ZKPodcast: Zooko talks Zcash on our 50th episode

Transcript

Do you want to break it up into multiple episodes? we'll do is it's the 50th episode and we have a special episode, 2 hours with Zooko. Welcome to Zero Knowledge. A podcast where we explore the latest in blockchain technology and the decentralized web. The show is hosted by me, Anna. And me, Frederick. Welcome to this special 50th episode where we sit down with Zooko to talk about his path into Zcash, the life of

Zcash, and what the future holds. So, we've covered a bunch of zero knowledge topics and one of the projects that keeps coming up is the Zcash project. And it is pretty exciting to have you on the show because I think first you've seen the sort of history of zero knowledge in application in crypto from the start. And I think this will give us a chance to set the scene of Zcash. We definitely would love to have additional people from that from from the company or from foundation on the podcast in the future. So, I think to

start, it would be really great to find out a little bit about you. My name is Zooko and uh I spend all day and all night thinking about Zcash currently. What else? For those that are not in the know, you have a long history in in the internet and sort of the cyberpunk movement a little bit and like can you give some background on sort of what what that world is that you're coming from? Let's see. Should we go in reverse chronological order or chronological order? Um I got my first home computer when I was five. It was pretty awesome.

This was a Five. 1979 or 1980, I think. parents do? Uh, my dad worked at a company. It was named Texas Instruments that made one of those early home computers that you would plug into your TV. You know, that came with a keyboard built into it. It was like the Commodore 64. Uh, but it was the other one that was on the market at the same time as the Commodore 64. So, I think he might have been using me for market research to see how I responded to this device, but he set it up in a closet in our home uh, and put a chair in there so I could bang on it. That's how I got my start in computing.

That sounds amazing. Little Zooko sitting in a closet banging on a computer. Then along the way you've been involved in a bunch of like decentralization projects and internet projects. What would you say are like the most notable things before coming to settle, I guess, a little bit more on Zcash? Most notable. So, Digicash is really important to me. It was a had a big effect on my life and it's it's an important thing that other people can learn from because it was a cryptocurrency at the dawn of the World Wide Web in the mid-90s.

And um, PGP was important. I had a little I contributed in very small ways to PGP. That was like the first mass market end user oriented encryption program that I know of. Uh, but it was an important political uh, battle because the United States government targeted the author of PGP and that made That was like the What do you call that effect when it's named after some famous actress? Streisand.

It's the Streisand effect, which is where you try to suppress something and that causes it to become interesting and widely spread. Yes. Uh and that happened when the US government tried to suppress this encryption program PGP in I guess the early '90s and that made that made it interesting. Everyone wanted to know why they were targeting this thing and uh that made this author Phil Zimmerman into a cause that people wanted to support. And that was the dawn of the cryptography civil disobedience movement.

So, you were there. You saw it. Um as a, you know, as a minor participant, as a member of the crowd of cryptography civil disobedience protesters. When you were really young and you were doing these kind of you were on the in these communities, were you super active? Were you talking to people? Were you just watching? Like when I was about 19, I got onto the internet for the first time, which was super exciting. Discovering the internet was like coming home to my tribe for the first time. You know, the people on the internet felt like my tribe, unlike the people in the town where I grew up with, which were, you know, kind of strange. And I I was pretty talkative, you know, I was 19 and thought I knew everything.

We meet people like that still today. Much of most most of most of what I said back then is is lost to history. As far as I know, there aren't records, even though it was a public medium like Usenet and mailing lists were broadcast all around the world, but most of it nobody has a copy of. Isn't that interesting? It's more private. At least nobody that we know has a copy. Maybe somebody has a copy and they're not saying. So, from Digicash, there's, you know, how did you get into zero-knowledge cryptography and Zcash and what was the path in there?

Well, there were these scientists who applied zero-knowledge cryptography to Bitcoin. And the result of their of that was a protocol called Zerocoin. And I read the paper that they had posted and I thought it was really promising. It's really exciting that something like that was possible. I believe I already knew Matt Green, the one of the authors of that, from other cryptography work that I'd done at my previous at my then project, uh which was Tahoe-LAFS, which is a decentralized cryptographically protected storage system.

Um can I take a minute to shill Tahoe-LAFS? Go for it. Uh you can't buy any Tahoe-LAFS tokens, but you can go download this free software, and it's pretty awesome because it's it's kind of like a decentralized storage system like IPFS or Swarm, um but it's a lot it's a lot more limited in some ways, but it's also better in some ways, and it's much much older. It's like at least 10 years old at this point. Um and it's sort of it's sort of like well-understood and mature. Um so if you're into decentralized cryptographically protected storage, you should get that source code and that science paper. But I believe it was because I was giving a presentation about Tahoe-LAFS's cryptography.

Um it was one of the first times I can't remember the very first time I met Matt Green. I'm embarrassed now. He'll probably hear this and think I don't love him, but it's just because my memory is uh fuzzy. So I saw that he and others had developed this protocol called Zerocoin, and I probably like messaged him and said, "Hey, this is awesome." or whatever. And then the next year, but but I knew at the time that it wasn't efficient enough to really be deployed as a live system because Zerocoin every single transaction required like about, I don't know, 40 kilobytes or or of data Wow.

in the in the transaction and that would be too much. Um that was it actually was the same year, 2013, that Ian Myers, who's one of the other co-authors of that paper, gave a presentation about it at the 2013 Bitcoin conference in San Jose. That was a really cool event. It was kind of like the second ever is the second or third ever Bitcoin conference. It but it was the first one it was the first one that wasn't just like a meetup with like a couple dozen weirdo fans, but it was like hundreds of people and there were venture capitalists and the Winklevosses and Roger Ver and I met Vitalik Buterin, who was working for Bitcoin Magazine.

He was probably like 18 years old or something. And I said, "Hey, good to see you." And we chatted for a minute and Vitalik said, "Bitcoin is the first technology that I've ever loved, which loves me back." I was like, "I totally feel you." Like that was the That was the vibe. It was a very exciting moment. The 2013 San Jose Bitcoin conference. And one of the exciting things was uh Ian Myers gave a talk about Zerocoin, about how you could use zero-knowledge proofs to embed private transactions into a public blockchain.

And um there's a lot of excitement about it because obviously more or less everyone in the Bitcoin community considered privacy to be not only necessary and important, but basically one of the one or two main purposes of the whole reason for existence of the whole project at that point was privacy. Uh so everyone was into this and so the Bitcoin core devs who were present, I can't remember which one it was who got up and said this, but one of the Bitcoin core devs went out of their way to get on stage and say like not to let everyone get too worked up about this. Uh it's we're really not likely to put this zero coin protocol into the next upgrade of Bitcoin because

it's way too inefficient. It would probably break everything and Bitcoin is too important to risk that kind of innovation in it. So, we told the zero coin people to go try it out in an altcoin like Litecoin and then if it works there, we could consider it. And something else that happened at that conference was that the the people who'd written the scientists who'd written the zero coin design, they met the scientists who that same year had come up with a breakthrough in efficiency of zero knowledge proofs, which is now called SNARKs.

Huh, who was that? Uh I don't know which ones were represented at the which ones met which ones at the San Jose Bitcoin conference, but in the end, the seven scientists who later founded Zcash with me are the co-authors of the paper that combines SNARKs with zero coin. So, they met each other and they realized that it's like my chocolate goes well with your peanut butter. Like the the efficient SNARKs would solve the problem of the 40 kilobyte transactions and return it and reduce it to a reasonable size like 500 byte transactions.

So, for you it was the introduction of SNARKs made it clear that wow, there is this possibility. I wasn't present at that meeting. I was at the San Jose Bitcoin conference, but I was wandering around. Brian Armstrong and Fred Ehrsam from Coinbase were there. I think they were probably all of Coinbase at that point. Um and I was standing at their table saying hi and they offered me the job of chief security officer for Coinbase. I said, "Oh, well, that sounds really great. I'm really complimented, but got all these other things I'm doing." But I didn't find out about zero cash until about a year later when those seven scientists had worked all worked out all the scientific details and published this new paper uh called ZeroCash.

And that after I saw that, let's see what happened. The next thing that happened was Okay, so I saw the paper. It was super exciting. It had this flaw, which was the trusted setup, which was that whoever set up the system would retain the ability to forge money undetectably. And then you would just have to trust that they really did delete it and and didn't accidentally or deliberately retain their secret forger forging key. Uh but it was actually efficient enough.

It looked like it would actually work in all other ways. And so at Real World Crypto Real World Crypto is a a conference that has nothing to do with cybercoins. It's all about cryptography uh because this was back when the word crypto meant cryptography and did not yet mean cybercoins. It's a really good conference. Uh no. I think this is more interesting now. So Matt Green gave a talk at Real World Crypto that year. I guess this might have been 2015. Like I can't remember when I met Matt. I also can't remember what years things happened but sometime in 2014 2015, Matt Green gave a talk at Real World Crypto, which is a really a really good conference, a really important conference within the

world of cryptography, because it's the it's the conference where all the things that could actually be practical and could actually affect humans get described get delivered. You You don't know this, I guess, but there's this wonderful field of theoretical academic cryptography, which is a dazzling intellectual um sphere of interesting concepts, like 99.9% of which will never benefit anyone other than other mathematicians who find it to be beautiful.

Oh wow. And so Real World Crypto is the is the conference to pick out the 0.1% that can actually help humans. And so, Matt Green gave a talk about Zero Cash at Real World Crypto and I was so excited. I was like, "Make sure I was the first one on the mic." And it was question times. I said, "How are you going to deal with this forgery key problem where the person who sets it up retains the ability to forge? That's totally a non-starter." And he was like, "Oh, well, we'll just like set it up on a computer in front of on a crowd with cameras and everything.

And then we'll destroy the computer so everyone can see that we didn't keep a copy." And I was like, "No, that's totally not good enough. You could totally fake that and keep a copy." And I think he might have been annoyed at this point cuz I'm hogging the mic and like, you know, spiking his talk. And he he's he says, "Well, fine then, you do it." And you were like, "Okay." In that moment. Well, like, yeah, he he contacted me he texted me or something a few days or weeks later and said, "So, about that thing, what do you think?" And so, we started talking about cooperating to to make it happen.

Wow. I love it when it's these like audience questions. Yeah. It It also reminds me I think it was when we were talking with Benedict Bünz and we're talking about these trusted setups and everything and it was talking about like how academics usually like to a cryptographer, yeah, that's just a parameter of the system. You just like, "Oh, yeah, and you have this trusted setup and then everything works perfectly fine." And they don't really care. But then when you want to go and apply it, it's like, "Oh, this is actually a big problem." In real world. In the real world. Yeah, yeah, I love that. I had that experience with the the theoreticians, the computer scientists, the cryptographers.

Like they used to call the trusted setup, the term for it in the world of science was common reference string. So, they were thinking, "We got to make sure that all the people have the same string as each other so that we can use that string as a input to our computations. So, that it's like completely innocuous. Like, the only it that the word implies that all you need is to make sure everybody's got the same string as everybody else's got, right? It's easy. But then But then after we agreed to get started on this project, so all seven of the scientists who are you know, are co-authors of the zero cash paper and me and my my little startup company, the engineers that

worked with me, all signed in to start this new project together called Zcash. And then, we had to kind of we had this very pleasant {slash} uncomfortable sent experience of having to throw out like at least 98 of the 100 great ideas we had for how to improve cryptocurrencies. This is about, I guess, 2015. And, you know how there've been like 1,000 cool ideas about how to do cryptocurrency in this way or that with all these features and you can buy bunkers to install the servers in and you can do air drops to different countries and uh they can be programmable in different ways and

So, we we we have we also had all those ideas and we had been talking about them enthusiastically for like ever. And then, we were like, okay, now we're really going to do this thing. So, the first thing to do is kill off 98 of our favorite ideas and what leaves us with like one or two or three. And one of them is, you know, we're going to implement zero cash so that transactions are private and are not disclosed willy-nilly to everyone else in the world. Yeah. Second one is, we probably need to change mining cuz if we leave the mining the same as Bitcoin mining, then that means the Bitcoin miners have a huge amount of power and if they like for any reason just choose to 51% attack it, it would be trivial for them.

The third one was we have to do something. It's not going to be good enough to say look everybody, we put the secret forgery key in this one computer and look, we're all destroying the computer because it would be too easy for like if we were tricking people, we could keep a copy of the secret forgery key or even if we weren't, somebody else could hack into that computer and steal a copy of the secret forgery key before we destroyed the computer. Right? It's just not really safe enough. We don't have technology today that can safely create and destroy cryptographic information like that. In my opinion.

So, the third feature that we decided we had to fix was how did how to set up the system with a stronger guarantee that the secret forgery key could never come into existence. Wow. And that became the first D-cash ceremony. And one of our employee employees, Taylor Hornby, I was saying, we need a word for this. It's not a common reference string, right? It's not the trusted setup because you're not The intention is to not trust anyone. Yeah, that the word trusted setup makes people think that you're trusting the group and it makes people think that you're trusting them with your privacy or something. Uh we need a a more specific word for this particular

forgery secret. And Taylor Hornby suggested Oh, wait, I'm not going to tell you what he suggested yet because you need to find out what our solution was first. So, our solution was we're going to have a multi-party computation. That's a a cryptographic process where there are several different participants uh each with their own independent computer. And they're going to collectively perform a computation to set up the system in such a way that if any one of them does it correctly, then it's impossible for the rest of them to recover the secret forgery key, even if all the rest of them are in

collusion together. So, as long as there's any one honest, it would require all of them simultaneously to collude together in order to record the secret just recover the secret forgery key. So, we're saying, so what are we going to call that thing? And Taylor Hornby said, it's the toxic waste. Because the things that each of the participants do on their own computers, those are harmless chemical precursors, which by themselves cannot harm anything. And the purpose of the ceremony is to make sure that we don't get all of the precursors together into the same room, which can form toxic waste.

Interesting. So, that was the third feature that we added to Zcash. By when you say not in the same room, we've talked a little bit about these ceremonies. Maybe let's go to that beginning when you had this worked out. What was it like setting it up? You guys weren't in the same room. Oh my goodness. That was just the most stressful thing ever. It was kind of fun, but kind of stressful, and I don't think I'll ever do anything like this again. Um because we went into super spy mode, like we started communicating with each other. Like, I handpicked five other participants. Well, first of all, I worked with Sean Boe to figure out what's the most efficient way to do this ceremony

because the more efficient it is, the more people we can squeeze in. So, we figured it would take oh, hours and hours for each person it involved. And I figured we wouldn't be able to get people to stay uh vigilant and present next to their computer in an uninterrupted way for more than one weekend straight. Yeah, that's even very impressive in itself. So, we could only fit six people in. So, I had recruited about like eight other people that I thought would be A competent and skilled that they wouldn't

get themselves hacked. It would be hard for just some random person to target them and hack them and take over their computer before the ceremony was held. And B, that they were trustworthy, uh that people would not suspect them of conspiring with me to secretly generate the toxic waste. Mhm. And I'd recruited a bunch of them. And then at the last minute, I told a couple of them, "Hey, it turns out you were decoys because we don't have room in the actual ceremony, but hopefully you've already done uh you've already done a service because if there any hackers out there that are trying to target all of us, they might have been distracted trying to hack you before now." And I might have missed one of the other people.

Oh. But it ended up with me and five other like secretly chosen participants for the ceremony that nobody knew who anybody else was except for well, nobody knew who all of the other participants were except for me or where they lived or anything. Um there were there was myself, there was Andrew Miller and Peter Van Valkenburgh who were two people that I thought were trustworthy and competent and hard to hack. And then there were three pseudonymous people. I I gave them false names and I told the other people, "Hey, I've recruited this person. Their name is Francois, whatever."

But actually those three people were that was not their name. Um and then the first two layers of defense were the multi-party computation feature of it which is that you have to hack or or compromise or get into into a a collusion with all six out of six of these people in order to recover the toxic waste. So, that's the first layer of defense. The second layer of defense is none of the computers that are handling the chemical precursors, right? The things that we have to keep separate to prevent toxic waste, none of those computers are ever going to be connected to the internet in the computer's life from the moment

it's like bought from a store until it's destroyed in a fire, it will never have been to a network of any kind. The And there's a couple more layers of defense. So, uh like the the third layer of defense is the night before we begin the ceremony, each person each of the six participants goes to a random computer store and puts their hand on a computer on the shelf and then pays for it and walks out with that box under their arm and then don't let it leave your sight until the ceremony's over and you've destroyed it. Wow.

Wow. t-shirt This is the stories are so amazing. This is the most uh complicated, strongest cryptographic ceremony ever performed, I suspect. I'm not really sure. I mean, the budget was like it was like six times the cost of a computer plus the cost of some hotel rooms plus some video cameras, so the total budget probably worked out to like $10,000 or something like that. But, I'm willing to guess that it was stronger and harder to hack than any cryptographic process that any military or anybody's ever done.

I could be wrong cuz I wouldn't know what military and spies have ever done, but we did a great job. Okay, so yeah, the night before everybody bought a random computer off the shelf. That's called random purchase by the CIA, I'm told. Uh to prevent supply chain attacks. And then uh you open up the computer with a screwdriver and you take out the Wi-Fi chip and the Bluetooth radio. And then you make sure that you've never plugged you never plug an ethernet into it, right? And then you boot it from a DVD which contains a special operating system image that we had made for this purpose.

And this is one of the weaknesses in this design. We've We've established like the first three major defenses and there are several more that we probably don't have time to go into. Um but even despite all these defenses, it's still not perfect. So, one of the weaknesses is what if the attackers put a back door into that DVD? Cuz who made the DVD in the first place? Um Sean Bowe from the Zcash company. a computer that's probably hooked up to the internet. Sean were malicious or if Sean's computer that he used to burn the DVD image were malicious, then maybe there was a a back door in that DVD. And the only defense we have against that is that we uploaded the DVD image and the hash of it to

well, the internet archive and a lot of other places so that anyone could examine it. But on the other hand, who you know, who's going to examine that and look for It's really hard to examine binaries or source code for that matter to find a back door. Anyway, so that's all that led to what we now know as Zcash. And you you past that point had a live network of some sort. Right. And I have to add like one more comment about this is that since then we did an even better ceremony and all of the output from the first ceremony is has been um superseded by the

cryptographic keys from the new ceremony. So, that brings us to Yeah, you you have a live network that this has been running for quite a while, but there there obvious sort of drawbacks. Creating a shielded transaction was slow, required a lot of RAM. And now, just a few days ago, you've launched Sapling, which huge speed improvement. We can get into some of the technical details there, maybe. But yeah, there again, you need to redo the entire ceremony. Right. And this time, it was done By then, we had developed a more efficient multi-party computation protocol. Remember, the the step in the first ceremony was figuring out how many

people we could squeeze in. Yeah. And Sean Bowe and others developed Let's see, Ariel Gabizon and some others that developed a a new method of doing the multi-party computation, so that you could have like basically no limit. We ended up with 80 or 100 different people participating in the second ceremony. And there was a lot more diversity in what they did, which was really awesome, because for example, in the first ceremony, one of the weaknesses was the boot image for the the same boot image that all six of the computer of the computers used.

Uh in the second ceremony, some people wrote their own software and used that to um And people had their own like which kind of computer they used, like was it a Raspberry Pi or what, and where they got their randomness source, like one of them had a Geiger counter with toxic literal toxic waste, like radioactive um material from Chernobyl from the Chernobyl accident. Damn. And they used that and sampled the timings of the decay events to generate the random numbers.

Wow, that's so elaborate. And I know it's so elaborate, but it but there were like 77 other elaborate things like Wow. um I actually participated by proxy in it. So, my friend Jared was on the mailing list and what like when it came to his turn, he's a statistician and so he was just sort of like, "How can I come up with randomness that isn't like a Geiger counter doesn't require you to go out and buy a bunch of shit?" Uh and he thought about it for a long time. So, in the end, he asked like six of his friends to uh run this program and like yeah, get them to through you know, do all the work. And then he

collected the work from those six and then he went out in the streets of Auckland, asked a random person that came across the street to name a number between one and six, and then he picked the output from that person and sent it in. Oh my goodness, I didn't even know that. Did he post that to the archive? Okay, well, I overlooked like there's It's great. at least 80 of these stories. It It was It was awesome. Let's talk a little bit about what that was for. So, this just happened recently, right? This This just happened 5 days ago, 6 days ago?

of that work to generate those random numbers was over the course of the last several months. And then a few days ago was Zcash's second birthday. Yeah. And on its second birthday, we activated on mainnet the new cryptographic improvements that are powered by all this work. Cool. And that happened so all of the previous work had happened, but like what was you activated? What is What was that? What does that mean? Is it similar to a hard fork? Exactly. Yeah. It is a hard fork. Yeah, I don't call it a hard fork because whenever I say that it's a hard fork, then people start contacting me saying, "What will the new coin be called and where can I buy some and how much will it be worth?"

Smart. I've uh gone yeah, railed against this term so many times that people don't listen to me. Hard fork is the hard way. You can't You can't determine a hard fork that causes a network split versus a hard fork that's a network upgrade. So it's better to call it a network upgrade. So we call it a network upgrade. Nice. And that's that's what happened 5 days ago on Zcash's second birthday was the network upgrade kicked in so that all the nodes on the Zcash network became capable of verifying the new optimized zero knowledge proofs. So this is your Zcash 2.0.

Yeah. The first version Zcash 1.0 that's been running for the last 2 years, it takes like something on the order of 40 seconds to generate a payment even on a high-powered laptop and it's not even feasible. Nobody ever implemented paying with Zcash encrypted payments from a mobile phone because of the computation cost cuz it would drain your battery on your phone. And all these cryptographers and these really great engineers that I've been describing who are part of the Zcash team, they worked for 2 years straight to come up with a series of cryptographic innovations that dropped that performance cost from 40

seconds to around 2 seconds. I want to talk about that in 1 moment. The 1 thing I want to do before is I want to link cuz I still don't 100% get where the trusted setup links to the upgrade. We talk about it a lot, but it's like I get what the trusted setup is. I get that this time the trusted setup was even like bigger and there was all these awesome stories. What part of that led like I don't understand where the where this links into the actual upgrade. Well, let me tell you a little bit about why is your why you need a zero knowledge proof in a cryptocurrency.

So with Bitcoin, you can make your transaction and that shows and also with Ethereum, you can make your transaction that shows that you're transferring some of your money from you to someone else. Mhm. And then you give that to miners. And the miners need to choose whether to include it in a block or to reject it. So, if you make a transaction that says you're giving more money to someone else than you owned in the first place, they're going to reject it. Or if you make a transaction that says you're giving money to one person and you also make another transaction says that you're giving the same money to a different person, that's what they call a double spend. Right? The miners are going to accept one of them and reject the other one. And the way they do that is by inspecting who it's coming from,

who it's going to, how much it is, and then inspecting your history to see where you got it and how much you got. Mhm. Well, Satoshi and Hal Finney and others tried to figure out how to avoid the miners being able to inspect everyone's history. Because that means anyone in the world can inspect everyone's history. And that means there's no no privacy. And what you've been doing, what you've ever done with with your money. And Satoshi and Hal couldn't figure it out back then because they didn't have efficient enough zero-knowledge proofs back then when they were doing that in early 2009. But with the invention of SNARKs and the invention of Zcash, we can now use zero-knowledge proofs, and

here's why. You can now encrypt the transactions. So, you're a miner and I say to you, "Here's a transaction. It transfers some amount of money. I'm not telling you how much cuz it's it's encrypted. Like it's an opaque envelope. I'm saying, "Inside here there's a transaction. It transfers some amount of money, but I'm not telling you how much. It transfers it from me, but I'm not telling you anything about who I am, to so-and-so, but I'm not telling you anything about who they are." But if you ins- but you can inspect something.

Well, the difference is in in Bitcoin, the miner has to like open up the envelope and study the history of both parties or of the sender in order to determine if this is valid. In ZeroCash, you give the envelope that's hit that hides all the content, and then you give this accompanying magic stamp. Mhm. The zero-knowledge proof. And the miner tests the zero-knowledge proof, and they say "Okay this zero-knowledge proof convinces me that somebody who did own some money, and they had never previously double spent it, they must be transferring some of that money to someone else.

Or else they would not have been able to produce the zero-knowledge proof. And but the zero in zero-knowledge proof means they don't they learn zero extra information beyond the fact that somebody transferred a valid amount to somebody. Does that make sense? So, this is why we needed zero-knowledge proofs, and why they have to be so efficient is you have to include one with every transaction. So, I understand this. So, the question that I have is how does the trusted setup What is coming out of it that would force an upgrade? I think this is where the piece is missing for me.

the question. imagine is that at the end you'd have something like a code or something, but I don't know it's not like it would write up the entire protocol code like does it unlock something? the thing is the zero-knowledge proof the prover uh who's generating the transaction, they've got to create the zero-knowledge proof. And then the verifier, which is every miner and every other full node on the network, they have to verify that the zero-knowledge proof is correct. Yeah. Um so, they know that the prover really had that money. Both of those operations in ZK-SNARKs, they use a certain sort of like a public key, you can call it. It's kind of like a a really complicated public key. And you use that public key to generate the proof, and you use that public key to verify the proof. So,

there's some zero-knowledge proof systems out there where you can you can get the public let's call this the public parameters that the prover and the verifier both need to use. There's some zero knowledge proof systems like bulletproofs where the we can generate some parameters for the all the verifiers and all the provers like here's some parameters guys, everyone use these parameters. And everyone knows that there's no backdoor to them. But with ZK-Snarks, the only way to generate the parameters for everyone to use uh comes with the accompanying toxic waste that allows forgery, okay? So, the whole point of the first ceremony was to

generate the public parameters with six different people so that we had six different precursors and since we we believe that we prevented all six of the precursors from getting stolen or getting conspired together, therefore we believe that the toxic waste never came into existence, okay? Well, when we wanted to launch the new improved cryptography that just now activated in a network upgrade on Zcash, uh we had to generate new parameters. That's the problem. The the parameters that we generated the first time can't prove the new efficient proofs, they can only prove the old inefficient proofs.

I got it. That's what So, you've been working so all of these years you've been working on building this upgrade, but the only way for it to come into existence is for It required another ceremony. And you know what? This doesn't make me real happy to think about, but every time we make an improvement using this current Snark-based cryptography, we have to do another ceremony to make sure the new improved parameters also didn't their toxic waste didn't get generated. Right? So, hopefully our cryptographers will come up with a better way to do this at some point. And we have a lot of ideas that we have been working on.

And it sounds like it was like a lot of fun and there's all these cool things that happened, but this isn't something that I mean, this is not optimal if you want to develop this system quickly, I imagine. Yeah and only be able to do it with such a which set with such a And it's risky. I don't like it because it's it's risky. Like Zcash is currently worth something on the order of a billion dollars depending on how you measure. And I would say that the amount of security we went to in the first ceremony in 2016 and the amount of security that all these other people like Frederick put in to the second ceremony in 2018 is enough. Like I don't think any attacker well, hey, the attackers would not have

guessed back in 2016 that Zcash would be worth a billion dollars. So they would not have tried that hard. By the way, somebody I think did try to hack the first ceremony and that's very interesting backstory. And uh is it okay if I shill another podcast on your podcast? Absolutely. We love other podcasts. Okay, so NPR's Radiolab is a really good podcast with really good storytelling and they made they did a story about the first ceremony, the 2016 ceremony and it's amazing and creepy and since it's Halloween season, this is a great time to listen to it. Uh because it seems like someone tried to hack us during that ceremony and they failed. It's really amazing. Cool.

We'll link to that uh in the show notes. Um but my what I'm saying is Zcash is currently worth something on the order of a billion dollars. I don't think anybody was capable or willing or aware in the past that they would say, "Oh, we'll like hire a team of or like six or 80 teams of ninjas and have them backdoor everyone's computers or whatever we need to do." That would cost I don't know, tens of millions of dollars or something and then we would have uh compromised the ceremony. I I think that would be probably impossible even for the 80, even if you had tens of millions. Maybe. But if you had like a billion dollars, I I don't know. You could you you could you you could hire an actor to pretend to be

a hacker and take the name Frederick and work in the crypto industry for a few years and then hire 80 more actors. I don't know. It's it's it's all ridiculous. Like what we've done is already super super powerful. However, what if we need to do it again? And what if Zcash is worth a trillion dollars and it's time to do it again? And the problem is if someone actually does it, goes unnoticed, they can forge money forever. I mean, and if they forge it slow enough If they get this toxic waste If they If they do it slow enough and exploit exchanges slowly enough that it doesn't really get noticed, you'll leech an enormous amount of value out of the system before it's even noticed.

Almost as much as national governments can do by just printing more fiat currency. A little dig in there. But actually, so we do have a defense against that, which is the thing we call turnstile, which is already in effect. Um so, I totally do not believe that anybody could have recovered the toxic waste. Oh, let me just throw in one more fun detail from the first ceremony. There were three pseudonymous participants that only I knew who they were. As soon as the ceremony ended, two of them, their real names were revealed. One was Peter Todd. The second one was NCC Group, which is this giant information security consultancy who

were running their endpoint in this laboratory under surveillance and trying and like doing all these, you know, analysis of what they were doing. The third one has never been revealed. His name is John Dobbertin. That's his pseudonym. Okay. But John Dobbertin is one of my favorite people in the world and I do hope that someday the story comes out before we're all dead uh of who he was and what he did. He wasn't the one who drove into the woods of Canada and That was Peter Todd.

That was Peter Todd. Yeah. Oh, I love that story. Yeah. Oh, that's so cool. My point was I totally do not believe that any attacker on the earth could have gotten anywhere near compromising even one of the six people who did that, much less all six. And I totally don't believe that any of those six people would have cheated and tried to steal the secret because that would have been immoral and I don't believe any of the six would have done that. So, I guess what you're saying is like there's it's not that you're worried that this toxic waste could really be used, but just the fact that it exists maybe in the future.

That it could exist. Oh, yeah, it doesn't exist, but could exist. Um this is what's making you look closely at like SNARKs. Yes, at other zero-knowledge proof systems that don't have a toxic waste problem um even though like Frederick said when we started this the academics didn't even realize this even mattered, but it turns out to be one of the most important issues. Uh but also I was going to get to what Frederick said about how if someone had a forgery key, the toxic waste, they could they could siphon like a huge amount of value out of the economy if it were a big enough economy and they did it so covertly enough they could siphon and more and more value out. Um like yeah, governments do. Uh

but we have a defense against that which is what we call turnstile. So, if anyone had the ability to forge Zcash in Zcash 1.0 as of the div the the network upgrade to Zcash 2.0 a few days ago. You can't send crypto You can't send Zcash from a Zcash 1.0 address to a Zcash 2.0 address without revealing how much is moving. Revealing to the public on the blockchain how much just moved from the 1.0 bucket to the 2.0 bucket. That means over time if the amount that moves out of the 1.0 bucket is less than the

amount that should have ever been Wow. in the 1.0 bucket, then we have proof that no counterfeiting has ever yet been performed in the 1.0 era. And anytime you do another upgrade, you'll be able to do that same check. again every like 6 months or 12 months. We can make a new bucket. And this is a tiny loss of privacy, but I don't think in practice it would actually threaten anyone. You never You never reveal any information about yourself, your location, linkage to anything else. You're You don't have to reveal anything about your balance if you if you run a tool which sends your money over the turnstile in like two or 10 random amounts at two or 10 random

times, then I think we can have a public accounting to double-check that no counterfeiting happened in the previous 6 months without really harming anyone's privacy in practice. Cool. It's called turnstile. Cool. I want to how paranoid we are that this is like the seventh layer of defense against this hypothetical risk. That's actually a good sort of um I've seen several arguments of one the miners wanting shielded generation of their rewards as well.

Oh yeah. But if you allow that, then you can't have this turnstile anymore, right? No, you can. You just the Whenever you mine new coins, it could go into the current shielded pool. And every 6 months or every 12 months, everybody has to move their Zcash from the old shielded pool to the current shielded pool. And then there's a public accounting of how much moved. That's all doable. I'm just saying yeah, but yeah, assuming that you know that the minor rewards are constant and you know what they are. And you know how many blocks have been mined which Well the the zero knowledge proof can prove all of that.

Okay. Uh there's a a technical reason that I'm a little not remembering entirely clearly why you can't mine directly to a Z address cuz that would require your miner to generate a zero knowledge proof of something. And currently miners don't have to generate a zero knowledge proof during the act of mining. They just have to run the the mining proof of work. We've covered a lot of the history of Zcash and the trusted setups. I now do want to hear about Sapling. Like why are we doing why was there an upgrade? What was it? What like I think you mentioned there was definitely speed was one of the problems.

That's really almost all of it. It's just the same. So it's the original purpose of Zcash is private transactions and the 1.0 version of Zcash just didn't really accomplish it because in order to use it you had to install this clunky software on your clunky old laptop and people nowadays don't use computers. They just use phones. And I know from Zcon0 that when you when you actually looked at it, even though there's this amazing shielded account possibility, a lot of the users of Zcash aren't using that.

I would say a lot of the third parties like wallet makers and exchanges have not offered it to their users yet. But that's also a thing of I was saw some stats from Binance or something yesterday. They have on the order of like 100 million transactions per second through their system. And if each transaction takes 40 seconds, then it's not really like that's a big server farm they need just to send stuff out.

Right. So, that was the whole point of Sapling was basically just do the exact same product but as efficiently as possible and also make it compatible with like hardware implementation so that you can put it in a ledger or a Trezor or a KeepKey. And uh also so you can put it in an HSM, a hardware security module that custodian services and exchanges use to protect their private keys from being stolen by hackers. And so I I kind of appreciate this like there's a certain the cryptocurrency world is so full of dazzling concepts. And I really feel a certain kind of pride that we are doing we have

done now successfully a pretty boring thing which is invent two or three scientific breakthroughs in or in work for two years straight in order to do the exact same thing 20 times faster. That's pretty much the whole the whole goal. Like just to check that. So, is there no other There must have been some more in the upgrade than just the speed. Uh the first two things I talked about improved efficiency. The facility to put the spending key inside a hardware device for added security.

And the last one that we mentioned is improved viewing keys. Viewing keys are a feature of Zcash which is I can take uh you know, you have your spend your spending key, right? That's a cryptographic string which allows you or anyone else who learns it to spend all the money out of that out of that uh address. Then you have the address. That's a cryptographic string which allows anyone who gains it to send money into that address right? So, we've added a third concept, which is a viewing key, which we we got the type the name if I mean we already knew the concept, but we chose the name from Monero. So, that our concept would have

the same name as theirs. Yeah. A viewing key is a cryptographic string that's tied to a specific address and a specific spending key and allows you to see but not to spend Oh interesting. That's actually I think it's really interesting because that's a that's a normal feature for cryptography. It's not that normal, but it's a it's a it's a product of mathematics to that is possible to have that kind of an object. And we had it in Tahoe LAFS, which I suspect is one of the reasons why Matt Green liked Tahoe LAFS back in the day. But, never before have we combined this viewing key concept from from encryption with the blockchain

properties of append-only immutable data. So, with Zcash, you can put arbitrary data into the Zcash blockchain. We haven't mentioned this before, but you know how you can embed data into blockchain. Well, you can do with Zcash too. But, the cool thing is if you do it with Zcash, the data does not become visible to everyone in the world. But, the really cool thing is it does become visible to anyone who you receives the view key. Ooh, this reminds me of my favorite story, the encrypted love notes in the blockchain.

I've seen a video where you told that story. Well, that uses the that that uses that property that you can put data into the blockchain, but only selected people get to see it. And that's the story of somebody you But, how do you know the story then? Were you actually able to see it? No, I was not granted the privilege of seeing the encrypted love note, but Uh, one of but the recipient of the encrypted love note told me about it. Ah, that's so cool. So, and that by the way, just for the record, that love note I I take her word for it uh that it actually exists in the Zcash blockchain, but it's impossible for me or anyone else to like spot it, right? It's fully encrypted.

Okay, let's talk about speed. This is the Yeah that's This is the big feature. the important thing. I guess there is a couple of reasons for the speed up. I know you talk you are talk a dev on covered some of it. We can cover some of that as well. But I'm also curious on um speed is one aspect and just like CPU time, but there's also memory requirements and are there improvements that are made with this obviously. Oh, yeah. That's a good point. And what other measures are there? What other kinds of efficiency are there? There's the fact that we can extract we can hold the the secret signing key in a a more constrained device like a hardware wallet. That's the third kind of That's a sort of efficiency because it'll it means you can now use a very

limited computer like a little Trezor or Ledger to do this by offloading the hard computations to a laptop. So, let's uh dig into the actual improvements. Um there were a couple major retoolings. What were they and what what did they bring? I break them down into three parts. There's the split circuit design which I can explain um and which is specific to Zcash style shielded payments. And then there's an upgrade to the whole zero knowledge proof system and the implementation thereof and the elliptic curve.

Uh all that bundled together would apply would be reusable by any zero knowledge proof app. Any application of zero knowledge proofs could benefit from that part. Um and then there's replacing the SHA256 compression function inside the Zcash design with a a different optimized cryptographically strong compression function. Those are the three pieces. And each one gave like a 2x to 4x speed up. So, the whole thing came out to something like a 20x speed up.

So, it's redesigning the entire circuit basically and looking for I mean, I I guess the hard parts in doing this was looking for what would bring a reduction in the size of the circuits. So, like switching from SHA-256 to like a Peterson hash. hop with yeah. So, Peterson hash is a long established cryptographic construct which has a really nice strong cryptographic property to it which is that if you can find a collision. Okay, so for hash functions, hash functions are my favorite cryptographic primitive and there's different things you might want from your hash function, but one very common thing to want from a hash

function is that you can't find collisions in it. AKA you will never have two inputs that would result in the same output. Right. So, Peterson hashes are are really cool because there's a a a very simple way to see that if anybody could find a collision for two different inputs going to the same output of a Peterson hash, then they can use that to solve the discrete log problem. And and the discrete log problem is one of the most widely trusted assumptions in cryptography. If that makes sense. So, the bottom line is if

you could break this, if you could find a collision in the Peterson hash, that means you could also break like 90% of all the cryptography in the world, okay? Amazing. What a What a challenge. So, that is So, put it the other way. This means this is at least as safe as 90% of everything else, right? That's That's one way to look at it as a sort of a an indicator of how safe this particular technique is. And then two of our cryptographers, Sean Bowe and Daira Hopwood, invented some new ways to compute Peterson hashes, which were way more efficient inside the zero knowledge proof. A new way to compute Peterson hashes inside zero

knowledge proofs, which is way more efficient than any other thing you could do before. So, I call those Bowe-Hopwood Peterson hashes, and that's probably the single biggest improvement from Sprout to Sapling. It probably all by itself reduced the total time by 75%. I think in your presentation at Devcon, you had mentioned it went from 37 seconds to 9.2 with that. Right, which is a big improvement already obviously. Another one that you did was you moved away from libsnark. Right. So, libsnark is a C C++ and assembly library that we used for the 1.0 Sprout implementation. And during the process of developing Sapling, we wrote

a fresh code base primarily authored by Sean Bowe, and it's all written in Rust, and it's all written without Rust's unsafe features, and it's really highly efficient and you know, really well-honed to be efficient at this particular task. The name of that library is Bellman, and this is one of the outputs from the Sapling project, which everyone else in the world can benefit from. As you can go download Bellman now, and it's I would, you know, definitely recommend it as a great starting point if you want to do one of these kinds of things.

Wow. And this is instead of using libsnark, you would use Bellman. That's right. And when we talked to Howard, he mentioned that, you know, in zero knowledge proof circuits, you have gates, and he mentioned that when he's like measuring libsnark, and he's done this amazing work to distribute snark computations not blockchain relevant, but like he said we can go from a million gates to a billion gates if we distributed. But he also in that frame talked about the new sapling circuit is like an order of magnitude fewer gates.

Oh yeah. Or one or two. I can't remember. Um one order of magnitude fewer. It was probably something on the order of a million gates in Sprout in 1.0 Zcash 1.0 Sprout. And it's probably on the order of 100,000 gates in Zcash 2.0 Sapling. And reducing the gate count was uh like 2/3 of it was due to Bo Hopwood Peterson hashes, and 1/3 of it or so was due to the split circuit design. Interesting. So, what is the split circuit design? It's like this.

Um in Zcash 1.0 Sprout, I've got this envelope, and I come to the miner, and I say, "Inside this envelope is a a record, a transaction, that shows that I am consuming two previously unused outputs, and I'm producing two new outputs." Now, this might This is the UTXO Like to really appreciate the split circuit design, it will help if you understand the UTXO data model. Okay. So, it's like this.

This is hard. We already asked this question before. The balance data model, it's easy to understand cuz it's like your bank account balance. You subtract 100, you come back and look, and now you've got 900, right? And that's how Ethereum is defined. And it has some advantages and some disadvantages. The UTXO data model is like this. We have a list We have a a bulletin board on the wall and we have notes or slips of paper that say this slip of paper is worth a hundred. This next slip of paper here is worth 50. This next slip of paper here is worth 200. Or whatever. And you are the owner of some of these notes and that's your money.

Now, it's time for you to give some money to the next person. You want to give 50 Zcash to me. But your ownership of the note is because you know the secret key for that note. Does that make sense? Every note has a secret key. Mhm. You know the secret key. That gives you the ability to use the note. Okay? But if you came to me and you said, "Hey, I'll I'll give you this note. I'll tell you the secret key and then you'll be able to use it." I shouldn't take that because how would I know that you wouldn't go ahead and use the secret key and use up the money out of that note before I got around to it.

It's like instead of transferring the account over to you. Right, cuz it's like it's like if I told you, "I'm going to give you my password to my bank account then you can have the bank account." That's okay, but you still also have the password to the bank account. So, this is not a complete transfer. That's the problem. And the way Bitcoin solved it and the way Zcash and others solve it is like this. We're going to have a protocol where we're going to put a new note up. I come to you and say, "I want to Oh, no, you you're you're the one who owns the notes, Anna. You want to give me 50 Zcash. So, I write a new note that says, "This is worth 50." I have the secret key for the new note and you don't. Okay? So, I put the new

note on the board and you sign a transaction which says, "My old 50 Zcash note, it's hereby crossed out. We put an X over it and this other note down here that's worth 50, this is where the the went. This is where the value went." I know that your key can't spend my money and every the miners who verified this can verify that the new note is worth 50 and the old note that got spent was worth 50, so that's legit. Okay? And now there's uh the old note, your old note is now crossed out. It's still on the board, but it's got an X on it showing it's being used.

That's the UTXO data model for Bitcoin and for Zcash. The only difference is in Zcash the miners and the public aren't going to find out which notes get used or which ones are created. Right. We're going to keep Okay, let's go down one layer here. Here's the magic. Zero knowledge. This No, no, you're going to get this. You are about to understand the real core of the Zero Cash protocol design. Ready? It goes like this. Every note has two different identifiers. If you If you Oh, god, how are we going to do this?

This is going to work. I swear it's going to work. The note has a note ID and it has a note nullifier. Mhm. And these are like little tear-off strips of paper on the paper. And I don't know if that analogy is going to work but the point Here Here's what's important. Cryptographically you can't take your secret key and come up with a different identifier because it's your identifier, the note identifier, is taking your secret key and hashing it with a secure hash in a certain way.

Mhm. And the note nullifier, that's the other way to identify a note. The first one you might call a serial number, you might call it an identifier. I forget what we call it. Let's call it a note identifier for now. The note nullifier is if you take your secret key and you use a secure hash on that in a different way. Okay? So, cryptographically, because of the way secure hashes work, you can't come up with a different note identifier that matches your secret key, and you can't come up with a different note nullifier that matches your secret key.

But you're just Are you looking at two hashes at the end? They're just two different hashes of your same secret key. And here's the magic trick. We're getting close. This is going to work. Stay with me. Nobody who's looking at the bulletin board can tell that a certain identifier and a certain nullifier came from the same secret key. Nullifiers and identifiers are all just random numbers to you unless you know the secret key, but you're the only one who ever knows your secret key. Okay? So now, here's the Here's how it works.

I'm going to make two bulletin boards. The bulletin board of the identifiers of every valid note ever created and the bulletin board of the nullifiers of every note ever spent. All right. So, Anna has a 50 Zcash note. The identifier of it is posted on the identifiers board saying this is a valid note. It has been created. Over on the nullifiers board, there's a whole list of the nullifiers of notes that have already been spent. Nobody can tell whether or not Nobody except for Anna can tell Anna.

Nobody except for Anna Rose can tell that the nullifier for her note isn't on the second board yet. Cuz nobody can tell which identifier goes to which nullifier. So, then you say "Hey Zuko, I want to pay you 50 Zcash." And I say, "Okay, great." I'm going to make a new note, so only I am the person who knows the secret key for my new note. I'm going to post the identifier for my new note on the identifier board.

Now, you make a transaction that posts the nullifier for your old note on the nullifier board. And it says, "This nullifier is being, you know, the note that at this nullifier identifies is being used up and a new note that this identifier identifies is being created." Now, here's the neat thing. Here's where we get the privacy. Nobody who's watching this process can see which of the identifiers of the old notes is linked to the nullifier that just got used up. So, they can't tell that it was Anna's

note that just got used up. Because there was two different Cuz they can't see the connection. Only Anna can see the connection between which nullifier and which identifier. Okay, what was the point of all this? So, all of this We got to the heart. Yes, that is the heart of the Zcash design. And now, you can learn the split circuit concept, which I suspect was primarily also designed by Sean Bowe. But, first we have to understand the way Sapling 1.0 does it, which is we got a problem here with thing we just went through. That's what you would call one input, one output. You used up one note, you created one note. That means the new one has to be have the same value as the old one. You can give me 50 if you have a 50 Zcash note, but you can't give me

25. Mhm. Right? So, now we have to make it more complicated. We have to say, "Hey, I'm posting a transit Here are the nullifiers of two notes that I just used up and my friend is posting the new identifiers of two newly created notes. Or maybe one goes to my friend and the other one goes back to me as change. You can't tell." And the zero-knowledge proof guarantees that the the values used up from the two old ones is equal to the values generated in the two new ones. Okay, that's a two in two out transaction and that's what we implemented in Sapling 1.0 in Zcash 1.0 Sprout. Okay, the amount of gates in the zero knowledge proof then is proportional you have to the hard part

the expensive part in the zero knowledge proof is proving that the two consumed notes are somewhere on the bulletin board of all identifiers of all valid notes without revealing which what. The way we do it is with the Merkle tree because everyone loves Merkle trees they're the best data structure ever invented and um so we have a Merkle tree whose leaves are all the identifiers of all valid notes on the on the on the bulletin board and we make a zero knowledge proof that says I know the secret key for something which if you hash it a certain way will form an identifier which if you hash it with its

neighbors in the Merkle tree all the way up 32 times will get to the root and the root is the root of all the valid notes on this board. That's the most expensive part of the zero knowledge proof. The split circuit design is a way to you guys have both fallen silent are you stunned? I'm No, I'm I I'm thinking about exactly I'm looking at a Merkle tree right now in my head. that's the most expensive part because you have to hash 32 times in a row. You have to take your secret hash it to get the identifier then you have to take the identifier and hash it to get the second level up in the Merkle tree and then do it again to get the third level up in the Merkle tree. At the end you've done like 33 or 35 or 36 different hashes to prove that

you knew one of the notes without revealing which note. So that tells you why the Bowie the Bow Peterson uh sorry the Bow Hopwood Peterson hash was so important for efficiency is because we're doing this hashing over and over and over like 80% of all the computation is hashing over and over and over and so optimizing that hash made a huge advantage. Got it. And the other thing that made a huge advantage is the split circuit design says if I have a 50 Zcash note on the board I can prove to you that I just used up one note and that I generated two new notes that added up to the same number.

Therefore, I only have to prove the Merkle tree existence of a single thing instead of proving two things. So that saves half the time. I feel like we've seen use of like that Merkle trees used in this way in other cases. Have we Have we covered this? Merkle proofs are everywhere and and everything else but the other only other thing I would say is this same thing is is talked about quite a lot. I don't I haven't seen it used in a lot of places but it's talked about a lot in terms of compressing witnesses for stateless clients. So in a stateless client you don't store a state database with the full node.

Every node is responsible for storing its own state but then when you modify the state you have to the every full node has the Merkle root. I have the data and the path to that data. So I have to prove to you that I know that path and therefore I'm allowed to update this Merkle roots to this new value. But then in like in a in Ethereum stateless clients that usually mean you have to submit like a megabytes of witness together with your data in a transaction and that doesn't the witness the same thing as the Merkle path?

Yes. Yeah. And and the leaf I guess. Yeah. And so the leaf is the data. Witness is the path. So you can you still have to submit the data but with a zero knowledge proof you can compress the entire path to one proof. Oh that's interesting. So you can remove a bunch of data from the transaction to to do this. All right. Now you understand everything about Zcash. Wow. Now I wish I could see this again with like a diagram. Visualizations.

But I Which I'm sure is out there somewhere. You have bulletin boards, pieces of paper, Well maybe. bulletin boards, pieces of paper, whiteboards. Maybe one day we will. Um or one day we'll at at least experiment with it. For now, audio is very nice. Mhm. I find it's cool. to edit. You can listen to it while driving. But it is sometimes hard to explain very complicated things on, but I at least focused on I was I was very focused on what you just said and I could actually understand. So, we know all about Zcash. Something else that I really want to dig into is ZEXE, something that you also mentioned in your talk. What is ZEXE?

Yeah, ZEXE, which Frederick might be better at explaining than me, is a recent invention from some scientists, which includes Zcashers and Howard Wu. He's kind of an honorary Zcasher anyway. ZEXE is just a science idea. So, it's not necessarily in the future of Zcash itself. Um but there's a science paper from a bunch of Zcash affiliated scientists and former Zero Knowledge Podcast guest star Howard Wu.

and some others. Um and it's it's an idea for how to use zero knowledge proofs. Basically, I'll I'll just oversimplify it here and you can correct me, Frederick, if you know better. The way I conceive of ZEXE is just a way to improve Ethereum-style behavior. With Ethereum, you want to run you want to execute a smart contract. So, you do is you give your inputs to all of the miners. They all run the smart contract for you on those inputs. And then they can sense on the output being the correct output.

With ZEXE, you execute it yourself on your own computer. And along the way, you generate a zero knowledge proof that this output is the correct output from executing it. Now, you just distribute that. You give the zero knowledge proof to all the miners. All the miners verify that it is a correct zero knowledge proof, and then they update the state to show the new output. And so, that's really, really interesting for at least two reasons. One is, now you don't have to tell everyone in the world what's the contract itself and what are your inputs to the contract. That's really interesting.

Um also, the output The output could be encrypted. Right? The miners I can give you a zero knowledge proof that says, "Here is a cipher text envelope. Inside the envelope is the correct output from my having executed this contract." Right? And that should be good enough for the miners. They can go ahead and update the state to contain that, even though they can't see what the output was. So, so this is a huge change in terms of the security properties of of dapps. Is now all of the from from going from having full insight into everything, now the miners don't need to know anything about the contents of dapps or what people are doing or what the results are.

But the other thing that's really cool about it is verifying a zero knowledge proof can be much, much cheaper than executing the script. So, now it's a it's a performance or scalability improvement. Here you're talking about a a paper, but this is for smart contracts, but Zcash doesn't have smart contracts. So, is this really for the Ethereum? I'm just curious where this So, the The was Yeah, it's funny though. I You know what the real answer is this, I think. It's that Zcash uses the UTXO data model that we talked about earlier in this podcast.

Ethereum uses the balance data model and for technical engineering reasons, the UTXO data model works a lot better for this kind of application. I'd say it's much less for either Zcash or for Ethereum and more like your story with the original uh zero coin or zero cash papers Yeah. for someone else to pick up right now and build a blockchain out of. Right. So, the the concepts could be applied to either Ethereum variants, Zcash variants, future Ethereum, future Zcash, or something else.

Amazing. So, I think yeah, yeah. I mean, you describe it well where it's both a scalability improvements, privacy improvements, um but there's also a lot of other things you can do with it if you combine it with stateless client stuff. I mean, now because of data availability and bandwidth issues, uh we can't actually do this, but in theory, if we solve data availability and bandwidth, we could have a blockchain that is literally just a Merkle root at every block. Mhm. And that's the entire thing that ever exists on chain.

And you can still prove everything along the way with zero knowledge proofs and Yeah, I'm not sure if just solving the unsolved problems of data data availability and bandwidth would be sufficient or if there's a also a third unsolved problem that we'd have to do there. Um I don't know how to describe this third unsolved problem cuz Sean, Bo, and I have been trying to solve this and we have this half-formed solution that we call duckweed, which is just like a bunch of scribbled notes from our coffee chats.

And it's stuck on how do you how do you update the Merkel root? It's subtle. It's hard to I might be misremembering, but it's like this. I find it easy to make a zero knowledge if we assume you know if we assumed oh there's a third unsolved problem we also assumed which was recursive zero knowledge proofs. So if we have bandwidth availability, recursive zero knowledge proofs, three currently unsolved problems, then hey, that would be easy to make to prove to you hey, here's the new right Merkel root. It's not enough for you though cuz you don't have a witness that you can use to find or update your state. That's the hard part that duckweed is stuck on.

Well, that yeah, that's what I call the bandwidth problem because or Oh, like like if you just downloaded the entire the rest of the state and scanned it then you'd find your thing. Yeah, okay, right. So we can either give everyone infinite bandwidth or we have to solve the duckweed problem in addition to the other three unsolved problems. Yeah. So it seems easy. Let's do that tomorrow. No, it's really exciting cuz I think they're probably solvable with you know a few more years of effort and then we really can have like actually scalable like scalable in in computer science terms in the old days like decades ago, I thought of scalable as meaning basically if the cost to you is logarithmic or better in

the size of the problem, I'll call that scalable. Um and this idea which I call duckweed in my head is the the first blockchain proposal that I understand where the cost to every participant would be logarithmic in the size of the blockchain. Is duckweed related to sharding in any way? I don't like the idea of sharding because it's it seems somehow inelegant. You mean that you go from essentially having a global state to having multiple local states that consolidate into a global one or is it Um, like there's an arbitrary boundary.

Like this piece is on this shard, and the next piece is on another shard. It's like having a a fault line in the earth. Like why is the fault line here instead of 2 ft over? So, it seems arbitrary. And it raises a lot of questions in my mind about how things behave differently across fault lines versus not crossing. There's much like practical engineering questions. But, I haven't been able to figure out any solution to the duckweed problem that doesn't involve some kind of sharding. So, that's my answer is how they relate is I'm not sure, but they definitely seem to.

Is there any public writing on duckweed? No, I'm sorry. I feel guilty for never having written it down yet. Is it scribbled somewhere on a Someday. Yeah, I have a bunch of 3 by 5 cards in my bag. This has been an amazing conversation. But, I don't want to end it yet. I want to know what comes next for Zcash then? This amazing thing has just happened a couple days ago. There's a lot of research happening, but like what do you see coming next? Well, the very next thing that's on my mind is what's going to happen with the new client that What new client?

Zcash Foundation have announced. So, until now, Zcash implementation has all been done by the company that I am the CEO of. Almost all of those people whose names I've described so far have mentioned so far in this podcast are employees of the company. And a few days ago, the Zcash Foundation, which is a separate independent nonprofit institution and and Parity announced that they were going to make their own independent Zcash implementation. And that's really, really interesting. That implies a lot of things, and I think it's the most

important development that's next, that's on the horizon. I did see I saw Josh Cincinnati's talk where he I saw his talk and he was talking about um how I mean he he did put like if there's having two almost competing forces can be very I don't think the word is empowering. It can make a system stronger. And I guess having a second client will be incredibly It will make the whole system stronger if something happens with the company.

I'm not hoping that won't happen, but there's definitely some legacy that can be continued, or if there's a bug in one, hopefully not in the other. I know that that's been the experience in the Ethereum community. For sure. We've talked about this before, like the one client model where most blockchains have like one dominant client. Yeah. And the problems that could come from that. Yeah, so I think I mean most Bitcoiners would say it's a good thing to just have one client, and Satoshi himself said so. Yeah. So there's obviously a debate to be had whether, you know, having a bug in one and not in the other is a good thing. I would argue it's a good thing rather than just living with the bugs.

Although it could also cause consensus problems. Yeah, so yeah, I mean that's the downside is if it it can cause consensus issues, but something like in Ethereum, I would much rather have a consensus issue and a split than someone maliciously exploiting a bug. Whereas, yeah, I mean it depends on what the bug is. I agree people do have differing opinions about this issue. But so far we've only been talking about unintentional divergence of behavior between the two clients. And what I think is even more important actually is the possibility of intentional divergence of behavior between the two clients, which means an intentional chain split.

Mhm. Unintentional chain splits are basically not preventable. It It basically boils down to never making a mistake, never having a bug is necessary to make sure you never have an unintentional chain split. Um and so philosophically what Nathan Wilcox, the CTO of of the Zcash company, emphasizes is instead protecting users from the consequences of chain splits instead of planning to have zero of them and uh and and not planning to be able to recover from one.

But intentional chain splits are where I think this is a really important development that the Zcash Foundation and Parity have made this deal because it now it's always been the case that Zcash and every cryptocurrency was a consensual opt-in relationship with the end user because no one has ever yet been forced to use any cryptocurrency against their will, right? As far as I know. But until now the options the user have are use the the Zcash software that the Zcash company is willing to support or stop using Zcash.

Mhm. Right? And And I'm okay with that. I'm I'm I'm I'm willing to tell the company that we're supporting certain things and that we're not supporting other things and I'm okay with some users choosing to rely on what we're supporting and other users choosing to stop using Zcash cuz they want something we're not supporting. That's fine. But it's going to be much better when there comes a time when their choices are rely on whatever the Zcash company is willing to support or stop using Zcash or rely on whatever Parity and the Zcash Foundation are willing to support. Now the end users kind of have a lot more bargaining power. So this collaboration that we announced, this has been a couple months in the works and we've been talking about how this is

going to work and what we're going to do. I think a big I'm not exactly sure who initiated it first. I mean it it's something that we've been wanting to work on for a long time. Something that I'm personally passionate about. So, it might have been us that approached the foundation first. I'm not sure. But, I think a big facilitator to being able to do this is the some of the stuff that that's been happening with sapling. So, we obviously write everything we do in rust. Mhm.

We have a Bitcoin implementation in rust. And so, when we saw Bellman is in rust, it's like, oh yes. Like the step going from a Bitcoin implementation to a Zcash implementation when you already have Bellman in rust, it's not that big of a step. Yeah. So yeah. I think we can actually get it done relatively quickly. You know, what that relatively means is undefined, but Have you figured out what other things you need besides the Parity Bitcoin implementation and the like sapling implementation?

Which includes Bellman. I mean, we we have an idea of what we need to change like you like this stuff that you're mentioning. Before when we talked about the UTXO model, there's obviously changes we need to do to the Bitcoin code base to actually Mhm. make it private. So, like foundational changes in the data model and and probably this Merkle tree is not really part of Bitcoin, so we need to build that in, but we have great libraries for Merkle trees and Merkle tree operations already from Ethereum.

Yeah. So, we don't have like an exact roadmap here but um Will it almost have like because it's Parity building, it will have almost like Ethereum-like characteristics? No, no. I don't think so at all. So, the Bitcoin client is a completely separate code base from the Ethereum client and it's not really um related in that way. Um and so, yeah, the the idea here is we will kickstart this. We'll build out the first version, get and hopefully will help onboard uh developers that will sit with a Zcash Foundation that will also work on this.

And then eventually at like when we get to a point where this syncs with mainnet, we'll basically hand over maintenance to the Zcash Foundation and and we are like done with our job. I think I mean, these are two ecosystems I very much like and it's very nice to see them working together. Yeah, it's nice. We all benefit. On that note, uh should we could also ask if there's any other future stuff. Oh, yeah. I mean, how many more hours do we have? How about this?

I hope this is only the first conversation of many. It was so amazing to have you on this podcast. was a pleasure. Really appreciate it. Yeah, it was really great. Thank you very much. And um yeah, I also do believe that we will continue to do podcasts on Zcash in general. I'd love to get some of the engineers on at some point. Um but yeah, I think for now to our listeners, thanks for listening. Thanks for listening. Thanks for listening. Oh no.