Episode 342 - Catch up with Zac and Ariel

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week I catch up with Zach Williamson and Ariel abis on so last year in Spring 2023 I did an episode with Zach discussing the history of plon a work that he and Ariel co-authored and in a separate episode around the same time I had an interview with Ariel where we covered the snark Trilogy as he saw

it at the time now in this episode I catch up with both of them and pick up each of their stories from where we left off to understand what has happened since we discussed Zach's work over the last year in bringing Aztec to life and how it has taken a combination of different proving systems and Advanced cryptographic Techniques to build this general purpose private compute environment we also discuss arl's work in the last year starting with his work on lookup tables and how this gave way to more research on an adjacent but different area called IVC it was this work on IVC that brought Ariel and Zach's paths together once again and prompted them to work together with Ariel rejoining Aztec earlier this year now these are two of my favorite guests and I had a blast discussing all things from the details of IVC and how it works

as well as the fate of pairing based snarks we cover a lot of ground so I hope you like it now before we kick off I just want to point you towards the ZK jobs board there you can find job opportunities to work with top talent in ZK I also want to encourage teams looking to fill roles to post your jobs there as well we've been hearing from more and more teams that use the ZK jobs board that they have found excellent Talent through this channel so be sure to check out the ZK jobs board we've added the link in the show notes now Tanya will share a little bit about this week's sponsors attention all projects in need of server side proving Kickstart your rollup with galot ZK Cloud the first ZK optimized decentralized Cloud its flexibility and customization supports any proof system such as sp1 polygon

risk zero or ZK sync at rates 5.8 times cheaper than AWS with two times the performance get started with a free trial plus extended grant opportunities for Premier customers until q1 2025 in addition galot is currently onboarding institutional prover node operators register at gal.com so thanks again galot today's episode is sponsored by Alo a new era of decentralized privacy preserving Computing is here Alo a layer one blockchain powered by zero knowledge cryptography recently announced their main net launch now developers can build applications that take advantage of ao's unique combination of permissionless programmability and privacy start by

learning their domain specific programming language Leo write and deploy your first ZK application at leo.org or head on over to al.org to learn more about their technology and what you can build Alo this is zero knowledge without compromises so thanks again Alo and now here's our episode today I'm here with Ariel and Zach welcome back to both of you hey hello so I wanted to have you both on the show because last year we did two episodes with each of you but we did it right around the same time it was in April when we recorded it and today I want to do a catch up with both of you but also I know that you're now working together again so we can talk a little bit about

how your histories over the last year have also intertwined so Zach last time you were on the show you shared a history of plon Noir and introduced or kind of like announced the building of Aztec 3 yes and Ariel last time you were on the show we did this episode all about the snark Trilogy this is really your construction actually your idea to to break down snark history into these like three parts and we ended our talk where you basically admitted to have been Nova pilled by Justin Drake and actually I was there when that happened at a at at a dinner and you had also just been some Che pilled by Zach so those were sort of the last two data points that we had that you had gotten

excited about IVC and You' also kind of been excited about how some Che and IVC could be used together so in this episode I want to catch up with you um I think we're gonna start though with Zach if if the last episode was all about the snu trilogy is this like the fourth episode in the trilogy is this is this the reboot that that nobody asked for yeah May that that that way rehashing but I'm I'm down with it let's go uh just so just so people don't get mad it was a Trilogy just of pairing Bas snarks for all the parts that were not there and it was more a hypernova idea to to incorporate S and F and folding together and if you haven't listened to it do that now and then come back because it's a really good episode yeah so is yours though Zach so I want to hear because in

your episode we actually did the history of plon which was the work that the two of you wrote together back in 2019 oh actually Zach I had a question for you before we kick this off go for it do you remember the first time you ever presented plon do I remember the first time I ever presented plon so was it ZK Summit 4 this is what I'm hoping um it was ZK Summit in San Francisco I believe you were hosting it it was it was a milestone yes yeah going back so you you had talked in that last episode about the history of plon about Noir the ZK DS cell and you were building Aztec 3 what has happened since then what has happened since then so well we've rebranded Aztec 3 to Aztec um so we don't have to explain to people what Aztec 1 and Aztec 2 were um but okay so

a lot has happened on the kind of the development side of it because back then I think it was more of an idea we were still architecting it designing it um like fitting around fig figuring out how the heck it all works and nowadays um we are close to kind of cutting cutting the pre-release um so we we have the developer Network version of Astic out today and live so uh this is a fully um programmable feature Rich uh layer 2 um for the ethereum network but unlike uh your typical layer 2 we have strong privacy guarantees by default so you can write a smart contract and it can have private um Shield of state state in it so you can have um hidden identities uh um you can you can uh do things like you

know link identities and credentials in the real world to what's happening on chain and have that link secure um so that people can't Snoop observers can't Snoop into it all all backed up by ZK STS some of the Mad stuff that Ariel me my team and many many other people in the industry have been working on uh and um we are very ambitiously building towards our public test net which um we are hoping to release soon uh we don't have a firm release date uh yet um but very soon cool it's not going to be some kind of marketing or PR test net that doesn't really work properly it's going to be fully decentralized from day one uh and this is all backed up by our programming language called Noir which is the programing language if you want to write privacy preserving ZK snuck um

and so yeah basically development is really powered ahead uh We've solved a lot of extraordinarily hard problems to get to the stage uh something we discovered very early on was that when it comes to building um like privacy preserving L TW there was an enormous number of open problems that hadn't really been solved or tackled uh yet um that we had to solve all with the help of the community um yeah so it's been it's been a Monumental engineering and and research effort uh but yeah basically we we think we've solved all the hard existential research problems the hard critical problems so we have we have reduced the complexity of building this network to a mere trivial execution problem that we are we are executing on you are in the engineering and like almost end stage engineering of this production line it sounds like yes um

you mentioned that it's going to be decentralized from day one can you talk a little bit about what that means yeah totally so the normal playbook for L 2 is you know you have some L 2 Network that's posting blocks into layer one and in order to produce those blocks you need an entity that that decides which transactions are going in your network that is um your sequencer sometimes called a validator and they're they're drawn from some kind of validator or sequencer Network um in a permissionless and decentralized way to ensure censorship resistance so that's what we be decentralized uh by mean that any participant in the network in theory can earn the right to produce blocks it's not restricted to a to a permission set when you say decentralized here though do you mean that like this the sequencer

because we I think we're kind of familiar with the concept of a sequencer for l2s is that the part that's going to be decentralized will it be like a decentralized sequencer right off the bat right off the bat anybody will be able to be a secret as long as you can post post a bond and uh you know you have the the hardware requirements which shouldn't be too too difficult but yes you can you can produce astec transactions nice yeah actually I know zkv is is uh experimenting with the test net we don't know yet if we're going to be a permanent operator but we we are kind of playing with it because it's the first time I think that we get that chance to be on like a in a decentralized sequencer pool so it's fun to try that if as is the first decentralized eum A2 we are going to

gloat about that till the cows come home because we're about 2 years late to the party compared to some others yeah it's not I don't know if you are the first but you're the first one that we've had access to somehow so maybe there are some other decentralized sequencers networks that are like more closed maybe or they're very far away from ZK rollups so we aren't participating in them but yeah I mean if you want to find them just just announce on on Twitter that there are any and then they'll come out of the W and go yeah fair and something that you shared back at zk10 was this I think proving system called honk is that what's underpinning the aztech system like what are what is the cryptography under in in Aztec today right so so the complexity is is

relatively high in terms of what do you mean by proving system anymore cuz you have your fundamental like zero knowledge proving system that us to prove correct of transactions but then uh nowadays you have these these things called incrementally verifiable computation schemes or accumulation schemes and so um on top of our breing system we accumulate our honk proofs with something called protogalaxy which Ariel was a brainchild of arel and Li but then with prot Galaxy there are some issues with um with all accumulation schemes where there are very expensive components to them and so we we accelerate those expensive operations using something we call Goblin plonk um Goblin plonk yes and then and then also is part of the scheme in order to transmit information efficiently between different instances of the IVC we have this sasi independent scheme um called uh the the the data bus so we have this

basically this this weird Frankensteins monster of sub protocols that are all being assembled together in in some some kind of terrifying monstrosity and to to to to wrap it all together in a bow and pretend that it's a nice elegant clean proving system we call the whole thing together we call it Mega plunk oh Mega plunk Okay so wait what happened to honk then Zach I didn't hear honk component of Mega plunk honk is the fundamental proving system yes very nice like in the Transformers isn't there like a mega truck that they all form into Megatron Megatron honestly we were just thinking like what what are like what are hype names for for large things and because you know we're all Millennials and Boomers in Aztec um you know our minds drifted to ' 90s TV shows

so that's that's where Mega comes from very cool I want to Loop in Ariel in this conversation um maybe the way we can do it is Ariel you were working at Aztec a few years ago you left worked on CQ like a lot of lookup stuff when we were talking last year that's I think you were coming off of a a period of just releasing a lot on on the lookup front let's let's pick up from our last episode and maybe you can share a bit of the trajectory to rejoining Aztec like what kind of work and and ideas brought you back to the fold well on on that note we can uh sort of recap the end of our episode uh which was me uh in Zulu quoting Zach saying well some check is

is better than folding so that's why folding is not that great and and you asked well maybe you can combine them and just at that time there were rumors of this paper called hypernova uh that exactly combines the advantages of Nova and uh and Su so just a few days after uh we recorded the episode The the rumors on hypernova were confirmed uh it's a paper by Co kapali and seti that merges sort of the combines the advantages of Nova style folding and uh Su Che and that started a sequence of of interesting uh interesting works so sort of sort of uh broadly you could say what hypernova is

saying well we can sort of uh instead of committing to these error terms which was the expensive part in this sangria work that uh generalized Nova to plunk we can use some Che instead of committing to to the error terms uh and then this really interesting paper came out uh protostar which said we don't even sort of have to do the sum check we can sort of just fold the claim about the Su check being correct and and I think one of the still I try to plug this but one of the still underappreciated uh elements of of protostar is that we usually have some uh relatively structured constraint format R1 CS uh plish is is more flexible but the cool thing about

protostar is that the constraints are totally except there's some degree bound on the degree of the constraint the constraints are totally um arbitrary they can be anything you can take any any variables from anywhere in the witness and and you know put them in some constraint uh and there's needs to be the the if constraint and the if plus1 constraint can be totally different uh so I was uh yeah I was really um really like this protostar work just to add to that you know like we're starting to explore how to leverage this internally because it's a very powerful property you can do whatever you want with constraints they can be they can be structured they can be unstructured at a bare minimum what one of the things it does is it means that the SoCal folding verifier when when you actually want to

accumulate like instances of your of a of a single proving system the accumulation work that the verifier does is not at all affected by the um complexity of the constraint system which for us is massively crushed down the cost of um accumulation versus more traditional ways of doing it just to still set the stage though Ariel the reason that you got Nova pilled was because before that you had actually doubted it right and it sounds like Zach you still sort of doubted it back in April of last year at what point do you feel you got like IVC interested like when did that switch for you was it Ariel who got you to think of it differently when it comes to ZK what I'm interested in is stuff that is useful for ESC um and like in achieving ESC

goals and Nova wasn't useful um for what we wanted to do which was general purpose programmable smart contracts um and if anybody wants to to argue that come talk to me you're wrong really it wasn't useful uh because we wanted we needed to to accumulate um arbitary circuits you know from a set of a million different contracts um and NOA wasn't helpful with that so this is why I wasn't interested in it hyping overa at least in the form in the paper wasn't helpful with that because all of these folding schemes they were folding one second over and over and over again under the assumption that that circuit is some kind of virtual machine circuit it wasn't useful for astec it's not how we could do things what we needed was we wanted to we wanted to fold or accumulate completely arbitrary circuits that could come from a set of a million a billion different

circuits I got pilled with folding when protestar and Proto Galaxy came out I see that's when I got pilled because that's when that's when that was possible and until then I didn't I wasn't interested to to be to be blunt but now it sounds like this this stuff is throughout the system right you're using IVC based systems or techniques everywhere yeah another crucial element of protostar that we Liam and I used in proto Galaxy is that they don't fold a sort of a fixed circuit they they fold a protocol uh sort of rather than a circuit uh and that can sort of you can translate that very easily to okay so now we can get any circuit because if we're folding a a protocol we can have say the selectors of a specific plong circuit be the the first message in that

protocol I don't know if I get this like a pro you're fold a protocol like what's the difference between a protocol and a system yeah I realized when I said it so the protostar uh rather than a fixed set of constraints it allows you to fold a protocol where crucially as in the all protocols we know the there's Randomness the verifier sends Randomness during random challenges during this protocol okay and that is crucial to allowing the folding to work with different circuits because officially the folding does need to work with a fixed protocol well this is maybe a bit of a rabbit hole but when you allow Randomness you can sort of get a universal circuit without the usual overhead W weird wild but why maybe

maybe a way of a way of generalizing it is like protestan prot see they fold these black box protocol so basically you're proving some kind of relation and the manner in which you prove it it's very very Loosely defined in in Galaxy unlike the previous works that came before it where you had this very fixed concept of like a a function that that you had to fold um and so your blackbox protocol basically the idea is ha is with with with something like plon or honk or Mega plon or whatever the hell we're using these days plon is is a is a is a single protocol but it encodes in ARB numbers of circuits because you can by changing plunks select a polinomial values you're configuring different circuits and so so through that um with something like protostar Proto Galaxy

you can fold an arbitary number of arbitary plunk circuits together um because they still they're all the same fundamental relation does this have anything to do with like because I I've always understood IVC is like everything that's folded has to be identical right like everything are these like identical folding steps are you actually saying that in these new ivcs they could be different or are they still that sort of parallel of the same thing okay let me let me let me give it another shot I think emphasizing protocol versus circuit was a distraction protostar allows you to fold a randomized circuit um it is true that all folding schemes at the end of the day need to work with a fixed uh circuit um so but say you you want you

say okay but my circuit is not fixed I want to fold something else at every step yeah so I'll say to you okay no problem we have this concept of a universal circuit that by fixing some of it you can get any any circuit you want uh the problem with universal circuits is for them to simulate all circuits of size n they need to be of size there's a big overhead they need to be of size o of n login protostar allows you to fold uh you can call it protocols or randomized circuit and basically the idea is this is what pan leverages for example when when your circuit has Randomness it can be

Universal without this increase in in circuit size that's one one way to think about it that was one of the breakthroughs of plonk back in the day well so I wanted to emphasize that that's that's another advantage of protostar versus the previous folding schemes that that it allowed to fold uh rather than a determin istic circuit it allowed you to fold a protocol or you could think of it as a randomized circuit a circuit with where the verifier can inject Randomness yeah and I mean to kind of add to this I think one of the maybe this highlight is one of the difficulties I had which is when I was talking about these folding schemes particular before protestar even describing what I was wanted to achieve with researches was was very hard CU I'm

like I want to fold op second and they like there's no such thing uh and I'm like I'm pretty sure there is and then protestar comes out and I'm like see like let's see you can use to follow arry circuits and they were like I don't understand what you mean it's like from a researcher's point of view you can't follow arbit circuits from an engineer's point of view you bloody well can um and and the the difference is because of what I was talking about with this concept of like a randomized you fing a falling you look like a randomized circuit which is in theory it's the same circuit in practice when you when you actually like look at practically what's being realized and achieved it's it's not the same circuit I see can I try to paraphrase at least what I think I've understood I think what you've said is like and this is

where maybe I'm not getting this right but I've always understood IVC is having in its folding in the the folding is almost like a parallelization of equal activities happening under the hood and they all have to be homogeneous they have to be the same like it's the same action over and over again when you talk about Randomness I start to think that like what's actually in those folding pieces wouldn't all be the same but I think for IVC it still has to be the same so do you almost like emulate it being the Same by this Universal snark well it's yeah it's kind of like a it's like a trick um as in you're folding plonk circuits the plon circuits need to be uniform in a certain way they need to have the same number of columns they need to have the same number of selected

polinomial but the values of the select poils can be completely arbitary okay uh in theory sort of and so in practice it means you can you can fill different plunk circuits so Ariel you you are looking at me like I maybe didn't get it correct so correct me yes so the yeah the repetitive part is the the protocol for example say what you're folding is a plon protocol so that but you're thinking of it as like if in a regular plon protocol the the selector polom are just given in advance you're thinking of round no no no round one is I send you prover sends you the selector polinomial and also in the same round he send he sends the witness polinomial then the verifier sends a random challenge

approver sends back a message verifier sends a random challenge so that's the fixed thing uh that you're you're folding say you would in protostar Proto Galaxy fold this protocol I see and so what's going to vary in the different steps it's going to be the prover messages like in in one round one iteration the prover will send you know certain values of selectors in another round he'll send a different values and and sort of the the point that Zach was saying is the protocol is fixed but by sending different selector values in each iteration you are in fact having a different circuit uh in in each iteration of the IVC because the only if you look at different plog circuits what's different it's the selector values okay in regular IVC in the Nova

IVC you don't have protocols what is actually usually happening there you have a fixed uh uh you have a fixed set of R1 CS constraints okay so I'm sort of picturing like a lot of folding steps next to each other all sort of folding into a single thing up at the top this is sort of the visual that I have but each one of those would be the same R1 CS constraint system I guess it would always be the same right right and here you're you're incorporating plonk into it yeah instead of saying you're folding a fixed set of r1s constraints you're saying you're folding arbitary plunk constraints and this added more Flex ability it sounds like all of a sudden it became more useful for something like the Aztec system yeah because with Aztec what's happening is if you're writing a

smart contract in in in Noir that gets compiled down to a a collection of snar secs so you got one snar secet per function and so in Aztec when you're executing a transaction basically say okay well I'm I'm calling a function so here's the Cy of the function you know here's a proof and then that function calls more functions then you need to provide proofs of those functions and so basically at each step of the IVC in Aztec when you're processing an as transaction at each step you're verifying a function ciruit from a smart contract and so that function circuit can be anything cool all right so Ariel I want to just ask you though so in that last episode when we did this snark Trilogy you had these sort of stages of the pairing based snarks where does this

new work fall in that trilogy is it still in the third Trilogy or would you say there's like are we in on the dawn of a fourth I think the folding work is sort of independent from what I called the third sort of chapter uh I don't know I think in that episode I called it like part of episode two or like a Side Story okay um maybe I more realize it's significance so I would be more hesitant to call it a side story but in terms of leveraging the caring that sort of orthogonal to to this whole folding um development so yeah so I'd say it's like it's like a spin-off uh you know show it's like uh Obi-Wan Kenobi or something nice can you

share a little bit more so I mean you've just mentioned some work that you actually published in proto Galaxy uh yes that was you and Liam so that was some work that came out maybe you can just share a little bit about like when that came out what else have you been working on around that time right so so like I you know i' I've made pretty clear I was pretty uh excited and interested in the protostar paper and uh at least in the original version of that paper there was this sort of redundant uh logarithmic overhead um so that sort of uh motivated uh Liam and me to tweak it a bit and uh I think simplified a bit though it's may be subjective and that's what led to the uh to the Proto Galaxy uh protocol M to be honest sort of after the pro Proto

Galaxy paper well really after the the CQ and CQ land papers I sort of shifted gears a bit and uh I was more in a mode Less in a research mode and more in a mode of I want to bring these third generation pairing protocols uh into into production and uh you know I feel a little like a like a band that had a big hit uh although they weren't sure it was going to be a hit uh and then they they have all the you know all the confidence and it's a new song coming out the the song was uh CQ you know you're sure it's going to be a big hit and uh nobody or you know not to offend the people who there have been some nice Works building on CQ so not to offend people calling them nobody but

simplified oversimplify nobody cared so oh damn I uh yeah so it was it was sort of a a to a degree a year and a half of uh seeing that nobody cared uh at the very least not enough people cared enough to sort of overcome the hurdles required to sort of bring CQ into beneficial use uh and there there are a few factors here uh one one factor is the exciting work on hash based snarks including the EC fft work the circle Starks work MH and uh another element is I initially when we recorded that episode on the trilogy I I thought that CQ is like a hammer that you can use on any nail and and make it five

times better uh but it turned out and this is very related to the whole table decomposability thing that was very emphasiz very much emphasized in lasso uh that sure CQ can let you work with tables that say are a million times bigger so does does that mean a million times better uh and sort of the answer is not if your table is decomposable and it's a log million a log log one million times better which is which is far less impressive uh yeah yeah so I so that sounded sounded Savage I didn't I didn't mean like didn't mean to put it down it's it's also research I think another problem with C like with CQ is just that basically if you for for a team to build with CQ you're making a really big bet

because CQ is not compatible with all of the new like fancy hash Place research coming out you're basically tying your your yourself to the to the pairing based cryptography ship for five five or so years if you're using CQ and I think for a lot of teams that was a very scary proposition uh particularly teams that that are purely focused on kind of scaling so zkm teams uh just because it was like the narrative was all about hash based cryptography at the time that was that was that was the sexy thing Ariel I I really liked the way you kind of put this where it's like you were working on this thread of research you were very excited about it I remember last year and you feel like you kind of you put it out into the world this was going to be your second hit or third hit and it wasn't picked up at the same time

you got Nova pilled and some Che pilled and combo pilled and then found a way to incorporate protocols into it so yeah what what was your pivot like where did you where did you go well you could you could say that sort of fast forwarding a bit uh Zach Proto Galaxy pilled me okay even though it's it's my own paper because uh I I even I think was one of those people Zach mentioned that uh didn't understand uh didn't fully understand that it could be used very conveniently for you know what we can call nonuniform IVC in the sense that the circuit is different in every every dur duration I remember it was zali right where was it Z I just I went I

went up to and like yo like this this thing is really PR Galaxy is amazing you know we're going to use it and and you were like huh what's this about it must have been after that though right it must have been after that maybe afterwards was yeah it was in uh this Barcelona there was this really cool thing in uh barcel July yeah yeah uh there was this uh what was it called zon zon was there uh but we yeah this was a chat inverse Daniel did it yeah yeah that was a really cool was it called I wish I had gone to that it looked so cool it was like crypto crypto launch experience yeah yeah it was like some kind of shamanistic zero knowledge spiritual thing it was brilliant I loved it there were like crystals and like magic I could see from The Branding who

uh yeah he like he like predicted something I wrote on a piece of paper and I'm still not entirely sure how he did it um but um yeah I thought I thought you were just being a like thought I thought you were just being a cool cat but I was talking to you about it cuz you were like oh yeah yeah yeah you know like PL Galaxy and I'm like you know it's pretty cool we're going to use it for for like an Aztec and folding in your light um no I I thought you you didn't understand the paper I was like what do you mean fold the different circuits and every but it turns out I oh yes I remember yeah you were saying you can't do it and I'm like I'm pretty sure you can and I remember trying to SC scribble down how you can do it and you like nah this isn't work and I'm yeah

I'm like I yeah I remember getting a bit annoyed I'm like I have to arel how you can you can fold arbitary circuits because that's exactly what we're tring a so Ariel you had basically done this work without realizing fully that that's funny I just don't realize yeah my own potential I don't yeah yeah basically yeah nice yes so I mean that's kind of that's kind of the context of our Dynamic right you know Ariel does groundbreaking research then I explained to arel like like hows no not how it works but why it's groundbreaking I mean like even like right back in the the day where like I was trying to explain to you this this this problem I had of like trying to do the cyclic shift thing and then you were like oh yeah by the way yes just like trivial how you do it

here's how you do it and I'm like oh my god do you know what this means I mean go on a tangent like one of my favorite uh sayings is luck is when preparation meets opportunity and a lot of my my papers are like you know someone else needs a little piece to be completed for them and since I've you know spent all this time like learning these different pieces from everywhere I you know I can sometimes end up being that person and you know and I'm on these papers so are you the preparation in that I was the preparation and like uh yeah me uh having that discussion with Zach run into Zach where like he he had this little chunk uh Missing uh well I mean I think it's not

it's not like I had a a little chunk missing from a protocol I didn't have a clue what I was doing I think you're underselling your contribution that uh I think plon is uh I mean it's putting together in the simplest way a lot of pieces that were were already there um and and what one of those pieces like is is really this arithmetization based on selectors it it already which which seem seemed novel to people that were so much working with R1 CS it it already appears in the gkr paper that is I think from the '90s and now sort of has remade its uh I guess through the last paper sort of became popular again it was also present in the Sonic paper you know like I mean in the most basic way I mean plunk is basically you take Sonic in its unhelped form and

you turn could turn the polinomial the vector representation from M from univ polinomial in the manial basis to un poal in the LR basis and prestol Blaster you have plunk more or less um so yeah it is it is very much about sometimes very small iterative changes can create like a massive step change in the practice I ality and usability of a protocol well well here there's there's this interesting thing that you have these communities doing similar things but not talking to each other so much and in the sort of you could say Stark it wasn't Starks then but like say leie the ecosyst uh everything was in lrange base and in this I guess team maybe it's team it's correlated with Yen gr's team uh at UCL everything was in monom base yeah

this was pre plun that you're talking about though right it is p plunk yeah yeah yeah I I want to come back to the present day in our story which is you'd shown Ariel how you would use Proto Galaxy yeah I guess what happened from there well uh you know after I got to simplify a bit after I got Proto Galaxy pilled I went back to to Aztec a lot of this uh for me this last uh half year has been thinking how to present and in a simplified way what's going on in the in the Aztec uh system what what they're doing with uh Proto Galaxy uh which is in the the stack proofs paper that came out recently what is stack proofs is that the mega plunk are you describing that or you

describing something else well it's it's sort of what Aztec does with a snork so you could say in a sense it's like more one level above in the in the stack so so stack proofs is is about so when you think of it usually when we prove things in in snarks it's like a linear thing it's it's one circuit it's one program that goes forward but really you know programs are very cyclical because you have inner calls so you know you start with a function a it calls a function B you go into B you finish B you go back to a but so far we haven't sort of dealt uh with that scenario in in snarks too much because either we we sort of make it all this going into B going out we make it all just one big Circuit of

everything um or we we use you know a ZK VM and in a sense you then you can you can think of it as okay just running one command after the other in in the ZK VM and one of the commands happens to me will go to the memory where B's code starts uh but sort of the the the thing that comes up in Aztec in the sort of proofs of the private contract in Aztec is you so you have these contracts like ethereum the contracts have functions and now every function the the point here I'm emphasizing is every function is already tied to a verification key so this sort of the point in the paper sort of this creates a situation where the order of the proving has to be different than the order of the executing right if

in the execution we do part of a go into B go out of B back to a uh and we can still sort of do that if we used the ZK VM we could also prove it like that but when you when the functions have been individually snark ified during proving you have to first do all the proof for a and then do all the proof or B because they already have their separate verification Keys which you're you're expected to use M so that is what the sort of the paper and the Aztec system uh sort of describe how to deal with one thing I I I like about the paper is so we all know this we've been talking about this notion of incrementally verifiable computation yeah uh we introduce in the paper a slightly

different notion called rcg repeated computation with global state that I feel uh better represents what are the actual use cases of IVC in uh in many cases and the simplest difference in IVC right if you look at Paul valiant's original paper he's talking about a computation that humanity is going to be doing for centuries but in the actual use cases uh we usually have we know the end point uh so so this is one difference between IVC and rcg that rcg uh we are assuming sort of we know the end point and that's already that's appeared implicitly in in some Works uh ongoing work of Nexus and this Mangrove

paper work uh uh of Lev sukov from PSC but uh the STX proofs paper is the first to sort of formally introduce a notion that that captures this is rcg different though is it a different system is similar to IVC or is it a continuation on IVC does it use the same techniques more simplification right uh like the the assumption is that you that you need a weaker because um you don't need to assume that it's an unbounded infinite computation uh you you could you could view it as a as a relaxation uh so the first yeah uh the first thing is indeed that we're assuming we know when it's going to end and we can leverage that and the second

thing so the important thing in IVC is the prover complexity should depend on the complexity of for example the prover memory complexity should depend on the complexity of one step even if you're doing a million steps the space the memory complexity should be only related to the what is this of complexity of one step in rcg uh yeah we relax that and we say well that's mostly true your complexity should be tied mostly to the complexity of one step but we have this Global State uh for me example it can be the memory axis calls in the different iterations of some program right you have different functions but they they

have some Global variables they're all referring to so we relax a bit the the IVC requirement a space requirement you say well you are allowed to your space is allowed to be dependent on the size of this Global State yeah so it's it's one of these things where can I just this is a bit of a tangent but I think it shows how these days cooperation between industry and Academia is so much more closely knit than back in the day because with what RL is talking about the astics of is it rgc rcg rcd the astics aren't great because you have this this Global State Property uh where in theory the computational complexity of each step could be proportional to the global state so you know if this was five six years ago uh something like rgc um there'd be very few people I think

very few experts in the field that will be interested in something like that because uh it doesn't improve like concrete astics but if you want to engineer a protocol in Practical terms it's way better it's because because uh being able to have this um like Global memory map that you can access in your recursive system and it being relatively cheap is a huge deal uh but maybe if the year was 2018 and not 2024 maybe that kind of paper wouldn't you know wouldn't get you invitations to conferences it wouldn't get people excited about it and so people wouldn't care that much but nowadays things are very different and yeah I think it shows that there's much more cooperation now between Academia and Industry and the whole the whole Community is benefiting immensely from that h I want to sort of discuss something else that's been happening

just generally um I think we started with some of the Throwbacks to previous episodes and Ariel your throwback was to the paing based snark Trilogy I want to talk a little bit about the hash based snarks and their rise and how that is coming into conflict or maybe collaboration with the paing based snarks so I think pairing based snarks elliptic curve-based plonk I think a lot of the systems that we know a lot of the the earlier work has been in that c category and and also new work but this new like newer work like plony 3 plony 2 Bas these are all in the hash-based snark category hash based meaning like they're often using something like fry variations of and Starks were kind of

the original on that track can we talk a little bit about those two different styles of snarks and how you see kind of the future of the space developing with those two yeah so uh there are these two categories for Simplicity yeah let's call them hash Bas snarks and pairing Bas snarks there's a very different bag of tricks in each one where things will end up in terms of efficiency wh Which side will quote unquote win it's hard to say I'm not picking a side in terms of mathematical taste I prefer the elliptic curve side um definitely the narrative now is that the hash bait snarks are dominating that they're more efficient somehow

right they're faster they're just much faster yeah and they're more Hardware compatible uh this is also an interesting point that the hardware companies who were into the EC stuff pivoted to working on hash based uh and actually uh Jim from irreducible he told me that initially they thought multiscalar multip ation would be more Hardware friendly but when you go into the details the because the memory act it doesn't use a lot of memory but the memory access patterns are more irregular and that's one thing that made them sort of pivot more to that it's completely randomized for the best algorithms um I've been sorry to be annoying I've been telling people that for like four years five years um like that the ECC is deceptively simple on

the surface but yeah if you want to make it fast it's bloody well that's what it seems like both ingonyama and irreducible vatana back thenat previously and actually this is also you know I thought they'd be thrilled to work on a setup for CQ uh because that's a huge multiscalar multiplication but I guess they discovered what what Zach said um so I think one thing to say sort of in favor of the EC based side is that there's much more Firepower right now leveraging the bag of tricks in the hash Bas side okay and you know and coming up with new tricks like new papers like Circle Starks very nice so that's why I think this race is uh undetermined you could

say it's not random maybe they tried to work with the other bag of tricks on the elliptic curve side and ran into problems MH I I think I have a slightly different take um so Asic uses it at a curbed we are going to be using elliptic curve stuff for the foreseeable future but I I think it that if if there is a kind of a battle between these techniques eliptic cve cryptography is going to lose it's losing um because of a couple of things one of them is like that more and more as the field advances it's becoming this is becoming an Engineers game an auto cryptographers game and what do I mean by that is in like the there's a sted of expertise and and knowledge and and skill coming into this SE but it's coming very much from an

engineering side these days and the very nice thing about these hash based proving systems is that the the protocol complexity of them is relatively low the the number of cryptographic Primitives is relatively low um which means that the complexity surface of the cryptography is is small and it makes it easier to layer on top of that abstraction layers an Engineers bloody love abstraction layers um you know how do you break down something complicated you form abstraction layers and abstraction lay and abstraction layers and you build on top of those abstraction and you focus at refinements and optimizations at each layer what does this mean in practice it means that you know things like people focus really hard core on parallelizing 32bit Prime field multiplication across you know vectorized uh Computing platforms or things like that with a lip the curve

based snarks it's very different there's an enormous amount of protocol complexity I was talking earlier about Mega plun you know we have the honk proving system which itself it's some multilinear polinomial commitment scheme which is based off of a un polinomial commitment scheme and some and some i w some transformation uh and then uh we have this Su check protocol and then on top of that you know we have this incrementally verifiable computation scheme which utiliz goblin plong which is itself composed of three independent cryptography subprotocols and then we have this data bus and then you wrap it all together and and you have megga PL right like this is way much this is way more complexity than um some hash BAS system that you just Brute Force recurse Through um so why why are Tic curve marks useful it's because the stamp of of of knowledge and and expertise coming into the the ZK space in my opinion

they've got blinders on because everyone's focusing on scalability um as in they're not using the zero knowledge property of zerge proofs they're using the computation compression part and so people are used talking about they make Zer ethereum virtual machines they're creating Zer proofs of risk five and with these kinds of architectures you can leverage centralized compute to a massive degree so you can have a you can have a bunch of gpus Shing through computations you can have loads of memory the tradeoff space there is is quite unique as in now let's think about what ASC is doing ASC is privacy preserving computation so when you're sending an atic transaction a user is constructing a proof of correctness client side and there the tradeoff space is radically different because you are very resource constrained you're not just resource constrained in terms of computation but more importantly your resource constrainted in terms of memory which is

not something that literally nobody gives a damn uh you know you look at these papers these research papers coming out like no one's going oh we need to focus on memory consumption you know you you you have these abstract concepts of trade and like space and time trade-off complexities that's abstract nonsense when it comes to actually building building an actual robot system like you need you need concrete specifics nobody cares like literally nobody cares uh because when you're building a zkm or you know you're you're you're raising 100 million to build a risk five virtual machine like you can just you can throw terabytes of memory at at your problem you don't care we do we have one gigabyte of memory because that's what that's the memory you have in a phone um in a browser tab before before before Safari will shut you down and so in our very resource contrained world right now elliptic

based cryptography is not just better it's it's not a question of better or worse it's the only game in town it's the only one it's the only game in town because that's the only one where you can create an IVC scheme uh where the memory footprint is low enough uh like both the memory and the recursion Footprints are low enough that you can have you can do practical amount of comput client side uh and we'll see the shake out yeah uh because if I'm wrong then alternate privacy based layer 2's um and their ones that going to come online that use hash Bas snugs I don't think they're going to work for a while I think they all have critical weaknesses because of these resource constraints which which means that they need some kind of centralized actor in the mix and that that for private transaction Network I think is fatal so

in that battle the hash-based versus pairing based or elliptic curve based snarks what you're saying and I have heard this actually before is that the more Focus you have on client side proving the more at least currently you'd want to use the pairing Bas snarks with all of the techniques that have been developed to make those more efficient when you're looking at client side so this is like the ZK VM types they there seems to be a trend towards ever more powerful hash based yeah um which I mean I'm biased I don't I don't care about that because because in that in that world ZK is just a commodity um you know it's just pick pick your solution off the shelf uh well ZK is not ZK right it's kind of but um I think what we're seeing here is basically uh I

think this is the song of Li curve-based cryptography as in if you want to build a network like Aztec today you ain't got a choice if you think you got a choice you're I'm sorry I'm sorry um you have my condolences but you know you you'll find out but what about the do you see a future where hash based snarks could become small enough efficient enough could like could like the hardware of your phone be so good that actually you can do this kind of thing client side yes absolutely I think the more the more vectorized compute comes Ines available on a phone the more that these techniques get improved the more practical it becomes the the real difficulty right now is because your your memory footprint is so small the amount of computation you can do in a single kind of IBC step is quite limited before you need to recurse and right now

in hash Bas systems the recursion cost is very high um relative to folding which means that if you want to do client side computation with a with a hash Bas snar you you have this this giant overhead of of having to do all these fing steps um these falling competitions because the amount of steps in your IC is very large if that can get resolved then we will switch to hashbx I suspect it will get resolved soonish but not soon enough for for Aztec yeah and Ariel I want to go back to what you were saying because you were saying like you just intellectually you're more into parents based it's more fun for you I think but I know I mean you've said you don't want to pick a winner but like are you also exploring the hash based stuff or could you take techniques you

developed maybe in the pairing based and try to apply them in the hash based would that be interesting one thing on that side that I like is the techniques the mathematical techniques I like from elliptic curves and what's called algebraic function fields that are traditionally more on the EC side they have made recent appearances on the hash Bas uh side so in the hash based World they want to use as small as as convenient field as possible and then sometimes the question is how can you still do a fast fft in these fields and it turns out in these uh two very nice papers the ecft paper of uh I think a group of people from starkware don't remember the uh the names and the uh the

circle Stark paper they do end up using techniques of the math I I like indirectly for the hash Bas snarks uh so I actually have spent a good amount of time with those uh papers I see you just mentioned like I used the example of IVC as not being possible in a hash-based system but you're saying that there is work in that direction I'm glad you you mentioned that there is recent work uh a paper called accumulation without homeomorphism uh by Boon Mishra nuan and Wang on bringing the the IVC and folding stuff into the hash based world I would say you know to oversimplify it's it's a little messy like there's bounds on the

you have to do a little extra work there's bounds on the number of IVC steps you can do but yeah it's interesting how far that will go in in practice cool I want to say thank you to both of you for coming on the show and sharing an update on everything that's happened in the last year also to hear a little bit about your work together and uh also kind of covering that pairing Bas versus hash-based snark landscape for all all of us um is there anything that we should touch on before we sign off thanks thanks for having us on Anna um anything to touch on uh just you know I feel I'm contractually obliged uh as the Director of Aztec labs to say head over to aztec. network check out the latest no matter what what time you're listening to this podcast at there's

going to be something relevant um check out n or ZK programming language if you want to get involved with doing cool privacy preserving stuff don't need to be a cryptographer to to use it it's rust B really simple check out the azte network you know it's the next big thing for blockchain and Ariel I want to say thank you for coming on as well um I feel like this wasn't quite part four of the trilogy I'm actually waiting for that and maybe by then you've had some time to like are we doing the prequels are we doing the post quals like how does it work so I yeah I'd be curious to hear that uh for our next episode yeah yeah I'll think of uh of plots for that good cool all right thank you to both of you and I want to say thank you to the podcast team Rachel Henrik

and Tanya and to our listeners thanks for listening