ZK Hack Istanbul: Polygon zkEVM presents: Implementing a Monolith verifier using Circom

Transcript

[Music] hello everyone we are the polygon team members that will be here ATK H lbon uh well my name is ector he's Ro and the last one is Jesus and in our daily basis I would say we are like Pro Engineers Pro engineers or less H but today we're here just to uh introduce you our Workshop we have the the clicker yeah okay ER well let's start with a just a brief introduction or of what we are

what we do and I normally like to introduce polygon J KVM as a well a very simplified version is that we are a layer to G rollup okay so here we have like three different words that everybody has to understand to be able to understand us the first one being what is a layer two and very simply a layer two is I like to say that it's like a it's something that you build in top of a layer one that is connected in some way to a layer a layer one and in particular for example you can inherit some properties of the layer one network like for example the security of the of of

one like ethereum but in particular in our case we can see ourselves on a like another chain okay on top of the ethereum chain that does whatever it wants okay but whenever we do transact from one state to another state we have an insurance in ethereum that what we are doing is consistent and correct with ethereum okay in particular I like to say that we are like a we are like an evm inside an evm okay but our evm is tailor made to support ZK related applications okay the second word is a rollup and uh well a a rollup is very

simple it simply means that instead of sending all the trans that we receive instead of being sent to ethereum directly we roll them up into a single transaction and the single transaction is the is the one that we include in layer one okay so we are paying for a huge number of transactions the same that a normal user will pay for a single transaction okay that's what R up is and the third one is zero knowledge okay the zero knowledge part comes from the fact that apart from sending the transactions for sure we cannot believe that the transactions are has been executed correctly okay so apart from that we generate a proof of the correct

execution of this transaction then we send this proof on chain and we verify this proof on chain okay uh with that if the proof is well check is checked to be valid that means that all the tax actions that have that has been proven are also correct okay okay in particular to be to be slightly more more precise we do not send one proof per batch okay we don't we do not one proof per a group of transactions we do something slightly more harder okay so as you can see in this in this very funny diagram ER we have on the bottom layer

ER some amount of batches batches are use group of transactions okay we generate a proof for each of them and instead of sending the each of this proof to to the to the blockchain we use run another Pro on top of these proofs used to aggregate them okay and not putting a single proof in the sense that if you verify this proof then that will mean that all the bottom proofs are correct okay and in top of that we generate another ER another another proof checking that all the groups of all the batches are correct okay in the same sense if you verify this proof then all the bottom are verify to be proven and so on and so forth until the bottom

one okay and and finally we are just sending one proof but all the batches in the bottom layer okay so we generate as as many as we want and just to let you know a little bit of the benb because intuitively this is like this has to be a lot of expensive but it's not okay so as you can see as you can see here we just take around two minutes to generate a proof okay use a batch proof then we take like 10 seconds to aggregate all these proofs okay so us to concatenate all the proofs and finally to generate the last proof H just a couple of minutes more okay so in total uh like uh less than five minutes

to generate all this this this proof okay and regarding the the the the cost ER we are just paying almost nothing just to be able to not only send in the transactions but proving the transactions like the number of transactions are 500 okay this is the number for 5 the transactions okay okay I'm I'm I I don't want to stop here too much because this is like the real architecture that we have ER in our system okay it's not only about the prover the the proving part the smart contract and so on but we have like a complete overflow starting from when the

US sends the transactions to us until it ends up H being proven okay in a batch this batch gets aggregated and finally we just interact with the smart contracts on layer one by sending these transactions and the proof okay but we have here like the pool database which is basically the place where we store all the transactions we have the sequencer which is the entity that decides in which order we're going to prove the transactions we also have databases in which we store our um State transitions H we have the executor which is the one which is in charge of executing all the transactions and finally we have the proving part which

is the part that is more interesting to us in this event okay so in the last in the in the last presentation it was presented H the Thon DSL that we typically use in our but in fact we have more dsls that we we encourage you to use if you like to use something different from thcom okay and in particular our architecture or the way we uh we interpret the transactions and are able to prove them is by having something that we like to call in fact is very similar to a like a machine processor okay it's totally structured like the processor okay meaning that we

for example have a ram we have a room we have a module for a checking that the storage instructions are being executed correctly we also have an arithmetic uh a place where we do binary operations hashing and so on okay and to implement all of that we have used ER two additional dsls one being p and the other one being ZK assembly okay in our bounties we will be focused in using thcom in order to prove ER well in particular we are very interested in improving H the monol trans function but we also encourage you to take a look at these languages

and see which on you prefer to use either ccom or using p and assembly okay so you want to do it okay so let's jump now to theing tracks like this hi how you so basically we will have two tracks uh the will have like 6K to to share between the tracks the idea little bit is like just put this two challenges like usually will be like 3K and 3K but the idea on a little bit is like to check the project that comes out and share the the proper amount to each project so basically one track will be like using thcom make the

mon has as eor just set and the other one is like using basically asor just explains we for building the polygon zbm we build a couple dsls and we also use ccom so basically use whatever stack of the Z VM that we use on polygon GBM to build another D and deploy whatever you want can be a game can be whatever whatever you want like can can proof a hash whatever and we also like encourage you to check this out ah the Wantage distribution I understand well well well I think well the idea I said like it will be like 6K total 3K 3K but uh well is like see the

the acceptance that every project have and share the amount of money like share a little bit between the projects that GES out right okay so the first track even if it looks like very specific there is a very good reason in why we want to ER build the monolith okay and the main reason is because right now under under line all the KVM we are using posidon like for everything except for where where you have to use Shadow fix6 we decided to use posum because at that time posum was the one that H was

easier to express using an arithmetic circuit okay meaning that proving the correct execution of poon of Pon poon inputs and outputs is very easy compared to other Alternatives okay so in particular we are interested in monolith because it's it looks like a very good replacement to monolith because it not only improves in the proving site okay it's not only easier to spread in in a circuit and therefore being able to generate proofs on that but it's also it's easier to compute ER monolith ER inputs and outputs okay so well basically the

objective is Computing the implement the monolith C function in thcom but as I said before if if you take a look at P or you already know pil and you're excited about this this language you can do it as well in pil okay pla are and ccom are very distinct in how you express constraints ER and in some parts of monolith it will be easier in ccom and in other parts will be easier in pil okay and for the criteria H for sure we expect you to make a correct implementation but overall we expect that implementation from one side is sound okay meaning that you do not miss any important constraint and on the

other side we expect it to be as succinct as possible okay meaning that you do not H add more constraint that are extremely necessary in order to verify a monolith implementation okay and use as like a a bonus a bonus thing that we will very consider is for example if you're using thcom it will be awesome and in fact it will be easy for you if you if you want if you decide to use thcom to use like very recent featur of income like Anonymous compon components or [Music] tax okay so I'm going to go fast through this but basically as you can see in the

table if you take a look at at at monolith and try to compare monolith for example against posidon and poson 2 which were the past candidates to do the very same thing ER in in terms of how many ER time do you need to compute er er monolith inputs and outputs is it's almost 10 times faster than the previous candidates okay and I if you compare monolith with a very wellknown and very widely used has functions like size 256 their timings are very very very tight okay so that means that this has function is really really

fast okay and just as a crash light on monolith this is what it look this is what you will need to be able to implement in in Ciro okay nothing else than that okay is used a recursion of more rounds than what you see here and for example the second part and the third part the bricks and the concrete part are I will say are very straightforward in thcom and the most challenging p is the first one because the authors recommend to use what we know as a lookup argument to be able to implement this part but you can do it anyways using arithmetic operations okay this is the part where is more like invention is up to you

okay and for example this is this is from from the actual paper of monolith these are the expected numbers that you are supposed to be able to obtain for example they got these numbers using the plony to a system and as you can see if you compare monolith and posidon the proving time and the verification time is a double Better h from the former to the to the second one hi again so H the ZK track as we as I say before like it will be like using the zbm stack which basically it's ccum

pill or ZK assembly ER whatever version of of these three it will be okay to do it uh well the idea will be like uh was make ad up if it's complementary with the smart contracts better so for sure this this will be a bonus and a little bit we will measure like the secure how secure is your upb how if it makes sense and stuff and of course if you end up having a end to end flow it will be much better and well we encourage you well the the code must be open source for sure and well if it in case of the smart contracts you can deploy it in whatever test net just uh well share us the link and that's TI and if you have any

questions about whatever toing is we are at the Bo and you can come for sure and now we'll do a live tutorial so uh in order to help you and because I don't know if you're familiar with circum or not but even if you're familiar sometimes it might be overwhelming if you have not uh done a circum project in a while to just get all the tools back together and do all the setup part which is which can and get all the commments and go throughs the uh through the documentation again so what we have tried to do we'll send this link later in um Discord I think it was yeah and telegram maybe so uh we have tried to create a an example rippo

which will provide the link and basically has like several examples and has a lot of a few scripts that you can use just to get stter easily uh instead of trying to go from scratch and try to search for our documentation so here in this uh repo what you will see let me check let mean one second let me close things and so basically here I need to I need to change the layout whatever but here you can see the repo in the repo what you will find basically is like a few probably not the best documentation but

still enough to get started and here you can we also provide many links about snar GS and also some uh some links to our uh repos and documentation about p and zwm because even though it's it was not originally the main idea we had you are as ector and J said you always encouraged to use P or zigm and if you want to go that that way we are happy to help you and if you have any questions you can uh reach us and we can discuss together we can try to and help you understand how everything works how to connect things and so so in this what you will find in this

REO oops basically there's like a few examples that you that they are kind of described here the first one you will see is a poson one right in in circum basically this is the exact poson that's on zircom liap because if you're not familiar with zircom as I think Thor said there's a lot of libraries that are already writing in circum most of them under the repo circum lip I think it's called um so basically we have a poson which is another hash function that you can use and see how that works and you will see that and now I will show you later that there's two implementations of circum because as ector said there's

uh one if you want to go for the monolith path uh you will face one challenge that's um lookups which are quite tricky to do in circum but uh you can do what's called custom Gates so and in this repo you will see uh some documentation about custom Gates and you will see how for example the whole poson hash was also right we we had a a custom gate for for the whole posidon which is not intentional for monolith but can give you some ideas on how you can use Uh custom Gates and then there's as we said uh we are trying the of course for new developers but if you are have been familiar for a while there's been new features going on that

uh as sector said Anonymous components and tax and also the the inspection functionality which are some features that are what we say we consider is that good practices so if you're new that's perfect because then you will learn for Scratch and that's even better but if you're have already done zircom circuits before it's good to introduce this because as I will show you now it give you like more clarity to the code it improve the security the readability which is also good right so if I go to the repo and see if I can show you a bit where's my mouse yeah here it is so as I said the

first uh you can see here and there's circum there's different circuits if we I think the screen is big enough for sure so you can see here in posidon there's like as I said this is a real posidon implementation that's used in production in many uh many um services and you can see how it was implemented and you can also check there's this uh Poseidon custom the said it uses it uses Uh custom Gates but it's uh actually the same so so there's two different ways of uh implementing posidon both of them different but equivalent if that makes sense because

at the end the result is the same and we have uh where is this test circum in which you there's a I'm assuming that all of you have seen a circum a circum template before if not I will also provide the link for the basic tutorials it's although it's true it's a low level language I think it's pretty easy to like understand and move forward and so what I was saying is here is you can see like we are just comparing those uh two uh versions and that's the first example um then you we have here in the uh Packa Json wh where come on come on

okay what yeah whatever I think I'm going to go down like this so here as I was saying even though you have developed circum circuits before it's usually annoying because you need to remember what were the exact uh commands uh what you need to write to compile to generate a proof to verify the proof depending on the on the pro you want to use so we have put together a bunch of uh these scripts so for example here you can see compile which is basically the instruction to compile any circuit then you can either uh generate witness with JavaScript and C++ and this way you don't need to waste time because it's not a lot of time but we're

in hakon we're a time constrainted so it's good for you to have some tools to get started right away and also as you can see we have we have different time uh zerom you can generate a pro uh different types of proof right now we support flun plun and grow 16 here we have the scripts for uh flong and gr 16 but plong is is uh literally the same as FL just changing a few letters we can update it later but this way here you have uh if you by just running npm run FL it will generate like the whole setup proof uh and verify that proof and then you can if you want to use it you can get this and just uh use it you want

and also that's one way to uh call to generate the proofs using scripts but we also have added a test in which you uh let me see if I can yeah here FL test and grph 16 test that's basically the same but it just uh how you you would do it in a JavaScript program that you want just to Rand and this is probably more useful for the ZK uh well justful for Z if you want to go for a Z app here you can see how snack GS is called because snar GS is another library that ccom has to generate the proofs and here you can see how we do you can do the different calls to gener from generating the setup to generating approval for verifying it

both with uh grow 16 and flun and what you will also find in this uh in this uh Pro repo is some examples of uh good practices what what what we're saying use St encourage people to use stxs your Anonymous components so for example you can see here we picked um uh a r a random kind well it's just a template that was in circum Le it's basically it's not important the template itself it's just a multi on basically you you just uh given a number of inputs you just check if all of them are one or not um but this was the

original template that was writen a long time ago like probably three or four years ago in in the circum Li and then we have a second version which is as you can see much more compressed and much more at first CL if you if you check this version you can much more easily at least for me understand what's going on so you can check event equals one there's one thing event equals two one thing and otherwise you just do a split in two and then do a Rec a retion on it and so that's what you say it's important to use it because it's the everything will be the same the proof will be the same the nothing will change but from the developer perspective and

from the and another people that's watching it I I feel it's much more easier to read and understand what's going on here that's four lines and it's like organized that here that you can just okay so here's an N what's happening you're setting each one variables individually which is kind of annoying and then also one other thing that's quite interesting to to know is the usage of the back when compiling and here I'm going to put an example that I don't know if youve heard like it was early this year there was uh a posting medium about a million dollar it was called a million doll gkb Cod early basically it was about uh a z comparing

liy that just soon did and allowing um BLS signatures and there was an issue in the circuit so basically uh this is actual real code of that liy and what was happening and it's it's obvious but not obvious when you write because also you can see here this is all all code so maybe if this was with Anonymous components would be like one line each here's like seven lines and not that clear but what was happening here here I just don't care about what's what's the what's going on they're just verifying some signators whatever but here you can see lines between 103 and

107 it says uh check all LS that are qual basically it was checking that all the numbers were um were well constrained were less than a big number and the problem is here and that's what what one the thing that ex was mentioning that it's uh very important that the thing is soundless that there's constraints for everything I think it's better to have extra constraints rather than missing ones although of course if if you can achieve the same with less constraint and and B sound that's perfect but it's preferable to have like to have more constraints than necessary and maybe checking things twice than rather not checking and what was happening here if you see line 106 and you're a bit familiar with circum you

will see that you are just doing a big less than but you are not and basically big less than is a template that returns zero or one whever and you want to to check that all numbers were less than but you were not checking the output so then uh you were doing a check but you were not checking the the output and then it was there was a huge back here and why I'm telling all this because a few months ago there was a new functionality that was added uh in circum and if let me see if I can write I think it's npm run compile no not this one yeah this one and there was a new functionality that just B that when you

compile instead of doing a straightforward compilation you add minus minus inspect it will explore or circuit and check and do this automatic check that I I'm I'm using all the variables is everything constrainted then the constraints may may be wrong that's another thing but at least you will not miss constraints and for example if I run it you will see here it's obviously it's obviously saying what I was saying that okay so in this template this output basically the less than does not appear in a constraint and that was originally like a huge finding oh we have like a huge bag very difficult to find CAU early now with circum if when you just compile it right

away you can detect all those all those bugs like in a second rather than having to explore the whole code and maybe if the project is is not too big it's fine but when you have some project like circum pairing that were huge it's very useful because you will make sure that everything is constrained and and uh this will be available as a set Discord I think we also we will also add so well there's already uh uh there's two folders one that's called circum with all these circum examples there will be another uh which it's more for the SM part we will also use we also add I think it's already there but we need

to check that everything works fine a zig app example basically how to use to create a zig app and maybe use a circum and then integrate with smart contract so also you you have something to start with and to get some inspiration see how things are connected and regarding other dsls that we use as I said there's not specific repos like this for you to play but there's the main ones and feel free to ask our any of us and we will try to help you explain how everything works and all of these and I think that that's it yeah use a couple of of of notes just to that you can do it do do these things a

little bit much much more harder if you're interested in in going through thcom even if you are new to ccom or you are very experienced I would recommend you to take a look at the official documentation of thcom because it has recently been updated H with the recent features that the the owners of the compiler have been adding during these mths and on the other side if you're more interested in in dsls like pil or maybe you just want to build a Zer knowledge application on top of the polygon stack I will recommend you to go to the official polygon documentation polygon gtk VN documentations because because there you will find everything that that you will need you will have a

specifics at how how PL works and how you have to think in order to implement something in p and also you will have how we interconnect or all of our stack if you remember the slide with all components in the hdk VM you will see the documentation exactly ER what do we use and how we we connect all these components and uh I will just to refresh a little bit roer ER the inspect command H will prevent you ER will not always prevent you for doing doing things wrong okay in some scenarios are in some examples it will be super useful like

the scenario that roer has showned H because thecon by itself will be able to detect that you were doing something wrong but in other scenarios for example if you decide to go for monolith ER maybe the compiler will not be able to say you what you exactly are doing wrong but at least this flag will tell you that there is something that makes no sense for the compiler okay but he will not know he will will not be able to decide what you are doing wrong okay so in some parts it will be super useful super useful in other parts H like let's say the process of correcting all these mistakes will be a little bit more handy okay

and you have the presentation okay no no it's okay it's okay H so yeah yeah I think that's basically it h so let's let's hack together thank you so since we are actually this is a little earlier than we had scheduled if there are any questions we can actually take them now I don't know if anyone has any specifics I know this was very detailed and maybe you don't yet know if you want to heck oh there's a question back there got it just just wait for the mic

so we get it on the video uh yeah so there's a library called circumspect and what's the difference between circumspect and the inspect uh flag in circum and and maybe can you repeat the question please yeah there's a I used to use a library called circumspect before the inspect flag was released for C so I would like to know what what's the difference between those two um don't know the difference honestly oh okay but it's just like good just I think I don't know how circum

inspect work I think inspect is a lot more detailed and provides a lot more does a more detailed um exploration is and integrated directly uh in the compiler itself so when you compile it will do all all this instead of having to prefer to external libraries I see also like for the monolith hash the monolith hash so do you need like the benchmarks to be compliant with what we showed us um I mean the the number that we show were just I will say speculative okay what we expect are that at least that the number of constraints that you use ER let's say to

implement the mon are at least better than those that you obtain with posidon posidon 2 and and variance okay one last question is like for testing we need also compliant hashes for example test cases for the Integrity of the hash function that we we want to develop yes exactly and that you provide that I I assume the library is where they have implemented the the monol if you need to yes for sure just ask us and we can provide to you okay thank you okay guys do we have any other questions by any chance now it's a good time to ask them

yeah uh hello uh I'm asking about the arithmetic of the two prime number use I don't see other prime number the yes mer 31 and the I think the gold the first one is the goldilux one which is very well known and the other one is one that is trying to be used which is called the meren meren 31 one which is a 32 B prime number it's another one that is also been tried to use as a replacement for Gordillo okay but it's something that is still ongoing research it is possible to use other prime number or just for the implementation yes yes I

mean the the the tool that were mostly used by by the original authors and in fact there is a part in the M which which is called the MDS metric multiplication H which in the in the and in the paper you can find those which are more optimized for these two prime numbers okay can I ask about the algorithm of the multiplication and conversion in the prime number can you say it again because which algorithm is us it for this implementation for example mon or which for the for the permutation Matrix you mean yes yes so this is like in the diagram that I show with with three

different operations in order to implement the monolith the MDS multiplication is the is like the last part of the permutation so you will need to implement in theom this matrix multiplication okay in order to implement monolith okay thank you welcome thanks for the math question questions yeah we have another one up there thanks uh so the last time I looked into this code of circom I thought it was maintained by the team called Iden 3 but somehow it's now polygon am I right right now the the the guys who are behind the Thon compiler are are from

the are from uh University in Spain from M University which are in collaboration with with ID ID3 and but yes right right now the the the those who are working in ccom are those guys and and polyg team members I see so my question is uh just out of curiosity do you have a plan to add secp 256 K1 as a field I think that there's many fields that are going to be added in the near future I think right now you can specify in zom like the prime you want to use and you can I think at least there's BN 128 and Goldilocks and there's I think they are final finalizing the test with

a few extra ones like so in in the close future in the close future you will be able to decide which prime you want to use in theom right now we have a small set of Prime members in fact those Prime members are the ones that we are using in in the gkbm but in a we expected that in a near future you'll be able to decide which per you want to use in particular it's going to be awesome uh if it's supported out of the box without some crazy gimmicky you know extension out of it I completely agree thanks okay some quite quite an announcement here I guess hack any other questions from the audience um yeah yeah in the

back hi how the K as assembly related to the ccom or are they related or not uh the ZK is a part of your ZK stack and you so the ZTE ZK assembly which is another DSL which is very very it's very low low low level it's the language that we use to interpret the eum up codes okay so we have so you use the ZK assembly for for implementing the ZK VM hermas or something like that we use the zdk assembly to not only to interpret the evmo codes okay but also to prove

some part of them okay so zkm is able to prove some parts of the op codes that we interpret but then the rest of the parts because they are not easy to implement in GK assembly we do it in pil okay so the I would say that the interpretation are the proving part of the of the evm is done with pil and ZK assembly okay and then we use ccom in the in the recursion in the recursion step of our proving system okay thanks and we use like we generate we are able to generate Stark proofs uh using pil which we can not with circum okay thank you so yeah do I see

any other questions yes yeah it's fine that's what we're here for regarding testing in circum so there is the library called circum tester yeah and wasn't tester yes yes and I I did the benchmarks is 10 times faster than snar GS gr 16 for example and I wonder like do you sacrifice security to have such faster uh testing framework for that compared to snark GS for example because once you uh like fetch the signals and the results you want to compare with circum tester it's pretty much faster and with the same results circum tester is just yeah it's just it's not generating as

Nar proof it just compiling the secret and then checking that the witness is valid or not but it's not generating the proof for that witness okay so it's doing the same calculation as circum but not generating the proof so when you when you use circum circum test or was you are just compiling the circuit with in Air1 Cs and then you are just you give you provide a witness and you and the program executes that witness and check that all the constraints are satisfied and when you call snar GS then you you need to specify which kind of proof that you want either snars or FL or plong and you actually generate the proof okay so the difference is proof generation yes I see thank you just to be a little bit more specific ccum test

term what it does is is generate the the let's say the the trace or the witness of the of the circuit and this can and this in fact Express what we call the a1cs constraint system and the Thom tested what it simply does it checks that this weakness satisfies the the a1cs constraint system that is supposed to satisfy okay and in contrastar gjs do much more than that okay in fact inar GS you could you could have a like a I would call it a press setup or pre process step in which you actually run the ccom tester used to ensure that the witness that you are Computing is actually a valid witness but then you have the pro the process of generating

the proof and verifying it which is completely different from verifying that the wisness satisfy their 1 CS okay great thank you guys okay so yeah just in case you actually come up with more questions there's going to be a QA uh tomorrow on the main stage here at 1:30 so yeah feel free to sleep on it and come back tomorrow with actually more questions and just as we said there's two tracks and even though at the website it's it was originally saying like the bond is were 5K 1K that's not actually true we're thinking more of a 3 three and also it will also depend on how what you guys if you want to play

with shom you can either go for molet or go for another for another kind of project and depending on the different submissions will decide how we split the B this so don't don't think okay so maybe if you want to do something with tcom you don't need to be attached to monolith you can do whatever you want and then we'll see depending on the submissions just do something I guess is a message so yeah thank you very much we're going to actually have a short break now since the next Workshop is in 10 minutes so yeah deploying zero knowledge Pro on Leo will come back in 10 minutes thanks guys