Collaborative SNARKs and Private Shared State - Aisling Connolly

Transcript

[Music] thank you very much for the introduction I'm very glad to be here I always say well always since a week ago say that the hometown eth conference is the best eth conference so yeah I really like e workk and so it's very nice to have an excuse to get uh our friends together and uh to meet each other so um as she said my name is Ashling I work at a company called TSO we build MPC stuff we do a lot of um protocols for zero knowledge and today I would like to introduce you to a small piece of tech called Co snarks or collaborative snarks um which opens up this whole new kind of corner of ethereum blockchain web 3 called uh private shared state so before

we kind of dive into it uh how many of you have any of you already heard about collaborative snarks okay actually quite a few nice okay then for the rest of you do you know about multi-party competition okay actually not bad and then zero knowledge proofs I guess is probably the one that most people in the room should have heard of okay great so not bad okay then it's nice to gauge because then I can tell you uh a bit more uh detail so I want to kind of give you a bit of motivation for private shared States I want to then kind of introduce kosnar as something that can actually enable this private shared State uh I want to then talk about how we actually take this

sort of coark idea how we actually implemented how we show that this is is a reality in practice and then a bit kind of the future of privacy and so uh what is private shared State and why do we need it so one thing that I find interesting about this world and like as the blockchain sort of ecosystem and Industry develops um ethereum kind of started and like gave us this public shared State and as it develops now we start to see these kind of new state models arising and I find this kind kind of interesting because U yeah when you have new types of data models there's like all types of economies that can be built around this so it's pretty interesting but yeah at the beginning ethereum gave us this public shared

State you had this kind of state transition machine that would take some data change its state move it around like you could then build smart contracts you could do stuff with this data this is how kind of defi evolved all this kind of stuff and this was great and like uh having everything public meant that everybody could look at it everybody could verify it and this was like one of the coolest things about uh ZK uh about ethereum but then as people started to actually build stuff on top of this state and on top of this data and build more stuff and more stuff it became a bit uh not so efficient let's say and then um I guess you know if you know about ZK at all that ZK rollups came around to help scale ethereum this was great because now all

of a sudden we have like much faster ways to do defi much faster ways to do uh General stuff with State on blockchains um but then you know there's kind of this issue of privacy now we're actually putting our lives on blockchain and this is kind of not so ideal if everything is public and one of the cool things as I said about ethereum was that you have this public verifiability which is great if you're trying to like take down the banks or if there's like uh in entities or institutions that you don't trust but for individuals like in their day-to-day life is it needed that like all my colleagues verify all my transactions no so like it's super nice to have privacy for an individual then given that we're in this situation where there's zero

knowledge rollups that were used for scalability now we can start to actually use them for the zero knowledge property that they actually were developed for in the original place um and so yeah these zero knowledge rollups kind of uh Advanced gave us the tools to have privacy and now you see the emergence of things like Aztec and Alo miden midnight these sort of uh either l1s l2s whatever ZK based privacy chains blockchain stuff and so now you have these two State models you have this sort of uh public shared state of ethereum where everything like this all this data everybody can see it everybody can verify it and then you have this other side where you have this private data it's either in your phone or it's

encrypted um and there's some sort of Disconnect between the two of these and um I think so what we try to do is to bridge these a little bit um so yeah like the public shared State gave this composability which was great that we could build on top of it the private state is great because now we as individuals can have privacy and we can build all these cool ZK apps and whatever um but the limitation is that all this nice composability and all this nice stuff that we could build like with ethereum goes away if you start breaking these pieces of data into silos again and so the dream is to then sort of try to bridge these two things again like be able to use the private State be able to use the public State be able to build

stuff on top of both and use different pieces when you want and so this is what we call or what is kind of being uh emerging in the industry now is being called private shared state so it's not just public it's not just private private Shar State and so the reality of this so this is the dream that we want that we feel like opens up this whole new part of the industry that is completely untouched the reality is that okay if you want to actually start doing stuff on incre data or on private data if you want to do stuff on public data if you want to mix these things you need to be very careful obviously um and then you end up in this world of computing on encrypted data so what is the state of that at the moment um well there's ZK

which is great uh you can do a lot of stuff with ZK you can make proofs you can verify stuff you can attest to things but the problem with ZK is that you're just proving sort of relations about things you're not doing any functions on this stuff like so if you have any data where you want to do some matching or if you want to do I don't know compute any sort of function on this private data ZK is limited in in its functionality for this so it's not really possible to do like a lot of computation let's say with ZK it's just for approving relations my name is Ashling I live in Switzerland this kind of stuff it's not like how many people in the room's name starts with a how many people in the room live in Switzerland so this kind of stuff cannot

be done with ZK another sort of like Hot Topic over the last I guess 10 years depending on if you're in the research side more than the industry side but is homomorphic encryption and this is cool in the sense that you can encrypt your data send it off somewhere you can compute functions on it you can get the encrypted result this is great like um but is it actually practical this is like a super cool thing like uh there's lots of nice uh properties the trust assumptions are low it's great but it's super impractical for Real World stuff like there are demos where yeah maybe you can do a little game if you spend like hundreds of thousands of dollars on like very beefy machines um but yeah for Real World stuff it's not so

practical another uh technology is multi-party computation so a few of you in the room said you knew about this already and this basically instead of like me encrypting my data sending it to one person or a cloud or whatever um and encrypt and Computing over that you split it over different people so you kind of end up with this secret shared data over multiple people and then they do computation and it comes back together in the end uh this is practical for like highly specialized protocols so you saw DC from world he talked about NPC they do probably the most practical MPC we work together but they do like it's like the most practical large scale

deployment of MPC but again it's like highly specialized protocols um so yeah it's kind of it's it's definitely more practical than homomorphic encryption so this is where we go um tees are hot now I think you saw the last guy talking about this with AI um great you can do like secure computation but then you don't get this shared part again you're back in these data silos so with the te the data is normally on your phone or on a device you you lose this shared State and this was the whole nice point of ethereum and building um composable stuff so surely there's something that can be done like either between all these or something else and then yes we enter collaborative snarks and so collaborative snarks are basically uh if

you combine MPC and ZK so basically you want to do a zero knowledge proof but in MPC so zero knowledge was nice because we had all these verifiable uh verifiability properties that we like from ethereum we had the Privacy side but then we didn't have the computation if you now take the zero knowledge with all its nice properties and you put it into this MPC environment you get the computation on top and so this is how to collab operatively computer proof basically and so this emerged in 2021 from Dan Bonet and his PhD student Alex um they wanted to collaboratively compute proofs without revealing the witness so I think at the time there was like some um different uses where let's

say I am generating proofs on my phone uh it's maybe like limited in its power like a small device or whatever and I then start to want to it's becoming too much for my phone I want to Outsource this proof Generation Um how can I do this by still maintaining privacy and they uh they in they uh introduced these coars to do this and so the approach was to run zero knowledge provs in an NPC environment quite simple I think and they use techniques like standard techniques from the MPC world so secret sharing and MPC to maintain this security while you're doing computation to maintain privacy um while you're doing things and then they also leverage the MPC friendliness so this is

something uh maybe more for like the research side of the room um NPC friendliness of provs for practical imp uh implementation so this means that there's like some parts of ZK that are very linear and it's very easy to compute them like in in parallel so you can split them across different machines um you can compute in parallel and then you have like a little minimal overhead of communication so this is uh one of the nice things about it and so it makes it that like when I said for uh large scale real world use cases if you have highly specialized NPC protocols it's good it's efficient but if you want to compute zero knowledge proofs actually MPC is

like a super nice practical tool for doing this and so how do they work um yeah like if you know just a small picture so uh for zero knowledge proof normally you have a witness or some secret data that you're trying to make a statement about make a proof about um yeah you give this to approver he produces a proof P um and then you send this proof pi to a verifier he verifies and so with the coark idea you're saying okay I don't just have one witness anymore I either split it in three or I have data from different people that I'm trying to prove some statement over and so yeah I have uh yeah a multi-party setting where there are for example three provs who collaborate collaborate together on private witness data and

produce a proof which is sent to the verifier and I think one of the important things to note here is that the verifi the same across both scenarios so like approve is appr pro and can be verified by anybody so it doesn't need like a whole new Tex stack like all the like ZK verifiers and all the ZK stuff that we had from before can be used in this setting so it's nice you don't have to redo everything you don't need to learn new stuff you don't need to develop like a whole new stock so this is cool how about implementing them okay so we we say yeah it would be nice to have this private shared State world where we can compute on private data we still have verifiability okay now this's this coark idea that came from these academics is it actually practical can we do this in the real

world and the answer is essentially yes um so the as I mentioned before like zero knowledge is uh like the main sort of heavy computation is linear and so secret sharing introduces no overheads to this so you can split the witness data across different uh compute nodes node providers whatever and you can do MPC like you can generate a proof very very easily with like little overhead so the main proof systems like Groth 16 plon these are quite MPC friendly so it means that yeah you you introduce very little overheads if you want to do gr 16 proofs let's say in an MPC environment and plank is less friendly than qu 16

obviously as it's kind of more versatile it's more robust um it's still efficient but yeah you get it's not as efficient but you still get um a lot more functionality and so yeah like this works really well for elliptic curve-based proofers so I think there's some people in the room who worked on hash-based um proof systems and hit there MPC is not so friendly let's say um so how about writing circuits so um yeah like as I said with the verifier you want that you don't have to rewrite the whole ZK stock so we basically took the kind of most commonly used uh languages for developing zero knowledge proofs the main one is well the easiest

or the like easiest place to enter the ZK world is via circom and so we added functions to circom that allows it to be like uh allows you to generate snarks in a MPC environment and so with these extra functions on top of circum we got co- circum so there collaborative circum and in circum we uh adapted growth 16 and plrs to work in an NPC environment and so then this gives you like a feature complete co- Circle the other one um so an like emerging DSL I saw somebody I see a no shirt in the in the audience um so there's an emerging DSL called Noir which is quite hot right now we sort of uh took a bet on this as like the kind of cool new

language that is emerging to develop CK circuits applications everything um we really liked it um and we were implementing some crypto libraries in Noir so we ended up then now taking Noir as the sort of uh next library after circum because it's the more widely used we expect um and so yeah we like with circom we added some functionality some functions to Noir to get con Noir um so yeah we adapted the provs that they use to work in MPC as well there's a QR code if you want to get to the repo where all this stuff is there you can play around um so where are we in practice so

I'm saying yeah hey we want private share at State hey we have an idea of how we might achieve this hey actually we can implement it does it work is it the case is it like FH where we're like okay it kind of works and like maybe in 10 years it'll be practical um but yeah like it's it's it's here now so the goal is generally to generate proofs with as little overhead as possible um compared to a single Pro so you're going from the single prover to a multi-prover setting and the reality is pretty sweet actually so um I think this is not so visible on the screen but um this chart shows basically that uh like the multi-party provs have like

little to no overhead um against the single party provs and even like this uh Top Line you see is a little bit lower um it's even so like the multi-party setting is even a little bit faster simply because we use rust instead of um JavaScript for these things so it's there it's practical there's no overheads actually this is kind no overheads in terms of computation um so yeah it's uh it works it's practical it's great um have we actually deployed anything yes um so last year we did some demos there was a Max pick challenge which was a game basically you uh was a guessing game where let's say everybody

in the room guess is a number we all encrypt our number we secret share to a network then we do uh an MPC see computation over all these numbers and choose the biggest so you have your private guesses and you do some computation over this to get the biggest um this was the first sort of private shared State game um and we also did Proof Outsourcing at Devcon if you saw anything with the cursive guys um they have these NFC variables and they were Outsourcing because they have an application and again it's a phone-based app that people were using or in the browser and there uh again as more people were using it the proofs were getting bigger and bigger um and again they wanted to Outsource but their focus is very much on privacy so they wanted to Outsource while

maintaining privacy so um we worked with them to do this proof Outsourcing where they were sending their witness encrypted secret sharing to our Network and then we generate proofs on this um but the bottleneck is actually one of the things I don't know if like even from the like traditional world like the traditional Tech like web 2 world people like to use MPC because it allows you to sort of break out of this data that you're in and you can learn some stuff maybe aggregate statistics or whatever and people tried it then in the in the old world in the web 2 world and people are also interested in it now you see like there is actually a need for this um and still people are not using it so much and so one question is like why what is actually the bottleneck here

and um I think it's actually like what we found is that people are not interested in building and deploying their own networks and like this makes absolute sense you're like okay hey I want private computation uh I'm building my ZK app whatever why should I be the one to also like then deploy find node providers write this secure network all this kind of stuff and so yeah there's kind of no real MPC Network that people can just like Outsource private computation to so now we start to build this basically and um in Devcon there was we had the first sort of alphanet version where we uh did these first ction Co snarks for cursive I mentioned earlier um yeah private

proof delegation and so this generated about 40 proofs per minute whereas otherwise they were doing about I think uh one proof every 10 seconds on the phone so it turns out that it's practical they get more proofs um yeah and they can Outsource their private computation so now the goal is basically to extend this network keep it on all the time so if you're interested in talking about private computation you can find me or some of my colleagues here so looking ahead um let's see how much uh it's still a very new and emerging area it's all like there's really a lot to be discussed decided like what is even this stuff called is it ephemeral like like yeah there's really a lot to be decided and it's very cool I think it

serves a purpose so like whenever like this new tech emerges people often ask like what's the use what's the use case or is this like tech for Cool Tech sake or like is this actually needed and the nice thing about coars is that they arose because there is actually a need that they need to solve and so um this was really cool I like this I mean it's it's it's useful and so yeah the main uses are these private proof delegation where you want to Outsource your proof generation to somebody else while maintaining privacy and then the kind of more broad computation um for a private share State um networks are in the works we're working on it so it's kind of emerging if you want to play with them let us know um there's many open problems so PC like when you gain this

efficiency over FH for example it int you introduce some trust assumptions it's like you don't get this for free and so there's this collusion issue which is some trust problems maybe there are mitigations for this you can run into tees you can try to do some economic stuff slashing whatever but uh this is very much an open problem the efficiency is a huge problem still like it works like we're doing it for for cool stuff world is doing great stuff like the proof Outsourcing is is fine but like it needs a lot of uh effort and also variety like so um the functionality is still quite uh not limited but like yeah we don't have the full range of everything so yeah let me know if you want to experiment um what I

what would you think yeah so like for me this private shared State thing like what I really want to get across is that like this is a huge area of blockchain of web 3 that is like completely on top like 0% usage here and so it's a bit like if you're sitting in 1990 and someone says look e-commerce is coming and you're like what like uh how can it be I don't understand why you want this digital stuff I can just go to the store and you're like yeah but like it can be so much bigger than just going to the store um so yeah it's a huge thing that is coming um people ask what is the use of blockchain so again we talked about the usefulness of stuff with blockchain what's the use case of blockchain why do we even need it you

can just have a distributed database whatever for me this is it like the like privacy in web 3 is the one thing that web two literally cannot do because they're centralized so for me this is the point of blockchain basically um so yeah if we trust the institutions high security stuff is solved like if you trust Google if you trust the banks whatever problem solved but the thing is we don't and like also for again our personal data for our individual stuff our social spaces these are not secure like Facebook can see your stuff Apple uh Google can see your stuff YouTube can see your stuff and they can steer you in different directions so yeah privacy is needed and that's it for me thank you very much

[Music]