►
From YouTube: Scalability is Boring, Privacy is Dead: ZK-Proofs, What are They Good for? by Ian Miers
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/scalability-is-boring-privacy-is-dead-zk-proofs-what-are-they-good-for/
The first mainstream uses of zero-knowledge(zk) proofs were for private payments in systems like Zcash and then scalability. In both, we hide data to improve privacy or validation costs. But private payments, unfortunately, have seen limited direct demand. And scalability needs faster proofs but not even zero-knowledge. What are practical zk proofs good for? This talk considers zk proofs + blockchains as a tool both for cryptocurrency and broader applications.
Speaker(s): Ian Miers
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zero-knowledge,transparency
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
I
wrote
the
first
papers
on
using
zero
knowledge
proofs
and
then
ZK
snarks
for
blockchains.
This
was
the
work
on
zerocoin
and
zero
cash.
This
turned
into
Z
cash
and
it
also
happens
to
be
the
protocols
that
underpin
basically
every
second
generation
privacy
coin.
That's
coming
online
now,
in
other
words,
I've
spent
about
the
last
10
years,
working
on
zero
knowledge
proofs
for
privacy
in
blockchains
and
today,
I'm
going
to
give
you
a
talk
entitled,
privacy
is
dead,
scalability
is
boring.
A
Water
ZK,
proofs
good
for
so
obviously,
privacy
and
dead
is
dead,
is
clickbait
apologies
if
they
got
you
in
here
for
the
wrong
reasons.
Privacy
is
really
important.
I
spent
the
last
10
years
of
my
life
working
on
this
stuff,
but
we
haven't
seen
a
large
amount
of
demand
for
private
consumer
payments.
Right
Monero,
launched,
zcash
launched
other
things
launched.
They
exist
they're
great.
A
A
You
know
what
happens
if
demand
for
this
kind
of
stuff
is
10
years
plus
out
one
of
my
co-authors
Iran
trommer,
sort
of
described
it
as
follows:
selling
privacy
for
people
for
blockchain
payments
is
kind
of
like
selling
seat
belts
for
cars
in
the
1920s
sure
we
can
all
kind
of
figure
out
that
in
the
future,
you're
going
to
need
it,
but
until
you
end
up
with
the
actual
interstate
highway
system
and
people
crashing
cars
at
60
miles
an
hour,
it's
kind
of
hard
to
sell
people
in
the
future.
So
what
do
we
do
right?
A
Second
problem
is
in
terms
of
research
right
for
everybody
who
likes
to
get
excited
about
new
technical
stuff
and
new
cryptography.
There
isn't
much
here
anymore,
the
techniques
to
do
this
are
known.
They're
done.
We
worked
them
out,
and
this
is
now
a
thing
to
work
out
in
industrial
applications
right.
The
approach
for
how
you
build
private
payments
is
that
zero
knowledge
proof
plus
an
accumulator,
typically
ZK,
snark,
plus
a
Merkle
tree.
A
This
was
developed
in
zero
cache
and
my
PhD
thesis
it
ended
up
in
Z
cash.
It's
now
in
you
know
pretty
much.
Every
single
other
thing
that's
coming
online,
now
Aztec
andoma,
penumbra
railgun.
They
all
have
features
on
top
of
this
they're,
not
clones,
but
that's
the
base
thing
for
privacy
for
payments
and
so
sure
you
can
build
tweaks.
You
can
change
the
accumulator.
You
can
change
the
proof
systems.
You
can
claim
it
something
completely
new.
A
You
know
you
can
add
extra
features,
that's
quite
valid,
but
this
kind
of
feels
to
me
like
we're,
leaving
behind
the
main
things
that
make
zero
and
all
it
proves
really
cool,
because
the
thing
to
me,
that's
fascinated
me
since
I
was
12.
Is
the
zero
knowledge
bits
that
we're
hiding
things
and
if
nobody
cares
about
privacy
well,
we
should
move
to
something
else
as
an
application.
A
Obviously
privacy's
not
dead
everywhere.
It's
definitely
not
dead
everywhere
in
cryptocurrency.
So
if
you're
one
of
these
second
gen
privacy
coins,
don't
you
know,
kill
me
for
killing
your
pitch
deck.
There
are
other
things
that
are
happening.
Probably
we
need
privacy
for
defy.
It
seems
like
Traders
do
need
that
you
might
be
able
to
use
ZK
proofs
to
get
out
of
Mev
or
front
running
Jerry's
still
out
on
that.
A
You
can
have
an
interesting
argument
with
Phil
Diane,
if
you
don't
believe
me,
but
nonetheless,
the
core
protocols
for
doing
zero
knowledge
proofs
are
still
like
the
same
as
far
as
private
payments
go
even
for
these
applications.
So
from
a
research
perspective,
there's
nothing
new
here.
So
what
do
we
do?
Well,
I
hope
this
isn't
too
offensive
to
any
of
you
are,
but
blockchains
are
slow.
A
So
that's
a
whole
problem
and
well.
Okay,
zero
knowledge.
Proofs
are
supposed
to
be
everything.
A
growing
blockchain
needs,
so
a
lot
of
people
working
on
scalability
for
blockchains,
doing
ZK,
Roll-Ups
dkvms
right.
This
is
a
lot
of
research.
It's
a
lot
of
funding!
It's
probably
several
billion
dollars
worth
of
value
from
ventral
capital
for
this,
and
this
is
where
all
the
excitement
is
right
now.
A
But
if
you
haven't
seen
this
well,
you
know
how
do
these
things
work
in
a
row
up?
You
have
a
server
that
is
taking
transactions,
that
users
generate
users,
submit
those
transactions
to
the
server.
The
server
takes
them
and
compresses
them
down
using
a
zero
knowledge.
Proof
does
anyone
know
which
proof
says:
hey
all
these
transactions
are
correct
and
then
the
server
generates
this
proof
and
sort
of
throws
it
over
the
wall
to
the
blockchain,
and
so
the
server
is,
in
effect,
saving
the
blockchain
work.
A
This
proof
is
succinct
at
least
somewhat,
and
so
it's
easier
for
the
blockchain
to
check
that
than
this
to
check
all
the
proofs,
and
so
then
it
doesn't
matter
if
your
blockchain
is
slow
and
does
10
transactions
per
second.
If
each
one
of
those
transactions
is
a
zero
knowledge,
proof
saying
that
10
000
transactions
are
correct
in
payments.
That's
the
theory!
That's
the
pitch
deck
everyone's
raising
off
of
okay!
This
is
great.
There's
really
nothing
wrong
with
here.
A
This
is
a
lot
of
brilliant
work
has
been
done
on
this
I
don't
mean
to
Bly
people
on
it,
there's
just
as
a
cryptography
Professor
the
thing
that
kind
of
bothers
me:
Z,
kpms
and
ZK
Roll-Ups-
aren't
zero
knowledge.
They
compress
transactions
on
blockchains.
You
don't
need
to
hide.
What's
going
on
to
do
that,
you
just
need
things
that
are
faster
and
smaller
to
verify.
A
There's
no
notion
that
this
has
to
hide
what's
going
on
and
in
fact
they
likely
aren't
going
to
hide
your
data,
and
so
this
is
going
to
be
surprising
to
some
of
you.
Of
course,
ZK
Roll-Ups
usually
reveal
the
miracle
hash
of
the
data
they're
dealing
with
that's
kind
of
obvious,
there's
a
zero
knowledge
proof
about
it,
but
they're
reviewing
the
miracle
hash
and
that
hash
actually
reveals
a
bunch
of
data
in
much
the
same
way
that
say
publishing
the
hash
of
your
password
is
going
to
reveal
your
password.
A
People
can
Brute
Force
these
things
and
it
wouldn't
matter
if
you,
when
you
publish
the
hash
of
your
passwords,
that
uses
zero
knowledge,
proof
that
it
meets
whatever
ridiculous
password
policy.
There
is,
you
know
three
uppercase
characters,
a
symbol
and
hey,
let's
throw
into
my
Emojis
for
good
effort.
A
That's
not
going
to
help
with
the
Privacy
problem
here,
and
so
this
is
going
to
become
an
issue
now,
maybe
it's
just
in
theory.
Maybe
it's
hard
to
Brute
Force
this
stuff.
On
the
other
hand,
ethereum
just
moved
to
proof
of
stake,
so
there
were
a
lot
of
angry
miners
which
a
bunch
of
hashing
Hardware
who
don't
know
what
to
do
with
it.
A
So
if
this
ends
up
being
an
Mev
thing,
you
might
have
some
problems
either
way,
it's
not
zero
knowledge,
and
so,
in
my
perspective,
this
is
kind
of
boring
from
a
ZK
standpoint,
because
it
just
isn't
using
the
thing:
that's
cool
and
fascinating
about
zero
knowledge,
proofs
sure
you
need
faster
proofs,
that's
quite
nice!
This
will
get
you
all
kinds
of
cool
technology
and
I'm
glad
it
exists.
But
it's
it's
skipping.
A
The
interesting
bits
right
and
so,
at
the
end
of
the
day,
zkvms
are
not
a
significant
source
of
zero
knowledge,
they're
sort
of
nutritionally
defunct
from
this
perspective.
They
don't
give
us
what
we
want
and
again
this
is
not
to
say
this
stuff
isn't
useful.
It's
driving
serious
Innovation
and
zero
knowledge
proofs.
The
things
I
worked
on
in
2012
in
2017
when
we
wrote
sexy,
which
were
like
implausibly
slow
at
the
time,
are
now
practical
in
part
because
of
the
r
d
that's
been
funded
by
the
companies
doing
this,
and
so
that's
incredibly
useful.
A
It's
a
bunch
of
tooling
that
I
as
a
researcher
can
use,
and
so
I
sort
of
think
about
this,
like
the
1980s
and
1990s.
When
people
are
building
faster
computer
processors.
These
things
were
tools.
We
could
use
to
do
anything
we
wanted
what
was
driving
people
doing
them
was.
You
know
faster
spreadsheets
for
offices
kind
of
like
what's
driving,
people
now
is
faster
spreadsheets
on
a
blockchain,
so
you
can
do
this.
That's
great,
there's
nothing
wrong
with
it.
A
A
So
this
brings
me
to
the
question,
and
this
is
where
the
sort
of
technical
content
of
this
Talk
Stops
this
is
this
sort
of
theory
question:
what
is
this
stuff
good
for
right?
What
are
we
going
to
do
with
the
zero
knowledge
proof
and
if
you
went
and
took
a
cryptography
class,
probably
even
if
you
took
my
cryptography
class
because
I'm
lazy
about
writing
slides,
you
would
get
a
definition
like
this,
which
that
is
zero
knowledge.
A
Proof
is
a
thing
with
correctness,
soundness
and
zero
knowledge,
and
this
is
a
very
sort
of
textbook
academic
thing.
It's
very
dry.
It
does
not
relate
what
these
things
really
do.
So
I
think
we
kind
of
should
start
thinking
about
them
in
different
terms.
So
in
deliberately
non-standard
terminology,
what
is
a
zero
knowledge?
Proof
doing
well,
in
my
mind,
it's
three
things:
the
first
one
is
confidentiality,
it
hides
data,
and
so
that's
how
we
got
Z
cash.
That's
how
we
got
tornado
cash.
That's
how
you
get
Aztec.
A
You
get
everything
else:
we're
trying
to
hide
data
to
get
private
payments,
because
blockchains
or
Twitter
for
your
bank
account,
and
that
sounds
like
a
horrendous
idea.
Okay,
that's
thing.
One
thing
two
for
ZK
snark
specifically
is
compression
right.
They
take
a
bunch
of
data
and
it's
easier
to
verify
than
doing
the
linear
paths
that
the
actual
verification
would
do
without
the
proof.
That's
nice,
that's
how
you
get
scalability
right.
A
This
is
what's
driving
people's
quests
to
save
money
on
gas
for
blockchains,
but
the
third
point
is
to
provide
something
which
we
can
think
of
as
credibility
right.
So
zero
knowledge
proof
from
the
cryptography
standpoint
is
sound.
It
gives
you
some
guarantee
that
some
statement
is
correct.
It
doesn't
tell
you
anything
about
what
you
can
do
with
it.
Credibility
is
this
point:
if
I
give
you
a
piece
of
data,
I
can
use
a
zero
knowledge
proof
to
show
to
you
that
it
really
is
the
data
you're
supposed
to
be
looking
at.
A
It
really
was
computed
on
correctly
and
this
actually
Okay.
So
the
idea
here
comes
from
a
piece
of
research
done
by
some
of
my
collaborators
back
before.
I
knew
them
called
proof
carrying
data
in
2010,
and
this
was
really
before.
Blockchains
were
a
major
thing,
at
least
in
Academia,
and
the
idea
was
you
have
data,
never
mind
where
again,
they
didn't
know
about
blockchains,
and
the
data
has
proofs
attached
to
it
that
the
computations
are
correct.
That
was
done
to
produce
the
data,
so
you
have
some
data.
Proof
here
says
data.
A
Whatever
someone
comes
along
computes
a
function
on
the
data
gives
you.
The
output
gives
the
proof
that
that's
correct
and
then
later
somebody
else
can
come
along
compute.
Another
function
on
the
result
of
that,
give
you
a
proof
that
that's
correct
and
you
can
just
sort
of
imagine
some
kind
of
state
machine
going
forwards,
looks
kind
of
like
a
smart
contract,
I
guess,
but
it
involves
zero
knowledge,
proofs
and,
of
course,
because
it
involves
your
knowledge
proofs.
You
can
also
hide
anything
you
want
in
the
process
of
doing
this,
so
this
is
great.
A
A
You
know
this
is
privacy,
preserving
smart
contracts
for
any
of
you
have
looked
at
this
stuff,
but
at
a
level
of
what's
the
property
that
a
normal
person
might
care
about
right.
So
what
do
we
do
with
this?
Well
in
general,
what
is
your
knowledge
proof?
It's
good
for
and
in
this
talk,
I'm
going
to
give
you
some
low-level
things
of
like
immediate
problems,
some
very
high
level
things
that
are,
you
know
what
was
on
my
mind
at
the
time
and
then
back
to
some
low-level
things
of
identity.
A
So
the
first
thing
that
you
really
do
need
zero
knowledge.
Proofs,
for
is
credible
safety
for
or
from
depending
on
how
cynical
you
all
roll
up
operators
right.
The
Bitcoin
people
would
call
this
censorship
resistance,
because
if
you
have
a
have
a
roll-up
right,
the
roll-up
is
taking
these
transactions
the
service
sitting.
Here
it
sees
everything,
that's
in
those
transactions
right,
these
are
normal,
ethereum
or
Bitcoin,
or
whatever
it
is
transactions
they
are
completely
transparent
to
the
server
server
can
see.
What's
going
on,
okay,
fine,
why
does
that
matter?
Blockchains?
A
Are
that
way
anyway,
the
problem
is,
the
server
is
getting
these
from
a
bunch
of
people
and
it
gets
to
choose
which
ones
it
takes
and
which
ones
it
doesn't,
and
the
problem
is
that
that's
going
to
be
obvious
to
everybody,
and
so
the
server
is
going
to
be
held
responsible
at
some
point
by
somebody
for
something
it
failed
to
exclude,
in
other
words,
zkvms
and
ZK
Roll-Ups,
at
least,
if
you
naively
do
them
in
a
single
server
model.
Aren't
censorship
resistant!
The
consequence
of
this?
Is
you
really
better,
not
mint
any
enfps?
A
If
some
meme,
a
government
doesn't
like
you,
probably
shouldn't-
take
payments
to
activists
that
the
government
doesn't
like,
if
you're
all
a
roll-up
operator
sitting
in
Texas,
I,
probably
wouldn't
take
donations
to
an
abortion
fund.
Right
now
might
get
you
in
a
bit
of
trouble,
because
if
you
do
your
nice
ZK
block
compact
trying
to
make
things
efficient,
isn't
going
to
be
a
block
compactor,
it's
going
to
be
a
trash
compactor
on
fire
you're
going
to
just
have
major
problems
with
transactions
you
process,
so
this
is
not
safe.
A
This
is
not
good,
and
this
is
a
major
problem
for
all
people
trying
to
get
blockchains
to
scale.
So
what
do
you
do
about
this?
Well,
you
replace
the
individual
user
transactions
with
zero
knowledge
proofs
so
that
those
transactions
are
now
opaque
and,
as
a
result,
the
roll-up
operator
can't
see
what's
going
on,
and
so
they
have
they're
a
dumb
pipe
and
they
have
some
limited
ability
to
manipulate
transaction
ordering.
A
But
again
they
don't
really
know
what's
going
on,
they
have
a
degree
of
of
deniability,
and
so
this
gives
you
a
minimal
amount
of
safety.
It
doesn't
solve
everything,
but
this
is
the
thing
that
you
need
to
be
building
into
your
ZK
Roll-Ups,
and
this
is
things
that
various
people
are
building
I
believe
the
original
people
who
came
up
with
this
idea,
I,
don't
follow
these
things
too
closely.
Aztec
currently
has
this
out
there.
Elio
company
I'm
involved
with,
is
also
building
this
I'm
sure
there
are
others
but
nobody's
really
broadcasting.
A
These
features
as
a
thing
that
goes
on
very
well
and
part
of
that's
because
that's
a
really
bad
name
right.
This
gets
called
a
ZK
ZK
roll-up,
which
is
kind
of
a
mouthful
and
every
time
I
hear
it
all
I
can
think
of.
Is
this
bad
meme
from
like
not
quite
the
90s,
but
it's
pretty
old,
so
you
should
be
doing
this
and
somebody
should
please
please
come
up
with
a
better
name
for
this,
that's
catchy
so
that
people
can
Market
it
because
I'm
sure
I
left
off
some
people
who
are
building
this.
A
But
this
poses
an
interesting
problem
for
those
of
you
who
are
working
on
zero
knowledge
proofs,
because
these
proofs
need
to
be
built
on
phones
and
that
doesn't
necessarily
work
with
every
ZK
proof
system.
That's
out
there
right,
I,
don't
know
the
full
breadth
of
these
things.
I
don't
play
with
most
of
them
most
of
my
stuff's
still
in
graph16,
but
I
do
know
that
some
of
these
things
are
slower
than
others
and
are
suited
to
other
cases,
and
so
there's
some
risk
factors
that
you
might
want
to
consider.
A
If
you're
looking
at
ZK
Tech
and
trying
to
figure
out
what
we
should
use
a
lot
of
these
systems,
the
approvers
are
architected
to
running
data
centers
on
Big
Iron
right.
This
may
be
fundamental
to
the
way
the
proof
system
works.
It
may
just
be
who
your
devs
were
and
what
they
knew,
how
to
do,
but
either
way
it's
not
clear,
they're
going
to
run
efficiently
on
a
mobile
phone
or
a
laptop.
A
Secondly,
for
the
proof
systems,
they
may
be
amortized
only
over
lots
of
transactions
right,
so
they're
not
really
efficient.
Unless
you
put
a
thousand
transactions
into
this
proof
and
check
them,
and
then
you
get
some
amortized
savings,
which
is
fine
for
a
server
compressing
transactions
to
do
a
roll-up.
But
again,
in
these
cases
you
need
phones
to
be
generating
proof,
so
laptops
to
be
generating
proof,
so
the
server
doesn't
see
what's
going
on
and
that's
only
going
to
have
one
transaction
in
it.
A
And
lastly,
the
proofs
in
a
lot
of
these
things,
are
very
large,
which
is
going
to
cause
all
kinds
of
problems
for
mobile
data
for
your
gossip
protocols
for
transaction
distributions.
This
is
also
a
warning
sign,
and
so
the
way
to
think
about
this-
or
at
least
I,
think
about
this-
is
you
may
remember
that
there's
been
this
big
problem
with
Intel
and
x86
for
the
past
about
15
years,
where
Intel
built
these
wonderful
server
chips
and
then
they
found
out
the
future
of
the
world.
A
So,
okay,
that's
the
basic
like
pressing
issue
today,
but
looking
more
broadly,
what
else
can
we
use
as
your
knowledge
proofs
for
right?
If
we
have
this
notion
of
credibility
carrying
data
right,
what
can
we
use
it
for
and
I
think
you
can
more
broadly
do
this
for
markets
like
competition,
decentralization
migrating
data
around
is
going
to
be
a
big
one,
and
obviously
you
can
also
use
it
for
like
preventing
money
laundering.
So,
starting
with
the
last
one
of
those
cryptocurrency
has
a
theft
problem
right.
This
is
stuff
gets
stolen.
A
Now
by
nation
states.
The
nation
states
actually
go
get
in
trouble.
Tornado
cash
got
taken
down
because
of
this.
Actually,
the
tornado
developer
is
in
prison
right
now
in
the
Netherlands.
Because
of
this,
which
is
kind
of
crazy,
for
you
know
thing
that
came
out
of
a
paper.
I
started
writing
10
years
ago,
but
this
is
what's
going
on
and
it
would
be
good
if
we
had
some
way
to
deal
with
this.
A
So
that's
one
thing
you
could
build.
Details
are
somewhat
complex
by
the
way,
but
it
is
possible
right
more
broadly,
you
can
do
all
kinds
of
compliance
right.
You
want
to
comply
with
anti-money
laundering
rules,
currency
transaction
reports
that
you're
sending
you're
not
sending
more
than
ten
thousand
dollars
through
a
system.
You
can
do
that
right.
A
In
theory,
we
knew
how
to
do
this
in
in
2016,
so
the
paper
I
wrote
at
Financial
cryptography,
but
now
there
are
actually
companies
building
this
because
again
we
have
more
practical,
zero
knowledge
proofs
in
part
because
of
the
people
working
on
Roll-Ups,
you
want
to
show
you're
not
on
the
sanctions
list.
We
can
do
that.
So
this
is
again
you
can
get
credibility
for
what's
going
on
with
money.
A
A
Well,
we're
all
trying
to
build
decentralized
ecosystems
right,
there's
a
whole
question
of
whether
those
are
really
going
to
be
on
a
blockchain,
or
is
it
going
to
be
some
oligopoly
of
servers
where
people
try
to
move
from
one
server
to
another
to
another
migrate,
their
data
from
one
thing
to
another
and
in
those
settings
it
would
probably
be
pretty
useful
if,
when
you
took
your
data
from
server
a
to
server
B,
you
sort
of
said
that
here
I
can
prove
to
you.
It's
correct
all
right.
A
Similarly
speaking,
you
might
want
to
prove
that
an
auction
you're
doing
is
not
tampered
with.
Google
recently
got
in
trouble
because,
allegedly,
according
to
several
States
Attorney
General,
they
will
manipulating
their
ad
auctions
instead
of
running
a
they
said,
they
were
running
a
second
price
sealed
bid
auction.
Where,
if
you
win,
you
pay
with
the
second
price
is,
and
so
you
should
bid
your
value
and
instead
they
were
running
something
that
was
approximately
a
first
price
seal
bit
auction,
because
if
you
won,
they
lied
and
said
there
was
a
bid
right
right,
underwear.
A
Yours
wasn't
basically
charged
you
what
you
were
willing
to
pay,
and
this
is
a
problem
with
Google.
You
know
a
semi-trusted
guy
in
a
legal
setting
where
there
are
places
to
prosecute
them.
If
you
try
to
run
an
auction
on,
you
know
decentralized,
wild
west
of
blockchains.
This
is
going
to
come
up,
so
you
probably
want
to
be
able
to
prove
your
options
are
correct.
Similarly,
you
might
want
to
run
a
matching
rocket
for
some
Rideshare
system
like
uber.
A
You
can
do
this
with
a
zero
knowledge
proof
in
theory,
right
thinking,
even
more
broadly,
you
might
want
to
be
able
to
say,
like
hey
if
we're
running
a
decentralized
social
media
system,
I
have
a
news
feed
I'd
like
to
know
that
my
news
feed
wasn't
manipulated
that
somebody
isn't,
for
example,
feeding
the
outrageous
stuff
just
because
it
generates
clicks.
Oh,
you
know
making
clickbait
titles,
for
you
know
ethereum
Devcon
talks.
A
You
might
want
zero
knowledge
proof
to
do
that,
and
the
thing
here
is:
these
are
all
sort
of
Pie
in
the
Sky
dreams.
But
we're
going
to
need
to
do
things
like
this,
because,
if
you're
trying
to
decentralize
existing
Services
organizations
and
institutions,
it's
kind
of
essential,
because
people
kind
of
trust,
these
essential
existing
things
for
better
or
worse.
And
so,
if
you
move
to
something,
that's
completely
crazy
and
new
you're
going
to
need
to
convince
those
people
to
trust
your
new
thing,
and
you
can't
just
publish
everything:
that's
not
how
the
world
Works.
A
So
this
is
sort
of
hard
to
think
about
as
a
concrete
thing.
So
he
was
a
you
know,
a
concrete
version
of
this
standard
tale
about
internet
gaming
right,
there's
some
awesome
game.
It's
an
online
game!
There's
a
server,
there's
a
great
Community,
everybody
loves
the
thing,
and
then
it
gets
a
little
too
popular
thing
goes
down
the
toilet.
A
What
you
want
to
do
is
like
take
all
your
data
and
go
to
a
new
server
with
the
same
game,
but
your
existing
game
state-
and
you
know
for
this
to
work.
The
game
has
to
be
open
source,
but
even
if
it
is
you're
going
to
run
into
some
problems
here
right
when
you
take
that
level
50
sword
or
whatever
it
is
from
server
a
to
server
B,
why
is
anyone
going
to
believe
that
you
actually
earned
that
that
you
didn't
just
make
it
up
right
for
the
server?
A
How
are
we
going
to
know
that
they
weren't
playing
funny
business
I'm,
secretly
running
a
pay-to-play
game
right?
How
are
you
going
to
know
that
the
economy
of
that
server
and
the
way
the
items
are
distributed
is
correct
right?
You
want
to
be
able
to
prevent
these
guys
from
like
toileting
this
game.
A
You
want
to
be
able
to
move
to
another
server,
but
you
need
all
of
your
data
to
be
credible
when
you
do
this
and
move
it
around,
and
so
the
only
way
you're
going
to
do
this
is
by
committing
to
the
data
on
a
blockchain
and
attaching
zero
knowledge.
Proofs
to
all
this
stuff
again
Pie
in
the
Sky,
you
can't
get
this
to
scale
now,
but
it's
an
interesting
idea
and
this
approach
is
broadly
feasible
to
not
just
gaming.
You
don't
need
to
just
do
this
about
a
sword.
A
You
could
do
this
about
any
number
of
things
right
if
you're
running
a
crowdfronting
platform
that
has
like
Awards,
something
like
patreon
patreon
goes
under,
you
can
move
to
another
server
and
take
the
awards.
You've
gotten
improve.
You
actually
got
them
so,
okay.
Well,
what?
If
we
thought
even
bigger
recently,
there
was
a
headline
that
the
IRS
had
gotten
in
trouble
for
manipulating
their
audit
process
and
under
the
Trump
Administration
auditing
senior
FBI
officials,
who
mysteriously
had
also
been
investigating
the
Trump
Administration.
A
So
this
was
regardless
than
tampering
with
those
other
stuff.
What
would
it
take
to
make
tax
audit
processes
credible,
and
this
is
just
sort
of
a
hypothetical
right?
How
would
you
know
that
this
is
working?
You'd
have
to
commit
to
an
audit
policy
in
advance?
You'd
have
to
put
up
all
of
the
tax
returns
committed
on
in
some
blockchain
and
permissioned
Ledger,
and
then
you
have
to
show
that
your
audit
process
was
applied
correctly
and
the
thing
is
in
the
process
of
doing
this.
A
You
cannot
reveal
any
of
that
data,
can't
tell
people
what
will
get
your
taxes
out
of
it.
You
can't
tell
people
what
other
people's
tax
returns
are,
but
if
you
want
everybody
to
know
and
trust
that
when
they
get
audited
by
the
IRS
or
some
other
institution
that
it
was
actually
done
according
to
a
fixed
procedure
in
the
rule
of
law
or
whatever,
it
is
you're
going
to
have
to
do
something,
and
so
maybe
again
hypothetically
if
you're
at
a
zero
knowledge
proof
on
a
blockchain.
You
could
do
this.
A
So
as
I
was
writing
this
talk.
I
kept
thinking
of
this
idea
that,
like
verifiability,
enables
cooperation
so
during
the
Cold
War,
the
US
and
the
USSR
wanted
to
disarm
somewhat.
They
wanted
to
have
less
nukes
because
they
could
save
money
on
it
and
it
was
better
for
the
planet.
But
there
was
this
problem
of.
If
you,
the
U.S,
gets
rid
of
their
nukes,
they
want
to
verify
the
Russians
are
also
getting
aware
of
theirs,
and
that
was
kind
of
hard.
A
So
one
of
the
limits
for
arms
control
treaties
was
that
it
was
hard
to
verify
what
was
going
on
and
what
happened
was
as
spy
satellites
got
better
and
then
spy
planes
got
better
and
more
pervasive.
The
Russians
in
the
and
the
US
were
capable
of
verifying
that
disarmament
was
happening,
and
so
they
could
actually
cooperate,
and
there
actually
are
now
treaties
about
being
able
to
fly
planes
over
other
people's
territory
to
verify
this
stuff.
It's
called
the
open,
spies
act.
It's
open,
Skies
act.
A
Excuse
me,
so
technical
advances
can
enable
better
verification
and
more
cooperation,
but,
of
course,
spy
satellites.
Don't
work
for
this
kind
of
stuff.
On
on
the
internet.
We
can't
just
publish
everyone's
data
ever
out
there
for
everyone
to
see
and
so
to
do
this
in
this
case,
we'd
need
zero
knowledge
groups.
A
So
we
need
to
prove
all
kinds
of
things
about
our
identity
online
that
we're
not
North
Korean
money
launderers,
for
example,
that
were
not
a
bot,
Elon
Musk
or
that
we're
over
18
to
view
a
video,
and
so
that's
time,
but
I
have
some
work
on
this.
That
would
kind
of
be
interesting.
So
with
that
I
guess,
I
will
take
questions.