►
From YouTube: Scaling Privacy with Starlight | Devcon Bogotá
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/scaling-privacy-with-starlight/
Five years ago, at DevCon in Prague, EY took the wraps off Nightfall, our open source public domain approach to privacy. Now it's live on Ethereum as a layer 2 privacy-enabled ZK-optimistic roll-up solution called Polygon Nightfall. That's only half the story though - we also need private smart contracts. This talk will cover our roadmap to that end, including our newest tool in development (also open source) called Starlight.
Speaker(s): Paul Brody, Chaitanya Konda
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: privacy,;,layer,2,;,applications
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
I
only
have
a
few
sessions.
I
want
to
give
all
the
time
to
my
co-star
chitanya
as
much
as
possible.
I
want
to
take
just
a
couple
minutes
to
talk
about
a
little
set
this
up
right
and
you
know
it's
good
to
see
the
hearty
crowd
here.
10
a.m.
On
a
Friday
morning.
Right!
That's
that's
not
when
you
expect
most
people
to
be
fully
awake.
B
A
What
is
the
point
of
privacy
right,
financial
and
Industrial
use
cases?
Privacy
is
fundamentally
essential,
right,
I
think
you
know.
We
talk
a
lot
about
the
value
privacy
in
the
world
of
blockchain.
We
don't
actually
do
a
lot
about
it,
but
if
you
serve
large
companies,
we
do
a
few
Enterprises.
What
you'll
discover
pretty
quickly
is
that
most
of
the
things
that
enterprises
do
aren't
suitable
for
fully
public
consumption
right.
A
They
don't
publish
their
contracts,
they
don't
tell
people
how
much
they're
buying
they
do
in
the
in
the
aftermath
right,
they
publish
their
financial
statements,
but
they
won't
tell
you
in
advance
exactly
what's
going
on
at
the
time
and
they
don't
want
to
disclose
what
they're
buying,
how
much
they're
paying
for
it.
So
privacy
is
really
essential
and
one
of
the
things
that
a
lot
of
people
don't
realize
is
that
you
really
need
actually
two
kinds
of
privacy.
A
You
need
one
kind
of
privacy
which
is
to
represent
digital
assets
or
physical
assets
to
tokens
right,
but
then
you
need
a
second
kind
of
privacy
to
represent
the
business
agreements
that
move
tokens
between
Enterprises
right.
At
the
end
of
the
day,
every
business
agreement
boils
down
to.
One
party
has
money:
the
other
party
has
stuff
and
they're
exchanging
them
under
the
terms
of
some
kind
of
agreement
right.
A
So
in
theory,
if
you
can
represent
the
money
and
the
stuff
as
tokens,
and
you
can
move
them
around
with
privacy
and
you
can
represent
the
business
Logic
the
rules
of
that
exchange
with
privacy,
then
you
can
pretty
much
manage
and
operate
any
kind
of
business
process
on
a
public
blockchain
and
for
those
of
you
who
don't
know
at
ey,
we
are
fanatically
committed
to
public
blockchains
right.
That's
really
not
just
public
blockchains,
but
very
specifically
to
a
theory.
We
only
build
on
ethereum
right.
We
only
build
on
ethereum.
We
only
build
on
public
blockchains.
A
That's
been
our
policy
for
many
years
now,
so
we've
got
one
piece
of
this
puzzle.
It's
called
Nightfall
Nightfall
allows
you
to
move
tokens
around
it's
currently
in
in
beta
on
the
test
net.
We
will
be
in
production
one
way
or
another
at
some
point
in
the
very
near
future,
and
that
allows
you
to
put
things
into
a
shield
contract.
In
a
sense,
it's
it's
a
little
bit
like
Z
cash,
but
for
any
kind
of
fungible
or
non-fungible
asset.
A
The
second
thing
that
we're
building
on
and
the
thing
that
my
colleague
shitanya
is
going
to
talk
a
lot
about
today
is
how
is
both
the
combination
of
Nightfall
and
starlight
and
you're
mostly
going
to
talk
about
Starlight
right
right,
so
Starlight
allows
us
to
do
something
pretty
useful
and
clever,
which
is
to
make
business
logic
private
on
the
public
blockchain,
and
this
is
the
really
hard
thing
we.
We
spent
a
lot
of
time.
Thinking
about
this
right.
It
it's
really
hard
to
teach
developers
to
use
Socrates.
A
How
many
of
you
use
Socrates
it's
hard
right,
it's
really
hard,
but
there's
an
easier
way,
which
is
what
if
we
could
make
a
compiler.
So
you
could
just
mark
up
a
standard
solidity,
smart
contract
and
then
recompile
it
as
a
zero
knowledge
circuit,
and
then
you
could
run
it
on
the
mainnet
or
on
a
layer
two,
then
you
would
have
a
really
simple,
straightforward
way
and
a
scalable
way
to
have
secure
Private,
Business
Logic
on
the
public
ethereum
ecosystem.
So
that
is
our
strategic
goal.
A
It's
nothing
short
in
my
opinion
and
trying
to
completely
transform
how
the
entire
world
does
business
by
moving
Enterprise
transactions
from
private
blockchains
or
private
systems
onto
public
ethereum,
but
with
the
kind
of
privacy
that
enterprises
need.
I
just
want
to
close
out
by
saying
that
both
Nightfall
and
starlight
are
in
the
public
domain
right,
we're
a
large
company,
so
people
are
sometimes
a
little
suspicious
of
what
it
is
we're
doing
right.
Everything
that
we
have
done
is
in
the
public
domain.
We
have
relinquished
our
ownership
rights
to
it.
A
It's
not
just
open
source,
it
is
fully
public
domain
right
and
so
there's
a
lot
of
stuff.
That
still
needs
to
be
done.
We
are
always
looking
for
help
in
this.
We
are
trying
to
build
a
true
open
source
ecosystem
around
industrializing
and
scaling
privacy
with
that
I
am
going
to
hand
over
over
to
the
true
star
of
this
presentation,
which
is
caitanya
Kanda.
C
C
That
is
just
not
practical,
because,
as
ey,
we
need
to
be
able
to
churn
out
private
applications
at
a
much
quicker
rate
than
the
developers
can
actually
learn,
and
that's
pretty
much
one
of
the
reasons
why
Starlet
was
born.
But
in
order
to
do
that,
you
now
need
people
who
are
experienced
in
writing.
Xenology
proof
circuits
that
itself
is
another
problem,
because
the
number
of
people
who
can
do
that
today
is
very
very
few.
C
C
Another
thing
we've
only
realized
after
actually
building
this
application
is
that
it
did
something
a
lot
more
crucial
in
order
to
build
private
applications.
Now
it's
pretty
much
instantaneous
in
the
fact
that
the
amount
of
time
it
takes
you
to
create
private
private
applications
is
the
amount
of
time
it
would
take
you
to
write
a
solidity
smart
contract
and
modify
it
a
bit
and
that's
it
instantaneously.
You
have
private
applications
ready.
C
Most
importantly,
what
we've
also
realized
with
an
r
d
is
that
as
a
bunch
of
people
who
are
hired
to
be
smart
and
to
do
smart
work,
we've
not
done
very
smart
choices,
because
essentially,
what
we've
done
is
we
automated
our
jobs?
What
do
we
do
now?
Well,
sadly,
I
think
Paul
had
that
today,
so
he
might
or
might
not
have
realized
that
until
now,
but
there's
no
going
around
it
anymore,
very
smart
again.
Now
how
does
Starlight
work?
C
You
take
a
solidity
smart
contract
and
we
pick
solidity
because
it's
the
most
popular
programming
language
that
blockchain
developers
know
today
you
take
a
solidity
smart
contract
and
then
you
mark
certain
parts
of
the
smart
contract
private
and
then
you
create
this
other
contract
called
zolidity.
Smart
contract
or
zero
knowledge
proof
compatible
with
smart
contract,
and
you
take
that
decorated
small
contract
and
when
you
call
zapify
zapify
stands
for
zero
knowledge,
apify
private
app.
If
I
is
pretty
much
what
it
can
raise.
C
Essentially
what
you
have
are
contracts
contracts
that
hold
the
private
business
logic
in
terms
of
proof
verifications,
and
then
you
have
circuits
which
have
a
bunch
of
statements
that
you
then
have
to
generate
a
proof
with,
and
then
you
have
what
we
called
Timber
now
Timber
is
another
ey
product.
That
is
actually
one
of
our
best
work.
In
fact,
what
Timber
is?
C
Is
it
a
Markle
tree
that
holds
as
Leaf
commitment,
Leaf
nodes
commitments
to
values
that
you
would
like
to
have
private
and
the
best
part
of
it
is
that
on
Smart
Con
on
on
chain?
All
you
store
is
the
root
of
this
Markle
tree
you're,
not
throwing
any
of
the
leaf
nodes,
none
of
the
commitments,
but
you
also
store
what
we
call
a
frontier.
The
front
here
is
a
bunch
of
nerds
at
various
Heights
of
this
tree,
which
is
used
to
compute
the
root
in
a
much
more
efficient
way
than
you
can
traditionally
compute
today.
C
In
a
Markle
tree
and
the
leaf
nodes
which
hold
the
commitments,
the
intermediate
nodes
of
the
Markle
tree
and
the
root
itself
are
held
inside
a
local
database
which
is
listening
to
the
blockchain
events
from
Timber.
So
that's
what
Timba
does
timber
holds
a
list
of
private
States?
Essentially,
and
then
you
have
a
blockchain
client
which
will
be
used
to
do
transactions
of
Starlight
you,
you
use
a
blockchain
client
to
send
those
transactions,
and
then
you
have
Socrates
now.
C
Socrates
is
a
tool
that
lets
you
create
right
circuits,
compile
them
create
trusted
setup
of
these
circuits.
If
you're
using
a
trusted,
setup
related
stuff,
and
then
you
can
generate
proofs
with
it
as
well
as
do
off-chain
verification,
which
is
not
too
relevant
for
us,
because
we
do
on-chain
verification
and
then
finally,
we
also
create
test
end-to-end
tests
that
show
the
entire
application
or
private
application
working.
So
it
has
to
call
the
contracts
generate
the
proofs
from
the
circuit
and
then
give
you
the
final
end
state.
C
C
So
any
value
that
is
held
inside
a
commitment
is
not
visible
to
the
outside
world,
only
visible
to
the
people
who
can
open
the
commitment,
and
it's
bound
to
that
value
too.
So
you
have
to
create
a
commitment
of
whichever
it
is
that
the
state
variable
that
is
declared
as
secret
now
to
take
a
quick
look
at
the
example.
Here
you
have
a
very
basic
example:
you
have
a
state
variable
called
X.
C
You
declare
that
to
be
a
secret,
so
which
means
any
value
that
is
held
inside
X
has
to
be
secret
to
the
outside
world
can
only
be
visible
to
the
owners
of
that
commitment,
and
then
you
have
a
function
called
add
which
takes
in
as
its
parameter
a
variable
called
Y,
which
is
also
meant
to
be
secret.
So
what
ad
does
is
it?
It
increments?
C
C
Secret,
State
variables
are
useless
if
all
they
do
is
hold
the
variable
and
do
nothing.
What
you
need
to
be
able
to
do
is
to
actually
make
changes
to
these
variables.
You
need
to
be
able
to
update
them,
but
the
question
becomes:
who
can
update
them?
Should
it
be
the
owners
of
these
commitments,
or
should
it
be
other
people
too,
and
there
are
instances
where
you
need
both
of
those
situations?
So
you
need
to
be
able
to
differentiate
between
the
two
and
that's
where
none
comes
in.
C
So
what
known
does
is
it
takes
the
state
variable
and
it
will
only
let
the
person
that
can
update
this
variable
to
be
the
owner
of
that
state
variable.
So
nobody
else
can
make
changes
to
that
variable.
So
the
kind
of
changes
you'd
make
is
essentially
incrementation
statements
and
the
way
it
works
is
also
very
important.
C
So
that
just
does
not
reveal
which
commitment,
you're
actually
using
then
you'd
actually
have
to
show
that
you
can
change
that
commitment.
By
proving
that
you
know
the
secret
key
of
the
public
key
that
is
used
within
the
commitment
and
that
public
key
essentially
refers
to
the
owner
of
the
commitment
right.
Then
you
will
have
to
nullify
the
old
commitment
by
creating
a
nullifier,
and
then
you
would
have
to
create
a
new
commitment
which
holds
the
updated
stage,
which
is
X
Plus
Y
in
in
place
of
X.
C
C
Plus
Y
is
defined
as
known,
essentially,
what
you're
doing
is
you're
creating
all
of
these
statements,
which
will
then
be
generated
as
proof
and
the
only
person
who
can
create
that
would
be
the
owner
of
the
commitment
to
begin
with,
and
then
you
have
unknown
now
unknown
is
the
opposite
of
exactly
what
known
is
so
known
was
someone
who
owns
it?
Making
changes
to
it
unknown
is
someone
who
does
not
own.
This
commitment
should
also
be
able
to
contribute
to
the
value
of
that
state.
C
C
So
if
you
want
to
know
the
exact
value
of
that
secret
variable,
that
does
not
come
from
one
commitment,
but
it
comes
from
the
summation
of
all
of
the
part
commitments
and
these
part
commitments
themselves
can
be
seen
as
utxo
like
nodes
that
can
then
be
individually
used
to
move
around.
So
that's
what
part
commitment
does
and
to
take
a
quick
look
at
how
that
will
work.
We
have
an
example
again
here,
a
slightly
different
example:
you
have
a
secret
variable
which
is
called
balances,
which
is
a
mapping.
C
It's
a
mapping
from
addresses
to
the
balance
amount.
You
have
two
functions,
one
is
deposit.
Whoever
calls
deposit
is
going
to
be
able
to
increment
their
balance
by
the
set
amount,
and
then
you
have
transfer
and
whoever
calls
transfer
will
transfer
a
certain
amount
from
their
balance
to
somebody
else.
C
What
I
want
you
to
notice
here
is
that
just
the
yellow
bits
of
the
code,
so
you're
declaring
balances
to
be
secret,
which
means
you
want
no
one
to
understand
whose
balance
is
how
much
and
then
you
have
the
function,
parameters,
amount
and
recipient
to
be
secret.
So
if
you
want
to
do
a
transfer
to
a
certain
user,
a
recipient
and
it's
by
a
certain
amount,
we
want
both
of
those
to
be
secret
too,
so
those
will
become
private
inputs
to
your
proofs.
C
Finally,
the
last
statement,
where
you
see
unknown
balances-
that's
the
other
bit.
So
the
way
unknown
works
is
by
creating
part
commitments
and
that
particular
statement.
You
will
notice
that
you're
incrementing
the
balance
of
somebody
else,
not
your
own
balance.
That's
why
you
need
to
frame
it
as
unknown
instead
of
calling
it
known
and
the
compiler
will
be
able
to
create
part
commitments
instead
of
throwing
an
error
at
you
very
quickly.
I
keep
talking
about
commitments
just
want
to
talk
about
what
commitment
actually
holds
for
your
normal
variables.
C
Well,
you
can't
see
what's
happening
there,
but
I
will
tell
you
it's
that
it's
about
it's,
this
mapping
kind
of
state
variable,
which
holds
balances
that
are
mapped
from
address
to
the
balance
amount.
It's
essentially
in
that
situation,
there's
a
slight
change
where
the
first
part
of
that
hash
has
the
state
variable
ID
and
the
mapping
key,
which
in
this
case,
will
be
the
address
of
who's
ever
balance.
C
It
is,
and
you
hash
them
together,
and
that
becomes
the
first
part
of
the
commitment
structure,
and
that
is
literally
how
the
commitment
structures
work
now
in
terms
of
the
various
steps
that
we
go
through
to
actually
have
the
completed
private
application.
These
are
the
steps.
First,
you
will
take
the
solidity
smart
contract,
which
is
the
solidity
smart
contract
with
the
keywords
added
to
it
by
the
developers.
You
then
syntax
verify
it.
There
will
be
various
cases
where
developers
would
not
use
the
keywords.
C
The
right
way
and
you'd
have
to
be
able
to
throw
errors
and
warnings
at
it
and
install.
It
is
smart
enough
to
be
able
to
show
that
then.
The
first
step
is
to
actually
remove
the
keywords
that
you
added
these
three
keywords
and
you
will
have
a
plain,
vanilla,
looking
solidity:
smart
contract,
you
take
that
contract
run
it
through
solidity,
compiler
and
output,
an
api.json
file
which
essentially
is
the
syntax
with
the
various
State
variables
and
functions
that
this
contract
holds.
C
Now
it's
a
Json
object
of
the
nested
type,
but
essentially
you
can
parse
it
as
what
we
as
what
we
know
as
abstract,
abstract,
syntax
tree
and
AST.
So
what
abstract
syntax
tree
is
it
lets
you
take
a
new
program
and
split
the
syntax
of
this
program
into
a
tree
and
in
the
case
of
facility
smart
contract,
you
would
have
your
contract
at
the
very
top,
which
will
then
be
split
into
State.
Variable
declarations
and
function.
C
Definitions,
State
variables
will
then
be
split
up
into
the
type
of
the
variable
and
the
value
of
the
variable
and
the
function.
Definitions
will
be
split
up
into
the
type
of
the
you
know:
the
function
parameters,
the
return
parameters
and
the
body
the
function
parameters
and
the
return
parameters
will
be
split
up
pretty
similar
to
the
state
variables
between
the
type
and
the
value
they
hold.
And
then
the
body
which
is
the
important
bit
is
going
to
be
split
up
into
the
kinds
of
statements
that
can
exist.
C
Expression,
statements
assignment
statements,
so
you
will
have
the
operation
on
on
one
end,
with
its
children,
node
being
the
left
and
the
right
hand
operands
of
this
operation.
That's
that's
how
your
abstract,
syntax
tree
would
normally
look
like.
So
you
take
that
tree
now,
once
it's
generated
from
the
abi.json
and
then
you
put
back
the
keywords
that
you
used
originally
in
the
solidity
into
this
tree.
So
if
a
variable
was
secret
into
its
type,
you
will
now
say
secret
type.
C
Variable
now
from
this
modified
abstract
syntax
tree,
you
will
have
to
generate
four
different
output
files,
the
files
being
circuits
contract,
the
orchestrator
code
and
the
test
code,
generating
that
you
will
actually
have
to
create
four
different
kinds
of
abstract
syntax
trees,
which
will
represent
what
the
code
should
look
like
in
files
from
these
original,
abstract,
syntax
tree
and
from
those
abstracts
and
tax
trees.
You
will
then
generate
the
code
files.
That's
pretty
much.
How
it
works
sounds
simple,
and
the
code
is
painful.
C
I
tell
you
now
just
to
give
a
quick
idea
of
what
the
architecture
looks
like.
You
would
have
your
Zol
contract,
which
has
three
functions,
all
of
which
you
need
to
have
all
of
which
have
secret
variables
that
it
manipulates.
Then
you
will
have
the
orchestrator.
The
orchestrator
holds
the
API.
Essentially
a
user
will
call
the
API
and
the
API
will
have
an
API
endpoint
for
each
of
those
functions.
So
once
you
call
the
API,
the
API
will
then
orchestrate
by
interacting
with
the
proof
generation
or
the
contracts
accordingly.
C
Now
you
also
Orchestra
can
also
do
setup
for
your
circuit,
which
generates
the
private
and
proving
keys
in
the
verification
keys
for
these
circuits,
and
then
it
will
also
deploy
the
required
smart
contracts
onto
the
whichever
blockchain
you're
using.
But
in
this
case
we
always
use
ethereum
pretty
much,
and
it
will
also
deploy
the
verification
key
into
the
verify
your
smart
contract.
And
then
it
also
holds
the
database
of
the
commitments
that
pertains
to
the
user.
Who
is
using
this
orchestrator,
as
well
as
the
secret
information
that
is
required
to
open
the
commitments.
C
It
will
also
hold
Keys,
which
suggest
about
the
ownership
of
the
of
a
commitment,
and
all
of
this,
of
course,
can
be
really
architected
a
bit
more
for
production
scenario,
while
you're
storing
this
information
much
more
securely
in
a
hatches
them
wherever
you'd
like
and
then
you
will
have
the
smart
contract
and
you
have
the
shield
contract,
which
is
the
con.
The
function,
which
is
the
contract
that
gets
called
when
somebody
wants
to
do.
C
One
of
these
functions,
which
will
in
turn
call
the
verify
your
smart
contract
to
verify
the
proof
that
you've
just
submitted
to
it
using
the
verification
key
that
is
relevant
to
that
verification,
and
then
you
will
have
the
timber
tree
that
we
just
spoke
about
earlier.
All
it
holds
is
just
the
route,
that's
why
you
see
it
in
yellow
the
rest
of
it.
C
It's
not
really
held
inside
the
smart
contract
cost
purposes,
and
then
you'll
have
the
Socrates,
which
holds
the
proving
Keys
the
circuit
files,
which
will
help
in
the
generation
of
the
proof
for
each
of
these
different
circuits.
And
then
you
would
have
the
temple
marker
tree,
which
holds
all
of
the
nodes
of
the
Timber
Markle
tree
itself.
Now
taking
we're
almost
the
final
bits
so
giving
a
quick
example-
and
here
we
have
it,
invoice
smart
contract
and
the
secret
variable
in
this
case
is
in
voice,
which
is
a
mapping.
It
holds
against
an
address.
C
How
much
invoice
is
owed
by
that
address.
Now
you
have
two
different
functions.
Add
invoice
pane
wise.
The
way
adding
Voice
works
is
that
somebody
who
wants
to
invoice
a
party
a
that
once
in
what
invoice
party
B
will
add
to
party
B's
invoice,
pinning
invoice
amount
the
amount
they
should
be
invoiced
by,
and
so
that's
why
you
will
see
that
I
am
invoicing.
Somebody
else
so
I'm
setting
their
stage
so
I'll
have
to
specify
unknown
and
that's
pretty
much
what's
happening
here
and
then,
when
pain
was
called.
C
What
it
essentially
does
is
I
will
pay
my
pending
invoice
to
whoever
I'm
supposed
to
pay
and
while
doing
that,
I
have
to
reduce
the
amount
owed
in
my
in
Wise
amount
of
debt
statement,
State
variable
by
the
amount
I
paid
by.
So
that's
what
pain
wise
does
now,
just
tracking
through
the
various
steps
that's
going
to
happen.
Is
you
know
you
have
an
absolutely
smart
contract
which
will
spit
out
all
of
these
different
bits
of
logic.
A
user
will
first
call
add
invoice
API
because
they
just
want
to
add
an
invoice.
C
When
that
happens
immediately,
the
orchestrator
will
look.
Oh,
should
I
fetch
a
commitment
from
inside
my
DB
or
not
in
this
case,
because
I'm
adding
an
invoice
with
somebody
else,
I
I,
don't
have
any
of
my
commitments
that
I'm
spending
I'm
just
creating
a
new
commitment
for
somebody
else
with
their
public
key
as
the
ownership,
so
I'll
just
be
creating
a
commitment
from
scratch.
Once
that
is
done,
I
will
then
have.
C
The
orchestra
will
then
have
to
speak
to
the
Socrates,
asking
you
to
generate
a
proof
with
the
private
inputs
and
the
public
inputs
required
for
this
function,
using
the
private
proving
key
of
the
ad
invoice.
Once
that
is
done,
we
get
back
the
proof
to
the
orchestrator
to
the
orchestrator
and
the
orchestrator
will
then
speak
to
Shield
contract
by
calling
the
ad
invoice
function.
C
The
Shield
contract,
which
in
turn
will
receive
this
proof
from
orchestrator,
will
have
to
call
verify
your
contract
to
verify
that
bit
of
proof
using
the
relevant
verification,
key
of
ADD
and
wise
and
on
successful
verification.
We
update
the
state
by
adding
the
commitments
to
this
Markle
tree
and
the
route
is
updated
at
which
point
the
timber
tree,
which
is
a
Timber
container,
which
is
listening
to
the
timber
events
of
chain,
will
receive
the
latest
commitment
and
The
Roots,
and
then
it
will
store
that
within
itself.
A
Thank
you
to
Tanya
and
I
will
just
add
one
final
message,
which
is:
if
you
want
to
play
with
this
stuff,
it's
out
there
on
GitHub,
it's
github.com
eyblockchain.
It
is
free,
it's
open
source.
It's
maturing
quickly,
I
think
we're
in
a
pretty
good
beta
now
and
it's
getting
better
by
the
day.
So
please
go
try
it
make
zaps
and
please
use
our
our
phrase.
Zaps.
Do
we
have
any
questions
or
just
gratuitous
flattery?
Yes,
you,
sir.
B
I
just
want
to
say
this
project
is
super
awesome,
one
of
the
most
exciting
things
I've
seen
here
at
Devcon.
Now
I
did
notice
on
the
GitHub
there's
a
lot
of
disclaimers
everywhere.
Basically
saying
please,
please
please
don't
use
this
in
production.
I
just
was
curious.
What
do
you
guys
have
a
road
map
or
what
are
your
thoughts
around
when
you
think
it'll
eventually
be
a
little
bit
more
mature
and
ready
for
production
applications.
A
I
mean
I
think
we
are
I
mean
we
will
say
when
we
think
we're
sort
of
at
version
1.0
right
and
we
encourage
people
to
test
and
play
with
it,
but
and
and
we
will
probably
get
some
third-party
verification
as
well,
but
you
know
fundamentally,
we
do
like.
We
can't
tell
other
companies
what
to
do
and
we
certainly
don't
want
to
be
responsible
if
things
go
wrong
which
they
always
do
in
software.
So.
D
So,
thank
you
for
the
talk,
so
one
question
is
there
a
way
that
two
private
keys
can
really
reach
the
information?
Another
proof,
so
in
that
sense,
you
always
have
been
figure
out
that
the
balances,
for
example,
the
only
one
looking
at
the
same
balance,
was
the
address
who
owns
the
balance.
So
is
there
a
way,
for
example,
is
there
a
regulator
or
somebody
who
needs
to
have
all
the
access
at
all
the
proof
to
be
included
in
the
information
you.
C
Mean
to
say
if
a
commitment
can
be
owed
by
more
than
just
one
key
well,
ownership
is
just
always
with
the
one
key
and
ownership
is
defined
as
not
whose
key
there
is
inside,
but
also
actually
the
knowledge
of
the
commitment.
If
you
wish
to
share
the
knowledge
with
more
than
just
one
person
either
of
them
can
now,
you
know,
spend
that
commitment.
So,
if
you'd
like
multiple
parties
to
be
able
to
spend
a
commitment,
you
just
share
the
secret
information
with
them.
That's
what
makes
them
the
owner.
D
C
So
as
part
of
events
you're
not
actually
revealing
these
secret
variables
at
all,
all
that
gets
sent
out
as
part
of
the
events
is
commitment,
which
is
hiding
such
that
no
one
can
actually
see
what's
in
inside
it
anyway
and
then
nullifiers.
Those
are
really
what
will
be
the
variables
that
events
transmit.
Think.
E
C
It
spits
out
strategy,
smart
contracts,
obviously
it's
within
in
the
byte
code
that
is
required
for
solidity.
So
in
that
sense,
if
that
yes,
but
if
you
want
to
hack
it
to
something
else,
you
literally
have
to
change
the
code
such
that
it
spits
out
the
bytecode
that's
relevant
to
whichever
blockchain
you'd
like
to
use
it
for
okay.
E
C
Up
so
the
proof
itself
is
generated
by
Socrates
as
long
as
the
the
proving
system
that
you
want
is
supported
by
Socrates,
you
can
actually
have
it
generate
the
proof
in
exactly
The
Proven
system
that
you
want
don't
think.
Planck
is
currently
supported
by
Socrates,
so
you
wouldn't
be
able
to
do
that,
but
I'm
sure
they're.
Looking
to
add
it
thanks.