Episode 334 - ZK Research Update with Joe Bonneau

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week garmo and I catch up with Joe Beno assistant professor in computer science at NYU and research partner at a16z crypto research we catch up on the work he's been doing since he was last on the show specifically we cover the naysayer proof work ZK middle

boxes sealed bit auction and other ZK related research projects that he's been working on now before we kick off I just want to highlight two events for you first ZK hack Montreal the IRL hackathon is happening very soon on August 9th to 11th we will be building the next generation of ZK applications in Montreal applications remain open if you've started your application and have not submitted it be sure to get it through and if you've gotten accepted be sure to RSVP so we know you're coming so yeah hope you will join us the second event I want to highlight is ZK Summit 12 happening in Lisbon on October 8th the application to speak or attend is now open and it's good to apply early if you want to be eligible for the early

bird tickets also if you want to speak be sure to apply before August August 15th because that's when I'll be closing the speaker form so yeah I hope to see you at both of those events all the links are in the show notes now T will share a little bit about this week's sponsors attention all projects in need of server side proving Kickstart your rollup with galot ZK Cloud the first ZK optimized decentralized Cloud its flexibility and customization supports any proof system such as sp1 polygon risk zero or ZK sync at rates 5.8 times cheaper than AWS with two times the performance get started with a free trial plus extended grant opportunities for Premier customers until q1

2025 in addition Gala is currently onboarding institutional prover node operators register at gal.com so thanks again galot Alo is a new layer one blockchain that achieves the programmability of ethereum the privacy of zcash and the scalability of a rollup driven by a mission for truly secure internet Alo has interwoven zero knowledge proofs into every facet of their stack resulting in a vertically integrated layer one blockchain that's unparalleled in its approach Alo is ZK by Design dive into their programming language Leo and see what permissionless development looks like offering boundless opportunities for developers and innovators to build ZK apps this is an

invitation to be part of a transformational ZK Journey dive deeper and discover more about Alo at al.org and now here's our [Music] episode GMO and I are here with Joe Beno assistant professor of computer science at NYU and research partner at a16z crypto research welcome back to the show Joe thanks for having me great to be back and hello kmo what's up uh so Joe you were last on the show in 2019 at the time I think you were only an assistant professor at NYU now you're also a research partner at a16z let's talk a little bit about what's happened in The Last 5 Years sure um I actually had a

detour and TOD in Australia for a bit at University of melbour too um but back at NYU uh and also working at a16z on the crypto research team um which has really been great uh for me the the Dual rule having both I get to work with students I get to teach working on a new textbook you know on the academic side which is uh o it's still quite some time away but it's an exciting project so I really like teaching and working with undergrads getting them into the space working with grad students um you know latest research and then I love working at a16z because there's a large portfolio uh of companies that we've invested in and basically my job is to

both do great research that we think is interesting for this space as a whole and also to work with uh with Founders and engineers at the companies that a16z has invested in and and try and help them out with problems and the two kind of create a feedback loop because we see problems on the industry side through a16z sometimes you know then they turn into research problems that we can work on uh now that I work at a16z I do have to say on podcasts like this that of course I'm speaking on my personal capacity so anything I say is not an official position of a16z and certainly not investment advice got it quick question for you by the way is the textbook kind of going to be a rewrite of your kind of OG blockchain textbook or is going to be a bit more towards

cryptography I know what what is the the outline if you can say of course of the new textbook sure I mean I can tell you the current plans with the disclaimer that we're very at the very early stages we're still getting feedback from some people who've taught using the original textbook um we do have an outline that we're writing toward but that could change um but we're actually writing it as a new book we're essentially starting we we waited so long it's been 8 years now since the original came out right um you know some of the original authors aren't working in crypto anymore some have left you know Academia and are full-time in Industry I guess that's Ed

Felton and Steve goldfeder at arbitrum yep so you know lots have changed just among the set of authors that being said we decided it would actually be it would actually make more sense to start fresh in particular the original book more than 50% of the the text is specifically focused on bitcoin you know and as you know even though Bitcoin is still still going very strong the amount of Mind share and the amount that people discuss Bitcoin and are are building on top of Bitcoin really doesn't compare so the new book will be much more anchored on ethereum the Practical examples will mostly be ethereum and solidity which was enough of a change that we decided to to rewrite we are thinking about it as a

replacement for the original book The original book will still exist it will still be possible to buy and people who do have a particular interest in Bitcoin might prefer it um but we are thinking that for most people teaching a first year college course on cryptocurrency the new book will make more sense it will obviously cover smart contracts a little bit about defi modern consensus a lot of things that weren't around in 2016 do you think it might touch on CK yeah that's a good question um the whole cryptocurrency Space is so big now it's really a rush to fit the whole thing into a one semester course which is what most professors that I've talked to who are teaching in the space uh are given is basically one course we did at NYU

last year actually we had the opportunity to have two courses so I taught an introductory course and Benedict Boon taught an advanced course that focused mostly on ZK cool that's a little bit of a luxury though I think most professors don't you know there's not room in the course catalog for two different cryptocurrency courses But to answer your original question we'll probably have one chapter on ZK that will mostly blackbox the uh the math and the mechanics of how it works and talk about the applications that it that it opens up that's cool has the perks of being more practical but I feel like consensus in ethereum is actually a rather complicated Beast so I I don't know I'm

curious to see how that turns out you know like proof stake in general is like can be quite complicated fairly quickly yeah it is going to necessitate rethinking the flow MH when you teach Bitcoin the nice thing since Bitcoin consensus is so simple to define the analysis is a little bit more complicated but it's very simple to Define sure that you can start from the Practical example of this is how Bitcoin consensus works and then you can zoom out a little bit from there and you can think about consensus in general and other ways that you might build it uh with ethereum we kind of have to go in the reverse order so we have to say here's what consensus is trying to achieve and some general concepts uh and then how ethereum consensus actually

works is the more advanced thing that comes later after you've got it sort of established the high level goals so essentially like you start by saying look here are like kind of desert a of some mechanism and there exists a thing which we call ethereum which satisfies it uh we'll explain later exactly how it satisfies it but exactly given this we now have a blockchain let's go have fun with uh this particular thing yeah in particular consensus we're thinking about roughly three sections of the book one is kind of basic mechanics of a blockchain signatures hash functions things that you really need to understand anything and just the the general idea of decentralization and then there will be a lot about smart contracts and how you build applications on top and then a

bunch about ways that you can make the whole process uh more interesting have better privacy have better performance and it's really only there that I think we'll be able to explain how ethereum consensus works at any any level of detail right it's just too much if you if you try to explain ethereum consensus before building smart contracts I think people are never going to get there yeah this is the like explaining uh category Theory before learning to add type problem you know like oh we should start from set theory you know what is a set before you learn how to do like 2 plus 2 equals 4 or something yeah and I think with with ethereum the core thing that you want to get to as fast as possible I think is just a smart contract yeah people can if they have a programming

background they can usually look at a smart contract written in solidity and start to understand what it's supposed to do so you can see the end goal and then you can say okay how do we build a platform that will actually run this smart contract enforce all of the guarantees so that it's actually interesting yeah no absolutely it is interesting too because it also has the like properity of like you know how do you address state is kind of implicitly encoded in the solidity Contra stuff like that which is like very useful understanding why we do the way things the way we do in ethereum for example or something like that yeah definitely so last time you were on um not only were you not yet a research partner at a6c but you also were talking about a

different topic vdfs and I'm sort of curious to hear from you like what's happened to that research and what's happened to vdfs did they get incorporated into the systems that we expected them to or yeah what what's going on there if I don't know if you've if you sort of like stayed in that space yeah uh it's a great question I've definitely stayed in the space so I've published a couple of papers since then the field has has blossomed a lot there have been I mean I would guess about 100 follow-up papers to the the early vdf papers in 2018 that introduced the concept so I think the results have been mixed in a sense probably the good news

or the interesting news is that the original to work on vdfs has led to a lot of other interesting things I would talk about delay functions in general which are just cryptographic functions that are supposed to be slow some of which don't have exactly the API or the properties that we thought of with the original vdfs so I think we've actually found a lot more applications for them since then there have been papers uh not just about Randomness beacons which was kind of the original motivating applications but about applying vdfs to things like like auctions things like voting um or to multi-party computation uh MPC as a whole so we found that they're a sort of a more Universal

building block than we expected maybe uh which has been great to see the research Community has kind of taken this and run with it um we haven't gotten as far as I would have hoped in 2019 on deploying them on building hardware and I think the big part of the story there was was quite interested and and did put a lot of uh work into it unfortunately ethereum developed Min route as a candidate vdf and would have been last spring about a year ago uh they they had a dedicated workshop and they brought a lot of really great cryptographers together to really say like are there attacks against this uh min root version

that we haven't thought of and there are some um so they released a nice report on crypto analysis of men route and they uncovered some ways that you could probably try to attack it if you have a lot of parallelism like a million or a billion processors there's some ways to speed up parts of the calculation I would say different people looked into the report and saw different things some said this thing's not bulletproof there's some ways to attack it some people said um there are these attacks but they're not actually that practical so depending on who you ask vdfs are on some sort of moratorium or deprioritization at ethereum I see they don't have an immediate place in the the

road map anymore the main place that they would help that they could potentially plug into ethereum is on the beacon chain um so there's currently a known hole potentially that validators or stakers can withhold their contribution their their Randal contribution when it's their turn and that that does give them for each slot there's one bit of bias into future values so you can bias the Randomness a little bit and there's a a cost to doing that right you you know at the very least you miss out on your block reward so the the story today is basically that there's some level of cryptoeconomic security it is possible to manipulate the randomness but it you're disincentivized economically from doing

so if you add vdfs to the picture uh then there's not actually any way to U attack at all anymore unless you had a speed up where you could compute the vdf much faster so I think that based my current understanding and based on conversations is that it's still something that might happen in the future maybe there's a bit of a waitand seee approach if people start withholding if this attack becomes practical then it would be time to add this in but as far as I know it's not on the immediate Road mapap for ethereum there are a whole bunch of other projects and people looking at at vdfs for things I feel like there was a time where there was a hardware component to this as well I know some of the teams that were working on these vdf Hardware

I don't know if it was an Asic for vdfs seems kind of like counterintuitive if it's a delay function but yeah I think a lot of those have switched as far as I know to working on like ZK Pro Tech MH yeah it does seem a little weird why would you want if it's supposed to be slow why would you want Hardware to make it fast yeah but it's actually an essential component of the story because you what you want what you want is for adversaries to not be able to go very much faster than honest participant so if you assume the adversaries might build dedicated Hardware to speed up this computation the idea is you want the honest parties to have it too so you know if you invest some money into having a decent dedicated Asic that can

compute the vdf then the amount of money an adversary would have to invest to say compute twice as fast is could be really really large right whereas if you just Implement in software then maybe the adversary could cheaply run it on an fpga or something and go much faster than the software and that would be a problem so yeah uh you know there was a lot of effort put into this but I agree that proving Hardware is you know is now a sort of seemingly a much more lucrative Market or at least that's where the attention is I think that's also TBD um yeah true we'll find out next I want to sort of shift Focus because you know one of the reasons we wanted to have you back on was to learn a little bit about other topics that

you've been working on since working on that vdf work and we had a couple papers that stood out to us um I don't know if we'll get a chance to cover all of them but I'll just sort of throw them out here to just give people a sense for like what we want to cover there's one called naysayer proofs which looks really interesting some work on middle boxes auctions yeah and if we have a chance maybe we can do a little bit more there but I'd love to start in on the nayay appr proofs maybe just give a bit of a background on this work and what I understand it as is it's it's almost like an optimistic ZK or something so like and and I've heard that referred to like you know ZK rollups that are like

optimistic but ZK but I think they mean it differently so this is the yeah this is a cryptographic optimistic ZK proof so yeah I'd be really curious to hear more about that uh yeah sure this is a this is a really fun work I think it's you know it's quite conceptual and the original paper is only eight pages which it's really very lovely actually it's uh it's a one of the first papers that I actually picked up and could just like read from top to bottom be like I get it and this is good like this is great it's written in a way that garmo likes it that's so rare that's shocking one might say yeah yeah uh well yeah glad glad you enjoyed it as a side note this has bothered me about the crypto space for quite some time that the average length of crypto

papers over the years has gone way up literally insane if you read crypto papers from the '90s they're quite short get right to the point now you could say we didn't know as much the field wasn't as deep then which is true but I also think that the expectation has become that you can't just present a new idea you have to present the idea and completely exhaust all feasible analysis of it before people will publish it at Big academic crypto conferences and I think that leads to a lot of premature optimization where researchers have to spend a huge amount of time working out the details of some new ideas that more than likely is never going to get picked up or will fail for reasons that don't have to do with you

know some subtle detail of how you prove the thing secure um so I have always wanted if there's a way to do it to get back to a space where people publish the idea first you get some feedback from the community is this idea interesting and you can always do the Deep analysis later if there's you know sufficient interest in the idea itself um so I I've wanted to do that with with other ideas as well in this case I really said we can really present this idea succinctly and have a a really nice short write up that will be readable I feel like doesn't eth research the like Message Board sort of try to fill that gap of like presenting ideas before you write

the paper or is it too short there too early yeah it's a good point it definitely does and some interesting cryptographic idea have come about there there's some limitations I mean they're often not writing in latch it's often harder to write super clearly references and things aren't quite as easy maybe a bigger problem is just academic snobbery that they don't like to read things that aren't PDFs they like things to be on ePrint or archive and that's kind of the the currency of that world but I I mean I'd like for academic conferences and workshops to accept more short papers and to encourage that so Financial crypto in a way is a hold out it's one of the last crypto conferences that

explicitly accepts short papers which have to be at most eight pages yep oh wow and it's not even very popular there's only two or three a year I would say but that's how naysayer proof was published and I'm glad that we went that way U but that's a big detour I should probably tell you what naysayer proofs actually are sure yes so yeah so like you said it is kind of an intermediate point between doing full ZK or succinct proving of a statement and doing just optimistic verification where you assert the statement and then have to do a fraud proof game if if somebody disputes it the observation that we started with when we were thinking about it is that a typical rollup or other kind of similar

service will publish updates with a proof um you know regularly they might might publish dozens of these a day um and most rollups essentially every rollup that we could see has never published an invalid proof so these proofs get published in some cases they're sort of big so it's a lot of data to put on chain some of them are expensive computationally to verify and in all millions of dollars have been spent verifying these proofs on chain even though like I said we had to really dig and we asked on Twitter we sort of asked internally to find one example somewhere where someone actually tried to post a proof that didn't validate and

this whole process actually found something okay so it's it's so rare so our thought was do we is there a way we don't have to spend this much money checking proofs that for a variety of reasons organizational reputation you just expect in the real world are almost never going to fail Qui question was a counter example uh it was like a test net right wasn't it where someone was running one of the validators I I remember when it happened everyone lost their minds uh soone posted an invalid State Route transition I believe yeah exactly yeah um so uh the idea with naysayer proofs is really simple you just publish the proof but you don't verify it and you only verify it if someone challenges the proof that was

the original idea sounds very very simple just publish the proof but don't verify it and then there's a couple of embellishments I can get to but that's the the basic idea I mean the idea is quite lovely right it's very simple but I think the embellishments are are particularly interesting because the the fact that you can prove that a statement a succinct proof is incorrect In smaller time much smaller than you can you know verify that proof itself is itself very interesting but so anyways I don't know if you want to describe what that even means I I kind of just went straight to the high level on that one but sure uh yeah so great so the the default the simplest possible naysayer proof is

really just one bit which says I think this proof is wrong so run the validation and you'll see that it's wrong more advanced asay proofs that can be even more efficient than that you don't just say the proof is wrong you say the proof is wrong and this is exactly the part of the proof that's wrong so you don't even have to to verify the entire proof you can just see this one little part is wrong and therefore the rest of it must be wrong um and there's some really simple examples of that so grth 16 one of the most famous proof systems essentially the verifier does three pairing equality checks all of them have to pass for the proof to be valid so a naysayer can just say oh check number two out of three is not going to pass try it and you'll see

oh and then you're instantly convinced you know it doesn't even matter if the other two pass or not this one's wrong so the whole proof's invalid there's a lot of other examples of proof checking that has similar structure where you have to check a list of things fry proofs you open a bunch of different Merkel paths and check things uh so a naysayer saying that a proof is wrong just has to say which of the openings is wrong and that's it in this case is it a new proving system then or is it more just like the technique to check to verify a proof this is the focus of this work yeah so I think uh it's the latter it's not a new proving system because it doesn't let you prove arbitrary statements in NP uh it only lets you prove very specific statement which is

that a proof in the original proving system is wrong it doesn't even let you prove that a proof in the original system is right uh you know to to verify that you have to just run the original ver fire the key observation is that it's often much easier to tell that something is wrong than that it's right MH if a proof is right every aspect of it has to be right but if it's wrong it can be wrong for any one thing so you just need a hint this is the part that's wrong and then you know you're you're done quite quickly how would this actually like exist in practice would a rollup company implement this and then they're verifying like when would they deploy this naysayer verifier like I can't

fully Place how this would actually work so maybe it would help to just say you know uh how would you actually build a rollup uh system using naysayer proof so you could think of taking a ZK rollup uh today as a starting point um so you still Post State transitions on chain you post a proof that the state transitions are valid but what you don't do is have the smart contract actually verify every one of those proofs that's posted by default you do nothing I see just like with uh an optimistic rollup where by default you don't do anything to check um that things are valid um the difference is that with a naysayer proof-based uh rollup there's still a

short challenge period And if a challenger or a naysayer shows up and says the most recent update was wrong they'll also this naysayer proof they'll point to the part of it that's wrong um and then the smart contract will actually have to wake up check the naysayer proof which is more efficient than checking the original proof and then you know they'll uh undo the most recent State transition so the proving system can still be whatever was already deployed but it's this verifying contract would act differently yeah okay exactly um so you don't even have to implement or deploy a full verifier on chain you just need a naysayer proof verifier and you save money in two ways the main savings actually just come from

the simple fact that most of the time this verifier never runs just like with an optimistic system if there's no fraud right there's no challenges um but even if there is a challenge it's cheaper than verifying the original proof that's where the naysayer magic this pointing to the specific error and the proof part comes in so maybe for a little bit more detail is um let's say I'm using fry for example you you mentioned a little bit earlier but I just want to iterate what is a Nayer proof for fry look like so let's say I I have some fry proof proof supposedly that does not verify if I were to like run this whole thing you know the proof for fry is already quite small right the proofs provided by fry

maybe is the better term so the natural question is how can a nay naysayer proof be even smaller than that right like what does it even look like what's the structure I mean it might help to explain fry for a second in the first place but so fry proofs contain um my understanding of them and I'm should say I'm not an expert on Fry but you commit to you know a very large amount of data um you have a miracle root of that commitment um and then through Fiat Shamir you get a challenge which forces you to randomly open some number of paths in the tree and prove that the individual items are correct M now uh so there's multiple openings there have to

be for security amplification all of the openings have to be correct for the fry proof to be correct um so if it's incorrect at least one of the openings is wrong and the naysayer can just point to the specific opening that's wrong and you can check the naysayer proof you can be convince that the proof's invalid by just seeing that one of the openings is invalid right right sometimes there's a metaphor if it helps I can try that uh let's hear it if you want to check that an airplane is safe for takeoff there's a long checklist of things you have to check the tires have air in them you have to check that the engine's running you have to check that the the flight controls are active right before you're convinced that that plane is safe to get

in MH so you know they have this long walk around checklist the Pilot's supposed to do now if I want to convince you that the plane is not safe and you should not get on it all I have to do is tell you one component of the plane that is not safe if I just say look just check the right wing there's a hole in it you know two feet from the end you'd go look at that and say okay M this is not a safe plane I don't care about the flight controls it cannot be safe with that problem and then you're you're done yeah the negation of for all of x p of X is true is simply there exists an X for which P of X is not true right so exactly that's really the the basis of the whole idea the thing is there are

already optimistic rollups so like what is the benefit of having a system like this like is there anything extra that you get from doing all of these proofs yeah it's really really good question I think it's actually helpful to think of a spectrum and the two end points which are pretty well known are optimistic rollups and ZK rollups uh you know naysayer proofs or a naysayer rollup would exist in the middle it has some of the advantage and disadvantages of each so I've you know said the advantages over a full ZK rollup that you don't have to pay the cost of proof verification every time compared to optimistic full optimistic the disputes are much much simpler in an asay proof system it's only one round you

immediately point to a problem with the proof uh and the fraud is basically instantly settled um with optimistic rollups usually there's this somewhat complicated logarithmic number of rounds fraud proving game um where the original uh prover plus the Challenger have to iterate and find the exact point in the original you know statement that was wrong and it turns out that eight it eats up a lot of uh gas because it requires multiple rounds and a lot of transactions it's also sort of error prone both parties have to be online they have to go back and forth there's a lot of kind of corner cases and bugs that come up so naysayer proofs you know

contrasted with optimistic they are a little bit more expensive even in the optimistic case but in the pessimistic case they're much uh faster it's you know only one round you get sort of instant settlement of a dispute cool I sort of want to move on to another work I think the name of it was like middle boxes that don't Snoop I don't know if that's the real title but somewhere in there you had that sentence so what is that and first of all what's a middle box okay yeah so this is a work is in a totally different direction M although it uses ZK it does use ZK so this actually came out of my work at NYU so NYU uh participated in a DARPA project called seeve uh it actually just just

wrapped up um it concluded in 2024 it was a a big DARPA project essentially the goal was to accelerate the development of ZK for every application except blockchain and cryptocurrency um so that was kind of an informal rule of the program uh blockchains were kind of like that which must not be named they boen yeah oh my God but I I do think that there was a sensible argument for it which is that the web 3 industry has seen a lot of investment in the space um so there's been a lot of development of ZK tools and and new proof systemss and everything else in this space and DARPA

was interested in other applications and thought that they would you know be better directing their uh their funds at things that weren't you know uh that the web3 industry wasn't looking at so I mean the one of the grand goals of the whole project was to have better interoperability between different proof front ends and backends and develop kind of a common intermediate representation okay um so that you could you know you could mix and match you could have different ways of specifying the statement you were proving you know instantly compile and run it on different backends and see which was uh the most efficient so there were a lot of really nice ideas plus a whole bunch of interesting applications I mean people were looking at proofs of software exploit proofs of you know

things like uh ml models being trained or that some linear programming optimization was done correctly so that was basically the you know the challenge was like what can we do with ZK that you know has nothing to do with the web 3 Industry but is interesting that's awesome so along with a bunch of colleagues at NYU we we wrote two papers actually on this notion of zero knowledge middle boxes and it's basically an application of ZK to try to get better privacy on the web so middlebox is really just any computer that sits between you and the server that you're trying to get to MH truly a middle box got it yeah exactly um so it I mean it's usually defined as one that actually does something you know

you could think of every router as sort of being like a middle box but they're not usually called middle boxes unless they're actually changing the traffic in some way but for example there's middle boxes that act as firewalls you know that try to prevent um attack traffic from entering or leaving your network there's loss prevention middle boxes that some companies have installed data loss prevention that try to prevent employees from uploading sensitive documents and shipping them out from the Enterprise Network mhm but probably the most common and well-known middle box is for filtering so if you browse the web on an airplane or a coffee shop and you try to get to a website that says it's blocked on the local network usually it's an adult content filter and these are

pretty widely deployed um so there are lots of public Wi-Fi networks there's a huge industry of parents setting them up in the home typically who if they have young children at home um and they want to have what's sometimes called a family filter and of course you know in uh some other places in the world there you think more about censoring political speech and things like that in the US context the dominant application is usually filtering adult content okay so where does ZK enter the picture um yeah so basically middle boxes have uh existed and worked for a long time implementing these filters by just blocking DNS requests so they they work at the DNS level um they don't let

you figure out what IP address corresponds to the name of the domain that you're trying to get to MH and that worked for a really long time because DNS was never encrypted even with https and like the growth of encryption everywhere else on the web for your content your DNS queries weren't encrypted until really the late 2010s when encrypted DNS started to become a widespread thing in many ways they're still kind of non- encrypted though right I mean unless you use I don't know if Chrome has a specific thing but for sure sa far does not encrypt DNS uh like requests in general Safari I don't know about Firefox uses encrypted DNS by default and has for a couple years now oh interesting okay um so the interesting thing is that when Firefox when Milla

planed to turn on encrypted DNS you know this conflict came about that it was going to break uh filtering on all these networks MH now it turns out there's actually a law on the books in the US that says that schools that have 12th grad or below students have to filter the school network for adult content okay it's been a loss since I believe 2003 so the implications you know is basically Firefox Milla realized if they turned on encrypted DNS everywhere schools around the country would be forced to remove Firefox not allow people to use it because you know it would it would get around their filter interesting um so what they did instead which is kind of interesting they

basically built a kill switch into the browser so Firefox tries to use encrypted DNS but when you join a new network it first does one kind of dummy DNS query and if the network responds then it says oh this is a network where I'm not supposed to use encrypted DNS so I will turn it off o interesting yeah so your network operator has the power to tell your Firefox inst installation don't use encrypted DNS on my network please and they basically have to go along with it um so all this led to us thinking a lot you know there has to be a better way maybe ZK could help us out here and the the basic idea is that you shouldn't have to turn off encryption and reveal all of your plane text uh to

the middlebox to your network Operator just to essentially prove a very simple fact right that my traffic is not going to you know websites which are filtered on this network MH so instead what you can do and what we did in this research project is to actually prove you know my browser sending out a packet this packet complies with the local network use policy for example it's not going to some domain that's on this uh on this block list so that's all you need to know I don't have to tell you my PL text I don't have to tell you where on the network this traffic is going it just complies with the policy and the middlebox should be able to say okay I've learned the information I actually need to know right the zero knowledge

proof has convinced me of that fact and nothing Beyond it which is exactly what ZK gives you so I'll permit this traffic to to you know Transit my network interesting okay I love use cases like this by the way I just love these like very tangible actually non-blockchain use cases uh this work is this zombie middle boxes that don't Snoop is that the paper or you sort of mentioned there's two papers so yeah so there are two papers the first one was just called zero knowledge middle boxes and then okay that was a bit more conceptual we did an initial proof concept and laid out this Paradigm that you could use ZK to prove that you comply with network use policies the

zombie paper is more of a built out system um where we optimized and we tried to see like could we get the performance to work here now this is a really really challenging space performance-wise um because basically you have to compute a proof for uh packet that you're sending out on the network and the proving time translates directly to latency for the human that's sitting there at the the browser browsing the web mhm and you know like people are really really latency and tolerant when they're browsing the internet adding a half a second makes browsing the internet really unfun you know maybe back in 1996 people were used to it but you know today we're used to like everything loading really fast and

you know Google famously like uh has whole teams and people get promoted for shaving you know 10 milliseconds off the latency of a page load so uh yeah so it's I should caution I guess I think this is a really exciting application of ZK and it's an interesting Paradigm um performance-wise it's really challenging we were able to get with a lot of work from some really great students at NYU we were able to get latency down to like you know the you know maybe the 1 second per packet range and there's some tricks where you can pre-compute parts of it and other things like that um but it's not really with today's proving systems and without any hardware acceleration it's not really ready to be something that you can

really prove every packet that you're sending out from your computer the DNS example is maybe a little bit more practical because it's not every packet it's just your DNS requests which you know there aren't that many of and it won't add latency to every packet just your DNS queries and maybe you know the the time is tolerable there interesting I mean what's interesting there too is that as like you know if you're using some some simple system that you can actually tune the the security parameter for like the hero or fry or something like that um it doesn't matter that it's like to the negative 80 or whatever you know is your security parameter right it just matters that it's you know reasonable enough um yeah so it I feel

like you know if you set a parameter it's like everyone in a thousand passes you know incorrectly or whatever it doesn't matter like great okay you know You' shaved a crap ton of like you know queries uh well specifically I me I mean sorry ZK queries not queries um and you know functionally is the same right one of every thousand or packets like happens to verify correctly okay well big deal you know yeah that's I don't think that's a big of problem no I think that's a great point that the benefits of this space and again it's it's interesting to work on because it's so different maybe from the web 3 dynamics that that a lot of people in the space are used to you yeah you definitely don't need the same security level the whole thing about filtering there's a lot of ways you know if

somebody wants adult content to play on their laptop on an airplane really badly they can pre-download it before they get on the plane they can type in an IP address manually that gets around most DNS filtering today MH so you know filtering is not really designed to be Iron clad there's there's ways to get around it MH we liken it more to sort of putting up fencing at a concert or something like that it doesn't need to be a fence that people are incapable of climbing over but it's you know it will keep most of the people in sort of the place that they're meant to be so yeah I think you could operate the proofs at a lower security level another thing that's interesting is that the proofs could be much bigger M you're only

sending them typically over the local network so if the proof is 100 kilobytes it's really not a big deal at all whereas in the blockchain space right that would be terrible and unacceptable for most applications so it's it's kind of a very different domain here you should think about um kind of like low security parameter proofs for this kind of stuff I think would be fascinating right CU you could like for a friendly hero proof where your secure parameter is like to the five or something like they're both tiny and extremely fast that might be a little low because the a malicious client can grind over that sure sure sure but like look if you have a malicious client that's grinding or or whatever maybe to negative 10 but if you're doing it for every DNS request like you know come on

like you have other problems to deal with at that point like that person's probably just doing something else doesn't need to do two to the 80 yeah right like two to the 40 might be a might be pretty solid two the 40 two to the 20 two to the 10 yeah I don't know so I I do Wonder at what point like when did this work come out what systems were you actually looking at when you built this um so the original paper I believe was 2022 okay and the followup was this year in 2024 okay so you it is recent then yeah oh so you're asking what proving system yeah I'm just kind of curious if like some of the small Fields Bas work or anything I don't even know if it would be relevant here here but like any of the new sort of like proving

systems were already out as you were working with this yeah so uh I mean we used Spartan in in zombie um which Spartan in Zombie yeah sounds so cool I know it sounds like a Halloween costumes or something but the but I mean so Spartan you know has a Fast Pro relatively large proofs but is a good fit for this space um interestingly yeah we didn't use jolt or Bas or jolt plus Bas even though you know my my student in arsu who is the lead author of jol was also involved in the middle Box's work but uh there's definitely like uh a lot of future room to optimize

and you know different people are sort of exploring this whole ZK middle box or even ZK applied to network traffic idea so I think that we'll see like a lot more optimization in the future cool um it might fundamentally be a question of if you believe that in the future a lot of consumer devices will have ZK acceleration in them wow so I mean I've I've heard this Vision maybe it's been discussed on your podcast uh too I don't know I don't know like tell me what you're thinking here Hardware acceleration has been discussed but like yeah yeah yeah so the initial you know all all the initial focus is on

having this Hardware in the cloud to do big proofs for rollups and things like that yeah it's possible in the future you know it will Downstream a little bit to to client devices so your laptop might have uh a ZK co-processor on it I mean I think probably even better chance that we'll have like an AI co-processor on it um like a tensor Processing Unit but the idea is that you know if we find enough applications of zero knowledge to privacy then this could be something that you know device manufacturers would say like oh yeah we should accelerate this so that our uh you know our users can get access to these great privacy enhancing features like nothing to do with blockchain yeah and there's other

applications too where being able to if you could prove things really efficiently on your laptop you know there'd be nice nice privacy benefits to that this is so cool I love this idea yeah I mean it's well it's really I think on the community I think to demonstrate enough that uh you know interestingly like always say like most of the time when people say ZK and the blockchain space they really just need succinct we're they barely using the ZK and the Privacy part of it at all right now what to get the Privacy you're going to have to go more towards the client anyway I think it's because it's all server side there's no point exactly so yeah I mean I think if we you know I hope that the space doesn't become like so completely

focused on building efficient rollup servers which is a great application that I think everyone wants to see have better performance blockchains but you know like the original conception of zero knowledge was about privacy right and there's a lot of great applications I think where it can uh you know it can help improve people's privacy you know not just the middle boxes stuff but things like selective disclosure credentials you know where you can sort of prove in ZK that you're over a certain age right or live in a certain area on the web all sorts of stuff like that I think if there's enough applications like that and we can demonstrate the value then you know the case will start to make sense where we'll have Hardware acceleration for clients to actually do these proofs and

hopefully it gets to be a positive feedback loop where Hardware means you know the applications are cheaper so more people are using them and then more people want the hardware and then we can do more things with them I do want to make a quick distinction though because you just used the term ZK co-processor but I think you meant like a hardware co-processor like the classic term co-processor but focused for ZK unlike the ZK co-processor in our space which is like a offchain compute using zkps exactly yeah yeah yeah yeah no same same idea but for your laptop you know you'd have a like a little piece of the hardware yeah it might be as simple as a piece of Hardware that does you know multiscalar multiplication really

efficiently for you cool it might be like more of a complete end to end thing tailored to one specific scheme but uh yeah I mean I'm excited by it's a ways off you know um but I'm definitely excited by that that vision of the future that you know ZK is a common building block in a lot of applications not just in the blockchain space and that you know it's something that we have good support for not just Hardware but of course good good tooling and good software support and everything I was say it's not that far fat right I mean we have we've had AI processors in our iPhones for I don't know how many years more than eight years now I think yeah um just like linear little linear algebra chips that just like do the thing very efficiently and certainly all

the Apple M Series Laptops and um my suspicious is actually that the ZK Hardware is not not that far into the future um it is a bit on us though to demonstrate you know its utility yeah uh but you know there are many ways you can make it fairly modular fairly quickly and in a way that doesn't you know it's it's useful for many things that aren't just like a particular proving system or something of like is there any other work that you've done in this sort of non blockchain ZK space uh yeah I mean definitely actively working on it so one answer is that there have been a lot of applications of succinct proofs to transparency logs which kind of look like blockchains if you squinted them but they're usually sort of run by one

company so certificate transparency is you know the best known system there's uh other things like sigstore which are binary transparency for software programs uh and all of these are basically aiming to create a public log of well certificate transparency is all certificates that you know in existence and valid binary transparency is all versions of a piece of software and those give uh oh I'd be of course I have to say key transparency which is you know something I worked on for 10 years and WhatsApp uh finally announced that they're launching this year and apple also quietly launched for iMessage cool and you know in that case you know you want transparency to all the public keys that are listed for your uh for your

username and some messaging system um so all of those uh you know somewhat similar to in blockchains but for different purposes there's been new protocols using ZK that make these systems usually more succinct much faster but also potentially privacy preserving so you can have a public log that lists all the users and their public keys in a system uh sorry doesn't list them explicitly but makes them uh you know public so that you can verify that you got the right public key for some user that you're trying to message but uh you know using ZK to keep that information private um so that's been an application I've been uh you know interested in for quite a long time and is you know I

think it's kind of having its uh its moment right now neat uh and yeah the last thing I can quickly plug um because the the paper is not even out yet but uh you know hopefully out by the time uh people are listening to this you know also on the line of applying tools from zero knowledge to traditional network security protocols you know we've been looking looking at using uh zero knowledge to improve certificate issuance so every website that you go to on the web you get a certificate asserting that you got the right public key that translates into the little glowing padlock which actually the padlock is going out of style pretty quickly browsers have decided they don't want to show a padlock they just show you nothing if it's actually secure and

otherwise like a scary warning correct um yeah but you know for a long time the security advice was like look for the green padlock before you enter your password or credit card number or anything like that and that that's really just saying that you have TLS session enabled and uh certificates been checked so certificate system has long been a huge mess um you know people in the security space always you know uh bemoan how your browser trusts a few hundred different certificate authorities all of them can issue a certificate for any domain on the whole internet mhm if you want to go a little scared you can like look in your browser's actual certificate store and see all the certificate authorities that

you trust a lot of them are owned by Foreign governments um there's there's a lot of weird stuff in there but yeah I mean if you if you get a new laptop and get a fresh install of you know Chrome or Edge or whatever browser you're using there's this huge set of parties that you're asked to trust um and there have been a lot of incidents where they've been hacked issued a certificate incorrectly um you know different things have gone wrong um so the yeah the security Community has tried for 20 years to say like there has to be something better than trusting these weird certificate Authority agents um it's been pretty hard right aside from certificate transparency we haven't had a really good proposal for what to

replace it with there's been the idea to use the DNS system so you already trust DNS to figure out the right IP address so why not get the right public key at the same time and the answer has basically been that DNS SEC the secure version of DNS which actually signs everything is a very bulky kind of unwieldy protocol it's really based on RSA signatures the records are big you have to get this full package of signatures from different parties validating a full DNS SE chain is you know it's a it's a pretty big process so basically for performance reasons you know we haven't been able to use that as a just distribution point for public keys but the really nice thing you can do the sort of ZK magic um or at least to sync proof magic is that you can take

all the DNS SEC signatures so you know if um my domain jon.com right uh I I control my own DNS but then I have to get it registered with the com DNS server and they get registered with the root and all those parties need to sign off um but what I can do is just verify the DNS SE chain once create a proof that says that I've actually done it and then you get like a very short proof that you know say this is the right public key or the right IP address for for my domain MH so yeah with uh with colleagues at NYU we wrote a paper showing that you can do this the uh performance is actually pretty good and if you use gr 16 with like the smallest proofs the proofs are so small you can

actually embed them in a legacy certificate nice so you get a certificate that basically has validated domain ownership in two ways through like the Legacy CA system and also through the DNS sex system and a proof um which is really really nice because then it kind of means you're not vulnerable to either like if if both of the systems fail then uh the attacker might impersonate the domain but if either one of them fails individually it doesn't I thought it was a really fun kind of creative paper the technical challenge was a lot of you know representing crypto like RSA signatures that's quite old efficiently in proof systems you don't have the luxury like in blockchain space uh sometimes and being able to pick your crypto

specifically to be proof friendly or or circuit friendly have an efficient representation you know if you're dealing with these Legacy protocols and trying to accelerate them uh in ZK you just have to deal with what's out there it's it's really really difficult it takes 10 years for protocols like this to actually change wow but uh yeah I mean in general I think that this is a really fun application of ZK to sort of you can think of it as like trying to fix some of the really messy complicated network security protocols that are out there but are really really hard to change for a for a variety of reasons yeah this fits very nicely into uh I don't know who said it first but um you can view ZK as kind of like a universal translation layer right of like ZK is is like you have these systems are ugly and

stuff and you can think of them as like ZK is like a nice like beautiful like box that just like encapsulates it and gives you like a nice short version of it and you can treat it as like okay that now exists out there here's a proof that we've done all the correctly please take it and verify it as needed and the rest is all detail so to speak wow it's really quite a lovely very much looking forward to reading the the work I feel like the more I learn about you know as a non-computer science major I never I did one computer science course many many many years ago um it's kind of terrifying to realize that everything we rely on is it feels like it's all put together with tape um that's definitely the feeling if you

if you read a lot of these these rfc's that find all the network protocols that you know you rely on every day like htdp and even just TCP it's amazing how sort of old and brittle they seem and they're they're so difficult to change I mean we've been trying to switch from ipv4 to IPv6 for 20 plus years and very little I mean it's it's so difficult to actually change things on that it's funny I think because we think of the internet and Tech being so modern and Cutting Edge but it's like there's already these core foundational pieces of it that look you know it feels like archaeology to read and figure out you know how they're how they actually work and then you do have systems that emerge where people are

trying to rebuild it from scratch like herbit or something and it seems almost like an impossible task because the amount of adoption and and I mean yeah I don't know if herbit is is even in that category but like yeah yeah certainly it's it's uh people have dreamed of like replacing the whole stack and doing this kind of Clean Slate redesign of the internet for a long time and it uh you know it's nobody's nobody's cracked it yet so wow I think it's a pretty safe bet that this kind of research and like using ZK to sort of clean it up figure out a way to muddle along and clean up a little bit is like will be a pretty exciting application

wow um we don't have much time left but we did mention this a little bit earlier on I want to just shift gears to a last work which is about auctions and I'm guessing are we going back into blockchain land for this one sounds like typically yeah so this is about decentralized sealed bid auctions the name was rigs yeah I guess also two papers in this space actually because we had a followup to rigs called the cicada but yeah both of them I mean it also sort of a followup to our earlier discussion about vdfs and what's happened in vdf since then so both Rigs and cicada are about using time lock puzzles to implement auctions mhm it's sort of like a conceptually

simple problem that has parallels all over the blockchain space so typically in a sealed bid auction everybody in a offline classic way to do it everybody would write their bid in an envelope turn them in once you have everybody's bids you open all the envelopes and the the famous result this vicory auction format is that the highest bidder gets the item but they pay the price the second highest bid mhm um and that solves a lot of incentive problems you know it makes sure that everybody is incentivized to just put their actual valuation down you could get the same result if you just had a what's called an English auction or an open outcry auction where people bid and

then you keep bidding until no one wants to bid anymore but I mean that can take a while and you know uh it's a big interactive protocol and everything so it's simpler to just do the sealed bid format MH interesting ly economists have been saying for decades like this is the right way to do auctions uh and they're sort of rarely done in practice people aren't totally sure why I mean one theory is just that the bidding and outbidding is kind of fun or more dramatic for people you know writing something in an envelope and then just being told if you want or not isn't as uh you know isn't as compelling but anyway I mean another theory is like it's hard to do this cu the auctioneer actually has a lot of power yeah right the auctioneer can they conclude with

Buyers or the sellers to change the price which is also why this is sort of hard to do in a decentralized setting so if you think about trying to do this on a blockchain um you could think about everybody committing to their bid but then you have to have everybody open their bid and that gets a little bit complicated so there's a tax where for example if you're the seller and you want to inflate the price you submit a bunch of bids at different prices then you wait for all the honest all the honest bers to open their bid and you open whatever your sort of highest bid is that was just below the honest winner and then that will force them to pay the max price MH um so if you have the ability to add bids to the system and

selectively decide if you want to open them or not the incentives kind of fall apart so uh how can you do an auction in a decentralized setting where people submit a sealed bid but they're sort of like forced to open it in the future there's a couple of ways you can try and do it some of The Usual Suspects you can have a threshold you can encrypt the bids to some committee and you trust the majority of them are honest and won't decrypt the bids until after a deadline you could try to use trusted hardware and tees you could try to use incentives you could say if you don't open your bid you get slashed or you pay some penalty all of those could work and have some downsides U but the approach in Rigs and

in uh in cicada is that you actually submit your bids using a time lock puzzle uh so it's a commitment to your bid um that anybody can open anybody can recover your bid but they have to do a slow function to get there um so it's really nice because it ensures that in the short term nobody can see what you bid but even if you drop off the face of the Earth you never return to open your bid eventually everybody can compute what your bid was so kind of private in the short term but public in the long term um which is what you want here you know you want everybody's bids to be private while the bidding is still open but then you really want to make sure you get everybody's bids out mhm um so it's a really elegant formulation there

were a lot of interesting problems to solve that I don't think we thought about too much before we started this work you know we thought this was an idea you could just sort of apply to the blockchain space and it would work and then we realized for example you have to prove that you actually have enough money to pay your bid yep so that's a little bit tricky if I'm bidding $100 for an item I have to prove that I have $100 of course if I just put $100 on deposit then it's not really private anymore because everybody can sort of see mhm uh so it's it's very tricky how you actually combine privacy in a fully decentralized uh setting with proving that you actually have as much money as you bid if you're not careful you can get into some attacks for example you

could submit a bid and then if you want to retract the bid you could just move the money that's actually backing that bid out of your account and then you don't have enough money and the bid becomes invalid oh wow do you like this is using like zero knowledge ekps but like would this also work in something like a te or an F setting aren't auctions even like better in those environments yeah as I mentioned tees are another way of solving this problem and making sure that everybody's bids are opened after some deadline of course you know you're relying on Hardware at that point so if the te is you know breaks if there's some side Channel problem or the key is extracted then you know security kind of collapses completely The Trusted Hardware

certainly works as long as the the hardware is not broken um FHA I don't think you need full-blown FHA because even with FHA you would need some committee that would decrypt the bids you don't have to actually do any computation on the bids what you could do in FHA is a slightly more private version where you don't actually reveal all the bids you just compute the winner and the only information that becomes public is who won and at what price mhm so yeah if you wanted to eat the cost to full-blown FHA you could you could improve the Privacy a little bit most applications of auctions people are happy if all the bids become public and you just compute the winner in the clear um so that's why you you know could potentially use a much simpler tool than

FHA makes sense so on the note of um why people don't do the kind of sealed bid is is exactly like what you said the auctioner has a lot of power not just in the blockchain setting but um I think recently maybe as of two years ago or something wasn't Google and some amount of trouble for inflating their second uh their winning price if I recall correctly I heard about that I I don't know the details but I I've you know I've heard things like that yeah I think Venezuela was also doing the same thing with oil payments as well so they were there were some implicit cusion between the auctioneer that was running thing and then the players who were who were in it to to maximize the revenue by pushing up the the second highest bid you know up a little bit I mean the

technical deals are a bit more complicated than that but that's essentially the high level stuff so even in like things that you might expect would be reasonably trustworthy it turns out that it's actually not so not so easy to guarantee so it's yeah it's very cool work in that sense um the last thing I'll say too is that there's kind of an interesting connection and we showed this a little bit in this cicada paper that voting has a really similar property that you want people's votes to be private while the vote is happening so that you're you know people aren't voting in reaction to other people yeah um but then you know depending on the type of election like a lot of chain elections you want to actually see how everybody voted if it's a governance vote so just like in the auction setting you want you know privacy in the short

term you want to keep everybody's vote secret and then you want to reveal everybody's votes so you can kind of use the same uh time lock puzzle idea Works in that case too that's so cool Joe we've sort of run out of time uh to go into other work we actually had a longer list we had deniable messaging decentralization of the powers of to we know you've actually been doing other stuff before we do sign off though is there any other maybe just highlight you think if people want to check out something you find really interesting what should they look at so uh well I mean first of all thanks for having me it's great to be back and uh I mean I guess it's good in in five years I've done enough work to fill an hour

conversation is a good good sign plus more we just don't get a chance to get to it yeah I mean I guess you know I really like my role like at NYU and at a16z and the fact that I get to work on so many different projects with so many great students you know I feel like I should always disclaim both as a professor and you know as a research partner at a16z with really great research interns most of the work I'm talking about was done by students so you know of course I have to give them all the credit for uh you know doing the doing the hard work on these projects but uh yeah it's I'm consider myself really lucky that I get to work on you know a variety of different uh really different projects and yeah the second thing you

asked I mean I guess I would say the fair data exchange project FTE uh also came out of the you know a16z research program that was really fun I think there were five different students who collaborated on that paper you know trying to solve this problem of how you can automically pay somebody to download some data that they're holding um so yeah you know I know we didn't have time to get into that work at all it is going to be present Ed at uh at SBC next month so oh cool I would guess a number of your listeners are uh going to go to SBC and that's I guess should be happening soon after this uh episode airs so yeah so before we sign off I did just want to kind of highlight something the last

time I saw you in person was actually in Athens at zk1 and then I was really happy to see that you guys had done you did like a write up of what you saw there was that your first summit just real quickly it was my first uh time at ZK Summit yeah cool um I will quickly plug ZK 12 is happening in Lisbon in October so we'll add the link to that and actually applications as this airs they're open um applications to speak and to attend but yeah kind of curious like what was it for you what what did it did what did you think of it you're coming in at like a ck1 at this point so it's like a pretty big event didn't start that way but yeah yeah I'd seen some of the recorded talks I think from

some of the other events I believe right the the talks are recorded from the past events yeah yeah for sure they're all on YouTube okay yeah so I I it felt familiar even though I hadn't been explicitly because I'd seen some of the talks and you know there's a lot of overlap between different conferences so it was a lot of familiar faces but it was amazing to see that much energy around ZK specifically and all these people that you know I've seen you know people starting companies people maintaining libraries all that we all in one place yeah it was really great and I know a6c said why don't you write a short blog post saying what you saw and I you know said sure and I think that actually it actually helped because it forced me to think about you know what I

thought were the interesting Trends but uh no I loved it it was a it was a great event nice yeah I hope we'll see you at the next one well thanks Joe for coming back on the show and sharing with us all of this work that you've done like all of these different topics that you're tackling a lot of them using ZK which is so cool um yeah thanks so much for being here yeah it was a blast thanks for having me so yeah thanks GMO for being the co-host for this one thank you for having me and I want to say thank you to the podcast team Rachel Henrik and Tanya and to our listeners thanks for listening