[Applause]
yeah so thanks for going to be another
the 10th of a long day so I'm upset I'm
the CTO of the a secret but we are a
very soon solution for theorems will be
for the tooling resources that may cause
people to go private a small types of
private records and I want to talk about
today is a new piece of technology that
we developed in collaboration in
clinical labs a new universal way as
much as its width around your oh thanks
man yeah okay so kind of high level I
got to kind of skim in a bit of an
interview about you know why it's not to
you so why they're important we're
trying to deal with them and then go
into a little bit about into a rather
low level dense about plop this universe
as long inspected and try and I guess
dispel some of the some of the mysticism
behind stocks and actually provides
insight into issues by how they work so
what's the fuss about stocks
imagine everyone is kind of relatively
familiar with the with the high level
stuff that's you can use starts to
effectively make computation free of a
theory why just having a proof of
computations that are actually requiring
every notes to perform computation
themselves in addition to that we had
mercy because with a snug you can hide
the improvements to your proof the
apotheosis of this
if you find the it was an alpha steel
preview but also if you've liked the
identities of the people sending
transactions and if you hide the actual
smart contact code there's been executed
unless it can all be achieved with
varying degrees of practicality so how
does pontifical it's been a rather a
snarky summer what you say between a lot
of them a lot of a lot of new
technologies that have been put out and
yeah focus upon a small part of this
landscape of tech and so I kind of want
to talk about yeah so the intrusions
behind it but it does why do you think
is useful so it's the universal stock
that was kind of designed from the
ground up glass to be viable lot of
theory but by that I mean showing that
the verification run time was fast
enough to be gasps a vintage and
ethereal and proves to be a destructive
relatively complicated circuits on
average can seem a bit hot their signals
as well presently consumer grade laptops
basically and yes inspired by its
predecessor sonic like the first
universe or something what that was a
tactical as it didn't require like a
quadratic a size reference tree and some
and you know if J different fingers
works by control and plan so we
published talk about one well half a
month and a half ago and we'd be very
busy building implementation of a proven
verify algorithm this is also very very
impressive stuff it's in an advanced my
State Department so this is over the BNT
FIFO curve so the feather if there has
people possible and the relevant graph
is the top left this is the certain
times for
like a selection for cervix but very
number of gates and I guess the the take
away this is that there were many gates
a pre-construction on like a my service
probe is under 23 cents and when you get
tons of things a particular seventeen
gates the group instructions on three
things and so this is the entire movie
nearly means the synostosis was
practical for databases on a theory we
estimate that typical like a private
transaction stock will run even about a
hundred twenty eight thousand two eleven
to twelve thousand twelve gates and yeah
this is the theme of the library we've
been building has been a source of
iterations very welcome feel free to
tinker around it so that's the final
stuff so why don't we kind of get to the
guts of house as well and what's going
on with them second and so we use
polynomial commitments meters long so
being hands upon with Sonic and monitor
contemporaneous previous system and then
we sum all these polygons conveyances
because it's a very efficient way of
achieving is a sickness it was not an
assistant effectively we know how to use
the simply commit to pollen Ethel so you
can take of polynomial with a very
health degree which is because an
enormous amount of information and
represented within a single elliptic
curve point and you can then have if you
can represent your snarks template bias
polynomial identity involving other
neighborhood commitments then a
verification algorithm Contessa's
polynomial identity by testing it at a
random evaluation point and have
confidence over they were whelming
probability if you're if you're kind of
snot description holds it randomly
points of a lot of everyone this also
interesting divorces plot from the
underlying
there's characteristics that are used in
sensitive the planning commitment skin
you can run not a solid two curves just
I published at BU closer
essentially did over the in commitment
skin that uses a tractor coral proves
even possibilities as reliability groups
Christine so actually okay so you think
will not make the list of a wish list of
what you need to make Universal to make
it's not obviously me wants a way of
constructing turning a program integrity
for knowledge and services totally done
with addition to multiplication games
that are stitched together to the former
self because this is a relatively
natural way of representing problem
statements when your underlying when you
actually do that when you're testing
these proofs of knowledge in using
persistence that you have used a filter
of particular we want them you know
pheromone running effectively constant
time animals Universal so we want there
to be any want us to set up to be to
each other system and then you can
include arbitary programs as snot
circuits without additional 50 subs in
at a that wealth human creator to set
ups but then you miss philosophers shoe
sizes which is a little bit of a problem
for it there
so you notice last he doesn't is not
familiar with the concept of a gate in
the context of stars okay so basically
the games has ended and the wires and so
ok so basically you have is basically
that the the the primitive hazardous
collaborations that he wants a parameter
in the same way that you can take any
computer paramount and decompose it into
a sequence of mandates accessible
successional CPU ship you can take you
can also take in computer
into a sequence of additions and
multiplications and so that's what we're
doing when we create start snack seconds
we're actually taking these things
equals premise of gates and thus
additionally together to make the
representation for more complicated
public permanent consent and we have
issuance of educates and they will have
given us another bite
and you can make a circuit by stitching
in this case together
we're like the ordering of can see
personal where's Weiss will be
completely Donnelly in a rather he also
probably created by the compiler with
human and you know pretty you have
satisfied Sanders has evolved Co to
prove that all the Y values are what
they they ought to be acting on
interface so you know when you're
stitching together all of these gates
you have to kind of you you you whenever
you make you connection which of your
gates are your federal city two wires
together together as you can have that
possible but minor physical otherwise
and then you've got to kind of validate
that's if you sell odds that you've
actually that you've run the program
opportunity in favor to the circuit and
all of the whites have the current
values and they should have at you
acting constant so fundamentally if you
want to represent a program as the
quantities to the College you only have
to do two things you have to perform an
a little asthmatic so you need to check
that the announced metric relationship
that every single Gators been satisfied
that the two o'clock whites either soft
and multiplied together is you must be
on the wire and there is a point global
consistency you need to validate that
the wires are correctly citing all of
the gates so that if one Apple artisans
are like several other wise of other
games that that's actually done
correctly from the first check is
reasonably easy to do this
the Secretary has been the bane of
unisys not sisters for quite some time
that was something which we think there
now we've made some brother huge of some
huge family so I'll start the little
check because that's the relative easy
part one second
and I like to think about snap circuits
and using vectors assembled angles is
polynomial so what abstracting public
that little bit unintuitive factors
almost as soon as well and then we can
map the effectiveness later on
so in song we have one we want we want
one a let expression
what about gates whether they can also
pick a traditional Gators is suffice the
verification and so you can do this with
a positive selector factors so if W a
help them depart on the vector say look
at the first man acquires the gates into
a circuit then by taking dot products
with these vectors and selector vectors
that kind of defines when you've
compiled the circuit because so they
they they face it by the circuit very or
not be that not be improved constructor
then you can either turn over other
multiplication people in addition games
for one of these indices so this you
kind of clarify if you want so it's one
of these rooms to be a multiplication
native make sure that the QL value at
that you are 1936 Ponderosa Center serum
that I have complications and civility
perdition's you would simply the
multiplication will get sir to deserve
you can also use these selector vectors
to scale up or down values of the wire
speaking to this case necessary and you
also have invented a constant
coefficients of doing it so this is a
kind of example to help that vitalik the
dominant in his blog
never would be healthy to go through the
kindest elucidate a little bit what it
looks like to actually represent
programís episode so this is a small
example where you have a circuit where
you have some input value x1 check that
the amplifier is executors sexual spoken
and so you have their first
multiplication gate to the left of my
wires are going to be feeding X into the
gates of the album should be AB squared
and then in the second gate people that
wasn't planning place square by X well
I'll get X cubed because then having
that together with X and then finally
having yeah that 5 just one small caveat
actually you don't need that much
multiplication table because you can
feed five hits and constant to this game
until miss ball and then the object
should be certified and then you verify
is to check that that's the that you
have actually supplied the correct
y-values thanks ed let's watch the tape
if X is so a little bit more of each so
might be talking about vectors but we
actually want to be asking like verify
personales using polynomial per fitting
so how I treat Matt protectors of
polynomials well the the solutions to
use something go to the brand base where
is any pick so it's a special set of
points on the x-axis so you have a
vector of Telamon tentative something
ten points on your x axis so we use the
reserve unity for a further from the
range of reasons but they don't need to
be this toy example another gospel a
negative was being polynomial web and
one of the special points will evaluate
to 1 and all the rest it will evaluate
to 0 it's effectively a delta function
and you can use these two even code so
to tender-back materials because you
take you map each vector index to
the special points that you're using to
be funny reversible inhibits and then
you particularly in a song so you're
multiply each vector element by success
key to the launch mother-in-law and they
are something together and you will have
a polynomial where at those special
x-coordinates a certain advanced Y
values will be the values of your vector
words this is a relatively convenient
way of representing vectors as
polynomials because it preserves effects
represent and that's three important
thing
so mr. Scheffer don't look here so this
disciplinary series community and if
you're on the mathematics this'll be
equal to you that the my fruits in unity
in Li X will be barman at the G through
some than any other words we use is
equal to zero so we can now take four
more vectors and turn them into
polynomials so we're taking those linear
some submissions earlier we take
elements on the meticulous on you this
will these the selector polynomials and
that uniquely defines a circuit whose
mark and then you do that for the Y
values which define sir one of the good
must satisfy exam to yourself if any of
this is that you can take the vector
arithmetic that used to describe your
gauge equations and directly matter to
polynomial realtor is if you have
effective identity which is equal to 0
everywhere then the resulting polynomial
identity will be equal to 0 modulus this
simple fashion polynomial to give some
intuition about why this is if we
consider like one of the special points
that people that we used to encode these
polynomials so say a peon first like the
second is vectors if we you'd like you
the resulting for neighbors that you're
crazy
let me set the second
unity your polynomials will have the
will be a value evaluates to the
invitation for vectors which means that
if you take a vector identity was equal
to zero then there was a common a
validity or physical polynomial where
and that immunity would also be zero
which means a if the specter identity
holds then the resulting polynomial will
be zero at all of the recipients special
axis once they introduce you in advance
and so the banishing polynomial is the
lowest to be polynomial that is also
equal to zero at all the rest of unity
so you know that if you have a
satisfying assignment you're a second
then this polynomial is he will always
be divisible by that vanishing to the
number and you can test for that so
check that you've correctly
[Music]
by the way feel free to ask such a
question settle anything imagine you
have any questions it's suspected not
than he was so if you have you met
review the bill now now we've talked
about great you can you can check their
every case in your circuit isn't
currently evaluated but have you
technically battery miserable - together
well that's a little bit tricky because
all you need to do effectively is if you
have a look at an apple wire from one
day that leads to multiple amplifiers in
the polychaetes
each fx50 check that that wire values
being copied correctly that's something
like that's a little bit odd nonlinear
and the way that we achieve is applause
with the permutation check and so
limitations somewhat the Heights event
brother they're rather terrifying this
to moments but I will find this trying
to dense down the intuition behind why
do you some permutations effectively
what we're doing is if you take all of
the wire that wire values in your
circuit you can map them to us into a
car market you deform in space you take
the the value of the wire and remember
to look at unique a unique value on
right senses and there isn't been the
results that actually have set up once
one for each of the items you can then
perform the same mapping but instead you
map your you map your Y values to
different form but in such a way that
for example if you have three values
that need to be the same because they're
they're copies of each other then you
want to effectively map those three
wires into the single net space visited
form order and what I mean by this is
for example imagine you have three wires
in your circuit and they need to be the
same values then you can
and kind of create two vectors where
you're you're basically your first
vector is you map your wires into this
corner space and then your second vector
is your mapping the same wires into so
if you're mapping that we want B to be
three like three wires into it so I can
turn this so let's say that we assign if
you have three wires like the first few
artistic imagine they need to be the
same and then you can assign indices gb
is what I see and say okay fine I'm
gonna map the first words at one the
second one to the third one two three
yeah then you also know you to do
meditation so you say okay now get them
at my first wire to coordinate three my
second wire to coordinate to my first by
the coordinate one you now have two
paths you have two collections of
coordinates where those do sets they
need to they if the the Y's continuing
opposite each other in those coordinates
will be the same but in different order
and that's what that's why we why we
call it to permutation the reason we do
this problem Conda to think to go to me
to check the copy registers because we
know how to do with annotations
succinctly and efficiently that was one
of the innovations of plum effectively a
policy that choose the two vectors
identical top reputation what you do is
you inject some randomness and you look
into your into your
measurements so take around a meter for
example and you then multiply pizza by
the index of your that rectum so you
take a 1 you have me to Telegraph it to
me to 80 you have 3 meters a 3 we then
take your fields and you multiply give
what you add 3 means to B 1 B 2 B 2 a 2
is 2 B 3 and so well this is trying to
capture is that those this pieces they
are that they appear exactly once in
both of these 3 and 3 sets but in
different orders from so for example the
only way a 1 plus Peter and consumers
mean look thank you they wanted speech B
2 plus B so musically the same and then
that may be the case if a 1 equals B 2
and you can make it around this
permutation checker you know effectively
if these three says form s equals it by
equals of the other birds to eat
coordinates then in case one of the
enemy or that's the same thang so until
the Oscars is not there today the normal
70 the set of a bonus once you have
those around the meter times will be the
same as the B points and then so here
the final step is defend the people that
will prove to you is that you if you
with just adding one random element into
your kind of collectibles that was able
to prove that you have two sets of
coordinates that have asset management
in a corner but you've not yet proven
that that those those corner tables are
in the correct or they need to genuinely
so he had a second recording um mm this
effectively we take each one of them is
coordinates two more second craters
family man and commissars and then we
take the product of them and so the
point of this is effectively we've met
we've met our Y values in between corner
spaces where the these sets of owners
need to be the same but they will be in
a Verity the different jumbled up order
and so the way to check that is what we
just take the product on them and if the
products the same then we have a mapping
which means that your wires have
incredibly copied which means that
you've correctly a songster stuff
otherwise no second yes yes it should be
sorry it was like that so because it's
okay into an asset today so I just won
so what we ask you since most of all
what's the purpose I mean assistance we
think is pretty cool technology but
without the use case is just a toy and
we aren't the we haven't or that aspect
though the SS missile is to do other
payments to do private odysseas elytis
loans effectively worth all of the
traditional financial services that you
do today in which where you expect it by
default where you might want to use the
consensus of a public gloating because
you might not foster care about this but
you don't want to give it and for in
your salaries being publicly you don't
even that isn't publicly don't miss
assume you plan to focus if they're
public in my training decisions in
public because that massive competitive
disadvantage you're looking to sell and
exit from the last position so aspect as
we has Oconee stance but we have a kind
of a collection of proves that were in a
supportive manner
this isn't plot this is a slightly older
technology were using the smokers
breathing quite recent they're going to
be a recipe to go to interesting so now
we kind of have a suite of three
receivers Emmys generals troops that
allows you to basics financial
transactions where the values in our
group so sense folks incumbents and that
and so it doesn't fall for a finished
where everyone get onto is that this
issue
this is astok trusted senator yeah I
mentioned that the stuff on needs
adjuster seller in teams one and that
one trust ourself is going to be
happening pre immediately after death so
we are going to sign ups to be a bit has
meant to the sermon everyone's as many
people as possible we're going to be my
ignition for with month and anybody can
take parts of these then feel free to
stop the idea is this program is
drinkability even 31 participants in our
ceremony tax policy and destroys the
toxic waste that they generate and a
similar into Z cash the entire scheme
the the the results material system will
be secured the traditional pair of
assumptions so he thought this would be
a common good that will be able to be
used by a lot of different projects on
ethereum Elsa
that was essentially his succinct
proving systems further reduces and so
- what we look like we have a front end
that even she needs you to see fuse
before we discern in a given time and
see if I thought your theory doesn't you
if you sign on the New Sun so yeah I
believe that is true
thank you very much
[Applause]
you