Ais of TACEO @ ZK Hack Meetup in Denver, 24 Feb 2025

Transcript

[Music] um thank you very much for the introduction and sorry for yeah the the fiddling with the thing can you hear me okay um it's already like the first day and I'm losing my voice I'm not built for this kind of stuff anyway I'm going to show you many many many things very very quickly and all of this is supposed to just be sort of like teaser of like hey like nuggets of information that you can grab on to and then come find us as like jerro guy said uh yeah come find us and ask us um it's a lot of information so uh I hope it's okay so I'm want to talk about coars and private shared state I'm ash from T um so maybe one

thing to start is like how many people here have heard about karks already so 1 2 3 four five six seven okay are they the same 10 people that were at the nor earlier maybe yeah this okay too well maybe you've uh you'll recognize some of the slides but then also you know do people know about multi-party computation okay it's ZK hack Meetup so I'm not going to ask that but like for multiparty computation do you know about this kind of stuff yeah okay great then I can go into the fun stuff quickly so one of the things I want to say is that the reason we're here is to talk about private shared State okay we're all coar this and ZK that and n PC and fhe and te and la la la like let me throw another

three-letter acronym in there and we're really here to talk about private Shar State and I want to tell you why for a second so being ZK people you will probably be quite familiar with uh State models and things like this so you know at ethereum that you have this public State this blockchain that everybody can read everybody can verify you can build stuff on it you can build stuff on the stuff that you built and it has all this nice public verifiability composability makes this like new world of development and it's great except it's not great because it's slow it's slow it's very slow uh I just realized it's being recorded so I better not swear it's very slow um and so all this DK stuff came around to help with the scalability side of it then when we got the scal the DK

side for scalability low and behold privacy comes in tandem so then you see things like Aztec Alo mid midnight coming up where there are like these ZK chains that give you this uh State like different state model now but around privacy does it have composability not really because actually this privacy normally kind of resides locally on your mobile phone or client side or whatever and so we have this public shared stage this like beautiful vision of ethereum and now we have this private stuff where we're very happy but like we kind of lost all this composability that ethereum gave us and we're back to square one and so what we really want is this sort of new state model where you get the composability of

ethereum the privacy of something like Aztec and then you're kind of like okay well what is this now some sort of composable private State yeah so we're calling it private shared State this is the dream that we're going for the reality means that actually if we want to realize this private shared State stuff it means that we need to start actually Computing on the encrypted data itself not client side not necessarily on an L1 but like somewhere else we need to do some um Computing on encrypted data and so yeah this is what will give us the composability but again remember this is not the kind of web two uh Computing on encrypted data now we're in the ZK world we want composability but we also want verifiability and so yeah

this is where coars come in so the uh verifiability is like the classic case of ZK this yeah Computing on different states without revealing to anyone this is the classic case of MPC so there's a question like if we put the two of these together does it work yes it does it's called collaborative snarks and this came about in 2021 from Dan Bonet and is a PhD student at the time Alex they sort of yeah ported the ZK prover into this MPC setting this is cool right but as Luca said earlier I think was a nice analogy this is like a great blog post unless you show something kind of special about this what was the special thing the special thing was that like okay you have ZK which has some overhead

in the computation that you're doing you have MPC which has some overhead and you kind of feel like okay if I do ZK in MPC these overheads are going to multiply and like just become huge and they show that actually this is not the case actually when you do ZK in MPC for some kind of special things some caveats whatever there are no overheads so like you can do MPC sort of kind of for free and so yeah like uh that was the paper from 2021 they take a single prover which takes us input a single witness outputs approved it's verified by a verifier they split it into this multi-party setting where there are three provs where they take in different shares of witnesses then you get this privacy you get your proof you get your verifiability you get everything you

dreamed of so that's what uh karks are so for the the the other few people outside of those 10 um this is like a brief intro to coars so we at AO uh very much like these because they give us this private shared State World That We're Dreaming of and so we Implement uh kosnar stuff not coastar stuff uh tools libraries that you can actually use and if you want to build private Shar State applications how do we do this um well first we need to implement a lot of MPC protocols uh we do this with uh okay I'm going to skip this but like yeah you get no overhead because there's a lot of kind of linear secret sharing that you can use for the efficiency um the main

proof systems that kind of are very friendly for this or growth 16 Clon also less friendly but still pretty good um mostly these are good for elliptic curve based provs uh writing the circuit so we heard before that like maybe it's not like ideal that you have to learn some new tool chains and it's like okay well we're in this kind of niche of a niche where you're talking about doing private computation on multiple inputs from different like the ethereum state the okay we're in this kind of weird world where like okay maybe it's okay to actually learn some uh new tooling so but we tried to do it in the absolute most developer friendly way that you possibly can so we build this coar tooling for circum or for Noir so if you know circum or if you know Noir you can

use this and you're all good um so yeah this is a QR code that links to the uh GitHub where you see the coar repo um this will show up again later so how does this look in practice and I think this is one of the things this is like maybe the stuff that's most interesting for the people in this room because I get the feeling or I make the Assumption at least that you know a bit about TK you kind of heard about coars maybe and like from people that know about TK and that know about coars they kind of ask slightly more intelligent questions let's say because they're able to sort of start reasoning about this buter in this kind of weird setting so it's also hard to reason about so let's help you

reason so this is a picture that we showed earlier and like uh it's like super small and you cannot tell really anything from this but I'm just going to point uh and quickly explain some stuff so like on the bottom left you have this Noir program so this is let's say for Co Noir the the Noir version of our coar tooling you just write as a developer your normal Noir program but if you want to leverage private share state if you want to do private proof delegation you want to do some dark pools you want to do some Computing on encrypted data and have a verifiable result of the computation whatever you want you write your Noir program this goes through um then you know uh there are different users Alice and Bob let's say using this

program they put their input into the application the kir part of the application secret shares their data into yeah these encrypted shares that are then sent to this MPC Network and the same happens for Bob and so this is how like H private data from different users ends up on the network so they kind of yeah do this secret sharing in their local environment send it to the network the network so the three provs or the three nodes in this NPC Network do some computation output a result and it goes to this what is called Charlie in this picture but just could be another server or like a front end whatever um so you get this proof as an output and you get the output of the computation so this is

like very very very briefly very high level as I said I'm giving you like throwing you tidbits of information that you can latch on to and maybe grab us later to ask questions so yeah it's just to highlight that you can take data from different people secret share it do some comput ation in a private way so that Bob doesn't learn Alice's input Alice doesn't learn Bob's input but somehow they learn some computation on their joint inputs um are they actually efficient okay so the goal like from this uh Dan b Paper was saying like yeah okay there's no overheads you could do this for free question is can we actually do this for free and so yeah the goal is to generate proofs with like no overhead compared to a sing approver the reality is okay

again another like graph with like a super a lot of information but like just so that you can see Heights of bars next to others and try to like reason about the efficiency of this stuff so this one is for kir if you saw Lucas's talk earlier he went into a bit more details about kir with kir like it's quite featur Rich which means that like uh it can be quite complicated to do an MPC very briefly but it also means that like us as a team working on this like we've just been kind of like uh working hard to like Implement as many features as possible because if people want to try and run programs in a nice way they want to use all the features of Noir so we've just been like yeah cranking out features rather than spending time on optimizations the next while will be

some optimizations but for now this is like considered quite unoptimized stuff and for each like on the bottom you see like different kind of uh experiments that we were doing so for like dark pools with uh 10 uh Prov with for generating Poseidon proofs Merkel trees all this kind of stuff on the left of each experiment you see the experiment run in MPC and on the right you see in Noir and so for all of these pretty much you see that like Noir is cheaper so doing it like just ZK alone is cheaper doing it for NPC is a bit more but uh as I said we hope to do some optimizations to get this faster as I said K Noir or Noir in general is quite feature Rich

it's like a versatile language circum on the other hand is a bit more restricted and we have a bit more control over what we are doing there and we can do a bit more optimization pretty quickly and so these are the benchmarks for the results on co- circum and you can see for some stuff we actually get like uh the same or cheaper than the ZK in MPC so if you want to do like MPC like a private computation in circom you can do pretty well with like little overhead over like the ZK uh with privacy equivalent so again just some benchmarks some pictures to show you like the relative uh differences between running these things have a look grab us if you have

questions and so looking ahead basically really this is just kind of the beginning like I don't know if you have seen I mean maybe one of the questions I should ask at the start is like not anymore how like do you know what coars are but rather like have you seen private shared state in reality like and the answer is kind of not really I mean not people are not really doing this yet so this is like super super the beginning and so yeah it's very fresh it's emerging it serves a purpose like there are people who are using this and who need this like for dark pools all the ZK stuff that you want to do all the stuff that you kind of hope to do kind of actually needs this computation layer on top and if you want to do this maintaining privacy maintaining the

verifiability maintaining the composability all this kind of fancy features you need something like coars so yeah there are many open problems trust there's research problems developer problems node running problems economic problems network problems all sorts of stuff so like it's a super cool huge area that's really opening up and there's like everything to do so it's really cool um yeah let us know if you want to experiment either as like developer note provider researcher uh whatever yeah uh there's everything to do and yeah so I guess like for me or us thinking about private share at state is like talking to somebody about e-commerce in 1990 like e-commerce is coming like you don't believe how good

this how big this is going to be and I was like what is she talking about for me it's kind of like this it's like really again the start of the internet and so for me yeah also like when people ask what is the use case of blockchain this is it like this is where you need the decentralization where you need the Privacy it's the one thing that web to can't give you like because it's inherently centralized here this is the thing like this is it for me at least I care about privacy so yeah uh that's it basically we need private shair at State use Co sarks talk to us and thanks [Applause] [Music]