Tom Pocock & Zac Williamson: AZTEC Protocol – Bringing Zero-Knowledge Transactions to Ethereum #335

Transcript

this is epicenter episode 335 with guests Tom Pocock and Zach Williamson hi welcome to epicenter my name is sibbeston Cuchillo today our guests are Tom Pocock and Zach Williamson so respectively there are CEO and CTO of a stack protocol a stack is a platform that enables private token transactions on aetherium so at its core it's a smart contract it's also known as the Aztec cryptography engine and here's roughly how it works so when a user

wants to make a private transaction they deposit funds into the contract let's say a hundred died and then the system issues a zero knowledge note which corresponds to this dime so as a holder of this note you can split it up into smaller amounts you can send it to whomever you like and then they would redeem that note for the corresponding amount in dime so this is one basic example an Aztek enables a number of use cases and we go into that during the interview the way a stake is built it requires that every participant in a transaction is using a wallet that has integrated the protocol so they built an SDK to allow developers to do just that and build a stack into their own wallets so they actually participated in the

trusted set up ignition process which took place last year and so she and I did this interview together so here's what you'll learn in this conversation how Tom and Zach met and founded a stack protocol what it is and what problems it solves how Aztek works in practice and under the hood the challenges of making dphi systems like maker Dow fully private how ERC 20 tokens could be issued as private tokens on chain the Aztek trusted set up ignition ceremony the types of transactions and business logic made possible by the Aztec cryptography engine the prospect of dark contracts with privacy built in the security guarantees of using a stack and

other zkp systems the use cases for ZK PS for things like privacy and scaling solutions and the growing privacy ecosystem these are some very unique times so it's time for us to think about resetting healthcare education money privacy environmental policy work and collaboration it's time to reset everything so on April 29th I'm organizing a conference where academics entrepreneurs and thought leaders will come together to discuss the lasting effects of the Kovach 19 crisis so let me tell you about some of the great speakers that we already confirmed I'm really excited about these so Mark Miller who's been on the podcast a goreck chief scientists and foresight senior fellow science fiction author cory doctorow will give a talk about how

we need to either decentralize or Die Another former guest Robin Hansen associate professor of economics at George Mason University will give a really interesting talk about flattening the curve with deliberate infection one of my podcast idols Jeff Jarvis author of the great book what would Google do and professor of journalism at CUNY will also be speaking about the impacts of covent on journalism we have former NASA scientist Creon Levitt giving a talk about the potential upsides of kovat 19 brian behlendorf of the hyper ledger project will speak about the blockchains role in mitigating the impacts of pandemics we couldn't talk about kovat 19 without of course having ryan's sulcus and also Reva tez senior director of strategic initiatives at Intel will

be speaking so these are just some of the speakers that have already confirmed and we're adding new speakers every day so please register registration is free and you can sign up at reset everything that events about 300 people have already registered and we hope to have enough speakers to make this run for 24 hours so once again it's reset everything that events and it's happening on April 29th I want to talk to all your founders out there you're building something that you're super passionate about and as a founder you need to think about a lot of stuff like which platform you're building on token economics building a team and raising money and you're also thinking about security piece keeping your users funds and data safe is a top priority for your business and its reputation so the

crypto space is like a big experimentation lab and lots of these experiments involve people's money I mean just think about the very project we're interviewing today in this episode Aztec we're talking about very very cutting-edge crypto here like as cutting edge as it gets and for these guys security should be and I'm sure it is it should be woven into every aspect of their organization and we're not just talking about smart contract audits here but everything from the company's security policies to front-end user applications so to help you get into this security mindset the privacy focused security consulting company lisa thority is hosting their first security sessions on April 30th it's a free online Meetup where you will learn about

the low-hanging fruit common vulnerabilities that you can fix today what a security audit actually looks like from start to finish and exciting developments in blockchain security research you can ask questions to the team of experts security researchers and get advice about the things that you're most concerned about and it's free so to sign up go to least authority calm once again it's happening on April 30th and there will be several sessions to accommodate all time zones do yourself a favor and get your organization into the security mindset sign up for security sessions at least two 30.com / meet up the status mobile app is now out and it is available in the Apple App Store in

Google Play Store once you've installed it join the public Channel epicenter come and say hi and if you ask us we'll give you some SNT tokens to help you get started and register your status ENS name so the speed at which status is changing is really mind-boggling so they just released version 1.0 version 1.2 came out last week and with 1.2 they've upgraded it from the whisper protocol to this new peer-to-peer messaging protocol called Waku which can handle 10 times as many daily active users as whisper and has a lot of bandwidth consumption optimizations and things like that so they're constantly upgrading this thing and making it even better I was just

talking with someone from the status team a couple of days ago and they're telling me about all the things that want to build into it like for example push notifications there are push notifications right now and status because of course if you have push notifications with like iOS all that data is made visible to Apple so they're thinking of really creative ways to get around those constraints and making sure that the messages that you receive are truly private and privacy is of the upmost importance now let me tell you something when you sign up for status there's no phone number there's no email address there's no identifying information you register with a seed you create a private key the way it should be and this is what secures your messages and

make sure that only you can read them it has a decentralized messenger a crypto wallet and a mobile app store so you can explore the ecosystem of DAPs and safely send store and receive crypto including ERC 20s and some er c720 ones download the status app at status a.m. or go directly to the Apple App Store and Google Play Store and with that here's our interview with Tom Pocock and Zach Williamson so we're here today with Hammond Zach the cofounders of apps tag protocol Tom and Zach would you be able to tell us what he did before you co-founded thanks for having us

originally I trained a long time go in maths at undergrad and then had a glancing blow trying to sing for a bit I didn't go very well and then I was in banking for a few years financial services more generally and it was in about 2016 that I started here about aetherium was quite excited actually for its prospects to provide a clearinghouse technology to private capital markets so that was really why the business got going in the first place I met Zach around that time and we started to work together on building a platform to enable the capital markets to issue and then trade private debt principally and then it wasn't until later on that we switched to Aztec protocol which was at the beginning of

2018 what about you Zach what did you do before ad seg so for astok I started out as a publicist physicists doing experimental neutrino physics then decided that really academia wasn't the life in and transitioned into software engineering and programming development and after about a year of doing that I started dabbling with not chained I met Tom we started working together on this Thomson credit mix in then from there kind of fell into his enormous cryptography and fell down that rabbit hole and that ended up being becoming a spec so what was it about zero knowledge technologies that you guys found particularly interesting and that made you want to really dive in headfirst in these protocols

in the first instance it was just we couldn't really progress the platform we were building on we wanted the clearing benefits the trustless trading benefits of aetherium for these private loans and we knew that it was gonna be a non-starter to do any kind of business on public blockchains without privacy so really that's why zach started to look into zero-knowledge techniques when we were on the entrepreneur first program because there seemed to be no other solution for efficient privacy so that's really what got us what is going on this it was it was a need rather than kind of being aesthetically pulled towards this technology I had entrepreneur first so if you told us before the show that you actually met in a private setting beforehand and then

went on together to entrepreneur first tell us about what this program does and you also met a lot of the people who now work at Ed's like that right that's right yes so the idea of the entrepreneur first program which started in London is now gone I think to six cities globally and the idea is that they have both capital and then a location for putting founders in touch with one another and giving them some seed capital and the idea study when we joined was you'd have someone with a kind of with the domain background so in that case this was me I had a kind of banking and then someone with a ideally a deep technology backgrounds in that case it was Zack and they tried to pair these people up and put them into a team

they put them through a six-month program and at the end you then get to present a lot of the leading by European and US investors Zack and I were a little unusual in that we had been working suddenly weekends together for about eight or nine months building this thing before we joined so we really joined because we thought it would put us in front of the top VC's in a relatively efficient way rather than looking for a co-founder but as it turned out we found two very talented other people one on a Schenk who's now our CEO and one Joe Andrews who's now our CTO and we asked him to join whilst we were on on the ultra novice program let's move on to ethic

protocol itself so in a nutshell what does it do in a nutshell it enables private tokens on a theorem it's a kind of a privacy layer that you can use to either create a privates token that accent like someone like a new dlc 20 token or you can wrap an existing LSU 20 token and make transfers of its private although I should qualify that by saying will be obscure are the values being sent around so that you can send me the private or apt etherium or try to die and nobody can see how much you transferred but at the moment we do expose identities this is a very deliberate decision to keep the gas costs of the protocol to minimum that's currently what the asset could

have got us at the moment we have plans to significantly enhance its functionality over the coming year based of some research and development some research that we firm incubated that dramatically increases our scope of what we can do because we now have any kind of a system of general purpose private computation that we can use to create and not just private tokens but complex business logic complex transaction of flows that has applications that go beyond simple value transfers good so that's plunk and we are get to that in a bit just from a super practical perspective say I have a hundred zero knowledge die and I want to send them to Sebastian what do I do you would use some private audit interface or some software they

use as the aztec developer toolkit from your perspective it would look exactly like a regular transfer you would say armature you know to Sebastian's address I want a sentient and I the only real difference that from the users perspective will be a couple of extra digital signatures that need to be signed over a traditional yesu 20 token transfer but our focus on when it comes to our tooling and resources has been to make this a from the users perspective completely indistinguishable from a regular shipping transfer and would sebastiana then also need a wallet that kind of supports zero knowledge died or would that just be on my end and what kind of wallets out there there currently support this so Sebastian would need a private wallets to redeem the day and convert it either send it

somebody else will convert it back into public tokens our protocol we released it at I think it's been just about every month now there are a few teams currently building integrations and we're building something we're calling the kiosk which is kind of a demonstration DAP that uses private transfers as a model to build off of well there may be some wallets to come on stream in the relatively near future you could actually go and have play around with this kiosk it's okay money is the address it's very quick you know there's not a company to sign-up process we decided to build it really because even though our our principle businesses providing private technologies to developers we've getting a lot of demand from people in the crypto community wanting to play around with a K die and obviously not wanting to wait the lead

time to wait for adapts to come out so we built this okay doc money so people can play around with decade I and say K rat eat straight away so I want to come back to this practical aspect for a moment there they go it would like to send me a hundred died but you know so fredericka is very privacy mindful and maybe I'm not so privacy mindful right like I'm just using an argent we're all it like everybody else and she's like hey I'm gonna send SEP some some die over this confidential transaction I have his argent ENS name and I'm just gonna send that transaction to that address is this possible and like with the die like what would happen to that die if I don't have an Aztec enabled wallet I can you talk about some of

those sort of practical aspects of how this actually works so practically doesn't quite a bit this nd in the recipient to have some kind of wallets that can totally a so critical and like send them require a transaction is required to convert into and out of the private sphere but from other than that it should be relatively like the flow is is the same you can extract all the information you need to send a private transaction through nearness domain name so that that is all the food we could need and then once you sent that private I to you it would be like the equivalent of receiving it any LC 20 token and you would need a some wallet support to actually access those funds but yeah this one's be waiting for you until it's leaking in order to go from having just regular die to this private

die what are the steps necessary so it would this just be built into the wallet where you send that die to like a smart contract or you talked a little bit about so the specifics of like how this works under the hood without getting into a ZK part of it but just so the specifics of how that works a beauty says so under the hood you do need to make a deposit transaction so in Zeki dough money we have an explicit flow for like funding or was where you would effectively serve as a single if their intersection that will convert so dye that you own into private dye the way that works under the hood is we have a smart contract with our calls ace the Aztec cryptography engine as a custodian of your public tokens whilst they're in kind of a private form so what will happen is you will send ace

some dye tokens ace will then give you in return a zero-knowledge credit claim on that dye that you can then trade around you can split it up you can send it to who you want and then they can and anybody who has one of these notes can then redeem die from it ace back mixing containers okay so just to sum up as a user I'm using a stack enabled wallet I send funds to a smart contract that's my contract then holds these funds and issues a note which is essentially represents these funds this note represents the private die so let's say I send a hundred die for this smart contract I then get a note representing a hundred die I can break that up and

how many parts I want and send it over to someone when that person receives the note that I suppose they can just extract the die back into so their public wallet and then send that to any aetherium address yes precisely I was thinking about this you know while reading your blog post and is it the case that if very few people because you mentioned earlier that identities are not obfuscated or not private but if if very few people are using this smart contract maybe not for die but let's say it gets implemented for another ERC 20 token that has little usage or a lot less volume would someone analyzing this contract and sort of like flows of

tokens coming in and out be able to perhaps extract who's sending money to whom I mean maybe not in the amounts themselves but make some assumptions about whose transaction with who is with that is that like a an attack vector that you guys have thought of they certainly would as where confidential and only at this point you're right I mean the less the fewer transactions you have great with the system pseudo anonymity only gets you so far unless you have a lot of volume going through the network there are companies I would say here which is first of all as tech was originally built for assets that were zero knowledge from day one in other words what we've applied it to is where the crypto capital is at the moment which is visible dye and so we created

these contracts to enable people to kind of convert in and out of that visible dye through this deposit scheme that Zack was talking about but are kind of our long-term vision of how people will use privacy is that these assets will be created in zero knowledge from their very creation in other words something like die at some point in the future it's the process of opening CDP getting your dye sending it the whole process start to finish would be private and that would then remove the ability or vastly reduce the ability for people to mine the network for data the second point is also we don't hide the transaction graph at this point but we will do when we make our our update up great long system that obviously also introduces a greater opportunity for

people to data mine and see who's transacting with who that is something that we will be eliminating in our future network upgrade I mean these data mining attacks they are pretty common in the zero-knowledge space so basically you see them on tornado and in green and so on but let's say I now have ZK die is there any chance I can actually use them in a confidential way say on Yunus Wawa so at the moment because the protocol is brand new yeah all of the IG's kind of existing defy infrastructure you can get it to work in a journal as well but it requires a little work to do so so what we have at the moment is we don't just have the ability to do basic transfers we launch the protocol with seven distinct types of transaction flow that

you can with seven distinct journals proves that you can assemble to create more complex business logic so you can do things like that for swaps if you want to create a decentralized private exchange every happening we have way as all like performing dividend payments so that you can have interest bearing or dividend bearing private financial instruments the long term aspirations is to make it so that you never need to leave the private sphere so that once he private funds either from a public asset or from a private asset any kind of economic activity that you want to do with that asset you can do through zeroes proof signals protocols so that you never need to convert your assets into public tokens and then obviously reveal information the bet we're making

as a company is that whilst we're not necessarily using these blockchain systems for day-to-day transactions the amount that we care about privacy is potentially pretty low as we start to shift more and more of our day-to-day identifying transactions onto these networks that's the point which we expect privacy to have to percolate throughout these systems because otherwise we'll be leaving extremely valuable pools reservoirs of data available for the whole world to see and to analyze and therefore we would expect privacy to be a kind of prerequisite for dealing with defy systems in the medium term there are some very interesting problems that I'd say it probably has yet unsolved about enshrouding defy with

privacy there's some really actually practical problems so you just think about something like make it down opsi we all know it's a super exciting project but of course comes with enough problems even in the visible setting now imagine putting all of its collateral base into a private wrapper so how now does does the make a dowel system make sure that it's EDPs are not underwater say it's hard enough even when you know the price which ethers trading water and what all the collateralization ratios on these CDP's are now make all of that collateral private make the die balances private make the CDP's private and what you now have is a massively paranoid defy system because the defy system has

to keep on tapping every CDP show holder on the shoulder and saying I don't believe you're not underwater now I know you weren't you weren't underwater ten seconds ago because you sent me a proof but please send me another proof I could please send me another proof and it'll have to keep on asking all of those our borrowers from the system to prove that they're still in a position of excess collateral that they're not underwater they notice that the dye is fully supported there are interesting ways that you could solve for that for example if you knew what the asset type was that was backing a system or the particular CDP if the system was allowed to know well I don't know how much collateral is in here I don't know how much die has been issued off the back of that collateral

but I know what the collateral type is I know the price is trading at you can then start to reduce some of these problems of the system having to keep on in a paranoid fashion asking for more and more proofs that you're in a position of excess collateral there are ways that if you as a borrower from system were prepared to give up just a little bit of information you could stop the system from pestering you too often so there are probably ways to solve that but it's putting dphi in a totally private setting is going to be quite a complex enterprise what parts of the dphi ecosystem can we make private without too much complexity and overhead I mean could we conceivably make all

arsey 20 token transfers private without provoking like this computational or sort of this overhead are there parts of defy that you think we could make private like Dex's for example or like token transfers in Yunus waa or something like that I'm asking this from from a very sort of like novice perspective because I'm like a super super familiar about your knowledge technologies the really low hanging fruits here is ERC 20 tokens that are not backed by another form of collateral so for example if you have a names make a coin or that does a load of assets out there I mean I suppose that's backed by the collateral its cash flows I may not be a great example but if you have an asset whose value is inherent to the asset and there's no further collateral

to look behind it's very easy to issue that asset afresh in a zero knowledge context with you in order that you don't have this issue where you know in the case of decade I currently you put the die into the contract and you get back a kind of a sleeve a zero knowledge wrapper as their own equipment you have left a visible trace because they're all sees that you've put in 20 or 30 die so for anyone issuing new ERC at least a years or 20 tokens or wanting to fully migrate to a private setting they can do that thereafter every single transaction that's done in that er c20 asset will then be a completely confidential so that's the kind of the easy answer to that question the other thing I think which could be done basically instantly

is something like USD C so that does have obviously it's collateralized but it's collateralized in an off chain asset which is not visible to the world so there's another example of where you could have a stable core I know whether you call that defy or not I mean some people wouldn't qualify that as defy there's another type of asset you could put on maenette without ever leaving a visible trace of the amounts involved right perhaps even security tokens or you know real estate back tokens or the sort of thing exactly in fact it was security tokens that Aztec was originally designed for in the very first place when it comes to zero knowledge defy this kind of there's a hierarchy of complexity that tom was just describing you have that the most basic thing is

kind of unilateral transaction so if I'm sending somebody or you're sending somebody some tokens or some asset or something like that where it's completely non tractive it's very easy to translate to a private setting the next level up our bilateral interaction so trades between two people like I'm trading something like an additional asset with you or I'm engaging in some kind of like futures trading or betting system and that is also quite practical to achieve in a zero-knowledge world takes a bit more work but you can do it you then get to kind of multilateral computations which become a lot harder so things as Tom's the things like dye things where you have some kind of collateral base where you need to form quite complex computations evolving that link inputs from lots of different

people like for example managing a CDP that's significantly harder to do and we see our kind of efforts focusing mostly on the first two these cases in the short term and then once we've summative there's Peaks then we'll we'll focus on the more complex systems we kind of understand what at second currently do and what you're looking to be able to do in the future so let's look at how this works under the hood so basically this is all powered by zero knowledge proof and for that we actually did a trusted setup that you caught the ignition ceremony so tell us about this and then it's kind of unpack the steps of creating a zero knowledge proof from there so as far as the ignition serum is concerned as you may be aware for zero

knowledge snark systems they depend on this kind of piece of mathematical scaffolding known as a reference string and it's a way of really making the computations that you need to do for a zero knowledge proof sufficiently speedy that you can get the stuff to public networks straight away so it allows the kind of the proofs Isis to be quite small and the amount of work that needs to be done for you to send a transaction to be kept relatively low what it does mean though is it's it's predicated on computing a kind of encrypted number but no one must know what that encrypted number is and so the way we did this was through a sort of form of multi-party computation where we went to our community of people who are interested in the Aztek protocol and said will you take part in this ceremony and this

ceremony is such that it would require every single one of these participants to collude with everyone else in order to be able to reconstruct this number that actually needs to be destroyed and never know so if just one person behaves honestly and they destroy their toxic information the system's secure so we thought we can design this ceremony so that it's not just good for the current Aztec system but also for future snap systems as well and so we can go big on this we can go out to the world and say institutions individuals who nourished in privacy preferably as maximally geographically distributed as as possible please come and take part one after the next layer in your toxic information your toxic

waste please test to the fact you've destroyed it and in doing so we can create this really secure reference string that everyone knows and trusts is not susceptible to corruption and so so that's what we did we ran a ceremony for in the end about two months it originally was going to go on for just a month but we had a lot of the interest from participants we had two hundred participants in all of whom just under one hundred and eighty successfully completed the computation and those participants came yes largely from the etherion community but also from the tesla's community as well we had major banks and institutions we can't name any one of those institutions unfortunately because we've to release that information in their own time and the point is if you can look at just one participant you as a user of

the system and say well I trust they didn't collude with anyone else you then know the setup secure that's how the ignition ceremi worked how did you design the ceremony I mean it like reserved sort of a threshold that you were looking at is 200 sort of a good agreed-upon number or is it the case that would it be better to have a thousand and does the benefit sort of flatten off after you reach a certain threshold there's there any kind of one perfect number which is seven billion and but it's kind of somewhat unworkable so you'd like every participant in the world who's ever going to conceivably use the system to take part but the truth is it's obviously it's given the amount of time that it takes to do this computation I mean we really actually shrank down the the length of this

reference string to make sure the computation could be done on the home computer and even including 200 people that took 30 days plus the time that we added on at the end so a 200 people our sense was they were sufficiently well distributed geographically you can see them on a map if you go to our ignition website which is only a satirical website you can actually see where all these people where most these people came from the review you know people who decide not to declare who they were or where they were from and that's fine but but most people have attested all you need to know is that if some handful of people that I look at you know be that they're telling me that Tess's foundation be that some institutions if you feel it's inconceivable that these

people knew one another interact with one another shared their data that's the ficient for you to know this reference string is is secure so 200 people there's no perfect number but it feels that the probability is wound essentially down to zero by having 200 people who provably mostly don't all know one another and have an interest in making system secure so how similar is this ceremony to let's say that the the ceremony that goes into creating a root certificate and in that case I mean for the little I know about the ceremonies it's like they're fairly robust and then you know people are locked away in bunkers etc like what is the level of security that these sir

moenay's provide what's the benefit of having like this level of security as opposed to just doing like a multi-party competition with 200 people like the randomly picked on the internet the as the NBC was structured in a way that we didn't need to take as many kind of extreme precautions as the sermon is that you're describing also means also the construction of it is that it's based off of the Z cash sampling multi-party computation and Searle idea it's the security piece by that are relatively conventional the reason why you would want to do things like lock yourself away in a bunker or drove out to the middle of the Gobi Desert with a laptop that you assembled from like second-hand parts that you've saw small little of a lot of that is because a lot of these multiple computations they

exist in two phases where imagine you have a set of participants but only the computation PC is require the participants to generate some toxic waste but then keep hold of that toxic waste and kind of preserve it whilst everybody else participates in like the first half of the computation and then the NPC will proceed into a second phase what everybody then needs to use that the toxic waste that they previously generated to perform some extra computations and that's extremely dangerous because that means then you need to keep hold of this toxic waste you know what it is needs to be lying around your computer on memory in memory on a hard disk perhaps and you need to be extremely careful about expressing that toxic waste for the Aztek NPC it's a much simpler affair where there is only a single round when you

participating in the ceremony you generate some toxic waste you pause the computations and then assert once you've taken part in that single atomic process you can destroy your toxic waste and forget about it you don't need to hold on to it and so that makes so many a lot more secure means that we don't need to take as many extreme precautions I'm reasonably certain that this setup works because I also participated in it and I destroyed my toxic waste and so now we have this trusted set up with this very long number that is secret to every single person so now what you guys have done is you have created seven different kinds of proofs based on this and so from my understanding that send swap dividend mint burn and public and private range so what kind of business

logics do these building blocks actually allow you to build in the privacy-preserving fashion so the business logic that it enables is we have three main types of transaction that you can do with these you have your basically life you know after all transaction like I'm sending you private are you'll simply be private dial private tokens you then have a bad for swap proof so you can take two different private assets trade them a month to people like if you and I wanted to save short private died for private thief then you would use this partial swap proof to do so without repeating information we also have something called the dividend proof which is a way of proving that the some encrypted sum of tokens is equal to a percentage of

another decrypted set of tokens so you can use that to create interest-bearing dividend bearing financial but private financial tokens on top of that we also have what we call mint and bump risks which is a way ways of just directly printing or destroying private tokens without having to convert public seconds and see what you would use these for a fully private financial instrument so if you wanted to the crowd for example a private loan like at syndication at issuance you would then use the mid proof to print that use these web tokens and similarly web and proof where you can which can be used to destroy tokens so Sebastian alluded to this idea but basically the moment that actually

something is within the ethnic ecosystem I'm actually giving a note which is a claim on an acid and so this note model is you know the you takes a model that we know from Bitcoin in C cache and so on why did you choose this UT EXO architecture because basically working with contact smart contracts is more difficult in the setting no it does add complications the reason why we went with the us EXO model is because it's significantly easier to give strong privacy guarantees in YouTube terminal than it is in an account this month because in an account based model imagine you and I have encrypted balances of some typing if I were to send you some token I need to somehow

add to your crypto balance and I myself I don't know what your balance is now that it can be done we chose deliberately to not to go down that route because it would make male r0 lotteries significantly more expensive to like in terms of gas costs on a theorem to verify and which would have made the trunk the transfer costs much higher and the kind of the overheads of you to exterminate away with our own let's develop a kit so that if you're a developer integrating a spec you don't need to worry about you take so model SDK exposes like a straightforward interfaces that you would expect from a traditional campus model of you know get some expanse send with some summary tokens logger term if you want to break

the transaction graph and tiny so you want to hide not just the values being set for the identities then that makes an account based model extremely difficult to do because if you're hiding people's identities then you don't really want there to be a kind of like one encrypted number which represents somebody's balance because making repeated modifications to this ballast is this very difficult to do that without leaking the fact that those transactions are connected they're all ways of doing it but they come with some seemed everything drawbacks it's much easier to use statistical analysis to kind of find out what's going on in the system

so you spoke earlier about the fact that you're moving to a new system called plonk so basically so far you've had these seven different kind of proofs that one could kind of assemble two different business logics but I my understanding is that this Pronk architecture allows you to do general computation in a much more general way so how does that work and what does it allow you to do so the way it works is you can create arbitrary certain in the ten people that they're called automatic circuits but effectively they're programs you can you can write traditional computer programs and convert them into zero not script so you can then you can then effectively

prove to somebody server mathematical proof that you have executed a certain computation and you can choose to keep the inputs and outputs of that of that computation private and encrypted and you can use that to create things like private tokens burn private transfers but obviously it's much more expressive and more powerful so you can you can evaluate complex business logic you can do things like evaluate multi-party computations to do not just bilateral trades but at multilateral interactions like rinsing the shares all there's this kind of more complex system or complex systems and so what we want to do with it is effectively a program ability into piastic protocol so that as a developer if you're building a private token or

private asset or private anything you get to program yourself what their transaction eligible the business logic is going to be and obviously this is a lot more extent extensible than having to assemble your logic out of seven specific proofs let's move on to the the ecosystem and I mean one of the things that I find particularly challenging with regards to protocols that we've built on top of theorem is that it's required upon apps to to integrate these protocols in order for a large number of people to be able to use them how do you guys so look at this problem and how are you working

with wallets DAPs and other applications within the etherium system to to integrate Aztek widely and are there are there ways that we can sort of generalize these things so that anybody using any application would be able to leverage Aztek without the app itself having needing to to integrate it so I think the first answer to that is the way we're working with the ecosystem is principie through our sdk so it's this it's this thing dealing with these private assets as sacra's alluding to earliest it's pretty complicated you've got to manage private notes viewing keys all kinds of structural complications so the first thing we can do for the

ecosystem is just trying to make these complex just go away and the SDK is the it's the sort of where it's in black box but it's that it's the management system that makes dealing with private assets as close as possible for the developer to into a Dean with a neo c20 token there is some extent to which it is impossible to make privacy so just a switch you can just turn on and off without any real integration at all not least because the management of your state the way you record ownership of assets is just markedly different by definition to visible assets and so I think there's never gonna be a point at which you could just say here's or privacy switch turn it on turn it off again the probably the closest we can go to that is by working and this is a kind

of a long-term project both for us and for other people in the industry to develop some language norms around a dart contract system so in other words doing as much as we can to go back to the engineer to the developer and say that we don't know exactly what you want privacy for and you might want to you know tweaks you might send what some additions of some additional logic you might want to keep a stream income you may not want to just send income you might want to have all sorts of conditions around escrow management for payments that we haven't thought of and haven't expressly provided you with a proof to do and so probably the best way that we can put that into the hands of the developer is by moving to a dark

contract system in the longer term where we can enable the developer to send a variable private to say I don't I don't expose a balance in this asset or I don't expose the conditions or or the the inputs around how I apportion a payment between two parties whatever it may be we need to put that power back into the hands of the user and that's why long term it's inevitable I think that these smart contract languages are going to have to absorb some concept of what it means to turn a turn a variable private is there any work being done in this to sort of move things in this direction is this something that we're seeing already

or we're just too early for that sort of thing to occur it is early I mean it does it requires a slightly more sophisticated form of developer by definition because they've got to understand a little bit more about how their launch technology works but it is also something that it's it's firmly on the the mid to longer term agenda it's just that we can probably deliver privacy using sort of 80/20 preso rule we can probably deliver a package to privacy rather more directly without the complexities of an entire language to go around it through our SDK at the moment through using a number of kind of out-of-the-box proofs in the longer term though that will certainly I think I'll

questionably be be a feature of the smart project programming is that you'll have you'll actually be an adult contract setting so it's not an immediate pressing concern for us because the things we really see it's being used for things like you know payments and escrow and that's all the low-hanging fruits that we can get to much much much faster is there anyone already bidding on this protocol there are people no no we can announce at this point as much as anything you know with six six seven weeks into the life of the protocol and at the moment its proofs of concept so I'd be kind of hesitant to to name any names at this point obviously it's a pressing concern for wallets to integrate the stuff to be able to kind of deal with private assets and there

are some I think anyone doing doing payments doing whether it's you know sending of salary or peer-to-peer payments or or merchant payments anyone doing that kind of activity on web 3 clearly pretty will be a prerequisite okay we're trying to encourage adoption using our SDK to those kinds of early users but no more to talk about just at this point okay I see and as a company what's your business model in all of this actually that's great let's look it's not something that we're publicly nailing on colours to the mast on that's partly because I think we have to see to really send how people use off our privacy from

to be able to work out where best to monetize and where best to make sure that we're not introducing frictions which will deter users so I mean it's certainly possible to say we've spoken a little bit about are these privacy proofs we've not really talked much about their prospects for for recursion because of course snarks you can use not just to send a transaction private but also to rollup transactions and to get efficiency and so it may very well be that someone providing for example a a rollup service can say okay ordinarily it would cost you let's say low hundreds of thousands guests to do a private transaction which you sent straight to mein that instead of that send your transaction to us we won't we won't to

come to the hood we can't because you're sending us a private transaction but we can roll up and aggregate your transactions with 100 or 200 or 300 other transactions and then repatriate them send them back to Mei net and so what that means is we've now been able to amortize to split the gas cost of that one transaction amongst several hundred transactions rather than you bear in it our gas cost on your own now that actually I think for a a roll up provider offers in one model of this of this world quite an interesting business case because you say okay we've now managed to reduce the cost of doing business or main net and we can probably make a sustainable margin by being one of the major Ola providers there are also ways by which possibly in the future our SDK could earn revenue by you

know developers paying for use of the SDK to make dealing with private assets really really easy so those are kind of two potential avenues of monetization I won't say wedded to either one of them yet just because I think it's going to depend a great deal on on who's integrating privacy into that apps as interoperability becomes a norm in the future and I think we can all agree that this is where things are heading how do you see Astec play a role in providing private transactions between chains is that something that you know would be possible and that you're looking at piers of thinking about it is something that we're thinking about and absolutely saying that's possible it's going to take a little bit of time to

fully implement trustless private sorts between chains because the most practical way of doing this or not maybe not those petaluma secure aging this is to embed like clients into these blockchain criticals so for example if etherium had a Bitcoin web client as a smart contract then the theory of the reason perfectly about what Bradley perfectly about bitcoins state as well as any other Bitcoin in it but obviously you can't right now implement the Bitcoin protocol as it as of smugglers and aetherium because like the competition of the his part what is what many orders the magnitude too large but this is letting us knots can and will help us so you can have a for example a smart contracts on aetherium that verifies not proofs that where you have

a stock circus-like program that effectively acts like the Bitcoin like clients and through recursive snopp composition basically you you have a snot circuit which will validate Bitcoin block headers and repeatedly and so you can you can build up a kind of an understanding of Bitcoin state and to do so where that kind of that computational burden it's offloaded to a single transaction sender asset of the entire etheric network and we see that being extremely practical in the future as your knowledge technology doesn't need to improve a little bit before that to become what's fast enough to do that that value that kind of complex logic but we think we're at the most in a year a year away from doing that and then then that will be very exciting because we can just embed like clients in two

criticals like etherium city planners ones that would be really cool I mean so this also brings to mind the question of you know use cases for zero knowledge and you know we've seen a lot of use cases around things like scalability sort of come up in the in the last one or two years in your view much of the ZK research is focused on doing things like scalability through roll-ups and how much of the research at least in the blockchain space is more focused on on privacy and do you think there's a good balance there or should should we see more of research and interests coming into the privacy side

that's a good question I think the majority of the research is on scaling because that's seen a lot of people particularly in Finnish to see that as a kind of the existential problem into so there is an extreme amount of overlap which means getting at privacy or at least privacy select the solutions for privacy can be applied to scaling is not necessarily the way around so I do I do see them converging it in the future and there's a lot of research that we've been doing around for our privacy critical to improve the efficiency of plonk that can be directly translated into scaling so there's some some work that's been part that's been published recently that we've done is to make a lot more efficient but it's also being used to explore scaling specifically

representing state trees like the theorems state in a way that's more efficient than the Merkle trees have currently used and the things like there was a lot of cross-pollination so I do see the two plan of research paths converging in the new future with all of the innovations that are coming out of the ZK space so I'd like to the you know the the user of cryptocurrencies like people who use it the area etc that you know there's this doesn't seem to be a whole lot of excitement around privacy preserving systems and more generally I just think you know as someone who uses signal for 90% of their messaging and like doesn't

have like a Facebook account or this sort of thing like you know for specifically for privacy reasons I feel like generally it's hard to get people excited about privacy what are some of the best ways you think that we can get people excited about privacy is this is this something that's reserved to a you know a sort of niche of people or are there broader other ways that we can make privacy more attractive to it's like the general public yes oh I know I'll put it that you can Maurice to get people exercised rather than excitable about privacy and what I mean by that is solely to earlier you know what we're doing things like putting tiny amounts of our capital into

CDP's or into a compound or whatever if there's nothing really about those transactions that tells a story about us that identifies us that tells us you know where we gonna get up copy in the morning when we live what our spending habits are what our preferences are so really there's no question that privacy becomes important as something that the average everyday person becomes extremely exercised about as soon as they feel that they're starting to use web 3 for things that tell the story about them so take your example payments of salary stringing salary as soon as someone's starting to pay salary and to receive a salary on may net the recipient salary is going to immediately say well I'm not happy with this being broadcast on main net and then my own

bound transactions people who are receiving money from me out of that salary being able to tell how much I've been paid I mean we had issue one internal example in our company which was quite funding to her privacy company it was actually a Paul Burke you know runs a plie and Tom white one of our engineers and Paul since the money - Tom and Tom was then able to expose Paul's entire crypto trading history just by looking a full sports account that's one point at which you know before that transaction occurred they might have thought nothing of it but as soon as they realized all of the the reservoir of economic history that one of them had already built up on main net thinking actually it wasn't all that significant that the realization came wow this is an absolute prerequisite to

doing any meaningful day-to-day activities on these public networks so I think it's gonna be a matter of people getting exercised not necesary excited about privacy because they feel they can't really do anything meaningful on these networks without it oh I'm totally excited about the privacy so the one the one last thing that I would really like to talk about is the security standards cryptography when it comes down to it it's super hard math and it's easy to get it wrong so basically to demonstrate badly last year so early 2019 Sukesh fixed a bug that had been known to them for here it was a cryptographic flaw in a paper that they used the if exploited would have allowed anyone to create an arbitrary number of Z cache tokens then

would have been undetected had they been created and the shielded work I mean obviously Z cache has been wrong for around for a long time and they have fantastic scientists and basically their subject met meta expertise is fantastic so basically what kind of security assurances can you give the people who use your SDKs and actually deposit tokens in in the pool that you give them then a tokenize claim to what kind of security guarantees can you give these people when it comes to the security of a cryptographic protocol there's really three main categories where it can be exposed as being insecure the first one is just simply implementation like you've not correctly expressed the

mathematics and code in your software as buggy we want to assure people who use our protocol that the code isn't flawed we've gone through two full security audits on a small contract and associated code to validate that yes the code is incorrect expression of the mathematics and there's no vulnerability on that side of things the other two ways that a critical program can be exposed insecure is either there is a flaw in the security proof so every cryptic a protocol has something like a soundness proof that demonstrates that it tends to mathematically prove that the only way an attacker can compromise a system is by performing specific computations that are considered to be

basically impossible given today's current technology and so if that triggers the flow then the protocol be insecure that's what got Z cash and SX proofs we are sunless proofs they be validated by quite a few problems now I mean obviously I can't give up like a perfect claim that it will never be found to be compromised but you know as is my kit is extremely confident I get a gimme extremely confident of that particularly the girls have flunked because one of one of our co-authors was Ariel gammas on the same person who actually found the Z cash bug so I'm yeah I'm extremely confident that there's no underlined form the soundness proofs that we have the third way that a proto book can be compromised is if the

cryptographic assumptions being used are not strong and so the idea is I mentioned before previously that a security proof will show that an attack asked to solve perform several computations that we think are impossible obviously if this computation sound to not be impossible and turn out to be quite easy that's a problem all of the technology that has to use is all about cryptography for general protocols they rely on very standard computational assumptions they rely on we forget assumptions based on elliptic curves which have been established for decades now so earth conventional so not countable also we have an extreme how to be a confidence that critical secure and if the underlying elliptic curve Crimson's

tennis will not be secure then then basically that has ramifications for things much wider than acetic the theorem protocol itself won't be secure in that setting absolutely so from you as a as a subject matter expert when do you think quantum computers will break these forms of cryptography so yes quantum computers I might be one most biased people come to our site question you because obviously the consequences of quantum computing become impractical or severe for us we have to move to quantum secure various systems that's where there are sufficient that we'd ideally omelet don't do that Jeremy I think that where we are at least multiple decades away from quantum computers being practical

there's been a lot of developments lately from Google and similar companies about the concept of quantum supremacy where as a milestone has been achieved across computing where quantum computers can perform a computation more efficiently than classical computers which is a big deal that computation however is the measurement of quantum mechanical noise so I think it gives a false impression of how advanced quantum computing is generally to do something like run Shor's algorithm which is however them you need to run on Aquatica visa to crack an elliptic curve you need an extremely large number of kind of quantum bits in your in your quantum computer and the difficulty of keeping a quantum systems stable

increases exponentially with a number of bits so like a 32gb system is not twice as difficult to achieve as a certificate in systems that she sits at to to 16 times harder to achieve and so given the number of qubits requires Marshalls algorithm and the current state of quantum computers I mean I'm very confident that we're going to have a basically we're gonna have a lot of warning many multiple multiple years of warning before quantum gives compatible enough to break elliptic curves so I hope that it turns on that great and I don't see happening for a very long time well that's reassuring so bro wrap up tell our listeners where they can find more information with a stick protocol perhaps you and you know integrate a

stack with in there if your room apps or adapts yeah thanks so best please find information on us as depreciable calm from there you can get straight into digging through our docs integrating SDK it's a pretty quick and simple process we've made it really fast because we wanted to encourage integrations that happens so we'll people to be able to to adopt privacy super fast without it getting in the way of what they're doing hackathons I've got some nice interactive Docs there as well we've got a new research page which shows you all of mathematical research that we've been involved in or produced as a company and some explainers as well so if you're a kind of amateur mathematician and you want to find out a little bit more about Xero which tech

hopefully those explainers will will help you understand get a bit of intuition of what's going on without having to kind of sift through these 20 30 40 50 page research papers and also join our telegram got a telegram channel as Steph protocol and also a Twitter which is where we send up most of our major news releases etc and that's for us later to contact us and yeah please feel free to reach out hello as the approachable comm is a good place to get in touch with mister to get help with integrating SDK or anything else you want to know great Tom Zack thanks for joining us today thank you guys thanks a lot thank you very much thank you for joining us on this week's episode we

release new episodes every week you can find and subscribe to the show on iTunes Spotify YouTube SoundCloud or wherever you listen to podcasts and if you have a Google home or Alexa device you can tell if to listen to the latest episode of the epicentre podcast go to epicenter TV slash subscribe for a full list of places where you can watch and listen while you there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other podcast listeners you can follow us on twitter and please leave us a review on iTunes it helps to be behind the show and we're always happy to read them but thanks so much and we look forward to being back next week [Music] [Music]