zkSummit - Creating confidential digital assets on Ethereum - Zachary Williamson (Aztec)

Transcript

all right cool hi everyone I'll get going again thank you it's it's not a pleasure to be here being able to like to talk about what what we'd be doing at Aztec with you all which is confidential digital assets on aetherium we are a privacy solution for the etherium main net that enables developers and individuals to create private digital assets confidential digital assets of confidential zero knowledge gap set interact with these assets just like you within the RSU 20 token least that's the vision so it's gonna go quickly over what I'm gonna try to cut keeping the stock was just kind of explaining what I what we think we need to happen to get to actually put confidential

transactions to work on etherium wait I didn't do that today I'm Zack I'm the CTO of Aztec yeah so we're a smoke we're a team based in London that are focused on building this privacy solution for theorem as a protocol layer for l1 fundamentally what we believe is that a theory on a public blockchain is in general can't really achieve that true potential unless you can represent value on layer one confidentially if the fundamental representation of value is private then it opens up an enormous number of potential use cases that currently can't be explored like almost all of traditional finance and crucial

financial services were kind of acquired privacy by default which is one of the one of the reasons why you don't see a large like proliferation of things like mortgages corporate bonds low syndicated loans on blockchain one of the key blockers is privacy and we're trying to solve that in a generic capacity so for the agenda yeah like what that what on earth needs to happen for that to actually be a reality how do we get an app an l1 solution that enables individuals users developers to create private digital assets without having to be literate and journalist cryptography and that feeds into the cryptography engine standard what the hell that is because that helps us achieve that how we create our efficient range groups and then finally going into

about our confidential token standard in the roadmap and what you can do to get actually start to develop with these things so before I go for go ahead how many people here are interested in creating like private tokens private assets on aetherium or adapts that in journalists adapt to interact with private assets how many people have actually done so yeah here's the problem so this stuff is hard really damn hard for a lot of a lot of reasons that you have to handle a perfect version of secret keys usually it's very hard to create these application specific proofs you need to be quite literate as you get snaks also think it's tux or you know single protagoras in other crypto there's no standardization so you make a solution

it's not going to be compatible with other people's solutions you've got to deal with trust the set up sometimes and then you have to deal with long period difficult proof constructions which present a massive you exchange for a browser-based app and expensive pre verification which is expensive how do we bridge the gap between the technical vision and reality how do you think this stuff actually workable so it's net1 what do you want what do we actually want we need to like because Chris could be used for a lot of things and this habit of getting conflated a lot but they are quite distinct and needed their own solutions Prabha transactions feeding solutions publicly verifiable private computation they're all extremely important for like fully developing the theorem ecosystem for promotion existence what we are a second focusing on is that confidential transactions layer being able to

represent the fundamental unit of value on layer one privately in an encrypted way being able to transfer it having a common standards so that is as a unit like can be applied universally so the building looks for a competitive liquor system are in my opinion what you need is you need customizable competitors transaction semantics if you're building an application specific side chain it's absolutely fine to have to do like batch validation of transactions you know you can push process you know 10,000 transactions on the side chain as a batch uses a case knock where's okay start proof to validate the correctness of that computation however for actual like the fundamental representation of value the actual like digital asset itself you have edge cases you always

have educators in the real world where the actual like specific semantics of your transaction are different one example would be if a regular series you need to make sure that no trader has more than 10% of the supply of your private assets or if you have some kind of minimum trade threshold or you have some kind of complaints like group signature scheming you need to prove that you can carry seed anonymously and so you need you need individuality however you also need interoperability so these are somewhat orthogonal to one another you need to be able to have confidential assets private assets that all conform to a common standard like ERC 20 so that you can actually communicate they can communicate one another you can set transfer tokens and

mob zero-knowledge notes to and from these these assets via swap contracts you can actually start to create meaningful that ecosystems and one of the and also for that you need a single common reference string basically you you can't have multiple trusts of set ups because then as a DAP builder you need to make a like an opinionated like guess at which assets and apps you have trusted setups that you trust in which ones don't if everyone just uses one trust to set up well I mean ideally zero but you know as one then you get rid of that problem and obviously you need develop a funding source right now like these are completely mostly completely absent not not due to a lack of ambition or talent but it's because

there's hardly any resources in this industry in the space and right now the twinning is extremely difficult to use even for people are quite proficient in this stuff and then finally you need the efficient construction verification on the proof side for PDO X if you're building it up in the browser it needs to construction all those groups you don't have to take two minutes and four and you wanted to be able to be done the hard over lats in for verification obviously guess is money and it needs to be cheap so how do forties building blocks first of all a family of zero knowledge proof that share this common reference string basically define a set of proofs that individually perform certain kind of parts discrete parts of business logic like for example an

interest rate payment and interest rate proofs is like you can prove like this value is X percent of this value or a joins like a basic join split transaction which I'll go to in a minute but basically had these kind of in a modular proof system where you can kind of pick and choose proofs of the Shelf to define the specific semantics of your individual asset and as shares reach a validation contract so we're calling the cryptography engine this is extremely important I'll get to that in the next slide but one of the things you can do with this is it means you abstract away the zero knowledge validation part from this digit it's my contract you're building you can use somebody else's libraries somebody who's experienced in this stuff that she like that has a lot of technical expertise and it means that these has a forward compatible because

if you have a digital asset a private asset that subscribes to the cryptography engine then if that controller made an answer new proofs over time that do more interesting and innovative things your asset if you choose to be will be automatically forward compatible with this new proofs which is obviously quite valuable specifically as this industry is changing so much probably in five years time will have an enormous that like a plethora of the neurologic technologies that we don't have at the moment and it would be very nice if the Asus built today are always compatible with those and then finally near the confidential token standard aside this altogether so a way of building a confidential asset that has a common interface a common standard so that you can compact interoperability and compatibility and

then finally simply dev tools that abstract away all the nitty-gritty of actually making zero knowledge proof this in the same way you can do no web freedom F signed transaction that makes a new DSA signature if you don't need to know about the mechanics of how that actually happens you just need to know that you need a private key and a message so I want to go into the kind of the how you how you transfer value privately on a theory list how we do it which is through these balancing relationships form retinal joint split statements so these are not like uses these have been around for a while I think you see cache originally pioneered them where basically you just have some input notes notes or like extra objects on Bitcoin except the values are encrypted and you prove that the value there's

some of the values of your input notes is equal to sum of the values of your output nodes and then if you serve as proof you prove this successfully then a smart contract can destroy the input notes in its state registry and create the output notes and that's not conflict knows you've not double spent but it has absolutely no idea about what's inside business which is of course the whole point and then when extra addition is so much is if there is a deficit in this balancing relationship you can fill up that deficit with public tokens so imagine you know your opponents are worth 20 in Europe notes are worth 10 that means you want to extract 10 more value then you get put in and so if you make that blood shortfall on tokens and you're basically converting ten tokens

into a zero and alternate form and that's how you get value into an out of our crypto system on chain notes are public so the existence of a notice public and the owner of editors public this was a deliberate design decision to to improve compatibility between different digit private assets we have a stealth address protocol that can be used to completely to make that the owner of a notes completely meaningless but the existence of a notice is there and then the private issue is its value and then you have you Akina spending key the we kept this keys deliberately distinct you need the viewing key to construct into dollars proofs and decrypt the note and in either spending key to actually authorize transfers of value which is valuable because that means then you can give

viewing key is true let relays you can then construct proofs on your behalf but you can very strictly define what those proofs can produce through your signing with your spending key and this really helps for extremely a much more complicated exhuming lot of protocols we're having a real air in the mix would really help if there if there is that kind of energy that you would trust with a VM key so to put it all together this is an example of a bilateral swap using the Aztek protocol or AIC s 1723 and 1724 standards I'm gonna try and go through this this is come this came this is from our protocol specification which is in its draft release is the link to it later basically what this is is a multilateral exchange of cryptid value between two

digital assets that have no knowledge of they're at each other's existence effectively the caller will have a proof is it like will have a valid zero and launch proof of a bilateral swap between these notes basically you know two actors are trading notes from two different assets and we have a ZK that so imagine this is an exchange that that perform at actually like it's job is to perform these folks to process orders what this thing will do is it'll talk to the cryptography engine in the asset category an ace to validate this bilateral swap proof once validated the cryptography engine will spit out a to transfer instructions and this is the one of the key things about the cryptography engine is it takes abstract arcane because your knowledge proofs as inputs and this bits

out transfer instructions as outputs that conforms to a common standard so now once that Sneaky depth has its two transfer instructions which say you know destroy these notes make these notes what it can do is it can then send those transfer instructions to the relative zero knowledge assets and now what happens when as your knowledge asset receives this transfer instruction well it has absolutely no idea about that dab it doesn't know what it is it could be a small contra it could be a person it could be somebody tapping Morse code into a tcp/ip connection to manipulate a block in there has no idea but it does know about the cryptography sure to subscribe to that so we can query the control condition oh hey I've received this instruction like is this a this is a valid instruction where did this come from in the crypto engine go yes

actually that instruction satisfies a balancing relationship and from a bilateral sort proof and it can do that just like automatically because it valid that proof previously and this is a real strength of the system because it means that both these 2zk assets they don't need to validate their internals proofs because it's already happened in the banished or swap proof normally traditionally every all one of these assets would have to validate as you know was proof according to their own custom individual semantics which would mean three transcripts which would be ridiculously expensive but with this one you only need one because they're all listening to the same cryptography engine that come talk of engine will then once it's you know affirmed that about some relationship all is that that asset thing can then do its own

permissioning check to know have the right signatures do we have the right prove all's blah blah and then it can issue the transfer instruction back to the cryptography ation which will update the relevant note registry destroying and creating the relevant notes the reason why they kept talking into neutral zone Italy registry instead of the asset is because that means this cryptography engine could provide a cast-iron guarantee of the correctness of the state of every note registry that there has been no double spending in any registry that the only way to add or change or manipulate notes is through balancing relationships this is extremely important in the long term because it means that you can you can de nominate their knowledge assets as a percentage of another note of another asset you can say like these notes are worth X percent of this the

notes in this netregistry and you know that because the second over distri is new it has new double spending that there's a legitimate thing you can do there is this is perhaps I can talk about off after that in questions that you know that's one of the fundamental reasons why we can do dividend n interest dividend payments interest rate payments through Aztec percenters payments in zero-knowledge and then once that's all done control flow will feed back down to these you adapt I know this might look a bit complicated that's because it is it's this is a multilateral transfer of encrypted value being mediated and validated by a public blockchain but the thing is this exists it works and it's practical like this entire flow will

cost you run you about at the moment 750,000 gasp and when see up here scholar stream that'll that cost will get crushed down and compared to you more like to other kinds of you know streaming technologies of everything was had us in protocols as soon as you're not as proof semantics you know this this type of flow but would blow through the lot of estimate quite easily so I did mention that efficient range proof the whole reason why these journalist proofs can happen like this this system can happen is because we have our journalist protocol sufficient to verify because of this range proofs are kind of I want to see I down a lot of time I'm gonna try and go into it a little bit that's alright because this is after all the zero knowledge cryptography conference our range proof is built on a

fundamentally a polynomial commitment scheme normally I'm gonna so polymeric schemes are extremely powerful in zero knowledge cryptography because it means you can you can you can very efficiently prove very complicated relationships specifically I think about polynomials when expressed over a finite field so a like a group of integers modulo a large prime and a value to develop the curve is war for two scalars in openness in this finite field the difference between the scalars will perfectly divide the difference between that polynomial evaluated at those two scalars that seems a bit abstract what what's the point well it means that if you have if you

hang on if you take this relationship it's call it new you can always compute this even if Y is a secret created during a cluster set up even if you do not know what Y is you can still compute the coefficients of the polynomial that is required and then when expressed your elliptic curve you're given the correct points you can then reconstruct the polynomial event of the curve and prove that yes you have a commitment to the polynomial this is valuable because what if you construct your polynomial so that if you commit to an integer which is within the range of your range proof evaluates to zero this is really portent because then you get

this relationship now new becomes this just by this expression about polynomial age it over Y divided by one minus K and so when you you know juggle the national rearrangement you get to this equation and you can express the server elliptic curve ease and by linear pairings where sorry I'm using exponential notation G is the generator in the first group g2 is a generator in the second leg larger pairing group so use multiplies together basically new Mike times y equals the exponent Y multiplied by nu times okay why is this important because if you satisfy that relationship then you have commits you committed to that polynomial where the evaluation polynomial is 0 because otherwise if it wasn't 0 you'd have an extra term in here that isn't

that isn't then you can construct your crypto system so that it is impossible to like sneak that term in and I'll get it a little bit so toss Acela I mentioned tries to set up your setup you have to basically evaluate that polynomial over a secret why that nobody knows this is actually is extremely similar to zmz caches powers of tau ceremony to the point where we can actually use phase one applications powers to tell ceremony so you have these powers and then you can use those powers to construct this to these these polynomial equations expressed driven elliptic curve basically you can you can figure out very efficiently figure out the coefficients all these polynomials and compute them that you know if I expressed over Y and then what you can do is you can take this thing this

divided by this you can efficiently compete colony will coefficients for that and compute those polynomials why is that important because now if you select imagine that's in a database because it is you select one of these new values and you check that the if you multiply this by K and then add it to the polynomial capacity of Y sorry this is this is I'm gonna flip this around if this is equal to the base point you pick from your database paired with the

trustor set up public key like G two to the Y if these match then you have a commitment to an integer where that integer is in a valid the valid range of the range proof and you cannot satisfy the equation without them in the case and there's a you know why or be you've solved one of the discrete logarithm problems that so much of elliptic curve cryptography is based around so you kind of get to the end of this how do you actually use that to make a commitment function how do I commit to an integer in a way that it means it's encrypted and it has the cryptographic properties of being commutation binding which means if I commit to an integer when I open the equipment I can only open it to the integer I can't open it something else and information thread exciting which

means that nobody if I give somebody my commitment they can't figure out what I've committed to that it can't figure out what the integers well first we need some randomness obviously because you know you randomized this stuff but then what you do is you just pick the trust if you want a commit to an integer you pick the relevant point out of the clusters head of database multiply it by that randomness a that's one of your points Gamma Sigma is then gamma multiplied by K added together with H which is the polynomial evaluated over Y multiplied by a and if you work if you expand all of that out switch they don't have time for fate into these pairing equations you get back to that polynomial commitment function and this is this can be treated like a pedis

equipment H can be treated like a generator because it has a factor of Y in it which means that you cannot map between gamma and H or H and Sigma or H that generates a point G because every single one of the mappings has a coefficient of Y in it and you don't know what Y is because it was just idea destroyed during the trustor setup and that's how we get an extremely efficient range proof our range proof all you have to do is step one use a sigma protocol to proven to zero knowledge that you can open a stack commitment and then step two is just do this by the repairing check so if you consider a signal protocol that opens a Feddersen commitment the only difference is this by linear pairing check and the real one of the extra strings that the asset

protocol is the right-hand side of these pairing up these pairing equations those arguments they're constant and they're always constant for every single a signal which means if we have multiple asset notes in a proof you can create a linear combination of like these the asset commitments each multiplied by a random variable and then use that in one pairing check basically you can condense an arbitral number of a Sutekh range groups down to one pairing check and a single protocol to open the attribute code for their sickness which is extremely powerful because pairings are expensive so you can use this in conjunction with signal protocols to prove like FML algebraic relationships directly expressed in the experiment elliptic curve and that's what we use

for I like joined split balancing reiatives battle swap interest rate payments blah blah blah and you can expand this like to create quite reasonably like expressive pre statements there is a limit to how high you can go but there is always a compromise between like interoperability and customizability the more customer you get the less interoperable you get so we've tried to find a balance between the two so this is our cryptography engine standard this are the proofs that are in kind of a V version 1.0 so you have that part of swap joint split we have a like a partial order feeling free form away when we can like well we'll get to that when we when if people request it um we have water we're focusing more on our tooling in the moment and there's some utility proofs for those customers which was like

mathematics him right now today these are the gas costs which seem I mean they're not they're not they're not you know it is 800,000 gas but sorry this is a tautology it's also it's 800,000 guests like this is actually practical you can do this today and sure it'll run you like 30 cents but my god it's actually possible you can actually create today combination digital assets using the answer critical they have them and actually have confidential settlements between different kinds of private assets which is not something which is really being talked about much but I think one of the key strengths or theorem is that it is a settlements layer and if you once you have private settlements then I opens up an enormous and like spectrum of use cases which can't currently exist and then commenting funny also with our er 1724

of competition seeking standard so this interface looks base ideally quite similar to any RC 20 you know his confidential or proven confidential transcend combination transfer from the ideas we extract away all the cryptography into these kind of like these bytes esic proof variables basically you use on a stick frequent API so say make me a proof here that you here the input notes that I have in here the opponent's I want boom you get your proof you can speed into the smart contract you don't need to deal with like the fuzzy mechanics of what's happening inside and then this is all come I think in our a stick mono repo so this is where all our code is this is where like this is where the guts of a circus and if you wanted like clear elastics start working on building converted assets this is where

to go as the congestion sup reconstruction where every protocol contains our small contract templates for our cryptography engine and example ER 1724 contracts and if you want to like get your hands stuck in with developing private assets well I mean me my colleague pool we're here today so if you really want to ask with any questions please please by all means do so Paul also wrote a like an example on our in our medium publication off like how to get started but that's that captain making confidential digital asset and this morning we published our draft specification of our V 1.0 protocol at our github repository so there's the places to go if you want to start looking into your asset finally because I'm almost out of time the roadmap for asset 1.0 so any key one

which is like about now but with like a couple of days behind chat because we've pushed our security olla thought every pn cooped up and applied the test nets are complete proof construction api and this kind of optimize Smartcar elliptic curve smart cart or something called via strudel basically it does what one of the pre compiles do is does but a little bit faster I don't get that deployed to cover costs down by trade percent you to finish a tries to set up a monster we can collaborate with the people you also need this people using Zeki schnapps or aetherium they need you exactly the same setup as us so there's an enormous skipper collaboration there and then form of your application or apps for smart conscious and good doc re-entry because my god if there was ever a need for formal verification it is when you're validating bespoke custom

at zero knowledge cryptography and so we tend to do that well it should also add all our cupric our protocols we have formal soundless proofs to them so that mathematically they are completely secure as long as you can trust discrete logarithm assumptions yeah and yeah so we just want to make sure that the code is an expression of the mathematics and then III release our production-grade minute please well thank you very much I've been Zack and it's been a real pleasure thank you [Applause] yes

so the user needs to have an exchange of notes so the basic they have to make an order-taker they both have notes they want some notes they need at the moment of address what proof does use a relay for finishing the reasons but we also have a I mean we sorry we've a bit constrained on resources but we also have like another proof it doesn't require their na which is just a bit more expensive and so we'd be definitely getting that into our main production release where basically you have two users they both say here's what I want here's align heed here's my trunk those are knowledge proof to do the transfer both users do that sign at their side of the proof and then the court document kind of like validates them both in a batch which can be a little bit more efficient than doing individually and

that will then spit out the swap waters yes so the relay would be absolutely the relay will be trusted with the viewing keys and tries to but not like splurging the being keys and revealing like humans notes and what they're worth yes it is possible the multi-party computation protocol which we've not really explored at the moment just because it's quite gas intensive and it's quite like the UX is really bad because you basically two users that have to like kind of eke ever closer towards like matching they meet and might have an order for 58 and maybe

I have a lot of a 48 what do you have in like you know going to successor browsers and absolute pain in the neck so maybe there's demand for it we'll build it absolutely but right now we're focusing almost simpler primitives once an orders matched no no they don't they basically either two ways one they used kind of like bacon exactly what you do in that situation you construct a digital signature saying I want to sell like this I want to sell ten for like at this price and then and here's the Bianchi so then what they're allowed to do they want save master proof they construct this journals proof but then the small contract would check the signatures and

check hey is the output of this proof equal to what these signatures asked for and that's how so yeah that it's complete from the from the order crater or take our makers perspective it's completely non interactive once they've given their data that data to the relay now that's that's where my partial order fillings in also comes in but it's I mean it's just I just we've just you know that you're busy with the the core the core protocol stuff but that's definitely get best definitely go in the engine because yeah like partial thing it can be done I think it's really cool and and it's important yeah like one

last question okay so do you mean with it when I talked earlier about like get so that would be a specific actual zero knowledge proof like type so the idea is you can add different proofs to the cocoa V engine they all have like an identifier which describes what they do and what you add one basically every single journalist proof has its own validator smart contract so you'd add one that actually validates Aztec proofs in a nurse in a batch and that's that's how you process it so yeah what you have to do is yeah you'd have to you'd have to have people

like some people either something small contract accumulate a bunch of proofs and then go to the code or games we go here I'd like to his his II inputs you this proof ID this batch validation proof piece validated Bonham so that's very context dependent isn't that like four four two four two people doing a trade either like some either them or a coordinator a relay a type person would be about editing that the batch I do only it's just narrow down what I mean by batch this is not as its current stands a scaling solution batch Federation it's it is more efficient than the loading division elastic proofs but you don't but it still does grow linearly so it's small batches only four more for like you X convenience and a slight gasp

optimization than an actual any kind of scaling solution cool well thank you very much it's been a pleasure [Applause]