Episode 256: New ZK Use Cases with Dan Boneh

Transcript

foreign [Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online [Music] this week Kobe and I talked with Dan Bonnet professor of computer science at Stanford and the director of the Stanford center for blockchain research we cover his most recent work in ZK Tech both in education and in research and then we walk through Innovative use

cases that he and his students have been working on since our last episode it was great to have Dan back on the show and I hope these ideas Inspire listeners to jump into the research or maybe build some of these Concepts into new products now before we start in I want to invite you to ZK hack3 a virtual event happening right now and running until December 13th it's all online so you can join from wherever you are ZK hack consists of a multi-week series of workshops from the best teams working in ZK teams like Aztec risk zero alienoma scroll Mina sismo and ef's privacy and scaling exploration group these workshops are designed to onboard and show developers how they can start working with zkdsls platforms tooling and Tech each Workshop is different so have a look at our schedule and sign up

for the events that you're most interested in in tandem with this we are running three puzzle competitions with this you are meant to find a bug in the ZK protocol and exploit it as fast as possible we release one every week and the winners of these will get prizes spotlights and lots of cred within the community I also want to highlight that the ZK jobs fair is happening as part of ZK hack and it's happening this week on December 1st the workshop hosts the teams I mentioned before will be there to meet with potential hires the event is held in gather.town it's a virtual space you get a customized Avatar you can run from Booth to Booth getting to know different hiring teams this is a great way to get to know the teams before you actually go through the formal application process or just come

to hang out with other participants from CK hack and see what kind of jobs are out there so if you want to attend be sure to join our event on December 1st this is the ZK hack sessions 4 with Aztec at the end of that event we're going to be sharing links to the ZK jobs fair or if you're already signed up for the zika heck newsletter we'll also be sharing the links there so yeah hope to see you at the job fair now Tanya will share a little bit about this week's sponsor today's episode is sponsored by Mina protocol the need for private trustless Solutions has never been more clear a new era of ZK power decentralized applications is coming and Mina is the place to build them introducing Mina's ZK spark cohort zero where developers do tutorials and

build zero knowledge applications or ZK apps and get rewarded there are a quarter of a million Mina tokens up for grabs for ZK spark cohort zero participants Mina's ZK apps are written in typescripts so developers can easily get started without learning a custom programming language like other ZK protocols to sign up for zkspark cohort zero head to minaprotocol.com forward slash ZK podcast and if you're not tuning in to the podcast live no worries Mino will be launching additional ZK spark cohorts just visit Mina protocol.com to check out the best way to get involved so thanks again Mina protocol and now here's our episode foreign he is a professor of computer science at

Stanford and he's the director of the Stanford center for blockchain research welcome to the show Dan yeah and I'm excited to be here I should actually say welcome back to the show you are on episode 100 many years ago and it's very great to have you back for this episode which I think should be episode 256. I wanted to pick a special one well I get the best numbers hi Kobe hello good to be here so Dan I want to ask you in the last three years it's been three years since you've been on I mean I feel like there's so much we can cover do you want to share maybe some of the highlights should maybe shifting work or Focus from the last time you've been on yeah it's been my God it's been a while right uh over

three years and so much has happened I think the Z zero knowledge world has uh changed quite a bit in the last three years so we're seeing things now that honestly even three years ago seemed seemed quite uh far away there are lots of lots of uh changes that have happened if I can kind of go through uh the high points and very very quickly I think the whole development of ZK evm and the progress that's been made towards making that real you know that's something that three years ago seemed seemed very far and yet you know now we're almost there right I mean we already have some available ZK EVMS uh working at decent speeds which is really really quite impressive the rollout of ZK Roll-Ups has uh been very impressive you know

they're they're now live and very supportive I think we're going to be seeing in the near future ZK based Bridges so trustless that are made possible by the by the use of uh these succinct inefficient proofs so in that sense things have been moving um really it's quite a remarkable speed I think we also maybe even last time when I was on the show we talked about using zero knowledge for compliance and that has actually become even more important uh these days so maybe we'll touch on that like later uh later in the episode so yeah so um ZK has kind of become even more Central and more of an enabling tool for the for the blockchain ecosystem than it was three years ago it's really quite remarkable to see definitely

I want to just touch on something before we jump into some of the topics and new works and that's that like three years ago when we had our interview soon after that you and I started a planning of a course the ZK course now this CK course I teased on the show and like I don't know if everyone realizes how far we got like we actually recorded a lot of stuff but then the pandemic hit and it put everything on freeze and one of the challenges with research like this and and topics like this as much as we tried at the time to make what we were making like a temporal so it would last forever time went on and actually some of it at least became somewhat obsolete we weren't able to use it

but this year I was so happy because in a way we got to accomplish at least part of what we had set out to do you hosted three modules of the ZK whiteboard sessions this is something that our listeners might be familiar with I often tease it in the intros so this is like these three modules that act as like an onboarding a mini course into ZK Tech so yeah I just wanted to sort of mention that because yeah that was a project I was I was really bummed we didn't get to do and I'm really glad we got to do something this year yeah actually we did get quite far along and then yeah and then the pandemic hit everything froze and that kind of uh messed up our schedule somewhat so yeah Anna thank you so much for doing the ZK whiteboards I

think that was a wonderful way to kind of make this happen and now now it's deployed I was very happy to record the first three sessions uh basically the first three sessions are kind of an intro to zero knowledge right it's kind of going through totally what zero knowledge is and how it's constructed it's even breaking it up into the components of uh you know commitment schemes and iops and then we construct each one of those in the in the session so yeah so those three sessions take you basically from zero to Planck and so good overview and then of course the rest of the CK whiteboard sessions are amazing they kind of go through everything that's been happening in the space totally and we I think there might be more of these in the works I'd love to do more with you at some point in the

future too I do want to mention something that our audience may not be aware of but there is this like mystery never aired interview of you me and vitalik back in 2019 or 2020 early 2020 talking about the future of ZK and all the use cases and it's never aired and I was just realizing this in prep for this uh interview that it would be maybe it would be really fun to kind of dig that out if we can find it yeah yeah you should we should definitely post it uh yeah you should definitely post it on uh wherever you think is appropriate yeah remember we discussed applications of obfuscation and kind of advanced crypto to blockchain so it's yeah it was a fun

interview and uh I think it's a lot parts of it many parts of it are still very very relevant so be great if we can post it we had this I think we had a different way of categorizing how we thought about CK so even that change might be might be fascinating yeah I just wanted to throw it out there if we find this we'll definitely try to put it up on the podcast YouTube channel or something like that for people to see just I wanted to also give people context if we do find it this is years old so it's kind of like a from the archives yeah never aired it's interesting to see if you predicted the amount of Blanc variants that came out oh boy what's Planck a thing then I don't think plonk was plunk was just plunk just came out

yeah wow I was just starting out its Journey yes it's crazy I don't know if we covered it actually I don't think we did or at least not in depth at the time so a lot has changed I want to talk a little bit more about General ecosystem stuff though because do you feel nowadays there is just like more resources education like are you doing more education around ZK in general as well uh yeah absolutely you know our regular course in all of our courses on cryptography now we uh we dive much more deeper into ZK than we did before um I have to say what's happened is kind of interesting you know the idea for using proof systems to Outsource computation which is kind of what's Happening Here is is old right this dates back to the early 1990s you know

there's this paper that I like to uh decide actually I like to quote it's called the bfls paper the quotes that goes something like a single laptop can verify the computation of a herd of super computers yeah this is like the vision back in the early 1990s and I think what's been holding the field back a little bit uh since then is the fact that you know computers got really fast so you know our iPhones now are like basically super computers and so we were missing an example of a slow and expensive computer that would then be used to verify the computation of very fast computers right because computers just got generally so fast that it was difficult to justify Outsourcing computation in a verifiable way and now

all of a sudden we got our example of a slow and expensive computer right it's basically a layer one blockchain amazing yeah so because a layer layer one blockchain is so expensive and you know not particularly a fast computer it actually now makes a lot of sense to Outsource computation to a GPU and have the GPU prove to the blockchain that what it did is correct and that's literally the kind of the reason why ZK roll ups and ziki bridges and all that have taken off it's really just examples of Outsourcing computation so it's really quite fascinating and beautiful to see that the vision from 30 years ago has kind of come now to fruition in the blockchain space because of what blockchains are so you know it's it's just wonderful to see so let's hear a

little bit about some of the res decent work you've been doing in the ZK space maybe we can talk about some of the use cases that you've been exploring oh yeah great yeah so there's actually a lot going on maybe I should say that like the one thing that's really important to stress is that the blockchain community is building kind of developing the technology of zero knowledge and you know advancing it by Leaps and Bounds but what's interesting is it's like it's like similar to the Apollo program right I mean they were going to the moon and but in the course of going to the Moon to develop all these other technologies that were useful in other Industries and what's interesting is the same thing is happening in the world of zero knowledge right it's being driven by blockchain applications the blockchain industry is the one that's kind of developing and

and uh commercializing these kind of systems but because these things have now become so easy to use you know we have lots of Frameworks that are quite easy for people to program in that now they're all of a sudden applications for ZK that are outside of the blockchain space altogether and I want to give you one example like this is kind of a a fun thing that we recently did this is with one one of my students Trisha data and it has to do with using zero knowledge to fight this information so let me tell you the story so the problem is this so uh as you know when you read a newspaper there's a picture usually that comes with a news article and the picture is kind of related to what the news article is discussing the problem is how do you know the picture that you're looking at

is really a picture that was taken at the place and time that the news article is discussing right so maybe you're reading an article about a war zone well how do you know that the picture that you're seeing is really from that particular war zone maybe it was taken somewhere else at a different time and this is not like a hypothetical threat this is really happening and it's happening so much that if you just search for this information through images you'll find many many hits of ways to try to combat this ways to educate the public about how to tell if an image is authentic or not and so the media in the media industry was kind of aware of this problem generally the news industry is aware of this problem and they put together this interesting standard yeah the standard is called the c2pa standard it stands for Content

provenance and authenticity and let me tell you let me tell you about your listeners might be interested in the standard in general uh in that what it does is uh it embeds signing keys inside of cameras yeah so like Sony has a camera that literally just came out this summer where the camera has a signature key embedded in the camera supposedly embedded in such a way that it's hard to extract the secret key from the camera and then every time the camera takes a picture it basically signs the data of the picture and it signs the metadata associated with it yeah so it produces one signature that binds the picture to the location the time and other metadata that's associated with the with the image yeah so now all of a sudden we have yeah we

have a side photo that anyone can verify and see when and where the photo was was taken okay so newspapers in principle could embed those photos in the Articles and now people can verify that really the image they're looking at really did come from one of these authorized cameras now I have to say there are lots of issues with this design so maybe even your listeners are starting to think about um all sorts of interesting challenges uh with this design but one challenge is that what comes out of a camera typically is a very large image yeah these fancy cameras they just like 30 megapixel cameras so they produce very very large images and newspapers don't need to send to their readers such large files so what they do is they resize the images they downsize them maybe they

crop them you know maybe they grayscale them they do these standard operations on these images before they embedded in a news article and then they send this edited image to the reader the problem is once you've edited the image the reader can no longer verify the signature right you need the original signature you need the original image in order to verify the signature oh so what do we do yeah so c2pa had some mechanism proposed in the standard that is not quite secure the correct solution is zero knowledge proofs yeah and let me let me explain why how does zero knowledge proofs come in here come into come to the rescue here so imagine you you run your editing software and it resizes the image what you'd like to do is then replace the signature on the

edited image with a zero knowledge proof that says this edited image is the result of a properly signed image that all we did to it was just resize it yeah so the secret witness in the zero knowledge proof is the written original image the and the original signature and the statement we're proving a the original image was properly signed and B if you apply resizing to the original image you end up with the image that was actually sent to the browser yeah so now the browser basically will get the the down sampled image along with the ZK proof the reader can just click on that image the browser will verify the proof and and the reader will know oh yeah this image really is taken at this place and

at this time that's fascinating and so we did a lot of experiments on how to actually how well this works in practice and it turns out it works really well like um the tools for zero knowledge have come so far that actually even though the picture is huge it's 33 megabytes of data right it's a huge uh huge amount of data that needs to be processed here we can actually do cropping and resizing and grayscaling in basically proof generation is under a second yeah and so we end up with a very short proof the proof is like 400 bytes that gets attached to the edited image that gets sent to the browser the browser can verify that the only thing that was done to the image was just you know a resizing of the image to make it

smaller and nothing else was changed right maybe the image was grayscale but nothing else was changed verifying the proof is like blindingly fast right this is like milliseconds in the browser so yeah so it works it works quite well uh yeah so now I'm hoping that we can actually demonstrate this to the uh you know to the Associated Press if any of your readers happens to be affiliated with any news organization please reach out to us it'd be great to actually have this deployed and used in the real world because it works it literally just works so this is really this is really interesting because in that use case that you just described like resizing this this you use your knowledge proofs for the for succeedness basically so theoretically you could still send the image and had have interested users

download it and verify all the Transformations themselves but it actually can be even more interesting because you can also apply blurring and transformations of that sort that where you would actually also use the ZK properties of these proofs which could be really really interesting yeah yeah no that's very true so the reason they resize the image is because they want to save bandwidth so having readers download the original image basically would kind of uh nullify that but you're absolutely right cropping and blurring would actually be now be utilizing the ZK property so that's absolutely right so good good application what's interesting to me is that this is like uh I don't know it's a fairly important application of ZK it's got nothing to do with the blockchain yeah because it's

just basically verifying images but the reason this is possible Right the reason the only reason using this as possible is because ZK technology has advanced so much that we can generate proofs and huge statements these are 30 30 megabyte statements yeah and we can generate them in a reasonable amount of time you know quite quickly and the only reason this is possible is because the blockchain community has kind of developed ZK proofs to the point where they're this fast so I think it's a kind of exciting story of how blockchain technology is bleeding into other other areas of society I love hearing about stuff like this I feel like there's a desire for more and more use cases more and more ideas I have never heard this one so I think that's really exciting and I feel like

what you just described also potentially opens it up to other kinds of mediums too like that the one you just refer to is image but maybe it could be audio maybe it could be something else so that's really cool so actually I'll mention like an open problem for your listeners so if somebody wants to jump in and help we can now do this for these large images but we'd also like to do this for video right this video also gets downsized and edited and readers would like to verify that the video is valid video files could easily be gigabytes long right and so the question is how do we generate ZK proofs on such large amounts of data as a video and so yeah this is a this is a good challenge for your listeners if anybody wants to

work on that this is a good thing to try I'm actually curious if the standards are the referred to how to sign videos as well or is it just for images yeah so they focused on images because they were interested in that in the in the News application so it's also it's also part of the Innovation that could be by The Listener so that's nice cool cool yeah how to sign a video but more importantly if you if you just do minimal editing to the video like I don't know like uh let's say you just want to zoom in and one particular character in the video and and and only publish that how do you do a zero knowledge proof that that's the only thing you did the only thing you did in the video is zoomed in and so uh yeah proved that the resulting video

came from a properly signed larger video yep yeah it's a good challenge maybe with enough gpus we can do it but uh right now this this is beyond what we can do on on a single laptop yeah okay maybe maybe we'll have to wait for Asics we'll see yeah quick question Dan about that do you need to have the underlying file in its fullest form or can you actually do things to like already kind of compress it just for the proving part of it like don't you just need sort of the proof of validity in a way you're proving that it existed the way you say it existed but when you put it into that proof could you have already like compressed it down a lot yeah so so the so the original signature of course is on the raw data so you would need the initial original

raw data to prove that the original signature is is valid and then once you verify that you that the initial signature is valid then of course you can compress and do Transformations and and prove that the only thing you did is those Transformations by the way there's a list of authorized of allowed Transformations and basically what this proof does yeah is prove that the only thing you did to the image is is authorized uh Transformations so Dan I feel like there's a lot of use cases we could touch on tell us another one what else are you working on yeah so another application of of ZK that's uh that's come up recently uh is is one that has to do with trusted setup yeah so let's talk about how to do how to do setups again many of you listeners probably

know that uh some examples of zero knowledge constructions they they do require a trusted setup right so this is where one entity generates what's often called the powers of Tau and then tau is is this random secret value that that entity then has to has to forget yeah that's the erase then you know often that's done with uh some interesting ceremonies where people go and break the machines that the power of tile was generated on or they do it in airplanes and they throw the machines off the airplane or they take like nuclear waste readings from Chernobyl that also happened yeah right right right so there's all sorts of uh interesting ceremonies that people do to generate these powers of Tau but it's really kind of crucial that once the trust is set up is is finished it's really crucial that

the secret data is removed uh you probably know the the ethereum foundation is actually working on a powers of Tau Ceremony this is a super super interesting ceremony that they're doing because it's going to involve a very very large number of people yeah and so very interesting project and I'm really happy to see them do this this is probably the power hours of style that they're building is probably going to be useful for many other projects Beyond just what the ethereum foundation needs is this the Perpetual powers of Tau that they've been running for many years or is it something else so it's a smaller one it's the tank sharding one and that's going to be very Corey in ethereum so that's really interesting yeah yeah so it's a very important ceremony it's about to take place and it supposedly will involve its largest ever

ever done yeah it's supposed to involve like hundreds of thousands of of users so this is a paper that we submitted recently this is a joint work with uh Lara nikalakonka who actually deserves a lot of credit for this idea is Tam regsdale who deserves a huge amounts of credit for the implementation and uh with Joe Bono who's also fantastic and the idea there is basically to try to do this uh work on a blockchain rather than uh just do it as a standalone application so you might ask well why do we need to do a trusted setup on a blockchain the interesting motivation is that blockchains have anti-censorship capabilities right so if somebody tries to block you from writing to the blockchain well the whole point of

approaching is it's designed to to make it possible for you to write so the interesting application here is if you try to run a trusted setup maybe there is some Network attacker that's trying to prevent an honest participant from participating in the setup right so maybe there's like a bunch of people who are in the setup but if the honest participants can be prevented from participating then we have a problem so it's interesting to run the setup on on a blockchain because we used a natural anti-censorship properties of a blockchain to make sure that all the honors participants could actually go in and participate in the setup and this turned out to be kind of an interesting question so now there's all these issues with how do you run a setup on a

blockchain and so basically the blockchain what it would have to do is have to verify that every time a participant comes in and randomizes the current state of the setup the blockchain has to verify that the participant really did its job correctly yeah they didn't mess up the setup yeah it actually really did participate and contributed Randomness as opposed to overriding everybody else's Randomness or just submitting junk altogether so the blockchain replaces the coordinator part here right exactly exactly exactly and it turns out there are kind of a couple of of models here so the two that are interesting is you can imagine putting the entire powers of Tau on the blockchain yeah and then basically the chain will just verify that every every update is done correctly so that's one

one approach uh that works for for small setups right where like in Deng sharding you know the amount of data that's generated is not that high so you can imagine storing all of that on on the blockchain so the question is what happens if you would like to actually not store this data on the chain and instead you'd like to store it off chain in which case what you could do is you can distort commitment to the data on chain right and so you have a commitment to the power of style that's stored on chain and now when someone updates the powers of Tau what they would do is they would update the commitment that's stored on chain so they would upload a new commitment on chain and then provide a proof that the new commitment is a valid update of the powers just how

relative to the old commitment yeah that would be the zero knowledge group now this is kind of starting to be kind of interesting how do you how do you do that proof and that's basically kind of what's uh what's worked out in the in the paper one interesting question is now you have a data availability issue which is somebody has to store this powers of Tau yeah so presumably we have to use one of the data availability Services you know there are many of those that are that are now forming that's where the powers tab will actually be stored the chain itself is really just used for anti-censorship and all it does is it just updates commitments you know from updater uh to updater so it seems to be like a good use of the properties of a blockchain of course it'd be nice if we had a chain

where gas costs were lower so actually you know more people can participate without having to pay the gas costs associated with each update um you know but hopefully that's that's uh that's coming in the in the in the next couple years so anyhow I thought this was kind of a acute application of ZK connected to uh to something that's stored on the blockchain yeah and I I do agree that it's really cool because in all the setups that I've seen and that I've participated or ran and basically have to rely on social layers to enforce that on that censorship produces property because you would post on Twitter or or then you would cast some doubt maybe on the coordinator that censored you and not having to rely on

that is exactly why I invented blockchains and that's that's really good use yeah yeah right right yeah so we'll see so maybe maybe uh even something like that can become can become commercial and used used in real real systems yeah quick question about that Dan when you actually produce so like you've you've talked sort of through the process of producing this I sort of imagined this happening on an L2 or cheaper than an ethereum ideally but the outcome of that does it go directly into the smart contract that activates the zkp or would it still have to do something like outside before you like I just I always think of the trusted setup as like this thing you have to do in order to start the snark or to start the

process yeah I wonder is it all on chain or is it just this part no that's a that's a very good question it's actually the proofs that uh participants contribute to prove that they updated the setup correctly of course that has to be done with what's called a transparent snark yeah so one that actually doesn't require trusted setup so it's kind of interesting that we're using we're using a transparent snark to bootstrap a snark that does require a trusted setup yeah and um that's what happens is the randomization process and the proof generation of course happens off chain and then what the party that that did this work what it would do is it would actually write this data on chain and

the chain which is verify proofs yeah so the chain basically does what it does best which is update commitments and verify that the update was done correctly by verifying a short proof you can use this directly like let's say in in some is let's say KVM or something right like that's kind of what they were getting at exactly like it's almost like like some deployed snark on the like and this is where even though I've done a number of episodes on The Trusted setup I don't know if I'm completely aware of like the moment that the what is it the SRS actually gets activated or gets used like can I think the question here is does it go the full process like can you do this generation and then it it sort

of like Falls right into an on-chain ZK snark and makes it private that's actually a great question so it's uh and the answer is yes okay that's right because what happens is the uh you know what we call the verify parameters right the parameters of the verifier it uses to check proofs you know those live on chain all the time they just get updated every time the SRS is refreshed but those do live on chain and then you know any contract that wants to use them can just read them and use them to verify proofs okay yeah it's a great good question actually that and that actually is completely supported cool yeah but although I think that actually you might have a problem when you're talking about deploying circuits because when you when you have Blanc and let's say other

Universal snarks you usually have to go through this indexing step and that's going to be hard to do yeah yeah let's set up the pre-processing setup would be done would be done off chain uh but that that's because you just there's no reason for the blockchain to actually do the indexing itself yeah but you would have a hard time verifying that basically this was derived from from the parameters that were on chain so you would still have this semi-trust on the off chain process to deploy a contract right uh well I mean so that's interesting if the wrong parameters were used in pre-processing and then you in the indexing phase and then you try to uh generate a proof

using the ROM parameters yeah the verifier will fail yeah that's fair that's fair you you would verify you'll end up producing wrong proofs right so that's not very very helpful to anybody yeah and then the on-chain contract would just reject those proofs yeah I'm more thinking about in the context of um let's say the dream of updatable snarks where you you would have a snark that always updates and that you can keep using an up-to-date version whenever a new participant contributes more Randomness but I think maybe this indexing part A Bit Hurts that dream um you know that no that's again an interesting point in that um every time you up you go through a series of updates you can imagine like a

batch of updates that that happened yeah you would have to rerun on the indexing algorithm but the indexing algorithm is is deterministic yes right anyone can check that it was done correctly so there's no trust assumption there and so you just somebody you have to off chain would have to rerun the indexing algorithm and then push push the results of the indexing you know the verifier parameters on chain and then and then uh the contracts on chain would use it yeah okay that's fair a lot of people contributed to the secret Randomness and the point of course is that no one was prevented from contributing to the secret yes definitely because of anti-censorship cool yeah amazing so yeah I don't know I hope this will this will uh some projects will actually end up uh using this kind of this kind of mechanism although I have to say that

what the ethereum foundation is doing is super super interesting so that project I'm really can't wait to see it uh take place and I'm really looking forward to seeing the the huge number of participants that contribute Randomness there so yeah lots of things happening in the space yeah so going from trusted setups are there any other kind of spaces in the blockchain world maybe kind of areas that we're trying to tackle or add ZK stuff into yeah the list is really long at this point maybe I can mention one more one more example for sure so one thing that that we were interested in is uh this question of how to run a Dao with a private treasury again this is work with one of my former students uh Griffin to knife and the

question basically is if you run a Dao today on chain you know everyone can see what the treasury of your Dao is right and this causes a problem where say when a Dao wants to participate in an auction right if you participate in an auction and everybody can see what your treasury is you know everybody knows exactly what your maximum bids can be and this is not hypothetical as you know this is exactly what happened with the Constitution doubt right where um you know the participants knew exactly what is the biggest or the largest bids that the Dao can issue and then somebody just issued a a larger bid and outbid them right so the question is basically how so hey you can you can take this in two different ways you can say from a game theoretic point of view what is the correct direct

auction mechanism where you have participants where some of them who have private States you know humans basically have private States and some of them have public state where everybody can read their can read their minds yeah how do you design an auction mechanism in that sort of environment yeah that's kind of a game theory question or a mechanism design question that should probably be solved actually I mean I'm a little it's kind of important for auction houses to change the way you do auctions because those participate and everybody can read the mind of the of the dial can see exactly what their treasury is the other way to go to take this question is to say well you know can we actually design a dial they can participate in an auction and keep its treasury secret and that's again where ZK comes in yeah and so the private Dao

design it's kind of a was kind of a fun design to uh to work on is basically where we build what's called a Dao platform yeah so it's one contract that will service many many different dials yeah so Juicebox is an example of such a platform form right where it's one literally it's one contract in ethereum that many different dials use and this one contract basically makes it so that the treasury of all these daos is all combined together so now somebody looks at the treasury of this one contract all they'll see is the aggregate treasury of a large number of dows but they wouldn't know the treasury of a particular doubt and so to make that possible it's very important that when someone sends funds to the Dao they don't reveal

to the public which Dao is the recipient of those funds so in some sense you need to be able to send funds to The Tao in secret that is you're sending funds to the platform but the world the public doesn't see which dial on the platform is the recipient of the funds yeah and and you can see that that's kind of where's EK techniques starts uh start to come in so now the dial basically has a lot has a list of deposits that were or rather the platform has a list of deposits that were sent to it you know some deposits were meant for one though one some deposits were meant for another dial and now the the manager of one particular dial on this platform would actually have a secret key it could use

the secret key to then say you know these 15 deposits are mine and here's a proof that they're mine because I have a secret key that proves that these were actually meant for me uh and then the dial contract will say sure these 15 deposits really are for you and therefore you can if you decide you can go ahead and send them to the auction house to participate in the auction yeah and so it turns out that doing this this is again where snarks turn out to be super super useful because imagine you have uh one particular dial that received a large number of donations let's say I don't know 20 000 donations well if you had to do a separate proof for every one of those donations the dial manager would have to prove this

donation is mine this donation is mine that donation is money but you have to repeat that 20 000 times and the chain would have to verify those 20 000 proofs separately instead you know we can use uh you know we can use snark batching techniques where we can take a bunch of proofs and squish them into a single proof and and then just present that single proof over to the to the contract and the contract just now verify this one single proof that says yes all these you know 20 000 donations uh belong to this one that were sent for to this one dial and therefore the dial manager can can direct those funds to the auction house yeah so cool and I have to say this is something that still needs to be built commercially like uh it works it is a prototype that shows this is very

practical it actually works it doesn't cost that much and um yeah I don't know you know I'm hoping again one of hopefully some of your listeners participate and out platforms and maybe maybe we can take we can take that design and make it uh make it real it'd be I think it'd be something that was really would really benefit from well what kind of batching technique have you used here to make this efficient yeah so so actually the it turns out the the basic proof is what we use is uh it's it's sufficient to use a very simple uh Sigma protocol so it's sufficient to use just kind of a proof of discrete log so the same type of proof to go into snore signatures were actually sufficient and so the batching the naive batching is to just use the same aggregation technique

or same batching techniques that apply to verifying snore signatures yeah so you know if you need to verify a large number of snore signatures there's a way in which you can actually save some work there and so that's uh that was like the the simple design but that doesn't bring it down all the way ideally you know the right thing to do is to actually use a snark to prove that you know these 20 000 deposits are all mine produce a single proof that the contract can verify and that would kind of make on-chain work minimize so there's still a need for a snark here that that's used primarily for speeding things up I'm also curious if the design included some measures for compliance or traceability that for example the Dow could show to

know someone that wants to look more deeply into their finances that everything is fine yeah so that's a that's again a fantastic question so compliance yeah this we should definitely switch gears and talk about ZK for compliance too um so the basic design actually was just focused on the privacy of the treasury but of course now you're absolutely right everything that as we learned you know you know these systems do need to provide some compliance capabilities and so that yeah that remains to the dial application that does remain to be done and so but that actually suggests maybe we should switch switch topics sure and talk a little bit about another area of where compliance is might be useful which is for make pictures yeah so we're

recording this right now just a week after this whole FTX thing has gone down and we also this summer went through the tornado cache of fact sanctions I've done a few episodes on that just sort of showcasing like the impact and what it's done but I think it had a really like both of these things are I think are going to have a pretty profound impact on ZK research and use case development like on one side can ZK actually be used to help mitigate some of these problems in the future so yeah tell me are you doing any work in that direction uh yeah yeah absolutely I mean so I'm actually glad to see how you uh framed it Anna that ZK could be used for uh privacy but Zeke and ZK can also be used for compliance

yeah and in fact there are a couple of companies out there that are using ZK for compliance I mean one one example of course is espresso systems that's kind of one of the one of the things that they promote so in the context of tornado there is a way to approach this from a technical point of view which is to ask how could have tornado been designed you know to maybe reduce the risk of uh you know the sanctions being applied to it yeah so that's a tech we can approach this from a technical point of view of course you know policy makers would approach this from a policy point of view which is you know what's allowed what's not allowed and so on but you know we're computer scientists we like to think about technical questions and so you know there's this interesting experiment yeah it's an experiment

exactly you know I I like how you say that it is an experiment which is if we had to start over and we could redesign tornado is there a way to design tornado in such a way that still provides strong privacy but it's compliant with or maybe I would just say deter Bad actors from using the service right because really that's kind of the ultimate goal just we want Bad actors to not use the service so let me kind of summarize these kind of three approaches these have been discussed uh separately in a number of places but let me just uh describe these three approaches that might help here again we're I'm not a lawyer where I mean none of us are lawyers we have no idea if this would actually satisfy the you know the the sanctions folks but you know just as a intellectual exercise

yeah let's just think about how what what might have helped here and by the way I should say this is uh something that we've written about uh this is written about this with uh Joe Burleson and Michelle crover and so let me kind of summarize three different avenues that we could we could try to go down the first one is actually it's actually a somewhat weak but let me say it anyhow this is what we would call deposit screening right so deposit screening meaning means that when someone tries to move into the contract saying to tornado the the tornado contract would actually check is the source address on the current sanctioned list yeah and you know there are a bunch of companies that provide uh a sanctioned list it's actually uh these uh it's kind of interesting so the analysis provides one

elliptic provides one these are kind of very simple contracts that you can look them up on chain and these contracts literally has have a function called is sanctioned yeah and you call you say is sanctioned address and the contract returns true or false if the address is currently sanctioned or not yeah so there are a bunch of these contracts available online last time I looked there aren't that many addresses on that uh on that list so I don't know maybe maybe um they'll update more more aggressively in the coming years but that's what's available today so this is called deposit screening where when you try to deposit it into a tornado basically tornado would check if the address is currently sanctioned and if so it would rejects the deposit yeah make sense uh that's a simple simple solution the

problem is this doesn't really work yeah the reason it doesn't work is because you know if a hack happens and somebody moves the funds into tornado right the hack would happen and within minutes the funds would move into tornado and there's no way the sanctioned list would update within minutes yeah and so by the time the the sanctioned list has been updated to block that address it's too late now the funds are already inside of the mixer yeah so it's a good thing to do but it doesn't quite solve the problem we want to solve so the next idea is to use what we call a withdrawal screening yeah so as you know with mixers once you move your funds into the mix you have to wait you have to the funds have to sit there for a while because if you just move them in and

immediately move them out you didn't mix it all right you you get you get no benefit from uh from the mixer so the funds have to sit there for a while in fact the recommendation is they sit there for a few days before you take them out so that you know they get mixed with the rest of the traffic yeah and and so well by the time you try you the bad actor try to withdraw the funds hopefully by then the sanctioned list has already been updated and now your Source address the address from which the funds came actually are now blocked or flagged yeah oh yeah yeah exactly your Source address is is blocked or flagged no that's exactly exactly right so withdrawal screening basically says that at the time that you try to withdraw from the contract uh basically you have to prove that the source of the

funds is not currently on this ancient list yeah and so yeah this is what we call withdrawal screening and what's interesting here is what's the technical tool that's needed for this is what's called an exclusion proof yeah so it's a very small change to the tornado contract at least a tornado classic it's a very small change that at the time that you're withdrawing you've Provence your knowledge again what's called an exclusion proof to say that the source address of the funds is not on the current uh sanctioned list wow technically this is this is like we know how to do this it's quite simple it's quite efficient you know exclusion proofs if your listeners don't know about exclusion proofs go read about

them it's quite easy to do exclusion proofs using Merkle trees yeah there's a very simple trick that lets you do exclusion proofs using Merkle trees and you can prove that your address is not on the list as opposed to uh is on a list what's interesting about this is if you are a bad actor and you move funds into the contract and then at the time you want to withdraw your funds have been sorry your Source address has been added to the uh to the block list then basically your funds get trapped in the contract you can never withdraw them and so that's interesting because that actually discourages Bad actors from moving into this contract to begin with right so maybe they'll just you know just stay away all together yeah and so maybe that's a way to help the design

now by the way this this only applies to tornado classic when you look at more uh complicated designs where you can do transfers inside of the contract things get a bit more complicated one can even think through how to do uh withdrawal screening even in that setup so that's kind of the the second approach yeah does that make sense so basically verify that you are not flagged during at withdrawal time and if you are flagged well sorry your you know your funds are are trapped it's interesting though because tornado itself did include this offline compliance mechanism right where you could reveal enough details to someone that wanted to verify that where

the fines came from and so on but this would make this on chain verifiable which which seems like a big Improvement and the the compliance tool you're referring to was voluntary right so you know exactly most likely most likely a bad actor would just not go through that uh through that process exactly it would like it would help an honest actor to to show that their fans are okay but a dishonest actor would just ignore it yeah yeah exactly I I should say that this withdrawal screening method there are lots and lots and lots of variations of it that you can imagine yeah but one takeaway from that is that hopefully you know because of the threat of your funds getting locked in the contract that will just keep Bad actors away but more importantly you realize it doesn't hurt

the privacy of good actors yes right so good actors you know remain you know you're not able to eavesdrop and or or peek into what they're doing we should keep this tool in our pockets to remember there is a way to try and discourage Bad actors using the system without actually hurting the privacy of good actors the third approach uh which is I think a little bit more problematic from a from a privacy point of view is what are called viewing keys right so viewing Keys is probably something you discussed at length in the on your on your podcast Anna yeah right so viewing Keys is basically where the depositor has to encrypt the source address under some Authority's public key which authority is not clear you know who owns

the secret key is not clear so viewing keys are in some sense kind of the they it's basically a back door right it's a back door to the privacy of people transacting with the system and all the issues with back doors come up in this in this environment as well so viewing Keys definitely are a way to go and in fact it's interesting are many people in our community in the blockchain community that you talk to and they they want to element compliance viewing key is a sort of the first solution that they go to yes and I just want to make sure you discussed on a viewing keys at length I imagine in other podcasts so we don't I don't know that we need to talk about them too much I don't know if I've talked about them at length they've come up but actually in this comparison that

you just made like listing those three approaches it does seem like a very kind of it's like the the big hammer one but you actually open the door to a data leakage of All Sorts what if the wrong person gets a hold of those and then can see all of the data and leaks all the information so there's lots of problems associated with that yeah yeah exactly those are all the questions I mean you're asking exactly the right the right question these are all the questions that come up generally with uh with uh back doors and uh I guess that's the term that they're they're called in Industry who gets access to the back door what if the back door is stolen what if it's lost yeah there are all sorts of administrative and management questions that come up with that so what's interesting is I just wanted to

kind of contrast the fact that viewing Keys is kind of where people naturally go to when they need to deal with compliance but I just wanted to mention also this withdrawal screening at least in the context of tornado classic that is another another tool in our toolbox again we don't know if this will satisfy Regulators I mean we have no idea if this will actually satisfy the requirements but I think it's a good tool to remember and keep in our Pockets if we need to design compliance systems that was interesting yeah and by the way the open question there is it does get more challenging if you can do user to user transfers inside the contract there are multiple sources for funds when you withdraw those funds and then all that

would have to be kept track of and then it becomes harder to do this uh this proof during withdrawal so there are also interesting kind of questions to think about in in terms of how to design this for more complicated systems it would be more complicated if there was a swap if there's any like uh decks and there's any sort of action no no that's exactly right yeah things exact that's exactly right things get more complicated if the source of the funds could actually be multiple accounts and now you would have to do a proof that none of the accounts that contributed to uh to the account from YouTube We're withdrawing is currently on the block list yeah and that's that's a more complicated thing to do yeah I think I think the situation is even worse because you yourself in

that anonymity pool you yourself don't even know the source of funds after a few transfers so it's it's even harder yeah yeah that's right that's right so actually there's an interesting design problem here right so it turns out there are actually ways to design this but now there's a trade-off between privacy and compliance so uh I'd say again there's an interesting design question there on on how to do this in these more complicated systems so let's kind of continue on this line though where we can actually use like elements of zero knowledge or ck proofs to actually help prevent any sort of financial malfeasance I mean here I'm obviously talking about what happened with FTX small caveat here FTX was a centralized exchange I think anyone who

listens to this show knows the difference where it was more like a bank than actually like anything on chain but I know that it's been floated this idea of like proof of Reserve through ZK this idea that you could use the KPS to prove that there is some sort of funds backing the activity that's happening so yeah I'm curious if you've been working on that if that's like a topic in your in your group yeah it's a funny funny you should mention this Anna because this is actually something that uh I guess we worked on many years ago and again I should say this is uh joint work with dagger Benedict buns Joe Bono Clark and uh myself an assistant called Provisions I think it dates back to 2015

or 14 I'm not exactly sure oh wow uh but this was in response to uh to mount gox yeah so FTX is not the first exchange to fail yes any of your listeners know uh yeah we've had these Pro these problems actually for quite a while now although maybe not to the same extents and so the question was basically how can an exchange prove that it's solvent and do it in zero knowledge right so what does it mean to prove that it's solvent right it needs to prove that its obligations are less than its assets right and so exchanges generally are kind of might be nervous about doing this because they might not want to reveal how many assets they have they might not want to reveal what their

customers obligations are you know how many customers they have what their customers have in their accounts so this is a perfect application for zero knowledge right the way this works is the exchange there are two parts to it yeah the exchange basically commits to its assets so it will give us your knowledge proof that it has so many assets on chain and then it commits to its obligations yeah so it proves and it basically computes a commitment to its total set of obligations to its customers and the interesting thing is every customer can log into the exchange you know when they use their wallets to log in they can automatically check that their balance in the exchange was included in the commitment to the obligations yeah so the customers sort

of inherently as they as they interact with the exchange they basically check that their accounts were included in the obligations that the exchange committed to yeah and so over time you know if enough customers do this uh the commitment to the obligations is trustworthy we know that this commitment really does represent the obligations that the exchange has to its customers and then the only thing that's left is a zero knowledge proof that the value in the committed assets is greater than or equal to the value in the committed obligations yeah so this is something that in principle exchange can do they could have done seven or eight years ago right so uh if the funds this if basically the exchange loses the funds it will not be able to do these proofs anymore yeah and

so I guess you know in the case of I'll go back to the to history since I don't want to talk about uh recent events uh but uh you know in the case of Mount Cox basically as soon as the funds we don't know everything yet yeah yeah exactly as soon as the funds were extracted from ongox they would no longer be able to produce these solvency proofs and you can imagine the solvency proofs would be created once every 24 hours so immediately when when bad things happen they can't produce uh solvency proofs anymore and uh the the issue would be would be detected now again there are lots of caveats to this if you start to think about this there are many ways in which exchanges can still complete the solvency proofs even though they might not control the funds for example they can take a loan uh temporary Loan in

order to do the solvency proof and then pay the loan back um just as an example yeah so they're they're still you know funny games funny games they can play with but you know the hope is that uh if this is deployed you know they have to do they have to produce this proof every 24 hours you know it makes people think twice you know if we if we take action X we won't be able to produce a proof maybe that will prevent them they will just make them it's a mental block to say well maybe we shouldn't be taking action X to begin with yeah because that would cause the proof to fail so it's another you know it's not a foolproof solution but it's another uh you know kind of Defense in-depth mechanism so it's one of these things that you know we back in 2015 1617 we tried to get

exchanges to to implement this yeah this would have been it seems like a kind of a pretty natural thing to for exchanges to use you know exchanges had other other priorities this does develop require some development work and so what what I'd like to suggest maybe to your listeners is folks are interested maybe we should kick off a standardization process around us right why don't we have like a committee or you know a standards body that decides on what is a proof of azure knowledge proof of solvency you know we'll have a a standard that says here are the formats that here's what we're committing to here's what the proof proves uh all these things will be standardized then companies will actually be able to implement the

standards in such a way that it will be very easy for exchanges to integrate well easy in quotes it will be easier for exchanges to incorporate this into their into their workflow and then boom every 24 hours they'll generate a proof and similarly while it's wallets could integrate this into their um into their processes and kind of the proofs will be checked sort of uh automatically by lots of customers yeah so if we have a if we have a standards for this you know it could go it could go a long way and again it's not a foolproof solution but it's kind of one of these defense and depth mechanisms that might you know in some cases might prevent this from happening again what's amazing about what we just covered is like so many of these examples I feel like are great for

listeners to hear and start brainstorming around and now that there's some proof of Concepts or some papers written up about this like you can start to think about this in different contexts and then hopefully we can start to see like all these new use cases honestly the reason all these use cases are possible you know we have to acknowledge the fact it's only possible because of the development of Frameworks to do zero knowledge proofs very efficiently in a way that's easy for developers to use yeah this has only happened because you know the blockchain community needs these zero knowledge proofs so there's been a massive effort in developing this technology otherwise none of this would be possible so I think we should acknowledge you know give credit where credit is due

definitely is it in the do you think it's in the languages or in the libraries like is it the fact that things have become more efficient or is it because there's now like 2 tools to engage with it without needing to be kind of in the circuit like using it more as like a black box yeah yeah definitely I totally totally agree with you Anna it's um what's interesting and kind of remarkable is the fact that now we can actually have developers work on zero knowledge proofs without actually knowing the details of how they work right they can interact with the Frameworks and make those things work without having to spend two years understanding all the Nitty Gritty details ten years ago you know Kobe you you know this very well 10 years ago if

you wanted to to develop uh or use a zero knowledge proof in your system you basically would have had to hire a team of cryptographers to go and understand all the different proof systems and then Implement everything yourself these days I can tell you that even in our course we have a snark project where the students developed like they within a week they're able to do inclusion proofs and Merkle trees basically we do right now we do it in circon but we're probably going to move to one of the other one of the newer Frameworks within a week some someone can go from zero to building like a prover and a verifier without too much effort that's only possible because of the development that's happened over the

last decade yeah I mean you don't even have to go 10 years ago like even six years ago I remember working with lips nark you already have to work for a month just to support fixed Point arithmetic or negative numbers and now now you have this out of the box and you can verify it on ethereum directly it's it's amazing I agree with you yeah look the proof is the fact again we can do this with one in one week students can go from zero to writing writing software that generates proofs yeah so so then one of the more interesting works that I've seen coming from your group recently was the collaborative snarks paper where um you could have multiple people collaborate on the different secret parts inside the snark and producer

proof and I was curious to hear about what were the applications that you had in mind for this and like what what it is and so on so I think it would be interesting oh yeah thanks Kobe yeah so this is something that uh worked on with my with Alex ostemir who you know very well I think he's been on the podcast a couple times totally and and so the question was basically what do you do when you need to generate a proof but the witness for the proof is actually distributed across multiple parties right traditionally when we think about zero knowledge proofs the secret with that witness is only held by a single party so what what do you do when this witness is itself distributed across multiple parties and this comes up actually naturally in a a lot of different

situations right so we were thinking of like in the in the banking system if you need to produce a proof on the transaction on the global transaction graph you know well every Bank only sees its view of the transaction graph nobody really sees the global transaction graph and yet somehow they want to produce a proof on the global transaction graph so that's an example where the witness is splits between multiple parties there's another nice example actually I think Proteus brought this up with where um imagine you are a weak device and you want to produce a proof what you can do is you can take your witness and break it up into multiple pieces give the pieces each piece to a large server and now neither one of the servers will know your witness because it's Secrets but

together they cannot work together to produce a proof over all the pieces yeah and presumably that actually gives speed up over doing doing the the proof on on this weak device yeah so there are lots of situations where these collaborative proofs actually come up when you have to produce a proof using a witness that's distributed across multiple parties so the question then is how do you do it and from a theoretical point of view this is immediate the way you do it is you basically run the proving algorithm as an NPC among the parties that hold the witness yeah so I hope your listeners know about multi-party computation right multi-party computationally lets you compute on shared data yeah well here we have shared data right we have a witness

that's shared across multiple parties they can run multi-party computation and generate the proof using using the shared Witness so to do that what it means is we have to design a snark where the proving algorithm is MPC friendly in the proving algorithm has to be efficiently implementable inside of an NPC protocol so how do we do that well it turns out you can actually take some of the existing snarks and massage them somewhat and they become NPC friendly yeah so you can actually run them very efficiently inside of an NPC to me by the way this is interesting because it's kind of a new criteria for snarks right we have all these demands from snarks right we want fast provers we want no trusted setup maybe we want Quantum

resistance this is kind of a new demand from a snark not only does it have to satisfy all the existing properties also the prover has to be MPC friendly yeah so how do we build snarks that that are NPC friendly and you know for example it turns out we can take our friend Planck and massage it in a little bit and how it works and lo and behold it becomes NPC friendly so we can actually run the prover in an NPC now the amazing thing that happened this is something that hardly ever happens in the world of NPC but the amazing thing that happened is that it turns out that when the that's you know snark proof generation is so heavyweight that in fact even when you run the prover inside of the NPC most of the work is done on a local computation

to compute the actual snark yeah so the overhead of the NPC is minimal it's like at most a factor of two yeah this is like unheard of usually when you take a computation and you convert it to an NPC things slow down by a factor of a thousand yeah but snark proof generation is already so hard that the overhead of the NPC is really that not that high it's quite quite negligible so the lesson here and again this is something again your listeners might uh should probably know about the lesson is it's actually not that hard to generate a collaborative proof it's really not much harder than just generating a regular proof yeah the overhead of NPC if you do the snark correct actually you know if

you implement this not correctly then the overhead of NPC is is almost negligible it's kind of doesn't add much complexity this by the way I think the experiment went up to like 30 30 provers or so so it's NPC across 30 parties and even then the overhead was uh was not that high there are there are graphs in the paper that um that show this and so yeah I I thought it was kind of a bizarre situation because like again in the world of NPC usually NPC introduces huge overheads and here it's almost for free yeah the overheads are so huge already and look yeah and and like the final proof that you get is um it looks very similar to an existing proof so you can basically expect the same verifier efficiency which which is

really appealing as well so basically people can use it in existing environments which is really cool yeah that's exactly right by the way there's one subtlety that I wanted to point out which is you know when the witness is distributed across multiple parties the threat model now becomes a little bit different right because now let's say there are three provers trying to work together prover number one might actually try to be malicious so it could extract prover number two's Witness right and so that that's kind of what the NPC protects against however there are some things that the NPC cannot protect against right in particular proofer number one can cook up a fake witness and see whether the NPC protocol results in a final correct proof yeah

and in doing that inherently unavoidably proven number one learns something about prover number two's witness in the sense that it knows oh my cooked up witness actually combined with prover number twos and threes Witnesses results in a valid proof so that inherently leaks something about prover number twos and threes uh Witnesses so just I think it is important to keep in mind when you use collaborative proofs it's perfectly fine to do there's one subtlety you have to remember in that inherently you have to leak some information about your witnesses to the other provers yeah in particular just the fact that you have a piece of a witness of a valid admit this that that actually will leak to the other proofers so this one subtlety I just want to make sure people are aware

of so nobody falls into this uh into this trapdoor so you just chatted about like the MPC ZK combination it's sort of in a way we're not used to because NPCs are usually seen as like The Trusted setup part of a zkp but I want to sort of finish off with a topic I don't know if we talked about it last time we might have but it is the ZK fhe combination and I'm curious if you're keeping tabs on that if you're if you've been paying attention to because fhe when we met I think you were the one who actually introduced it to me potentially on our last episode this idea that you could have this place where you could do like private computation have you been following that does any does your group ever touch on that or yeah what do you think of it do you think we're still a

ways off well I mean that's no that's that's a fantastic question I mean fhe is kind of one of the most amazing things that happened in in crypto right I mean the fact that we can compute arbitrarily on ciphertext is is mind-blowing yeah I guess if the the space of fhg is also advancing quickly right there are a couple of companies working in the space and and so that technology is maturing quite rapidly as well so there's some connections between fhe and blockchains as well yeah so there's kind of two touch points between ZK and and fhe uh so one touch point is where ZK can help fhe in that uh the fhe model is right now in some in some sense what we call uh honest but curious where

you kind of assume that the person that's Computing on ciphertext is Computing the right function well what if you don't trust that person and you'd like them to prove that they computed the right function well that's where you can kind of use your knowledge to say you know hey Mr Computer you computed on ciphertext but please also include a proof that you computed the right function and so that's an application of ZK to fhe there's also an application of fhe to ZK maybe I won't get into that but it turns out there are actually constructions that we can do using it using fhe that are that are beneficial to ZK but maybe we can leave that for a future excellent to another time sounds good Dan thank you so much for sharing all of this work I feel like I'm going to use this episode probably

towards like any future hackathon that we do I'm going to send people to listen to this one because I think they're going to get a lot of really great ideas that they could potentially then use for creating products actually with a lot of this stuff so yeah thanks so much for that rundown this is great Anna by the way just to show you the the wealth of the space we didn't even get to everything that we could have talked about it would have been fun to also talk about hyperplunk and how hyperplunk works it would have been fun to talk about uh generalizations of iops to things like fiops but we can leave that to another another episode I think what it shows is just how broad the spaces and how much activity is going on in the in this area

so Anna thank you so much for running this podcast series I think it's really a fantastic tool for the for the community yeah thanks for being on I do want to say one thing before we sign off and that's that we do I think as this airs we're in the midst of ZK hack which are like month-long multi-session workshops and puzzle hacking and Dan you're one of your students actually helped us with one of our puzzles this time around so I wanted to say big thank you I think by the time this airs that puzzle should have been released into the wild so if anyone's listening and wants to find out more about that kind of thing check out ZK hack I'll add the links in the show notes to that yeah and thanks so much for the the education work you do in this space because I do

feel like a lot of the people who are coming into cryptography and computer science like you're their first impression of what is going on in the ZK world and I think it's been really fun working with you on these videos and yeah I hope we get to do more fantastic likewise thank you Anna thank you Kobe cool cool thank you it was fascinating all right I want to say a big thank you to the podcast team Tanya Henrik and Rachel and to our listeners thanks for listening foreign