Stwo and Circle STARKs

Transcript

okay terrific Ross so uh I'm Elan s from Star I am very sorry that I cannot attend in person but we have three Representatives three senior representatives from starware um who are uh present at edcon and uh I urge you to take a time to talk to them so we have um Elia who's the product lead for Stark net if he's in the crowd he can raise his hand and wave we have Yoni who's the engineer lead for Stark net if he's around he can also raise it as a hand and wave and we have ODed um VP marketing if he's around he can also uh wave so please uh go and talk to them um

frankly they know stuff better than than I do um so um Eddie been s co-founder and CEO of starkware I want to tell you about uh the next generation of proving uh that we are very excited about and this excitement is now shared also by many others in the ecosystem you know people at the ethereum foundation and elsewhere so before that I want to tell you a little bit about what is starkware about what are we about because you know there's a lot of crypto goes through these cycles and there are these ups and downs and people ask themselves what is this all about so I can share you with you at least briefly what starkware is about and where do we come from so and

with your permission I'll read it because uh it's like really really important this is our DNA today we lack ownership of our Digital Life others custody our assets and interactions I mean you know nation states large corporations and they may confiscate our assets with no recourse for us starkware challenges this we envision a world where Integrity is publicly demonstrated and is upheld by all our mission which we're working with our team of roughly 200 people and growing our mission is to create a global Integrity web where Bitcoin ethereum and

other chains connect and scale so that individuals truly own their lives in a way that cannot be taken and confiscated from them and would achieve this by pushing the frontiers of Integrity with math with code with open or ZK Stark protocols used in real world applications on a global scale top blockchains that's what we're about but now I want to tell you about stew stew is the world's fastest prover you should care about this because it reduces the total cost of computation and you should be excited about this because it's going to hit

startet main net in roughly half a year or less um and it will hit Maya of starnet without developers needing to do any change in the way they access or interact with starnet so let's take a step back and see where we're coming from and first of all let's explain what a validity rollup is validity rollups sometimes are also called ZK rollups but we prefer the more accurate term validity rollups because it's about scaling blockchains using the math of validity proofs so uh as you can see on the top we have um the offchain state um which receives a bunch of

transaction and on the bottom we have the state on ethereum so ethereum is the ultimate layer of security and we have I don't know if you see my um cursor hovering over it but we have the rollup state which is uh the hash or the latest state of all the accounts and contracts on the layer two and how do we update it well go offchain to this layer two to the validity rollup and bunch of transactions enter the M Pool and then they are sequenced by a sequencer sequentially one after the other and constructed into blocks and these blocks are so it's very similar so far to the way the things work on Main at ethereum

or Bitcoin for that matter but here's where things are different um on on Main at ethereum basically you know one entity submits a block and then everyone else in the network has to run through all of the transactions and update the state locally you know one transaction after the other to uh know that everything was done with Integrity but with a validity rollup we rely on math so we send these blocks to approver the approver is a machine it doesn't have to be trusted it doesn't have to be signed any machine can be this prover because Integrity is actually supported by math and not by Authority or reputation so the prover generates a mathematical

proof a ZK Stark well a stark sorry without ZK that attests to the validity of all of the transactions and to the Integrity of the new state and then a proof is produced which is sent to a Smart contract the verifier smart contract that sits on layer one and only if the verifier smart contracts accept the proof do we change an up dat um the state and um this is a scalability solution and the reason is very simple the reason this offers greater scale is that the amount of computation needed to verify a proof is exponentially smaller than the amount of computation needed to

run the transactions what I mean is that if we have let's say a million transactions taking place on the validity rollup in order to verify that all one million of these transactions happened correctly the verifier smart contracts need to spend an amount of gas that is equivalent not to 1 million transactions but to something like let's say a 100 transactions or maybe a thousand transactions so you save a factor of you know somewhere between a 100 and 10,000 in the amount of computation needed to be done this is how validity rollups work now here's a brief history of

proving which basically I want to tell you something that I'm very proud of which is that we pretty much uh innovated and and jump started a lot of what is today best practice so the ZK uh paper and the whole study of proofs and interactive proofs States back pretty much 40 years to the mid 1980s and a bunch of people received cheering awards for it including this year 2024 uh the um recipient of the curing award is my own PhD advisor Professor AB vidon who also happens to sit on our scientific board so there there's been a lot of research uh Going Back 40 years

into uh proofs um where you know first of all I was fortunate to contribute to this in offering the first uh use of general purpose zero knowledge for privacy which was zcash which I was co-founder of and um then we had a bunch of mathematical breakthroughs that led to the Stark paper and the underlying protocols such as fry and Stark and uh this was around 2018 and already back then we start we said to the world look the best way the end game for scaling blockchains is to use arcs and we founded a company around

it together with urri colodne a bunch of others um um and this was uh six years ago um when we started it very few people believe that proofs are the way to scale and even less beli that Starks are a way to scale within proofs everyone was talking about you know Groth 16 snarks and Things based on elliptic curves uh but fast forward today and you know thanks to the efforts of starkware which invented um Cairo programming language and the Stone Pro and the star scaling system and Stark net everyone today agrees that Starks are the end game for scaling so the ZK sync system three

polygon um validity rollups um risk zero sp1 they're all based on Starks on our technology and um the reason I'm saying this is because what come next is going to be even more impressive than what we've done so far but we've already saved for our customers on the starx systems more than $1 billion in gas fees and we've uh you know we're now supporting roughly 10 teams um 10 separate teams such as dydx and mutable and sare um that are using the starx system just yesterday uh only immutable which is just one of these 10 systems running in starx had a TPS of 30 um which was among the highest uh in the

L2 World um and we're going to grow even bigger so we demonstrated to the world that um this is the right way to scale blockchains and ethereum in particular and thanks to this we have a very large and growing ecosystem again I urge you all to reach out to the people from Star already sitting among you uh IIA Yoni OD talk to them um we are the fastest growing uh L2 over time and we're staying strong so where are we heading um what's going to be the next thing in terms of scaling it is the Stover stew stands for Stark number two our first PR is called Stark number one and we think that the

third version which we'll probably start working on I don't know in three years will probably be called the Str you know for three or three followed by squat row squat we'll see about that anyways what is it so first of all it uses a very very small um field size which means basically that the basic unit of computation when constructing proofs is not some large uh number these are very small numbers that fit inside a word uh a computer word a computer word is 32 bits so you can fit uh each one of these numbers inside a computer word or you can fit them inside a word used by the Bitcoin H script er

um virtual machine it's a very very small and convenient word size which is going to lead as you'll see to very large speed we're going to have a much improved virtual machine for Cairo like you know a new version of the CPU that will allow developers even more agility and ergonomic uh uh programming it is based on a beautiful mathematical breakthrough called Circle Stark and it will use also a bunch of older things that are um very good like the Gare lookup method and mixed degree traces and I urge you to talk to uh erh our team there if you want to learn more about these fascinating mathematical Concepts so um about two weeks ago um we measured uh the you know the amount of

computation that you can run um and we showed we broke the world record we'll probably break it a few more times uh before we reach production uh in the ability to prove a throughput of over half a million pedon hashes on a quad core laptop and you can't see this but I'm using actually a a Mac uh Pro uh chipset and there it's over 700,000 and some people using a pro Max uh even uh managed to prove upwards of 1 million um invocations of a hash on uh on a laptop now this is more than two orders of magnitude better than anything known

previously at least according to senior people in the ethereum community where pretty much blown away and we're now discussing with them you know ways whether there are ways to uh use this reshape the uh map Forum because there's a lot you can do if you have this throughput on hardare so um this allows you to do things like subsecond recursion which means you can have very fast finality for extremely large batches of blocks you can have subsec sa Pro which could allow you to even enlarge the state of ethereum even more and it opens the door to putting Stark

net on bitcoin which is something we already um um declared that once opcat which is the ification to bitcoin um a soft Fork is adopted uh within six months we will have tet s safely not just on to ethereum but to bitcoin as well and hopefully after that to many more uh chains uh that provision remember we said that we believe that this Integrity web that we're building isn't about just one blockchain but we must have this sort of web that connects together many many blockchains so that you know people can basically choose and move in a self- custodial way between them um easily and that's our mission to help that happen

again I urge you to go talk to uh Yoni IIA OD to learn more about the possibilities opened by St and also to explore if there are ways uh to add and contribute to this open- source code uh whether in the context of Stark net or to do research that can advance ethereum's road map to use it so let me tell you a little bit about what is you know what is the magic uh the math magic going underneath it again I won't have a lot of time to explain this if you are inclined you can look for the you can Google Circle Stark and then you can find both a white paper or you can find a Blog that I wrote about it and uh vitalik just released a Blog

about it so there's a lot of information and excitement about it I urge you to read more so um okay there's this thing called there mer primes they are the form two be some power minus one and one of the primes two to the^ 31 minus one um and basically what we're doing is we're going to use maths to uses math that is all about addition and multiplication where you take remainder it's called mod you take remainer from this specific Prime so you can see that it's enough if you have even 31 bits with 31 bits you can represent any number within this world because we

always uh you know take remainder from this fixed number H which is why you can you can fit um these uh two words inside the computer world so you get really great performance um and you also can work with a smaller granularity a little bit like um so I mean previous provs used very large fields that that U had let's say 256 bits and then but if you want to just represent one bit or you know just a work with eight bits or 16 bits you were wasting a lot of space because you use these very large uh number of bits to represent them but now with a 32-bit uh you know basic element you have

better granularity uh it also happens that on Hardware on commodity Hardware such as gpus and CPUs the particular kind of computation that is taking remainder uh from this particular PR it's very nice because 2 to the 31 equals one so basically if your highest most bit is is turned on you can sort of you know turn it off and replace it by the lowest most bit which is very simple and hard workare so this is why you really want to work with uh this particular field called M31 however there's a problem the problem is that just as in the case of ffts you would really want um to have um this structure called a mathematical

group and you want the group to be such that it contains like in a Babushka it contains subgroup of half the size which contains another subgroup of half the size and again and again and again and for that you need the group to be of size two some integer power like let's say two to the^ 30 but the problem is that if you look at M31 and it's uh you know it's basic group the multiplicative group that comes with it it just doesn't have that structure it doesn't have the structure of being of the power two to the some some some large integer um so what can you do about this well one solution that already uh we about a few years ago and again is is you know

another breakthrough coming from um you know Star Wars uh Engineers who are also scientists and um is that there's once you fix a finite field there's pretty large variety of groups you can try to find and work um with and they come in different shapes and sizes these are well they all pretty much come in one shape uh the shape of an elliptic curve but they come in the many different sizes so you could take an elliptic curve and find a group over it and use that group to basically build everything needed for a stark even over the field M31 but this is somewhat expensive and complicated working with these elliptic

curves well the new breakthrough that came from a joint work of polygon and also between polygon and Stark whereas you know scientists engineers uh goes under the name of circle Stark you can see the paper is only uh half a year old or even less and the idea is to take the circle the circle um curve and take points on the circle and use them in order to find your group um that has size 2 to the K and it just so happens that this this works so in the good old days you know the good old Starks that we use previously um you could think that the group was somehow similar to

the group of um you know basically of of integers uh you know oneus one two three so you can think of this you know imagine it somehow as a line elliptic curves have this sort of weirder shape which uh I'm not going to go into but now we're actually using uh a different Group which is the circle um and it is the set of all points X Y such that x^2 + y^2 = 1 modul um the prime so for instance number the point x = Y = 2 15 happens to be a point on the unit circle uh over M31 because if you square each

one of these X and y's and sum them up together you will get two to the 31 and 2 to the 31 equals 1 if you take remainder from this meren Prime so uh it turns out that you can find a group over there again please talk to our folks on the ground to learn more it's fascinating beautiful math that actually goes back to the uh you know stuff you studied in Tri trigonometry and algebra uh so it's very very interesting addition or you know action of the group is like taking you know adding the angles in some and why should you care well you get like beautiful new M which is in collaboration with polygon Labs baked

into open source code and you know papers that everyone is uh invited to read you get crazy efficient um scale 100x improvement over the current status and um it's open source please contribute it and for Stark net you will get it automatically if you write in Cairo and Deploy on starnet you will just get much higher scale much lower cost the ability to run the proofs and everything on your laptop lower fees but you don't need to change everything you can come already today and on board um and contribute to the open source so so uh the world's fastest prover which will reduce computation and will hit main it in half a year or so I want to thank you

and if we have time I'll be happy to answer a question or two all right ladies and gentlemen do we have any questions yes okay hi Ellie I'm cry ner from stet Astro nice to meet you my question is what is the difference between M31 and filter 252 and we sh will we use it in Cairo um you repeat the last part what is the difference between M31 and the

filter to 152 in Cairo 252 field like the stop what is the difference between the stone field and the stew field yes yeah okay terrific question so as context right now right now the proofs are are that we generate using the stone open source prover um basically use a 22-bit field and we're going to move to M31 which is a 32bit field so the difference I think is captured maybe in the simplest way in the cost of multiplication Stone multiplication you know after a lot of optimizations we try to do even using vectorized machines there about um 40

cycles per multiplication and um St or M31 multiplication is oneir of a cycle so it's a roughly 120x faster to multiply over M31 than it is over the stone Prime that is the biggest difference and that is the main one of the main reasons we wanted to move over to uh M31 than okay thanks and then you know I'm a developer on stocket and as a developer you in Cairo should I change it or should I need to change the data type or I just use a Cyro for the ms1 I think I'm not sure I it's it's

reception is a bit hard I think you asked if I need to do any changes in Cairo if that for M31 and um the short answer is no nothing uh M 31 and and St will be applied as is onto all the existing Cairo I'm not sure if I answered the right question because I didn't hear very well um okay thanks very much all right thank you uh we have time for maybe one or two more okay there's another question uh can you come over here sir hi Ali I'm Kevin from I'm very glad to see you on screen and I'm very proud

to have your support and for big layer investment and my question is it's actually it us about uh the Bitcoin load UPS you you mentioned uh the Bitcoin approv mention um because we all know that in Bitcoin utx o model we don't have the ability to support the um the account States states of the something like ethereum and uh uh could you share some uh some some light or some um some uh some ideas about how to maintain this state with opat thanks yeah so okay question is how um will a stark net settle onto um

Bitcoin when Bitcoin for has a very different structure and doesn't have I mean it's state is captured by utxo sets which are constantly changing and not by something as an ethereum and account based model and so on and I agree it's it's a very big challenge um but what happens with opcat at a very high level um and I confess I am not the most technical person to address this but opcat basically allows you to um concatenate strings and to somehow open and check that certain strings match each other and this already and this opens way in order to do the following suppose you somehow had the hash of the

previous state or even the previous you know the hash of this previous state with concatenation you can basically open up screens and sort of refer to that state and you can also use the script language of Bitcoin to actually transition and move this state and update it along or rather create scripts that can be executed correctly only if they verify the proof and they recognize the previous state and they will transition the previous state to the new state dictated by the proof so this is all opened if you have opap and the details of that are extremely complicated I don't know if waking Chen is in you know the audience but maybe

again the folks on the ground if you talk to them they can explain a little bit more um but it is a non-trivial challenge however I will say we're very optimistic that we can solve it so uh with with opat thank you thank you for for the answer all right thank you for the question and thanks Eli we're running out of time so we want to thank you for this session let's give a big hand to Eli thank you very much