ZKPodcast: zkVM with Oleg Andreev

Transcript

[Music] welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik [Music] in this episode we sit down with Oleg from stellar to talk about the Z KVM protocol and we explore what that protocol is before we start we want to say thank you to this week's sponsor

Apple Graf apocrine access research paper platform is designed to break down barriers reward researchers and promote open science institutions and for-profit publications put a high price tag on much of the world's best research even when that research is funded by the public this hinders professional communication it constrains data analysis and it slows the rate of scientific progress as a whole to counter this Apple graph has built an extensive collection of open access research papers including some on cryptography distributed computer systems and blockchain if your researcher or a learner who'd be interested in such a system do check out their website welcome o Graf do so thank you again Apple graph now here is our interview with oleg from z KVM so today

we're sitting with oleg who is the inventor of z KVM a protocol architect at stellar and also i just learned recently a crypto anarchy historian welcome to the show awake thank you for having me and before we jump in this episode we'll probably have a lot of topics that people may want to brush up on for example it'd be really great if you listen to our episode on sexy with purchase our episode on bullet proofs with Benedict blintz I'll put all the links to this in the show notes there might be some others that come up as we go anyway can you tell us a little bit more about yourself what is your background what have you been working on so I'm Russian I was born lived in saint-petersburg for quite a long time

later I moved to Paris and lived eight years in France and recently been to United States for a few years where I've been working on this problem of you know block chains why do we need them what do we mean how to make them are you so you're working right now at stellar that's correct what what is stellar we've actually never talked about stellar I don't think on this podcast so if you can tell us like what is stellar in a nutshell so you know like when you say I'm working on watching as people immediately think you're it's like total scammer so stellar is one of those few companies that are doing something reasonable

here's the thing when bitcoin happened it was solving very narrow very important problem and when it became a little bit bigger people were wondering like how do i you know use this for my own things like for stocks for currencies for you know coupons whatever and there were a lot of interesting answers but the common thing was that we need this environment not for no digital gold but for issued assets where individuals organizations for profit companies whoever could issue their own assets and have them exist in some shared common medium that's what stellar is doing this is what I was also

doing before stellar when I was working at chain so that's like a big problem and stars succeeded at deploying complete protocol few years back with a pretty interesting consensus algorithm just designed just for that what is the relationship between Z KVM and stellar great questions so the key VM is a result of mostly my work at chain on designing the multi-asset blockchain architecture with confidentiality with smart contracts and with efficiency and scalability in mind and recently chain was purchased by light here at the same time I with my

team Katie Union Henry de Valence and other folks at chain and then interstellar we came up with a complete solution to combine all the latest confidentiality improvements with our work on smart contracts and blockchain design in general under this new name the KVM that was effectively a new experimental design to see like how much further we could take stellar and so I joined stellar with this project what was the project before you keep saying it's a chain chain started in 2014 as a developer API for Bitcoin developers and pretty soon they realized that there was

a lot to do in this you know as fear of multi-asset of bull chains folks from Nasdaq and Visa were very interested in building the infrastructure like blockchain infrastructure for their needs I was a protocol architect during this time figuring out this design and effectively the same time stellar was trying to solve virtually the same problem then I coming from the other angle instead of creating consortium of companies working in the financial industry teller proposed a noble consensus protocol and a complete design they launched the actual network and then we were seeking cooperation from players in the financial field and then chain installer sort of found each other

and this way there was a merger between the lightyear and okay but the project the Z KVM project did that start before that like already called seek a VM before well the GT VM is actually a step in the evolution of several sub projects so on one hand it's an evolution of T X VM that we did a chain almost two years ago on the other hand it brings the latest innovation that we did with bulletproof and so she gave him a spectively combination of bullet proofs and KX VM and Boo Boo's who are also working on a chain and interstellar so as the key VM on one hand is pretty recent just got started

lost December I think but behind it it's this kind of years of accumulated experience and it's not only the work that I was doing in the fo'c'sle chain but a lot of ideas from the rest of the field came into it so it's to the big degree it's an editorial work of composing the very best ideas of other people in an elegant solution so maybe we start talking about zk VM and start talking about what a VM is so we've talked about the EVM before quite a lot and I think we've talked about was I'm a bit here and there and like there are

these different virtual machines but we've never really like dug into what the different aspects of a VM for a blockchain is or what design requirements or what they look like for blockchains maybe we'll you start there what is what is a VM for a blockchain great question so let's gonna scroll back 10 years ago when Bitcoin started turns out Bitcoin already had a VM so what bitcoin is is you have the state machine that is called utak so sad and when you receive a block you verify transactions and apply them to this state so you insert new outputs you delete the old spent outputs the

interesting design was that instead of just checking validity of transaction buying and checking some signatures in the in the outputs and you would have little programs in each output so every time you verify a transaction for each input that links to corresponding output from the previous transaction you would instantiate a little miniature VM that has some instruction set and this VM is only limited to verifying whether this output can be spent or not so in the simples case it has one instruction saying please check the signature in the more complex case it could be please check multiple signatures or please check some time lock or some other conditions and you would be

instantiating this miniature VM for each input run it if it returns okay then the input is well spent and if it returns error then the transaction was informed and you discarded so this existed from the day one and Bitcoin the interesting idea implemented in etherium is let's unify the state transaction format and the VM all-in-one so your state is sort of like at one single replicated computer and each transaction is simply a program that does some changes to this state and they had a notion of smart contracts where it's an object in the state with which you can interact and this object

Desai's capabilities so this object could be some sort of account or multi signature account or some think of this it's like object-oriented programming some object with more complex capabilities up to the ill-famed dao this unification is what was cool about etherium so to go back to the Z KVM so what we learned from Bitcoin and etherium is that there is a tension between a flexibility safety and scalability it's a quick question does stellar have a VM so stellar doesn't have the VM in the like common sense but it does have operations so each

transaction is a list of high-level operations and in this sense it's very similar to the KTM because operation since the KVM they're also high-level you don't have gonna it's not it's not like x86 CPU instructions set where you do some you know bit manipulation and it's also way higher level and aetherium where you have to just build up you know tiny data bases inside the etherium state machine so it's high level in sense that you operate on a little concepts like where this value should go or should I issue this asset should I retire it I want to check that in you know ten conditions stuff like that so it was very similar in to GK diems in the sense of the separations but

installer they're implemented as just enumeration of things that you could do in the transaction and it's less like a programming language while is he KVM it's more like a Bitcoin like stack programming language so the cool thing about the key VM is that it combines the good ideas from Bitcoin and gue ladies from etherium without sacrificing safety or scalability so in the KTM you have a transaction that is mostly defined by program which is similar to theorem but you also have the unique subset as a state in the state machine like in Bitcoin so what happens is the transaction expresses the connection of inputs to outputs Lex says

I'm clean this output but the outputs are actually objects that are instantiated and could be could be frozen that contained data and financial values and in those data in financial values are sort of protected by another program with sub program so in in the key BM transaction you have this one single program that connects inputs and outputs interact with these contracts and as a result creates new outputs so that you get full flexibility of expressing arbitrary conditions you can move values around you can have conditions covering multiple values but at the same time all this validation is local to this particular transaction so

once you've done validating it the only side effects that it has is the list of consumed outputs and created new outlets just like in Bitcoin this means that you can verify multiple transactions in parallel and then resolve any conflicts at a very simple utak so set operations so you said the KVM comes a little bit from TX vm so where is what's that history and what is TX vm and so what's the change to z k vm so the x vm is something we came up for the chains version of the multi-asset blockchain protocol with Dan Robinson Keith Erick public stain and Katharine and myself and before TX me

and what we had is something like a Bitcoin like data model and transaction format to which we were trying to bolt on confidential assets protocol so confidential assets is a generalization of confidential transactions invented by a Gregory Maxwell Adam back and the other folks at Vox dream so confidential transactions is simply about encrypting financial values in the transaction and checking that in puts and outputs balanced and confidential assets is a generalization that was produced independently and pretty similarly by block stream and chain in 2017 where you generalize this to multi-asset at blockchain and block stream implemented it for a liquid system that they have

so in converge assets you keep at the same logic like the inputs must balance with outputs there is an extra twist that this balance equation should work for individual asset types so if you have a couple of currencies you should not be able to transmute doors and tiers and doors themselves should balance and the earth should balance so we were experimenting with this also trying to bold it into our data structure which turned out to be pretty complicated at some point we even had a little graph with sort of like a little directed acyclic graph as a transaction forward which was a little bit crazy until Dan and Kieth came up with a cool idea of expressing all the movement of the

values inside the transaction not as pieces of a graph or some you know static data envelopes for data structures but simply as items on a stack and a stack machine and expressing all the logic of moving things around in directly in the programming language so the big difference would be that all those predicates and conditions would not be confined inside the outputs but would be available on this kind of flat at the transaction level so that was the innovation and we called it t --xv M stands for a transaction virtual machine okay so how does the EVM or how does the how does T XVM compared to the EVM is it

similar at all so there are some similarities but they but conceptually they are very different so the similarity is that your transaction is mostly defined by program that does things the difference is what these programs are doing so in EVM you have a global state of various contracts and you can do arbitrary changes throughout the whole global state of the system so contracts can call out the contracts and you can use the whole state as sort of a library of functionality and contracts also BPM as two big degree focused on giving you computational capabilities like you can literally compute things and arrange

data so you can build if you want to do the custom asset like there was a or C 20 tokens you have to build something like a little Bank inside the contracts at the you still have to write this little table and have this list of accounts and balances into this like withdrawal deposit actions on it while in TX VM you have a in a higher level instruction set where issuance and movement of assets is a first-class operation you don't have to kind of synthesize it and the goal is not to compute things but to be able to express common financial contracts so if you

have a need to have an asset that has some conditions on who can move them and how they can be able to trade it or to create an order book then you have enough tools to express just that but you're operating on a higher level so you the assets are your first-class citizens not the numbers the TX VM is so that it can't handle any sort of computation it you wouldn't be able to run anything complex you wouldn't be able to run anything past value transfer on it like there's no of zero value transactions in the TX VM is there you technically you can do that but it's not designed at optimize just for that and if you're doing things that is designed for they would be efficient and

straightforward so you normally want to compute something like whether it is some combination of parameters and inputs is satisfying certain formulas and so like allows an unlock of the value you can totally describe this in cakes VM but if your goal is to have a complicated state machine that has some you know long algorithm to compute stuff with a bunch of data to process then it could be there impossible could be possible but very suboptimal okay suboptimal got it so is the TX VM turing-complete

like can I do whatever I want in it or not so the XVM is too incomplete it has loops and jumps and has a run limit that is our version of saying they like the gas in it however I mean that's the thing you there is um it's kind of more high level than easier but if you really want to create you know can a custom logic of like walking the miracle path and proving some inclusion of something somewhere you can do this and would be efficiently computed and it takes me I would still guarantee you that there's no hard to track down side

effects throughout the whole system happening because everything is confined to the unique source that you're spending there you can do some single toasts like a single utak so that is a super smart contract that people interact with and the cool thing that all the race conditions and conflicts and accessing this singleton would be resolved by people off chain so the note that verify transactions they would just have very you know kind of localized logic to to process so that's that's the cool thing if you want to do something kind of crazy complex with exp in which you can in the KVM some of those things were revisited so see gibeom was even higher level than TX am it's not you

incomplete it doesn't have run limit or gas it's it's more if you look at the what is happening well you keep the kayvyun transaction it's more like operation of a parser so there are no loops there is like only one direction and in return you get even better safety there are performance guarantees and it all works nice with confidentiality features so yeah I'm not a big fan of promoting the idea of Turing completeness because it's one of those things that like gets thrown around a lot as an important thing or like as a thing that you can talk about but like yeah I always come back to this joke that CSS is turing-complete and

doesn't mean that you actually want to program in it it's interesting though like once you go non Turing completes usually people go there with a very specific use case in mind so if you look at or like proof assistants they go to non Turing completeness because they need to be able to start statically guarantee like runtime you know execution time or or like you bond-buying like having bound computation time and not having to solve the halting problem and various other aspects like that in zk VM when you go to non Turing completeness what's the use case that's in mind like what why go there what's the intention that you

should be able to program to put it short the use case is the financial contracts with blockchain acting as a court and this a concept actually blockchain is a court belongs to Gregory Maxwell and he probably was you know explaining this at Bitcoin events so Larry is the blockchain is not a replicated computer to compute things because even in an aetherium you can you can and you do compute things off chain anyway you don't really need other

people to recompute this again for you the goal of the blockchain is to get the security a lot of computations to you what's the most that you need is the proof that things were computed correctly the simplest example is a digital signature no one is competing the digital signature on chain it is computed completely in private with your secret key but what you get on chain is the signature that can be verified in public and the idea of the KVM just like bitcoin is around public verification of private computation so to kind of loop it back to the contracts and always you know in a custom logic like well what's

this place they're in financial relationships you may have some relationships that have formalized conditions for resolution right so if you will say have a loan that could be a collateral they could be conditions for unlocking this collateral by either party and when you can formalize some of these conditions you can put them and encode them directly into the smart contracts on the blockchain that would sort of protect the collateral or money that you loaned and this is this is why

you use the blockchain for so the way you just describe this it reminds me a lot of some of these other zero-knowledge projects usually on on the theory and things like roll up what matter Labs is working on these are like ZK proofs as like check-in points using plasma like structures but having the zero knowledge to prove the validity but in that case it's not private and I'm curious in your case it's both so it's like proving the validity but at the same time keeping it all private so zkv I'm stone somewhere in the middle between kind of low tech Bitcoin and high tech things like coda with the recursive easy case narcs and zags a that also uses one level of recursion

for proving the computation so all of these ideas have this common sense that we want to somehow express the conditions commit to them on the on the blockchain which effectively locks up funds and then we can unlock those funds satisfying those conditions and then we somehow prove that we satisfy them so in case of bitcoins happening all completely in the public in case of zk DM data parameters and financial values are encrypted and in eggsy for instance the logic that we commit to is fully encrypted and private foolproof yeah yep

so yours is okay I see so it's somewhere between so it's not it's like the way I've understood sexy eight through our conversation we've done an episode on on that it was that it was baked into it like the exact way the transactions happen is all made in very very private ways and everything like this the the privacy is is part of its actual function in your case is it more like added on top of so in the KVM your logic that you put into your transaction is optionally revealed so the transaction itself is a program which you reveal like in etherium or Bitcoin scripts

however if you walk the valley with some condition you can pack this condition in a single public key through the taproot protocol and when you want to lock the value you have two ways to to do that again remember that blockchain is a core so how to do that if you have a cooperation between all the parties to the contract then what they will effectively do is compress the contract logic in a single multi-party public key which represents a multi signature condition and here we're talking about an out of n condition so all the parties have to agree mutually and in this case

they can produce a single signature to unlock this value and do something in the transaction and the original logic of the contract would never be revealed and the cool part is that once you spend or lock and lock this value this way it is indistinguishable from an ordinary single key account so it looks exactly like just transferring money from a personal ward so if that's the common scenario where people cooperatively unlock the funds then custom contracts are indistinguishable from just individual accounts so the whole block chain consists normally of transfers from a public key to double-team so that's

pretty cool for from price perspective however if you have a disagreement if we have a contract between ourselves and it times out for insisting 11 times out and I'm a debtor I don't show up in time and you you want to you know move on then you can open up the contract and show to the network amiracle branch in this may be a big tree of different options and show that there is one condition there just for you that allows you to lock this failure so you reveal it and it protects some of my interests so it process checks the time out actually occurred so you don't just take my collateral you actually you

know have waited proper amount of time and what happens is you reveal some part of the logic on the blockchain provide the necessary data in the transaction to satisfy it and the network verifies this logic and allows you to publish this transaction so here you have this reveal of there let's say the formula but Anza KVM you don't have to reveal the data and the actual financial values that are taking part in this formula so if you have some specific time out amount or you have some specific price or type of asset or amount of acid all of these

remain encrypted okay alright so how does like now I'm now I'm really curious how does Z KVM compared to something like Z cash because there's a few things that you just mentioned it sound similar to a Z cash construction yes so Z cash is strongly focused on protecting privacy of transactions so the main focus in Z cash is to keep the transfers potential and anonymized so whenever you make a transaction it's not linked in any way to the previous transactions that you might've made which is very different from many other blockchains how they work because they explicitly

link inputs and outputs or some state changes like in aetherium so z cash breaks this link and it does that at expense of all the other considerations so for instance if you want to have some custom contracts you have to do a transparent transaction you cannot use this special type of chain can you show that a private transaction where you simply prove that the coins were moved correctly without being controverted but you don't have any room to insert any custom conditions on this movement so that's one thing and the key VM is trying to protect the confidentiality of data and draws the line right before not

approaching the anonymity so in C KVM inputs and outputs are directly linked just like in the Bitcoin okay so which part is private exactly then so what is private is DSO think of this is similar to tor versus TLS so TOS protects the contents of your connection it doesn't give you any anonymity guarantees so when you connect to google.com you send the packets from your computer to google.com or well those are encrypted and if you want extra anonymity you have to do extra work so you have to connect through the two or three VPN will have some like layers of interaction this is similar to how you know you would do this in Bitcoin you would have to do

multiple transactions pass them to the mixers or use Cohen join or use some some sort of protocols outside of the core protocol and to improve anonymity of your transfers and a for starters for instance your you use one-time public keys so every time you receive money you receive on a different public key that's just basic thing and then you have to do the extra steps so easy cash is designed to not require those extra steps it's just baked in special sort of accumulator in the protocol from which you can take the money out put money in and those links are broken so the reason why the key VM is not doing that is the scalability it turns out whenever you break the link

between the input and the output whether it's the cash or is done like in Manero where it's not as good as NC cash because you don't have the this global a name it is that you have a handful of can a fake outputs mixed in by your choice and inside the transaction so in either case you don't have explicit check on which outputs are already spent so you have to introduce additional mechanism for preventing double spinning and then all the occasional narrow it's done through a set so called the set of nullifiers so unifier in C cash and key images in Manero so what happens is every time you try to spend a coin you have to show

this unique string of numbers and that was not supposed to be used before so everyone and the network has to remember all of those strings of numbers and check that your newly created transaction doesn't use one from this set and this is very different from the unique so sad because in unique subset you only have a set of unspent things which grow scan immoderately for instance and Bitcoin the whole boxing is like over 100 gigabytes but the unique subset is only 3 gigs that kind of grows proportionally to the sort of to the user base it's sort of mentioned it but like so you keep these transaction you keep the you sorts or not it's not

anonymous yeah it's not anonymous at the at the base layer so at the base layer you have pseudonymous addresses like in Bitcoin you have this single-use public keys you have direct link between person APIs and to anonymize those transfers you have to do the all the same things that you would have to do in Bitcoin so would have to do coin join to cooperate with other nodes in the network to combine multiple payments and one to increase the anybody set or you would use mixers or you will use multiple like multiple layers of those things so we understand the model of accounts now and

going tying back into your to your previous thing you said that what you get private is the data so what is the data in that case that is private yes so see kvm is like TLS without tor so you protect the data which is all the contract parameters and all the financial values that are flowing through the system so if you have a transfer of some amount of certain asset like five issued dollars you would have the type of this asset like processor type of currency encrypted and you would

have its quantity also encrypted and if you have some additional parameters in the contract let's say time interval or price or you know some counters you can keep those encrypted to okay and what you would expose is transaction graph and you will expose the minimum required logic to satisfy the predicate so if you have some formula that you have to satisfy to unlock some money look that you paid back the loan with interest then you would have to show the formula it will be executed as a plain program but the variables on which it will

operate would be all encrypted okay that's interesting so the contract itself is in plain sight yes except it's only one branch and only if you have to reveal it so if parties cooperate they would never have to reveal the contract just like in a court like if you if you have cooperation you would not go to the court you would resolve it in private but if you don't cooperate then you go to the court like to public network and show the necessary contract details you don't have to show the whole contract just one branch and say okay this is like security branch that protects my interests I want to invoke it here's my proof and here's my

transaction so as an analogy like if you had crypto kitties the contract itself might be public but you can't you don't reveal like which kitties you've traded you just reveal that person a so the kitty to person B but they don't know which or for how much exactly okay that's the part of it that you hide yeah so it may seem like not such a big deal but it's one of the most important parts and another important part is to keep the whole system actually scalable you know great these buy a lot of people and if you want to protect your transfers even further you can do this with like add-on protocols not of the not of the

consensus layer where it's hard to scale but outside it so you can do coin join like the mixers are like VPNs of blockchains the coin joint is sort of interactive animation too so a question on you said that if if both parties are cooperating you don't need to reveal the contract that sounds to me like both parties actually need to be online when the transaction is made yes so it depends on what you mean by online if they have to construct a transaction that you have to do this one after another like it's a Multi multi step process but it's not like they actually have to be in the same you know time zone sitting in the

same room they could do this step by step I mean insurance so I can you know initiate my transaction send necessary pieces to you and then go go home and then you will like complete it next morning and then when everything is you know signed then it can be published right so they don't need to connect to each other but basically person a sends out a transaction with the relevance encrypted pieces person B can and download that sync that through the network you know do their part of it and send their part of it back that's exactly right okay so I think this is I actually have

to say the comparison to from Z cache to CK p.m. has been really helpful to to dig into this so then let's let's actually try to do the same thing for the sexy protocol how do you see yourself comparing to or being different from the sexy protocol so sexy is trying to hide the actual computation so the idea is you want to you have a custom contract that protects the funds but you don't want to reveal the logic of this contract so for doing this actually is using Z key snarks there's a zero knowledge proof system and it's using it recursively kind of one level dip so

that you prove ins your knowledge that you have proven in zero knowledge have the computation of this contract so the KVM doesn't do any of those things so the King says all right so if you have some custom logic you just you dump it on the chain and people will run it as is so there is no like encapsulation in this opaque gonna does so it's proof you then and also like Z KVM doesn't use snarks either right so that's the other yes it does not as you keep me instead based on bullet proof so there is a very interesting contrast between snarks and bullet proof these are very different

and the difference in them really influenced the design so it almost never makes any sense to just swap one for another so it's not like it's just one is faster and another one is better in some other way they're so different that the heavily influenced how you design the whole system and a system that makes sense to be built on one doesn't make any sense to be built on another and vice versa so for instance if you have something like z cash or is eggsy where have a lot of computation that you want to do in zero knowledge you want something that gives you a compact proof with a short verification time so C key snark stands for six synched non interactive argument

of knowledge and succinct stands for this compactness no matter how much complexity have so this allows you to pack a lot of complexity and this is white enables is X the end C cash those don't make much sense for both Bruce because bullet proof give you a logarithmically sized proof and linearly the linear complexity in terms of time that you spent for verifying it so but proofs make sense for shorter and shorter statements smaller temptation sizes but the import like the other important difference between them is that snarks require a trusted set up and bullet proof do not and the key part is

actually not the trusted part but their set up work so if you have a set up it means that you lose a lot of flexibility you have to figure out the logic the formula that you want to verify upfront you have to build a system that verifies the proofs about this logic and deploy it and only after that you can use it but in Z KVM we walk away from all of this altogether where you don't even have to have this multi-party thing between the parties interacting with each other you can just generate them without setups at all yeah you may still need like if you have a bullet proof

proof between multiple parties you would still need to cooperate to construct it but boot proofs allows you to do all this on the fly so the whole network would construct the proof structure or the constraint system right on the fly from the instructions in the transaction so your transaction would say I want this to be in this you know condition this I want this formula to be true I want this in Formula out of all of these instructions as Gideon builds constraint system inside bulletproof on the fly and this is what every node does when they verify a transaction and then they apply this proof that is attached to a transaction to that constraint system to

verify it and then constraint system was thrown away and the VM was destroyed once the transaction is is verified this permits you to use first of all way in a more robust cryptography can I'm more like time-tested because it's way simpler advanced snarks or or any like curves that use pairings and it allows you to build in a more simple fashion those you know custom at hull conditions right on the fly and it performs pretty well so since it's all very you know narrowed down to can create you know high level conditions for financial contracts the con the the

logic of the contracts is not having a lot of moving parts and so the cost of both proofs this linear cost is not bad it's actually gonna pretty low together with you know all the other things that have to be verified in Syria knowledge so you could do like a payment in one or two milliseconds we've talked about the zero knowledge part being sort of protecting the data that goes into a transaction but what about the scalability part does the zero knowledge part play into that where does the scalability come from to me it sounds more like that is property of having non global states and being able to paralyze

transactions yeah so the main part of skill abilities to having the reasonable state model so you can verify things in parallel and you don't have any sort of like time bombs where you accumulate more and more data with every transaction that you have to scan which has nothing to do or knowledge is it's just a choice of how you you know design your clique stays state well actually I'm not correct it has to do with zero knowledge because for instance for Zika anonymity feature you have to have this you know accumulator of Luud virus so it can affect your state so if you don't provide anonymity

then you don't have to make this trade-off so you can have a very small state and then you can go and further and compress the state with miracle trees and the Utrecht so scheme so it takes virtually constant space look around kilobyte but the other part is that so Ziggy VM uses the script ography stack that we worked on with Henry de Valence and Cathy youn at the chain so it starts with the curve 255 19 Dalek that implements Edwards curve define 19 that is pretty famous it's one of the fastest curves available for people to use and it's not the same curve as Bitcoin users because it's the different

shape and on top of that it's it's implemented pure interest and on top of that Henry developed a ristretto prime order group there is a restricted version of decaf which was created by Mike Hamburg that canner turns this symmetric non prime order curve into prime order group which is what you need for all sorts of you know cryptographic protocols so it gives you the correct abstraction so now we have this stack written to rust and why do we use this curve well because it allows very efficient parallel implementation so you can use seemed instructions and parallel wise computation of various you know

elliptic curve operations and very efficiently in hardware and he was able to demonstrate the significant performance improvements or anything else out there so it's almost three times better than I left my Bitcoin curve implementation see presidents there any other things that are happening to make the scalene side better like you've just listed two right so so it's the design of the state yeah that's the highest cryptography mhm and this cryptography is also batching also if you have a lot of things to compute when you have aggregation of multiple zero knowledge proves and for instance these signatures

are all matched together all of this if you have like waterful load and to compute then you can do it even faster when you do this in a batch so you can save a lot of CPU time also bulletproof are scaling logarithmically so if you a granade multiple transactions in one eye which you would for instance want for privacy like you have a coin joint where you know ten people just you know mix inputs and outputs in one place they could produce a single bullet proof proof that what cost is virtually as much as their individual proofs so they save on bandwidth significantly what what is the KVM then is it like do you

imagine it actually acting as its own system does it sit on stellar does it work with stellar Susi KVM is a new experimental design it's very different from stellar it is not connected to anything yet so things like you know consensus protocol and we're how it integrates with the stellar are like not done yet we have experimented with a side chain between TX vm installer as a kind of proof of concept it's in our repository we are right now at the stage where we're still figuring out some design aspects of ZK VM before we can you know move on and decide on what is the best

way to put it in the hands of the people to try it out quit seek a VM be like implemented separately or like included in other chains like is it stellar specific or is it sort of like a like an just a new piece of research than anybody could use it's more like the letter it's an open source project and you're free to go and try to do something with it you can make an absolutely awesome private blockchain out of it if you want but it's very similar to star in its goals right it's the question is like how to make a resemble design for multi acid environment where you don't longer have this you know peer-to-peer relationships

which can a bank like system but you have this common environment for where assets could leave so issues just you know put them there and then people can trade them and you have this place cool so to wrap up we talk you touched on this a little bit already but what state is it in how much is built how like you you sort of mentioned you could plug build a private blockchain out of this but do you have like networking built out you have like the core blockchain you already said consensus algorithm isn't really connected so so what states is it actually in like how how is this designed so the core design is pretty much figured out we're still hashing out

some things about the API and some you know little details but the general consensus critical parts are done and some of the kind of service functions like how you compose transactions are sorted out but there is no consensus algorithm there is no networking state I've only recently started working on a simple demo where you have is gonna private watching to play with and it's still on github it's under development so there is two kind of approach it is like a full stack thing so to have a feedback from higher level API is on the designer of the system to see if the things make sense so if we have some

unnecessary features or unnecessary complexity we could hash it out before it's too late so we don't just you know figure out some low-level thing fix it in stone and then later learn that it's not good enough so we're gonna taking they're kind of full stack walking development approach cool cool so thank you for coming on the show and sharing with us the zk VM protocol yeah and I guess good luck with the project thank you so much for having me thank you and to our listeners thanks for listening thanks for listening you [Music]