foreign
[Music]
welcome back so our next speaker is
Brian Wilkes and he'll be comparing the
performance and security characteristics
of some zero knowledge proofs that are
commonly deployed in the ethereum
ecosystem so Brian
hello wow that's loud so
who are my data scientists in the room
raise hands
very few devs devs out there lots of
devs nice investors d-gens
yes put it down
um how about expertise
um who's a beginner in zero knowledge
just got the basics
cool um who knows what's going on but
has not written a circuit before
true ZK expert knows a ton about ZK
you perfect all right
um well um thanks for having me my name
is Brian
um I am a grantee with the ethereum
foundation on privacy scaling
exploration team so
um today I'm going to be talking about
um ZK proof performance and security
characteristics so
um so what's in the docket for the day
search for me to go over some background
so we'll just give some background on
what zkps are I'm try and work through
what they actually mean for on-chain
data
then we're going to look at how to
actually find those um zero knowledge
proofs and verifiers on circuits on and
off chain
then we'll look at some of the
characteristics behind those and what
they mean
so unfortunately Waldo's not going to be
with us today so this is the second best
piece of art I've ever done so I hope
you appreciate it everyone so what are
zkps of our high level first we'll go
through this quick and then move on but
um we have Alice Alice wants a drink
she's a prover we have Bob Bob is the
bartender is a verifier
um Alice does not want to give all of
her information to Bob and so therefore
she can put in her birthday
the circuit will output a proof Bob can
verify that proof is correct that she is
old enough to drink and the cerveza will
flow so um what's important for this is
you have
approver
you have inputs you have the circuit
itself you have the proof popping out
and then Bob decides if it's true or
false and then does an action based on
whether that verification is true so
um why do we need zero knowledge proofs
in ethereum so the first thing that we
struggle with is scalability so
right now we can do about on main chain
13 transactions per second
um and we really need to get into that
13k transactions per second if not
significantly higher to get in the Visa
range so
um how is your knowledge proofs help us
that you can separate they can take
fully separate chains
um and they can impart the full security
of ethereum to those chains
so privacy as well um is something
that's a hotbed issue to me uh
ethereum's public if you're a data
scientist
um as a few of you are you can go online
or you can go on ethereum and see anyone
ever everyone ever does um so I don't
want to live in a world where you have
scalability and everything sits on that
platform without having the Privacy
behind it so let's talk about on chain
so this is what it looks like you have
your layer 2 blockchain here um so uh
they have the blocks going you aggregate
some of the transactions together
um and then you batch them into a ZK
circuit so you take those transactions
they go into the circuit the circuit
produces a proof this is all off chain
so then you have your ethereum main
chain on where things are expensive
um
so you're able to take your proof and
post that to the verifier smart contract
um and then the layer 2 State source of
Truth can get updated so that's what
happens with the scalability side of
things now let's talk privacy um it's
very similar I won't have reveals for
you I'll just go right to it there's a
secret there's the ZK circuit um you put
the secret through it produces a proof
and then that proof goes on chain to the
verifier smart contract and funds are
released so that's very similar that's
going to be your mixers your channel
caches different things
um
what's important for both of these two
is that you have
um off chain and on chain and on chain
is where the verifier in the proof gets
posted I mean off chain is with the
circuit and the proofs are
so this is the best piece of artwork
I've ever done so I appreciate it while
you can so let's find some ZK proofs on
chain and figure out where they're at so
um this is called the search for
verifiers so why are we searching for
verifiers
the important characteristics of a zero
knowledge proof are in the circuit so
the circuit is going to generate um
they're going to have the different
characteristics that are important to us
let's look at a particular DK sync um
transaction flow for instance so
between September 26th and September or
September 20th and September 26th there
were two thousand one hundred and
seventy one two thousand one hundred and
seventy blocks 265
000 transactions um which were batched
together into 214 inputs proofs brought
on chain so what you want the ZK circuit
did not change but those inputs and the
proofs did
um so
each circuit has a unique verifier on
chain so for each circuit or circuit
systems they have their own unique
verifier that's there and the um if you
want to know about circuits and you want
to use on-chain data you need to go
through the verifier
so going through the verifier
um you use the L1 on chain data um so
let's talk about how to find verifiers
so the first section is um if you guys
haven't used bigquery on from Google I
highly recommend it um it's a great tool
it allows you to search through lots
more data than things like Doom do as
much as I love Dune so
um different queries that time out
within 30 minutes for Dune will go in
about two seconds for bigquery so
um check it out
um the three tables that I used um for
this project were contracts traces and
transactions
since you're almost all devs I won't go
over traces versus transactions but
start versus end of things so okay
um so the first way to try and search
through bytecode um is to go for
constants constants will show up in byte
code as a big hex so if you can get a
big enough number that's unique enough
for what you're looking for you can take
that in search with very simple SQL
queries
um in through the byte code so this is
both a big and unique value it's the
finite field
um so the finite field is the range at
which you modulate over when you're
doing
different cryptography cryptographic
things for um knowledge so this is it in
HEX form um it's massive so the first
way that I look through the data was to
search for this finite field
unfortunately it didn't exactly give me
all the verifiers so it gave me a lot of
different noise there's 558 contracts on
that have the finite field constant um
and after checking every one of them
manually most of them are not verifiers
so I moved on to trying to get into
method IDs so the second tool that I
think is really important and apparently
it's new according to etherscan it is
the transaction decoder so the
transaction decoder
um what it does if you look through it
is if you go through and look at a
transaction it will tell you the exact
flow of what happened on through that
transaction so looking at this here is
another ZK sync example
um
first it proves the blocks
after going through some proxies and
then in the verifier contract it does it
calls a function called verify aggregate
block proof so after doing some modular
Edition down below it outputs true and
the state gets updated
so method IDs the method IDs are the
first 10 characters or four bytes that
come through with any input or
transaction call for traces or
transactions so just going through them
briefly
um you can see that this function here
is for startware um and it's a fry
verifier so this is what is actually
verifying the proofs um so if you want
to know what the method ID is for this
particular function here
then you take you take out all the chaff
if you will from inside and then you run
the kcac 256
and you take the first four bytes plus
the indicator that it's hex so that
there the ox
E85 A6 a28 is the method ID it'll be the
first 10 characters in any call that
when you look through the data so
um a great resource again
um I'd like to show the resources that I
get to use um the four byte.directory is
fantastic um you can input any method ID
and it will tell you what the um text
signature for what it should be is so
um now what do we find
essentially there's about 65 confirmed
verifiers on main chain now there's
probably a few more on maybe 30 more
that are not on verified public
contracts so
um in those 65 confirmed verifiers have
done
over 600 000 verifications
so um of those
there are about 16 that are active still
um that's active according to me and
some of them are very minor projects if
you're trying to squint it's because I
made it small so you'd have to go on the
GitHub at some point so sorry
um
I was surprised by how few verifiers
there are actually on main chain but
moving on to the characteristics so
we'll look at proving systems um so
you're proving systems here that are
actually being verified on main chain
um you have your your Classics I'm sure
you guys have all heard of these but
your growth 16 from 2016. um that runs
your tornado cash your Hermes your Loop
ring um in a bunch other uh different uh
privacy functions you have plonk um
which is asked to connect ZK sync um
then you have turbo plug which is the
original Aztec um Aztec connect uses
turbo Planck before it gets on chain but
then it uses Planck on chain if that
makes any sense then you have Halo 2
which is coming out zcash uses it um and
then also scroll is going to deploy with
it most people I talk to are really
moving towards that Halo 2
move it seems like it's a really good
proving system so um it's not on main
chain yet that I've seen so then you
have your Starks on and that includes
all your starboard projects
so Starks versus snarks
snarks the succinct non-interactive
argument of knowledge and that then
there's Starks which are scalable
transparent arguments of knowledge and
the major difference between the two
there's a bunch of them these are the
base level for what happens but Quantum
Computing is probably going to be able
to take down snarks or but Starks will
probably be resistant to it so what is
quantum Computing when will it come
I have no idea but um if it does this is
what will happen
so looking at these different
um proving systems you have graph 16
which is in blue
um really taking off that's on the back
of tornado cache as well as loopering
and then you have down below you have
your Stark um fries that are coming
through those are the starkware projects
um they have really taken off dydx posts
a lot of data to chain often and then
you have your plonks and unknowns are
probably blocks um but I didn't wasn't
quite confident enough to say that so
um okay let's talk about trusted setups
so a trusted setup is where on the
elliptic curve um you should evaluate
the different ZK proof so it's it's kind
of an agreement and a spot that um
approver and a verifier can done kind of
verify through
um what that snark's going to look like
so I'd like to think of it like a
trustful how many people have done trust
Falls before in their life a couple yeah
it's scary
um so you get up there on a big standing
and then you fall backwards and as long
as one strong person below you is there
to catch you then you should be good so
as long as the trusted setup is kind of
similar if everybody's toxic waste gets
collected together if everyone gives
their secret out
um it doesn't want to catch you or is
distracted then um the snark can be
um then the chest is set up
um will not work and someone will be
able to write proofs that will um
be false positives and they'll be able
to take money from you if that makes
sense so
um this requires one honest participant
from the mo from the MPC um ceremony
I also like to think of it like Thanos
um if you have enough Infinity Stones if
you have them all you can destroy the
proof and it'll be good so uh it's bad
actually
okay so um what are the trusted setups
um we have
um growth 16 over there on the end um it
has a two-phase trusted setup
um and then the universal setups came in
and that's Planck and turbo plunk and
that only requires one so whereas Roth
16 needs a new ZK circuit or needs a new
Pro needs a new entrusted ceremony for
the um each circuit that it produces
um Planck and turbo Planck have a
universal setup and that allows them to
only have one total ceremony so if
anyone here wanted to create a plonk you
could use the universal ceremony that's
already been created
um and already been done and then you
have Halo 2 and Starks um they do not
require trusted setups so that's
obviously you want the least amount of
trusted setups as you can
so moving on on the actual projects
themselves you have
um graph 16s are Loop ring polygon
Hermes their withdrawal and then tornado
cash um those are the major ones that
are currently being in operation so the
number these are trusted setups they use
the Perpetual powers of Tau um which is
um basically an on-chain on step one for
the different uh trusted setups then
they had a step two that step two these
are the number of participants that were
in those ceremonies so if you can get to
16 people from the loop ring that did it
if they all compromised then that will
not be a valid just the setup and then
those funds will be able to be taken so
um you have 16 for Loop ring you have
six participants in the polygon hermesis
then um tornado cache had a whopping
1114.
um moving on to plaques um so like I
said there's you only need one trusted
setup ceremony to be correct and then
anyone can use it so they're all using
the Aztec clock Universal setup um it is
all these you can see asset stations um
on GitHub to see how they worked but
they had 176 participants on in that so
that's all your your ZK sync your ZK
space as to connect Aztec Tom all the
way down the line but then you have your
Starks
um which do not have
um any trusted setups
um we'll start by recursion this is the
other major thing that um people are
looking for for performance so as you go
through performance a recursion is the
ability to take you know a big
computation and break it up into a bunch
of little ones into them um together and
then recursively proof back to the firm
back to the top so
um what this allows you to do is
parallelization of proof generation so
you can decentralize and have a bunch of
provers doing this in parallel um
so get out your Asics because you just
got rid of them for the merge but uh and
then it also lets you do proof chaining
um so you can have the output of one
proof be the input for the next proof
um so what provides recursion pretty
much everything but graph 16 is now
doing recursion and they're doing it in
better ways I guess as you move forward
so
um that was the other the why would
anyone use graph 16 if you can't do
recursion and you have a big trusted
setup you it's faster
um and there's it's cheaper to verify so
it's the OG it's been there for a long
time um but people are moving on because
of those two problems mostly
so now I guess we can talk about my
favorite topic which is data
availability as a data scientist
um so uh we'll talk this is going to be
about l1s and l2s so for um for the
purists out there l2s would only be
Roll-Ups but I'll use both back and
forth so Zeke validiums validiums um
they have their state route is on the
bridge contract um and then they have
their state reconstruction that's off
chain it goes through a data
availability committee to go on chain to
be able to make it so you have that data
but it is permissioned on that side of
things then the alternative
which is in supposed to be gold it kind
of looks like bronze so forget that um
is you have your state reconstruction
and your state route
um for the ZK Roll-Ups
um down on the bridge roll up or down on
the bridge contract so that allows you
to
um always have that data to be able to
generate a proof um in case you need to
escape so
um why would you do oblidium over a
roll-up it's many more transactions per
second so your imxs and your different
Stark X projects are able to be a lot
cheaper um so moving forward
um let's look at your validiums that are
currently operating you have Stark X
which is on immutable X
um you have rindify so rare Apex um
other ones that are coming out you have
um ziki Porter almost coming out from ZK
sync
um and then your roll ups I'll run
through these because you guys probably
all know them but
um you have to idx
Loop ring
ZK sync V1 usdk space
um starknet
so
I'll pause for the camera
then moving on there's a couple more
that are um the newer ones that are
coming up for Roll-Ups that are exciting
um you have ZK sync V2
um which I think is under 30 days now
which is exciting to mainnet
um you have scroll
um which is going for a higher level of
evm compatibility
um and then uh let's see what's next
then you have all of polygons projects
um which are all exciting in their own
right so
um let's talk about what it means to be
a roll-up so everyone talks constantly
about how the full security of ethereum
is being inherited by these Roll-Ups so
what does it mean to have the full
security of ethereum
you need to have the right to be able to
force exit from that chain so if you
have on your Layer Two if they have um
decide to be against you you need to be
able to submit your transactions
directly on layer one to the ethereum
bridge contract and get your funds so
right now you have your happy user down
here
um that's from Walmart it's kind of
creepy actually the more you look at it
so don't stare at it too long um but the
transaction goes to this uh the happy
sequencers here they put the transaction
into the layer two those transactions
are batched on into the ZK circuit it
produces the proof and it goes to the
ethereum bridge contract as as we talked
about before so
um this is how it's supposed to function
so let's say that the sequencers become
evil and start smoking cigars
um you get unhappy
so your transactions can't make it to
Layer Two and your funds are frozen so
what do you do
you take your
transaction and you go directly onto
layer one to the bridge contract so when
you take your layer to transaction go
directly to it then the validators have
a certain amount of time to actually
include your transaction on into the
layer twos so usually it's between 7 and
14 days so if they don't do it within
that amount of time then Hell Freezes
Over and um the chain freezes so your
layer 2 cannot update State on layer one
and the serial knowledge circuit um then
you as a user can produce a proof from
the circuit then that proof will provide
you the ability to get your funds back
um so that sounds great but it's also
kind of difficult how does the average
user especially when these proofs are
off chain
um in usually sometimes proprietary how
do you generate that proof um that's one
of there's a few things that you have to
really do to inherit full ethereum
security so let's go through them
to have the available data on layer one
so if you don't have that available data
then you can't reconstruct the state
proof and therefore you won't be able to
properly get your funds back from the L1
contract
um secondly you need to have functional
and accessible Force exits so
those Force exits have to be in code and
they have to be accessible for the
average person they need to be able to
generate those proofs they need to be
able to take that data um and Pull and
directly send it to that L1 contract um
that for a lot of devs it's not a big
deal that
um there's the the front ends are all
centralized but we need decentralized
front ends to allow people to escape
um in the case of one of the sequencers
um going evil so then thirdly you need
time delays for the L1 contracts so
if the layer 1 contracts aren't have
time delays or if they're immutable
um then it gives people the chance to
actually exit from that later one but if
they don't have time delays then they
can just change the contract and
everyone's funds will be frozen from
there so
um and then late then last is um this is
a nuanced one but the the amount of
money that you can secure from L1 is
really based upon the amount of locked
funds on layer one so if if everyone
Force exits then the layer one contract
which is the bridge contract with all
the assets
um they will impart all their assets to
the people but if there's more total
locked value above on Layer Two then
somebody's going to be out of luck so
the best way to think about this is a
lot of the l2s are starting to get
traction with direct transfers to them
um they might even have their own state
from different contracts and Native
tokens
if you have a native token on an L2 and
you don't have assets backing it up on
the layer 1 Bridge contract then the
ability for you to inherit ethereum
security and take your assets off um
isn't there so it's really important
that um as we move forward that any
state that is native to the L2 is um is
known as for that risk that it has so
now
um let's get in I guess this is the end
of my talk so I'm going to try and
implore you to get into the data
directly um don't be like Waldo
um and be sad because other people tell
you what's true and what's not um so we
have
um I I tell you I I'm very impressed
with these projects I think you guys
should all check them out they're all
open you have bigquery you have Dune
um the dunes getting better and better
um and then the bigqueries of public
database that has all the ethereum layer
one posted there they'll give you 300
credits to go on query through it um and
you can really differentiate yourself
especially as a data scientist um
you have
that the project that I actually
completed um please check it out on just
the QR code for it I'll have it at the
end too so obviously miss it it's no big
deal but
um please go check out the data tables
all the SQL queries on any of the
different things
um please uh feel free to let me know
what I screwed up and it'll be good
um and then L2 beat is just such a great
resource I'm sure everyone's heard of
them and I'm sure you've been to their
Booth yesterday but
um they categorize all a lot of risks
and a lot of specific things happening
within these different projects and I
just can't recommend them enough to
check them out they're doing Bridges now
too which is exciting um and then the
layer twos um I haven't got to the data
on layer twos so I I it would be really
great for everyone to check out the
different we're going to a different
layer modular blockchain where you have
layer ones layer twos and layer threes
and these layer threes are going to be
deployed on layer twos in the Privacy
things already are for like semaphore so
um I highly recommend that I really like
to see somebody on check out layer twos
and be able to do the same data type
projects for that so
um I have some thank yous I'd like to
get get ahead of
um so I'd like to thank the daily
Discord Channel and and podcast for
being so great um that's my favorite
Discord Channel there is um if you need
stud to know things there's so many
helpful people
um
there's the zero knowledge podcast
um it's so good for all the new pressing
things I highly recommend them as well
um l2b I'll show them again
and then on the ethereum on Foundation
privacy scaling exploration team
um that's not their symbol but I think
that there's their new logo for Defcon
is really cool so I put it up there and
then I'd like to thank Justin Martin um
for all of his help and getting me into
this um and I'd also like to thank Mark
for all your help getting me through
this stuff and really brainstorming
through it all and I'm trying to get
through all those issues so wow so I got
thank you very much
uh
I will take quite yes please
I'm sure yeah they'll have a mic for you
unless you're really loud and then you
can just go for it
I was wondering if you comment a little
bit more on the security considerations
when dealing with Native assets on l2s
like I get that you can't withdraw the
funds on the other one but can you
double spend or can eat out there like
Forge a balance or things like that
given the stage rolled up no I you know
I I don't think that those are concerns
um to do double spends and things but I
do think
um because your state is the state
source of Truth is really sitting on
layer one so
um you're not going to be able to uh one
of the reasons they do some of the
delays and things I believe is to stop
double spend from happening um but the
um and that's why they freeze the state
route on layer once
um but I I don't think that um yeah if
you understand I won't go back over the
ideas of but if you have tokens that are
here
um and the values more are there than on
the bridge contract then you won't be
able to get your money back off of there
so if it makes sense
hello so when you're talking about State
on layer one have you had any thoughts
in regards to uh upcoming State expiry
not yet but I I would love that I'd love
to hear your thoughts on at some point
I'm kind of practical on the side of
things as far as what that should look
like and what colorful even yeah please
go ahead sorry
um yeah I don't have any particular
thoughts just that I think current plans
are to expire estate after a year or so
yeah
um you know some other way to get the
state I my understanding is there will
be I mean zero knowledge proofs that
we'll be able to construct that and
prove that that's true um but then
you'll also have
um so you're kind of using the same
different different technology but I'm
not going to speak to you about a turn
on what I don't know it's not about it's
a great question though
um I'll definitely I can look into it
and get in touch with you about it