foreign
[Music]
we're here to talk today about our
journey from solidity depth to ZK Dev I
talk about how we went from uh salinity
developers it got introduced to zero
knowledge cryptography and went on to
implementing battleships so uh my name
is Ian and I am Jack and yeah like we
said we're gonna walk you through our
journey and uh how we got to where we
are today
um but first off I want to start by uh
thinking the ethereum foundation
um just over a year ago today
battleships was just an idea and to go
from presenting at Denver uh receiving a
grant from the ethereum foundation up
here uh presenting at Devcon today you
know it's a pretty surreal experience so
um none of us expected this so thank you
so uh before jumping into what uh our
journey in ZK first let's start off with
a question what is web3
shout it out yeah please raise your
hands
uh I think
decentralized
all right answers uh I think to really
get an appreciation for what the
definition of what three is so uh it'd
be helpful to look at what some of the
tight ends of the industry have said so
Satoshi oh wait that's not Satoshi
I guess
okay you know we'll go with that Satoshi
and I just want to preface real quick uh
blockchain predated what three by about
five years uh so this is defined in
satoshi's terms of uh what Bitcoin was
uh but he basically said Bitcoin is a
purely peer-to-peer version of
electronic cash which would allow online
payments to be sent directly from one
party to another without going through a
financial uh financial institution uh
next someone we probably all recognize
here as well uh
vitalik buterin uh in the context of
ethereum his definition of what three
was what ethereum intends to provide is
a blockchain with a built-in fully
fledged terrain complete programming
language that could be used to create
contracts that then can be used to
encode arbitrary State transition
functions but none of this would be
possible if it weren't for the work of
Nick Sabo who I coined the term smart
contract and came up with idea in 1994
and his uh his idea of what this eco
ecosystem representative was the
obscurity of a large random number so
vast that a lucky guess is unlikely if
the in if desired the lifetime of the
universe and that's the foundation on
what uh cryptographic Protocols are in
an intern smart contracts are built and
then finally appropriately ending at the
uh founder of the or the corner of the
term what three Gavin wood his
definition was
in short we engineer the system to
mathematically enforce our prior
assumptions since no government or
organization can be uh be trusted
so that leaves us with our own
definition what three is sovereignty and
cyberspace and following from that
cryptography is the authority uh the
enforcer of the laws in this news uh and
set space
so now that we have a definition a
little bit of the etymology of web3 uh
let's talk about the actual state of
this industry
um and specifically some of the issues
that are plaguing it
um personally we see the biggest issue
as being the um almost zealous
conviction in tokenization of all assets
and uh perhaps this might be a little
america-centric but um you know you
could just take a look at the housing
market as an example of an asset class
that maybe you don't want to hyper
financialize and what we essentially are
seeing is that as time has gone on
protocols focused more and more on
financial prosperity rather than the
actual core tenets of what web3 is
supposed to be as as we just went over
um and beyond that uh I'm sure a lot of
you here have heard a lot of talk about
privacy and scalability over the past
few hours
um again from an individual perspective
and from an Enterprise perspective uh
it's unusable a lot of the time so I
mean if you try to make a swap when
ether was at forty eight hundred dollars
you probably paid 50 for a swap that's
hurts
um and while some of us have gone ahead
with web 3 despite privacy concerns
there are a lot of ways that private
information can be leaked and then on
the front of Enterprises they've just
full-blown written it off for these
reasons a 50 transaction fee is a
non-starter and the fact that certain
information is public on a public
blockchain again is a non-starter so we
saw the rise of private blockchains and
those were also ruled out as uh well
they are private and scalable to the
outside you are still sharing critical
business information with the other
validators who happen to be competitors
in the industry so what we've seen is
essentially uh at least until uh
recently the solutions were just not
there
so uh really we think that uh we can
summarize this issue uh in a single way
that that web3 which is mostly become
synonymous with D5 uh defy decentralized
Finance has lost the plot of web 3. uh
cryptocurrency has become this mechanism
for profit generation whereas that's not
really what Bitcoin was supposed to be
Bitcoin well it has appreciated
considerably from being worthless back
in uh 2000 2009
um it
appreciated because of its Financial
agency and stability relative to Fiat
currencies it was designed to be not
censorable or manipulatable you can
print more than 21 million and the fact
that it appreciated in this economic
condition is a consequence it wasn't
explicitly engineered to go up and then
we have protocols like
Luna where uh you know there wasn't too
much Innovation on the side of the
decentralization or peer-to-peer
networks or cryptography but they did
present uh you know a novel algorithmic
stable coin which turned out to be a
financial weapon of mass destruction
a lot of capital was destroyed both for
retail investors and institutional
investors lost a lot of money and not
only is this bad for the industry just
because they're resources that um are
suddenly uh taken away it actually
causes a recession in uh
decentralization in this industry and
this is I think something even vitalik
has brought up uh as we uh create these
insane volatile uh liquidity events uh
governments notice and they decide their
mandate is to exert force or exert power
over
um these industries so as we create more
of these opportunities for them to
notice uh
we lose decentralization so
uh essentially what we want to say uh or
we want to see to have web3 grow uh to
where I think we all see it being in the
future is for web3 to break out of
decentralized finance and become
something more than just a monetary tool
and we kind of see that with like
decentralized science decentralized uh
social media some governance tools are
definitely more focused on information
rather than the financial aspect but
what we really believe is that zero
knowledge cryptography is going to cause
an explosion in these tools so um
specifically you might if if you're um a
little unfamiliar with zero knowledge uh
you might think of tornado cash and uh
how zero knowledge can be used as a tool
of anonymity or potentially even
subversion of central Authority or
surveillance however it's actually
important to note that um at pretty much
its Inception uh one of the thought
experiments for um justifying the need
for zero knowledge was denuclearization
between bitter enemies United States and
the Soviet Union they needed to prove to
each other that that they were actually
denuclearizing but they didn't want to
send uh or they didn't want to allow
inspectors from each other's countries
into their nuclear bases so to have uh
disjointed or adversarial parties that
are able to coordinate and prove things
to each other is incredibly valuable
both in the decentralized context uh
where you know parties are just
disinterested and perhaps in more
centralized contexts like the
relationship that individuals often have
with Central authorities where
incentives are very much misaligned we
can start to build solutions that kind
of bridge that Gap so going
into the specifics again we can uh on
one end we have tornado cash coin mixers
which are alternate tools of anonymity
and on the exact opposite end of the
spectrum with very similar code uh we
have uh tools of of compliance know your
customer anti-money laundering
um and uh moving on uh there's also uh
and I'm sure a lot of you have seen uh
like the temporary Anonymous Zone all
the semaphore stuff
um there's the ability to create an
anonymous social media uh programs that
again allow coordination without any
sort of central Authority and uh on a
completely unrelated vertical we can
construct iff signals which many of you
probably know you don't know what those
are but essentially identification
Friend or Foe signals go on combat
aircraft and uh when they're flying
through an airspace you can basically
with a zero knowledge iff you would
prove that you're allowed to be flying
in that airspace without actually
revealing the details of that mission
and we can
um
start to fortify uh trustless Computing
even bulletproof hosting and again on
the other side of things we can be
fortifying uh centralized processes
specific Ally let's take IRS there's a
little bit of entropy that goes into the
audit lottery so we want to make sure
that that is uh that entropy is sampled
correctly as well all of the parameters
that are used to choose how someone is
audited we want to make sure that those
are all correctly chosen uh improved and
then finally
um
something that is not so new chain link
has been working on proof of reserves
for a while but facility takes the uh
unbanking of Pop
again on the other hand we can have a
centralized Supply chains so uh take the
distribution let's say of alcohol when
you go to a bar you need to prove that
you are of age and the bartender needs
to prove that they are only
um Distributing uh alcohol to people who
are of age and this takes the form of uh
literal cops sending in uh minors to
actually test these places and that is a
reactive solution that uses resources
whereas if we were able to have a system
where you can't even get in the door if
you can't prove you're 21.
we create a lot more we free up
resources for obviously the people who
are checking uh the cops and then as
well it makes the lives of both
really the distributor a lot easier
given the compliance is is managed in a
programmatic way and a proof a provably
correct way
so just to summarize it uh we have uh
semaphore again
um which is uh something that could be
used for anonymous coordination or uh
kyc ammo so what you should really be
thinking is that zero knowledge is an
incredibly versatile tool and how it is
actually molded into whatever product uh
that's up to you so specifically uh if
you are kind of intrigued by semaphore
and you think that you have some way to
contribute there's actually a grant
round going on right now
um I it said uh 14th on an earlier thing
but I'm pretty sure that this link says
uh the 28th so I would uh highly
encourage you again if uh this is
remotely uh interesting uh to look into
that Grant uh because there's a huge
community of like-minded people so
awesome yeah with the background of uh
some of the applications of zero
knowledge let's jump into uh the actual
history and how this came into being so
uh no doubt uh zero knowledge has very
much been much uh somewhat of a
Zeitgeist this past year everyone's
talking about it how it could be used
for privacy purposes scalability but uh
what not many people might know is
actually uh you can trace this Genesis
back to 1985 uh two years after the
founding of tcpip and six years prior to
the first website on the world wide web
uh it was first published in obscure
paper by goldwasser Macaulay and rakoff
and uh really what this paper at first
introduced the whole entire concept of
zero knowledge cryptography but it'd be
about three decades until we actually
saw uh some continue or some additional
work on this uh in 2013 we saw the first
CK snark implemented through something
called Pinocchio
um we saw the first example of a ZK VM
through a tinyrem uh these weren't
blockchain uh specific per se but three
more years we would begin to realize the
uh
you know the opportunity that zero
knowledge cryptography really could
provide in terms of scaling uh and
providing privacy to ethereum and this
happened through uh the proving
mechanism called growth 16 which was
really the first practical CK snark you
know something that could uh handle
almost any arbitrary
computational uh problem and uh encrypt
it
um two years later we would see a golden
year and zero knowledge cryptography uh
Barry White Hat implemented the first
throw up as far as we were able to uh to
uh ascertain uh circum a language made
specifically for writing CK circuits uh
were released by an organization called
iden3 uh the foundation of the zk's
historic which is a different
um type of zero knowledge proof apart
from Starks that stands for zero or
sorry uh scalable transparent argument
of knowledge and uh what it really
provides
um that snark stone is it's Quantum
resistant and it also removed moves the
need for a trusted setup which up until
this point has been a major complaint of
implementing zero knowledge proofs fast
forward to 2019 and Aztec released a new
proving scheme for Stark's called Planck
this didn't totally get rid of the proof
uh The Trusted setup but what it did
allow is a universal trusted setup so
instead of needing to provide uh perform
a lengthy trusted setup for every single
snark you implement you only have to do
one that can then be applied to many
um a year after that uh starknet
released their own ZK VM called Stark x
with its native language called Cairo
importantly to us uh Z cash started work
on the Halo 2 proving scheme which is
foundational for battleships V2 what we
want to accomplish here and uh we'll
talk about that a bit later uh in our
presentation a year after that Mina came
along with the idea of snaps zero
knowledge applications or zero knowledge
steps as well as circum released uh or
item three release circum 2.0 uh which
really with that that's what made it
possible to uh release Battleship speed
one and present at East Denver uh back
earlier in 2022 then fast forward to a
modern day A year later 2022 uh plonky
two the successor to plunk uh allows
proving speeds that are 100 times 100
times faster uh zke EVMS are beginning
to enter the mix uh in the experimental
stage uh that include polygon Hermes
scroll which actually implements Halo 2
and then uh ZK sync as well and then
finally uh an interesting uh application
that exists now is zprize which is a
zero knowledge analog of xprize what it
basically aims to do is uh provide a
list of bounties so that um those
interested in improving the uh
efficiency which with
um zero knowledge algorithms compute uh
can go and claim these prizes
um but yeah no now that we've gone
through the lengthy history let's talk
about how you can actually apply ZK to
uh the evm and to do this you really
have two options uh you have the option
of applying a domain-specific language
or utilizing a ZK virtual machine
um and both both uh methods have their
own pros and cons their own trade-offs
and ultimately when it comes down to is
you know what are you trying to achieve
with your application what's the scope
of it um but we'll uh go through the
pros and cons right here
you know this Pointer's tricky
um so when it comes to a DSL scaling
requires expertise
um but whether it's EK evm the entire
purpose of this uh other network is
really to allow scalability of your
applications
um
uh
with dsl's computation is verified
directly on layer one uh but with GK VMS
technically they are a layer two so all
computations take place on uh set Layer
Two
and then consensus for dsls comes from
the root ethereum network of your choice
and then again uh touching on the point
just before uh a layer two or a ckvm
being a layer two you know you're
relying on an entirely separate set of
security and uh validators that you
trust will uh put your
um eventually reached consensus on layer
one but ultimately it's up to this
external network
and then uh when it comes to dsls uh the
software development kits that exist
right now do their best to abstract away
complexity but really what ends up
happening is uh you kind of have to put
on another thinking cap
um you know for those of us who are used
to uh developing in standard languages
you really when writing to your
knowledge produce can't get away without
learning some of the cryptographic
principles uh underlying elliptic curves
uh finite Fields constructing arithmetic
circuits so there's definitely a lot of
overhead and a lot of investment you
have to put in before you can actually
get to writing your own program
um whereas in a VM uh it's specifically
abstracting a lot of the ZK uh overhead
away so you can get in with knowledge as
a developer and get ahead and running
your apps like that
um and then finally talking about
portability uh between dsls and VMS uh
what a DSL basically allows you to do is
it's a way of constructing your uh files
for proving and verifying 0 your
knowledge proofs then it's up to you
where you want to deploy them to be it a
solidity smart contract on uh
be root ethereum chain it's really up to
you where you deploy to but when it
comes to ZK VMS you face vendor lock and
risk you know you might have a specific
idea of what chain you want your
application to end up on but down the
road uh if you're
you know if the scope of your project
changes you can end up being locked in
and um
you know I
lose some flexibility that way
but we're out we ended up going on is uh
the DSL route and for that we chose
cercom uh circom was an obvious choice
because it intuitively uh provides a
language that closely mirrors the
cryptography you have to learn
um so after going through that headache
learning the ins and outs of the
underlying cryptography you can pretty
much write out everything you've been
working on the past weeks or months
however long it takes you uh but anyways
uh as much as we love story com we found
it difficult to actually go from
beginner's EK developer to releasing
battle Zips we actually have crafted our
own good book called uh awesome circum
and uh you can reach it there by
scanning the QR code or go to
battleships.com resources but I just
want to preface that it's not quite done
yet but come this Friday it should be
complete
um but yeah check it out for sure
we're gonna get that
that finish but
uh basically uh taking the topics that
we think are important from uh you know
someone who's absolute newbie uh uh to
basically be introduced to borderline
spoon fed
um and there are some that are really
well documented um
the proving systems Roth 16 and Planck
and
oh ceremony that is trusted setup for
grass 16. we don't really need to do a
lot for that we are really just
aggregating existing documentation and
putting it in an easy to access format
on the other hand we have multiplexing
in circom this is a little hidden tidbit
that took us a while to figure out if
you read the circum documentation you
will be misled into thinking that you
can use if statements you
you try to use an if statement to
compute a condition to select a
conditional statement in circum you will
get an error called non-quadratic
constraints not allowed very dreaded and
to circumvent it essentially you need to
do something called signal multiplexing
which is where in zero knowledge you
cute both cases or let's say you have n
different branches of logic you compute
all n branches and only once you've
computed every single branch in zero
knowledge then can you select which
branch you want and this is uh this is
an analogy from electrical signal
processing I believe this is how uh TV
channels and cable even works but um the
point is if you aren't familiar with
this I know I wasn't when I was looking
through various code bases and looking
at multiplexing and while you see an if
statement in the documentation it can be
very confusing but um so that's an
example of something we go more in depth
on
um for the sake of time I'm going to
speed through a little bit of this um
but uh we have some stuff that's again
more documented uh which is the
arithmetic friendly implementations of
uh different hashing algorithms which
then uh underlie the signing algorithms
so sha3 and um uh ecdsa out the window
uh we're now using Poseidon or MIM C at
the very least and uh eddsa which are
far more efficient
um we have Merkle trees which I'm sure a
lot of you are aware of but they are one
of the most powerful tools both for
privacy and scalability we can take a
massive massive data set and compress it
into a tiny hash and not only is this
clearly a method for scaling but we're
also taking that data set and obscuring
the data within it while still being
able to operate on it so this gives us
both privacy and scalability so you will
definitely be working with Merkle trees
and then there is first and third party
devtooling the first party devtooling
you literally just have to use
circum uh relies on snark.js to actually
put proofs in the evm and then there's
also circum tester which unless you want
to spend two hours running tests every
single time uh you're going to want to
use something that simulates the logic
rather than actually running the entire
overhead and then there's also
third-party tooling which is maybe not
as required but still is very important
for having a good time developing so
there is The Shield CLI which was just
released I believe two weeks ago they
released their first non-beta version
and you can think of shield as hard hat
or maybe truffle for circon essentially
it um takes you'll see in the battle
Zips code base there are a couple of
bash files that handle the generation of
circuits and this is something that
requires an understanding of what you're
doing whereas The Shield CLI will just
do this for you so whether you're
already experienced with the circums and
arc.js and solidity stack or you uh are
brand new especially it's going to be
very helpful for kickstart starting a
new repository and then there's also the
circumspect static analyzer
and this is another thing in circum the
debugging and error messages leave a
little bit to be desired so having a
tool like uh
circumspect to analyze your code point
out areas where perhaps your miscon
training misconstraining something or
you're just not correctly writing code
is is very valuable so again circumspect
and shield CLI very important and then
finally implementations we've done a
couple of videos and we've got stuff on
there so I'm not really going to go into
it but um the actual specifics of using
zircon
so now that we've kind of gone through
uh all of uh what that is uh again I
think there's like one more minute so
I'll be quick but
um we built uh our original version of
battle Zips as a purely a privacy
preservation tool and uh this is mostly
what we've been speaking to you about
today uh circum so this essentially
allowed us to prove uh an adversarial uh
interaction between two parties where
they could still trust each other uh
without revealing all this information
so it was a great proof of concept for
us to demonstrate
um private information on a public
blockchain but it fell short in a lot of
ways the scalability is pretty trash to
be honest and um the intermediate state
so you're still hiding the ship
positions but um hits and misses all the
different turns in a game all that's
public so moving on what we're now
working on with the assistance of the
ethereum foundation through the grant is
Battle Zips V2 and this is a little more
uh exciting and novel we think
essentially we want to demonstrate using
battleships the generation of State in a
state Channel off chain and then we
summarize the entire State channel in a
single transaction using zero knowledge
and what this allows us to do is produce
these interesting truths so you get this
uh almost immutable or indivisible
object a battleship game valid
Battleship game occurred between Alice
and Bob where Alice was lost we'll talk
about that in a second but um
essentially this benefits both privacy
in that you have the intermediate state
shield and scalability in that um you're
batching all these transactions and um
we intend to demonstrate how that can be
used to drive qualitative insights
without revealing a ton of like personal
information using ELO scores so I think
we'll just skip to the next slide but
because it's kind of the same thing
um again uh battle Zips and and Zips is
a kind of data structure is uh basically
State Channel summary
um where we're rolling up all of the
state that we generate in like a
ephemeral Layer Two we collapse it back
onto layer one as soon as the state
generation is done and um we already
talked about the battleship Battleship
proof but uh there are a couple of more
real world examples that um are exciting
to us take proof of a valid delivery you
know there's a bunch of different parts
that go into it perhaps there's iot
temperature controls or perhaps there's
an inertial sensor on something that's
fragile and can't be moving in transit
chain of custody whatever you decide is
necessary for your supply chain you can
then package that into a single proof of
delivery and what that uh the
consequence of that is that the
participants in this say the delivery
drivers who have no interest in being
doxed on chain uh don't have to be
docked on chain you you can start to
involve them in these economies without
them being exposed to all these negative
externalities that web3 currently
exposes us to and again just another
example which is a little less novel
obviously there's you know snapshot
which is somewhat centralized but
um
essentially we can uh you know take this
entire
um uh voting process off chain I assume
it probably looks a lot like Macy too
actually in in um premise but instead of
it occurring all of the state
accumulating on chain
um where uh in in Malik style uh it's
it's all even public uh we are
accumulating uh the vote off chain and
then rolling up uh a proof that a vote
occurred on this proposal where 65
percent of stakeholders approved it or
65 of Governors or whatever so uh it
creates these kind of indivisible proofs
that uh can be used for various things
so
yeah
um so if you guys have uh any
[Applause]
thank you
[Applause]
sure yeah um
really quick any desire to be working on
this and you're struggling to get
started
um we have I think in uh the battle Zips
resources we have a link to our Discord
um you can go in there and drop
literally any question we'll do our best
to answer it
with the QR
yes sir
um and then are there any questions
maybe have time for like one or two
okay if not another huge round of
applause for Jack and Ian
thank you
[Applause]