Bonus Interview: What’s Next in ZK Research with Justin Drake (Ethereum Foundation)

Transcript

foreign [Music] I'm back with uh Justin and uh ZK Maven expert interviewer Anna Rose and we just wanted to talk to you Justin about kind of the other things that you're working on in ZK with the EF and sort of any exciting projects that uh that you might have all right so in ZK specifically where ZK means zero knowledge we are working on something called secret leader election and you may have heard of ssle where not only is it secret but

also you have a single leader at every uh at every round and basically the the problem that we're trying to solve here is that right now on the beacon chain you know and everyone knows what the next proposes will be you know their cryptographic identity that the pup key and if You observe the peer-to-peer Network most likely especially for home validators you'll be able to assign an IP address to that data data and so what you can do as an attacker is mount a denial of service attack and this is bad because if we have let's say 50 of the validators running from home uh then

basically an attacker can take down roughly 50 of the blocks and that could be used and incentivized through through Mev basically there could be a tax that are actually rational to do and then not only is that attacks for external people to come in but there's actually incentives for validators to start ddosing the other fellow validators and the reason is let's say we have two blocks in a row so two slots in a row um I know I'm the second proposer I have an incentive to go DDOS The Proposal just before me and the reason is that all the transactions that come in and

all the juicy transaction fees will go to me if I can DDOS and prevent the formation of a block just before me wow and so so this isn't really even theoretical like I I think in Solana this is sort of Happening by accident where people are so desperate to get their transactions in that they're like going to the Future proposers and just did asking them oh wow like the threat is real right um I think I think I I could be wrong no you're right I guess it's it's DDOS for a separate reason so in Solana they have this optimization where as a as a user from I understand you send your transaction directly to the next block proposer and so that's kind of a a DDOS Vector in in ethereum we actually have a

a mesh Network in for for gossip so you kind of you send your transactions to all your peers these peers send the transaction tools the other peers and so it kind of more evenly spread out to build the mempool so it's a different architecture yeah um yeah at What stages of the research it's a fairly Advanced actually okay um so the research I would say is is done uh if not it will be very very close to being done and now where uh we have proof of Concepts uh which we're trying to bring to production basically um now maybe I should explain where the zero knowledge comes in yes um so what we have the the the the Primitive that we have is what we call a re-randomizable commitment so

basically every validator has a commitment to their Pub Key which they they put on chain and the beacon chain will basically keep track of these commitments in analyst and what we want to do is we want to re-randomize them in such a way that when the re-randomization happens the validator can track their own commitment but everyone else is observing can't it looks like a random shuffle to them and basically what we do is that we allow every proposer to perform such a randomization but we need

them to prove in zero knowledge that they've done a permutation meaning that they haven't kind of taken away commitments or inserted their own commitments um and yeah this is basically where the where the zero knowledge comes in and so we have a a custom proof system which is kind of a variant of Bayer graph which Mary Manor has has designed and it's basically the only ZK kind of primitive that we have on on ethereum layer one uh except if you consider signatures to be ZK in the sense that they don't leak the private

would you would you call this like CK in consensus is it like or what what part of the stack would you call this yeah so it's using zero knowledge proofs as a tool for one of the building blocks one of the modules so the way that I think about the layer one is that you have multiple modules you have the randomness module you have the secret leader election model you might have the registry module uh you might have the finality Gadget and all of these other modules tools and from the point of view of an application developer or from the point of view of a user you're going to get to see all these modules they come abstracted away and packaged to you through the properties of the evm

very cool at what point does that actually get implemented like what would it come with the merge or is it are we thinking it's like way going to come way later great question so for the merge we have a strategy of a minimal merge meaning that we do the merge and nothing else okay um if the attack that I described it in a lot of service attack happens um then that could be an incentive for us to accelerate deployment of secret leader election um so we kind of have this in our back pocket if we do see the attacks if not then I guess you know there might be higher priority things for example deploying uh what's now called Bank

shouting or the first step being proto-dankshafting um but I I am a little bit worried because this denial of a service attack Vector is probably the lowest hanging fruit for an attacker with just a few thousand dollars and some uh investment from a development time perspective they can relatively easily um harm the the ethereum chain can you say the name of the ZK thing again just for our listeners yeah sure so it's you have various um proof systems where we have plonk we have graph 16 and here it's kind of one of the earlier ones called Bayer Groff

this is before graph 16 yes I think it's before graph 16. okay and the reason why we can use kind of one of the the older proof systems is because the the statement that we're proving is very structured is this proving that you've done a permutation properly and so instead of having a general purpose snock proving scheme where for arbitrary circuits or arbitrary NP statements we're only proving this very structured statement would you need a trusted setup for this somehow great question um the the answer is no okay um so you can basically use a bulletproof style commitment the same commitments as uh with Nova cool nice um very cool so I guess if people want

to find out about this where can they read up on this type of stuff great um so we have um a full spec of secret leader election which we call Whisk because you're Wicks whisking the set of validators you don't want to use the term mix I guess yeah we have so many I feel like that's loaded somehow so whisk is good I haven't heard that this whisk is great um so we have uh George Who basically uh came up with whisk and he wrote an eve research post which has all the links to um you know the uh paper by bear Groff but also the modification by Merry Manor um as well as proof of concept

implementations of whisk uh in in in Rust cool yeah yeah that's awesome so yeah thanks so much for sharing with us this kind of like update or something something else to look for in the work you're doing with CK yeah absolutely it's an important incremental security upgrade for ethereum uh and if you look into the road map actually a lot of it is just incremental security upgrades vdfs is one of them data availability sampling is one of them um and yeah there's there's a there's there's a few more out there as well nice okay cool yeah thanks thanks Justin thanks uh CK Maven Anna Rose that's a

new name every time thanks everyone for watching cheers [Music]