Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 16 Dec 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Maze - Aggregation Tool for Circom PLONK Proofs

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/6/maze-aggregation-tool-for-circom-plonk-proofs/index

The session aims to demo Maze, a CLI-based tool for aggregating several circom-plonk proofs into a single aggregated proof developed using Halo2 library. The session will also include a high level explanation of aggregation of plonk proofs using Proof Carrying Data (PCD).

Speaker(s): Janmajaya Mall
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zk

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Proof right now you perform setup ceremony and then you set it for a circuit, and then you prove a specific input on the circuit and then you verify it or you generate is already called Data and what does auction verification look like? Basically, you have a verifier contract that verifies the proofs, so on L1 the cost comprises of execution cost as well as called at a cost, but on L2 the majority of the cost is the call data cost. So for a growth 16 proof, the execution cost is 210.

A

000 units called in a cost is 128 bytes for a long proof. The exhibition cost is 300 000 units and we called it. A cost is around 400 bytes. But what if we want to verify? 50 got 60 proofs on chain. It will all obviously take times 50 right that will be around 10.6 million gas units and 6400 bytes.

A

But what if I told you that you didn't have to live in that world anymore? What if we could prove 50 proofs at the cost of one? And yes, we can do that and we can do that using aggregation.

A

What is proof aggregation now? Basically, you can get several proofs into a single proof, and that is it, and that is what True Value radiation allows you to do.

A

And how do you do it? You can do that using maze. It's a tool that helps you irrigate individual flock proofs that you can generate using smart JS into a single aggregated proof, and why should we use it? Basically, you will get constant proof size. That means constant call data of four three two zero bytes, so it doesn't matter whether you're aggregating 20 proofs, 40 proofs, 50 proofs. The call data cost will always remain the same and the same goes. Foreign.

A

The same goes for the execution cost that would be approximately around 600 000 gas units.

A

So let's try it out to build an aggregation circuit. You need a bunch of prompt proofs for which you'll build the aggression circuit, so we generate the plan proofs using snog JS, and then we build the aviation circuit using maze, so I've already done the necessary setup for generating plan proofs using snapjs. You can see the circuit is here and we have the proven key file over here now we'll use the circuit Files The Proven key file to generate a bunch of proofs for which we'll generate the for which we will build the ignition circuit.

A

So for that first we need to install a focus log.js that adds this new command called snatches Planck setup mails, which helps you output necessary files for building the ignition circuit. So it takes inputs.json which contains several inputs, for which you need to generate the proof so over here we have two inputs this and this, and then it takes the circuit file and the circuit.zk file, which is the proving key for a single prong proof and will generate proofs or Json public signals and the verification key.

A

So let's run this command and it will generate the necessary files. So we have got two proofs public signals and the verification key. So now we'll use the mace tool to build an aviation circuit. So let's check it out so maze tool has a bunch of commands. The first one is mock.

A

Setup mock setup, builds the aggregation circuit and runs a mock prover on it, and then we can also generate a email verify for the execution circuit and we can create a proof, verify the proof and we can also simulate even verification of the proof so for the demo purposes, I'll stick to mock setup because rest of the commands are pretty computationally expensive.

A

So, let's just run the command maze mock setup on the files over here. So we have the verification. Key we've got the proofs which we need to Aggregate and the public signals.

A

And there you go so we build the existing circuit for two proofs and now it is running them off proof, so it will take a while until then. Let's just try to understand how does it all work so, basically, in the verification of a plant proof, you have two parts. The first part is the G part that performs the computation required for pairing check and the second part is the expensive part. That is the pairing check.

A

So the trick is that in the aggregation circuit, we verify the cheap part of each block proof and within the aviation circuit we accumulate the expensive part of each block proof into a single accumulator single pairing check, and that is the final accumulator and we expose the final accumulator as the public input of the proof.

A

Now the verifier would will first verify the proof of the aggregation circuit and then we'll perform a single parent check on the final accumulator and after this, the verify would be satisfied of the proof of the aggregation, aggregated proofs, and that is it so now, let's go back and check whether the equation Securus was successful or not, and you can see over here. It was a success and it took 22 seconds. So that means our aggregation. Circuit of this of these two proofs is satisfied.

A

So now you might be wondering okay, fine, we're able to aggregate a lot of proofs into a single proof and we're able to save a lot of lot and call data and the execution. But what are we increasing in exchange? The thing that we incur in exchange is the approval cost. It is very computationally expensive to generate aggregated truths, so for 25 proofs it takes 27 minutes and for 50 proofs it takes 58 minutes on a pretty beefy machine, so that is it and that is it from my side. Thank you for listening.