►
Description
StarkWare Co-founder and Chief Architect, Michael Riabzev (https://twitter.com/@StarkWareLtd) and NEAR Co-Founder & CTO, Alex Skidanov (https://twitter.com/AlexSkidanov) discuss StarkEx, STARKs vs. SNARKs, and do a deep dive into Stark's algebra.
StarkWare solves the inherent problems of blockchains – scalability and privacy. They develop a full proof stack, using STARK technology to generate and verify proofs of computational integrity. StarkWare’s cryptographic proofs are zero-knowledge, succinct, transparent and post-quantum secure.
------- About Whiteboard Series ---------
The Whiteboard Series with NEAR is a set of video interviews with Founders who are building scalable solutions for Blockchain. We deep dive into their story, what they're developing and how it is helping the ecosystem.
Follow the latest from NEAR Protocol on,
Website: https://near.org/
Discord: https://near.chat
Twitter: https://twitter.com/NEARProtocol
GitHub: https://near.ai/github
#WhiteboardSeries #Blockchain #FutureIsNEAR
B
Yes
sure
thank
you
alex
yeah.
So,
as
alex
said,
I'm
a
co-founder
of
startware
and
chief
architect
instructor.
The
plan
for
today
is
to
dive
into
one
of
our
products
the
start
exchange
a
south
custodial
exchange
engine.
We
will
see
some
comparison
to
other
exchange
engines
and
other
models
and
ideas
and
analyze
things
like
scalability
and
data
availability.
B
B
B
B
There
is
a
centralized
database
in
this
bank
and
the
one
who
decides
how
to
change
the
database
is
actually
the
bank.
I
don't
know
I.t
department,
they
can
do
any
change,
they
want
in
a
blockchain.
It
is
not
the
case
in
the
blockchain,
everybody
see
the
transactions
and
they
know
exactly
how
to
deduce
from
these
transactions.
What
are
the
balances
of
each
and.
B
In
the
system,
additionally-
and
this
allows
them
to
make
sure
there
is
no
no
malicious
behavior,
for
example-
nobody
just
prints
out
money
out
of
thin
air,
something
which
is
technically
possible
in
a
central
system
and
no
money
is
being
stolen.
Somehow,
because
every
transaction
in
a
blockchain
requires
a
signature
of
the
one
who
owned
the
funds
before
another
important
property
in
blockchain
is
anti-censorship.
B
This
mechanism
is
insured
in
the
decentralization
nature
of
blockchain,
because
when
I
want
to
send
a
transaction
in
a
blockchain
and
if,
for
example,
somebody
doesn't
want
me
to
do
this
transaction,
I
can
believe
that
the
fact
that
there
are
many
miners
in
the
network,
if
I'll,
just
provide
enough
fee
for
this
transaction,
it
will
be
mined
by
somebody,
and
this
is
so.
Those
are
two
very
important
features
of
blockchains
and
we
will
focus
on
them
today.
B
B
B
B
B
If
you
don't
want
to
trust
somebody,
we
can
use
a
cryptographic,
utility
called
proof
systems.
A
proof
system
is
a
or
a
proof
of
knowledge,
actually
is
something
that
can
take
knowledge
of
transactions.
It
can
take
the
statement
of
let's
write.
It
here
explicitly
balance
zero,
given
a
set
of
transactions.
B
B
This
technology
is
called
zk
roll
up,
which
vk
comes
from
zero
knowledge
proof,
but
actually
you
don't
really
need
zero
knowledge
for
this.
We
just
need
a
proof
of
knowledge,
and
in
this
technology
it
scales
much
better
than
blockchain.
So
what
is
the
work?
Each
node
in
the
network
need
to
do
in
such
a
case.
In
such
a
case,
the
work
each
node
has
to
do
is
the.
B
B
B
Something,
for
example,
by
a
factor
of
two
you
just
add
a
small
constant
to
its
log.
It's
it's!
It
just
grows
very
slowly.
I
can
give
even
the
actual
numbers,
because
here
in
the
start
where
the
stark
exchange
is
currently
based
on
validium,
so,
for
example,
when
we
do
batches
of
100
transactions
or
batches
of
64
000
transactions,
all
of
them
take
roughly
a
bit
less
than
5
million
gas.
A
B
B
B
B
C
B
The
exchange
cannot
just
move
to
a
state
where
alex
does
not
have
android
editor
or
something
removed,
but
the
exchange
can
decide
and
not
to
serve
alex's
your
request,
and
in
such
a
case
this
is
this
is
correct
for
any
system.
This
is
correct
for
ck
roll
up,
the
exchange
can
decide
not
to
serve
and
in
validium
and
what
happens
in,
I
think
most
of
the
system
in
start
exchange.
This
is
the
way
that
we
do
it.
B
A
B
Tell
the
smart
contract
that
they
are,
they
want
to
withdraw
their
funds
and
the
exchange
does
not
serve
them.
Then
there
is
a
time
lock
that
if,
after
this
time
lock
the
funds,
for
example,
alex's
funds
are
not
withdrawn
to
unchain
and
the
smart
console
does
not
see
that
alex's
request
was
indeed
served.
B
Okay,
it
means
that
it.
It
is
a
threat
on
the
exchange
that
if
the
exchange
decide
to
censor
somebody,
then
they
have
to
send
or
they
then
they
cannot
operate
anymore.
They
have
to
stop
work
at
all
completely,
but
it's
still
not.
It's
still
not
a
good
enough
solution,
even
in
this
case,
although
it's
a
big
threat
on
the
exchange
alex
is
still
missing.
B
His
android
ether
that
he
deposited
into
the
exchange
not
a
a
way
to
continue
and
to
provide
alexis
funds
would
be
for
alex
to
get
them
directly
from
the
exchange,
but
in
a
thicker
road,
for
example,
it's
easy
to
do
it
in
seeker.
Roll
up,
the
smart
contract
can
know,
for
example,
what
what
are
the
balances
in
some
cases
or
any
way?
B
If,
for
example,
the
balances
are
kept,
what
is
usually
done
in
the
merkle
tree
and
only
provided
on
chain
sanded
in
the
transmission
alex,
has
all
the
data
needed
he
can
reconstruct
the
merkle
tree
and
can
provide
the
smart
contract
with
an
authentication
path,
convincing
smart
contract.
He
really
did
a
owned
hundred
ether
in
the
exchange
and
the
smart
contract
can
give
them
access
and
send
him
this
hundred
ether
in
a
validium.
It
becomes
a
bit
more
difficult
because
the
because
alex
in
this
case
only
sees
what
all
the
networks
is.
B
B
Those
committee
member
members
are
required
to
provide
all
the
users
their
data.
Of
course,
even
for
such
a
committee,
there
are
several
possible
models.
It
could
be
the
case,
for
example,
when
all
the
balances
can
be
public,
like
in
decentralized
exchanges
where
everything
is
on
chain
anyway,
that
the
data
can
be
available
to
everybody
all
the
time.
All
the
snapshots,
all
the
exclusive
balances
are
published
in
some
websites,
for
example,
and
the
only
some
selected
committee
you
need
to
find
on
them,
and
this
is
what
the
contract
verifies
and
the
in
diversifying.
B
For
example,
one
of
the
things
that
is
very
important
to
traders
is
their
privacy,
the
and
in
such
a
case,
the
committee
member
keep
this
balance
of
information
to
themselves,
but
they
are
required
to
publish
them
to
anybody
in
case
the
exchange
freezes
in
order
to
allow
an
exit.
Does
it
make
sense.
B
A
Change
the
color,
so
so
it
is
worth
very
quickly
discussing
right
that
some
other
roll-up
solutions
to
provide
data
availability.
They
just
submit
all
the
transactions
in
the
call
date,
as
you
mentioned,
they
think,
and
but
they
don't
store
them
in
the
storage
yeah
right.
So
so
you
also
mentioned
that
very
verification
of
the
stark
is
50
million
gas
right.
So.
A
Oh
sorry,
yeah!
Yes,
sorry!
That's
what
they
meant.
Yes,
a
little
less
than
5
million
gas
right.
So
a
little
less
than
5
million
gas
allows
you
to
send
in
the
cool
data
on
the
order
of
300
kilobytes
of
data
right.
So,
if
transaction,
depending
on
the
size
of
the
transaction
that
allows
you
to
send
on
the
order
of
1000
transactions
for
the
same
for
the
same
amount
of
gas
right.
So
I
guess
this
is
not
very
viable.
A
So
so
I
think
well,
my
my
calculation
could
be
a
little
off,
but
if
we
assume
the
transaction
is
on
the
order
of
300
bytes,
it
will
allow
you
to
send
approximately
1
000
transactions
for
the
same
price.
If
transactions
are
smaller,
that
will
be
more
transactions,
but
that's
additional
right.
So
if
you,
if
verification
costs,
5
million
gas.
A
B
B
B
Trust,
okay
and
before
I
start
the
discussion
about
trust,
I
want
to
say
a
few
things
about
the
blockchain
properties
and
to
dive
on
a
bit
deeper
discussion
about
proof
systems
to
analyze
it
a
bit
better.
So
there
is
here
and
something
which
is
arguably
an
opinion.
But
let's
look
at
this.
This
way
opinion
my
personal
opinion.
Maybe
somebody
else
can
think
so
opinion.
B
B
B
I
will
just
do
a
state
transition
where
alex
does
not
have
this
money
anymore,
and
I
have
this
money
instead
and
then
they'll
tell
him
okay.
Here
I
withdraw
everything
that
you
have.
You
have
nothing,
so
it
seems
that
one
one
one
is
is
more
basic
in
the
importance
and
two
is
an
important
addition,
but
does
not
stand
by
its
own
okay.
B
Yes,
this
is
a
great
question
alex
yeah,
I
mean
anti-sensorship
in
regarding
withdrawals
regarding
the
self
custody.
The
self
has
to
be
property
of
the
exchange,
preventing
the
exchange
from
censoring
things
like
orders,
or
things
like
that
is
not
directly
related
to
self-custody,
which
is
the
first,
the
first
goal
we
are
trying
to
solve
scalable
self-custody
and
I
think
it
might
have
some
regulatory
or
additional
issues.
B
A
But
also,
I
I
think
it's
it's
it's
worth,
comparing
quickly
the
the
zika
roll
up
in
an
optimistic
roll
up
right.
So
it's
in
the
model,
above
the
difference
between
optimistic
roll
up
and
ezekiel
roll
up
right
that
in
ezekiel
roll
up
when
we,
when
we're
submitting
a
new
set
of
transactions
for
other
new
balances,
we
submit
a
a
proof
right
that
they're
correct
we're
submitting
a.
I
was
called
validity
proof
right,
yeah.
A
Optimistic
instead
of
just
submitting
your
balances
and
we're
saying
those
balances
are
correct,
trust
me
and
then
anyone
in
the
future
can
submit
a
fraud
proof
right,
providing
a
prove
that
they
are
not
valid,
in
fact
right.
So
what
is
the?
What
are
the
advantages
of
of
the
zika
rollover
optimistic
rule.
B
A
B
You're
absolutely
correct
it's
another
dimension
that
I
just
put
aside
for
the
scheme
and
did
not
focus
on
it.
So,
as
you
said,
optimistic
proof
and
optimistic
systems
based
on
fraud,
proof
are
a
bit
harder
to
analyze
because
they
require
a
liveness
of
of
the
users
of
the
system
in,
in
contrast
to
the
systems
described
here,
where
you
have
a
safe
state
transition
in
some
way
in
optimism,
optimistic
roll
ups.
B
The
operator
can
try
to
do
any
state
transitions
and
even
try
by
opportunity
to
cheat,
but
all
the
users
have
some
window
some
time
period
they
can
claim
the
operator
is
trying
to
cheat
here
and
to
show
it
with
some
kind
of
a
proof
that
something
invalid
happened
in
the
system,
but
in
contrast
to
all
to
the
systems
here,
it
requires
everybody
to
be
alive
and
monitor.
It
is
very
sick.
C
C
B
I
can
use
safely
etherscan,
for
example,
or
other
actually
trusted
applications
and
to
trust
what's
going
there,
because
there
are
many
many
validators
in
sikhiro.
If
there
would
be
some
very,
very
big
energy,
sorry
optimistic
relatives,
there
would
be
a
very
big
optimistic
application
in
the
scale
of
bitcoin
and
ethereum.
B
It
might
be
the
case
that
I
will
feel
safe
about
it.
Similarly,
but
if
there
is
a
small
application
where
there
are
a
few
dozen
of
validators-
and
it
could
be
the
case
that
there
is
some
window
in
the
time
that
none
of
them
is
operating,
I
don't
know
some
kind
of
an
issue
they're
on
vacation.
There
is,
I
don't
know,
they're
all
in
some
area
where
there
is
a
issue
with
electricity
right
now.
B
I
don't
know
what
I
would
be
afraid
that
the
system
would
get
to
some
invalid
state,
and
so
I
think
the
analysis
of
a
fraud
proof
based
systems
is
a
bit
harder
and
there
have
their.
They
have
their
advantages
of
scalability,
because
in
the
optimistic
systems
there
is
no
need
for
the
operator
to
prove
every
time
and
generating
proofs
is
a
costly
process
to
prove
every
time
they
transition.
A
A
I
think
to
your
point:
you
mentioned
that
you
can
trust
etherscan
because
of
number
of
validators.
Arguably
etherscan
can
provide
you
invalid
data,
even
if
even
in
the
case
of
many
validities
right,
but
if
you're
on
a
light
client,
I
think
then,
then,
then
I
think
your
your
point
becomes
correct,
because
if
I
run
a
light
client,
I
only
validate
the
the
hash,
the
hash
complexity
of
the
chain.
Right
then,
I
trust
that
more
than
51
of
block
producers
are
honest,
and
so
the
longest
chain
is
the
valid
chain.
A
B
Okay,
so
a
crash
course
in
complexity
of
proof
systems,
so
there
are
several
proof
models
in
computer
sense,
complexity,
the
simplest
one
is
a
proof
model
where
approver
provides
a
proof
to
a
verifier
and
the
verifier
reads
the
entire
proof
and
checks.
If
it
satisfies
the
claim.
The
statement,
this
model
is
a
very
known
model.
B
It's
a
class
of
problems
called
mp
and
nondeterministic.
Polynomial
time
solvable
problems,
and,
if
you
think
about
it,
anybody
who
learned
the
basic
complexity
classes.
It's
familiar
that
with
the
definition
that
np
is
the
set
the
languages
in
np.
The
problems
that
belong
to
the
np
class
is
the
set
of
problems
that
there
is
a
polynomial
lens
weakness,
polynomial
in
the
length
of
the
problem,
description
that
a
verifier
can
verify
it
deterministically
and
check
if
the
witness
satisfies
the
statement.
B
So
this
is
the
the
smallest
class
of
such
a
proof
system,
something
which
is
a
a
bit
more.
A
class
which
is
a
bit
bigger,
is
interactive
proof
system.
Interactive
proof
is
just
like.
I
don't
want
the
approver
to
provide
me
all
the
information
I
interact
with
the
prover.
It's
just
it's
like
a
it's.
Like
questioning
somebody
in
the
court
and
asking
them,
where
did
they
been,
what
did
they
do?
Checking
their
allerby
and
things
like
that?
B
B
There
was
the
idea
of
having
any
program
and
that
approver
can
generate
a
proof
showing
that
there
is
no
some
some
input
to
the
program
that
would
satisfy.
For
example,
the
program
ends
with
return
true
or
con
false,
and
a
verification
of
such
a
proof
would
take
a
poly
logarithmic
time
in
the
length
of
the
execution
trace.
So
this
the
set
of
languages
in
this,
this
complexity
class
is
languages
that
can
be
determined
with
a
non-deterministic
exponential
time.
B
B
B
A
So
that
would
not
work
right
if
the
proof
can
have
like.
Let's
say
a
proof
is
such
that
a
single,
a
single
line
can
make
the
entire
proofing
correct.
Then
sampling
several
lines
would
not
would
not
work
right
so
there
they
need
to
be
some
property,
that
the
proof
is
either
entirely
correct
or
or
has
a
large
number
of
of
incorrect
statements
right.
Yes,.
B
It
could
always
be
the
case
that
if
you
read
the
proof,
deterministically
you'll
see
that
there
is
some
issue
there,
but
there
is
still
high
probability
that
the
verifier
given
the
query
is
the
very
first
row
would
be
satisfied
by
the
proof.
But
what
it
says
in
such
a
case
is
not
that
the
proof
is
correct,
but
the
proof
is
closed.
B
As
a
code
word
to
a
correct
proof.
So
it
means
that
there
exists
a
correct
proof
and
if
there
exists
a
correct
proof,
it
means
that
the
statement
is
correct
and
actually,
if
the
proof
is
close
to
a
correct
proof,
then
the
approver
could
have
generated
the
correct
proof.
Actually,
because
the
proof
is
proof
of
knowledge.
Making
something
close
to
a
correct
proof
shows
knowledge
and
knowledge
shows
that
you
general
can
generate
a
correct
proof.
B
B
A
B
Maybe
if,
if
I'll
give
you
a
word-
and
I
ask
you
to
translate
it,
it
might
work,
it
might
be
a
case
that
you
actually
speak
hebrew.
But
if
the
word
is
very
complex,
you
don't
really
know
it.
For
example,
I
speak
russian,
but
there
are
several
words
that
I
don't
really
remember
in
russian.
I
would
it
wouldn't
be
easy
for
me
to
remember
them
a
possible
test.
So
so
just
asking
you
to
give
me
a
word
or
to
translate
a
single
word.
B
B
If
you
really
know
hebrew
is
if
I
could
give
you,
for
example,
an
article
or
a
book,
a
short
book
or
an
article
in
english,
and
I
would
ask
you
to
translate
it
to
hebrew
in
such
a
case,
you
would
do
actually
a
lot
of
work,
but
I'm
being
busy.
I
wouldn't
really
read
all
your
translation
of
the
article
or
the
book.
I
would
choose
a
few
random
paragraphs
or
a
few
random
areas,
and
I
would
verify
the
translation
is
good,
meaning
the
syntax.
B
The
hebrew
syntax
that
you
used
is
indeed
a
good
syntax,
showing
that
you
know
how
to
write
something
that
makes
sense
in
hebrew,
and
I
would
check
consistency
with
the
origin,
with
the
article,
for
example,
to
check
that
it
is
indeed
in
line
with
the
original
article,
and
it
would
be
very
easy
for
me.
I
think
that
something
that
would
take
you
about
maybe
a
few
hours
to
write.
I
could
verify
it
with
a
few
seconds
and
actually
as
more
work
that
you
would
invest
in
writing
it.
B
B
B
B
Circuit
that
would
allow
it
to
verify
the
correctness
of
the
answer.
Okay,
so,
but
now
we
have
an
issue
here.
The
proof
size
is
pretty
long.
For
example,
as
we
said,
when
we
talk
about
computational
integrity,
computational
integrity
is
defined
in
the
following
way.
Given
a
program,
both
the
approver
and
the
verifier
agree
on
the
approver
proves
that
they
know
an
input
to
the
program
that
eventually
the
program
accepts.
B
For
example,
the
program
ends
with
a
return
true
statement,
and-
and
it
could
be
a
very
long
run
time
of
the
program
right-
the
the
program,
the
time
that
it
would
take.
The
prover,
for
example,
to
run
the
program
could
be
exponential
in
the
length
of
the
program,
for
example,
if
there
is
a
very
long
for
loop
or
a
while
loop
in
this
program,
the
proof
size
here
is
very
long.
It
is
a
quasi-linear
in
the
length
of
the
trace
of
the
program.
You
can
think
about
this
way.
This
is
when
we
talk
about
programs.
B
B
C
B
Because
its
length
is
at
least
as
a
verification
of
millions
of
transactions,
you
cannot
send
it
on
chain,
it's
a
very
long
proof
and,
as
we
said,
the
verifier
only
need
to
query
a
few
indices
from
the
proof.
So
what
we?
What
we
actually
send,
is
not
the
proof
what
called
hill
the
proof,
but
what
we
send
is
the
transcript.
B
Of
the
communication
between
the
prover
and
the
verifier-
and
this
allows
everybody
to
simulate
the
verifier
and
to
verify
that
everything
is
okay.
For
example,
if
you
see
the
randomness
is
okay,
there
are
the
very
fair
choice.
Then
you
can
know
what
are
the
queries?
You
know
what
are
what
is
the
circuit
and
anybody
can
actually
verify
the
response
right.
B
Okay,
yes,
so
this
is
exactly
something
that
I'm
about
to
to
go
into.
If
you,
if
you
somehow
magically
trust
the
verify
randomness,
then
you
can
verify
this
transcript,
and
now
we
have
a
question:
how
can
you
trust
this
verify
randomness
and
another
thing?
How
can
you
trust
that
the
approver
that
the
the
values
the
approval
returned?
The
answers
are
indeed
a
related
to
this
specific
proof
that
this
proof
was
generated
before
notice
that
the
prover
just
seeing?
B
B
B
This
transit
by
the
way
is
called
an
argument.
The
argument
this
is
in
the
academy.
It
is
called
an
argument
of
knowledge,
but
in
in
the
space
of
blockchains.
This
is
what
we
call
a
proof
both
when
we
say
that
we
send
proofs
on
chain
and
both
when
you
have
snark
proofs
on
chain.
None
of
them
are
actually
proofs,
they're
all
arguments
for
something
much
much
bigger.
B
An
argument
on
the
other
way
is
based
on
the
com
on
cryptographic
assumptions,
and
we
will
see
in
a
moment
two
such
arguments,
one
used
for
start
systems
and
the
other
used
for
start
systems.
We
will
see
exactly
why
it's
waterproof
and
why
there
are
the
where
there
are
those
assumptions
of
those
complexity,
assumptions.
B
B
B
And
the
queries
are
sent
to
the
proverb
this
way:
notice
that
the
approver
doesn't
really
need
to
interact
with
the
verifier,
because
the
approver
knows
already
what
would
be
the
query.
So
the
approver
can
commit
on
the
proof
and
then
to
simulate
the
verifier,
putting
the
merkle
root
in
the
prng
and
then
to
answer
the
queries
and.
B
C
B
Yeah
so
you're
absolutely
right
alex
absolutely
correct,
and
this
is
a
real
issue
in
a
way.
So
in
a
proof
system,
something
that
I
did
not
get
into
is
a
soundness
the.
What
is
the
soundness,
for
example,
if
we
go
back
to
the
analogy
of
translating
something,
when
I
ask
you
to
translate
a
word
or
a
sentence
or
an
article
or
a
book,
we
have
come
to
the
conclusion
that,
as
you
do
more
work
for
example,
then
it
it
would
be
easier
for
me
to
check
it.
B
This
is
one
thing
another
thing
it
would
be
more
sound
if
I'll
check
more
places.
Right.
If
I
have
more
queries,
I
can,
I
can
have
better
sounds
so
if
we
have
an
interactive
protocol
when
the
approver
cannot
predict
what
would
be
the
fair
randomness
just
as
before,
not
using
the
feature
heuristics,
and
I
just
want
to
convince
you
something
now
online-
I
just
give
you
the
commitment
and
then
you
give
me
randomness
and
I
have
to
answer
your
queries.
B
I
think
that
if
I
have
probability
one
to
ten
to
cheat
you
in
such
a
protocol,
you
will
feel
pretty
safe
and
if
you
want
to
feel
very
safe
probability,
one
two
hundred,
if
I'm
able
to
cheat
or
really
sure
about
it,
one
two
thousand,
I
think
in
such
an
interactive
protocol.
You
don't
really
need
what
is
called
a
high
sound.
B
When
the
protocol
is
non-interactive,
you
actually
need
much
higher
soundness
because
of
writing
exactly
as
you
set
up
in
such
a
case.
The
proverb
can
try,
for
example,
to
choose
some
index
here
and
to
grind
on
it
to
try
there
many
many
different
options
to
this
index
until
they
get
a
route
that
would
would
generate
queries.
B
So
in
such
a
case
and
the
way
to
increase
the
soundness
is
just
by
having
more
queries.
So
a
proof
which
is
non-interactive
is
by
nature,
not
a
proof.
In
this
case,
an
argument
which
is
non-interactive
is
by
nature
bigger
than
an
interactive
argument
and
because
it
requires
it
includes
more
queries
and
more
vertical
authentication
paths
in
the
case
of
stars.
Does
it
make
sense.
A
B
C
B
C
B
B
B
It
somehow
messes
up
all
the
structure
of
the
proof
in
a
way
that
when
you
read
something
from
the
proof,
it's
harder
for
you.
If
the
proverb
cannot
know
what
was
the
original
data
that
needed
that
that
that
caused
the
values
the
encrypted
values?
This
is
something
that
mixes
everything
up
and
the
queries
are
something
that
read
this
mixed
up
information
and
the
idea
here
is
the
following:
with
this
homomorphic
encryption.
B
When
the
prover
sees
what
are
the
queries,
the
prover
doesn't
know
what
exactly
those
queries
represent.
They're
in
an
encryption
form
sent
into
an
encryption
proof
and
the
prover
doesn't
know
how
exactly
to
generate
something
that
would
satisfy
those
queries
unless
the
approval
really
generated
a
real
proof.
B
B
C
A
B
Not
only
interactive,
this
scheme
is
actually
a
verifier
designated
okay
in
this
scheme,
because
the
soundness
of
this
scheme
requires
the
prover
not
to
understand
what
are
the
queries.
There
is
no
commitment
actually
to
the
proof.
There
is
only
a
request
for
the
approver
to
encrypt
the
proof,
with
some
key
and
to
answer
to
some
queries.
B
B
If
the
prover
would
know
what
those
queries
are
then,
just
as
before
the
approver
would
know
what
are
the
queried
indexes
and
how
they
would
be
checked.
So
the
prover
can
generate
a
proof
which
is
a
complete
rubbish
and
only
to
put
a
values
that
would
satisfy
those
specific
proofs
and
those
specific
queries
in
the
relevant
indices
and
encrypt
it
and
do
everything
in
the
protocol.
And
then
the
mover
actually
can
generate
a
proof
that
satisfies
the
verifier
for
any
statement.
Even
invalid
statement.
Right.
B
A
B
This
is
so.
This
is
a
very
fair
designated
proof
and
in
a
way,
in
contrast,
for
example,
to
the
starts,
where
what
the
way
that
we
call
such
a
protocol
is
the
public
coin
protocol
or
a
transparent
protocol,
because
the
randomness
doesn't
have
to
be
secret
as
long
as
the
randomness
is
known
to
the
prover,
only
after
the
proof
generation
it
doesn't
have
to
be
secret.
B
Another
thing
that
we
can
see
here
that
in
snarks,
first
of
all,
another
difference
is
that
is
that
the
statement
is
not
about
a
program.
It
is
about
the
circuit
and
the
encryption
key
here
is
as
long
as
the
circuit
as
the
circuit.
So
it
is
actually
it's
not
some
synth
work
to
generate
those
keys.
It
is
a
an
expensive
work
requiring
complexity.
B
All
those
parameters
and
delegating
them
to
a
trusted
party.
This
is
what
is
called
the
trusted
setup
and
what
the
trusted
party
does.
They
just
publish
this
set
of
encryption
key
encrypted
queries
and
the
circuit
to
verify
approve
verifier
only
execute
this
very
small
circuit
on
the
answer
and
the
approver
has
to
generate
a
proof
encrypt
it
with
the
encryption
key
and
answer
the
predefined
queries
in
the
trusted
setup.
B
This
makes
the
verification
very
succinct,
but,
as
you
as
the
name
says,
and
as
you
understand
from
this
process,
this
setup
has
to
be
trusted.
In
particular,
it
is
very
important
for
these
queries
not
to
be
linked,
because
if
those
queries
are
leaked
somehow
in
this
phase
and
then
proofs
can
be
furnished
for
any
statement
even
for
incorrect
statement.
A
C
B
I
I
never
thought
about
this
question,
but
my
intuition
says:
no.
I
don't
think
it's
really
related
here
to
breaking
neuro
knowledge.
You
know:
okay,
no,
it
should
not
break
zero
knowledge
because,
for
example,
the
zk
snarks,
the
very
very
designated
protocol,
as
I
described
before,
is
a
zero
knowledge
protocol.
It
protects
the
youth,
the
approver
and
the
verifier
knows
what
are
the
the
plane
queries,
the
verifying
the
designated
verifier
protocol?
The
verifier
knows
everything
here,
all
the
information
that
can
be
leaked
so
and
it
is
still
a
zero
knowledge
protocol.
B
A
Makes
sense-
and
so
I
guess
a
natural
question
arises
so
given
snarks
do
have
a
trusted,
setup
and,
and
many
people
are
very
unhappy
with
the
with
the
existence
of
trusted,
setup
right
and
and
starks
do
not
what
are
the
disadvantages
of
storks?
So
so
one
of
them,
I
guess,
is
a
complexity
right,
so
snark
is
appears
to
be
constant,
or
rather
the
size
of
the
of
the
number
of
queries
right.
While
stork
is
logarithmic
in
the
size
of
the
proof.
B
Yeah,
so
yes,
starks
are,
the
proof
in
starks
is
bigger
the
the
main
difference.
The
main
disadvantage
is
the
is
this
miracle
authentication
path
that
you
need
to
send
to
the
verifier
and
end
up
being
part
of
the
argument
that,
for
example,
goes
on
change,
and
this
is
of
course
something
which
is
expensive.
B
B
A
A
So
so
so
so
so
consider
I
have
a
large
proof
of
the
of
the
transactions
like
on
the
exchange
right.
So
on
the
verifier
side
I
will
to
the
verifier.
I
will
provide
the
miracle
witnesses
of
for
the
for
the
queries
that
that
were
submitted
right
using
randomness
and
so
on
the
verifier
side.
I
will
then
execute
the
proof
right
and
and
executing
the
proofs
successfully.
If
I
can
prove
that,
there's
a
proof
that
I
can
execute
successfully,
it
is
equivalent
to
an
extent
you
mean.
B
A
A
B
It
is
indeed
an
interesting
idea,
it
has
trade-offs,
but
it
could
be
the
case
that
I
guess
for
very
long
proofs.
It
might
be
beneficial
right
now
when
we
have
a
authentication
path
of
length.
I
don't
know
of
the
order
of
30,
for
example,
then
replacing
them
with
the
proof
might
seem
not
really
beneficial
make
sense.
B
Which
we
can
do
now,
given
the
discussion
before
so
I'll,
just
remind
what
we
said.
We
said
that
in
the
blockchain
we
have
two
properties,
one
a
sound
state
transition
and
two
anti-censorship
anti-censorship,
and
we
said
that
one
seems
to
be
more
important
than
two.
So
in
this
case
I
would
just
write
that
we
have
here.
B
B
And
here
it
is
actually
one
based
on
trust,
so
two
based
on
trust,
meaning
the
anti-censorship,
is
based
on
trust.
So
if
you
remember
the
discussion
that
we
had
before
regarding
regarding
the
stark
exchange,
so
in
stark
exchange,
we
have
a
validium
and
the
anti-steroid
ship
ends
up
being
based
on
trust.
It
is
just
like
trust
is
not
always
a
very,
very
bad
thing.
B
B
B
On
trust,
it
is
actually
given
the
discussion
that
we
just
had
when
we
have
state
transition
based
on
zk
snarks,
then
the
fact
that
the
proof
cannot
be
forged.
For
example,
you
cannot
just
move
to
a
new
state
that
you
want,
and
it
is
sound.
It
is
based
on
the
trusted
setup,
because
if
somehow
information
from
this
trusted
that
leaked
to
the
operator,
then
the
operator
can
forge
any
state
transition.
So
in
this
case
we
have
a
vk.
B
C
A
B
A
B
B
B
And
that
would
allow
both
data
on
chain
and
a
data
off
check,
so
you
can
have
a
funds
in
the
same
exchange
and
you
can
choose
if
you
want
your
balances
to
appear
on
chain
when
they're
changed,
and
in
this
case
it
is.
It
should
be,
of
course,
more
expensive
because,
just
as
the
price
tag
shows
here,
it
would
require
all
the
verifiers
of
the
network
to
read
these
balances
and
to
verify
them,
and
things
like
that.
B
C
B
Exactly
the
program
in
this
case
would
be
something
of
the
following
form:
it
would
have
two
different
of
when
it,
when
the
knowledge
or
the
public
input
to
the
program
would
include
a
set
of
balances
or
a
range
of
balances.
Actually
that
should
appear
on
chain,
and
the
proof
would
attest
that
if
a
balance
in
this
set
changed
then
here
is
the
new
value
of
this
balance,
and
the
smart
contract
in
this
case,
which
has
access
to
to
those
balances,
would
verify
that.
C
B
A
B
You
only
because
the
the
only
reason
you
would
need
this
data
availability
to
know
those
the
balances
is
in
the
case,
there's
the
exchange
freezes
and
you
want
to
use
the
escape
patch.
So
you
don't
really
need
to
verify
what
was
the
values
before
you
only
need
to
keep
track
of
the
most
updated
values
of
those
balances
right.