ZK Study Club - ZEXE reading pt 1 (of 3)

Transcript

so I think we are on yes cool okay so today we're going to be doing a study club on the sexy the exe paper this session will be led by Yusef so thank you for doing that and given the size of this paper and sort of the depth of it we decided to break it up into three parts which is hopefully the right amount I know even the first part was still pretty dense like first half of the first part was easy and then it got more intense but Yusef do you want to do you want to take it from here yeah sure so just to present myself because I think we haven't been introduced to each

other I miss a few of you in Berlin in Zika summit so I am a cryptographer and I work at ey so mainly on privacy issues so today we will talk about the SIG's a paper so yeah so we wanted to break this down to three parts so this one it's so this one will cover until page 21 I guess so yes so the first part of this paper is is somewhat an overview of all the paper so we're going to go through all those contribution in this paper but not maybe pretty much in details so so I prepared some some notes as I were going

through the I was going through the paper so so yes so the main point of of the paper was so to perform offline computation and then upload a proof of correctness of the computation to the ledger so the post should be zero knowledge constant size and constant time verification so I was below so obviously we're talking about Zika vaccine so how they want to do this is they introduced a new cryptographic primitive they called it decentralized private computation DPC and they had many many others contributions regarding the efficient implement implementation

of ZK stocks and recursive call can put compositions so these how they do this and they have also introduced and come up with a new set of elliptic curves so for elliptic curves to be precise and so in the comes in the abstract still we we have a sneak peek of of the the performances cost so as external transaction is - 68 968 spite so if we are talking about two to two inputs which we go so you're gonna talk about this more in details later and the generation time is less than one minutes plus some time that goes with

the offline computation and the verification time is tens of milliseconds so and why they want to do this is at the end of the paper they come up with some some use cases where they can apply zigzoo so for example privates decentralized exchanges for user defined variables or sets and privates what regulation friendly private stable coins so the concept of this session with respect to the paper so will be the introduction techniques and definitions of DPC and construction of DPC are also as in the paper so yeah so these papers study through

limitations of distributed ledger so we all know the them so privacy and scalability so this is we call the distributed ledger or blockchain is based on these transparency consensus so everyone is executing the transaction to do direct verification and then everything is transparent so there is no privacy per se so there have been a lot of work that addresses those those limitations so so a better way to answer to understand sex is to look to the related work that addresses those those issues and the most famous one is

geocache papers geocache protocol so they address the privacy of the Canton's privacy of the sender and and and the recipients within the anonymity set and how they do this is by leveraging on zero-knowledge cross but the problem here if we want to do it in idiom or in any distributed ledger is that the function or the transition state function will be different this time because in for example in Bitcoin it is only the cash flow of a single currency right so there is no hiding of this function but in ATM if you have like for

example a RC 2007 20 so we need also to hide these functions so not only we need the data privacy but we need also the function privacy and the scalability is the the problem of the execution for the for the verification so if you look at some related works that handles these two so we can talk us about for example challenges exit games relying on economic incentives for example plasma so yeah so it's it relies on some economic incentives so the I'm not sure how it goes now in plasma but at some point it was like they have they're having an exit game and then the in you

know in a plasma chain if you want to retrieve your money back into the main that you start an exit game and anyone can challenge you so this involves some some economic incentive but in sex we want to to focus only on on cryptographic coves I know that it's one thing I know that like it is definitely like I don't know what we're plasmas that either for that but I know that originally and I think still true--but which is also mentioned there that's just based on economic incentives yeah there's like a game like you said cool so other solutions that relies on cryptography is for example multi-party computation so multi-party computation is you have a set of participants and then everyone each one has a private input and they execute a public function

but this power this function is public state so it doesn't hide these these functions so you can keep privacy or your secrets so your secrets and puts but the function would be public so there is a paper how and then you have also for example this recent paper by Benedict pews Zita so which is basically doing bringing a confidential transaction into each area so can be the transaction they were introduced in Bitcoin in new TX obeys a blockchain they will apply to member Wimbledon green or beam and to suit ammonia so but in in distributed ledger if you have

balance as the problem is yeah yeah you can feed the transaction what you do basically is a Podesta commitment where you have a value and then applying in factor and then univer just on the homomorphic the addition of those Podesta commitment in order to verify the equation and then you need some orange pros you know that suit to avoid the negative numbers but the idea is well if someone doesn't give you the blinding key so it will block your UT so but in a cerium or distributed ledger it will block the entire badass so Zeta is a paper to do this and also you have hardware in claims that are Intel SGX but is another problem so so about six so the can be the contribution goes this

way so they have introduced a new cryptographic primitives called DPC decentralized private computation so they in the first part of the paper they establish a formal language of zexal so we called nano Colonel birth-death predicates and second they have an implementation strategy so they come up with a lot of contribution with this regard so ZK smart recursive composition of proof and another thing is the delegated DPC so when you want to generate a proof you can delegate this book to some untrusted worker and the size of the transaction so if you have

in input and input it will be 32 times M plus 32 times M plus a constant that is a 840 so the I said 968 if we have a two to two input two output transaction so yeah so as I believe the the starting point of six was to extend the zero cash right so in zero cash how the privacy is handled on address so you have coins so fungible tokens if you want to talk more generally about distributed ledger so in order to create a coin you publish a commitment to this coin and in order to consume this coin you publish a serial

number of a coin so a transaction will be a serial number of old coins plus the commitment to new coins plus some zero knowledge proof that attest that the serial number belongs to some old coins and commitments presume the same total value so you do this with Merkin proof as in easy cash for example the idea is that you will have three parts Syria numbers of old coins commitment to new coins and some zero knowledge proof that access of the correctness of this transition so in this excerpt so they start from zero cash and they want to extend it so a coin would be this time of a code so this is just to establish a common language in sex so a coin is our equal so if a coin is a integer value

our code is some data payload so introduction in zero cash assyrian number of old coins this time it will be Syrian number of all the e-coat commitment to nui code and zero knowledge proof so that's an arbitrary function was applied to all the record in order to produce new area code so in zero cash it was only one single function which is the cash flow so this time we can so we want any any function to any function to be applied to new record in order to to to all the record in order to produce new equal but then the problem is if you want it to be any function so we want user-defined

functions so this will I'm a problem because we want the function to be private first and we want it to be permissionless which means that any user can choose any in the old coins and apply to them a new arbitrary function in order to produce new ID code so so this will result in a problem of isolation because we will have some for example some users that are dishonest that are malicious and they will use some user-defined malicious functions so how can you isolate malicious functions from honest functions so in the paper they have proposed some some some

solutions and they come up with their solution at the end so one of the solution will be just to to add to the sets of the enola truth to add a new zero knowledge proof that attest that the same function was used but this is quite limiting because in other words in other words these boils down to the fact that you will apply zero cash to every token so for example in if you have a our c720 LC 20 and then you will apply z cash to everyone because if you if you isolate functions in a way that you add some zero literal that the same function

is used so this for example you cannot do some some cost so can swap in a zero knowledge - so this was the first attempt and the second attempt is to do some universal function on the ledger so on the ledger you will have a universal function and then your user-defined function will be we will be inside the data payload so one universal function and data payload as a user-defined functions so but in order to to to execute different processes on the same ledger on the same execution environment

we need to share some salsa once again so this extra language re/code nanoka so which is a minimalist shared the execution environment that allows to execute different processes without violating the privacy of each so so so if we recapitulate every code will be the data payload plus so those what we call birth predicates so to create re code and then three decades to consume our code and then we need some some public input to to apply those days or

birth predicates so they call this a transaction transaction memo under and then private information will be aux input so for example if we take this example we want to do some some some some cross asset swap in etherium in a private and zero-knowledge fashion so we would create so Alice for example once once ten token a two to exchange against 50 tokens B so what she does is she created these disparate decades and in this transaction memorandum she says

that if some requirements are fulfilled for example if someone knows the secret that opens a commitment a hash functions well the atomic swap can occur so so those are for the timing just language formal language introduced by by is excess so if we calculate we have a record so those are the equivalents of coins but they are payload the data payload but not values we have a birth and death predicate so those are usually defined functions so super function but recall and we need some some public

input in order to apply those predicates so we call this transaction memorandum and then everything that is private still is called oxytocin inputs and also in the well in the in this section techniques they are talking about dedicated DPC dedicated distributed private computation I think we will talk about this more in details in next sessions but the idea is so we are doing so so proof that access to the correctness of offline computation so an offline computer so approve the bottleneck of a proof in terms of time

is the generation of the proof so in their paper they propose a way to to give to an untrusted worker the ability and the right to to generate this proof on their behalf without without having this secret without revealing those secrets so the leverages under my randomizer ball signatures are if you read the paper entirely they took no signatures and they extended it to some randomized about signatures but we will talk about this maybe in next session so if we continue through the paper so yes so as I said many contributions were

related to to to the technical implementation so there have been some challenges and they come up with some solutions so so those predicates those birth and death three decades they they are user defined so they are a literary functions so if you want to create a zero knowledge proof on a on a arbitrary function so you need some sort or whether you need a university case Knox so for example there has been this paper sonic but it is not quite production already for the time being or you will end up with a Z case like predicate so because if you want to put a predicate you want to circuit a circuit for this

predicate so so this will this means as you guys like per predicate so we agree that universal universality is costly so a solution is to do a proof of proof so instead of doing a general proof for every single predicate so a predicate is user-defined so so we will end up with up approved predicate what they do is they they generate a proof of line of those predicates and then on the ledger day there if you're a very fine the proof so this means a proof of a both but so so on the ledger we will have a universal

circuit for a universal circuit that is a verification circuit of a proof so I prove for example in Zack say they took the the state of the art he gets like they took GM 17 so yeah state of the art with the simulation extracts ability feature so they took James 17 um 17 the verification is 2 equations 5 pairings so it is constant size you have 5 pairing computation but if you want to do it in easier um you will end up with 6 pairings because if you want if you want to use the pay compiled in E theorem so you need all the element to be in the J 1 J 2 element so you will have occurring in addition but this is

not another problem so it is a constant so we can create a we can create a circuit that's very fysop off and then those predicates so in p-predicates and p statements we will recreate offline the proofs or them but if we look at the literature for recursive snog because this is what we want to do even if it is only one depth recursive snoc because they do not need to do a proof of a proof of a proof of a proof they just merely need a proof of a proof so if we look if we look to the literature so especially the PCT v17 paper so they leverages on what they

call the elliptic curve cycles so because the problem is so for example let's take the example of James 17 so the proof in you know or in any pairing busy case not the proof is a set of points on the elliptic curve so in GM 17 it is three elements so I put an appendix at the end where I I'm talking more in details about this anyway so the idea is yeah so you have a proof is a set of points on the elliptic curve so in GM 17 for example it is true element in the first group and one element in the second car so those points are

belong to to a subgroup of order say n and the verification is pairing computation so be linear maps they they take element in subgroups of order n and they output element in in an extension field P to the power K so if you want to create a circuit that does the verification so in the verification so it is an extension of P so it is a P arith metric but the generation of the proof so you want to generate proof of saw point of order n so the generation is arithmetic of order n so it will be nice if we can have this n equal to P

but unfortunately we cannot because so the explanation I've done it sorry so the idea is impairing based in pairing base in pairing base the elliptic curves in parent-friendly elliptic curves so we want the subgroup order to divide the field size power k minus 1 so if the Ville size is equal to the power if the field size is equal to the subgroup order so the subgroup order will divide 1 so the subgroup order will be equal to 1 but we want to sub order to be a large pipe so so yeah we cannot find elliptic curves that has if P equal to R and still paying friendly because

we can do if they're not paying friendly but then we will end up with an elliptical that has a finished race equals 1 and then we know some attacks like smart attack that's that's how to discrete log on in those anomalous scripts anyway so yeah so going back to their contributions so empirically we know from this paper BC TV that we can create some pair infinitely cycles so the the solution to this mismatch in a thematic is to to do up the to do the first poof on our on our curve and the second could proof on another curve but then the field size of one will be equal to the order of the other and vice versa

so there will be no mismatch all another solution will be to model the the earth metric in P by the arithmetic in n but this is costly because we will have a log be a log field size overhead so the best solution empirically speaking is to do it with elliptic curve cycles so this paper proposed a family of elliptic curves or Amenti form an empty family so it was the first family ever to propose apparently elliptic curves so but the problem is that they have an embedding degree equal to 4 or 6 so this is a problem because so yeah so this is the parameters of the curve so P is 149 bits

so if we reason about the the security of the curve so we will reason about the the impeding degree fall since it is the smallest one so the if we are 1 48 49 so the discrete logarithm in the far in the in the target field so once we won't be that hot won't be 128 so they they are not that good and that efficient at 128 bit security so in sector they come up with a new set of elliptical not that that perform well in 128-bit security but they do just merely a proof of a

both they do not need a cycle because in a cycle you need this the order to be equal to the size but also the size to be equal to the other the other way around so we will end up with a cycle and then you will all your two curves as much as you want to create a proof or proof or proof of a proof but in the excel we want all only a proof of opposed so we can be limited to find in an elliptic curve that has an order equal to the size field of the previous one and that's it and we do not need to file the the field size of it to be equal to the order of the other just a one way function so it is how it occurs as they call it a bespoke recursive

recursion or recursion of depth only one so so yeah so what one solution is to take for example an elliptic curve that is quite efficient at 128-bit so we know few few of them for example the elliptic curve will have on etherium so alt bien 128 so this is an elliptic curve that is apparent friendly and and that has 128-bit security so and if we look at the literature of painting based elliptic curves there we know a method to to construct elliptic curves that has precisely I know the a subgroup of order

R so we fix the subgroup order so this construction is called so this construction is called Cox pinch so so at the end in Appendix B I guess I I I gave this so how we can do this Spanish method so we know all this equation so this has theorem which means that the number of points on an elliptic curve is equal as the pair or is equal on the is equal at the fifth size plus one minus some for Venus trace that is between minus two square P and 2 square P an intuitive way to understand this is to look at shows

has elliptic curves so we have y square y square is equal to X cube plus ax plus B so imagine if you have so X is a is an integer between 0 and P minus 1 it belongs on F sub P so if X goes from 0 to P minus 1 and then you have to resolve the equation in in Y square so imagine you have one solution of this equation equation per X so you'll have piece P pairs X Y and then you will you will add to this the neutral element because it is not a rational point it is

in projective geometry so we you will have P plus 1 point but this jar but this is just an image in imagination when where you have one y that one y / X but if the quadratic equation has the Oh solutions or maybe two solutions so we will have people flip P plus 1 plus or minus some those equations so so this is what we call the four be nice ways and there are many other ways to define it but anyway it is between minus two square P P and two square P so if we raise to the power two we have four P minus T Square is positive so we will end up with this will with this equation

where D is a nun is a non residue so because this one is positive so in in Cocke space you you define you fix the the part of the prime R and you end up with an elliptic curve but if we look to this equation so we have T we have Y then we have T Square we have Y Square and here we have T and Y that's our modular air so there is no there is no so the the Q there is no way to think that Q wouldn't be equal to R square in terms of bits so the this is a problem because if we take for example BN

curved or so if we would take any elliptic curve that has a security never 128 so we want so the point of the field the pine field size would be 256 because we wanted to be secured to hope Allah algorithm or to baby step giant step that is in that has a complexity quadratic in P so so yeah so we will end up with an elliptic curve that that has a lot of bit but since in Cox pinch method we can construct pair in front the elliptic curve with an arbitrary impeding degree so we choose the

impeding degree so if we choose the MVD degree so we said that air that Q will be equal to sub group order will be equal roughly to the player to the part to the pine field size square or vice versa the prime field square will be equal roughly to sub order square so we will have twice twice much bits so then we can choose the embedded degree to be 1/2 DB the degree of for example BN curve so being of how have unimpeded degree equal to 12 so in Cox pinch we all we only choose an impeding degree equal to 6 because the the the the fine field is is

twice bigger so this is what they did in Zacks so they they constructed a Cox pinch energy curve over a beardless but not a BN nor a BLS 1238 so so if you if we go back to to see to look at so electrical that have are used in distributed ledger for the time being so in a theorem we have BN 1:28 and in in in Z cache after the sapling activation we have BL s12 381 so those two elliptic curves they have the same impedance we equal to 12

but the problem is is efficiency if you want to do a poll for off because the Spanish energy curve so we will call it the embedded elliptic curve so these embedded elliptic curve will have it is constructed in a way that the it has a subgroup order equal to the pine field size or the previous one so we can construct this i i've played a little bit with sage much recently and I've constructed a cox pinch elliptic curve over bien 128 so the the iam elliptical but it is not quite efficient because the P the pine field size of of BN is not highly to attic or in other words

the pine field size minus one is not divisible by a large power of two and this is a problem if you want to do some a fifty algorithm some fast Fourier algorithms you want to the the you want the the field to be highly to attic so you want it to be divisible by by a large power of two so in being curves or in BLS 1238 one that is used in z cache so both are quite good at pairings because they have a an in-between degree equal to 12 but they have a field size that not highly to addict

so this constructed elliptic curve will have a subgroup order that is not highly to hook to adding and then other guys from from success a so it is better to find another another elliptic curve to substitute BN or Z cos P areas rather than using them with with with an elliptic curve that is not that much highly to adding so what they do so what they did what they did is so so the the the proposed a new set of elliptic curves so the first elliptic curve is the one to substitute BN 128 or being

z cash so this is a beard s-curve so it has an impedance equal to 12 so I think that I yeah hey you said I had a question when I was when I was going through this you said you know the author's goes that instead of doing with recursive crude composition they wanted to do this proof of the proof and by using ox pinch this was somehow bounding recursion it wasn't immediately obvious to me I guess how how that was being used mostly because Cox Pence method was new to me did you have an understanding of how that method was bounding the recursion or Ori kind of how that proof you said was yeah yes okay so yeah very good

question because the bell the bound of the recursion is not related to cook speech but it is related to what they want to do an unbounded recursive or a simple recursion is when you have to edit tickers so let's say e sub 1 and e sub 2 they have subgroup orders R sub 1 R sub 2 and they have prime field size a P sub 1 and P sub 2 so a simple recursion is when you have R sub 1 equal to P sub 2 and R sub 2 are equal to P sub 1 so the the relation is going the other way around

but in a bound with recursion you need only one elliptical that's that is that has an order equal to the prime prime field size of the previous one and as much as I know I'm not very sure but in pairing based the families so if you look at I think I should do put the page the the references later if you look at the taxonomy paper by Freeman so this paper is a very good paper when he gives all those families of pairing pair in front the energy curves the to my knowledge the only elliptic curve the only family where you can press I the subgroup order is Cox page so this is why they chose Cox bish I guess not sure why I guess it's only I just wanted to

also say there's any other questions or anything else that people want to say they should probably jump in where are you at right now I'm trying to follow you in your notes I just shared the dog by the way in the group so that if anyone wanted to look around I realized that after the fact that that you are sometimes referencing things a little bit further down what's the third point you know if we look at the the section definitions techniques and constructions yeah I'm at the Third Point starting from the end from the bottom Coco yeah okay so I'm not sure if much you this answers your question

well I was just the question was actually to the group if there's any questions if there's anything else that if that's been sort of you've been thinking about yeah yeah so for for this stick I guess I need to I need to look a little closer for now for now I could also understand that my knowledge of pairing or you know how like why there he spoke recursion is different than you the other one for me this is all rather new just that seemed like like an important point that jumped out at me that you know just so coming coming more from the engineering side Anthony okay to think that's bounding recursion ought to be quite useful so talks okay sounds good so so you said

yes one quick little question I should well okay so okay this is a distraction of apologies so maybe it could be an email but um the one thing I never quite understood so when they make these cycles of elliptic curves there's they the effort has always been to try and make a cycle where both curves are pairing friendly yes and nobody I've never seen I've had some offhand comments that oh that wouldn't work or something but I've never actually seen and anybody try and do one where only

one of the curves at a pairing and you just do another's is it you just do another like a bulletproof on the other curve to see you attempt to verify a pairing pairing equations and a bulletproof which I know suck but then you completely hide that you never know no never heard discuss this with anybody or no but no you can't say that why this doesn't work by the way that's Jeff and Alistair so if you notice Alice's voice has changed that's Jeff you were there nevermind this is too much of a distraction

continue we can just engineer I did have a question a little bit about like this relationship between this and Sonic's because you that that one depth embedded version that you just described sound a lot like the way they describe Sonic's is there a connection there do you know well the connection is so this entire point of doing a proof for pool because universality is costly so instead of creating a circuits for predicate or you just create one Universal circuit that is verifying a proof that you have generated offline so this is how they they turn around the universality but if Sonic is there is an actual

implementation of Sonic that has been proved well yeah so we do not need this proof of foof you just do a universal circuit on the ledger and then whatever function you want to prove use you use the same you use the same circuit because it is universal but well it is universal in to some to some depth up to some depth because for example if you have if you generate a circuit that has let's say 1 million gauge you can prove whatever NP Statesmen that has less than 1 million gates if you go beyond 1 million gates you need another another circuit and then they have another nice feature that is that is updates ability so in sectional as well they are talking

about multi-party can be to generate the trusted set up in Sonic if you do not pull if you do not believe in this trusted set up you just take it and updated so it is updatable but yeah we do not need to over for if if we can work with Sonic's all right keep going then okay okay so yeah so we constructed our first elliptic BLS that is highly - addict with respect to both the group order and the field size so the BLS in zika's for example it is highly - addict with respects only to the go order

because well they do not care about the prime field sense in if even when doing a 50 and so in the excess they constructed a new BLS curve that is highly - addict with respect to both the sub group order R and the prime field size P so this is the first elliptic curve and then they constructed a new elliptic curve Cox pinch over this Vieira's so this is the second elliptic curve so it has so but but it has some limitations because as we said R square so the subgroup order square is roughly equal to the profile due to the prime field size so it will be tedious to do computations over it because it is twice

bigger so leave they did so - to minimize so they want to minimize operations of a of a Cox pinch in Attica so we have we have two elliptic curves we want to minimize the operations over the elliptic curve that is heavier so if it is so if its addresses privacy so if it is a proof of a proof so if it is related to those birth and death predicate so to those user-defined functions we want to keep private so we do the computations over C over Cox patients you see it is a proof of a poof and it is private and all other the

checks the normal checks that do not involve privacy of the user defined function so we do it over the BLS curve that has less bit so it's it's it's not that heavy as the Cox pitch so this is another optimization and then another optimization just like z cache did after sapling activation so they want to optimize is the NP statement so we have been talking about those zero knowledge proof for to prove that a serial number belong to some old coin and you know the opening to some commitments of new coins

and the same for equals but so those commitments are hash functions and hash functions so if you want a circuit of half that does that does hashing so you will end up with with with a huge circuit so you want to optimize the circuit you want to optimize those entry statements you want to prove so dialer Hopwood in zika's they come up with those PDS and hashes yeah so Peterson hashes so over Edwards elliptic curve so here again we need another elliptical so and it works and it works and if she curves so for example is you can they've called it joob joob and then they've done the same in any theorem over the being curve they call this baby joob

joob so this is a curve that has a number of points equal to two the prime field size so the same as our bounded recursion but it's not very friendly and they they define the Patterson hashes over so insects they did the same so they come up with so they have this being is curved they have this Cox pinch curve and they have created their joob joob like curves over both cox pinch and VLS so we end up with with for elliptic curves so here in this table so you have all those elliptic curves you have the size bits and so you have the embedding degree 12 six you have the two are the

city so the r minus one is the visible buzzer by a huge of of to so 47 so this is quite good 46 is quite good I think that in the construction they they chose only those that have these what we call the two a DCT or the two a DCT order so that is greater than 40 I think there is a way to do this in BLS curve because while impaired in front the energy curves you need a lot of a lot of requirements and the best way to to come up with a family of elliptic curve is to to change those requirements from integers into polynomials and if you do this with

polynomials so we will end up with with a family because at the end of the day we will evaluate those polynomials into all those integers and say finding one that clicks for example one that has those requirements you want or prime V prime integers etc so one way to do this is to substitute the equation of your polynomial with X to the power 40 I'm not very sure but this is how you can do this so in the notes so yeah so I have in this appendix just the steps in Cox pinch method so I wanted to in faces in this to say to see to explain that you will have a twice much bit but then

another thing is the complex multiplication method because in Cox speech method or in any other pair in friendly construction so you will at the end of the day at the end of your method you will just prove that there is an elliptic curve that has a subgroup of order R that has a PI field size P that has a phobia strace t that has a discriminant a complex multiplication discriminants d and while all those integers but then what is the actual elliptical so how can you write it what are the coefficients of these of this elliptical what is if you talk about a short wire start if you go what are the

a what what is the e and what is the B so yeah we need what we call the complex multiplication method so this is so this is the from the complex multiplication theory so we need to find a polynomial so we call a Hilbert polynomial a class of a Hilbert polynomial sub D where D is the discriminant we find the root and then well the the elliptical of parameters turn out to be 3 K C square what I think that we should maybe sometimes do a session about sparing from the energy curve construction but well you know in Cox finish method or in any pairing

baiis elliptic curve construction we need we need these complex multiplication method in order to come up with this a a and B so if we go back to the contributions of Zig sir so yes so this so this curve means that we don't need many operations every CPT to verify the thing depending on chain but how hard is it for the prover how hard is it fine what well the for the povo it is always it is always the same and the bottleneck in the Poe generation if we were talking about pairing base locks would be the the multi exponentiation and yes if you do it on on CP it will be

the universal bit the hobbit on CP on the bigger thing so i mean if we had recursive snot we basically do everything on the easy on the easy curve right well if it is not related to privacy we do it on the easy curve if it is related to the predicate we want to keep private we do it on the now is medical care yeah yeah because we are going to do a proof of opposed so it is private so yes and the the last point is yes so in Sector they are using GM 17 so the state of the art of painting based of pairing base marks is gone 16 but it

has this malleability that can be addressed in different ways for example slugs using no defiers but well even in Pinocchio we we knew about these this is malleability vulnerability if we can say this this way so they chose to do it with GM 17 so GM 17 has this simulation extracts ability features which means that it's not malleable so but it comes with a cost so the pouf size is always the same three points on the elliptic curve 2 on the first group 1 on the second group so and the verification English 16 is one equation with 3 pairings or 4 things if you want to use the Ethiopia compile and

in GM 70 it will be 5 pairings or any theorem it will be six banks so it comes with a cost of of of verification but I think we cannot do better than GM 17 if you want the simulation extract ability for example in ghost 16 in the paper well God said that what he proved that you cannot come up with a slug that has only one element proof otherwise it will be linear and so which one's work and he came up with three elements and as an open question he asked if we can come up with two elements but in GM 17 they prove that you cannot come up with like two elements so this is like the state

of the art on in terms of size of the proof if you want the simulation extracts ability so without in GM 17 or 16 or pairing basic as marks or what we call the pre-processing as you guys knock you want to be more general we need a trusted setup so yeah I trusted setup so we need this transcript so in GM 17 so yeah the the they are doing the same as the cache so a multi-party computation where everyone adds to these secrets so for example the powers of tow and well as long as one of those participants gets rid of of his secret so yeah

so it works but I think sonic would be a nice uh nice thing to to think about if you if you want to do offline computation yeah this is Amit always I'm always stuck like stuck on it's like when do you do that and how often do you actually have to do it like in the bill that your sis is proposing without Sonic's without Sonic so yeah so you need a trusted setup per circuit so for example in Zika they have always the same circuit which which verifies those ZK piece that's are the salient numbers belongs to these old coins so you need a miracle proof path authentication you need the all that you know opening to

commitment of new new coins and then you need also to to verify that the total value holds so if you if you are if you are doing to input coins to out sports coins or two inputs or equal to a sport or ego you need to verify that's a plus B is equal to C plus D so this is one circuit I'm not sure how how many gate it has but it is always the same circuit and it is always the same function that is the cash flow of the single currency but in general in zero knowledge on the easy case lock if you if you need to to verify a new thing you need to create a new a new trusted setter but in Sonic will just create one trust sets it up

and then as long as your function has less gates than the trusted set up you will always use the same circuit so yeah and then in the note I've added those those appendix where I explained maybe a little bit more in details so the recursive stuff that's at sorry at the technical terms so as a math human shed so we are not doing cycles this boundary question we are doing chains so cycles they overlap so you have for example a two cycle you have two elliptic curve so

you relations in both ways so if for example if you have a three cycle you will have three elliptic curves so one two three so you have a relation between one two between two three and then between three and one but the technical term if you want to say is chains so we have a relation between one two and between two three and that's it we do not overlap so here we are only reasoning about two cycles or two chains so two elliptic curves so a cycle is a relation between 1 2 & 3 1 2 1 and a chain is all on the relation between 1 & 2 so one way so it is a bounded recursion and I yes I think that's it on my on my side there is a

github called easy Factory for Matthew you said you come from engineering so there is a sage matt repo where you can't play with those elliptic curves you can constructs Cox pinch you can construct MNT curves and then you can play with them if you want to understand this more or for those who want to understand this more in mathematically speaking so yeah so there's a lot of literature I guess I I haven't had added the references yet but I should all those papers I mentioned yeah the fact that we need we actually need one custom peseta application the person desk

Erica yes we need a trusted set up for decades but this is this will be like offline but what we do on the chain so I think this is some term in the paper they call it a master circuit or a master trusted setup so if you remember we said that if it is related to the user-defined function so if it is related to the privacy we do the computation over Cox page so it will be a proof of above so a proof of a proof is a circuit that does the verification so it is the same circuits so we need only one trusted setup to do up move of up off because it will be always the same verification the

verification or Jim 17 whatever the predicate is is always these equations but then those are the checks that are not related to two functions yes you need a trusted set up but those is not meeting you trust a set up later for that for when you want to use something there are set of applications can't be too big unless we want to do a lot of trusted setups well it's up to the users so if it so the idea is we have a universal trusted sets out to do proof of proof so for those birth and death predicates and then other checks it depends on the application we we are talking about so maybe there is no other checks rather than the predicate so it

depends on the so this is form a theoretically point speaking based on this exit paper but we have to look at the text for example application or maybe the atomic swab or maybe the stable coin 5 at sea privacy so maybe we will see more in details if we need those those additional checks or not that was a very that was a lot that you just got through in an hour so congratulations that was a very that was a feat I would say but I think because the first part of the paper was pretty much everything right well maybe not details but yeah it's sort of the

overview I'm wondering is there any other questions or anything because like I know that one of the co-authors is in the group and he was asking if we have any feedback or any thoughts yes I had a question that's fine sure sure you said you said the verification is always the same which is then he said that you basically have a single circuit to do the proof of the verification of the proof of the proof or whatever it is I'm just wondering when you have public data you when you have a when you're verifying a snack that is that includes public data then you have to include the

private public data in the verification you basically complete the proof using the public data does that mean that the permissibly as it were complete there will be no input by the verifier as you know I insert the public data at this point or something okay I've got your point so yeah so for example if we if we take if we take James 17 for example verification yeah so this is the equation of the verification so those also PI sub a PI sub B and PI sub P sub C are the the proofs and VK Delta V K gamma and VK alpha beta the verification

cases that are points on the elliptical and this X is the instance so yeah it depends on the the public input but what we want to do is a universal prediction per application so if you want for example to do a Dick's it will be always the same verification if you want to do private atomic swap it would be the same verification so so to my understanding by may be armed but yeah the idea is so yeah you're right it is always this verification key is related to the instance so you need if your public input so you your instance changes so you need to change

these verification key VK subjects or do you yeah that's fine I was just looking for the third button Thanks oops I forgot I was muted yeah I had say just talking to myself there do we have anything else we wanted to bring back to produce any other sort of thoughts so far I guess not only okay cool well I

think we're we're at time I wondered how did you guys feel about this did you get something out of it like I I it's interesting because there's no way I haven't seen anywhere where you can actually see such a detailed walkthrough of this paper and this is helpful definitely yes I think the only video that is available on YouTube is pilot video and he are the only presents the used cases you can like very very very overarching yeah this is detail that's not that's not really in the paper you have to sort of chase it all the references to get this yeah very interesting you - they're nice to see it cool so yeah I think you said

this was really great to do um I think it would be cool to do I mean we our plan is to definitely do three do you think three is too little do you think we should actually break it down further or do you think we could do it in like another - I think what we haven't covered that yet is the delegated DPC we haven't covered that yet and we haven't covered also the the the use cases so Dex five atomic swaps table coins and yes we also if you want we can go through more in details these are occurs bounded occurs recursion and all those details but those points we haven't so I cover

covered them at all so delegated PPC and the use cases and you also mentioned the the elliptic curve because like what is it constructions and just like that in itself could be a session maybe it was maybe not part of this but it was just kind of a point of takeaway for me yes III think yes this would be very interesting if we can have like a session about elliptic about elliptic curve construction in general or about pairing based elliptic curve constructions I wonder if we might want to look around for something like that for like a class or courseware or something because it would be cool to see that like in a broader way yeah

I provide some interest in that because I had a distance I heard someone saying about you know the code of protocol project oh it only spent you know so much CPU time finding their pairing and I could only take that really at face value because I don't quite know how to do with the curve pairing or or what are the pros and cons or how do you even solve that if you're just you know exploring a space of paired curves so maybe that even turns into a bigger seem for us but doing doing a beginning of that would be would be really good sounds good alright then so I'm gonna shut down the

the live stream and I just wanna say thanks to everybody and thanks again yousa for for putting this together it was really cool I'm excited to rewatch this video too because there's some parts for it's pretty dense and I'm gonna have to double check him uses thank you thank you sis like Joe