zkPodcast: Trusted Setup Bonus with Tornado Cash

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik this week I follow up on the trusted set up survey I started a few weeks ago with this bonus interview this time i chat with tornado cash who recently ran a very fast set up with the largest number of participants so far now before I start in I want to share a list of the

things going on in the ZK podcast universe generally over the last few episodes you may have heard me in this intro spot list like one or two things that that are related to the podcast well I thought it might make sense to actually share a rundown of all of these activities so you get a bit of a sense of some of the resources or channels you can explore if you're interested in the topic okay so here it goes right now you're listening to the podcast if you haven't subscribed please do if you're a first-time listener welcome if you are a longtime listener and you'd like to engage a little bit more check out our telegram group now in the telegram group that's where you can chat with other listeners reach out to our guests or

just chat about zero knowledge proof you can also find out about zero knowledge proof related events there next up is our YouTube channel that's where I share videos from this podcast videos from the zk summit and also videos from the Z case study club the Z case study club videos are basically deep dives into zero knowledge topics with some of the experts in the space we do these somewhat sporadically but we average out to about one to two a month the recent Z case study club videos are all about halo and they're hosted by Sean Bo and Dara hopwood so you might want to check those out another initiative is the monthly ZK mesh newsletter this is a newsletter focused

on the latest research into zero knowledge proof sand privacy technology next up you may have heard me mention the ZK validator the ZK validator is sort of separate from the podcast but related because I'm involved in both things the ZK validator is run by myself and will Harborne from diversify were an active validator on Kosmos Kusama and soon on polka-dot and it looks like we're going to be joining some edition pretty high-profile POS networks very soon the point of the validator is to be an advocate for ZK research and privacy technologies in the networks that we work in we create working groups connect the core devs with the ZK community and in the process we learn a lot and

prepare documentation and research papers around that so if you're involved in any of these networks you might want to look for us the ZK validator is actually powered by some trails a company that I learned about when I had them on the show ok I think that's it nope wait one more thing I just for some reason I just started to subreddit I have no clue if this makes sense at all as a platform for this audience I've heard mixed things some people say Oh read it's a bad place because no no researcher has a reddit account other people are like why does there not exist a zero knowledge focus subreddit so there's actually two there's R's zero knowledge and our ZK podcast both of

which I'm a mod on so you're welcome to post in either of these ok and coming up I guess this isn't on right now but something to look forward to in the fall you can expect a new zero knowledge summit as well as a ZK focused snarks online course that Dan Bonet and I have been working on it's a little bit delayed but we're almost there so please stay tuned for this as well I'm going to add in the show notes a long list of all of these things that I just mentioned I think it provides a number of ways for you to interact with the ZK community I mentioned this in last week's intro but I'm looking for someone to help me coordinate and organize kind of a lot of these projects if there's anyone out there who's looking to get involved in

the zero knowledge research space if you are organised and have some experience running events and maybe even have some light project management skills it would be really great to hear from you get in touch I'm looking to fill two roles right now maybe more in the future so hope to hear from you cool so now onto the episode now here's our bonus episode all about tornado caches trusted setup [Music] so a few weeks ago I did an episode all about trusted set ups and in that episode I got a chance to interview for people who had participated in or who had actively worked on previous trusted set ups now at the end of that episode I

mentioned the tornado cache trusted set up which had actually still to this day is the biggest and yet the guys from tornado cash weren't on that episode and we did try like we did actually have a bit of emails back and forth we didn't get our scheduling right but I'm really happy that today I get to explore this so welcome Roman storm and Roman seminoff hello everyone hello so we fully explored it in that episode but still I think it's worth just defining what a trusted setup is again so how would you describe trusted setups to our audience it's a multi-party computation that is required for snarks and if at least one

participant of this ceremony is honest then the whole ceremony can be considered successful and will allow to trust as they interact with this snark and something that I actually learned on the previous episode on this was that originally I thought that the general what it generated was some random string but it's not its parameters it's like vector commitments or something I can try to describe it to you in simple words like imagine like the participant generates a bunch of random numbers and thus kind of like hash on those numbers and add this hash to this ceremony and

destroys the source random numbers in what happens in reality under the hood instead of hash we have exponentiation so the participant generates some X and then exponentiate sits on the curve and curves work in such a way that it's hard to do a reverse operation it's hard to find out this source X and the user all so needs to destroy it I add the entropy source yo generates some random X and then exponentiate it e n to the power of X and then destroy this source number what does it look like I think I asked this in the previous episode but what does it look like to an engineer like

what do they get a bunch of numbers like a very very large file with a bunch of numbers and for example as a result of powers of tau it's like literally these powers of this random tau so tau to the power of 1 tau to the power of 2 and then tau to the power of 2 to the power of 28 so a lot of them they're not individual values they're it's not like individual values along a curve yeah it's just individual values like each like tau to the power of 2 is just a number on the curve and this is the large sequence of these billions and

billions of those numbers but that's the what you're talking about there is the movement from phase 1 to phase 2 right yeah and it's the same towel but to the different powers for phase 2 to out to the snark as a powers of tau like phase 2 January it's a little bit different like the output is a little bit more complex it's a few different numbers and they are specific to the circuit and then after we receive this large file we will still have to post processes in order to generate like a really fire key before solidity contract for example okay so you have both already been on the show

and we actually have an entire episode dedicated to tornado cache and the build and what it's about this episode we're gonna be looking more into the trusted setup side of things but I still think it's good for people to kind of meet you again so maybe just quickly introduce yourselves so that we we know who you are sure I'm Roman storm co-founder of their knowledge project in a quick summary tour another cache is a noncustodial privacy solution for aphelion watching I'm Roman 7 off I work on more technical side of stuff of tornado-like snarks so let's talk a little bit about this trusted set up that tornado cache did as far as I

understand it's the largest that's happened so far you have over a thousand participants I want to kind of ask you like other than this like size of it what was really unique about the trusted setup that you guys did I think the reason why we had so many participants in a such a short amount of time is because we were able to automate the coordinator role in our process which basically means our web application that we published anyone could easily use that without having any sort of technical knowledge with a few clicks of the button they were able to generate a

source of entropy and upload it to the ceremony tell me a little bit though what was under the hood there because I mean so as tech had as tech who we had on that first episode they actually had a automated coordinator as well but yours was incredibly like I'm like for it to fit into a browser what had to happen technically for that to work the main reason is because our circuits are small less than 30 thousands of constraints and so it takes around like 10 megabytes the keys as opposed to other ceremonies for example interpret all powers of Tao

the keys are like 50 gigabytes for our stack they're smaller but still kind of large but 10 megabytes is small enough to fit in the browser we were able to compile the trusted set up contribution code to web assembly so it was able to run in around it took around 30 seconds to generate contribution in the browser for comparison the same contribution is generated in a few seconds if you run it natively so the browser version is slower like significantly slower but it's still fast enough because our secret is so small you were not doing the full trusted setup though right like

there's often I mean we've talked about this in the previous episode where there's there's phase one and there's phase two the tornado cache was only Phase two correct we took the results of per petal powers of tau ceremony it is designed to help all other projects because it is universal for anyone who wants to do their trusted set up they can to take the result of per petal powers of tau like one of the latest results and do only phase two specific for their circuit and that the perpetual powers of tau is this etherium foundation kind of run perpetual powers of tau exactly as it sounds where people are still today contributing if they want to what number did you come in at

or what number did you take from this may be a better way I don't remember the exact number but it was around 30 okay so like 30 participants had already done that first phase one and then from there you took parameters or something right oh like actually from the parameters we generate special like powers of tau files that are much smaller so we take this 50 gigabyte file and generate only enough powers of tau for our snark so from this 50 gigabytes we generate a file of a 10 megabyte size and use it for face tone how long did you actually run this for I believe it was wrong for

two weeks Wow so in two weeks time you were actually able to get like over a thousand people to come and participate yeah more than half contributions were in the first one or two days Wow how did you plan for this like this is actually a question a little bit more on the social side like how did you come up with this concept how did you figure out that this was like what you needed and how did you do it we were required to do so because in order to preserve trustless all all this smart contracts so that we don't have any sort of control over the turn of the cash protocol we had to

complete the trust set up ceremony in order for every user of their another cache to don't have any trust that we can still manage or change something in the smart contracts basically like to prove to the community who's using it they'll like at this stage it's it's math protecting this thing it's it's more yes math and that we cannot modify it basically we cannot take the funds all those to another cash small contracts got it so but how long like what kind of planning process went into running a trusted set up first of all we try to make sure that the ceremony is as simple as possible so we thought about how we can improve upon all the

ceremonies that we've seen in the past so we decided to make it like we saw the opportunity that we can make the make it work in a browser and we can we try to do it as easy to understand as possible for regular users that doesn't know about snarks or how to install some tools on their computer so in the end they need it only to come to our website and click a button and that's it that was actually that's another question that I had which is like what was a walkthrough like like what was what did a participant have to do to actually be part of it sure there were two ways to participate in our process of ceremony the first was

the very easy one that is targeted for average Joe basically you could go to a ceremony that turn and that cache website where you could clip a contribute button then you can choose how would you like to contribute would you like to put your name on for your contribution or you you had a choice to do this anonymously by saying let's say if you wanted to put your name on it you could send it with a github or twit with our account so that you could do your contribution then this contribution would generators on coincide and then it will try to upload to the on a server and then the server itself it would try to verify that the country

contribution was valid and if it is it would be included into the ceremony itself and if it was if you failed for example if there was another contributor that got in the interval line and was already accepted the application so that it would try to do the another contribution automatically and that would do try to complete the process the same it sounds like I mean so one of the the points here was like how did people actually register how did you know that they like could any like did you need to have a social account or an ether dress or anything you could actually just join you could just go to the website and be like I'm gonna send entropy exactly also new think about our ceremony was

that our human ease mechanisms are different so the most larger ceremonies they need to do some kind of schedule and make a line from users to make sure that no two users contribute at the same time but since our contribution happening in around one minute we use optimistic approach so when user clicks a button we don't even check whether someone else is in line or whatever we just download the latest contribution and two hours on top of it and if it so happens that two users had a collision and get contribution at the same time the browser will just redo so in this case user will spend one more minute but

that's fine yeah as we can see it work faultlessly for us and we also target that advanced more advanced user let's say if somebody doesn't trust our website they could do the contribution using the command-line interface that was also available for everyone and by the way if somebody wants to replicate our work if you need the trusted set up feel free to look at our github everything has been open sourced and taken for your own needs were you guys concerned at all about like a DDoS attack or anything like having it be flooded or is that just not a worry I know we just saw that this risk was pretty low like who needs to do dose

like there's no money to be there is no profit to be near fair enough and I suppose it's still such an ish kind of scene that is correct I mean if somebody did those our website what are they getting out of it and that would be pointless and expensive for them they would actually spend money on that but without any profits how did you actually wrap it up how did you decide and the trusted set up it was a wild guess we we thought well let's try well we kind of pretty predicted that it should be it should generate enough participants due to the simplicity of our application so and I just verified that we ran it actually

for 10 days and we did of course we did not expect that it would get like over a thousand contributors which was quite success in our opinion and I think the main aspect of that that we added some social aspect that at the end of the contribution people we presented that if you want you can tweet about it and and people start tweeting about that and that's how it generated all this hype around trust set up ceremony for another cache we also had an interesting story on the lunch because we didn't want a lot of people to come at the same time to the ceremony because in this case there will be a lot of collisions so we

didn't start by publishing a tweet or official post that we start at a ceremony but instead to test stuff we just gave out this link to the ceremony website to a few people like Kobe and others like cryptography into just and they made a contribution and of course click the button to tweet about it and then exploded them still like we had a ton of people just came it in without official announcement and then we published a blog post I guess after a day or two after actual line I think I saw that you had already had like 300 participants or something when you were like by the way we're doing a trusted so unexpected for us we're like

oh my god people already know about it without us saying about it that's actually that's a that's a good point they're like did you feel like there was some education that you had to do it sounds like at this stage maybe not because it there have been trusted set ups before so what was the education like did you actually have to explain in a way what the purpose of this was for I think I was quiet personally I was quite impressed how many people actually aware of trust a set up for easy key starts that they actually understand what it is for that they have to like contribute some entropy in order to make the system fully trust us because as we already know from the previous podcast that if

at least one contributor was honest this setup is can be can be considered trust us do you think a lot of the people who participated in the ceremony were already using tornado cache yes and no it felt like most of them yes they already aware of that another cache and they know what they're doing I think it raining trust set up ceremony I think it brings another social aspect that people want to contribute to something and it doesn't really take much time to contribute to the trust setup ceremony you only have to like run a few programs and it's completed to complete the process and it's just I think it's just a human psychology that lets us like oh

yeah by the way here is this cool project called on education you can actually be a part of it yeah I guess that's what it's really nice about these things but let's talk about like how you feel about trusted setups like in your case you had a really successful really cool trusted set up that a lot of people participated in but do you actually think do you like trusted set ups do you want to see them stick around trusted set ups from technical site at least at the moment allow for the most efficient proving system so if you want the fastest very very fire and smallest proof sizes you usually have to use trusted setups but of course like it would be better if

there were they were not required and we see the new developments in Universal trusted setups for example in plunk where you need to run only one trusted set up for all snarks built with these proven systems or even like transparent proving systems but there is a trade-off there are a little bit less efficient do you see a future for trusted setups or do you think in the next like two years they'll disappear do you think this is just like a moment in time I think they'll still be around because this space it takes a lot of time for any kind of security checks and balances

like people have to test it on production somebody has to take a risk so I don't believe we are yeah I believe we're going to see more trusted apps in the future so you guys so this is where I wanted I want to sort of switch gears you've already been on the show and you are live before so this is kind of this is the part that I want to understand like the trusted setup came after you were already live what were you live with before what was what was tornado cache pre trusted setup it was just the setup done on our laptops so we did like a few contributions but basically since

it was trusted setup done by developers the people had to trust that we didn't hit our toxic way to kind of believe in it what happened like how did you how do you actually change the snark this is the part that I want to understand like you generated new parameters through this trusted set up while the system was live so did you have to like go offline for a bit or like how did that work we just updated the verifier keys on smart contract and prove your case on our yoy did the did the sort of activity in tornado cache have to stop or did it change in between those two things or was it actually able to continue at the time of the design after another casually - we

already planned for trust set up ceremony so that's why we put a few functions in our smart contract to update the verifier key so that it would be like zero downtime actually like the another cache system worked as is before because if you had a deposit in total nada cash pretty trusted set up your would roll will still be valid even after we updated the key I think that's the that's the most important part that the vilify key would still work for the previous deposit is there any other like updates or kind of news you can tell us about tornado cache since we last spoke sure right now we're currently working

on terminada cache III that's the next version of Talmud our cache that will all people to get rid of like fixed amount deposits we call internal polls that would be just one giant other people can send arbitrary amounts of ether into this pool we also just recently launched they're not a fun data which is initiative to help us out to build turnout the cache v3 yeah we also we want to build the privacy of wallet actually because right now there another cache v2 is the app it's not a wallet so you the user still has to manually manage their private notes and it's very

important to keep the private notes before the compliance reasons we also launched compliance tools so that if you use their navigation if you need to prove the origin of your funds that are legitimate you can do so by going to another that cache slash compliance you can put you're not in and that will generate a compliance report so it's very important to keep your private notes for verification reasons but so far there haven't been wallet so it has been easy for like every person to use it and that's in the pipeline that is correct yes we believe so right now for another cache only solves unchanged privacy with that another cache worried

we could also bring of chain privacy such as managing the user identity I mean obtain metadata there like geolocation IP addresses oh do you see tornado cache sort of fitting into the d5 stack or is it separate like this tornado cache fit in there somewhere we believe we do especially with maybe few interesting features that turn and the cache can provide and III version we also want to get rid of the decision making process of turn a location which we mean that may be a dhow would be a great idea for the next version after

another cache so that we let the community to decide how to another cache should keep evolving that means there is a huge room for defy integration and fitting into the define narrative I'm really curious to see how like if defy actually responds to zero knowledge proof stuff or starts to actually showcase some of it I know that there's like experiments going on but I'd like to see more actually I shouldn't even say experiments there's like full-on Dex's powered by zero knowledge proof in fact we might be having one on soon um but yeah it's really nice to see that i guess and i think i'm gonna be exploring

a little bit more in that intersection so listen thank you both for coming on the show again and updating us about the trusted set up that tornado cache did i'm so sorry we didn't get to include you on the first one but i'm so happy that we actually got a chance to explore it today it was our pleasure as usual we really love zero knowledge podcast keep doing your very important work for all of us thanks thank you and to our listeners thanks for listening you