►
Description
Link to the slides: https://super-static-assets.s3.amazonaws.com/cf9ede3c-c1a5-4875-bfdd-503fdc50bd04/files/db61f92b-1aaf-4a1e-9225-5ff24784256a.pptx
Speaker: Pyrros Chaidos
Course Director: Hakwan Lau, D.Phil
Teaching Assistants: Cathie So, PhD; Hunter Priniski
At Zero-Knowledge University, we prove what we’ve learned not by repeating the content aloud, but by demonstrating it through application. We aim to apply zero-knowledge proof technology (ZK henceforth) to deliver timely, market-ready products for web3.
Perhaps we all know nothing. There is only one way to find out.
To learn more about Zero-Knowledge University, please visit https://zku.one
Note: Late enrollments open till January 2nd, 2022.
A
A
So
since
I
told
you
my
background,
it's
not
really
in
in
computer
science,
if
you
want
to
look
up,
this
is
the
link
that
that
is
there.
You
can
see
I'm
actually
a
neuroscientist
by
training,
but
I've
been
in
tertiary
education
for
basically
half
of
my
life,
I
actually
less
than
half
of
my
life.
I've
been
a
professor
for
14
years,
and
recently
I
left
I.
A
So
we
are
experimenting
with
a
kind
of
new
model
here.
What
we
call
learn
to
earn-
and
some
of
you
might
be
here
for
that
reason,
and
that
that's
fine,
that's
that's
part
of
the
the
the
interesting
feature
of
this
course
is
that
basically
we're
trying
to
instead
of
making
just
making
it
free
making
the
course
free,
then
some
of
you
will
see
lack
of
financial
commitment.
You
don't
have
to
pay
the
tuition
you
made.
You
know
some
people
tend
to
drop
out.
A
So
instead
of
binding
you
to
a
contract
and
make
you
put
down
a
payment,
we
instead
will
give
you
money.
So
just
by
completing
the
assignments
on
time
and
satisfactorily
will
give
each
person
200
and
each
week
there
will
be
various
other
incentives
to
keep
you
motivated.
I
think
it's
a
little
bit
crazy.
I
think
so.
A
A
Now,
if
it
sounds
too
good
to
be
true,
it
probably
is
because
the
assignments
may
be
harder
than
you
think
so.
Assignment
0
has
already
been
posted
online.
It
will
be
finalized
right
after
the
class
and
and
we'll
we'll
announce
it
on
this
court,
and
it
might
be
harder
than
you
think
so.
Some
of
you
come
in
might
be
much
less
prepared
than
than
you
need
to
be
zero
knowledge
proof
is
what
vitalik
buterin
once
called
moon
math.
A
It
is
not
exactly
very
easy,
but
we'll
try
to
see
how
much
we
can
face
the
challenge,
but
if
you,
you
know,
drop
out
no
hard
feelings,
and
you
know
there
are
different
plans
and
different
things
you
can
do.
We
might
also
later
on
try
to
organize
some
other
courses
that
are
easier
in
terms
of
the
technicality
required.
A
The
other
thing
is
try
to
help
each
other.
This
is
not
really
a
university.
You
see,
the
setup
is
very
different.
We
don't
charge
tuition
fees
and,
and
nor
is
it
just
like
a
you
know.
We
dump
some
content
online
and
let
you
study
this
is
really
the
the
pay
structure
and
everything
and
the
discord
and
having
people
here
is
to
help
you
build
this
community
mentality.
So
this
is
a
bit
like
a
paid.
A
A
A
I
struggled
to
understand
some
of
the
math
myself,
but
the
goal
here
is
not
to
be
a
master
in
everything.
Rather,
we
want
to
set
a
concrete
goal.
Is
that
you
should
be
able
to
launch
a
product
on
magnet,
I
mean
any
magnet,
it
can
be.
Eve
can
be,
can
be
xdai
whatever
you
you
like
to
to,
but
to
be
able
to
really,
you
know,
deploy
a
protocol
by
the
end
of
the
course
it
doesn't
have
to
be
everything
from
scratch.
I
think
that
would
be
very
hard.
A
A
So
the
rough
format
of
the
class
is
we
meet
twice
a
week.
So
today
would
be
a
will,
be
a
lecture.
Sometimes
the
lecture
will
be
given
live.
Sometimes
they
will
be
recorded.
So
you
you
should,
you
know,
make
time
to
study
the
lecture
before
so
that
the
class
becomes
more
discussion
based.
We
will
mix
a
match
just
so
that
it's
less
boring
and
we'll
we'll
see
what
works
the
best
for
you
and
then
after
thursday,
typically
after
the
class
will
announce
the
assignment,
that's
only
for
the
first
half
of
the
course.
A
So
it's
not
going
to
be
seven
week.
Seven
assignments
only
going
to
be
four,
including
today's
assignment.
So
after
that
you
should
try
to
do
the
assignment
on
your
own.
Again,
we
won't
be
handholding
you.
This
is
not
a
college.
You
know
undergraduate
course
try
to
do
the
assignment
on
your
own
as
much
as
you
can
from
thursday.
To
monday,
we'll
give
you
a
chance
to
ask
questions
and
then
monday,
we
will
try
to
troubleshoot
together
with
you
why
the
assignments
may
be
might
be
too
challenging
and
then
by
wednesday.
A
You
have
to
hand
in
your
assignment,
so
you
see
that
the
whole
thing
is
can
be
quite
q,
a
driven.
So
we
thought
about
making
the
course
really
small
like
like
five
to
ten
people.
Then
then
it
can
be
really
like
an
open
seminar,
but
in
the
end
we
also
really
want
to
benefit
as
many
of
you
as
possible.
A
So
what
what
we'll
do
is
we
hire
two
tas
I'll,
introduce
them
and-
and
they
will
basically
be
curating
your
questions,
so
you
can
write
your
questions
on
discord,
but
better
still,
there
will
be
an
interface
that
that
will
use
for
you
to
post
your
question.
You
can
vote
up
and
down
the
questions
and
then
they
will
be
basically
creating
the
questions
and
and
then
addressing
them
and
raising
them
on
your
behalf.
So
let
me
pause
here
a
bit
and
let
hunter
and
kathy
wave
to
say
hi.
B
Yeah,
so
I'm
hunter,
I'm
a
phd
student
in
cognitive
science
at
ucla.
That's
how
I
know
hawk
one,
and
he
was
my
introduction
to
harmony,
and
I'm
just
really
excited
to
work
on
educational
stuff
that
I
think,
has
real
world
impact
rather
than
kind
of
the
stuff
that
you
may
experience
in
a
normal
university
setting.
My
research
is
generally
focused
on
what
I
call
cognitive
data
science,
so
kind
of
the
intersection
of
human
computer
interaction,
cognitive
science
and
experimental
psychology.
C
Right,
hi,
everyone:
this
is
cassie,
I'm
from
hong
kong
and
I
actually
just
got
my
phd
under
the
supervision
of
hot
one,
so
my
phd
is
in
neuroscience,
but
really
what
I
do
is
machine
learning
to
analyze
spring
imaging
data.
So
currently
I'm
working
as
a
data
scientist
in
the
fintech
startup
industry,
but
then
I'm
very
keen
to
just
get
a
head
start
in
the
blockchain
area
as
well.
So
I
want
to
kind
of
make
myself
familiar
with
the
you
know:
the
most
cutting-edge
technology
that
is
in
blockchain.
A
A
Good,
so
we
talk
about
the
format
of
the
course
the
class
details,
so
I
told
you
I
I've
been
a
professor
for
over
a
decade.
One
thing
I
know
is
people
don't
read
the
syllabus,
so
you
must
read
the
syllabus.
We
don't
we
don't
label
it
as
a
syllabus,
but
go
to
cku
read
the
docs
just
a
couple
of
them.
It
will
tell
you
the
class
details
and
sometimes
we'll
update,
and
it
will
be
reflected
there
as
well.
A
So
that's,
basically
all
the
final
other
regulations
in
case
of
you
really
care
about
the
the
cash
prizes
that
the
regulations
are
there.
Having
said
that,
I
really
also
really
really
want
you
guys
to
use
this
court
and
check
your
emails,
because
things
would
change
bear
with
us.
This
is
you
know
we
call
it
a
university,
but
of
course
it's
not
a
real
university
there's
a
disclaimer.
We
are
not
an
officially
approved
entity
for
for
for
giving
tertiary
education.
A
This
is
more
like
an
online
study
group
with
a
lot
of
subsidies
given
by
harmony
to
to
make
things
more
interesting
and
more
exciting
and
and
help
from
from
from
you
know,
professors
like
like,
like
pirates
who
are
basically
help
giving
the
time
to
us
for
free,
so
there
will
be
a
lot
of
it.
You
know
glitches
and
and
things
that
we
don't
expect.
This
is
also
the
internet.
You
know
we
don't.
We
don't
know
each
of
you
so
well
in
person.
Yet
so
we
will
improvise.
A
So
there
will
be
things
that
will
change
along
the
way.
So
a
lot
of
things,
especially
the
the
topics
of
the
the
course
and
the
classes
we
would
try
to
modify
to
to
to
adjust
to
the
level
of
difficulty
and
interest
that
would
be
suitable
for
you,
so
use
this
card
raise
questions,
help
each
other
answer,
questions
and
also
check
your
emails.
That
would
be
announcement
and
then,
if
things
change
so
okay,
I
think
I'm
done
any
questions
so
far.
You
can
post
it
on
the
chat.
A
E
E
E
D
D
Anyone
want
to
volunteer
their
their
thoughts
text
should
be
fine
as
well
as
as
long
as
I
I
don't
forget,
to
check,
chat,
there's
a
middleman.
Well,
there
there
could
be
a
middleman
or
actually
a
a
behind
you
man
right
so
the
guy
who
is
in
the
middle
or
the
guy,
who
just
put
an
extra
pin
pad
on
top
of
the
real
one.
They
can
see
what
buttons
you're
pushing
and
they
will
know
your
pin
and
once
they
pickpocket
your
card,
they
will
empty.
Your
bank
account
right.
D
D
E
D
So
if
the
attacker
was
trying
to
just
brute
force
a
four-digit
pin,
he
has
a
1
000
chance
of
guessing
right.
If
he's
trying
to
guess
to
digits,
he
has
a
100
chance
of
guessing
right.
So
this
is
in
a
way,
a
weaker
protocol
and
well
banks
support
that
by
adding
risk
management,
browser
identification,
another
form
of
authentication
and
extra
password,
and
what
have
you,
but
the
protocol
by
itself
has
actually
been
weakened
to
make
it
not
leak
as
much
info.
D
So
this
there's
this
tension
in
that
the
first
protocol
we
saw
leaked
a
lot
of
info.
The
second
protocol
leaks
less
info,
but
it's
actually
weaker.
So
it
seems
like
there's
this
tension
behind
protecting
privacy
and
protecting
against
snooping
and,
at
the
same
time,
actually
having
a
level
of
security
that
is
adequate
for
what
we're
trying
to
do
and
keeping
with
the
soft
examples.
D
Let's
imagine
a
situation
where
somebody's
applying
for
a
job
right
and
let's
say
it's
a
programming
job,
so
what
the
company
requires
of
the
applicant
is
them
to
be
hired.
So
I
I'll
put
up
an
ad
asking
for
somebody
who
has-
I
don't
know,
let's
say
15
years
of
blockchain
development
experience
right,
that's
a
very
reasonable
ad,
but
I
need
to
be
to
make
sure
that
the
applicant
I
hire
is
actually
qualified,
because
by
the
time
I
go
through
training,
I
give
them
their
first
assignments
and
get
results
back.
D
It
might
be
a
few
months
and
a
few
thousand
dollars
into
the
hole.
Until
I
know
I
have
the
right
applicant.
So
what
I
would
like,
as
a
company
would
be
to
give
people
a
test
assignment
and
hire
them
if
they
actually
perform
well
in
that,
but
well,
ideally,
the
test
assignment
would
be
something
useful
to
me.
D
So
how
do
people
actually
test
people's
skills
before
hiring
them?
Well,
they
use
a
protocol
that
looks
like
this.
They
tell
people
a
story
about
this
farmer
who
has
a
goat.
He
has
some
corn
and
somehow
a
wolf
has
also
ended
up
with
the
farmer
and
they
want
to
cross
the
river,
but
they
boat
only
holds
two
items
at
a
time
and
the
applicant
is
asked
to
find
a
solution.
Now
is
this
a
problem
that
is
useful?
No,
absolutely
not,
but
why
are
these
questions
popular?
D
So
essentially,
what
this
test
in
an
interview
tries
to
maintain
is
that
it
sets
a
bar.
So
that
applicants
that
are
actually
good
at
what
they're
claiming
will
succeed,
applicants
who
don't
know
what
they're
doing
will
fail
and
at
the
same
time,
it
maintains
that
this
is
not
real
work.
This
is
not
something
that
will
take
months.
This
is
not
something
that
seems
unfair
to
a
potential
applicant
because
he's
working
for
free.
D
D
D
D
D
So
a
second
important
milestone
in
this
process
was
that
of
fijamir,
who
introduced
a
very
simple
technique
to
make
such
protocols
non-interactive,
and
this
is
very
important
because
in
practical
applications,
interaction
is
actually
hard
to
arrange
so
in
a
blockchain.
What
you
usually
want
to
happen
is
that
you
will
send
a
single
message
to
us
to
a
smart
contract
and
something
will
happen.
What
you
don't
want
to
happen
is
you
will
send
a
message.
D
This
will
introduce
a
very
large
number
of
problems,
because
then
the
smart
contract
needs
to
keep
track
of
things,
which
means
that
it
needs
to
store
some
sort
of
state
which
makes
it
more
expensive,
which
makes
everything
more
complex
and
which
makes
everybody
have
a
bad
time.
So,
ideally,
what
we
want
is
that
we
want
protocols
that
only
work
in
a
single
round.
D
D
Further
work
from
bloom,
feldman
mcauley
gave
a
wider
range
of
protocols
that
could
be
turned
non-interactive
and
actually
proved
that
anything
in
np
can
be
done
by
using
what's
called
the
common
random
string.
We
will
get
to
that
in
a
bit
so
to
begin
with,
let's,
let's
settle
on
the
terminology
that
we'll
be
using,
and
that
is
that
of
relations
statements
and
witnesses,
so
suppose
that
what
I'm
trying
to
build
is
a
protocol
that
solves
the
following
problem.
D
I
know
some
secret
such
that
the
hash
of
that
secret
equals
such
and
such
value,
and
this
looks
very,
very
similar
to
a
standard
authentication
a
web
page
right.
So
the
server
has
this
hash
of
your
password
and
then
you're
trying
to
prove
that
you
know
this
password
that
hashes
to
what
the
server
knows.
D
So
this
is
reasonably
close
to
the
real
world.
So,
in
zero
knowledge
terms,
we
have
a
statement,
a
witness
and
a
relation.
So
the
statement
is
the
public
data
describing
the
instance
that
we're
trying
to
prove-
and
in
this
case
it
is
the
hash
value
right.
So
I
am
trying
to
show
something
that
is
true
concerning
that
hash
value
and
that
hash
value
is
in
the
domain
of
the
protocol
public.
D
Now
the
protocol
treats
the
hash
values
public.
This
does
not
mean
that
you
need
to
show
it
in
the
entire
world
right.
So
if
I'm
authenticating
to
a
server,
then
again
in
the
eyes
of
the
protocol,
the
hash
value
is
public,
but
there
is
no
reason
for
the
server
to
broadcast
that
value
to
the
entirety
of
the
web.
But
in
the
in
the
eyes
of
the
zero
knowledge
protocol,
hash
value
is
public.
D
Then
we
have
the
witness.
The
witness
is
private
data
known
only
to
the
prover.
That
is
actually
what
supports
our
statement
being
correct,
and
in
this
case
it's
the
word
secret
or
actually
our
password
right
and
then
we
arrive
at
the
relation
and
the
relation
is
the
key
behind
the
this
protocol.
It
essentially
describes
what
equation
or
what
set
of
equations
needs
to
hold
between
the
public
and
the
private
data
for
the
statement
to
actually
be
true.
D
So
in
this
case
we
have
this
relation
between
the
witness
and
the
statement
that
simply
says
that
the
relation
is
true.
If
the
hash
value
x
is
actually
equal
to
the
hash
of
the
witness,
and
this
essentially
describes
what
the
protocol
is
doing.
It
does
not
tell
us
how
it
does
it,
but
it
tells
us
at
a
reasonably
high
level
what
this
protocol
is
supposed
to
accomplish.
D
So
once
we
have
defined
statements,
witnesses
and
relations,
we
can
also
say
that
the
statement
may
be
true
or
might
be
false.
So
a
statement
is
true.
If
there
is
a
witness
that
makes
it
true
and
again
if
we
have
the
witness
at
hand
or
if
we
have
a
candidate
witness
it's
easy
to
check.
If
the
relation
is
true
or
not,
we
just
evaluate
its
definition
right.
So
here
we
have
x
check
if
x
is
equal
to
h
of
w.
D
If
somebody
gives
us
some
value
of
w
and
some
value
of
x,
we
could
just
run
the
hash
and
see
if
they
match
so
once
we
have
some
candidate
value
of
w,
it's
very
easy
to
determine
if
that
value
is
appropriate
for
a
statement
x.
What
is
harder
to
do
is
to
check
if
a
statement
x
happens
to
have
some
value
of
w.
That
makes
it
true.
D
D
D
So
now
that
we
know
what
we're
talking
about,
let's,
let's
see
what
the
the
usual
promises
that
zero
knowledge
protocols
provide
us
with
look
like,
and
these
are
properties
that
are
enjoyed
by
pretty
much
any
decent
zero
knowledge
protocol.
In
fact,
usually
we
have
some
stronger
ones
so,
first
off
we
have
completeness
and
completeness
very
simply
speaking
says
that
if
everybody
does
what
they're
supposed
to
do
the
protocol
works.
D
So
if
we
have
a
true
statement
and
the
appropriate
witness
and
we
give
them
to
the
approver,
then
the
approver
will
succeed
in
convincing
the
verifier,
and
the
a
crucial
point
here
is
that
the
verifier
is
given
the
statement
as
an
input,
but
not
the
witness.
Otherwise
that
would
be
trivial
right
now.
The
the
more
interesting
properties
are
that
of
soundness
and
zero
knowledge,
so
soundness
in
the
plain
version
is
quite
simple
it.
It
says
that
well,
if
x
is
a
false
statement,
the
very
file
will
reject
it.
D
D
D
Not
only
is
there
some
witness,
but
we
can
actually
find
it
right,
because
that
is
the
hard
part
I
mean.
I
can
tell
you
that
there
is
some
pre-image
so
that
the
sha-256
will
output
all
zeroes,
and
you
will
probably
believe
me
when
I'm
telling
you
that
there
is
such
a
pre-image,
but
that
that's
of
no
value
the
the
interesting
part
is
that
can
you
get
to
that
pre-image?
D
D
And
this
is
also
worded
in
a
very
curious
way
right,
so
what
does
it
mean
that
we
can
simulate
the
execution
logs?
Well,
if
we
can
simulate
something
using
only
x,
then
logs
are
useless
right,
because
if,
if
these
logs
were
were
useful,
then
we
could
build
some
on
our
own
and
we'll
would
be
able
to
do
whatever
useful
thing
these
logs
can
do
for
us.
So
this
is
a
very
roundabout
way
of
saying
that
logs
of
execution
of
this
protocol
are
useless,
and
why
are
they
useless?
Because
anybody
can
build
them.
D
D
D
Because
I
didn't
did
do
it
on
the
spot
exactly
so.
This
is
what
essentially
the
zero
knowledge
property
captures.
It
says
that
unless
you
are
seeing
somebody
in
the
spot
taking
part
in
the
protocol,
then
nothing
is
worth
anything
I
mean
I
could
have
googled
the
answer
and
just
made
a
video
about
it.
D
D
D
D
D
E
E
F
Okay,
so
the
question
that
I
had
earlier
is
that
considering
the
idea
that
logs
themselves
like
when
you
pull
them
up
are
useless,
what
is
the
context
of
having
a
protocol,
that's
soundness
and
like
its
ability
to
like
reference,
the
actual
value
of
an
of
a
particular
like
object
on
chain
like
what?
What
is
the
significance
of
that
versus
having
the
proof
be
actually
completely
like
open?
If
that
makes
sense
right.
D
So
in
the
interactive
version,
the
difference
between
simulation
and
real
world
usage
is
doing
it
live
essentially.
So
the
way
in
which
we
cheat
in
the
interactive
version
is
that
we
will
do
things
out
of
order.
So
in
a
proper
interview
I
would
go
to
the
interview
they
would
decide
on
the
question
to
ask
me
and
then
I
would
answer
if
I
was
trying
to
cheat,
I
would
decide
on
a
question.
D
D
So
essentially,
the
research
paper
version
of
a
protocol
would
tell
you
essentially,
which
way
we
cheat
and
the
way
in
which
we
cheat
is
not
something
that
is
realizable
in
actual
quote-unquote
production
use.
Okay.
But
the
argument
saying
that
these
proofs
could
have
been
produced
in
a
cheating
way
will
still
hold
value
in
real
use.
D
D
D
D
So
coming
back
into
this
trivial
example,
we
mentioned
that
completeness
and
soundness
without
zero
knowledge
is
very,
very
easy.
You
just
send
the
witness
to
the
verifier
and
have
the
verified
check
right.
So
essentially
you
you
still
put
in
your
pin
in
the
pin
pad
and
the
the
bank
checks,
and
everybody
else
knows
your
password,
but
that's
fine.
It
was
not
one
of
the
requirements.
E
D
There
is
no
cheating
prover
for
that
protocol.
None
at
all,
it's
also
a
useless
protocol,
but
nobody
can
cheat
so
essentially,
this
tells
us
that
completeness
is
actually
worth
something.
It's
it's.
What
forces
the
protocol
to
work
and
not
be
quote
unquote,
overly
secure
for
its
own
good,
finally
completeness
and
zero
knowledge
without
soundness.
D
That
is
also
very
easy
to
to
achieve,
and
this
is
a
protocol
that
always
says
yes.
Can
I
have
50
bucks
sure
a
hundred
of
course,
a
million
right
away
so
in
in
fact
we
we
do
need
the
the
completeness
property.
It's
it's
not
as
trivial,
as
might
seem.
It
doesn't
just
say
that.
Well,
the
protocol
works.
D
It
says
that
the
protocol
needs
to
work
and
we
can't
take
any
shortcuts
in
trying
to
to
achieve
security.
So
there's
a
there's,
a
few
more
properties
or
parameters
of
zero
knowledge
protocols.
One
of
them
is
the
setup.
Some
of
them
can
be
used
without
a
setup.
Others
need
to
have
what's
called
the
trust
setup.
D
So
a
trust
setup
means
that
we
need
to
have
some
sort
of
elaborate
ceremony
that
will
produce
the
setup
string
in
order
to
ensure
that
no
one
person
can
cheat
now.
The
the
good
news
is
that
people
have
figured
this
kind
of
protocols
out
and
they
usually
come
with
a
very
nice
guarantee
that
if
you
have
n
people
taking
a
part
in
that
protocol,
then
only
one
of
them
needs
to
be
trustworthy.
D
For
the
protocol
to
be
successful,
and
by
successful
we
mean
a
common
reference
string
is
produced
that
is
not
under
any
one
person's
control,
so
the
the
idea
is
that
everybody
rolls
some
dice
and
the
randomness
is
pulled
together
and
as
long
as
nobody
knows
what
all
the
dice
rolls
were.
The
protocol
is
fine.
So
what
you're
supposed
to
do
is
that
you're
supposed
to
roll
your
dice
do
stuff
with
the
results
and
then
throw
your
dice
away
and
not
write
down
the
result.
D
D
We
can
reuse
the
exact
same
setup,
and
that
is
great.
Otherwise
we
need
to
rerun
part
of
the
setup
if
we
change
from
a
protocol
that
hashes
to
a
protocol
that
checks,
I
know
public
keys
to
a
protocol
that
checks
signatures
to
a
protocol.
That
does
something
else,
so
we
prefer
universal
setup,
but
well
sometimes
we
we
sacrifice
that
for
efficiency
and
will
come
towards
that
at
the
very
very
end
of
the
lecture.
There's
also
the
question
of
interaction,
as
we
mentioned
in
blockchain
applications.
We
do
not
want
interaction.
D
We
do
not
want
interaction
because
interaction
implies
state.
So
I
send
the
verifier
a
message
and
then
the
verifier
replies
something
back,
which
means
that
the
verifier
needs
to
remember
what
they
sent
to
them
and
what
they
replied,
because
otherwise
I
could
try
and
say:
oh
you,
you
asked
me
about
what
I
had
googled
beforehand.
D
So
if
I
go
to
some
company-
and
they
ask
me
about-
I
know
rust
development
and
then
I
pretend
to
answer
is
if
they
ask
me
about
zero
knowledge,
they
need
to
remember
that
they
ask
me
about
trust,
which
implies
that
this
information
needs
to
be
saved,
which
makes
everything
more
expensive,
so
long
story
short.
We
do
not
want
reaction.
D
Finally,
a
very,
very,
very
strong
property
is
that
of
succinctness,
and
that
has
to
do
with
the
size
of
the
proofs
produced,
so
usually
in
the
context
of
non-interactive
proofs.
What
happens
that
the
approver
does
some
calculation
sends
a
blob
of
data
to
the
verifier?
Now,
ideally,
you
want
that
blob
of
data
to
be
very
small.
D
In
fact,
we
would
be
extremely
happy
if
that
blob
of
blob
of
data
is
has
some
fixed
size.
That
is
small
and
does
not
depend
on
the
complexity
of
the
problem
that
we're
actually
tackling,
and
this
is
something
that
snarks
do
for
us
and
by
extension,
if
every
proof
is
quite
small,
then
the
verification
speed
is
actually
quite
quick
as
well.
E
D
Right
so,
ideally,
we
would
like
this
property
that
proofs
are
tiny
either
in
that
they're,
very,
very,
very
small.
In
regard
to
the
relation
the
statement,
the
witness,
or
ideally
they
have
a
fixed
size,
even
if
our
relation
is
complex
and
our
witness
is
large
and
this
acceptance
can
be
both
concrete
or
amortized,
with
amortized
being
that.
D
D
So
if
we
have
some
sort
of
mixing
service
that,
in
a
in
an
environment
without
proofs
had
the
ability
to
essentially
take
everybody's
money
and
run,
then
maybe
we
can
use
soundness
to
force
them
to
behave
in
a
very
correct
way,
and
there
is
an
additional
property
that
actually
does
not
have
a
lot
to
do
with
either
building
privacy.
Well,
we
only
had
the
standard
security,
integrity
or
building
integrity
into
a
private
operation
that
required
trust,
and
that
has
to
do
with
succinctness.
D
So
we
have
things
that
we
know
how
to
do
and
we
can
do
them
pretty
cheaply.
But
if
we
do
a
lot
of
them,
they
suddenly
become
expensive.
So,
let's
say
verifying
transactions.
You
can
verify
one
transaction
pretty
easily,
usually,
but
at
some
point,
if
you
verify
enough
of
them
it,
it
starts
to
become
a
bit
of
a
hassle.
D
Maybe
it's
actually
cheaper
to
use
a
protocol
that
verifies
instead
of
sending
the
data
itself
and
verifying
it,
and
this
can
enable
service
in
both
space
and
time.
So
this
is
the
the
third
killer
app
of
zero
knowledge
is
not
using
zero
knowledge
for
zero
knowledge,
just
using
it
to
hide
the
witness,
not
because
you
want
to
keep
the
the
witness
secret,
but
because
you
cannot
be
bothered
to
send
the
u
this
the
witness
over
the
internet-
and
this
is
a
very,
very
interesting
property
right.
D
So,
let's
hear
about
everyone,
if
they're
interested
in
taking
a
slightly
close
look
into
one
specific
protocol
or
if
it's
something
that
you
think
you
can
dive
into
on
your
own,
we
will
provide
references
and
the
slides,
obviously
to
do
in
your
own
time
and
move
on
to
essentially
the
broader
picture,
which
will
echo
the
discussion
we
had
previously.
So
maybe,
let's
have
a
show
of
hands
on
who
would
prefer
what.
E
D
D
So
what
happens
that
the
prover
essentially
creates
a
temporary
value?
That's
supposed
to
hide
his
private
information.
He
sends
that
to
the
verifier.
The
verifier
picks
a
random
value
c,
which
is
the
challenge
sends
that
to
the
approver
and
then
the
approver
does
his
final
calculation
sends
the
purported
solution.
S
and
the
verifier
will
accept
or
reject,
and
now
in
actually
going
through
the
mass
that
proved
the
properties.
Well,
we
do
some
math
and
we
show
that
correctness
works
and
for
soundness
or
actually
knowledge
soundness.
D
D
There
is
this
way
of
structuring
the
proof
about
zero
knowledge
where,
as
we
were
saying
before
the
way
you
cheat
is
that
you
decide
on
the
question
before
you
start,
and
that
is
fair
to
do,
because
we're
building
a
transcript.
There's!
No
two
persons
in
the
room
actually
holding
a
conversation
we're
just
sitting
by
ourselves
and
the
playing
both
parts
in
whatever
order.
We
want.
D
D
D
D
D
The
way
they
trip
themselves
into
bizarre
world
was
by
using
bad
randomness
in
all
likelihood,
but
the
the
takeaway
message
is
not
just
to
be
careful
about.
Randomness
is
to
be
very
careful
about
what
the
requirements
for
actual
use
of
the
protocol
in
the
real
world
are,
and
something
that
is
very
important
and
that
we
will
revisit
next
week
in
all
likelihood,
is
the
the
argument
about
trusted
reference
strings.
D
D
But
what
you
should
be
interested
in
is
how
to
use
the
protocols
correctly
so
that
you
stay
in
the
real
world
and
you're,
not
inadvertently
leaking
information
or
allowing
people
to
provide
invalid
proofs
and
potentially
steals
people's
money
or
private
info
so
to
to
sum
up
some
proof
systems
that
will
probably
come
up
in
your
in
your
study
in
this
class
and
potentially
in
the
applications
that
you'll
build.
So
first
off,
we
have
snore
signatures.
D
Now,
notwithstanding
the
facts
that
we
never
talked
about
with
a
discrete
log,
they
do
just
that.
One
thing:
on
the
other
hand,
this
one
thing
is
quite
useful:
it
can
get
us
signatures,
it
can
get
us
with
some
extra
tricks.
Things
like
ring
signatures
used
in
monero,
so
there's
quite
a
lot
of
use.
We
can
get
out
of
even
this
one
tool
and
it's
also
quite
easy
to
get
into
just
to
study
it.
D
D
So
you
can
make
a
protocol
that
says
well,
I
know
of
inputs
x
and
w
x,
being
public
w
being
private
and
they
can
be
as
big
as
you
want,
such
that
when
this
program
runs
in
this
input
it
outputs
zero
or
it
outputs
one
or
outputs
500,
and
obviously
this
is
very,
very
expressive.
You
can
build
literally
anything
on
top
of
that
which
is
pretty
cool,
so
systems
that
allow
you
to
do
that
are
bulletproofs
plonk
and
gros16
they're,
not
the
only
ones.
They're.
D
Probably
the
more
popular
ones
which
also
builds
into
the
assignment
you'll
be
tackling
which
has
to
do
with
circum.
As
I
said,
these
proof
systems
can
be
used
to
represent
any
program
and
the
usual
way
in
which
these
programs
are
represented
are
as
circuits
or
sets
of
constraints,
and
this
is
a
very
strange
way
of
programming,
because
at
the
same
time
you
might
be
writing
code
that
assigns
values
to
variables
or
signals,
or
you
might
be
writing
code
that
verifies
that
an
assignment
is
correct,
so
in
in
a
way,
you're.
D
So
one
part
of
the
program
does
one
thing
and
one
part
of
the
program
does
its
flip
thing,
you'll
you'll
say
it
in
more
detail.
So
let's
go
back
to
proof
system,
so
we
have
bulletproof
splunk
and
growth,
16
and
they're
actually
ranked
in
this
slide
in
order
of
efficiency,
so
plonk
is
more
efficient
than
bulletproofs
and
grocery
sting
is
more
efficient
than
plonk.
D
D
D
Either
you
need
to
be
doing
something
native
with
zero
knowledge
or
if
you
want
to
use
zero
knowledge
protocols
inside
the
smart
contracts,
you
either
need
to
have
a
super,
simple
protocol
that
can
be
done
expressed
as
a
sigma
protocol.
That
looks
like
snore
signature
or
a
slightly
more
complex
version
than
that
or
if
you
want
to
go
full
hog
and
the
just
check
a
circuit-based
proof,
you
need
plonk
or
gross
16
or
something
similar,
such
as
sonic,
marlin
or
or
one
of
the
same
family
right.
D
A
Yeah,
thank
you
so
much
pierce.
This
is
really
great
and
we
actually
write
on
time.
So
I
suggest
because
the
next
class
will
also
be
taught
by
you
peers.
So
we
can.
We
can
actually
have
some
questions
offline
and
we
can
consolidate
and
let
people
digest
it
a
little
bit
and
then
maybe
we'll
resume
the
next
class.
But
meanwhile,
maybe
we
can
also
answer
some
questions
in
the
practical
session
on
monday.