Anonymous Engineering Paradigm, Modular ZK and Geometric Proofs / Amir Taaki

Transcript

foreign [Music] oops

um hi thanks nice to talk with everyone uh okay so yeah so crypto is uh the buff of agarist parallel economic Network and uh right now uh transparent crypto is crypto there's fragile so fragile fragility it means the in an adverse environment the it is infrastructure that cannot survive and transparent systems they break uh Under Pressure but

in an anonymous system this is reversed um where attacks against anti-fragile systems only vindicate their value proposition and draw and it drives more and more users uh into anti-fragile or crypto so um you have this side of crypto where there are projects that you know the way that they're built that they're fragile when they come under attack users end up exiting from the system and then you have crypto projects which are anti-fragile and the more they come

under attack the stronger they become and crypto is under attack from all sides they're increasingly using the language of War Elizabeth Warren last week announced that she was she was forming an anti-crypto army to fight against crypto so we've really reached a new phase in the escalation of the war against crypto and the inevitable endpoint of this fragile anti-fragile sides of crypto is uh Evolution into what we call a reg fly and a dark fire and a reg fi is a side of crypto which is meaningless it's

powerless it's completely encumbered um and uh and nearly impossible to use and and everything intro is interesting is like driven into Oblivion and then there's the underground unregulated side of crypto there's free and unencumber to properly explore the true destiny of crypto as a major historical invention on par with the the printing press or gunpowder a new asset that cannot be uh cannot be is immune to seizure by the states that essentially makes the nation-state economic model Obsolete and

you know uh dogfight we're building uh we're creating the infrastructure for this movement to stand its ground to innovate and to push forwards so a bit about uh darkfi you know darkfi is not just a an L1 for ZK contracts it's um we're into the entire concept of anonymous engineering Paradigm uh where we see the all of the developments in cryptography can be used to construct a new paradigm of computing a self-sovereign paradigm uh also we have the as far as I know the only L1 which

has censorship resistant validators so like the ofax censorship which happened on if it can't happen because our validators are Anonymous and no trust is set up because we're using Halo 2 and then Anonymous Network level privacy via tour on Nim and you can add any other transport so and right now so I mentioned Anonymous engineering so yeah and so in in particular now in this last decade there has been really some

huge breakthroughs in uh consensus algorithms distributed systems and cryptography um you know ZK obviously is a very important technique but also you know there's NPC and he and then more exotic things vdfs functional encryption even in the mathematical side which is what in this talk maybe I'm going to explore more we're increasingly going away from like before cryptography used to use a lot of simple number theoretic Concepts now it's going increasingly more into stuff like arithmetic geometry and like Advanced abstract abstract Concepts so um and

uh so we're trying to conceptualize this new this this Paradigm of how we currently instruct Anonymous applications yeah and so anonymity actually expands the design space of what's possible so an example of that is you know we made a Anonymous style and that was you know because of our experience with Assange style where we raised 55 million to free Assange by all means necessary but then it was a weird situation where we had this treasury that was on chain and people you know were participating and it was

but it was for a political prisoner so there's a lot of risk for people there so then and not only that but also we were participating in an auction uh to bid on an nft but our treasury was on chain and completely public so uh it it just led to this very inorganic situation where nobody wanted to bid against us so um it just completely broke the game theory of of the entire thing so that's why we may we we made a anonymous anonymous style and you know if for example I give the example of voting in the anonymous doubt you know you create um a vote which is uh uh which is you make a commitment using a homomorphic

commitment scheme and then uh people post that and then at the end somebody comes and adds all them up together and they publish a proof of the votes passing a threshold which is set in the dial and then that allows the money to be debited from the Dallas treasury on chain so already there you can see it a whole different bunch of techniques being used homomorphic commitments uh verifiable encryption ZK proofs Anonymous protocol and liquidity so those combination of techniques is like how you can conceptualize Anonymous engineering and in particular in ZK uh or in general in the cryptography now we're going increasingly I think the end point will be uh modular systems where

you will be able to chain together different pipelines or different uh cryptography systems or for example in ZK different proving systems that specialized for different tasks so um and I was and as also I was talking about this exploration that's happening now which um you know honestly like a lot of the contracts we use is very simple uh uh uh like uh schemes around polynomials but there's a vast Universe out there that you know we're only just beginning to explore so um I I wanted to give uh example of uh construct that can be used for set

proofs so there's another talk after this interesting about that uh but for example if I show here this is a circuit layout and you can see the big uh vertical green column and that's a lookup table and unfortunately when I use that lookup table it forces me to uh have to I can't force me to double my circuit size so I get all this wasted space that you can see below so um that's kind of awkward especially for smaller circuits so one idea that people are talking about is uh that you can do you can do curved

trees which is a as a elegant uh construction but the main slowdown in curved trees is you need an elliptic curve in a product proof which is a Patterson proof and um yeah and so uh and so what's interesting is there there is this paper which is called zero knowledge proofs of elliptic curve inner products and in the paper he says um he says many this is in the intro in the second section he says uh many discussions of elliptic curves so this is by Liam Eagan by the way many

discussions of elliptic curves avoid delving into the details of how the group law is actually derived so a lot of cryptographers that a lot of people in crypto in general they're using this group lore of elliptic curse but there's no motivation for where did that group law come from uh preferring instead to define the group law in terms of an opaque collection of axioms and it's not apparent it's not apparent why these Define a group but for the purposes of programmers they and cryptographers they treat the elliptic curves as a black box and it's not and they typically don't have a deeper understanding so this computational oriented view of elliptic curves is the starting point for zero knowledge proofs of elliptic curve operations have tended to be defined

so however using the Picard group one can show that the collection of of curve points sum to Zero by demonstrating the existence of an element of a function field of the curve and how exact intersects these points um so yeah so this asymmetry between what is necessary to compute and what is necessary to verify computation was carried out correctly is fundamental to computer science and reframing other problems in this way may lead to more performance zero knowledge proof systems so I found that kind of I found that very interesting so I'm going to talk a bit more about how this is constructed so

um an important problem in number theory that people talk about is okay there's a prime number that is equal to the sums of two squares okay how can we find all of the set of numbers the the uh have have this property uh and and maybe you can set it to a specific prime number but one way to do this is actually to view it not as an equation over the rationals or over the integers but to actually view it as uh cure join I where we can split it into the product of these two factors and people who know this stuff will know then you can conceptualize in terms of

prime ideals um and then there's a very elegant proof that you can use to say okay these are all the numbers that fit that factorization X Plus i y x minus i y so this this is broadly I think this is called Pell's equation but it's a broad class of problems that mathematicians like to think about in number Theory and but then but then a crucial part of this proof is that you need to be able to guarantee that whenever you have a number Alpha in this field that it can be factorized uniquely so that's when we start talking about unique factorization

this becomes like a very important problem in number Theory so there is this concept of uh of a euclidean domain so euclidean domain is like as like as you know with normal numbers so I put this equation at the bottom but another way to look at this is that when you have a number Alpha and when you have a number beta and when you divide when you do alpha divided by Beta then the remainder will be some fractional amount that is less than one so um so I can give it I can actually give a diagram of that here and you can see um if I zoom in so you see this is this is the field

that is uh cue adjoined with square root of minus three and if I'm if I where's my mouse how do I get there oh [ __ ] one's sake [ __ ] I need to be able to move my mouse to that screen but but it's a okay okay should work yes okay so if I put my mouse here

then you can so just to explain this is uh lattice of all the and all the white things are the actual uh uh integer points in this field it's it's like a generalization of integers to this field which allows us to to kind of do similar things as we do with integers and and so then we can say okay is every point in this field uh close what's the closest point there is there a closest integer point so in this in this what the [ __ ] that's my presentation ah

Okay cool so yeah in this equation here uh the equation at the bottom it says that um okay when there's a alpha and there's a beta so for example if Alpha was number 10 and beta was like the number three then uh then there is some integer uh like for example the number three such that ten is equal to 3 times 3 plus a remainder and that reminder would be less than the the number three so now as I said if you rearrange that you can also think about that 10 divided by three and the remainder would be 0.333 Which is less than one so uh when we look in this lattice here

we've got okay all of the points in this plane what's uh is that like it in this bounded region is uh are the numbers uh less than one so if I move my mouse you can see the the top calculation which is calculating the the distance or the or the norm you can see is 0.5 and as I uh let's see if I remember how to do this oh yeah as I increase the numbers you know I get to this one which is 15 and I put my mouse here you see it's still one but as soon as I increase it here

then now it's greater than one so this field stops being euclidean it loses that property and so then okay and so then um in in the number Fields then we can start because it's a dedicate domain then we can start to look at okay okay we can't use this euclidean property to prove that there's unique factorization but we can't actually look here in terms of we can't actually look at it in another way to see is this the main principle and so then there's this construct called the ideal class group and what that is is we Define uh we Define uh an ideal basically

as a principle if it can be uh if yeah if if there's this prop if the idea is is principle then uh uh then there then they're equivalent and when and so if the size of this group um yeah so when I look at a number and we we look at the factorization of that number we will look here not in terms of numbers but in terms of this thing construct called ideals and so we want to be able to see they can be factorized uniquely by looking at can it be factorized in terms of Ideal sort of print support

when we say principle it means defined by single element which means then it can be the factorization of a bunch of elements and so we Define this property of of principality and then we look at like the total con deconstruction of all the elements in this field and we quotient it out in this equivalency relation by the set of Ideal set of principle and so then uh we can actually look at okay what's the size of this group and if the size of the group is one then we know it's a principal ideal domain and so therefore that we know it has unique factorization but if it's greater than one it tells us how far away does this uh field deviate from being a unique factorization domain and

so and so this is a construct that people use in cryptography for like unknown order groups for example like cheer they're using it for their uh for their thing and actually was and the way that they Define it is you have these topple of three integers and so actually this group that I just constructed which is a very algebraic group there's actually a computational way of of defining it and so you can construct this ideal class group where there's an equivalency between these topples of integers that represent a type of uh uh uh type of quadratic form where you use matrices from this group called SL2 and this group is defined by

uh by uh forms of the by it has two subgroups one subgroup is of order four so it's mate it so it's s and you see it just does a rotation along like by 90 degrees and you see s inverse does a rotation in opposite direction and then the other one is T and T is an infinite size subgroup you can see this is T going in that direction you can see it's t going that way so if you so if you look at the topple which says ABC that's the coefficients of the quadratic form and so there there is actually for every quadratic form where the discriminant is the same which is -12

um then there's a way of adding doing certain operations where you know I mean like I I won't do it here but there's a certain algorithm that you do that if you give me any top or or that represents a form you will always get a unique uh representative of that class and actually uh this abstract thing is can be computed using those quadratic forms and you can do a lot of cryptography interesting cryptography with it um but this construct generalizes to elliptic curves and you might know this from pairings it's used a lot in pairings the the devices and so the

broadly speaking you have a function that's defined over elliptic curve and you can construct these devices a representation of the zeros of a function and you know that these devices when they can be represented by a function we call them principle but when they don't represent a function they're just normal devices so again we construct this class group where device is a principle if they can be represented by a function and so it can do a lot of interesting things in that but one of the property which you can actually compute using resultants is this via reciprocity where the F of div G is equal to the G of div F and so what

you could do is you can construct a protocol where the verifier gives you a random line at the intersects your function that you're trying to prove is a function that has these zeros and if this function has these zeros then it means that those points on the elliptic curve they add up to the identity and so that is an interpolation of of those points and so the and so you know there's this resultant and you can see that it's got this dualism symmetry property which happens a lot in Geometry um so if you take for example your function that you're trying to prove

interpolate these points q1 up to qn then uh the if you calculate the result on f and g you will see that F of the zeros of G is actually equal to G of the zeros of f and so uh and so you have this identity that you can use um where I have a function f with zeros of that I'm trying to prove has zeros of q1 up to qn which then means that q1 uh the sum of q1 up to qn is uh is equal to the identity on the elliptic curve which then you can use to construct in a product proof in the way and then what

the verifier does is they construct a random line which has three zeros because that's a line going for an elliptic curve and then I evaluate my function f on all of those zeros and I check and then we check if it's equal to the line evaluator my zeros and and so then that's the protocol but actually we can use this thing called discrete log which if you look the discrete log is is equal to differentiating U and divided it by U but it takes that statement which is multiplicative in in inside of the brackets and it turns into an additive statement so then that statement which was more multiplicative we can actually make it more efficient

by turning it into additive statement and making a a statement about the structure of that that group uh so but and then you can use that to construct a elliptic curve in a product proof and um it's interesting because also allows us to construct more abstract statements inside of our ZK proofs so for example you know you can construct statements about divisor class groups inside of the ZK proof and if you can do that then you know potentially you can model things like hyper elliptic curve divisor groups which have an unknown order for Janus three or or above but genus 3 is recommended and uh and then

and it's part of this trend which I think is uh very interesting inside ZK which extending the operators the developers have access to inside a ZK like right now we use addition and multiplication and you can extend that with custom Gates but having access to potentially more high level properties is is interesting and the and and so the ZK development itself or this Paradigm is is fundamentally algebraic and um and so uh part of that is like how do we construct a tooling which allow Anonymous Engineers to construct an application and then schematize it

and formalize it and be able to implement it and so that's also part of that investigation which we're still very early in in terms of how do we build or construct tool chains or compilers that will be able to do the optimization of of circuits and there's a lot of stuff about like dependent types and type Theory Etc because I showed you that table earlier which had that row and there is a gadget and I snap it in and I'm restrict I'm just it's a fixed number of rows I can't optimize it and also I have to add like a certain number of columns and I can't use less common columns so all of that optimization is done by hand it's

predefined in the library so all of the tooling is is very primitive so and uh and so all of this tools or techniques are are are things that we can wield that we can use to hack and to construct uh applications there they give us a huge amount of power and our thesis that we published uh more than two years ago is we're seeing it happen uh more and more constantly the uh that really uh necessity is going to drive the value proposition of dark fire

which it's and and like our thesis is just being Vindicated more and more um you know like it's at this point is practically inevitable the and in that case like darkfi will be strong market leader we will we are like we're like our Triumph is guaranteed um and yeah I'll leave you with this quote by Satoshi who who gifted us uh free software money uh thanks everyone foreign