ZK Whiteboard Sessions – Interview with Ariel Gabizon on The PLONK Origin Story and Roadmap

Transcript

foreign [Music] I'm here with a elite podcaster Anna Rose and the two of us are going to talk to uh Ariel gabazon um he was an early team member at zcash accomplished researcher uh co-author and creator of plonk and current team member at Aztec so exactly welcome yeah thanks nice nice to be here yeah taking the time Ariel what are you

what are you up to today these days like how would you describe your role and what you do uh hmm I do a bit of I mean I guess it's in the spectrum of you know art research like trying to push the limits of you know ZK snarks you know further uh which today I would say has a lot to do with the lookup techniques like um trying to really be able to work with the classical which relates to being able to work with the regular Primitives signatures encryptions not just smart friendly ones

uh and all the way to you know reviewing PR's looking for bugs and at a higher level I would say right it's the question of how do you how do you write snark software securely and more generally you know decentralized defy systems which we see every two years every two weeks right getting hacked for hundreds of millions of dollars how do you write code like that securely so so those are those are the kind of things that uh occupy me and you do that at Aztec yeah yeah I'm right now when did you join I joined Aztec it was January 2020.

oh wow um yeah yeah um basically I was I was at ccash for a few years then a protocol labs and sort of when when I met uh Zach and we came up with uh with plonk I felt that um sort of that um collaboration is where I do my my best work awesome let's talk origin story of Planck so you're the co-author with Zach and there's another author as well right yeah [Music] uh yeah so uh basically what what happened uh was that I met Zach at this event uh the zero

knowledge seminar of binary District in in London and uh uh he asked me a bunch of questions that I didn't really know the answer to or or understand but he asked me one question that was was very was easy to me because I saw very similar techniques in the uh in sort of the Stark world that I was in working with Ali um was that uh using the LaGrange basis uh yeah I mean the question he asked me was how do you say you have two sort of vectors or polynomials how do you check that

um one is a shift of of another and uh exactly when yeah the point is when you go go to the LaGrange basis the the shift operation it's really uh becomes yeah very very simple it's just multiplying by by a generator uh and and I wasn't I wasn't aware of the time this had to do with Zach digging very deeply into uh into the Sonic the last section of the Sonic paper uh who knows maybe he's the one person who fully and and understood it and um one reason that section is is uh is

uh is complicated is because they try to do a so-called Grant product argument in in monomial base and yeah that becomes um much simpler in in LaGrange base so so that was one element of of Planck uh being born uh yeah actually if I could I could go back a little earlier or go a little high higher level and talk a little about about sort of snark history uh yeah so I guess a little a little of of snark history uh so basically the what one very important

tool in in making snarks is this idea of of doing operations on encrypted or hidden values uh and one main reason why that's that's useful is that the prover that is trying to cheat he himself doesn't know this this value so he sort of can't adapt his strategy to that specific value um but the big limitation with this approach is that we only have very very we have very limited ability to do operations on on it sort of encrypted or hidden values we can in a sense only do degree two operations using using

elliptic curve parents though you know as a tangent a great area of research is how to extend pairings to higher degree uh Maps um and then there's sort of this ggpr work uh how I view it is it said well if we arithmetize things using these qaps that were then sort of dubbed r1cs's um we can you know degree two is is good enough for us and this sort of started a uh you know multi-year uh Saga where where people were perfecting the the GGO PR approach

and that led to this grad 16 paper which sort of like this is the best thing you can do with with this approach um but sort of what's what's interesting and but then also right uh at the same time that these Works were were being were being created uh g2pr so right there were a few things happening in parallel there was of course Bitcoin coming in 2000 uh in nine uh and and there was the beginning of sort of practical snarks with ggpr in 2012.

and uh right the reason these these two sort of uh histories interact is that we started having relatively practical snarks and at the same time with Bitcoin we started having a very urgent need for Technologies like uh like ZK snarks uh so we had suddenly this urgent need for for privacy and and sort of we had this ggpr approach that was becoming very uh dominant so that was the approach that was uh being used uh but then exactly when snarks were coming into practice this this issue of The Trusted setup uh became

a huge practical issue um and when it lived in the realm of theory it's just like yeah you actually have to do it yeah then it doesn't matter like or you know a little more nuanced you could say in a theory it's interesting like some trusted setup versus no trusted setup but when when these things got into the realm of practicality what the setup looks like became suddenly a very important question and and you know with the launch of Z cash people started to notice that oh okay if this setup was what what's called both Universal and updateable meaning we do it once for all programs and there's no

need for someone to keep his secret you know well protected for long periods of time and come and keep participating for can just be someone participates for 20 minutes and he's out and we can replace them with anyone else it doesn't matter uh so this gave a lot of motivation to these uh the question of universality and updateability of of the setup well and I I can imagine that you felt that need like very acutely because you discovered a very serious vulnerability in zcash and my understanding is the team effectively had to keep it quiet and I'm sure was maybe a little bit nervous that it was going to be exploited for the eight months that it took to run a new trust itself it was

eight nine months yeah that for most of which that only only four even inside the team it was only four people who knew about it and there were a lot of funny anecdotes like uh so the transcript from the setup could be could be used to to like exploit so we we took it off offline and then we got people like complaining why what happened with the transcript of the setup oh my gosh and uh yeah and I I remember Sean saying so Sean was like saying okay I have it at home I'll upload it soon and then he he just

stopped answering slack or checking slack so you wouldn't have to answer questions about it so there were a lot of uh yeah but yeah so that but but also even before I mean just seeing the when we did the first setup of six people it was so even with six people you need someone for like 48 hours or whatever to you know sleep with their computer or drive through Canada with their computer playing it on fire at the end yeah yeah yeah so so that gave a lot of uh motivation to these um these questions of universality up and update ability uh and so suddenly ultimately with with

the so that that actually made people notice this work that was actually there from 2010. this Kate zavarucha Goldberg work it's interesting there was actually there already from 2010 and so then when it was finally used in in the in the Sonic paper they they used it to get this universality and updateability but you know just I guess from sort of momentum they were using this arithmetization from previous papers that was it was a little hard to work with and sort of for me the the pre-birth story of plonk is uh actually Mary mallor she showed me

or us from Z cash this K this kzg uh paper and uh well after I thought about it for a few weeks I was like okay so actually we don't have to just use this and keep doing everything else the way we've been doing it the last few years uh this this polynomial commitment scheme it means we suddenly have a lot more freedom than we have in the r1cs approach so for this sort of higher component of the snark this what people are not now calling the IOP or polynomial op I I suddenly realized after seeing the the the the the Kate polynomial commitment scheme that okay

actually the design space now is much larger than it than it was when we were constrained to these r1cs uh from the ggpr approach um and so I was starting to think okay what is the simplest sort of polynomial IOP you can do when you're not limited by degree two equations uh and that also is sort of part of the birth or pre-birth story of of Planck cool well it's it's sort of ironic right because um a lot of people coming into learning about through knowledge proofs in you know when I did like 2017 2018 we thought that r1cs was like fundamental

and that was sort of the like this like basic building block of ZK systems but the I I believe the uh arithmetization used in or the the technique used in Planck was from like bear Groth and it had predated I mean the permutation argument I think had predated r1cs and um well I would say it's a combination of uh the basic protocol there is from a bear grot but it's a simpler instantiation of it using univariate polynomials and lagrant bases that I mean in hindsight it's extremely

simple you don't really need to know about it but the reason it was it came to me is is because of working I guess with in the Stark world with Ellie Ellie Benson at his lab where they're this sort of idea of using a generator to jump from one point to its neighbor it's like all the time oh it's extremely like all the time in Starks because with air like you just care so much about accessing the next and the previous rows yes um that's interesting but but yeah I I remember being because uh plonk came out at about the same time as Marlin and uh so my co-founder at the time Daniel

immediately like latched on to plaque and I was like you know still an r1cs world and but but I I think that uh uh the plant just had so many advantages and it's actually a much better model for thinking about and like a more natural model for thinking about arithmetic circuits especially with custom kids um yeah yeah I yeah again it's just not limited by this uh you know degree too because there's no there's no reason for that limitation and when you're basing your uh yeah your design on a polynomial commitment scheme so you wrote or the plunk paper was published and Aztec definitely like did

you immediately start on an implementation then or maybe not you but like Engineers here well Zach Zach implemented it but since then I guess the the question I want to ask is like since then plunk has like evolved into these variations with amazing names I think are mostly turbo plants a lot of them I heard there's an octoplank uh okay that's that's new to me isn't there a plonkish now uh yeah I think uh it's like plunk like yeah general term for anything that has like Punk and a punk augmentation with custom Gates wild

but talk like what has that been like and almost like maybe from your starting point what's been interesting or novel that you that either you discovered or that other people discovered ways to like change this thing you created um well one yeah one very interesting um thing that was discovered was the ability to use lookup tables um who who was the which team or who kind of video well the first time uh the first time lookup tables were used uh was

um well I don't know if it was the first time we saw it it was in this paper called Arya uh by a lot of authors from UCL not and but uh pluck-up was a sort of a more efficient way to do uh to do lookups um um I think we did want to find out from you like what's next as well like what are you working on today in terms of plunk and like what directions do you maybe want to see it go um so the one question that's very much on

my mind now and uh I don't know if to say it's just about flonk but um yeah I I would say like better techniques for for using uh for using lookup tables like uh I think when the techniques it when and if if and when the techniques for lookup table improve by uh you know like a even just like a half order of magnitude from what they are now it'll it'll cause a big pivot because you know one one pivot in so now there's a lot of focus on emphasis on snark friendly functions like what functions can we

arithmetize efficiently um so if if lookup tables become their use becomes efficient enough all that that won't be as needed or as as motivated I would say and you know together with that all this uh sort of game of how to most efficiently arithmetize things you know finding all these little optimizations and minimizing the number of equations or a lot of that might um might go away if lookup techniques become a little better um is there any work that you would see as comparable in terms of impact or like

maybe it might not be from the Planck ecosystem but like that's happening elsewhere that is exciting to you or that you think could influence it well this this recent uh uh caulk paper um I think it made the first uh big jump in exactly what sort of what I was interested in improving improving lookup techniques uh since plokup though only able to deal with r1cs can it also be applied to it's not it's not specific to uh um to uh to r1cs it does rely on on pairings and bilinearity I think

yeah yeah we're interested in it but in the fried setting I I don't think it's as applicable yeah I mean well that's an right I mean this is uh this is sort of an interesting I mean you have you know some some companies or uh I don't know I'd say you're you're you guys are sort of in the middle but you have uh you know you know one at least one company making a very um strong bet on on Stark techniques and if yeah so caulk is I I'd say it's the

first paper where sort of the use of pairing is extremely inherent for for efficiency as opposed to just using it for to get a polynomial commitment scheme where you can say okay I have a fry substitute so yeah it's interesting interesting to see how how that will go um do do you sort of see any kind of Opera like are are there things sort of or areas that are kind of on your radar as far as improving lookup efficiency Beyond caulk or is it are you just sort of um I mean for me right now uh looking at called related ideas a lot of

my focus is is there uh yeah what what else um yeah honestly that's that's where a lot of my focus is right now cool nice Arnel thanks so much yes thanks thanks for having me and thanks for sharing with us this like story of Planck and hopefully that helps to give a bit of context to you know what folks are learning through this series so nice sure we still need a sign off we need to figure that out for me and we podcaster Anna Rose thank you for watching and until next

time great cool foreign [Music]