►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/zkps-and-programmable-cryptography/
Historically, cryptographic protocols have been built special-purpose for specific kinds of claims or information hiding mechanisms. zkSNARKs and other new cryptographic tools move us to a world of "general-purpose" cryptography, where we have expressive languages to express claims about digital identity, reputation, and more. We discuss a high-level framework for thinking about where and why ZK and related technologies might (or might not) be useful for digital applications.
Speaker(s): gubsheep
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: ZK,Zero Knowledge,Programmable Cryptography
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
I'm
gupsheep
and
I
work
with
the
research
focused
organization
called
Xerox
park.
Today.
I
will
be
talking
about
this
idea
of
zkp's
and
programmable
cryptography,
which
is
a
phrase
that
we
use
to
describe
a
lot
of
what
we
focused
on
at
Xerox,
Park
I'll
describe
what
programmable
cryptography
means
and
why
we
think
it's
important
for
anyone
who
is
interested
in
the
future
of
Next
Generation,
blockchain
and
decentralized
applications.
So
first
off
I'll
give
a
little
bit
of
context
into
what
Xerox
Park
is
for
folks
who
have
not
heard
about
this
organization.
A
Xerox
Park
is
a
relatively
new
research,
focused
org,
which
supports
what
we
call
application,
Level,
r
d
on
ethereum
and
other
decentralized
platforms.
So
this
means
trying
to
better
understand
what
is
possible
to
do
on
these
kinds
of
you
know:
smart
contract
platforms
or
with
new
decentralized
application
technologies
that
isn't
necessarily
currently
possible
today,
but
might
be
on
the
horizon
projects
that
we
support
include
things
like
Dark
Forest,
as
well
as
Persona
Labs
building
things
like
hanging
on
or
if
folks
were
around
the
applied
ZK
showcase.
A
Yesterday,
you
might
have
seen
proof
of
email
or
various
ZK
machine
learning
experiments.
We
also
build
circuit
Primitives
for
ZK
snarks
and
focus
a
lot
on
infrastructure,
maintenance
and
third-party
development
of
tool.
Stacks
like
snark.js,
sir
com,
Halo,
2
and
more,
and
we
also
do
a
lot
of
community
building
efforts
and
we
work
on
Cross
team
and
ecosystem-wide
projects
as
well
cool.
So
one
of
our
largest
areas
of
focus
at
Xerox
Park
is
applied.
Zk
cryptography,
which
means
that
a
big
Focus
for
us
is
understanding
what
is
possible
to
do
with
DK
crypto.
A
What
you
know
theoretically
should
be
possible
to
do
with
DK,
crypto
and
decentralized
apps,
and
what
we
need
to
do
to
to
get
there
to
eventually
bring
those
kinds
of
tools
to
production
and
apply.
Zk
is
one
of
a
category
of
relatively
newer
cryptographic,
Primitives
that
we
categorized
under
this
term
programmable
cryptography
and
in
order
to
describe-
or
you
know,
give
a
feeling
for
why
programmable
cryptography
is
important.
First
I
want
to
go
into
a
little
bit
about
the
a
couple
of
the
reasons
that
we
think
that
applied.
A
Zk
is
especially
as
important.
So
there's
two
concrete
reasons
that
I
think
are
especially
compelling
in
terms
of
why
ZK
is
going
to
be
powerful
for
unlocking
the
next
generation
of
decentralized
applications
and
I'll
just
go
through
those
real
quick.
So
the
first
thing
is
that
zero
knowledge
cryptography
gives
us
what
I
think
of
as
an
expressive
language
for
claims.
A
So
what
does
that
mean?
We'll
go
through
an
example
to
to
get
a
sense
for
what
an
expressive
language
for
claims
looks
like?
Let's
take
the
example
of
ZK
snarks
and
group
membership
proofs
in
the
context
of
claims
about
digital
identity,
so
the
simplest
kind
of
identity
claim
that
we
have
from
cryptography
and
something
that
we've
known
how
to
do
for
many
decades
is
prove
a
statement
like
I
know
a
private
key
corresponding
to
someone
say
like
Alice's
public
key,
which
implicitly
identifies
me
as
Alice.
A
So
this
is
something
that
I
can
do
with
a
digital
signature,
something
like
you
know:
RSA
or
ecdsa.
The
invention
of
public
key
cryptography
made
proof
like
this
possible
or
made
provable
statements
like
this
possible,
and
this
is
infrastructure
that
underlies
so
many
of
the
digital
systems
that
we
know
and
rely
on
today,
including
you
know,
secure
traffic
on
the
internet
as
well
as
blockchain
systems
like
ethereum
or
Bitcoin.
A
So
going
up
one
level
in
complexity
from
the
previous
slide,
we
have
claims
like
I,
know
a
private
key
corresponding
to
one
of
the
public
keys
in
a
group.
So,
for
example,
I
know
a
private
key
corresponding
to
one
of
Alice,
Bob
or
Charlie's
public
keys.
This
kind
of
claim
is
commonly
referred
to
in
the
literature.
A
As
a
group
signature
or
a
ring
signature,
we
do
have
cryptographic
protocols
that
are
purpose
built
to
enable
people
to
generate
you
know,
group
signatures
or
ring
signatures,
but
they
are
again
special
purpose
built
for
this
kind
of
claim
and
the
math
or
like
the
cryptographic,
protocols
that
make
these
sorts
of
claims
possible
are
oftentimes
incompatible
with
the
math
used
for
ordinary
signature
schemes.
So
you
know
we
figured
out
how
to
do
these
group
signature
schemes
a
few
years
after
we
figured
out
how
to
do
digital
signatures
in
general.
A
You
know
key
registry,
you
have
to
build
a
different
key
generation
algorithm
and
you
have
to
popularize
that.
So
you
know
the
math
involved
in
making
a
claim
like
this
can
be,
can
be
incompatible
and
require
you
to
sort
of
move
to
an
entirely
different
system
than
if
you
want
to.
You
know,
use
systems
that
allow
you
to
make
claims
like
this.
A
A
So
this
way,
I
now
have
this
system
which
uses
the
exact
same
key
generation,
algorithm
or
key
generation
strategy,
as
a
system
that
allows
me
to
you
know,
simply
prove
that
I
know
the
private
key
corresponding
to
Alice's
public
key
and
we've
turned
essentially
this
problem
of
Building
Group
signatures
from
a
math
problem
where
we
have
to
go
to
a
cryptographer.
They
have
to
write
us
a
paper.
I'll,
do
all
this
stuff,
bootstrap
a
new
key
registry
into
essentially
a
programming
task
that
you
know
any
developer.
A
Familiar
would
say:
Circle
can
carry
out
okay,
so
slightly
more
complicated
than
this.
We
can
go
a
level
even
further
up
and
consider
augmentations
to
this
protocol
such
as
I
know
a
private
key
corresponding
to
one
of
Alice
bobbert
Charlie's
public
keys
and
the
other
two
either
can
or
cannot
prove
that
they
did
not
generate
this
message.
So
sometimes
this
is
this.
Property
is
called
by
various
different
names,
some
call
it
like
disavowel.
So
as
an
example
like
suppose,
I'm
Bob
and
I
generate
a
signature
that
is
either
coming
from.
A
A
But
again
these
use
new
math
are
incompatible
with
previous
systems
and
are
generally
fairly
difficult
to
engineer
again,
however,
with
the
DK
snarks,
this
is
a
pretty
trivial,
like
two
line
circuit
code
change,
so
again
we're
sort
of
seeing
this
idea
of
this
language
that
allows
us
to
build
these
expressive.
Claims
that
are
compatible
with
you
know
previous
claims
that
other
cryptographic
systems
will
allow
us
to
generate.
A
And
finally,
we
can
get
to
claims
you
know
of
this
level
of
complexity,
something
like
I
know,
a
private
key
corresponding
to
one
of
Alice,
Bob
or
Charlie's.
Public
keys
and
I
either
possess
a
signed
attestation
from
one
of
David,
Eve
or
Fred.
One
of
these
trusted.
You
know
attestation
service
providers
or
during
a
block
with
header
X
I
knew
the
private
key,
corresponding
to
an
account
with
at
least
32
eth,
and
you
know
dot
dot.
You
can
kind
of
compose
a
bunch
of
arbitrary.
A
You
know,
predicates
on
this
identity
claim
and
I
think
it's
pretty
fair
to
say
that
there's
like
no
cryptographer
in
the
world
who
you
could
go
to
and
ask
them
to
build
a
special
purpose,
new
cryptographic
tool
that
would
allow
you
to
prove
this
specific
kind
of
claim.
Nor
would
it
even
make
sense
to
but
again
with
DK
snarks.
This
actually
becomes
fairly
trivial.
You
have
your
building
blocks
in
ZK
circuits.
A
So
another
framing
of
this
idea
of
the
expressive
language
for
claims
is
that
ZK
snarks
turn
math
problems
into
programming
tasks
rather
than
having
to
go
to
a
cryptographer
to
write
you
a
new
paper
every
single
time.
You
want
a
new
kind
of
digital
identity
claim
to
exist
in
the
world
and
be
provable.
You
can
just
have
a
ZK
circuit
developer,
compose
the
right
Primitives
inside
ZK
circuit
code,
okay,
so
cool
thing
number
two,
which
is
closely
related
to
cool
thing
number
one
is
that
ZK
adds
interoperability
to
cryptographic
systems.
A
So
what
does
this
mean
well
to
explain
this
first
I
just
want
to
do
a
quick
breakdown
between
two
terms:
snark
friendly
versus
snark,
compatible
cryptographic,
Primitives
Stark,
friendly
cryptographic.
Primitives
are
you
know,
Primitives
like
hashing
algorithms
or
digital
signature
schemes
or
encryption
algorithms
that
are
specifically
purpose
built
for
to
be
efficiently
provable
inside
of
ZK
snark
proving
systems
so,
for
example,
the
Mims
here
Poseidon
hash
functions
or
eddsa
signatures.
A
However,
most
of
the
cryptographic
systems
that
exist
in
the
world
use
cryptography
that
was
invented
before
we
knew
about
CK
snarks.
So,
for
example,
a
lot
of
hash
functions
use
a
lot
of
bitwise
operations
which
are
very
costly
to
do
inside
of
ZK
snarks,
and
so
these
these
systems
are
not
snark
friendly,
but
they
are
what
we
have
to
work
with.
So,
for
example,
all
the
signatures
on
you
know,
emails
signed
by
mail.
Servers
that
are
being
sent
out
are
not
going
to
be
snark
friendly
signatures.
A
However,
we
can
start
to
at
least
connect
all
of
these
different
snark
compatible
systems
together
by
embedding
these
different
signature.
Algorithms
hash
functions,
encryption
teams
Etc
inside
of
snarks,
even
if
it
is
costly,
so
as
an
example
of
a
few
crypto
systems
that
exist
out
in
the
wild
we've
got
key
distribution
and
identity.
Registries
such
as,
like
you
know,
you
can
build
a
an
identity
registry
of
like
gpg.
Keys
GitHub
allows
you
to
generate
locally
a
key
pair
and
upload
it
and
make
it
publicly
accessible
to
anyone
so
that
anyone
can
verify.
A
You
know
your
commit
history
or
things
like
that.
Repos
you've
contributed
to
so.
For
example,
if
you
go
to
github.comeep.keys
you'll,
see
like
my
RSA
Keys
ethereum
and
Bitcoin
rely
on
the
ecdsa
signature
scheme,
so
addresses
are
going
to
be.
You
know
a
hash
of
an
ecbsa
public
key
in
ethereum
and
I.
Think
mail
servers
use
the
dkim
protocol
to
sign
and
authenticate
messages
which,
under
the
hood,
relies
on
RSA.
A
So
one
of
the
things
that's
going
on
with
all
these
different
signature
schemes
is
that
they
kind
of
can't
really
talk
to
each
other.
You
know
if
you're
running
on
the
RSA
protocol,
you
can't
really
understand
an
ecdsa
signature,
however,
by
making
all
of
these
Primitives
snark
compatible
by
implementing
RSA
signature,
verification,
ecdsa,
signature,
verification,
etc,
etc.
Inside
of
snarks,
what
we
can
start
to
do
is
we
can
start
to
build
adapters
between
all
these
different
systems.
A
So
again,
if
I
have
an
RSA,
primitive
and
an
ecdsa
primitive
inside
of
a
snark,
then
I
can
start
to
make
claims
like
either
I
have
a
GitHub
account.
That's
contributed
to
the
you
know:
ethereum
GitHub,
org
or
I
possess
at
least
100
eth
and
again
by
making
existing
cryptography
snark
compatible
and
combining
that,
with
this
expressive
language
for
claims,
we
can
start
to
make
statements
about
all
sorts
of
digital
or
online
activity.
A
So
both
of
these
features
are
examples
of
the
power
of
programmable
cryptography,
which
probably
is
you've
grok
from
now.
You
know
both
of
these
features
are
giving
us
these
tools
to
much
more
flexibly,
manipulate
digital
objects.
So
now
I'm
going
to
kind
of
give
my
description
of
programmable
cryptography,
which
is
that
it
is
cryptography
that
can
be
layered
on
top
of
arbitrary
computations.
A
So
we
can
say
things
like
this
message
originated
with
Alice,
as
we've
seen,
or
this
message
can
only
be
read
by
Bob,
but
every
single
new
mechanism
that
we
want
to
build,
whether
it's
like
you
know
arbitrary
identity,
predicates
or
read
permissions,
or
things
like
that
would
require
us
to
build
a
new
special
purpose
cryptographic
system.
However,
now
we're
seeing
tools,
like
you
know,
ZK
snarks,
as
we've
discussed,
that
allow
us
to
move
from
this
message
originated
from
Alice
to
I,
know
a
private
key
corresponding
to
one
of
these
people.
A
One
week,
I
would
say
that
smart
contracts,
Also
spiritually
kind
of
fall
in
the
same
category
as
a
lot
of
these
other
programmable
cryptography
Primitives.
So
you
know
imagine
very
early
on
in
the
history
of
this
idea
of
blockchains.
We
would
have
these
consensus
engines
where
people
could
come
to
consensus
on
only
very
simple
or
specific
data.
Transformations
data
Transformations,
like
you
know,
Bob,
can
decrement
his
balance
by
100
ether
to
increment
Alice's
balance
by
100
ether.
Nowadays,
with
smart
contracts
and
programmable
blockchains,
we
can
sort
of
execute
arbitrary
predicates.
A
A
So
in
each
of
these
examples,
there's
this
common
thing
theme
of
moving
from
the
specific
to
the
general
with
ZK
snarks
I
can
move
from
proofs
of
specific
claims
to
a
general
purpose.
Language
of
claims.
Smart
contracts,
allow
us
to
move
from
coming
to
consensus
on
canonical
data
that
can
be
modified
in
only
very
specific
or
narrow
ways
to
a
general
purpose:
language
for
modifying
or
executing
code
on
this
canonical
data.
A
Witness
encryption
moves
us
from
a
world
where
we
can
permission
data
to
only
be
read
by
a
specific
person
or
specific
set
of
people
to
having
a
language
for
specifying
arbitrary
predicates
for
read
permissions.
So
I
kind
of
imagine
this
as,
like.
You
know,
decentralized,
oauth
tokens
where
anyone
can
plug
into
this.
A
Okay.
So
the
second
part
of
this
basically
thesis
is
that
programmable
cryptography
itself
seems
like
a
very
powerful
tool.
Blockchains
are
also
a
very
powerful
a
powerful
tool,
but
it's
not
sort
of
a
priori
obvious
like
why
these
two
things
are
related
to
each
other,
except
that
they
both
sort
of
derive
from
similar
mathematical
principles.
A
But
I
claim
that
there's
actually
a
very
deep
and
complementary
marriage
between
these
two
powerful
things
and
to
explain
why
I
think
that
is
first
I
want
to
give
my
kind
of
mental
image
of
what
ethereum,
as
a
data
availability
layer
looks
like
say,
like
five
or
ten
years
out
from
now.
So
in
my
head,
the
way
that
I
kind
of
conceptualize,
the
idea
of
you
know,
ethereum
the
global
data
availability
layer
is
I.
A
Think
of
ethereum
almost
as
this,
like
you
know,
giant
super
thick,
coaxial,
cable
that
basically
streams
Humanities
like
Global
stream
of
Consciousness,
so
Humanities
you
know
promises,
bets,
Secrets,
debts,
dreams,
etc,
etc,
and
this
coaxial
cable
is,
you
know,
made
available
to
any
person
or
Computing
device
in
the
world.
So
you
know
any
phone,
any
computer
that
like
lives
on
some.
You
know
like
institutional
server.
A
Anything
like
that
can
hook
into
the
one
gigabyte
per
second
canonical
data
stream,
look
up
data
and
know
that
they're,
seeing
exactly
the
same
thing
as
someone
across
the
world
is
seeing
now
right
now,
this
data
stream
is
completely
transparent
and
that
has
been
a
design
decision
that
has
been
necessary
in
order
to
gain
acceptance
of
this
particular
data
stream.
That
we're
wanting
to
claim
is
the
canonical
data
stream
or
the
legitimate
data
stream.
A
So,
in
order
to
build
acceptance,
we
have
this
principle
of
don't
trust
verify
and
in
order
to
verify
you
need
to
be
able
to
see
all
of
the
data,
but
I
claim
that
this
is
actually
extremely
limiting.
There
is
a
wide
class
of
applications
that
you
might
care
about
to
build
where
you
don't
want
every
piece
of
data
to
be
completely
public
and
I.
A
I
want
to
consider
the
example
of
games,
so,
for
example,
let's,
let's
consider
poker
in
poker
a
lot
of
the
depth
of
the
game,
relies
on
the
fact
that
I
know
my
cards,
but
I,
don't
know
your
cards
and
you
know
your
cards,
but
you
don't
know
my
cards
poker
as
a
game
would
simply
not
work.
If
we
knew
each
other's
cards,
it
would
be
completely
degenerate
right,
like
it
wouldn't
really
make
sense,
it
wouldn't
be
any
fun,
and
you
know
a
slightly
more
complex
example
of
this
might
be
strategy
game.
A
So,
a
couple
of
days
ago
we
had
a
talk
on
Dark
Forest,
which
is
a
fully
on
on
chain
strategy
game.
You
can
kind
of
imagine
it
as
something
like
Starcraft
on
the
blockchain,
and
one
really
key
mechanic
of
Dark
Forest
is
that
in
Dark,
Forest
players
respective
locations
are
all
hidden
which
gave
which
gives
the
game
a
lot
of
its.
A
My
you
know:
secret
night
from
secret
location,
a
to
secret
location,
B
I'm,
not
going
to
tell
you
what
a
or
b
are,
but
this
zero
knowledge
proof
proves
that
you
know,
there's
an
L
shape
between
them
or
zero
knowledge.
Proof
might
prove
something
like
drawing
some
card
I'm
drawing
it
validly,
according
to
the
rules
I'm
drawing
it
out
of
a
randomly
shuffled,
deck
I'm,
not
cheating
and
just
like
continually
drawing
a
bunch
of
aces.
A
So
you
know,
there's
a
bunch
of
game
examples
which
we
can
kind
of
Imagine,
where
the
game
just
simply
does
not
work
if
all
of
the
information
is
transparent
and
while
those
are
kind
of
toy
examples,
I
think
they
allow
us
to
start
to
hint
at
this
more
complex
future,
where
we're
using
blockchains
for
a
much
wider
range
of
use
cases.
So
you
know
I
think
one
completely
digital
completely
reasonable
digital
interaction.
A
So
you
know
each
of
the
components
of
this
interaction
today
are
not
possible
due
to
the
fact
that
there's
so
many
things,
there's
so
many
constraints
on
what
we
can
keep
private,
but
again
with
things
like
fully
homomorphic
encryption,
witness
encryption,
ZK,
snarks,
etc,
etc.
These
kinds
of
interactions
may
start
to
be
unlocked,
while
still
preserving
the
neutrality,
where
all
this
data
is
living
on
some
like
globally,
verifiable
blockchain
or
data
availability
system.
A
So
the
last
kind
of
like
analogy
that
I
want
to
make
here
to
kind
of
create
an
image
of
what
this
future
might
look
like
is
you
know,
I
want
to
kind
of
describe
the
concept
of
an
Ender
Chest
from
the
game.
Minecraft,
so
Minecraft
is
a
you
know,
Sandbox
game
in
which
you
can
Harvest
resources
and
build
stuff,
and
in
Minecraft
there's
this
concept
of
chests.
So
with
a
wooden
chest.
If
I
build
a
wooden
chest,
I
can
like
place
it
down
here.
A
I
can
put
items
in
into
the
chest
if
I
leave
and
come
back,
the
items
are
still
going
to
be
there.
The
chest
is
a
very
important
like
primitive
in
Minecraft.
If
anyone
else
goes
to
the
chest
and
they
open
it,
they're
going
to
be
able
to
see
all
the
items
that
I've
placed
in
there
in
Minecraft
there's
also
a
very
powerful
tool
called
the
Ender
Chest,
which
is
sort
of
similar
to
a
chest.
A
But
has
these
kind
of
this
kind
of
magical
property
where
ender
chests
inventories
are
marked
as
like
per
player
inventories
and
are
sort
of
shared
across
every
Ender
Chest
that
exists
in
the
world?
So
if
I
put
an
ender
chest
down
here
and
put
down
like
you,
know,
five
stone
or
something
and
then
I
put
an
under
chest
down
over
there
and
like
I,
walk
over
there
and
open
it.
A
I'm
gonna
see
that
same
five
Stone
and
if
someone
else
walks
into
the
walks
over
to
the
under
chest,
they're
not
going
to
see
that
same
inventory
that
I
have
they're
only
going
to
see
you
know
what
they've
put
into
the
under
chest.
The
ender
chest
is
an
incredibly
powerful
tool
for
Minecraft
players
that
allows
them
to
execute
on
these
larger
scale.
Strategies
build
these
much
more
complex
constructions.
A
It
just
makes
it
easier
for
you
to
do
a
lot
of
things
and
I
think
as
more
of
our
social
and
economic
activities
Move
online,
we're
going
to
need
Primitives
like
these,
these
digital
ender
chests
that
allow
us
to
carry
things
like
our
reputation,
our
financial
history,
our
social
context
across
different
platforms,
and
in
order
to
do
that,
we're
going
to
need
these
new
privacy,
preserving
mechanisms
that
fall
under
this
category
of
programmable
cryptography.
So
that's
all
I've
got
for
today.
A
B
And
thank
you
for
the
talk.
As
we
went
through
a
lot
of
the
slides,
there
were
examples
of
ZK
things
where
you
have
a
claim
and
it's
true
or
false,
and
you
prove
it
but
I
guess
the
bigger
picture
of
all
programmable
cryptography
could
have
other
sorts
of
statements
like
I
summed
all
these
numbers-
and
this
is
the
true
sum
and
so
I
guess
those
are
other
flavors
and
maybe
that's
homomorphic
encryption
I'm,
not
sure
how
friendly
are
those
with
each
other
right
now,
like
proving
things
and
doing
math
and
getting
continuous
results.
A
Yeah,
this
is
a
great
question.
So
right
now
you
know,
as
you've
probably
noticed
like,
we
are
specifically
very
focused
on
zero
knowledge.
Cryptography,
which
is
you
know,
one
of
one
piece
of
this
like
much
broader
category,
but
it
seems
like
disproportionately
represented.
So
why
is
that
the
case?
Well,
one
reason
is
that
zero
knowledge,
crypto
systems
are
simply
much
more
mature
today
than
a
lot
of
these
other
systems.
Where
there's
there
only
exists,
theoretical
constructions
or
academic
implementations.
C
A
So
I
think
Quantum
cryptography
is
a
slightly
like
orthogonal
direction
to
what
a
lot
of
these
tools
are
going
to
enable
specifically,
for
example,
like
one
way
that
we
think
about
the
interaction
of
quantum
cryptography
with
these
tools
is
considering
which
of
these
tools
Quantum
or
like
which
you
know,
for
example,
ZK,
algorithms
or
like
fhe
algorithms.
We
have
are
quantum
resistance,
in
other
words,
once
we
have
quantum
computers
which
of
these
algorithms
might
we
be
able
to
break
now?
A
That's
kind
of
a
different
thing,
however,
from
necessarily
you
know
the
affordances
of
these
tools.
So,
for
example,
like
you
know,
it's
when
I
think
about
programmable
cryptography,
I
usually
think
about
it
from
the
perspective
of
like
what
these
things
can
do
for
us,
rather
than
necessarily
like,
what's
the
underlying
algorithms
and
what
are
the
computational
models
in
which
they
might
you
know
broken
by
or
enabled
by
whether
that's
Quantum
or
elliptic
curves,
or
you
know
large
Prime
fields
or
things
like
that?
Oh.
D
Thank
you
for
talk,
can
ask
you
if
I
understand
it
correctly,
the
state
currently
in
Dark
Forest,
you
keep
it
locally
and
you
just
put
the
proofs
on
chain
that
may
not
be
ideal
for
the
future.
If
you
lose
the
state,
you
kind
of
lose
the
game
like
what
are
your
thoughts
on
how
to
keep
the
state
safe
in
in
other
ways,
either
using
a
homo
marketing
prescription
or
your
general
thoughts
around.
A
It
yeah
this
is
a
great
question
and
I
think,
like
you
know,
as
an
extension
of
the
debate
that
people
have
around
the
viability
of
you
know.
Everyone
custodying
their
own
keys,
for
example,
on
a
blockchain
I
think
that
there
are
a
couple
of
things
here
that
might
be
possible.
One
is
like
you
mentioned,
and
fully
homomorphic
encryption
might
allow
us
to
store
private
State
on
that
is
encrypted
on.
A
You
know
cloud
services,
but
still
be
able
to
like
retrieve
that
data
and
perform
operations
on
it
just
like
we
would
if
it
was
local,
while
still
preserving
the
privacy
of
that
data.
That's
pretty
far
out,
though,
and
in
the
meantime
I
think.
The
most
immediate
thing
that
we
can
focus
on
doing
is
like
building
more
user-friendly
solutions
that
allow
you
to
keep
critical
or
sensitive
data
on
your
own
machine,
I
mean
everybody
already
does
keep
critical
and
sensitive
data.
A
E
Right
thanks
for
the
talk,
what
do
you
think
about
the
fundamental
bottleneck
of
like
zkp's
being
quite
slow,
and
you
have
this
trade-off
between
like
proof,
generation
and
verification?
Do
you
think
we
will
have
sort
of
more
like
external
offram
Solutions,
maybe
like
layer
2
is
for
full
ZK
or
like
do
you
see
the
most
promising
Solutions
being
in
like
fundamentals,
ekp
research
like
what
do
you
think
of
that
whole
opponent
trade-off.
A
Has
you
know
expanded
by
like
three
orders
of
magnitude
and
we're
still
seeing
like
rapid
improvements
via
new
protocols,
new,
better
engineered
libraries
for
proving
Stacks,
more
efficient
circuit,
implementations
and
things
like
you
know,
ZK
friendly
Hardware
are
just
getting
started,
so
I
think
that
like
well,
eventually,
there
may
be
some
industry
of
services
that
arises
around.
You
know
offloading
computation
or
things
like
that.
At
the
moment
there
are
still
a
lot
of
optimizations
that
have
not
yet
been
fully.