Episode 341 - coSNARKs with Ais and Lukas from TACEO

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week Nico and I chat with Ash and Lucas from TSO we discussed their early work and interest in cryptography as well as privacy preserving Technologies we then cover the founding of Tso and their recent work on co- snarks or collaborative snarks that combine MPC and ZK we

discuss exactly how these are created their co- circom language the characteristics of these cnar systems and real world applications of this technology both live implementations and possible future uses now before we kick off I want to remind you about ZK Summit 12 coming up in 2 weeks in Lisbon the program and tickets are now available on the website there was some confusion about the event being sold out early bird tickets are sold out but General tickets are still available head over to ZK summit.com to find out more and I hope to see you there also I wanted to highlight the ZK jobs board if you're looking to jump into ZK professionally this is a great place for you to find your next job I've added the link in the show notes so do check it out now Tanya

will sh a little bit about this week's sponsors attention all projects in need of server side proving Kickstart your rollup with gelot ZK Cloud the first ZK optimized decentralized Cloud its flexibility and customization supports any proof systems such as sp1 polygon risk zero or ZK sync at rates 5.8 times cheaper than AWS with two times the performance get started with a free trial plus extended grant opportunities for Premier customers and until q1 2025 in addition galot is currently onboarding institutional prover node operators register at gal.com so thanks again

galot Alo is a new layer one blockchain that achieves the programmability of ethereum the privacy of zcash and the scalability of a rollup driven by a mission for a truly secure internet Alo has interwoven zero knowledge proofs into every facet of their stack resulting in a vertically integrated layer one blockchain that's paralleled in its approach Alo is ZK by Design dive into their programming language Leo and see what permissionless development looks like offering boundless opportunities for developers and innovators to build ZK apps this is an invitation to be part of a transformational ZK Journey dive deeper and discover more about Alo at al.org and now here's our [Music]

episode today Nico and I are here with Ash and Lucas from T welcome to the show both of you hello very glad to be here hey Anna hey Nik thanks for having me hey Nico how are you doing very good how are you good so this is the first time that I have you on the show and also I'm not that familiar with what T is like is it a company is it a kind of consulting firm like this is something I've been trying to figure out so maybe we can kick off with just like a quick description of what too is so it May started out as more of a Consulting project but it's now a full-blown project and at T our vision is to develop NPC encrypted compute for web

free with the ultimate goal of creating a secure compute layer for the internet just as TLS was created to secure communication we believe there is a growing need to secure computation itself making sure that privacy and security are built in to every online interaction and we departed our mission by building the first tooling for collaborative snars nice I can't wait to jump into this it sounds so exciting but maybe before we do it let's have just quick intros to you and how you got into the space so Ash why don't we start with you what were you working on before and what led you to work on this so I

actually pretty much since I got into cryptography I met Christian who is also the the chief scientist T um so I was yeah doing my PhD in cryptography in Paris um I met Christian actually in uh a workshop in Bogota in Colombia in 2016 I think where I was talking about blockchains and he was talking about designing efficient hash functions and this kind of stuff so we had a kind of interesting start of conversation and but he's also somebody who's very interested in privacy in in his personal life and relative to technology and me too so we always kind of had a lot of nice conversations and

at the same time I was also working in the payments industry sort of looking at how to add a bit of a privacy layer to payments as they were at the time and given that I was working in cryptography and payments and privacy and all this sort of stuff it naturally led to the blockchain topic and then when you talk about the blockchain topic and payments and privacy you very naturally fall into MPC in this multi-party computation because you're in this distributed setting and you want to do yeah kind of very stuff like computation that needs security and that there's a lot of Regulation around and all of this so yeah I was working a lot on sort of um

trying to build NPC into the traditional payments industry um and realized that the traditional payments industry is a bit slow to adopt these things and while they might like to think about them and say that they want these things actually realizing these things in practice is not going to happen this decade or the next I think maybe it's a bit pessimistic but in any case I for the traditional sort of Industry yeah actually that's true uh the newer ones like newer ones are coming around now but in any case I I left and started working full-time in the the blockchain industry and so since about three years ago I was working a lot on thresold crypto but recently this summer I joined Lucas and Tao now going back to my

Origins and focusing on MPC again and the Privacy topic I saw actually your Twitter bio is head of privacy yeah what does that mean we talked about this a lot actually and um for me it's like I mean this was always what I wanted to do and we we talked a lot about whether this actually makes sense as a role because normally if you hear like some sort of privacy leadership role it's usually around legal stuff or like gdpr or like regulation or like you know internal systems are you managing the customers's data in a privacy friendly way and all of this and like of course in web 3 none of those questions apply so that doesn't

make any sense in a sort of web 3 organization but for me this might be quite a long rabbit hole that you me down know but uh for me it's super important that any company that that is building sort of security related Tech thinks a lot about privacy and tries to ensure that whatever they're building is used in in a nice way for the right reasons I think with cryptography it's one of those things that shifts the balance of power mhm and like for me I for sure want to shift the balance of power in the right way and so this for me generally comes down to the Privacy

topic and privacy for individuals privacy for groups like allowing people to have dignity in a digital world all this kind of stuff I mean there's just so so so so so many problems now why open no one's looking at because everyone's so focused on the cool math and like the cool proofs and whatever but it's like there's so much more and like with every every everything that we do at T and that I do in particular I really want the Privacy aspect to be shoehorned in there like and that really we build like the nicest possible tech for people and Lucas what about you what

got you started and what got you excited about this so I started out after high school as a software engineer and after one and a half year working at the very Traditional Bank I kind of want to go to the details of what computers are doing and for me then I choose the more theoretical field of mathematics and over the next couple of years I spent a lot on specifically discret mathematics and was then very drawn into cryptography actually I ended up uh in Christian's group at theat University of Technology very very much focus on the intersection of cryptography and privacy back then and Ash was a guest lecture actually she did uh talk on the right to

encryption and exactly at this time I worked on MPC applications in EU funded projects in the EU funed projects we had all these amazing Technical Solutions with MPC for secure and collaborative data analysis and people were liking it so the are project Partners but in the end it came always down to the same question sure we trust you that this is secure you can prove it and it's better than what we have but how does it align with the general data protection regulation in the Au because this in the end mattered most and I had no clue uh I knew that there was a regulation but

that's it and I had also the feeling the legal teams didn't really understand how impactful this what we now call programmable cryptography is compared to some let's say standard security measures mhm there was just this huge disconnect so over the next year Christian and I worked hard to bridge the language barrier basically between cryptography and legal scholar so there were not much really new work but really just yeah helping understand each other and this eventually led to the first paper on NPC in the gdpr and along this way for this whole one year ashw act as advisor because not a lot of people are

interested in this kind of intersection between phography and legal scholar so it's hard to find to somebody you can talk about this I think with this uh talk about the right to encrypt I really loved this because uh I mean I don't know anything about the law but like for me this was so cool because there was stuff in the law that said that people should have privacy online and that they should be able to live their lives as they do in the Real Worlds but also online and the same like within the UN Declaration of Human Rights and like all sorts of things like all sorts of like official documents where so many people lawyers and leaders of countries sat around tables and decided yes we want

protection for our journalists yes we want protection for our citizens and that means using things like encryption on the internet and using things like pseudonymity or anonymity whatever you can gu guarantee and yeah as Luca said there was quite some disparity between the language used in the law and the understanding of the lawyers and what the computer scientists understood and so the work that they did was very much yeah trying to bridge this and I just went around shouting about it like you should think about this more and they did so it was great I was really happy and so is that sort of the origin story for tatero is that how things got started so this is more of the story how Ash was always around us right

the so the first time the T team so the people the courting behind that se came together or worked together on an industrial project was right at the start of the pandemic we got a request from the government asking if we could explore how to combine Mobility data on the one hand with information about people who are covid positive and to do this all in a privacy preserving way uh so that they can see some hotspots where infections might happen often and it was a huge challenge to do this in a privacy procuring way what came out of several intense weeks of work was something we called the corona heat map it basically

was a proof of concept that involved aspects of every major privacy enhancing technology so MPC homomorphic encryption Ser knowledge proofs and differential privacy and to us this project was really pivotal because it proved that you could do this on a large scale and even if you combine these Technologies which in practice you most often have to do to make any impact but as an academic team we got also some hurdles so we quickly realized that the tech worked but something more was actually needed to make it practical for deployment and that's when we knew we had to move

Beyond Academia if we want to see this Tech on a large scale in practice and that's how the was porn was this a project that was more from a single Institute or was this like a larger scale collaboration cuz I'd heard a lot about like around this time these like multi-institution projects trying to tackle Co I know there was other initiatives like this and like you know larger call outs for research by governments was this similar were there multiple institutions working on this so this one I think you're referring mostly to the contact Discovery stuff so this was really multi institutional stuff that a lot of cryptographers and people from different areas work together so for this at least all the cryptographers were from K University of Technology we

had done also some uh legal Scholars uh from Belgium uh so this was like working with Mobility data from cell tower so you could really go to the telecommunication providers for the dator wow but it never happens it it is a scientific paper published but yeah because of the limitations you have as an academic team to move Beyond proof proof of concept we couldn't deliver fast enough so what is U tatso building these days we we hear often the name Theo linked with collaborative snarks yeah we're working a lot on collaborative snarks now at the moment and I think as Lucas mentioned at the beginning I think the ultimate goal is to build this yeah layer of security for

computation on the internet so something like TLS um so we're calling it at the moment CLS this compute layer security but like that's kind of a distant dream that like everything on the internet is encrypted and you can do all your computation over this and so in a first step um any sort of privacy preserving computation is interesting for us and given that we as a company but also as individuals have a lot of experience in MPC and zero knowledge and given that zero knowledge is like very prevalent let's say in the web 3 world now there's kind of a lot of sense in People Like Us looking at how do you do zero knowledge in an NPC in a distributed way and then the question

comes like well does it actually make sense to do that like why are you just trying to you know find nails to hit with your hammer and actually it turns out that yes like when you look at kind of the progression of how things have gone in the ZK world this makes absolute sense right because from my perspective at least and I think most people would agree in general roughly speaking at least m the kind of introduction of zero knowledge proofs were a lot for scalability in in the blockchain world so like it was more the succinctness that was used rather than the zero knowledge property of these proofs and so using zero knowledge proofs for the succinus reason really Advanced the

field let's say and then you have this kind of wide scale well WID scale somewhat wide scale a few times deployed and quite efficient snarks then you might think okay well why not add some privacy now you have these like welldeveloped tools why don't we actually use the ZK property okay it's maybe a little bit more um heavy in terms of computation maybe you need to do a little bit more mouth but like you know it's there so let's start using this and you saw this starting to happen over the last few years with projects like Aztec and Lao who who went to main net recently so yeah there are these networks now where they have a smart

contracts and you can use zero knowledge proofs and they have this sort of public States and private States and you're trying to do things between them and sometimes it's it's clear how you would compute on on a public State as you would in a normal blockchain like ethereum or something but in trying to compute on private State okay you can do a lot with zero knowledge proofs and we've seen like uh very nice examples of people kind of twisting and turning things so that they can manage with zero knowledge proofs I think one example we were looking at during the week was about some marketplaces um so kind of ZK marketplaces and you can let's say commit to some

information and put it in a Marketplace and say like hey here's some encrypted information here's the zero knowledge proof that it's legit and that you should want to buy it and then a buyer can come along and say okay even though I can't see the information I trust you that it's legit and the kind of information that I want because you've given me the proof um so I buy it and then they engage in a transaction but this requires the sort of manual step of the buyer actually finding the encrypted thing for sale so there's no sort of matching protocol between buyers and sellers as there normally is let's say in a defi protocol or something like this or in a decentralized Marketplace and this is exactly this point where you

need something like MPC or these collaborative of Snorks or some sort of place where you can actually compute zero knowledge proofs either together or some functions or or whatever so NPC is the thing that just kind of lifts all this fancy ZK stuff that we've been doing further into this sort of fully decentralized and kind of even autonomous if you want World U more than it could without from solo player to multiplayer game yeah exactly I remember the original collaborative snarks papers and so one was the Bon and Alex Emir one and the other one another one was uh actually presented at ZK Summit 7 so there's a nice little link here by patri MRA this was the EOS paper and back then

the way these things work was like one party had to split the witness into like shares of a witness and then distribute those and then parties with the sharff could collaborate to create a snark together is that still where we are today or have things changed like what are you guys doing so if we're talking about the private proof delegation case where you only have one party client site that is maybe limited and wants to Outsource the proof to some proof Market or to some beefy machine MH this still applies and is a very good way to you compute locally your extended witness secret Shar to the network and then the proof generation is extremely fast but

for actually the things that Ash mentioned if you have multiple players because in the mult party setting you have to compute this extended witness in an NPC protocol itself and we have done work uh with our first tool in circum which also does this witness generation step but for full disclosure it's not as easy as the private proof delegation use case so there you run into these problems that you always have with generic MPC MH what is circum so circum is our first tooling for collabor ative snarks it allows you to build programmable collaborative snarks based on the circum language so the front and the domain specific

language you can now use to write collaborative snarks or as I mentioned even now NPC programs is circum amazing so people can today write like circom plug it into the too tooling and get like the software for a collaborative snark exactly like what's the performance like so we have now here to differentiate between these two Parts the witness generation and MPC or if you're just doing what you mentioned was done at the CK Summit uh 7 I guess uh for the later part the MPC part is extremely fast because CK is very MPC friendly we would call it so the computations you have to do in a CK

proof are to 80% maybe linear so it's ffts msms and this is quite cheap to do in MPC so for example I give you some early benchmarks of our tooling and this multi-party setting we we're as fast as uh snar GS which has no MPC MH and we're a bit far off of Rapid snars but we I think theoretically we can go even to Rapid snarks so that's the claim also in the original Cooperative snarks paper everything you can do on a single machine you should also be able to do in the NPC setting you mentioned msms and like that sounds like it's elliptic

curve snarks so I'm just curious in the construction that you created is that always like with elliptic curve or pairing based snarks or could that also be a combination with hash based snarks so you're exactly right it's very friendly for the elliptic curve based stuff because there are group operations and this we know how to do very fast in MPC hash functions are particularly unfriendly to NPC because they're designed in a way to have many rounds to be highly nonlinear and that's some stuff you don't want to have in NPC there are some tricks around this but which get you some more costs at the verifier level this is really an very interesting open research question where

we also try to get some teams involved to pick up this topic of collaborative snarks that are hash based mhm so there are two parts really one part is is the witness generation and so this is probably very clear to people who know about zero knowledge that you you have a witness and then you prove some statements on this witness and this witness is either I mean if you care about privacy this witness is usually a secret piece of information so one part is actually um generating this witness in in a privacy preserving way um and this was done in an NPC F this can be done in an NPC fashion across different parties and so this is what we kind of refer to now as you know Computing or

collaborating on private shared state so maybe you have different private States across different users in let's say a privacy friendly blockchain and then they would all collaborate together on their different pieces of state to generate a witness and then this witness the second part of it basically is that with this witness then you want to generate the zero knowledge proof and so the question is do you do this in a single party setting or in a multi-party setting and so here again you can do uh a multi-party setting to generate the zero knowledge proof so it's really MPC and ZK at the same time it's Computing is zero knowledge proof across different machines so yeah each machine or each

each party or each user or each node or whatever the machine might be um comput some part of the proof and then at the end all these parts are brought back together and then you have one Z zero knowledge proof at the end and this is sort the outsourced proof generation part so we have two parts one is the witness generation and the other part is the the actual proof generation would it be fair to say that this is sort of to zero knowledge what multi are to signatures I would not say that okay how come because multisig what do you do right multisig are the thing is with M I hate multi6 I shouldn't say that out

loud but I really hate multi6 and um but with multi you don't have shares of keys first right you have each individual keys with which you sign and also the group is fixed and advanced right so you can't have this sort of ad hoc situation where people can come and go or or whatever so I would say it's not so I would say it's more like the threshold like threshold ZK more than multi- ZK interesting actually this leads me to another question like if you're doing you you just sort of this is actually news that like any one could kind of join this it's not a fixed group but is it fixed on a single round do you have to have X amount of participants to

create this the proof but then the next round they could be different is that sort of what you mean or yeah is it like within one round that people are coming or going you could reshare it so this is not a New Concept in NPC to reshare your secret shares and then you can choose completely different notes during the computation during the single round yes oh okay wild okay so it sounds like possible but painful it comes with you have some certain trust assumption maybe and also if the state is huge you also have to transfer it and write all the send all the data over the network so it depends of the use if it is feasible and also makes some sense so now that we

have this sort of little black box of our collaborative snark this multiplayer game that we can do I was curious like what kind of of applications do you have in mind for this technology inside and outside of like the blockchain space so from a very abstract point of view you need collaborative structs whenever you want to compute on more than one private State mhm so you can think of it like every time you do some matching algorithm every time you have some kind of information ass symmetries like in poker game or something like this then you have to create this shared State and that's what collaborative SNS are best for so I think like the use cases where we see people generally most interested

or when yeah like if you have I think marketplaces I think is is a nice one um because it is the place where you can't just get away with zero knowledge proofs alone you need some sort of computation to to get you over there to find buyers and sellers to match people and so any sort of yeah as Lucas says anywhere you need matching so like job boards or you know dark pools or dating apps or I don't know all this kind of stuff um just general marketplaces if you're trying to I think this Dark Forest game had um a marketplace where they're using zerge proofs to sell like locations and things like this there there is a manual

step like done by people where of course there's room to fail so there they could use coars for example to do this matching there a lot of the main places and as well the proof delegation so suppose I want to do some computation on my private State on my phone but my phone doesn't have the capacity to do like big proofs or I want to do the proof in an app but I don't want to like download all these zero knowled proof libraries in this app and have this huge bloated system on my mobile phone just for for whatever small thing there maybe you do some Outsourcing and uh in these kinds of cases we're seeing the people

are interested would the Privacy be maintained in that Outsourcing step both yes and no I mean you have the option so this again goes back to the the two points either you can do the proof generation just in a multi-party setting but you can also do the the witness generation and the Privacy like uh you can have privacy for the witness there as well well I'm just wondering like you know with the Prov marketplaces that exist and yet people want to do some proofs on their phones or on like client side but then they are sending it to be batched or like to be in like some larger system one of the big issues is that privacy is often lost along the way like if you send something to aover network for

someone else to prove on then they can see what you're doing and I'm just wondering here if you could do the witness splitting beforehand that would somehow keep that secret even if you're sending it to another agent to prove yeah you could exactly do this and actually this was also how we got to work on coar because we did work I think it's now more than one year ago work on a purely CK project and we realized that the computations that we want to do a just infeasible client side but it had a privacy component so we we realized we have to do something else here and everybody else was like brushing over just out sorted to a proof market and we

said actually no the BR always have has to know the witness except if you're doing collaborative snarks and so the first we did go down the rabbit hole studied all these papers about collaborative snarks and presented it at CK Sumit 11 so this was then more on the theoretical side which led us three month later to the first implementation but I think for us exactly this like the proof markets is I think for us probably one of the most exciting areas for for this now because it is a sort of Hot Topic and it is somewhere where we can like immediately fit in with the tooling that we have now

might not be super super efficient or maybe it's not perfect but uh it's something that we can already do and I think for us well at least for me I think this is pretty cool with all these use cases do you have anything that's already deployed already live that people can use so we have used our own tooling to demonstrate the capabilities just at ECC mhm so we did this was what basically a private guessing game that needed coars and so it was online for uh one week and in the end we rolled a proof on optimism um a coar that actually did the witness generation and the proof generation in our library and

how fast or slow was that so the witness generation was quite expensive so it took like I guess one hour the proving then is done in a few seconds MH I think we recently had Andrew Miller on the show talk about um tees and specifically like how they're a good solution to the the problem of collusion in MPC um since you know we're here discussing MPC I wanted to bring it up to you guys like is collusion a big problem with collaborative snarks uh what are the mitigating factors are tees an option and are you looking at these things so yes in MPC you always have to consider the potential attacks that could come from collusion there are certain NPC schemes where if you're part of the

computation yourself you can be confident your data is kept private M uh even if all the other parties collude however if we saw like in this private proof delegation setting this perfect setting isn't feasible especially if you're dealing with a large number of parties or some restricted devices so when the use case doesn't allow for this ideal setup we have to think seriously about the possibility of collusion there are several strategies uh one could use to mitigate the risk and to me the two most interesting approaches at least from a technical side are first you can make sure by randomly selecting notes

from a really decentralized set of operators that you get some good probabilistic guarantees and second uh the what you mentioned with Andrew Miller um the NPC Insider trusted execution environment is a very powerful way to prevent or at least get the bar on collusion very high because you first have to break the te and then you have to find some somebody else that wants to collude with you and maybe the second one even runs a different D so even if you have some exploit for one t vendor you don't necessarily have something for the second party MH Lucas is very diplomatic

about uh his answer would you be less diplomatic yeah I'm less into the te Story I mean I totally agree with Lucas that yeah like if you have tees from different vendors and like uh MPC no like if you have a fully decentralized setup and whatever it's great and I think it's it's good when you stack these things on top of each other and I think that's like the solution that many people are are suggesting at the moment and I and I agree that yeah for sure it makes it harder but something that I think I don't like is that there's always this sort of negative connotation with privacy everybody always talks about it in this sort of weird way and NPC also has this oh but collusion and it's like

yes this is like the best thing about NPC it's like okay we have like a super awesome problem to try and overcome and then people just throw tees at it and it's like is that your best answer like come on like let's think about this this is a super cool problem that exists in like a distributed setting in computer science like let's work on it instead of throwing tees at it and the other thing is that like in these places like even the University where Luca studied there's like Labs of people people like Bachelor students breaking tees for their homework like it's not hard to break tees so and it makes sense I I do think it's good but like if I just hope that people don't see this as like the

ultimate solution and like I really do hope that people actually think about the collusion problem one because it's a cool problem as AR know I think you arnno was on your Show recently as well and he like he always says like it's just neat like it's a neat problem like I want to work on these neat problems but it's also super useful for like every single decentralized system that we have right now so yeah I think work harder don't be afraid of like collusion problems and things like this and like coming up with new ways of doing things or new types of networks or new ways to join and communicate and compute and all sorts of stuff so yeah tees are cool and

they get us they get us some of the way but don't stop there don't stop there yeah so is the collusion problem the main research topic at tser right now or it's just in the back of your mind and has nothing to do with a company I would say yes I mean it's one of the it's the main long-term research problem like it's obviously that we don't expect solve it today or tomorrow but um I think it is like the number one long-term research problem I would say maybe Lucas doesn't agree but uh this but I think it I I would say so yeah it's maybe also the most interesting because you can approach it from not only cryptography but from Economic Security and you have different vors to

it they are more like cryptography and Engineering research questions we ask ourselves like one that comes up often is how to do lookups in MPC so such that we can support proof systems in collaborative snarks that use lookup tables and the second uh big one is like how do you construct general purpose MPC in terms of the architecture do you go for a virtual machine approach how do you model oblivious Ram so just a short digression and SE knowledge if you're theover you know what memory operations you have to

do and where stuff is located in MPC you cannot uh reveal the access pattern because if the person Computing the collaborative snar knows which memory it touches it leaks some secret information so this is a problem we don't see in the ckvm approach which is now kind of new to the programable cryptography world just to make sure I understand this are we saying the access patterns of the program that's being ZK or being NPC or are we talking about the computer that is running the NPC or running the ZK so for an example in NPC if you have an if Branch you have to do both sides of the program because otherwise you would leak

the information which branch you're going and if you have a lot of these informations coming together you actually have quite a good understanding of the witness in the end yeah got you same problem we have with circuits back in the day yeah just before we maybe move on for collaborative snarks I wanted to ask um is there other tooling than the circum sort of library that you have not yet but maybe soon okay I think uh we have hinted a few times that um so I think with the co- circum this collaborative circum tooling that we have um it we did it with plon and uh Groth 16 and I think we hinted that we

were also working on Honk oh and I don't know if any uh like big fans of honk no where is used but I think uh it won't take long for people to piece it together that we might be looking at Noir so I think the next um sort of release or batch of tooling will be around collaborative Noir right and then private shared state starts to make a lot of sense with a private exactly so this was I mean yeah so this will maybe be talked about at zk2 so hopefully things get done on time yeah this actually this episode will be airing before ck12 so people should be on the lookout we heard you're also

working with worldcoin tell us a little bit about what you're doing there so with World coin we're working on an NPC only use case so there is no CK involved okay the idea is that in the world contct Tre you have this database of Iris codes which are maintained to check uniqueness so that once you verify you cannot verify ify a second time M and the use case is to move this from a centralized database where you have only one owner that sees all these Iris codes into a decentralized setting with MPC where none of the operators knows anything about your Irish codes so basically MPC finding the whole

uniqueness check in the world coin TCT Tre amazing is that in the works now live soon is there things that people can check out like documentation maybe yeah so the first version I think went live in May and we're working on a second version with better privacy and security properties and moving from a two-party setting to a three-party setting and I think it will be deployed in the next couple of weeks which also will be GPU implementation which gives us much more frood actually that's a great point to to three parties we've been mentioning all this uh collaborative snars and NPC we never really discussed the the size of the part like how many parties we allow for

in these use cases in your benchmarks how many parties do you usually foresee and sort of in a close and distant future what will those things look like so for the benchmarks we mostly used the free party setup although we also have Shamir secret sharing which theoretically you can do with end parties and free parties is most of the for the most of the use cases uh the most efficient protocols so I guess we will will see if the use case allows these free party setups we will tend to see free party setups mhm would you say that like the work that you're doing going forward is more focused on the ZK side or the MPC side like where is your research headed like what kind of parts

are you trying to make more efficient where are you looking for gains so I would say we're very much focused on the MPC side but with the restrictions of NPC computations that appear in your knowledge proofs so it's like we have to really understand the CK system very much and at some point we might even make some tweaks to some proof systems to make it more NPC friendly I see have you come into contact with other MPC projects then like are you working with other MPC teams to like share info or yeah working on kind of building on some of the work they're doing we're generally coming most of us from Academia so we do a lot of

collaborations also with other universities so across the stack like doing with researches that doing more of like basic research very vertical stuff and incorporating this learnings into our tooling but also like people want to use our Tech that kind of build upon us and so there both directions that have a lot of influence of how we think about the tooling H what do you think the big picture is for NPC like where is it at is it really usable yet or do you think it's still sort of in this like almost usable State and yeah what what would be like its end goal I think we've seen with the the Whirl coin case that it is

actually usable now like I'm not I'm generally the type of person that doesn't like to overstate how how ready things are um but this I think is actually ready so with the iris uniqueness check like the world coin database right now is about 6 million people and whenever anybody joins the world coin Network or whatever whenever they scan their Iris in one of these orbs this Iris scan needs to be checked against all six million other entries in the database and like an IRS scan is not just like it's not like a signature or anything it's like it's like lots and lots of strings because there's like fuzzy data and like it's a camera picture and it's

like your iris which is super detailed information and there's a left one and there's a right one and like uh you know it's like really really a lot of information and all of this like a lot of information about each of your irises needs to be checked against a lot of information about two irises from six million other people so there's really really really a lot of computation and so to do this in in an NPC setting now I think we are doing around let's say 10 uniqueness checks per second so this is for me completely practical like uh this is a very practical large industrial use case so it's not like FH or something like this which is just further away

from being practical it's not fully practical yet that you don't notice it happening at all but it's there and I think the end goal is that kind of going back to what we talked about at the start and even how we met like communication on the internet like when I used to give these talks a while ago like when I first started getting into Crypt graphy like TLS you know you have this lock in your browser okay the lock is gone now but everyone used to say oh look there's a lock in your browser la la la this was very recent like it was only like 10 years ago really that this became quite prevalent what maybe 15 years ago now but like TLS is new and like it's kind of crazy to me to think

that like a few years ago we were just sending our credit cards around in the clear on the internet like like it's ethereum I mean it's like if you your credit card or your passport around okay it's not so public like ethereum but like it's very public and so kind of very quickly and overnight people like when TLS got switched on somehow by fluke okay it wasn't overnight and it took years of work and whatever but when it was switched on kind of people very quickly went of course we want privacy for our communication and so when it actually happens like when this flip happens it happens very quickly and so for me when like I look at the amount of information we send to Google and like we use Google Docs and we okay

I should maybe I shouldn't mention specific big tech companies but Google and Facebook and whatever that like we send so much of our private information and all of my life sits in these platforms upon which they're Mining and you know doing whatever and training AI models and all sorts of stuff and like controlling and shaping the way that I interact with the world I think this is crazy like it's actually crazy that this is just sent in the plane and so for me the end game for NPC ultimately is that internet computation is encrypted like it's as simple as this it's like the communication thing overnight it'll just be like of course how could we have

possibly built a business on ethereum without confidentiality how could we possibly have sent all our bad trades and our nfts and how can you possibly see every time I got rugged and now you're judging me and like it's terrible like okay at the start it's funny because we're all playing around and we're trying yeah um and like using new stuff and like helping our friends and testing basically being the beta testers for the stuff but if you want to go into the real world I mean it can't be this way so yeah so for me ultimately there's it's a private World powered by MPC or something like this interesting you just mentioned I mean you mentioned

worldcoin you work with them I find worldcoin still to this day terrifying um but it's interesting because like you talk about the iris matching we're talking about like eyeballs right they're scanning eyeballs and they're matching irises but I guess like you need such a it's such an extreme case that like if that wasn't properly private which I am concerned it isn't but then it would be really bad like I think it's maybe an example of the level of d opan that it could reach if it was out in the open and I know that they are working at least like they talk a lot about being on more private and being as open sourced as possible you guys actually are working on some part of it so you you probably know better but yeah

it's almost like the lighter the use case the less we care but over over time even those light use cases could become like it's it becomes like the pattern of your behavior that also gets mapped I love that you're scared of this uh World coin thing sorry like there was always like in the Privacy circles there were always like two no-o areas it was like don't give your Biometrics away and don't put secrets on a blockchain and like here we are like putting our biometric on blockchain I haven't either I do after we have deployed the first version you did you will after you've deployed the first version is that what you said no we after we have deployed the first version I did the did

it okay cuz I guess you knew the cryptography itself deeply that's a big trust in your own engineering team there yeah yeah yeah I mean what I do also find crazy though and this is not only blockchain this is like the fact that like 23 and me owns the genetic code of people and it's like not in the most private way is insane and so many people have done it and if any family member of yours has done it you're kind of exploited it's it's terrible anyway I I this is where I I think these things become ever more important and um it's nice to hear you working on it and that you're thinking about this actually circling back to the origin story of tat is there a world where you're

collaborating with uh maybe governments again or more like traditional industry to bring them into this new private computation world yes I do see that this programmer cryptography which we're developing now in the web free will eventually be everywhere Maybe we don't call it web free as we don't call something an online business today anymore which we maybe did 15 years ago online business yeah that's true e-commerce e-commerce but yeah I I I definitely think so and I agree and I think in pretty much every aspect of old industry let's say or the government like digitizing the government these are old

systems and they're falling apart and like they're hard to maintain and they're held together with like cellot tape and pencils type thing and and they're all talking about upgrading and they're all looking at ways to actually do these upgrades and I think a lot of them at least from what I have seen in like many conversations that I've had with banks and with governments and with insurance companies and payments companies and whatever like they all do look at blockchain because it is actually practical for what they need and like especially the banks and payments and insurance and document storage doctors like medical staff governments they need to share data across them like they need to share data

across different departments but not to every department and there are strict rules on what they can share and what they can't share and they're under heavy regulations and so like they're kind of stuck between a rock and a hard place because they want to upgrade but like the tools that are available to them now like public blockchains are public and so since since always I mean since as long as I've been in the field they've wanted to do this and sort of now it starts to become I think this world coin example is probably I mean I'm scared to say it but like I think it's like the leading deployment of MPC protocol like it's the most practical Big Industry project would you say Lucas or yeah definitely if we look at the

frood of the MPC how how much NPC computations are done definitely so having something like this now is like at least a nice tool in our bag to go around to the industry and say like hey look you don't have to ignore blockchains anymore because like they're doing it and it's like super sensitive data they did it based off you know governmental pressure regulator pressure so it can work and um I think it's a way to bring the the old industry and the new industry together interesting it's getting battle tested too I guess right like it's exposed so yeah are you concerned about it being hacked or anything like that there is the payer I

mean like in in theory it's secure mhm and I mean as far as we're concerned the implementation is good and it has been audited and it's open source I guess if if there's listeners who are interested in the work that you're doing are there ways for them to engage with this kind of stuff like to get involved with building MPC or the collaborative snarks there is a ton of ways like I mean right now we have released the co- circum tooling so if you're like someone who builds circum circuits or you know you know how to program there and you want to play around with NPC this is one way I think a few of the other ways that we talked throughout was about the research Direction so like if you are

someone who likes designing hash functions and knows a bit about Starks or things like this and you want to do Stark friendly hash like hash functions or NPC friendly this and that so like basically so that we can do collaborative Starks in a more yeah MPC friendly way that would be great other things generally the Privacy topic I mean I think it's quite important and I would love to see what apps people are trying to build what is particularly interesting I know there's like a few groups now there's the web3 Privacy now group who are doing a lot of nice interesting work um and collecting a lot of the

applications and use cases and projects so but yeah I think the main way is to try the tooling and and talk to us about Starks and collusion they would be my things Starks and collusion maybe not in the same breath but uh yeah like um I think the Stark the Starks and the collusion problems are the two two of the biggest research directions so you're saying Stark so is it the more are you focused now more on the hash based stuff we are not but we think about it a little and we would love if other people thought about it more ah I see okay this is a this is a request yeah Community request cool well I want to say thank you to both of you for coming on the

show and sharing with us the story of too and collaborative snarks and the work you're doing on MPC I mean we haven't done an episode in a long time on MPC generally so it's kind of it's cool to hear it being used in this way nice thanks a lot it's uh I've listened since the start and I always wondered if I would ever come on the show so it's kind of funny that I end up coming here now I'm a bit not the start start right Ash yeah no the actual start it's really bad yeah I remember listening because I was start no one should listen to the beginning of this show it was great I was still doing my PhD so I was like reading all these papers and I was working on little signature schemes and

things and I was like wow I can't believe like there are cool people talking about zero knowledge wow it was so funny yeah it was great well done to you though really and yeah it's great that you kept it going and it was really like even if it's funny to look back I think it was so great at the time I loved it even the very beginning though I mean there there was truly zero knowledge about zero knowledge like we did not know anything about that I knew very little my co- my co-host at the time at least was an engineer working like in blockchain for me it was really just like stumbling around in the dark but over time I figured out some certain things I hope I got some things going yeah anyway thanks Lucas too for for

coming on yeah thanks Anna and Nico it's been a great conversation yeah thank you both I want to say thank you to the podcast team Rachel Henrik and Tanya and to our listeners thanks for listening