foreign
[Music]
yeah so I'm going to be talking about
the kzg ceremony or how I learned to
stop worrying and love trusted setups so
five months ago I think I wasn't the
only one who stopped using the chain or
started using it very sporadically
and the the demand is just way way
outstrips the supply of block space
and this is this is not a future we can
continue on into for ethereum so we need
to greatly change how we're doing things
to scale our capabilities the l2s are
the promise way of doing this
um for your multiple years now we've
been hearing about the roll-up Centric
design and how l2s aren't going to
provide us with what we need
but l2s are only part of
what's required scale incomes in sort of
two variants for ethereum there is
scaling compute
l2s take us from what ethereum is right
now which is effectively a single
threaded very slow computer to a
massively multi-threaded much faster
processor
the problem is is that l2s on their own
don't have a way of storing this data
enter
proto-dunk sharding also known as
eip4844 and the idea behind here is that
we enable
incredible amounts of data for these l2s
to use and just for them such that they
can
provide if they're providing the compute
here's the storage to match that and
scale ethereum up to to what we need so
what does this protodank sharding look
like we have these Notions of blobs it's
some arbitrary data from the protocol's
perspective we don't really care what it
is but to the roll ups it's basically
going to be compressed transactions and
then we use this device called the kzg
commitment to compress down this data
and Only Store a small reference to it
on chain then once the block proposer
has proposed this data the validators
there in the bottom check that this data
is available they check that they have
access to it and that the network has
propagated this and if so they vote that
they've seen this data and biscuits also
put on the blockchain so from the
blockchain's perspective we know that
this data was around there was an
opportunity at some point for all the
Roll-Ups and roll-up users to download
the data that they care about the
validators then save the data locally to
their own disks
and this this gets stored but this has
the problem which ethereum has right now
which is where we're storing incredible
amounts of data again and the idea
behind Bank charting is that we're
scaling This Way Beyond ethereum's
current capabilities which would mean
for the people who are already
struggling to run their their nodes this
would be unacceptable
so the final step in this is uh two
weeks later
we throw away the data
so it's not that we promise to keep this
data around forever that's not what
protodank shotting guarantees protagon
dank shotting guarantees that at some
point in the past
this data was available for people to
download and should they have wanted to
done that to have done this they could
it is then on the Roll-Ups on the users
to store the data they're interested in
so if you're interested in certain
transactions you could store just your
transactions roll up sequences could
store well we'll be storing everything
but it's just no longer the Chain's
responsibility to store this you can put
a host on ipfs it doesn't really matter
just that validators no longer need to
store this so effectively they have this
sliding window of the past two weeks of
state that they need to look after some
may ask why kzg
there's a very full table I'm not
expecting you to take all of it in
um
the current solution we use for these
kinds of commitments on chains are the
are Merkle trees but as you can see
there's lots of red on the Merkel that
the Char Merkel tree column on the left
there
um what and what we really care about is
this Top Line right if we're trying to
enable
um
if we're trying to enable Roll-Ups and
l2s lots of them are ZK EVMS or ZK
Roll-Ups and they care about being able
to prove things about this data inside
the roll up and as you can see from this
Top Line if we stick to our current
mechanisms it's quite literally not
possible
the only realistic or other alternative
would be ipas but there are several
other trade-offs that they make
so kcg is a very promising looking thing
but it has this one big red negative as
you see over there and that's this
trusted setup and that's what I'm
speaking to you about today trusted
setups thus I hope should make everyone
a little bit nervous trust is not a
thing we try have in the system is trust
but verify so ideally you shouldn't need
to do this I'd like to be able to
convince you today that in this case
this is something you should be able to
trust and that you can verify lots of
things about it so the idea is that
collectively as an ethereum community
and hopefully including many of those
outside of our community we're going to
summon a secret
there's not a single person entity
doesn't matter what scale that will be
able to know what the secret is
but together we will have generated this
it runs on a so-called one of Interest
assumption
the idea here is that we need one person
not to have actively been malicious it's
not that we need one person to be good
it's we need one person not to be bad
and to actively like pull apart the code
and try to figure out how they could
corrupt this and that kind of thing we
just need one person not to have done
that
um
so what is this what does this look like
um the ceremony is going to be written
by people people make mistakes so there
will be bugs this is part of the plan so
we have multiple implementations that
people can use you can write your own
implementation the idea being that even
if there is a bug in one of the
implementations there are still a lot of
a lot of contributions that people have
made by the other implementations that
keep us safe there will be malicious
people in the blockchain setting it's
very adversarial
theoretically if you could collect all
of these secrets that people contributed
it would be worth a lot of money because
you could do a lot of bad things so in
some sense there's some value behind
this not really because you really need
to get all of them having one short is
not enough but there will be some people
who will try to be malicious and try
spreadfad so we lose a few more of these
contributions but the idea is is that
there'll still be many contributions
which won't have this problem and by
many contributions I really mean a great
scale like that's not even close
not even this is my sort of lower bound
goal for the number of people I'd like
to contribute this is 8192 contributions
um
this graph is something I personally
care about it's a bit silly but
hopefully this ceremony we're running
will be the first ceremony ever where
they are more participants than we have
powers so normally you have these very
big hard to run ceremonies and one or
two people contributing here we have a
ceremony with that's very easy to run
and we have
ideally tens of thousands of people
getting involved ensuring the security
of of all of this making sure that those
candles stay lit so a lot of this came
to the design decisions of the ceremony
um it's designed to be quick and easy
for
everyone here at no matter what your
level of
technical skills there is an easy option
which is there's a website you can go to
click contribute and it'll walk you
through it in about five minutes very
easy to run on your computer if you want
to write your own implementation
the specifications have been kept to an
absolute minimum even at the cost of
some efficiency of the setup just to
ensure that it's very easy to do
um and then in other ways we've just
tried to keep the ceremony as as minimal
as possible
there's also the idea of the ceremony is
updatable which will mean something to
the cryptographers but for us is that in
uh 10 years or so when our communities
progress when hopefully I'm less
relevant to the protocol because we're
less capturable and we've grown further
um and we've adopted many more people
that we can add to the previous ceremony
build upon it
um to update it such that we'll have
even more people uh keeping those
candles alive so how does it work that
sounds like some big scary math but in
reality it's not
so the idea is that each individual
generates a secret and they mix in their
secrets with everyone else so in this
example the first person mixes in the
number three into like the overall
Secret
the second person adds the number five
to the secret and then the third person
multiplies the number two in so the idea
is that this this brown colored 30 is
the mix of all the colors slash all the
secrets from the various people that
came before
and that it represents all these these
these secrets and these people generated
these numbers randomly but there's a
problem with this and that's that as it
stands here anyone can read this right
it's just a number 30 that's not a great
secret so you need to encrypt these and
we encrypt these by
um quote unquote hiding them the
exponent we turn them into elliptical of
points
um this allows us to still perform the
math that I was saying it is quite
literally multiplication
but it is done in this in this encrypted
form so that no one can read the overall
secret there's one other thing and
that's that we have the role of the
sequencer
the sequencer's job is to do two things
one is to decide who's going next there
are thousands of people who want to
participate how we decide who's the next
the next contributor
um and the sequencer basically uh holds
the files and when there's uh when
someone asks for it and it's they're
available they'll pass over the files to
the next person to contribute the second
thing they do is they verify these
contributions so
um we need to be sure that these
contributions that people give back to
the sequencer someone hasn't tried to
delete some of the points or try to do
some weird crazy math that breaks it so
the sequencer just double checks that
the files that they're getting back are
still valid files so that the ceremony
can keep progressing the sounds like the
sequencer has incredible amounts of
power this is not true so the sequence's
abilities are basically the only thing
they can do is censor things
they could lie and say that the file you
gave them was corrupt or invalid and
they could also just not give you a turn
so you would log in with your ethereum
account and then they'd be like oh no
sorry your therm account's not valid
um or we've got certain validity
conditions it doesn't meet those in this
case we have signatures which hold the
sequencer accountable for this role so
should they try to do these kinds of
things we'll have a proof that we can
publicize to show that this was
happening and we can decide how to
progress from then
um
so realistically the sequencer doesn't
have any weird and funny Powers
um it is just a server that runs a very
simple algorithm just verifies things
and passes them on
in the end it'll be up to the community
to verify that the sequencer did their
job correctly so there's a transcript
file that should be split out of the
ceremony at the end which contains the
secret this final secret and we can
verify that what the sequencer did along
the way was correct and valid I kind of
lied a little bit earlier when I said
that's how it works is a little bit more
complexity so how does it really work
here you might have heard of something
called the powers of Tau
these are the powers so it's not
actually a single secret we store
multiple copies of the secret we stole
the secret the Secret's a number by the
way we saw the secret the secret squared
cubed etc etc all the way up to the
secret to the power of 2 to the twelve
or as these encrypted points then when
it's your turn to contribute the
sequencer will pass you this this file
and you will come up with a secret with
obviously with the hope of your computer
right and you do some some computations
so you also calculate your own personal
local secret or entropy you calculate
the powers of this and you do basic
multiplication so you multiply the the
corresponding power with the uh the
corresponding elliptical Point given to
you from the sequencer
and
by the linear properties of
elliptic curve multiplication we end up
with this final thing which is basically
showing that now your secret has been
incorporated into this overall secret
and you can now pass this on to the next
person that you then take this powers
and hand it back to the sequencer who
verifies that what you did was correct
what you did was valid
and that you haven't tried to to to
cheat the system so when can you
participate
um
the we should be launching a test net
very shortly ideally in the next few
days
um they were fairly certain that most of
the cryptography is uh unlocked we've
that that's pretty reasonable we've
already had a first audit on that but
there are a bunch of ux bugs that we
need to sort out and we're handling that
and that's a part of the test net is to
get people to participate and help make
this the the best process it could be
we've got a final audit launching early
November which will hopefully be
concluding after that should anything
arise in that audit we'll we'll squash
those bugs review that and then
hopefully launch the ceremony by the end
of November
um
eip4844 I don't show lots of people have
heard discussions as to when that's
going to be
um ultimately it's up to the client devs
and the community demand for when this
gets shipped but as this is a
prerequisite we'll basically be running
the ceremony up to until that point
which is a minimum of two months but
obviously we'll run longer should it
take longer to get to eip4844 there are
grants
um I'm sure many of you have heard never
to roll your own crypto I'm trying to
tell you you should roll your own crypto
um all that's needed to uh to implement
this like from scratch is to do elliptic
curve multiplication
um maybe some of you have heard of this
or like had it explained to you on a
whiteboard it really is a like
relatively simple thing to do you have
quite a lot of time to do this
participation so if you are going to
write your own implementation uh you
don't it doesn't need to be super
optimized you don't need to read all the
latest papers
um so if you've ever wanted to
understand what's really going on under
the hood of elliptic curves this would
be a great way of doing it
um alternatively you could use an
existing client uh sorry an existing
elliptic curve library and on top of
that you could just implement the client
side of things like the secret
generation how you how you sampling that
Randomness and how that gets passed on
to this elliptic curve Library
and then the second category of Grants
is for crazy Randomness generation and
contribution
so if you would like to go on some weird
Vision trip that somehow is going to
bring out this the the secret that you
can prove to other people has been done
in an interesting way
or you want to have
use your local Ant Farm to like measure
the location of ants or something weird
to sample Randomness something that is
very hard to bias such you can convince
other people that your contribution was
valid that you generated Randomness in a
novel and interesting way
functionally
these are less important because your
computer should do this Randomness for
you we all rely on our computer's
ability to generate Randomness already
for all of the encryption and
cryptography used within this ecosystem
and like The Wider web but it's even
more interesting and we can make even
more assurances if you start doing
things like this and then finally as I'm
sure some people have seen from past
ceremonies you can destroy that destroy
the hardware used to generate the secret
what's a little bit different from our
ceremony is that the secret only exists
in the realm of your computer for a few
seconds 30 40 seconds or so so it's not
some something that gets stored to disk
that you need to get rid of later or
something like that so destroying your
computer is much less necessary but
should this be something you want to do
or should you think that you can
convince more people that this is secure
by doing it reach out to to myself or
Trent and we can be and you should be
able to see a bit of shouting about this
on Twitter about what are good places
for Grants and I think those are the the
major points I wanted to top on so are
there any questions
Y2 to the power 12. ah we actually have
several ceremonies so
um where the ceremony is consist
consists of four sub-ceremonies two to
the power of 12 13 14 and 15 which are
basically all the sizes of data blobs we
could see ever needing for dunk sharding
um so 2 to the power of 12 basically
gives us one megabyte blocks in
expectation that could grow up to two
megabytes but basically that's which we
think is a reasonable Target and should
be fine with current technology but we
give ourselves the ability to scale
um what's that 16 times over that should
we need more growth in the future and if
we need anything beyond that we'll rerun
the setup there's also an optimization
we made which is pretty fun and
interesting which is where instead of
having one large setup and then using
subsections we can instead do several
smaller setups
um and then we can skip the low degree
proofs because these setups are disjoint
so you don't have more Powers should you
need them but that like the low degrees
in force by running out of points that
sounds like the max live okay hello uh
if I stand correct if I understand
correctly then
um everyone
um
who's participating in a ceremony
could have like the chance to um
uh see what the current secret is so is
there a chance that if you we the last
one picked in the sequence then you
would have a higher chance to
um kind of ruin the whole process
um so not really and that's because we
don't operate over the secret and plain
text we operate over the secret encoded
as an elliptic curve point
so it's not we don't use it in my
example where the secret was 30 we don't
actually use 30. we use uh 30 times the
generator of the curve so some elliptic
curve point
which means when I give you the powers I
actually hand you this elliptic curve
point which means you can't see into
what the secret is so if you have
something you build on top of there it
it's useless to you just looks like a
random elliptical point which is the
same security assumption we depend on
for the rest of ethereum's signatures
Etc
okay thank you ciao hello okay
um you mentioned the quantum
vulnerability yes uh what is the
mitigation for that and also BLS
signature aggregation and
when is that going to be a problem
when it's going to be a problem I wish I
knew I think there's a lot of money to
be able to answer that question
um so
if we want to switch away from this to a
less Quantum vulnerable things we would
have to switch to
um probably hash based commitments local
trees the issue about it being
um
not verifiable easily inside of snox
would go away because Snorks would also
be broken
um so like depending on like what your
commitment schemes are you would have to
tail all of that but we'd have to see
quite a big re-architecting of this
entire system and so it's not something
we have like a built-in backup like we
do for many of the the other seams
um in answer to your BLS aggregation or
whatever question for the signatures
we're using for ethereum right now under
the hood for your private Keys there's
also a Lamport keeper like Lamport
signature key pair so we can always
revert to that to execute a one-time
transfer should that need to happen so
there's more uh there's resilience built
into that already
and you don't think it's going to be
within the next 10 years that the
quantum will happen then I don't think
so or at least not at the rate where all
of a sudden we're gonna have to throw
everything away
um the good news is we probably won't
need a trusted setup in the case that
Quantum is broken so we should just be
able to switch out the commitment scheme
we're using
um but yeah I don't see it happening in
the next 10 years if it does I don't
think it'll happen overnight thank you
uh I was wondering how like on a on a
test net do you what kind of tooling
you're using to like execute these
adversarial conditions so the thing with
a do you mean adversarial against the
sequencer or against the like setup in
general uh so like on a test net you
wanted to actually like have one of them
like hide a secret or like not make
something available like how easy it is
to how easy is it to do that on these
like Live Test Nets so the thing here is
that
um
there there's basically just one
validity condition I can sort of okay
I'm already on the next person's slides
never mind click is not working um I
just slide on this basically one
validity condition or two checks we need
to do to assert that the uh update has
been done correctly so it's not that
like there's a weird subset of collusion
or something that can break things it's
that have we built the sequencer in a
way that's such that it can't be dosed
or crashed which we can use fairly
standard testing infrastructure for
um and when you're submitting these
these files we can like try corrupt them
and that kind of thing but that's going
to be rejected immediately by the
sequencer so it's a bit different from
standard test Nets that we see from
blockchain networks because the
adversary looks very different it's more
of a web 2 adversary in attacking the
sequencer directly than what would
happen otherwise okay it makes a lot of
sense sure
thanks very much for this for smaller
projects would you still trust if if
we're talking about a separate project
would you still trust The Trusted setup
or would you think about different
strategy stocks or anything else
trusting this setup or their own setup
no if you would work on a project a ziki
project now that is kind of thinking
should we do trusted setup should we go
with stock with something else it's hard
to know I think a lot of that comes down
to the execution things like how many
participants have you have you had come
on board or how many different
implementations do you have we already
have a few floating around I think we
could get something like 10 or 12
different implementations these kinds of
things the good news is that once this
is up there's now more infrastructure
for smaller projects to leverage in
terms of
um like just extending these powers that
would be great but
it like in intrinsically that it's like
very much a case-to-case based thing
um I I don't think trusted setups in
general are safe I think there are ways
of executing them that are safe
um and I think some of these things I
touched on are important to do that
thanks
um have you considered starting with an
already established setup and
basically adding your Randomness into it
and if you're not doing this why not
uh yeah we have there's been a lot of
discussion on that
um so we're using the the setup is done
over the BLS 1231 curves
um which
I mean there have been setups done
before
um but not that many anyway
um what I was referencing earlier with
this optimization where we stopped doing
the low degree proofs because we ran out
of powers so we don't have to check that
the polynomials of degree less than 2 to
the power of 12 because there is no 2 to
the power of 12 plus one point we
literally run out this optimization
Falls away when we use these other
trusted setups that exist through to the
safety of uh the the kcg commitments and
the way we're using them in 4844
so for asset breaks things being able to
use it so while it would be a good base
from the perspective of not knowing what
the secret is from the security things
we care about in our application it
doesn't add anything and then it's more
of like arguing about nothing about
Sleep Numbers kind of thing it's much
easier just to start with the generator
which is what we're going to be doing oh
yes it's a sequential process so sorry
the question was do you run it in
sequence and how do we handle civil
attacks so yes we do run it in sequence
because of the way the
um things are encrypted or whatever it
fundamentally has to be that like the
way the math works out it fundamentally
has to be a sequential process we can't
combine two parallel ones later
um our civil processes are twofold
that's that you need to authenticate
with signing in with ethereum and we
check certain properties of your account
so like a fresh account is not going to
work but an account that you've got even
like you've sent one of two transactions
uh should be good enough that in the
past the alternative to this should you
not want to use sign in with ethereum
because you like only ethereum adjacent
or something like that is GitHub and
there we're verifying that in the past
you've had a commit to uh on on some
repo
the simple attacks here in the black low
orders like if we have
some people contributing five times or
so it doesn't really matter
um because they just mix in five sets of
Secrets but if we extend this out it
does start to matter so if everyone like
if everyone manages to sublet and
everyone was the same person replicated
that would be bad so we don't need per
flexible prevention just moderately so