{"id":"THTVKXYRgZY","title":"NEAR Whiteboard Session with Zcash","description":"NEAR is the Blockchain for AI\nWebsite: https://near.org/\nNEAR AI: https://near.ai/\nIntents: https://near.org/intents\nChain Abstraction: https://www.proximity.dev/\nSharding: https://nearone.org/\n\nFor the devs\nGitHub: https://github.com/near \nDev Docs: https://docs.near.org/\nDevhub: https://devhub.near.page/ @NEARDevHub\n\nConnect with socials\nTwitter:   / nearprotocol  \nBlog: https://near.org/blog/\nMedium:   / nearprotocol  \n#NEAR #nearprotocol #NEARAI","channel_name":"NEAR Protocol","published_at":"2025-04-14T00:00:00.000Z","thumbnail_url":"https://img.youtube.com/vi/THTVKXYRgZY/hqdefault.jpg","transcript_text":"Hey everyone, welcome to another episode of the whiteboard session. Today we have uh with us Shan Bo uh one of the key people behind Zcash the original design as well as all the upgrades since then. Uh it's uh great to have you here Sean. Yeah it's awesome to Yeah. Okay. Okay. So let's dive right in. Uh yeah Sean, can you give us an overview of how uh Zcash works and then we can you know dive into the specific topics of how Yeah. Yeah sure. So I can explain. So Zcash comes from this academic paper from like more than 10 years ago or roughly uh called zerocash and zerocash was trying to think about how do we get uh private payments like like in bitco or uh payments like in bitcoin and cryptocurrency but completely private and private means that at least for the from the perspective of uh the zerocash paper that introduced this these concepts is that transactions should be as indistinguishable from each other as possible. Mh. So whatever a transaction whatever value a transaction is spending should be as indistinguishable as any other transaction. So you can't really figure you can't really exclude or do set exclusion tax or whatever and also the values obviously can't be public or any other details about the transaction that would let you to uh violate anyone's privacy. um depending on who you talk to, it's uh you can kind of see it as maybe the transaction is encrypted and um uh you don't decrypt it for anyone, but you use zero proof to demonstrate that the encrypted version of the transaction is is valid. Uh and that's it really. Um the exact model I'll use the whiteboard cuz we're here. Yes. Uh the exact model, the way it works is um we have this uh accumulator. It doesn't really matter how it works. For our purposes, I'll just call it cumulator. And whenever we send somebody money, we create something called a note. And again, I'm simplifying things a little bit because this spans almost a decade of of development. But uh basically a note is a public key kind of like in Bitcoin and a value. So you would call this like a like in Bitcoin you call it a UTSO and uh you have this note and then you have this thing called a note commitment. Mhm. Uh and the note commitment has some randomness R whatever that uh blinds it so that you can't um so that it it can't be you can't get any information about the PKMV that's hidden inside the note. Yet you can it's also binding because you can reveal the note uh data and the randomness to reconstruct the commitment. So when you create a uh new uh some value send some money to somebody in in this uh protocol you create the node and the node commitment in a zero knowledge proof and the network will go and take the commitment and put it in this accumulator. Then later when you want to spend it there's another thing. So we'll call this the note accumulator and then uh you could call this maybe the spend accumulator. Okay. And in this um when we go to spend this note there's also some other information in here. Uh again I'm oversimplifying but maybe we have some row or some some data in there. It doesn't really matter. The actual technical way that it works has to defeat a bunch of different attacks. So, it's more complicated than this. But when I spend this note, I reveal reveal a zero knowledge proof. There's a witness into this accumulator that tells me tells everyone that I know that a note exists and I reveal something that allows everyone to see that I spent. It's some deterministic computation of this commitment. We call that a nullifier. and this uh nullifier. It could just be this row value, but that's not secure. It's something that's determined by the node and the row value and everything else. It's some it's some function of of the commitment or the data in the commitment or something to do with the no commitment. I see. And uh we reveal it and it's just from everyone else's perspective, it's just a bunch of random numbers. There's nothing that you kind of like a hash or Yeah, it's a it's basically just a hash um of some secret. It actually is also a function of some in practice uh at least in what we do it's a function of some secret uh values that you only know as the person that is spending the note. I see. So in the zero knowledge proof you prove that you know the secret you prove it corresponds with the notes public key and you also use the note uh the secret or secret derived from it in order to to compute the nullifier and then you reveal this outside of the zero knowledge proof. So you could sort of see this as like the boundary of what is uh visible to the public versus private in the zero knowledge proof would be something like this. Um uh except this nullifier um sort of whatever. Anyway, so uh so all the nodes on the network store these nullifiers in uh some table or something and whenever someone spends some money and puts one of these proofs out and these nullifiers get exposed, you just go through and make sure in this list that you know the nullifier hasn't been seen before because otherwise you're trying to spend the money. So the nullifier is public. It's all that thing is all public. Yeah. So uh let's see what else. I mean that's pretty s it's pretty simple the way it works. Yeah. Go ahead. Yeah. Yeah. Yeah. So maybe like before we dive into the kind of technical details of how this stuff work. Can you just like walk us through like how a transaction works from like a you know user perspective like if like user A wants to send to like user B some you know some some tokens how how how that works. Uh so how the transaction looks maybe. Yeah. Something like that. Yeah. Yeah. Okay. Well uh I guess it looks something like this. So we have uh Alice and Bob and Bob sends at least this is the way it works currently. Bob sends an address and uh for our purposes that's just a uh that's just a public key basically. Uh they send some PK. Good enough. Mhm. Alice takes that PK and creates uh so I'll go through what Alice some of what Alice does because the symmetry later but anyway Alice will um uh create this this this note object that I was talking about for for the funds that uh they want to give to Bob and uh the note obviously contains this PK value this uh you know row value um uh and and obviously the value that they want to send. Alice wants to send Bob like five Ze or something like that. Um uh Alice also picks some random number. So here's here's the node commitment. Alice also this value um sort of gets exposed uh sort of in in the way that Zcash currently works the value gets exposed as some homorphic commitment to to the value. So like VG um RP prime H or something like that. some some this is a bud some commitment to the value. We can use that to make sure that the balance is correct inside the transaction. So this is this is the this is what we would call an output inside of the transaction for in like the Bitcoin model. Okay. Um there's this commitment and this commitment becomes public. Uh this is public and we have a zero knowledge proof that takes all these commitments but also all these uh spend objects. So these are all the spends. These are all the uh outputs and uh the spends obviously have the the thing that I was referring to the nullifiers. So there will be multiple different nullifiers but also there will be more of these uh encoded encrypted values of uh VN1 VN2 that look that behave like this V value that get exposed publicly as well and then we check to make sure they're balanced. So the V is separate from the commitment or V is the commitment. V is a V is part of the note which is committed to. Okay, we expose V because we're going to have multiple outputs and multiple spends in a transaction. We need to make sure that the sum of the uh spends minus the sum of the outputs is zero or the residual fee whatever fee. So we end up just adding all these together and then adding and subtracting all these and we get some oramorphic commitment to like the balanced version of the value and then using like a schnore signature or something on the outside you prove that uh that that it that you know the key that you know this H or whatever and you whatever um and that it's balanced. Mhm. So the the magic in Zcash is the to demonstrate knowledge of this commitment or or sorry well you have to do that but also knowledge of of these the commitments that you're spending there's not only so much space on the whiteboard especially when I write so large anyway uh you uh have to prove that one of these commitments that you're spending this correspond with one of these nullifiers exists inside the accumulator the node acculator um that's pretty easy if the node accumulator is something simple like a like a merful tree and so uh you just prove you have an authentication path into it and there's this other thing that we call an anchor uh it's not that important but basically it's just some previous Merkel tree route of the emulator usually a recent one um and the network just says that certain anchors are valid because they've been the at block boundaries we check the current route of the accumulator and add it to a list valid anchors and the anchor is the route that all of our spends use as a reference in order to prove the authentication pass. So in the zero moment proof we're proving we know authentication pass into the tree to commitments that look like this. We know the randomness we know uh we don't necessarily know the secret key but for our purposes is good enough. Mhm. Um we and and so on and so on and uh and then we also prove that we know that this nullifier and that we computed it correctly and we exposed it as part of the spends as part of the outputs. We prove that we've constructed an output uh with with a value the zer all doesn't care well public key we put it in. I know our recipient will care when it gets a bunny. They don't care about that. the uh we don't the zero offer doesn't really care what the randomness we picked or any of this other stuff. So uh in zero true for derivatives we construct a commitment input of values that we want and then we expose the uh theorphic commitments to the values and those are exposed but they the commit in itself is also exposed probably and then the network will do the two things that it needs to do. It check well three things. It checks the proof but then it also checks but it checks to make sure the anchor is valid. So, so the accumulator that's used inside the spends is valid. It then checks to make sure that these nullifiers that are exposed are actually um that haven't been used before in a previous transaction. And then it takes this commitment and it adds it to the node accumulator. Yeah. And boom, that's min plus or minus some uh extra cryptographic derivation key structures and things like that to prevent certain kinds of attacks. uh and and for defense and depth against other kinds of attacks, we add much complexity to it that's well justified and you get mostly what our current protocol is actually what our protocol has been really for the last 10 years but we've changed it over time and just you know uh tried to make it more robust or tried to adapt to new proving systems or whatever. Yeah, pretty much it. That's the structure of the of a of a payment that uses the zero cache model. Yeah, for the most part. Yeah, it sounds great. So, just coming back to the how the transaction actually works. So, basically Bob sends this um uh address or this public key to to Alice and then like what does Alice do after? So, Al so Alice creates this transaction that I just described the the the manner um it gets mined. Now, one thing that happens that I overlook because I'm getting ahead of myself a little bit is that this transaction doesn't this just contain the the the nullifiers and the commitment and everything else. It also contains the cipher text currently. This is actually a problem, but I intend to help fix. But uh it contains a cipher text that's encrypt uh it's it's uh and sending the details about the note like this row and this R value and the V and all the rest of this stuff to uh encrypted to the public key to Bob's public key. Is it encrypted by Bob's public key? Yeah, it's using a diff helmet key exchange to uh uh create using OKP and all that stuff. And so, you know, it contains an EPK and an ephemeral public key that's used for the exchange because it's just the onedirectional communication. And um it gets mined. Bob scans the entire blockchain and looks at every single uh Bob scans all the transactions, looks for cipher text, uh attempts to decrypt all of them, will fail for most of them, except sometimes it'll succeed. And when it does, it will take and try to check to make sure that it it was actually a correct commitment. those being sensitive some value that they can spend and if it is that they'll be able to reconstruct a commitment using the information in the psych text and then um uh then they know a authentication path into uh the the noted accumulator for their commitment and then they could spend the the the money later so I see to somebody else and then this diagram just completes over and over I see does does it mean like in order to transact uh between like let's say Alex wants to transact Bob, they first need to establish connection between them. Like it's like a just like a protocol. They need to kind of there needs to be like a kind of actual peer-to-peer connection being um so I wouldn't mind if that were the case. However, uh well, so there is some sort of channel obviously Bob needs to communicate and address to Alice. Uh the manner in which the channel's established is up up for grabs. That's it. For example, let's say Alice wants to send Bob some money, but Alice never or Bob never gives Alice um uh an address. Y Alice could do all this on behalf of Bob and give Bob the information that Bob needs in order to spend the money. Like create a secret key, create a secret key for Bob, all the rest of this stuff and do everything and then create the transaction and send Bob the money. Bob Alice could steal the money if Alice wanted. Alice created the money. Alice could give this blob to Bob on a on a different on on some channel and channel. Okay. And and so the direction in which some and in the the flow in which some of this stuff happens uh can depend. But yes, there needs to be some way for Alice to communicate to Bob or Bob to communicate to Alice. um either a public key or y here's how to contact me so that we can establish a secure channel say collaborator make a transaction and here the information you need to spend the money send it before I do or there needs to be some channel error yeah and both needs to like locally maintain the knowire uh yeah so now that yeah well in this hall here where Alice sends the money voice. Alice sends the money but Alice doesn't really care. Sure. Uh the nullifier bod will Yeah, boss. Yeah, B needs security nullifier appears on the blockch or secret key or whatever. Um so yeah, Bob needs to uh Bob needs to know what the nullifier is in a simple model. Bob just needs to know what it is and and prove it and and reveal it and then hope that they didn't get hacked and steal their money and reveal a nullifier. Now uh um in the glorious future we might have a different kind of protocol in which uh Bob proves that uh the nullifier that they have for the note they're spending isn't in the spend accumulator or at least at least assist in in demonstrating such a thing. Um, so they would need to maintain and really care about their nullifier a little bit more than just revealing it and letting the consensus take care of the job of making sure it's on the spend accumulator. That's where some of the scalability uh stuff might come, right? But but in order for Bob to be really sure like he cannot just like trust some like RPC node telling him what what the nifers are, he probably needs to like run like a kind of light light node that actually tracks all the nars that appear on chain. I I mean honestly I I I don't think so if Bob wants to if Bob is Yeah. Well, I mean obviously if you ask a server and you say here's a nullifier, has it been used before? The nullifier or the the the server should give you evidence that it was. You show you the transaction that was mined and say here's the nullifier is public. So um but in practice uh if Bob has their private key then nobody else has that has has the inability to create a transaction with that nullifier. Mhm. There's there's no way. So as long as Bob hasn't been hasn't lost custody of their keys and they don't have to worry about someone I see they need this authentication craft into the tree and as trial and more commitments are being added to the tree. And uh you need to advance the frontier of the trip frontier uh your your authentication path as time goes on. Otherwise when you reveal uh otherwise we'll spend the money the anchor you're using doesn't is a old too old of a version of the accumulator that doesn't include these nodes. And so now your uh transaction isn't quite as indistinguishable as it could be because you've basically told everybody that these nodes aren't the ones that you in practice it would require you use quite a little accumulator for it really matter but it might matter for different kinds of attacks. So using a very recent version of the accumulator guarantees that you have some pretty strong price. Uh so maintaining this witness requires you either to scan the blockchain as kind of go and get every single commitment that gets added and then use that in order to update your a witness or you could rely on your own server to provably they could do this without g uh these sort of uh dentas or you might call them bridges or whatever just the information you do the water make in order to take uh any witness that has advanced to one part of the you know one state of the accumulator to any future state uh you can be dying but but that that's assuming you trust a block you you like because like I mean you need to actually like the root of the seem prop like way that bro authentic yeah uh I suppose yeah you this all assumes definitely that the consensus is established that but no like even like let's say the chain is like all right then you you asking the server for the like latest block that contains the root but then what if it give you a bish block right okay yeah we definitely assume that uh whatever information we're getting like if we're a light for example yeah that's then we're assuming the server we're talking to isn't lying to No we're we're not really assuming that for privacy reasons because uh the worst case scenario is that You're just proving that you spending a no and familiarity doesn't exist. It's not a valid. It's not is you don't see reveal anything. Sure. It's been interesting I think. But if y um uh if you're a full node on the network and you're validating everything assuming you you're needing a consensus everything you'll never right information about the changes in the node that you would be able to trust and then okay yeah that sounds good. Uh can you talk a bit about the separation between the shielded uh irises and the transparent type? Yeah. So the reason why transparent edrices exist at all in Zcash is because um for legacy reasons when we we launched Z cach and uh back then and even to this day uh it's very difficult to convince people to use the private version of it because of stupid regulatory things and uh whatever. And so uh we have we had this transparent addresses at the beginning. It also allowed people to use Zcash and learn all this stuff and people who did want to let use this this stuff which over time you make easier and easier and you don't have to care about all it crap and you just use uh the very simple uh things on your phone that you send payments just as you're sending transparent. But uh if you wanted to just use Bitcoin style transcaring transactions, you could. Uh so we had to have some mixture of the two cuz it's actually quite simple. Uh in addition to all this shielded stuff and you may have these uh homorphic commitments that reveal the value. Well, I mean at some point may have prove that there's there's Dallas to the value. That's easy to do. Uh you just reveal this uh randomness and then you do a schnore signature over the value and then you use that as a fee or whatever. You have transparent addresses or stuff being sent around inputs and outputs just like in Bitcoin. Really simple. Now you just have public values that are you have uh uh in those outputs obviously just like in Bitcoin there's some ts ID an index uh and you know it's strip out Q script sig eter and you do all the same stuff and the value is known to the consensus and so that consensus can uh add the value see to this and make sure it's valid that I really truly simply lives in the same session. I see this same structure except that was cool commitment. It has there. Okay. Uh and yeah makes it easy to move between shielded and the uh transparent. Yeah, it does. And it also means that we know how much money should be shielded at any given time. So for example, if there is a bug or sound is callable to snark or some friend some other issue uh which it has in the past in Zcash uh then if somebody were to exploit it they can't take more money out of where this sort of blackville universe where all the money goes uh and and lives in this shielded what we call a shielded pool. They can't take the money out into transparent addresses or into a different shielded pool without turning it passing it through what we call turn style which is just sort of an um it it happens implicitly just by the fact that the values have to be revealed in order to uh relate them to the quality values um in the transparent transactions or in order to transmit value from one SH pool the other during an interial period. We've in the past we ma maintain the ability to um see the value of the classes from one pool to another. If we change the protocol submitting to them and they don't speak the same language they uh we we expose the value on one protocol and then uh you either go to transparent or you go to some other sh protocol and you can see it and you keep track of a bunch of values. So visa is sort of a way to um uh hedge against the risk the catastrophic failure and hopefully to make that so makes sense. And I also heard that the transises and the serial divers actually use different keys right one is sub to fix 61 the other is the lat. Um so in so the addresses so like this address the bog is is this is a shielded address. It contains a key uh in sappa it contains a key off a different elliptic curve called junja cut um which just happens to be an elliptic curve that's more efficient to uh do stuff inside of the zero knowledge proof for the zero proof that we used is in saplin uh is the same thing with the numeral version of of shielded payments in our system orchard it's just a it's a public key on an elliptic curve that just so happens to efficient to do I say in in with the SRS that we were using the zero fruits that we were using for transactions in Satlay and Orchard uh it wasn't efficient for us to do site D256 scan white sheets um or at least I mean it there's there's some ideas there but uh it wasn't efficient for us to do that so we never bothered to to do that we we just use whatever elliptic curves we could find or create the uh satisfy our security needs and efficiency needs. So that's the reason why I chose correct stopped uses a different uh uses a different uh elliptic curve different or anything the uh for the signatures in this case we also use the elliptic curve uh this isn't done in bitcoin but we use the elliptic curve for diff exchange right so to do the secret test you don't need to do that there's no secret that's called I mean you have hashes of uh of the scripts uh pub key or the the scripts that are is to the troop actions but other than that you know everything's public okay I guess maybe then it's a good segway to talk a bit about the the black box right uh the the magic that's happening behind the scenes uh yeah can you talk a bit about the scenario set that was used on how that's evolved over the over the years yeah uh so in the original launch cache we uh so this was back in um 2016 roughly. Yeah, you can do that for you. All right. While you guys are releasing, I'm going to do one quick thing. Yeah. All right. So, in the original launch of Zcash, uh we use a Snark that had just uh came out not too long before uh called VCQB uh 13 or 14. I forget what it was. It was around that time and I I don't remember what year it's called. Uh and this was based off a sarap called Pinocchio. I think it's called Pinocchio. I think that's what you get. Um, Ponopcio uh was one of the first practical uh ZK stars that came out require uh some trust setup as a ctography and all that. So VCTV uh 13 or 14 I think it was 14. Anyway, and uh so the authors of these DD14, I think all of them were ended up created objects. They kind of tended some other academics uh to work on a zerot paper. Uh required parents. So you can only use elliptic curves for which the uh sort of decidual bit problem is it deliberately made really difficult requires setups or it is deliberately made really easy trusted setups which there's some ways you can use parents trusted setups to do cool things but most of the time they come hand in hand. Yeah. Uh so of which curve that that this was the same curve that's used in okay in Ethereum let's say it will be or one is the first that's using uh the antic4 curve and yeah so we just create we created a start on this and um it was really slow you it required like on most consumer desktops it would require at least around 48 seconds in order to create a proof Totally practical. Yeah, but this was the beginning of Munda. So we had launched this only a couple years after this paper had been published. We were the first people to deploy SARS John Zero watch person at all and ever. So, uh, fast forward, we we do some research and we figure out that we we're going to do a new version of proto and the goal of sapling was uh made the stars or at least uh um at least make them a lot uh faster than they are. And we're invol efficient create that you can make them on your phone. um do this. So we built our zero as Bruce law across 16 cross 16 uh which had also just so this is seven was 2018. Okay. So we implemented uh this using a new loop curveless 1231 which is also used in we're the ones that came up with that one. Uh we I guess the authors of the paper we were uh based off in zero cache you know the B2 the T4 curve I think it was it was probably either around travers or something like that I made that curve I don't know they just made it s for something um what's important about these curves is that they aren't just pars they has to pass certain structures and that make it efficient for you to do uh multip evaluation and interpolation just a polo with a large hole wide degree polios that code the circuit and things like that. Um so they they have to be designed so that they they're friendly to FFTs that they it's what we call at the time there's ways to avoid that error. Uh so gratusine uses this uh new peripheral it also uses so that it's important to distinguish these this curve is what's used for the SS but underneath it lives the cryptographic products that that are efficient to evaluate abuse uh in inside of this the circuits that are built over the scaler field will get 254 we use uh uh all the R256 uh compression function. That's uh in in when we did sapling uh we use build sub31 and we created a a curve called gem. It's just basically a uh a twisted arrows curves that we use that's uh it's very similar to ED2.5 and and very has it yeah saying that cross 16 is uh very fast but it has a problem which is it requires per circuit trust out yep per yep so it's no different than 14 uh per circuit setups absolutely does But one of the things we did for saboting is that we realized that uh unlike in the the original once cached is we had created a multi-party computation to do this trusted cinema so that there were you know six people and they collaborated instruct predators and as long of an SD uh we needed to scale that to much larger people. You should launch already people wanted to be more certain the setup was done correctly. Uh this the per circuit setup pain was kind of a pain because yeah uh it means that you have to start over and refine change the surface which sucks and we we started working on addressing it later on. Uh one of the other things is that the setup uh for this was uh uh small number of people and so uh the reason why is because the structure was set up just didn't allow people to jump in, contribute, leave. they had to jump in contribute just based on the way the protocol worked at time uh contribute and then stay up for the next round which is the polomials that are using in this original protocol uh there's multi multivariate polinomials that the structure it codes the circuit and so the the only practical way of doing the uh the justice that required you to do rounds for every single layer of the polic uh in got 16. So we need to do this step. Uh we we weren't going to be able to have waited the time for started setups. So we've released scale to origin of hey people this is something I worked on uh uh where we created a setup which allowed us to do an open-ended setup. And so what we did is we broke 16 out into a phase one and a phase two. Phase one is not serious specific. I see. I see. And it can run on its own for like indefinitely. At some point we did cut it off because you know there's only so much we can do. And then at the point that we do cut it off, we go to phase two which is certain specific. And uh in phase two, we take the stuff that was created in phase one. We encode our circuit for the for the uh protocol and then we do a setup and again it's open-ended and it could go on for as long as we could tolerate it and we stop it at some point and use those for that for the setup. It is per circuit in a sense because this phase two, but the the phase one would be reused up or you were a different phase two. So this was sort of a way to make the setup more trustworthy but didn't quite exactly uh solve the problem with per circuit setups and also man setups and shadows kind of sucked for you to avoid guess. So the next year so this about 2019 I think late 2019 this early 2019 or maybe late 2018 I don't forget uh I would I started working on this paper called sonic huh sonic and we had come up with a way to avoid per circuit setups by braful apart the whole breaking apart the simarity the two pieces one's an auto connect scheme of some kind and the other is I'm sorry we didn't call it this but it essentially um uh it just does a for our purposes just some protocol that uh it uses the binomial commitment scheme in order to demonstrate something we called them oh wait sorry interact you sure pio okay I I think that has actually become the paradigm that T will be using for you know the years to come. Yeah. That that set the stage for all the rest of the week we uh we sort of broke that up and we didn't really study formally the the what was needed for either of the pieces but we broke them up and and that allowed people to work on more efficient zones and more efficient BBS uh separately and that also formalized it and sort of it led to this explosion. They they put marin everything but they all required they didn't require foot surfing sad everything was just a bunch of man and prayers. Um so uh that was sprout satellite and then orchard which dad only knows what year that was. I think it was like 2022 or is that the oh anywhere uh or was the new version of the shielded protocol this didn't require trusted setup this did use um uh obviously start use uh inner product based um inner product argument plus something that's based on clock I'm sorry I said flock as it's described This is actually is a uh protocol that uses a parent friendly thing but it is a general protocol for using yes uh yeah product just doesn't work. Yes. Yeah. Uh but it but the the doll side is has molder proof uh I wouldn't say is your roots the proofs are logarithmic and the size of the circuit that's no big deal. It's actually pretty competitive. So it did was constant. The problem is the verification time auto verification is definitely longer a lot longer than it's so much longer than we can't deploy IP based snarks of any significance inside of something like the because to compete with a cost size or cost of time you know purification of paras uh is just it's scenario work u used for this but we actually use several prayers we call them pass they form a cycle with each other. uh we use one of the curves for the uh for the actual snar itself and then the other part of the cycle of the curves is used for the uh for like the pol keys and all that kind of stuff and they because they each each one of those curves has as its scalar field base field of the other curve um you can use uh cycles of elliptic curves to do I'll proof for first stuff Uh so in the meantime in between Zapling and Orchard we started really focusing on cryptographic primitives protocol changes and research in order to make recursive proofs classical because at the time before or just after sapping uh when we started nest there wasn't any way to do recursive proofs proof sub proofs uh prove carrying data in more general sense without uh doing uh uh you without using these pairings and all this other stuff because the only way we knew how to do recursive proofs at the time is he take the verifier you'll do proof and you and Kobe couldn't sure get inside to chat of course that only really works if somehow the search the verification is already conver and we are able to uh uh avoid that using some tricks that we came up in the Halo uh paper and Halo introduced this concept which has been sort of uh adapted and formalized in different ways. Some people call them accumulation schemes of what the full man yeah whatever it's based the idea is take problems that are similar to each other and profitable under an academic come up with a way to rephrase that in terms of accumulators or folding whatever you want to do and uh so that's not explosion of papers where people come up with ways to do reversion in in uh without trusted setups uh more efficiently with trusted setups uh and all all sorts of greats Crazy stuff. It's all lattis grade stuff coming these days as well. Yep. Um, so that's the reason why we use pasta curves and the worship protocol because we're we're kind of setting the stage at least. What we were trying to do is uh use these curt cycles together with the idea pro and halo back towards 20. Yeah, sure. Something like that late 2019. Uh, and we were to take profile and make more efficient by using our first proof. So we'd already have as a curve cycle and everything now uh trying China's past and so I'm not entirely sure that that be used for in the future. We might ditch those curves and do something else. I don't know. Yeah. Yeah. But that was the original part. Yeah. So good. Um I think we're almost on my plan. Uh any you know last things that you want to call record for anyway. So in the in the uh protocol that I read before yep Bob sends the address to Alice. Alice produce transaction gets my transaction ciphered very has the same effect and then Bob has to scan all the whole text not corrected yet but it doesn't scale this users and the payments increase but can't do that. There are other peanut flows which involve tell us about talking to each other as some lame uh over an existing channel or a new channel or whatever um in order to do this exchange of information without having to put it on a chain so that Alice gives all the information they need in order to uh to to create the witness for the spender. Uh so they could do that in the existing protocol. It's really easy to update your witnesses into the your update your authentication path in merchant tree using uh the the bridges I was talking about earlier. So that's that's not a scalability problem. This is scalability run the scanning or just sort of what we call it at least or what I call it is the scanning that's avoided by changing the way the payment flow works. The other problem is and probably the main issue is the nullifiers. Every single time some money is spent on the system, these null pairs have to be disposed. And we could need some evidence for in order for the consensus rules to establish that you aren't cheating or you are forging money that you're with spending. Yep. Something or some combination of things need to make sure that the nullifiers are uh unique and hadn't been used before. you know the result we need some sort of non-membership proof in conjunction with the ability of the consensus rules and and the ability of the the system to check uh to make sure that these alt bars are are being reused as well why don't you need a but all the full node they do have all non farer you kind do like look up to see like exactly yeah now uh if all the so what we'd like to avoid is all the formones having to keep the all of around I think in practical um that's was on it says war. So so we need to horizontally um scale the actual storage b and uh yeah storage of these nullifiers and the the act of actually checking that yeah the nullifiers have been reused need or only that somehow you can use sharding to do that. There's other things you can uh do uh potentially you can do non-membership proofs uh into versions of the accumulator uh older versions of the accumulator to help the number and if you're required to do that up to a certain threshold then uh the number to start forgetting old versions of old valuifiers because then uh users of the system can just demonstrate non-membership proofs with the old versions of the accumulator And as long as those are valid and the null pairs don't repeat in more recent versions, then you know that uh there's no duplicate null pairs. And so that's sort of the direction we're moving. I'm moving a toward making Z scaleable. And so that that's the this is sort of the uh well okay so the being able to take a non-reership proof yeah and then update it to a new version of the um spend what do I call it a spend uh accumulator or something like that and it's with additional nullifiers in it being able to do that update or be able to at the very least be able to get a non-membership proof from somebody that you can use in order to create a transaction. Uh is sort of a pro problem called sync the syncing problem you and solving both of these problems uh pretty much solves most of the scalability that can a prior tainment model like ours. It's just a matter of being clever about how uh the communication channel is used in order to uh perform the original payment to scan or receive the note that you want to be able to spend and then maintain your witnesses which is your authentication path to the Merkel tree or to whatever accumulator you're using in order to prove that you have a also prove that you have species. Yep. uh that however that works and there's different ways of doing at that however it works that is the syncing problem and so is uh solving these two problems yeah that's that's scalability uh challenges for Zcash in a nutshell they see that yeah okay that sounds very exciting and booking forward to uh a future where the cash solve both of those problems yeah me too absolutely okay Sean for the whiteboard session","transcript_synced_at":"2026-11-03T04:58:28.473Z","segments":[{"start_seconds":2,"text":"Hey everyone, welcome to another episode of the whiteboard session. Today we have uh with us Shan Bo uh one of the key people behind Zcash the original design as well as all the upgrades since then.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2s"},{"start_seconds":13,"text":"Uh it's uh great to have you here Sean. Yeah it's awesome to Yeah. Okay. Okay.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=13s"},{"start_seconds":18,"text":"So let's dive right in. Uh yeah Sean, can you give us an overview of how uh Zcash works and then we can you know dive into the specific topics of how","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=18s"},{"start_seconds":26,"text":"Yeah. Yeah sure. So I can explain. So Zcash comes from this academic paper from like more than 10 years ago or","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=26s"},{"start_seconds":34,"text":"roughly uh called zerocash and zerocash was trying to think about how do we get uh private payments like like in bitco","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=34s"},{"start_seconds":43,"text":"or uh payments like in bitcoin and cryptocurrency but completely private and private means that at least for the from the perspective of uh the zerocash","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=43s"},{"start_seconds":52,"text":"paper that introduced this these concepts is that transactions should be as indistinguishable from each other as","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=52s"},{"start_seconds":59,"text":"possible. Mh. So whatever a transaction whatever value a transaction is spending should be as indistinguishable as any","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=59s"},{"start_seconds":68,"text":"other transaction. So you can't really figure you can't really exclude or do set exclusion tax or whatever and also","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=68s"},{"start_seconds":76,"text":"the values obviously can't be public or any other details about the transaction that would let you to uh violate anyone's privacy.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=76s"},{"start_seconds":82,"text":"um depending on who you talk to, it's uh you can kind of see it as maybe the transaction is encrypted and um uh you","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=82s"},{"start_seconds":91,"text":"don't decrypt it for anyone, but you use zero proof to demonstrate that the encrypted version of the transaction is is valid. Uh and that's it really. Um","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=91s"},{"start_seconds":101,"text":"the exact model I'll use the whiteboard cuz we're here. Yes. Uh the exact model, the way it works is um we have this uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=101s"},{"start_seconds":108,"text":"accumulator. It doesn't really matter how it works. For our purposes, I'll just call it","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=108s"},{"start_seconds":117,"text":"cumulator. And whenever we send somebody money, we create something called a note. And again, I'm simplifying things","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=117s"},{"start_seconds":125,"text":"a little bit because this spans almost a decade of of development. But uh basically a note is a public key kind of like in Bitcoin and a value. So you","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=125s"},{"start_seconds":134,"text":"would call this like a like in Bitcoin you call it a UTSO and uh you have this note and then you have this thing called a note commitment.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=134s"},{"start_seconds":144,"text":"Mhm.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=144s"},{"start_seconds":147,"text":"Uh and the note commitment has some randomness R whatever that uh blinds it so that you can't um so that it it can't","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=147s"},{"start_seconds":157,"text":"be you can't get any information about the PKMV that's hidden inside the note.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=157s"},{"start_seconds":161,"text":"Yet you can it's also binding because you can reveal the note uh data and the randomness to reconstruct the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=161s"},{"start_seconds":167,"text":"commitment. So when you create a uh new uh some value send some money to somebody in in this uh protocol you","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=167s"},{"start_seconds":176,"text":"create the node and the node commitment in a zero knowledge proof and the network will go and take the commitment and put it in this accumulator. Then","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=176s"},{"start_seconds":184,"text":"later when you want to spend it there's another thing. So we'll call this the note accumulator and then uh you could call this maybe the spend accumulator.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=184s"},{"start_seconds":200,"text":"Okay. And in this um when we go to spend this note there's also some other information in here.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=200s"},{"start_seconds":210,"text":"Uh again I'm oversimplifying but maybe we have some row or some some data in there. It doesn't really matter. The actual technical way that it works has to defeat a bunch of different attacks.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=210s"},{"start_seconds":220,"text":"So, it's more complicated than this. But when I spend this note, I reveal reveal a zero knowledge proof. There's a witness into this accumulator that tells","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=220s"},{"start_seconds":228,"text":"me tells everyone that I know that a note exists and I reveal something that allows everyone to see that I spent.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=228s"},{"start_seconds":236,"text":"It's some deterministic computation of this commitment. We call that a nullifier. and this uh nullifier. It","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=236s"},{"start_seconds":243,"text":"could just be this row value, but that's not secure. It's something that's determined by the node and the row value and everything else. It's some it's some","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=243s"},{"start_seconds":250,"text":"function of of the commitment or the data in the commitment or something to do with the no commitment. I see. And uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=250s"},{"start_seconds":257,"text":"we reveal it and it's just from everyone else's perspective, it's just a bunch of random numbers. There's nothing that you kind of like a hash or Yeah, it's a it's basically just a hash um of some secret.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=257s"},{"start_seconds":268,"text":"It actually is also a function of some in practice uh at least in what we do it's a function of some secret uh values","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=268s"},{"start_seconds":276,"text":"that you only know as the person that is spending the note. I see. So in the zero knowledge proof you prove that you know the secret you prove it corresponds with","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=276s"},{"start_seconds":284,"text":"the notes public key and you also use the note uh the secret or secret derived from it in order to to compute the nullifier and then you reveal this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=284s"},{"start_seconds":293,"text":"outside of the zero knowledge proof. So you could sort of see this as like the boundary of what is uh visible to the public versus private in the zero","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=293s"},{"start_seconds":301,"text":"knowledge proof would be something like this. Um uh except this nullifier um sort of","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=301s"},{"start_seconds":308,"text":"whatever. Anyway, so uh so all the nodes on the network store these nullifiers in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=308s"},{"start_seconds":316,"text":"uh some table or something and whenever someone spends some money and puts one of these proofs out and these nullifiers","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=316s"},{"start_seconds":324,"text":"get exposed, you just go through and make sure in this list that you know the nullifier hasn't been seen before because otherwise you're trying to spend the money. So the nullifier is public.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=324s"},{"start_seconds":332,"text":"It's all that thing is all public. Yeah.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=332s"},{"start_seconds":335,"text":"So uh let's see what else. I mean that's pretty s it's pretty simple the way it works. Yeah. Go ahead. Yeah. Yeah. Yeah.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=335s"},{"start_seconds":341,"text":"So maybe like before we dive into the kind of technical details of how this stuff work. Can you just like walk us through like how a transaction works from like a you know user perspective","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=341s"},{"start_seconds":349,"text":"like if like user A wants to send to like user B some you know some some tokens how how how that works. Uh so how the transaction looks maybe. Yeah.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=349s"},{"start_seconds":357,"text":"Something like that. Yeah. Yeah. Okay.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=357s"},{"start_seconds":359,"text":"Well uh I guess it looks something like this. So we have uh Alice and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=359s"},{"start_seconds":367,"text":"Bob and Bob sends at least this is the way it works currently. Bob sends an address and uh for our purposes that's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=367s"},{"start_seconds":376,"text":"just a uh that's just a public key basically. Uh they send some PK. Good enough. Mhm. Alice takes that PK and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=376s"},{"start_seconds":385,"text":"creates uh so I'll go through what Alice some of what Alice does because the symmetry later but anyway Alice will um","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=385s"},{"start_seconds":393,"text":"uh create this this this note object that I was talking about for for the funds that uh they want to give to Bob","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=393s"},{"start_seconds":401,"text":"and uh the note obviously contains this PK value this uh you know row value um uh and and obviously the value that they","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=401s"},{"start_seconds":409,"text":"want to send. Alice wants to send Bob like five Ze or something like that. Um uh Alice also picks some random number.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=409s"},{"start_seconds":417,"text":"So here's here's the node commitment.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=417s"},{"start_seconds":421,"text":"Alice also this value um sort of gets exposed uh sort of in in the way that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=421s"},{"start_seconds":429,"text":"Zcash currently works the value gets exposed as some homorphic commitment to to the value. So like VG um RP prime H or something like that.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=429s"},{"start_seconds":440,"text":"some some this is a bud some commitment to the value. We can use that to make sure that the balance is correct inside the transaction. So this is this is the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=440s"},{"start_seconds":447,"text":"this is what we would call an output inside of the transaction for in like the Bitcoin model. Okay. Um there's this commitment and this commitment becomes","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=447s"},{"start_seconds":456,"text":"public. Uh this is public and we have a zero knowledge proof that takes all these commitments but also all these uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=456s"},{"start_seconds":463,"text":"spend objects. So these are all the spends.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=463s"},{"start_seconds":467,"text":"These are all the uh outputs and uh the spends obviously have the the thing that I was referring to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=467s"},{"start_seconds":476,"text":"the nullifiers. So there will be multiple different nullifiers but also there will be more of these uh encoded","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=476s"},{"start_seconds":483,"text":"encrypted values of uh VN1 VN2 that look that behave like this V","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=483s"},{"start_seconds":490,"text":"value that get exposed publicly as well and then we check to make sure they're balanced. So the V is separate from the commitment or V is the commitment. V is","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=490s"},{"start_seconds":499,"text":"a V is part of the note which is committed to. Okay, we expose V because we're going to have multiple outputs and multiple spends in a transaction. We","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=499s"},{"start_seconds":508,"text":"need to make sure that the sum of the uh spends minus the sum of the outputs is zero or the residual fee whatever fee.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=508s"},{"start_seconds":516,"text":"So we end up just adding all these together and then adding and subtracting all these and we get some oramorphic commitment to like the balanced version","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=516s"},{"start_seconds":525,"text":"of the value and then using like a schnore signature or something on the outside you prove that uh that that it that you know the key that you know this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=525s"},{"start_seconds":533,"text":"H or whatever and you whatever um and that it's balanced. Mhm. So the the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=533s"},{"start_seconds":540,"text":"magic in Zcash is the to demonstrate knowledge of this commitment or or sorry well you have to do that but also","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=540s"},{"start_seconds":547,"text":"knowledge of of these the commitments that you're spending there's not only so much space on the whiteboard especially","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=547s"},{"start_seconds":554,"text":"when I write so large anyway uh you uh have to prove that one of these commitments that you're spending this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=554s"},{"start_seconds":562,"text":"correspond with one of these nullifiers exists inside the accumulator the node acculator um that's pretty easy if the node accumulator is something simple","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=562s"},{"start_seconds":569,"text":"like a like a merful tree and so uh you just prove you have an authentication path into it and there's this other","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=569s"},{"start_seconds":577,"text":"thing that we call an anchor uh it's not that important but basically it's just some previous Merkel tree","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=577s"},{"start_seconds":584,"text":"route of the emulator usually a recent one um and the network just says that certain anchors are valid because","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=584s"},{"start_seconds":591,"text":"they've been the at block boundaries we check the current route of the accumulator and add it to a list valid","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=591s"},{"start_seconds":599,"text":"anchors and the anchor is the route that all of our spends use as a reference in order to prove the authentication pass.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=599s"},{"start_seconds":606,"text":"So in the zero moment proof we're proving we know authentication pass into the tree to commitments that look like this. We know the randomness we know uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=606s"},{"start_seconds":615,"text":"we don't necessarily know the secret key but for our purposes is good enough. Mhm.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=615s"},{"start_seconds":619,"text":"Um we and and so on and so on and uh and then we also prove that we know that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=619s"},{"start_seconds":626,"text":"this nullifier and that we computed it correctly and we exposed it as part of the spends as part of the outputs. We prove that we've constructed an output","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=626s"},{"start_seconds":635,"text":"uh with with a value the zer all doesn't care well public key we put it in. I know our recipient will care when it","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=635s"},{"start_seconds":643,"text":"gets a bunny. They don't care about that.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=643s"},{"start_seconds":646,"text":"the uh we don't the zero offer doesn't really care what the randomness we picked or any of this other stuff. So uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=646s"},{"start_seconds":653,"text":"in zero true for derivatives we construct a commitment input of values that we want and then we expose the uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=653s"},{"start_seconds":660,"text":"theorphic commitments to the values and those are exposed but they the commit in itself is also exposed","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=660s"},{"start_seconds":668,"text":"probably and then the network will do the two things that it needs to do. It check well three things. It checks the proof but then it also checks but it checks to make sure the anchor is valid.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=668s"},{"start_seconds":678,"text":"So, so the accumulator that's used inside the spends is valid. It then checks to make sure that these nullifiers that are exposed are actually","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=678s"},{"start_seconds":687,"text":"um that haven't been used before in a previous transaction. And then it takes this commitment and it adds it to the node accumulator. Yeah. And boom,","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=687s"},{"start_seconds":695,"text":"that's min plus or minus some uh extra cryptographic derivation key structures and things like that to prevent certain","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=695s"},{"start_seconds":702,"text":"kinds of attacks. uh and and for defense and depth against other kinds of attacks, we add much complexity to it","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=702s"},{"start_seconds":712,"text":"that's well justified and you get mostly what our current protocol is actually what our protocol has been really for the last 10 years but we've changed it","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=712s"},{"start_seconds":721,"text":"over time and just you know uh tried to make it more robust or tried to adapt to new proving systems or whatever. Yeah,","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=721s"},{"start_seconds":728,"text":"pretty much it. That's the structure of the of a of a payment that uses the zero cache model. Yeah, for the most part.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=728s"},{"start_seconds":737,"text":"Yeah, it sounds great. So, just coming back to the how the transaction actually works. So, basically Bob sends this um uh address or this public key to to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=737s"},{"start_seconds":744,"text":"Alice and then like what does Alice do after? So, Al so Alice creates this transaction that I just described the the the manner um it gets mined.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=744s"},{"start_seconds":756,"text":"Now, one thing that happens that I overlook because I'm getting ahead of myself a little bit is that this transaction doesn't this just contain the the the nullifiers and the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=756s"},{"start_seconds":764,"text":"commitment and everything else. It also contains the cipher text currently. This is actually a problem, but I intend to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=764s"},{"start_seconds":772,"text":"help fix. But uh it contains a cipher text that's encrypt uh it's it's uh and sending the details about the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=772s"},{"start_seconds":780,"text":"note like this row and this R value and the V and all the rest of this stuff to uh encrypted to the public key to Bob's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=780s"},{"start_seconds":788,"text":"public key. Is it encrypted by Bob's public key? Yeah, it's using a diff helmet key exchange to uh uh create","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=788s"},{"start_seconds":795,"text":"using OKP and all that stuff. And so, you know, it contains an EPK and an ephemeral public key that's used for the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=795s"},{"start_seconds":803,"text":"exchange because it's just the onedirectional communication. And um it gets mined. Bob scans the entire","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=803s"},{"start_seconds":811,"text":"blockchain and looks at every single uh Bob scans all the transactions, looks","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=811s"},{"start_seconds":819,"text":"for cipher text, uh attempts to decrypt all of them, will fail for most of them, except sometimes it'll succeed. And when","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=819s"},{"start_seconds":827,"text":"it does, it will take and try to check to make sure that it it was actually a correct commitment. those being sensitive some value that they can spend","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=827s"},{"start_seconds":836,"text":"and if it is that they'll be able to reconstruct a commitment using the information in the psych text and then","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=836s"},{"start_seconds":842,"text":"um uh then they know a authentication path into uh the the noted accumulator","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=842s"},{"start_seconds":849,"text":"for their commitment and then they could spend the the the money later so I see to somebody else and then this diagram just completes over and over I see does","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=849s"},{"start_seconds":857,"text":"does it mean like in order to transact uh between like let's say Alex wants to transact Bob, they first need to establish connection between them. Like","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=857s"},{"start_seconds":864,"text":"it's like a just like a protocol. They need to kind of there needs to be like a kind of actual peer-to-peer connection","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=864s"},{"start_seconds":871,"text":"being um so I wouldn't mind if that were the case. However, uh well, so there is some sort of channel obviously Bob needs","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=871s"},{"start_seconds":879,"text":"to communicate and address to Alice. Uh the manner in which the channel's established is up up for grabs. That's it. For example, let's say Alice wants","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=879s"},{"start_seconds":888,"text":"to send Bob some money, but Alice never or Bob never gives Alice um uh an address. Y Alice could do all this on","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=888s"},{"start_seconds":897,"text":"behalf of Bob and give Bob the information that Bob needs in order to spend the money. Like create a secret","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=897s"},{"start_seconds":903,"text":"key, create a secret key for Bob, all the rest of this stuff and do everything and then create the transaction and send","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=903s"},{"start_seconds":910,"text":"Bob the money. Bob Alice could steal the money if Alice wanted. Alice created the money. Alice could give this blob to Bob on a on a different on on some channel","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=910s"},{"start_seconds":920,"text":"and channel. Okay. And and so the direction in which some and in the the flow in which some of this stuff happens","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=920s"},{"start_seconds":927,"text":"uh can depend. But yes, there needs to be some way for Alice to communicate to Bob or Bob to communicate to Alice. um","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=927s"},{"start_seconds":934,"text":"either a public key or y here's how to contact me so that we can establish a secure channel say collaborator make a","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=934s"},{"start_seconds":943,"text":"transaction and here the information you need to spend the money send it before I do or there needs to be some channel error yeah and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=943s"},{"start_seconds":951,"text":"both needs to like locally maintain the knowire","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=951s"},{"start_seconds":959,"text":"uh yeah so now that yeah well in this hall here where Alice sends the money voice. Alice sends the money but Alice","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=959s"},{"start_seconds":967,"text":"doesn't really care. Sure. Uh the nullifier bod will Yeah, boss. Yeah, B needs security nullifier appears on the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=967s"},{"start_seconds":975,"text":"blockch or secret key or whatever. Um so yeah, Bob needs to uh Bob needs to know what the nullifier is in a simple model.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=975s"},{"start_seconds":986,"text":"Bob just needs to know what it is and and prove it and and reveal it and then hope that they didn't get hacked and steal their money and reveal a nullifier. Now uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=986s"},{"start_seconds":994,"text":"um in the glorious future we might have a different kind of protocol in which uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=994s"},{"start_seconds":1001,"text":"Bob proves that uh the nullifier that they have for the note they're spending isn't in the spend accumulator or at","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1001s"},{"start_seconds":1009,"text":"least at least assist in in demonstrating such a thing. Um, so they would need to maintain and really care","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1009s"},{"start_seconds":1016,"text":"about their nullifier a little bit more than just revealing it and letting the consensus take care of the job of making sure it's on the spend accumulator.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1016s"},{"start_seconds":1024,"text":"That's where some of the scalability uh stuff might come, right? But but in order for Bob to be really sure like he cannot just like trust some like RPC","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1024s"},{"start_seconds":1032,"text":"node telling him what what the nifers are, he probably needs to like run like a kind of light light node that actually tracks all the nars that appear on","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1032s"},{"start_seconds":1040,"text":"chain. I I mean honestly I I I don't think so if Bob wants to if Bob","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1040s"},{"start_seconds":1050,"text":"is Yeah. Well, I mean obviously if you ask a server and you say here's a nullifier, has it been used before? The nullifier or the the the server should","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1050s"},{"start_seconds":1059,"text":"give you evidence that it was. You show you the transaction that was mined and say here's the nullifier is public.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1059s"},{"start_seconds":1065,"text":"So um but in practice uh if Bob has their private key then nobody else has","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1065s"},{"start_seconds":1071,"text":"that has has the inability to create a transaction with that nullifier. Mhm.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1071s"},{"start_seconds":1076,"text":"There's there's no way. So as long as Bob hasn't been hasn't lost custody of their keys and they don't have to worry about","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1076s"},{"start_seconds":1084,"text":"someone I see they need this authentication craft into the tree and as trial and more commitments are being added to the tree.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1084s"},{"start_seconds":1094,"text":"And uh you need to advance the frontier of the trip frontier uh your your authentication path as time goes on.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1094s"},{"start_seconds":1103,"text":"Otherwise when you reveal uh otherwise we'll spend the money the anchor you're using doesn't is a old too old of a","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1103s"},{"start_seconds":1111,"text":"version of the accumulator that doesn't include these nodes. And so now your uh transaction isn't quite as indistinguishable as it could be because","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1111s"},{"start_seconds":1120,"text":"you've basically told everybody that these nodes aren't the ones that you in practice it would require you use quite a little accumulator for it really","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1120s"},{"start_seconds":1128,"text":"matter but it might matter for different kinds of attacks. So using a very recent version of the accumulator guarantees that you have some pretty strong price.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1128s"},{"start_seconds":1137,"text":"Uh so maintaining this witness requires you either to scan the blockchain as kind of go and get every single","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1137s"},{"start_seconds":1146,"text":"commitment that gets added and then use that in order to update your a witness or you could rely on your own server to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1146s"},{"start_seconds":1154,"text":"provably they could do this without g uh these sort of uh dentas or you might","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1154s"},{"start_seconds":1162,"text":"call them bridges or whatever just the information you do the water make in order to take uh any witness that has","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1162s"},{"start_seconds":1171,"text":"advanced to one part of the you know one state of the accumulator to any future state uh you can be dying but but that that's assuming you trust a block you","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1171s"},{"start_seconds":1180,"text":"you like because like I mean you need to actually like the root of the seem prop like way that bro authentic yeah uh I","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1180s"},{"start_seconds":1189,"text":"suppose yeah you this all assumes definitely that the consensus is established that but no like even like let's say the chain is","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1189s"},{"start_seconds":1198,"text":"like all right then you you asking the server for the like latest block that contains the root but then what if it give you a bish block right okay","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1198s"},{"start_seconds":1207,"text":"yeah we definitely assume that uh whatever information we're getting like if we're a light for example yeah that's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1207s"},{"start_seconds":1216,"text":"then we're assuming the server we're talking to isn't lying to No we're we're not really assuming that for privacy reasons because uh the worst case","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1216s"},{"start_seconds":1224,"text":"scenario is that You're just proving that you spending a no and familiarity doesn't exist. It's not a valid. It's not is you don't see reveal anything.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1224s"},{"start_seconds":1233,"text":"Sure. It's been interesting I think. But if y um uh if you're a full node on the network and you're validating everything","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1233s"},{"start_seconds":1240,"text":"assuming you you're needing a consensus everything you'll never right information about the changes in the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1240s"},{"start_seconds":1247,"text":"node that you would be able to trust and then okay yeah that sounds good. Uh can you talk a bit about the separation","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1247s"},{"start_seconds":1255,"text":"between the shielded uh irises and the transparent type? Yeah. So the reason why transparent edrices exist at all in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1255s"},{"start_seconds":1261,"text":"Zcash is because um for legacy reasons when we we launched Z cach and uh back then and even to this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1261s"},{"start_seconds":1270,"text":"day uh it's very difficult to convince people to use the private version of it because of stupid regulatory things and uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1270s"},{"start_seconds":1278,"text":"whatever. And so uh we have we had this transparent addresses at the beginning.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1278s"},{"start_seconds":1283,"text":"It also allowed people to use Zcash and learn all this stuff and people who did want to let use this this stuff which","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1283s"},{"start_seconds":1291,"text":"over time you make easier and easier and you don't have to care about all it crap and you just use uh the very simple uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1291s"},{"start_seconds":1299,"text":"things on your phone that you send payments just as you're sending transparent. But uh if you wanted to just use Bitcoin style transcaring","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1299s"},{"start_seconds":1307,"text":"transactions, you could. Uh so we had to have some mixture of the two cuz it's actually quite simple. Uh in addition to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1307s"},{"start_seconds":1315,"text":"all this shielded stuff and you may have these uh homorphic commitments that reveal the value. Well, I mean at some","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1315s"},{"start_seconds":1322,"text":"point may have prove that there's there's Dallas to the value. That's easy to do. Uh you just reveal this uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1322s"},{"start_seconds":1329,"text":"randomness and then you do a schnore signature over the value and then you use that as a fee or whatever. You have transparent addresses or stuff being","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1329s"},{"start_seconds":1338,"text":"sent around inputs and outputs just like in Bitcoin. Really simple. Now you just have public values that are you have","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1338s"},{"start_seconds":1345,"text":"uh uh in those outputs obviously just like in Bitcoin there's some ts ID an","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1345s"},{"start_seconds":1353,"text":"index uh and you know it's strip out Q script sig eter and you do all the same stuff","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1353s"},{"start_seconds":1362,"text":"and the value is known to the consensus and so that consensus can uh add the value see to this and make sure it's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1362s"},{"start_seconds":1370,"text":"valid that I really truly simply lives in the same session. I see this same structure except that was cool commitment. It has there.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1370s"},{"start_seconds":1381,"text":"Okay. Uh and yeah makes it easy to move between shielded and the uh transparent.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1381s"},{"start_seconds":1388,"text":"Yeah, it does. And it also means that we know how much money should be shielded at any given time. So for example, if","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1388s"},{"start_seconds":1396,"text":"there is a bug or sound is callable to snark or some friend some other issue uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1396s"},{"start_seconds":1402,"text":"which it has in the past in Zcash uh then if somebody were to exploit it they can't take more money out of where this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1402s"},{"start_seconds":1411,"text":"sort of blackville universe where all the money goes uh and and lives in this shielded what we call a shielded pool.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1411s"},{"start_seconds":1417,"text":"They can't take the money out into transparent addresses or into a different shielded pool without turning it passing it through what we call turn","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1417s"},{"start_seconds":1425,"text":"style which is just sort of an um it it happens implicitly just by the fact that the values have to be revealed in order","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1425s"},{"start_seconds":1433,"text":"to uh relate them to the quality values um in the transparent transactions or in order to transmit value from one SH pool the other during an interial period.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1433s"},{"start_seconds":1445,"text":"We've in the past we ma maintain the ability to um see the value of the classes from one pool to another. If we","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1445s"},{"start_seconds":1453,"text":"change the protocol submitting to them and they don't speak the same language they uh we we expose the value on one","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1453s"},{"start_seconds":1460,"text":"protocol and then uh you either go to transparent or you go to some other sh protocol and you can see it and you keep track of a bunch of values. So visa is","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1460s"},{"start_seconds":1468,"text":"sort of a way to um uh hedge against the risk the catastrophic failure and hopefully to make that so makes sense.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1468s"},{"start_seconds":1477,"text":"And I also heard that the transises and the serial divers actually use different keys right one is sub to fix 61 the other is the lat.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1477s"},{"start_seconds":1487,"text":"Um so in so the addresses so like this address the bog is is this is a shielded","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1487s"},{"start_seconds":1493,"text":"address. It contains a key uh in sappa it contains a key off a different elliptic curve called junja cut um which","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1493s"},{"start_seconds":1503,"text":"just happens to be an elliptic curve that's more efficient to uh do stuff inside of the zero knowledge proof for","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1503s"},{"start_seconds":1510,"text":"the zero proof that we used is in saplin uh is the same thing with the numeral version of of shielded payments in our","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1510s"},{"start_seconds":1519,"text":"system orchard it's just a it's a public key on an elliptic curve that just so happens to efficient to do I say in in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1519s"},{"start_seconds":1527,"text":"with the SRS that we were using the zero fruits that we were using for transactions in Satlay and Orchard uh it wasn't efficient for us to do site D256","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1527s"},{"start_seconds":1536,"text":"scan white sheets um or at least I mean it there's there's some ideas there but","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1536s"},{"start_seconds":1544,"text":"uh it wasn't efficient for us to do that so we never bothered to to do that we we just use whatever elliptic curves we","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1544s"},{"start_seconds":1550,"text":"could find or create the uh satisfy our security needs and efficiency needs. So that's the reason why I chose correct","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1550s"},{"start_seconds":1559,"text":"stopped uses a different uh uses a different uh elliptic curve different or anything the uh for the signatures in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1559s"},{"start_seconds":1567,"text":"this case we also use the elliptic curve uh this isn't done in bitcoin but we use the elliptic curve for diff exchange","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1567s"},{"start_seconds":1575,"text":"right so to do the secret test you don't need to do that there's no secret that's called I mean you have hashes of uh of","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1575s"},{"start_seconds":1583,"text":"the scripts uh pub key or the the scripts that are is to the troop actions but other than that you know everything's public","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1583s"},{"start_seconds":1591,"text":"okay I guess maybe then it's a good segway to talk a bit about the the black box right uh the the magic that's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1591s"},{"start_seconds":1598,"text":"happening behind the scenes uh yeah can you talk a bit about the scenario set that was used on how that's evolved over","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1598s"},{"start_seconds":1606,"text":"the over the years yeah uh so in the original launch cache we uh so this was","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1606s"},{"start_seconds":1613,"text":"back in um 2016 roughly. Yeah, you can do that for you.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1613s"},{"start_seconds":1625,"text":"All right. While you guys are releasing, I'm going to do one quick thing. Yeah.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1625s"},{"start_seconds":1632,"text":"All right. So, in the original launch of Zcash, uh we use a Snark that had just uh came out not too long before uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1632s"},{"start_seconds":1642,"text":"called VCQB uh 13 or 14. I forget what it was. It was around that time and I I don't","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1642s"},{"start_seconds":1648,"text":"remember what year it's called. Uh and this was based off a sarap called","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1648s"},{"start_seconds":1656,"text":"Pinocchio. I think it's called Pinocchio. I think that's what you get.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1656s"},{"start_seconds":1659,"text":"Um, Ponopcio uh was one of the first practical","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1659s"},{"start_seconds":1665,"text":"uh ZK stars that came out require uh some trust setup as a ctography and all","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1665s"},{"start_seconds":1672,"text":"that. So VCTV uh 13 or 14 I think it was 14. Anyway, and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1672s"},{"start_seconds":1679,"text":"uh so the authors of these DD14, I think all of them were ended up","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1679s"},{"start_seconds":1687,"text":"created objects. They kind of tended some other academics uh to work on a zerot paper. Uh required","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1687s"},{"start_seconds":1697,"text":"parents. So you can only use elliptic curves for which the uh sort of decidual bit problem is it deliberately made","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1697s"},{"start_seconds":1705,"text":"really difficult requires setups or it is deliberately made really easy trusted","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1705s"},{"start_seconds":1713,"text":"setups which there's some ways you can use parents trusted setups to do cool things but most of the time they come hand in hand. Yeah.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1713s"},{"start_seconds":1722,"text":"Uh so of which curve that that this was the same curve that's used in okay in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1722s"},{"start_seconds":1732,"text":"Ethereum let's say it will be or one is the first that's using uh the antic4 curve and yeah so we just","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1732s"},{"start_seconds":1740,"text":"create we created a start on this and um it was really slow you it required like on most consumer desktops it would","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1740s"},{"start_seconds":1748,"text":"require at least around 48 seconds in order to create a proof Totally practical. Yeah, but this was the beginning of Munda. So we had launched","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1748s"},{"start_seconds":1756,"text":"this only a couple years after this paper had been published.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1756s"},{"start_seconds":1760,"text":"We were the first people to deploy SARS John Zero watch person at all and ever.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1760s"},{"start_seconds":1765,"text":"So, uh, fast forward, we we do some research and we figure out that we we're going to do a new version of proto and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1765s"},{"start_seconds":1774,"text":"the goal of sapling was uh made the stars or at least uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1774s"},{"start_seconds":1785,"text":"um at least make them a lot uh faster than they are. And we're invol efficient create that you can make them on your phone.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1785s"},{"start_seconds":1795,"text":"um do this. So we built our zero as Bruce law across 16 cross 16","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1795s"},{"start_seconds":1803,"text":"uh which had also just so this is seven was 2018. Okay. So we implemented uh this using a new loop","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1803s"},{"start_seconds":1812,"text":"curveless 1231 which is also used in we're the ones that came up with that one.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1812s"},{"start_seconds":1819,"text":"Uh we I guess the authors of the paper we were uh based off in zero cache you know the B2 the T4 curve I think it was","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1819s"},{"start_seconds":1828,"text":"it was probably either around travers or something like that I made that curve I don't know they just made it s for","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1828s"},{"start_seconds":1836,"text":"something um what's important about these curves is that they aren't just pars they has to pass certain structures and that make it efficient for you to do","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1836s"},{"start_seconds":1846,"text":"uh multip evaluation and interpolation just a polo with a large hole wide degree polios that code the circuit and things like that. Um","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1846s"},{"start_seconds":1854,"text":"so they they have to be designed so that they they're friendly to FFTs that they it's what we call at the time there's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1854s"},{"start_seconds":1863,"text":"ways to avoid that error. Uh so gratusine uses this uh new","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1863s"},{"start_seconds":1869,"text":"peripheral it also uses so that it's important to distinguish these this","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1869s"},{"start_seconds":1876,"text":"curve is what's used for the SS but underneath it lives the cryptographic products that that are efficient to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1876s"},{"start_seconds":1883,"text":"evaluate abuse uh in inside of this the circuits that are built over the scaler field will get 254 we use uh uh all the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1883s"},{"start_seconds":1893,"text":"R256 uh compression function. That's uh in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1893s"},{"start_seconds":1899,"text":"in when we did sapling uh we use build sub31 and we created a a curve called","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1899s"},{"start_seconds":1907,"text":"gem. It's just basically a uh a twisted arrows curves that we use","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1907s"},{"start_seconds":1914,"text":"that's uh it's very similar to ED2.5 and and very has it yeah saying that cross","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1914s"},{"start_seconds":1922,"text":"16 is uh very fast but it has a problem which is it requires per circuit trust out yep per yep so it's no different","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1922s"},{"start_seconds":1930,"text":"than 14 uh per circuit setups absolutely does","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1930s"},{"start_seconds":1938,"text":"But one of the things we did for saboting is that we realized that uh unlike in the the original once cached","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1938s"},{"start_seconds":1946,"text":"is we had created a multi-party computation to do this trusted cinema so that there were you know six people and they collaborated instruct predators and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1946s"},{"start_seconds":1955,"text":"as long of an SD uh we needed to scale that to much larger people. You should launch already","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1955s"},{"start_seconds":1962,"text":"people wanted to be more certain the setup was done correctly. Uh this the per circuit setup pain was kind of a","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1962s"},{"start_seconds":1970,"text":"pain because yeah uh it means that you have to start over and refine change the surface which sucks and we we started","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1970s"},{"start_seconds":1980,"text":"working on addressing it later on. Uh one of the other things is that the setup uh for this was uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1980s"},{"start_seconds":1989,"text":"uh small number of people and so","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1989s"},{"start_seconds":1998,"text":"uh the reason why is because the structure was set up just didn't allow people to jump in, contribute, leave.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=1998s"},{"start_seconds":2006,"text":"they had to jump in contribute just based on the way the protocol worked at time uh contribute and then stay up for the next round which is the polomials","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2006s"},{"start_seconds":2015,"text":"that are using in this original protocol uh there's multi multivariate","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2015s"},{"start_seconds":2022,"text":"polinomials that the structure it codes the circuit and so the the only practical way of doing the uh the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2022s"},{"start_seconds":2029,"text":"justice that required you to do rounds for every single layer of the polic uh in got 16. So we need to do","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2029s"},{"start_seconds":2037,"text":"this step. Uh we we weren't going to be able to have waited the time for started setups. So we've released scale to origin of hey people this is something I","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2037s"},{"start_seconds":2046,"text":"worked on uh uh where we created a setup which allowed us to do an open-ended","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2046s"},{"start_seconds":2054,"text":"setup. And so what we did is we broke 16 out into a phase one and a phase two.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2054s"},{"start_seconds":2061,"text":"Phase one is not serious specific. I see. I see.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2061s"},{"start_seconds":2071,"text":"And it can run on its own for like indefinitely. At some point we did cut it off because you know there's only so","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2071s"},{"start_seconds":2078,"text":"much we can do. And then at the point that we do cut it off, we go to phase two which is certain","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2078s"},{"start_seconds":2088,"text":"specific. And uh in phase two, we take the stuff that was created in phase one.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2088s"},{"start_seconds":2093,"text":"We encode our circuit for the for the uh protocol and then we do a setup and again it's open-ended and it could go on","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2093s"},{"start_seconds":2101,"text":"for as long as we could tolerate it and we stop it at some point and use those for that for the setup. It is per","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2101s"},{"start_seconds":2109,"text":"circuit in a sense because this phase two, but the the phase one would be reused up or you were a different phase two. So this was sort of a way to make","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2109s"},{"start_seconds":2117,"text":"the setup more trustworthy but didn't quite exactly uh solve the problem with","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2117s"},{"start_seconds":2125,"text":"per circuit setups and also man setups and shadows kind of sucked for you to avoid guess.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2125s"},{"start_seconds":2133,"text":"So the next year so this about 2019 I think late 2019 this early 2019 or maybe","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2133s"},{"start_seconds":2141,"text":"late 2018 I don't forget uh I would I started working on this paper called sonic huh sonic and we had come up with","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2141s"},{"start_seconds":2150,"text":"a way to avoid per circuit setups by braful apart the whole breaking apart the simarity the two pieces one's an","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2150s"},{"start_seconds":2158,"text":"auto connect scheme of some kind and the other is I'm sorry we didn't call it this but it essentially um","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2158s"},{"start_seconds":2166,"text":"uh it just does a for our purposes just some protocol that uh it uses the binomial commitment scheme in order to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2166s"},{"start_seconds":2174,"text":"demonstrate something we called them oh wait","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2174s"},{"start_seconds":2181,"text":"sorry interact you sure pio","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2181s"},{"start_seconds":2189,"text":"okay I I think that has actually become the paradigm that T will be using for you know the years to come. Yeah. That that set the stage for all the rest of","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2189s"},{"start_seconds":2197,"text":"the week we uh we sort of broke that up and we didn't really study formally the the what was needed for either of the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2197s"},{"start_seconds":2205,"text":"pieces but we broke them up and and that allowed people to work on more efficient zones and more efficient BBS uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2205s"},{"start_seconds":2212,"text":"separately and that also formalized it and sort of it led to this explosion.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2212s"},{"start_seconds":2216,"text":"They they put marin everything but they all required they didn't require foot surfing sad","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2216s"},{"start_seconds":2223,"text":"everything was just a bunch of man and prayers.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2223s"},{"start_seconds":2228,"text":"Um so uh that was sprout satellite and then orchard which dad only knows what year","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2228s"},{"start_seconds":2236,"text":"that was. I think it was like 2022 or is that the oh anywhere uh or was the new version of","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2236s"},{"start_seconds":2246,"text":"the shielded protocol this didn't require trusted setup this did use um uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2246s"},{"start_seconds":2253,"text":"obviously start use uh inner product based um inner product argument plus something","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2253s"},{"start_seconds":2262,"text":"that's based on clock I'm sorry I said flock as it's described This is actually","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2262s"},{"start_seconds":2268,"text":"is a uh protocol that uses a parent friendly thing but it is a general protocol for using yes uh yeah product just doesn't work.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2268s"},{"start_seconds":2280,"text":"Yes. Yeah. Uh but it but the the doll side is has molder proof uh I wouldn't","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2280s"},{"start_seconds":2286,"text":"say is your roots the proofs are logarithmic and the size of the circuit that's no big deal. It's actually pretty","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2286s"},{"start_seconds":2294,"text":"competitive. So it did was constant. The problem is the verification time auto verification is definitely longer a lot","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2294s"},{"start_seconds":2301,"text":"longer than it's so much longer than we can't deploy IP based snarks of any significance inside of something like","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2301s"},{"start_seconds":2308,"text":"the because to compete with a cost size or cost of time you know purification of paras uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2308s"},{"start_seconds":2315,"text":"is just it's scenario work u used for this but we actually use several prayers we call them pass they form a cycle with each other.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2315s"},{"start_seconds":2327,"text":"uh we use one of the curves for the uh for the actual snar itself and then the other part of the cycle of the curves is","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2327s"},{"start_seconds":2336,"text":"used for the uh for like the pol keys and all that kind of stuff and they because they each each","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2336s"},{"start_seconds":2344,"text":"one of those curves has as its scalar field base field of the other curve um you can use uh cycles of elliptic curves","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2344s"},{"start_seconds":2353,"text":"to do I'll proof for first stuff Uh so in the meantime in between Zapling and Orchard we started really focusing","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2353s"},{"start_seconds":2362,"text":"on cryptographic primitives protocol changes and research in order to make recursive proofs","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2362s"},{"start_seconds":2370,"text":"classical because at the time before or just after sapping uh when we started nest there wasn't any way to do","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2370s"},{"start_seconds":2377,"text":"recursive proofs proof sub proofs uh prove carrying data in more general sense without","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2377s"},{"start_seconds":2384,"text":"uh doing uh uh you without using these pairings and all this other stuff because the only","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2384s"},{"start_seconds":2392,"text":"way we knew how to do recursive proofs at the time is he take the verifier you'll do proof and you and Kobe","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2392s"},{"start_seconds":2399,"text":"couldn't sure get inside to chat of course that only really works if somehow the search the verification is already","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2399s"},{"start_seconds":2409,"text":"conver and we are able to uh uh avoid that using some tricks that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2409s"},{"start_seconds":2417,"text":"we came up in the Halo uh paper and Halo introduced this concept which has been sort of uh adapted and formalized in","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2417s"},{"start_seconds":2426,"text":"different ways. Some people call them accumulation schemes of what the full man yeah whatever it's based the idea is take problems that are similar to each","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2426s"},{"start_seconds":2434,"text":"other and profitable under an academic come up with a way to rephrase that in terms of accumulators or folding whatever you want to do and uh so that's","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2434s"},{"start_seconds":2443,"text":"not explosion of papers where people come up with ways to do reversion in in uh without trusted setups uh more","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2443s"},{"start_seconds":2451,"text":"efficiently with trusted setups uh and all all sorts of greats Crazy stuff.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2451s"},{"start_seconds":2457,"text":"It's all lattis grade stuff coming these days as well. Yep. Um, so that's the reason why we use pasta curves and the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2457s"},{"start_seconds":2465,"text":"worship protocol because we're we're kind of setting the stage at least. What we were trying to do is uh use these","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2465s"},{"start_seconds":2472,"text":"curt cycles together with the idea pro and halo back towards 20. Yeah, sure. Something like that late 2019.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2472s"},{"start_seconds":2481,"text":"Uh, and we were to take profile and make more efficient by using our first proof.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2481s"},{"start_seconds":2488,"text":"So we'd already have as a curve cycle and everything now uh trying China's past and so I'm not entirely sure that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2488s"},{"start_seconds":2496,"text":"that be used for in the future. We might ditch those curves and do something else. I don't know. Yeah. Yeah. But that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2496s"},{"start_seconds":2505,"text":"was the original part. Yeah. So good. Um I think we're almost on my plan. Uh any you know last things that you want to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2505s"},{"start_seconds":2512,"text":"call record for anyway. So in the in the uh protocol that I read before yep Bob sends the address to Alice. Alice","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2512s"},{"start_seconds":2520,"text":"produce transaction gets my transaction ciphered very has the same effect and then Bob has to scan all the whole text","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2520s"},{"start_seconds":2528,"text":"not corrected yet but it doesn't scale this users and the payments increase but can't do that. There are other peanut","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2528s"},{"start_seconds":2536,"text":"flows which involve tell us about talking to each other as some lame uh over an existing channel or a new","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2536s"},{"start_seconds":2542,"text":"channel or whatever um in order to do this exchange of information without having to put it on a chain so that","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2542s"},{"start_seconds":2551,"text":"Alice gives all the information they need in order to uh to to create the witness for the spender.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2551s"},{"start_seconds":2559,"text":"Uh so they could do that in the existing protocol. It's really easy to update your witnesses into the your update your","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2559s"},{"start_seconds":2567,"text":"authentication path in merchant tree using uh the the bridges I was talking about earlier. So that's that's not a scalability problem. This is scalability","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2567s"},{"start_seconds":2575,"text":"run the scanning or just sort of what we call it at least or what I call it is the scanning that's avoided by changing the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2575s"},{"start_seconds":2583,"text":"way the payment flow works. The other problem is and probably the main issue is the nullifiers.","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2583s"},{"start_seconds":2590,"text":"Every single time some money is spent on the system, these null pairs have to be disposed. And we could need some evidence for in order for the consensus","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2590s"},{"start_seconds":2598,"text":"rules to establish that you aren't cheating or you are forging money that you're with spending. Yep. Something or","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2598s"},{"start_seconds":2606,"text":"some combination of things need to make sure that the nullifiers are uh unique and hadn't been used before. you know the result we need some sort of","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2606s"},{"start_seconds":2614,"text":"non-membership proof in conjunction with the ability of the consensus rules and and the ability of the the system to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2614s"},{"start_seconds":2622,"text":"check uh to make sure that these alt bars are are being reused as well why don't you need a but all the full node","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2622s"},{"start_seconds":2631,"text":"they do have all non farer you kind do like look up to see like exactly yeah now uh if all the so what we'd like to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2631s"},{"start_seconds":2639,"text":"avoid is all the formones having to keep the all of around I think in practical","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2639s"},{"start_seconds":2646,"text":"um that's was on it says war. So so we need to horizontally","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2646s"},{"start_seconds":2651,"text":"um scale the actual storage b and uh yeah storage of these nullifiers and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2651s"},{"start_seconds":2660,"text":"the the act of actually checking that yeah the nullifiers have been reused need or only that somehow you can use sharding to do that. There's other","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2660s"},{"start_seconds":2669,"text":"things you can uh do uh potentially you can do non-membership proofs uh into versions of the accumulator","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2669s"},{"start_seconds":2678,"text":"uh older versions of the accumulator to help the number and if you're required to do that up to a certain threshold then uh the number to start forgetting","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2678s"},{"start_seconds":2686,"text":"old versions of old valuifiers because then uh users of the system can just","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2686s"},{"start_seconds":2693,"text":"demonstrate non-membership proofs with the old versions of the accumulator And as long as those are valid and the null pairs don't repeat in more recent","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2693s"},{"start_seconds":2702,"text":"versions, then you know that uh there's no duplicate null pairs. And so that's sort of the direction we're moving. I'm","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2702s"},{"start_seconds":2710,"text":"moving a toward making Z scaleable. And so that that's the this is sort of the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2710s"},{"start_seconds":2719,"text":"uh well okay so the being able to take a non-reership proof yeah and then update","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2719s"},{"start_seconds":2727,"text":"it to a new version of the um spend what do I call it a spend uh accumulator or something like that and it's with","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2727s"},{"start_seconds":2736,"text":"additional nullifiers in it being able to do that update or be able to at the very least be able to get a","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2736s"},{"start_seconds":2743,"text":"non-membership proof from somebody that you can use in order to create a transaction. Uh is sort of a pro problem","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2743s"},{"start_seconds":2750,"text":"called sync the syncing problem you and solving both of these","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2750s"},{"start_seconds":2757,"text":"problems uh pretty much solves most of the scalability that can a prior tainment model like ours. It's just a","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2757s"},{"start_seconds":2766,"text":"matter of being clever about how uh the communication channel is used in order to uh perform the original payment to","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2766s"},{"start_seconds":2775,"text":"scan or receive the note that you want to be able to spend and then maintain your witnesses which is your authentication path to the Merkel tree","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2775s"},{"start_seconds":2783,"text":"or to whatever accumulator you're using in order to prove that you have a also prove that you have species. Yep. uh","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2783s"},{"start_seconds":2790,"text":"that however that works and there's different ways of doing at that however it works that is the syncing problem and so is uh solving these two problems yeah","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2790s"},{"start_seconds":2799,"text":"that's that's scalability uh challenges for Zcash in a nutshell they see that yeah okay that sounds very exciting and","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2799s"},{"start_seconds":2807,"text":"booking forward to uh a future where the cash solve both of those problems yeah me too absolutely okay Sean for the","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2807s"},{"start_seconds":2814,"text":"whiteboard session","url":"https://www.youtube.com/watch?v=THTVKXYRgZY&t=2814s"}],"youtube_url":"https://youtube.com/watch?v=THTVKXYRgZY","url":"https://near-pedia.xyz/videos/THTVKXYRgZY"}