. Again, this it's with optimizations. You could just make this go away. Um, and I'm gonna it as you could as you could see in the in the in the function in here verify it gets the proof and the public inputs. Usually you would have the public inputs in a contract. You would use another contract that will provide the public inputs. So you can um in this case we are just calling the function directly.

So just going to pass public inputs. So I want to prove uh one way of getting the proof from that unreadable file. Let me show that screen again. Um where am I? Uh Can you see it? Uh >> can you see my terminal again? So, oh, still remix.

>> Yeah. >> Oh, yeah. >> Yeah. >> Okay. Now, I see it. So, it relics will ask me for my proof and I can't read this, right? So, in the sheet, I actually have a way of I have written a way of making the proof look real because it could just go and cut and it will look like this. So, not really useful. Um so you could just go and you could also go with proof fields and remove all the zero eggs concatenate all of this uh it will work like do it like this and so on until we get the wall things but you can see this will take a while so I'm just

going to do like this copy and paste this thing it will get me the proof in the visible format. So >> nice. Just a question because um I didn't see I was doing at the same time. Did you deploy the contract >> or not? >> Yeah. Yeah. Yeah. I'm going going to show you in a second. Just going to show you >> how how how I get the proof from this u unreadable file. So going to copy this thing. I'm going to put it in a file somewhere so I so I won't lose this.

It's going to put So, I'm going to put this in a note like notes text. I have the proof here. Uh, it's not spell check. Okay, it's fine. Okay, so I'm going to go back to Remix now. Um my uh remix. Yeah here.

I hope you can see it. Um so now I have my proof here. So I'm going to copy this this file this uh huge string here. Going to paste it here. I think it's not hexodimal. So I actually has to add a zerox at the beginning. And then the public inputs will be just 30 zeros and then 12 which should be the 18. Uh it's going to go and grab it from from the from our target folder as well. can go. And these are like 30 zeros and 12 that fits the fits the the the space.

Um, and I'm going to call it like and hopefully this will work. Let's see. Pretty small, right? I'm going to make it a little bigger. Okay. I don't want AI assistance. How do I remove this? Just go away. Go. Go. You're fired. Okay. Yeah. Um I just want to clear some space here. Okay. So, I have run this. Um hopefully it went through the You can see that's pretty expensive, right? 6 million gas, right? You can make this. We're we're actually

improving this because we need this for for Oh, come on. It shows up on the other on the other side just Okay. Um because we're using this for ASEX. So, we are working on improving this to I don't know 10x or something to make it much cheaper. So, I've called this and it said pretty anticlimatic, but it will say verify true. Cool. That's it. Right. So my smart contract has has verified that my age is indeed higher than 18 without I've never in I've never passed through the contract but my age was right. All I did was

pass the public inputs and again in a situation in normal situations this this will be hard hardcore in your contract. So even public inputs wouldn't be sent it just send the proof. So the the flow would be me as Bob. I generate this proof and then I send it to the smart contracts and the smart contract just verifies the proof and say for sure this person is uh older than than 18. The problem again with age verification is that I can say whatever like uh it's just not enough. So people like ZK passport what they do is they verify

that your passport is true that it was signed by the correct entity using signature verification and then using the the payload in the passport that was verified to to check your age and and prove that it was higher than the whatever is the minimum rate. So that that's what they do. It's pretty pretty interesting if you want to look into uh their circuits which is the passport. Um here they have a ton of stuff and a ton of tooling as well like you can see the circuits pretty complex but uh yeah

cool. I don't know if you have any any questions. >> Yeah, the question was um when you deployed the contract, >> did you use an already deployed one or you just deployed it with remixed? >> Uh I just deployed with remix. Yeah. and just >> so I pasted the contract that >> I pasted the contract then I went here saw the compiler >> I used an optimization but you don't have to I think I think it works without without optimization so I'll just

complain more uh so maybe maybe even adding more brands I don't think this this is how it works but anyway uh well they went down but anyway Um I compiled it and then when you go and deploy and run transactions it is showing here already. So you can go with honk verifier which is the only one which is not it's the only one is not a library. >> All the others are libraries. >> So >> so this is a library. So this is libraries that are used. So as you know with solidity libraries are other contracts. So it just goes and and and deploys all the libraries.

So if you deploy this one, it will deploy libraries and then the one that you want to verify. >> The one that you want. >> Yeah. >> Cool. >> Cool. More questions. Cool. So you will probably want to do this in JavaScript, right? So that would be the next step if you want to do a web app or something. So there's you go to noranglang.org.

Here's our nice website. You go into the documentation and there's a tutorial on how to do that building web app with Martin Berber. So you could go through with through this. I think there was something that is not working uh because of vit uh I don't know if we have updated this yet um but yeah we're going to find out uh because this this is hardcoded to a version that works but if you try with a later version then you're going to find out some some problems because vit uh I think doesn't doesn't give you all the uh all the resources something like that but you would use a library called nojs and NodeJS is and BPJS. So these would

be like the libraries for uh compiling, executing and then proving auto browser. Um and this will just uh make you I think it's pretty stupid. Uh oh, it's all it's also age verification, so it's not that stupid, but yeah, it's just an example. You could do anything with it. Um, yeah. Any more questions? Cool. Then let me just wrap up. Yeah.

>> Oh, sorry. Um, I I don't have a lot of information about Noars, but I heard that they're using ZK snarks, right? Isn't zay snarks are you know constant size but what we have done the proof uh size was changing I I believe I get that way so I I don't understand it >> um not not anymore actually with with the latest uh honk the proof size is uh is static doesn't doesn't change >> oh >> um but there there's there's a that's not the biggest difference. I mean there it's the proof is much smaller than it

is with stocks and I think that's one of the biggest differences between them. Uh the way that they work is also different. I I really don't know how I can't explain much further. >> Oh, I see. No, thank you very >> but I know that obviously Starket uses Starks. I mean it's in the name Stark. Uh so I know Starket uses Starks. Um and Bartenberg uses Snarks. Uh but they are um I mean it's all ZK. >> Okay. Sorry. >> Yeah. Another question from Austo. Yeah.

>> Uh uh yes. Um and my question is uh what could I do if I need to generate a verifier for another network besides EVM? >> Good good question. So for stark net I already told you there was this Garagga um Gagga starknet we're going to find here send our oh have a blog post on doing that. So basically you can uh write noir and then verify that no proof in a car program. So this is pretty cool uh really really amazing stuff. Um so they have a documentation on how to

do that. Um it's really cool. Um there is someone working on Salena as well but I think they're so they have successfully verified and mark in Salena. I don't know if they are providing any kind of tooling or uh I honestly I don't know what's the status of that work but I've seen on Twitter someone say I've successfully verified as um an art proof in Solana so that's good and and so far I don't I've not heard of any other uh smart contract um blockchains that that's verifying art proofs honestly it's not that relevant.

Maybe you could uh use it like to verify in a in a Cardano in Cardano maybe uh or um Polka Dot maybe. I don't know. There's other chains >> Stella. Yeah, that's Yes, that's true. Someone was working on on on a verifier for Stellar. Yeah, but um you can reach you can reach out to me in my somewhere in my link tree here and I'll try to um try to find what's the status of the stellar integration >> and yeah because now I am learning stellar too so I want to know how to integrate this new or knowledge proof

with stellar and make some applications there. Yeah, there's there's a team working on that. So, but I mean I don't know what's the status and they're definitely maybe they will have to change something in I don't know maybe they have to change something in Brattonburg or something. I don't know. I know that Cara had to make some their their own flavor of Bratzenberg uh to make it work with Caro, but uh but it's it's different and it's actually pretty insane that you can verify a proof in a stark, but I mean those guys they they're pick brain. I mean the smartest people uh you can imagine. So yeah, stellar may maybe it's easier. I don't know.

Okay, thank you so much. >> Cool. So, let me just wrap up with the question that some people bring. What is the difference or what why is no used in in AIC? And uh you would be surprised if you go to docs.astc.network and try to write a contract in Aztec and realize it doesn't look like noir. So, that's the thing. It is it's its own framework. It is definitely Noir uh but it's not really a requirement. But the cool thing is that every program, every smart contract written for ASIC is a collection of of circuits, collection of

NR programs. Each function is a NR program. And so you can define them as being public or private. And that's exactly where they're going to be run. If they are running in public, then the node is going to be running that that proof and and and passing it to be verified. And if it's a private function, then it runs on your phone, your mobile or your device, and then you're sending the proof to the verifier. So the the change that a noir allows is from normal web tree development that you say, "Oh, please do this for me. Here's the signature."

Uh, and with noir and aastic, it's not quite the same thing. You're like, I did something. Here's the proof. So, something has already been done. You just need to prove to the verifier that that's that has So, when you send a when you send a a transaction, you already sent it. You're just letting the node know that you have sent a transaction. Here's the proof that I've sent a transaction. So uh I usually joke and say that you could theoretically write the contracts, deploy contract, mint tokens, send tokens uh in a plane without without internet because those are all private functions. So you could

in theory you could do something like that. Um because you're just telling what already happened and this is the power that noir allows that wouldn't be able to be done in any any other language or framework and so that's why noir is so important for us and that's that's the relationship but I would totally recommend you to go and try to write some AIC contracts if you want to. Uh those are those are interesting. Cool. And that's it.

Um I don't know if you have any any final questions then this is the time otherwise um going to leave my link tree here so you can ask me questions on Discord or Signal. Maybe signal is easier because I don't usually answer messages uh in other places but uh yeah and I can I can help you with what you're trying to build. >> Thank you very much. It was really really good uh you know workshop. I really enjoyed it.

>> Glad to hear. >> Yeah. >> Do you have any other questions people? If not we can end. It was a long session. Thank you very much. Yeah, >> thank you. >> Yeah, and >> cool. >> If you have any questions, as Pedro said, you can I think you can find him on Twitter or Signal. And thank you. >> Thank you. Bye. Bye. >> Bye. Take care all of you. >> Thank you.