ZK Study Club - ZEXE reading pt 2 (of 3)

Transcript

okay so I think there we are I want to say welcome everybody to the second sexy study session I Yousef is gonna be again leading this one yeah and I'm excited to see what you have in store this this particular video is gonna cover the sections from page 25 to page what was it like 40 45 I guess 45 okay nice cool so why don't you take it away yourself okay that's done okay so yeah as you say this is the second session so maybe we start by recapitulate and what we covered in the first session so and then we will cover

the pages from 25 to 45 so your you start Yousef one quick question do you have notes or anything I will I will type them down after the session and then share them good so I think what we maybe we'll do then is follow along with the paper if we have it or okay sounds good yep okay so I can share screen and then I would have to pay possible okay is it see is it working you can see ok I'm gonna meet myself now okay okay so

so yeah we will be talking about 60 paper so this paper is written by people from near from academics so from UC Berkeley John Hopkins University Cornell Tech and also from from industry as well the question so the first session recovers from page 1 to page 25 so we we talked about the introduction the techniques definition of the new the new scam they have a post called DPC decentralized private computation and the construction of this DPC today we'll

be talking will be recapitulate it's an allure what we have covered because what what we did last time was an overview of all the paper but because these first handful pages were basically all the paper but then the next sessions goes go more in detail but we haven't covered yet delegated DPC how do you delegate the the generation of the poor to some untrusted worker and the application and then implementation strategy we have talked about this but maybe not pretty much in BJ's so so yes so just recapitulate so sexy is about doing

offline computation and upload a proof of correctness of the computation so the proof would be a zero knowledge pool a Saxon geo Nolet pool that has a constant size and cast a time verification so they do this by introduce a new tracking parameter is called EPC decentralized computation and so the main point is to address two of the limitations of the blockchain or know about that's our scalability and privacy so the starting point of of zig say is to extend geocache protocol so geocache protocol as implemented for example in Zika is

being it is production for the time being so but it is working on you on on some bits on bike blockchain so you have a coin so I have tangible token a coin and you know that to publish a coin you publish the commitment to a coin and in order to consume the corny published the serial number of a course on the action is basically a serial number of some coin or some old coins and commitment to new coins and some zio knowledge clue that everything is okay so that the Syrian number belongs to some old coins and the commitments preserve the same total value so no coin wire were created from

impact so you know although to extend this in six so a coin is is now a hurry code so we need to to do the same protocol for example in ethion multiple tokens so we reason about values what's about Taylor's alicorn is are equal just to establish a six people a transaction is a Syrian number of some all the record commitment to some new record and zero knowledge proof that some let's say arbitrary function was applied to the old record for some new icons Carina but then the problem is if we want the functions to the

user-defined how can we preserve the privacy of those functions those are fine and I mean be permission list step that means that any user can choose any all the ring code and apply their own user-defined functions on them to create those new echoes so if we can do this the problem now is how can we isolate malicious functions from honest functions we can add a zero new let fool that asserts that the same function is being used without saying what is the same faction but this is basically boils down to having a zero cash for every

token so this has a lot of limitation because basically what you are doing is you are doing a zero cash for every token and you cannot benefit from from interoperability so for example you cannot do cause costal can swap for example so so in the paper they established a common language so II called we've seen what is an iPod so and the solution to - to this problem we have evolved is to have to to incorporate those functions those

user-defined functions into the data payload so you will have a university function on the user defined function incorporated within the data table so so as a kind of language we need a mono camera so this is some sort of a OS an execution environment operation system where we can we can process different transaction different area codes without value rates and virus of age so the recall will be the data payload as before but in addition to this a birth

predicates so to create the recall at the three decade to consume the decode what they call to his action memorandum which is the public input to those predicates and auxiliary inputs which are the private input to those predicates so this is what we've seen so far re code is this set and after this we talked about challenges to implement this and how do you do this this universal function and user-defined function so basically the solution is X was to do approve of a both so so we've seen in the literature recursive lock so

so those you know that we are talking about now is so the choice is XML GM 17 so those are pairing based pre-processing ZK stocks and we want to do recursive slacks we want to do so there has been a lot of research so this the paper in 2015 scaleable zero knowledge it had used a new way to do this with cycles of pain friendly energy curves because typically as we said the problem is it's more about implementation because when you generate approve you generates points on the

elliptic curves so those points belong to some subgroup let's say of order n so you do some computations of arithmetic n but then when you do verification those are pairing based ZK slots so the verification is basically pairing computation and things are billing earmarks that takes two points from two groups that have the same order on the ticker and outputs a point output an element on some on some finite field okay so this finite field has no equal to some to some to the file to the size field of the of the elliptical not the subgroup order which are different so we

have an arithmetic mismatch because so then we generate the proof admitted let's say and we verify the proof of an arithmetic let's say of all the an extension of order P so the problem we have a mismatch so there are many attempts so the first attempt is to have an elliptical that's half n equal to P so this will be perfect but unfortunately there are no parent a parent friendly elliptical so analytical that can do pairings that has this criteria because typically in appearing not really if you want to talk more in

details about those pairings or we can just move to further 1460 I mean it's almost it's almost getting into the section 7 of the implementation strategy because you know again it gets broken down gets broken down there but I think we covered it pretty well the first time okay I mean maybe I mean was there anything else you wanted to cover from the first session because maybe now would be a good time to ask what questions people had from reading this second part of the paper and then we could start digging into each of those okay cool so then so then yeah we could open it up to to the group who's on the

call today you know how how is it how is it that you found this second section of the paper do you have some open questions or some particular points that you wanted to cover today I know I know at least for me I wanted to address a little bit about this delegation to the untrusted worker where's you know when so of course it was one of the it was the the biggest chunk of this part at least for me but when the goal is to use this you know randomized to address this this randomized public key you know I'm also starting to wonder unless it's being unless these workers are operated in a benevolent model you know how like words freon's infrastructure how is it

that an untrusted worker is gonna authorize someone to ask it to do any work or you're gonna need to you're going to need to know like a trusted pool of workers when you're on your mobile device and you want to ya delegate that work that's seem to be you know it's like really good privacy proof preserving but maybe that's just another layer because it seems like like a mismatch unless you're just expecting that infrastructure to be available okay maybe before you I think the idea here is this if there's any other points because I think you're gonna you're gonna go through it right like Yousef you we're gonna actually like go through a little bit more detail this section I think that's what you had prepared yes exactly I wanted is just to recapitulate

what we've seen on them I just ask if you want to talk a lot more about paying basically so that if you have any bit is not like the main topic in Dixon yeah so I think but I think that the idea that Matthew had here is that if there are any other points that have come up maybe it's good for us to hear about it before and then while you're going through it you can sort of highlight where that is potentially mixes but so were there any other questions or Alistair did you have anything curious hi Alistair by the way hi hi yes I'm still reading this section of paper famous last words yeah all right well I guess if there's

if there are any others like if there's anything that comes up as we're going through it I think it would be good I think we didn't really say this last time but we started to do it anyway but if we did like a few of us jumped in when there was like this parts that got a little fuzzy and I think that we should feel kind of open to do that again this time so just yeah so Yusef I think if there aren't any other questions go ahead okay so just to put a context into these dedicated DPT so that their solution is XA is to do a proof of opposed so so you have like a universe function and then you have user-defined functions incorporated within data and we need to do a proof of a pause so you

do your zero knowledge proof of chain and then we do another proof that proves your proof prove that the quietness of verification and you upload this second form into the legend so there are other challenges we've talked about how you can do in cursive snarks and so stuff but the problem is if you want to generate zero knowledge proof so you have weak devices so so if you are familiar with the widths marks for example so whether Pinocchio DM 17 across 16 of Sonic so to generate to prove the bottleneck in the generation is the

domotics pronunciation so we have a city of witnesses you have a set of evaluated polynomials in some secret points committed to some political basically points on the elliptical witnesses and then you need to compute so if you have witnesses W sub I and you have points if you need to compute some WI times so so there are like we do not do it the naive way the straight way but there are algorithms to do this like both coasts or pippin J are implemented in the cache after certain activation so but the bottlenecks is the generation of

the pool because of this Multi multi position so what we want to do here is this DPC decentralized private computation scan we want to Billie gate the generation of the Pope to some third party to some work but the problem here if is if well the my approach would be you give the worker all the information to generate the proof on your behalf but you do not want to do this because all these information includes also your secret key because the serial number is somewhat a function of your of your secret so you do not want to do this another approach will be security

negation but it is always the same the same idea wherever the protocol is when you do computations with your secret info and they do you want to do to delegate this computation to some third party without giving giving them the permission to spend on your behalf for example the idea is what intuitively is maybe to have some ephemeral keys it's a matter of security so for example a similar similar similar problem is monoblock chain where you have you have confidential transactions but then in

order to know if the transaction center to you you need to scan all the transactions but we want to delegate this scan process or third party but know that you scan need to get to give them your secret key but you do not want to give them your secret key so you create an ephemeral key all what they did what they did is you create two sets of keys so some DUI keys and some spending keys so this is a little bit the same idea but this UE is the light on the spending so the solution is X is to sign the transaction so you give the information to the serial number for example you give all

the informations to the trusted worker to generate the proof and then he gives you the book of course you verify who but how can you be sure that he doesn't spend another other recourse on your we have without your finish so you sign those so the verification of high of a transaction before was only the verification of the zero knowledge box so that the same total value is he those although in code can it smells Syrian and does not exist those commitments are willful and that he verified American three paths etc now in

addition to this we do all of this but then you verify also the signature but this is like somewhat a simplistic solution because if you sign the proof and then all the notes on the ledger verify that you are you indeed sign the so this is basically a signature scheme where you sign with your private key and everyone verifies with you public key but the problem is it's violate privacy because well it's violates the link ability because you will always verify with the same public key so here is the idea of randomizing keys so instead of

of having like FML keys we have some sort of a finicky but in another way so you sign with our demise key so now the Syrian number so if we've covered this before the Syrian number is function of some unknown pseudo-random function now the the signature so yeah if we see for example those randomized randomized ball signatures so what what we want to them to achieve is so you have a public key you derive from this public key another public key that you

cannot link link link its back to the origin one and the same way you have a signature you cannot link it back to the original signature so this is logically the unlike a link ability so given a public key and the door is public key cannot link them back and existence exists finish an affordability so this like some strong notion of unfortunately unfortunately unfortunately require in all the signature schemes where you cannot fold and there's some public key a signature but now you cannot fold under a public key or any and demise public any derive from the key cannot

fault the signature and it is injective mathematically speaking the randomization is injective which means that computation elite cannot find collusion if you have the same public key and you derive two randomized public key is given to different salts through different random numbers you cannot find the same the same derived public key so it is only injective right so you cannot find collusions so why we do this so as a saline number now will be a public keys are on demised public key and the random the salt used will be there these pseudo random function so the old Sharia

number and the user will sign the Pope and the randomized the signature so now the sick list explosion was only to sign the transactions and then scientist was actually and verify them with the same public key so this five units the ability now you will sign them with randomized public key so it will output a randomized signature so you cannot link them back so but then the question is yeah everyone can verify the pool but how can you how can you prevent double spending well this undo my signatures

are deterministic and we said that they are in objective so those public keys so that those public keys those there are public keys those on DeMars public it will be different if the random is very time different so I'm basically the the serial number is this undermines public key so which is deterministically in a deterministic way we we are sure that there are no double spending so this is what's the explaining in section 5 and then an extension of this section 5 is is 1 5 points for where this is now

implement this is now implemented but it is an idea you can do three short signatures or blind signatures on official transactions or blinds in a transaction that boils down to using three shots in natures or blind signatures the idea is threshold where when you have a pool of people that's require worker to trade proof on their behalf and then he generate the proof give them the proof and they push the probe to the interaction with the signature now if you have a pool of people you can say well I have a proof of five people but I only need three

people to do this to to sign so you can do this or you can for example sign on some blindly proof you do not know the cancer it depends on on the use case so I don't remember what you say that they they propose but official it is always a good idea to split the security with the security amongst mini Castilians so if you want to understand this more how its works we have to go back to go to the appendix was 8 yeah well I am I don't

find the appendix but the idea they use small signature so I think then you're looking for page 51 it's yeah it's this one one this one okay thank you yeah it is it is appendix P so so there are many papers that do under my suppose signatures they have chosen to to modify their that's most natures oh I think you know what are smoke signatures they are there like ECDSA signatures what everyone is usually CDSA because it's no unfortunately we're patent but now there are fairphone patent but there is not be IPR Bitcoin improvements proposal to use

snow in nature instead of ECDSA meters for many reasons because well the security proof of ECDSA is not very clear because you need to link x coordinates of points with points and snow signature is pretty much straightforward and security Bob is clear and yeah you can do a nice stuff with no signatures for example we can do natively multisig nature so this is why I think for many reasons they've chosen snow signatures the only modification they they've done is well this honda musician is basically

Acadian our key derivation function so there are standards to do KDF the you have a public key and you want to create another public key that you link it to your public key giving some random so the idea is a public key is a point on the elliptical is no signature so you have a secret key which is our random point an integer integer and this integer times the generator political is your public point is your public key which is a point on the elliptical now what you do is you add you generate another point that is some salt times the generator called the drive key will

be the addition of the public key your public key and this random key random point you are generated with children integer times in Jeanette so I'm talking in terms of addition and multiplication because I'm I'm talking about the go p-- of elliptical but if you want to be more generic so yeah it will be exponentiation and multiplication addition you substitute the addition by multiplication and the multiplication by exposition what I prefer to look at them like in terms of elliptic even if it is a little more specific so this is how you you want boom is a public key and how you undo my the signature you have to look at how how to Signet how the

snow signatures computer so the snow signature is basically this so it is the scree shine still working yeah okay so so the signature is this so so so you have your public key so you have the message so you create so you take an integer random integer you create so let's say the commitment of these integers or G to the power okay okay and RH is hash function a collision hash function

so you hash the message concatenated with ru camp you to be here and the signature will be so this and integer minus X which is your secret key times this hash and Yahoo will be s and E and to verify it it is pretty much straightforward so you need only to compute this RV which is you commit this first part of the secret key so the generator point and use the public key power this second point and you verify after hashing it that it is

equal actually to e so and in order to make it compatible with with the randomization so as we said the randomization of the public key is here so you just what it is in the paper it is in terms of multiplication so we will just stick with it so you have a random point you have a random integer you committed and you do the multiplication so this is basically a public key and you multiply it with your public so on the door and immunization of the signature is minus e times R so you can do the computation on with a pen and paper it is very easy to verify it is

minus here you know that so that's the verification is always correct giving this randomized public key and the sound of my signatures so whether you are verifying it for the same message so whether you are verifying it with your public key and signature although under my public key or signatures which is always the same verification and those terms you have added he and he they cancel out each other in the verification so this is how they do the delegated part so it is it is important if if you are running a weak device and

and you do not want to do the probe generation because it is costly so you can delegate this to some to some trusted worker but then since we are talking about privacy you do not want this trusted work to spend on your behalf but only to generate approve because if you give him all the information to generate support so he can generate another pool that's kind other he code without your permission so the idea is rather simple the implementation it uses like doesn't use like normal people Rafi such more

signatures and randomized randomized above signatures you know how to do how to do them but the the use case is pretty it's pretty interesting and the idea is always the same if you want to delegate some process that means that require some private input in whether you do some ephemeral Keys or you sign you sign after after the after the third party that have done the work so one one question for me at least for me that's you know randomized double signatures or randomized Bowdre I says that was

something new for me I hadn't come across that before do you know do you know of other places where that's used or where I could go looking for for more stuff like that because I found that yeah I found that new and also quite interesting ok so you've seen on the paper they have some some works not to undermine suppose it nature that links the specification yes not many ideas exit paper actually received a specification yeah yeah and a bunch of the links for you know this has been

deployed was related to this not going update from Zika I think yeah yeah although I can say this but I don't know if you guys heard the podcast episode we did we did with Sean but he was area you very much downplayed his role in this paper so he said that it was more like the work that he'd been doing on sapling became very useful so a lot of it was used in it but he wasn't necessarily part of the construction of this so yeah I don't know if he's just being humble because he's pretty humble but yeah so make no more don't be the relation but is there anything else I think that's actually a really good

question figure out just so we said we trust the yeah with everything I don't know maybe if anybody else on the call is heard about this I mean it's more a question Oh too because also by the way at Matthew can you hear Alistair Kenny I can hear him caught from times it's time my word shall I say something is this me can you hear me cuz he joined after me I think you have to join again he's just answering that and I can hear you guys make Matthew will be back he's having some of us weird sound things funny made Alastair what were you just saying umm so yeah that this one device again she thinks that the interesting but what I'm interested in here is what

do it so we trust the untrusted worker with everything apart from privately so are these pirates keep just one more day off so he particular he knows all the secrets just not how to spend this token yes but every time he wants to deny it approve it will be with some new some new Syrian numbers because area numbers are being those are no - public keys sure Matthew are you are you all good now I'm

sorry if I talked over you allosteric I have a I have a funny browser bug that's fine I think all right continue okay so so yeah they do this with snow yeah just formatives so this is a link for one of the randomizer ball signature that are not snow signature for example I think it is yeah this one which is a paper form 16 yep yeah just just sorry because this I need to understand a little bit more about the mechanism there because as you've said you know the serial number for the records that

we're creating is being derived out of the key pairing so when we're randomizing still that still that's gonna be verifiable but then I had also kind of reread my notes from the first part of the paper where it wasn't clear to me if this was meant to be a Bitcoin like Bitcoin style setup where addresses as addresses are meant to be disposable and used only once and then when I read you know how how this randomization is happening it was unclear if that's meant to be you have kind of you know an address that's long living and so you're possibly doing you know many rounds of transactions and you're delegating it so I don't know if I I don't I don't know

if that's correct or not like I just I still had a big question mark on top of that where if it was only so that you can do delegation or if it's because the addresses are going to be long lived for you I think it is only to do the delegation because the the public key is called in the paper P sub sig a public key only power coordinator and the idea is you sign with a secret key that the worker doesn't know so obviously when you give him the information so he has all the information but you have to create another pair of keys to sign that he doesn't know and in order to address this link ability problem you do the randomization so that every time which

will be another pair of keys another signature so the the signature is the signature which verifies that you had the the previous token disagree well the signature is is like independent from the portable you do the protocol as the plane DPC are in the plane decentralized by a private computation but once the pool the the worker have created the proof you just sign it with a la with a key so you can do it with a new key but the problem is if you sign it every time

with the same key so every time everyone will verify it with the same of my keys so people we can can link on the ledger that this function where does this PPP say come from I can't see in the algorithm exactly what's in it where is that I can't see in the in this specification exactly what's in this PP sick which makes it a bit tricky to occurred M can you page where the PPC paper and it certainly pays in you see it's public information yes so which public information and what determines

it okay okay so so what what they wanted to do in the paper is to propose a scam randomized about signature that is January so generic so when you define a signature you need to define a signature protocol you need to define those steps that are initial initialization key generation sine function and verify function so in the initialization so for example if we take the specific example of snow signature so this PPC will be the generator point on the elliptic curve so the generator

point of the reticle G so we are working on the same elliptical so the elliptic curve we will have for example as well the hash function so we have to agree upon the hash function so this PPC is just those public informations in order to do the it's the thing that everyone uses is the thing we get from the setup that everyone has okay exactly the thing I try to work out here is where do we where when we sign this does the thing we're signing her why is it that only the person who actually owns the thing can sign it sorry Sam I can so see the setup here is the year the the person is

delegating to the DBC who gives all the information for this proof he's the only person that can sign it and that means it must contain something it's most concerning the serial number so but but the problem is it is on the ledger on the majority we have an additional verification so the additional verification is the verification of the signature so even if the worker puts on the blockchain a proof that he has spent some all the records on the behalf of another one the ledger wouldn't accept the the pool unless he verifies the signature and the signature can not be forged by the

worker because he doesn't have the secret key of this spare key is called PC and paste PC the public key signature and the underlying cigarette game yeah it doesn't have this piece SK sigma-i right but that's yeah but what is it the bet is that this is verified against well it is just a verification it is just a signature verification when you sign some some content some message you need the message and the public key and just verify that this message were signed by this public key in in our scam the message will be the power of itself

so you will sign the proof with your signal key right but it has to be the case that only you can sign this pre-pre free to be verifiable yes and you're the only one to have the secret key that's because and because all the information are available actually accepts of the secret key and the public key is also available when you you consume when you when you consume your Rico you read the serial number and the serial number is the is actually good public key

there are numerous public anger so everyone has this randomized public key to verify the summation so so before the serial number was just up to the random function of some neurons now it is actually a public key so you have a serial number and you verify the proof against this area number so the idea is that given for example if we take the function initial that verifies the signature is its computes a function that it's compute a public key and you verify the equality equality so this is

this will be the same you the verification is computing some some public key and then you verify it against the Syrian number that is actually this public key that signed the message which is the problem I'm not sure if if I am clear but anyway the signature is always a message and the public key this time the message is the proof and the public key is the serial number of the recording concerned you know yeah I mean I I have a similar question this is this is why I'm curious

about this mechanism of randomizing an address because I guess we're looking at page 27 figure 10 you know is the short version of it and then in the appendix B it kind of opens it up larger where so we we have our public parameter sig coming in with the transaction and the sni and either the witness alright sorry either the taxi or the proof along with the signature but when we randomize we've actually changed that signature so we got like the prime of that but also also the PK has changed for when we go into I guess this is shown better in the

appendix B where was that on figure 21 on page because I guess their guess there we have we have the public parameter of the sig and we have the PK sig but that's the randomize one and so is that and we have a message but then we also have the signature and that would also the signature prime correct is that like is that how it's is that correct is that how its balancing like that PK sig and the and the and the signature I forget my Greek letters today and is that I don't know is is that the correct low or have I made a mistake there yeah the whole point is

given a public key so piece a and the signature you verify anime set and with the same message if you derive the the signature under you derive the public key with the same unknown you can still verify the same message so you either have a signature you know or the public key you still can't verify because in the in the derivation process in the mutation process those elements you have added they cancel out each other in the verification and even in success so the the public key so you have a public key and you there are you randomize it and

when you randomize it you have a new public key and this is the serial number this is this area number you push and when you vary when you sign the proof you sign it with this under my signature so you sign it with the secret key that is linked to the serial number so everyone can verify with with the serial number because when you consume recall you publish the serial number oh right because we did the randomization before we sent some data off to this you know to this delegated worker and then when we get that back we signed the whole thing with with the randomized private key that was associated to the public

key that we sent off right yes exactly okay yeah but technically the secret key will be the same whether it is a random key whether it is a public key or undermine public which will be the the secret key will be the your secret key plus desandem elements you add you added yeah because if we see in 52 52 paying you to in one same here so the public key cig is actually j to X so this J to X plus R sub sick so the secret key will be all

sake plastics so you just factor factor with with you yeah okay so more question looks good okay so yes what we haven't covered yet these may be the the applications I guess yeah section 6 yeah sector sensor so what I wanted to do when you know it

capitulated is to talk about section section seven before because this this is basically we covered this in the previous session and so we do want to do it before the yeah applications or maybe because the application is just given examples for those birth to a decades and death three decades so maybe one more concrete I want to be I think we're sort of running out of time so I wonder if we may have to break at some point and basically just hold this for the

next one what do you think I mean what do you think would be really good as prepped for the next one like you think we should do seven first but do you think we actually have enough time to do seven I think that's this time we've covered all the paper because we've been going back and forth appendix and and all the sections and even in the previous session even the first handful pages where overall overview but we have been digging more in details so what we haven't done just yet the applications so maybe because we are on out of time we will talk about the implementation

strategy because we have seen this before and then I guess for the next session we can do the applications and got some Foods in the oil burner let's do that and then let's let's wrap pretty soon because I'm gonna actually have to jump I don't know about other boats but okay sounds good so just okay so the implementation strategies so as we said the universality is expensive because what we said that we incorporate those user-defined functions so data payload and we will have a probe of a curve so we will create poops off line for your predict a bit and then you create a

proof that verify those proof and you upload only this second probe into the blockchain so you will have like only some Universal circuit that's verifies a proof of a pole so it will be always the same thing but the problem is universality is expensive so the solution is to do incur serfs marks recurred recursive smog verification but recursion is expensive because as far as I know empirically the only practical way to do this using cycles of pairing friendly image occurs because as we said

we do not have analytical that's how a sub order equal to v articles one that have a subgroup order let's say n and the other one has a slinky and then you create analytical that n is equal in a way that n is equal to P so there is no arithmetic mismatch but the only cycle we know is the one used so the one produced 2015 scaleable zero knowledge proof and it is being used for the time being in Kota protocol to do constant size block chain so those set of ellipticals are called a plenty

elliptical so like first family of 10 ability curve but the problem though the drawback is is that they have an immediate degree equal to 4/6 or in other words the security if you want a good security for what 128-bit security political are not quite efficient because the parameter will have to be here to have to increase in order to meet this security so six regard said that in our scan in our DPC scam we need Melanie approve of a poll so we do not need an infinite

recursion let's say we need only a pound at the recursion so they come up with so because recursion is expensive so the solution is tail outcasts so they come up with us new sit off ellipticals that do this so you know instead of having a cycle so a cycle where you can all mini times you wanna do you just need to do a chain so just create our analytic curve on top of the first one and that's it so the the first I do do we well initially since we are doing doing offline computation for each area unlike

blockchain let's take this elliptical so it is all to be but I think they have constructed Ichiko it's not on the paper but you can do this with the same I constructed this embedded elliptical over BN myself but the problem is it turns out that is not quite efficient because in snarks you need to do polynomial computation for interpolation and to do this you need fast Fourier transform so you need the order to be divisible by a large power of two but unfortunately the field size of this BN curve that will be the subgroup order

of the next curve we are looking for it is not divisible when it is not divisible by a large power of two so it's not quite efficient so what they did is they created a new energy curve DNS that is that is highly visible by a large power so we respect to both the fridge side and the Sun rule because of its I will be the sidewall of the next curve so they created a first cool curve a second curve so we are the key in the cox pinch method but the cox pinch method is costly because the size of the elliptical grows so by a factor of two so if you need an elliptic curve to have

a security level 120 128 you need a size field of 256 but then the curve that you will generate will be x 2 and the other one x 2 so it goes so we have our good curve on the bed curve efficiency so what they do is the splits relations act out the curve so let's do not forget that doing all of this for privacy issues so those predicates that are related to privacy verified in the dead curl but all other checks knots do not win 8 to 5 se are verified on the good curve so this is one of their solutions but then the problem is NP relations

have many checks so yeah so the checks were talking about our commitments and hashes so this is like work for the cache so for example sha-256 a huge circuit so what they did is they come up with those peterson hashes so they constructed a model it occur over the elliptic curve in the shape of edwards so it is a special oolitic special shape really quick and what has complete formula so which is we do resistant to side channel attack for instance it is

another subject but the idea is they have two curves to a good curve and the bed curve and on top of those curves they have constructed to it was curves so just like Dyer are constructed the Jubjub curve if you have heard about so to do pit or some Russians we have four curves and then the last problem and in this section is is sharing information between in PNP relations is costly so yeah so instead of showing the information they share the hashes yeah and the hashes they use Blake so I think makes was used in smart key so I think I came across in the

indicative of snarky of Blake - and the Blake's result is also I can current to Peterson hash to 3 place for example so [Music] 256 so this section is is quite good because when you go through which you have a problem and then a solution of problem and then the solution I think we just lost you we got to the end of the solutions I'm sorry well actually yeah I don't know if you

do you feel like do we act are you not quite done yet because actually we trying to think your was that did you just finish a solution 5 I'm sorry say that again maybe just just finish off I think we just have yeah I think I finished the the section 7 so we still have to talk about the application okay cool sorry to rush you there at the end because I know that there was I'm sure that there could have been like questions and stuff so I definitely want to like hold this until the next one oh yeah there's Matthew again so you could actually hear him so we were just saying we're probably gonna wrap up now okay I guess it's a shame because usually we'd love to like actually pool

together some questions or something but I have a feeling what might happen with this particular paper is that at the very end after we've gone through like a number of these sessions I think they're if we still have open questions we should bring them to the group and see if any of the authors who might be in there could help us out but I think for now I kind of just want to say like thanks again you said for going through all this yes I'm just on this clipping if I've done any mistakes so those are my mistakes maybe I haven't understand fully the paper so cool but I mean I think this is the study club so I think

the idea here is that like work we're all trying to learn together yeah so I just want to say thanks again to everybody the video should be up pretty soon and Yusef and actually all we should probably coordinate for the next one I think for sure for the next one like I'm really excited to touch the use cases and try to understand how this stuff could all be actually used and how it's different maybe than the other solutions out there so this is exactly yeah yeah so I guess we'll have to hold on for the next one we can we can put in them in the material the video there is a video about the one of the users index so why don't we do that we can actually

had a little bit more to it and do a do a session on that plus maybe some other parts of the paper if it makes sense oh cool all right thanks everybody I'll see you next next time I don't know what that's gonna be exactly all right