foreign
[Music]
from a crazy project called worldcoin uh
you might have seen some of these funky
sci-fi looking devices around
um
they are very conveniently round
um I'm going to talk a bit about where
we apply zkp in our stack because it
turns out it's actually a ton of really
cool application for what we're trying
to do now a little bit of what we're
actually trying to do we're trying to
create bootstrap Universal basic income
through
um
uh through crypto and one of the things
you need to do as soon as you start
handing out free stuff which Ubi
basically is is make sure that people
cannot um fraudulently climate basically
civil protection so we have to solve the
Civil protection problem there's a
couple of approaches you can do kyc is
one of them but not very privacy
preserving and we are all ckp people so
we like privacy turns out that the only
feasible strategy up to let's say a
billion people
okay
is um is to use Iris based Biometrics
and you need really good Hardware to do
that better than what you can currently
find on the market so that's that is
what this device is
now the way it works is um you take you
take your wallet you download the app on
your phone
um it generates a public private key
pair in a system called semaphore that
I'll go to soon you show the public key
as a QR code to the device the device
interacts with you make sure you're a
live human being takes your iris and
Bets the iOS through a neural network
all on this Hardware
um in a 128 dimensional vector and then
signs the public key this short Vector
as a message goes to our server we make
sure that it's sufficiently distant from
everyone who signed up before add the
factor to the database and then just
send the public key to the semaphore
smart contract where it gets added to
the on-chain Merkle tree
now
that's the sign up part after this it's
just you your wallet and the blockchain
we're no longer really involved is from
there on it's fully trustless and
decentralized and the way you use this
system is your wallet creates a grot16
zero knowledge proofs that prove that
you know the private key to one of the
public keys in the Merkle tree
you don't actually reveal which public
key that is you're completely Anonymous
in that sense you generate a unique
nullifier which is kind of like episode
a random number for the specific context
that you're using to make sure that you
haven't done the particular thing before
and then you can attach a message to the
thing so we can sign some message with
this concept so where can you use this
for example now we use this to airdrop
tokens to our users they can claim a
token by generating proof that they
haven't that they're a unique human
being and haven't claimed this token
before another really cool use case is
for dowels where you can vote on
proposals and you can build mechanisms
like one person one vote or quadratic
voting and have the proper simple
protection to actually make this work
now the way the anonymity actually pans
out is so strong that even if you vote
on multiple proposals you wouldn't even
be able to trace that behavior back to
the same human being so privacy is
extremely well preserved in this system
so this is where we are now but um
there's a couple things we would like to
do better
um one thing we need to do is right now
the public key gets added to the market
Tree on chain which costs about a
million gas which is completely not
feasible on ethereum mainnet where we
want to launch this thing
so the first thing we did is build
growth 16 proofs that aggregate multiple
insertions and create a batch insertion
operation
and basically turn the insert part of
the whole stack into a Seagate roll-up
thing so there's like a back-end server
a sequencer that creates these batches
and sends them
now um the second part where we could do
this is in the claim part which is
currently individual proofs 300K gas
probably good enough for now but we can
also help out there by allowing people
to deploy the apps that want to use it
to deploy their own sequencers have
proof aggregation going on and get that
cost of usage down as well which for
voting you want because you want
fees to participate in Dallas to be as
low as possible
there are things already get more
complicated because now we need to have
a recursive proof system the users
produce these proofs on their wallet and
then we want to batch them together
in lot 16 this is currently very hard so
one of the things we're working on right
now
is migrating the semaphore proof system
over to blonky2 and then have recursive
plonky2 proofs and then have a final
block 16
verifier of the plunky 2 proof that
turns it into a glott 16 proof that can
be very easily verified on chain so now
you have a proof system where you have
very fast proofs which belonging to
which blocky 2 allows you can recurse
those proofs and then in the end you can
turn it into a glot 16 proof and you get
all the benefits of the cheap
verification and the white support that
was 16 has really excited about that
thing
um what else is going on so another
thing um
another thing that's going on is we want
to sign up a billion people and right
now ethereum l2s simply don't have the
capacity to handle that we're also going
to sign up people with relatively low
balances we want this to be very
inclusive so assume the average user has
a 10 balance and wants to use that on an
L2 right now on ethereum that is like
five cents per transaction which is kind
of okay is but it's because of the bear
Market
um a year ago it was two dollars per
transaction so that's not good enough so
how can we fix this well there is a plan
on the roadmap already it is called dank
sharding and proto-dink sharding so
we're very actively involved in
in the client the development around
4844 the EIP that implements this we've
been helping out implementing The
Trusted setup ceremony that Carl
presented during the opening ceremony
and we're going to be helping out the
clients implementing the crypto there
just to get dank sharding in just so
that we can launch on an evm compatible
L2 and still have something our users
can use
um another area where cryptography comes
into the equation is right now the
neural network basically runs on trusted
Hardware but like you've heard in the
past two talks we can actually do better
than that zkml is feasible a year ago I
was experimenting with running a machine
learning small little Network in a
plonky two proof and I got
I managed to do 10 million parameters on
my laptop in less than a minute so
technology seemed like and that was
without any significant optimization so
presumably we can get much further than
this and this is good enough to do the
biometric stuff on your wallet now what
is the advantage there and how do we get
there in the first place like right now
if we update the neural network which
will happen a couple of times we would
need to ask all our users to go back to
the hardware
so that they can trustlessly create the
updated factors
If instead we turn the orb into an
authenticating camera like Jason
mentioned the orb will just sign
sign your raw data send it to your
wallet you can keep it on your wallet
self-custody you're in control and then
whenever we have a new version of the
neural network we can just push the
parameters to your phone and you can
just recompute the thing locally and
then send us a zero knowledge proof that
hey
I have this um I have this raw diametric
data it's authentic it's signed by an
orb and here is the updated embedding
and we can update it in the system
another cool area is um looking at NPCs
to get rid of this Central database and
make it a little bit more decentralized
we're not actively doing that actually
at the moment but we are actively
looking at is using mixnets or private
information retrieval to make sure that
when you query one of our servers for
example to help you generate the miracle
proof instead of downloading all the raw
data from the chain make sure that we
don't learn your IP address in the
process
um let's see what
uh yes one more application of the zkml
stuff longer term so right now what I've
described here is a way to do a scalable
privacy preserving proof of personhood
that we can deploy on ethereum mainnet
scales to a billion people and then can
be used on all the chains that we can
copy state to which is basically any
smart contract enabled blockchain out
there
um but proof of personnel is only the
beginning you would kind of soon as want
to do a little bit more like that you
would for example want to
make sure that someone is in a country
that your the app is legally allowed to
support I don't know um there will be
applications that require such things uh
how could we integrate that so one of
the things we were thinking of is
um we could have the orb also take an
authenticated image of your face
just like with the iOS image send that
authenticated image to your phone you
can scan your passports all modern
passports have signed data on it which
includes like this the stuff that is
basically on the front of this class but
your photo your date of birth your
nationality and so on
and what you can then do is use a zero
knowledge machine learning to verify
that the two phases are the same the one
that we know is you because of the orb
and the one that is on the passport
verified that those two are the same
verified that the passport is signed by
a key from some government
or like is in the list of non-government
root certificates basically and then you
can
you have a chain of trust establish
established and now you can fulfill
arbitrary queries like is the name in
the ofag list is the nationality in the
approval set you name it
um
yeah and I think that covers what we've
been doing so far
um in terms of applied ckp at worldcoin
and what we're planning to do in the
next couple of couple months years
probably
um and I'm opening the 420 questions
thank you and we have time for a couple
if if there are any questions
uh what stops me from stealing your eyes
ah yeah there's a very common
misconception about Biometrics people
think of them as sort of a private key
like if I somehow get access to your
fingerprints I can steal your accounts
doesn't work like that your fingerprints
are not secret you leave them on every
single glass on every restaurant you've
ever been to the thing that uniquely
identifies you is that you have that
fingerprint on a real life finger
so it's very important that you check
what is known as the liveness check that
you make sure that you the data you're
reading actually comes from a real live
human being and not from a printout or
whatever
um fingerprints are actually not that
good they're only unique up to a million
people we really need irises for that
irises have a couple more advantages you
don't leave them at restaurants it's
actually really hard to get someone's
Irish accurate accurately so it's it's
quite consensual the process like you
need to actively participate in order to
get a good capture of this information
cool and thank you for the talk can you
explain one more time the example of a
digital camera attesting to the data
prior to it being sent and how that gets
around the issue of your face changing
uh your face changing
yeah
having to redo it so we
um
so there's two parts where we do this
authenticated data game uh the first is
just to make the user experience of
updating the model better like instead
of having to go to The Trusted Hardware
again we can now trust you to do it
yourself correctly because of the zero
knowledge machine learning the second
example I gave is that well what if we
have a proof that this phase belongs to
this public key
and then we can create a chain of proofs
that oh we know that this public key
becoming so this this phase because the
orb signed to that fact then this phase
belongs to this passport because we have
a Serial knowledge proof that those
spaces are the same and then we can do
all sorts of further claims based on the
fact that we now know that this public
that this public key belongs to this
name
and all of that happens self-custody on
your wallet so none of this information
ever leaves your domain
foreign
thank you so much
um we're gonna well we're gonna cut for
a quick break so I guess we might as
well take one more quick question
going back to the question about
stealing people's eyeballs what's
stopping someone like uh let's say an
African warlord taking an orb and
scanning entire Villages eyeballs and
then taking their accounts
um I mean ultimately on the social level
uh this this problem applies to any any
kind of system like if you have a super
oppressive regime people can make you do
anything
um what we do about it is we're just
simply not going to those places uh
yeah we we our goal is to be as widely
distributed as possible and be
everywhere on Earth um we're not
specifically targeting in such areas we
are just as active in Europe and America
and you name it
uh yes it does a lot of liveness checks
um this is actually another interesting
discussion that we keep having is
the hardware is going to be open source
the firmware is going to be open source
all of this is open source except for
two parts that we're considering keeping
private which is like the exact nature
of the liveness check because
we're confident that they are very very
hard to circumvent but still everyone is
just better off if if we use Secrets
like security to obscurity here and the
same thing goes for the hardware
tampering like there's a bunch of booby
traps in there that prevent you from
taking out the signing key and also
there we uh
made the decision that security to
obscurity here is better it's it's one
of the unfortunate things you need to
deal with once you do try to connect
cryptography to the real world you need
to deal with the fact that the laws of
physics don't have a nice difficult and
handshake in them
okay