ZK Cryptography and the Frontier of Innovation w/ David Wong (ZK Security)

Transcript

[Music] hello and welcome back for another episode of The Strange water podcast thank you for tuning in for this week's episode at this point it's becoming increasingly clear that ZK is going to be one of if not the biggest Narrative of the next cycle of crypto even if you aren't in the types of circles that are constantly iterating on how to use ZK to add more computation to distributed systems like ethereum you probably are seeing all of the headlines of startups raising seed and series a rounds to bring ZK to

life but ZK is a tricky business because not only are you dealing with advanced math St straight from the professors and grad students discovering it you also need to work through all the complexities of the smart contract Paradigm and then you need to make it all work together needless to say this is incredibly hard made Harder by being so far out on the Innovation curve that there are very few resources available to help fortunately as the ZK based ecosystem begins to come to life many of the resources that we need are com online right alongside it today's guest is David Wong co-founder of ZK security

and auditing and consulting firm that specializes in ZK based applications through ZK security David and his team help support the applications building these new technologies with a specific focus on building secure systems throughout this conversation you will begin to understand just how diff difficult it is to build ZK apps and how the math behind zero knowledge cryptography introduces even more surface area for attacks David not only walks us through a few common critical vulnerability he helps us understand how Auditors work to root out these problems in a technology so new that it's still

being written but this episode is not just an episode about auditing or Consulting this is an episode about the world of ZK we both start and end with some of the huge questions we all ask ourselves every day in this space what is the purpose of ZK what makes a good ZK powered app how will ZK change the world and of course the big question we all asked ourselves what am I going to build with ZK one more thing before we begin please do not take Financial advice from this or any

podcast ethereum will change the world one day but you can easily lose all of your money between now and then all right I am so excited to bring out David Wong let's talk ZK David thank you so much for joining me for the strange waterer podcast yeah thanks for having me of course man so um before we jump to ZK and like the the interesting circuitry of it all um like I I'm a big believer that the most important part of every conversation are the people in it so with that as a frame can you help us understand who you are and like what brought you to ZK world so

I guess there's a short answer and there's a very long answer should I do you want me to end for for the middle the middle answer yeah yeah about the middle yeah everybody has like a long story to wherever they are but um yeah I guess I was always I was always interested in in Computer Science and Mathematics and so I've I naturally got into cryptography um uh studying cryptography and then getting into jobs where I had to do cryptography uh and that's that's let's say that's the first part and let's try uh I'm going to skip it um but doing cryptography I discovered about zero knowledge proofs pretty early on so zero knowledge proofs were um you know it's taught in school and and Zer not proofs

as like is a very basic primitive that that was invent invented a very long time ago and and you couldn't do much with it it it was mostly like small constructions uh so it's something we learned in school and early you wonder like okay is is this thing useful and as you enter the the applied world as you start working then you realize that it's actually not really used anywhere uh or at least that was my first I was wondering like why why am I not seeing Zer not proof used anywhere um and then then I realized pretty early on that actually signatures the digital signatures or cryptographic signatures that people use everywhere are actually zero knowledge proofs but they're a non-interactive form of zero knowledge

proofs um if you think of zero knowledge proofs as like an in an interactive protocol between a prover and a verifier uh messaging each other trying to you know the prover trying to convince some the verifier of something uh signature is like a non-interactive Zer proof like you just send it once and people can verify it um so so then I realized like oh my God Zer proofs are used um and I'd say I think it was in 2016 I ended up at some party um the the Koda protocol part launch party or something like that where they like a cooworker brought me to this party and they sort of announced their project and it was just kind of

blockchain um uh verify you can verify the entire the entire blockchain in one zero knowledge proof and and that zero knowledge proof is actually a verification of preview zero knowledge proofs and and I remember I remember being like wow like I didn't know you could do that with your knowledge proofs it that was my my first time being like you know I had been in cryptography working there for for quite a while and I was wondering uh where I could get more into is there like a specific subfield of cryptography I could um start digging into uh and that's where I found zero knowledge proofs in and I and I wanted to really dig into that I was mindblown by that project which I ended up joining actually two years after um

and I guess yeah I guess that was the start for me to to get into zero Notch proofs yeah no I mean something that you said that really resonates with me is especially So I entered the space um from defi you know from Finance to defi to ethereum and then to I don't know like the world computer let's say and and um you know when I first heard about zero knowledge um outside of a like intro to number Theory course right it was about the ZK evm and um ZK l2s and like I I remember like thinking that ZK meant something very specific about the technology that was being implemented

like that almost like you know there's a core kernel of like code that was understood to be ZK and if it had that kind of code then that made it ZK and I think like the big unlock is to realize that ZK is is really like a paradigm um that is much more common than like you would think now based on the amount of energy that goes behind the word ZK like it is basically just the idea that you know you can have ver formal verification without sharing all the data and like on once you realize that ZK really is a buzzword like it opens you up to be like much more creative creative and um just like figure out where this stuff can be used yeah yeah I

would say I yeah I guess different people have different ways to see it like my my mental model is that like like people have used the word ZK like I guess that's what you're saying also um like what what matters that we have a new primitive a new black box that people like you know a new tool that people can use um and you can build all sorts of applications on top of it and it's sort of up to you to decide what you can what's useful to do with it how you understand the possibilities when you see it and so that blackbox to me is sort of um the ZK part is like actually yeah like it's almost like you might fold yourself into believing that that's the only thing that's actually useful

the zero knowledge um but at the end of the days it's uh computational integrity and so it's like this blackbox just allows you to prove some computation and you can use that to either delegate computation or a compressed computation if you have a long running computation or turns out that you can also like mask parts of the computation not just the entire computation itself but the inputs or the outputs whatever and so you also get privacy uh but privacy is sort of a privacy is sort of an add-on usually it's pretty cheap to have privacy on top of things and actually a lot of these systems that you mentioned don't even use the the Privacy aspect no for sure I was um

uh earlier this year I was attempting to do a startup that we didn't move forward with but um it was essentially like centralized ZK as a service where you know you just send us like the data that you want a kcg commitment against and we'll just like do the you know all the math for you and then give you back the commitment something like that or you know then like much more abstracted to like ploner stuff and for VCS who didn't really get the space quite like enough the question we would always get is like I thought the point of ZK was privacy and you're saying that you're going to send all this data to a centralized server like doesn't that break everything and I think like that was like kind of yeah I mean again I think we're we're hovering around this that

like what what is new is the realization that the ZK framework which has been around since like the 60s or 70s or whenever has this like new specific use which is about projecting computation and like that compressing and like projecting in our world into blockchain but um you know has more applications than in blockchain so I just like really see that as the Paradigm it's about compressing and projecting computation it's interesting actually because I see a lot of U so so I think what you describe is sort of to me is proof delegation or Pro proof as a service maybe for specific proofs um but I I think we're seeing I I don't know if you've OB you're observing that from

from your bubble but in my bubble everybody has their own bubbles um from my bubble I see a lot of um proof as a service or proof delegation startups or projects and and things like that so um there seems to be a new a new story I guess uh that people are going to need to use like proving things is a bit heavy and so people are going to need to use uh these provs that are uh more beefy machines and and not them well I think the underlying bet that we were making on the entrepreneur side and I think that look like it's very apt to call basically every ZK company that has been funded in the last year as like oh we're just going to build tools for ZK and

then like de so developers can go build applications and I think the the BET from an entrepreneurial standpoint is like all of this stuff is so new like it literally comes out of like professors mouths at conferences into companies that like there there's just Alpha in like being the guys that are building tools right now and like whatever we find the actual use case for this like we just want to be already familiar with this stuff and so um I think like the the proof of a as a service like concept is really because like it's the only Paradigm in which like there's some sort of like economic thing and then you can go sell it to VCS but I really think like the this is really true like like

actually I've had this conversations of like all of these uh new tools that are coming coming up or that people are building are most mostly open source and they're mostly becoming Commodities and so it's very hard to monetize that so the infra play is sort of the like one big play that people can can uh can try to make to monetize yeah it's the infr play but it's also just like the getting experience so like when like the true zero to1 unlock comes out like when we figure out that we can run like AI on a ZK based chain like the the guys like succinct Labs or like modulus Labs or like uh inuyama or cisk like they will like have the experience to like you

know really pivot to that and like get it done I I think we're perfect I love that you're saying that because I think we're perfectly aligned I think it's exactly what like that's my modotto and I think that's maybe maybe VC is actually uh start investing in companies more for the teams and what they're going to learn through the process and if they have like maybe it's good if they have a short-term you know monetization strategy but on the long term it's about getting familiar with the technology and being here uh when the technology gets um gets to the point where a lot of lot more use cases are use cases are unlocked like you're saying um so yeah that's that's sort of that's what I'm I'm sort of doing right now in the space I'm uh I don't want to say I'm costing uh I think there's a

negative connotation but I'm I'm um I'm paying attention I'm learning and building and auditing and doing all these things uh but I think the bigger use cases are yet to to happen and and we're going to see a lot more happening as as these you know Primitives and constructions become more and more useful and and performance and uh and so on no and I think um you know we we'll tie up this conversation here and get back to your story and actually what you're building but um but uh just to wrap this up um a recent guest I had was Jason Morton from uh Ezekiel or E KL right or yeah ekz whatever but so he's he's very recently former Academia and

now like in this more like entrepreneurial Builder space and maybe still in Academia but the point the conversation that we had was very much about how like what is special in crypto is like how I guess like open we are to um to accepting like new research as like something that needs to be built um and needs to be like applied to you know blockchain or to computation or whatever and I think that um you know that regardless of like the story you're telling about yourself like that is what you're doing if you're in the ZK space right now is like we don't know what's going to happen but we all want to make sure that like we are the masters of the tools when the revolution comes yeah

that's that's sort of a yeah I mean that's that's sort of how I see Jason very clever guy and he's I mean he's at the center of like two extremely uh hype Technologies right like Ai and and and ZK so um yeah I don't know how practical this thing is today but if it turns out it's practical he's going to be at the center of of it all so it's a good place to be yeah yeah no and I think that's what we're learning every single day is that um the the center like if you build the technology good enough and you can scale it fast enough then like the ideas come from there and uh that's like the Paradigm being flipped around so anyway let's get back to your story so you um found was it theota blockchain or you that's originally what got you into ZK

two years later you started working for them like what's uh you know the medium version of your story from you know the Kota to um what you're building today um so I guess Coulda was renamed Mina in the meantime before I joined but um yeah I spent two years there uh basically I arrived at at Mina with very little knowledge about ZK uh besides the the basic stuff that I had learned in University um and so I basically spent my two years learning about everything that I could learn uh from uh backends with so back ends like the proof systems like plonk uh which we used Amina and Halo to which is the I guess the

recursion protocol so so that proofs can verify proofs and verify proofs and so on um and I also learned about front end stuff so front end is like how do you write circuits how do you write these programs that uh zero proof systems can prove uh and so our uh front end was called snarky or snarky JS um so I spent a lot of time learning basically all of these things from L level details to to high level more High Lev stuff like how to create uh nice interfaces that or nice abstractions that developers can use to um you know you don't want to write like Lowel circuits you want to write um I guess

Mina would say you want to write JavaScript or typescript uh um and so during my time there what I what I saw talking to developers and seeing kind of the space develop is that a lot of these ZK platforms are going to come up very very soon mean is one of them which still hasn't launched its um Z app platform so it's a ziki smart contract thing um there is a Leo that's about to launch with Leo the the uh language there is Aztec network with Noir um there there is uh I guess ZK sync uh I I don't know starkware has something but it's not really ZK yeah uh

with Cyro exactly like there's all these um interesting platforms built on ZK and perhaps allowing users to use ZK so privacy applications um and when I see people using them uh they make the same mistakes over and over and over um and basically it's it's kind of a new paradigm it's it's hard to write things in a secure way um and so I saw that and at the same time my background was sort of insecurity like I had also studied security I had worked uh for like four years at NCC group as a consultant uh so during that time I would or throughout that time sort of one of my dream was to

create a consultancy and and do auditing and uh security pen testings and stuff like that and so I left uh Mina and I created this thing called ZK security with two ex-coworker so Brandon the CTO um at Mina or or at 0 Labs the company behind Mina and uh Gregor who's uh basically the tech lead for for snarky or which they rename OJs by the way um and so we we we funed this with with this idea that people were going to need us and that there there will be a big Market of um these ZK smart contracts and and and these ZK smart

contract audits uh so yeah I've been doing this for I don't know um less than a year probably a year soon uh and we've been uh interestingly we've been Contin continuously booked but a lot of these audits have been mostly lowlevel for now I get I guess none of these ZK platforms have already launched um or none none of these projects really have the money like these these um smaller projects built on top of these ZK platforms have the money to pay for these audits so right now we've mostly seen low-level uh audits on proof systems and um or or circuit stuff but very very low level

circuit things um so yeah yeah that's that's the story of where we are today got it and so just to be clear what you're saying is the consultant the the um the business that you're trying to build is about like servicing the layer of applications that are going to be built on ZK powered infrastructure right whether that's risk zero or starkware or like whatever um of these systems that are gaining so much hype and what you're saying is that like we're so early in this phase that like whatever people are ambitious enough to build on these platforms that haven't really launch yet um just don't really have the like sophistication in financial or like

otherwise capacity to like support like Soup To Nuts auditing is that is that what you're saying they're they're either not here yet or they yeah or they can do it financially yeah and then when you say that um what you have been booking are these low-level um like low-l systems and like some circuits but super basic are those just um like because you these uh startups can like afford that or are these like are are you working at all with the bigger infrastructure companies like an you know an igen da or a um I don't know starkware or you know polygon ZK evm uh I I guess I I can only talk

about clients where which we have gone public with so so usually we try not to to mention clients that uh where things are not public um but yeah I mean we we've worked with starkware we've worked with um penumbra we've worked with alio like these are the kind of names that M Labs recently um so usually bigger companies that have um you know more more budget for these kind of audits and which are doing things that a more fundamental you know they're doing things themselves and not and not uh they're not necessarily projects building on top of another project got it yeah yeah and how much um so in these ZK based systems which uh you know are

again have so you know everything about smart contract um like auditing is like so much more like complex than just like regular security test testing now on top of that you're adding like the most complicated and advanced number Theory uh possible Right how uh I guess like first question is like what percentage of your energy and effort goes into like each one of those layers or or let's um if if that's going to change as the business maybe like what do you project that being and like two how do you deal with like auditing systems that are so new that there's not a lot of like resources to like really understand um if something's secure or not so to

answer the first question so our bet was that we would really be on the higher layers and that that's where we would grow uh but we have been in the lower layers like I was saying and I I'm wondering if this this is actually going to stop so so obviously the higher layers are going to unlock at some point and there's going to be a market um it's just a question of time I that's my belief um and I know I'm starting to think that the lower layers might actually not slow down because things keep keep uh on improving everybody's nobody's you know is centralizing towards one solution that everybody's using everybody's having is building their own solution so I don't think this is going to stop anytime soon um and and

so I think we're just going to you know grow the company on all the different layers basically that's um from proof systems to compilers to to um to projects built on these Pro systems um your your second question was how do we audit these new systems when when we don't really know how to do it I would say that auditing is always sort of you're always confronted with new systems when you audit anyway um so during my four years at NCC group I don't think audited the same stuff twice like I was always looking at new things I was always trying to learn which is why I love auditing by the way um like one one part of one upside of auditing

is that you're always learning something new and so it's it's all about it's all about having a mindset so so you create this security mindset of when you read something you'll start looking for bugs you'll be like oh okay this is interesting okay I understand oh but what if I what if I change this thing here isn't that weird and then that's how you find bugs um and the other part is to will to to learn and reverse engineer so uh like with any other system when you the best way to find bugs is to try and understand it try and use it and by I mean it I'm sure it happened to every developers you know the you you play Within new Cod base or something like that and so you try to

use it and you end up finding a bug just just by trying to use it or um so a lot of the bugs I found actually I found the first CV I found was exactly like that I was playing with the goang standard library and and I found a bug and I was like oh wait how how bad is that and end up being pretty bad um but it's it's just about playing around and uh that there's no there's no secret to um to Consulting no no fair enough so um like pivoting away a little bit from like the building of the business and into um just like the the problems that you're finding you mentioned that um one of the like opportunities that you identified was that you were saying that

a lot of people were making the same mistakes so can you talk about at a high level like go starting from back when you were first starting to noticing these to all the way until now like what are like broad Strokes the big mistakes that people um like come to ZK work with okay so let me let me try and probably I should write about that at some point but um maybe let's start with three maybe there's three big ones with the first one being very easy it's just logic bugs you know bugs that would happen in any sort of applications including smart contracts um second is more like mathy bugs so there's a lot of low-level uh math stuff that happens if you're mostly if you're working at that

layer or you're building libraries I presume that higher level developers will not do too much math and and these kind of things um but for example there is this non-native arithmetic primitive so so when when you build programs uh for your knowledge proofs you build programs using a specific field so basically everything is a number between zero and some large Prime um usually of 255 bats uh but if you're using the the actually that's not true forget about that the numbers vary um and so you're you're sort of in this weird Paradigm where um you're you're always doing these operations modul this

specific number and sometimes you don't want to do that sometimes you want to them modu another number and so that's when you're for example trying to verify um an etherum signature an etherum signature is based on SE p256 K1 it's like an eptic curve which is in a different um based on a different field field than most proof systems and so you sort of have to emulate the other field or maybe I even went too far with my explanation sometimes you just want to do like begins arithmetic you want to like handle large numbers and be able to add large numbers and these kind of things in any case in all of these problems you're going to have to try to simulate these things and you're going

to have to to use a bit of math and with in any in all applications we've audited that did that basically they were bugs um I think I can think of one application that didn't have a bug there and that's the recent so recently we audited ZK login from Sway and basically we didn't find a bug there uh but that was the first time we didn't find a bug in such an implementation so kudos to them um but yeah so so I was saying Logic box normal logic box uh more like lowlevel like math box so I gave the example of nonnative arithmetic or big the third one I would say is this idea that um when you write these Zer knowledge

proofs you're in this different Paradigm that you can sort of go out of your program and do computations out of your program and then insert the result back into your program uh so we call that in circuit and out of circuit computation and if you've never heard of that that probably doesn't make sense any sense but the best example to explain what why you need this and why anyone would want to use that something like that is um how to implement a division so if you want to implement a / B is equal to C it's actually quite uh it's not straightforward um but one thing you can do is compute the result yourself so you do this out of circuits

you compute you know you do a divided by B you get C and then you insert C in your circuit and then you say and you prove in your circuit that when C is Multiplied with B it gives you a because multiplication is easy so a ID b equals c you move the B to the other side basically uh so you produce the results yourself out of circuits and then you move the the equation you you switch things around in the equation um and so yeah so if you understand that then then you understand that you can do a lot of things this way uh Computing things out of circuits might be easier and then inserting them back in the

circuit or in your program and verifying that it was computed correctly may be easier than Computing it inside the circuit and so people do that all the time and this leads to Um this can lead to to really interesting bugs um for example in penumbra we we found this double spanning bug which is basically something going out of circuits and being reinserted um and when you do that it means that the oh yeah so maybe I forgot to explain that it leads to bugs because if you don't verify that it was computed correctly then it means the prover can do whatever they want they can just insert whatever value uh they want yeah hopefully that makes sense no no no yeah dude makes a lot of sense and I think um I think for one like there's this like

really interesting and again we talked about this with Jason Morton there's this really interesting uh property around ZK proofs where like the important part here is that you're verifying the computation and you can use this external World in which you have like unlimited resources or don't have to worry about these weird things and I think the example that he used was um you know it might be really hard to do something iterative in your proof but if you can just compute it in regular world and then like do all the iterative computations and then just have from the beginning to the end like you can put that in lookup tables and then you're just doing like one lookup as opposed to I uh blanking on the specifics off the

top of my head but it it perfectly reflects like the point that you're making which is yes you can like kind of use your dual resources to do some of the trickier stuff outside of your proof but like you're just inherently creating surface area for more bugs when you like pull out and then reinsert back in and um like that's let alone just the already crazy complicated math on top of the already crazy complicated smart contract logic yeah cool so I guess a lot of the things that I'm like wondering when you're talking about these bugs are like are these opportunities to create like Primitives whether they're open source or you know they need to be centralized for whatever

reason but just like Primitives that are well understood and become plug- andplay on the like Lower Level side and um like yes there will always be new innovation and people working on the New Primitives but is the idea that like once the the math and the paradigms are well understood those can aify and then you as an auditor can look at those and say like okay those are implemented in the standard way so we know them to be secure and that's why we can focus on the um the application layer is that the thought process yeah it's I I mean um it's an interesting way to see things I think right now it's like the Wild Wild West you know people everybody's doing

something different uh when it comes to non-native arithmetic people are doing different things uh we have this I guess we can call them gadgets of like or building blocks that you you you I think one person would do right and then people would reuse but um it's not happening too much and I think we'll see it's starting to happen in some layers so um for example more and more projects are built on top of arcworks which is a rust library that that builds a lot of building blocks for for proof systems uh or more and more people are building on top of the hello to library which hasn't

has nothing to to do with the hello 2 protocol um and so we're saying I believe psse has the most popular Fork of hello 2 so I'm so we're seeing a centralization more and more people are using this so there's more eyes there's contributions from different people um different projects have forked that repository so they're still pushing things upstream and so um these are benefiting everyone uh but these are pretty lowlevel um in terms of like yeah higher level things that can be reused I'm not really seeing that much to be honest yeah you know it's job security for us some way for sure for sure so let's

shift this conversation up to the higher level and onto the application layer and um I guess the big question I have for you is someone who's seeing a lot of projects um at least uh definitely seeing them if not working with them yet is what are the types of applications that people are building that really leverage ZK in a um non-rival or non just like tacking it on to um cative VC way like I I have some idea of what ZK is enabling today but I would love to hear from you like what when people are building in ZK like what are these applications uh I mean I mean you just talked to Jason I guess zkl is like one interesting application um I'm I'm not sure exactly um the LI what are the

limitations these things today and and how far I can go but that's that's definitely interesting um what like I just mentioned Z Lin to me that that's also something that's very interesting it's like um so so my way of thinking about things is that when you try to think about ZK like sometimes it's sort of hard to come up with use cases that are interesting and one um and because that's that's because a lot of times instead of a Zer knowledge proof you can just request a signature and that's good enough like in a lot of cases around the world you know you're thinking of an idea um and just having the server sign something and you know you have this

clim or this signature that you can pass around is enough you don't need like an actual proof that the computation was done correctly um most of the time you don't care about that so so I'm like whenever I'm trying to think of applications I'm like oh [ __ ] signature is enough like yeah ZK is not super useful here but actually ZK is useful to verify signature signatures either to compress uh the verification of signatures or either to add privacy to that and so ZK login is exactly that it's verifying ver verifying signatures from Google or you know whoever has signed on the fact that you authenticated with them and it's verifying that verifying that signature and all these things in a circuit so

that you remain private basically nobody knows who you really are um there was ZK mail recently like this IDE that you can verify males also without um and so same thing here is a signature from like Gmail or something like that um and and and so yeah verifying signature sounds interesting there or you can verify signatures to compress things which is the first thing I was mentioning and so we've seen that with plumo for example or uh when you want to like put um synchronize to a blockchain in a in a fast way and you don't want to like reverifying a bunch of signatures uh

Mina is a bit more involved because it actually verifies everything but plumo is just about verifying signatures um what else is what else is interesting let's see no no well I think that like goes to reflect again how early it is and how you know at the beginning of the conversation we were talking about how the opportunity is to just get your hands dirty and to build just the Primitive tools um as we just as a community start to figure out what is this for you know and I think we've made you know my my little shtick um it was the uh you know like cryptography as like a science right was invented in you know the N like with with the radio but

like really around uh World War I and two right to encrypt like battle Communications from like one side to the other and then we got like better and better and better B and like but really what we used cryptography for was encryption right and then in 2008 Satoshi Nakamoto came along and said like here we go I have a new use case for cryptography that has nothing to do with hiding stuff right it is about like first it's about money which I think is like a little asinine like what it's really about is like verifiable like distributed computation and um like so now we have two use cases for cryptography and like the idea that

we're done with two is like just not how the world works right like either something is meant for one thing or it's meant for like unlimited things and it's up for like human creativity to figure that out and um you know every legitimately if you're like building something for if you're raising money for something in ZK it's essentially to build more middleware layers on top of blockchain and that's cuz like that's really again the only thing we figured out since 2008 that this is like really really for but um I think the bet that you're making and that most of us are making is that um both whatever is happening in blockchain is you know like

a multi-trillion dollar um economy but also that so much more is coming um because of the this like new understanding of what uh this science means yeah yeah I think I think we're going to see ZK expand to the non-blockchain world as soon as it becomes as soon as people understand uh more of what it can do and that that means better tools like easier to use tools uh and I think maybe risk zero is is in a good position for that um and as they become more and more performant because today uh to be honest they're not the most performant um Primitives yeah

um yeah yeah I guess you you were also saying that like we only had encryption I guess yeah the world of appli cryptography was kind of limited to encrypting things maybe signing things um and and doing key exchanges with with uh Google and and other websites um definitely I think block you know cryptocurrencies and blockchains have brought like this new like the the slow database Paradigm um on how to like have not just a distributed database but a decentralized database with like security bin and I think because we have that a lot of a lot of the cryptography that we

didn't really know like it's kind of hard to test cryptography today unless you work somewhere and people trust you to use it uh somewhere with a lot of U users and so uh and so I was at Facebook I guess and we had some great ideas um of cryptography schemes and we got shut down a number of times uh because it's kind of dangerous to to um so so for example um we're working on on using um so you know like passwords suck and and all these things and it'd be nice if you don't have to store a password on the server um and so the there is all these schemes are called like um password authenticated key exchange

uh where you sort of do a key exchange with clients based on their password but you never really see the password and so we we try to uh to push that uh internally and um I think the I mean for right and wrong reasons but for right reasons also like the uh we couldn't really push it too far because if you turn it on like a lot of people are going to start using that and you don't really know the implications and consequences of that um when the system in place is working you know for for a lot of people um so it's hard to apply cryptography novel cryptography today but with blockchain uh people are going crazy like there's no rules there's

nobody to tell you no don't do that uh or it's dangerous and and we see that you know money is being lost like large quantities of money are are being lost all the time so this is kind of like the da side of being able to to test things rapidly um but yeah yeah so ZK has found a place in blockchain I think NPC is starting to uh to have interesting applications in in in blockchain we're seeing F also uh in a number of projects so so there's a number of Primitives that are seeing um that that were not very practical and you know realistic a few years ago and are becoming more and more um hyped and interesting uh and

it's it's it's not going to be just ZK I think you know in like the next 10 years yeah and I I am I am very bullish on uh figuring out applications for this technology that is like being fueled for better for worse through blockchain money but um you know for example I think it was like about this time or maybe December last year um Professor Dan Bon was on um the ZK podcast right and he basically uh was just doing the state of the land for um you know ZK in at the end of 2022 and one of the applications that they were talking about is they were working with um cam camera manufacturers to like build chips

into like you know high-end Nikon or even like consumer Nikon cameras so that like when a photo is taken like the sensor IM like every single like pixel and the configuration of the camera and GPS if it's in there is all like baked into a zero knowledge proof that um then you know lives with that photo and you know that is like a step in the direction of combating the deep fake problem right and I um like you I'm like a little bit confused on the intersection of ML and um ZK or cryptography or blockchain right but like I'm just so convinced

that there's something there because like machine learning is about abundance and like like creativity but just like Deluge and like the cryptography is about you know scarcity and like slowing things down or you know blockchain is about slowing things down and yeah security and so I don't really I don't think the world's moving so sorry excuse me the world is moving so fast I don't think anyone knows where we're going but like the idea that those are not part of the same story seems crazy to me yeah I'd say I'd say we've seen it with every cool technology like nothing works without security because humans are shitty uh and you know like if we're all good people we

wouldn't need security and and uh but unfortunately uh for us we we need to have this you know this whole field of security and cryptography and to me it's an overhead you know it's like an unnecessary overhead like it's I shouldn't have to spend my time thinking about all these problems because if we were good people we wouldn't need this but anyway this is my um and so I think with with all these new technologies that we're seeing ml I guess included um like they're growing and people are experimenting but we're soon realize that things are not going to work if we don't secure uh things or add Security in them whatever that means uh but you you'll always see security

backed in at some level if you want things to work um at scale and so I'm not sure yeah I'm not sure what it's going to mean for us um there I by the way I don't really like this example of the camera like it for me I always give this example as like an example of bad use case for ZK because so so there's always this sort of tension where people care about security and privacy but not really and people mostly actually care about things that work and are fast and are usable and and so I don't want to you know I want the camera that gives me the best pictures and and that when I click on the button it takes the picture right

away and it's easy for me to put it on my computer and share the pictures and um if I'm going to have to pay more to to get something that has more you know Assurance on like where the picture actually came from or something like that um or if I have to pay more you know I'm a newspaper and and I need to pay more for a picture because I know that it comes actually comes from the camera hour I don't know like all of these things are not realistic to me like I don't think anybody cares much about these things um but maybe yeah maybe in like 50 years where every picture nobody knows if a picture is real or not uh that would actually make a lot of sense I don't know no man I I don't

think you're wrong at all I just bring it up because it was the use case that had nothing to do with blockchain that came but like I I'm dude I'm totally with you I think that like unless we not even a government level but at like a religious level mandate that every camera has these chips like it's just not going to help right I mean my I so I I like to play this game where it's um pretend a VC walks up to you today and it's like I will give you however much money you need you just have to pitch me on a company right now like what would you say and my answer is I'd be like okay what we're going to do is we are going to suck up every single image and video and audio file on the internet

that we can text file everything we're going to suck up everything that we can and we're going to like create the most efficient proof system possible and we're going to batch it all up and then just start committing everything to the blockchain and to ethereum or some L2 right a mutable X I think they're really cheap right and then what we'll do is build like a browser extension that just every time it sees a photo it like does that same uh commitment and then checks to see if it can verify it on chain and you know the first first few years will just be about creating history like a onchain history like this will only be useful going back to when we start but the idea is like the blockchain provides

this immutable record and someone needs to start um like populating the database and then we can use that to say like even if it's the most compelling possible realistic deep fake if it's about the 2024 election but no one's seen it until 2026 or whatever then we interes um then like my browser extension can verify that so anyway I just want to uh like follow on with your point that like I don't sounds like a lot of work no yeah but this hypothetical VC is offering me money so right you can you can audit for us you you can prob yeah um you know talk to the archive.org people right like that that's basically what they're doing

without cryptography like in a very centralized way no and I mean I think that kind of uh nicely circles back to your point that the hard part about ZK is at least like the way that we think about the world now is a lot of the things that ZK provides like could just probably better be solved through a simpler solution whether that's archive.org or a signature or whatever and I think that's yeah if he doesn't provide like 10x or 100x like like benefits people are not going to use it like in general that's so you got to find a good ideas so I mean I guess with that in mind like you you're still like here building a career in it like what do you like what is your thesis and like why what do you see as the 10x or 100x

thing that like can be brought to the table by this technology or by this math uh I mean the first part of my answer is that if I had a good answer I wouldn't be sitting here I would be uh pitching to VCS and and uh and uh working hard on on that on that cool startup idea so so I I think yeah I think I'm still uh yeah actually I tried to write about that um if you check one of my last blog post was was about trying to think about ZK and and how um I me it's called my journey through ZK or something like that trying to think about zik and how this can be useful not just in a blockchain context and that's

that's when I started thinking about okay it can be useful when you verify signatures like that's a pattern that I see and so what what else what else could we see there um but yeah so so I so I have some specific ideas that I think haven't been implemented before uh but I I'm reticent to uh sharing them here cu cu uh these might be some good ideas to implement at some point um but I don't know it's kind of hard to think like what if what if ZK becomes like extremely usable and extremely performant like you can run them on your laptop and um then how would people use them especially I'm

especially interested in how Enterprises would use them so I guess in that that blog post that I just mentioned like it's all about signatures and how verifying signatures like can be useful I also talk about something else I say that um privacy is usually only useful when you have when you're directly interacting with the users and when the users are creating the proofs then that's when privacy is useful and we've seen that privacy has been useful um mostly on the blockchain because there's like priv money involved and these kind of things but whenever you have machine to machine interaction then you don't care about the privacy and it's mostly about the compression uh of computation and so I think this is this

this is the story like it's a vague story but if ZK booms in the non-blockchain world it will be in an ENT Enterprise um context and it will be between servers and it will be to obviously to ad security we're still in the context of security um but to add Security in a way where uh you're delegating computation or you're delegating a long run running computation and you want to uh to um keep number of servers synchronized or or get claims that are verifiable and but but I I understand that it's very vague but um being yeah I it's hard to be more precis than that no for sure man I I

hear you I um it's definitely it it's a tough question and like I guess let me just try to answer um with mine that's it's like at a much higher level but um like quick background on me so I uh went to Stanford I studied computer science I actually took intro to number Theory with Professor B uh Dan Bon and then I left Silicon Valley and like was just wanted nothing to do with it and I actually went to uh St Louis Missouri and worked for anheiser bush in Bev which is the largest beer company in the world they're like 40% of beer worldwide uh it's like Budweiser and budlight um and my my first job there yeah yeah nice yeah the the museum the the city museum

thing was [ __ ] amazing yeah yeah I always tell people uh when I live there I was like you can come to St Louis I have a great long weekend best long weekend so much fun beer super cheap stay for 4 days fried pizzas yeah no but anyway so uh my first job there was in tech Innovation and I did that for like two to three years and then I moved over to finance and that's like where I really learned how the world works but um in Tech Innovation like so much of it what we did essentially boiled down to like how do we throw sensors in things to like try to get like even a tin bit of sophistication the into like our operations and like I cannot overstate

just how rickety corporate or corporate Global is behind the scenes like at anheiser Bush in 2018 I had to deal with Magnetic Tape like that's where all of our server like like cold data was stored and so um you know I I can talk all day about like the types of stuff we worked on but like I would just put like Bluetooth sensors in in um in like coolers that we you know because we we would make massive investments in coolers and put them out in retail but we need to like track those and like one is to just make sure that they aren't being stolen and then two is like well can we get more sophisticated can we do heat mapping can we like push ads based on if people are close and um you know

we put accelerometers into tap handles just to like measure in real time like when beer was being poured like all this crazy stuff and like let me tell you man like the world the real world like is so just old and shitty and doesn't work and like half the time our problems would be that like you know like networks were old and like systems didn't work and all this stuff and I just like I on the flip side now that I'm in crypto world and like seeing a lot of machine learning stuff like I'm so convinced that the world of like the Jetson or like iroot or any of these like futuristic Societies in which like machines do everything for us is like inevitable but

my question is how to get from that like futuristic Society um to from here and like what I see that ZK is going to enable is the internet of things right like this like buzzword that we've been using basically since like the early 2000s but is like how do we have machines out there in the real world that have like an identity and which sometimes like it really matters we want to know like that that specific climate sensor up in the Arctic that's monitoring like ice change is like actually from the UN and doing proper calculations versus you know the like minor blah BL like the the traffic light robot we don't really care or you know

whatever I don't care but the point is like I see ZK and like blockchain being a huge part of that as like part of the core technology that allows us to like really become like a futuristic like Jetson style uh world yeah I H so I I feel like I yeah the world the the iot world has always been lagging behind like it's like even like even like 10 years ago when a lot of cryp cryptography was understood the world of iot was still living a well without security or like it it's really like it's um that's that's that's what I'm saying

right like security doesn't really matter like like security work is really needed for things that scale like you need it on the internet because everybody can just plug to it and and try to mess mess around right uh or you need it for blockchain because it's it's open and everybody can connect to it uh but I think for things like your house you know someone can just like break the window and get in my place right there there's not much security because we don't expect people to come and like actively uh be malicious like there's not that level of a exess or or insecurity and I think that's that's what iots are facing it's like like very few people are going to go out there and

they try to like Jump Around fences and still sensors and still like people do it right but it's um there's enough friction to do that and it happens rarely enough that people don't care about security there that's that would be my take no no yeah I I think that's fair and I think that's a reflection of like the Internet of Things world we have now are like light bulbs that you can control with your phone um I'm just imagining like a world of like autonomous cars and like um you know like just this weekend me and my fiance were walking uh just like on a busy street and we saw this like one of those like robot things that

um is on Wheels and it delivers your order to your house and like it was like really sad because it was like bumping up against a curb and like couldn't get up but like I I just depressed robots yeah like there's a whole crowd Gathering like like should we should we help it um and but anyway the like I just I'm so convinced I mean I'm I'm only 32 but when I was a kid like we didn't even really have the internet and now we've we're going to this world where there's like robots that we're feeling empathy for that are delivering us food food and like Amazon's been doing this drone stuff for years and you know we're in autonomous we're very close to autonomous car world and like I

just um I I don't I see ZKA as a security thing but I also see it as a coordination thing and especially as like these things become more and more autonomous and like maybe need to hold property which will be like blockchain related property um like I guess ZK to me is like how again going taking us right back to where we started ZK is how we're going to be able to project all this computation into these spaces to um like coordinate this like again J Jetson's world that I'm convinced is coming interesting yeah well we'll see I guess yeah it's if that happens then uh well if it happens soon

enough then I might profit from it but I don't know what's the timeline here yeah no I me the big thing I'm betting on in terms of science is like curing like aging and cancer and like all that stuff so that's the one I want to benefit from how how can we use ZK there yeah yeah all right man David thank you so much um before I let you go can you just like tell the audience uh how they can find you and how they can just learn more about like what you're doing and and maybe book an audit oh yeah uh yeah thanks so I guess just go on my Twitter so my Twitter is crypto davidw and from there you can just click on things and you can find my blog and my YouTube channel and my you can find out more about ZK security and um yeah

and if you need a nits or if you're interested in that space or if you have a question about uh you know Zer not proofs and you're interested just DM me on Twitter or tweet at me or or send me an email somewhere uh and I'll try to answer David man thank you so much I really appreciate it and um yeah going be well yeah and thanks again for having me yeah this was fun nah