NEAR Whiteboard Series w Aztec Network

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:03

   hey everyone welcome to another episode of the Whiteboard session I'm Bing from near and uh with me today is uh Zak co-founder of Aztec and uh Zak is very well known for his pioneering work in the thk space uh in the past several years most notably to work on PR uh so it's great to have him here and um uh yeah let's talk about how Aztec works yeah thanks for having me on how does Aztec work so

2. 0:32

   uh okay so as is a privacy first um lay to for ethereum so the idea is that you can use it to send endtoend encrypted blockchain transactions so the user like you don't see who the user is who's transacting you don't know the small confs that they're calling and you don't know about the data that they're changing so um I guess there's a few ways I could start to describe this um I could describe the overall Network

3. 0:56

   architecture to go to go with yeah as sor right so let's say you got the user got a little dude here who wants to he wants to uh wants to transact and so they want to call let's say you know um Bob wants to wants I I cannot write letters oh well I'm more of a I'm more of a numbers person or letters person okay it's just so the idea is you want to send a transaction right so uh what what are some of the distractors that we have um uh so let's say the transaction you want

4. 1:28

   to do is uh you know send send like one East to Alice so first of all this person's going to need to make a secet proof so what's going to happen is there's going to be a entity called uh well there is called the pixie this is stands for private execution environment and this is basically a component so if you think about a normal blockchain uh you know you have your blockchain node implementation so you'll have guess you'll have rest right where which handles the whole um like blockchain sync State syncing transaction

5. 2:04

   construction um uh abstraction via RPC uh by Vi an RPC node for Aztec we split it into two you have the parts of the node that handle private State and then you have the everything else part of the node and the reason we do that is because the private part really needs to run client side whereas the public part uh you could use like an inferior type abstraction to to to to abstract it away

6. 2:29

   so the idea here is that um from here this P this like this will basically from here it will will say like I want to generate I want to like call contracts like you know uh Ox AF whatever e um which will uh you know which is basically like let's say it's an a uh I can't remember what you calling it Arc or a uh let's say arc2 contract and then so what this thing is going to do is this this thing has got my this dude

7. 2:57

   State stored locally the private State and crypto State and so this will is provides an like an abstraction layer where um uh you can generate uh proofs sync with with sync sync state from the chain uh in a way that is very application specific it's bit like a like a like a a bit like a firewall so that um the like the webset or the D where this is running in it can't like abuse is privileges to to see what this

8. 3:26

   person's state is in in any other deit other than his contract and so what this is going to do is it's going to spit out ZK it's going to basically spit out a ZK PR uh you know like a ZK PR uh sorry just for me to the where does this execution actually happen like is this like a loc against a client side execute this is all local in the moment local okay this is local this is this is

9. 3:50

   local it's called Local Host so so the idea is this will be basically like typically you know uses web browser so this whole thing is running in like in an ey frame the Prov cryptograph Pro is running in WM and that has to be dealt with and the output of this is basically a proof which gets um uh um uh which is B which is affectiv be the the transaction um so then what this happens

10. 4:12

    is this goes into a peer-to-peer meol oh did you know like this is where things get a little bit more like a standard blockchain um uh and then you'll have a block Builder like a basically what we call the sequences Network so we have a sequence of selection protocol called um finet which is functionally what it it's a um uh sticking based uh system where you know you stick for the right you stick um

11. 4:42

    tokens for the right to be a sequencer the more you stick the more likely you are to be selected but it's not guaranteed um uh and so so the sequencer is just called s they will they're building a block right um uh they're going to they're going to select this out yep uh and basically a search into the transaction and then equ crud Network I'm distracting a lot by the way yeah I'm not I'm not talking about the state model I'm not talking about like uh how we do encrypted State like events or you know like the public private

12. 5:14

    State abstractions um uh and so then the sequence is going to going to basically Outsource proving truth so two things are going to happen I let called this the this is the layer one so the sequence is going to first of all they're going to make a post to layer one going yo this is the block okay um and then they're going to generate then this there going to be approver he generates a

13. 5:39

    proof um which is basically a bu proof um and then this gets verified uh and then like basically verifies I see yeah one and basically L1 controls all the state routs um uh uh and so you know in order for this Glock to be B valid it's going to present it's going to um provide some like you know input State routs output State Roes and appr proof of State the correct of the state

14. 6:06

    transition verified not one um and so that's that's the that's the high level oh sorry question here uh for the sequencer network is there any consensus involved or you only do BR production delegate consensus to to A1 yes so there's a small amount of consensus here so um econom economic uh consensus is a bit inaccurate but what what we do is so we have this issue in our L2 which is not present in most l2s the ones that on privacy preserving which is that this transaction here that that that Bob is

15. 6:38

    spinning out um is non-trivial in terms of its size because the Z it's got a z proof so right now that ZK proof is 100 kilobytes if we worked on it we can get out to 8 kilobytes but that's still a lot of data so normally what happens when a sequencer is posting their block on chain they're posting all the information needed to prove the block so you don't get censorship attacks um and uh we don't want to do that because we don't want to post every single

16. 7:01

    transaction proof on shame too large however when the proof is made by this proof basically swallows up the individual ZK proofs um because all once the proof is made all the only ding to broadcast is the block proof and all of the state diffs that have happened as a result of all these transactions and so um so so the naive thing to do is basically to have a synchronous model where blocks are only valid if they come with the proof MH but then the problem with that is the is getting good through

17. 7:32

    because in a in a rollup like this the you know the the I guess for the for the audience the the um uh the the the the amount of time required to prove a block scales with a log of its size which means that you Big Blocks like big slow blocks means bigger through but so we want big slow blocks but if you want big slow blocks then we want pre- confirmations because we want this dude to be able to send a transaction get

18. 7:55

    very fast like um finality so they know it's going to be in the next block and then they can build on top of that transaction and so what we need is pre confirmations we need the sequencer to be able to say okay I'm putting a transaction in my block um but without posting the proof data on chain which means we basically need a very Min like a miniature Data avability Network that can maintain data like can can basically

19. 8:19

    can Poss data for 10 minutes so it's it's a far some Celestia so we're just in 10 minutes that's nothing more than that but so we use a little economic consensus model to do that where you have a bunch of validators that basically um put up some put up some tokens um under the guarantee that certain proofs will be available I see I see um and is is a part of the S network is a different a different set of people doing that it's a I can't remember how

20. 8:43

    we did it s I think it's a different set of people doing that okay yeah yeah yeah okay okay yeah I see um yeah is there some interesting economic modeling too because we don't want the costs to be too large because it's like 10-minute finality it's not very long uh but uh but also we want like it's trying to do some modeling about we were working with blog science basically like if you can do a like a if you could censor

21. 9:09

    transactions on a 10-minute time frame like practically what's the Miss out of money you could extract from that and then making sure that this the slashing costs are higher yeah and then then what happens when the blog proof haven't uh hasn't arrived on on the one like do you just like like it would like you you still keep sending blocks to to the one just like the proofs would arrive later yeah and the the idea is really the the block production times aren't aren't

22. 9:41

    particularly high so the idea the idea is really um the the the time lag is really um how do I put this because you can generate the block proof um over time as as the block is being built um typically when a block is fully constructed it won take much longer for the block to arrive but we just want to make sure that uh like in that I think it's like a one minute window now basically

23. 10:06

    um like you know we gically can have partial blocks within that one minute M so that we can get down to like 10 second or initially we're talking 10c finality obviously we want to go a bit further than that longer term I see do um just like thinking from like a more like broad chain perspective uh is there any risk of like reorgs when you don't have the uh proce like or no I guess Pro another run here like I think that's

24. 10:32

    like s are producing blogging there like whatever algorithm they use is there any risk of like forks and and then you know reorgs and so on I mean I think there there's always small risks of forks and reorgs but the so the the biggest risk of a of a reorg right is if the block if a block is being claimed as like it's being presented but the data required to make the proof it doesn't exist yeah because the data like the da Council Bally not done their job so they all

25. 10:57

    that they the M or incompetent and then get slashed now block gets deleted and you got to remake a new one so I think because we're L2 because we use ethereum's consensus M am I wrong about this I we need to check because I I I've not reallying delving into the architecture side lately but I think it's it's unlikely to get a real of more than one block with our with our system okay um because uh like generally we're

26. 11:22

    not like we're not really queuing up multiple blocks and improving them generally like you can't I see I see I see you can't prove a block uh like you can't post a you can't like settle a new block into the previous okay okay okay okay I see I see I see um and and then on the pr Network side how does like U is there like I assume there multiple provs right how how do they choose like which one proves this block

27. 11:45

    or is there is there like a competition or like Market there this we we want to make a market for it so there's lots of startups that are spinning up doing proven networks I I think like um uh um uh sp1 I believe that well not as on zbm but they're doing a PR there's quite a few others and so we basically want just make a make a market mechanism right where the sequence can negotiate with the pr networks to get the lowest price but ideally we want to abstract

28. 12:11

    away as much of it as possible to you know actual PR networks that they make it their their job to do this and and so how that work is like whoever submits to proof first gets the reward or something so it's it's slightly more complicated than that uh because there's not really one proof we recursion it's more like 500 proof so let's say imagine this block sizes 1,24 so got 1,24

29. 12:35

    transactions each one's a proof the way we're thinking about it is that you you have a like a tree of rollups so um you know you have a rollup one here which will basically take you know it's tx1 tx2 s something out you know then you have like three and four and basically all of these little things are ZK circuits that are basically just aggregating two transactors that's all they're do um and then you know um and then you have another circuit which

30. 13:00

    Aggregates two transactions and another circuit that Aggregates two transactions and and and using this approach you can get maximum par um and so basically there's lots of proofs that need to be made in the sequence of coordinates so basically what they're doing is it's just a pure a pure Market mechanism um where they're just saying hey how much I want how much would he give me um it's uh we were thinking

31. 13:22

    originally of of of trying to support Uncle proofs basically the idea being if if I a slow Low Pro right am might make a proof but it's I have yeah but but ultimately um I think yeah longer time we'll have to see how this shakes out because I do think the economics of puing are weighted towards a winner tix or scenario uh but what we don't want to end up in is a world where you just have one giant Pro because then the single point is failure um I think

32. 13:54

    it's that's something an open problem to solve to I see okay um maybe let's dive into how the public private state do that uh I'm going to have to wipe this off I'm afraid yeah how does how does public private State work right so what's actually happening in this proof what's going on here so oh by the way before before that I have a question like how does the like given this local competition means that uh uh the user needs to have a state locally right they need to like download

33. 14:28

    the State Lo to be all they need to know their private State yes they need to know their private State yeah yeah and so there's the the way how do you do that yeah there's a tradeoff space here because the the what we want to do is not what we do because what we want to do can't be done yet which is is um it's called om oblivious message retrieval ah so the idea is you could in theory use

34. 14:51

    fully homic encryption so the idea is that you have a third party server that has the entire state tree private state tree of your of your network but is all encrypted uhh and then the user sends a request for specific Leafs but then um what happens that request is esed in an FH context so effectively um the request is encrypted the server doesn't know which which Leafs um they're extracting but they can still run the competition

35. 15:15

    that is that's a few years away so the way we we work we do it is through effectively side channels um so and note tagging the idea is we have a mechanism by which if I am going to send you some some dat so I'm going to like generate some do some transactions I send you money give you data uh I could do a handshake with you where we basically use uh Diffy and secret sharing generate a shared secret that will that I will

36. 15:39

    use to encrypt your data the data I'm sending you and then if you and and what we and all out of that we basically get sped out a list of little T of tags tag and when you're sync into the network you can basically uh like listen for these tab IDs uh which is a a relatively lightweight operation so instead of what we do do which is a naive thing is you trial decrypt every piece of encrypted

37. 16:02

    State on the Chain um that's not sustain so so using this tagging system that works but if the handshake is occurring over a public Channel then effectively what gets leaked is people know that somebody wants to send something to you but of course we can always do the handshake in a site channel that people can't see uh there's also other complications so for example um if I want to make a proof If I want to do a transaction proof with my private State I need to construct Merle proofs speciically like

38. 16:32

    to prove that my my inced blob is data is in the in the in the state tree right right and naive you that requires knowledge of the entire state tree which you don't have if you're running a local light exactly um there are some ways of working around that but uh I think in the short term uh like the the the fastest solution is basically just you you there's a third party server you

39. 16:57

    request the mle PS you are leing information in that context so um there's some trust Vector there that um and so like like ideally that ENT doing that as like a VPN partner or something like that somebody which has high trusts But ultimately longer time we want to again use oblivious messaging obivious mess able to handle that I see I see so so go through how State works yeah well for go through States why don't I go

40. 17:22

    through um the the core semantics in the protocol because the two are inic heavy linked so have a contract my my contracts can contain public functions and PR functions so these are uh um and basically what what a each function gets compiled down into a ZN circuit and a verification key and the contract is defined as the sum of its verification keys for so you basically create a little tree verification Keys you hash that has contract address I see

41. 18:00

    um and these things can modify priv Stakes uh well yeah got private State uh and call public functions and these things can modify they can also if you want you can oh yeah these things can also they can read historical public State oh okay but there's a native operation I think so I can't wrong um and this I think you can read the this can if you want to I mean you can in theory modify pirate privacy a public function but it's not Friday at that point Le secret yeah um uh so the idea

42. 18:48

    here is basically uh when you make your okay so let's um um un Bob I want to make a proof of like transaction um I am not going to have the up to- dat L State um roots of the network at least I cannot be assumed to have yeah but I will have a statement yeah um made at some block block number and I can read the state out of that block number um so it's you can get some useful properties have about um particularly if you have like special state which is um which is

43. 19:19

    which is immutable for example or have like time lock state which what which you know would change like multiple EPO I so you can use this to do some basic um things like es and gating um and so what is public and private State the public state is like a theum it's an account based in model so public state is basically just key key Val storage so it works just like ethereum um you can have mappings you can have in the private State works like Bitcoin

44. 19:53

    ah is utxo best utxo and exp transaction objects I is cool yep um so with Bitcoin right what ises the utxo the utxo is a contains an owner and a valy one's normal um and the idea was is you can create these and you can destroy these and that's all you can do you can't modify them we use a substraction for the same reason that zcat uses it for privacy because the way this works is

45. 20:23

    um uh merel trees and nullifiers so I I don't know the level of like uh for the for for the typical audience member I don't know that typical like background level so I'll just run through what these are right yeah yeah sure yeah so also this is a if you're applying for a for a for for an engineering job at azte and they have some some fun coded questions about about merel trees that

46. 20:48

    we trti many developed as um okay so you have you Merle tree you have a look at a pendon merckle tree any enough I said what are the what are these so the idea is if I want to make a utx if I smart contract was a creative par variable they will they will add it into the tree you know uh just and and this and it is very important nothing get modifi those deleted in this tree and this is important so that users can use historical state routs to prove the existence of State variables because if if a if a new SE is in an Old State

47. 21:28

    state route it'll be in the currect one as well and the same with an another fire set you know like so the idea is when so we want to create you know um uh create axm I'll do that this will be encrypted obviously with a secret key um and let's say I I want to destroy it I've put it in the other five SI which again is also aend um the value of this is that the these when like the NF fire uses a effective a different encryption

48. 21:59

    algorithm to the to the Mer tree the state tree okay uh and so um like an OBS some third party Observer when they see a NF fire being created they can't link that to anything in the append mry because they don't have the decription keys and so in order to kind of like spend a note in Aztec what you do is you send a transaction where you destroy a notes by creating another file M and then you create you notes in its place

49. 22:22

    so let's say I have a I have a state variable which represents five and I want to change into three I'll destroy the five I'll create the three uh and the so the way that works is in order to destroy the utx I have to prove that it's um it does not exist in the L fire just a non-membership which hist sonically we're actually quite expensive but not anymore there's been lots of

50. 22:46

    advancements on that um uh and another difficulty with this is ensuring um M like you don't leak any information when performing Act because whil as a user if I'm sending a creating a transactive proof it's very easy for me to prove that that a note exists in the street I can't prove that I not does not exist because I'm using an Old State so I want to get basically I need the in the back in that old diagram like

51. 23:16

    the the sequencer is the entity that needs to perform the the nullify checks so what what this proof is spinning out is basically like inside the street public inputs on public inputs you have what you have a list of things you have basically utxos to create nullif uh like uh nullifies to add uh because the idea is you only un validated doesn't exist if you want to add it um uh like encrypted

52. 23:50

    events to Emit and um any like any messages m I want and also public functions to call so so um I I'll going do this in a second because because this is how the public private State stuff works um and so the idea is the NFI is all encrypted so it does it's okay to to like for a third party to perform the NY checks because theyed but the number of utxo nullifiers and the number of events and the number of methodes and the number of public functions these are all public I and so you have to actually be a little bit careful to get full like 100% guaranteed

53. 24:33

    privacy uh because let's say I'm doing a base if token transfer whether the absolute numbers of these are small or or I'm doing some really complicated defi transaction where I have loads of these well you can distinguish between those so the way it works at the moment is that there are certain like sets that you can that you can that that that we well like okay so in the actual protocol the number of things you're doing here is not really bounded

54. 24:58

    when it comes to actual pents that we want people to use there is you choose set so there'll be like a set of where you create four UT and noi obious for 8 1632 and the idea is that you can fill these you can fill the set with nonsense if you haven't got enough actual valid I see I see um but obviously the more stuff you doens transaction so there's a trade offer um ah okay okay and so when

55. 25:24

    it comes to calling public functions oh sorry before that question like how does to what is like the um if you think about like s this more cont you have variables you can be like in the Maring so how does that actually translate into like what is that kind of matter yeah so so we we so we have um a li as to as to NR as. no yeah to handle to create abstraction zus where you can basically

56. 25:49

    you can create a storage structure uh that um uh will will have a certain type so it'll be a struct or like or a field element or like a U2 it can be whatever you want it's going to the compiler will convert that into multiple like UT exive required because each of these can I think can contain like 32 bites of data ah 32 B of so the IDE is okay so just like how in ather you have storage spots that going do 32 btes and in the

57. 26:13

    solidity language right if you have a a St a structure you're storing that's more than that it'll page multip storage slots same with utx is and the idea is that the the main methods that you have to imple like that uh are available to you is you can you can create them more you can destroy them uh and that's that's about it I see but if I have something that has relatively large State and I do some operation like

58. 26:37

    iteration or something like wouldn't that create a whole bunch of like those you T so like only if you're reading and writing that any of you you of modifying them so but it's a good question so okay so here's something which we're quite proud of um take Bitcoin for example if you want to create a Bitcoin wallet it's actually quite a headache because you have to handle all of these UT exos um and if a user is like I want to send 3x

59. 27:01

    34 Bitcoin then your wallet needs to understand okay well how many like of all their utx how many do I need to combine yes now imagine it's extending that abstraction not just to bitcoin but to like smart contracts and general Stakes yeah uh it would be an unworkable method with wallet has to handle that so how do we deal with it right well we deal with it by in no we use um the the your the smart Contra developer

60. 27:26

    basically defines uh like get geta and CA functions directly in a smart contact so let me give an example works why is actually crack I CRA open my laptop and actually get some of the Noir examples up because it's been a while I don't want to get bad effect so the idea about Noir is you have functions constrained functions and unconstrained function constrained functions are actual like they you know

61. 27:49

    they're part of your circuit and unconstrained functions are helper functions that you can that like you you can run when generating proofs but they don't actually contribute constraint to your and but the an functions can make Oracle calls into the pixie to restate so let's say I have a wallet contract uh uh not wallet like say token and I want to say uh get so let's say like I have an unconstrained

62. 28:22

    function get um ballots what I can do here is basically I need to might EAS look at my friend to get the exact semantics but yeah no worries there basically there Oracle calls you can make to say get me all of this all of the users utx um and you can basically know you can be like you know for you know I in you know storage dot I see I see and you can basically iterate up so you can add all the notes and similarly if you uh uh

63. 28:54

    let's say I want to do a trans so so that well now I'm actually if I'm if I have a wallet right and I just and and I want to get somebody balance it's just like solidity right where I just call the the get balance function in the in the smart cont API and everything just in theory just work similarly if I want to if I want to send somebody some some notes then what's going happen is let's

64. 29:19

    say like by default the S transaction is two and two hour so basically I can destroy two notes and crit you notes so the way this works is let's say I want to send you one e um I would like I would destroy so say I would destroy two notes worth 0.5 or let's say let's say just to give an example I destroy a note worth .8 and .5 um and then I'll create a not worth one which I give to you and I and I create a not worth .3 which I give to me as my

65. 29:43

    change um and so in in the substraction what you can do is if you you use one of these UNC F to basically figure out okay does this user have enough notes to do a two and two about transaction given the value that they want to send and if they don't use recursion we basically make another function call into this contract to combine two NS into one oh I see I see um and so the idea is there is in the

66. 30:07

    handy path if the user has the right amount of notes it's a very fast transaction trip generation is really fast in the unhandy path you might need to do a few like it's it's still one automic transaction because you know contracts can call contracts in in our instraction but making the trft might be a bit more expensive because now you have to before evaluate model function calls to combine notes um but the general like design principle theistic that we follow is that the complexity of

67. 30:31

    managing utxos is handled by the smart contract developer ah okay okay and the smart contract basically exposes an API ABI API whatever um that uh wallets or DS can basically cter to get all the information that you don't need to like write offer chain code to handle the the the annoying nuances of say it does mean like as a smart contract developer I need to basically like it could get the

68. 30:56

    logic could that get complex of managing utxos good that's why as exist so basically we had these this library that that tries to create abstraction layers over the utx I although we did make a design decision very early on which is that once we create abstraction layers which help to manage utxos we do not hide the nature of the utx what we don't do is let's say I want to to create a token contract I want a pivate balance you can't just do something which is

69. 31:21

    like you know uh u64 private bance uh and then you know you can do it balance you know plus equals 5 or like minus equals we can't do that and the reason for that is there's no way weing that because there's an annoying Edge case in these uncon functions if I'm in my SM I'm isting user storage notes there is no guarantee that when executing this function the user is providing all of

70. 31:54

    the notes all of the notes because basically um obviously if you're using the pixie yeah then yes you do but let's say you have a malicious user that's that's operating maliciously there's no way of knowing how many notes a user has because they're all encrypted yeah uh and um and so uh so your trust user to provide them to you oh okay okay you can't even have a state variable which describes the number of notes the user has because if it's encrypted if it's encrypted then um then

71. 32:28

    it then it then if I'm sending multiple transactions that are modifying the number of notes I have then that one encrypted variable is going to constantly change and so that Lees information if you encryp that varable using the utxo another fire set instraction then how am I supposed to send you a note because I can't if I'm sending you a note I can't increase your encrypted note count I don't know I don't know how to decry it right um uh uh I could use holomorphic encryption to

72. 32:51

    do that but then if that's happening then people can see like that I'm modifying a specific variable in the database so basically you never know you don't know how many notes a user has you you have like you only know for the honest user and so that problem means that you cannot create abstractions where you can just plus and minus OB objects because um uh the see I see like you you don't you can't really know when

73. 33:15

    you're under flight basically I see uh and um so yeah we have lots of like nice helper abstractions to allow people to like iterate over notes create notes destroy notes or like um uh uh like we abstract away the the idea of merging notes have needed to recursive but ultimately like the core actions of creating destroying etx objects that's not that's not attracted away from the developer do do you have some like notion of like gas that meters like the complexity of the proof that potentially

74. 33:47

    going to generate because like imagine like in the like mous like saying that like there's a lot of steps and Legas um well the thing about this is so we sa a malicious contract or whatever which is really really complicated what's the effect of that it means that the the user client side is going to spend forever making that proof which is not nice but it does not affect the Integrity of the network you cannot

75. 34:10

    Network because it's all crying okay okay so what you can do is basically uh like the like we have a measure of um complexity for these Crews because they're basically needs compile into circuits the circuits have number of constraints so you basically count on how many constraints and you know that ahead of time uh so um so you know if you can you can basically you can like in the no software you could just eat

76. 34:34

    out and unreasonable um so we don't have gas there but we do that we do have a a concept of gas with for um the state that you're creating so if you're creating youx notifiers make Ting events right that's all that has to go right now it gets forecast for EIP for it for four blobs on to L1 and so there's a cost there so that gets near Meed and anything that happens in public land guess Meed like a traditional a little shame because the public function stuff is all executed set aside by the well

77. 35:06

    both SEC and the poers I see I see um should we talk about the how the public and private yes con one sec yeah one of the so public functions modify public state which is basically sh Global state if I have a small contract if I have a total Supply varable it can't be private but it can be public it not be private because um uh private state is encrypted and so if you have like a global variable who encryp that is actually

78. 35:38

    being worked on by one of our partners um uh compan tat who were using very Advanced multi-party computational to hand sh state which I'm very excited by um uh but it's uh four those parties that participate in this B party cor those parties that actually participate in the that is a question yes so is work basically and you have to there's honest majority and and it gets a little bit

79. 36:01

    complicated um so like the base protocol itself doesn't have a notion of shared private States but we we're like we're hopeful that we can add in those kinds of semantics via series of work in the future but right now it does so um with public state with shared public state right you have race conditions right if I have if there's two transactions coming work therefore um the you can't make any you can't make

80. 36:26

    proofs about public function of public State because the you don't know what the latest State rout is and you know you don't know what the transaction ordering is to execute public functions first they need to be ordered by a sequencer and then they need to be executed and so this creates a very interesting like Dynamic where if I have a p private function that calls a public function uh these things are happening

81. 36:49

    at like um in a timely synchronous way so if I have like a private function fool is it right and I call you know I call like bar and I call B it and I say this is private and this is priv uh well this function gets executed before this function even though you because because I am locally I am ex I am all functions first so how does this work how do you actually if if things are time not time order correctly how do

82. 37:26

    you create some kind of semantics to write contracts that yeah aren't weird and the solution is actually pretty simple it's that public functions come on return parameters when you call a public function it's like it's it's a void function like you can give it arguments but it has no time parameters and so in that that model because public functions can't well I mean this is you modifi

83. 37:48

    privacy okay they this is you public modified privacy it means that um any side effects that the public function performs I see I see canot cannot touch the exactly SOA what we're doing is we're we're we we're creating an abstraction where it doesn't matter on which order these things are executed in because they can't affect each other I see I see I see um which obviously is there are there some limitations there because if

84. 38:12

    you have no parameters you can't uh there are some things you can't do but honestly there is a lot of very powerful gy you can get out of this because generally what you you constructure your contract so that you know you have some private validation or private execution and then after you do that's the steps there some public stuff you want to do sometime all these public functions can contain assertions that have to be valed for the transaction to

85. 38:35

    succeed um that use shed state for example and so things like that um like um don't uh if the public function contains assertion for example and you don't like when user execute this locally they don't necessarily have the latest State yeah how does it actually work like you assert like does it does it say like I assert on this they root that this no no so you assert in the public function you assert on the

86. 39:00

    latest State because you're not you're you as the user but the user doesn't necessarily know what the like you're right but that's the same as any blockchain sure okay okay CU like in ethereum right if I have if I'm calling a function that has an assert I can only guess about whether succeed or fails I don't know 100% sure sure so what happens is like what happens is locally you simulate this transaction using the

87. 39:22

    latest that you have and then you send your transaction you cross your fingers and you hope that what like when it actually gets mined it's it you get the same outcome which is exactly the same dyamic as existing blockchains today well what's an example of this uh let's say a private function that contains cost to both public and private functions yeah so one example be defi uh so let's say an exchange um so let's say

88. 39:45

    I want to do a private I want to I want to do a swap so if I got a basic Dex like a like like un CL then that's going to be largely public because I have things like liquidity pool scenario ities of the people transacting be private so what I would do is like in terms of your in the transaction flow you word it's a fun braal this interally actually so um I'm actually not the best person to describe this cuz the we man really nice abstractions to make this seem sensible and what I about to

89. 40:31

    describe is everything you kind of explod it out so let's say I a swap yes for die uhh so I will set one I will uh I will unshield bo uh um will shield be this is we do to like um uh like pseudo addressed so that's so um uh and I will do the same for diet then so basically I'm like I'm Bob bob. East or b s second and I'm creating basically like a throwaway address here is actually what happens this but this is the same outcome um so so I'm I'm un like these with some pseudo address which I control but it's not linked to

90. 41:26

    my real address I then and this will be private and then the public land I will tract I will I see I see I see okay he's to die uh forx and then I Shield yeah um yeah shieldless okay okay so these are this is public and this is a this is a hybrid this is actually two functions which stop it Civ ah okay okay okay um and so another like another basic point is let's just say I am doing something completely that that's completely public um for some reason in

91. 42:15

    Aztec coition yeah but see but um but we we have ction Aztec so so the the protocol itself doesn't validate like um public gra key P signatures what happens is you define an entry points contract and that contract requires the authentication logic so what you could do is let say the start of this what say is you could do like you could like uh like uh you know let's say you do it via Google sign so let's say you have an mat smart

92. 42:47

    contract which verifies the protocol um and you're using that to validate your address and that'll be PR function so okay uh account orle always basically FR um so that's one example um some others would be like if you have if you're doing some escrow or something just time sensitive you may want to call a public function to like assert that the like you might to assert that the

93. 43:17

    current lock to is that is within some um and things like that well good good yeah this uh this is very cool uh um maybe can we talk a bit about the our client side proof generation because I assume it's like a resour like you need to think about how much resource consum cannot be like too expensive to do and like yes yeah yeah so so yeah we use our own kind of custom cryptography engine so software is called barenberg we started building it in 2018 uh I

94. 43:47

    actually started rting it before I even had had a sar protocol other was because we were using it for just basic electric but uh so you know in 2019 we came up with a plk Co and then we basic is on that to tur plunk and then Ultra plunk and then then we have plunk and then we have mega Funk and then and now we have uh okay so basically like the I can go through the pring system because effectively the way it works is right

95. 44:13

    now the like the the memory limitation like basically like you can do all this stuff with that like w fruits and the memory bandwith is 4 gabes uh which is pretty high it's basically wi and you can do it in four the target longs long time is to get under one gab but right now we want to like focus on launching a security so so we're not quite there yet um apart from very small uh so how does this work how do I describe it so so we have our so we have the base

96. 44:42

    like the core PR protocol which is uh FK so this is basically plunk custom Gates uh plus uh um a su Che IOP so unlike the original paper we we replaced so I don't know what the the domain level experience is here like that's fine it is so like you know if you're proving stuff um if you want to make a Zer proof of some program whatever there's there's kind of three steps to it first of all you have to take your program statement and convert it it to some kind of um algebraic representation that you can

97. 45:23

    easily prove so generally this is polov algebra so um so have some you know like a bunch of pols this simple arithmetic relation over over the pols that's equal to zero and the trick here is that the pooms are very very high to be millions millions of times y um then you have something called an interactive or proof to Chen to validate your polinomial relation is correct or more more precisely converting this this

98. 45:48

    polinomial expression over very highd polinomial to an to to an expression over uh single value um and the way that we did that in the original plunk paper was through quoti testing so so basically you check that these polinomial expressions are equal to zero modul some kind of vanish polinomial that's kind of it's kind of annoying uh it's a bit slow it's memory gting so we use a su Che now which is

99. 46:12

    kind of an older technique but it didn't work back in 201 19 with the kind of uh algebra and arithmetic we need PL but there's been lots of enhancements since then and even the Hy pump pick trade 20 which make it possible so now use 100 yeah um um uh we also have like our little tles so basically originally this was umat but we uh a couple of years ago there was a a log up all all how created called log up which was a ini like a a big Improvement on sh up so we use that

100. 46:43

     um and memory instructions uh obstruction so basically this is a little subprotocol that allows for um uh like the the emulation of rams um in your circuit so that you can basically read and write into memory um at arbitary locations and making that very efficient uh so that's the freeing system um uh oh yeah plus multi C so Gemini oh multilinear well that's one of the annoying things about Sun checks the good Sun checks they require multilinear

101. 47:21

     theal you but anyway so see but this isn't alone is not because the problem with and with the with the like so this architecture that we have right I've wanted to do something like this for for many many years but the problem has always been um call semantics so if I have a transaction where I'm calling a contract that calls another contract that calls another contract that calls another contract how

102. 47:43

     do you compose that all into a single group and the answer is recursive composition you basically need to have circuits which verify proofs of other circuits and that's very hard to do efficiently it's very hard to do on phone it's very hard to do in a web browser where you don't have access to like your the nativ the native CPU you have to use web assembly they inter is horrible yeah so making recur fast

103. 48:09

     enough is always the hard part and so the way that this works is we use there's a Proto Galaxy folding scheme so this was something that so it's it's an evolution of protostar so protostar was a fing made by uh uh things Poli was um and uh uh and then Ariel and Liam Ean Galaxy so prot Galaxy formal scheme for CMS so it's not te accur call this cion but it's like the same you get the same outcome so the idea with

104. 48:47

     folding scheme is let's say I have multiple proofs that I want to verify so instead of actually like verifying them is this like run creating a verification within aik is very expensive what we do instead is we basically create random linear combinations so the idea is you have you you have you have a so for the photo Galaxy you have a you have an accumulator so you start with your inputs

105. 49:11

     are an accumulator inance could uh so call this um I can't remember these symbols uh and then you have a um uh like a new suet um and the idea here is that you to create a random combinations of these you basically want to multip you want to inject some kind of Randomness into the into the new cular instance and add it into the accumulator instance to clear new app accumulator um and the idea is

106. 49:57

     and the idea is what you're doing there is effectively um uh I'll just SL this out e STS with arrow so basically what happens if you if you basically take a bunch of circuits like like by instance I mean um so you have a like a committed a commitment to A Satisfied witness mhm if you just smash these together like you add Randomness and smash them together the result isn't a valid proof

107. 50:27

     anymore right because the the the the whole point of this of the circuit is you have some some expression of some polinomial was which equals zero and if you just create random linear combinations of multiple in circuit instances then the polom algebra do long get equal zero but it does equal some kind of eror and so the idea with the folding scheme is that you have this this protocol between aover and a verifier so folding CRI and a folding verifier where the folding verifier well

108. 50:53

     the folding C basically says okay I'm going to smash these two circuits together or the like is satisfy inst of the circus together um and the result is that instead of the the the proof ration being zero is now going to be the terror and the verifier will will run a little into a protocol Boo the prer to validate that the error T's correct and this is much cheaper than action verifying fully

109. 51:16

     verifying and so um the this was a big unlock it is um for us uh because now as said you know running a full recursive verif we run folding verifier which is much cheaper but there's a problem with this which is that the in order to evaluate the folding verifier there are two kind of operations you you can do field operations and curve operations and the ELC curve operations are very painful to do yeah um uh because that you know it's nonn to fi the basically like you know

110. 51:49

     all your C algebra is over some prime field and the elliptic coalgebra need to perform is over a different Prime field it's not an extens it's a different pip field oh okay um and so you have to like to do that you to emulate this nonn fire field and the way you do that is by you emulate a base two number system and you use and then use that it's horrible very tensive so how do you solve that sir Goin so Goin plun is a rasan

111. 52:19

     acceleration you can say like full what it does it's a very very nasty uh complicated protocol to convert the expensive operations in the folding bar fire to cheap operations so what it's doing is it transforms the uh expensive electric curve operations into elect curve operations that are over a a native curve so so where the field the prim field matches your field and this uses curve cyes so for example as4 curve and

112. 52:50

     so there is a cycle curve for um so over like so the curve so like with uh so let's say has end points and the arithmetic is FP so for the ECC uh like equals celd and we had a separate club which we called grum C which has P points and and and and the circuit and field and so the idea is you can very efficiently evaluate some bn4 operations over in a gr circuit it can about gring operations SEC and so what we basically do is a very complicated protocol to

113. 53:32

     transform uh the the B&T V4 operations we need to do to basically delegate them into like EV you you you evaluate them in a in a circuit to fight of a Duncan and then you you you you proves uh you prove that you basically correctly transform the show perform the transformation um and then there's one final piece of the puzzle a sub call called the datab buus Plum data bus what is the DAT which is basically an efficient way of transferring information between

114. 54:05

     multiple circuits that are being composed together so if each let's say each circuit that you're recursing over has a thousand public inputs well in the fing verifier um public inputs are not free right basically you have to Hash public input and that gets expensive if we have a thousand of them and so what we want is a constant time protocol where basically no matter how many public imputs you have the amount of time requireed to kind of transport them between different instances is Conant

115. 54:30

     and that's what the data bus does um and so this is a complicated mess smish Mash of protocols um uh and yeah so all of these combined is how uh is how we uh create a cryptographic proding system that can handle the complexity of the aste network is and do the client side with with minimal um mineral resources that sounds great is there any limitation to like you know the computation can do or like well okay so there is a limitation where basically every single fun private function that

116. 55:06

     you do um it can have a maximum of about a million constraints ah okay okay however you can always break outs your if you if you go over that you can always break it out into multiple PR function calls and so the the only limiting factor there is well that the sheer amount of time taken to okay as long as every single call you're making is under a million constraints then then the the factor how long you got to wait to meet the p mhmh and then roughly Hub let's say for like 1 million uh restri

117. 55:31

     uh constraints final Hub how long takes to one canra function well just one wouldn't be that long uh like 20 well maybe 20 seconds one is quite a lot like you don't need anything close to that for for both things sure um but for a general as so for the so we did a um engineering offsite 3 weeks ago and we got finally the first time on my test we got an endtoend token transfer transaction working is on a on in a web browser and on a phone and it's impressive thank you uh I think the proving time for that was 15 seconds oh

118. 56:03

     which is it's like it's it's tolerable but not great uh is what I would say um you know but that's kind of the performance flaw there's there's lots of stuff it image and prove it that that we've not been focusing on um like for example we don't even use web GPU uh when we're proving we don't use single instructure multiple data so there's L there so so we're confident we can get that lower um the Target that we have so our VP minimum viable product targets

119. 56:27

     for main that is a complicated def5 transaction in proved in under a minute on consumer out which is um you know it's it's like you know it's it's complicated right I mean by the standards of the industry of ZK yeah that's amazing but s a web two User it's not good at all um so something else we we're working with is basically we want to make aaable like cre delegation if users want it so basically you know you give your Pro with third party which does in theory

120. 56:59

     could crash it would you would lose privacy but if that third party is a te maybe not or if it's a multi-party proving Network like T um so yeah but like basically the goal is we want them the base Network the base predal to function without third part like without infrastructure but if you want like a web 2 style sppy ux then may wants to delegate some Stu uh we'll see the goal is the goal is to get rid of that long term you know we're not going to stop iterating all this and improving this

121. 57:29

     until we get to that but in the short term uh you know if you want to do super complicated St an aack and you don't want to wait a minute to the proof you might need to do competition deligation I okay yeah it sounds great uh we went through a lot of stuff and uh thank you Zach for walking us through this and yeah it's great thank you thank you Danel yeah we enjoy this a