ZK7: Park Bench Panel

Transcript

[Music] as mentioned this is not a panel with much prep on my side i have one question to start us off and that is is r1cs dead uh i don't know um yeah i i don't know is r1cs dead do you think it's do you think that now we live in a in a r1cs world like post truth but post r1cs um i don't know i think we will moving

forward have is there feedback we we hear you yeah we will have um some systems we still use r1cs but i think what you'll see increasingly sort of taking r1cs maybe augmenting it with things like lookup tables maybe increasing the arity of r1cs so it won't look like the r1cs that we all know and love um it'll maybe look something different maybe it's not arwenskis anymore i don't know i mean from a standardization point of view having one set of constraints which everybody agrees on everyone's using the same terminology everyone's writing the same systems using the same programming

languages all the rest of it that is really nice um from uh making snarks fast and being able to do cool tricks like look up tables and other tricks r1cs kind of doesn't support that so i would like to see a world where we do agree on a constraint system but maybe we need something which is a bit more a bit more expressive where we have a bit more ability to play with it got it is r1cs dead uh i i think there's a good chance it's uh it's it it will die

because the reason it came to prominence is that it captures really nicely what you can do in snarks in what's called the ggpr approach which led to grout 16 which roughly means what you do is you check a verifier equation in a secret point in the exponent and then since we only have parents we don't have trial linear maps or it captures really nicely what you can do with that and that approach had some nice advantages but it had this big disadvantage of uh setup per circuit

and i think that disadvantage is gonna yeah make that approach to constructing snarks like sort of not not not be used and we're going to all move to this other approach this polynomial iop approach i i'd like to say a word because because you said plonk there there is a sense in which planck is getting too much credit in the sense that everything that is not r1cs people uh call it plonk like any sort of constraint which is not cs that it gets accredited to plonk uh so in a sense that's giving plonk too too

much credit because in a sense planck went back to the way people were were writing constraints before r1cs sort of the genius of ggpr1cs was to manage to do things with just a degree 2 rather than degree 3 equation which is which is easier to think to come up with and they came up with this thing that you only need degree two and so a pairing is enough um yeah so that's that's my thoughts on it is there nothing that can be done to r1cs modified change that could like bring in some of those characteristics i i think r1cs is not necessarily just restricted to ggpr like this linear pcp

style snarks you can combine it with the polynomial irp model which sort of allows you to use these lookup techniques custom gated i mean it stops being r1cs at some point i guess i don't know what the threshold is but you could do like for example r1cs with lookup tables it should be totally plausible um and yeah then you don't have that exact structure of r1cs but uh yeah i mean it's still maybe the spirit of r1cs would live on um but also i think people are like doing uh you know new stuff with r1cs for example in terms of recursive snarks the most efficient recursive snarks that we know of today

use r1cs or a variant of it and yeah the recursion cost is like 30 000 constraints 25 000 constraints which uh r1cs constraints and and the constants are very low so i think maybe maybe in some niche use cases and maybe there's a spirit of r1cs will live on but yeah maybe people will stop slowly uh using things which just do pure r1cs like drought 16 and such cool by the way feel free to jump in at any time so for those who just arrived a little bit later the way this works is we started off on a topic but we actually open the floor to anyone here who has an idea comment

question if it's just a question the panelists will answer but if it's at all opinionated or if it's more of a comment then you'll be switching places with one of these participants so i want to open the floor i do have like a few other questions in case you need to like spend some time thinking about this but i do need your questions for this to work so are there any questions all right there's a mic that's what i need hey are there too many uh different plunk implementations what was that are there too many

was it yeah different flank implementation that sounds a little bit opinionated okay they're gonna answer and you're gonna switch they're coming out yeah i'm i'm i'm really glad you asked that because that that's been on on my mind um and i think it relates to the to the pandemic uh because we weren't uh because we weren't running into each other uh you know as as frequently as we we used to then uh you know people teams were working by themselves which has advantages but it's created i think uh very strong double efforts you know it's not

double it's decimal effort whatever it is exponential many effort such situation uh yeah we've seen here in the talks today a lot of nice talks but yeah right a lot of groups including us aztec are creating you know similar tooling so i hope now that the world is coming back a little more to normal that we'll be able to right we need to think of collaboration mechanisms where you know at the same time companies some things they want to keep to themselves sometimes but at the same time how can we um you know make you know joint infrastructure in a way that's convenient for everybody and there's not too many overheads of i'm using that format you're using this

so i hope we'll figure that out of course it's more general than planck all this polynomial iop approach including marlin a lot of the components are very similar i would say having as many different implementations for the same verifier as possible would in general be great the problem is they're not the same verifier everyone's verifier is just subtly different so when it comes to sort of saying ah if this one breaks that's fine we can just use someone else's implementation currently we're not at that point oh wow yeah i think yeah people sort of have been experimenting over the past couple of years trying

different techniques different implementation strategies and i think that's a good thing especially with like new tech you need to have you know let a thousand flowers bloom but yeah i think we're also seeing now some more standardization eff efforts like a vampire and and i know there's like a bunch of people trying to corral the implementations all into like go in the same direction a little bit so cool yeah okay which one of you needs to leave first i think i was talking a lot so i don't think i leave all right so you're gonna take his place eh come on up welcome to the stage yeah

[Applause] what have i done all right are there any other questions now you know what happens remember if you make a very like clear just a question with no opinion then they'll just answer it but if you have an opinion you're coming up here not that scary up here it's totally fine oh and those folks who are at the back if you don't mind try coming a little closer just so the mic holder doesn't have to run around too much you oh yeah do you want to introduce yourself yeah my name is kev i'm a software engineer

kev wow cool i know you that's so cool i didn't know them too wow all right question i saw one uh oh jeez i guess because it's aztec and alia does privacy belong uh on l1 or l2 do we think this is is there an opinionated no that's neither what do we think yes yeah yeah all right but we'll they'll answer the question then you're coming up i think privacy belongs everywhere right now as much privacy as you want as you can get your hands on you want it perspective it can be very challenging

to get privacy at layer 2 and not at least one because you're always going to be in the situation where you have to put the transaction on chain under a public address which then can be used to de-anonymize you unless you go through a centralized provider so there are some challenges to just doing it at layer 2. i would also say there's some problems to just doing it at layer 1 actually which go along the lines of if somebody breaks your protocol you might not know about it so it's a tricky one i'm not sure where i stand do you want to answer that one i only went i said privacy everywhere oh yeah you did sorry sorry you didn't answer yeah i don't know i just know that

privacy is hard so cool all right next up off the docket i know you have a meeting so all right you're coming up any other questions comments thoughts ah there's one is the future of solving mav more privacy or less mev in ways that are not private oh that sounds pretty neutral shall we answer that there's no there's no opinion in there is there there's always an opinion are you saying you want to come okay why don't we just we'll do it we'll do a lot what was the question again i didn't

catch it fully maybe so some projects are solving mev by doing batch executions under privacy um layers whatever their implementation is and that actually has the convenient property that if you're doing packed batch executions and no one can see the transactions then you actually don't have an med problem there are other solutions to mev that sort of look like mav mitigations and i think there are probably maybe solutions that i don't know about so the question is is the future of mev which is by extension the future of smart contracts that deal with any sort of financial application is it privacy

or are there other mev solutions that come to mind uh like are you saying the solution to mev like the threshold decryption kind of thing well so i think the the argument is in some sense philosophical because i think some people take the position that mav just moves to other places when you squash it in one place and i think that um say penumbra for instance penumbra does uh a decentralized exchange um with z cash styles shielded transactions um that are batch executed um so the sort of like neat thing about that is that they've done a particular kind of smart contract their their entire chain is like this specific decentralized exchange

application um and they've engineered their own chain to do it z cash style transactions um and they don't have to worry about mev so maybe it's kind of a big deal yeah now that's an opinion i do want to get their answers and then you're going to come up yeah no i think yeah we need sort of probably both because there's just so many kinds of mev right some of them can be stopped via specific privacy measures that but others like you know i could just drop everybody's transaction except the ones that i want that that i know are mine for example right so you could do like those kinds of attacks as well um and also i think just space is so is way too early to sort of

you know just go in on one particular approach and be like this is the end-all be-all of mitigating mev um right so i think probably we'll see in the future is a hybrid of all these approaches and that's a boring answer but we have thoughts on that privacy mev um yeah so i i think what penumbra's doing is really cool and i think that those mev mitigation mechanisms will be really interesting um so william actually in the back had a really interesting take on this and so there's this tension between um being uh sort of censorship resistant and being mev resistant because you you can imagine a world in which like a

roll-up would have a centralized sequencer and that sequencer would have like some reputation at stake uh and and he just wouldn't uh extract any mav because we we can tell when mev's been extracted and so it's possible that users might like opt for uh like less for more like censorship susceptibility uh if they're guaranteed to not have mev extracted from them uh and like you can already see at like i'm just like parroting what william said but uh you can already see this happening uh with flashbots where users will like actually accept centralization and like censorship susceptibility because they know that they're uh less

susceptible to mev so that's interesting what do you think kev are you thinking about that um yeah i should preface and say i don't have a very strong opinions on most of these things [Laughter] i will say that the way the question was docked it seemed like mev was a bad thing um in my head i agree um well with the miner getting like uh like if you pay transaction fees and that goes to the minor uh wouldn't you cost it as mev i wouldn't is that not a traditional transaction that is that is what a transaction is you include a transaction fee it goes to the miner but mev is if the miner were to sequence suppose you were going to

trade coinado coin b and the miner said i see your transaction and i'm going to put some transaction in front of you and some sandwich some transaction behind you you've been sandwiched they've driven the price up in front of you and that's map right yeah i define mev as any way the miner can extract value which is also from transaction fees um but yeah i see the way i see what you're saying in that the way that you explain it that way is bad um yeah i don't know i've never seen a movie as a really pressing problem i agree with brendan that censorship resistance is more an important problem so yeah all right so i think you're now off if you want to leave your mic there pass the mic to alex by the way is that chris at the

back [Music] hi actually alex thank you so much for helping me out uh chris maybe can help us out now awesome yeah come up yay okay more questions oh yeah do you want to introduce yourself hi friends i'm thor i work on threshold signatures at a project called entropy um and we saw your slides flashed for a minute here the pink's squiggles yeah i scribble on slides and i did a talk earlier about distributed key generation um and i also hang out in the zk hack discord channel and talk about zero knowledge proofs with the study group

yeah hello very nice all right questions so the question is is the future more computation on chain or off chain i think that's an okay question that's a question right okay this question is there more is the future more computation on chain or off chain um so i can take the cop-out answer and say obviously it's going to be off-chain because most computation occurs off chain but if i was going to take this slightly less cop-out answer i think the question is really are we going to implement improver verifier schemes on chain for

like all significant blockchain projects at some point and i think that question is almost certainly um most computational craft chain i think that if you actually wanted to achieve throughput at scale the obvious way to do it is to reduce your asymptotic complexity on chain to verifying a proof and i think that's sort of why i think the whole zero knowledge thing is neat um because we're it reduces to verifiable computing if you can do o of n squared operations unchain instead of o of and two to the power of n operations on chain obviously you should do that because that's going

to be cheaper that's sort of how i think about the direction of how do you scale blockchains you would like skill blockchains by reducing your complexity and you do that by doing more computation off-chain and supplying a proof what about you uh yeah oh i think is your mic off do you want to use somebody else's real quick there's a way to open it i think you have to do something at the bottom um yeah i mean i i hope it's off chain because uh i would hope that like the work that i'm doing and many others are doing it will like end up with most a lot of computation moving to l2 so um yeah but i i think it it like

necessarily must right because like we can't be stuck with uh like ethereum's uh transaction throughput indefinitely and so i mean i think it'll either be off-chain or we won't really be doing many zk summits in the future yeah i agree i mean the answer is uh quite obvious in my opinion verifying execution on chain seems to be the way forward all right any other questions oh so it's like common to you know the futures option computation is that how do we actually you know

differentiate between y3 and wipe two right so one of the main features is really compulsibility right that's on chain you can have things that interoperate right i just share the same interfaces like us20 and stuff like that but when you really move to option wall gardens are we just doing everything essentially that web 2 is doing just with tkps you can i think now there's a comment and a little bit of an opinion yeah you're done right yeah that was another comment supposed to be a question again oh okay okay so you want to hear from them and then you're going to switch okay thoughts opinions i didn't hear what you think [Laughter] i might have thoughts

they're currently forming but us i'm sort of stalling for time i think that the way to address that question is that in web 2 world let's take your email for instance i don't really think any part of your email should live on chain um there i think there's like a project that's working to like invent a spam filter where like if you don't have a address on a white list um then they have to spend send you like some unit of currency to pay for the attention that you're going to waste by archiving or spamming their message um but realistically like none of your emails should really be unchained so if we're going to talk about stuff that should be on chain um it usually has stuff to do with like there's an obvious like incentive for an adversary to like

grow like come over bonk you and steal your um so in web 2 world um which i i kind of resist the the dichotomy a little bit and prefer to think of it about like what incentives do people have to like come over and bonk you and steal your stuff um i think like web 3 world is about like we actually have an incentive to come over and bonk you and steal your stuff and that obviously has applications and anything that does that has to do with like finance um which is sort of like why d5 has blown up but it also has to do with like stuff like how do we organize communities that like produce value so like the dow stuff that's happening um i guess like i i've now forgotten the question but i just sort of nattered for a while lots of opinions over here well would it

would it be time for you to come up i think so sure i think you're you were the you're the most you've been here the longest right yeah it's voiced an opinion yet oh um right who came on before you were on the longest yeah okay then he takes your spot no no no no we try to keep it in order i have one job pay attention to who's here and i don't do it very well usually by the end of the day come on up i love how everyone's clapping this time we don't usually do that but it's nice who are you um wei dai from bain capital crypto cool if you recognize my name it might not be from the right context i'm not the

inventor of b-money okay oh good to know all right questions comments thoughts we need active people here this is the only way it works also just like i said before people in the back if you can come up a little closer that would be awesome with layer two have we sold the scalability triloma with layer two have we solved the scalability trilemma is that an opinion is this i think i think it depends on whether you consider like a centralized sequencer at l2 to be decentralized but i mean certainly like yeah we can like compress basically an unbounded amount of computation uh

on l2 and then put it on that one and so uh i don't think we have if you look at other twos it's actually value centralized right centralized sequencers so essentially like you're reducing the one of the axes right like there's no decentralization so you have not solved but but but you can still exit right so you still have like censorship resistance on that uh if you have the escape hatch right but but that doesn't have the same throughput uh so if you want this realize that essentially all twos will be changed themselves and the same problems will show up i think i i suppose that i don't believe that the scalability trilemma is a good formulation of

general problems that we're attacking it's a formulation of some of the problems but i think as a meme it's kind of now been proven to not really be a trilemma so i suppose that we can achieve inter or we can achieve scalability decentralization and security simultaneously or i think that's the trilemma taxis is that it scalability inter scalability security and decentralization yeah well i guess i guess we did all those things we just haven't done scalability security decentralization privacy privacy mev resistance and uh censorship resistance i don't know other things too all right any other questions we need we need questions or otherwise

this thing doesn't work so come up with something people or an opinion thought on anything that we're talking about uh raise of hands if you think blockchain is not negative for the world isn't and wait yes is net negative if you think blockchain is a negative for the world i was at rwc last week like no one's allowed to put their hand up here [Laughter] so like i think really so like when i was at rdbc last week and 80 percent of these cryptographers at a rwc real world crypto conference um put up their hand and the guy who spoke up said it was an environmental crisis so i think like that's sort of a signal that we still have a lot of communication to do and

that we're pretty much drowned out by people who do communication real well and real bad i see someone with a mic is um are we moving towards a world where all chains are at least trying to inter-operate and is that a world that we want to move towards can i steal me on the case for like a chain that should exist in isolation um i feel like the best you could possibly do is say like if you could provide a path that being isolated was more secure and um admittedly less useful but more

secure maybe you'd be able to do that but i don't actually think that the interoperability of a chain is correlated to its security so i say no uh so the question was whether we like just empirically like whether we are moving to that world um yeah i mean there are more chains now they're inter-operating i think i think so yeah we we should you know build chains that inter-operate with each other while keeping in mind that with different consensus as you know there's security compromises right that's when you do bridging um you know if your consensus do a rollback you know there's a

ramification of that right but uh but i think that's a good choice i usually have to make but um we should make change that's interoperable like and and not only interoperable but actually like you know composable and like by default in some sense also we should be really clear about the security of bridges and like how we like communicate what the risks are to users because clearly that's not hasn't happened anyone else oh there's one over here should we get ferdinand i try to balance it out so i usually try to give people a chance um do you guys see like super loud sorry do you guys see like a place for any

sort of other roll up once and if like zero knowledge figures out the centralization of the sequencer and like making the execution a lot cheaper do you see like optimism arbitrage existing in the world or is that just like a temporary patch for like demand for ethereum block space i'm going to switch you out it's it was just a good question i want you to come up no you got it you got it come on no you can it's totally easy yeah you can switch out for me but uh you have to do it it's a question like frog proofs versus ck proofs or yeah or you could sure [Laughter] yeah i i think capital efficiency wins

ultimately and so uh like i think validity proofs well like assuming like performance and throughput and latency i i think uh zk roll ups will win come up it's great we get to meet you just it's super chill here i promise it's really easy we're not we're not mean it's true all right you're gonna do great what are you what are you doing who are you i'm walt i work at galaxy on research nice to meet you

uh wait what was that question though again let's say it again uh do you see a place for other type of like roll up schemes outside of zero knowledge if you know sequencing and and they get a lot cheaper are you seeing other schemes past what we've already seen like roll up optimistic or is there like yeah is there some other stuff that you're that's on your radar no no but i was curious what other people had yeah other schemes if anyone else has if you look at let us know we'll see here labs do right so like because roll-ups are rolled up because data is done chain right so you have the data uh you want essentially on chain like line to verify that it's got you correctly uh you know that's essentially a

zero-dollar proof that's you know for a given set of call data or state changes and you know everything's done correctly right and maybe i i don't see how you could um you know improve on that um it is pretty standard it sounds pretty standard to you know have a you know if you do have a zika roll up right i guess like more so the question was like if that takes longer than expected so like push it out like three five years before it's like fully ready let's say let's just say that if even if you disagree that let's just say if that happens and then you have like arbitrary or optimism you know they launch a token they get incentives they get users and

you get like seamless liquidity exits by like protocols that are just like harboring the capital inefficiency and charging like a minuscule fee and you have let's say like 20 different versions of optimism just batching all the transactions like now this has like a network effect a complementary effect like you can just go instantly onto arbitrarium from a centralized exchange if you're retail right or from from an app like i think it's called like argent is an app that does it natively so like not necessarily that it's the better technology like do you see a way to get users on there i mean obviously you can do like incentives but well sorry all right i suppose like i ultimately think the answer is that if you can do a zero knowledge roll up

that is doing its stuff as you would expect and it's optimized and all that then um you've sort of won the game um but of course that's a lot more complex to implement um than an optimistic roll-up since fraud proofs are just simpler to implement um which is to say that you basically have like a lot of research and implementation cost to get something like that off the ground as you can roll up off the ground um but i suppose that this is going to be true any place that zero knowledge proofs are going to be applied that you're going to see sort of like the several stages of uh ecology where one of the earlier stages of an ecology is no proofs and then you get fraud proofs then you get zero knowledge proofs i sound like a crackpot but um the um

yeah the answer i think is that no you probably do end up looking at zero knowledge roll-ups at scale because you can get better scalability properties and better trust assumptions but i think what he's talking about here is like time to market like capturing like yes they'll be better but will they win oh yes you know what i mean because like better scalability and more assumptions better better trust assumptions maybe like slightly better scalability and then but what if everyone's already somewhere and everything's been built there and they don't really want to move oh okay so this is like marketing um the other part yeah i think something's happening with polygon right like you have

side chains essentially receiving more traffic than roll ups because they they're earlier right marketing is really powerful all right i see your question over here so it's more like an opinion okay yeah but basically to your uh point i think um like whether the technology is going to win like it depends on whether technology itself has network effects right so i don't see zkps as necessarily having the network or like or a fraud proof saving network effect it's the chain that uses them has network effects but if ckps become powerful and easy enough to use i don't see why arbitrary more

optimism will not switch to them even if they build the ecosystem oh wow yeah i mean if it's cheaper and more efficient and like it it doesn't make any difference for them which technology they use if they already have the users and it becomes better to use ekps i love that it means ck wins in the end anyway yeah yeah yeah cool okay opinion for sure do you guys want to respond yeah i suppose that um unless you believe that institutional inertia or momentum or like institutional knowledge like plays a role and like maybe they'll just like stick with fraud proofs because that's what they know but i think that's kind of like how do human organizations work question the answer is that if they're obviously

possible to implement and superior in practice and there's reason for them to do so then they will at least try they probably will at least try yeah cool all right i think you two are switching actually thor i think who want to replace me that's the next person all right any questions all right oh introduction yes yes so i'm bobby and i'm i work on polygon maiden he gave a talk earlier today too oh yeah clapping we forgot about that eh okay next yeah in the interest of not letting you off so easily let's imagine the hypothetical in which there is an ironclad perfect privacy layer one zero

knowledge proof that is strictly prover verifier what things do you still put on layer two or what things do you put on other blockchains is the answer nothing or something something called you're coming up anyway respond to a question um that's more common right yeah yeah so i don't think you can actually do like a perfect private l1 with just your other proofs it's actually what i did this you know taco ball my in my talking about the hypothetical world for philosophical reasons what do you do in that environment is that it then you know you have infinite throughput you have your dream layer one is that it then now you don't put anything on layer two or on other chains that don't interoperate yeah so here's um an idea right so like look hundreds of years in the future uh

here's the argument for why we need multi-chain right is that if we're actually gonna be on different planets you know humanity is gonna be like you know on earth mars like different galaxies you need different chains unless you solve like the communication problem right of like you can't go over this bit of light so uh i think you know we need multi chains and also you know like zooming into right now we need different communities right so um it is what anomala is working on right so i think uh you just can't build one l1 for everything and so there will be multiple chains and so therefore um you know probably i guess this does not argue for for all twos or rollups but but i think you know i do think there's going to be multiple

chains and interoperability between them so and with that i think you uh yes and with that and um to follow up on that i actually think the question is like i mean a bit tricky like if you have perfect something that means there is no possibility to improve it but it also implies that you believe that there is no like progress left to be achieved so if like yes if you think that human civilization kind of stops progressing then yeah there is nothing else to add but even if you have something perfect at this point in time people will invent something and the question is will this perfect chain adapt the new stuff or will you have to create a new chain that adopts the new kind of improvements over time so

do we have any other questions oh actually we didn't do an intro oh hi i'm justin uh i'm with threshold uh i'm mostly up here because now that thor is gone there's a need to have at least someone up here who has spent substantial amount of time uh frustrating and responding to tux's pull requests i i thought you were gonna say maintain one of them up here i thought you were going to comment on the fact that you guys have the same shoes well that's a consequence they're related okay um controversial question opinion are we talking too much about blockchains are there other applications people want to talk about what a good question you're coming up come up here that's good i think you're off though are you

if you want to answer that uh i don't think so i don't think there's anything as interesting so no cool i mean this is a zkp simon so in theory there should be other applications of zkp so maybe we are talking too much about blockchains yeah sure actually i met someone this week who's like i'm doing a ck thing not blockchain and it was a bit like ah they exist all right let's switch not only are we talking too much about blockchains we're talking not enough about what a blockchain is in light of you know the ideal layer one technology welcome to the stage who are you um

my name is jocelyn i'm a phd student with andrew miller at uiuc fantastic you just gave a talk yes i did very nice cool welcome to the stage let's do the class i like that um do you have some thoughts on what you just asked actually um decentralized identity that would be a use for zk off but is it off blockchain don't you don't you find like they end up on blockchain for the immutability somehow i mean you could but you could also just not [Laughter] [Music] oh there you go some would ask

if there is a culture for in layer twos for foregoing security for innovation um given that they hold quite they usually hold like a large amount of money inside of them is this the right way to go what was the beginning of that question i couldn't hear you right away um the fact that layer twos are foregoing security for innovation they're foregoing uh security for innovation well when you say security do you mean privacy or do you mean privacy and other things i mean the cryptography may not be sort of well audited for example i think in many ways it is like i think

it depends on how you look at it but um you know the way for example a lot of roll-ups are being rolled out they don't have escape hatches for example already so you're definitely forgoing some security to you know build other systems and i don't know if that's the right trade-off or not but um you know that that's what's happening yes do you want to check i think you yeah i think you guys when you come up don't touch the bottom sorry because it breaks it oh yeah i think it's on yeah yeah actually i think uh an interesting other thing about that like you can break security doing a lot of things right so if you write your code modularly enough that you can switch in the parts that break security like that should probably

help with some of the move fast but don't break things do you want to come back [Laughter] i mean you can although i kind of want to leave the stage open to a few other folks what's up uh yeah i was wondering what people think about the uh sort of field friendly hashes um you know they're all fairly new uh poseidon um you know all these things uh is it really a good idea to be building all these systems on very newly developed hashes that hold you know lots of money behind them i feel like there's like a there's an opinion in there there's a critique they're gonna come up

i think it's a good idea because that's how you figure out if they're actually secure or not otherwise how would you uh determine that so yes maybe some money will be lost but at least we'll have a field friendly hashes to the end trial by fire also yeah i guess a couple of things building on that one if you write your code modularly enough you can you can switch it out and and the other one being i mean if you look at like history of like original cryptography a lot of the older hashes the like functions themselves develop together with good definitions that like didn't exist when they were developed so um given that those exist now

it's quite likely that what we have now is better than like two years in poseidon is probably better than shot 256 may have been two years in wow thoughts i don't know i'm still using shaw one i'll let you know how that goes okay i think you're gonna switch out with bobbin now i think thanks bobbin for being on the stage and welcome [Applause] do you want to introduce yourself uh yes hello i'm uh jeremy brustell and i uh uh work at uh risk zero cool you guys also you didn't present but your team presented earlier today what was it you didn't present but your team

presented earlier today uh yeah i was actually there too yeah it was me and redford you were presenting okay cool all right what was sorry say what you what was the question again just uh well my original question i was just asking about what people felt about the security of the new field friendly hashtag yeah yes and seeing people seem bullish on them which is you know i think actually understandable good i was just curious all right are there any other questions oh is there somebody who hasn't asked a question oh yeah he i mean he was there for a while so so i i have uh my question is uh i i feel badly about the security of the

sidnar friendly hash functions okay i think you're coming up after do you have any is there do you guys want to comment on that before he i think he's taking your place no just come on okay come on up come back [Applause] in retrospect did we introduce ourselves at the beginning no oh wow okay who are you he's back we get to find out ariella gabazon i i work at aztec network uh before that i was at the zcash and protocol labs

worked at a lot of the big ones um what was the thing you just said oh well i gave an opinion that i am i'm uh i have a sort of a negative bias against the snark friendly hash functions uh well because my intuition is that um for for and i am not a big hash expert but my intuition is that for hashes to be secure you need to mix two like sort of orthogonal operations like if you if you look at shaw or blake or you have the addition mod say 2 to the 32 and and and you have the the bit wise

operations like bit wise sore whereas in you know in the snark friendly uh snark start friendly ones you you have to mainly focus on on sort of one operation one universe your your finite field all right questions hands um my question is um why don't we trust sgx is it already broken and if it's not already broken will it break before quantum computing arrives in force so so i uh you for one i think that sgx does uh has had a number of different

issues where data has been leaking or other things that have been shown so there are some places where sgx has had issues in the past some of them are not complete breaks but they're meaningful also i think fundamentally in order to trust sgx at the end of the day intel has private keys that will let them you know falsify sgx data so fundamentally you must believe that uh intel is uh sufficiently trustworthy right and i think that if you're looking at sort of like nation state level people working in security i think that's not a universal assumption i suspect a lot i suspect that intel is plausibly not the only people that have that key for example i've always been curious about your

opinion about sgx i i don't know anything about sgx but somehow when i hear people talking about it it seems they don't like it that's been my experience as well do your thoughts um i think this fits in somewhat also the question i would have asked you about the hash functions what are assumptions that you like for hashing i feel like it's just like it sort of is is almost like another cryptographic assumption right working with sgx like ever believing in it um and i'm not sure like to what extent it's a testable assumption or false about a falsifiable one

um yeah i think the question to you there was which ones do you like wait which which hash i mean like what what responsions do you deserve assumptions with some of the proofs that these hash functions come with well so i mean i mean right most hash functions they don't have uh security proofs i mean the only one i'm aware of is uh again i'm not a big hash expert the only one i'm aware of with the security proof is patterson based on discrete log which which i like but i'm not a big hash expert but i think except that all the hash world is more uh your wrist or well heuristic no i would say in some sense i do think

that um you know with regard to security some of the zero knowledge stuff does take things a little faster and looser than the traditional cryptography like sort of you know circles has and part partially that's just desire to get the things to be running fast enough so that they can actually like you know get it to work um and i do expect that that will become more uh you know um conservative over time as well but yeah well yeah i mean i mean started to repeat what i said before because i think it does maybe answer the sort of answer the question is i i have this intuition that you need to mix in a hash two like orthogonal operations two very different operations

there's a question over there yes it actually belongs a little bit to that theory versus practice uh thing for more applications for zero knowledge proofs do we need more theoretic work or more practical work sorry for the very binary question that's good uh so i mean i actually think that uh theory has jumped forward in sort of these leaps right um you know the i think that you know if you looked a couple years ago um a lot of zero knowledge things would be not feasible to use in practice and you know through the sort of creation of these ever increasing proof systems starks and snarks there's been massive leaps forward if there's another massive leap

forward that we still haven't found yes we should really focus on finding that uh it's unclear to me how much of that there is so in the meantime because theory doesn't distribute as well like many people can be working on theory one of them will happen to stumble acro across the right answer on the other hand the practice the development you can just put resources and energy at making these things faster you know so i think i think the short answer is that the practice is much more uh predictably improvable and so that if i had money that's what i would focus on because theory is a a gamble you never could be that it's like it's more incrementally yeah exactly and there's no theory can

come in like with a left field you don't completely change more money like won't like the the phd students do it for the love at the end of the day right like whoever comes up with the next big breakthrough oh no i'm in it for the money so yeah cool i think we have a question there two questions have accumulated and i think both relate to something that gabriel said one is how can you prove the correctness or security of a symmetric primitive i think this is something that the field has been struggling with for a long time and that means like how can you prove the

security of a hash function and the second one is possibly slightly opinionated what about reinforced concrete which is the name of a concrete arithmetization oriented hash function uh i i don't know i don't know the answer to either of the questions fair enough thank you so so i mean in terms of i think in general uh symmetric primitives and hashes um are sort of uh you know hard to prove um relating like like the penderson relation to discrete log does help it but it's very expensive right so i think at the end of the day um there isn't a good answer to that

question right now i think the answer is you just have to reduce the amount of systems that you trust to a very small number and then hopefully those have been looked at for many many years and no one's found the answer i mean i think like shot 256 is likely very hard to break since uh if you could do that you would own all the bitcoins um uh but that said uh i think that on the uh the other question wait what was the other question reinforced concrete oh reese's concrete yes uh so i actually like reinforced concrete because it actually answers your specific concern so basically their idea is that they do some field friendly things and then they run it through a lookup table so it's like an s box type of thing right using the the the sort of p lookup thing

my personal complaint about uh reinforced concrete is that they only do that like once and that the the way they do is a little weird but i think that that method uh because there's a meat in the middle thing you could do but but i think that that method is a good method and i actually think that like the future field friendly hashes is very likely to succeed um the first the current the zeroth crop i'm you know do you have any thoughts on that um i guess thoughts on that and also the previous question about theory versus practice um i think like a lot of times theoreticians care just about asymptotics right and i think the biggest problem right now is doing transparent snarks post

quantum there's still log n um in the poly commit side um and and then there's also the question of like how do you prove that hash functions are post quantum how do you prove the security of hash functions i think both of those are related so if you can come up with good hash functions and then poly commits that are better than log and in program size that's probably going to be useful actual theory thing to work on other than that it seems like asymptotically you probably can't do much better right yeah actually i did want to say a word about the i think i think it would be good if there were there were no big theoretical

advances in in the next few years because uh i i think yeah i think there should be focus it's not maybe it can be also a combination of theory and practice but yeah we need to focus on how to write and verify that circuits are are secure because i i have this fear that the the people that are stealing hundreds of millions of dollars every week from smart contracts when they stop being able to do that then they'll they'll move to zk circuits and i i suspect right now that that won't be too hard at the the way people are very quickly putting ck circuits into production so

so i think we have to yeah focus on how to like really very you know like you verify the you know an intel chip or whatever with uh you know very even formal verification you know maybe do things like that even cool so that was an opinion and i would normally bring you up but we are actually on the hour i think people have had an amazing day a long day but maybe you want to have some drinks thank you to all of the panelists actually a lot of you in the crowd [Applause] [Music] and uh i guess a big thank you to coming out to the zk summit seven that concludes our seven woohoo yeah all right and i guess i'll see you

downstairs then we are going to have more drinks cheers