zkSummit - zk0x04 Park Bench Panel

Transcript

[Music] okay so we are really reaching the end of the zero knowledge summit this is something this what we're gonna do here is called a park bench panel it's something that I do every summit I'm gonna explain how it works so we have our starting panelists I have a question I'm gonna ask a question they're gonna answer the question and then I actually throw it out to all of you if you have an idea a comment a question something from any time today like any topic put up your hand I'll call on you and then you can ask the question if it's a question the panelist will answer if there's an opinion in the question you're gonna take one of the

seats of the panelists and so this is a rotating panel you got it now this isn't really no we're really torn here all right talks gave me a very nice opening question which was what is your cryptography wish list and actually can you guys move a little closer to each other this is weird Georgio's you won't be here long you have a hoodie so all right cryptography wish list the thing you wish already existed I guess constant time snarks would be nice or or something or or

something that's extremely efficient so that let's just say that that you can't do better than native compute so it's a native compute parodied maybe not cryptography which is generally I would like like to have more flexibility to verify cryptography on the theorem virtual machine so I would say snore on Bitcoin and also alysha's secure two-party computation with low computational complexity when you say snore on Bitcoin is that a deployed on Bitcoin yeah all right I want to throw the

question out to the audience or I want to actually ask the audience for so the mic is right there the mic is there right Jacob I need your attention so the mic is right there I need you to put up your hand if you have any comments questions ideas anything you want to ask these panelists or say all right we got a question we got we actually got a question right here so I was told to share my opinion my wish list is that I'd like to see a lot of more interesting constructions based

on lattices I really like a lot of interesting stuff that's coming from a lot of space cryptography and lattices are particularly interesting because of just how of all the many things they can do and I would really like to see more research into a lot of space your knowledge proofs efficiencies for improvements on just a lot of space constructions and things like that I think they're kind of cool do you want so you're gonna take a spot but maybe do you also have a question anything you'd put towards everyone here so given like everything that y'all have seen today was like journals proofs like what was the most exciting thing you saw today

that you're like oh that's cool like anything stick out from any talks so he made an howard you're out so you're gonna give up your seat leave the mic with George's or someone and you're gonna take the spot and George's do you want to answer that question for me probably the world's Caitlyn because I actually haven't read like any of the documents that specify it so it was like all completely new to me and I think it's cool like if you're able to do my understanding from Halo was like it allows you to do pairings like in a way without having like without requiring a pairing curve I think that's correct so if that's true

like I think it's good uija so a lot of them were great for me but Marlins probably was was the one that I enjoyed why was that why was it interesting I guess just the the cryptographic compiler aspect of it or building towards that and having something that can combine like different types of proofs and polynomial commitments to produce you know snarks with different properties I think that's a very interesting direction all right are there any questions or any comments from the audience there was a who had a hand before okay yeah I just wanted to add to the wish

list I want short postponed room signatures and lattices are not the way to do that right cool all right so I think there's there's an opinion in there Georgio's you're off Allen you're on so do you wait this seems like it disco like why would you say it was awesome then because lattices offer like a lot of interesting properties like post quantum that you you want a short post quantum signature yeah no but there's like some cool stuff that last is like fully homomorphic encryption you know there's

it's different different use cases I just like lattices they're intellectually stimulating mathematically stimulating I think they're cool like you agree probably right all the branches of mathematics for post quantum cryptography are intellectually stimulating why prefer lattices over the others I feel like you're politicizing my answer I like lattices I think they're cool that's I don't know I don't I don't favor them in the in the pqc or anything I'd you know I just I just think they're kind of cool and they have a lot of interesting properties and I'd like to see more research and lattices does anyone else have any opinions or thoughts about lattices thoughts or

opinions on lattices all right so I'm gonna ask a different question which is more about post of just be careful putting the camera there there might be people running around you post quantum you just mentioned that do we have to care all right what she said actually if if there's a way to update your signature scheme when quantum computers arrive you can get away with using pre quantum signatures until that point which you cannot get away with is

encryption because if you encrypt a safe plaintext now it can be stored indefinitely and decrypted by quantum computers when they arrive but you can get away with postponing the adoption of post quantum signature schemes by the way you can put up your hand at any time not only when I ask a question if you are thinking something you're welcome to do that so you say we should be worried or we should not be worried I think it's not as dramatic as some people hint okay you say I agree with that one so very balanced who said no I know that person that's a Deirdre oh oh wait so wait no

she said yes yeah who said no oh cool okay my take on low noise quantum computers is there a thing that like the same civilizations that like engineer event horizons of black holes do and not things that like we have to worry about like if you can build low noise large quantum computer you can write like lays a star and kill me piñon I would would challenge that opinion and say that if you assign a probability of I don't know two to the minus sixty to the construction of

large-scale noise-free quantum computers within the next ten years then you could not possibly claim that any RSA cryptosystem has a security level of 2 to the minus 128 128 yeah I think I'm claiming that the probability of a quantum of a low-noise quantum computer in my lifetime is lower than you can keep going I uh yeah I think it's a strong claim that we won't see I mean there's some I've heard both sides I've

heard you know people specifically a team a team just like have you ever met someone whose job it doesn't depend on this possibility who claims that like you can build a quantum computer in our lifetime that's great it's like okay that's great critical thinking and I would agree the problem is is that as Alan pointed out here is that it is a non zero chance that if this happens that it's going to cause so many problems and we're kind if you're like a huge if you're the government you know or if you're somebody who want or who cares about storing all this information

all this private and keeping it all private you have to include you know the a quantum future in your threat model at some point and even if it's not gonna be here in a hundred years you know we don't it's still important okay we're gonna let somebody in the audience make a point here I'm sorry I have a question about application I want to know about the low-hanging fruits of what we can do make money with this now so I was thinking like you know what I'm dealing with it now and so I was thinking like for example for zero knowledge and like credit reporting companies like Experian or transient that seems to be a low-hanging

fruit for zero knowledge or Swiss bank kind of things so what do we that an opinion no it's a question what are some good low-hanging fruit things that could benefit already today from zero knowledge kind of proof we're gonna leave it as a question fair enough you get to stay there and you guys can try to answer it I'd say that this day and age a lot of people are enthusiastic about this thing called democracy I have no idea why but if you're going to have a vote it's possible to prove that the Italia's correct and still guarantee that the votes remain confidential and I think that's it doesn't even require very complicated zero knowledge proof and in

fact over at Microsoft they're they're developing this cryptographic voting system that is designed to have very easy to understand your knowledge proofs such that high school students can actually write a verifier for the voting system I like that as low hanging fruit both for practice and for outreach and well so you're asking about the sort of like credit reporting stuff and I would say that everybody who's tried to introduce like advanced cryptography into like conventional like underwriting

has like run into a brick wall but we are sort of sort of clearly closed like a bunch of systems where like you need where it's like nice to be able to make like especially short term like loan risk decisions like I loan you something to some money to open a payment channel and way or to and I'm exposed to risk for you know some number blocks and it would be cool to introduce some sort of zero knowledge proof based under running scheme into systems like that and I think there's probably money we made there I'm also interested I thinking zero knowledge voting like what Allan was talking about I think is is really

interesting not really in support of the banking system so if you make money for those people I'd it's just a Polish the state instead alright I think we have a question over here actually it's it's explicitly not a question okay but I and then really Henry is is patiently over there and I'm sure very interesting to say but just in reference to this voting thing well first of all of course the correct question or the you know once you ask not about making money but how can we better the world with the technology but with respect to voting in particulars to plug if you want to learn how to implement such a scheme we're doing a

workshop on Wednesday I forgot if there's rules with with the etherion foundation I will also be giving giving a talk and the end goal will be at the end you will have implemented such such a such a voting scheme using snarks that's it all right is there an opinion in there are you coming up come on I'm okay thank you no no you gotta come up Isaac actually deploying a voting like that is a terrible idea I think it's a great research area but do not for the love of anything deploy that okay your you made it your an opinion you get up here you

can respond I agree voting is terrible however yeah I don't think that I was more lines of like voting for like unions and striking that would be really cool anonymous unions decentralized autonomous unions I like that idea alright there's a question over here alright um so sort of having like a flash back to the 90s and the first episode of Crypt Wars you had a situation where people said like oh well you know we can make

these kind of compromises on encryption and we'll have like for instance export cipher suites and this is the way by making this reasonable compromise we can like protect the viability of encryption and then what happened you know over the next 10 20 years was that those design decisions caused like 20 years of exploits in TLS and so my question is what are the compromises on privacy that are being made today in block chains that will be haunting the world for the next two decades that's a really good opinion I think you have a seat it was

whisper aged as a question so there's like a flipside to that question it's like will soundness questions about your zkp system haunt the global financial system for the next 20 years which is the other the flip side of where we are right now all right any other questions out here if not I'm going back to quantum just keep trolling the questions [Laughter] okay so actually let's let's go back to that because that was sort of lively and

not everyone got to weigh in on that what do you think should we worry about quantum computers or not going back there I think yes theoretically I think in principle again there is a lot of sort of the lower hanging fruit we should probably worry about more in practice but I mean in the long run why not hedge against it sure there's that risk it's an interesting problem to study you go for it yeah basically speaking you probably have some stupid mistake in your implementation of all right we need we need a couple more questions going ok that's how it works people keep your hand keep thinking of

things put your hands up so similar to voting I guess or maybe not but with like MPC and like modern sort of threshold cryptography thresholds signatures in particular and while it's implementing these kind of things exchanges this kind of stuff what's your view on like that space at large and the security of those schemes as well as actually like deploying them in practice so my understanding is that and in principle it can be done it can be done quite well the problem again is just that you you get more and more complex things you need to implement correctly and it's easy to make mistakes and I think there were some very critical mistakes and some implementations of threshold ECDSA schemes that are on

github so you know be careful but in principle I think it's it's a it would be nice to have sort of reliable implementations that people can build on because I think many people kind of assumed this as a building block for various things but then if you look at sort of what's out there is code you can use today there's not that much good stuff that's battle-tested I'm like say you know signature library where you just go pick something on your good my impression of the NPC space is it's kind of like the zero knowledge proof space before Z cache which is there's been a lot of academic work but like there hasn't been a good feedback loop between like practical implementations and the academic work so what the academics work on probably has nothing to do with what would actually be useful in industry and

I would actually disagree with you there's like some like real world non blockchain MPC things that alike project no there's this like Dutch potato auctions like always what gets ported the sugar Estonia there's like no feedback loop there's like yeah and so like what happened with Z cache was it like created that feedback loop between the zero knowledge proof community and like academic community and like industry and like as what what we see here and like that needs to happen for him people wasn't like the trusted set up was an MPC so wasn't that also some sort of feedback loop and like it's a very Universal trusted setup it's

a very constrained NBC so so is the threshold ECDSA what we're doing with the setup for the etherium 2.0 verifiable delay function like RSA modulus is probably like the biggest and most high value use of like very like traditional MPC ever it'll be interesting to see if it like completely falls over replacing hi I'm presently asking you a very new question here okay I guess talk about like the relationship between formal verification which is the theater knowledge poof because my understanding is resolved well I mean

this is mostly a question but I mean with all form verification you can't be sure that whatever you commit to is actually what you want and then you know how do you guarantee the soundness of that purpose design question for you you think that's true even with formal verification I think that even if you have some kind of formal verification you still have no way of being absolutely sure that what you're proving is what you want because you always have this problem of okay I've made this formal model and does that formal model actually correspond to the behavior that I intuitively expect because all of these systems that are people are building are ultimately systems of interaction between people and so unless

you have a way to this isn't saying this isn't a kind of like a nihilist view that like nothing no improvements are possible but just that you know attaining kind of perfect security is not really possible unless you define your security goal to be lower than their kind of human interactions with the system so I mean I guess my follower cousin will be think there will be requirement for formal verification for any sort of a ticket so there should not be any there's like two layers of this problem one is the lair of is your proof system sound and then is your implementation of

your proof system what the paper says and then the second way of the system is like we had we talked about these circuits and these polynomials but we don't talk about where they come from and whether or not they represent the protocols that like we think they do and we still don't we also don't we have there's a lot of like lack of verifiability there like lots of work to be done like these things can all be improved a lot I would maybe add that I have the impression that in the blockchain space formal verification has kind of become this check mark thing you want on whatever you do and people end up with very shall we say generous or charitable interpretations of what it

means for your thing whatever it is to be formally verified and that's a bit of a problem yeah because the statement you're making are just very complex it's hard to break down saying it's formally verified checkmark read like what did you actually formally verify like does that correspond to what you really want to be doing etc etc etc actually we have a question right back there said okay for you it is cool that we made formal verification of buzzwords though agreed yes I just have something to add on to that because that there's almost like I think kind of a third layer in addition to like theoretical security of the

protocol and then making sure that implementation corresponds to it which is just kind of extra attack vectors that come from doing computation in the real world like side-channel attacks and also our analysis but don't you feel like all right like there are systems set up to look for that right that those not fit in the first in the theoretical like thinking about the side channel not usually in like academic papers well I like your opinion we can come up

and take over that yeah that's e so now you kind of getting how it works right you can ask a question you can make a comment so as we talk about applications of zero knowledge proof I here I want to talk about blockchain and guilty as charged but what are some of the other applications of zero knowledge proof that are actually becoming practical now that we should be talking about and some food for thoughts naturally identity cards as things like real why do you get rolled out your international mobile subscriber identity which can be used to track your location at any cellular

operator you associate with where your thoughts on that I think that's a question I'm not sure that having some kind of zero knowledge system helps with like you know a national identity or like an an MC or something I think that that effectively just amounts to kind of like privacy washing a bad thing do you have any thoughts you could say something thinking I'm I'm a bit skeptical whether weather is Zeke a

piece and they're more complex forms are ready for those kinds of applications at this point because I mean for one computational overhead but also things like who actually like how many people have the knowledge to do this work like right like you can easily hire somebody that can you know write something I don't know big data analysis pipeline using Hadoop and Java or whatever but like now do the same thing with zero knowledge proof how many people are there even a world that you could hire to do this job for you and then like what would your security property with regard to the society that's trusting in this because they would at the end of the day very much rely on some sort of social proof right where some expert says the system works and at that point is it from a society perspective that

different from having having some sort of law that 4-bits the company from doing bad things with the data I don't know at this point in the future maybe not so just like one more kind of you know to maybe think through like with a question but you suppose that all this zero knowledge proof technology was like very ready and very you know deployable and everything and then you could in theory build some kind of very privacy-preserving like national identity system and then like roll that out to every aspect of people interacting with each other like would that actually be good and I think the

answer is no like it is good that like when I go to the store I can just like hand someone cash and they don't need to like verify my citizenship and I think that maybe here but I think in Sweden they're like going for cash for sure and I think that's pretty evil right and and I don't think so so that's kind of the what I meant by like privacy washing like suppose you could do that would it be good well no all right did you have a point or question or a comment what do you value more in zero knowledge proof

the scalability or the privacy or both and why I mean I think the cop-out question to that is that we don't really need to value one aspect particularly more than the other is in most of these schemes we don't need to trade-off scalability to get better privacy I think from a practical perspective more recently there's been some exciting work on scalability I think maybe a bit more than privacy

can I guess your answer oh really Oh both I mean why not both touch has been very patiently waiting thank you Oh [Laughter] so I think that a lot of people in the space specifically in privacy or you know maybe more or less than zero knowledge and really cryptography in general - I think a lot of people are more valuing applications and kind of losing sight of the end goal of like what a lot of cryptographic research and

cryptography engineering is about and it is consent like we are building essentially consent based systems that allow us to opt in with our own data or our information rather than you know say oh like Henry put it privacy washing where I can just cuz I can encrypt something and share some information with somebody doesn't mean that it's a good thing to do it doesn't you know it where the cool thing about cryptography is that there's power asymmetry it's what I can agree to do and what I want to do in an application so that way I you know I don't have to worry about somebody abusing my data even if it's encrypted I just want to know if I have the right to choose whether or not to

engage I think you're gonna take this spot I think there's a question right here yeah so earlier as mentioned how complex these things are I think in one of the talks videos how few people in the world understand these things but we are sort of deploying these things in practice in this block chain space I think bolt proofs is what maybe a year or so after it was released so are we moving too fast and should we be slowing down on actually deploying these things ok question ok it's a question I got the jury almost [Laughter] yeah yeah I mean I would say that we're

not really I don't think we're going too fast in that if we kind of slow down and start trying to really standardize things we might just end up with something that's suboptimal like only considering schemes using r1c us instead of the more recent polynomial based schemes and that would be right this kind of goes back to the question of how we can screw ourselves over for the next two decades and we kind of want to avoid that and like from like a business decision slash you know research perspective I would say that like

there's times when you know that there's like a there's times to really push hard and go really quickly for a lot of this stuff and I think now is that time you know projects will deploy things where maybe we're not getting as much utilization as we would hope to have but in the future maybe we'd want more like right now is the time to deploy I think stuff that we feel like is experimental to see what actually works and what doesn't work you're incentivizing people to do more research and you know break stuff sometimes and I think that's really important for the entire community to know what the practical applications are so have people build on them and use them build things that you know can fall apart but you know with

warnings and things like that you know whether or not you build like mission-critical applications on this stuff that's like an ethics problem I think that you know the implementers should probably consider before they work on it but I think right now is the time to really move fast and and get that stuff out there test it and figure out what is going to work in the future question that came up during a discussion previously and the coffee break what's up with the CK pa6 well we will be seeing any of those anytime soon oh yeah good question a six I don't know much on the hardware implementations of ZK Peas I think that would be really cool to find more of

them the Z cache foundation-funded one so that could be cool I mean I think it exists I haven't personally tested it but because there through a Z cache Foundation grant there's now an FPGA implementation of Els 12 381 question is is it good no Asics not the implementation like having these kinds of Asics is it so on the so currently in scaling Bitcoin we saw representation of a scheme called proof of necessary work

by a queue Scotties and Joseph Bono and the idea is that you can do Nakamoto consensus where you're proving in ASIC and you're also grinding a nonce so if you deploy a good system that does Nakamoto consensus with snarks you directly incentivize the creation of snark Asics so this must happen do you want it you want to say something before you to jump off there um I don't know I'm not a big fan of proof of work but what I'm saying that like if you're stuck with the work anyway because I need to have the approval right but I I mean instead of having proof of work you could switch everybody over to proof of stake okay so when when I read about the flaw in Z cache found by Ariel Gaby's on

I wondered why didn't he just exploit it to get insanely rich and then I wondered maybe he did how would we know do you think that that the possibility for someone to find a flaw in systems deployed today is is a serious threat to those systems and how do we deal with that I think that's a good question so to summarize the question is not of do I find the threat that somebody can find serious flaws in the implementation today do I think that's a big threat I

mean in general yeah of course like like finding flaws and like a ton of these anything really can represent a huge threat specifically for cryptocurrency I think it's a big deal because you know we can't really just redeploy it you know once it's out there it's out there you know I I think it's I think it's worth people just kind of saying building resilient systems and and kind of including like okay think about it put it in your threat model when I'm concerned when I'm engineering a system like this or a blockchain even you know what can I do in the event that this may become an issue and even if people say oh it's not mish you unless you can

prove ibly say it's not an issue I mean there's still implementation flaws too and things like that where you know maybe an issue even if it's not provably an issue so I would say I want more people to start thinking about these critical failures and how they are placed in their own threat models when they're building these applications and exactly what they can do after you know this critical failure this incident what can be done about it and kind of assuring the public that using it today and if this does happen we have mitigations in place yeah cuz the question really is is like should you not deploy these things like should you like at what point are they safe enough even if there are some sort of

vulnerability yeah like I think there's a ethical or some ethical questions to whether or not you should deploy or use them but obviously it's an opt-in thing not everybody has to use the cache you know not everybody has to use monaro or these all these cryptocurrencies are they gonna be adopted by world governments tomorrow no you know so I think it's an opt-in risk as long as people do their due diligence and figure this stuff out they should do it if they want to yeah so on the technical side - then is that like there is a scheme by my dad we

designed others like that they call this DK sharks which allows you to verify that like the setup was not compromised even though the setup itself was not public coin so maybe that can help like in the case where you don't trust I like getting all the money like I'm like dumping zookas firstly that secondly like I think that like the universal setup is obviously a good step forward for that reason and thirdly like so on the like getting people to like be able to evaluate this stuff I have like a question on this like for everybody so okay obviously like being firstly to devise these protocols is a very valuable skill set and to understand this protocol implementing these protocols is an extremely valuable skill set there is like a weird situation

where like obviously because this is a very valuable skill set and like many people are like largely motivated by making money and it creates a situation well why would I teach you how to do this if by you being able to do this I'm gonna make less money like if I were to sell my skills up to somebody else so like come from a completely like like morally whatever you want to phrase it needs to be some way like like some mass education of people like - sometimes I get everybody up to speed like up to this because the people that are like very selective about this they won't teach you everybody's like so busy like all these people that like know how to

do this they're ridiculously busy and nobody has ever sat down with me to teach me anything like that so I don't know busy I can agree with motivated to not teach people I saw pardon me I did not mean to yeah I did not mean by anyway to say that I'm not disputing that there can be motivations like that yeah but at least for the for the ecosystem that I have seen thus far I I can't think imagine anyone being less willing to share knowledge because this is now this is a good community of good people I would hope but you know who knows how it will go if this if this

stay if this whole thing like blows up and like every major government let's say wants to like do proof of concepts or whatever the value of the skills will go way up and like people yeah yeah the one thing that I think is interesting too is that you know teaching people about these concepts is is important I you know teaching them specifically about zero knowledge proof sand like literally the constructions of them not sure there's a value in teaching the entire broad society the mathematics behind zero knowledge proof but telling people that there are ways for them to achieve their own privacy to get what I was talking about those designs where we're building consent into applications

when people start seeing the benefits of these kinds of applications they're going to demand other people start using these they won't know exactly how they work specifically but they're going to say I like I preferred that this company does this thing I'd rather use this thing when that yeah I thought those going back to this point which is like more is like is the education or the information at the heart of this actually withheld from people I actually think it is to some degree because so the and you've got a lot of a lot of cryptography is hidden behind a significant wall of academia and we've in the political scene we've seen this

exact problem where we're talking more and more about political philosophy than we actually are practical implementations of like actually getting things done and actually enacting real change so what I want to see is people you know escaping this from academia and putting it you know more into the streets if you will like let's see like making it accessible yeah a conference like this making it accessible to more people don't have documents do do we want it to be two trees there is there a - is there a point where it becomes too accessible though no maybe just sorta like people could be implementing it willy-nilly making all sorts of problems yes I mean there I don't think I don't think it would ever be a problem with somebody implementing too much of their own

crypto you know obviously we have trust we don't you don't just go put in your credit card in some random website despite everybody being able to kind of build their own you stripe them like start receiving payments right so I I do think that there's a lot of cryptography that's hidden behind academia academic language and papers are academic language I'm a high I'm a high school graduate that's all I am I dropped out after my first semester in college like teaching myself enough math to get to this point was difficult you know and we should actually be able to build more and more infrastructure for people who are like me or just anybody who's interested in

cryptography to get to that point to actually implement use it and learn about it and instead of hiding it behind this academic barriers like oh you don't have a doctorate you're not allowed I think I forget the name of the conference yeah like it was like very fortunate for like I forget the name of the conference but they required that like everybody would submit a blog post in the short video of like how their paper worked I forget maybe those ACM I don't know but it's like very useful because you know like other maybe I don't have the time or the expertise to read like through all your security groups so I kind of trust that your security proofs

work because like you got in the tier one conference and you got to stupid the reviewer to accept it but in the end all I want to know is like how can I possibly implement it and like what do I need to know about it like there's no need for me like to route through the whole thing through like very like intimidating latech we like groups there's a question right over here yes your patient li wei-ting well the point I was gonna make was similar to what you've just raised was around the B incentivization of how of actually making it accessible because a lot of the traditional academic model is just you know you're you're getting funding to do a very specific thing and you know they're not paying you to teach

other people they're paying you to do the research and it's something that is sort of an inherent failing I find a fee of a lot of the like it gets it gets research done which is great but if you aren't if you're not within the the like PhD postdoc academic track and the and the the strain that there's imposes it does make it somewhat difficult to sort of become an entry point there a similar one related is like a reproducibility of things there's similar decision distance into ization around that because most conferences and publications won't publish like you know oh I did the same

thing twice and I got the same answer to them early in modeling authors like for their implementation and like giving the actual concrete numbers yeah all right question over here sure thank you so just want to share that that that in my experience I mean I got a lot of help from from from the academia like especially UC Berkeley and I saw deaf in the audience I don't think yes but they're super helpful I talk to to deaf he was he used to he was here earlier he's he's awesome this to me it has been a dream like for

example like being literally like being able to speak with Ali like last week in Simon's like and just ask me anything ask him anything like it was there for me it's like a huge right or like being able to see Dumbo name person and say hey I'm a fan like you know what I'm saying I am finished so my question is is is I do agree that that that a lot of like the the papers out there are by academics of course and in for academics so what's not like like for engineers the best material out there to learn about their knowledge that's such a good question for engineers my way I learned photography may not be the best way but you know

like you were saying I wish I had a network of people and I could go out to be like help me understand this paper instead it was literally I read a paper I get stuck in like the introduction and I'm like okay I need to go and find I need to go read about this like weird math thing and I go on Wikipedia and I find try to go through that oh god I have like four other things I need to learn about and that was how I did it I literally just kept reading it until I understood it so for engineers who probably don't have that time you know it's I there's a lot of slack groups there's a lot of telegram groups there's a lot of people who are willing to help you in this space we need to make those people known like you we need to be more

open about groups where we can have these questions and discussions and where we can actually have like you know the no stupid question kind of policy and they need to come in here and and help us figure it out like cryptography has been overwhelmingly dominated by this thing that you know don't roll your own crypto which is important but at the same time it has been extremely xenophobic to any new any new people and demotivating I remember that the first library that I tried implementing and that of specter of my head was very prominent like yeah I was I really didn't feel that I was supposed to be

doing this but no one else was yeah I think in the like in the long term I think you know so there's absolutely a need to sort of like get more face time with people get and get more yeah get more if more people know about it then more people can learn about it because there's fewer contended resources to be able to learn so like the business thing to care to but there's also sort of like a layering thing because like you think of modern engineering you know software engineering the moment you know how many people actually on a day-to-day basis have to care about how a compiler works not that many for the most part there's reasonably good abstractions away from

most of the stuff and we we're not there yet with Bozek hippies but it is somewhere that we can absolutely get to and when we have more of that sort of tooling available it's and you know some of the good work that's being done like you know snarky and Socrates and these other so like dear cells that are working to like abstract over some of the bits that a lot of people shouldn't need to care about it's going to make getting and actually using these for like your your everyday engineer who just is trying to write that web page that for some reason needs a zkp to talk to the server yeah it's gonna make their life so much easier and if we get to that point then I sincerely hope we

learn from the lessons of compiler errors where we actually you know we do actually try and document what's going on inside and so if you do want to learn you have yeah that's another Avenue because then it's it's canonicalized knowledge and in a sense like you know at a DCC you know I sometimes use the quip that Shawna's our compiler and Dara's our dare show one flag and that's not scalable and so yeah we need to get to the point where where the stuff is like canonicalized or more widely usable there's a question actually I don't have a question I have an opinion that in academia like there is a trusted set up that is of pure reviews pure so POS know

how to separate complex stuff from or like just to say like what is and what is not so like pure reviews are not public so I mean like I feel that like at least the at least the papers that are accepted in music on census should have like maybe like these reviews blinded and published so that like you can like sort of have a more information and more like dialogue around that this I think that's an interesting opinion I think you're taking this seat and I actually want to ask that question to kind of again cuz like yeah I think you're taking this one peer review like generally as a topic

it's something I've been come like in this space with all of this explosion of new stuff coming out is it being peer-reviewed and how is it being peer reviewed and at what point should a company and this is actually people have asked me this question what that I'm the person answer but it's at what point should a company use one of these in the limitations and go with it because there's so much coming out so quickly that there's this sense like I'm gonna wait and see till something stabilizes but at what point should they jump in and like yeah how is it being reviewed so for peer review like god 16 was at a circuit right so I think it was a do group which is like a pretty like good conference like as good as it gets

like the new papers there it like a print but I expect that they will like be submitted like to one of it on I don't know Alan like did you are you guys going to submit it to somewhere like probably so I think that like for peer review like it is important but like how many people exist are able to peer review odds are odds are that like like there is a good overlap between the five paper that get submitted let's say on smile temple like the people that submitted them like like they might end up like being reviewing like their own paper like so to say it like because they're so few so it gets back to the education like loop like as more people

like learn about it more people will be able to peer review it and maybe they will be able to do informal peer review like the actual like conference one of the recent papers that has is just e print has zero peer review I would say generally try and avoid if you you know if you trying to look for something that's established yeah maybe don't just take a random paper off ePrint and and implement it also someone who has taken random papers on the prints and implemented them yeah like so I can speak a little to what we did because obviously company hi probably obvious we with sprout we were taking an

established paper that have been that had gone through review and published and all that with with sapling that was very much an engineering effort on top of that and there was a lot of sort of new stuff going on with with this and as a result because we never had like a paper that got published to do that what we instead came up with was you know created was a protocol specification that was very specific as specific as we could make it and then we spent a lot of time and a lot of money on audits oh you did audits as a peer review it's it essentially as we've also got significant feedback from from academics that we that we had it did not go

through however an academic peer review process so that's not to say that that like academic peer review is the only thing that matters in the space with these constructs but it is something that you should at least be getting input from that's interesting cuz that sort of falls in that cutter or like got it as review it's like a point yeah I mean the thing with an auditor of course is like you know they are trying to you know okay strapped into a new system within like three weeks that you've spent a year designing so there's this pitfalls to that as well the thing is in these situations like they audit or like you're paying them the door to consult with you to like find the problems in

your stuff what ends up happening is you're consulting with the auditor to explain to them how your stuff works for like half of the time and like this is like like usually a big problem like for example like I designed like lay off chain like scaling systems like anytime I had to speak with somebody like to evaluate my stuff like you know you know the full thing like for much longer time than like is required because like them it's not like part it's a very specialized skill set you have the same thing in academic paper as well I mean you know you've you've written a paper in theory the paper explains what's going on but in practice a lot of papers will assume some background knowledge or assume a fear but you know because

they're you know they're working under page limits restrictions or whatever and you know you do have similar issues with constraints things you have the you know Pyrrhic the the reviewer and response process that essentially is a similar thing there's a question right here I totally agree that peer review is terrible the state of the system is terrible we have academics writing papers not to to optimize the presentation of new science but to optimize passing the gatekeepers and we should find another economic incentive system to have a proper peer review and as a company I would not require peer

review as criterion to deploy something well with that's two points it's so interesting so you would peer review is bad but you wouldn't require peer review the quality of beer review varies sometimes academics have far too little time to review far too many papers and don't end up reading them in detail so okay peer review doesn't give you a big guarantee of soundness to begin with it does filter out the 10% worst papers okay you're up yeah at the end of the day it's it's a risk assessment so you know it's up to each individual so peer review is far from perfect okay but that

doesn't mean that we should go ignore peer review right it means that there's also test of time cryptography whether it's in academia whether it's an industry these aren't the questions there's no academic barrier that is not the issue here it's that cryptography is an area of mathematics and mathematics has always had a strict language strict definitions strict ways of analyzing things to minimize confusion in order to get everyone who's reviewing a concept on the same page to be able to come to the same conclusion and agree that they're agreeing about the same thing so whether you're an academic or an industry professional or whatever you are to say

that we shouldn't have to learn a strict language that has been developed in a field in order to participate in the advancement of that is just blame it's ignorance of the way mathematics works right it's not about academics versus industry and I think what's what you're seeing now though which is beautiful is that there are people who are contributing new ideas to constructions and then collaborating with people who are perhaps more familiar with the language formalism in the language and they're working together in order to then write papers that it gets emitted to conferences and this is not to say that conferences are a perfect process but they're one process and probably we should not be just implementing things

that were accepted to the top-tier conferences but waiting for a few years before implementing them that's test of time all right you're good you get stressed but if you say an opinion you came up and then you can answer questions yes okay completely agree with Ben there are some academics here and I'd just like to ask one question is how many of you like amongst the last ten papers you reviewed how many of you actually reviewed the proofs in up indices and because I have reviewed some paper and nobody really looks at those you already assume those is you don't have time to do that and correct yeah so I think like peer review is very

important but like outside the academic community peer review is for the outside community peer review is objective process that you know that something has accepted into this big conference that is good but you don't know like that's what I'm saying like somehow like blindly make reviews public and like let like people have a discussion on top of that that was there is no opinion so I don't know I think that's a good way to go because it doesn't like sort of break anything like it's just moving from just a objective thing to subject to thing work like because peers have a better idea of like separating

what is like core idea behind the paper versus like like they can separate like they can understand that language better so like their reviews are more meaning than would say a normal person was reading the paper for the first time has not familiar with the language I think Ellen had a point there in answer to your question I don't always read the proofs sometimes the the theorem is trivially true and and I can figure out how the proof is gonna work before even reading the proof so why bother and sometimes the theorem is trivially false and then I do just enough work to prove that it is false so it really

depends on on the paper oh so wait somebody else has to make but do you want to respond to that most of the time there's other conversations happening here hold on there's three viewers are rarely required to read the abundances so if a paper has been published even at a top-tier conference there is no guarantee at all about the offender's been do you have any thoughts on that question so it is true that that

the append proofs and appendices are not always read I think it just goes to my earlier point which is just because the papers been accepted to a conference does not mean it doesn't have mistakes in it right I think that you know perhaps one of the issues is that papers being submitted to conferences these days are too long they have too much in them reviewers aren't given proper incentive or enough time to review maybe there's something that needs to be fixed about the the you know the venues for papers specifically in cryptography maybe it's not a rigorous enough peer-review process you know there's also journal papers and conference papers so papers that have been accepted to a conference have not undergone the same rigorous journal process that that is required to be

accepted to a journal in fact usually things that are submitted and accepted to journals that's after they've already been accepted to a conference and more time has passed and people agree on the result but just I guess one more thing on this is that if if and I think Alan touched on this if papers are written the main even if you don't get to the proof but the paper is written using modular concepts that make it very clear to the reader what's going on and so if there's more of a focus on like methodology for building proof systems and using a common language then actually sometimes the reviewer doesn't really need to look in

the appendix too carefully because the proof pops out right sometimes if it's intuitive to the reader how the proof would work it also makes it much easier to then peer into the appendix and see that it matches there intuition so there's another reason not to write monolithic constructions and then give a big proof of security but to have a way of describing constructions that makes it easier to review okay we have we're getting close to the end by the way folks but so your your point you talked about mathematics is a language I don't disagree mathematics is a very elegant and very beautiful language and though it does have very strong definitions and you know that we just can't drop in and just say oh this is

what that is you know my problem with it comes from the same problem that I have with a lot of politicians and political activists and you know in the space for this is that and all that we've also I think identified with this and is that academics are now using their language which is purely academic you can't disagree that it's not purely academic mathematics is a purely academic language is not a language that every person understands they're hiding their ideas behind it and putting them specifically for a reviewer like as you just pointed out now it's easier for a reviewer to review modular concepts instead of a monolithic concept in many

ways this is true but I'm not a reviewer I've never I've never reviewed a paper and I mean I have in my own my own Docs and but I've never gone to that paper right and that pert of the author and said oh this is weird you know they don't want to listen to me to be honest but my point is that a lot of these concepts are now being hidden behind this academic language of mathematics the person is implementing it oftentimes doesn't care that about the definitions of what you know some of these symbols are and whether they exact what they mean they just want to get something implemented and that the implementer for and when we're talking about applied cryptography Flags your knowledge proofs in many ways are your target is not the reviewer as you

pointed out the review is not that incredibly valuable in to some degree and so now we need to be targeting the implementer not the reviewers this is not we should be avoiding academic language we should be avoiding really weird mathematical constructs just because they make more sense to you know some doctoral students somewhere who spent three or four years studying that really one specific thing that they know about more than everybody else we need to be writing papers for people who will implement them for people who are going to try to teach other people how it works so we can find out ways if they actually work or not cuz it's not gonna be stopped in review right so you're supposed to take this I find I actually but I think this is

probably the last point and I'm happy to hear what you if you wanna respond but maybe you want to say something first like it's not like on us of on the honors of like researcher to like really really like make sure that it is like publicly understood able to the even the person who haven't done enough like are not up to the same ground level so it's not their completely their responsibility so like there would be metal men's there will be responsible for like digesting that content and in a better way so that they can provide better specifications because if you if you from the scratch if you start like from the top down if you like directly

try to make it like consumable to everyone then like you lose out on like the specification you want to put forward and so I feel like there has to be like it's not sole responsibility of like researchers to give out give out like everything that they are working on you know way that like like everybody like it's not a newspaper I say the pastor on and you take the seat and you wanted to say something first oh yeah I mean I don't know if maybe it was slightly misinterpreted but I think what we were saying is that the review process isn't isn't useless it's just it not as good as it as it could be and the

answer is definitely not to just make it accessible for the implementer rather than a reviewer and by the way a reviewer is not someone specific it's someone who speaks the same language right there is there's a if we're speaking different languages if we're speaking Chinese in English I mean we have to come up with the language so that we can communicate right and so cryptography has been has been written in such a way that there is a language to try and argue that things are secure and anyone who wants to participate in trying to analyze and whether something is a secure construction or not I think should learn that language isn't the best language right now if in fact if you have ideas of how the language can be improved that is amazing research to

do and foundational cryptography studies how do you come up with new languages that are better than if you talk to Lamar for example from from ETH he says that our you know the current models we use are totally or non intuitive and we should use different models for analyzing things because of constructive cryptography there are photographers who who spend their careers working on just coming up with the right language to write protocols and argue their security and that like it's a big part of cryptography in fact I see I would and I I agree with that I think that's great that we can actually have research done and actually improving the language that we communicate cryptography and yeah my

my more concerned with having this using when I say hiding behind an academic language and like you both agree mathematics is purely an academic language it is not everybody here must agree with that it is purely not good at math I don't know exactly what the distinction is that you're making between academics or industry or no I'm not making a distinction in the industry but the point is that you've gone through the academic process to learn that language for someone like me I couldn't afford to learn the language no most people my age can't afford to learn the language and I'm not willing to go into debt to learn that language so compared to like other play other countries and things where you know and maybe they have the resources for anything it's quite privileged and exclusionary to assume that everybody who will be in that research field is

going to get to that point as you pointed out there's actually so there's a lot of material that is available online and a lot of the cryptography that I learned as a student of cryptography was from reading papers from reading online instructionals they're made available if you want to learn for example about about zero knowledge there were a few there called the winter's bar ilan winter school workshops they're pretty good they're accessible dan and I are teaching a course for undergraduates that's going to that's unblocked chains in cryptic our Theory starts for undergraduates oh you're talking I'm saying but like there's also like again it's like if you if you take a core if

you if you use online material to first take a course in cryptography or a first taking a basic course in computer science then you can and then you can go understand the lecture or a course on snarks it's like because of the the proliferation of online material it does make it cheaper and more accessible for people to learn it but it doesn't say that people shouldn't shouldn't go through the process of learning a language in order to participate in it now I think you're saying you're right education would be broke and if it's only you can only access it through money and that's why it's great that we have online educational material now it sounds like the undergrad situations is good and those higher graduate levels maybe are less good but that doesn't mean that they have to stay that way and I'm gonna have to actually wrap this up

because we are at time but I want to say thank you to all of our participants in the park bench panel thanks for coming along and thank you so much for the for coming to the summit I think there's still a little bit of drinks there might be some drink tickets please enjoy them oh let's not forget to thank onna [Applause] [Music]