zkSummit: Jordi Baylina - Circom0.5 Breakout session

Transcript

okay let's start thank you everybody and yeah what we are going to do it just mainly work little bit with circum we are going to do well we are going to try to do a full project trying from the beginning and we were going to try to code and see very much how we work with these zero knowledge here just a little disclaimer the project that we are working doing here is just an example problem there are things that could be done better that can be done with much more performance so do not take it as anything serious just for example just to learn silk ohm and to learn the zero knowledge so let's start the project that we want to build let me share the

screen that's the first thing that I should share the screen I hope everybody see my screen it's a bigger screen so maybe the people see it I'm going to try to do it bigger okay so the the main so the main thing that we are going to build is a project that tries to proof that you were somewhere at some place so what's what the project will consist where the project will have like three

actors okay first we are going to suppose you have for example a truce GPS or maybe some Oracle or somebody that at the states that somebody that somebody tells you where you are at some time imagine that you have a truce the hard work that you can ask them where you are and they makes you approve this for this this hardware will just create a packet let me just see if I can so we'll create a packet we will create a packet that contains course on location so a latitude a lot a

longitude maybe a time as time and ID maybe the serial number of the trusted hardware or the idea of who you are or the Oracle okay and all these will be all these will be a sign it so all these packet will have a signature okay so yeah well we have maybe we can collect a lot of these at the station's a lot of these proofs that you know the trusted hardware fund this

is our in my possession but maybe later I want to prove you that I'm I've been at some point at the time maybe three days ago I was very close to Barcelona but I don't want to tell you the exact time when I was to Barcelona and exactly how close I'm we're so I don't want to reveal you the full latitude the full the full latitude and longitude this exact latitude I want just to tell you that may be that you are so here is the globe okay so I want to tell you here is a point and I want to tell you that you were just closed inside this circle so you are close to this point but you

don't want to know you don't want to know if you are here if you were here if you were here you were here or even if I was for example in the morning in the afternoon maybe with a window with the time okay so I want to generate I want to create the proof based on these data so needs I need to have this signature signature here is important okay so the verifier now's the public key of the of the of the of the trusted hardware okay so and I want to put some they trust the public hard work this is what we are assuming but I want to prove I want to prove that I'm close to there okay so the first step will be to generate to generate

this to generate this this this attestation the second step will be to generate the proof okay that you were that you have some of these points and the proof if we see in order to generate the proof we need a like a reference so we need to know assess for example one thing is exactly what what the point I want to prove that I were close to so I will need for the proof I will need another latitude and a longitude that should be close to should be close to the one should be close to the one that that we are sustaining maybe I want to first sample at a time window maybe at time

from and time to okay and I want also to generate a distance so how much clothes do you want to prove maybe this can be ten kilometers can be 100 kilometers can be want to prove maybe that I was in Europe so I can put a set a point in the middle of Europe and I can say that there is I don't know 3000 kilometers around and this will prove that I want a new look for example or it can be very close it can be I was in some place and it can be like I don't know what hundred meters maybe a zone or

a plane so this distance is important because I want to prove how close I want to prove that I was inside the circle but I repeat I don't want to verify I don't want to reveal I don't want to reveal this I don't want to reveal the exact location and the exact time stamp of the location I just want to prove that this fulfills okay and of course a very few the very fear will take exactly the same reference plus the proof of course it will not take the station and it will prove that and it will

verify that this is that the decision would verify that this proof it's okay okay so this is very much the project that I want to do so let's so let's let's start let's do it okay so the first of all I'm gonna do a but if I'm going to go very fast I'm going to do a little a little UI in order to show that and mainly I'm gonna put them to the base but let's just create the project and like you see here and let's call these it's gonna be it's called of CK locations the project

you you okay let's create the project let's create for example a directory where we are going to create the HTML and can be a public hey let open let's open this with okay here you're the new file it's

called index okay and just be here it's some boilerplate and just couldn't pay is the one that I have it here just to go fast let me go through over it so this is not oh man you okay so here is well this is a normal

HTML nothing nothing nothing important here just let me let me just see this HTML because this is very much what we have seen now so let's just go see the public run a server and I start the server here I need to save it yes let me just do it a little bigger so mainly what I have nothing here just but here is what I create is like that this

is the interface for the positioning system we are going to simulate you know an attestation GP up or approve GPS okay I prove up you know what roasted hardware our trusty GPS that will just generate generate this would generate as sweet as I tell you an identification tieless time and latitude and longitude and just we just generate the which will generate a NAPA station know a set of data that mainly includes this information sign it okay then the prover what we want to prove of course we want to prove with we have of course to prove that we need to have the the certification generated before okay we need the time window so from and to the

time window that we want to prove that we were at that specific place that's the reference place that we were close to and how much close we want to prove in this cases thank you for those we can set up to everything so with this will generate approved okay and at the end we will to verify that what we need that to verify look we need just need the proof that the proof is a zero knowledge proof disprove do not reveal any information just a proof and it proves that this identifier was a dislocation between this time and this time but we thought we willing the exact location you and this verification will just returns true or false

okay so this is we have the interface I think it's good to write the interface to because we know what we are building now and now let's start let's go to the first part the first part Hado the first part is going to be too bright the packet sync the packet position okay so this is this at the station okay so this is very easy we of course the first thing is that we can not use normal signatures we need to use the baby chappie we are using ETA psi signatures so in order to do that we are using circum lip circum lip is a well it's a library that maybe that includes a lot of silk weights to work with zero knowledge what

also includes a set of JavaScript tools in order to for example to sign not in the circuit but you need to sign in the browser and so on so let's but let's create that okay so in this case I'm going to create what I let's crate here folder with solid source and inside the sword or such now a new file and this is going to be designer okay so the sign your dog GS let's see how it looks like again I'm going to do a little bit coudn't paste but do go through the code there so the code Steiner if you go to the Saenger okay let's see this is a signer

okay so here we define a packet a pocket is gonna be it's gonna be include inside a field in a 256 bits actually it's not 256 it's like 253 bits is the over a number that's inside it's a an element of the inside the order of the curve of the baby judge job card okay so this is the prime field so let's see what here we require the big numbers here we we have some well here include from silicones and some some information some some some helpers EDSA is what actually is all the library that helps us to sign things okay little endian into buffer and well it converts this convert some

little india and to buffer just for the result to put it in a normal offer in a normal except a similar number okay but that's it now it's time for cycle actually is not use okay so okay so here is the proving key well we need to generate here i car code a random this is a bad practice do not do that this is adjust this for testing purposes I just heard here in the code private key is this brown practice but in order to just move forward I just put it here so I just created this private key and I generate

the I generate the public i generate the here which from this private key with really a say you can generate the public okay okay so from this public key I can well what I hear is what I do I think so the sign here is the actual what they are tall work that's okay so here we have the sign just do it with a bigger the sign it takes the identifier it like the time this time it's like the latitude to take the longitude okay it packs here the first lines mainly it packs them all together here it packs them all together you know you know in a few in a in a few telamon okay in a number okay and then

we just sign this number with the private key okay and the result we'll just put it in a buffer okay that's mainly what we are doing okay and at the end we just return this xs/s m/l of this buffer so this generates mainly this in the rates may be the generates the proof okay and but we also explored here the public key so we can know this this is the design they're also expose which is the public key so let's say this is like that close things okay so that's mainly nothing nothing fancy here just we are signing here maybe the only interesting thing is how we code floating points because you know here we are also you're always working with with integral numbers but

what happened when we want to work with floating points inside that's not well we need some kind of codification okay we can induce some normal floating point purification like you know next phone an assignment bit or whatever I just created one that it works okay and let's see how these hold this hold this hold hold hold this is not so in order to do that I should go maybe he here and yeah very smelly reverse well I just take 56 bits numbers I just take 56 bits the first 25 bits so

the less significant 25 beats are just among it so the most significant bit is the sign and it's a fixed exponent so in this case I just take 2 to the 32 exponents that's what I'm working of course this can be parametric and this is one of the good things of theorem is one for example I can write a full library that works in that works in floating points may be the exponent the size of the exponent can be parametric so I do not have to rewrite everything I just have this template that generates circuits that works with me with different precision and I can reuse them and that's one of the interesting things for example of so well mainly what it does this function that we see here

float to int mainly if we just take a look a float win well I just tried these you tools where it has all these things on your file booty rules j/s so let's just cut and paste agribusiness yes so we can see all these functions how it works you have a bunch of functions but float to int so mainly of course here already take the when the number that I want to that I want to encode this to this to in this case is to a number okay so and the N is the topic in this case would be 56 and the e is the exponent in

this case is going to be 28 so here is already you see this flexibility of doing the things variable much more for free and then e I just take 56 of 32 by default well I just check it if de is negative is that negative I just save it and I just just create the positive part and the positive part just mainly I just take this number and come and just convert it to a normal to a normal integer and then if it's if it's simpler I just said the sign the Center sign just put the next beat so here I have a tardy Jordans sorry to interrupt you but um can you increase the font a little bit yes is it okay now guys because somebody's writing in a chat they can't

see it okay call alright you you can speak up if you want like during the like you're in the talk as well something happens please interrupt me if you have any doped or maybe I'm doing okay so while you see here is the normal codification that there's a normal qualification that I'm doing here okay so of course here I encode the latitude and longitude and the timestamps are just in Taylor so I just take 32 integrals so here here is the curious how the field last so the first the low 56 bits are the longitude the next 56

bits of the most the last more significant bits are the latitude then 32 bits of time Stan and then 48 bits of an identifier just a normal a normal integer so we put them all together to a field element and we just sign them sign them okay so let's just do that in order to do that to work that well we need to do some some tricky things what I do here is what there are many ways to do this but one is the way to do and yeah here I mess it up just go online just mess it up here

what one way to do this is here in the public what I do for example it's just I create a main I just create a main main dodge a guess okay this main Dodge is just let me copy and paste these it's very easy one but just what it just does is just publish an object us in this case one is the distance prover in this case and just put this the signer in this case we need just on the design we have also the prover and the very far

hi everybody but this is made a designer so I'm just going to comment maybe here so that doesn't disturb here okay and with this everything should be ready let me just see if if everything is ready so what I do here is just use browserify so I can just do public just in order to convert to a bundle so that it can be seen in the so it can be can load in the normal web page so here what I do is just pro certify I mainly want to do main j/s and the output is going to be bundle so this mainly what it does for

people that don't know JavaScript it takes all the dependencies of the requires and everything it packs all together so that you can run it in in the browser so here's one yes okay serious thing well this is gonna be some pilot so it works okay so no if we go to the HTML just just to see just go to the HTML well at the beginning I just here I just set up here they in it I just put normal under all that value all the values to the fields just put a default value here okay so here I have a just a normal form that's a sign here I have

all the buttons and so on I have a button that's that just says so click just sign and if you go to the package sign so mainly just created just just just cause the distance proof were not sign with identifier the time of stand are likely to want you to taken from the from the from the take it from from the UI okay so here you come to the xiaochun sorry I couldn't hear you can you repeat okay I can hear but anyway I continue I

guess I do understand what you say okay so so here I just call this distance prove er and then and then I just put the result in the in in the single pocket result so let's see if this works okay so say if you go to the here just we well I need to load this if this tomorrow here and see approval design is not a function that sign is

not function missing looks like our I it doesn't name sign them require the source signer so sooner oh stop it here [Music] well I need to include circum late no

problem see if it takes all the video and all that stuff it takes a while to download you No

over here you you why doesn't mode takes too much well

let's move forward let's write lighter so let me just go to the original repository what is the one that should works hello can you hear me yes okay so let's just just sign theory just generates as you see well this is what should happen in the other side it just

generates this as you can see here here we have the well we have all the main you know the first is Allah this is a little Indian so here is that don't know the code that we want to generate these remaining zeros is because just one 256 bits and we are using in some demo class and this is mainly the signature all this is the the the signatory takes three field elements a point and many subjoin another scholar okay so this is the everything is embed here okay so once we have the signature then we need to go mainly to the main work that's may need to write the silicon tube right the one to write the to write

the to write the silk words so let's go directly to be writing the circuit so here we go and we just location just generate one just let me just do it for both sides quits okay and main circuit that we are going to build on and here I'm going to put it all together we are going to do a top-down implementation here that's the best way to do working in circle so the first one that we are going to build this ah

now let's see the first one that we are going to build it's the one that's gonna be call I'm going to call it here going to keep the same them that they had before distance to bar dot mine okay so let's just scholar create another one new file this

has proved our domain well let's just go to the first to the code to the distance prove our distance prove er let me just cut and paste from here let's see what's the distance prove our does okay so here is some normal program on the thing go to this a template it's a template that has two parameters in this case is generic it should be generic for and for the sides of the floating point and a probable in this case would be make more sense just to to remove N and E okay but here is just from a a parametric part design is silicon silk which is very much like

designing electronics so what many what you are just creating like this is like the first component and then we are in the first component we are putting more components and this and we connect those components and each of these sub component we put more suit suit components and we connect these sub components so we are doing a bottom a top-down design okay so what half here well here is we have a reference a reference mainly sub I is it here is the the prover is this is a private but it is sorry this is a so here we take the the reference mainly it's a it's a bite that parts the time the time window the reference distance there so the window

that we want to prove the distance that we want to prove and so the times that the time the window and the distance okay and this is packed together so it's a single number okay but each of the each of the bits of this number have different meaning okay but in the input of the suit with this is just a single a single a single input okay we pass also what would be the position the position again is another number you can see it here in the next lines in the in line 20 here is the the again the packet this is actually what's silent okay so we see the Primus tan the position and the identifier or everything all that packet in these numbers so this is the other the other

input then we have our 1/8 and s these three numbers are the signature the one that was generated before and then we have an output here you see that the output is public okay so in this case we'd have to pull one public input and one public output well public input is a reference because we want to prove something and be something that we want to prove in this case is we want to prove that we are close to some city so that means that this if we need want to we need to tell exactly what we want to prove we want to root we don't want to reveal the exact position that's why that position is private okay but we we need to know what exactly what we are

proving okay so and of course we are so proof that we also give the identifier as public because we may want to prove so we want to prove that us or identifier that we were there no maybe not somebody else so that's important also to put this the outputs are always public in itself so okay let's see what we does well here we have two bits this is a component that mainly what it takes it's have a single input which is a field element and the result is in these cases all these 56 plus 56 processes 452 in this case 231 outputs each one is a filter element but if this

Philipp Telemann is wearing tip that can only be a binary can only be 0 or 1 and this is the composition of this field element in a very in Venera in you know in canary fields in very elements okay so many these explosions the parses the this reference ok and it generates a lot of the outputs ok we do exactly we explode also the same with with the position ok so the first things is we compute the identifier ok we we just explode that and then we just take the the specific for da beats that are from one tone if working from 144 to 192 okay and we just send them to the

output here you see this this arrow in silicone this arrow is this double arrow is very important because here what we are doing is we are doing two things we are assigning okay so we are extending how we are completing the witness but we are also generating a constraint in this case we are also generating a constraint that this must be equal to these so the nice thing of silicone is this is that when you are using this arrow you are safe you are safe so have this if you're using dhokala rules you are safe I construction because you are assigning something and we're forcing that you are also creating a constraint that that happened so if while you are using I would say that in Silk'n while you are

using the wall arose and you are using let's say how detect components at least you have the warranty that you are not going to forget any constraint now that's one of the most difficult mistakes - so it's the most typical mistakes that you you may do when you are building silk weights on that so here is just we are just connecting you are assigning we're just this is like in electronics we are just putting on wire between in these cases well the output of this component to the input of this component here you see that reference we can take in the reference it's the input we're connected to these companies mainly you see that what we are doing is just connecting the pieces together okay

so we have this we have this comp we have these two components and then we drag constructs so this is the this bit to numb is the opposite that of the non two bits so we are creating from 48 inputs in this case we are just creating a single feel that's warranty to have the binary and with all the constraints that are inside and this is the this is used in the here in the bitty file is included from the from silk'n okay so this is we defined its this is already done for you okay so we compute that and we put it in the OP this is the easy okay then we have another component that we need to write but we are really dedicated that it just say that it's

near this company mainly half has as an input half two positions so the latitude and longitude one and latitude to longitude to have a distance okay and returns a bit returns a float element that can be 0 or 1 it's going to be 1 if this these two points are close enough there one this one is so the both are if there are if these two points are the distance between two points are bigger that the distance that the difference input then this output is there is going to be zero okay so what we are doing here check here so we are putting this

dope triple equal people equal in circle means a constraint so we are forcing that the is near so that the output of this is one so we are forced so if we are generating this proof so if you're running this loop that that here we have a constraint so this proof with that's what actually want to prove that this distance is there okay so that this distance is close enough so that this fulfills this is component also fulfills what else we want to do well we want to check the time stamp the window again here we have a well we we have a cure for doing this we have here if you go

here to 963 we have already a component that's less than and the less null it's a very simple component it just it takes two inputs in this case they are not binary they are just normal fields and it returns 1 if the first is less than the other okay and return 0 if if not okay so that's that's a single comparator but this is a company it's a well it's quite complex company but it's already in the library of silk only ok so we just use them so this less than we are using this and well this input requires that the two inputs the pool the two inputs be constructed so we don't baby does not accept binary that sense of concealed so

we again we have the bits to numbs just construct them okay so we construct them and then the output of this I'm Stan don't understand from noon time us time to noon we put them to the come to the comparator okay so and we do the same for the comparator Froman from the comparator - okay so we have the actually the time of time that's sign it that's now gonna be the private and then we have this reference the reference the the from and the two on on the reference actually I'll go the one second of it for me so we want that the time from me is less than the current instant and summon the current time the Salam is

less but that means that in the and finally we need to prove we also need to check with you to verify that the signature is valid so here we are just instantiating a VBS a this is also part of the library of the silicon bleep library that's just just check that a verifier is valid so you see here the inputs of these ididsa mainly what you need to pass them is the well enable that means that you can disable this signature button for theast we want to use for this that this company is enabled see the you see that the things

that who are getting closed people that knows a little bit about electronics designing zika's narcs the design music's are silk which is very much like designing electronics have a lot of common things so that's that's a cool part so the other thing is we need to verify is the the public key of the signature in this case this hard code here the same way that we could correct everything but this is the public key and here is just the input this is the signature so this is just and of course the message the message in this case is the position the position remember that's the base of this packet that holds the latitude longitude the timestamp and identifiers so that's mainly holy we say of course well this is again there

are a lot of things that means to be taken account if you want to put that in a video example but you can see here how easy is to write you know the full circuit in silken so mainly we just divided the problem and most of the project most of the problems here that most of the you see most of the companies here are well are already implemented you know comparators b2 noms them to be its packing unpacking the signature so we have almost most of the work done from the same company what we do not have well we do not have that is near ok these near needs to compute this distance and also it needs to work also for example with with floating points we

well it didn't exist before now ok so in this way we just created some little bit of libraries that work with floating points ok so here we have a set of tools that we have have to vote for this specific example but can be reduced okay and this is all the floating point the floating point management okay so on the protein for the floating point management mainly we need to two functions many as minute lat and meet wantin to multiply okay so let's create let's create this float and float multiply okay so this new field let's go to the float what that's

okay let's see how this float at would look like this is a more for you fold that okay so well it just takes well this is this is probable it's not the best example let's go let's go well let's let's yeah well let's do it here we have N and E and uh nice as you know is this the how big is the floating point and e is the exponent is a fixed

exponent floating point so it's not floating point is do the more a fix point library okay just quite float but it's not it's a decimal maybe no number of operator see here is this is how many this is a generic library so this is actually generates another so you can add two numbers see number four numbers n numbers so how many operands you do you have in these cases and okay okay so for this example imagine that an OPS is to you want to add two numbers okay but could it be three could be before and in order to write it is very easy and then enough set is okay we can also add like a constant so it's another that you can add two numbers but you know almost and

this is this constant sorry this is very much for free so you can add two numbers the numbers for numbers and so how we do that okay well let's go a little bit about that let's go this is our just but this is the input/output these are variable so we will see here so let's start here in 913 okay so here in these from line 13 to line 26 well go to all operands okay and maybe what we do is we convert all the operands so that the inputs are in binary actually when you're in a converting building from a family to feel actually all these with with the component that we have seen before bits

to none okay but I just put it here more longer just you can see a little bit hope it looks like so anybody here there'll be a little strange what about the N you to let me just go to you

you so mainly what we want to build this we want to convert so mainly what we want to build is a constraint that says out its equal to that X 0 times 2 to the 0 plus X 1/2 to the 1 plus till plus until X and 2 to the N minus 1 let's put here minus 1 ok so I want to build this constraint okay that's mainly what I

want to build okay so what I'm doing I just created a variable in this case that's a linear combination and I'm adding and I'm adding each of these each of these parts so if we go to the let's see here so the linear committed while we start with offset to this we add the offset and here for each well here is let's go here inside the inside the loop okay so we start with 0 okay and here we are incrementing so the input in this case is like zero so the input so the the input K input 0 so the the less

significant bits times to eat to eat twist where the meaning is 1 so it's X 0 1 we then we double though we have two and then a 6 egg is the first week the two we double the first week to the 2 to the 2 v ii ii ii to the 3 so 2 8 16 so we are putting all them together we are just creating this linear combination in your combination it's a particular okay and this is important that because when you are building circle when you're building silk wits we have this is this is important because we are building two things one is that what we call the construction phase and the other is the winners computation phase in electronics it is very simple this is very thing

easy to understand in the construction phase mainly we were in the factory we are putting all the components together we are just building the safely we are just putting the static part we are putting the comparators we're putting the so we are putting we are just creating the constraints okay and the other in the endow in the in the witness computation part mainly what we are doing is we are computing these winners we're competing the specific Y values which values X 1/2 each wire in this case is not finally while it's just like an Aloha wire it's a it's a finite field wire but we need to compute all this weakness we need to compute all these intermediary signals okay so the

as you can see there is these two processes simple heartless to process the first it runs and it computes the things and when we are running in the computer things the the signals they don't they are they are that we're working out you're right form this thing that we don't know yet which is the value okay so we can build these linear combinations that mainly it's a linear combination is mainly it has a signal and a factor for each signal so it creates a linear combination okay so we are creating this in the LCS this video combination where you adding when while you are adding signals end up in that in the in the in the construction phase while you are it while you are they are

ending signals it does not so it does not cook it just takes it just remembers what it is it take just take the diesel in a combination of these signals with this fact of this movie so we are generating here LC is this linear combination and at the end at the end what we look here well we compute in this case we have any computer signal that's this is a combination and here or this all you see here this is the sine part okay so here mainly what we are doing is where we are creating this output this so this output but we are taking so we put it positive if the sine is positive and we just multiply by -1

if the sine is negative the sine is the last the more significantly that you see here okay so we are just taking down and if if this is 0 this is to my times 0 is 0 so this is just multiplying by 1 but if the assign is 1 as 1 minus 2 is minus 1 multiply ILC is the senior combination and this is a result so here is where actually this constrain is bill we are assigning a thing you know and putting on a constraint we can do that because here we have only one multiplication the thing is in that constraint can only be one single multiplication and of course it cannot have extreme stings it can only have additions and multiplications it cannot have you know square roots or not have a shift left soror or compare

edge compressions or something like that not are the rules of writing circuits okay so we are computing that for mainly what we are doing is we are computing that for each for each single okay so this is the first of step for all the operators we are convert we are creating this field okay that we already have all the inputs but converted to not go finally to a field representation and then here what we are adding with the elk co2 is mainly worth doing we are just accumulating mainly what we are doing is we are adding but in the field space we are adding all these fields okay so here we have a single constraint that's here okay so once we have this constraint well what's next

well what what's next is mainly what we need to convert again to binary and for doing that mainly we are just forcing that is each of the bits is binary and as fast and because the number of bits that we are using is less than the field it needs to hold the constraint if it goes over then it will not be possible to convert them finally something that's bigger than that so here there is no danger of overflowing in this case all these things that you see here well this is mainly how you how you how you once you have the output you need to put also

the sign okay so the sign here here you see something that's interesting in the in the in something that's interesting in silico okay whereas using here a single are you single row you should not use it as far as far as you know exactly what you're using this isn't safe to use unless you know what you are doing here what we are doing is okay we are assigning the sign directly just be putting the sign here we have this operator here but actually do the work without this less than zero then the sign is negative and if not is positive okay but we need to also create the constraint well here the first part is that that that this field must refinery okay so this constraint it

forces that this sign is either 0 or 1 it cannot be other thing else because of this constraint okay but it can also be Brown okay but the thing is that the nice thing is that if the number is because then we are where we are just here is the output we'll see how is the output here the output we are just weren't just generating there we are generating the output here and again we are forcing that the output is finally 0 1 okay so we will be able to construct this film we'll be able to construct this this field is this output if and only if the number so the number is below the number of bits so we can be because this is has

only an intermediate to transyl a specific number of bits and it's much less but the total is less than 256 in this case may be well in this case is 50 60 is 56 bits so 55 beats so we need to the addition needs to fit in this 55 bits if it does not fit it will not match or you do have an overflow for example this is not gonna work we are not going to be able to generate the proof okay but if it's negative that means that it's going to be a lot of bits that are going to be also set in there so we will not be able to put it so here we need to choose the right sign on the output here in order for this to

be to be able to compare that to binary so we convert that to 2 to 5 so this is how we handle the sign okay so here we just generate the output and then at the end it's just we just do the final assignment we just examine -1 and we putting them together ok so here you can see a quite complex this could be typically in a library in a library for writing floating points okay you can use the same technique for doing multiplications for doing additions why for doing anything anything else so let's go a little bit let's go let me just move to the original project I wanted to build I

want to build it from scratch you you okay so here we have a lot of things here okay well here this is the main

city this is the most important here the main the only thing that does it just instantiates with these specific numbers the distance prover that we just created before okay so it has the distance Bluebird here and then we have if we see here for example we have floating are floating multiplication this is the same for multiplying two inputs and an output in this case is just two multiplications I mean half other fancy stuff here just for adding with a factor so having with a lot of floating-point operations that that can be built in here okay so and the most maybe the most interesting thing is how we compute the distance okay because at the end we need to

compute the distance well in order to cook compute the distance we're just using this this formula okay this formula is just well it just it's an approximation it's not the exact distance but it works quite well okay so here mainly what we are doing is just converting the air of in a square in the flats if the thing is that the latitude is it's very easy because you know just from minus P 2 P 2 pi okay and whatever latitude is that y-axis okay and the longitude the thing is that well the earth it has different diameters depending on what's the latitude and in the North Pole and the softball the

diameter is 0 in the equatorial is 40 so here what we are doing is just correcting the X by the cosine the cost of the average latitude okay so if they we are in the pole because cosine cosine of 90 degrees is 0 so the X is going to be nothing okay but if you are if we if you are in the equator then a little angle just move some meter just really moves a lot of meter so we are just adding X Y and then we are just applying we are just applying Pythagoras here so this approximation that's what's called a cube rectangular approximation gives a

quite good approximation for example is more good enough but but the nice thing of this is that this is operations that are here are quite easy here we can say well here we have multiplication chance this is that well this a subtraction subtraction is a single addition by just changing the sign of the second operand so we know how to do that already here's where you have a square root but we are so we need to just prove the inequality so what maybe what we are doing here is just we're squaring this function so we have this square must be equal to R square times X square plus axis R square Y square okay so mainly and then if we just subtract this this

if you're just subtracting are the left side with the right side if the if we are subtracting B and we get a negative value that means that we are close to if we are getting a positive so maybe what we are doing is we are just subtracting the squares and if we are negative so we need with this we just avoid to do the square root so that's the first difficulty that we do here okay and the other thing is the cosine while calculating the cosine its own little bit more complex but we can do that inside the Stoics and we just do it by applying the Taylor's theorem okay so we just a compute that it's of course it's no consolation but with just with three terms we just calculate X X square X to the three X plus four and we just compute these cosine you can see for

example the average cosine okay so here mainly just takes two angles okay and gives an output and here it calculates X X X square okay so mainly just do an addition and squares two inputs okay it here it calculates X to the four just by multiplying X square times X square then X to the six and multiplying its square to X to the four and then just doing an addition with a factor so we are adding while we have a one here is minus the first element Plus this element to this element this is the flat factor add that's why that's all together so it just takes the

in this case is three takes three inputs floating-point inputs and it just that's just the first times the first factor which is negative number the second times this second this number plus the third times this their number okay and these are just constants these are factors this is not just a scale there is the one-half because we are doing the other actually it's X plus y divided by two and is already taken account in in these factors so the output of this just gives a cosign but with quite few multiplications each multiplication it's about sixty constrains so we can do what

cosine of 60 of 32 sorry over 56 precision numbers with maybe less than 200 foot range which is not bad for for for for this for example the abbs a signatory it takes four thousand constraint which is for example might be much more much more than that okay so you can see this modularity and you can see how we can we are building all these we're building all these together okay so okay we have this all these silk weight okay and oh okay what we do with it with this circuit okay when order to work with this ooh Pete and to plug it

in to plug it in the in the in own project well the first thing that we need to do is compile compile it with zero so let's let's do that okay so in order to compile with simple let's just [Music] well we just compute theorem the circuit is distance who made the circum okay and here and this is the thing that's something that's new in

this version of steer con before in the old silicon is just a raikage a JSON file okay and right now we generate many things one thing that we want to generate these are one CS system this is a specific file that just includes the other constraint system itself okay the second is gonna be the final thing that I want to generate this bubbling itself wasn't in this version of silicon we generate full Wasson package we optimize that actually do the weakness computation so from this circuit we will have just a package with more it wasn't that will compute all all the windows all these intermediary values that's needed to create to create the proof in

snarks or in any other forum any other zero knowledge systems okay we can also generate the s from Sun symbol symbolic this is mainly just it helps to debug it mainly is a text file with all the names of the signals so we can well we can check debugging circuits is very much like the bong in electronics so maybe you you just run the secret and then you can go with the oscilloscope and just check each of the signals what are the values so you can run to the circuit and say okay these values these but then I do this operation go to this but it's more static thing it's more like plugging our sillas cop more than just going just like a normal program

that you are just trusting it you can do that also but you know this is the way of debugging this okay so minus B that's a very bold stuff yeah well that should work so let's just let's do it okay it's the most generates a lot of tracing things so here the number of constraints and a lot of things and and and that's it so here no I have a if I see here well have a lot of things here because I really run it before but here what I have you need you need to just check did you need to see just all the silicon stuff plus here we have a distance prover dot cpp

so this is a c++ for generating the weakness but we have also the wasn't part we have the symbolical we we have these are one CS okay so this is what this is silicon generated for us okay so if i want to run a start then and then i can go to as knowledge a yes and this large a yes i run the setup i already so if I drew this knowledge a yes it's not a yes well as our one CS you need you need to here is the path distance prover mine dot RR one CS okay so this is the

r-1 CS system okay well it's not yes I want to run the setup okay by default now we try just a growth 16 as the standard one so I just generated well this may take this may take a while just you're just running the the set up this is well there are you can run it's better maybe to run the setup baby with Delmon with other libraries that go much faster Nijs is just for playing it for working with small simple okay and this

setup would generate mainly two things the probing key and the brief and the brief occation key the proving key is mainly all the information you need in order to generate the proof you can see here that the boss evaluated before and the verification key that's mainly what you need to verify the self the proving key is a big it's a big it's a big it's become file it's a quite huge in general but it depends on the number of constraints that used to be a big file generating the proof is very hard in this works but very fine is very cheap and the verification to verify the verification key used to be very very very small depends mainly on the flow on the number of the public inputs or

public outputs but just to be it's just very very very small small file so the verifier general can run easily actually you can run it even in the in the blockchain itself okay so here I want to introduce know what's running the setup that there is another package that well what's call before what's called wasn't it was called before web start but we just renamed it it to Weissmuller it's exactly the same project but what actually does it just computes the proofs and verifies the proofs in in the browser mainly with wazzle so very highly optimized wasn't library to run to compute the proof some brief I the

proofs ok and another thing while running is that I want to mention and this is the new things of the autofill chrome is that well it also all the C++ that generate is very optimal optimal actually there is a library that we created let me just show for you you github.com want me over this is FFF IO this is a this is a finite field library that works directly in assembly this is very very very fast and is used together with c++ generated Google generated know

and many what it does is the library let me just show you what it does it just take a format that looks something like that you have when you see a number I've seen the finite field number you can you have the what would be the you have these okay the first thing is that you can have the long representation or the shorter presentation if you are working with small numbers you are using the show representation so we have a flag here at some point that's uh this is the most significant bit of the first 64 what okay that says if it's longer sure if it's short it takes this side if it's

long it takes this side and the other flag itself is if this side is Montgomery you're not movable so you can have a number that's sure that's shorter Montgomery that means that this is a shorter presentation and this is the non-volley representation you can have a long normal that means that this is just short just it's skip it and you just worked with the long side and long Montgomery means that this side is moving and they of this library it's an assembly library that just takes the inputs and it takes an account if it's long short Montgomery Montgomery and if that's the best thing in order to compute that so for example it can compute for example a short times Montgomery a long time long Mohammadi so

it takes all the other possible combinations and it computes that very very fast and this is for completing the weakness is very very interesting because it goes really fast and this is exactly the same library or the same format works with we have like two libraries one is for Intel assembly the other is for wazzle and the world uses exactly the same format so the winners computation that you generated winner in circum it can be run in both things actually and it could be very easily to export also to other languages like go landlord may be fast for other languages it could be very easy to for silicon to generate code but for example in order the same way that engine anything C++ it

could be possible to generate go long or rest or any other language quite this it's very much prepared it's not done yet but it's prepared to run for to be integrated to 2020 language also another interesting thing is that the witness computation in silicon can be run in parallel it is that because these are components and these components you know they work it's like an electronics it actually come work very much in in parallel so there is like up so you or the C++ code actually runs in parallel so if you are if the circuit is what

design because you may have some dependency things inside but if you don't have dependency that you can there are some tricks to avoid these dependencies you can run these witness computation in parallel and it goes really good fast this is for example in the robots is very important because this was one of the bottlenecks that we had and it's not the bottleneck right now anymore okay so that's the thing other things that are interesting and I wanted to show here is well these numbers also you see words in positive and negative a lot of times the winners you see the negative also are short that's not important thing on that yeah the other maybe other thing that I

want to mention it that that it works with any with any curve it's not on it that's not only work with PN 128 that's original curve that we were using first or what that used in video but right now the circum is a time feel diagnostic so you can can work may be which I mean peak or so and work with zigzag works or any other any other corp so well let's go to the project I don't know how I'm going in time it's one it's little late but I'm continuing and I'm gonna go so it just is anybody wants to live I'm just continued and continuing the stuff it's a lot of people here right away 30 seconds of break

the back okay well let's continue we already created the setup here okay so we have them all ready to set up so right now where we already have a include example here so let's let's let's no no we need to run the the witness computation so to run the women's competition we just do a yes we want to use the Y's and file that generate 84 then the input it will just take the input adjacent that's the input

of the circuit so we will compute all the winners of the circuit given the given input let me just I think it's - I [Music] JSON and well this with this not Jason actually can generate JSON or binary but I'm generating here Jason and yeah that's a that's mainly that's made me so this is just it's not competition is with this calculation well just generated the witness Jason

all the fight some of them are zero just normal okay so this is just a no winners computation okay I know just once we have the witness have this adapter with a proving key with the witness we can now generate the proof okay so we can do for example it's not a yes okay so here is the what we can by default it takes the public the same name so I just avoid the parameters okay this mainly takes no the witness takes the proving key and it computes

the proof okay prove it takes a while we will see that later when we run it in the in the browser it runs much much much faster because here we are just using this snark jes which is not optimized it's just for playing the wrong but if you want to run it then it's better to go directly to the Wassenaar that's much much much more optimized you you

it's open another window that's already done here if I verify say okay okay so I generated a proof Jason this proper also generates the public this public this is identifier and this is the packet reference okay so these are the two public inputs

of this circuit okay so we already have this circuit we can test it here we have it in common light so who we were who we do that who we work that in how we work that to our project how we connect your project well as I told you we are using Watson snark okay that uses exactly the same formats and everything that yeah so in order to have the wiseness gnarrk let me just see how the plumber works and just go to the source you see the proper well okay so here you can you can you can check it but here the proper let's

see what the proper does okay in order to the to the proof here mainly what I do is okay I have the signal position reference so I get all the lily I personal things I all these reference parts I just pack them all together to a binary this is the reference okay so as an input and here I construct the input to the circuit okay so the input to the circuit is just what the reference that I build before I have here well the position well I asked an input I have the so I

have that the position maybe the position is mainly what was signed by the signer okay so here I just take what it was we take us an input of these as an input we take all this sign a position that mainly is the packet the packet filled with the signature or not together so here I just extract here what would be the message so I extract the the weather here is the the position that's one we build the position that's well good and then we extract from the we extract from the buffer position we extract the signature

[Music] we get to put the reference and we also put our yeah position how is this you you you oh yeah this is the first element this

is the first element of the the first element of the position the second and the third on a single tour and the fourth is there so this is that from the position what's I need we have the original that's that what we call the position here the message that sign it on the signature here and then we have the reference and we thought that together well we printed here this isn't interesting to print it because then I can put them pasted to the input file somewhere okay and here here is what's interesting witness calculation Winx calculation builder okay so where this comes from well this is in order to work with the wasum okay so the Wasson we just wrote at the beginning we just fetch it here

depending if we are in note or we are in the browser we fetch in a different way but we did here we are just getting all these mainly what we are doing is just getting this was on a buffer okay and we pass to this component is the winners calculator the winners calculator is include in a repository that we split it from silk'n that we call its aircon runtime by the word sync of runtime so sylco means GPL license but but circum runtime is apache Lunt license so it can be used every so simple programs can be used everywhere so this is a split in the ball you just take it in the here you see here in the circum runtime is

the winners calculator and this just takes care of just as an input it takes the awesome well you see here how it works just create this just win this calculator builder we build up this winners calculator and then the windows calculator we just pass the input that's that one because struct here with the inputs of the silk weight here we are in optional it pushes a sanity check mainly we double check that the constraints also for thing this would not be necessary in a production code but this gives also some information something goes wrong here and then the results are witness with the witness is just on the right of all the witness itself okay so here what it does all this stuff here is it packs

not to a buffer this is we probably are going to improve this a little bit because the problem here is that note and work it works a little different with buffers so you need to do some some tricky things on there so if you're using here you can take this as a reference of a way of converting we're probably going to simplify this stuff but we are converting all these witness to a buffer and then we are just using the BN 128 that actually is the BN built the end to be a this is a web star the Watson star so it was was not the way to use my summer star is mainly will have this build the end

20:58 sin the init code we just build it okay so we have these extensions of its BN 128 and then we just call BN graph 16 and proof is generate the proof we pass the buffer okay this is the right buffer okay and the proving key okay the proving key it's also when we get it from the beginning from the set up okay just a normal normal buffer to and that's it and with this it just generates a proof and we just output if we see that which let's let's try to do this in here okay so if I just take this single position this is what gets from

here I put it here okay and I want to prove that unless that here here is exactly the same position so you you tough it's trying to load the product

the proving key and it's the service stop do it again and you see how fast it was in what it looks like one minute or so you know it doing it here in the browser much much much faster because this is bright and full in Wasson and the generation of the proof is much much much faster okay

so well know that we are here we can just take the proof and purify that so the input we have the very fire we put exactly the same identifier at the same reference a lot together with verified insights well you see that the purification it's also really really fast if occasionally miss larks is very fast let's see well for the last let's see how a little bit how the very fire works the very fire you can see here so mainly what we are doing is while we are building exactly the same component at the end oh come on yet we have the reference we build the reference from the we pack the reference as we see before we construct the public key we have this identifier and the reference and here we just verify that we have we

passed the verification key that's note here it's a JSON file it's very small okay we have the public key which is this and have the proof the proof you see this a JSON file with just a points of course so the purification key is exactly the same wasn't snark and you can verify that in the in the browser the browser easily just to show also how the c++ code work which is written the c++ okay so in order to compile the sequence process in order to generate the to generate the we miss rotation of the C++ well the first thing

that we need to do is we need to build this finite field library so in order to do that we just yeah we will build this this comment so maybe it's well here we are running this fine in the in the model finite field Yasim we build this build ZK field dot j s actually what this library does is it's a JavaScript code that generates intel assembly ok so it's a template and in and this intel assembly you as a parameter you give the prime number so we will generate a very optimized code written in assembly with

the montgomery multiplication show all the possible optimizations done it by nasa me and we generate an assembly file ok so when I run this okay what the best is it generates these files is what we call f FR dot ASM if i see for example how this would look like you see this is not simply code this is generated by this library and you see here there are all the other other operations that work in this finite field of course you have an issue multiplication but you have also shift left shift rights Beanery operations of all sorts of operations because circle needs it in order to compute the the witness so it generates this assembly ok so I know that I have

already there the assembly well the first the next is I need to compile the assembly in order to compile this assembly I just used nan so you see NASM in this case I'm in a Mac so I'm using this if you are well if you've seen the readme of the of this finite field library of the ffiii ASM it's the documentation is there ok but here this is very specific format ok so but with this mainly what it does is generate a fair often FR dot o ok it's an object file so know that I have this list so we have right now while I did it here what

I had to but I have left oh that's a generated by the assembly okay so no that time I have the finite field library that's already generated I have the C++ the silicon what generated the silicon okay and then I put them all together and here I run this what I have here well I have of course the what the output of the silk oh I have the finite field library there is also this this script also generates a fear far dot see

this problem is gonna be removed in the future but there are some some not very much used operations that is using the GMP a still there are very strange ones and we will remove all of them so that we don't have this dependency yet but right now we have this FRC I don't see still yet because there is still some some of the very rare and difficult to implement in assembly that still uses the jail but there are no exponentiation and some some very strange things okay so and then here we have all the obvious calculatewinners the main and the youtubes

this is everything is in the or this is in the silk on runtime so in the simple rule time we go to the circum runtime just let me go see a circle you have the other run time for the see you have the rental for Jaso the see you have these C++ files that you need to you need to build these C++ so it's actually what actually is the common part what actually the main competition so the output is going to come be called

distance proving domain well we need GMP because we are still using still something this is mondo be required we also say that we also include the point just here is we are telling them the compile what to look for the include the include files so we just run this and this generates just generated these so I can already run name um as an input its input the JSON it could also be it accepts two kind of inputs JSON on binary in this case I'm using JSON but also use binary and then

I just put witness Oh Jason okay so this just runs the win this competition and you have all the code here of course it's just compiled so maybe you can you want to embed in your in your application somewhere okay so here it just it you see how fast it works you know just it takes more time just to load the same program that just to compute the witness itself in this this is the small okay so I have sort of still half over well it's exactly the same because I'm using the same values okay but you see here also as a tutorial little bit how to generate these c++ so we have run all together so we have all this system the system is working this is a course is not a production this is

a you know it's an example project but that's mainly what i want to show in this in this workflow all these let me just share with you let me just share with you the github repository of this this is everything is in the item 3 project you seen the repository 9 and 3 there is a lot of things related to seeker songs that are interesting here is this is called distance prover we were half everything here all these

just if I see the chat should oh boy and you I don't know if anybody hold-hold do I - I will share my screen [Music] how do i how do i stop sharing the screen there should be a button like to stop sharing keep looking oh yeah here I

just stop share case stop sharing yep got it got it okay so see me go to base this is want to go to the chat just okay this is the link of the repository and also if you go to telegram let me just share the

idol 3 telegram group if you have any questions in that this is amazing channel so happy doped you have in circle or anything that you're interested or whatever this is a quite good channel try to keep it as less noise as possible but this is the telegram group 5 and 3 and well that's

it that's what I wanted to to show when you know please feel free to contact me or anybody in these it's amazing people there so thank you that's it one moment are you guys G seeing the link to the chat or it's just me like the link to the telegram group oh it's over there ok it's I was a little bit slow Thank You Geordie I don't know if there is any questions or anybody wants to ask something come together really nicely um what's the benefit of the rank one constraint that you get as a first do I need to go used to get before and does

it help or what can we use it oh well our one CS the idea is to I will see as for example first the first thing is that's much more compact this in binary innocent binary so if you work with big with big with big circuits going with a JSON is not viable if you are talking about millions of constraints you need to go to binary for sure though so that's what the first the first thing the second is that this is much more when it takes less to load it takes less to transfer from one site to know as much it's much it's much more manageable and and this also this binary data is that it could make it it could it could

maybe make sense maybe to plug it in different places for example you can take this or once yes and maybe plug it to another another language so now just import one company from one language and put it in the other and just start to mix it things so that that's it's not possible yet but that goes in that direction so here and also because before during the Chasen you had these constraints and you found so the you know JavaScript code that just read the witness but was really slow and pretty much it was everything mixed though here it's very clear so like the the local straight system goes in one side this is what's needed in the in the setup process happened you can explore

to me you can ghost in one direction and the other is the witness computation and this is our no these are two parts of the circle silk'n generates these two things and we keep it separate and makes a lot of sense to go it once in one direction on the other you need or wasn't too general to compute the winners or verses and you have that constraint system and generates it to fix that's make sense yeah perfect sure more questions do you plan 20 to implement any other proven system yes yes let's see what we have time but I want to hear the risk to

proving systems that are at least in my list one of those is plunk and the other is bulletproof these are the two that at some point would make sense but the nice thing is because these are ones yes you can plug it actually recent for some plot for example with Behrman and so that it's not difficult the way it's done it's not difficult to plug it in the end except because you have brain-o you have these split pretty much because you have this javascript in socialism ask if this witness computation in one side you have the constraint system in the other and you can pass that to any other constraint system so it's just a matter

of developing and pushing but what's in the to-do list is this plus I want to start working also in the in the painting in the painting component brightening the things that are in see the organ and the clarity but that are the things that I would like to do or questions okay guys which I think that we are done

thank you very much for being here let's go to the conference