Unlocking Privacy with Noir and Starknet

Transcript

hey folks sorry for the delay I was I guess I was just waiting for someone to walk in and and let us know that we could start but uh let's get started so um it's really good to be here and talk about something that's been cooking for a while really really excited to sort of unveil it at this point um but first my name is manmit sing and I work as a developer relations engineer with the Stark net Foundation I'm here with Milton from wakeup labs and today we're going to tell you how you can Implement privacy preserving TBS on starnet using Noir um I also just want to say that we're really excited about this

collaboration because it does unlock a whole new space for Innovation where you can use the kind of hybrid model hybrid ZK model that Aztec has innovatively sort of created and plug that into the hyper fast scalable uh solution that we have over at starnet with Stark proofs um could we so just by a show of hands how many people here have actually used starnet or ever tried to program in Cairo you should have a good reason but okay so a few people I see um uh so let's just start with a quick refresher on starnet if you've been following rollups on ethereum you probably know that starnet is a validity proof-based

L2 on ethereum that uses scalable and transparent arguments of knowledge Ergo Stark proofs to process transactions in a way that is fast and cheap and also theoretically post Quantum secure uh but what does that actually mean uh actually I don't think we need to because if we running a little later uh shorten time but Starks are basically a transparent construction of zero knowledge proofs that are battle tested they've been in production since uh for for at least three or four years at this point uh you don't need to have a trusted setup or any securely uh generated parameters for a proof object uh they use the randomized Oracle model and hash based

commitments and starnet has actually proven to be fairly performant it had um up to 600 plus user operations per second uh last week and and it was able to um uh process subset a subset ERC 20 transfers as well um and of course all of this uh could be uh is no it's just this one uh all of this is could you go back a slide please thank you all all of this is based on our uh programming framework for Star proofs which is Cairo which you can kind of think of as being an analog to Noir but for Star proofs uh it's a t in complete rust-like programming language uh which is based on a research paper by the same name

Cairo CPU for arithmetic intermediate representations uh and I want to also point out that Cairo is not exclusive to Stark net as I mentioned it's a t in complete programming language and the provs the pro engines that are used to generate these proofs uh namely stone or uh Stark one and stew which is the second iteration of it are open source you can find them on GitHub and you can use them sort of akin to Winterfell which is I guess a better known uh uh repository there um go to the next one um I guess this is a bit redundant everyone here knows what Noir is uh but the thing to point out is that Noir uses snark proofs uh I I guess that

makes sense for privacy preserving uh transactions is from a performance point of view but again Noir is rust likee uh again interesting little distinction there Cairo and Noir syntactically rust like but quite similar quite dissimilar under the hood uh but Noir does provide an efficient and developer friendly environment to to generate circuits for for um snark proof called honk right like optimized blunks uh right so we can go over to the next slide um so can anyone guess what the problem is like why can you take like generally you could take a a snark proof uh but but like what's the main difference between a stark and a snark

proof that makes them difficult to interoperate between each other anyone want to take a guess um you want to say something the second letter it is the second letter basically the second letter basically so you've all probably used Bitcoin at some point and ever since Bitcoin it's been common practice in most blockchains to use elliptical curve based cryptography litical curve based signatures ecdsa uh and so forth so on and so forth now most ZK schemes actually use commitments right like commitments form the Bedrock of a lot of ZK schemes and traditionally like the the snark and the

slightly older I can't even believe I'm saying older it's also new relatively uh but like snarks use uh elliptical curve based commitments um whereas Starks use hash function based commitments which is based on uh a trust model called uh the random Oracle model and you can read up on that more and I can also talk about that later once we have more time uh but essentially you cannot verify a snark proof and the same way that you verify a stark proof um so what you need over here is some method to basically implement the kinds of um elliptical curve libraries at a high level in Cairo so that you can verify snarks in Cairo

then verif prove that chiro program using a stark proof and verify that as a stark proof so it's kind of like wrapping a snark into a stark um so how do we do that uh and then there are some Challen challenges here so traditionally like these uh little um software tools that you need to to verify what we really need is a way to multiply across elliptical curve points like you can add elliptical curve points uh across traditional commitment schemes you can multiply them so you need something called elliptical curve pairings um and it's kind of tricky to implement so what we did is or what what people in the Stark net ecosystem did is they implemented an open-source library

for elliptical curved pairings and provided those as built-ins which you can kind of think of as being similar to um what do they called pre-compiled in the evm space uh on starnet Main net so you can actually inv like import these pre-compiled or built-ins into your smart contracts uh which uh on Stark net the other really cool thing here is that um every snark proof requires unique set of uh random parameters meaning that pretty much every time you deploy a smart contract using Noir you're going to need to deploy a customized verifier for that smart contract of course they

all follow the same sort of underlying template uh but what what this tool that that people have built in the star ecosystem called Gaga does is also generates a new verifier each time you have a Noir smart contract and that verif is written in Cairo and you can just deploy that on mainnet and that allows you to have sort of this uh boilerplate code to verify your contract on Stark net using uh the uh relevant elliptical curve pairings you can also then modify that smart contract that you have the verifier contract uh and add additional business Logic for example if this proof is valid then do this or that on like a fully onchain game or or a D5

smart contract if you want to learn more about Gaga and how works as I mentioned it's open source it's got some documentation you can find it at that QR code um and that's kind of like the high level theoretical overview of uh of what we are doing uh I guess we should see it in action now uh and and that's what the folks that Waker Labs have been working on so I'll hand it over to you you might also need this okay I put it here it's okay thank you well well hello everyone H super happy to be here I am Milton bman and co-founder at wake up blaps we are a

software development Studio we focus on building uh like at the Ed at the edge of Technology ER products H we always build a blockchain and crypto ER we we do products and the apps for the the crypto ecosystem um we have been working for a while and we have been doing it with top players in the in the industry H that's why they trust us to build a complex solution things that didn't exist before and that's why what we like most sorry for my English that's not my primary language ER what we like most is doing that H like kind of building the plane

while while you are in the air uh that where we have fun and where we think we add value to this industry so yes that's why starware stet asking us to do H this product for this demo it's a POC H in which we will showcase what mamit was talking about the possibility to use no our language to H generate a proofs and validate them in starnet using Gaga so um we build and just to wrap up about wake up Labs if you need help on doing complex stuff we are here to help you if you have ideas we can help you with that

also if you're engineer or you are friends of Engineers that love working on this kind of projects we are hiring ER so now going to to the demo ER what the starware H asked us and proposed was kind of Designing um a token a private erc20 token it's a a token that will be with the same interface as the rc20 that we all know H but in this case everything that will happen on chain will be private ER nowadays all all of you know that if if we send transactions on chain you can see almost everything it's pseudonymous but you see the money

where it goes in this case the idea was to generate this token in a way that ER all this information re private in every user or every wallet uh and as I said we we did it we built a react native a react JS app that uses no ER and also interacts with the garaga we build the smart contract in kaido um so I will move forward with this um the brog is name enigma that you can try it there it's on SEO testet it's a PC it's intended for workshop and for

demo purposes right now but we can try it a bit you can try it ER nowadays you can create a you can me tokens and then you can send and receive ER and also do some other stuff like in year C20 approve or transfer transferred from all in a private fashion uh if you have H tokens there or you can mint it in the faucet you can try it um it is not typical that we show a light demo in person in real life but I will try it um I have a nice video of how this works but let's do it uh now live if you agree with me um I will go to the demo and then I will

explain how it works uh Enigma here I will share here there where in Enigma so I am here in the app I can see my notes then I will explain a bit about these notes is the same concept as utxos in Bitcoin you know so all your um your balance is the summary H is the sum of all the valid notes uh you exclude the burnt notes the

notes that you have used they are nullified that's your balance um now I will send yeah I will open the other window here uh where we are I cannot see what uh let's I'm trying to show the what you believe me there is another user here what is this not

working you new tab on this one is full screen maybe ah there it is so we have two different users here one with the arc browser the other with the Chrome browser they have balance so I want to send some balance to this one so then I will explain a bit of this but it user has an address and also public key for encryption purposes I will try to send

0 04 to this guy so here we connected with the Argent wallet if everything works as expected we will do a transaction there the thing that will happen is that ER we will be verify generating proofs locally uh in the browser where we we state that we have this money and we will send it to this guy but and it will remain on chain but nobody can understand what is happening

beside these two guys so there is a a transaction here in starnet it has this proofs yeah so this is a protocol it's yes it's inspiring ccache exactly yeah using erc20 interface and working yeah exactly um so this transaction happens uh on a stet the proofs that we generated in our local machine using Noir they come to the smart contract in Cairo be with the help of Gaga um and here we receive this note um and if you go to the transaction

you will never understand what happened um we can do a other stuff I won't show it you can try it yourselves kind of approval or transfer froms [Music] um I will continue here and I will show a bit of how this works so as we saw um just before H we have a a receiver that shares his address and public key H to the sender the sender uh when you load the app you have to know your balance and the the

POS the the way to do it is to fetch every commitment that we that there is in blockchain I I will explain what is a commitment H but it's just when you send H you kind of it's the UT EXO way kind of you create a note and you sign it and you encrypt it and you send it to the smart contract ER and that is on chain and it is a there is a Merkle proof with every commitment from every everyone that is transferring tokens so to know your balance you have to go and look for every commitment in the smart contract H and check if H you can decrypt it or not if you can decrypt it

you are the owner of that note of that commitment if you cannot you pass along to the other so then you have a full balance er um when you have the balance you select which note you will send or which commitment uh you generate the the CK proofs as as we have just seen you generate local and then you send it to a blockchain in this case we go directly to the blockchain but we could have a relayer in the middle in you have more privacy if you add that uh and you send the the transfer and what happens when let's say I send a note with I don't know one Enigma token um and I want to just send

0.8 so as the same in Bitcoin ER kind of you nfy the one Enigma token note ER and you that you do that on chain so you inform to the blockchain that this note of one Enigma token is not H is not useful anymore and you generate two new notes one with 0.8 that you send to the receiver and one with 0.2 that is a change for you um and well after that happens the the creation of the new noes the nification uh the receiver can check again the the balance uh and the transfer happen um so how we preserve privacy yes the

user generates the proofs locally as I said H the data is obscure because we use encryption and signatures ER and of course the user or the client is responsible to handling the these notes I was mentioning so you have questions wo I have uh there was yeah had contact ah here this one just in case you want to contact us so if there are not questions I think

we will move h on to the Google meet there is somebody from starware right he will connect and he will H introduce you to how to prepare uh your computers to build all this kind of stuff um I will try to connect there let's see if this

works there we have Michael can you hear us ah everyone I'm from exploration team sorry that is not as interactive as it should be because of the last name replacement but I'm trying to make it quick and insightful for you so what what we wanted to show you today is how relatively easy it is to build privacy preser applications with Noir using stet as a smart contract layer right now and um uh yeah so we have we don't have like much time so what I and uh like even

installing like all dependences will take like a lot so what I would suggest is to just uh take a look at the codes so maybe like clone the reper locally and uh follow the steps so there's like a guide and you can I I will just like give you a quick walk through to explain what is what so before we dive into the codes so couple of things so when we talk about private preserving applications so what we usually mean is two parts so one part is what is L on the client s and uh which is implemented typically as the Z program or circuit so in our case we're going to use Noir for that and the second part is like

quotequote public part that lives on the public blockchain and where we keep uh state where we verify the proofs and where like the business logic lives okay so in our case uh we won't have any states so in this tutorial so not not even State commitments on nullifiers and even en crypted State uh no business logic just a circuit local prover and proof verifier on stet and that's it all right and what we want to to Chief is uh roughly displayed on the on this diagram so we have a no program we have a smart qu construct net we have loads of moving

parts so garaga which is a glue uh thing like a glue between Noir world and car world is everywhere so it's used for cold generation it's used as an SDK on the client side is also used as a library um in a smart contract and uh if you put like all together so we have an app uh essentially we're like Reinventing adte but like using this um combined stack all right so um now I'm like switch into the code so hopefully you have like already opened that uh let me know if you need couple of seconds okay

so as I said before right so this Workshop is pretty simple I just combined the quick start from Noir and quick start from the Gaga tool chain and uh if I put them together so I can like bigle the atar that'ss which preserves privacy so and we start with uh so what we had to do is actually like install like all the dependencies and if if you had the the codes you can find like all the steps and like the commments uh you could run uh just like so it's like a lot of uh uh different um tool chains so it will take a look so like assume that

we already have all the environment installed and uh the first thing is I have uh I have to have like a circuit and I used the uh nargo um like a starter to generate a template pro project for me um so it it's very simple so it just does one simple thing okay so so uh just sry points two inputs one private one public one

assertion uh so this is like what you get when you uh like follow the uh no quick start okay so we have this project generated and uh it consists of the source file we have also the um no Manifesto where we have the description of the package package dependencies and we also have like a separate file that that is responsible for where we specify uh the inputs okay so this is our Baseline uh now we're going uh to so this is like essentially the first part of the application I mentioned right so the part that lives on the client soal like private part

okay so we got our circuit now what we wanted to do is we want some somehow to create a smart confer then we we need to deploy it on stet then we need to generate like a proof and verify that on on stet and that will be essential like the whole the the full cycle and that's what I'm going to do right now all right very well so first thing I'm going to do is since camera circuit I can uh come it down so I have like reg like an LS for this comment uh

so if you go if you look inside so it's just the invocation of the Nar the uh compile to P so what I have now is I have compiled the circuit down to the intermate representation okay and um the next thing I I need to do is I need to obtain the the uh verifier key okay that is like necessary to verify the proofs and uh this is what I do using the Barett and B uh tool chain so like in case you don't know so Noir is one of the cool features of Noir is that you have you

can have like multiple proven backends so the default and like most used backend develop ad St called and we are using exactly that with the special flower the uhra hunk with C cash uh so the ultra hung is optimized for The Proven speed uh the downside is that the verification is much more expensive but we will like show that like constru so it's like a still spr ship we use like specifically to uh to to generate Pro really very fast so now I have the C compile I have my verification key so

this is enough for garaga Tool chain to automatically generate a smart conflict code in Hera okay and that's what we want to do so we uh what we do is we call the Gaga we say Okay so we're going to use the ultra Hong flavor so this is the p fire key it's name of the contract and like while we have like a bunch of files uh in K uh we have the uh what we have here is we have essentially like a smart contract BR Ino that implements Ultra hon proof

verification okay and this is like enough for us to just demonstrate the like the essence right so how we can settle like a ciruit on on start so we have a smart uh and it's like fully functional so if we wanted to add some business logic we could edit that or we could compose several smart CS to implement like a modular design so what we're going to do right now is we're going to deploy that into into start net and uh uh like on stet so it's done like in two stages so first you need to declare contract it's as if you are uh uploading the codes um and then you need to

instantiate that so first I do uh Sor I do declare and uh so luckily gag already has like a really nice um common for that so you don't need to use like any other tool L um what is happening like under the hood is the Smart contract is being compiled and uh yeah so the we obtain The Clash hash it's like the hash of the of the compil and it's being submitted to to the star transaction so it is down now I can deploy

it and this is like another type of transaction which re uh relies on the class cash that we have declared previously and what I said now we have the smart contract is living on stet test net it has one entry point that is called verify HK proof and that means that we can already try to do that so uh we have our circuit we have inputs both public and public in private specified which means that we can um generate weakness okay and once we have a witness we can uh produce a proof Okay cool so that is like uh the

only missing step is we need to somehow convert from the um proof we obtained using the N to chain to a format that St smartone would understand and that's here Gaga is like a game AC as a glue um so what we do is we use Gaga uh to uh convert from the uh proof obtain to the smart contract arguments essentially so we specify that again so we use the uh Ultra H flavor so this is proove this is theine key and uh we have produced the we call data like in the RO

format and once we have that we can finally sorry for that uh so we can finally uh invoke the contract so we specify the contract address and the entry points and here's like the call data we have generated from proof and uh yeah so this is the the result the transaction that we have uh that we got and just to show you how much uh uh do cost so this is the the transaction where we

verify the H proof all right so this is the transaction uh we had likeed appr Pro and was like successfully verified and it cost us like a little less than 10 cents so like it can be like further reduced to like four cents like a small tricks uh also like important thing here is we are like below certain limit of par app

so without into details so that allows us to use group verification in a transaction validation phase so if you know about like account exraction so typically you have like two stages like transaction validation and execution and uh what it means is now you can have um f l transactions or um um some flexible pay master so you don't have to necessarily have to have a start account or pay any fees you can just submit transaction with the newr proof and it can like land on chain uh which is like pretty cool and this is kind of like another reason why it's interesting to combine more and

start that so first it's like it's super cheap second you can do really cous things with that counstruction um um okay so last thing I wanted to uh I wanted to share is the following so okay we have settled no proof on stet it's super cheap it can be used with instruction to to create some new experiences what's next so uh we here we we wanted to do like even more cheaper so how uh we're like so the team working

on Gaga is now looking into new flavor of the bir Prov system it's going to be uh it will be called like Ultra Stark hon and it's in it Essence it's we uh switching cat to posidon which is more friendly but cheaper toi in K and the uh Ultra second home appication going be even more cheaper um that's it that's everything I wanted to share with you like again like sorry for like non that interactive format if you have any question please shoot here is the link to the Gaga it's super cool it's like it has really good docks and uh yeah I encourage you to

take a little thank you [Applause] our questions for M no questions Michael okay perfect thank you I a love was the end right so this is it thank you guys