foreign
[Music]
I wrote the first papers on using zero
knowledge proofs and then ZK snarks for
blockchains this was the work on
zerocoin and zero cash this turned into
Z cash and it also happens to be
the protocols that underpin basically
every second generation privacy coin
that's coming online now in other words
I've spent about the last 10 years
working on zero knowledge proofs for
privacy in blockchains and today I'm
going to give you a talk entitled
privacy is dead scalability is boring
water ZK proofs good for uh so obviously
uh privacy and dead is dead is clickbait
uh apologies if they got you in here for
the wrong reasons
um privacy is really important I spent
the last 10 years of my life working on
this stuff
but
we haven't seen a large amount of demand
for private consumer payments right
Monero launched zcash launched other
things launched they exist they're great
they aren't really moving the needle and
so I've found myself wondering as I work
as a professor I'm like What's the next
thing we do you know what happens if
demand for this kind of stuff is 10
years plus out one of my co-authors Iran
trommer sort of described it as follows
selling privacy for people for
blockchain payments is kind of like
selling seat belts for cars in the 1920s
sure we can all kind of figure out that
in the future you're going to need it
but until you end up with the actual
interstate highway system and people
crashing cars at 60 miles an hour it's
kind of hard to sell people in the
future
so what do we do right
second problem is in terms of research
right for everybody who likes to get
excited about new technical stuff and
new cryptography
there isn't much here anymore the
techniques to do this are known they're
done we worked them out and this is now
a thing to work out in industrial
applications right the approach for how
you build private payments is that zero
knowledge proof plus an accumulator
typically ZK snark plus a Merkle tree
this was developed in zero cache and my
PhD thesis it ended up in Z cash it's
now in you know pretty much every single
other thing that's coming online now
Aztec andoma penumbra railgun they all
have features on top of this they're not
clones but that's the base thing for
privacy for payments
um
and so sure you can build tweaks you can
change the accumulator you can change
the proof systems you can claim it
something completely new uh
you know you can add extra features
that's quite valid but this kind of
feels to me like we're leaving behind
the main things that make zero and all
it proves really cool because the thing
to me that's fascinated me since I was
12 is the zero knowledge bits that we're
hiding things and if nobody cares about
privacy well we should move to something
else as an application
obviously privacy's not dead everywhere
uh it's definitely not dead everywhere
in cryptocurrency uh so if you're one of
these second gen privacy coins don't you
know kill me for killing your pitch deck
uh there are other things that are
happening probably we need privacy for
defy it seems like Traders do need that
um you might be able to use ZK proofs to
get out of Mev or front running
Jerry's still out on that you can have
an interesting argument with Phil Diane
if you don't believe me
um but nonetheless the core protocols
for doing zero knowledge proofs are
still like the same as far as private
payments go even for these applications
so from a research perspective there's
nothing new here
so what do we do well I hope this isn't
too offensive to any of you are but uh
blockchains are slow
so that's a whole problem
and well okay zero knowledge proofs are
supposed to be everything a growing
blockchain needs so a lot of people
working on scalability for blockchains
doing ZK Roll-Ups dkvms right this is a
lot of research it's a lot of funding
it's probably several billion dollars
worth of value from ventral capital for
this and this is where all the
excitement is right now
but if you haven't seen this well you
know how do these things work uh in a
row up you have a server that is taking
transactions that users generate users
submit those transactions to the server
the server takes them and compresses
them down using a zero knowledge proof
does anyone know which proof says hey
all these transactions are correct uh
and then the server generates this proof
and sort of throws it over the wall to
the blockchain
and so the server is in effect
saving the blockchain work this proof is
succinct at least somewhat uh and so
it's easier for the blockchain to check
that than this to check all the proofs
and so then it doesn't matter if your
blockchain is slow and does 10
transactions per second if each one of
those transactions is a zero knowledge
proof saying that 10 000 transactions
are correct in payments that's the
theory that's the pitch deck everyone's
raising off of
okay this is great there's really
nothing wrong with here this is a lot of
brilliant work has been done on this I
don't mean to Bly people on it there's
just
as a cryptography Professor the thing
that kind of bothers me uh Z kpms and ZK
Roll-Ups aren't zero knowledge
uh they compress transactions on
blockchains you don't need to hide
what's going on to do that you just need
things that are faster and smaller to
verify there's no notion that this has
to hide what's going on
and in fact they likely aren't going to
hide your data and so this is going to
be surprising to some of you
um of course ZK Roll-Ups usually reveal
the miracle hash of the data they're
dealing with that's kind of obvious
there's a zero knowledge proof about it
but they're reviewing the miracle hash
and that hash actually reveals a bunch
of data in much the same way that uh say
publishing the hash of your password is
going to reveal your password people can
Brute Force these things
and it wouldn't matter if you when you
publish the hash of your passwords that
uses zero knowledge proof that it meets
whatever ridiculous password policy
there is you know three uppercase
characters a symbol and hey let's throw
into my Emojis for good effort
that's not going to help with the
Privacy problem here and so this is
going to become an issue now maybe it's
just in theory maybe it's hard to Brute
Force this stuff uh on the other hand
ethereum just moved to proof of stake so
there were a lot of angry miners which a
bunch of hashing Hardware who don't know
what to do with it
so if this ends up being an Mev thing
you might have some problems
um
either way it's not zero knowledge and
so in my perspective this is kind of
boring from a ZK standpoint because it
just isn't using the thing that's cool
and fascinating about zero knowledge
proofs sure you need faster proofs
that's quite nice this will get you all
kinds of cool technology and I'm glad it
exists but it's it's skipping the
interesting bits right and so at the end
of the day zkvms are not a significant
source of zero knowledge they're sort of
nutritionally defunct from this
perspective they don't give us what we
want
um and again this is not to say this
stuff isn't useful it's driving serious
Innovation and zero knowledge proofs the
things I worked on in 2012 in 2017 when
we wrote sexy which were like
implausibly slow at the time are now
practical in part because of the r d
that's been funded by the companies
doing this
and so that's incredibly useful it's a
bunch of tooling that I as a researcher
can use
um and so I sort of think about this
like the 1980s and 1990s when people are
building faster computer processors
these things were tools we could use to
do anything we wanted what was driving
people doing them was you know faster
spreadsheets for offices uh kind of like
what's driving people now is faster
spreadsheets on a blockchain
uh so you can do this that's great
there's nothing wrong with it you can
also nerd out on exactly what you're
going to do for the zero knowledge
proofs and just go I don't care what
anyone's voting on an application that's
also fine but some people should dream
bigger right just like we did with
microprocessors you know build the
internet build the metaverse build
something
I don't know what it is
but we should be thinking about it like
and so we need to figure out what the
combination of ZK proofs plus
blockchains can do that isn't just
faster spreadsheets on a blockchain
um it's going to be part of it but it's
not going to be everything
so this brings me to the question and
this is where the sort of technical
content of this Talk Stops this is this
sort of theory question what is this
stuff good for right what are we going
to do with the zero knowledge proof and
if you went and took a cryptography
class uh probably even if you took my
cryptography class because I'm lazy
about writing slides you would get a
definition like this which that is zero
knowledge proof is a thing with
correctness soundness and zero knowledge
and this is a very sort of textbook
academic thing it's very dry it does not
relate what these things really do so I
think we kind of should start thinking
about them in different terms uh so in
deliberately non-standard terminology
what is a zero knowledge proof doing
well
in my mind it's three things the first
one is confidentiality it hides data and
so that's how we got Z cash that's how
we got tornado cash that's how you get
Aztec you get everything else we're
trying to hide data to get private
payments because blockchains or Twitter
for your bank account and that sounds
like a horrendous idea
okay that's thing one thing two for ZK
snark specifically is compression right
they take a bunch of data and it's
easier to verify than doing the linear
paths that the actual verification would
do without the proof
that's nice that's how you get
scalability right this is what's driving
people's quests to save money on gas
for blockchains
but the third point is to provide
something which we can think of as
credibility right so zero knowledge
proof from the cryptography standpoint
is sound it gives you some guarantee
that some statement is correct
it doesn't tell you anything about what
you can do with it credibility is this
point if I give you a piece of data I
can use a zero knowledge proof to show
to you that it really is the data you're
supposed to be looking at it really was
computed on correctly
um and this actually
Okay so
uh the idea here comes from a piece of
research done by some of my
collaborators back before I knew them uh
called proof carrying data in 2010 and
this was really before blockchains were
a major thing at least in Academia and
the idea was you have data
never mind where again they didn't know
about blockchains and the data has
proofs attached to it that the
computations are correct that was done
to produce the data so you have some
data proof here says data whatever
someone comes along computes a function
on the data gives you the output gives
the proof that that's correct and then
later somebody else can come along
compute another function on the result
of that give you a proof that that's
correct and you can just sort of imagine
some kind of state machine going
forwards looks kind of like a smart
contract I guess but it involves zero
knowledge proofs and of course because
it involves your knowledge proofs you
can also hide anything you want in the
process of doing this uh so this is
great it's a nice piece of work but
you know first of all how do you agree
on what this data is did everyone saw it
second of all what is this good for this
paper does not answer that question this
proposes this academic mechanism so
we're back to the question of what does
your knowledge proofs good for and so in
my mind the thing that a zero knowledge
proof combined with the blockchain and
that combination is crucial gives you is
credibility right that piece of data if
it's on a blockchain can tell you uh
that everyone agreed on this right this
is what's out there and then I can give
you a proof that it was correct that you
know I didn't see anything else that I
wasn't supposed to when I was Computing
on it and that you know the operation I
did was done correctly and then we all
get a share consensus on this because
it's on a blockchain I can't equivocate
on what I did I can't double spin
something if there's something in this
data you know this is privacy preserving
smart contracts for any of you have
looked at this stuff
but at a level of what's the property
that a normal person might care about
right so what do we do with this
well in general what is your knowledge
proof it's good for and in this talk I'm
going to give you some low-level things
of like immediate problems some very
high level things that are you know what
was on my mind at the time and then back
to some low-level things of identity
so the first thing that you really do
need zero knowledge proofs for is
credible safety for or from depending on
how cynical you all roll up operators
right the Bitcoin people would call this
censorship resistance uh
because if you have a
have a roll-up right the roll-up is
taking these transactions the service
sitting here it sees everything that's
in those transactions right these are
normal ethereum or Bitcoin or whatever
it is transactions they are completely
uh transparent to the server server can
see what's going on
okay fine why does that matter
blockchains are that way anyway the
problem is the server is getting these
from a bunch of people and it gets to
choose which ones it takes and which
ones it doesn't
and the problem is that that's going to
be obvious to everybody and so the
server is going to be held responsible
at some point by somebody for something
it failed to exclude
um
in other words zkvms and ZK Roll-Ups at
least if you naively do them in a single
server model aren't censorship resistant
the consequence of this is you really
better not mint any enfps if some meme a
government doesn't like you probably
shouldn't take payments to activists
that the government doesn't like if
you're all a roll-up operator sitting in
Texas I probably wouldn't take donations
to an abortion fund right now might get
you in a bit of trouble
um because if you do your nice ZK uh
block compact trying to make things
efficient isn't going to be a block
compactor it's going to be a trash
compactor on fire
you're going to just have major problems
with transactions you process so this is
not safe this is not good and this is a
major problem for all people trying to
get blockchains to scale so what do you
do about this well you replace the
individual user transactions with zero
knowledge proofs so that those
transactions are now uh opaque
and as a result the roll-up operator
can't see what's going on and so they
have they're a dumb pipe and they have
some limited ability to manipulate
transaction ordering but again they
don't really know what's going on they
have a degree of of deniability
uh and so this gives you a minimal
amount of safety it doesn't solve
everything but this is the thing that
you need to be building into your ZK
Roll-Ups um and this is things that
various people are building I believe
the original people who came up with
this idea uh I don't follow these things
too closely Aztec currently has this out
there
um Elio company I'm involved with is
also building this I'm sure there are
others but nobody's really broadcasting
these features as a thing that goes on
very well and part of that's because
that's a really bad name right this gets
called a ZK ZK roll-up which is kind of
a mouthful and every time I hear it all
I can think of is this bad meme from
like not quite the 90s but it's pretty
old
um
so you should be doing this and somebody
should please please come up with a
better name for this that's catchy so
that people can Market it um because I'm
sure I left off some people who are
building this
um
but this poses an interesting problem
for those of you who are working on zero
knowledge proofs because uh these proofs
need to be built on phones
and that doesn't necessarily work with
every ZK proof system that's out there
right I don't know the full breadth of
these things I don't play with most of
them most of my stuff's still in graph16
but I do know that some of these things
are slower than others and are suited to
other cases and so there's some risk
factors that you might want to consider
if you're looking at ZK Tech and trying
to figure out what we should use a lot
of these systems the approvers are
architected to running data centers on
Big Iron right this may be fundamental
to the way the proof system works it may
just be who your devs were and what they
knew how to do but either way it's not
clear they're going to run efficiently
on a mobile phone or a laptop
um secondly for the proof systems they
may be amortized uh only over lots of
transactions right so they're not really
efficient unless you put a thousand
transactions into this proof and check
them and then you get some amortized
savings which is fine for a server
compressing transactions to do a roll-up
but again in these cases you need phones
to be generating proof so laptops to be
generating proof so the server doesn't
see what's going on and that's only
going to have one transaction in it and
lastly the proofs in a lot of these
things are very large which is going to
cause all kinds of problems for mobile
data for your gossip protocols for
transaction distributions this is also a
warning sign
and so the way to think about this or at
least I think about this is you may
remember that there's been this big
problem with Intel and x86 for the past
about 15 years where Intel built these
wonderful server chips and then they
found out the future of the world was
mobile devices and they've been trying
to play catch-up with getting their
chips to work on mobile and there's some
business development things there
there's some fundamental technical
things or some business positioning that
have causing them problems and so we may
end up in a similar situation with ZK
proofs where you can't get these to work
in the right settings you want and then
you're gonna have to do a nested ZK
thing you have to add another ZK proof
under your ZK proof in a different
system that's going to drop your costs
and up your complexity so Food For
Thought for those of you who are working
on these things
um
so okay that's the basic like pressing
issue today but looking more broadly
what else can we use as your knowledge
proofs for right if we have this notion
of credibility carrying data right what
can we use it for and I think you can
more broadly do this for markets uh like
competition uh decentralization uh
migrating data around is going to be a
big one and obviously you can also use
it for like preventing money laundering
so starting with the last one of those
cryptocurrency has a theft problem right
this is uh
stuff gets stolen now by nation states
the nation states actually go get in
trouble tornado cash got taken down
because of this actually the tornado
developer is in prison right now in the
Netherlands because of this which is
kind of crazy for you know
thing that came out of a paper I started
writing 10 years ago but this is what's
going on
um and it would be good if we had some
way to deal with this
so what if you wanted to prove uh to
somebody when you make a payment the
money you had wasn't stolen and you
wanted to show them that the money
wasn't stolen when you got it from
somebody and when that person got it
from somebody that money wasn't stolen
then either right add infinitum all the
way back
this is impossible if you're just asking
questions you can't do this without
cryptography right if you just do kyc or
whatever you'll stop at just who you are
who who's giving you the money and you
won't really get a good notion of what's
going on but ZK proofs compose
recursively right so I actually can
build a zero knowledge proof that not
only is my money not on a list of stolen
money but it wasn't on a list of stolen
money when it was paid to me and that
wasn't on a list of stolen money before
that before that all the way back in
time so we can have this sort of
credible money where despite the fact
that I'm anonymous you actually know
that it's not stolen
all right so that's one thing you could
build details are somewhat complex by
the way but it is possible
um
right more broadly you can do all kinds
of compliance right you want to comply
with anti-money laundering rules uh
currency transaction reports that you're
sending you're not sending more than ten
thousand dollars uh through a system you
can do that right in theory we knew how
to do this in in 2016 so the paper I
wrote at Financial cryptography uh but
now there are actually companies
building this because again we have more
practical zero knowledge proofs in part
because of the people working on
Roll-Ups
um you want to show you're not on the
sanctions list we can do that so this is
again you can get credibility for what's
going on with money
um
more broadly though right let's not just
think about payments what else could you
do what could you possibly want to prove
to somebody
well we're all trying to build
decentralized ecosystems right there's a
whole question of whether those are
really going to be on a blockchain or is
it going to be some oligopoly of servers
where people try to move from one server
to another to another migrate their data
from one thing to another and in those
settings it would probably be pretty
useful if when you took your data from
server a to server B you sort of said
that here I can prove to you it's
correct
all right similarly speaking you might
want to prove that an auction you're
doing is not tampered with Google
recently got in trouble because
allegedly according to several States
Attorney General they will manipulating
their ad auctions instead of running a
they said they were running a second
price sealed bid auction where if you
win you pay with the second price is and
so you should bid your value and instead
they were running something that was
approximately a first price seal bit
auction because if you won they lied and
said there was a bid right right
underwear yours wasn't basically charged
you
what you were willing to pay uh and this
is a problem with Google you know a
semi-trusted guy in a legal setting
where there are places to prosecute them
if you try to run an auction on you know
decentralized wild west of blockchains
this is going to come up so you probably
want to be able to prove your options
are correct similarly you might want to
run a matching rocket for some Rideshare
system like uber you can do this with a
zero knowledge proof in theory right
thinking even more broadly you might
want to be able to say like hey if we're
running a decentralized social media
system I have a news feed I'd like to
know that my news feed wasn't
manipulated that somebody isn't for
example feeding the outrageous stuff
just because it generates clicks uh oh
you know making clickbait titles for you
know ethereum Devcon talks uh you might
want zero knowledge proof to do that and
the thing here is these are all sort of
Pie in the Sky dreams but we're going to
need to do things like this because if
you're trying to decentralize existing
Services organizations and institutions
it's kind of essential because people
kind of trust these essential existing
things for better or worse and so if you
move to something that's completely
crazy and new you're going to need to
convince those people to trust your new
thing and you can't just publish
everything that's not how the world
Works
um so this is sort of hard to think
about as a concrete thing so he was a
you know a concrete version of this
standard tale about internet gaming
right there's some awesome game it's an
online game there's a server there's a
great Community everybody loves the
thing and then it gets a little too
popular thing goes down the toilet uh
the devs get greedy or bought by some
company
um blizzard uh and um they somehow ruin
the game
never mind how uh and so you know in
classic Futurama binder we're going to
make our own with better things
um what you want to do is like take all
your data and go to a new server with
the same game but your existing game
state
and you know for this to work the game
has to be open source but even if it is
you're going to run into some problems
here right when you take that level 50
sword or whatever it is from server a to
server B why is anyone going to believe
that you actually earned that that you
didn't just make it up right for the
server how are we going to know that
they weren't playing funny business I'm
secretly running a pay-to-play game
right how are you going to know that the
economy of that server and the way the
items are distributed is correct
right you want to be able to prevent
these guys from like toileting this game
you want to be able to move to another
server but you need all of your data to
be credible when you do this and move it
around and so the only way you're going
to do this is by committing to the data
on a blockchain and attaching zero
knowledge proofs to all this stuff again
Pie in the Sky you can't get this to
scale now but it's an interesting idea
uh and this approach is broadly feasible
to not just gaming you don't need to
just do this about a sword you could do
this about any number of things right if
you're running a crowdfronting platform
that has like Awards something like
patreon patreon goes under you can move
to another server and take the awards
you've gotten improve you actually got
them
um
so okay well what if we thought even
bigger
um
recently there was a headline uh that
the IRS had gotten in trouble for
manipulating uh their audit process and
under the Trump Administration auditing
senior FBI officials who mysteriously
had also been investigating the Trump
Administration so this was regardless
than tampering with those other stuff
um what would it take to make tax audit
processes credible and this is just sort
of a hypothetical right how would you
know that this is working uh you'd have
to commit to an audit policy in advance
you'd have to put up all of the tax
returns committed on in some blockchain
and permissioned Ledger and then you
have to show that your audit process was
applied correctly and the thing is in
the process of doing this you cannot
reveal any of that data can't tell
people what will get your taxes out of
it you can't tell people what other
people's tax returns are but if you want
everybody to know and trust that when
they get audited by the IRS or some
other institution that it was actually
done according to a fixed procedure in
the rule of law or whatever it is you're
going to have to do something and so
maybe again hypothetically if you're at
a zero knowledge proof on a blockchain
you could do this
um so as I was writing this talk uh I
kept thinking of this idea that like
verifiability enables uh cooperation so
during the Cold War the US and the USSR
wanted to disarm somewhat they wanted to
have less nukes because they could save
money on it and it was better for the
planet
um but there was this problem of if you
the U.S gets rid of their nukes they
want to verify the Russians are also
getting aware of theirs and that was
kind of hard so one of the limits for
arms control treaties was that it was
hard to verify what was going on and
what happened was as spy satellites got
better and then spy planes got better
and more pervasive the Russians in the
uh and the US were capable of verifying
that disarmament was happening and so
they could actually cooperate and there
actually are now treaties about being
able to fly planes over other people's
territory to verify this stuff it's
called the open spies act it's open
Skies act excuse me so technical
advances can enable better verification
and more cooperation uh but of course
spy satellites don't work for this kind
of stuff on on the internet we can't
just publish everyone's data ever out
there for everyone to see and so to do
this in this case we'd need zero
knowledge groups
um so you know what is your knowledge
proof's good for these three things uh
on a more
you know concrete thing you can also use
them for identity moderation
decentralization
um so we need to prove all kinds of
things about our identity online uh that
we're not North Korean money launderers
for example that were not a bot Elon
Musk um or that we're over 18 to view a
video
um
and so that's time but I have some work
on this that would kind of be
interesting so
with that uh
I guess I will take questions