[Music]
hello everybody
um we need fast
proving at the beginning was we need
proof we need to generate proofs at some
point we need to generate cheap proof
this was the beginning of the zkm but
what we are seeing now is that no proof
are would say it's cheap enough
especially if you are doing a rollup and
you have a transaction but we need to
proof them fast why we need fast
proofs I would say for many reasons
uh the the reasons I mean in polygon for
example we need it very much for the ACT
layer when you when you want to transfer
funds from one chain to another chain U
two things needs to happen first you
need to one chain needs to commit to one
state so that the other chain can use
the fonts of the first chain and the
other thing is that the second chain
needs to be sure that this state is
correct okay so it has two options the
first thing is that the second chain
just follows that chain and then warant
is that this this this state is correct
or the other option is that the chain a
provides uh zero knowledge proof that uh
his state is correct in the first case
well it works well maybe if you have two
networks but if you have hundreds or
thousands of networks that are appearing
or disappearing every time it does not
scale well I mean you cannot ask all the
all the all the all the validators of
all the chains to run a validator of all
the other chains that are in the
aggregation space so the way to the way
to uh U scale that is by having a zero
knowledge proof that uh warrant is at
state is valid this is um um and then
but then this means that the user when
he's doing some interchain communication
uh in the user in the user interaction I
mean in the user in the ux you will need
this uh you need to Wi for this time
okay so and uh so we need to generate
these proofs as fast as you want other
context I mean yesterday in uh in the
presentation of The Bean chain was a ZK
uh chain so that means that in in this
context you need a lot of places like
clients needs to validate so needs to
prove that the the full execution chain
it's another case that's important so in
many cases this chain uh so generating
fast proof is important so how fast can
we go and I want to present here so an
internal project that we have been
working for uh the last five six months
uh inside ethereum we call it internally
zisk and is very much about that is how
much we can push the proving system zis
is also based U it's a system that can
uh prove u i mean you can build a pro
programming rust it's a r five uh
compiler is a r 564 bits it's a little
bit different from other projects but
the full idea of this project is how
fast can we uh can we move how short how
fast can we generate this proof this
actually are this three different I
would say three different pieces or
three different projects itself one is
the pr itself Pro is a generic Pro so
the idea is that you can build uh your
own Pro that can proves anything which
say It's Kind the hardware layer you you
we have the pill two pill two is based
on um pill two is based on um the pill
one language that we use in the zbm and
allows you to do an arithmetization and
way we extended a lot of the a lot uh of
the we extended a lot the pill to
language the the pill to language uh I
mean making them more easy for auditing
uh this arithmetization and mainly
including um one thing that's called
vcops that mainly means that instead of
having uh monolithic proof we can divide
the proof in sub proofs this is very
important because then we can paralyze
very well so we have a proof we divide
the work in different sub proofs and
then we aggregate them together this is
the main idea of how we can accelerate
uh uh the things okay so the the pro I
mean it's a generic Pro so how it would
work okay this is the process that if
you want to build a any proof it can be
from a fibon serious if it's the kind of
a Hello World until uh I mean a VM
project that's in there or maybe some
whatever you want to build mainly you
need to build two things so you need to
build armatization the aration is in
this um in the in this uh so we just
write the pill so is are in meditation
itself you need to write what we call
the windows computation this is at the
end is filling it's a program that's
actually filling um the trace of this
and that's very much and with that you
already have a so with this um well you
compile the pill okay so you get a kind
of a pill out format you get the rust
you compile uh a library I mean you get
a a dynamic Library okay from the pill
you get some helpers so that allows you
to build this Windows computation easily
okay and then here we just run a normal
setup Pro setup here the setup is the
configuration of the pr itself some
Starks configuration that's just a
configuration file here we generate a
normal approving key and a and a
verification key and then we have the
normal thing we have a approver for the
approver have an interface that you get
an input and this Pro generates the
proof and the public uh uh and the
public outputs and you can take the
proof and the public outputs and verify
and the verify you see that's got it
here okay so this is the so this is
would be the schema that would that
would work okay um thing is that this
Pro is generic I mean you don't need to
recompile the pr it's just a u just a
program that's running there but can be
a program can be a service uh can be I
mean um
this PR and this program can have like
different versions I mean it can be in
GP GPU in I mean you can it doesn't
change I mean you can have it's a
generic for any the co the idea is that
it's generic for any for any
circuit this program is I mean is is U
it's open source um and is uh everything
is designed to minimize the latency okay
we will see later uh the different
things on related to that okay so and
then uh um let me just go back so
um this would be the prer okay but on
top of the prer we have a specific
circuit so it's a just just one uh so we
are using it's like a so the specific
circuit using p 21 that's implemented in
P 21 we can use the pro that's actually
this um uh this dis is this uh let's say
RIS five emulator kind of actually is
not I would not call it an emulator it's
a ZK processor the thing the only thing
is that uh there is a direct conversion
between R 5 or even wasam or other or or
llbm to this ZK processor it's a
processor that has only about uh 50
polinomial so it's very very lightweight
uh processor and really fast and and
really fast processor okay so um and
then it works very much like any other
VM in there so you can build a program
so you you build the the circuit in in a
normal program of course you can test
your circuit at the end it's a
deterministic program so you compile the
the the circuit you get a program and
then you have an input and an output
it's a deterministic program that
generates the circuit once you have that
that's the only thing you need you can
take this program you can generate mean
you can compile using rust and some
setup and then you get a kind of a ROM
or if you want a you know an elf kind of
a program
itself um and then uh you can use the
Pro I mean the pro that we saw before of
course here the the the zis the private
key the the verification key is already
is already done because this is a an a
specific application a specific circuit
for the prover but the prover is exactly
the same and then of course you have an
input uh a proof and output and the
verifier the only thing is that the
input includes the the private private
input and and the ROM so you can prove
any any program that you want and of
course in the verifier you can you can
use the ROM has so you you can use the
fire
itself okay so let's go deep in how uh
this I mean how how the architecture I
mean how this um uh circuit works well
as I told you before this circuit uh is
based on uh vops actually is many there
are many sub proofs each this Su prooof
there are different kinds and this this
works very much like a normal processor
we have like a a main processor with a
program with a ROM and then we have a
ram we have a arithmetic operations we
have a lot of co-processors um uh that
can be connected here okay uh so each
one of these is one some proof and
actually you can have for example
arithmetic if you have a lot of
arithmetic operations you can have a lot
of sub circuits and all them add them to
the bus and they connect them together
this bus I mean is not an electronic bus
but there something would say similar
it's more an algebraic boss but this um
we are using here lock ups and here the
idea is you can have Su proof so you can
have the main processor you have the
arithmetic processor each one is like
sending things to the BS and the main
processor says okay I'm assuming that
this arithmetic operation is correct
okay and then there is the arithmetic
coprocessor that's saying I'm
guaranteeing that this arithmetic
operation with these values is correct
okay so the full system is correct so
one is adding to the BS the other is
substracting to the boss and at the end
the boss means zero if if everything is
uh uh warranted and the cool thing is
that I mean in this boss I can add
arithmetic operations I can add memory
instructions I can add whatever you
whatever you want we can have we have a
kind of identifier but with the same
polinomial we are just adding and
substracting different things all all
together okay you see the
arithmetization I'm not going to go in
detail on the arithmetization but I give
you the the big idea I mean um the
processor is not based in registers
registers in ZK I are relatively
expensive mainly because in one
instruction you are using in general one
or two registers so that means that
there is like if you have 32 registers
you may have like 30 30 columns that you
are not even using in that line so doing
registers in ZK is quite suboptimal so
the main idea here is okay we have like
so in each so in each instruction what
we do is we go directly to memory we are
doing two access to memory we are
reading to things and we are storing
back to the story back to the memory and
in this and this so this is the the the
main idea okay so we have only we have
only one one register actually we have a
couple of registers a program counter a
kind of a frame pointer or stack pointer
um in there we have this main so this
main instruction that can be any
instruction there so we have a way this
is a way to load the first register load
second registers I mean you can load
from memory or you can load maybe from
an immediate value or other um uh things
maybe you can take just the prev see and
things like that okay um we um we store
the memory we gener we store to the
memory we can also for example store to
a program counter so we can do a dynamic
jump in there okay and the we have the
operations the operations at the end is
just throw into the boss the operation
that you want to build so the the the
main St machine is quite uh simple in
there and then we have some um
conditional jumps uh somehow I mean this
this logic there at the end we are just
so the operations is a plus b equals c
maybe with aari or with a some flag that
you where you can do a jump to one line
of cod or a different line of cod so
this is very a little bit the the the
the deepness the big idea of the FK
itself okay and as I told you this goes
through this through this bus okay and
one of the advantages and I want to see
here I won't give you details about the
why uh this architecture is very optimal
for example when you have an um a
multiplication so the six processor is
sending that and uh the arithmetic is
also somehow proving that specific
operation in there okay so you can have
this arithmetic operation but one thing
one optimization that we can do is okay
for example imagine there are a lot of
uh operations that are uh usual when I'm
doing for example 1+ 1 or uh 3 + 1 I
mean I'm doing the small numbers I'm
going to do a lot of them in the in the
processor so instead of proving all of
them in the processor I can have um
another steam machine that's kind of a
cash where I have precomputed operations
that are used quite often and then so so
the processor it's always it's it's
sending the same thing but then these uh
basic operations can be sended can be
proven back to the bus so that means
that for these small operations or for
these usual operations the cost I mean
the number of cells that we are doing
are uh very low okay can extend this
idea so we can have this processor
imagine that I have a operations I can
have a usual operations table I can have
operations that are doing so a specific
stain machine that's doing 32 bits
operations and another stain machine
that are doing 64 uh stain machines
operations just to save here just to
save uh space
okay this idea for works for example for
memory for the memory memory alignment I
mean what I'm doing in general most of
the process are doing uh reads and bries
that are aligned well no problem the the
processor is doing some memory operation
and the memory that just works in in 64
bits 64 bits uh words then you're doing
a read aligned read you get it from the
memory aligned read you get it from the
memory but what happen when you are
reading an an align it well we can have
a special St machine that's solving
these un aligning things and actually is
okay so you want a non-aligned operation
this is solve so the the arrow to the
bus means adding to the bus the the
other arrow that goes in the other way
subtract to the BS so okay I'm proving
this but in order to prove this I need
to do two R operations and of course
some Logic for check I mean for putting
these two two reads in the same in the
same one and then of course the same
memory machine is doing these uh two
reads in there this allows us to do this
kind of techniques it allows us to do
for example continuations in a very easy
way way so if I have a processor I mean
I have a I can I can I I can divide the
execution in different different slots
in different different phes okay so it
this the first 100 clocks second 100
clocks and so on so I I can I can't
divide them but at the end of the
processor so I need to connect I mean
the the next slot needs to have the same
state that when I finish well what I can
do is just send this uh state to the bus
uh and recover this state from the bus
and then connecting all them together
okay the final one the first one this is
because it's cyclic I mean z in general
we wor cyclic and then disconnects the
same with uh continuations in the ram
continuations in the ram of course is
not time frame in the ram you want more
address uh face but so I can divide the
proof of the ram that can be big in
smaller pieces and but the idea is the
same I have an State transition function
that goes line by line but uh from the
one Chun to the next Chun I I can um
send this the state of the run to the
bus recover the state of the run to the
bus the last the last address that you
are reading or writing and then you can
continue so we can split also for
example the ram in there so this allows
us to divide all the work I mean there
is no big state there is no State
machine that you need a big thing so you
can divide always the work uh in
everything okay here I as I mentioned um
this there is a direct conversion this
is important direct conversion that
means that you can use Ras or or any
other Pro or any other compiling
language is 64 bits you can use goang or
you can use C++ or you can use uh uh
even Java I mean there is a so um um uh
this 5 64 bits is is quite a standard uh
in there and as I told you there is one
um direct conversion one to one from uh
risk uh uh from risk to thisk we also Al
have a kind of a side project that we
are um evaluating converting from wasam
to CIS and even directly from LM to CIS
this is particularly possible and it can
be quite optimal because when you go to
intermediate code U you don't need these
registers and then you can uh have
better code in the processor but in
general um the cost of the
proof um of course the processor is
important but I would say that the
operations that are doing the processor
are even more important in general so
also the the mean the
well it's not that you are optimizing
the processor and then you get a better
proof you need it's the whole thing that
you need to
optimize okay um well this Advantage we
already talk most of them okay it's low
latency low latency low latency and uh
yeah we integrate with the recursor we
didn't talk about the recursor but the
recursor is the idea is that you can
take the the any proof and then you can
uh build kind of automatically uh uh a
proof that uh Aggregates both proof for
example if you are proving two blocks uh
of ethereum you can get a a proof that
actually Aggregates this proof okay and
we have this recursor that's a tooling
that allows you to do that automatically
uh uh on this okay so latency how we uh
push hard on the latency actually there
is four pieces I have not much time but
I'm going to try to go fast the first
one is the one that you cannot paralyze
okay it's like okay if I want to prove a
computation I need to compute that thing
okay so I cannot paralyze that
computation very much okay uh and also
if we are emulating for example 5 I do
an emulation so here I can go as slow
but we are trying this to go as fast as
we can currently we are at 80 mahz so we
can run a processor running let's say
the minimum Trace that you need then to
generate the winess
computation uh we can go I think that
there is margin here for at least one
order of magnitude Improvement then we
have the winess computation the windows
computation this is already done in
parallel so this can be paralyzed Um
this can be paralyzed um uh very much
and you can even start building this
Windows computation while while you are
executing that also the windows
computation the idea is that we're doing
that work in the worker we are not have
like a central Pro we can do that in the
worker that means that here we limit a
lot the the the bandwidth so we have one
bandwidth we don't have bandwidth
requirements it's minimal the quantity
of information that goes from the uh uh
between the the workers or a central I
mean the coordinator and the and the
workers okay then we have the Su proof
building actually this is the high work
but the cool thing is that because we
can we can we we have control of what's
the sides of the sub proof then uh it's
just a matter of putting more subs of
course if they are cheaper and faster
you will need less sus if are slower you
will need more and that's very much a
matter of a cost but not a matter of a
latency because we can control very much
this uh proving this proving time okay
and then the other last is okay then we
need to aggregate okay this is probably
cently where we have the bottleneck but
uh I mean the good news is that we are
getting much much much better and uh
this number 10 seconds we already get
lower to that here as mentioned plony 2
has very good circuit for there and
optimizing this ation circuit is uh
super is super important okay there is a
talk think I think in 1 hour or so I
think it's in this room that will give
more details on this U uh uh
optimization parallelization all the
proofs that I mean all the proof we are
been running in a super computer and
doing experiments and see that all these
numbers get very very good and this
scales uh very well okay future plans
lot of things to do a lot of things in
the bck a lot of optimizations that uh
we want to implement
and uh you can try it it's working right
now we have a basic thing it's working
the last time that I said that in the in
the in in a in a scenario somebody
created a tornado cash and was inter a
nightmare but but but just this is work
in progress okay so I would say at this
point is the status that it's working
requires some refactors of some pizzas
some cleanups some documentations and we
hope that let's see if in the coming
weeks
everything looks nicer and uh we want to
build the it has no PR compiles I mean
know these estate machines are limited
but you can build any program and you
can prove any program for these uh pre
compil so for these specialized uh State
machines we we we wait uh I mean take
maybe uh two three months still to to to
to complete okay and that's very much my
presentation enjoy
it thank you very much let's go through
some questions so what issues did you
run into using risk V 64 that risk V 32
wouldn't
have I mean well these are we have been
checking what's better what's worst here
there are uh I mean there are pros and
cons I would say that the big the big
Pros is that when you are doing
especially when you are running rust you
are doing a lot of M copies I mean you
are moving a lot of uh memory
information and when you are using 64
bits this is much much much more optimal
I would say this is one of the things
that that we saw that there is a lot of
uh copies uh in uh moving back and forth
uh uh in a place and because uh also the
the the corrent kurrent uh I mean
current systems are 64 bits so
everything is much more standard for
example if you want to build I mean if
you want to use rust is 32 bits is okay
but if you want to do go for example you
cannot do it in 32 bits so you can do in
64 so 64 is also much more standard and
but again the the different test that we
did is that
we're slightly better doing in 64 in 64
bits so that's why we stick it at 64
beats and how will this be different
than sp1 risk
zero uh well uh uh we need we still need
to do some benchmarks and compare but uh
here the thing is that we are designing
not for cost I mean that we are here we
are going to push uh as hard as we as
hard as we can in uh in doing the speeds
uh as fast as as as as fast as uh we can
so it's difficult it's difficult to
compare it's difficult to compare yet
also we have some um this uh machines
that these special State machines that
needs to be finaly but uh I mean the
numbers that we have seen is that we are
much faster especially in CPU uh we are
working very much in the GPU and the the
numbers are quite promising but again I
don't like to talk yet about the numbers
because it probably would not be fair
and and and uh things needs to be more
um seted uh I would probably both sides
to start getting some real comparations
from a developer experience point of
view what does the developer need to do
to incode the chain rules into zis just
write a Ras code I mean just just write
a program that do do the whatever rules
that's in there uh just a side note here
is take care on the security of that is
um um
when you are proving when you're getting
some input and getting some output the
input uh you can you can still have
soundness problems if you are not
writing the right way so you need to
understand a little bit how the things
work even if you're writing a
programming rust because there are some
security issues that can happen there
but yeah at the end is but at the end is
writing a rasco and are there any
drawbacks that come with
cisk I mentioned this security things
that uh but this is common in anym okay
you need to you still need to understand
a little bit what behind but uh it's
much more practical and it's I mean it's
it's much easier to to to write a Ras
code and out it on a Ras code that not
an assembly written in some specific
special processor
there don't all these improvements by
build built specific Hardware are they
better than making optimizations on VMS
I think that's what that
says maybe uh if they do uh we will we
will we will we will uh Implement them
but they are not hard to build this
Hardware I mean this is not like a uh
real Hardware that you need to build
like uh machine machinery and this is
just a program and electronics you need
to have them the right way and once you
have it you're they already there I
don't know what these mean so maybe you
could read them out if they make any
sense to
you um yeah this is um I we would
probably need the the context but this
is at the end is uh is the position of
the this is the position of the
registers because we are emulating
registers in RIS 5 so we are setting a
specific positions in the memory that
actually are the registers and this is
just defining the this is just defining
the constants that defines the the
registers in in there there question in
there yeah that's very much the the
thing I mean I can't we can give you the
tail I mean there is on that but that's
yeah that's the developer needs to write
uh P do not at all not at all unless you
want to build maybe some specific State
uh some specific uh State machines I
mean some co-processors or things like
that that then you can extend that way
but the idea is that the the final
process the final person that's writing
in Ras just write in Ras and that's it
great give a hand uh for Jordy BINA