Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 15 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: ZK Proof Performance and Security Characteristics by Brian Wilkes, CFA | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/zk-proof-performance-and-security-characteristics/

ZK tech gets almost mystifying treatment from both regular users & devs. However, beyond the moon math, quantifiable differences between the zkps deployed in the Ethereum ecosystem can help users and builders understand what they are interacting with. Join me as I explain our methodology for collecting and quantifying these differences in a format digestible for the non-math professor.

Speaker(s): Brian Wilkes, CFA
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: ZKP,performance and security metrics,data analysis

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Welcome back so our next speaker is Brian, Wilkes and he'll, be comparing the performance and security characteristics of some zero knowledge, proofs that are commonly deployed in the ethereum ecosystem. So Brian.

B

Hello wow, that's loud.

C

So, who are my data scientists in the room raise hands very few devs devs out there lots of devs nice investors d-gens, yes, put it down um how about expertise, um who's a beginner in zero knowledge just got the basics cool um who knows what's going on, but has not written a circuit before true ZK expert knows a ton about ZK. You perfect all right!

C

um Well, um thanks for having me, my name is Brian. um I am a grantee with the ethereum foundation on privacy, scaling exploration team, so um today I'm going to be talking about um ZK proof, performance and security characteristics. So um so, what's in the docket for the day,.

C

Search for me to go over some background, so we'll just give some background on what zkps are I'm, try and work through what they actually mean for on-chain data.

C

Then we're going to look at how to actually find those um zero knowledge, proofs and verifiers on circuits on and off chain.

C

Then we'll look at some of the characteristics behind those and what they mean so, unfortunately, Waldo's not going to be with us today. So this is the second best piece of art. I've ever done so I hope you appreciate it everyone. So what are zkps of our high level? First we'll go through this quick and then move on, but um we have Alice. Alice wants a drink. She's a prover we have Bob Bob is the bartender is a verifier.

C

um Alice does not want to give all of her information to Bob, and so therefore she can put in her birthday the circuit will output a proof. Bob can verify that proof is correct, that she is old enough to drink and the cerveza will flow. So um what's important for this, is you have approver?

C

You have inputs, you have the circuit itself. You have the proof popping out and then Bob decides, if it's true or false, and then does an action based on whether that verification is true. So um why do we need zero knowledge proofs in ethereum? So the first thing that we struggle with is scalability so right now we can do about on main chain 13 transactions per second um and we really need to get into that 13k transactions per second, if not significantly higher, to get in the Visa range.

C

So um how is your knowledge proofs help us that you can separate? They can take fully separate chains um and they can impart the full security of ethereum to those chains.

C

So privacy as well um is something that's a hotbed issue to me: uh ethereum's public, if you're a data scientist um as a few of you are, you can go online or you can go on ethereum and see anyone ever everyone ever does um so I don't want to live in a world where you have scalability and everything sits on that platform without having the Privacy behind it. So, let's talk about on chain. So this is what it looks like you have your layer, 2 blockchain here, um so uh they have the blocks going.

C

You aggregate some of the transactions together um and then you batch them into a ZK circuit. So you take those transactions they go into the circuit. The circuit produces a proof. This is all off chain. So then you have your ethereum main chain on where things are expensive. um So you're able to take your proof and post that to the verifier smart contract um and then the layer, 2 State source of Truth can get updated. So that's what happens with the scalability side of things.

C

Now, let's talk privacy, um it's very similar I won't have reveals for you, I'll just go right to it. There's a secret there's the ZK circuit um you put the secret through. It, produces a proof and then that proof goes on chain to the verifier. Smart contract and funds are released. So that's very similar. That's going to be your mixers. Your channel caches, different things.

C

um What's important, for both of these two is that you have um off chain and on chain and on chain, is where the verifier in the proof gets. Posted I mean off. Chain is with the circuit, and the proofs are so. This is the best piece of artwork I've ever done so I appreciate it. While you can.

D

C

Let's find some ZK proofs on chain and figure out where they're at so um this is called the search for verifiers. So why are we searching for verifiers the important characteristics of a zero knowledge? Proof are in the circuit, so the circuit is going to generate um they're, going to have the different characteristics that are important to us. Let's look at a particular DK sync um transaction flow, for instance, so between September 26th and September, or September 20th and September 26th.

C

There were two thousand one hundred and seventy one, two thousand one hundred and seventy blocks 265 000 transactions, um which were batched together into 214 inputs proofs brought on chain. So what you want? The ZK circuit did not change, but those inputs and the proofs did um so.

C

Each circuit has a unique verifier on chain, so for each circuit or circuit systems they have their own unique verifier. That's there and the. um If you want to know about circuits- and you want to use on-chain data, you need to go through the verifier so going through the verifier. um You use the L1 on chain data. um So let's talk about how to find verifiers. So the first section is, um if you guys, haven't used bigquery on from Google I highly recommend it um it's a great tool.

C

It allows you to search through lots more data than things like Doom do as much as I love, Dune, so um different queries that time out within 30 minutes for Dune will go in about two seconds for bigquery, so um check it out. um The three tables that I used um for this project were contracts, traces and transactions since you're, almost all devs I won't go over traces versus transactions, but start versus end of things. So, okay, um so the first way to try and search through bytecode um is to go for.

C

Constants constants will show up in byte code as a big hex. So if you can get a big enough number, that's unique enough for what you're looking for you can take that in search with very simple SQL queries um in through the byte code. So this is both a big and unique value. It's the finite field, um so the finite field is the range at which you modulate over when you're doing different cryptography cryptographic, things for um knowledge.

C

So this is it in HEX form, um it's massive, so the first way that I look through the data was to search for this finite field. Unfortunately, it didn't exactly give me all the verifiers, so it gave me a lot of different noise. There's 558 contracts on that have the finite field constant.

A

C

After checking every one of them manually, most of them are not verifiers, so I moved on to trying to get into method IDs, so the second tool that I think is really important, and apparently it's new according to etherscan, it is the transaction decoder, so the transaction decoder um what it does. If you look through it is, if you go through and look at a transaction, it will tell you the exact flow of what happened on through that transaction. So, looking at this here is another ZK sync example.

C

um First, it proves the blocks after going through some proxies and then in the verifier contract it does. It calls a function called verify, aggregate block proof. So after doing some modular Edition down below it, outputs, true and the state gets updated, so method IDs. The method IDs are the first 10 characters or four bytes that come through with any input or transaction call for traces or transactions, so just going through them briefly, um you can see that this function here is for startware um and it's a fry verifier.

C

So this is what is actually verifying the proofs. um So if you want to know what the method ID is for this particular function here, then you take. You take out all the chaff. If you will from inside, and then you run the kcac 256 and you take the first four bytes, plus the indicator that it's hex so that there, the ox E85 A6 a28, is the method.

C

Id it'll be the first 10 characters in any call that when you look through the data, so um a great resource again, um I'd like to show the resources that I get to use. um The four byte.directory is fantastic. um You can input any method ID and it will tell you what the um text signature for what it should be is so um now. What do we find?

C

Essentially there's about 65, confirmed verifiers on main chain now, there's probably a few more on, maybe 30 more that are not on verified public contracts, so um in those 65 confirmed, verifiers have done over 600 000 verifications.

C

So um of those there are about 16 that are active. Still, um that's active according to me, and some of them are very minor projects. If you're trying to squint it's because I made it small. So you'd have to go on the GitHub at some point. So sorry, um I was surprised by how few verifiers there are actually on main chain but moving on to the characteristics so we'll look at proving systems um so you're proving systems here that are actually being verified on main chain.

C

um You have your your Classics I'm sure you guys have all heard of these, but your growth 16 from 2016. um that runs your tornado cash. Your Hermes, your Loop ring um in a bunch other uh different uh privacy functions. You have plonk, um which is asked to connect ZK sync, um then you have turbo plug, which is the original Aztec um Aztec connect uses turbo Planck before it gets on chain, but then it uses Planck on chain. If that makes any sense, then you have Halo 2, which is coming out.

C

Zcash uses it um and then also scroll is going to deploy with it most people I talk to are really moving towards that Halo 2 move. It seems like it's a really good proving system, so um it's not on main chain yet that I've seen so then you have your Starks on, and that includes all your starboard projects.

C

So Starks versus snarks snarks, the succinct, non-interactive argument of knowledge and that then there's Starks, which are scalable, transparent arguments of knowledge and the major difference between the two there's, a bunch of them. These are the base level for what happens, but Quantum Computing is probably going to be able to take down, snarks or but Starks will probably be resistant to it. So what is quantum Computing? When will it come?

C

I have no idea, but um if it does, this is what will happen so looking at these different um proving systems, you have graph 16, which is in blue, um really taking off that's on the back of tornado cache as well as loopering, and then you have down below you. Have your Stark um fries that are coming through. Those are the starkware projects.

C

um They have really taken off dydx posts, a lot of data to chain, often and then you have your plonks and unknowns- are probably blocks, um but I didn't wasn't quite confident enough to say that so, um okay, let's talk about trusted setups, so a trusted setup is where, on the elliptic curve, um you should evaluate the different ZK proof.

C

So it's it's kind of an agreement and a spot that um approver and a verifier can done kind of verify through um what that snark's going to look like so I'd like to think of it like a trustful, how many people have done trust Falls before in their life a couple yeah, it's scary, um so you get up there on a big standing and then you fall backwards, and as long as one strong person below you is there to catch you, then you should be good.

C

So as long as the trusted setup is kind of similar, if everybody's toxic waste gets collected together, if everyone gives their secret out, um it doesn't want to catch you or is distracted, then um the snark can be. um Then the chest is set up, um will not work and someone will be able to write proofs that will um be false, positives and they'll be able to take money from you if that makes sense.

C

So um this requires one honest participant from the mo from the MPC um ceremony I, also like to think of it like Thanos. um If you have enough Infinity Stones, if you have them all, you can destroy the proof and it'll be good. So uh it's bad. Actually, okay! So um what are the trusted? Setups?

C

um We have um growth 16 over there on the end, um it has a two-phase trusted setup um and then the universal setups came in and that's Planck and turbo plunk, and that only requires one so, whereas Roth 16 needs a new ZK circuit or needs a new Pro needs a new entrusted ceremony for the um each circuit that it produces.

C

um Planck and turbo Planck have a universal setup and that allows them to only have one total ceremony. So if anyone here wanted to create a plonk, you could use the universal ceremony. That's already been created um and already been done, and then you have Halo 2 and Starks. um They do not require trusted setups. So that's, obviously you want the least amount of trusted setups, as you can so moving on on the actual projects themselves, you have um graph, 16s are Loop, ring polygon, Hermes, their withdrawal and then tornado cash.

C

um Those are the major ones that are currently being in operation. So the number these are trusted. Setups they use the Perpetual powers of Tau, um which is um basically an on-chain on step, one for the different uh trusted setups. Then they had a step two that step two. These are the number of participants that were in those ceremonies.

C

So if you can get to 16 people from the loop ring that did it if they all compromised, then that will not be a valid just the setup and then those funds will be able to be taken. So um you have 16 for Loop ring. You have six participants in the polygon hermesis, then um tornado cache had a whopping 1114.

C

um Moving on to plaques um so like I said, there's you only need one trusted setup ceremony to be correct and then anyone can use it so they're all using the Aztec clock, Universal setup. um It is all these. You can see asset stations um on GitHub to see how they worked, but they.

B

C

176 participants on in that, so that's all your your ZK sync, your ZK space as to connect Aztec Tom, all the way down the line, but then you have your Starks, um which do not have um any trusted setups, um we'll start by recursion. This is the other major thing that um people are looking for for performance. So as you go through performance, a recursion is the ability to take.

C

You know a big computation and break it up into a bunch of little ones into them um together and then recursively proof back to the firm back to the top. So um what this allows you to do is parallelization of proof generation. So you can decentralize and have a bunch of provers doing this in parallel, um so get out your Asics because you just got rid of them for the merge, but uh and then it also lets you do proof chaining.

C

um So you can have the output of one proof, be the input for the next proof.

C

um So what provides recursion pretty much everything, but graph 16 is now doing recursion and they're doing it in better ways: I guess as you move forward. So um that was the other the. Why would anyone use graph 16 if you can't do recursion and you have a big trusted setup you it's faster um and there's it's cheaper to verify. So it's the OG.

C

It's been there for a long time, um but people are moving on because of those two problems, mostly so now, I guess we can talk about my favorite topic, which is data availability as a data scientist um so uh we'll talk. This is going to be about l1s and l2s. So for um for the purists out there l2s would only be Roll-Ups but I'll use both back and forth. So Zeke validiums validiums um they have their state route, is on the bridge contract um and then they have their state reconstruction that's off chain.

C

It goes through a data availability committee to go on chain to be able to make it. So you have that data, but it is permissioned on that side of things. Then the alternative which is in supposed to be gold, it kind of looks like bronze so forget that um is you have your state reconstruction and your state route um for the ZK Roll-Ups um down on the bridge, roll up or down on the bridge contract.

C

So that allows you to um always have that data to be able to generate a proof um in case you need to escape. So um why would you do oblidium over a roll-up? It's many more transactions per second, so your imxs and your different Stark X projects are able to be a lot cheaper, um so moving forward.

C

um Let's look at your validiums that are currently operating. You have Stark X, which is on immutable X. um You have rindify, so rare Apex, um other ones that are coming out.

C

You have um ziki Porter, almost coming out from ZK sync, um and then your roll ups I'll run through these, because you guys, probably all know them, but um you have to idx Loop ring ZK sync V1 usdk space um starknet, so I'll pause for the camera, then moving on there's a couple more that are um the newer ones that are coming up for Roll-Ups that are exciting. um You have ZK sync V2, um which I think is under 30 days now, which is exciting to mainnet.

C

um You have scroll, um which is going for a higher level of evm compatibility um and then, uh let's see what's next, then you have all of polygons projects um which are all exciting in their own right. So um let's talk about what it means to be a roll-up, so everyone talks constantly about how the full security of ethereum is being inherited by these Roll-Ups. So what does it mean to have the full security of ethereum?

C

You need to have the right to be able to force exit from that chain. So if you have on your Layer Two, if they have um decide to be against you, you need to be able to submit your transactions directly on layer, one to the ethereum bridge contract and get your funds. So right now you have your happy user down here, um that's from Walmart, it's kind of creepy! Actually, the more you look at it, so don't stare at it too long. um But the transaction goes to this.

C

uh The happy sequencers here they put the transaction into the layer. Two those transactions are batched on into the ZK circuit. It produces the proof and it goes to the ethereum bridge contract as as we talked about before. So um this is how it's supposed to function. So let's say that the sequencers become evil and start smoking. Cigars, um you get unhappy, so your transactions can't make it to Layer Two and your funds are frozen. So what do you do?

C

You take your transaction and you go directly onto layer one to the bridge contract. So when you take your layer to transaction go directly to it, then the validators have a certain amount of time to actually include your transaction on into the layer twos. So usually it's between 7 and 14 days. So if they don't do it within that amount of time, then Hell Freezes, Over and um the chain freezes. So your layer 2, cannot update State on layer, one and the serial knowledge circuit.

C

um Then you, as a user, can produce a proof from the circuit. Then that proof will provide you the ability to get your funds back. um So that sounds great, but it's also kind of difficult. How does the average user, especially when these proofs are off chain um in usually sometimes proprietary? How do you generate that proof? um That's one of there's a few things that you have to really do to inherit: full ethereum security. So let's go through them to have the available data on layer one.

C

So if you don't have that available data, then you can't reconstruct the state proof and therefore you won't be able to properly get your funds back from the L1 contract.

C

um Secondly, you need to have functional and accessible Force exits, so those Force exits have to be in code and they have to be accessible for the average person they need to be able to generate those proofs.

C

They need to be able to take that data um and Pull and directly send it to that L1 contract um that for a lot of devs, it's not a big deal that um there's the the front ends are all centralized, but we need decentralized front ends to allow people to escape um in the case of one of the sequencers um going evil. So then. Thirdly, you need time delays for the L1 contracts.

C

So if the layer, 1 contracts, aren't have time delays or if they're immutable, um then it gives people the chance to actually exit from that later one. But if they don't have time delays, then they can just change the contract and everyone's funds will be frozen from there so um and then late then last is um this is a nuanced one, but the the amount of money that you can secure from L1 is really based upon the amount of locked funds on layer one.

C

So if, if everyone Force exits, then the layer one contract, which is the bridge contract with all the assets, um they will impart all their assets to the people. But if there's more total locked value above on Layer Two, then somebody's going to be out of luck. So the best way to think about this is a lot of the l2s are starting to get traction with direct transfers to them. um They might even have their own state from different contracts and Native tokens.

C

If you have a native token on an L2 and you don't have assets backing it up on the layer, 1 Bridge contract, then the ability for you to inherit ethereum security and take your assets off, um isn't there.

C

So it's really important that um as we move forward, that any state that is native to the L2 is um is known as for that risk that it has so now, um let's get in I guess this is the end of my talk, so I'm going to try and implore you to get into the data directly, um don't be like Waldo um and be sad because other people tell you what's true and what's not um so we have um I I. Tell you I I'm, very impressed with these projects.

C

I think you guys should all check them out. They're all open. You have bigquery, you have Dune um the dunes getting better and better um and then the bigqueries of public database that has all the ethereum layer one posted there they'll give you 300 credits to go on query through it um and you can really differentiate yourself, especially as a data scientist. um You have.

C

That the project that I actually completed, um please check it out on just the QR code, for it I'll have it at the end too, so obviously miss it. It's no big deal, but um please go check out the data tables. All the SQL queries on any of the different things um please uh feel free to.

C

Let me know what I screwed up and it'll be good um and then L2 beat is just such a great resource, I'm sure everyone's heard of them and I'm sure you've been to their Booth yesterday, but um they categorize all a lot of risks and a lot of specific things happening within these different projects and I. Just can't recommend them enough to check them out they're doing Bridges now too, which is exciting, um and then the layer twos um I haven't got to the data on layer, twos, so I I.

C

It would be really great for everyone to check out the different we're going to a different layer, modular blockchain, where you have layer ones, layer, twos and layer, threes, and these layer threes are going to be deployed on layer twos in the Privacy.

C

Things already are for, like semaphore, so um I highly recommend that I really like to see somebody on check out layer twos and be able to do the same data type projects for that so um I have some thank yous I'd like to get get ahead of um so I'd like to thank the daily Discord, Channel and and podcast for being so great. um That's my favorite Discord Channel. There is, um if you need stud, to know things, there's so many helpful people, um there's the zero knowledge podcast.

C

um It's so good for all the new pressing things, I highly recommend them as well.

C

um L2B I'll show them again and then on the ethereum on Foundation privacy, scaling exploration, team, um that's not their symbol, but I think that there's their new logo for Defcon is really cool, so I put it up there and then I'd like to thank Justin Martin um for all of his help and getting me into this um and I'd also like to thank Mark for all your help. Getting me through this stuff and really brainstorming through it all and I'm trying to get through all those issues, so wow so I got.

C

Thank you very much.

C

uh I will take quite yes, please I'm sure yeah they'll have a mic for you unless you're really loud and then you can just go for it.

D

I was wondering if you comment a little bit more on the security considerations when dealing with Native assets on l2s like I, get that you can't withdraw the funds on the other one, but can you double spend or can eat out there like Forge a balance or things like that? Given the stage rolled up no.

C

I, you know I I, don't think that those are concerns um to do double, spends and things, but I do think, um because your state is the state source of Truth is really sitting on layer, one. So um you're not going to be able to uh one of the reasons they do. Some of the delays and things I believe, is to stop double spend from happening, um but the um and that's why they freeze the state route on layer once um but I I.

C

Don't think that um yeah, if you understand I, won't go back over the ideas of. But if you have tokens that are here um and the values more are there than on the bridge contract, then you won't be able to get your money back off of there. So if it makes sense.

B

Hello, so when you're talking about State on layer, one have you had any thoughts in regards to uh upcoming State expiry, not.

C

Yet but I I would love that I'd love to hear your thoughts on at some point, I'm kind of practical on the side of things. As far as what that should look like and what.

B

C

Even yeah, please go.

B

Ahead, sorry, um yeah I don't have any particular thoughts. Just that I think current plans are to expire estate after a year or so yeah.

B

um You know some other way to get the state I. My.

C

Understanding is, there will be I, mean zero knowledge proofs that we'll be able to construct that and prove that that's true, um but then you'll also have um so you're kind of using the same different different technology, but I'm not going to speak to you about a turn on what I don't know. It's not about it's a great question, though um I'll definitely I can look into it and get in touch with you about it.