ZK Study Club - Fiat-Shamir with Alistair

Transcript

okay hi I'm Alice - it from the web free foundation I'm a researcher but I don't do security and this is this is a new topic for me so I'm just sort of trying to share with you what I agreed to do this talk mostly so I could learn about this myself so if anything is wrong please tell me so I suppose I should start so everyone could see my screen you guys probably good yeah okay I

suppose I just got where Chris's talk finished which is the future me a statistic for a you know a three message interactive protocol like a Sigma protocol so the idea is that we can have interactive protocols that are our public Corinne the where the verifier just sends random queries and and so that were the fit what fits me suggested in 1984 is a way of turning a public coin interactive protocol into a non

interactive protocol to prove the same thing and the idea was fairly simple we just replace all the verifies answers with hashes and so forth rebrand protocol the pre-boot would send a the verified reply sort of the approver would simulate the verifies replace the hash of a and then they would give the answer which correspond to the hash obey and so why does this work so the basic idea is that if there's only if it's this protocol only has a small problem in all probability bearer it's fairly sound

then there's only a few responses that the verify could send that would make this fail and now the to prove er to prove something incorrect would have to try a lot of messages a to get a hash which has this probability of failure and so this is a bit like sort of proof of work we're trying to find a one of a small number of hashes and if this is hard then we can maybe hey make it hard by boosting our probably the probability

of success that our error probability is very small then there's no interactive protocol should also be sound so the way you'd formalize this is by using the random Oracle model and the basic idea is that remodeler hash has something which gives a black box which gives a random output for every possible input so for every possible input we sample independently at random from the uniform distribution over strings of a certain

length and if this is what the obviously has to be long enough to get the query it's fairly easy to see in this random Oracle model if the original thing had some failure probability P then basically for every a the pre bertrise every first thing the two tries they had they would have to compute a hash and then there'd be a p probability the product would fail so they can only compete and first responses and hashes of those then

the failure probability only goes up by M now sort of this this the security of the future mayor requires that the proof is computationally branded this is technical difference in between the proof of knowledge in which or proof of other things indeed in which the the soundness is only Cisco and that argument where it only works against not only to only work probably but only against computationally ground approvers so Fiat Samir will hopefully turn a proof of knowledge into an argument of

knowledge so this is what argument emerges in Starks and snarks and so random Oracle is actually quite a strong assumption for hashes for many things we need assumptions like the hashes of one-way function that it's collision resistant and the problem with the random Oracle assumption is it's not really true it's just a a model in particular a hash isn't the black box we actually have to complete it somehow and this is kind of and well the the under

set problem actually affects the security of the achieve a heuristic as in the results showing that it doesn't work the general and so the rubble of papers on this was a client I get to give a sort of version of their thing see if I can convince you that this thing doesn't quite work so suppose we have a you know one of these three message public coin interactive protocols which is a proof of knowledge I actually ask a question you mind yeah sure so oh this is one thing that

annoyed me for a long time when I was doing this is what was the notion of the term public coin come into play I missed the last session so maybe you guys explain that but I did say there's our thing that like I didn't go down the rat hole to figure it out yeah I'm not exactly sure what public means here's anyone else I mean I think it means that the verifier publishes their their random number and there's definitely a private corner and I'm not sure what it is but the coin part is clear in the various responses a random yeah I also think it means that the randomness is derived from some statistical distribution which is known to everyone else also I think that is also one of the parts of a public point

CBC's net and that the word coin sort of confuses me in that context I think it basically means you're like flipping a coin in order to get a ton of this randomness yeah yes so like each bit would be a coin flip so if you generate the five bit like a random string then you flip a coin five times okay okay I'm pretty sure you could change the language there and instead of public quayne you could save public randomness and yeah the public part is that it's it's considered public much known by everybody got a guy okay that helps a lot thank you okay yeah I wasn't sure

about that myself but maybe important things to verify think she'd be random and they're hashes are somehow modeling the randomness here so how does their argument kind of work so suppose we have we have some three message interactive public own interactive protocol that's a proof of knowledge so the prover sends a to verify reply to the random beanie the proven replies with some answer and the verifier accepts if some function have maybe an answer it evaluates to true so the idea here is we're going to build we can it modify this protocol to build in a trapdoor which is going to be insecure

only for the for the future mere cases well brother it's going to be only it's going to increase our problem us a probability of error decrease our sadness probability bit but indeed for the original protocol but in the transform case it's good you change it to a hundred percent and the obvious thing to do is to so the idea is to change it from proof annoyed into kind of a proof of knowledge or clairvoyance right whereby the verifier accepts the proof if the prover proves that they already knew the verifies random

response so in this case the verify would accept if the original function is true or if the hash EBA is B and now it's clear that the chances if that be was actually random of the hash of a being B are very small and this means that this actually is a proof knowledge if you go through the definition a scientist has been decreased a bit by the probability that hash of a was actually this random number B and so the soundness is decreased and I'm trying to like sort of map this to just like this decreasing by a very small amount the

probability the hash you base B but if you transform it now we lose all sense because the hash of it that bees always going to be the hash array and the soundness starts to go away because the hash because you're using a hash there is the no of collisions etc and even collisions it's it's the the the proven those we already know what the response is going to be and this protocol just it we just use our knowledge of the hash and because we know the hash we know the response no excuse me allegation regarding this is the the hash function or isn't it like the when you say that

actually I either F F is f accepts or has of a is equal to B and hashes already known to the prove aright the fore-end right so yeah what are the obvious issues about this is that it only works for this hash and it's obvious that if we try to transform this photo by fit fit Jimmy we should use it different hash because the hash is right there I see oh I mean yeah okay so okay this is though this this is the argument of protocol itself it's a part of part of the proof itself edge of a equal to B so yeah this can't be used for the randomness yeah so we can't use H for

the randomness but the thing is is that H is just a a a function right it's it's not a black box it's something we can compete yeah and you can use this and one of the things about computation is if we have a sufficiently good proof of knowledge we can use our argument of knowledge we can use that for it to verify arbitrary computations right so what we can do to get something that doesn't work with any hash is to said so as well as sending our original and today we're gonna send some code which is going to be the code of the hash and

then the verifier is going to accept if the original protocol which says accept or if we apply with a stock that verifies the execution chase of this of the hash of the first message we sent Bingbing now it's clear that whatever hash we use for this we can just put the code in you can put the code to the cash - you're not first answer in the first message and then this doesn't work for any cash for that hash now for this to work theater mayor had to work on stocks

because otherwise stocks in their work but it's darks work then in fact the Fitch Amir if start if the mobile works to generate stocks from from sticks from the interactive Oracle proofs then it doesn't work for all arguments of knowledge because it doesn't work for this one which means that you can't get you can't prove that theorem works in for general interactive proofs pathology director volumes of knowledge here and that's annoying I'll stir I don't fully

get the conclusion though what you're saying there's because it does work for Starks it this is a bit of a circular argument ok so you've seen it can you just say it again because I thought in your notes too and I did it so if it's stuck then this protocol that this protocol here that I've just given is this is an argument of knowledge the reason why it's only an argument to not the proof is because we can prove for stocks and this protocol is an argument of knowledge because the chances of whatever code we the this execution trace evaluating to be it's very small and so the the verifier only accepts

when the original protocol accepts except with very small probability so the SWAT additional probability of error and it's a perfectly good argument to knowledge but whatever hash we choose the we can put the code of that hash in and then they can they can prove very stark that they knew that they could work out from their initial message what the verifier responded so this is like a very silly argument of knowledge protocol that doesn't that the future

may transform doesn't work on and sort of the movie character argument here is that for all non contrived articles we haven't broken future me yet and therefore we should be unloading things in the random Oracle model and yeah this definitely has some downside right there are there is some if you saw the video we link that there are some positive results that say for sort of short proofs of knowledge and this is where the definitive proof of knowledge an

argument of lodge was important we there it there are some still extremely complicated hashes that under some crazy assumptions actually work but because of the way this uses a proof of knowledge we're probably not going to get it to work this way the stags there has to be something much cleverer to get this to work but the counter-argument is that well cryptographic schemes you know the real test is whether we can break them and they haven't been broken they haven't been broken and the random

Oracle model does give you good evidence but I kind of a bit worried about so even if only contrived protocols are insecure there's always this danger that someone might try to design and secure protocol maybe with recursive arguments of knowledge like this one kind of uses that has a back door but which they can prove this secure in the random Oracle model who knows hmm yeah that would mix mix trusted setup seemed perfectly fine back impressive anyway let's ignore that and talk about the Randa and and talk about what we can show in the atom Oracle

model I have can I interrupt you for a manicure okay regarding the kitchen this later I out the same question in the contribution itself so in this protocol if and so is this talk as a so it's like his argument is like stocks can soul stocks can sort of you can get cue the proof of execution of like the B is something so the B the B B's verifies answer so the idea is that if this was pitch made we'd be able to choose our

code to be the hash so this would be B exactly be yeah okay so so when you say a fiat semi works for stocks it does not work for all arguments of knowledge so yes this is an argument of knowledge because it's not very less secure than the original protocol yeah although it's only an argument because talks can be proved forced and ehm it doesn't work for it in for any hash its insecure and doesn't give you an argument of knowledge

and this is why it's hard to prove the feature may worked for the stocks does that make sense I mean I understand like it's probably go back and have a look at it again because it's sort of so uh the silica sort of feels like a like a generalization of the previous like we had the same yeah - function it's exactly the same except it works for different hashes it works reading hash because the pre we can yeah no but like because the chord is already fixed and

the B could be like it should work FB if because the verifier already know C is the code like he receives the code from the book first part he can choose a different hash function and well yeah by this sort of the assumption in is that for the non interactive thing is the hash is chosen beforehand so we can maybe choose the hash after we fix the protocol okay but this is not interactive I say we can't use the hash later I say oh yeah yes it sure that the code of the hash is explicit here but we could just do a commitment to it we could do zero knowledge that there's a lot of things you could do to make this even more obscure that it's not clear that the prove is cheating here if you

really wanted I'd see but it's still a crazy idea and so yeah a bit scared that maybe you can come up with a contrived protocol that is insecure but it's not obvious it's insecure and is secure in the random Oracle model but never mind yeah like the random Oracle model is fine in practice so far let's try and assume it okay so how does this thing generalize so so one of the things about the maths behind Starks behind this interact more acoustics is that they use

rounds to improve the scalability of the protocol so if we use you know we especially have a pay round protocol the I'm sure I've got the arrows in the wrong direction here have now in the first three nevermind so first the verifier sent a random thing then they prove were sent a random response then the verifier does it and then the prover replies and this happens K times prefer is the first yeah that's the first three arrows are pointing the wrong direction sorry I think you have it right though the prover sends the first one for some reason the standard protocol has to

verify going first I'm not sure why and that's actually really annoying in some ways and sort of how do you fit you Mir something like this you the answer is you just hash everything that you know at this point so if we're proof of knowledge of something we let me hash that as well and you catch all the messages and by the end you're hashing a lot of things call you hash the hashes which is more or less comes to the same thing and the idea again here is that the and the reason the reason you hash

everything you can is because it makes harder for each of these things to individually be big being forced and whoever sort of does this force because he wants to commit the door no let's start he is trying to prove oh well no hang on yeah at the fluid at the arrows it the wrong way around for the first three that's gonna be confusing wish I could change those but yeah the verifier first sends the hash of the thing that leads to be proved then the previous send something then the verifier then responds with the random thing which is well this gate could be the hash of zip know that if like why like what the very thing i knows x this is not interactive proof of X so what no me you describe it

there's a thing you're trying to prove the knowledge of X and there's a witness w and it is knowledge then the verify it should not never find out W but the verify knows that think you're trying to prove otherwise yeah and so the the actual thing that this paper considers that is required for Starks is a more complicated generalization called the interactive Oracle proofs now I might try to describe those now or am I trying to scribe those at the end because the other thing I want to do is to try and

describe what the paper proves about these multi-brand protocols how secure they are so maybe I'll do that first I think do the Oracles at the end ok so what so what they do is not exactly the with hashes not exactly this but so what is the security of this thing okay within so it for one round for this one round protocol with a verifier well three messages where the verify only send one message we look we lose a factor of the number of hashes to prove occur boob force and it would be nice if the same thing was true here with

multiple rounds but it's not quite true I'll try and give an example where this is worse okay suppose we have a protocol where each reply by the so in order for the prove that to a malicious prove it to prove proves the knowledge of something false say they might have to convince the verify in each of these key rounds and each in each round this this may only happen with a small probability hey now this interactive proof you have to fail this thing P times so it only fails with probability yeah and it's

insecure never might with probability P to the so we're taking this this probability P and we put it the power K and but if we're trying to brute force this the Fiat Shamir version of this we can actually do it round by round so what you do is you brute force in this case X better if it was a because this makes less sense you try and brute force this such that a1 is one of the these bad things that the allows to verify to claim believed false things and it takes you sort of one over P hashes in

expectation to do this and then you try and do it again for the second one and that will take you about one over P hashes and in the end ah and moba P they should be K over P so now you know it you know takes UK over P hashes and expectation to break the protocol and that means we care would be hashes it fails with probability 1/2 and if you do the math this will tell you the error has been broke the blown up by a factor of M over K to the K you know this is M to the cave rather than just M and it turns out that this is actually tight

this is the worst example and if you have the K round public own interactive proof then the area's blown up by most a factor of M to choose K which is about every other K to the K and and yeah they all this is this is like the worst case and they also wanted to paper also tries to analyze whether we can do better than this and they have this notion of a state restoration attack and sort of what the state restoration attack allows to do is

imagine the approver can rewind the protocol and set the verify state to what it was earlier so here to attack this protocol where you have to get these small properties P independently you first attack the first round you first we try something and it goes wrong you rewind to the beginning you restore the state the beginning until you've broken the first round and then you try again that the second round only restoring it to where you were after the first round and what they show you is that and maybe there there are protocols for which snake nation attacks are not as effective as they are on this one and

what they what they show is that this is a fairly tight characterization of what the what the security is in other words how low we need to get the error probability to be if we want to be secure even if the against brute force by the proofer and the sort of result is that if the no interactive protocol if we can compute em hashes is at least a sound and actually fairly close to a sound as a stapler as this this this interactive protocol where the proof is allowed to restore the state but in which there's only em around so can I actually say something and you

can correct me or it's wrong so okay it what I'm understanding is that the the way that this works is that the reason why there is sort of this lack of soundness or lack of security is because the prover can basically go ahead and keep trying a bunch of combinations of things in order to build something that the verifier would agree to write that's right and so for me that that is the sort of the kernel of that problem the actual effect that the kernel that problems because they know the hash function is that correct they're always gonna know the hash function mm-hmm yeah where kernel of that problem and how is it solved or is

it not so you don't so yeah the idea is you you don't really solve this problem so what we want to do is we want to get a bound on how much the error blows up because if we do that what we can do is we can we could do some things like repeat the protocol in parallel if you do that carefully you can you can do things to reduce the error to start with so in order to counteract this attack what we're going to do is we're going to reduce the area of the original protocol and it's kind of crucial to know what so if we can bound the blow-up at the error

better then that means our original protocol can have a higher error and for something like starx this will mean it's shorter because you need less repetitions to get and to get the same security so the better you can bound this the shorter your stock will be and the final proof will be if you big it because you need that you need lengths to get the original to get the error down and then the the reason why it's called accurate the future mere heuristic is because you're not eliminating the error you're characterizing and doing your best to bound the error rather than completely

of making sure it doesn't exist is there kind of the reason they knew it's called the heuristic is because they didn't have a proof for it when they first got proposed it okay and the random Oracle work madlyn was invented about 10 years later after niche aamir and more as soon as it was invented theater Mir was was proved to be secure because it was designed to the random Oracle model was designed to prove this kind of thing to be secure uh okay okay so that's the city the security came later on history analysis came very much later even even with assumptions initially there there was yeah no clue what you could prove about

this and that's why it was a heuristic got it got it thank you so yeah a lot of this paper was sort of concerned with how you might reduce the error blow-up in in theater Mir in order because well obviously stock where I want to have short proofs and so this paper got a tight characterization of that it also came up with this idea called an interactive Oracle proof which I'll try to describe probably best if I

do that with the screen touch from the paper okay now I have to working out how to share a different application I believe you can do it tada okay we good you see that bigger - yep okay so this is a diagram of an interactive Oracle proof which may or not be back clear so the idea is that the they want to model the case like a probabilistic view checkable proof where there's a there's a very long thing a very long message that is never actually

sent to the verifier instead the verifier is only going to query it so what happens here is that the proofer said to this message m1 they're the verifier sent a message m1 then the prover sort of responds with this this message f1 but the verify doesn't see the message they can ask for random pieces of it and then they said a random reply m2 and the premiere applies and so on and any time later after the approver has done something has sort of committed to one of these F's the verifier can query

random parts of it and the idea is sort of combine the probability checkable proof where we have this long proof the verify claim you look at small parts of it and a multi round interactive proof protocol now you could sort of turn this into an interactive proof by committing to f1 but committing to f1 already introduced some abstract if they didn't want it so how do we sort of make this make sense and and applies the HMA to it well the first thing is that we sort of the proven needs to commit to these long

messages and they do that by doing your merkel 3 this is the diagram they have a merkel 3 I'm sure you're all familiar with Merkel trees so I'm sorry before you go on is f2 can you go back 1 1 that images had yeah is m2 a function of F 1 & 2 it's random got it so this is this is yeah this is a public coin thing all the messages everything the bet ultimate verifies messages all my queries are random got it and this is simplified lots of things because the yeah the yeah

I wasn't sure if if you know if m2 is depend on f1 then it creates the circle of where it's hard to not make it interactive so that's why I was asking that yeah now it certainly makes it easiest to non-interactive that the messages don't depend on anything because they just random got it that's why I was asking cool thank you yeah so we sort of commit to these messages by doing the Merkel clean in other words we do lots of hashes here these hashes Rho is a random Oracle but it's just a hash and they this Baker consider zero knowledge so it kinda wants to make these private by adding in some random things so the idea is we're going to commit to this Merkel tree and when to

answer a query we will just reveal the path that includes this thing and that will show that this the thing that we committed to actually contain this thing will reveal and this actually requires weaker assumptions on hashes just local trees only need one way functions and collision resistance which is a lot weaker than random Oracle and with that kind of the the non interactive construction looks a bit like this so there's something Sigma zero which i think is basically just X to the thing we're proving and maybe some other

things and then we hashed that to get this message one the proof of replies with f1 sort of but actually they just compute the Merkel route and put that in the proof and then we use the Merkel root which is the hash of everything to do yet more hashing to get the something we're going to hash to get the second message so you have the design principle here is we just hash everything we already have it's kind of extended by these merkel things but it's much the same and because of this observation that actually the verifies message doesn't depend on any of the clear

queries they consider moving all the queries to the end so this is the way of reorganizing the queries such that they come at the end and what it builds is this structure of where each step is depend on the previous step because of because you're hashing all the previous teaches exactly mm-hmm knee sure and this paper then goes on to show that this construction has the kind of security develop in the sanest that I gave the blurp in the proof of knowledge and they also want to show that that zero knowledge is preserved and but

that's more complicated because actually there's an even crazier assumption on hashes that they assume in this case it's something called explicitly programmable random Oracle's which makes even less sense but I'm not sure to what extent is a technicality to get round the the definition of zero knowledge which doesn't really handle randomized algorithms very well but I won't go to that that's complicated so I think this is probably this is where I've got to so I'll finish and answer questions yeah all right thanks for that

yes looking I I didn't get through this this I opted paper when I'm when I'm looking at this so on the left-hand side of the diagram we have that what is that that's a little Sigma like so Sigma naught goes into Row 2 yeah and that's what's fed and that's what's fed to get the M 2 so is that like is that just I mean that's just saying we ahead of time we fixed which hash function we use and so every rep every message now coming out of the verifier is feeding the merkel root in and that's it or is there some additional addition coming there's two hashes Rho 1 and Rho 2 both of which I

think radicals and so the Sigma's are just the intermediate steps of this this thing here so suppose what this this rash of Rho 2 it you know so Sigma ah so Sigma is the hash of the first in Sigma Sara got it and so so I guess like whatever the initialisation is vector or the seed whatever is and so that Sigma naught is known it's probably produced from the the thing we're trying to prove X and actually yeah it's just the hash of X okay great yeah nice when

when you were before we came here and you were saying oh you know how would you how would you you know make it so that you didn't need so many queries but at the same time so you couldn't brute force every round I was imagining that yeah you need to do some strange threading but then but then yeah well it would make you kind of count brute force every round and that's why this worst case blow-up happens whoo but yeah you want to make it so that you can't paralyze the brute force right yeah well I guess strange question but maybe something that was left in my mind from

one of the sessions that we had last month do you still feel that that a Merkle tree is kind of the best aggregator or is it simply you know the one that we have lots of them wouldn't agents for and so everybody keeps reaching to it so well the thing about a Stark is we have an awful lot of this merkel 3 is overprinted the entire execution path of something the entire execution and then that means it really has to be efficient so yes using RSA accumulators would lead to a much shorter proof but the cost approval would be a lot more complicated and at least Merkle trees are easy

brandeis yeah so yeah this is this is how stocks are secured and I tried to say earlier about why the random Oracle model isn't perfect right right I mean do you do you have do you have any other thoughts on that because for me you know i when i was also searching information for this I just saw several papers actually before I even found the original paper for future near heuristic it was more hits for you know why it's unproven or why there isn't a proof for future mere

heuristic I mean knowing what you know now how do you feel about about using this in the wild so I think actually it's so I can't get this this proof to work for stocks so one of the things about stocks is we commit straight away to the execution trace now that means we can't really hide inside that computation any hashes because if you evaluate the hash in the execution trace and then we take the hash of that before we do anything else then that means there's some circular function of with a hash in it that so can regression with the hash in it that can't be that there's gonna be hard to solve so one of the tricks in the in the classical I thing was we commit to think the thing

we publishes the code not the execution trace and then we can sort of get the hash and we can apply the code to the the hash of the code but we never include the hash in the first thing we sent if it was the execution trace we would have to do that so it seems a bit harder but the thing like the thing I'm most worried about is seeing the way this this this stark appeared in the second in this construction is how on earth are we going to do we with the several cryptographic protocols that involve recursive arguments of knowledge right yeah it's blockchain projects using recursive snarks and things and that looks a lot more dubious now in petitions yeah well snarks to probably

I'm not sure did they use for Jimmy and they probably do so I wasn't paste yeah but let's say yes for now I think they do well that may be a good question as a piece of output from this study group right like what do they use and how are they structured yeah I mean the only recursive snark protocol that I'm aware of still is coda they have a white paper out since many months and I believe all their code is public and github so I'm sure most cared about actually is their office probably gonna be at the summit and we have an episode with them so that this contrived example let maybe I can

design a recursive argument of knowledge protocol that's insecure has a backdoor that only I know about yeah and as far as everyone else is concerned I have the best proof that in the random Oracle model not that that's the scary part so that the kind of thing that keeps you up at night Alastair or is that just I'm not too worried about think these seem to be broken but that's you know if you're paranoid that's what you'd be worried about well I have a cushion regarding the current slide Oscar and like in the proof in this case is is although all the markers routes for the

queries that are like generated in this way is there something that is sent or also the parts are the part of the proof that are given to the very sorry hello I think we didn't hear the last part of your sentence so uh so what is your like final proof from the prover that is viewing to verify right so the things that are highlighted here in this diagram other things appear in the final I think message because if I can calculate all the other intermediates

themselves as long as they have the parts that are highlighted okay yeah make sense you have like time to go back to the discussion that you were having about the case of stocks in case of the Fiat Zamir mystic why do you think like I didn't get that I didn't get it intuitively why the argument of execution trace was this that's that's a bit vague you know I wonder was it that part was it really because what like you mentioned there's the argument of

knowledge and the proof of knowledge and are you saying that because like it's almost like it alls into the category of argument of knowledge therefore no no no though people have positive results for proofs of knowledge in not argument of knowledge the thing to note about this that this entity of protocol with the stock is that if we didn't use the stock if we didn't use fear to mere here we could instead of doing a start would he'd be a stick the thing the interactive Oracle proof that is transformed by fair to major stock there there is a an interactive Oracle prove the stick which is a proof of knowledge and not an argument I think here for me at least it's still going a little too

fast okay so we could place this dark here by the interactive Oracle proof that okay it would be transformed by fetching interest up that they think they prove isn't it everything knowledge right there what you're saying so there's the Oracle there's the Stark there's the future mere transformation right are you using your use the as far as I understood the Oracle is used in fiat Shamir to do the transformation now it's like part of it or the hash comes from right so this is confusing so the okay and this is like so that they have

this abbreviation my rope and non-interactive random Oracle proof and then the Oracle there is a random Oracle but an interactive Oracle proofs the Oracle is not the random Oracle it's the the verifier has Oracle access to the previous messages this is a different Oracle yes a different use of the word Oracle which is got to be confusing proof has no randomness and I think I believe that this these sticks are proofs of knowledge to me and that kind of means that we could make this thing with instead of a three round thing we

could use a stick for the proof of knowledge and we could use for these different rules of clairvoyance we could also use a snake and that would give us an interactive Oracle proof which was a proof of knowledge that wasn't secured when you fear troops you ate it and it's like this so the distinction in between this this this proof of knowledge and clairvoyance and the original proof of knowledge is not the difference in between the proof and an argument if we actually want to use fetching me on stocks it's something more complicated I don't think any of these positive results sort of deal with that okay you guys have any other questions

well if you just said it you said a little uh-oh I don't know if you meant to do that did you have any thoughts no I was under the same impression do you hear me yes I hear you I'm struggling with the different notions of the word Oracle as well because in the past I was also very reluctant using random Oracle assumptions and standard assumptions and interchangeably and now it bites me in the ass once you go to public blockchain for instance so that's why supporting so it was saying random miracles yeah are a

bit controversial I've certainly seen if some of the papers defending ran miracles pointing out that people who tried to get round them have sometimes produce more complicated protocols which were insecure and often in ways that they didn't you know yet they proved it was secure in some way but it turned out to be insecure in some other way because and it's kind of it there's an argument that the practical argument is that you should you should go for simple protocols because they're easiest to attack to analyze attacks on and sometimes these simple protocols will be ones with random Oracle's in them yes I agree I agree understood Thanks

cool maybe I have one one questions Alastair but it's more of a closing thought which is based on everything you've read and I guess you got pretty far through the IELTS paper do you have do you have any ideas for next step or are you pretty satisfied right now auctioneer heuristic I I don't know yes next step for whom I'm sure that they would want to carry on and try and use this characterization of difficulty to reduce their numbers a bit they're always trying to shave logs off and end up with Starks which is still very big

to make it more practical but I don't know I mean I'm kind of interested in whether we can attack this thing but I think the answer is no and I've got no idea how to prove it no does anyone else right so they'll continue to be no proof for the Shamir heuristic or no no generalised proof there's no attack that were you just said say yeah there's no attack on anything pract anything that was wasn't designed to be attacked Wow and did obviously stupid things all right so I think we hit our our I want

to say alistair do you have any last sort of closing remarks you want to share I think I made all my last remarks some communications okay well I want to say thanks to everybody who joined for the Study Club and the video is gonna go up if you do want to listen back I did share your notes Alastair kind of we're speaking because I realized that sometimes this screen flickered so that's also in the chat and you might notice the Elster there's a bunch of people trying to join so I actually did share an unlisted link and there's a few people who are watching Hodges suggests cool yeah so I'm gonna stop the broadcasting but maybe I'll just put a call out here that like if anyone else

wants to host one of these or if you guys have a topic that you want to do something like this on or paper put it into the group because I think this is kind of how we can come up with these things and I want to say a big thank you to Alistair for covering this very important topic and also showing us sort of like the nuances and the places to to make it kind of exciting where you try to break it it's cool yeah thanks also you did a really great job okay Cheers all right I'm gonna stop the breath