[Applause]
laughs
because it's upset which might explain
all parents work for those people or not
tell them well King requires us back
there yeah we'll really explain you need
this very morning I can just be more
loud so first for those who was not
unintelligible King we will use it as a
short story of how stars party
what are you saying absolutely alright
she's bright attractive for a liberal
for estimating and will instead like
instead of showing the codes we wanted
to show some publications precise atomic
State Building this target which is
unfortunately not the star without the
humidification and also the negative is
here we can quickly discuss education
for medians when you start start for VDS
venture competition starts but at the
end of the presentation
which was burning we must humanist which
you can make out of the fried and
potential improvements to it and
difficulties Wiseman but just now you
will make so the level will be quite
enhance so just be prepared for it'll be
worth can something will lead to
presentation mainly what answers the
question says something happens as a
format as if you don't understand
something like you really won't ask the
question it should price it handed we
should stop and ask your question okay
thank you for coming as Alex told we
won't speak about our implementational
stars called order because of recent
appearance of new proof system such as
born and because of our commitment
skills we decided to give the motivation
of our dog of course it has its roots
its source in starts and we'll start
from the definition of juggs show how
they were born and then I will try to
show how some components of its charge
when they define this chapter fry can be
combined or even for example blown to
achieve for just around times extinction
snack next one
hello there are not with the following
reminder stars I will briefly described
all the steps because organization
called air and a second and justify
itself then I will speak about one
second okay
Jimmy's gait commitment which I still
mostly use now and how we can build you
commitment scheme from from tried and
then I will try to speak about possible
applications of commitment scheme to to
make food transparent snacks okay so
let's begin this is the formal
definition of algebraic intermediate
representation
it's might look quite weird but I will
just explain what the board what what
does it exactly mean and you will see
that it's pretty simple
okay
[Music]
okay and is just kind of register
machine so you choose your parameters F
which is just a finite field which
should be a residue field some applied
fields and other words and W is a number
of registers so just keeps them and
they'll tell them empty is just going
trace is the number of steps that your
program just executes and a cherry stem
we just modify the contents of every
registered
don't plant the program is encoded as a
matrix of size T cross W
but the question is how can what's the
possible ways to modify the content and
in fact is how as jack box there is some
kind of restrictions on how to modify
the values on each step we should apply
the same set of polynomial functions
random called the trace constraints what
they call them P 1 P 2 up to P key and
they should be applied at every step
every such polynomial is a function in
to W variable the first atomic particles
is just all the state of registers and
the next one is the new state of
registers and the most simple example
wedding many of you have shown at my
chance came on as a sequence so the
first register is just 1
- in a second it's 1 2 3 and so on so
the UM second register is just the sum
of the various employees registers and
the function in to the variables is x1
plus x2 minus is equal to 0 what is x1
is y/x I call them all together
producers to be next and then you will
have letters to be Y so I think this is
X and this is y it's one - why - just
apply the sum function and the new value
of y is just the previous value max
and the same set of functions is applied
at every step but sure in real
applications or summer weeks in which
the previous well it's the previous well
and why's the new welcome and the same
set of function applied at every step
and of course just here captures many
functions but in reality you try to call
some weird to service you will have
phenomenal relations which can be cupid
or tragically general imagine and you
can mix the x and y variables as you
wish and the main the main thing here I
want to stress is the difference from
around one caste system when they try to
encode some gadget in tasty services for
example hash function and then when they
try to use it to use service several
times you will need to pay every time
you use your hash function so if your
stop it contains three instances on the
same path percentage function then you
will have a triple number of kids and
the difference in this situation with
just by different was just encode your
guard upon the ones and then you may use
of a billion but you need to have some
bunch of provisions so the sensitive
trains should be applied at every pair
of steps or for example each every the
decent between the services should be
able to one or two but this would be
some kind of a bejeweled party so guess
how many of you are familiar with
miss Frances he was in the campaign
doesn't make any sense
yeah and the witness the witness is just
the particular instance of matrix the
bells of the matrix are just I taken saw
that those relations will revolt that's
it
by the way I have only spoken of
tradesmen strengths another thing is how
to embed bubble inputs and this is junk
by boundary constraints there are just
two bowls of coordinates and well the
first coordinate is just at the step and
we two to a boil boundary gas trade the
next quadrant is the Nano greatest
strength and the value by one so the
body constraints just says that the
value of these self matrix is ever this
is bicycle I think the next one
go back with this guy that's nice this
is an excellent can you go back
yeah just simple sentence you in your
constraints constraint should be
satisfied and
because E is a function every element of
is it is a functioning in two double
variables and the first half variables
is the previous are all matrix and the
next one is the next row this is what is
original
it was like any questions okay the next
one as well over the best way to encode
any proof systems is to reduce them to
reduce even the witness to animals now
we have just the boundary constrains in
the chest and the trains constraints
presented in form of polynomials but our
witness is just is just mattress and
then we need to somehow transform our
representation into the form which is
most suitable to oldest just chance
itself and we need the kind of regime
the roti means that we want to blaze the
valence of our matrix which is a witness
in turn into engine code into integral
normal again this is just the definition
in its books weight and now I will
explain what can be done in the see what
is relative there some some difficulties
but you know it never nevertheless the
main the main thing is the following we
choose two groups I have just our files
view
and would take two groups
Juwan and the tomb to do inside their
multiplicative sir group must build us a
group of our field and the first one
should be of size T in the second one
should be of size W so in practice we
want to who want to be the one our field
to have a lot to a decision so invest
its multiplicative group multiplicative
group is divided by light power - and
our trace length and the number of our
editors to be a positive tone so if it
is not the case we're going to simply
exchange more practice with it then and
when do you want be the junior age of
the first group and Jesus the first
group and nu is the generator sexual and
we just really rate our seven the size
of a matrix with elements generated by
these two groups at least self-adjust
Shaban 1 raised to to him and so on and
this will just use the variable
so the cell with index I J when I waited
with G hi
you might know this your hitch the idea
and then then then I will take the
function f on the domain g1 plus g2 to
have this varies in L and the where they
are on three I minus 1 J minus 1 would
be just a well then see how to whom and
this is this will be our witness yeah
just just for this is very for this is a
very formal definition of presence and
once you do some practical application
of this and just understand how this
works its formal definition it just says
take every row contain a simple together
and do the interpolation over the
multiple kids have group in a prime fell
it's just very simple well you can see
you can see the same structure in many
systems where you want to encode you
witness
so you literally place your witness
values you think is ever existed witness
political and I want to require all this
as witness bullying develop on certain
points to be pulled to my witness
volumes here use the same just take your
video to continue can fit the needs of
all together you get to pull remember
you do you get set up Wallace which is
size T by W so you just need to salute
which is T by double size and just do a
simple manipulation which is that just a
fast Fourier transformation it's from
some practical perspective and less the
formal information even this one doesn't
shows old essence well this one is too
complicated explanation or actually how
it works
the simplest one this is just two
interpolation Ginga Adriatic always
points it treats an old visit like while
used as a point this is a point and
while the previous matrix contains
evaluated at this point is this view
requirement for polynomial and you
strictly defined simple integral of GP t
by W minus one developed by double point
success and optimization optimized
applications I don't think you can put
an eight all together because this is
going to be a large single fifteen you
can say I will have not one but W
witness bullet or else this doesn't
change a start and you see my witness
polynomial number one it's just for
register number one so you do larger
number of interpolations but each of
those is going
my smaller size is this a solid
immunization which is used everywhere
which is used by Stanford bias by the
Rings guys like this is an efficient way
to have implemented but here we don't do
too much about optimizations because the
right through many of them we really we
just tried to explain them as essence of
the start
you notice the superstar itself is this
common typical sympathises of one
eternal and then to have relationships
about the polynomial incentive
relationship model bloggers and concerti
will explain the narrative for say the
last loan equation comes from why to own
just encode this way remember that every
trace phenomenal supply to every pair of
of constraints then just what would
happen if rotate we'll take our mask to
be just the consecutive values of the
group of the second group I'll just
write it down
and new 1x
be
X
yes up to the last one
just the previous set of registers and
the numinous two 1s
[Music]
once we're at X
okay so the first form of these album
level is into double variables at first
until central where is that we just put
it eponymous air the consecutive pairs
of elements of the second group x x and
next we just take the same function and
multiply not only the elements of our
first row but also by the generator of
the first row but then what what would
happen if Project X to be just unity
then to be just unity you just filled
one apparently these fellows will be the
first row of our matrix these will be
the second row of our matrix so which a
X to the 1 then we just quote our
constraint on tech transparence it would
take X to be tirant of the first group
dream then we encode the second pair and
then I could take the rest to square
them this way would be encoded there
third the third pair of rows and so on
so this this equation will hold for all
elements of hottest group and just
written back
mas challenging those parameters our
constraint on normal is the same is the
second level check it from every state
and with representation and our domain
our domain is just as I said
Oh finalmente first group
and so our domain remember you will be
just the project X - - every element and
we know that this element for my second
rule so this will be used region is a
single form its t minus five and this is
very important this is very bad effects
that our group has such that a magical
complex representation was being
calculated efficiently yeah so exploit
the storage of solution with one
exception here this vulnerable to open
every game except the last one yeah in
information from here so it should we
truly Elsa Colin's this one but there is
nothing after but we're in a cyclic
group so who literally it believes the
last role was the first one where
relationship as default we have to pick
at one week our desert but they're still
efficiently template or another was
abused during sentient race yeah this
gives you a diminish over it's going to
talk about the tail yeah just to just
for some well this is three the
condition of course just for intuitions
estate Creek was used by Zachary and
Larry all episode name's Eric want proof
system that you can multiply the
argument of the bull
by the generator internets in certain
cases and this keeps you bike like at
displacement at time displacement or
just innovation is places let's go back
to few panache example with 1 1 1 2 3 i
will only work in them like on this part
of these 2 rows just for now by
definition to do with this whole
interval over X and let's say I use it
Omega is the generator or we get a force
equal to 1 because they have four
elements here by definition this one
blue pieces so one movie this one
it's another one well representative but
carry and this one is too so I just
didn't read to them one by one by
community so why it's called rolling
against its allows you to navigate in
space if I never would sell in terms
they reach a certain time by selections
of thanks now you will one adds a real
application of have separated raided
witnesses for separate registers who
love me to the beginning space still
need to navigate in time so what this is
the diffusion function of over X what
happens if I look it's a function of X
multiplied by Omega squared s will
actually leave me and say rises
oh my goodness nervous oh it's 1:1 here
Omega squared it will give me one this
will give us a song
if I take my modified function at Omega
the first power
give me two so I will displace high time
by one step this way is called the wrong
with him
if any one I choose to live but the
easiest example to see too many ones
here I think you do the same for next
period for us will be my representative
cause it just allows you to navigate
this is why it's multiple yes and for
Z's you just everything you want a
practical perspective well you can
transform polynomial in this form over X
into polynomial displaced one by very
simple and efficient reliable
information which it takes a week you're
not gonna multiplication this is all
three okay yeah so this what you would
have in the practical implementation of
as optimization you don't need to negate
in space even while in the original
papers everywhere it say you take only
witness put it all together is one
witness bullet or note in order to
practice so you only need to the
beginning spacing everything else falls
to be precise it is not from the
original
but by the next one which sports the
operation so here they say you for all
these in every field it to work oh no
it's for all X for which the other major
lunar node is equal to zero so where he
has money to go in our memory but I mean
it's a part of the next so it's not
recycle Li that the stage of not there
are some technical tears just second
come out of domain which I don't want to
speak about just sorry
who from chuckwei but what's going on
remember from the previous slide the
previous slide but if X is a rotten
tomato then should be the root of the
slide construction and he these large
construction is taken as a numerator and
so on on every such and every X from our
domain which is just the elements of the
first group this fraction should be
phenomenal
yeah and we just take random petitions
from the verifier in order to combine
all those functions into one
mr. so that to keep I saw what they mean
by fraction
you actually care just explain less so
you season one help cupid internal is
punishing my personal question yeah but
if you can space full direction I mean
business practice music
for a witness since it means that for
every X for which light we chose the
simple example it is equal to 0 and Q
political is equal to 0 to be divided
one way or another because it captures
people literally at this point admit
that if you do this division and this
construction is not a rational function
but it's a polynomial of degree which
you can predict by the tracker system
just for those technical perspective
Duke wants to have this has raised to
the low degree so this will internal
which will be part of surprise Fulop
drove to very large search County few
constraints like small number of
constraints large degree you would
rather prefer to break in constraints we
should agree to well 3 is not good
because you're always part of work is
multiple to so by 2 or 4 and the large
from optimization expand here's just a
question why you can't / desperation
when you have polynomial which is
that wasn't right but not some function
because you can define it as a function
but you will then see or but your ass
will not be able to see it you well your
mouth piece and put it on constraints
check announced now we just go state XY
as to next steps but you say well I
replaced my x1 by the people which is
perfectly possible Q is just to punish
people in general it just defines you
where it gets very cold just if you want
to fold them there you go since the last
one is well kept
yeah this is a definition y equals I
think it's used everywhere even though
the grocery see brothers good money but
I think might be available and once
again I want to stress that it does not
they let protocol and to the region the
paper but it's nevertheless the main
idea install our only produced to the
poet went to show that a function g GX
is not a rational function by a
polynomial a polynomial of degree which
is the same that the order of the first
group and when it's a tool to august to
check this efficiently the next one
yeah and the problem which we are trying
to solve is vaccine suggesting or just
having some access to function f I mean
Oracle access that means that you might
only compare with some values so just to
verify as well as from the function and
the probe just get stipulation at some
points and we want to and the reply was
to know that this function is indeed a
degree let's talk about the fishes so
you want to have the twelve you could
have this way so well you can trigger
the proofs of G of X is a lot of the
people available for example uses a
permit because it's actually gives you C
to be found is very alternative to what
you want to do today is efficiency
between communication between premiere
[Music]
so you don't want an to check this
relationship everywhere you need also
values and do like linear network
television so you this why it's called
Oracle accent first of all the approver
tells I know some set of bogeys and then
commit to them so we mentioned it's just
to those numbers which you break the
part number by number and give it to
someone you can ask for certain for
those numbers one by one and the service
will not be changed in principle you can
ask frozen but then you do have some
work pitches in norms that you can take
one by one and the small number of
others which will peak from this trusted
source and in in relatives is trusted
sources and marriages those to the pulse
will be not for you to say alone whether
all those those qualities came from
sample in our milk all those as well as
together with some truth which you again
will count as a work from the pool
internal which was small degree or
unlikely to be spawning yahoo proceeded
was a form apart from talking of
innocence yeah
there's no need to equate in other words
okay next one
so that new handsome Austin as Alex told
to query all the vendors follow function
them ID but to know the domain is real
legit it'll be enormous number of
queries and this is the theme we were
trying to avoid and the question is that
one candies we achieved with what
algorithmic number of queries Reggie is
remember is the degree of power with the
self the answer is yes this is really
ingenious protocol the formal definition
of so the problem we're trying to solve
by working in interactive or growth
model anybody is familiar with internal
growth model okay okay explain direct
interactive host
I think everybody knows this B is a
promoter the the Bruce data the
Provos data is not saying just as a
little piece of information they send in
terms of Oracle's edge tables and the
verifier never fire when he received
this table with edge table he can only
query a small number of points this is
called easily model and interactive or
growth model it just combines those to
go those two goals this internet
protocol from which every message from
the prover is a kind of Oracle like
table from which the provider queries on
the small Mart feeds
in response and the next answer from
Chloe is a gated table and Wednesday
wouldn't think about interactive Oracle
proof of activity
the first message format for months
should be an hour Oracle to the function
and we want to prove that it is a
polynomial of degree Kendall in fact
once every every every other Oracle will
also publish a function be the case all
right
so just think of them ideal you have two
functions F and G any functions not
animals and they can service
and then just count the number of points
in which they are different
an example is two and I just take the
relative time distance or divide this
number by its estimate so that my metric
will be between zero and one and this is
just geometric it has all properties of
matrix symmetry that dragon in water
yeah fry fry oxide with them in the next
one these are the parameters of Prai and
it's exactly takes logarithmic number of
queries but what I want to stress here
is the sounds service uses some
parameter Delta our initial function
our initial function which will provide
all the Oracle to throw coracle for each
can it may not be a polynomial
it may be some function some function f
which is which has some distance from
the space of reed-solomon codes and fry
is unable to distinguish precisely the
functions which are accessible normals
and the functions which which has some
distance from the space over summer
coats just the other night I think here
we will do
another solid example men okay so friend
initially problem the kind of bull
remember was promised let's just say we
have a full animal it was immoral
collect we gathered some problems of
birth so for for a capital it will be a
polling of like we happy already knows
as a suitable I don't know just to show
you how to fireworks and we get its so
from the main we get a simulation so
let's meditate with our domain this mole
is just four elements are 1 2 3 & 4 as I
think of a function for a small inner is
just some function for is this well 1 2
3 4 wasn't away the stress by looking at
and I'll say I know that degree of this
pulling our goal and say is equal to 0
so I will just have this a lot at once
and it have a look horrible access to
lives to that taste is a different like
this so when your opponent multi grew
honest I thank you for your ability to
enjoy teacher
those are my invisible Oracle exercises
I would can assimilate him with some
people where I can particular volume so
what would I do and what I'm willing
again as a result was a primary I can
treat all the boxes ones because if I
would I would just interpolate this
locally by myself trusted source and get
the master wizard
but it was well as they got or from the
Greek literally just from some honey
so if I would get this in full I will
interpolate this and see well this is
indeed a bulletin which we 0 just
because it for is this one I would do
the same work and I will get degree
which is more of the cereal but I can I
have an excess terrorism - I can cook
together sweet answer so I can only get
an answer with some probability which is
sums and for a delta parameter the other
parameters will the Delta pressure will
tell me how many points I want to be
sure that this polynomial doesn't
deviate from sample not just from exact
one but from sample interval t0 other
others the same work also exists to
emulations or to Oracle safety v8 in one
hand so in this case my Delta u1 or so
let's say I want to distinguish between
two cases where it's exactly is a
polynomial certain degree after certain
degree or when is one course closed so
it seemed only different than one point
and why is this case but those first so
not into points I am okay was one and
for this so I fixed my promise of the
Delta which will tell me how many steps
of practically I have to run which ends
end of the different practical
perspective will tell you what is the
process and then his name but let's say
I want to be lessons
sir McKay was knell to be one cop so I
will allows someone to keep evolving is
not exactly from the polynomial but from
some function we made in two cells here
that my delta is larger and the property
of the primarily
as to certain conditions which we won't
hear it out we'll give you a larger
sound so you prove size will potentially
be smaller for and if you want to be if
I want to be sure is that this is only
different in one cell with slit a
country bits of security
my firm is going to be like here that
meeting gauge if I want to be sure that
it's different
Dante mama at maximum took two cells was
the same everything
it's a security instead of Delta
parameter supportive will show why it's
important to letter steps but all the
improvements of relative a vertical at
least for now the order to improves the
sound so we improve the second term in
this minimum function and LC say what
it's like what is your delta up to which
you can even use a prayer but we will
not touch this is too much Delta
question so how can you tell me how you
met the number of point that these four
intervals
delayed to the beat of security oh well
I mean this is the songs error it
basically tells you what is the chance
that you were cheated if you want to
explain to claim all the parameters here
that they're all the deep is important
and they think that on the camera is the
Delta we decide we decide how much
according to this prior to Delta Alex
told it means how how much year are we
can take so this is face of Islamic odds
and this is just the job to boom in this
base does the circle of radius Delta and
this is a function which is just in
those Delta blowing for this function
with parameter Delta who was right of
course doesn't mean that this function
toggle I want to stress not yes why not
why this is not important for forced
jobs as I have said we sure that some
functions of we this function is a
corner but if normal notice the prover
is able to honest to pass fry them just
this means that he knows some function
which is in this Delta reduce by this
multiple normal and the only honest
witness for drugs is a phone number but
that may have decoding algorithms such
as sujin decoding algorithm or bullsh
velcome algorithm algorithm we just
gives us the proof of knowledge there
just addition to normal and for the main
say if just prove hakuna was not only
local but the function itself if he is
able to provide any part which is closed
then you just use those algorithm
decoding and you need therapists people
number which will satisfy the condition
but yeah this is the true Yahoo actually
says this is a at least D for life
practical so yeah here everything will
take you before was about employer girls
I mean we assumes and approvals honest
we just need coats at regional problem
the essentially this is a purple easy
food so what we want to say is let's say
the verifier is satisfied with follows
the conditions and like all the checks
will put here it means that certain
values from the Oracle and in principle
criminals or hopefully many resources to
pronounce an Oracle hope so he has
access to all the valleys locally he can
do whatever he wants business if he
satisfies degree mark even if the
vertical was not executive while this is
a polynomial but they we just closed and
there is an algorithm for the proven
himself to take those values decode a
polynomial from them and this polynomial
will be the true business so the bullet
even even used to prevent even knows a
business but he Possible's checks with
also enormous number of bits of security
he in principle would be able to take
all those values and finds it through
weakness easily in a polynomial time so
in principle this is a proof of
knowledge and if permit has satisfied
the rain fire then he can get the
knowledge of Toledo's
this is not raining tweeting
to speed up a little bit so there's
limitations but quite common used I
think it's most important when concise
system and there are many tools
libraries to encode programs in the
Muslim country systems and there are not
so many tools record in stock air so I
think this just penetration as I have
told the property of air saw that John
is just both well on the poor which
mathematicians and the proof sizes large
special where we can pay each term
stocks where the proof is of constant
size but the final part of juggs is
really ingenious and maybe we can apply
some other primitives as mainly what try
shows us that some function is a
polynomial may be able to apply the
strong properties of right or other
related problems and we try to do this
with nominal commitment this is a
definition and just what is going on
Prabhu has phenomenal but he wants to
know - over this point of us he just
always just guesses the commitment to
the small number so we as verify may be
sure that played to this donor won't be
changed well verify silicon
he only knows that the brewer has sadly
known the mind and moreover the
polynomial is of degree the degree of
autonomy was bounded by some parameter
chicken is a top phase then the latest
Epps protocol with us at the brewer to
open the committee polynomial at some
point and verify just opens a revelation
of a polynomial and also send us some
proof of correctness
so that relate to my chair that this
openness is these days related to the
conditional normal self so it's possible
we was thinking about to commence or
something I think I don't have much time
so he took our kingdom each month which
is just that main protection schemes
unity and using no protocols but what
what's the main point here first of all
why isn't some kind of Russian and the
fractional movies is the main thing that
fries Franco squeeze which shows that
funding is not really really really ever
spoken you cannot just keep this part
same thing which is
which wasn't quite right which basically
tells listen same as a bullet on all
feet and even the okapi is the true
politics going on at this point and this
well if you still practice and you will
get to zero waste points because it is
ilithyia narrator and if it's the booth
defenses numerator has a good at this
point that you can divide it and get
another collateral which is just making
you less so you can do this is very easy
this is and relation be exploited by
commitment and else it begins as a set
of space you can implement to how what
does it agree is a blonde with me - you
can be questioners your initial
commitment was actually political after
certain degree and after to you this is
official you cannot you cannot commit
saturation function unless broken down
as if your crypto use this and then
later and opening space you Elsa not
face the proof and say this my
commitment is my sample uses my proof
if everything passes and was a factor of
utility it was to do all of this other
information committed at this point
otherwise yes some of the main thing
that this furniture are a is not should
not be known neither for committee
approval and all for verifying and there
are many zeros schemes such as long or
as a novice taken sewing the only the
only one team because the only one
reason they require the just a setup
ceremony
is it was their ways to keep management
and so you were able to replace it
commitment with something that requires
only as far as the child or against a
child then those commitments Keynes
those zero schemes will be transparent
by my design
okay this is just the main the main I
might want to call the fry based an old
countries much I just want to explain
what is going on first
first the commitment
at an interface we want to be sure we as
a verified one to be sure that the
function under commitment is a phone
number not soundest
random random set of wireless and the
commitment here is again Naruto as in
Pride and so we run one it has a fry at
commit phase to be sure that the
function of the commitment is a
polynomial and then around another
instance of private over face but this
time with respect to the August fraction
and again we're trying to show that this
abdominal I think we'll skip the proof
this is the main idea why why oh why
this this book but there's one one
important thing between the gate
commitment beyond the private and
schemes as told some in second fry is
unable to distinguish between Domino's
and functions which are close to them
with respect to of having waitress so if
we are not sure that our function can it
stays is not even a polynomial which
function will open later and the deal is
this is our space with some goals or
just who do you promise this is our
function of which the brewer gives no
access to this is just just the circle
of function f and the Westham intersect
at several numbers the fact this now
commitment scheme will only show that
the opening
the opening which will be done at
open-face will be the weather of almost
one of these polymers at intersection
and there is one special case when Delta
is chosen is chosen to be the Ichiko
tech writers parameter in this case
if there are any intersection between
our function and the space of problem
proponents of our degree the
intersection will contain only one point
and this particular case okay just may
think that facial commitment at approval
was not to the function but to that one
one point of intersection but when we're
trying to apply our commitment schemes
- it's real protocols such as born for
example we apply them to witness
Panama's inform scheme the verifier us
approval to cope and available with us
phenomenal and we may think that any of
the possible detection available with
stone Demasi
it doesn't really matter but there is
one one positive the next one
this group idea was stupid for now this
is the relaxed version was intelligent
reduce and her last question where the
dissection contained more than one point
and he will show that the opening is
related to their to the one of inventor
section and another theme in porn
indicate commitment is not used on the
is not yet only to open the various of
witness panels their commitment is also
used for speed-up calculation of custody
what I mean about the jacinto jacinto
animal and causes our problem this is a
phenomena that have known for both a
proven and the verifier but it is a very
less degree and then the blue asked
developers they preferred to send to
send the opening of this constraint
bernama
at some point because hidden you don't
want to do a huge amount about to be
late my degree and women speak about it
commitment but know that you can even is
received then the open of the camel or
the commitment is specific specifically
normal and we just share that the
commitment is just is related to the
content or normal but in this case in
this case there are several other
animals to which no to which the office
may provided and when I speak about
constrictor enormous this means that the
prover might send the open to Nauticus a
phenomena which means that he sent the
answer to another constraint system to
another problem this is the difference
between with the spa animals and potato
animals and so the goal is problem
evolution problem because there was no
significant number this is the
polynomial which is known for both sides
and for which the verifier wants to get
the opening just to speed up to reduce
his complexity and and so on and the
solution to the problem is the following
this is our space again we
[Music]
now we're just the total number to the
variable normal so this is inside our
space little Jake the parameter Delta
and there were some other polynomials
with these generators but that is East
at Starbase the bundles are small for
both of us at the start of protocol and
so all other one of most of the points
the circle are known to both sides at
once so we just change some what you
want with such property that the bearer
of our equal number is different from
the relevance of other animals in this
zone and this will be 0 our constraint
phenomenal and also just 1/2 and if I
want such a poet such a f0 of my one if
not equal to Phi Phi 1 4 4 very provide
greater we hope that one that make sense
and this is this is the replacement of
the search of such a rebel said sorry
don't resent much this some kind of just
as a child this list very huge decoding
the photos of animals may change my
amount of time the socialist point is
also a Sun God but this is
which was the German it was and this is
food just as a child and there was no
need for some secret parameters as
journal in kid commitment and here here
he previous protocols which just opening
people open schemes we divide by just
one life function and here I was just
the point which okay so tell face and I
too is just the point which the verifier
is not open the very edge and you as you
us is a function that just interpolation
but wanted to publish the function of
those points with respect to various
that one NZ to once again the chaplains
the weather of zero at seven a point
which we try to open and develop prior
to failure of opening and do it is known
a difference from committee from
American to scheme any questions
I think here I actually summarized it a
little bit differently
so it also counts as a problem of the
political relationship everyone knows
that your article lemma which tells them
if you want to satisfy relation like if
you care for their own a certain degree
that has a random points and this is a
great word as around the point a
probabilities and people have a people
has a root is negligible in a large
amount you like as a fancy price right
just approve because this particles
exist yeah
so well in principle if you go back to
go all the way back to the start
principle let's say we can heavily this
is deep a life particle which we didn't
cover but there is away from beginning
to sleaze check is around employ and
share you Curia good I mean his around
the points everything here you knows the
degrees out front so you can just check
and guess so you can make the check this
enormous soundness and to bring a small
price if you do it mess around the point
let's go and you can do this the problem
is as Costa says we worked was in the
frying pan dulce parameter Delta and if
you help a small you prove sizes large
if you did building is larger for a same
summer your first size is smaller assume
really want to work with a large Delta
in starts it's not the problem you take
a large now life you got that right
there was some lubrication exited that's
given you take large Delta so you can
see you have this intersection to the
principal as a random point you can
actually take any of those polynomials
and pull the volume for this one of
those as a random point and you can do
it for everything becomes with this
equation well up to something certain
example and the best is how we can
satisfy this equation at a random point
as well from a polynomial
have this oceans is around the point for
another one you have this option like
this setup options and you can pretty
simply gets some espera persistence like
it will depend on another average size
for each volunteer know like how many
others you can feed from these
intersections and the number of
polynomials / fuel size this is very
simple but it's dark it doesn't matter
because even while we pulled all those
volumes you actually set this by every
constraint biggest constraints known is
a very fire as a set up space so in
start a fire literally check having
expanded this is quite hard to mutations
my kept optimizing constraints capture
chasm efficiently computable in narcs
which don't work was layered circuits
like Ross 16 everything missions of
Parowan CS plonk with an us organization
sonic is an us organization your APIs
are be three circuits so you have to
encode your problems a cow becomes if
you're a fire otherwise very fire to do
so safely apply because paint which is
when you're working or adjustable a temp
large degree collateral which is still
with your work but if we do it namely we
cannot use this just mainly use this kit
for constraining polynomials because
they're different so your content and if
you allow these kids in principle let's
say one of those points
but nothing stops the prober delicious
burger from competing all other
constraint pull animals and make you for
one of those actual witness for a
solution is trivial it just settles
there so you cannot stop this you cannot
predict it up front so in my commitment
schema can only allow this case because
you cannot allow the prover to she was
just not peeking from some set of
Wally's but actually to begin another
problem so for a commitment scheme may
you apply it you would have to limit the
Delta to this case and this Delta is
equal to roughly one-half minus
something this is not too large its own
us first some certain sounds your
process would be larger than if you
would allow predicate so now we have to
eliminate well now we want to try to to
increase the Delta so let's say we need
to work with this case we need some kind
of second chapter in this case which
says it go back on distinguishing
well in this case we what we have to do
is we need to second boundary so with
those our second one there is a set up
as satellite in principle since the
problem is nobody was prepared the great
fire weekend highs reduces three with
completing all of those full animals
which are its intersection and like
begins a wall is a wall unit field
whereas they're all different so we can
use this in reality we will not with us
will pigs around the point this is small
number compared to the fill itself so so
chances there 80 of those two has the
same volume as a random point is still
eligible so we can be quite sure that
we'd be twelve and proven cannot now
change the problem and after this we're
okay possesses help back to this case
because we knows that problem now so the
power constraints are fixed as a set up
space where a cave is preferred having
some freedom of choice from set up
Wallaces around the point but still at
the end of the day he will not be able
to satisfy sums but we know a
relationship well similar to start the
pockets difference is much simpler the
end of the day you still will be limited
by particular truss analysis
this part is nonlinear problem where she
got dissolved we got to know people
versus soundless aerosol particle which
was for which we optimized about
additionally so now we can have a larger
Delta potentially
limitless on the right part and this
will gives us a smaller approved for a
safe sound with you which you think ever
was it allows you to have full benefits
of sobriety but for every pro system
which just uses and demands of yeah a
lot
the last thing down here gestures I said
the colonel Kaminsky with the sternum
for witnessed animals the relation
scheme with Jasper as a child for
character animals and it will be blind
for some zero-knowledge schemes we
caught both a witness polynomials and
their content on memo and then their
witnesses in constraints enormous
polynomials and then just wear the veil
is at some point and check some novel
relation between them as used schwarzy
bill this is just exactly bond where are
they
for example that constraint polymers for
banca those electrical members cube
collect you write multiple
multiplication so on and he just sending
random various is for assimilation of
interaction but the final step of
protocol is a checksum relationship
between animals upon which our customer
normals and fixed at the chocolate which
are called our just problem and with
this phenomenal possibly CJ our
constraints will be just the other and
he advanced areas particularly if this
relation holds if it doesn't called
attack at one point them with a random
probability then called at the sweater
at the space so we just need to check
this relational point and for this we
use the chemical scheme to open the
values of witness polynomials at some
point C of our choice and use the
relation scheme to open the world
at the same point see just to speed up
the calculation of Earth prom terrifies
point of view and then to just check the
relation and the siege it seems like to
be in a full the last one it seems to
achieve our goal which is a system which
is for just balance
okay the chakras is logic but the search
for the Point C but nevertheless
topology
it's exchangeable at Wonka 716 and as we
replace our chemical scheme by fry which
works in interactive Oracle link module
which is just caches a song there were
two commercial constructions it is
quantum resistance resistance so that's
that's it
any questions yeah you forget to mention
mentions of this in principle because I
get definitely there was when we are not
bound by any year parameters and just
too tough so main when we take as many
levels of recursion as we need for our
aims all purposes
[Music]
first of all it's we don't try to make
the grow system it can be okay it just
allows you to take into proof system
which is masculine or commitments and we
shall send codes constraints or as a
program itself as a colon or no and all
supplies the city well you can call it
food restaurant if I mean yeah you you
think the Blanc is a fungus well it's a
pro system it tells a decision and just
the east based and the fact that you can
commit to someone will have interpreted
as a random point and then obviously
it's a random point it's out of a system
where you have in mind or not trying to
apply so long and to replace the kids
management which requests as a child by
new commitments and relations in fact
that we need to our vacation time is
even to operate I mean sugar girls are I
would it be run time recognition
approving well for now for you do
progressing exactly just twice lowers
inverse but should be should be
optimized to the same level yeah yeah it
should be to be the same speed because
here or fried particularly capital order
extensions of the module so which means
that you just take the point of degree M
and you have to calculate equity of
like sixteen pound which is like which
is a large to share but there's only
like now it's already less than 30
percent sons of work so the rest doesn't
work is just actually a little petty but
can you still look free it it's fast
it's still not free so yeah it should be
on par for replication we will see what
what will be there it's a pasta - oops I
mean now it's Elsa freedom of choice if
you want to be transparent plus repairs
it you can do this or you can use this
if you're don't need recursion and I
mean if you've already has a transit
setup in terms of powers of towel for a
cape commitment you can just take those
and if your beeps good very problem you
can use it it's not a freedom of choice
I'm not even talking about like exotic
instructions where you can use the
transparent parts of transparent one is
like water levels of recursion and then
you can do the final one with kid
commitment because now you don't have a
problem with curve cycles for sarsen
like that very friendly curse because
here you everything wants to build as
already departed for fill the sky - in
DC - which is already a requirement for
every scene for polynomial relationship
and this approach systems over a
parameter what do you mean it does been
just rented means you don't even trust
setup then four key commitments of the
curve
yeah well key commitments so small is
outreach the unknown so entry to deserve
an agreeable so you have to produce
yourself out there are wait I'm not we
know there are ways and efficient
ceremonies
uses and it's still commercial it's not
per circuit facets but because there's
only can you come in with this universe
on it just requires
it's linear in the size of the circle so
if you want to do a really huge circuit
like I'm able to for all these
parameters the constants I said yeah
well just for simple means well now you
have a freedom of choice or to fill so
you can get your multiple domain of the
enormous enormous size after some limit
of course but here is there as well
through certainly is a practical limit
on the size of the key commitment or oil
to a chicken to me most in terms of the
storage is a parameter and if your penis
in a framework example of metal of
relationships usually you also found
advisor multi could give several sites
like for a number of recipients so
totally fine by the way human place kid
commitment to even born like systems by
darkness but to the same thing
yes because its commitment coming its
commitments team service and for all the
depends on accessibility if you take 100
beliefs with another so it's just a
retinal trace now it just should be 16
if you want to work with at least was
was the Syrian smart contract this great
fire yes there was an idea of like for
the proof sizes
yeah for original commitment scheme
where we wouldn't allow where we would
require some uniqueness I see estimated
for 228 : a role for some types 16 80
kilobytes without some strong
optimizations for relax brother for a
unique liquid in Vegas restrictions
should be 68 in a kind of worst case
without documentation I cannot give a
number of a septum ization because I
kept trying to imitate yeah for
indication if we can use this to request
evaluation scheme for set up along
normals it should be reused like five to
six times 20 kilobytes limit without
optimization by the way maybe there was
even no need to find such points set or
ablation schemes we maybe we may just
say that this is kind of swansea
impossible suits the set up a transfer
ability argument here on this side for
Allah
right for recursion there's only six it
matters is this circuit size if you have
a plastic very fire biggest with it it's
only staffers will be publicly verified
for everything else you have your pro
sizes in within the private living so
well it's very fire serving it will
depends of them choose the cache
functional so like how you make the
transcript or principle procedure but by
assuming like two twenty three to four
pull internal what it should be what
smaller well recursion gives you such
trade-off between society okay I think
it's just time but because it was a long
session you should cover your brain
[Applause]