zkSessions: DeFi & Privacy - Building privacy-preserving DeFi

Transcript

good wonderful cool um great um so hi everyone um i'm uh i'm zach i'm the cto of uh the of aztec and um what we what we focus on is um building uh privacy preserving technologies um on public blockchain specifically um ethereum um with an end goal of enabling cheap efficient private transactions and to provide um uh very expressive anonymity um for for users so that you can have private wallets um and also eventually um which is the subject of stork um privilege of preserving d5 reticles and so i just want to talk a little bit about how how it's like the mechanics of how such a system can work um

on a platform like ethereum um which by its very nature is very is um has to be at some level quite transparent um in order to verify the correctness of transactions being a bit slow so um yeah so i'd just like to open by just explaining what what exactly are private transactions what do i mean by that how do they how do they work what are the mechanics of them because it's not um quite as simple as um just encrypting user user data um because you you kind of need um there are kind of three um types of privacy which this was actually um originally anna uh coined these communist terms and i was talk uh talking about that um about a year ago and that's data privacy user privacy and code privacy um where data privacy is um the actual

values of transaction on the blockchain are hidden so people know who you are but they don't know how much you're sending around um then you obviously have user privacy where the actual user identities are anonymous on top of this so you don't know who the sender and recipient of a cryptocurrency transaction are um and you don't know the values um contain like um being transferred or even ideally the asset itself and the final kind of ideal um goal of um what we're building towards code privacy where you have a very feature-rich um programmable ecosystem like you do one ethereum with smart contracts except that those contracts are by their very nature private um so that uh users when you transact with the blockchain people can't even see they can't just see who you are but they can't even see that the

the i didn't like the address of the smart contract you're transacting with um and that gives you a very strong analytic anonymity set because effectively all your transactions are kind of pulled together in this not in this encrypted anonymous pool with everybody else um however um if you want private transactions um there need to be some um modifications from a traditional transaction because of some sort of of these anonymity requirements specifically um a private transfer can't produce any kind of um uh like paper trail or um uh it needs some information which allows you to to build up a transaction graph um and so you can't your trans transfers internal elections can't produce a linkable database updates

um so even things like ethereum's account based model is extremely difficult to implement in a privacy preserving manner without um without compromises on um on user privacy uh because just in their act of updating somebody's balance um even if that balance is encrypted is going to leak some information so the way that we're doing it and the way which is commonly done so for example z cash is doing it this way too is by using the bitcoin's concept of a um unspent transaction um object um and by that i mean instead of users having accounts um where like with a single value that defines how much they own of a certain token you instead um have discrete notes um where a note represents some defined value of

cryptocurrency and let's have an owner and a user's balance um is um just defined as just the sum of all the notes they own so i could have like a you know a 10 a 15 ethereum nodes um and this um construction makes it much easier to perform private transfers using this concept called the joint split transaction um which gets encoded into one of these fancy zika snark circuits so just to um run through basic a little bit of how this works the idea is you have to input nodes um where from the perspective of an observer um these notes don't give leak any information they're all encrypted so they have that the if you could decrypt the note it'll tell you who owns it and how much they're worth but um unless you have a

private key you can't see that and so the idea about how you how you do a private cryptocurrency transfer is you have two input notes that you own as a user um and you effectively destroy these notes and in that place you create two new notes where you use zero knowledge proofs um to prove that the the um values in the encrypted output notes is uh equal to the values and the encrypted denims and because your encrypted alphanets can have different owners um that allows you to perform a private transfer that's how i could send uh i could send uh tokens to another by destroying you know 10 10 ethereum that i own and then creating like two five ethereum notes where one is owned by anna that would be a private transfer as long as nobody can um uh identify um

uh well just a little bit more complicated than that but that's that's that's at a high level that's how it works and you can get extremely strong privacy guarantees from this kind of construction um and so but there's a problem with this um which is that xerox proofs are extremely expensive um they're computationally expensive to verify and on ethereum i think with current gas prices you know verifying ezekiel is not proof could run you up to a hundred dollars um which is not particularly scalable if you want cheap private transactions and so the way that this is that one of the ways that you can you can solve this and the way that we're trying to do it currently doing it is using the um these concept of a zk roller or

i guess in our case specifically um it would be a zkz roll up because generally zk roll ups refer to kind of rolling up public transactions and what we're doing is rolling our private transactions so anyway um so the idea is you you have instead of um having a zero knowledge proof which verify which process is one of these transactions where you destroy some notes and create some notes in their place you have a extremely complicated general circuit which verifies a very large number of these zero knowledge groups so the idea is you have this architecture where um users can deposit um cryptocurrency and withdrawal cryptocurrency from this roll-up um very much like you would deposit in withdrawal into earlier two

um except that uh any kind of um private sense that you make within the swallow architecture are completely hidden from the world um and because withdrawals um i'm not linkable to depositors um it makes it very easy to um obtain a high degree of privacy um even in the even um if you need if you need to if you have if you want to use your cryptocurrency for some kind of public application or like in a smart contract uh because you can deposit some ethereum into this rural architecture and that at some later date you can withdraw it to a different address um and nobody can link the two um this is also quite a useful method of funding um anonymous addresses as well um if you if you have any need for that um so that's um

and then uh yeah just a at a high level how the how this architecture works is you take that joint split zeke is not proof i mentioned before and you just create another zero circuit which verifies a very large number of these joint split ziggy snap proofs um which is a little bit easier said than done because um verifying zero knowledge proofs is very mathematically intensive task um and the um zero knob circuits are not traditionally um uh traditionally like the um proving algorithms for xero proofs um are relatively slow so this would take quite take a lot of computational power to perform um but there's been several advantages over the last few years which has made this uh practical scale um uh but yeah um anyway um maybe if

anybody has any questions about this architecture i'm happy to just to discuss after the after the talk um and then one extra one extra step to this is basically as as ezekiel roll up circuit which is getting a bit ridiculous now uh but the the idea is um uh it's just a way of state of massively paralyzing xeron's pre-construction um so you um because uh typically um constructing these examples is not very easy to parallelize multiple devices but by using this this recursive technique we have we make that very possible and possible the idea is you have a roll-up circuit which aggregates 32 private transactions and then you just have another roll-up circuit which aggregates 32 roll-up transactions and then

you can build that in a tree-like structure to scale your roll up to extremely large volumes so that's how you um that's how that's how one can enable private transactions on a blockchain but how does one actually do d5 decentralized finance because that's a very different kettle of fish um um the next step um it quite naturally follows that if you can do private value transfers can you do something a bit more expensive can actually program the logic in these circuits to create private smart contracts because a note um in one of these transmit transactions it can represent more than just token values um in in many ways it functions a bit like a like a store slot in a silly smart contract

um and so those rules around that drawing split transaction can be modified because these zero circuits are programmable um however that does massively complicate the roller park connection because you're adding untrusted code execution uh into your into your problem um and so you need safeguards to make sure that users um are protected from malicious actors um so the way that you can do this is um by creating this concept of a kernel snark circuit um to achieve um this this kind of um this uh concept of code privacy where you can have private smart contracts you program in the context of the leg roll-up um and have users transact with these private smart contracts um completely anonymously the idea around the kernel snuck circuit

is um it basically it contains a record of all of the you have it um so your private smart contracts are encoded as um zero node snark circuits that you can construct proof service to transactions and what the pedal snark circuit functionally does is it verifies the correctness of a single a single one of these single private smart contract transactions um the the value of this is that um an individual user um transacting with this network would construct this kernel z is not locally on my device um and in doing so um obscures the address of the smart contract they're transacting with um so where are we at so far um you can do

programmable private smart contracts so what about programmable private device um it's a very it's a very tempting prospect and something we're trying to that we we very much like to achieve ideally this year however um there are problems when you want full privacy um specifically the fact that all of the states in yours in your system is private and it's owned by users um because it's encrypted and somebody needs to know how to decrypt it and you can't have um public state in your smart contracts um things like the turtle supplier token or metrics around which you can construct a liquidity pool because um uh it because modifying these these global variables um will you leak information about a user's transaction

um and so for example if you wanted to make a private maker dial that would be that would be quite difficult on the surface because um if you have one of these collateralized debt positions they need to be um you need you need some algorithm to determine whether your cdp is under collateralized and liquidated but if your cdp is encrypted how's an algorithm supposed to figure out whether you're under collateralized and even if it can how are you how is it supposed to liquidate that position if if the only person who knows what that position is worth doesn't want it to be liquidated um see you can do private d5 like in a very direct manner in a way that you can look for example like um port making out or some private world to some private system or um something like uniform but it's quite

difficult because it requires multi-party computations and you need additional trust assumptions because you effectively need to replace the function of an algorithm and a smart contract with a decentralized kind of set of users validators that you um need to somehow trust will act um honestly and not collude or and use use staking incentives to ensure that so that seems a little bit um unfortunate right because that's uh that's quite a it's um not ideal um let's certainly that kind of advanced multiparty computation in the context of zke roll ups on ethereum is quite some way away so is there some kind of shortcut that we can do is there's some

kind of cheat to interface to to be able to get privacy with existing d5 protocols and um bill says yes um and that's basically by interfacing private transactions with public defense and acquiring very high degrees of user privacy so the way that this works the what we're trying to build right now um is mostly a lot of defect protocols can kind of be modeled as translated token swaps where you don't know the the the exchange rate between the tokens you're swapping until the point that your transactions might um so some examples are like uh unisoft that you do pool or trading on uni swap um these are functionally you call a contract a smart contract and you trade token pairs maybe with some additional logical checks

um uh and so can you create a privacy preserving bridge to layer one existing d5 protocols um what the answer is yes um so what you do is you have this you have a z cable architecture where you aggregate a large number of user deposits so the idea would be um users can kind of deposit notes of a fixed nomination into a pool um so to give an example you have like 100 ethereum um that you that you want to trade into into unison then you and a hundred other people um could deposit 100 ethereum into into a pool that will have um ten thousand ethereum in total

um and the idea is because all the deposits um are of the same value and all of the identities are randomized and anonymous um nobody knows who has actually deposited into the system um and then once you have once you've pulled that 10 000 of three together you then interface interact with the layer one network and you perform you call the d5 protocol um as an aggregated construction um and then once your d5 protocol has um you sent your transaction you received whatever token in exchange that you expect every user can then withdraw their a lot of portion of that um of that of the process of that transaction um and convert them back into private zero knowledge notes um uh and that kind of system can give you a

very strong degree of privacy um so this is a little bit how how it would work the idea is inside your zika roll-up it's on the left you have um notes for fixing automation they get aggregated together in this aggregation circuit um the idea is then once the amount of value in that circuit is passed is reached a certain threshold um it gets sent across the layer two layer one boundary to a d5 bridge contract um uh and then this defibrillation contract will um trade with unisop or rv or whatever um and then send the process back into the application second and then the um uh the depositors will withdraw their their new notes um uh where because you know how like what percentage of the pool you own you can um trustlessly extract what you've earned um without any any

risk of double spending or somebody taking more than the their due so that's what that's what we're building um and one of the other advantages of this is um you get quite cheap interactions layer one because you're sending this expensively i want to section um it represents a very large number of users instead of just a single user and this process of depositing and withdrawing into the aggregation circuit because it happens exclusively on the layer 2 um it costs very little gas it's quite cheap to do how do i actually power this private d file because um the concepts i've talked about here are quite um uh complicated to pull off in practice um you need some extra you need quite um specialized cryptography because when i've been talking about these things like kernel snack circus

and aggregation circuits these are all um zero circuits that perform um an extremely large amount of mathematical number crunching um specifically that they're verifying the credits of hundreds of zero horse proofs which is not trivial to do um and so this is where the latest r d that uh ariel and i um our chief scientist have been working on is going to hopefully um uh come become quite coming quite handy um so um plonk is a universal snark proving system that ariel and i published um in 2019 and we've been we haven't been idle since then we've been working on it and refining it and improving it and also taking in um all of the brilliant ideas that have come from the the wider cryptographic community to improve this thing

and we've developed what we call it ultra plonk which is um uh what we think uh it's the pretty much the state of the art when it comes to universal proofing systems uh it allows you to relatively efficiently verify the correctness of um zero knowledge proof and cyber zeros proof so this concept of recursion um and you can do it on ethereum today uh without having access needing access to um advanced cryptographic premises that aren't supported by the ethereum critical and you also have constructions like um things like you can represent random access memory inside your circuit um uh so you can have things like dynamic arrays which for a typical program it probably sounds extremely trivial i mean dynamic parades you've had we've had this since the 1960s back when people were programming and cobble

um or in regular computers but this is something which is extremely hard to achieve inside um a zero knowledge circuit um because you're what you're effectively doing in with zika snacks is you're taking like an imperative computer program and trying to turn it into some algebraic formulas and mathematical representation and so um things like array access uh way um is not particularly easy to do but we've got a way to do it and that along with other techniques is why we think we can be well we can build this um previously preserving system um and so yeah anybody who is interested in zeros previously works in this this is just a table of the constraint counts for our improving system and um anyway yeah um happy to go back to anybody's any questions

we're also building um a private smart contract domain specific language for programming these circuits so that you can program in a natural high level relatively natural high-level language um uh that then compiles down to zero's proof without you having to worry about the cryptography behind it or having to be understand the photography yourself um and the idea is that um this can be used to create very feature-rich programmable credit smart contracts so you can have a lot of logic that encodes the correctness of your private transfers um so we're releasing that uh this week um i believe actually we'll be seeing alfred um so yeah um uh we'll be uh publicizing this uh fairly soon and uh yeah um if anybody wants to have a go

um and this is what we're building uh releasing uh next week it's called zk.money um which is a fully private crypto appointments using our zk robot technology which we're deploying on mainnet uh this week um uh so it's been a for us it's been quite a long uh development process but it's it's finally hopefully going to arrive next week um and yeah this is this um is aggregated ethereum transactions um on ethereum um using our zika royal technology um completely trustless um with uh one of the strongest uh um with with an extremely strong analogy set um where we're aiming to get the average cost of a private transfer down to about 15 000 gas um so

um very competitive with regular ethereum transactions um so yeah um that'll be coming next week and longer term um what we what we're aiming for is um spreadsheet you just build everything that i've just talked about so um halfway through this year we're going to be building this this this aggregation circuit and this ability to interact um uh privately with existing d5 a1 protocols um and to do so relatively cheaply and then finally next year we will be publishing our full vision of the non-programming language and have the ability to um directly program circuits inside our installers roll up architecture um so yeah that's pretty much

um uh yeah that's pretty much everything i have to say that that's kind of our road map for getting um uh privacy into into defy um uh yeah thanks for listening and yeah if anybody has any questions i'd be happy happy to answer this is so exciting i i actually have a question for you about the rollout like you you have this plan to roll this out next week on mainnet but like are you deeply affected by the crazy gas prices yes um it's a tough time right now yeah we've had so we've had to reset our expectations we were hoping to say that you could do a private transaction for 10 cents uh but now it's

merely uh the cost of a regular ethereum transaction um which is um uh it's unfortunate but it's something we're working on um uh so um we i don't think we're asked by the effectors because um i think the the value there's the the people who use are critical um desire transaction privacy quite strongly um so um uh given that it's not it's the the price of it is going to be pretty much equivalent to an existing transaction um it means that um uh yeah anybody who who wants privacy um will hopefully be able to afford it um but yes it certainly is not going to be uh not not yet uh at the the point of extremely cheap private transactions

hopefully that's coming later this year if anyone has any other questions you can actually leave the you can leave them in the hop in oh there is one here um yeah there's is is noir dsl named after the french cabinet noir uh no it's it's not it's just um it's named it's just we thought um it's named because it's the um god i feel so uncultured the french were black um and because what we're doing is uh privacy and shielding transactions from the public uh okay we thought uh it was very appropriate although now i'm curious what this cabinet noir is maybe we can look that up after

uh john asked do you see a path to achieving similar functionality but without a trusted setup yes um although it would require some um it would require a theorem protocol to to add support for um new cryptocurrency parameters um and uh also probably um ethereum certainly when ethereum 2.0 comes online and the cost of cool data um drops then they'll be they'll be very plausible so um the the xeron's printing system we're using which and which uh the ones that most people are using these days um things like um plonk or marlin they're very amenable to to being ported over to proving systems that don't require

however the trade-off of doing so is that the proof sizes um scale to hundreds of kilobytes up to even a megabyte um and at those with that data size it's extremely expensive to process one of these translators on ethereum uh because adding 100 kilobytes of cool data is um it costs millions of gas um with which with current gas prices is quite punishing um whereas uh using a trusted setup um uh the the second size the proof size is only like one kilobyte um so what we've got at the moment we hope is a bit of a halfway house where we do require setup but it's just one trusses setup for every single circuit that gets programmed uh so we won't need to repeat it but um yeah is that the same are you using the same kind of parameters as you

created in the ignition ceremony or are you making a new one for this no we're using the admission one um yeah uh it's quite fortunate we created our ignition ceremony for a very different protocol and it just so happened that we could read for this for we could reuse it for plonk um very cool uh john smith the person who asked about the cabinet noir actually answered what that is so maybe i can tell you it was apparently used to read encrypted mails for the king's court a dark room where the cryptographers of that day secretly worked on private letters that is fantastic i wish we did name it after cabin in norway that's brilliant um not neat yeah i think you should probably like

back call like if anyone asks again you'll be like actually um okay one oh there's one more question here um are you considering releasing on top of like l2 maybe an ovm like the optimistic roll up instead of layer one so working i guess wow that would almost be like a zk roll zk zk roll up on top of an optimistic roll up i think that's what that would mean yeah um yeah absolutely um we're considering it um certainly there's if there's um yeah um like we're we're our tech is very any ovm that supports um smart contract execution

we can quite very easily pull the critical to and um that's certainly something that we're exploring right now cool