►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/vampire-a-novel-cheap-to-verify-zksnark/
In this talk, I would like to introduce Vampire (https://eprint.iacr.org/2022/406) -- a novel zkSNARK that has the smallest communication complexity and on-chain verification cost of all known updatable zkSNARKs.
Speaker(s): Michal Zajac
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zero-knowledge,zkSNARK
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
Guys,
I'm
really
excited
to
to
present
you
our
new
music,
a
snark.
It's
a
it's
a
joint
effort
with
with
two
other
guys
with
helger
lipma
and
janosim
from
simula.
So
we
in
our
paper
we
presented
a
new
zika
snark
called
vampire
it's
it's
a
zika
snark
for
arithmetization,
called
as
r1cs
light,
it's
Universal
and
updatable.
A
That
means
that
you
can
have
like
one
trusted
setup
for
for
every
circuits
up
to
given
size,
and
if
you
don't
trust
that
the
trusted
setup
was
generated
correctly
or
non-maliciously,
you
can
always
update
the
setup
by
your
own.
It's
it's
based
on
Marlin,
another
ZK
snark,
but
it's
like
really
highly
optimized.
I
would
say
it's
a
Marlin
on
steroids.
A
A
So
the
difference
in
the
proof
size
is
about
500
bytes,
but
graph
16
is
9
either
Universal
nor
updatable,
and
it
uses
only
two
subjects
and
why
I
want
to
talk
about
some
checks
is
because
this
optimization
was
possible
thanks
to
the
fact
that
we
we
invented
a
new
subject,
which
we
adapted
account.
It's
a
universe,
some
check
it
has
great
communication
efficiency,
because
the
proof
for
the
subject
is
only
one
group
element.
Furthermore,
the
complexity
of
of
this
subject
is
really
really
good.
Is
almost
linear.
What
is
much
better
than
a
standard
subject?
A
We
use
in
snarks
called
Aurora
which,
which
requires
ffd
okay.
So
let
me
tell
you
how
to
make
snarks
shorter,
how
it
was
possible
to
to
to
do
to
deliver
a
snark.
That
is
only
four
group
elements.
Long
so
snarks
like
a
class
of
snarks,
we
we
are,
we
were
investigating,
has
a
number
of
of
building
blocks,
so
so
first
there's
a
relation,
so
we
need
to
to
pick
What
relation
for
snark.
We
are
proving,
and,
for
example,
the
relation
could
be
r1cs.
It
could
be
r1cs
light.
A
In
our
case,
long
hair
has
its
own
relation,
so
arithmetization
matters.
The
ultimatization
also
tells
you
well,
the
proof
size
really
highly
depends
on
the
arithmetization.
You
pick,
then
we
have
a
subject.
So
basically,
the
question
is:
how
many
subjects
do
you
need
to
show
your
result?
Then
we
have
lean
check.
A
So
the
question
here
is:
do
we
even
need
a
line
check
and
the
last
but
not
least,
the
famous
polynomial
commitment
scheme,
which
also
like
defines
the
the
size
of
the
proof,
so
we
need
to
tell
which
polynomials
are
we
committing
to
and
what
polynomial,
what
commitments
do
we
open?
Can
we
batch
openings?
Can
we
batch
commitments
so
to
compare
to
compare
Marlin
with
our
vampire?
So
there
are
some
several
differences.
A
So
first
of
all,
Marlin
is
for
r1cs
while
vampire
is
for
r1cs
Lite
and
why
it
matters,
I
will
say
in
a
bit
in
a
few
in
a
few
slides,
then
we
have
a
sub
check.
Both
Marlin
and
vampire
need
two
subjects,
but
but
Marlin
uses
Aurora
some
check
and
the
vampire
uses
count
and
Aurora
regarding
clean
check,
martinin
acquires
it
we
don't.
A
Then
there
is
a
batching
of
of
kcg
a
cut,
a
polynomial
commitment
scheme,
so
in
case
of
marlin
it
is
batched,
but
we
managed
to
budget
better
okay.
So
let
me
tell
you
about
the
difference
between
r1cs
and
r1c
as
slight,
so
we
start
with
arithmetic
circuit
as
usual,
and
and
we
we
have
some
left
input
gates
in
the
circuit.
We
have
some
right
input.
Gates,
we
have
some
output
Gates
and
these
gates
are
encoded
into
three
matrices,
so
Matrix
a
corresponds
to
left
input.
A
So
we
have
only
one
Matrix
that
need
to
be
need
to
be
sent
and
we
want
to
show
that
that
the
vector
with
evaluations
times
this
Matrix
gives
gives
zero.
Okay,
so
let's
look
at
this
for
a
moment,
so
so
W
Times
Z
equals
zero,
basically
means
that
for
all
X's
sum
over
y
of
w
x
y,
so
the
elements
of
the
W
Matrix
times
element
of
a
z
Vector
equals
zero
and
with
some
mathematical
trickery
we
can
say
Okay.
So
let's
not
talk
about
vectors.
A
Let's
talk
about
polynomials
and
let's
talk
about
some
of
some
polynomials
some
over
some
y
for
some
polynomial
F
and
here
comes
the
subject.
So
count
is
a
new
subject.
So
subject
argument
basically
states
that
if
you
have
a
polynomial
F
and
you
evaluate
it
at
some
elements,
a
belonging
to
a
set
H-
and
you
sum
over
all
these
elements,
then
you
get
some
value
V
and
compared
to
Aurora.
A
As
I
mentioned.
I
Aurora
needs
two
group
elements.
We
need
only
one
group
element,
so
I'm
not
going
into
details
of
of
this
subject-
maybe
maybe
some
other
time.
So
let
me
only
say
about
batching
kcg
very
quickly,
so
there
are
like
two
two
ways
of
batching
polynomial
commitments.
First
of
all,
we
can
batch
openings
of
multiple
polynomials
evaluated
at
the
same
point
and
that's
what
Planck
is
doing.
That's
also
what
what
was
done
in
Marlin.
However,
due
to
some
new
results,
we
can
also
batch
openings
of
multiple
polynomials
at
multiple
points.