ZK11: Mopro: Client-Side Proving on Mobile Made Easy - Oskar Thoren

Transcript

[Music] uh hi everyone my name is Oscar I'm going to talk to you today about mopro so the takeaway of TDR of this talk is three things so we want to make proes of mobile uh mpro is a toolkit for uh SE application development or Mobile and other platforms and let's make S proofs on mobile great together so first we want to make proofs of mobile why do we want client side proving uh well let's put the ser back into CK I think a lot of focus the last few years has been in terms of the succinctness properties you get from from CCH uh and that's great but it's not enough for a lot of applications where user require some kind of privacy or interoperability

properties so let's look at a few examples so this is from uh Susu uh sup pass so suu was this is this kind of Proto Network State first one happened last year in Montenegro and they had this kind of digital identity system CK idty called supas and that allowed this Ro to Pro that you belonged you had access to certain things and you can do voting and all these kind of things with a siki identity solution and they later on uh built on this so end of last year they had this kind of funny game at in Istanbul Dev connect for some of you might have been uh where basically you were like catching frogs and these were like easa signatures and it was like a way of gamifying and get a lot lot more people to play around with this and I

think at this event we also see things like jboi and basically people playing around with this kind of secet identity things and seeing where we can take this technology uh obviously for this kind of C stuff it has to work on mobile you're not going to carry on your laptop uh and you also need it to work on basically all devices like 95% of devices because otherwise you can't use it to gate events or do voting on these types of things soort of more from The Real World we have uh something like adhar so adhar is this uh real world identity system that's used in India has more than 800 million users and basically use this for everything it's very convenient ient uh if you s of need to sort of prove something to your landlord or get a bank account or apply for a job you basically sign send

this PDF sign PDF with all your secrets and stuff and that's what people use and has a huge adoption uh there's a product a PC sponsor product called anadar that's basically adding CQ on top of this so you can sort of and it's doing that permissionless right because it's basically a PDF with an RSA signature so with that you can do things like selective disclosure and potentially proof of humanity and these types of ation and there also other examples in this same category like for example proof of passport which is a similar thing in Europe uh and I think this is part of like a larg of trend that we've been seeing in the CK space for the last few years where there's more and more of these like digital uh signatures and whatnot that we can of take and add CK on top of so if it's RCA signatures or

emails or GitHub keys or E things in ethereum or what have you uh obviously this is um a lot more complex in terms of uh circuits and constraints compared to S twoth that's much more simple uh but other SE identities there's a lot of other examples right so going back to the origins of this space with Bitcoin and and so on and cach like actually getting fundable money right where your your your your income or salary is not tied to if you buying a cup of coffee or whatever that's still something that a lot of people are working with and on and struggling with today including a lot of products at in this space um and also private Finance is more generally uh in various domains uh there's also more novel things like

private social networks and basically where you can try to hide the social graph and for that you also need some kind of client side proving uh as well as even more sort of out there ideas like ckl there's lots of products that are experimenting with maybe using your private photos or something like that and then being able to prove things and interact in novel ways and what all of these things have in common is that basically the user they want to generate the proof on their phone right to get the Privacy any drop ability properties you need so what do what do we want from client are proving uh first of all it should be secure so trust minimized and sort of the user herself generating the claim uh it should be fast so you want to have good performance for for big circuits I mean big in a relative sense

here uh like if you look at ecsa and RSA it's like around 1 million constraints which is much bigger than something like semap for uh but obviously smaller than all these l2s and so on but basically you want have like a good ux and performance not just in terms of proving time but also in terms of memory considerations uh and proving key size and these types of things uh shine fining should be friendly both sort of to end users obviously but also to developers and it should just sort of work on all or at least 95% of devices right for it actually be useful for a lot of applications and when I say clients approving I don't just mean browsers I also mean sort of natively uh and you might think like why bother and I think there's a few reasons why you might want

to bother so one is uh security so you get operating system level security whether that's uh Secure Storage or biome biometric authentication just general isolation uh and I think this is important especially for like Secrets like real world identity and so on uh you might not just want to put that in a trusted like random web view you also get much better performance just sort of native performance whether it's like multi Fring or or access to GPU and and these types of things and while you can get this in browser to some extent it's always going to be more limited compared to what you can get natively and it's also going to be sort of less consistent in terms of across different devices and browsers and so on uh you also get better affordances so more better

integration uh with the phone whether that's things like camera or sensors or secure Enclave or push notifications or persistence and so on and just sort of a n More native and fluent experience um obviously some trade-offs right like a big one is if you don't need an app you don't have to make one uh this potential censorship especially with something like the Apple Apple Store uh but I think the biggest one by far is it's very complex to develop and distribute and this is basically where mpro comes in so moo is a toolkit for seek application development on mobile uh so it's a set of libraries and utilities with a bunch of goals so modularity is a big one so it should be easy to of add new proof systems and platforms developer friendly so very easy for of

developers to get started to right seek applications has a focus on on performance so both sort of fastring but also low memory usage and these typ of things um multiplatform so you can write your seek application once and then it works on on multiple platforms if it's Android s or R native what whatnot uh and you can think of it a bit like Foundry for seek application development so the main interface now that we have is basically this command line interface uh and this is the main way you interact with it and this allows you to get started in under five minutes where you sort of initialize the product you choose sort of the platforms and the proof system you want to use and you of prepare the circuits and then you can build for a specific platform and you can also do testing and exporting

bindings and all kind of stuff and just briefly this is roughly what it looks like so you have a sort of core with your circuits uh some Rust wrapper and then IOS and Android specific stuff um as well as a config and the config just allows you to have a bit control in terms of the architecture that you are targeting or so if you want some debug information as well as what circuit you're using and Trust setup and so on and then this is basically this example application this is xode this is what people use for developing iPhone applications and it basically generates this example application that allows you to do basic proving and verifying and then you can go crazy with your actual app design so how does it look like um we can figure this a kind of a flow between

multiple layers where you start with a user and then working towards the app tooling and then sort of towards uh proing systems and so on and and you don't have to understand this in detail but the key idea is kind of separation of concerns like modularity right so I don't know if you can see but jok say that users they have no brain they just want something to work and a circuit developer they just want to work on the on the circuit and focus on that and the same thing for an application developer and there's lots of things going on here there's like circum circuits and moper core circum compat arworks moper modules and so on and what basically what I'll do is I'll we'll take a slice of one thing at each layer and also see how these things fit together so we start with Circ uh why

circom well it's basically the most widely used DL for client side proving and empirically that's where a lot of the more interesting client side subse applications are are written in right right now H you basically just use the circuit same way uh and then you can sort of use moo to prepare it a bit like you do some compilation steps and generate some artifacts like an optimized proving key and stuff like that and you can just bring your own circuit set up then you have this mpro core which is like a core the core R library with multiple adapters we're starting off with circom but it's very easy to of add other proof systems and we have done some PCS around that and it basically has an API if we initializing the library proving and verifying dealing with calization and these types of things and in the case of

circum it's using circum compound which is part of the aworks family to load the circuit and a weight generation is either done natively uh kind of experimental and still a bit work in progress it only works for some circuits or via wasmer and then proving itself is done natively via Arc gr 16 then basically we have this mopy Library Andy is just like foreign function interface so that's how you talk across language barriers uh so that's what allows you to bridge between rust and Swift and cotlin and so on and is wrapping this rust API in dealing with called like lowering and lifting so if you have a big num in Rust it's not the same in Swift so you need to take care of that uh and it's using UniFi to generate bindings for these different languages uh we have support for iOS Android as well as R native the r native

support is uh separate via Bridge from yanis at PSC it's a bit expirable as works we also actually have web support but that's completely separate from the other stack and it's not native obviously but just for completeness so you can write to seek application and then have it work in multiple platforms and unify so basically it's Firefox had this problem like how do we develop complex crossplatform applications and this is the answer they came up with and if you're familiar with cbind Gen is basically a more modern version of that and the key Insight here is that you you can keep your business logic in Rust for example and then you have these uh bindings to different uh language run times so you have the same sort of core code base and then you just do up so platform specific things where you need

to so you have native bindings uh in Swift and cotlin and so on and then you have the applications so this is Anar uh and this is sort of showcase app we've been working together with them on um and then at the very end you have the user right and the user they just want things to work they don't have any brain they just want something to work quickly and that means things like Fast proofs and there's robust experience and few actions and I think it would be really cool if we as a space can sort of create this experience that hide all this CK voodo stuff and integrate seamlessly into app uh and uses daily life and provide even better experiences than what we get with current technology so just going back out sing back out uh the whole idea is to make sort of to

make make the life of you as application developer easier uh and as a developer you can only focus on so much at a given time like there's uux snap development and Swift libraries and Architectural linking rust CK circuits proven systems there's a lot of things right and this requires a lot of people or at the very least it takes a lot of hats and and doing this takes away from focusing on like the business problem and with M proo basically what we're doing is they're splitting we're splitting this up and allowing developers to focus on their area of expertise and the details here are not super important but that's kind of the general idea and and intention and then developer experience is just this right so you have this command line interface you write your circuits uh you get some UniFi bindings and you can also test

this in isolation in Swift cotlin and so on and uh I know if any of you have sort of used xcode but it can be quite painful but from an if you're an application developer there's like sort of no rust or sey specific things involved this just like another app with with s of Swift bindings or what have you because we're embedding the rust library in of hideing in that complexity uh I mention modularity is Big design goals and I think that applies in a few ways so one is in terms of platforms so adding support for something like python is Trivial so if you want to have like a desktop app or whatever um proof system so adding proof systems is very easy we have done some PCS uh like in hackathon in few hours we could do like a basic um PC for Kimi

which is this plonus proof system uh and it doesn't take that much time basically you're wrapping the rust API and exposing the bindings obviously this depends on the spec the particulars of the proof system and how easy it is to embed um and when it comes to tooling like a lot of concerns you have are very similar with like ffi or cation or linking and packaging and so on and by having this kind of rust core it's kind of a shelling point for the CK ecosystem it's like Fast secure flexible has lot of developer mind share and so on uh it's it's quite easy to of integrate things and finally it's also public good so m is not tied to a specific business or or product and that means that basically whatever is useful to people people actually writing interesting seek applications that's what we want to

support So agnostic nard and thanks PC and search park for the grant so where are we now so been working with anadar uh on the version one of of showcase application and what happened is at the end of last year we did this PC together with them um and at the time the number of constraints in circle was around 160,000 and then it's boned up to 1.6 million it's down a little bit now but it's still like basically order of magnitude uh we also been working with with proof of passport that have similar concerns in terms of C identity um also the reason that the number of constraints uh exploded was because they actually added support for like proper nullifiers and selective disclosures and so on so you can sort of prove that you have a valid adhire and you are from a certain province which

are insting for certain applications so as part of this because the number of constraints exploded we were like oh is this actually going to work performance- wise uh what can we actually do on a mobile phone and that led us into sort of exploring that and trying to understand the limits of client side proving and sort of working on things like native wi generation and load loading of Arc set key uh making it faster so that's kind of the proving key that we use arworks based uh We've also been working sort of an improving developer experience so the command L interface I showed you earlier to just get it make it very easy for you to get started very quickly as well as API and Rec support and so on just briefly this diagram so turns out that like the main ball neck when it comes to running

things on making proes on mobile is like memory and that's kind of well understood I guess AI but it's nice to have empirical confirmation of this so basically this graph shows you memory usage and then this is number of constraints at the very end that's like 1.6 million constraints um so what this means basically is that if you have a modern phone with more than 4 GB of memory you can do things like anadar or proof of passport because they're all on the order of magnitude of like 1 million is constraints and you need like a little bit of a buffer for sort of system usage and other applications because otherwise your phone might have uh kill your kill your process and so on uh there's also other performance conations but memory uses is by far the biggest one because

if you don't have enough memory uh it doesn't work it just crashes right U but Pro time and winess information it might take a bit longer but it's still tractable uh there's also other concerns like prove a key and so on that you can talk to me more about if you need it um yeah so finally let's make CK all mobile grade together so uh I'm based in Taiwan and one this is organization called go zero and they have this model it's like ask note why nobody's doing this you order nobody that's think it's pretty good model for like open source development in general so you can contribute uh so would love to see people uh try it out and provide feedback write seek applications it's it's fairly easy now with the new command interface uh we had recently there was like a hackerone at Oxford

with some CML product called confidente they they were using mpro we didn't know about it and it worked for them so I guess that means something for developer exerience uh it's also like a Community product um so we love to S see more support for more platforms and more proof systems and just general performance improvements as well as docs and so on and there's a lot of grants available in space so if this is something you interested in there's definitely opportunities to contribute more specifically so we have like experimental reated sport but that can be integrated uh better uh also intering to of make the offering more complete to of have support for uh PW and stuff like that even though that would not be native that's still an interesting stepping stone for some products uh more proof systems so we've been talking uh with uh people doing

Halo 2 stuff and Noir which are very interesting from client side proving point of view but Al also other novel Pro systems like Nova or V or vus have you heard about this morning that that would definitely be interesting from a client side proving point of view as well as performance thing so there's native we generation uh it works for some circuits but not for all of them so we would love to sort of make that more complete um GPU acceleration that's another thing uh these phones that we around with us they are quite powerful with the GPU so it be great to be able to unlock that it's actually Grant it's ongoing that's looking into that but there's definitely more work that needs to be done uh as well as loading the set key and a lot of other performance things that need to be

done uh some contributors so these are people who have been sort of using moo or things that we rely on or people have actually been contributing to Moo so six Park PC uh for the grant and so on Vivian who's been helping out a lot in terms of uh building up moo yanis Floren who working on um C identity system so both uh anadar and proof of passport respectively so we have had some good feedback with them moven and food chain uh who have been sort of looking into GPU exloration ferco from worldcoin who have done a lot of in terms of circum witness uh Native witness information AR man and V who've been also doing similar things and hopefully you if this is something that you're interested in so uh recap we want to make Pro of mobile M

Pro is a toolkit for seek application development on mobile let's make Mak Pro and mobile great together future AK the future is mobile the future is now uh thank you any [Applause] questions here are some links to repo and [Applause] socials yeah uh so do you use any multi-threading on GPU acceleration for these proofs do you provide any API for that cuz I'm wondering when I want to integrate my proof system into this mobile suit then I would I would be able to I would I I would I would have to be able to provide some

mappings from rust to Swift or to Java on Android in order to run something in multi-threading or GPU yes so so the the basically with you have your rust code and then you use this you write this sort of interface thing in UniFi and then it automatically generates these bindings and when it comes to multi there's nothing specific for it but basically you can do things separately in the background it's just like another rust library right so it's not it's it's it's nothing nothing specific fancy in terms of making it taking advantage of your phone's B frame per se but it's sort of running in the background in separate thread just like any other separate process and it's yeah and you are able to do it on phones normally yeah because

I think you probably know that on for example on web on browsers it's quite limited yeah so so native is obviously more flexible right because it's not quite as flexible as like a laptop where you can have sub processes and stuff like that which is like another limitation uh but I mean you can run it in in the background basically uh and as for GPU uh so something people have started looking into but it's a bit more work in order to of Leverage the goal would be to get sort of MSM acceleration and leverage some of the C price kind of findings but adapting that to mobile it's just like a bit more involved and will take a bit more time okay thank you sure any anyone else you mentioned memory you didn't

mention proving times proving time yeah so uh memory is the biggest one uh proving time it it depends a bit on sort of browser and so on but like when we did compared cat check with um circuit is about 10 times faster uh and then with an like it depends a little bit on the how how complicated W generation is um for anadar when it was like 1.6 million constraints the Wason based WID generation is like 10 seconds if it's native it's like 0.3 or something like that and then 20 seconds raw Pro time uh other ball is also like it it's a bit slow to of load the proving key that's something we're working on as well as the size uh so in circom you have this

set key proven key uh we when we convert it to arworks we use like Point compression and stuff like that so it's 50 50% smaller um but yeah but the biggest Bal neck is still like memory uh and the loading the set key uh and there was some weight information proving time is not that much of a concern right now obviously if you have like 10 million or whatever uh constraints and it becomes more of a concern um but yeah to bring that down I think requires a bit more work I think it's probably more fruitful than to look at different proving systems like Halo 2 or something else uh if you want to get like a second proving time or solo you mentioned these uh quite specific circuits yeah have you looked at VMS anything VMS yeah VM circuit no not specifically and I think

that you probably wouldn't do like a VM from a phone you would probably do like a subset something similar order of magnitude like 1 million I think the largest client side related things like there's um cemail cptp I think that's like 8 million uh constraints or something like that and that's like but but you wouldn't do like a whole VM thing right you would just do a subset I think that's how Astic is thinking about it as well we do the private thing on your phone and then you send it off somewhere to of do more complex things but I think that's still sort of an open area to explore more [Music] yeah for the wasm are you using 32 or 64 bit

wasm uh I think for uh if I remember correctly for I think it's 64 but I think was some for some older Android phones I think it might be 42 but we want to get rid of it completely to be honest it's just like because wasm has that limitation that it you can't use more than 4 GB of memory yeah yeah so so we we don't want to use that ideally it's just like a kind of a stepping stone uh where we want to replace it with the sort of rust based circum like circum is a bit special as well uh just because of how history and so on but uh yeah we don't want to use it at all it's just like a stepping Zone basically uh as far as M you can also

com run uh this on the Mac um so Al there the memory limitations uh higher and like what's do you think the biggest C like have you benchmarked this on a Mac M1 and2 uh not specific we briefly compared it to like snjs and it's more memory efficient so like for example people who have had problems around on out or on their desktop with snjs Tac they've been able to do it with this I think it's like half the size something like that uh like I think you have the same problems obviously but it's it's more stricter because usually phones are are more limited uh but other than that it's basically the same uh I don't think there's anything specific that makes memory use me yes basically same on on a

phone as as a laptop with the difference that laptops are more powerful basically okay oh hey um uh I'm curious what your opinions are on some of the recently there's been some interest in these kind of MPC protocols that allow you to offload the brunt of the work of client side proving I'm curious what your opinions on those are yeah I mean in general I think it's very interesting obviously complexity is is a big thing but I think as the Solutions of NPC are maturing I think it's that definitely relevant also another interesting thing with NPC is is my understanding it's like maybe more latency bound or

whatever like the performance curses are different and that means that it makes a lot of sense for something on mobile so I I do think that's interesting it's is like a bit early but I would love to play around if someone is interested in that I think that would also be very cool to make it better on on phones but it f it's fairly early yeah yeah I believe right now also it puts your privacy under like one honest actor assumptions where your actors are external trusted but I think it could be tweak such that you are one of those actors so as long as you don't Reveal Your definit that would be to explore I agree yeah all right let's thank uh Oscar again than [Applause]