[Applause]
so they sing along I do 1910 foundation
of advocacy and large applications and
today I tested myself on Sunday night
working on our past two weeks in
collaboration with and then Steve that's
Patricia right there thank you so much
Patricia yeah so today is all about how
we use these proven tennis tokens to
enable anonymous voting using
civilization and I am finished and go
into the demo I'm gonna go into the code
I'm gonna explain my system works and
talk about how these two applications of
oxytane technology I'll give you so
that's just think about like a juicer so
let's say if even there's always drama
that's always nice and controller issue
and there's always like like Precious
about where that we're going to include
this get into this handful all right
everyone to come to second and community
consensus and some issue and some people
say okay we can try to use an election
or moving to together to get some kind
of fight resolution but that's that's
fine in candy but they're too far sir
you can vote as long as you have an
address which is not so good because it
printed us free and if you vote you can
find out other people's but anybody can
see all more than one and there's a lack
of privacy so for this use case we solve
for privacy
using 7/4 which is a civil knowledge
signaling gadget which I explain a bit
later and we saw identity by using the
Pope of it because for example a bass
part everybody present Agri tourism
officials team with hand upon these
tokens and each was an early experiment
we will make it available to your
address and I want that energy the DSD
71 token which proves that you had an
event and you could combine these tokens
and say that I said at your house a
single one of the DEF CON fact that so
we combine these two components until do
a very similar so let's do a demo
everybody is on the laptop and you
already have the energy mobility I will
encourage you to go to one another app
is a main happy so okay mask mask one on
the address that owns an opening and
click on register and your time in your
your pop-up ID which you can find an
even scan
so for example if I go to my pen and ask
forgiveness can I look at right yes II
721 tokens you see that three days ago I
played by both token so this is my zone
IDs for tonight five wishes for my
fishes for DEFCON 5 I would like this
organizing into the box and I'm register
so that's just one protection should
cost less than a person twice by five
cents and then once you do that you can
go to post and you'll be able to see the
list of questions I hardly need to see
that it with and you can know things
might look at answers so so we can see
like the function of people voting yes
or no and now is just gonna do it with
them or by adding a question and answer
a question any suggestions for highly
controversial topics that happen
[Music]
so so it's just a sign of encryption and
that we submitted to my auction database
and now I'm gonna do the one team I mean
a real Airport on admission and this is
where the menu items
I'm gonna prove that I am in a set of
registered identities
and also at the same time send a signal
which disturb answer yes to to the back
end the bank is gonna verify that I am a
participant of a little debt they don't
know which identity I unless I'm the
only one that is obvious but if there
were like ten people who registered and
I made a proof it only shows that like
one of these times so this is like
basically a schnapps and the a snacks
basically I wait for you to verify
commutation without running the
computation itself and so there's like
two main steps the first step is to
generate proof and this is something for
the converse of the things like how many
to do that the improvement vacation have
it done in relational time and it can
also be done for trade for the sake of
this demo the industry the recognition
of objects in the MIT someone that and
you can generate crews any possible and
so what happens is that each other into
that process into an API sensor that I
can I can verify the truth updates the
database if it was previously we also
have a mechanism where you cannot vote
twice and this mimics these on chain
behavior of is my contract that prevents
you from forty twice so this will take a
comment
and I can Germany to like me mechanisms
that city sucks how you can see this
next website
I haven't got my let's say I have the
set of the website deposited and then my
means the new plugin because I came like
the dead fun does it have to update your
registry
you just have to register it well it
just will be also if it's be able to
just pull from the 7:21 untrackable
interactive update you'll have we the
miss of interest of my dentist who ever
registered through this app so if so
even take the don't get immunity of the
register I use this app alright so the
answers yes and I reach anybody when I
talk to try this out
unfortunately it's not super mobile
friendly so I don't think that it woke
up all of its the URL one of us
at this point any questions before I
[Music]
actually make a trend left endpoint and
directly but travelin API so that you're
asleep
okay so in this case we send the vote to
object to the again but that's the
reason for that is because as a demo and
just for the demonstrate way votes you
know in a better in like a production
application the you would send that vote
like through tall Sunday to an API of a
realtor that would really that prove to
the contract and receive a reward from
the transaction that that was something
that would cover with here yeah by this
case we're sending through an API in not
because we are not because when piracy
but because first of all is a demo and
second of all even in production we were
selling fruit okay and then the relay
would send money obviously I'm just
gonna try to do division syllable but
make the transaction directly then
people will
you are able to use it so that we are
aware right so the only transaction that
can be linked to your address is the
registration transaction or the on the
transaction that adds an impression to
the system but may answer the question
we generated proven Center to a third
party video that does the transaction it
is against for you and that really is
rewarded by so this is like on a tangent
but I'm just going to anyway
in the content version one idea that we
have is to is that when you and you ask
your question you would have to send
some along the question and it need to
be stored in the contact and when you
answer the question the contract needs
that small reward to be really
understand the transaction and that's
why as Holliday is incentivized to
relate intersection offenders so that's
how you get away with not made against
for fully because the people of
expression could subsidize the case
without follow the recipe but for this
demo is and how the opportunity I don't
know this so there's no comment on that
okay so now I just come in to my America
is my nation of Pakistan
okay so right so just to summarize what
is false and telling a free registration
have Asante but that's only one that
goes on chain that's a back-end server
that checks whether the word user and as
a token it does the is it is not proof
verification of train and those
installing SQL database and as also a
they also check the cache of the the
answer and the identity to prevent our
synthetic so I can explain what a pixel
antivirus fail this is what prevents the
same user from signaling twice to a
question or to avoid a 2008 crash and
this effect this mechanism is Pompey is
what I'm doing to mimic what the
contract with the contractor so one
chain as messages now this if that we
later we want a chasm and the spot
contract right feisty it is not true and
only drop has a signal on both big food
is bad so what is great on yet so we
have two layers the first layer is
basically the toy player it's a smart
contract that it's in the question and
answer and
traitor but that's the interface when
atomic what we call semaphore and
semaphore is like the base layer for
decades now osteo knowledge applications
like this so semaphores what we also use
posnick so smoke simplify so if i stupid
generalize what it does basically is two
things first thing is that it allows you
to register your identity
second thing allows anybody in this poor
identities to signal registry by signal
and means like comcast any string to
these will not change but when they do
that they have to prove that they are
one of the registered identities that
had measures on their self study so from
an attackers wannabe all they know is
that this list of registered identities
and that's the base of signals but you
don't know which singer is linked to
which identity so in the same way
and an attack that noses that they
stopped attendees who have registered on
his lap they notice a bunch of votes but
I don't know which identity is meant to
wish vote unless everybody was yes to
having that consistent well Cyrus or
unless there is only one percent voting
they're somewhat obvious
so this offensive depends on fire to
succeed invested half depends on having
a lot of poor participants in school
otherwise you can use two restrictions I
got over it or not and semaphore is
basically to reiterate is a base layers
for these applications other
applications are like a mixer anonymous
pocket even probabilistic micro payments
so there's a few ideas so this comes
from very high pan and Quebec and from
here and they've been like I think it
under stock states have been talking
about some beforehand this is just one
application
yeah okay so if I have it go even deeper
into the Sun the Sun opposing a star
circuit and any questions about this
seem to do like conventional election
you first have to register everyone
expect oh well I I can't think that this
would be useful for national induction
just because that's what the logistics
way to have these securities the stakes
are way too high and I if someone if
this gets hacked then then the country
actually gets a that is not so fun oh
but what is like analogous to like so
it's for example Singapore and from
that's this way
so Singapore's independence was like
1965 and even then when there was there
were elections people weren't all that
they were secret and after today and we
hear this I mean I mean every five years
of the connection the government says
you're vollis secret because they want
to instill certain a lot of trust that
network will not be attractive and and
it's likes to like to believe that
because if they don't believe that
they're not gonna vote in the way that
they want to become feel out of some
kind of my sense of anything if we don't
have that in New Zealand than plenty but
on the Dow you know not necessarily
going for the best interest of the doubt
we might be voting for some kind of some
other generic sensitive which we don't
really want to rather than like
incentives to try to spend so this is
just one option that might be able to
have that but I don't anything it might
election then it's saying how they burn
three votes every time is interaction I
mean they'd won the votes have been one
after the election so so you don't know
who work as long as ya telling it to a
friend you want yes yeah yes yeah
managing the user will be interesting to
let me use this other these like to
create them yourself so my greatest the
other is myself right yeah I can G isn't
but it's a special
so that's gladness that will be done
suffered of the affinities up
it was the salt all six people ready for
what a serious problem so I put a bridge
is literally there this six thousand
tokens
I could've registered like a couple
other one that's why I purchased at my
I'm certain I date and then I learned I
mean we are assuming that each of us
only has one poor talking now unless you
steal someone else's condition but
nothing I do about that I think he met
that registry registry he has
yeah yeah yeah yeah that's enough
something that we assume that there's no
collusion yeah
okay so this is officially the last
light because I expect everything to
diving into nzk stocks might be a bit
complex I was gonna do this very slowly
and the survey server so it is audience
how familiar are you with Stevie snacks
have you at least heard about it alright
as anybody you go to see a star circuit
okay
if anybody's alright so let's just drop
into the coal chubby
[Music]
we'll listen you know how he is not food
what so who doesn't know like the ABCs
of disaster I go into the pipe wall and
like talk about ruining my vacation key
thing again okay I think that's just I
just divided up on one
I think it is
[Music]
I mean
[Music]
okay so just to recap Zika snacks are
basically the ability to verify
conversation without right so Zika
snacks and basically the ability to
verify interpretation in a initial
amount of time dependent understand how
the national competition is without
revealing certain inputs to the
commutation so for example let's say you
want to say that you have a function
that I have some text and now see this
is a hash function right so let's say
that you want to give this hash function
the Hedgehog W is some consideration so
the first thing we do is that you can
call this function in two variables
socket and now we have now we have a
circuit and the two inputs the first
thing what is W in a second is take the
code of F is incorrect in inliner to
make specific specific language as used
to program the circuit but as a as an
input of you and an input H so we want
to be able to prove that we know W you
want to prove that we know that we that
we know the in hex of a hash without
rebuilding one in Texas so this matrix
is a single angle and this is a common
input
so even though I say that this is
function and this is a socket it's
important to know that we don't think
about circuits like like black boxes we
don't think about them as input and
output it's something that we thing in
terms of whether this equality holds we
want we want this basically encoding a
bunch of SS statements Antichrist
statements inside the socket so that
this circuit or this proof of you valid
if and only if all the constraints over
so we're not like it's not like a
function in the in the traditional sense
so we take a circuit and requires
circuit C and for C it's not going to do
is something kind of trusted set up so
we were just a setup you will take in
the socket and then you run this process
but you can you get two keys and you get
some toxic waste so you might this
process contrast set up you get
verification key of proving key and it
also produces some toxic waste which you
must discard otherwise you can prove you
can generate figures and I get Tom on
how to do this how to discount this in a
way that's less non-transitive
so when you want to generate the exam
proof you need a piggy so with a pinky
so in generate proof
you need a circuit ended up proving key
and you need the witness the witness is
a secret agent good do we need a public
input don't things alright well major it
proved to me in the public I don't I
don't think really verify it when you
need anybody's money money let's just go
a bit thank you yeah so this it's so
it's so many details I just have to go
up there so we generate improve this
wait and then let me get the truth and
when you want to verify the proof be
they use the verification key and the
funding inputs H so if this is true it
means that I know that I know that
witness I know the plain text of the of
the hatch H given the unification key
and the proof it was fast and I don't
know if so that's C it's not 101 the big
problem with taking snacks is that you
have this classic setup where you need
to generate a proving gamification key
but you also need to this can't be toxic
waste and this is something that is
really troublesome to do because the way
that the best way to do this is to
multiply plan accommodation where you
have a bunch of people to do the Chester
setup in step by step phrases and you
only need one person to be honest on a
Polish people who do this transit setup
it's part of House of Taos everybody and
for semaphore we are doing this
increment potential house hotel where we
are coordinating with 120 people so far
to take part in the ceremony to generate
to do the multi-party computation for
transit setup so as long as at least as
long as only one of these people is
honest the whole thing can be trusted
and c-catch did this in two years ago
without sampling of thousand calorie
trance L so this stuff is not new the
can be a bit like mine Danny so is this
be patient well it trying to navigate
all this complex stuff so we're gonna
take this and apply this to semaphore so
just let me mentioned how
circuit this is super simple circuit
that the function that hashes is attacks
there returns a hash
so the semaphore is basically so make
the circuit checks whether the hash
nasty the hash input with the dominant
good measures the hash of the witness or
the secret but semaphore is doing
something a bit more complex what we're
doing is semaphore is proving three
things the first thing is that we are
proving that we have and we have the
valid lover proof to the maca root
starting the smart contract given given
the identity commitment that we might
improve knowledge on so what is an
identity commitment so earlier when
we've registered our identity into the
app we what we did was not just some a
transaction on the transaction thus the
hash of an EDD as a colicky and two
random strings so this is these are
these all these identity commitments
installed in your country as an leaves
of a motor free and they've Ruthann
about the free store in a contract it's
not at the Center for contract when we
generate the burglar-proof we download
all the leaves we generate the marathas
and that's the maka proof and we see
when we earned let me generate the proof
the one of the private inputs it goes
into a circuit and the circuit verifies
the locket proof and only analog approve
along the two other conditions it would
be a very truth
so this that's the first thing we do to
prove that the user is indeed those are
the first condition that needs to hold
for this any questions so far
how does it help in terms of complexity
how much more complex is this then this
is like wasting that is eternal really
yeah
ZK is a super complex right because this
is just like one note if on a single
denomination so what I mean is that for
mixer
each leaf only represents a fixed amount
[Music]
in this case it's just so another thing
a little bit with sequence but this is
recently
and so before the is Michael can fall if
we use a circuit which was above the
treetops 25 us so that's to the company
leaves that can be stories and a
contract which is facing into the
company registrations that takes like 30
seconds to generate proof on a laptop
and that takes like 800 K yes - very
very fun yeah I think it's what I wonder
it has to be positive but for this
year's case we lower the number of these
know that about nervous in a tree to 12
so to Travis like 4,000 basics and
that's likely the attendance of that car
once of the second concussion without
driving
the power of the polynomial
so you're choosing if your power is not
high enough
right then the verification is necessary
even if it's as true is actually false
because we go theory because because
this is only true up to an epsilon and
the axle on is is a function of a of the
power of the polynomial all right I
think I'm sure the D for their customers
we most have met right not super sure
like he catches like it started I will
have to check with people who know the
details all right so anyway so that was
just the first part of the proof now we
want to prove to other things
the second thing gotta prove is that the
signal was winning broadcast at once
which means that we want to prove that
there were no cover that we were to
ensure an economical price so that is
something called nullified hash which is
a hash of the identity image file which
is one of the rented marrow cells has
along with the monkey and when you when
you register it was a contract you also
had a passion along with the external
which is a hassle that question masked
by the users and finally the top so the
contracts thoughts or the enzyme size
mattress and the circuit also ensures
that the hatch is valid
just like my passion in this episode and
finally we also do EVPs a syndrome
gratification to ensure that the public
key that was that's that the whole name
of the the registrant has is valid and
this is a median EVPs be a kid not at
ECDSA tamaki so the reason for that is
that in DDS a common keys are much more
friendly and much of some it was a guess
not and not so much so far ECDSA keys
which means that zk stop applications on
if you have some challenges in terms of
UI UX because these keys have to be
stored somewhere other than users wallet
such as such as in local storage but
just yesterday they're also big
announcement made meta masks when they
have a plugin system that as you have
something fun at keys so there's
something that you can explore and
figure out if there's possibility use
instead of storing their keys and office
operation so just a recap this time
across subject proves three things that
the users identity is one of the set of
register identities that signal was one
intercept ones and that the user truly
almost in here
there was used to that like to Leo Esaki
because they had a sign a message that
is the circuit the circuit breaker is
the angel so and also that we have the
signal that we are broadcasting ahead
answer we are broadcasting a signal to a
question which is hatch to become a
excellent modifier the semaphore
contract supports multiple identifiers
and s how many other questions yeah so
Before we jump into more code can be any
questions yeah okay yeah okay but I will
join it to the maybe I will join it to
the flow of how this whole thing works
from start to finish from the UI all the
way to the secrets of it just look at it
hope some good
all right so that's staff in the front
and look at what we do when we register
so customs at first everything basically
this is like a yeah rather when we
register we generate an identity
commitment and this function basically
hashes together those three things
right so we are using a Peterson hash I
mean a pleasant commitment to have the
public key of the user and and two
random values and this UI is using
something that lifts and publishes the
like and iam might be extracts over a
lot of people graphic populations that
need to use to use and so it says it to
be contract just a transaction when it's
done we just have a user and then when
you submit a question this is where
[Music]
and it's like a so we have to question
that the user sign it you think it was
an inside function and we studied up to
the backend database I think much more
interesting if I show you what happens
of a Vista project if it's done on
training registration is a safe because
we already do that huh train for one
train registrations basically you
instead you just pass along the identity
commitment to the Center for contract
when you submit a question what we're
doing is we're adding it we're adding an
external modifier to these and of our
project and we also for this version of
the building we require the user to send
some keys along with the transaction and
this is what pays to be the hospital so
this fact this is this fee could be any
about but it should be enough to cover
is a field of pupils and then when you
answer that question we have to answer
and we first of all check whether the
question that is answered two x's and
then we submit this to this semaphore
contract and along physique is not proof
whose terminals are a BST cosmic why is
my agency and
and but also these are the public
influence to the Ziggy stock hash
functions are second
yeah
[Music]
yeah but as far as every times identity
bites
right so now let's go one nearly fell by
the exception dimensional we're going
into the center format right
so all this is all it's all value so if
you won't if if you think if you have
nice I'm not an occasion that wants to
use ideal knowledge but you don't want
to play around with building a whole new
circuit this might be why keep it also
helps that warm it through p.m. also
doing like that trust set up an audit
for the central code so what was I done
you wouldn't have to run your trust as a
set of audit for this component
alright so insert identity this is the
function s elephanta LT identity to be
poetry one tree and broadcasting a
signal is where we first base V check
whether it's signal whether this
security system through this valid and
then we just added to the mapping of
Cygnus in Astana track and this function
to check whether the star proof is valid
is here
[Music]
so my proof is
it's like this my contract HUD verified
also this contract is auto-generated by
a library called circle and circle is
the JavaScript based by B by an f3
unless you're right ziggy-zag circuits
and when you buy the circuit you can
complain compound a circuit you can also
also generate this solidity contract
that allows you to write haikus so now
let's go one but one Monday deeper into
the set of all Z K star circuit
[Music]
so in this case we looking at
[Music]
alright so circuits available motors and
me come on it in this case a main
component is the phone this is very
defined the signals so these are public
inputs and these are private inputs so a
permanent list included the identity the
public key as a component propose the
identity commitment as well as the
second child that was generated and the
mother constant as for the timing was
those police actually single and B X on
a non-fire so this is where I get really
detailed and a lot of projects using
cell phone such as CT lower-right also
to a lot well country verification I
mean signature verification about Madrid
about the truth but also it but just in
a different way because they're using it
for verification
so this so that students in my example
so let's say what to verify that the
identity commitment is valid which is
going to check whether the hash of the
three components for the key identity
trap dog energy amplifier matches the
given intensity competent so circuits
have inputs and outputs no submissive
inputs and as long as the inputs are
valid then this occurs well right so we
have a component color person come on it
doesn't commitment which is like the -
function that's for need for staffs and
what we do is that it be publicly the
bits on the public key we do that and
assign them into the Edison hash
component and we do the same with the
identifier and intractable
so thinking about this DSL is that you
need to do a lot like bit level
operations which is super tedious and so
credits all go to college someone raised
mother right and we do the same for
other components
it's not and another day if all these
all these constraints
check out then if also get kissed and
the and moving on the stack you'll see
that this you'll see this it's not on
trying to verify approved potential will
go back to the semaphore contract that
will pass this function will execute
successfully and and that's the only
rule with semaphore so yeah I'd like to
cover a lot of tight detail in this and
there's so much Monica so I would
encourage I'm ready to join the
semaphore society pentagram so
this is where a lot of the research and
development in to see this Knox's
company and this is also where he thinks
a party that mixer that gives us a
fastball it's just yeah Internet's not
working for me right now but don't deal
[Music]
yeah so be good when we go kind of
github you can see the link to the
Democrat group and how much anybody to
approach me for different questions
about how to use simple and if one is
not real and if you wanna apply a file
applications I am writing myself an
ellipse and publishes a and compact
method as you use it more easily and
doesn't write blog posts and a comment
Asia to help developers to integrate
this into yes challenges it's not in two
weeks because I company said by one code
from the mixer by Gooden itself this is
my different covet test that you see
that the UI the UI build is like almost
the same yeah so this is like what
another application of all fishes the
pizza I never talked about this two days
ago
you can basically write when you deposit
F into the mixer what you're doing this
which measures the relative identity and
then you draw your senator sitter and
because he cannot send us things like
that price you cannot expect and because
we have and because it cannot link
deposits to signals it because it cannot
link signals to identities it's not
being controllers from deposits and it's
how the mixer works using semaphore the
base value yeah so just a given to
demonstrate
but just how it's going to download the
be use of the elderly generally the book
improve something that proved to be a
young which sends the transaction and is
a guest users behalf and the user gets
better so it's like a safe design for
identification
any challenges or right there's a ton of
challengers because I guess I guess the
first thing is like subscribing a head
around all the different types of
materials and the types of photographic
primitives that I use but you can even
use like sha-256 hash even though it's
fastened traditional with us that super
slowly stocks and get into them
understanding or like the fact that the
understand hash functions at the top
perform differently is itself like one
of the colors that that people have to
get you to understand this whole thing
because it in stocks and Memphis kind of
different so that's one of the
extractions that we want to help people
not have to worry about and they use
their cell phone initially the name
certifies its I'm still working
documentation and guides but it's an
idea and so all these functions should
help developers to use this system I
will have by 7 minutes to go
maybe I'll take like two more questions
[Music]
like they thought about people like like
sellout down to Miami but it's it Wow
the juicer is around telling about the
book what is there is through that the
ability to any maybe you know if Elvis
fan example my critics of my features
need to like let me spend once but
inviting it might be multiple times
right
some of us official but it was looking
and under the petition that lead that's
[Music]
yeah this is like a separate project
when you also using his lungs to prevent
pollution in Dallas so I think that
ideally - is that using a safety stock
you can make it one plus to buy a boat
because someone could pull together and
make you all you're powerful right now
I'd rather but it's like I don't think
it's to do a little bit of wiping this
is using I could completely this red
circle but it's using similar videos and
similar concepts did you see Phil Diane
stop it I followed his research is
basically how can you prove that you can
likewise nestle this is a very similar
collision stuff yeah there's a bunch of
people trying to do this thank you so
much
[Applause]