zkSummit - Park Bench Panel with Anna & Fredrik

Transcript

all right so we have a full panel to start with I'll explain the format briefly this is what we call a park bench panel which means that it's a rotating panel we start with four people here and is the judge which we'll get to what the role of that is but essentially we'll start with a question the panelists get to answer that anyone in the audience is allowed to ask any question but if anyone states an opinion or asks a question in a way that it sounds like an opinion and that is what Anna's judge of if it's a if it's a true question or an opinion formed as a

question so if you may if you inadvertedly have an opinion because we hope you will you basically take the seat of one of the people sitting here and they sit down in the audience again and it's round robin style so eager we'll go out first and then going down the line replacing people as you have more opinions but once you get off you can always come back so you're not off forever you can totally come back and if you're up there you're free to express any opinion you want yeah okay so I think we have a first opening question and so if you like if you guys want to grab the mics that are there just test

them make sure that they're working yeah very nice so I think the first question that we thought would be relevant to the event is what is the security of a snark or Stark and is it enough okay so Starks based on the security of a collisional hush function and if you want it to be non interactive we need to assume the theater mere assumption you're a stick as well and that's it except except of that everything is just

mathematics and about snarks as we all know there is a trusted set up and the the script local logarithm problem that if somebody uses a quantum computer we know that it is breakable I would agree with everything like that but the one problem I have with the way Starks are currently presented is that well you said that they were in the way you've created them right now and the way you're for scaling they were to the 80 bits of security which isn't really enough in a practical setting for Applied Security but yeah that's there

other than that they're pretty good but also but Peterson hashing also is not post quantum security either though so depending on what you're proving then well you know you can kind of alleviate the quantum security you can have a team of academics researching the security of snarks for 10 or 15 years and they can guarantee you that it is secure under every condition and then people use them that are not academics or they haven't spent ten years or they do something they think is secure and they get people to audit it and it's looks secure until somebody finds a bug in it which inevitably always happens so I think

that the security of snacks and stocks is not a problem if like is the math sound or is the D log problem hard it's more like a um how often to humans mess up really badly and are you one of those when you made one of the stocks or stocks I express my opinion as a what cast listeners not as a engineer that's what I learned from from the pot from podcast listen about both algorithms so I like that I like that it's a post quantum secure theoretically and no one knows yet right and with with stars and also I participated in this workshop and

I where we reviewed the paper and it's actually it's a it's it's it's possible to understand with some you know basic math skills the the paper and there is no toxic waste so that's that's great and what I like most that anyone can basically participate in in the ceremony right when you when you set up start the the only concerning thing for me is absence of open source prover so there is no yet but well community will create one eventually right and maybe it will have different speed speed parameters our like features but the the the basic

protocol will be open source eventually right yeah of course the protocol has to be open source because nobody can trust a cryptographic proof system if it's not clear so it's not only will the very first of course gonna be open source we might publish a reference prover which maybe not be as efficient as the program will be using but there must be some reference and not for transit option but for the community so it is a possibility and I wanted to say about the security based data security piece this is just a parameter and there is no

problem to generate a proof for any security you want to a 120 and it will be just a bit bigger a few more kilobytes and you'll have better security alright so now I think we open up yeah let's open up for questions anyway I have the first one so related to this I'm curious on like I'm relaying this question from someone I talked to outside earlier like a snark or a stark is a probabilistic argument so what is the probability that it's wrong like what what are the probabilities and if you have a protocol

like coda that has recursive marks the like what people say is that the security reduces with each recursion so what like how much does that reduce the probability in each recursion when does it become unsafe so we took exactly the security as we just discussed 80 bits of security 120 bits of security if we have 80 bits of security the probability of a verifier to accept proof to a false statement is about to in minus 80 if it's a 120 the probability is doing

minus 120 and you can tune it to be as low as you want to and paying in the size of the proof but this verification scale when you put it into a practical level of security yes it won't change much the other said if you want to move from 80 bits of security to what hurt when it will add maybe a few kilobytes to the proof but it will be it would it is still something logarithmic in the statement size and you it will be verification speeds just

one second I think we might have a question or comment from the audience I guess like you know I don't need to go up but it's I think you have to I that's already you're up okay okay so but but I don't know who said I don't know who said this but it's definitely not true what what is true is that it's you know there's something in the definition of knowledge sound argument or whatever that that you know you need to build this extractor and it is true in the security proof that the with each

recursion the extractor gets bigger bigger and bigger but this this doesn't relate to the soundness of concretely speaking of the of the proof system all right I think we can actually open up the floor to new questions does anyone else have a question or a comment yeah the comments about the historic thing so how do I love snark right now on the forum the security of BN 2256 is about 86 bits so I was securing it and why do we concern ourselves with number that are above that when the underlying curve is already not secure we provide

more security right now all the circuit we built then this underlying curve is allowing us to prevail to create so that's an opinion and sadly it's directed to you so you don't really get a chance to answer it but okay you can answer it if you want to and then you're gonna take his place no you are you are it's part of the game okay so again 80 bits of security in this case if the entire network of material miners want to collude and do something problematic with a stark proof

they would do it if the verifier is done to 80 bits of security but again if you're a threat just have a very fair with higher security 102 any bit of security for example actually I wasn't address I think my point wasn't addressing to start give us more like it's a lot start right now everything says so then you can come it's it's also I don't know if that's exactly I mean just to say something about about this curve this is because of this like improved Steve algorithm in 2016 in 2016 or for a sovereign Berger Lester never got the other person but

III think it's more like a ha some people say it's like 100 to 110 bits but anyway maybe maybe you know different yeah so actually I'd be interested to hear maybe if you have more information on this 86 number maybe there's new developments I'm not aware yeah but at the time I was at Z cash where we're thinking of switching curve and people are saying oh it's just a hundred bits of security because of this new number field sieve algorithms and it's at least then it was very good conjectural so they're kind of saying under this number theoretic assumptions that we we don't know that are very hard like very

complicated and very hard to estimate if they're true or not under the most optimistic case about the these number theoretic objects these ideals in these number fields we only need to go over a space of size 2 to the 100 to compute the discrete log or whatever but then again they make this very optimistic assumption or conservative right in terms of security that really there's a way in linear time to go over this space of size to the 100 but it's it's it's a very complicated space so just as far as I know there was in terms of concrete

attacks it wasn't clear that there was something maybe it still has 128 bits of security you know I think you're up to just also point out to like a big point of this is also just the capabilities right like if we can envision that the idea of an attack now at this point is not oh we know it's 100% possible we have developed an attack that actually breaks the security it's that at this moment in time there is now a future in which we can imagine an attack being developed and therefore is it ethical or ok for us to build an entire ecosystem on top of this what may be weak curve so that's that's like the whole point here so if it is at some

point weak weaker than 2 to the 128th or whatever it's it says and now a whole new class of attack is showing this is potentially a problem suddenly you know we should probably start thinking about where are we going to move in the future and should we just do something different maybe increase some security parameter somewhere to make sure that even if there is an attack like this we're absolutely fine it's like in the case of like es 256 like Grover's algorithm you know does it decreases the security by you know the square root so 2 to the 128th AES to 128 becomes 64 bits of security but AES 256 becomes AES 128 which is still a great amount of security which we can probably

not ever envision somebody breaking so I'm gonna have to cut you off soon cuz you're you're off and you're up I I was gonna say even if we come up with like a attack that says we can do it in 2 ^ 64 time what's the realistic sort of implementation of that you know 2 ^ 64 times what you know how many operations how much disk space how much ram people say oh I found an index calculus attack that means in a tooth pair of 60 I can break this algorithm but it requires you to cover Mars and hard drives that's not feasible so there's not just to ^ whatever as being a sort of a security

measure what are the practicalities of that and like what would it take to implement this alright any other questions in the audience oh can I say something missed how this works yeah so I think that was a very good good reply I think maybe it's we should just maybe separate to maybe two terminologies like saying something has 80 bits of security maybe should mean that there's an actual attack running time to to the ad and maybe four we should use also the phrase to differentiate sometimes the conservative security estimate is 80 bits and then maybe to differentiate between those two

cases that make sense to me I've also seen people doing some you can may be defined bits of security in terms of your distribution on future worlds where there are attacks you know with of different complexities it's we have a question Hey so following the discussion of whether it's ethical to deploy substandard or maybe not future-proof security what's your view on upgradeable security force now so otherwise is it realistic to think that will have upgradeable security and then maybe we don't have to worry about these things too much comment like it's a pretty much a

question I'd say it's a question you say question okay it's a question I it was to me I'm not sure what you mean by upgradeable security so you just do some magic and you replace under the hood all of the encryption algorithms or whatever cryptographic primitives you're using and everything becomes as secure as the latest iteration there's a few suggestions for that no it sounds okay get over here just a comment

it's you we do it we're doing it this way you're next oh wait oh wait oh you're right sorry oh oh no God I'm so confused today we're missing the we're missing a person okay well if there's three sorry about that um yeah I think there was a question yeah so I'm I'm not sure how to do something like that or you may be referring to the update these updatable snarks that have come out now the time happened to be up here I'll tell you exactly which which one I mean so there's a Hungarian guy presenting and

if CC and I forgot his name and he presented cryptography based on it wasn't lattices it was something algebraic and he claims that you can change the underlying group or whatever it is to upgrade again I'll get you a coupon they'll exactly and he claims you can change the underlying group without knowing what the you know just just as a black box so you don't need to know the plain text you can update the security without knowing the plain text so you can kind of upgrade the security on the fly and it has some this kind of photography has some disadvantages as well but that's a big advantage and

maybe there's another magic so now that I know there's one magic like this maybe there's another magic of upgradable security well you start with something that's not known to be quantum vulnerable but you discover it is and then you change to a different underlying thing and then it's not yeah I I didn't know anything about that that sounds great okay can we open up the floor to any other questions could be about anything we've discussed or actually anything at all anyone is free to change the topic to something else as well yeah so I'm afraid sorry I'm very sorry this fools power the rule that might not be in complete a question but it's more than an idea I like to express

which is I could just come right actually we have a seat so one potential idea for upgradable security that uses the same crypto system is well you can perform like the whole point of like a recursive zq stock construction so you can create cycles of pairing friendly elliptic curves where like the the group modulus of one curve is equal to there like the corner motifs of another but theoretically you could inside as Equis zk stock second you could do elliptic curve scalar multiplication over curves with different prime fields it just would require an offensively large number of gates wait theoretically you could do it

so imagine if you had a pedestal commitment over one elliptic curve you could create a snark circuit which opens that commitments to a witness and then re encodes that witness on another elliptic curve and that would be one I believe theoretical way of of providing in like an upgrade of upgradeable security what do you guys think of that I think that's a great great idea like you have like a transition period where everybody upgrades their commitments and proves that it's a commitment to the same plain text or say them like noted Z cash case yeah yeah that's a very interesting idea cool questions in the

audience do you have an Orthodox bank account and if so despite having one do you think you can represent the subset of humanity known as the unbanked okay that you can come up for that there's a little opinion in there angle there's an angle get up [Laughter] do you want to go first you want to

answer it there there's a mic there and you actually represent the unbanked I don't know if we need to represent I mean you want to I think we shouldn't okay here's the opinion if I'm on stage as engineers and scientists and technologists we should strive to concentrate on engineering and science and not pretend that our work doesn't have moral implications but rather walk but rather walk with people that appreciate these moral implications social scientists and philosophers and community leaders and you know and

teachers and whatever and I don't need to be Banco unbanked I need to know who to ask and who to talk to and be part of a group that that has the sensitivity for those issues and listen to them all right oh there's there's another question here so with regard to the algebraic group model and it is my understanding that there actually aren't any formal proofs of its security like what is the security of the algebraic group model so both the algebraic and generic group model what they say is what we're

proving is your your system is secure - against a malicious prover that only does these operations in the generic group model these operations are just the regular group operations just scalar multiplication and addition so they're the same it's just this question of adaptivity like in the this always confuses me what's the difference between the two it's yeah it actually does now that I have a little stage

pressure I can't remember the subtle difference between the deep of a question for a panel maybe for some context correct me if I'm wrong but the point is that you assume that there's a certain types of things that the adversary can do and it doesn't model stuff like for example pairing right if you if you can have an isomorphism between two G bikes touches that's non-obvious it doesn't capture that but then you can prove stuff if you assume it there was a very limited instruction set that the address I can do you can prove actual security and that's that's

the claim to fame of this yeah so that's true but it's kind of a difference if you give an excuse after you do something or you give a reason in advance so in the generic group model you have to say these are my carbon reference string elements these are the operations I'm going to do on them and whatever I get I get in the algebraic group model you can spit out any element you want but then you have to show how you can get this element as a linear combination of the the elements you had before all right are there any other questions in the room and again this can actually go in any direction you want it doesn't have to be about what we've talked about this might

be a silly philosophical question but um do you think that is your knowledge proofs and all the science of amazing science we're building here is just a product of our um you know huge primal brains or is something that we just stumble upon a discovery so essentially is your knowledge proof science discovered or invented that's kind of an opinion no is it no okay it's a question discovered ornamented I have no idea well I'm gonna try not so anyways there okay proper panel right here this one we want

grab your mic i I think journalist cryptography is not like Wallace's derive from pure mathematics is not an expression of like it's it's it's very much an applied science it's built to run around like assumptions that we think we believe to be correct and I think it's because of those like rather that they are just flat-out just basic or something like assumptions that we have no for mathematical proof separate like two discrete logarithm problem I think because of that you I it's fair enough to say that it's invented because I don't think is like is its know is there's no one like natural how do I put this perfect isn't like this like the standard model of particle physics way by observing like by observing reality

you will identify like maybe you weren't all the particles and maybe you won't call them like you things like force kick forces but you'll you'll you'll figure out that there are twelve of these like sort of indivisible visible things or equal particles and they're mediated by these four fundamental forces whereas you can fight you can like elliptic curve cryptography and zero and logic a photography like it's it's far to my opinion like saturated with with like our own like like desires and assumptions and prejudices to be eight anything like anything anything that pure that that could be considered discoverable you argue against then yeah the comment here if for a standard model

of particle physics sorry I'm Russian nuclear scientists so the standard model of particle physics is based on completely abstract assumptions which reduce all the current experiments up to the insane precision to nineteen three parameters with those parameters should be defined empirically from experiments and measurements so is there well it's invention in a sense that you can write this model abstractly without observations but it's also a discovery because you can get these 19 parameters from the experiment let us just remark first under particle physics because I couldn't don't say this it's a nice comment and I think you can come up here in the meantime I can

say why it was discovered ok zero knowledge proof we'll discover they're not invented because there's those two options either there's some inherent truth DiMarzio knowledge books are too amazing and special to exist that we will just invent them clearly there's some inherent property of mathematics and we as we know it and then the question is is mathematics invented or discovered and if mathematics was discovered then well then zero knowledge proof cell kind of like an amazing thing

that was discovered together with it and if mathematics was invented then it would be too surprising to find that the owners puffs were invented with it so they have would have had to be discovered I was initially prepared to take a position of similar gsella tree and doesn't it really come down to the role of ego in the self because [Laughter] is there any other question I think we might have someone out there there's a

couple hands oh sure yeah I want to ask just to know that in Ashfield why do you have people coming from mathematics from academics and talking about generic models and things like that and you have developers ingenious and they have to work together very closely so I would like to someone to discuss the interaction like you've ingenious need to learn more more mathematics more proof skills at proving things do mathematicians need to learn to program hot how do we communicate so yeah we don't have anyone from ZK anymore but

poryvayev the most experienced robot walk I mean that's a really good question it's a good question I guess you got lucky in that aspect we in isn't it a little bit doesn't it have a common thread with my question about the banked and the unbanked because it you know it goes down to our identities I don't know I've recently taken two just calling myself an unlicensed plumber which is true occasionally because if I'm in despite the fact that I write in an integrated development environment all day long most days when I call myself a developer what have I done to my human

hood but drawn a box that puts the role of mathematician to use your example outside that identity and and then I I've lost some sort of perspective and so when something comes to me that it seems as though it is been discovered rather than invented I think that it's important to celebrate that discovery with the curiosity of you know a human of a universal creature and and not or at least not exclusively with the role that I might apply to myself as developer or a

mathematician or whatever had I happened to have drawn on my resume most recently the skills look consider what we're talking about this entire day and it's not only zero knowledge proof and it's not even only zero knowledge concepts but even zooming out a layer or two from there are we talking really with incredible focus and clarity on notions that are conceptually so new I mean certainly within our lifetime and many

of them many of the things that we're discussing are weeks or months old so the skills into the degree to which the skills divide us I think have to be viewed as something that in the temporal dimension are both incredibly fleeting and always accelerating so if you feel that you need to cross a line in terms of those skills one of the things you need to do is learn those skills I know we can't all get PhDs in mathematics from Cambridge but you know the the learning these skills and changing who we are and what we think about them is a process that happens with incredible rapidity and I think that's evidenced by

the fact that we're all in the in the room discussing these things in the first place this is a really good answer we just clap at that [Applause] do you have any thoughts on that well my answer would be much more trivial and first I would try to like to remind everyone not to invent your own cryptography that's the first rule others in this well everyone knows that wonderful implementations of leap snark which was done by people who obviously do science but they write the code and for people who want to just try to make something better faster or something like this well you can start with the code but really it's some point you will have to understand so there is no no fine line it just depends what was it

you want to be an engineer who is not unbanked but can understand the needs or you can be a scientist who can just want to feel how it works is his own caste like build it from the ground up not just a probe system but oh it's the implementation Cicely snark I want anyone in the audience you're allowed to put up your hand I know you might have we might have an extra answer so oh we actually have somebody with it well I have a question so after this brilliant philosophical question let's go back over to math well to my understanding and I may be wrong zo no let's put like for example snacks or socks our arguments of knowledge are not suppose in the sense that the the the soundness is only computation and not

perfect so is that a mistake to call them pause other than argument because we're talking about zk p zk thank you you're good to come up it sees a question where it's kind of question but maybe as my parting words can I answer the previous question is my pouting words but I don't think I think he just jumped off where's that your where you know no I'm Hugh oh I think you're still here yeah oh you know what you wanted to answer the question so just one point in entities that the scientists the scientific disciplines of today are the engineering and engineering disciplines of 30 years from now so if you think of

coders you had to be a scientist type to write code in the 70s and by now any kid high school kid can write code really and you had to be a scientist type to write data science can statistical stuff in the zeros or the 90s but by now it's getting more and more democratized in right now and you had to be a scientist to write cryptography public key cryptography in the 90s but by now it's kind of more common and today you have to be a scientist to write zero knowledge proof or whatever and in 30 years from now and there's enough support and enough libraries and so on you could do you know in 50 years high school kids will be like like zero knowledge puffs so

yeah cool so it's actually perfect because I was about to ask this question we are creating tuning right now to allow anyone to create zero knowledge system if snark circum socratis and everything and we all know that you need to have some kind of quite advanced cryptographic knowledge to actually make secure system and how do you see this knowledge transmitted and transfer how do you see normal developers get into the field that's a good question well I think everyone knows the most trivial

answer for this - er this is a well let's fight this work is open first I mean the whole idea of open source is relying is that there is someone still in there you can actually read what you made and if you made the mistake it was mistake was spotted this and this third party person well fix this mistake but not use it for their own advantage so this part basically leaves the requirement to knowing how to rides a heavy cryptography if you go into practical implementations you know need to know how to write paying functions is there are 10 people who definitely knew how to write it and they've made it before and the sense of how we implement the actual circuits well that buys the raise there are different people who do

it they have different angle of view angle how they do it in circles they do in Socrates house he work with the dictionary it is again what the open source software is for and what is human Foundation also supports as far as I know I think the answer is that just keeps a spirit for this and if if a person well and now it will be my more or less personal opinion because I was working a little bit as a teacher in university if a person you want to teach is interested he will learn no matter what you do people just do it all by himself you can give him small hints like 1% push in one direction and it's it is a person doesn't want you cannot teach

them anything so this part is if you can make the material which will push interested parties 1% that's enough questions there's one over there you even heard from you actually have a question and might be an opinion oh no in the various scalability solutions that we talked about today from Starks to roll up to everything else there's a lot of proposals to basically say we're going to create a snark or a stark that fills up an entire block with one transaction that represents a bunch of other transactions is it ethical to fill

up every block with one transaction from one application opinion so what do we do oh wait do you want to take over my role okay we've never done this no no you stay he's the judge someone to run around the mind and I'm gonna I'm gonna give around the mic well it looks like as one of the people who do this I would have to answer it no it's not the problem is even while all of us give a number some huge number we can aggregate a lot of transactions for a huge price like one-time one-time lump-sum price at the point with some concrete numbers let's

say it's five hundred or thousand transactions per second you consume the entire assyrian capacity of every block like every block all the time well let's first get to the point where the thousandth is needed there is still no killer application for blockchain so there is no killer application for scaling solutions just we need someone else not to just make the scenario scaling so sounds like this we need someone to make this application so it's not only as their knowledge which is important it's just a general creativity make it now is a killer application for stable dice table akane I think is the first good as soon as I can pay for a coffee in the morning first make your Dao I

will agree we are dangerously close to developing into crypto kitties up here I want to just point that so let's see what did the ethics of including a single transaction only in a block consist of it seems to me that essentially the question is who's whose interests are excluded from that block and whose interests are included in that block in the case of roll-up assuming the proof is fair and accurate we are reflecting the interests of both people who's Merkel proof is being compressed in that block as well as people who want

not to need to store the entire Merkel tree in that block whose interests are being excluded well we have everybody else that wanted to get a transaction into that block so I'm rather than given answer I think I'll just sort of observe that that appears to be the ethical dilemma and someone correct me if I if I have missed a part of it we have another question over here yeah hey what is the most interesting application of zero knowledge for you well I give a lot of like personal opinions today I don't how crusty still

here cuz they please stand up this is a guy who made the game using their knowledge in Berlin and presented it on stage as the main prize so I believe in their knowledge gaming well even maybe it sounds artificial but well please someone just design a game which will be interesting we seen the critic it is been since the day those are interesting please just someone do you want answer know that did you just needed to stand up so everyone you know the person who did kind of the kind of secular feature for their knowledge you making something funny just sir knowledge this area so involved everyone works in scaling like let's of the global problem it's used to make heard a

foreign bank with low transaction fees and all this yes it's good yes it's good but at some point you need to just think about people who don't care about it makes the killer application or or you can make a poker with their knowledge to with probable shuffles and everything so yeah can make more and more ideas there's another question over here this will maybe be a short one or a long one I'd be very interested in to hearing what a see case our course start snark or Sark would sound like interpreted on the flute [Music]

a Christian it's actually a comment so just wait with okay okay just with respect to the conversation about is it ethical or whatever because I thought that was a very interesting question anything the answer is the same for all you know situations where you have some finite resource like a quote unquote public bulletin board or

whatever that people like to think about blockchains that you use a market to determine the allocation of that resource no it's not ethical of course it goes to the person who has the most money so anyway right people who don't have money don't need things I mean it's also giving an unfair advantage to the people who have the technological meit's to introduce their mega transactions the real question then is is there anything distinct about this particular ethical dilemma and the way that it introduces market effects and technological effects that is a is it distinct from anything

else that you might ask about the blockchain like you know like our if if this were the if this were actually the ethical dilemma in other words if it boiled all the way down to well the person with the most money wins or the person with the best technology wins do we have any real authority to distinguish that ethical dilemma from any other question that you can ask about blockchain tech at all in I'm inclined to say that the answer has to be yes but if we can't identify how than perhaps that's a problem sorry that question I guess that might be a comment I don't know however so a while ago I was on a podcast this is a long time ago but somebody asked the question of me

that really changed my view a lot of things and was we are doing so much technological innovation and at the same time we're leaving behind those who don't have the privilege of being of using our technology what what what role does art the things that we build actually play in the lives of the unprivileged does it play a role at all you're actually replacing him now right ok so this is my burning thing right so

I'll try to play it sort of purely political and not go into the metaphysics of who or what the identity is for it for people who don't seem to directly benefit it seems the hope is and this is what we've been talking about since the Bitcoin white paper that I think here it is and again this is the very simple political thing so you know if it is true and it's a big if that the authority structures of the geopolitical

configuration of today are subject to deprecation by dint of losing their stranglehold on the printing press of the economy and obviously as we see blockchain grow we noticed that it's not merely the printing press of the economy but of a number of different computational and economic and social ideas then we hope that absent that stranglehold the governments of the world will not be able to wage endless war and therefore that the victims of endless war who are have surprising and coincidental overlap with those who don't have the privilege of this

technology we we'll be in a better position so as we build one of the imperatives has to be to end endless war does anyone else have some questions I do not want to go on stage but I do have an opinion so um I I love to to dream up products and I've built a couple of companies and I spent the entire 2018 getting into blockchain like I took a year off almost just do

that so I was extremely intrigued and fascinated and now I would they say when you are the smartest guy in the room you're in the wrong room now today I am in the wrong room but because of the opposite I feel like the dumbest person here in the room because I don't understand the mathematics behind the proofs themselves but what I do get out of this is an enormous amount of inspiration ideas for future products that deliver value to our society and what we observe in the social media and in politics strangely we which goes south strangely coincides with the technology that you guys are working on and that enables a better future so I think yes it doesn't matter well I

wanted to continue in a previous question but else else's this one is great include in general in in the course of human development and as it's especially well seen in the United States there is always a cycle that kind of the new money it's the old money and this is how the innovation works so read a lot of let's say like entities or families you however you call it with a huge amount resources accumulated historically but still the innovation allows new people to get on station you can get the influence and principle is this influence would be zero from a side of the public book chains it would be

very much unlikely that any government would want to introduce Allison restrictions or any regulation it usually the government makes those if it fills presents so I say there is already already a good progress in this but it's far from complete list I'm not sure exactly how that factoring the second thing you said but I would strongly object to the claim that quote unquote you know that people who made money in the past are sort of pushed out or whatever by people who make money the future that's just an empirical not true I mean you just if you think that's true you know go meet someone whose last name is Rockefeller and ask them if they know

I'm serious and you know how much they had to work in their life or that's an extreme example obviously but of course this is you know true unless extreme examples I just said I want a second thought a lot but the another point is that you say we're building a better future but the question ultimately is for who if you're talking about the first world capitalist society that we all live in then sure our lives are gonna be practically you know changed by the technology we're building now but for a person in Kenya who doesn't have access to a to some of the technology we have this is a huge privilege and are we leaving them behind and not going to

bring this to them and how can we benefit their society and not just you know white privileged you know Western society do we have time we are kinda out of time I think maybe we can ask the room do you guys want to do another five minutes or do you want to wrap up yeah okay I think we're gonna keep going five four minutes there's some very good points here just it's the question either it's a point or at based on I'm going to go along with Alex I mean just just very briefly about where you're right about drug feller the trophy's in the US in the last 40 years a number of

the top ten the Teutons red the most richest men are people were certainly mad and it's true that there is some of them were born rich it's a rich but actually in the in the US where market kind of work it much more pregnant at what we have in Europe were in Farida for in Florence for the last 600 years it's still the same family so the question is is it is an orange also to go back to the Kenyan example technology as bring out a lot there and besa is the most one of the most exemplary success in mobile banking and is a Kenyan basis it's a freaking it's like it's been in Kenya and the tech there is bringing on

new opportunity which is tends to go along with what Alex were saying but can I so first of all I think that this I believe is that there are problems with you know inheritance and wealth and quality in Europe there are also problems problems in America and and and I in fact they're worse and and I think probably this example that you gave you know there are tech billionaires now okay well yeah there's 200 people maybe who now aware let's make money you know many people live in America it's like 300 something million so this is like a form of this is a kind of mythical you know myth of lottery ISM that oh yeah there's this one in literally one in a

million roughly chance of of making money but anyway I just want to say yeah okay I don't know what to say I had an opinion but i'm like i like that i like this guy's politics question yeah let's final question zero knowledge related sarong do you what what cash future will have to use inside the zero knowledge I'm sorry for the change but

she asked me a zero knowledge hash function should we use inside near Sarah knowledge purse I think probably everyone knows it's Sean it's you know Tyra and Sean's Darren Shan Dara Hawkwood and Sean's a Peterson hash function except not with the windowing optimization that they do because it's an anti optimization actually I can tell you offline I would say the pitterson hash functions are probably your most efficient bet right now unless unless you're looking for quantum security in which case we have yet to see a really cool lattice space zero knowledge proof that just sweeps the floor of performance that we've

never seen yet and but of course in Adi there's some downsides to it but in that case maybe something lattice space based off of learning with others it'd be really really cool I will makes a quantum security and concrete implementations Peterson had is not quantum secure no matter whether it's inside was a snark or historic or whether it's external the function a external pro system is quantum secure so I would say make something which was more or less analyzed and has the least number of constraints I really like hash function by vintage heritage from which was presented at the DEF CON and if someone can do the proper analysis or

maybe just break it so I don't think that it should be usable in the future please do this it was a hash function which I don't think it has a name a proper name it was presented by me to heritage and a DEFCON 4 in the last year if you basically had like some like 68 break comma constraint system constraints per round and like pair of full hash functions should tend to less than 500 I just I want to briefly also answer that it depends if you just what do you need from the hash function if you just need what's called collision resistance then definitely Petterson if you need something that looks random looking like you're kind of a random Oracle then you still need to use the

heavier sha-256 or or blake to [Laughter] yeah all right Peterson or Blake - that's the final answer or the new experimental one if you can prove it say okay a question tonight can I ask a question of the audience is 2.0 when the can we switch to show three instead of catch act 256 thank you I actually know the answer to that so they plan on switching to something slower but they stuck with ketchup because they don't want to depend on

this like different properties of like two that they were the original design was Blake - they shifted back they want to shift to something quantum secure in the future it's branding so I think that we have gone way over time but we've had a wonderful session with everybody I want to say thank you to all of the panelists and thank you guys for playing this kind of awesome game with us just now we try to do this every time I hope you enjoyed it and got something out of it thanks everyone and so I guess I couldn't say Fredericks you're just here for one sec because this kind of concludes the summon like thank you all for coming

this was the third edition here I think it was like probably the most zero Knology one the most focused one and we have drinks for about two hours right Julie so enjoy stations going thank you you