Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 15 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Next Generation DSLs and IRs - Panel

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/6/next-generation-dsls-and-irs/index

We discuss the future of higher-level langauges and circuit representations with developers from a number of toolstacks.

Speaker(s): Jordi Baylina, Ying Tong, Louis Guthmann, Brandon Kase, Kev
Skill level: Beginner
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zk

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

So our next panel is on dsls and IRS for ZK circuits yeah. These are all um implementers and authors of some very popular CK, dsls and IRS, and so today we're gonna get together and um I've prepared a few high-level questions here, I'm going to read them out, um so the first one is sort of an exercise to locate each other on the language stack and see how we relate to each other, and the second afterwards is to then figure out. um To what extent can we share infrastructure, or should we even try?

A

Is it impossible after a certain point, um and over here I want to note also a lot of Prior work from the compiler and smt verifier communities? So can we also reuse some of their work and then lastly, I had a high level question about you know what programming in ZK should look like. What's your ideal DSL, is it very different from normal programming yeah?

A

So just keep these in your head and I. Think I want to save maybe 25 minutes for audience. Questions at the end, so I think, let's start with a round of introductions.

A

um I have like I, have pre-prepared some visuals for you um in case you need them. So the first first one is pill. Jordy, so can you give us an introduction to what pill is.

B

A language mainly it's Bill means polynomial identity, language and mainly what it is is when you define a circuit, that's based on polynomials, for example. A Planck is an example of a way of um circuit, that's based on polynomials, but you can do much more things, much more complex, uh that's our base in polynomials that still allows you to just write those identities and then out of those identities, just build the proof automatically the same way that you do in a normal, uh zero knowledge language. The same way that you did in circum.

B

You can do it in peel here. You need to do something else, because you need to maybe write the weakness somehow, but it's just a kind of abstraction where you can just focus in writing. What are the identities uh that you want to fulfill and yeah? This is mainly what Spiel.

A

And Jordy also is the author of circom, um which is a very another popular Library. So how does pill relate to circom.

B

Well, bill is for polynomials, and circuit is more for uh signals you're just working. We are not working with polynomials at all. You are just building, uh um you have just signals and you just build constraints around those signals, not constraints around polynomials. So um the idea of circum is uh it's. Circum is a low level language, because you can write everything every every uh every circuit you can write it in circum. Circum does not have any special library right, it's better than you need any plugin special.

B

So all the circum is rated in circum, so it's on there, but at the same time, is a high level language because it allows you connections, so you can have you have blocks and and then you connect blocks even small blocks. You do Big Blocks Big Blocks, you do a bigger blocks, and so in this sense you can go all the way down and on the way up uh on circum.

B

That's why it's so flexible and then it connects very good with snark.js and other proving systems and yeah it has been there for years, has been already a full rebrite. We now introduce uh introduced uh these new extensions of the language. It's mainly um mainly our Anonymous templates, and we also already are adapting to Planck circum was born in Darwin CS era, okay and now, but in Noble works perfectly in Planck. So we have also custom Gates and yeah we're extending uh the language and it's a full community. That's working on there.

A

Thanks Jody so yeah to me, it's interesting. This um distinction between um a language for polynomials versus first signals and I'm gonna skip to Noir because as I understand it, nor can Target both Planck and r1cs and air and even more back ends so Kev. What's nor about.

C

um Can you hear me yeah, so Noir is a lot more high level, uh it compiles. It compiles down to something called a Sear, and essentially you never tell the proving system how to do something. You just tell it what you want to do so, for example, uh if you want to do a char-256, uh you don't tell it to use custom Gates the.

D

C

System just decides: uh what's the best way to do it so in this way we're sort of back-end agnostic fully so, for example, you'll never see like uh custom Gates inside of Noir or any sort of that syntax or lookup tables. You might see maps, for example, yeah, so yeah.

A

Cool um I'll just go around I have questions I'll just go around the intros first. um So this is the picture. I found for Cairo I, really apologize, I'm sure that better pictures exist, but.

E

um This is the best either produced 100, um so um yeah, so I guess Cairo deferred to um to some extent I wouldn't be able to actually go into I want to see friends, but Carol is just during complete language. So you were writing Cairo. You were the same way: you're, writing solidity or in any smart contract language that you can think of. So from the perspective of Cairo, you write a program.

E

This program is completed to a carabite code, which is run into the Cairo VM and prove among all the programs that are proven within the same proof. So in that sense it's like there is not things much much difference. You don't have things in there. You don't have lookups, you just have like um you know, programming and sometime for some operations. We do have this notion of built-in, but built-in are just something you call as part of the function.

A

And the best for last kimchi slash snarky JS, um Brandon, hello,.

F

um Thank you. Yes,.

C

F

So uh this is snarky JS, with a Y different from snark.js. Had a few people confused this week. um Yeah, uh you know, name name might evolve, I, don't know um so uh yeah. So kimchi is our. Is the proof system that snarky JS is built on top of uh right now? um The way that it's built we can plug into other proof systems we just haven't yet. um Kimchi is the proof system that is in uh Mina or well in in the test net of mina.

F

That will be hard forked pending Community voting, um but the idea is I mean kimchi is a Planck, 15 type proof system. It has no trusted setup, it's Universal uh and uh we support like infinite and efficient recursion, which is important for mina. This is sync blockchain, um but it but the cool thing is. You can also use this proof system to build Uh custom zkps, which are our smart contracts on Mina um and uh and you can build circuits outside of mina as well. So uh I I, don't know.

F

There's not much in this picture. I want to explain I, guess the the one really important thing about snarky JS. You can see on the top left there, um the the code snippet.

F

um It is typescript and is extremely high level, language um and and there's this sort of uh I guess, there's a lot of reasons why we designed it the way we did I'll just point out a couple things one is we get all the tooling and infrastructure and ecosystem that comes with typescript?

F

um So you know, npm is great. Vs code is great. All the Integrations already work and are good, um and uh we think that you know when people are writing zero knowledge, proofs or writing any programs like the model that people are used to thinking about. Computations is you know, you have a function, it takes some input and you produce some output. So one of the things that snarky.js does is it lets.

F

You write your computations with your circuits at the same time and the output of those functions gets sort of fed in as a public input automatically for you. So in the end, your your code actually looks like normal code cool.

A

Thank you, so I'm gonna start with an opinionated question, which is um what is what do you think of um intermediate representations? So what Cersei is this project?

A

um That's inspired very much by llvm and everyone's turning to look at the screen, but so the idea behind that is to define a common standard IR, um to which many different front ends compile and from which many backend many different back-ends can compile. So how well do you think your project would fit into a model like that.

A

Okay, like yeah.

F

Okay, yeah I'll start I mean yeah, so so uh snarky JS is like I said, like super high level um and right now it's directly connected to kimchi, but um we could and probably should connect to some intermediate representation so that uh we can, you know, share that work of connecting to custom back-ends.

B

In the case of circum, actually it exports to two different languages.

B

Internally, it has an intermediate representation. Already is uh second one so exporting that to other language like rust or like go is in the in the road map and uh okay exporting to maybe some other intermediate representation. If it looks like uh good enough, uh that's uh that that would be definitely possible here, I'm, not sure about the specification. I have not read it yet, but, for example, there are things that how you paralyze uh witness computation in circum.

B

We have a way that you have different components, because there are components you can say that this component, this company is is, can be run in parallel, so the windows computation can be run in parallel. This is very important, especially when you are doing big circuits, so uh you know I'm not sure, maybe some somebody that's explained that would that would be maybe an answer for for them, but they uh sometimes there are details there. That are not that that easy.

E

So in the context of Cairo, um so it won't really even work um I mean because Cairo, as of now doesn't have internet representation and directly by basically just a very high level. You know like a bit like Seas representation, just like compared to assembly and Carol itself, Carol the current version, at least to just directly generated by code. That said Cairo we have carrier one coming in a couple of months uh and camera.

E

One has don't have something called Sierra and Sierra is within literally means safe, intimate representation, and the purpose of Sierra is to enable uh the language to turn deterministic. Actually, so Caro is not deterministic, but Sarah will make it deeper Mystic, because when you make a language for an L1 or two four, four blockchain itself, if you want determinism, you want determinism for a very specific reason. Actually, which is you want to be able to prove a fair transactions without determinism?

E

You screw it for that, and so we for now we don't have it, and it is those Vector that we control by making by right now whitelisting the contract. But tomorrow, when we're going to go for permissionlessness and then centralization, you can obviously do that. So we are working to have this safe internet presentation which will be deterministic, and this the intermediate step will be able to actually compile to multiple backend so either Cabo or like an optimize for xc6 for execution, layer and potentially from phoenixes.

E

But in that case we'll probably lose most of what you're gaining and what you wanted. So uh I I don't see, I, don't know if it's practical to compile for I I, don't know about Cersei, but I would be it's a great name for Stark by the way, uh but uh yeah I, don't know uh I, don't expect so I, don't know if you could do that.

C

Yeah, so we did once have an effort to integrate a Seer with Cersei. uh We dropped it just due to priorities uh from what I remember. It was fairly easy if we extend Cersei to have uh these black box functions uh just because the Cersei IR just can't optimize uh for these black box functions um so yeah, it's possible. We just haven't picked back up on it.

A

Yeah I I think nor is probably the newest shiniest language like it just dropped um and I'm I have lots of questions about Acer acir is noir's intermediate representation, so it can compile both to r1cs and Planck. um So how does this IR capture both of these um very different arithmetizations.

C

um uh Essentially, you have these arithmetic Gates, which are just linear Expressions, which aren't bounded so for r1cs, that's quite simple: to compile down to for plunk, because you usually have like width, 4 or some uh fixed width. We have something in a sear which basically chops the gates into the perfect width for a blank for the Black Box functions. It's really just the proving system just takes in the witness indices and just fills in the constraints for them. So it's quite simple what it's doing? It's not doing anything complicated.

A

Yeah that makes sense Brandon did you have thoughts um on the IR thing, yeah.

F

Well, I I think I spoke in the in the beginning, a bit.

A

F

A

F

Don't have anything else to add um cool.

A

um So what I'm hearing is like basically compiling to an IR, you could stand to lose some um some very specific performance optimizations. uh Unless the the IR allows you to Black Box things, easily cool I, don't have a question for Louie as well. What do you mean when you say uh Cairo is not deterministic and that your IR is deterministic.

E

So so Cairo today so proof our dkps or Language basic. You can create hint and in that break vitaminism, um but we we Carriage. There is not domestic. So for men to be more specific. We actually have two flavors of Cairo.

E

uh What we like what I like to call Pure Caro, which is the one you would just directly prove a program within within sharp or sharp being the shareproof infrastructure that we provide or um or um that's your pure Caro and what's dark X is star, X is built on and even Stark net itself is built with, and you have what we call Stark net Cairo and Stockton Cairo. Don't have a notion of State. Dove has a notion of like Cisco and plenty of things that you get from the OS itself.

E

So you have like Cairo for a start net. You have Cairo for real, pure Cairo, so the thing is that the Cairo Force darknet cannot be non-deterministic, and that is for a very pure incentive reason, because if you don't have determinism that you can make transactions that are not provable, meaning I'm, the only one. We know that this transaction is done in and I only want to know the hint and therefore the rest of the word cannot prove it, and so, for instance, let's give an example that people like to choose.

E

You know I want to do a force transaction for man, one you know being that optimistic. Roll-Up push I mean talks a lot about um then, in this context, with determinism I can't this is a dose Vector, because I don't know if the transaction is getting pushed to me is provable by me. I, don't know that and so and another thing that is important to you, that fair transactions, so fair transaction, can be valid.

E

You know the price of this pool only swap move and now for my transaction failed, and otherwise it can be uh malicious. So I'm spamming the network with transaction hoping to get what I want, but if I don't I, don't think I, don't pay anything and that's why I can spam the network for anything and I need to run it and so creating those Vector, so Force darknet we have to make Cairo deterministic or I mean the version of Cairo.

E

For Stockton will be deterministic for that purpose and to make it deterministic, we need to prove that the program was compiled into deterministic version of Cairo, which is a safe intermediate representation called Sierra, and the Sierra will compile to Cairo itself, and so right stuff will be proven within starnet. When I'm deploying a contract, I will be proving to use darknet that this contract was compiled with using CLM. So this is what I mean by Carol become deterministic in that conflict.

A

I guess my next question is uh number three which is yeah when you were writing your languages. What features did you prioritize? So, for example, um Noir is very rust-like. They even have a version of cargo called nargo um and then uh snarky js's, like typescript um Cairo, is also a pretty high level yeah.

E

It's Miss right now, it's a mix of scene, but right the new version will be very rust-like.

A

E

Is coming in the I say three months right.

A

And, for example, ganark was just written directly in go, Halo 2 is written directly in Rust, but but pill and circum are like kind of closer to the metal. I think so is Halo the metal the circuit I mean, um and so is Halo 2. So yeah. What are your thoughts on uh the trade-offs between like higher level representations and lower level representations? And um how did you you know, decide on the designs that you did.

E

Can maybe start so? The first that's actually an interesting story from from uh from Star War expertise experience, so the first version of Star Kick, so starcx was, and it is the first product in stockward and which is basically a centralized but non-custodial back end for uh dabs who need scalability. So you know, customers are dydx, diversify uh immutable and so rare, and so the first version were written. You know very low level, literally in polynoms, uh and this thing does transfer and swaps, and so we started to work in Cairo.

E

It was 2019 and it became production ready uh in uh in May 2020, um the first case of actually uh where we used it for what's for the ready to bake off in June 2020., um and so um the funny story that the improve the performance of the of the system massively improved when we start using Cairo, because it was much higher level and who had a lot more flexibility in the way we could reason about the system in the way we could write about the system.

E

Not only was again in philosophy in velocity, but also again in actual Pure Performance, and so um there is, you know in some green of and when you need that performance Improvement, we have these things that are built in the same built-in as equivalent to Cairo, to those specific shape on your CPU, like the one that does 64 bits, and so, if you really need like optimization at the very low level for a specific operation like say proving um right now, we did it first okay check.

E

We did it for um um for um uh for a seriesic signatures. We in the range proof and sort of things that we write them in those and for the rest we just write in, and so there was not really any trade-off in many way, except that much simpler and nicer to write.

E

A

Yeah, that's interesting that, like a higher level, language actually improve your performance, but yeah I, guess so. You're pushing a lot of the manual optimization to the compilers and like stuff that computers are better at and then the commonly used so-called pre-compiles. um You do hand write that.

B

You started when, when I started to write circum, the main purpose is, as I said before is circum is at the end it's a low level language. So it is that, if you're writing silicon, you should understand what you are doing. You should understand.

B

What's in the what's behind the the circuit level, of course you can do things in um in a high level because you can connect things, but the idea is that you have precise- and this is some something that's very specific to circum- is you it should not be any hidden constraint anywhere. So other constraints are there. You can check the code.

B

Maybe you need to go inside the circum leap or someplace in the library, but you will find all the constraints there and you can track them and you can see them so you can have full control of what you are doing. This, of course, is dangerous. I'm, not saying that. That's. Why? Because you know you need to understand if you're I've seen people that writing circum language, that they don't know what they are writing. So it's not going to work.

B

Okay- and this is we we understand- this is a a thing, but this is what circum is uh for. Circum is for writing would say: Circle means for people that understand what's happening underneath that's the that's the thing.

B

Okay um said that the disease will be linking with what he said is I think that in the future nobody will have to write circuits and because uh Siri is a very specific thing for politics and and then you can write you, you will be able to write things in in Cairo, for example, or things in maybe some high level or even in in solidity. There's a kbm at the end is a language that you're writing a language and you you're, building a zero knowledge, you're building a zero knowledge there. So you can.

B

uh There is other projects like Risk 5 that are also building on top of that. So it's uh the the zkbm.

B

What brings behind to the to the to the world is that you can have any any processor any base, a risk, 5 an ebm or chiro-like, or some some specific virtual machine, so some processor- and then you build on top of that processor. But the circuit is the processor. The circuit is like the hardware okay, so it's like. Maybe we can talk about Hardware, language and software language.

B

uh Silicon is a hardware language, okay and so for language should be normal, so for language, C, solidity, python or any other language that builds on top of that I don't see a space for um I, don't see, but this is a it's opinionated on me, but I don't see a space for a specific language as a specific high level language, because I think that a very high level language should be enough to to run on top of that.

E

Can I just add one thing, but it's what you said: um I tend to agree with the entire statement about, however language. There is one thing, though: um I don't I I'm, not sure and I, don't think necessary that you know things like python or Russ will run enable you to write vkps tomorrow, because there is still a very strong Paradigm competing Paradigm Beyond it a very strong differences which might require you still to have like a different accepting that you're working on something different.

B

Yeah probably this is but this is this is at this point we are running faster, so it's uh I think it's just a matter of uh times and yeah and how difficult it is. You know right now, uh depending is if you are, if you want to run a very, very complex uh uh language, very complex thing, it's one thing, but if it's complex, it's going to be also difficult to write a complexity, so I I think the way to go is high level language.

F

Cool yeah, so um I uh I and my team have a very, very strong opinion about this. So I guess for for background. um So Mina the the Mina protocol. um We started building it in uh 2017.

F

um and uh for those that don't know, Mina basically is just like an enormous, uh like zkp circuit, that that powers, everything so there's um a recursive, uh a like linearly recursive proof for uh compressing the blockchain that follows.

F

You know the rules of blockchains um uh there's like consensus logic, there's verifiable random functions where, like uh fractional numbers, are approximated using like crazy uh calculus things, basically enormous enormous programs and and uh enormous circuits, and- and we realized very early on in 2017 that, like we could not write the circuits manually um and and I agree, it's I I would I, would sort of I mean in some ways it's like it's like programming directly with Hardware, but I think you can also kind of think of it metaphorically. Like writing.

F

Assembly, Language um and- and you know you can't like uh these days when you're trying to write a really complex program. You don't use Assembly Language, you use a higher level language. So um so we so we built the first version of snarky, which is an embedded ocamel DSL in 2017, um and uh we used it for and we still use it.

F

You know whatever five years six years later um and uh it's great and we've learned a lot and and the the specific um you know, we've taken those ideas and brought them to snarky JS, which is just sort of like bringing that into into typescript instead of ocamel um the uh you know, we we thought about like okay. If we could build a high level language that compiles into something and then like Implement, a bunch of optimizations, but the the landscape of proof systems is, we thought would evolve quickly.

F

It has evolved quickly, it continues to evolve quickly, um and so uh it makes sense right now. um I guess it's similar to what we were just talking about. Like uh you, you, you can't today efficiently use like a regular language directly like uh like you, can't write a rust program um and have it run efficiently uh in you know for some definition of efficiency, um uh but um but you can, uh you can build like a little library or framework in in a language that already exists.

F

Embedded in it, so that's what we did with ocamel, it's what we did with typescript um and uh and and and you can, you can build, um you can expose the lowest level so so, like the.

F

There are people who are like experts at optimizing constraints for the proof system, and then you can build abstractions over that uh and with types builds, um you know, type structures build computations um and- and this has worked for building this enormous uh system that we have in Mina and we see it starting to work as well for building really complicated applications with crazy recursion and all this stuff in in snacky.js.

C

Yeah um I think I disagree with everybody.

B

That's okay! That's why you're here.

C

um From like uh I I think that using rust, at least for our use case, um it would be a bit clunky to encode like um semantics, for, like privacy like private State and public state, so I mean it it's possible, but um I think for the user, just be a bit clunkier, which is why uh I think, maybe, if you're not using it for the Privacy use case, then high level languages like rust and go might work um for uh for for using typescript and uh languages like that.

C

Right now, um when we were designing Noir, it just seemed like we needed to restrict the user from doing uh very specific things that it seems like in typescript. They could just counteract it and uh I guess. One example that I always bring up is the. If statements like, uh if you're, using like a high level language, you sort of can't just do if something else, something because in typescript or high level languages that works different from like a circuit based. If so,.

E

In Cairo we actually do a cattle at the runtime, so we don't evaluate if statements, we only evaluate the path we take. That's why uh yeah.

F

uh Of course, I have a counter opinion to that. um Yeah I think uh um the the costs uh of of using a custom language in, in my opinion, in my team's opinion, uh severely outweigh the the benefits. So I guess just to talk about the. If example. Yes, you, you can't use the built-in typescript if in the context of uh like within a circuit.

F

But if you are, if you are Computing a value that you're then using in a circuit, you can use if statements and and if you're, if you're, actually in the circuit, there are tools in in the typescript ecosystem that can help us actually Warn and or error to the user like we can use eslint to provide an error if you're, using an if statement in in a place that uh you shouldn't be and and that and of course that won't be perfect, but um we've found that that actually uh is, is working really well. So.

E

I actually I'm agreeing with both of you, so I'm gonna explain what I mean by that um I agree that you should have um basically your specific language at the same time that um that I mean that tends to help you think about the Computing model you are in and at the same time you also want a language that are familiar to the public or people are already using, and so one solution that we I mean first of all, I'm saying I didn't say about Cairo, so Cairo actually been CPU air.

E

So roughly Cairo can evaluate any program and it was clear to everyone here, but it's and notably what it means that there is two things that you get, that you don't get in circuit, usually which you you only get. You get recursion um very easy recursion. You don't have to evaluate your circuit and second thing that you get for free. Is you only evaluate the if statement the path you're taking? So when you have many many ifs, then you actually only you don't pay for all the branches.

E

You only pay for the the one you're using and so um one consequence of this. One thing that we were able to do was I think all the team built is. They started to see trans compiler from one for the higher than other language two characters.

E

So we have one right now: a language compiler called skyro made by your team out of Switzerland, which is combining Idris or just being a functional language to Cairo for the story, if you are, if you want to use it, you'll be the first one to ever, use it so have fun. uh I actually never found anyone who wants to use a functional language. So maybe there is one in this room, uh but uh just like functional languages, so go for it uh Idris um so seriously.

E

If you want to do, have fun, go for it seriously, it's crazy, but uh but so I'm trying to say that um I don't know if it's the ultimate path, but uh um they there is like there is a middle ground. Can.

F

I uh yeah so um yeah, so just uh for for in in snarky.js today, connected to kimchi I mean this is powered by kimchi, of course, but uh we we also can handle recursion infinite recursion and in snarky.js we've built an interface. That's just it's like essentially the same is writing a recursive function, so you just you, you know you, you put your function in a JavaScript object.

F

That's the only difference um and whatever arguments you have, if you type them as like proof, then uh the system will know that you are trying to do something. Recursively and it'll do all the complicated for you uh and in your in your code. You can just say, like you know, if, if like P is your proof, you just say like P dot verify and that sets up all the constraints for your circuit uh and then and then the other bit about the.

F

If statement, branching thing like today in I think any proof system that I'm aware of including kimchi, including the current version of kimchi um yeah. You have to pay for both branches and you can kind of approximate branching by like multiplying by zero or one, um but we are actually working on an extension to the proof system that will uh will allow you to do these kind of, like arbitrary jumps in an efficient way. And that, though, is uh you know I'm not working on.

E

Oh, is it not a CPU, like you know, like basically running in the arbitrary program, then.

F

E

Always VM, basically at.

F

That point um you, you get essentially the the power of a VM with the performance of direct circuit yeah, so it's kind of the Holy Grail and and the I mean the intuition behind it is like uh there's, you know, there's like look up tables and and custom Gates, and all these things in Planck.

F

um You can sort of extend that to uh allow um for like arbitrary Ram like random access memory, and then you can kind of do another fancy thing to get arbitrary jumps efficiently um and the details of this I'd have to connect you with a cryptographer on my team. But um I am told that this is the path that we're going towards.

A

I've seen that I've seen that in your repo is the dynamic lookup table right, yeah Jordan has been silent for a while. You.

B

Know at the end is this is what are you writing, Hardware or software? If you're writing Hardware, you need a hardware language if you're writing software. My my my opinion is just use a standard software language and uh why? Because the hardware and the problem is that you need the piece of Hardware, you need the process or the hardware that that can compile to this software, but this is there. So this is where to go.

A

Cool um I want to save some time for the audience to ask questions, so we have about 15 minutes. So any questions from the audience.

G

So we actually touched on Hardware a lot during this conversation. It'd be interesting to hear uh from the different panelists like what you actually see the kind of future of ZK Hardware to be in like what direction it's going, not.

B

That kind of Hardware we.

G

Were talking about I think we're.

F

Talking about but yeah, we can talk about that too, but we should we. We can't. We can't talk about like real physical Hardware as well. Yeah.

B

We're talking about the polynomial Hardware, it's.

G

Like you know,.

B

G

Hardware I recognize that.

E

I I can no we're making a joke, but let's uh on the artwork acceleration, so I'm gonna take a hot stake here. um Star query at this stage do not believe that we need them um as simple as that. um The reason is because the software itself is being improving so fast and the structure in the architecture of how you do things has been improving so far that at this stage we we don't know what the future will look like, and so what I mean by this is hardware.

E

Development is you're roughly a year and a half before getting to production and a year and a half from a year and a half ago, uh Cairo were barely working started with in premises. uh Recursion wasn't working, um we and, and so for instance, the thing that we are working on right now, so we already do recursive recursive proof on production today of approve ourself but like, for instance, one architecture. We're not doing it at the moment is um basically a three of proofs like basically right now.

E

The only thing we do is we have what you call jobs and jobs are like those Stark Nets starkware infrastructure used. All of that to Sharp, and so all the customers and you start and included of the infrastructure, are sharing the same proof. So every every one of that is using is basically everyone is paying a marginal cost of the proof cost on that, and so um so, for instance, diversify or immutable like right now is having like 70ps in their environment and they're, using a significant amount of a step within this proof.

E

So they do one job and we have other proof and also another type of of the job is approved. So we, um so we don't really. We didn't, went all the way yet into that uh tree architecture and so full Hardware.

E

um There is already a significant, like you know the the thing Central fact that we can't really say this is very good. That said, I have a friend of mine, I, guess umovich from uh the company called wait. uh It's, uh which is a very good friend of mine, he's also already working on this, making uh groundbreaking Improvement on outbreakable, explanation, Shake pronunciation or even like you know, uh MSM, which I have no idea what it means. But uh I would let him to you he's not here today, but yeah I.

E

Would let him answer that another day.

F

C

F

So different I guess slightly different opinion, um so in in uh in snarky, when you use snarky JS for writing, applications on Mina or just in general, we're encouraging um the the proof computation to happen actually like on the user's machine. um In this way you get uh privacy and- and uh you know, there's there are ways that you can sort of do part of the computation on the machine to get the privacy and do the rest on a server all these things.

F

But um when you have a proof system that has a lot of cool features in it uh like kimchi, um it's it's slower than a proof system that has a lot less features in it um and uh Hardware acceleration would then kind of you know, make it faster. I I think it would be uh cool I guess, like you know, we're encouraging people with snarky Jazz to write uh circuits with recursion with with linear, recursion or tree recursion.

F

That's been working in Mina and Mina's mainnet for a year and a half sort of internally and and now on our decentralized test net. We have uh you know you can do it with custom circuits and and settle on chain and all that stuff and it works um uh and and yeah, and it's a little bit slow right now we're working on optimizing it, um but I I am imagining a world like I.

F

Think a cool world would be one in which, like The Ledger, that we all have um or something like that uh that has our wallet on it also would have like a a snark accelerator, uh companionship or something um I I. Don't think that's coming anytime soon, but um something like that could be cool and and even like, obviously, in the shorter term, taking advantage of like gpus fpgas and silicon like at any level I think would be helpful uh because it would it makes these proof systems that are I.

F

Think like have a lot more features um uh more, you know faster, so you can do different kinds of applications than you could if, if they were slower.

B

I would distinguish this is actually a very, um very different. So talk about zero watch proof. We can distinguish between a small, small proofs and uh big proofs, because the big profile for ckvms and for uh roll ups and for when you want to do aggregation and these high computation stuff and then small proof, more questions but they're more related to something like Identity or a game or something that you want to run, especially in the client.

B

I. Think the client has a lot of sense uh because it's uh it's where the hardware you know you are building. You do a a big investment, but then you you you you can uh spread to many mobile phones or too many uh places. So this makes a lot of sense and for things like you know these privacy things for for things like uh uh gaming, for things like identity, uh just proving things about your data.

B

I know all this that so uh I think this makes a lot of sense in in in that direction, for the hardware, um so for the big things and I'm talking more specific to maybe a specific project, which is the ckvm, but so representativity is that for us we are I. Tell you why we are interested in Hardware. uh Maybe here you will you will you will see why?

B

The idea is that um uh in a so, if you want to have a competition, the days that you want to have a competition uh that approving competition, you know disaster, there is a market for for for uh generating proofs big. Those big proofs uh here you can have there is a problem. Is that you have a centralized. Maybe you have some provider that has a lot of power and these monopolites the the the system in the case of ckvm?

B

This is not a big problem, because you can only build the proof, that's already deterministic, so you cannot do crazy things, but you can degrade the network. So the problem is that somebody that has a huge power, that's able to generate a lot of proofs, maybe just stops and stops doing that and and and then uh the the network just degrades so in for us.

B

The way for us to to to to to avoid that is to have the best, the best proverb available, even in Hardware when I'm saying Hardware, at least in fpgas or whatever, even Asics, if it's required so, but the idea is to have the best approver a valuable open source and a valuable for everybody, so that there is no monopolistic uh proverb that can take that. That's. Why?

B

For us, it's so important that the proverb is open source that the property is available for everybody, and not only that that the technology to build the Brewer is available for for the community, because this is the guarantee that we have that the network would not be degraded.

E

It won't even have to on top of this um in the context of stock net.

E

The way we are looking we're going to look at this proving Market is by actually having uh like a kind of POS exam mechanism where we have a leader who would be the proving one and we have like a in Cascade another one and second one would come afterwards uh if there is degradation, and so um the the other thing is that I just want to say I forgot to say: let's talk about that, but um people have been very focusing a lot on on um on acceleration, because Stark are very slow and there is no because the operation that he did curve and so on uh and some means I mean I mean but I mean at least uh Jordy and I uh working more on stocks, which are much faster and much easier to to use to to work on on regular servers.

E

So I think that maybe a difference of nor take relate to that machine.

C

I mean uh so I'm gonna answer the question I wanted to hear. Instead of the one you actually asked, uh because I don't really know much about uh Hardware acceleration uh in terms of uh programming for Hardware versus programming, for a software I think proving systems are changing too much for at least us to focus on uh sort of being so close to the metal just because the muscle might change next year or the year or the year after uh I will say that for privacy, it's sort of a different space.

C

uh If you have privacy, you need to sort of think about how to accelerate approver like because we usually use wasm, whereas if you don't have privacy, it's really fpgas and GPS like. How do you accelerate uh this? This massive beefy machine.

F

H

F

Just to um there was this discussion about, like uh you know, markets for decentralized provers- um and this is just my I- just have to say this, because too many people are surprised by this at this conference. Sorry, if it's a little bit off topic, but Mina has a decentralized, sequencers, decentralized, provers, a Marketplace for producing proofs um that are sort of needed by the system, and this has been in production for a while, and uh we um encourage more people to look at it when they're thinking about their marketplaces and and everything cool.

G

Great answers thanks guys.

F

D

There's a worker.

D

Okay, um I have a question: it's like maybe continuing on the hardware thing, but most of the I mean a lot of people. Kind of um compiling Target now is actually solidity. So actually a lot of people are moving on.

D

Ethereum and kind of this is Defcon, so, like uh the most artificial kind of constraints that I'm seeing is probably the fact that we have one pre-compiled curve to work with, but we can only work with BN 128, so wondering what's your intuition, why why don't we have more curves to walk with in your opinion, I, don't know it seems like it will kind of release a lot of the.

E

Bottleneck so okay, I I, can make two comments, uh the first one in the pure application Level, and why people should care about what you're describing um so I think that one of the biggest original saying that, if you're made when they were built in order to see in retrospect right, we couldn't know, is to have had EOS I, think EOS was a mistake but and and um and you're right having new curve, like you know, uh being able to use the p2056 when it is on your phone or even being able to RSA verification, I mean just to throw random ideas.

E

Right um would be unlocking a lot of use cases I mean just to give you an example um starting running through the company on gaming, that is using the construction to verify p2056 the the you're, using your securing clip of your phone to sign signatures for gaming. That's awesome, which is awesome.

E

um That's actually not for me, the biggest you know lock of the verifying the evm the main difference. The one problem is that um either you, the Computing Paradigm of the VM, is very different from when you have nvk I mean beats. Boolean logic is expensive and ZK is cheap on the evm right, so this is kind of the starting point um and um while, if like you know, a lot of team are looking into I mean diving, I mean, or you would talk more about that than me um about you know putting the vvm.

E

uh We didn't make the choice, because we were in our opinion. We were optimizing for performance of The Proving system and then now that we have that, can we back work, make it Backward Compatible, and so we have in our case warp, which is like a tooling that enables you to transpire from uh solidity to Cairo and the practicality of it.

E

I can't really judge no one really used it in production, but they managed to recently announce they managed to compile to unifa V3, which is a significant bit, and um there are an existing effort right now to rewrite the vvm in Cairo. So I don't know once again. If it's a POC, if it's for fun or I, don't know, maybe maybe it would be practical to prove that I want to see the numbers. I won't believe it.

B

Going to your question, um why uh why not others I think? Maybe you should ask to the EF people, maybe better, but what's clear is that at least the BLS 381? This is a must, and this is will be introduced sooner or later uh in in ethereum, among other things, because signatures so because all the all the staking stuff- it's it's done with this BLS stuff and also bien well at the beginning, was that was not safe because there was something discovered, but then it's much more safe that we thought that was safe.

B

So it's it's there. You know it's some. There are some doubts of the BN Corp, so I think that sooner or later ethereum will have. There has been some efforts. I know that there has been some uh stops uh at some point uh on these this this adding this, and here is, for example, uh we are implementing the fully VM right now we don't have to compile anything like we just get the code and put it there doing that what has been an effort, but what are the difficult things? What what? What? What's the?

B

What are the piece? That's really difficult to add. So we were able to to build the evm, but there is one one piece: that's complex, we'll do it, but it's really difficult to do it. um This pre-compile contract of the bn1, so complicating the complicating the uh the layer ones. uh Vms uh is not a good thing, and this is uh there. Are you know there are some? Of course there are some mistakes we did with the IBM was created. One was created, uh wasm was not even an option at that point.

B

Just for you to just people to realize on that of ZK. Nobody knows they didn't exist, but uh so here and and the wife what I've been hearing. What I see is that uh dbm should tend to simplify, not to get more, not to get more complex, and this is I think this is a feeling that uh in ethereum the people that's working, scissoring we have uh ebm is probably too complex and we need to tend to simplify the gas models.

B

The the sum of codes and- and if you see the proposals that are uh coming are more in the not in extending the ABM but in simplifying dbm and said that. I think that the BLS is is a must.

F

Yeah so um I guess similar similar to uh Stark, where we we started, not with evm compatibility in mind for for mina um and snarky.js and our proof system, um but differently from starkware. We didn't. We didn't start with like performance in mind um because we're we're not trying to build like uh CK ZK roll up, scalability solution.

F

um We we were like okay, there's all these cool things you can do with ZK uh with with privacy and recursion um and and we want to build a proof system uh that enables uh people to take advantage of all those cool things um and uh and and so um in the same vein as what you were talking about like there's all these cool things now that you can do in in our proof system and on Mina, and you know, we're working on an uh ethereum Bridge so that the mean estate can just be fully verified from within ethereum and and the idea here is like we want to bring all these great features uh to ethereum Developers.

F

But uh you know like I guess: typescript is you know, people are writing front ends into typescript anyway, so hopefully it's not too bad, um but uh but yeah, rather rather than like kind of trying to put all these things inside evm. It's like okay, let's use you know efficient uh elliptic, curves and all these things uh to to do these interesting privacy and recursion all this stuff and then uh wrap it up in a nice present that can be verified quickly on evm.

D

I can say my question is because uh you know start the standards are evolving sometimes, and this is like a like the the hottest the metal will be in terms of zero knowledge standards. So some of the time, the constraints on the standards come from things that are not necessarily very efficient and eventually Downstream you, you don't understand how you got something that is using a certain aspect, so a lot of it down. Downstream decisions are being taken because of of that right.

D

We have baby jab jar because it fits the prime field and and I mean it could be more efficient to amazing, like uh kind of from a philosophical kind of aspect of.

E

At some point you need to leave with with there that's the point and and and you you can I mean you know you can wish us we we could wish, and we did many times. You know uh wish I suppose if we can't but the reality that you you won't get to adapt I mean we may be all convinced here and Decay the future, but maybe other people outside or not, and so we it's a consensus. We want to agree on.

E

What's what's good, so I tend to agree with Jordy, we need actually a much more in favor of simplifying the network than doing it than trying to bring more more things to make our life simpler right now and uh just to give you yeah, that's basically.

C

Yeah I don't know.

B

For this is uh look in in the second circuit, we are using a different Prime field. We are using the goldilock spring field. We are building a stark. We are building a recursion of a stark. We are doing a lot of crazy cryptography in there and just in the last moment we just built the glow 16 or a plonk. That's just, but this is the last the last piece. So it's like the adapter.

B

If you want to the network, if, if so, maybe then that so maybe the IBM you you just need one thing: hash functions. How many hash functions needs uh requires the ABM. Well, we have ketchak. We have a a shadow 56 recently, a 30 minute Blake, uh is it necessary, maybe with Shadow 56 would be more more than enough from the beginning.

E

You couldn't argue that the pre-compile could have been you know like we could have made things cheaper or in first place, or maybe you know, made many things that are wide if more so much more efficient of the spring. You know there's many things you could discuss in the back, but.

B

This is why why and why this is possible right now and maybe- and this is changed from three four years ago- it's because we have this validity proof. We can compute things of chain and validate them on chain. So we just need to care how we validate these things on chain and bn128, or if you want to BLS it's more than is more than enough.

B

So probably if the, if the ethereum had to be done now, uh it would be less uh cryptographic, Primitives and uh more basic thing, because we can we can we can accelerate that of chain uh and and validate that uh with uh with the visibility proof on chain.

E

And just to conclude on this, if you want to have much more impact and make one change, changing I mean it's going very ballsy changing kitchen might be more helpful.

B

No because you change, we pass it on in which which in which prime field yeah yeah. But that's that's that's the thing you know it's and I've been thinking. You know all of us. We haven't have been thinking on that this. Why Poseidon is not in the or, why the so? Why don't we have a milk C at some point?

B

uh It's not in the in the VM and- and this is the thing, but as we evolve as we evolve, we see that this is less important because we have because this computational proof are getting much faster and much better. So we require less this, so we can sacrifice a little bit of optimization right now we can look in in in the ABN circuit. We can, we can validate for 500 catch acts in the in the proof we can validate.

B

uh I, don't know like something like 100 or 200 uh cdsas with the cdsa ethereum Corps. In there we can do paintings inside there. We can do everything in there silly it's not optimal doable and it's it's getting every time more efficient. So, at the point that we have this, we require less. How from the L1 we require less Health from that, so so that's why I think that this tendency to simplify is is is is, is, is a trend.

A

Oh yeah, I I, also feel like part of dunk. Sharding is moving in that direction like they introduced the pre-compile for Point evaluation for kcg, and you know, then you can understand kcg proofs. But beyond that, it's all blobs. You know it's all um delegated to the Roll-Ups. Well, we are. We are over time. So there's one last question: okay, ask it ask it.

H

Thanks thanks, yeah I just wanted to know that I see a lot of sense in like breaking this evm eyes and creating DSL, not only for like opening new area of innovation and like clear question to basically Amina I mean. Does it make sense, or you also like, for example, to collaborate with Cairo and uh maybe, like you know, since, like it's better model for the CK than uh like imperative languages and uh yeah basically work on better tooling. For.

F

Yeah I mean operational.

H

F

I I think we are, we already are right, I mean we, we have uh someone on on at o1 Labs, which is like the the team that incubated Mina um is, is looking into getting Cairo to work with, with kimchi.

E

Yeah- and there is even one in the room who actually took her work and made it into work with Winterfell, so you can look at the guy in a very nice blue shirt over there Max, so yeah next has a practical, Cairo, a very, very fire and prover uh in Winterfell. Today, um I mean to be honest, it's actually go back to the point question about simplifying stuff.

E

um Why we have no l2s. We have L2 that can do stuff, um let's use their their advantage to bridge where we could do the B4, and so, like you know an example. uh There is a team actually maybe like, maybe in the room actually over there uh snapshot. X is working right now to do N1 voting using L2 to make them cheap and that's something you couldn't do before. So that's this kind of thing that we can do with l2s now that we couldn't do and then one we don't have to change that.

E

One for that so simplify. Please.

A

Cool. Thank you all panelists.