Episode 262: Ethereum’s KZG Ceremony with Trent & Carl

Transcript

foreign [Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online [Music] this week Kobe and I chat with Trent and Carl from the ethereum foundation we chat about their work on the kzg ceremony and dive back into the topic of trusted setups we cover what they're for how they've been run and then look at how this ceremony is different from the previous ceremonies we've covered before

we kick off I want to let you know about the upcoming ZK Summit 9 event happening on April 4th in Lisbon once again we bring together the top teams and researchers to talk about their latest work and the most Cutting Edge implementations in the ZK space so mark your calendars apply to attend and join us now Tanya will share a little bit about this week's sponsors [Music] Aztec network is building a Next Generation encrypted blockchain powered by ethereum the team is proud to announce Noir the world's first Universal ZK language Noir makes it safe and intuitive to write ZK circuits and encrypted smart contracts Aztec is now hiring engineers and cryptographers to build an execution layer enabling scale

and privacy for crypto applications join the team making encrypted ethereum a reality learn more by visiting aztec.network forward slash careers so thanks again Aztec anoma's first fractal instance namada is launching soon namada is a proof-of-stake L1 for interchain asset agnostic privacy for privacy namata deploys an upgraded version of a multi-acid shielded pool circuit otherwise known as masp that allows all assets fungible and non-fungible to share a shielded set the masp circuit's latest update enables shielded set rewards directly in the shielded set a novel feature that funds privacy as a public good visit nemata.net for more information and join

the community on Discord at discord.gg forward slash Nevada so thanks again anoma and now here's our episode [Music] So today we're here with Trent and Carl from the ethereum foundation welcome to both of you thanks for having us on thanks for having us I also want to welcome Kobe who's going to be co-hosting this one hello So today we're going to be revisiting the topic of trusted setups this is a topic we have covered quite a few times on the show I will add some links in the show notes to the previous episodes I mean I did one full episode just on trusted setups two or three years ago it's going to be kind of fun to dive back into it today we're

going to be talking about the kzg ceremony which is a ceremony initiated by the EF it's kind of a unique episode because we're actually doing an episode on it while it's running so that's a new one I guess anyone listening can actually potentially participate and we're going to find out a little bit more about this so maybe before we kick off into all of this it would be great to get to know you too Trent why don't you tell us a little bit about yourself what you work on day to day and why you're working on a trusted setup sure so I've been in the crypto space for a couple years now um since about 2016.

I used to work in architecture and design that's what I went to school for and that's my my training got into ethereum and pretty quickly fell down the rabbit hole and worked at a couple different companies like youth Global white block and then eventually made my way to the ethereum foundation where I do Network coordination or upgrade coordination so for example 1559 and the merge these are the sort of things that I'll be getting the community to engage with helping them understand what these protocol changes are helping them engage in the process things like that so that's what I'm doing day to day and then this is sort of a special project the ceremony that we've been working on since uh last May I believe cool and

what about you Carl yeah so uh I'm a researcher with ethereum Foundation mostly focusing on the proof of stake side of things and all the fun challenges that go along with it I I've contributed a lot to the the specifications that is now ethereum proof of stake and uh I guess my specialty is focusing on side projects or like not not the primary research not the the main specs uh but things that are very important to the ecosystem but you need extra work so for example the the launch pad and all the deposit flow for validators I think many people would be familiar with uh I did a bunch of work there and on wallet standards etc etc and uh now my latest Focus has been on this kcg ceremony

um and uh 4844 more generally took your forays it's like first four years into ZK land or had you been doing stuff like this before no I've I've never worked on a trusted setup before well I mean I've participated in them but not okay I haven't run one or yeah no I mean in terms of uh doing anything beyond uh having discussions um sure yeah exactly learning um the lots of discussions with uh my fellow researchers in the EF and other people in the space trying to understand all the latest protocols and how we can apply them and tweak them and improve them but I guess this is my first like output that would be meaningful to most people cool one side note like Kobe and I we've mentioned this a few times on the show

but years ago we ran a Koran I mean Kobe really built a lot of this I helped and we actually had some other folks with us as well but we co-ran a trusted setup and Kobe I was just thinking about that trust us up so this was for plumo that went on forever yeah that was like like a year wow and and like it was I think let's say orders of magnitude less participants than there are already in the live kcg ceremony but there are good reasons we can talk about that I'm glad I'm really glad we did that though I mean it just kind of gave for me at least it was like real insight into what it means to run one of these things um I want to talk about the kzg ceremony

what is this ceremony maybe starting from like a person who's potentially like wants to participate in one of these things like what where is it what is it what's the plan for it kcg ceremony is if we're thinking about it literally it's it's an event that goes on for a couple months uh release its plan to and it is literally the ethereum foundation hosts a sequencer which passes data between a number of participants they perform some computation send the data back to the sequencer server and then you repeat the process until uh we hit a time limit or the the output has been judged to be sufficient in in

some regard so that's like literally what's happening there's just data being passed around and you perform computation locally um but if you think of it more from a high level uh ceremonies generally are about coming to consensus on a process the same thread you'd see in consensus mechanisms how they're trying to come to consensus on the the head of the chain there's um people participating and there's incentives and things that people are trying to do possibly to corrupt it it also fits into that sort of area of crypto broadly where it's this group or distributed community of people who are trying to come to consensus on this in our case a string of data and so there

are a number of things that you can do to improve the the process around coming to consensus around whether this string is legitimate whether the process to create this this Randomness was credible that's maybe more of the high level perspective yeah and I think like listeners of this show I've mentioned this a few times so the thing that these ceremonies are trying to Output is called an SRS can you tell me what does that stand for the structured reference string yeah I think every trusted setup every ceremony will output something like this the SRS is meant to be public but every contribution that you just described from individuals is meant to be private yes it depends how you define contribution here okay so people add a

secret some some Randomness to the file that is meant to be private but then they contribute to the ceremony or add a contribution by mixing in this Randomness with everyone else's contributions um the way that I like to look at it which is that you know every participant gets like the current SRS right and shifts it a little bit in a way that the others can see and then if you have one that does not reveal how they shifted it then everything is secure because we can predict that shift you just mentioned a sequencer in other trusted setups we usually had something called a coordinator are we talking about the same thing yes why why the name change actually not

sure is it because they're sequencers and Roll-Ups maybe no no no no that's almost yeah okay okay after the fact I think it's more just to like not over emphasize the power that this entity has um they're not some privileged entity in the space and in essence all they're really doing is deciding who goes next so they decide on the sequence of things um coordinating sounds a little bit more like there's someone pulling the strings in the background when does this person really have well this this entity uh server already has much less power than that yeah I guess sequencer is more of a passive framing of just like okay we take stuff we pass it to somebody else we're not like I guess I mean obviously there is some

coordinating type activity happening but um maybe it's just a personal choice not personal but like we just sort of settled on that yeah actually I'd love to dig a bit more into like the role of this sequencer here because I think that in different setups the sequencer or the coordinator had different powers like you say and when we look back at the original setups like the zika setup there really was a coordinator and it was Sean or someone eventually it was Json I think and that person actually chose who goes next and that went through a mailing list and there was kind of this Assumption of if you know someone gets censored or you know if the

Google mailing list hides the messages from someone they can make in a public outcry and they can get like included in that way right and this came up to me because you were kind of equating it to consensus protocols in some like for seminology and maybe there is a bit of difference because the sequencer is even less trusted where in consensus protocols maybe you have more power to sensor or whatever yes and no um and that the one of the hard things about consensus protocols is deciding on the order of things because different people have different views different nodes have different views of the order that messages came in so it's the reason

we end up with short-term Forks on chain is because from different perspectives it might look like one version of reality and from another person's perspective another thing and they're both maybe honestly telling the truth as to what they saw happen and then the consensus protocol like helps realign things yeah and so what's happening in the case of the sequencer is we get rid of a lot of those problems by having this entity that decides who's going next in essence what the order is so they're like in some ways it's less trusted in some ways it's like really helps out promote the protocol here and like it wouldn't be a design that would be okay with in a standard blockchain consensus setting right given the amount of participants kind of already in here I'm assuming the

sequencer is automated right like it's not there is no person anymore at the end yeah there's nobody clicking a button right now except next I mean I think like right now there are like 4 000 people in the lobby so that would be a lot of clicks that would be a lot of work actually now I'm curious and we probably did cover it on one of those episodes years ago but what was the first setup to automate the coordinator was it the second Z cash one or was that like was it a later one I I don't think the second ticket was also automated actually you think that might have been manual as well I think so I believe ignite must have been examinated right I think ignite and uh tornado okay a

tornado for sure because that was like a two minute one online yeah right were there any others that you've looked at while designing yours we did yeah yeah that was because I was completely coming from you know starting from zero so I did quite a bit of research um I've probably forgotten a lot of the like little details and specifics but yeah that's what I did uh mid last year was kind of trying to get an overview of of everything that had taken place before interestingly this isn't one of the things I looked into as whether the sequencers are automated or not okay it's it's been interesting is like lots of these details aren't super obvious in some of the previous ceremonies it's really hard to find all the specifics yeah yeah even just some Polish

questions like how many powers or like exactly what the calculations look like those kinds of things you've got to go digging in code and old GitHub repos and that kind of thing in order to to understand this so in some of the later ones or like the more recent ones there's sort of this like parallelization this is what in the Puma one that we did we had like multiple participants running it at the same time and I'm just wondering with the one with the kzg is this fully like sequential as someone's contributing their entropy and their contribution you cannot have anyone else contributing at the same time well so they can generate the entropy beforehand but doing the computation has to be sequential okay so it really is like basically there's a

participant adding their contribution sending the Baton the sequencer then sends it back to the next participant and that just continues yeah so and we can get into a bit of the design philosophy later but um what what some of the other ceremonies have done in the past is say you have a thousand points to calculate yeah you do pipelining so as you process the first hundred points you send those back the sequence of thoughts verifying those and passes those on to the next the next participant so you don't like although it's a sequential process you can sort of break up that sequence but a little bit of the way we've tried to design the ceremony and some of the fortunate things we've had around the requirements of the ceremony means that the benefits would get from doing that are relatively small we gain other

things by not doing so yeah actually in Plymouth we did even something a bit more complex where you know one participant Works let's say on the first chunk of the ceremony and another works on the second chunk and then they switch places and then that one works on the first thing that the other one works on the second so it's like how to further execution but like we can talk about the parameters later but yeah in the kcg ceremony like it's so fast how much time does it take to contribute even it's not really useful to do this chunking no that's uh that that's exactly it so I mean in in browser we have multiple implementations of the software you can use to contribute um the the one in the browser wasn't

blob running rust code under the hood that takes something on the order of 12 15 seconds wow and uh if you if you do it from from a CLI on my machine some of them are sub one second to contribute wow I don't remember exactly how to word this but when you talk about this very short duration I'm assuming this has something to do with like whatever the size of the circuit or thing that you're using this srs4 is smaller and I realize I might have worded that wrong so yeah why why can it be so quick so in this in this setup we don't actually have a circuit because this is not a traditional ZK application and said this

is just a commitment scheme so we need like almost the precursor to before you you put it in a circuit we'd literally just need the powers and by Powers here we mean uh some Secrets secret squid secret cubes uh literally black Powers as you think in high school math and fortunately the way this the East kcg commitments scale relative to our needs and relative to the needs of eip4844 means that we only need very few Powers so um some of the previous ceremonies which have been for ZK setups have had for example two to the 28 powers in our case the setup we really need only has 2 to the 12 powers so only 4096 pounds of tar there were also I mean there was a

really complicated setup where like for Elio where they did different setups for different parts of a snark in this case is it just a single setup for a single part of a snark or will there be like a second one is there is this one in a few that's what you'll usually see is like a phase one and a phase two and Carl correct me if I'm wrong but I believe we're just doing the phase one there's no circuits that happened in the phase two ceremony so like in many other trusted setups you would do basically first a powers of tile setup or something very similar and then you would fine-tune it after that to be specific for your use case depending on your proving system um in the case of the kcg commitments we

don't need that second phase we can directly use the the piles of Tau one one question is why do this setup like there are a lot of setups that have been done there's srs's that other projects could potentially use so like why do a new one is it so unique does it have something some characteristics that the others don't I think an important thing to acknowledge here is no one I mean asideful it's about a bit fun you should really avoid doing a ceremony it's like always a a potential point in the protocol yeah exactly yeah but sometimes the the things that the the setup enables because of the the algebraic structure that you're creating here means that we can do many great things in cryptography

later uh what we've seen is there have been many other there have been other setups in the past not specifically for example for the curve we care about so ethereum already uses BLS 12 381 as its curve for BLS signatures for validators in ethereum proof of stake it's already in a lot of the clients and we have really robust implementations of the software we've done some optimizations under the hood where we care very specifically about having a set number of points so lots of these these previous Paths of tile setups have for example 2 to the 20 odd points and we specifically can have in the case of what reason for 4844 um

initially is 4096 points if there was 4097 points there are actually ways we could break the cryptography um and the reason this is true is we're skipping some checks so um one of the things that you see happening a lot in improving systems and uh within in the ZK setting is called degree proofs which is you basically checking that a polynomial is only so big that there isn't more data hiding somewhere or that this is the end of of what was committed to and the way we we ensure that this is the end you instead of checking you can you can prove it's the end but instead of checking it's the end we just like there are no more points so instead of having extra points where you could cheat the

system you run out at 4096 and then there's no we don't have to do it this proof every time we need to use this commitment device that's a really good point because like when when I'm reading papers um like let's say all the new lookup arguments they sometimes let's say skip the part where the a degree checks because they say you know you have a setup of the required size of the size of the table that you have and this is basically exactly what you say here you don't need to do the rechecks if that's all you have in that case though is the output of this very much only for the use case you have in mind or could other teams use it other people could use it but it's going to be unlikely to be useful outside of a kcg commitment I see

set up you're not going to use it in a general snack just because it's too small unless you have some very tiny snock you wish to use it for because of this optimization uh because we've done this there isn't actually one set of powers that we're calculating so the ceremony if you if you dig into the files or the specifications it's actually Four ceremonies pretending to be one yeah where we we're running four mini trusted setups for different numbers of powers so uh two to the 12 which is four thousand ninety six two to the 13 2 to the Fourteen two to the 15 powers and the reason here being that if 4844 ever has larger demands down the line we can then change the the setup we're using to one of these other ones which

we've run where we have more piles available but again run out exactly when we need it to run out so we can skip these degree proofs but by having these four ceremonies and one we sort of like cheat and get around these possible Futures yeah you wouldn't have to rerun it then like you would be able to use these outputs for the future okay yes yes and this is I mean I would say it's updatable but that seems a bit ridiculous to say because it's almost trivially so we can always just there's very little that's going on here um and relative to some of the other requirements you might need for a snark setup or something like this this really is a trivial construction I think the other reason why it's important for us to run our own ceremony for example if there was something else that could slot

in exactly if another blockchain had run something and it happened to fit our use case exactly I don't I still think we would want to run our own for a couple different reasons the main one being the ethereum community possibly hadn't participated in that ceremony and so the trust assumption is you need just a single honest participant but if you as a you know General member of the ethereum community didn't have an opportunity to participate you have no way of verifying that the assumptions of how these this other ceremony was run you don't know necessarily how the code was written not that anybody's really necessarily digging into our setup um but they at least right Kobe is but the average contributor is just opening the

browser and they you know they'll add their entropy and then go on about their day so yeah this goes back to the idea of like building consensus and specifically in the context of a specific community so everybody has the opportunity to actually participate in something that's going to go directly into the protocol and you can be sure that if you're using ethereum if you're in uh using the ethereum network that you can verify that your contribution was included and at least you know that you were honest and you discarded your secret that's another reason why I think it's important yeah that actually makes sense so it's it's funny we we have not mentioned the term multi-party computation yet um but just for listeners who are

familiar with that that is what this is and that's that idea where if one participant is honest then one can be assured that the output is correct or is protected but in your case would you I mean you you kind of mentioned that you felt like the ethereum community had not been able to participate but like tornado is pretty ethereum focused I guess you weren't able to use the output of that anyways so you had to kind of redo something like this yes I mean it ties into that um I think many of us have participated in these these previous ceremonies not only for ethereum but for other chains and protocols um but uh not I think many people in The Wider Community I think is is one of the issues here and then the second thing is again because we have

this like very important trust assumption about the running out of points at precisely the right time if we use another setup that is longer and we use it as a start right we build on top of it which is something you could do for if if they had an updatable setup or something like that um if we were to use that and their ceremony was bigger then that violates our trust assumption already so like it's already not particularly helpful and would already allow you to like it's not adding anything if you can't verify that it has this property of running out of points precisely when you need when someone dishonest would need them yeah I I I would maybe challenge that a bit in the sense that you could always like take a the chunk that you need and build a top of that and then you would gain

something and yeah I think those are all like extremely convincing points to me yeah no it's it I agree it's not quite as simple as that we we actually spent lots and lots of time debating this over the the previous few months as to like where should we start uh for some of these exact reasons but it's also easier just not to have any questions about whether these like funny numbers come from or whatever like the numbers when the ceremony started uh every secret was one that's perfect and you could check that yourself as like yeah it's it's easy to to have that argument nothing up my sleeve right yeah exactly also compared to other setups I think that the kcg ceremony team or group that was working

on it with a lot of emphasis on creating multiple implementations or like creating a spec that anyone could implement and that also seems like a really appealing point in enhancing the trusting ceremony right I think this is something we've done that's quite radically different so with ethereum proof of stake this was all written with these the specifications first and so there wasn't any like more enshrined client of of any of the others or that kind of thing myself and many other researchers at the EF and our ecosystem were writing specifications and then other people implemented those um and we learned a lot from that and from the perspective of how it enables more people to a easily understand

what's happening which I think is important in a proof of stake or in a consensus protocol but also really important for these ceremonies you can explain things in normal natural language you don't have to implement optimizations in these specifications it just says like here's what you need to do which I think is really beneficial and then the second thing is this allows for a lot of clients to exist so we started the ceremony like there was no no other code asides for like what the specification said so we started this this whole idea with with the specifications and from there like encouraged many people to to write to implementation so uh from almost day Zero we had multiple implementations of of this code and like we're seeing more and more pop up as this the ceremony

progresses so we're really trying to encourage more people to write is there a GPT based implementation yet not that I know of okay that's quite unique for these types of things is it the first time that that happens that there's like multiple clients or multiple implementations of a trusted setup software it's the first time where they've been multiple to my knowledge at least it's the first time they'd be multiple viable implementations in many other cases they've been people who have modified one of the other clients that exist or written their own crypto components or sometimes even reversing engineered and written their own implementation to like help convince themselves that this is secure under

like similar premises but I think this is the first time where it's been this like multiple Client First approach where there's like there isn't a canonical way of approaching of contributing or anything like that we really want people to sort of find their own path a little bit here and ideally have as many different clients implementing the software as possible it sounds so directly inspired by just the way that like the POS the mer like all of that had happened where there was multiple client teams building off a spec sharing knowledge is that sort of now built into the philosophy of a lot of builds like this if a community if the community has to come together there's always going to be an attempt to get a lot of different teams building the same thing I think it's

um it's definitely a good thing to aim for uh and we'll probably get into this later but we're also very lucky that it's pretty straightforward and simple to actually write an implementation um okay for example like or we might talk about like how many contributions we have currently and how many we expect in the future a lot of this comes down to the fact that it's a very small amount of computation that you have to do similarly creating a client implementation is I mean Carl has said like you could do it in an afternoon I don't know if it's that quick but it's it's a lot faster than writing you know some of these other multi-phase uh ceremonies got it how many contributions have there been so far and how many do you expect maybe we can actually talk a little bit about like what you've also

learned along the way what's what's worked what broke I'm really curious to hear so uh I have the dashboard up here as we as we're talking we have just under 7 300 total contributions uh okay which I think might make us the larger ceremony ever so far already in terms of number of contributors I guess yes right yes yes absolutely in terms of number of contributors I think we did the longest running possibly um yeah like the biggest care you know forever and while we're while we're like going through this and I'm realizing like oh you know we have a ton of contributions but it's not necessarily you know you

want to be able to compare these things Apples to Apples that's what I was thinking of like is there a metric where you can combine like the total amount of compute time and the number of contributions because you know yes it's nice that we have a really large number of contributors but we're we're just lucky um that it's it's a tiny computation um so you know other ceremonies it's super impressive that they've been able to get the number of contributors that they have with you know when they're passing around multiple gigabytes uh and you have to schedule it's much much more intensive for us you know we just have this website and people show up to it so we're very lucky in that sense yeah but you are right like that uh you know in

the amount of trust that you need to have in the ceremony is is much less because you know like you say you know just need one honest participant and if you have seven thousand already then you're really in a good shape so that's nice yeah I think it's it's actually something that's changed over the years in terms of like what ceremonies mean or what Trust of setups mean and that's the emphasis on how much trust is needed um in the beginning there was like it really was trust the six people in a room yeah um and now we're at the point where it's like trust seven thousand odd people and I think that's that that's got a very different meaning because at this point like it's it's not that you have to trust someone to do the right thing it's that you have to trust not everyone to

have like pulled apart the code and like figured out how to extract the the secret themselves because like most these implementations don't just show you your secret they like do some extra uh hashing and and Randomness mixing etc etc so it's like many extra steps and like after that you need everyone to collude so already at the current point I feel like we're getting very quickly to the point where it's like it's not really a trust thing and the it would be very unlikely that everyone were to get together to to to reconstruct the secret and we're shifting to a realm where it's more about like are there common bugs in all the interfaces or uh is there a mistake in the ceremony in the cryptography something like that it's like the the trust model is has changed a lot over time

and I think that's why I mean crypto our industry is notorious for redefining existing terms or you know misusing existing ones but I think that's why we've chosen to lean so heavily on ceremony and not trusted setup because this is very different from whatever the same this ain't your daddy's trusted setup kind of thing of like this is very different from six people in a hotel room in Colorado uh this is everybody can participate It's relatively accessible you just need a browser and some time to keep checking the page tell me about like some of the learnings like the participants like I'm guessing they're creating entropy like you said kind of Randomness on their own are there any like cool examples are people

meant to share this somehow like how they got it obviously not share the random number but like share the their method so the interface uses we've gone a little bit beyond what's like the base case the bare minimum of what you would need so we have three sources of entropy if you're using the the web browser so you're moving around your mouse and the the interface is taking snapshots of your mouse cursor at certain points in time you also input some text entropy and we encourage people to either do keyboard mashing or include random characters so that they don't remember it and then the last one is the browser actually generates it locally generates some Randomness

locally in the background so you don't even see this part of it so maybe we'll get into exploits later but if somebody really wanted to compromise their contribution they would have to pick apart the interface and and withdraw or like take out all three examples of of entropy that they've crafted the sapling setup had I always reference this example of they they went up in an airplane and measured radiation from the Chernobyl piece of cloth which is very evocative and like really awesome we're not expecting everybody to get to that level but yes we we are seeing a couple cool examples um like somebody is making a cat toy and then playing with it with their cat and then extracting the randomness from that

cool have there been any hiccups in the rollout of this no in general it's gone fantastic like really that there were so many ways that this just just hiccups so I mean we've tested this a bunch locally and it's been audited uh separately by multiple people but it's very different that from actually testing it with thousands of people actively trying to get involved so from that perspective we're really happy um one thing that has been interesting to see is we've employed something a little bit different to most ceremonies and um that's there's an acute to participate so when you would like to to join use your whatever interface you're going to do it be it the one of the hosted websites or you the CLI interfaces etc etc and you sign in with even a theorem account or GitHub address a

GitHub account and uh from here you go to contribute and you get put in what we call the lobby and the lobby is you and everyone else who's trying to contribute at the same time and then what everyone does is it says like to the sequencer hey how about now like can I contribute and the sequence is like nope someone else is already contributing yeah cool and then you come back 30 seconds later and you're like okay what about now and so everyone is like constantly asking the sequencer if they can have a turn to contribute um and so the I think a lot of people have been butting up against this thing where there's this this notion of a Lobby where you can be in it for quite a while where the lobby is like as you're

currently speaking is almost 4 000 people trying to trying to contribute next and you can be in quite a while waiting and it's not necessarily a cue so your weight doesn't necessarily get shorter over time um it's like a constant chance of you being included to to contribute next oh wow okay like the people in the lobby are not in order they're just right pinging randomly and one of them's gonna get accepted so there is a chance that you just enter into the lobby and immediately get to contribute yeah and we've had people who like who like so we've had a bunch of people complaining because I've been in the lobby for a while and then others would be like oh I just rocked up and it was like a five minute thing thanks this is also great a range of experiences okay yeah yeah at

the managing expectations around that has been I I think something we could have done a bit better um and explaining what's supposed to be happening and the fact that waiting here is is not something that like if if the Lobby's big you should just go away like come back later um yeah that's that's not nice to hear but that's that's kind of just the way these systems work um and I think this has been the source of a lot of frustration for a lot of people and then the second thing is like the way most people seem to be contributing um because it's just the quickest and easiest is via the the website hosted at ceremony m.org because that's a browser implementation browsers aren't used to like constantly staying online and like speaking to another piece of software in this case the sequencer so when like browsers don't

aren't very good at regularly checking in to be like asking at the appropriate time like hey can I contribute now so we've had some like desyncing errors or like the computer puts some tabs to sleep or something like that so we're still trying to like get to the bottom of of all of those in terms of uh what's happening there and that's like accentuated by the fact that you could be waiting a while because this Lobby is currently pretty big with lots of people trying to try to get in has the sequencer had any trouble like could the sequencer go down at some point and need to be restarted I really hope not okay that would be bad yeah yeah I mean it would be bad from like a ux perspective and a thing it has it hasn't gone down and we've like rarely chose a a beefy

machine to to run this on okay um when when we're discussing like what resource do we want to us like basically what's the the fastest machine with the most cores crazy amounts of RAM and and the best guaranteed internet connection you can get so it really is a powerful machine so we haven't seen anything there but like one thing we have found for example is the upgrades like so the sequencer we can improve the The Experience so right now if you have one of these hiccups with your browser or something like that you get logged out and you have to go back back to the start and like sign in with ethereum again and that's like not a very pleasant process so one of the the upgrades we have in the pipeline is to basically be able to keep you logged in so the sequence will

just Mark you as being in an idle state and then when you start your browser comes alive again it will then like take you out of that that idle state which I think will be a lot better ux for for many people does the browser have to be open and visible and that you have to do something once you get into the position to contribute or is it automatic so that's all automatic it happens in the background but exactly like what the browser needs to do we don't really know because different operating systems and different browsers do different things in terms of putting tabs to sleep I see I see okay so like I would recommend having it like maybe in the corner of your computer or like something like that and like checking in on it maybe yeah trying to open 20 tabs in front of

it but I mean again if that does happen and your browser does go to sleep we can always uh bring it up again but I mean yeah so so one of the things I was trying to get to earlier is like in terms of you're asking what hiccups of the sequencer is in order to implement this change with a sequence that doesn't immediately lock you out we're going to have to restart the sequencer which is going to kick everyone out of the lobby that's what it would do okay yeah so it's like a little unfortunate that like it's going to be if we're to do it now 4 000 people who have to like leave and come come log in again um but again these are like some of the small changes we might have to to to to make to make everyone's ux a bit better

yeah so the logging out thing happened to me a few times already and because they always have to move my my computer around and like change tabs so just before this episode started I started waiting again so maybe I'll get lucky and during the episode I'll be able to contribute that would be cool Kobe wants to speak to the manager yeah aren't I'm doing that right now the best we can say is just wait a little bit longer fine so I have this question I mean when I was putting together questions for this I thought of asking if this has anything to do with this on-chain ceremony that

we had talked about on a recent episode with danbone where the sequencer or coordinator is actually on chain as I remember correctly yeah and as far as I can tell this ceremony is not that right it is the sequencer it's still like like you described like it's a beefy machine it's a one it's one machine it's not like a decentralized thing yeah so the this is entirely off chain and and uses like more traditional web constructions uh for for making all this happen um the reason this the idea of an on-chain ceremony is possible is because again the sequencer's role is just to decide on the order of things and to decide whether someone's contribution is like actually a valid contribution they didn't just make something up and say

flower when you expect a set of points so you could do this all on chain and submit it to a Smart contract or you could to come up with all sorts of fancy constructions for verifying this whether the chain data basically serves two purposes one is verifying that things are done correctly and the the second is making the data available to everyone so that it's you're able to just download it and use it when you want but the reason this is not super useful in our case is that our ceremony is sort of just too big to be able to to fit on ethereum right now okay too big in terms of participants or contributions too big in terms of like the number of points oh still okay yeah so there are ceremonies like super tiny and like we keep getting all excited about this it turns out that

like if you look at ethereum ethereums it's like even more slow then the sequencer is Tiny although the ceremony is Tiny okay they would have overloaded the gas limit right yeah so if we just do like the call data for 4096 points it's like just bigger than a full block and I mean like four is in 1559 for like 30 million gas in a block so it doesn't fit in a full block uh which means like the cost of contributing would be very high and and we'd be taking capacity for the entire network for yeah four months which is probably not endearing to people would this Ceremony be able to be run on a Roll-Ups then like or on another L1 like where it isn't a

constraint possibly um and this is actually one of the really fun fun things I realized a while ago um and that's that so the thing with Roll-Ups is they they need this data availability they need to to guarantee this data and that's in essence like they they need to put this data somewhere and that data in in the case of ethereum um is on like the ethereum base layer and that's like the whole point of this this junk shotting and 4844 approach is to provide more space for that but if if we just use ethereum as it stands now the Roll-Ups run into the same problem where it's like if you were to use a roll up it could do the computation really efficient but the data itself still wouldn't fit inside a single block but if we had 4844 deployed then we would have the space to do this so it's

like a recursive problem like how do you bootstrap uh having enough space to to stop this so in the future if we were to like rerun the ceremony there there is a chance we could do it on chain assuming that the Roll-Ups weren't using all the space etc etc okay I think this is actually a good point for us to start talking about like why you're doing this ceremony at all you've mentioned this eip4844 and I'm assuming this is what this enables but yeah can you explain what that is and how you need this SRS like why you need a trusted setup to enable that or to work with that so to understand EIP Voyage before you need to understand like ethereum's vision for scaling moving forward

l2s are the vision we see for ethereum moving forward in terms of providing a lot small compute to to for everyone to be able to to fit their transactions and nfts Etc on chain but computers useless if we don't have the storage to back it up and l2s have this problem where in order for like their trust assumptions to remain true in terms of like uh what happens when there are malicious people malicious sequences on l2s or something like that this data needs to be provided somewhere else and it needs to be provided with a level of assurity that a sequencer on L2 simply couldn't provide so what the sequencer and L2 sequencer

does is they take all this data and they put it on ethereum on the ethereum base layer on ethereum L1 and this works great but now we're having these like l2s massively scaling the compute for ethereum but they're starting to run out of space and the costs then for the the l2s be they ZK or optimistic the cost for them start rapidly growing when they have to put more stuff in the blocks than their space in the blocks etc etc so the idea behind Proto dank sharding also known as eip4844 is that we have a bunch of data next to the ethereum chain that is broken up into blobs and we call them blobs because from the chains perspective we don't really know

understand and or care what's in them uh but it's just an arbitrary amount of data and eip4844 uses kcg commitments to commit to this data so that it is a like we we have a proof much like you could use local trees for state and traditional blockchains uh or ethereum right now you do a similar thing but with this new commitment device and then later on if anything goes wrong with with the roll up the the roll up can prove things about this data so these blobs make this data available to everyone so data availability is something that's discussed a lot so the validators are looking at the current state of the chain check that the data really is in these blobs and that they

were able to download it it's available for everyone so if you're using an L2 you want to see that your data made it into one of these blobs and you can download The Blob yourself if you really want to make sure you have it and then if the sequencer on an L2 tries to cheat you or ZK proof fails etc etc we can go back and find out like here's the data to prove what did or didn't happen um and that's sort of the the vision for scaling ethereum now yeah I want to ask you something here first I want to just get a clarification you said the kcg commitment is that what you called it like yes so you said the kzg it's like like this whole ceremony is for commitment so it's not for snark is it or is it a snark like I think this is

where the the terms you're using I'm just curious if it's like in this case the ceremony the whole thing is it just for this commitments and it's not really a full snark it's not a stock it's it's purely for committing to data okay so you could view as a snockers committing to computation yeah in some ways um and this is doing a similar thing and the reason we use this over like some of the other commitment devices that we've we've seen as us uh saying earlier local trees or maybe some local trees wouldn't work for example because uh they become quite expensive to prove in stocks so if you have ZK Roll-Ups now we're trying to offer them this data if they can't prove

things about this data it becomes very hard to reason about um so that's why these kinds of hashes wouldn't work we could swap out a Shaw hash or something like that for an arithmetic hash which would be more favorable inside a snock but then one of the other requirements we have is with a full of like future visions of where we'd like to take all of this uh all these data blobs is to take them and extend them out using a ratio coding so we take each like each amount of data and we like massively extend it and we commit to that extension and the way we do that is by putting a polynomial through it and this polynomial happens to use the we can use the same cryptography that kcg relies on

under the hood which is also like comments based on a polynomial hence why their their powers in the powers of tile that we're using right and the like a polynomial cxx squared whatever it's the same thing we have that of the powers and these piles of tiles so that's like the sort of commitment device that we're building here and the fact that there's this like Synergy between of like future Visions for how we would like to commit to data and extend this data and ultimately do data availability sampling which I can touch on in a moment it would require this these polynomial extensions anyway so we're using this cryptography or similar things anyway and then that's really just like is a cherry on top that is the same thing and works really well with that yeah so actually I have a question about 4844

itself because you're creating kcg commitments on bills 12 381 and you put it as data blobs that are not easily accessible to the rest of the chain or to Smart contracts and others and also like there are no pre-compiles to use BLS 12 381 like there is this long-standing 2537 I think that wasn't deployed yet so how can people actually use 4844 on channel is this purely for data storage so I mean the answers that we need to get we need to get that EIP merged or included I think everyone's on the same page there it's just hasn't reached the

topper priority list of client developers because it is very useful for that also for verifying the signatures we have and could be used for some other fun cryptographic things so definitely need that the way the 4844 Vision Works is sort of twofold it does it does two jobs one is first making sure that data is available to everyone yeah when a new blockers proposal all the side data all the validators go and download it and check that it's available and only if it's available do they attest to it which is like part of the roles of a validators or testing to two things um and so this allows us to like ensure that this data is there and allows like end users to go download this data but then in order to like prevent the state blowing up for these validators

otherwise you just have like more and more data you have to look after these validators are actually allowed to forget this information after a certain amount of time so you can just delete blocks that are older than a certain amount of time this allows the validators to have a constant sized database that they care about for these these data blobs and then users must download this data that they care about and the sequences on all these l2s will download this data and then the the second role here is like if something goes wrong in um in an L2 and we need to start having fraud proofs or like we need to have debates basically and and resolve things um as to like what what reality is uh things need to be then proved against these kcg commitments yeah so if I say

like something went wrong and the sequencer stole my money or something like that I have that the transaction I downloaded a week ago whenever when the transaction actually happened and I saw that that data blob go Unchained and then I go to um if they're a main chain and I say here's the data I would like re-provide the data because the chain might not have the data anymore I re-provide the data and at the kcg proof that this is the correct data and from there we can verify like this commitment was correct and like resolve this conflict so the only reason correctly in that case that um like 404 I think I saw that it includes like a point evaluation pre-compile yes that's correct okay cool that's because I think I think

I saw that the scroll team was planning to use this like they wrote a blog post about how they would show that the commitment that they get from their snark which is on bn254 and the commitment that you get from the data blob that would they would use this proof of equivalence to show that basically they committed to the same data which in their case would be a list of transactions do you know if that's like the common use case for for roll ups how far to use this like to show that the list of transactions were included or or the data in transactions I mean so from a black protocol designer perspective I get to like wave my hands and say like that's up to the Roll-Ups but uh my understanding of the the landscape as we speak is like yeah

that's that's basically what will happen um and like what what is the intention of of many many things it's basically a list of transactions okay cool and potentially the proofs to go along with them in the ZK setting one of the the interesting things is that when like based on ethereum usage right now there's going to be so much data available when 4844 launches that we're expecting people to just do silly things and like throw memes on chain just because you can because data is going to become really cheap again I mean it'll be temporary until until roll ups scale to use this but uh it'll be fun to see that landscape play out going back to the the ceremony I just wondered what happens if and I know like there's over already 7 000 participants everyone's

created their own they've added their own entropy but what if somehow the toxic waste of this ceremony was discovered what could anyone actually do so you talked about it's like it's for kzg commitments like what could it break what could some malicious actor actually do if they if they found that collection of entropy that you're not supposed to know the private stuff right maybe I can just the context is like they would have to extract every single contributors I know all three forms of interesting people it's very unlikely if they did they could Forge fraud proofs I believe uh for l2s committing back to L1 and that would be bad this would only work

for like the optimistic type thing things or is it if the toxic waste is discovered it allows anyone to make like arbitrary arguments about what data was committed to in 4844 in these data blobs and so in the context of l2s this could mean that you could lie about the transactions and with optimistic relapse you could then say that different transactions were included and no one would have any on-chain way of proving that this wasn't the case and in the ZK setting you could say that oh like maybe the the ZK has like here's the proof that they committed to you could say here's a different proof and submit it and it would like also be look equally valid to the chain so like you lose the ability to like uniquely commit and

prove to things that that happened so it really becomes the Wild West in terms of L2 like data security after that point now at that point we require social recovery to to get us out of that bind because that's like is really terrible from an LT standpoint okay yeah exactly so I think like maybe if we could invade the scenario even for zika roll up you could lie about the the fact that the data is available and you will not be able to replace let's say the sequencer or others and people's money might get stuck until you've like figured this out socially so the data availability is an interesting one because that's that's the job of the validators and so like they would still you still have to be

providing data to them you could be providing fake you could lie about what the data really is and change the data after the fact but you still have to provide data and when we switch over to full dunk sharding um then like every node on the network not only validated would be sampling this data to to check that it's actually there so one there is one case that I can go into obviously it's it's very unlikely that everyone has leaked their entropy and you know decided to collude and corrupt the ceremony but there is a case where uh you know we go through these this many months of contributions and then there's a final output and then Carl turns malicious or something and decides to you know output this faulty or corrupted version of the ceremony

which he claims is a ceremony but actually isn't and then you know in this scenario the client teams are also like we trust you Carl good job thank you for this output and then they put it into clients without doing diligence so one small step that we can take in advance of this actually being included into clients is this social signaling around okay the ceremony is done everybody is going to signal that they've run some verification script that this is the output that we're all expecting that we were all included in and yes okay we're all thumbs up good to go and my contribution is actually actually in this transcript so that'll happen you know after this special contribution period or sometime sometime between the end of the ceremony and before client

releases are actually cut for whatever the upgrade is that includes 4844. so that'll be really important when it comes time you can do this now but you're you're checking it against the current state not the end state of the ceremony so when that time comes I encourage everybody to you know not just do your part of contributing to the ceremony that's that's step one to step two is doing this uh run a script locally and okay yes I've verified that my contribution is included interesting and but participants don't have to this is more just like you're going to encourage a lot of people to come back and check it right you don't have to but it's sort of part of this whole like Carl mentioned earlier of like once we get Beyond you know X thousand

participants you're only improving the The credibility of the ceremony in small degrees and this is one way where you can improve The credibility of the ceremonies having many people attest to the output of the ceremony as being valid and credible and legitimate cool one of the cool extra things here is that because we're using people's ethereum addresses to like verify like as some kind of anticiple attack mechanism we have a built-in signature scheme as in you can sign messages with your theorem account and using this like you sign your contribution as well so you could see that like anna.if was contribution number six seven whatever and because

you can verify this and there's a signature there as long as I trust you to also have control of your theorem account I can verify that this was your contribution so it's like additional levels of verification that we have built in here which is what we sort of get for free by having people use their ethereum accounts do you think there's a lot of like farming happening this seems to happen with a lot of these projects where it's like even if there's like no promise of an airdrop no sign of an airdrop there's nothing but people are just like jumping in in mass and so they won't just run once they wouldn't just like run this once but rather run it like I don't know 100 times are you noticing this is is there anything you can do to like stop that a little like

I've seen a couple indicators that maybe some people are you know pursuing that path um at the end of the day it's all good entropy this is all stuff that will only help the ceremony unless it's like uh you know somebody colluding with this specific intent to you know keep around their secret and then try and corrupt the ceremony later on did notice a bit of it it seems happened with the recent namada ceremony yeah um we'll see if that ends up being the case for ours it's definitely we weren't expecting this level of attention this early so this kind of plays into the issues of like we have some troubleshooting and and the lobby wait time is really really long it's a good problem to have uh but we definitely

weren't expecting this amount of attention you know in the first three or four days by the way I don't think it happened with Nevada but I think it it like people were trying to right right sure yeah theirs is actually quite coordinated like yeah yeah yeah they had tokens and things but the the other Safeguard we have against this is that we do have a cutoff of uh you had to have sent if you're using ethereum addresses your anti-sibil login um if you had made three trends actions before Friday last week the 13th that's that's our cutoff point so you can't yeah yeah right you can't just start like farming a bunch of addresses now send a bunch of transactions and then uh use that as a legitimate account um so

there is we do have at least that Safeguard okay however that won't stop somebody who's been doing stuff like this for years right yeah if they've been farming they're gonna you know they'll have it they'll have it set up this is something that we've known and expected um and part of like the discussions that trench and I've been having again have happened off the Lost while with the community is like what where do we set these constants at like how do you decide that like having sent three or four transactions in the past is the right number the decision here was to rather keep it on the Lower Side to be extra inclusive and have more community members particularly people who may have only joined after the switch to proof of stake for moral energy reasons or something like that like just to try and

like have as many people contribute as as possible at the cost of having more people like potentially try just contribute multiple times etc etc and we're like very okay with that and that's part of the design of the ceremony rather on that direction than excluding people um from from participating cool I was looking around at the Json that the ceremony sequencer returns and I saw like parameters that they were wasn't expecting so you mentioned that you know you bundle a few setups in one here actually but from what I know if you do like kzg and you skip the degree text and you don't need more than one G Point

let's say in every setup so how come you have 65 of them in the ceremony you're right we don't um it's it's more of an encased thing they're so cheap and almost free to include like 65 is such a small number of of G2 points that we decided just to include it in case someone finds a use for it later so what what 65 points are there like you have thousands of G1 and 65 G2 so what what is the structure of those it's the same powers of Tau so it's just reflecting those uh increasing increasing Powers just in G2 okay I mean they're just like so much less right yes yes yes yes but again we as I say we don't really have a use for them it's

just in case we decide we could do something fun with it later or in case someone else comes up with a use case very interesting cool so you've told us that like the plan for this is a couple months and then it would be included in the next update but like what is the time frame for four eight four four like what do I'm maybe you don't want to predict it here but like what's the larger trajectory and roadmap for this yeah giving giving timelines always backfires but um withdrawals is the next main focus and that'll sort of complete the loop of proof of stake and give us a full proof of stake functioning system that people can enter and withdraw the validating participating in validation but once that's done and you know there

are devnets currently and client releases hopefully in the next few weeks and then it'll move into testnet upgrades things like that once withdrawals is done within the next few months then a lot of people have signaled that they're very interested in seeing 4844 be really hardened and implemented in clients you know there's there's already a ton of ongoing work currently so one thing that we've been really fortunate to do over the last year or two is start to develop parallel tracks of for contributors so the merge was ongoing and people were already working on 444 same thing with withdrawals getting the initial spec going so forward 4 has been in development for a while in terms of like ideation and client prototypes things

like that it's really exciting to be working in core protocol ethereum at this time because we can start to parallelize these these massive upgrades and big changes to the protocol that will bring significant benefits so once withdrawals is done in the next uh I won't give a date for that either but uh the big Focus directly after that is the next upgrade Cancun that's what it's called pessimistically that would be Q3 of this year yeah okay so I want to say thank you to both of you for coming on the show sharing with us the kzg ceremony how it works what it's for and how it's going yeah thanks so much for that I'm still in the lobby the the just it only got larger

oh man I'll see what we can do I'll pass along your request no it's fine I'm I'm happy to wait the lobby seems to be most empty at midnight UTC yeah and it slowly you know I think we've peaked in terms of attention these first few days and it's slowly balancing out but that's still like several thousand people in the lobby so maybe wait a week if you really don't want to like babysit your tabs and then you'll have a better time of it sounds good thank you for having us yeah been fun we should also give a thank you to everybody else besides us who worked on this this isn't it's not the the trending Carl show um there were probably two dozen people involved in various aspects of this um and the project wouldn't have

happened without them contributing to the front end the interface working on the actual crypto that that runs in the background working on the sequencer that the people that worked on the audit so I I won't list them all because I'll probably forget somebody but a massive thank you to everybody who put in time and love into this this project cool all right I want to say thank you to the ZK podcast team Rachel Henrik Tanya and Adam and tour listeners thanks for listening [Music]