Scaling with Zero Knowledge Proofs

Transcript

so next up we're gonna hear about a meme which has propagated in the cryptocurrency space very often which is scaling I mean particularly in this talk we're gonna hear about doing it with sing zero knowledge proof so from the matter Inc let's please give a warm welcome to Alex Bukovsky Thank You Ben [Applause] hi my name is Alex I started working on roll up with etherion foundation and then I'm part of Manor labs and I'm gonna talk about scaling solution called ZK roll up so see here all up III I was trying to explain it in the various short manner in one sentence it's a layer to scaling solution it's a

sidechain essentially resembling plasma MVP very much with two key differences the first difference is that we save we solve the data availability problem by putting the data directly on layer one chain we don't use storage we just put the data there we rely on the theorem to broadcast the data to everybody and the second second difference is that we replace fraud challenges of plasma with zero knowledge probes so we for each state transition we provides your knowledge proofs which guarantee that everything we changed in the data is correct will deep dive into the architecture bit further but let's see

what it gives us why it's why it's cool so first of all we don't have any liveness assumption in our case because the state transitions are secured by zero knowledge proof users do not have to monitor the chain and submit proofs that something is incorrect this is very good from user experience perspective and we also achieve the same security guarantees as layer one essentially so I can just send my money into the side chain and go offline and I can be sure that no matter what operator alive or not I will always get the funds back if the layer 1 is secure now roll-up is capital e capital efficient compared to state channels or

to some flavors of plasma which require you to have additional capital at bonds or in case of plasma you need some additional funds to exchange non-functional coins with roll-up you can just have a count based model where you only store funds in sidechain which you need a cool thing about stirring data in like the cool thing about having data availability solved on the layer 1 chain is that we can have multiple operators in the roll-up which guarantees censorship resistance we don't have just one operator like in some plasma constructs but we can have for rotating operator in and as we also have no need for mass exits and

interestingly the operators themselves are not exposed to operational security risks they never have to store the private keys on machines which we should connected to internet all they do is provide proofs of things which everybody already know so what are the limitations at the moment we because we put data on chain we can only have up to 500 transfers here C 20 token transfers for example per second which is much less than plasma is capable of but if we compare it to the theorem it's just five years C 20 transfers per second and PayPal does 160 on average so until we reach 500 it's gonna be a good problem

to solve and it's actually solvable it will just introduce some more friction so we're not doing this now because reason anita's and second limitation is that roll-up is based on zero knowledge proof we have some limitations in the way they are constructed so we can only do fixed functionality for now so in the first version we're gonna focus on your seat when a token transfers atomic swaps and state channels however there is in EAP for aetherium which is scheduled for the next card for hopefully it will be included which will allow us to do our betray smart contracts in roll-up because we will support different elliptic curves which allow recursion and then we can verify proofs inside

roll-up of other proofs which will allow us to basically arbitrary computations so let's deep dive into how it works how many of you are familiar with your knowledge probes so not so many okay I'm gonna explain zero knowledge proves are a cryptographic protocol which allows you to convince a verifier that you have completed some computation which is publicly known like we you have some function we call it the circuit this pop function is publicly known to both parties you have some private input we should not disclosing and you have some public input which is both parties also now and then you can provide a short proof which convinces that you may

perform the computation correctly without this causing the X so how we can use it for scaling two flavors of zero knowledge proof snarks and Starks are six int the s in both state four six int non Trekkie fragrance of knowledge or transparent arguments of knowledge which means that the amount of work you need to do to verify the proof and the size of the proof itself is much less than the amount of work you're trying to prove so what it means I can take 1,000 transactions or more and concatenate them into one very short proof in case of snarks is gonna be just 300 bytes starks are significantly more expensive that's why it's difficult to start for

blockchain at the moment but starks are super short and it will cost you only 600,000 guests on a theorem to verify and it's constant no matter how many computations you do the verification will always cost you the same thing and the proof is gonna be the same size unfortunately this comes with the trade-off because snarks require a trusted set up and this was the main reason why they were not widely used in the past except for Z cache which had a trusted set up ceremony well trust assay that means that somebody has to prepare some common reference string which we can use for generating proofs and verifying the proofs now whoever creates this set up if they keep some parameters

they don't delete the initial entropy they put in the cell they can fake the proofs so of course it's not ideal for blockchains if just one person would provide it this way we rely on multi-party computation ceremony where we can have n participants contributing their entropy to the setup generation and if it is one of them is honest and deletes the toxic waste then the entire ceremonies is solid and nobody can fake the proofs so we have like you need 100% collusion in order to do something wrong so this would work if not a problem that we need to do this setup for every application its surface

circuit specific in previous version of snarks so every time you do an update or create something new you would have to perform this multi-party computation and this is expensive this is difficult from a relational standpoint but now we have a new construct called sonic snark which requires a universal trust setup so now with universality the problem is practically solved because we can have a lot of participants contributing the randomness and the probability of them being all malicious is very low especially if we have some highly credible well-known participants so we conducted the implementation of of sonic proof-of-concept the benchmarks are not

quite there yet so that we can use it on top level but it will certainly be usable as smart contracts inside the top level construction which also can be universal if if the top level circuit is some common functionality we all agree upon which is useful for example verifying Sonic's it will be fine so this is being solved in this year and we expect even some some more proof techniques proof systems to appear this year which are maybe even more efficient than Sonic's now let's deep dive into how it actually works we start with the sidechain state just in plot like just

like in plasma MVP we use a count base model which is represented by Merkel of accounts with their balances with public keys and we have a miracle root and with a sigh chain work for a simple we have mainstream blocks and we submit transactions to the session operators they collect them in blocks produce these blocks and then we commit the miracle root of the state change produced by the block on the main chain and then after that we submit a journalist proof generated by the circuit which verifies that every transaction in the block was correct that we took the sum amount from the

from the from account decreased it by this amount we added this amount to the to balance and the amount did not exceed the funds which a user had and we can also have some other logic logic on the arbitrary and we calculated for all n transactions for thousands of transactions and we submit this proof also on the main chain which is verified by a smart contract on the main chain and only after this it's verified this state is final and you can withdraw funds and the the gist is not proof generation takes it can take anywhere between 1 and in 30 minutes depending on the hardware you use on average we can do we can just assume 5 minutes is going to be sufficient with good enough

hardware so how I solve date availability for each transaction we submit some small amount of data in our case it's just 9 bytes which is compressed from index to index amount and the fee which we pain on the main chain is called data in one big transaction we concatenate them all together at submitting one transaction compute the hash of this data and then we pass this hash as a public parameter in snark so that our journal proof also guarantees that we used exactly the same data which we made publicly available so now because we only use call data so we just put data in in on aetherium without

using storage and we only put a very short delta of the state it's much cheaper than actually having normal aetherium transactions so 9 bytes of coal data costs you only like 700 gas whereas simple theorem transaction is 21 K gas and a talking transfer is about 80 thousand years right so this is how it is with data availability which unfortunately limits us to 500 TBS per second for now but that that's quite good so yes we have a working demo you can visit it at metal apps website unfortunately I cannot demonstrate it

now because it's not interactive but it's working as a PC and we well this is the roadmap for whoever wants to make a picture the current status is this so the there is a bellman library called bellman Community Edition adopted by us to support etherium pre-cum precompiled for aetherium allowed BN to 5/6 elliptic curve which is being widely used I'm very happy to see this we launched the PLC which can be tested and play around with we conducted the test run of the NPC in Paris with an adopted software

from Z cache which we changed so that it can be still around on a single laptop despite the circuit size being really large so that we can compress transactions and we also complete the implementation of the production grade prover so now we're focused on doing the circuits and contracts for the first version which will also add functionality of atomic swaps for text order settlements for example and state channels which will allow you to open closed and update the state channel in zzk roll-up and then we're going to undergo a security audit and then it can be launched in production so that's it

thank you very much we're gonna follow up with some news soon so follow us on Twitter yep thanks