foreign
[Music]
so our next panel is on dsls and IRS for
ZK circuits yeah these are all
um implementers and authors of some very
popular CK dsls and IRS and so today
we're gonna get together and
um I've prepared a few high-level
questions here I'm going to read them
out
um so the first one is sort of an
exercise to locate each other on the
language stack and see how we relate to
each other
and the second afterwards is to then
figure out um to what extent can we
share infrastructure
or should we even try is it impossible
after a certain point
um and over here I want to note also a
lot of Prior work from the compiler and
smt verifier communities so can we also
reuse some of their work and then lastly
I had a high level question about
you know what programming in ZK should
look like what's your ideal DSL is it
very different from normal programming
yeah so just keep these in your head and
I think I want to save maybe 25 minutes
for audience questions at the end
so I think let's start with a round of
introductions
um
I have like I have
pre-prepared some visuals for you
um
in case you need them so the first first
one is pill Jordy so can you give us an
introduction to what pill is
a language mainly it's Bill means
polynomial identity language and mainly
what it is is when you define a circuit
that's based on polynomials for example
a Planck is an example of a way of
um
circuit that's based on polynomials but
you can do much more things much more
complex uh that's our base in
polynomials that still allows you to
just write those identities and then out
of those identities just build the proof
automatically the same way that you do
in a normal uh zero knowledge language
the same way that you did in circum you
can do it in peel here you need to do
something else because you need to
maybe write the weakness somehow but
it's just a kind of abstraction where
you can just focus in writing what are
the identities uh that you want to
fulfill
and yeah this is mainly what Spiel and
Jordy also is the author of circom
um which is a very another popular
Library so how does pill relate to
circom
well bill is for polynomials and circuit
is more for uh signals you're just
working we are not working with
polynomials at all you are just building
uh
um you have just signals and you just
build constraints around those signals
not constraints around polynomials so
um the idea of circum is uh it's circum
is a low level language because you can
write everything every every uh every
circuit you can write it in circum
circum does not have any special library
right it's better than you need any
plugin special so all the circum is
rated in circum so it's on there but at
the same time is a high level language
because it allows you connections so you
can have you have blocks and and then
you connect blocks even small blocks you
do Big Blocks Big Blocks you do a bigger
blocks and so in this sense you can go
all the way down and on the way up uh on
circum that's why it's so flexible and
then it connects very good with snark.js
and other proving systems and yeah it
has been there for years has been
already a full rebrite we now introduce
uh introduced uh these new extensions of
the language it's mainly um mainly our
Anonymous templates and we also already
are adapting to Planck circum was born
in Darwin CS era okay and now but in
Noble works perfectly in Planck so we
have also custom Gates and yeah we're
extending uh the language and it's a
full community that's working on there
thanks Jody so yeah to me it's
interesting this
um distinction between
um a language for polynomials versus
first signals and I'm gonna skip to Noir
because as I understand it nor can
Target both Planck and r1cs and air and
even more back ends so Kev what's nor
about
um can you hear me yeah so Noir is a lot
more high level uh it compiles it
compiles down to something called a Sear
and essentially you never tell the
proving system how to do something you
just tell it what you want to do so for
example uh if you want to do a char-256
uh you don't tell it to use custom Gates
the proving system just decides uh
what's the best way to do it
so in this way we're sort of back-end
agnostic fully so for example you'll
never see like uh custom Gates inside of
Noir or any sort of that syntax or
lookup tables you might see maps for
example
yeah so yeah
cool
um I'll just go around I have questions
I'll just go around the intros first
um so this is the picture I found for
Cairo I really apologize I'm sure that
better pictures exist but
um this is the best
either produced 100
um so um yeah so I guess Cairo deferred
to um to some extent I wouldn't be able
to actually go into I want to see
friends but Carol is just during
complete language so you were writing
Cairo you were the same way you're
writing solidity or in any smart
contract language that you can think of
so from the perspective of Cairo you
write a program this program is
completed to a carabite code which is
run into the Cairo VM and prove among
all the programs that are proven within
the same proof so in that sense it's
like there is not things much much
difference you don't have things in
there you don't have lookups you just
have like
um you know programming and sometime for
some operations we do have this notion
of built-in but built-in are just
something you call as part of the
function
and the best for last kimchi slash
snarky JS
um Brandon hello
um thank you yes uh so uh this is snarky
JS with a Y different from snark.js had
a few people confused this week
um yeah uh you know name name might
evolve I don't know um so uh yeah so
kimchi is our is the proof system that
snarky JS is built on top of uh right
now
um the way that it's built we can plug
into other proof systems we just haven't
yet um kimchi is the proof system that
is in uh Mina or well in in the test net
of mina that will be hard forked pending
Community voting
um but the idea is I mean kimchi is a
Planck 15 type proof system it has no
trusted setup it's Universal uh and uh
we support like infinite and efficient
recursion which is important for mina
this is sync blockchain
um but it but the cool thing is you can
also use this proof system to build Uh
custom zkps which are our smart
contracts on Mina
um and uh and you can build circuits
outside of mina as well so uh I I don't
know there's not much in this picture I
want to explain I guess the the one
really important thing about snarky JS
you can see on the top left there
um the the code snippet
um it is typescript and is extremely
high level language
um and and there's this sort of
uh I guess there's a lot of reasons why
we designed it the way we did I'll just
point out a couple things one is we get
all the tooling and infrastructure and
ecosystem that comes with typescript
um
so you know npm is great vs code is
great all the Integrations already work
and are good
um and uh we think that you know when
people are writing zero knowledge proofs
or writing any programs like the model
that people are used to thinking about
computations is you know you have a
function it takes some input and you
produce some output so one of the things
that snarky.js does is it lets you write
your computations with your circuits at
the same time and the output of those
functions gets sort of fed in as a
public input automatically for you so in
the end your your code actually looks
like normal code cool thank you
so I'm gonna start with an opinionated
question which is
um what is what do you think of
um
intermediate representations so what
Cersei is this project
um that's inspired very much by llvm and
everyone's turning to look at the screen
but so the idea behind that is to define
a common standard IR
um to which many different front ends
compile and from which many backend many
different back-ends can compile so how
well do you think your project would fit
into a model like that
okay like yeah
okay yeah I'll start I mean yeah so so
uh
snarky JS is like I said like super high
level
um and right now it's directly connected
to kimchi but um we could and probably
should connect to some intermediate
representation so that uh we can you
know share that work of connecting to
custom back-ends
in the case of circum actually it
exports to two different languages
[Music]
internally it has an intermediate
representation already is uh second one
so exporting that to other language like
rust or like go is in the in the road
map and uh okay exporting to maybe some
other intermediate representation if it
looks like uh good enough uh that's uh
that that would be definitely possible
here I'm not sure about the
specification I have not read it yet but
for example there are things that how
you paralyze uh witness computation in
circum we have a way that you have
different components because there are
components you can say that this
component this company is is can be run
in parallel so the windows computation
can be run in parallel this is very
important especially when you are doing
big circuits so uh you know I'm not sure
maybe some somebody that's explained
that would that would be maybe an answer
for for them but they uh sometimes there
are details there that are not that that
easy
so in the context of Cairo
um so it won't really even work
um I mean because Cairo as of now
doesn't have internet representation and
directly by basically just a very high
level you know like a bit like Seas
representation just like compared to
assembly and Carol itself Carol the
current version at least to just
directly generated by code that said
Cairo we have carrier one coming in a
couple of months uh and camera one has
don't have something called Sierra and
Sierra is within literally means safe
intimate representation and the purpose
of Sierra is to enable uh the language
to turn deterministic actually so Caro
is not deterministic but Sarah will make
it deeper Mystic because when you make a
language for an L1 or two four four
blockchain itself if you want
determinism you want determinism for a
very specific reason actually which is
you want to be able to prove a fair
transactions without determinism you
screw it for that and so we for now we
don't have it and it is those Vector
that we control by making by right now
whitelisting the contract but tomorrow
when we're going to go for
permissionlessness and then
centralization you can obviously do that
so we are working to have this safe
internet presentation which will be
deterministic and this the intermediate
step will be able to actually compile to
multiple backend so either Cabo or like
an optimize for xc6 for execution layer
and potentially from phoenixes but in
that case we'll probably lose most of
what you're gaining and what you wanted
so uh I I don't see I don't know if it's
practical to compile for I I don't know
about Cersei but I would be it's a great
name for Stark by the way uh but uh yeah
I don't know uh I don't expect so I
don't know if you could do that
yeah so we did once have an effort to
integrate a Seer with Cersei uh we
dropped it just due to priorities uh
from what I remember it was fairly easy
if we extend Cersei to have uh these
black box functions uh just because the
Cersei IR just can't optimize uh for
these black box functions
um so yeah it's possible we just haven't
picked back up on it
yeah I I think nor is probably the
newest shiniest language like it just
dropped um and I'm I have lots of
questions about
Acer acir is noir's intermediate
representation so
it can compile both to r1cs and Planck
um so how does this IR capture both of
these
um very different arithmetizations
um uh essentially you have these
arithmetic Gates which are just linear
Expressions which aren't bounded so for
r1cs that's quite simple to compile down
to for plunk because you usually have
like width 4 or some uh fixed width we
have something in a sear which basically
chops the gates into the perfect width
for a blank for the Black Box functions
it's really just the proving system just
takes in the witness indices and just
fills in the constraints for them so
it's quite simple what it's doing it's
not doing anything complicated
yeah that makes sense Brandon did you
have thoughts um
on the IR thing yeah well I I think I
spoke in the in the beginning a bit I
mean yeah I I guess
yeah I don't have anything else to add
um cool
um so what I'm hearing is like basically
compiling to an IR you
could stand to lose some
um
some very specific performance
optimizations uh unless the the IR
allows you to Black Box things easily
cool
I don't have a question for Louie as
well what do you mean when you say uh
Cairo is not deterministic and that your
IR is deterministic so so Cairo today so
proof our dkps or Language basic you can
create hint and in that break vitaminism
um but we we Carriage there is not
domestic so for men to be more specific
we actually have two flavors of Cairo uh
what we like what I like to call Pure
Caro which is the one you would just
directly prove a program within within
sharp or sharp being the shareproof
infrastructure that we provide or
um or um that's your pure Caro and
what's dark X is star X is built on and
even Stark net itself is built with and
you have what we call Stark net Cairo
and Stockton Cairo don't have a notion
of State Dove has a notion of like Cisco
and plenty of things that you get from
the OS itself so you have like Cairo for
a start net you have Cairo for real pure
Cairo so the thing is that the Cairo
Force darknet cannot be
non-deterministic and that is for a very
pure incentive reason because if you
don't have determinism that you can make
transactions that are not provable
meaning I'm the only one we know that
this transaction is done in and I only
want to know the hint and therefore the
rest of the word cannot prove it and so
for instance let's give an example that
people like to choose you know I want to
do a force transaction for man one you
know being that optimistic roll-up push
I mean talks a lot about
um then in this context with determinism
I can't this is a dose Vector because I
don't know if the transaction is getting
pushed to me is provable by me I don't
know that and so and another thing that
is important to you that fair
transactions so fair transaction can be
valid you know the price of this pool
only swap move and now for my
transaction failed and otherwise it can
be uh malicious so I'm spamming the
network with transaction hoping to get
what I want but if I don't I don't think
I don't pay anything and that's why I
can spam the network for anything and I
need to run it and so creating those
Vector so Force darknet we have to make
Cairo deterministic or I mean the
version of Cairo for Stockton will be
deterministic for that purpose and to
make it deterministic we need to prove
that the program was compiled into
deterministic version of Cairo which is
a safe intermediate representation
called Sierra and the Sierra will
compile to Cairo itself
and so
right stuff will be proven within
starnet when I'm deploying a contract I
will be proving to use darknet that this
contract was compiled with using CLM so
this is what I mean by Carol become
deterministic in that conflict
[Music]
I guess my next question is uh number
three which is
yeah when you were writing your
languages what features did you
prioritize so for example
um Noir is very rust-like they even have
a version of cargo called nargo
um and then uh snarky js's like
typescript
um Cairo is also a pretty high level
yeah it's Miss right now it's a mix of
scene
but right the new version will be very
rust-like which is coming in the I say
three months right and for example
ganark was just written directly in go
Halo 2 is written directly in Rust but
but pill and circum are like kind of
closer to the metal I think so is Halo
the metal the circuit I mean
um and so is Halo 2 so yeah what are
your thoughts on uh the trade-offs
between like higher level
representations and lower level
representations and
um how did you you know decide on the
designs that you did
can maybe start so the first that's
actually an interesting story from from
uh from Star War expertise experience so
the first version of Star Kick so starcx
was and it is the first product in
stockward and which is basically a
centralized but non-custodial back end
for uh dabs who need scalability so you
know customers are dydx diversify uh
immutable and so rare and so the first
version were written you know very low
level literally in polynoms uh and this
thing does transfer and swaps and so we
started to work in Cairo it was 2019 and
it became production ready uh in uh in
May 2020
um the first case of actually uh where
we used it for what's for the ready to
bake off in June 2020.
um and so
um the funny story that the improve the
performance of the of the system
massively improved when we start using
Cairo because it was much higher level
and who had a lot more flexibility in
the way we could reason about the system
in the way we could write about the
system Not only was again in philosophy
in velocity but also again in actual
Pure Performance and so
um there is you know in some green of
and when you need that performance
Improvement we have these things that
are built in the same built-in as
equivalent to Cairo to those specific
shape on your CPU like the one that does
64 bits
and so if you really need like
optimization at the very low level for a
specific operation like say proving um
right now we did it first okay check we
did it for um
um for um uh for a
seriesic signatures we in the range
proof and sort of things that we write
them in those and for the rest we just
write in and so there was not really any
trade-off in many way except that much
simpler and nicer to write
nowhere too
yeah that's interesting that like a
higher level language actually improve
your performance but yeah I guess so
you're pushing a lot of the manual
optimization to the compilers and like
stuff that computers are better at and
then the commonly used so-called
pre-compiles um you do hand write that
you started when when I started to write
circum the main purpose is
as I said before is circum is at the end
it's a low level language so it is that
if you're writing silicon you should
understand what you are doing you should
understand
what's in the what's behind the the
circuit
level of course you can do things in um
in a high level because you can connect
things but the idea is that you have
precise and this is some something
that's very specific to circum is you it
should not be any hidden constraint
anywhere
so other constraints are there you can
check the code maybe you need to go
inside the circum leap or someplace in
the library but you will find all the
constraints there and you can track them
and you can see them so you can have
full control of what you are doing this
of course is dangerous I'm not saying
that that's why because you know you
need to understand if you're I've seen
people that writing circum language that
they don't know what they are writing so
it's not going to work okay and this is
we we understand this is a a thing but
this is what circum is uh for circum is
for writing would say Circle means for
people that understand what's happening
underneath that's the that's the thing
okay
um said that
the disease will be linking with what he
said is I think that in the future
nobody will have to write circuits
and because uh Siri is a very specific
thing for politics and and then you can
write you you will be able to write
things in in Cairo for example or things
in maybe some high level or even in in
solidity there's a kbm at the end is a
language that you're writing a language
and you you're building a zero knowledge
you're building a zero knowledge there
so you can uh there is other projects
like Risk 5 that are also building on
top of that so it's uh the the zkbm what
brings behind to the to the to the world
is that you can
have any any processor any base a risk 5
an ebm or chiro-like or some some
specific
virtual machine so some processor and
then you build on top of that processor
but the circuit is the processor the
circuit is like the hardware
okay so it's like maybe we can talk
about Hardware language and software
language uh silicon is a hardware
language okay and so for language should
be normal so for language C solidity
python or any other language that builds
on top of that I don't see a space for
um I don't see but this is a it's
opinionated on me but I don't see a
space for a specific
language as a specific high level
language because I think that
a very high level language should be
enough to to run on top of that
can I just add one thing but it's what
you said
um I tend to agree with the entire
statement about however language there
is one thing though
um I don't I I'm not sure and I don't
think necessary that you know things
like python or Russ will run enable you
to write vkps tomorrow because there is
still a very strong Paradigm competing
Paradigm Beyond it a very strong
differences which might require you
still to have like a different
accepting that you're working on
something different
yeah probably this is but this is this
is at this point we are running faster
so it's uh I think it's just a matter of
uh times and yeah and how difficult it
is you know right now uh depending is if
you are if you want to run a very very
complex uh uh language very complex
thing it's one thing but if it's complex
it's going to be also difficult to write
a complexity so I I think the way to go
is high level language
cool yeah so um I uh I and my team have
a very very strong opinion about this so
I guess for for background
um so Mina the the Mina protocol
um we started building it in uh 2017.
um and uh for those that don't know Mina
basically is just like an enormous uh
like zkp circuit that that powers
everything so there's um a recursive uh
a like linearly recursive proof for uh
compressing the blockchain that follows
you know the rules of blockchains
um uh there's like consensus logic
there's verifiable random functions
where like uh fractional numbers are
approximated using like crazy uh
calculus things basically enormous
enormous programs and and uh enormous
circuits and and we realized very early
on in 2017 that like we could not write
the circuits manually
um and and I agree it's I I would I
would sort of I mean in some ways it's
like it's like programming directly with
Hardware but I think you can also kind
of think of it metaphorically like
writing Assembly Language
um and and you know you can't
like uh these days when you're trying to
write a really complex program you don't
use Assembly Language you use a higher
level language so um so we so we built
the first version of snarky which is an
embedded ocamel DSL in 2017
um and uh we used it for and we still
use it you know whatever five years six
years later
um and uh it's great and we've learned a
lot and and the the specific
um you know we've taken those ideas and
brought them to snarky JS which is just
sort of like bringing that into into
typescript instead of ocamel
um the uh you know we we thought about
like okay if we could build a high level
language that compiles into something
and then like Implement a bunch of
optimizations but the the landscape of
proof systems is we thought would evolve
quickly it has evolved quickly it
continues to evolve quickly
um and so uh it makes sense right now
um I guess it's similar to what we were
just talking about like uh you you you
can't today efficiently use like a
regular language directly like uh like
you can't write a rust program
um
and have it run efficiently uh
in you know for some definition of
efficiency
um uh but
um but you can uh you can build like a
little library or framework in in a
language that already exists embedded in
it so that's what we did with ocamel
it's what we did with typescript
um and uh and and and you can you can
build
um you can expose the lowest level so so
like the there are people who are like
experts at optimizing constraints for
the proof system and then you can build
abstractions over that uh and with types
builds um you know type structures build
computations
um and and this has worked for building
this enormous uh system that we have in
Mina and we see it starting to work as
well for building really complicated
applications with crazy recursion and
all this stuff in in snacky.js
yeah
[Music]
um
I think I disagree with everybody
that's okay that's why you're here
um
from like uh I I think that using rust
at least for our use case
um
it would be a bit clunky to encode like
um
semantics for like privacy like private
State and public state so I mean it it's
possible but
um I think for the user just be a bit
clunkier which is why uh
I think maybe if you're not using it for
the Privacy use case then high level
languages like rust and go might work
um
for uh
for for using typescript and uh
languages like that right now
um
when we were designing Noir it just
seemed like we needed to restrict the
user from doing uh very specific things
that it seems like in typescript they
could just counteract it and uh I guess
one example that I always bring up is
the if statements like uh if you're
using like a high level language you
sort of can't just do if something else
something because in typescript or high
level languages that works different
from like a circuit based if
so in Cairo we actually
do a
cattle at the runtime so we don't
evaluate if statements we only evaluate
the path we take
that's why uh yeah uh of course I have a
counter opinion to that
um yeah I think uh
um the the costs uh of of using a custom
language
in in my opinion in my team's opinion uh
severely outweigh the the benefits so I
guess just to talk about the if example
yes you you can't use the built-in
typescript if in the context of uh like
within a circuit but if you are if you
are Computing a value that you're then
using in a circuit you can use if
statements and and if you're if you're
actually in the circuit there are tools
in in the typescript ecosystem that can
help us actually Warn and or error to
the user like we can use eslint to
provide an error if you're using an if
statement in in a place that uh you
shouldn't be and and that and of course
that won't be perfect but um we've found
that that actually uh is is working
really well so I actually I'm agreeing
with both of you
so I'm gonna explain what I mean by that
um I agree that you should have
um basically your specific language at
the same time that um that I mean that
tends to help you think about the
Computing model you are in and at the
same time you also want a language that
are familiar to the public or people are
already using and so one solution that
we I mean first of all I'm saying I
didn't say about Cairo so Cairo actually
been CPU air so roughly Cairo can
evaluate any program and it was clear to
everyone here but it's and notably what
it means that there is two things that
you get that you don't get in circuit
usually which you you only get you get
recursion um very easy recursion you
don't have to evaluate your circuit and
second thing that you get for free is
you only evaluate the if statement the
path you're taking so when you have many
many ifs then you actually only you
don't pay for all the branches you only
pay for the the one you're using and so
um one consequence of this one thing
that we were able to do was I think all
the team built is they started to see
trans compiler from one for the higher
than other language two characters so we
have one right now
a language compiler called skyro made by
your team out of Switzerland which is
combining Idris or just being a
functional language to Cairo for the
story if you are if you want to use it
you'll be the first one to ever use it
so have fun uh I actually never found
anyone who wants to use a functional
language so maybe there is one in this
room uh but uh just like functional
languages so go for it uh Idris
um
so seriously if you want to do have fun
go for it seriously it's crazy but uh
but so I'm trying to say that
um I don't know if it's the ultimate
path but uh
um they there is like there is a middle
ground can I uh yeah so um yeah so just
uh for for in in snarky.js today
connected to kimchi I mean this is
powered by kimchi of course but uh we we
also can handle recursion infinite
recursion and in snarky.js we've built
an interface that's just it's like
essentially the same is writing a
recursive function so you just you you
know you you put your function in a
JavaScript object that's the only
difference
um and whatever arguments you have if
you type them as like proof then uh the
system will know that you are trying to
do something recursively and it'll do
all the complicated for you uh and
in your in your code you can just say
like you know if if like P is your proof
you just say like P dot verify and that
sets up all the constraints for your
circuit uh and then and then the other
bit about the if statement branching
thing like today in I think any proof
system that I'm aware of including
kimchi including the current version of
kimchi um yeah you have to pay for both
branches and you can kind of approximate
branching by like multiplying by zero or
one
um but we are actually working on an
extension to the proof system that will
uh will allow you to do these kind of
like arbitrary jumps in an efficient way
and that though is uh you know I'm not
working on
oh is it not a CPU like you know like
basically running in the arbitrary
program then
um yeah I always VM basically at that
point um you you get essentially the the
power of a VM with the performance of
direct circuit yeah so it's kind of the
Holy Grail and and the I mean the
intuition behind it is like uh there's
you know there's like look up tables and
and custom Gates and all these things in
Planck um you can sort of extend that to
uh allow
um for like arbitrary Ram like random
access memory and then you can kind of
do another fancy thing to get arbitrary
jumps efficiently
um and the details of this I'd have to
connect you with a cryptographer on my
team but um I am told that this is the
path that we're going towards I've seen
that I've seen that in your repo is the
dynamic lookup table right yeah
Jordan has been silent for a while you
know at the end is this is what are you
writing Hardware or software if you're
writing Hardware you need a hardware
language if you're writing software
my my my opinion is just use a standard
software language and uh why because the
hardware and the problem is that you
need the piece of Hardware you need the
process or the hardware that that can
compile to this software but
this is there so this is where to go
cool
um I want to save some time for the
audience to ask questions so we have
about 15 minutes so
any questions from the audience
so
we actually touched on Hardware a lot
during this conversation it'd be
interesting to hear uh from the
different panelists like what you
actually see the kind of future of ZK
Hardware to be in like what direction
it's going not that kind of Hardware we
were talking about I think we're talking
about but yeah we can talk about that
too but we should we we can't we can't
talk about like real physical Hardware
as well
yeah we're talking about the polynomial
Hardware it's like you know arithmetic
Hardware I recognize that I I can no
we're making a joke but let's uh on the
artwork acceleration so I'm gonna take a
hot stake here um star query at this
stage do not believe that we need them
um as simple as that
um the reason is because the software
itself is being improving so fast and
the structure in the architecture of how
you do things has been improving so far
that at this stage we we don't know what
the future will look like and so what I
mean by this is hardware development is
you're roughly a year and a half before
getting to production and a year and a
half from a year and a half ago uh Cairo
were barely working started with in
premises uh recursion wasn't working
um we and and so for instance the thing
that we are working on right now so we
already do recursive recursive proof on
production today of approve ourself but
like for instance one architecture we're
not doing it at the moment is
um basically a
three of proofs like basically right now
the only thing we do is we have what you
call jobs and jobs are like those Stark
Nets starkware infrastructure used all
of that to Sharp and so all the
customers and you start and included of
the infrastructure are sharing the same
proof so every every one of that is
using is basically everyone is paying a
marginal cost of the proof cost on that
and so
um so for instance diversify or
immutable like right now is having like
70ps in their environment and they're
using a significant amount of a step
within this proof so they do one job and
we have other proof and also another
type of of the job is approved so we
um so we don't really we didn't went all
the way yet into that uh tree
architecture and so
full Hardware
um there is already a significant like
you know the the thing Central fact that
we can't really say this is very good
that said I have a friend of mine I
guess
umovich from uh the company called wait
uh it's uh which is a very good friend
of mine he's also already working on
this making uh groundbreaking
Improvement on outbreakable explanation
Shake pronunciation or even like you
know uh MSM which I have no idea what it
means but uh I would let him to you he's
not here today but yeah I would let him
answer that another day
um I I yeah so different I guess
slightly different opinion um so in in
uh in snarky when you use snarky JS for
writing applications on Mina or just in
general we're encouraging
um the the proof computation to happen
actually like on the user's machine
um in this way you get uh privacy and
and uh you know there's there are ways
that you can sort of do part of the
computation on the machine to get the
privacy and do the rest on a server all
these things but
um
when you have a proof system that has a
lot of cool features in it uh like
kimchi
um it's it's slower than a proof system
that has a lot less features in it
um and uh Hardware acceleration would
then kind of you know make it faster I I
think it would be uh cool I guess like
you know we're encouraging people with
snarky Jazz to write uh circuits with
recursion with with linear recursion or
tree recursion that's been working in
Mina and Mina's mainnet for a year and a
half sort of internally and and now on
our decentralized test net we have uh
you know you can do it with custom
circuits and and settle on chain and all
that stuff and it works
um uh and and yeah and it's a little bit
slow right now we're working on
optimizing it um but I I am imagining a
world like I think a cool world would be
one in which like The Ledger that we all
have
um or something like that uh that has
our wallet on it also would have like a
a snark accelerator uh companionship or
something
um I I don't think that's coming anytime
soon but um something like that could be
cool and and even like obviously in the
shorter term taking advantage of like
gpus fpgas and silicon like at any level
I think
would be helpful uh because it would it
makes these proof systems that are I
think like have a lot more features
um uh more you know faster so you can do
different kinds of applications than you
could if if they were slower
I would distinguish this is actually a
very um very different so talk about
zero watch proof we can distinguish
between a small small proofs and uh big
proofs because the big profile for ckvms
and for uh roll ups and for when you
want to do aggregation and these high
computation stuff and then small proof
more questions but they're more related
to something like Identity or a game or
something that you want to run
especially in the client
I think the client has a lot of sense uh
because it's uh it's where the hardware
you know you are building you do a a big
investment but then you you you you can
uh spread to many mobile phones or too
many uh places so this makes a lot of
sense and for things like you know these
privacy things for for things like uh uh
gaming for things like identity uh just
proving things about your data I know
all this that so uh I think this makes a
lot of sense in in in that direction
for the hardware
um so for the big things and I'm talking
more specific to maybe a specific
project which is the ckvm but so
representativity is that for us we are I
tell you why we are interested in
Hardware uh maybe here you will you will
you will see why the idea is that
um uh in a so if you want to have a
competition the days that you want to
have a competition uh
that approving competition you know
disaster there is a market for for for
uh generating proofs big those big
proofs uh here you can have there is a
problem is that you have a centralized
maybe you have some provider that has a
lot of power and these monopolites the
the the system
in the case of ckvm this is not a big
problem because you can only build the
proof that's already deterministic so
you cannot do crazy things but you can
degrade the network so the problem is
that somebody that has a huge power
that's able to generate a lot of proofs
maybe just stops and stops doing that
and and and then uh the the network just
degrades so in for us the way for us to
to to to to avoid that is to have the
best the best proverb
available even in Hardware when I'm
saying Hardware at least in fpgas or
whatever even Asics if it's required so
but the idea is to have the best
approver a valuable open source
and a valuable for everybody so that
there is no monopolistic uh proverb that
can take that that's why for us it's so
important that the proverb is open
source that the property is available
for everybody and not only that that the
technology
to build the Brewer is available
for for the community because this is
the guarantee that we have that the
network would not be degraded
it won't even have to on top of this
um in the context of stock net the way
we are looking we're going to look at
this proving Market is by actually
having uh like a kind of POS exam
mechanism where we have a leader who
would be the proving one and we have
like a in Cascade another one and second
one would come afterwards uh if there is
degradation and so um the the other
thing is that I just want to say I
forgot to say let's talk about that but
um people have been very focusing a lot
on on um on acceleration because Stark
are very slow and there is no because
the operation that he did curve and so
on uh and some means I mean I mean but I
mean at least uh Jordy and I uh working
more on stocks which are much faster and
much easier to to use to to work on on
regular servers so I think that maybe a
difference of nor take relate to that
machine
I mean uh so I'm gonna answer the
question I wanted to hear instead of the
one you actually asked uh because I
don't really know much about uh Hardware
acceleration uh in terms of uh
programming for Hardware versus
programming for a software I think
proving systems are changing too much
for at least us to focus on uh sort of
being so close to the metal just because
the muscle might change next year or the
year or the year after
uh I will say that for privacy it's sort
of a different space uh if you have
privacy you need to sort of think about
how to accelerate approver like because
we usually use wasm whereas if you don't
have privacy it's really fpgas and GPS
like how do you accelerate uh this this
massive beefy machine
I I guess just to
um there was this discussion about like
uh you know markets for decentralized
provers
um and this is just my I just have to
say this because too many people are
surprised by this at this conference
sorry if it's a little bit off topic but
Mina has a decentralized sequencers
decentralized provers a Marketplace for
producing proofs
um that are sort of needed by the system
and this has been in production for a
while and uh we
um encourage more people to look at it
when they're thinking about their
marketplaces and and everything cool
great answers thanks guys
actually
there's a worker
okay um I have a question it's like
maybe continuing on the hardware thing
but most of the I mean a lot of people
kind of
um compiling Target now is actually
solidity so actually a lot of people are
moving on ethereum
and kind of this is Defcon so like uh
the most artificial kind of constraints
that I'm seeing is probably the fact
that we have one pre-compiled curve to
work with but we can only work with BN
128
so wondering what's your intuition why
why don't we have more curves to walk
with
in your opinion I don't know it seems
like it will kind of release a lot of
the bottleneck so okay I I can make two
comments uh the first one in the pure
application Level and why people should
care about what you're describing
um so I think that one of the biggest
original saying that if you're made when
they were built in order to see in
retrospect right we couldn't know is to
have had EOS
I think EOS was a mistake but and and
um and you're right having new curve
like you know uh being able to use the
p2056 when it is on your phone or even
being able to RSA verification I mean
just to throw random ideas right
um would be unlocking a lot of use cases
I mean just to give you an example
um starting running through the company
on gaming that is using the construction
to verify p2056 the the you're using
your securing clip of your phone to sign
signatures for gaming that's awesome
which is awesome
um that's actually not for me the
biggest you know lock of the verifying
the evm the main difference the one
problem is that
um
either you the Computing Paradigm of the
VM is very different from when you have
nvk I mean beats Boolean logic is
expensive and ZK is cheap on the evm
right so this is kind of the starting
point
um and
um while if like you know a lot of team
are looking into I mean diving I mean or
you would talk more about that than me
um about you know putting the vvm uh we
didn't make the choice because we were
in our opinion we were optimizing for
performance of The Proving system and
then now that we have that can we back
work make it Backward Compatible and so
we have in our case warp which is like a
tooling that enables you to transpire
from uh solidity to Cairo and
the practicality of it I can't really
judge no one really used it in
production but they managed to recently
announce they managed to compile to
unifa V3 which is a significant bit and
um there are an existing effort right
now to rewrite the vvm in Cairo so I
don't know once again if it's a POC if
it's for fun or I don't know maybe maybe
it would be practical to prove that I
want to see the numbers I won't believe
it
going to your question
um
why uh why not others I think maybe you
should ask to the EF people maybe better
but what's clear is that at least the
BLS 381 this is a must and this is will
be introduced sooner or later uh in in
ethereum among other things because
signatures so because all the all the
staking stuff it's it's done with this
BLS stuff and also bien well at the
beginning was that was not
safe because there was something
discovered but then it's much more safe
that we thought that was safe so it's
it's there you know it's some there are
some doubts of the BN Corp so I think
that sooner or later ethereum will have
there has been some efforts I know that
there has been some uh stops uh at some
point uh on these this this adding this
and here is for example uh we are
implementing the fully VM right now we
don't have to compile anything like we
just get the code and put it there
doing that what has been an effort but
what are the difficult things what what
what what's the what are the piece
that's really difficult to add so we
were able to to build the evm but there
is one one piece that's complex we'll do
it but it's really difficult to do it
um this pre-compile contract of the bn1
so complicating the complicating the uh
the layer ones uh VMS uh is not a good
thing and this is uh there are you know
there are some of course there are some
mistakes we did with the IBM was created
one was created uh wasm was not even an
option at that point just for you to
just people to realize on that of ZK
nobody knows
they didn't exist but uh so here and and
the wife what I've been hearing what I
see is that uh dbm should tend to
simplify not to get more not to get more
complex and this is I think this is a
feeling that
uh in ethereum the people that's working
scissoring we have uh ebm is probably
too complex and we need to tend to
simplify the gas models the the sum of
codes and and if you see the proposals
that are uh coming are more in the not
in extending the ABM but in simplifying
dbm and said that I think that the BLS
is is a must
yeah so um I guess similar similar to
uh Stark where we we started not with
evm compatibility in mind for for mina
um and snarky.js and our proof system
um but differently from starkware we
didn't we didn't start with like
performance in mind
um because we're we're not trying to
build like uh CK ZK roll up scalability
solution
um we we were like okay there's all
these cool things you can do with ZK uh
with with privacy and recursion
um and and we want to build a proof
system uh that enables uh people to take
advantage of all those cool things
um and uh and and so
um in the same vein as what you were
talking about like there's all these
cool things now that you can do in in
our proof system and on Mina and you
know we're working on an uh ethereum
Bridge so that the mean estate can just
be fully verified from within ethereum
and and the idea here is like we want to
bring all these great features uh to
ethereum Developers
but uh you know like I guess typescript
is you know people are writing front
ends into typescript anyway so hopefully
it's not too bad
um but uh but yeah rather rather than
like kind of trying to put all these
things inside evm it's like okay let's
use you know efficient uh elliptic
curves and all these things uh to to do
these interesting privacy and recursion
all this stuff and then uh wrap it up in
a nice present that can be verified
quickly on evm
I can say my question is because uh you
know start the standards are evolving
sometimes and this is like a
like the the hottest the metal will be
in terms of zero knowledge standards so
some of the time the constraints on the
standards come from things that are not
necessarily very
efficient and eventually Downstream you
you don't understand how you got
something that is using a certain aspect
so a lot of it down Downstream decisions
are being taken because of of that right
we have baby jab jar because it fits the
prime field and and I mean it could be
more efficient to amazing like uh kind
of from a philosophical kind of aspect
of
at some point you need to leave with
with there that's the point and and and
you you can I mean you know you can wish
us we we could wish and we did many
times you know uh wish I suppose if we
can't but the reality that you you won't
get to adapt I mean we may be all
convinced here and Decay the future but
maybe other people outside or not and so
we it's a consensus we want to agree on
what's what's good so I tend to agree
with Jordy we need actually a much more
in favor of simplifying the network than
doing it than trying to bring more more
things to make our life simpler right
now and uh just to give you yeah that's
basically
yeah I don't know
for this is uh look in in the second
circuit we are using a different Prime
field we are using the goldilock spring
field we are building a stark we are
building a recursion of a stark we are
doing a lot of crazy cryptography in
there and just in the last moment we
just built the glow 16 or a plonk that's
just but this is the last the last piece
so it's like the adapter if you want to
the network if if so
maybe then that so maybe the IBM you you
just need one thing
hash functions how many hash functions
needs uh requires the ABM
well we have ketchak we have a a shadow
56 recently a 30 minute Blake
uh is it necessary
maybe with Shadow 56 would be more more
than enough from the beginning
you couldn't argue that the pre-compile
could have been you know like we could
have made things cheaper or in first
place or maybe you know made many things
that are wide if more so much more
efficient of the spring you know there's
many things you could discuss in the
back but this is why why and why this is
possible right now and maybe and this is
changed from three four years ago it's
because we have this validity proof we
can compute things
of chain and validate them on chain so
we just need to care how we validate
these things on chain and bn128 or if
you want to BLS it's more than is more
than enough so probably if the if the
ethereum had to be done now uh it would
be less uh cryptographic Primitives and
uh more basic thing because we can we
can we can accelerate that of chain uh
and and validate that uh with uh with
the visibility proof on chain
and just to conclude on this if you want
to have much more impact and make one
change changing I mean it's going very
ballsy changing kitchen might be more
helpful
no because you change we pass it on in
which which in which prime field
yeah yeah but that's that's that's the
thing you know it's and I've been
thinking you know all of us we haven't
have been thinking on that this why
Poseidon is not in the or why the so why
don't we have a milk C at some point uh
it's not in the in the VM and and this
is the thing but as we evolve as we
evolve we see that this is less
important because we have because this
computational proof are getting much
faster and much better so we require
less this so we can sacrifice a little
bit of optimization right now we can
look in in in the ABN circuit we can we
can validate for 500 catch acts in the
in the proof we can validate uh I don't
know like something like 100 or 200 uh
cdsas with the cdsa ethereum Corps in
there we can do paintings inside there
we can do everything in there
silly it's not optimal
doable and it's it's getting every time
more efficient so at the point that we
have this we require less how from the
L1 we require less Health from that so
so that's why I think that this tendency
to simplify is is is is is is a trend
oh yeah I I also feel like part of dunk
sharding is moving in that direction
like they introduced the pre-compile for
Point evaluation for kcg and you know
then you can understand kcg proofs but
beyond that it's all blobs you know it's
all
um delegated to the Roll-Ups well we are
we are over time so
there's one last question okay ask it
ask it thanks
thanks yeah I just wanted to know that I
see a lot of sense in like breaking this
evm eyes and creating DSL not only for
like opening new area of innovation
and like clear question to basically
Amina I mean does it make sense or you
also like for example to collaborate
with Cairo and uh maybe like you know
since like it's better model for the CK
than uh like imperative languages and uh
yeah basically work on better tooling
for uh yeah I mean operational
verification I I think we are we already
are right I mean we we have uh someone
on on at o1 Labs which is like the the
team that incubated Mina um is is
looking into getting Cairo to work with
with kimchi yeah and there is even one
in the room who actually took her work
and made it into work with Winterfell
so you can look at the guy in a very
nice blue shirt over there Max
so yeah next has a practical Cairo a
very very fire and prover uh in
Winterfell today
um I mean to be honest it's actually go
back to the point question about
simplifying stuff
um why we have no l2s we have L2 that
can do stuff
um let's use their their advantage to
bridge where we could do the B4 and so
like you know an example uh there is a
team actually maybe like maybe in the
room actually over there uh snapshot X
is working right now to do N1 voting
using L2 to make them cheap and that's
something you couldn't do before so
that's this kind of thing that we can do
with l2s now that we couldn't do and
then one we don't have to change that
one for that so simplify please
cool thank you all panelists
[Applause]