ZK Hack Lisbon: Creating Zero-Knowledge Proofs with RISC Zero

Transcript

foreign [Music] so just as a recap for folks who are not physically present we've got some bounties working on if you want to go ahead and build an application for the risk zero zkvm we'd appreciate it and our other Bounty out there is create support so anything that uses serialization or deserialization crates in the guest we'd love to support more serialization and deserialization so first things first let's make sure you're all on the Wi-Fi if anybody hasn't connected we're going to be downloading in just a few seconds

so you want to go ahead and get onto the ZK hack open Wi-Fi so if everybody's there just a quick review what we're going to cover today is first getting to know the ZK VM I'm just going to go over a little bit about what happens in the guests and host about creating receipts and about how we built our ZK VM and how it might be different from some other systems out there we're going to get you started on your first risk zero project we're not going to do from start to finish here it's just going to be getting you started but we will walk you through a simple example and then at the very end I'm excited to introduce Bonsai our upcoming proving system so

to get us started we've got a couple of different approaches to writing ZK the first one is a direct approach where we have language that's compiled to produce an arithmetic circuit and then that newly built circuit is going to operate on inputs and generate a proof as output so if you note the direct approach is going to give you a custom circuit which can be useful right is customizable but we like using the zkvm approach because now instead of being in the business of circuit generation we can compile rust down to an intermediate representation that we can run on our VM circuit so the program itself gets treated as input to the VM circuit and this means we can use the same circuit roughly for every program which is what we mean by general

purpose so before we continue I just want to talk a little bit more about what it means to use the risk 5 instruction set and what it means to be general purpose so the risk 5 instruction set for folks who aren't familiar it's an instruction set architecture which is an abstract set of computer instructions and we like it because the instructions are simple they're stable they're open they've been around for a while and they've got a lot of eyes on them so they've had a minute to have a lot of The Kinks worked out so now we're able to write rust code because it can compile down to risk five instructions and then when we say our program is treated as circuit input what we mean is we've got risk five instructions we can operate on risk 5 instructions we can

use the same circuit for every program and what that means for you today in this Workshop is that you don't need to write circuit code and you don't need to read circuit code you're going to be working entirely in rest so as we dive into the zkvm just want to get a few preliminaries taken care of we're going to be working today in rest so if you don't have rest you want to go ahead and install that and then we've got a cargo risk zero tool here that should automatically set you up with a starter template project and if you want to take a moment to follow these steps if you have any difficulties just go ahead and raise a hand we've got a few Engineers here that can walk around and help folks out but if you'd rather just listen for now

this information will be available later it just takes a few minutes to do the initial builds so recommend getting a head start and while folks are getting that set up in just a moment I'm going to talk to you about proving with a virtual machine and generally how our system operates but I want to give folks time to and then well folks are doing that I'm

just curious how many people here have worked with the rest before awesome okay we've got a good number how many people from here are it's your first time working with rest great okay and so one nice thing is that this actually is a reasonable way to learn rust if you're also working on this project because you can just write rust code you know and so if you're new to rest just writing a little bit of rest some of the pieces today might not make sense but um we're excited to support you anyway in it so I'm excited to see you here um anybody I want to do the same show of hands here for folks who has already

played with the risk zeros ekvm okay a good number of people luckily our Engineers seem to have already played with it a couple haven't I'm a little concerned but um anybody who has not played with the risk coz KVM Engineers that want to explain themselves okay awesome all right so now that I've stalled it looks like the typing has slowed so I'm going to move to the next section here so proving with a virtual machine the big picture is just like a regular VM we've got a host we've got a guest the guest is going to run the core work to be proven and then the host is going to prepare appropriate inputs and react to the outputs which in our case is a

receipt that we've run the code we said we'd run so with the host code anything you don't need to be a part of the proof you can go ahead and run on the host so any code that you don't need to prove the execution of and where this differs is unlike a regular VM rvm is going to generate a computational receipt so this is the zero knowledge proof part and that receipt today is going to return right to the host and we're going to check it in the host but in general you'd be sending that receipt on to other parties making it publicly available whatever your application needs so to get us started we're going to take another look into what a receipt is

since this is what you'll be passing around once you're done with your program is computer okay um so the receipt consists of a journal and a seal so the journal is where you're going to record public outputs and just to let you know this is zero knowledge so nothing is public by default so anything you operate on if you want it to be public when it's done you're going to have to write it to the journal and then that means you get to choose what outputs you're making public using a command that we're going to cover in a few seconds and then the seal demonstrates that the receipt is intact it shows that the journal is in fact the output of this program whose hash we've included in the

seal hash with a little bit of a hand wavy there but so now to get into our example we're going to go through for example we're going to do a basic proof of factorization I'm going to prove to you that some number is composite which means that it's created by multiplying two integers both of which are greater than one so we're going to make a zero knowledge proof for it and we're going to be writing a program or I'm going to be showing you a program that multiplies two non-trivial integers and then produces a receipt so in the receipt just to refresh we're

going to share to our Journal that composite number that we create using the program so that'll be the part that'll be the public output and what won't be public is the numbers we multiply because we're going to be multiplying those inside of a guest program and then the receipt tells us our program ran so that we know the number is composite because we ran a program that multiplied two numbers right so to get to know our starter template oh yeah yeah I can stop leaning here all right yes okay room I am just making sure that this is

fully accessible um so apologies for briefly explaining factorization um making sure I'm not going to drop anything here I appreciate you okay so what does this actually look like you probably want to know if you're writing code just to refresh you're going to be writing guest code which is the code that will actually be part

of your zero knowledge proof you're going to be sending input data to the guest for it to operate on and then you're going to be doing something with that result with that receipt when you're done so just so you know with our upcoming Improvement service you're just going to be writing guest code so you don't have to worry about any input data you'll just be passing that in as parameters and then the results are going to be made automatically available to you so for now we're going to handle all three in our examples and for any projects you're going to be building over the weekend you'll be taking care of all three of those and this is kind of a first look at the guest code and what that looks like I'm going to be highlighting a few pieces of

this but I'm just going to take a few seconds and let you take a look loading a few values in making sure neither of them are trivial Computing the product all that's taking place in the guest so some pieces to note we're going to be grabbing inputs from The Host when we're done with our result we're going to be committing it to the journal so this heart has to happen explicitly so as you go ahead and write your own programs for the zkvm remember that none of your results none of your output are automatically public so you're going to be making choices about what you want to make public and what you want to keep

private right and that being able to make those careful choices is a really important part of writing a program so even though it's just basic rust you still need to throw in you know the right decisions along the way and another piece to note is that data needs to get serial sorry another piece to note here is that when we're checking this if you panic you're not going to produce a receipt and this is actually pretty useful if I am writing a program and I have a receipt that itself is proof that I've successfully executed and so a panic is informative right in cases where you just want a binary did it work or didn't

work and you don't need to know the particular error that was thrown you can just make the thing panic and then you don't get a receipt out and so now I'm going to be going into sending inputs this is host code so previously we're looking at code written from the guest this was code written for the host and some pieces to note here you have to serialize data to send it to the guest so that's what this piece is doing this library and because data has to be serialized to the guest that's why we have one of our bounties out there so we can get more data available as

guest data a few pieces to note this type that we're using it's going to be the same type that the guest code reads so as you share values with the guest you're going to want to make sure that you're reading the same values in to the guest when you commit values out of the guess you're going to want to make sure that you're reading those back out from the host the same type so just make sure your types match as you go um yeah yeah this is our so this is our serialization and deserialization Library so you'll be able to serialize and deserialize with

with this and the host and this just is how we were able to get get data into the guest and get data back out of the guest yeah yeah host to guess guest to host we've got our own but it's you know standard survey format totally so I have another question okay um so another piece here um so this add input u32 slice is the basic way we're going to send data to the guest so we've picked two numbers and now we're sending both of those values to the guest

and just a quick recall I want to pull you back into this guess code then we went ahead and read those multiplied the values and committed it back to the host so sorry to Jump Around after committing just want to point out the last step here reading the journal so here we're going to take the same u64 value we committed which is the composite number read it back out and make an assertion

here that this number has in fact been produced from as the product of two non-trivial integers so now I want to talk about where you're going to be modifying code because this full example it's available it's part of our examples it's not that far off from our starter template but what you've just downloaded has a pile of to do's and I just want to go over them so that you know how to get from there to the program that you're going to be writing so there's 10 to Do's in the template some of seven of them are minor and cosmetic like update the readme use a license you're happy with but the three non-trivial ones cover the points we've

just been discussing so you're going to be writing code for the guest you're going to be communicating input data to the guest and then you're going to be doing something with the results in the receipt so let's go over the two Do's real quick um aside from the major items there's a few to update the readme rename your guest program add to get ignore if you want but for the most part they're pretty straightforward and mostly around writing guest code communicating inputs and then using the outputs and just as one final oh yeah oh my screen's on the fritz I'm so sorry

okay was everybody able to see the last few slides or has it been on the fritz okay good all right so this next bit I just want to add in one note because that last example was pretty simple if you're going to be oh boy I better not touch this now okay so um the elastic all right we're just going to ignore that for a second so the last example is gonna was pretty trivial it just had single values coming in and out you know what we're just all right last example was pretty trivial we just had single values coming in and out you're gonna okay you know what I I don't I cannot

explain this all right so the last example was pretty trivial but in general if you want to get input and output you're going to want to use structs um and so if you want to pass in a whole lot of input you want to create a struct pass that in probably create a common shared library and if you're going to get a lot of complicated output out you probably want that as a struct because everything just gets written to the journal it's up to you to interpret what comes in and out easiest way to do that is with a struct and rest um and that's just a pro tip to make your life a little easier as you go from this trivial example to a genuine program and if this wasn't incredibly glitchy you would see a simple example with that but I welcome you all to take

a look at our examples we've got plenty available that demonstrate this and you can find those in our main repository now I believe they're in Risk zero zkvm under the examples folder inside of that and we've done that so that you can go ahead and give those a try and they're up to date with our most up-to-date version which we've just released so all the examples should be functioning there you know give this another try because I do have a lot of pictures coming up okay so

um I'm now going to be talking about our proving service with no pictures okay no we got pictures maybe all right let's see if we can get this to work come on buddy there oh totally let me go back actually and hopefully this isn't too glitchy

because that's a really important part the guest code is okay the guest code imagine is the guest code is code that takes in the two values that we're going to multiply together produces their product after checking that neither one is one right and then commits that result publicly to the journal so without worrying about slides that's what's going to be inside of that main function and the guest for you and what that means is that if I have a receipt I already know that it's a composite because I know that you successfully ran a program which if it ran successfully

and didn't Panic must have had two integers as inputs that were not one you know that multiplied together and then you can read that public value out of the journal when you're done and so that's what the guest program contains thank you for that question that's really interesting yeah yeah exactly exactly and so and that's where I'm talking about occasionally you can use a panic in that way if you don't care about why it panicked right if you're just wanting to say if you have this receipt then you

know it didn't Panic here and make that a condition of its successful execution then you can throw panics in where usually that wouldn't be a good idea that's right yeah yeah uh I appreciate you so much yeah yeah spread the good word of zkvm [Music] foreign you know unfortunately the next few slides are actually the ones that have nothing to do within this booklet but it's all right it's all right we're gonna keep rolling um okay

so oh my goodness all right you know what okay I want to encourage everybody I'm going to be real careful here I want to encourage everybody to try our bounties so now that you've had a chance to take a look at what you can write in the guest ckvm I want to just first check are there any other questions anybody else wanna um so none of our bounties right now are going to be using anything with solidity no Bonsai is not going to be publicly available for this we're just writing programs for the ZK VM for it so we did briefly make it available but we're

going to hold off for a little while longer before making that public but we do encourage you to write programs for the zkvm and once we have the proving service available you'll be able to submit those and run them on the proving service so that's the state for now yeah so I'd be happy to answer any technical questions aside from when is it coming out it's true it's not a technical question could I oh what is bonsai totally um I have a lot of pictures on the next slide and I will get to that one in just a second but if anybody has zkvm questions I just want to make sure we're all good on the the basics before I go to the service that runs the basics but

thank you for asking that I'll just one second I think I saw a hand behind yeah oh um that's a good question just the guest code but what we're able to do is rust compiles down to risk five so you get it for free and so if you're trying to use the proven another environment I mean if you could get it to hmm yeah

oh ouch yeah okay I thought not touching anything would work so you can enable that that it's not like but you know it is that might not be bad

okay it's just been all right take one second here and then I just want to add on briefly to that which is that the prover has the limitations we just discussed but verification can happen anywhere as long as you can Implement a verifier yeah yeah so already done already in existence oh that's very exciting okay I was really hoping that this part I

would be able to have pretty pictures for okay not really not gonna touch anything Bonsai all right now we're on to the next section here I just want to talk briefly about our upcoming proving service we're all really excited to see this launch we're still working on it pretty heavily what it's going to be is it's going to be a network that's designed to let you build kind of a new class of zero knowledge applications it's massively parallel it's chain agnostic and it's also like the zkvm general purpose so in order to enable this we built a pretty modular architecture that can be composed to let the network interact across any chain across any protocol

so what we have right here is an example that uses blockchain but I just want to point out your program does not have to come from the blockchain this is not a blockchain specific application or service so we're going to provide an API you'll be able to interact directly with Bonsai without necessarily coming from the chain and you'll also be able to upload your own binary files for us to execute at your request there and you'll be able to directly upload completed proofs so although this example here is going to use solidity for ethereum we will be expanding support to other chains so please just take this as a working example because it's pretty modular and composable it's easier to concretize here but if you have another example particularly off chain we're still

really excited to build this out for you so starting with the blockchain example we're going to start out here with a contract that asks us to go ahead and run your program in a zkvm that contract in our first working example goes to our Bridge contract which not a classic bridge in the blockchain sense but just something that handles API interactions it's going to interact with our API and then we'll send the proof request to a request pool we're going to run your program send our send those inputs to the guest ckvm and so just like the example we took a look

at we're now going to be running a guest ckvm program just like the example we looked at the zkvm program is going to generate a receipt and where this differs is we're going to start passing the receipt on to our proof roll up system and we'll take care of this for you and then at the very end we're going to verify the receipt and send the results back to your contract and now or tell your contract where to find the results and then your contract will be able to use the program's outputs so with this example just writing in solidity you can call out get results and do an off-chain computation which we're pretty excited

about because there's quite a lot of things that you wouldn't necessarily want to do on chain or that are currently kind of limited on chain but just to reiterate this example uses solidity for ethereum this example is a non-chain example but this is not a blockchain app service specific service it's a ZK proving service um and if you're interested in joining the wait list hopefully this will not glitch out for long enough for you to take a picture on your phone um awesome I'll give you a second here okay

and take a second until I see all the phones go down okay fantastic and then I just want to check um in in the back you asked about Bonsai I want to see whether your initial question got answered or if there was a more specific one that you were looking for okay cool that is a pointy question I am not prepared to answer at this moment I'm not going to answer questions about money or time I should have been more specific um any other questions specifically just about engineering um

so give me your auction walk me through your auction example right right right right right oh so whether you could have statefulness inside of that stainless yeah it's it's one it executes it's done executing it produces a receipt out so in that regard it's pretty modular um totally yeah I'd probably have to and anybody want to tell me anybody engineer here want to tell me otherwise

for the oh great awesome just want to make sure I'm telling the truth here um any other questions yeah totally right ah yeah yeah yeah because you are

sharing the proof right and I did say that the proof was everything that was public yeah so I'm sharing the receipt and the receipt functions I'm not going to say functions as a proof the proof is the the process by which I prove it but then the receipt says I have proven the correctness of this execution and the receipt itself is going to tell you that you correctly executed your program and you'll be able to see which program was executed and match it against that so that part is the receipt itself what the journal is for is just for anything that happens inside your computation that you consider an important result to share with other people and that's not the computation itself but values in there along the way because oftentimes a black

box ends up being kind of useless unless you want to say this ran and assert that a program ran and that's all you want to run which sometimes you do right sometimes you're checking the validity something checking the Integrity of something making sure something passes all of your requirements right and you've made it Panic otherwise and in that case it's fine to just send the results but in most cases you are going to want to have some parts be public right um [Music] whatever

and then you hash that and uh and uh that could be a thing is another problem is that you want to verify that you own you know the secret is to be the remix right yes and the other way to do it is the key to have to be really stupid right so that's why usually I mean you know well this is the iodine in the gas flow that basically just take the input is to be your secret key hash it and then commit the result

of the X right uh and then when they say complete you write to the German that that is the kid right so when you verify I received in this way you can always be sure that the proverb knew the secretary foreign [Music] totally and I want to point out that that publicly sharing the hash is a pretty common pattern a pretty common

not design pattern but a pretty common pattern when you're writing a program for zkvm so to use another example if I was playing the game of Battleship I'm not you know for those who aren't familiar you put the ships on the board somebody else guesses a place that either blows up your ship or it doesn't if I want to make sure and attest to the fact that I haven't moved my ships around that I'm using the same board I might commit a hash of the board in a program that checks whether you sunk my battleship so and then we have another example in our examples repo that's a wordal example where we make sure that we're actually using the same word and not shifting the word out from under you which would be a pretty mean Wordle game yeah yeah it's going to Hash the same

way every time yeah no problem and thank you for asking that it's a good understanding which pieces to share ends up being really really critical for writing a good program any other questions all right in that case I want to open this up and say does anybody have any projects they're interested projects they're excited about things they're interested about building and want to know more on and I can either answer it or connect you to one of our engineers in the room that you're that you're like no no this is great that you're building something

[Music] awesome fantastic okay so for folks who didn't hear folks who are remote somebody's building an order book matching engine and would love to have people reach out anyway that they should get in touch with you if they're remote or perfect anybody else okay cool in that case um I just want to check in with our Bonsai team anything else you'd want to chat about Bonsai on anything else you want to share awesome all right in that case I want to open

this up and either give you time back or encourage you to stick around and start working on projects we do have a pile of Engineers here so if you want to get started we'd be happy to help you out and just spend a few minutes getting you getting you going and going past any of the initial blocks you might encounter so thank you really excited to share this with you I hope you all have a really great hackathon [Applause]