Beginner's Guide to zkSNARKs 2: Proof Systems in the Wild

Transcript

everybody hear me me and why did this stop strange okay can people hear and see me I I think if I try and record it it's blocking stuff anybody that's

all can nobody hear me of hand up I believe H do I accept please um you can also directly message in the side there we go invite to speak so you can come up and speak if you like or you can send a message in there yes hell don't [Music] have sorry your audio is very unclear for me could you repeat that yeah so you don't have permission for uh I'm I'm really sorry I really can't make out what you're saying it's very muffled the audio you can't you don't have access to the to the chat

you're saying yes oh what the hell how did that happen you lost access to this to the chat oh god um they must have changed something about it and I'm not sure I have the permissions to change that and I'm not even sure where you do it cuz I think that's done by the administrator of psse um uh okay so maybe this time around I'm really sorry for this I don't know what

what they've changed maybe this time around if you want to ask a question you can um raise your hand and I'll keep my eyes peeled for for those um yeah then I'll make sure that's changed for next time because that that you know I know a lot of time I don't want to speak when I ask a question I just want to type one in the chat so um I let me try and quickly send a message the stick hands

up um maybe yeah okay so let's get going welcome to part two uh same general Point says the the content online and um this is where you'll start to see the order of stuff diverge so I think polinomial which is what we're going to do first now is in the the right place but this uh the next stuff where we Explore More generally what's happening will be um at the end at the end of the book um stop me for any questions as we said if there's any quality issues let me know and I will do what I can to change that hopefully there shouldn't be any audio issues I think last time my my

vpm was turning on and off for some reason and that was um affecting the audio Yeah so in terms of the first session I don't have any clarifications um that I wanted to add um in terms of things that I should have expanded upon but if you have any leftover questions from the first session now is the best time to to ask any of them I'll just give you then I'll take that as no leftover questions the first session relatively straightforward but I really think the

main stuff you should definitely remember regardless of what you do afterwards because it'll probably be somewhat related to crypto um remembering the stuff from the first lesson is the most important for like just general understanding and now we're going to do a bit more exploration of the space so we can get going so we're going to do three main things um intro to polinomial is just a bit of math and that's going to help us understand some of the differences between the different proof system ultimately basically everything we're doing is related to pooms so it'll be a lot easier to discuss the differences if we look at them I'm going to mention constraint count that's really only two three minutes and then we're going to look at these different proof systems that are out there only a few of them because there are just tons and tons

okay a polinomial I know it's a like sort of scary sounding maths word um I you know even I don't like it that much but they're actually not that complicated you I'm sure all of you saw these in school and it's just a function you know f ofx equals something this one here we have 4X y^ 2 + 3x - 5 um and they're also Limited in in their shape um so I'll show you what I mean by quickly sketching we can have F ofx equal x cubed + 4 x + 5 now this is a polinomial and the restrictions we

have are that um the powers so you know this three here and this x technically has a one there we just don't write it because that's assumed what to be the powers can only be whole numb numbers and whole positive numbers so x^ 3 x^ 5 um we can't have a non- integer one so X the^ 1.5 you know that's not allowed or G of x equals x to the uh four no sorry 3 over 7 you know these aren't allowed similarly the coefficient the number in front I mean this is technically a one

and this is a five these also have to be whole non- negative numbers and that's the Restriction we're working with so they're fairly uh straightforward and we also can't have a negative power x the minus one which is the same as 1 /x now the example in the slide also has two terms it has an X and A Y so if we're to write one of those h of X Comm y we got to put in both variables we do x y^ 2 plus x^2 y + 5 um this is also a polinomial at fits our rules where we have the whole powers and and the coefficients are fine as well um but for many of our proof

systems we won't work with two um variables we won't have a y we'll only have an an X there are some proof systems that will work with multivariables and they'll actually have tons of different variables but for for initial learning it's much easier to focus on on you know single variable at a time and that will be this is what plunk going to do okay so that's what a polom is and you're going to see that we get a lot of properties um very quickly now the first thing we can do with polinomial we can actually represent data inside our polinomial and at first that might sound a little

confusing or strange um but it's actually really really straightforward and we're going to see the power very quickly so I can do this for a little setting as well let's say that we're in a kind of um online game show type thing and we're guessing the the price of of uh some objects and let's say uh I'm guessing that the first object is 37 and the next one is 51 and then it's 1004 what I want is a way to prove to you later that this was my guess now but I don't want to share my guess with you cuz then you know my stuff I want to keep that secret so what we can do we

can represent this data as a polinomial and it's extremely straightforward we're going to do F ofx = 37 + 51 x + 104 x^2 right we just use them as coefficients and you'll probably notice that we can just keep doing this like if I had more numbers going onwards we could just keep adding higher powers of X so we can stick as many numbers as we want in this polinomial it could be 100 could be a thousand it could be in the millions um in practice we we we'll be doing this with polinomial that um contain millions

of numbers as as coefficients so the powers of X go into the millions so we can represent data inside polinomial um but we're still stuck a little bit because again if I don't want to share my guess with you sure I might have a polom but I don't want to share the polinomial because that still contains my data um so this is where what we're going to get one of the scaling properties we're just going to compress this and I'm going to send you something called a commitment I'm just going to evaluate this polinomial at a random number we'll do F of different different color that's fine f of um I

no let's do 10 you know because this way I can work it out 37 + 51 * 10 + 104 * 10^ 2 which is going to give us 37 + 510 Plus 10,400 which going to equal 10,947 I believe and now I can send you this value I can send you this value and if I give you this value um you know I evaluated it at 10 as well so you know

the value with pols evaluated at 10 and that that's the value and that it contains three numbers but you still can't actually work out what my coefficients were yeah in this example you might be able to Brute Forces because it's quite small but in practice we'll work with a much larger set this random value won't be 10 it will be some you know number in the millions if not billions or actually way way higher than that um right so I can send you the commitment and then later when I actually want to share my values I will say hey my my values were actually 37 51 100 4 and then you'll just make the polom yourselves and you'll calculate it

at this random point and if you get the same value come out your conclusion is going to be that was actually my polinomial so we just did a lot right there we we represented data inside pols and then we compressed it remember these polinomial can contain millions billions of data points millions in practice and we just represented all that data in a single number this thing here that we called a a commitment and then I can later use that to prove the numbers I had earlier okay so this is where a bunch of the the scalability is coming from um it's by evaluating polinomial at random numbers in practice um there's

another cool thing I'll touch on but we won't evaluate at uh 10 we'll evaluate at something called we usually refer to it as towel and what's interesting about tow is that it's a random number but we we don't actually know what the number is because it's an elliptic curve point we haven't touched on any of this maths but I'm just briefly mentioning it um but tow is actually elliptic curve point so we won't get out a number we'll get out another elliptic curve point and the interesting thing there is that we can actually keep reusing the same random value tow even though we know sort of what tow the elliptic curve point is okay so we'll touch more on that

detail later but the the main point here is actually that we can get data and represent it in a polinomial uh yeah so if you recall the image from the last session we're going to add in a few more steps we have the same starting point value idea to idolize circuit and then we're going to make the circuit but now instead of going kind of straight to the polinomial uh sorry the proof we're going to do a few things with the with polinomial um and you can already guess some of it you know the making of the polinomial you just saw how we can do

that and I'll show you how we do it with a circuit then we do the committing two pols and that was the evaluation at the random point and then we'll do something called a qu in the pols which is actually just evaluating it at another random Point okay and then you get out the proof so how do we turn an actual circuit into a polinomial well we're not going to make one polinomial we're going to make a few of them okay let's take circuit that was a uh times plus plus that's a

multiply plus plus and we have 3715 3715 we can work out these values that'll be you know for a valid circuit this will be 21 this will be six and this will be 27 um so we'll first we'll make our first polinomial and I'm going to call this L of X because L's going to mean left so we want the left wires which is this wire here this wire here and also this yre here so that's 3 plus uh 1 x you know the one here is

redundant but I'm putting it in just for completion and then plus 21 X2 next we want to um the next one I'm call it R of X and obviously R is going to be right so this going be this right wire this right wire uh this right wire and that's it so we have 7 + 5x + 6 x^2 and lastly we have an O of X for out and that's going to be this y here this y here and this y here the 21 + 6x +

27 x we're representing y some y values more than once you know twice so for example here this this six wire we're representing it twice and that's like done on purpose because in practice um this isn't one wire it is a there we go these are actually two separate wires and what we're claiming is actually these two things are connected so with the sort of the same wire but that's actually because we connected them and that's why it appears twice in our pols and our proof systems going to confirm that these two wires or two

gates are actually connected as we say they are um and then same as before um in fact prior to that you can now also see that we have this circuit but we also sort of just represented it as pols like are these the same thing like sort of not but also sort of yes like they represent the same information as as far as we're concerned the pols don't actually um don't fully demonstrate how gates are connected that's one bit of information that's missing and it is done by another polinomial but we're just ignoring it

for now because it's too much stuff at once and we'll focus on some what's happening but you can see that this compation physical Gates being connected but by pols and regardless of the size the computation the number of gates we can always make these these pols and then as our outline showed we can uh commit to them so we're going to evaluate them at the random point which is to just do let's do

this so evaluate them at a random point and then once I I send you these values these commitments I've kind of locked in this this circuit CU if I want to change anything about it now then I will change what the um I will change what this commitment value will be um and then you'll you'll be able to notice that through the proof system so this commitment is ensuring we kind of lock in place our circuit along with all the Y values you know if you recall from last session uh we the the Y values that aren't initially filled in are called the witness and those are kind of a private information for the approver so we commit to them and

then we what will happen afterwards is that we'll do something called querying and essentially the verifier you in this case will come up with another random number not to but a new random number it can't be a number I was going to guess because if I can guess it I I can cheat so after I make these commitments that's when you have to come up with the new random number and there is a way to always do that it's called the Fiat jistic I'm not going to go into how it works because take you know a few minutes and it's a tangent and not necessary but um after the commitment sent that's when we come up with a new random

value and then we'll get those values where's the red L of whoops yeah that wasn't right of a new random value or Alpha and then basically these values are the things that are going to go in the proof and they should behave in a certain way that we're able to predict um not going to show you how they should behave because that's you know several layers deep and several hours in of explaining the math of how it all connects up but these are going to be the things inside the proof so I mean

we've been talking about proof in a very abstract way we say there is this kind of object that is a proof what it actually contains um are these commitment values and these um these random queried values and they're not actually like numbers like three or 10 they'll be elements of a of an elliptic curve okay and then like I said that will be our proof by okay so here's the uh new picture I just showed you in tandem with the previous one so the top half is the

previous one from last session and the lower one is the the new one with this additional info I just showed you so if you recall we started off we have a value idea entrepreneur will say let's build a circuit that verify that sorry creates a transaction or verifies a transaction ction or verifies a block in ethereum or that proves I can vote and allows somebody to vote anything like that we imagine what it sort of looks like idolized circuit then we actually code it and turn it into a legit circuit with some values pre-filled out and then anybody can use it let's say it's a voting one it goes out to all of us and we'll fill it in with our own values our own secret keys to prove that we are um the owners

of we are the you know legitimate ID people and that we're allowed to vote and that we insert our vote as well we'll take that filled out circuit turn it into these pols we'll commit to these polinomial and then we'll be given random numbers to evaluate our polinomial at and we'll do those evaluations we'll combine our combine these values into the proof and then we'll send the proof and then the tallying Authority the you know whoever that's going to be will receive all these proofs check that they're all valid and use them to build up the vote yeah so that's the same process for any proof system um they basically all work with polinomial they're all going

to represent what's happening in in polinomial some of them sort of don't necessarily look like polinomial but uh they are still basically doing the same thing and they'll make them they then commit to them they then want to kind of check it randomly um and then that's that's the proof and and sent off okay so that's going to help us discuss like I said what some of the differences between different proof systems are because it all comes down to how they work with polinomial and then we have something called a constraint count um which is relevant to people working in this field because when we make our circuits the the vote you know vote V voting circuit

how big is the circuit you know how many gates are there the this circuit it's got three gates got constraint count of three you know fair Fairly straightforward meaning but the the the the more gates you have the larger the constraint count the longer it takes to make a proof and in some proof systems also it means the the larger a proof is the more um points you got to evaluate and stuff like that so you know all things being equal you want to minimize the constraint count okay so that was our touching on pols we're now going to look at the different

proof systems I don't know if there's any questions about polinomial so far to the um next part this is anen from the online we're just laying out a few different proof systems and

very doing a very high level um um comparison uh the arithmetization if you remember from last session is how we turn our ideal circuit into an actual circuit and for the plon and Halo 2 the second and third rows it's called plish and that's what we've been drawing here these addition and multiplication gates are fish arithmetization but uh Groth 16 uses something called a rank one constraint system and I'll just briefly sketch that um instead of yeah it will it will have things of the form um A1 Plus a B2 plus up to some value

a multiplied by uh B1 plus B2 plus up to another value uh B let's do m is going to equal another combination C1 plus C2 up to Value C so it's not just addition and multiplication um sometimes we say that addition is free because if this is one constraint you can keep adding things into the B part you know B one so you can sort of keep adding in new numbers

into this single constraint but you don't have to add more gates for it you're just changing some of the stuff that's in there um and then you you know you got to turn these into M matrices which are like this squares of of numbers and uh visually this is a lot harder to work with we can't draw pretty little um addition and multiplication Gates and connect them with wires uh and then Starks usually use something called algebraic intermediate representation and those look different again um yeah but you can look at the table on the online we're just going to go through each each system itself Groth 16 is unsurprisingly from 2016 and it was one of the first very

good proof systems there's been a lot of progress made since um it came about but it's still used in in a variety of places and the the primary reason for that is um it makes the smallest proofs the proofs from glass 16 have only three um objects inside them three curve points um which is the the we know the theoretical minimum is more than one and it's an open question whether you can do it in two elements and and not three but nothing is is better than grow 16 as far as we're aware unless it's changed um very recently without my hearing of it um and also because it's older

there's like a lot of stuff built around it there's a lot of helpful stuff to learn how to use it and a lot of libraries to use with it and stuff like that so there's a lot of tooling and the barrier to entry is is a lot low lower so even though the prove of time and stuff like that is is not not comparable to many of the newer systems if you want to mega mega optimize the size of your proof then this is still a great thing to go for um one of the main drawbacks about it though is it requires something called a trusted setup for every circuit we haven't gone over what trusted setup is I've mentioned it a couple of times um but it is a big security thing so if we basically you want to do it in an

open decentralized way and if only five or 10 people take part um you just need one of these people to be honest in order for it to be safe now if you have five or 10 people take part you can question whether they're not they haven't these people haven't actually colluded once you get you know if a thousand people take part then then you're going to be safe and secure but that's very unlikely for it's just a single small circuit so if you're going to be making lots of different circuits you really don't want to be using R1 CS this is more for a single circuit used tons you know maybe a transaction circuit or something else yeah there's a bunch of circuits at

the PSC that have been made with this that are still in use like I said it's still in use in a variety of places uh then we come to plonk which is like I said is the is the main one we kind of using for our structure of understanding and if we get to um yeah when we get to it a lot of the maths is related to how plunk work Works um when I say it has a universal setup this this means it also has the trusted setup the same as grth 16 but instead of having to do it for every single circuit you uh do it once and you can use it with any circuit and so then it's

a lot easier to get a thousand people to take part and this has been done a bunch of times there's a variety of them and there's a way to update them as well um so that's a lot more of the tile and you know that helps the security a lot and the the yeah so plon has basically been developed and refined a variety of times at the end I'm going to just briefly mention some other proof systems rather than having their own slide it just plunk was a great Innovation I think 2019 is when it sort of came out maybe 2020 I'm pretty sure 2019 and they just kept adding to it and making it

better and better but when we say plonk we kind of refer to the original uh paper vanilla plonk is sometimes called we have one called Halo 2 which is from the zcash or a electric Coin Company um it's something called a recursive proof system um so you don't just make a a single proof you actually like it's kind of a chain of proofs a proof is made and then when you want to make another proof you let's say you know you want to prove the next vote instead of just proving the next vote you'll actually take in the previous proof and and sort of confirm that that was true and that your computation is

also valid and then the proof you get out um doesn't just so show that your vote was valid but also that the previous one is valid and you can build up this chain I could try and sketch this so in the voting example if we do graph 16 or plon we're going to have proof one proof two proof three four oops and we have to verify each of these single proofs but in the case of a recursive proof system like Halo

2 we're going to do proof one and then this is going to go into proof two and then that resulting proof will go into proof three and then of course last into proof four and then the verifier only has to check proof four because that will confirm all of these and not just the last one so you can see a lot of value there in any kind of computation that requires a long running thing this is going to be ideal um you know a blockchain itself the state ultimately that's what we want

to do we want to make a recursive proof of the entire history from the Genesis block whether it was from 2014 or 20120 ideally that should be one proof rather than a a proof for every single proof system sorry for every single block um I mean you can imagine that you want to make a proof for from the Genesis all the way to now but if you want to do that as a single computation that's going to be the billions if not trillions and more um values you have to put in your polinomial um and that's just going to be impossible really to to make a proof for it's going to be way way too slow

into take too long cuz the the proof time isn't is rarely linear which it's actually super linear so the larger it gets it doesn't like if it if if the data if the computation is twice as big the proof generation time doesn't grow by a factor of two it grows by more than a factor of two so you can't just do a huge computation you instead ideally want to do it in lots of little chunks but keep combining these chunks together through a a recursive proof system type thing uh Halo 2 itself it it's also got a very high barrier to entry it's very kind of tough to learn how to code with it I tried to write an intro book thing

and you know it was very tough to understand um it does use the plish arithmetization with the additional multiplication Gates um but yeah it's tough to use I think it's used at PSC a lot although I think things have moved on a bit since Halo 2 because the new system in the past couple years have been very very good then we move on to something called Z Starks um Z Starks are also a type of snark but but generally speaking people might say Stark when they refer to a hash based proof system um and snark when we refer to an elliptic curve based system they don't require trusted setup ceremony which is one of the positive

security things about it that people like cuz then you don't have to worry that uh you know they were colluding people and stuff like that I think if you have a thousand people take part in in a in a trusted ceremony it's fine you know if it was done in an online decentralized way if you know if a thousand people at Apple took part in their one I'm not going to trust it I'll be like yo that's just sketchy but if it's done openly online and anybody can take part I'm going to assume there's going to be at least one honest person um but they are also plausibly postquantum secure we we add the word plausibly because we we haven't proven that they're postquantum secure but uh

we haven't found a way to um break them with quantum computers and this is um we're not we're not really expecting to maybe it's a little bit unfair to add the word plausibly because there's a variety of places in in cryptography where we um assume things um I might give you a quick overview cuz I think it's a very useful thing to know um but like in elliptic curves we have a few hardness assumptions there's something called the discret uh logarithm

assumption which we usually do dlog so I capitalize them for short and this basically says if you turn a number into otic curve value um and give it to somebody else they can't work out the original value the only way they can do that is by Brute Force there's no quick way to do it and we don't have a proof that that that's the case we don't have a proof that you have to force it but no one's ever found a way to break it so we believe it's hard and you know this has been known about for hundreds of years so no one once weig it out in that time we think it's going to remain that way um but we do know 100% certain you

can break discret log with quantum computers yeah we have an algorithm for that so it's provably not Quantum secure but it's not proven to be normally secure but the amounting evidence of nobody figuring out suggest it is there's a few other tic curve type um hardness assumptions uh there's one for the type of cryptography that came before um which is called like RSA and that's where you have two primes and multiply them together and it's secure because people don't know the primes involved it's called a hidden Order Group that's the same thing we're assuming that the only way to to work out which two primes are multiplied together is to just Brute Force essentially check all of them and that's been known about for literally

thousands of years and we haven't found a fast way to do it so and we but we haven't proven that it's not possible yet either but because is Thousands thousands of years of evidence of humans failing we're fairly confident that um it's not possible but we've just not figured out how to prove that it's not possible yet um and then in uh well this STS we work in something called the random Oracle model oops Oracle model uh which basically says that um hash functions that generate a properly number um and we we don't we can't

really prove that hash functions are definitely random but we also haven't broken it yet either and we also don't believe that quantum computers can break them um but so there's these hardness assumptions in different places and different proof systems rely on different hardness assumptions but that's where the post Quantum security discussion comes in generally Starks have been a not slower than uh than snarks or ellic curve based proof systems um so there is this tough tradeoff but at the same time there have been some more recent developments that are speeding up Starks in a way that snarks can't be sped up sped up so they're starting to combine elements of

snarks and Starks together to get the kind of optimal outcome they use this different arithmetization that we discussed in there um and but their proofs unlike the several that came before the proofs are not constant in size you know I say grth 16 has three elements in its proof um but for Starks it the the larger the computation the larger the proof is so well the larger the the input size which is the you number of things you're filling out um right so that's few tradeoffs between some of these systems but like I said it's just the space is constantly changing it's a very rapidly evolving

area there's new one called Bas which is trying to use like um Fields characteristic is two which is trying to minimize redundant computation like under normal circumstances um and this is actually what most of them are trying to do but under the previous proof systems because we don't treat four as the number four we treat it as like an element in a massive field a 256-bit field um if you do like those of integer sorry index computation you know you do 3 plus 7even and and 5 minus 2 you're not actually working with a you know two or three bit number you're working with a 256bit number and basically that all of

that is sort of redundant like it is there for security reasons but there are other ways to find the secur well it's possible to have other ways to improve the security so if you don't have to work with 156 bit numbers but can minimize it you can minimize redundant computation um and get lots of speed ups that way and that's essentially what all of the sort of did as binias um working with like the binary hyper Cube there Circle Starks there plony 2 which there was actually plony one it's not like plun 2 um there was plony one originally from like M protocol but I think they got bought out by um polygon then they made plony too and that was one of the you know first big Innovations and that

was the redu in size instead of using a 256bit curve I think they came down to like a 64bit and then plony 3 brought down to a 32 bit um but they they they made up for the security loss by doing other things inside the protocol and you know there's tons and tons of other systems as well and each one of these if you want to read the paper it takes at least at least a week got kind of understand things in a bit um with a bit more depth so it's very hard to be an exp and all of these like ideally you would have started 5 years ago and been doing it basically full-time since so don't worry if you don't know that many systems and in in detail like very very few people

do and don't feel like that's a requirement to be a successful person in the space you can be an expert in one of the you know popular currently used proof systems and that's uh plenty sufficient but of course the more you do know the better and having a basic understanding of the differences between some of these proof systems will go a long way but you don't have to know it you know stepbystep detail and that's kind of essentially it um I just have this little slide about what I do as a engineer I I mentioned a bunch of this in the last session so there's not too much to say there now like I'm focusing a specific area about how we um we're trying to build at the

terminal 3 where I work we're trying to build a a zero knowledge database so um if we it's for kind of Enterprises so rather than any company have to look after all their user data which means that every single company has to have their own kind of data team um with security Engineers making sure that their data is secure and stuff like that um we they can essentially to us and we'll make sure they're all safe because we can ensure that better rather than spreading the work amongst all of them we can do it much more effectively and we can also do it in a zero knowledge way to uh preserve the privacy of their users and they can ask us a query and we will say in this database

there are only you know 10 people who are female and living in Hong Kong with uh a masters earning over $100,000 um but if they want to believe us we have to make some form of proof so we're finding ways to do that um but if we wanted under like naive to do it naively with the current proof systems we've got to conduct a computation on a database that might have hundreds of thousands of entries which is like huge uh which would lead to constraint counts that are just way way too big so we've got to find ways to compress all of that and in a similar way to how we saw that polinomial is can

be compressed and you can represent all the values in a single number we can use tricks like that so I've been looking at inside that about how we represent all that data and then how we conduct like an intersection on the sets or like you know if the query is male and master how do we get these two like subsets and combine them together and prove that the resulting set is actually you know the proper query and look at protocols for that and a union as well and then counting number of people inside these polinomial so for this mine's more R&D so I've been looking at different protocols looking at the protocols that

existed before um seeing if they work for us if they don't and see if we can improve them or find our own um our own methods and then coding it and then there's discussing discussion with the team we got to make a bunch of tests for the code going to try and write a paper um so yeah I mean it varies month to month you know some months might be 60 70% coding and and a few meetings and a few discussions some of it might be more 60 70% research um it's going to vary a lot when you're at a more early early stage uh startup uh yeah but that's probably the the the rough overview um yeah so and

also like I said I'm not working with that proof system per se right now like we're trying to build our own uh SQL proof system like a ZK SQL proof system which is um the general proof systems work with arbitrary computation which makes them very versatile but less ideal for specialized areas and in our case like I mentioned a versatile proof system has proofs that are too big so we're building a more specialized proof system um that's the end of this session this is also a little bit short I'm going to mention um just a little homework thing afterwards for if you're curious but the next two

sessions we are just going to be maths only maths um so prepare a little bit hopefully you won't be uh too afraid we're just going to briefly cover some of the main stuff that's involved but we can't go into much detail but ideally by doing this you'll understand a lot better the kinds of things you have to do and understand if you want to understand the proof systems in more detail and that when you go to more advanced courses or look at more advanced material you'll be better prepared I'll just quickly do homework ask if you have questions um I don't know how much you remember from Tuesday but if you look at

data and studies on this um yeah going the wrong way around but if you look at data and studies this top left curve is called the forgetting curve it turns out that like within 2 days you usually forget like 60% of the stuff you learn you know by six seven days later you're down to like 10% and it's kind of like what's the point of learning if a week later you're left with basically nothing right so that's really annoying and so if you want to join an area just go to single sessions isn't enough you want to keep repeating this stuff the top right curve is um if you start to see the stuff again and again

I can't use a cursor to point at what I'm show I'm showing but in the top right graph the original learning line You'll see matches the the curve to the left but then once you see the material again your first review you'll see that the the curve is much better and that the bottom of the curve is a lot higher so you'll retain more information and then another review again will be even higher and so so I mean this you know kind of is a little bit obvious the more times you review material the better going to going to learn it but at the same time how many people go to lectures and things like that um and then review the material like often we'll make notes and the note taking process is more

effective for us to learn but if we don't actually go and review the notes we're still in the same scenario like it might not be 10% that you remember a week later maybe it's 15% because you encoded it a bit better but you're still missing the most important thing which is a review of of this stuff um yeah and uh so I'm going to mention like something I I've changed in How I Learned stuff in the past year and it's been like phenomenal and I wish I did this a long time ago and it's based on like really really solid heavy science stuff and it's like very obvious to um that it works super well but we haven't done stuff this way um at the top right we we're showing that if you see the

material again if you review it you going learn it better um so there there's a thing called a space repetition system on the left I put SRS emphasis this is a space spaced repetition system and what it is it they're just actually flash cards basically and there's an algorithm so you'll see the flash card you'll see the front you'll try and remember the back and then you kind of score when you look at the back you'll score it from one to four on how well you remembered it and then there's an algorithm that determines when to show you it again and these algorithms are scientifically optimized to be as efficient as possible at getting bits small bits of data into your long-term memory so at first it

will show it to you 3 days later and then five and then a week and then two weeks and then a month and then 6 months you know something like that depending on how well you remembered the back when you saw the front so that that um time delay extends out pretty quickly and then within a few reviews it'll be a year or two years before you have to see it again and these bottom graphs this is data from this kind of thing uh so the left mo leftmost one obviously the the color coding the red is when you receive material and just study it the yellow is when you receive material and you personally study it a few more times the blue one is a concept mapping so you receive the material and then you

concept map and this where you kind of mind map you'll draw like a that EAS I just say like you know polinomial and then you do like a field you know you kind of mind mapping this all all together and then you have retrievable practice which is the flash cards I mentioned because when you see the front of a of a flash card the thing your brain actually has to do is you have to retrieve the information that you know is going to be back like based on the front what do you have what memory do you have to retrieve um so it's referred to as retrieval practice and it's done via this kind of space repetition system and in this study with verbatim questions and verbatim means like word

for word if it's like a what is this equation you know you want a very like a very specific answer it's not open to interpretation um it's just like a what was this definition or or something like that and you'll see that the proportion they got correct the best group by far was the space repetition system this reproval practice okay and then we move to the inference questions and this is where um the inference question is where the the answer wasn't like given directly but it has to be inferred from the information that was there so maybe it ask for like the volume of a bottle and you were given the equation for uh a shape bottle shape and then you

have to kind of work it out anything like that where you have to use the information you got to figure out what the correct answer to the other thing should be and even here you can see there's a kind of like very still a very clear gap for the retrieval practice it's not as big as it was before but it's still better and then what I find very interesting is this last graph called metacognitive predictions which is a very strange term but all it actually means is they asked people which method they thought would do the best and people thought repeated study was going to do the best because it's what we all do at school and they also thought retrieval practice was going to do the

worst and the most insane thing to me about that is that the retrieval practice is is the study plus the retrieval practice and yet they thought it would do worse than just study on its own so not only is this like the best way to learn there's all there seem to be some kind of misconception I don't know if this has been um this information for this last graph in particular has been recreated elsewhere but the best method is thought to be the worst method okay so that's my spiel about memory and trying to remember this stuff and if you want to join the field particularly if you're like kind of doing this part-time if you watch a lecture this week and you know two and then next week a little bit you it's very hard to hit the kind of a

critical mass of of um time spent with the material to to not need um uh something like this um a method go over the material again that's that's why I'm recommending this and I use this for all my stuff I learn all my cryptography and anything else I read cuz if I read an article or like five or 10 articles about how blockchain works and not cryptography which what I actually focus on two three months later I've totally forgotten these articles don't remember anything from them and that's happened again and again and again where I've learned some stuff from other fields but I haven't reviewed it because who actually reviews it and I've forgotten that stuff but now instead I I I get this information

instead of like note taking I will make my flash cards and then I'll keep going over them so whenever I do read something and I make a flash card about it I will still know it generally speaking six months later a year later so what this system is it's called anky um it's free you download it for free and here's an example of a flash card that I've made I said like what is the gas cost of verifying a plunk proof versus a stock proof on ethereum and on the back the thing I have to try and remember is it's under 300,000 gas for plunk and around 5 million for starware um some of that might have changed a little bit because it's a you know a new PR system that sofware might

use um yeah I can even show you quickly here here's my anky um I can just go to all my cards I've gotten new and here here's all it is what are Circle stocks i' like made this today I didn't actually remember it very well like I said I wrote it this this morning the size of the of the proofs sorry the size of the uh proof that the arithmetic Fields were're working in to get speed UPS uh new start construction that somehow makes use of points on the unit circle oh yeah yeah sorry that's what the circle part is for but somehow making use of things on on the unit circle so I haven't really read into Circle Stars much at all yet but because

of this card I will now sort of remember the rough overview of like the point of them and then on the bottom you can see the difficulty thing uh see it in 1 minute or 10 minutes or one day or five days I'm going to do 10 minutes what is a data race this is for you know to get better at programming and this is where you have undefined Behavior because um things aren't going to access data in in a a predetermined order it's going to be some kind of Randomness there so undefined Behavior you know I remember that more verbatim because I have this card and I will just go over I will use this several days a week and go over all the knowledge I have so it's very easy

to use it there's so much data about how it's going to help you so I would super recommend it and of course the homework would be go and make some slides on on things you want to remember one useful um um puristic is you can try and set like a quoter or something so if you go to a lecture right make three or five or 10 cards if you read an article try and make two or three cards and you force yourself to make a certain number of cards when you do stuff so you've set yourself a habit U maybe also like encapsulation ones like um um say what a circle Stark is in in one sentence is a nice one because you instead of like end up writing loads which isn't actually what you should be

doing you're you're trying to get your brain to encapsulate all the information into a single sentence um so there's a lot of stuff there about what cards you actually and how you represent it that will determine what you actually remember which is something you'll learn as you go but anyway end of my Spiel the point is there um if you if you are interested download Ani free open source software and start to make CS to help you learn this stuff much more effectively and the gains from this will just kind of accumulate o o over time uh yeah cool so any any questions about anything said today or or last session Maybe you can also message me personally and I can I can open the

question on this um you know if you don't want to speak on stage on my last in the witness account no questions yet said I don't know if you message me I don't know where it will message me don't if that's

question no all right okay are those questions message request um do have one question that's from 30 minutes ago okay no questions yet okay is that a question

yeah sorry about this uh side chat issue I I I imagine because I asked them about the um ability to raise your hand and I guess they disabled it by accident or something which is very unfortunate um but we'll fix that 100% for next session because that really really sucks I'm I like when I'm in these sessions I I don't want to come on stage I just want to ask in a side chat so someone is I believe typing a question but do recall that the next sessions will be the same time on the

same days next week so Tuesday and Thursday at the same time we started but those are just going to be maths um yeah that's all we're going to focus on um so I'm having a question hello to cursive proofs can be chained on the proof of the same circuits uh yeah yeah um that's something I don't fully recall right now actually but that's a good point when I when I was this showing Halo this recursive proof system where you're chucking in um you know one proof into the next proof does the circuit have to be the same

circuit as the one you're Pro proving like if it's a voting circuit can you then Chuck in a transaction circuit and prove that as well for Halo can't I can't fully remember there are there are there's other systems called like they're referred to as folding systems and something like Halo and and um hyp sorry not Halo um Nova and Hyper noova in those ones the circuit has to be the same if it's a voting circuit the other one has to be the exact same circuit you can't have any changes but in in Halo 2 I can't fully remember I believe the answer is yes but I can't say that definitively so there's still some restriction in in the ability

to recursively prove stuff but uh yeah there's a proof not proof system um blockchain called Mina and they use a recursive proof system I think it was kimchi or something that they made themselves to recursively prove their entire blockchain and it was designed like that from the beginning so they claim to be the kind of smallest blockchain because it's like less than a megabyte or something and that's because they just they keep updating their proof of um of their blockchain so you can look at you can see the state of their blockchain and confirm it in you know a fraction of a second because it's just a single block with a single proof um because the proof demonstrates that everything that came before is also

valid but yeah pretty sure hello to uh you have to do it on the same circuit if you're recursing it uh cool no other questions so I'm going to assume there aren't anymore unless someone has their hand up which I don't think they do you well uh thank you everybody nice to see you all again hopefully we get recording for this session as well oh yeah about the previous recording I believe hang Young's still working on it um as soon

as I get the link we can share it unless it's already been shared yeah so I will chat with h about the last uh uh recording and we try and get this recording out as well uh thank you have a good week um please do check out anky I sincerely recommend it to help your general learning and we'll go over the maths on Tuesday ask me any questions whenever you please by uh take care have a good I'm assuming evening I believe most people

are in Asia okay byebye