Episode 365 - ZK in Sui & zkAt with Kostas Kryptos

Transcript

Welcome to Zero Knowledge. I'm your host, Anna Rose. In this podcast, we will be exploring the latest in zero knowledge research and the decentralized web, as well as new paradigms that promise to change the way we interact and transact online. This week, Tarun and I chat with Kostas Cryptos from Mysten Labs and Sui. We chat about the latest work they've been doing bringing ZK to Sui, with an update about ZK login, and Kostas introduces ZCat or ZK authenticator, a new research project that describes how to offer programmable and updatable access control to accounts by using the

properties of Groth16 in a new way. We also discuss the ways they are thinking about making Sui quantum ready, their work with the Greek stock market to try to bring it on chain, and more. Now, before we kick off, I just wanted to point you towards the ZK jobs board. There you can find job postings from top teams working in ZK. If you're a team looking to hire, you can also post your jobs there today. We've heard great things from teams who found their perfect hire over on the ZK jobs board, and we hope it can help you as well. Find out more at jobsboard.zeroknowledge.fm. You can find this on our website, and I've added it to the show notes.

Now, here is our episode with Kostas. Today, Tarun and I are here with Kostas Cryptos from Mysten Labs and the Sui project. Welcome, Kostas. Very good to see you, both of you. It's been a while. I'm super happy I'm coming back to my roots of zero knowledge and advanced crypto. Thank you so much for this. Nice. Hey, Tarun. Hey. Excited to be back. It's been a while. Yeah. True. So, Kostas, you've been on the show before. Previously, you were talking about proof of solvency for exchanges. And then last time you came on, you introduced ZK login.

Indeed. Um ZK login is similar to ZK email, which our audience might be familiar with as well. And in that episode, we had you and Ayush on together. Yeah. Today, I mean, I want to talk about all the ways in which ZK is now being used in the Sui and Walrus ecosystems. But, yeah, maybe I also want to share quickly my like my connection to the network. So, ZK V, my validator business, is actually running a validator on Sui and on Walrus, which has kept me kind of in the loop. Torun, what's your connection to the network?

I was a seed investor, um small seed investor, but kind of have known Evan for a long time. Um and have spent a bunch of time talking to different Sui DeFi protocols and um investing in Sui DeFi protocols. So, I I I I've been more on the not ZK side of Sui, let's put it that way. But um obviously excited about the fact that there's a lot more first-party support of ZK in Sui than a lot of other ecosystems and trying to figure out where that will go.

Cool. Thank you, Torun. So, Kostas, you have been on the show before, and I think we've done intros like extensive intros. But, why don't you just tell the audience kind of who you are briefly and what you're working on at Mysten Labs? Sure. Sure. Very quickly. So, by the way, I started my career as a AI engineer and researcher. I was hacked This is useful. I was hacked in 2003-2004. I I had a prediction market back then. I I used neural networks to to predict soccer outcomes. Imagine, this was my my job.

And uh because of many wealthy people using my engine to to do all of these prediction market selections, uh I was pretty much a target. And then someone hacked me. And after this, one of the like a very good professors in mathematics in Greece came to me cuz as you have to like improve your security uh posture in in the ecosystem. And then this is where I turned into cryptography. I did a lot of stuff around digital signatures. You will see me actually breaking the DSA, breaking zero-knowledge proofs, breaking quantum post-quantum schemes and all of this stuff. But, uh what happened and changed my life, it was 2009 that I joined the pretty much the Satoshi family. I was very close friends with many people who

were one of the first designers of Satoshi. And then I worked very closely with Mike Hearn, who was a creator of BitcoinJ, the the the Bitcoin library in Java. And this gave me pretty much a ticket to get into the core team uh very quickly like of of the Bitcoin network. I worked uh in many companies since then on on the crypto space. But, this is where Mark Zuckerberg started the Libra project on on Facebook. And then he hired me to lead the cryptography team. Um eventually the Libra didn't launch for many reasons. Not because of the technology. The technology was there. And you can see it now, so many projects emerged after the Libra collapse, right? Sui is one of them. Like, we had Aptos, we had some other uh projects from there. Uh but, the reality is uh the team at that time,

and if you consider how much money Facebook spent into building a cryptography team, it was immense. Like, it was probably a lot a lot of many millions I would say even billions working on on this uh particular effort. Facebook tried to build a stablecoin which was a basket of tokens back then. So, it was not a stable dollar, not a stable euro, but it was pretty much an ETF of tokens, right? So, some euros, some dollars, blah blah blah. At the same time, blockchain was uh not uh at its best. on outs with the government. Yes. Yes. Uh we also had COVID as you can imagine. Eventually the project didn't work. But, the team that we had was uh as I told you before, one of the best in the world at that time.

Obviously, Mark hired many folks into Silicon Valley and uh uh working for Facebook. I personally interacted with WhatsApp as well working on payments for end-to-end encryption in in the system. Libra had a plan to also be part of the messenger and WhatsApp payments. Eventually, nothing from this happened but the nice thing is Sui made it. So, five of us left Facebook. I was I was like one of the first who realized look, Facebook is slow, Facebook couldn't make it because of the regulation but at the same time we have a technology here that we cannot ignore, right? Mhm.

And I personally worked pretty much in the direction from the leadership of Facebook on solvency proofs. This was one of my first initiatives on on the zero knowledge proof space. Mhm. But also we did the first open source library for Starks, Winterfell. Probably you know Winterfell. Oh, yeah. Exactly. I was I was leading as a director of cryptography this project, right? I mean it was pretty much my baby. With Bobin, exactly. Yeah, yeah. Yeah, myself and Bobin actually started the project and Bobin was obviously the father of all of the engineering there but I was the the inspiration for for this project. And then eventually because of this Sui made it, a lot of people from Facebook, Google, Apple, many many folks around like Silicon

Valley who wanted to enter the crypto space joined us. And this is where we are now pretty much a blockchain that has some of the best ever finality times and a lot of innovation. You will realize that the rate of white papers even against like new ideas about zero knowledge is literally every one or two weeks. There is a white paper every one or two weeks in Mysten Labs and Sui around the new innovation. You do pop up in quite a few of our ZK Mesh editions. Yes. ZK Mesh is our newsletter that we send out monthly. We're always looking over new research. Exactly. Exactly.

we see your name. It's not always ZK what you release but when it is, it's in ZK Mesh. Indeed. Indeed. Look, you have to do you have to do many things. Obviously, ZK is when you need off-chain computations or like some privacy. At the same time, we cannot stay on this one, right? We very recently we had the announcement from NIST, "Hey guys, everybody should switch to post-quantum." And then eventually, as we see, most of the blockchains today are not post-quantum, right? And then how do you interact with agencies in the government in 5 years from now? You cannot. You have to switch, right? So, we work on this uh concept as well. ZK, by the way, is part of my story. If you see my team working at the moment on uh the transitions to to a quantum-safe uh like blockchain, ZK is part of it. It is part

because we all know like Ligero and STARKs are uh post-quantum secure. Yeah. So, gradually we have to switch into these schemes down the road. What do you actually have to switch to make it post-quantum? Like cuz Sui is proof-of-stake, so it's not like it's uh the consensus will be broken somehow, but like where is the cryptography that would need to be upgraded? It's everywhere. Uh even if we say sometimes that uh technically you just need to change the signature scheme and from ECDSA or EdDSA, you're moving into a post-quantum scheme. This is only one part of the equation right?

Mhm. So, one is the signature. At the same time, Sui is agile in the sense that people can do ECDSA, EdDSA, multi-sig. They can also do ZK login that is currently using Groth16, which is not quantum secure. quantum secure, yes. We have also some accumulators uh internally for the state management, which is also using elliptic curves. There is also even the hash functions as we go into the like quantum-secure uh like space and level, they have to be longer. Exactly. They have to be a certain kind. There are a few things that should change, and I would say even at the level of communication between the servers, you know, in some situations you have TLS now. And the TLS and the green bar we see at the top of the of the browser, it's not quantum secure

anymore right? Uh we're still using RSA. If you see all of the certificate authorities in the world, all still RSA-based. And they're not even elliptic curve-based. So, it means that we have to do a lot of work on multiple streams to to make this happen. And at the moment we have many cool ideas. We're going to discuss a few of them today. Some of them are requiring STARKs or Ligero or like system with zero-knowledge proofs because it's the easiest way not to change the logic but still be post-quantum secure. And some of them are just requiring new schemes either for encryption or signatures. But it's not it's not one thing. I believe it's like seven or eight places where we have to change.

When you talk about kind of making it post-quantum, like would you have to be updating each of these systems? Do some of them require like a full network up- upgrade to be able to do it or can you do it without doing a full network upgrade? So, the whole idea is the following. Let's go one by one the indicator logic, right? So, people now have mnemonics and these mnemonics are converted into elliptic curve signatures like we have ECDSA or EDDSA. Like Sui, Aptos, Solana EDDSA, some of them Ethereum and Bitcoin are ECDSA, right? All of them are not post-quantum secure. So, what do you do?

We're adding a new flag in the protocol. The new flag might be called as Bitcoin head taproot. It will be called post-quantum authenticator. So, everybody who wants to create an address that is now post-quantum, they have to use the new flag. Okay. So, like users would be or like applications using it would have to make a choice in their system. When you are creating a new account, obviously if you are if you are switching, you have to do something. Now, what's happening with the old accounts? And we know like Bitcoin for example has one very big issue with the sleeping addresses of Satoshi. There are some addresses that are there.

They're not doing anything. And imagine if there is a quantum apocalypse one day. Someone who the first target will be the 11 million like Bitcoins, right? This is where people will go to hack because this is easy money. So, because Sui is using EDDSA, people don't know it. But you know, EDDSA is more friendly to to be post-quantum ready compared to ECDSA. Oh, what are you what are you saying? I thought you said ECDSA. You're saying EDDSA? EDDSA, yeah. EDDSA, ED25519. As I told you, most of the modern protocols are not using ECDSA anymore.

They switched to EDDSA. And however, EDDSA has a very interesting property. Now, I will go slightly deeper into math to explain to people why EDDSA is a better like a selection if we want to go post quantum without the user necessarily creating a new account. Is it even possible? Some people will say, "Come on. Elliptic curves, how can someone be quantum secure if they're still using elliptic curves?" But there is there is a very very Is it like you wrap it in the arrow or something? Like do you just have to do an extra step?

Yes. So, that's that's the whole idea, exactly. I mean, now I'm obviously you're so experienced in ZK that you know the the answer before I mention it. Sorry. Yeah, no no no. That's that's that's the interesting part of the story, right? So, EDDSA, not ECDSA, EDDSA has a very interesting like peculiar way of creating the key internally, the private key, which starts from a random seed, and this random seed generates the private key. Right? This is this is how it typically works. But this is using a hash function.

So, technically, if people have the seed, which is considered the private key in the EDDSA sector, you can just SNARK, STARK, or dual arrow over the conversion from the seed to the private key. And then you can create a STARK key signature over this. So, you completely omit the elliptic curve part, and you only care about the key derivation part. And now, for the first time, we might have an account that the address maintains the same the same exactly the same format, but you're now signing with STARKs. You're not signing with ECDSA or EDDSA. And this cannot happen with ECDSA because ECDSA it have this property on then on kid derivation, right? It has to be

Yeah. uh a special version of ECDSA, typically deterministic ECDSA. But when you run it, so you're like cuz you have an address, you have you can sign with that address if you're the owner of it, and you run it through something so then all of a sudden it's post-quantum secure. But like if someone was to get your non-post-quantum version of your like someone accessed it, could they still sign on No. Like with the Okay. But why why no, right? Because one day we just press a button without sending anything to the system, but we say, "Look, everybody who had an EDDSA account, now we don't accept elliptic curve signatures. We only accept the Stark version of your signature."

can be a decision by the network, basically. can vote and say, "Look, we believe that there is a common threat because some countries, some agencies very close to a quantum computer. We're now pressing the button, and everybody who used to do elliptic curves, forget this part of the algorithm, erase it from your memory. Now you have to use the Stark approach for signing." Interesting. Even if you keep the same seed, right? Which is which is very unique. Very unique that but it is possible. So we will see a major advantage of uh blockchains after Ethereum that used EDDSA because they have this extra uh like little about little characteristic. Yes, exactly. Exactly.

So that's one interesting way to do zero knowledge, not for L2s, right? Protecting your account against post-quantum. Nice. Well, that's a great start. I mean, so this wasn't the the point I was going to I was planning on starting with, but I'm really happy like we kind of have we've led us into some of these ZK applications within Sui. It's also cool because I've been covering sort of quantum and post-quantum topics in the last few months, and I haven't actually spoken yet to a team about like migrating an existing system into a post-quantum one kind of when it's live.

So this is a cool example. Exactly. By the way, I call all of the non-quantum secure algorithms, some of them have this property I call them quantum ready. From now on. Okay. They're not post-quantum, but they're quantum ready. Yes, it's post-quantum ready. If you can do this this this trick with a stark, it is post-quantum ready without changing your address. Cool. All right. Well, let's kick off with some of the ZK applications, ZK other ZK use cases. I kind of want to start with ZK login because we you did present it uh actually our episode was back in late 2023. So, almost you know, whatever year a year and a half ago now. I'm curious what's happened with the system since because in that episode you did describe it, but I think it was quite fresh.

So, yeah, what's happened with it? How is it being used? Exactly. Now, it's the most used zero knowledge application in the world. That's the result. That's that's what you're saying, but more than Worldcoin cuz I thought they could they had that claim somehow. No, in in number of in number of proofs per per transaction, no, I don't believe so. Sui has so many transactions that imagine every single time you're signing a transaction, you need to provide a zero knowledge proof. I don't believe they have more. Okay. Okay. Cool. They have to create an account, of course, right? But every single time you're signing, I'm not sure they're doing the same. So, on verification side and how many times you have to do this on the blockchain, I think Sui Sui is by far more like used.

That's actually interesting that you're saying you need to create a ZKP each time though because like ZK login as you presented it was more like when you're logging into a web website or you're like doing something where you need to use your account in a very like tangible way, you're creating the ZKP, you're doing something there. But how how come with ZK login you're actually creating a ZK proof for every transaction? Yeah, let me explain to you what's happening. Yeah. So, changed or is it like I will explain the verification the verification is happening many times, but I will explain why.

So, when we do login with Google, login with Facebook, in the background, what's happening is Facebook and Google is giving you something, right? A small small piece of data that says, "Okay, it's you, Kostas. Uh you have an account on Sui, and that's your email, and that's your name," and so on. Obviously, you don't want to put all of this information on chain, right? Because then people will identify you. We want to offer privacy. At the same time, this doesn't give you a public key in order to sign transactions. It's only like something that Google states, but it doesn't give you the option to to to add the public key. We added the public key inside this result from Google and Facebook. And then we had to snark it.

So, we added the Groth16 on top of this. But every single time you're signing a transaction, you need to have a proof that your public key is part of this particular thing that Google sent you. So, when you go on chain, you have to verify the zero-knowledge proof because the transactions are not signed with ZK, they are signed with a public key. But to ensure that the public key is the correct one, you have to verify zero knowledge. Now, you will tell me, "Yes, for every single time you're using the same public key, you you need to generate a a proof." No, obviously, smart people are cashing their zero knowledge, and they submit it on the blockchain.

Cashing it, okay. Yes, but the blockchain has to verify it. Okay, so the verification is happening a lot more times than anything else because it's happening on every transaction. Got it. So, that's that's the whole idea here. Uh and obviously, because you're cashing it in the same session, you don't need to have like all of the CPU requirements for for zero-knowledge proofs. It just needs uh to happen once when you open your wallet. But verification-wise, yes, I I don't believe on the blockchain anything else is is doing more than us at the moment. Fair. I I had one quick question, which is, you know, I think of login as an auth uh format where it's individual user logs into service. So, like the topology is you know, hub and spoke, right? There's

like the hub of the thing that's logged into, and then there's all the users. Now, in a world where people are delegating their credentials to third parties, whether the third parties are AI kind of apps acting on their behalf and maybe logging in via tool calls or not, whether they're delegating it to third parties, you know, that are human or companies. How do you think about building sort of like access control system on top of login such that you can like do this kind of like delegation system when you have or even I mean the simplest version of this that is like live and used in crypto, right? Is a lot of the Telegram trading bots where they trade on your behalf, but you grant them some certificate authority for like some amount of time for some amount of

protocols or whatever, right? So, how do you how do you think about that expansion? Because to me that's sort of like where, you know, now you have way more interesting topologies of interaction between the users and the protocols, but also it's like the complexity for the user goes up. So, like there there's kind of the two dimensions you have to You and I look, ZK login by the way regarding the UX, it's actually removing all of the friction on remembering and everything, right? So, we realized for the first time that a lot of people that now using the blockchain, you don't even need to remember password. You just you're just familiar with logging with Google and Facebook just because you do that in in your everyday life. And then we we had a few companies that they were targeting a particular like part of the population.

Imagine Red Bull was one of them, Red Bull Racing. And they had to create a campaign and they said, "Look, there is no way uh like more than 1% of our users are going to remember a mnemonic. There is no way. There is already too much friction in the blockchain. And I understand that on the background there might be like a lot of math uh like Tarun, I agree totally with you, but we try to hide it from the user, right? The user doesn't even need to see a blockchain transaction is happening because they just log in with Google and automatically they have a way to to to authenticate. Now, obviously we don't want users to only rely on Facebook and Google and maybe they want extra security like I want and Google and Facebook. I want to log in with Google and Facebook so they both need to

collude and they also need to collude with my wallet provider like three out of three collusion in order to cheat my account. And then in Sui what we did is we created this like native authenticator which is multi-sig. So technically an application can just request from the user login with your two most major I don't know OAuth mechanism you have and you're going to have an account. Now, again this might not be enough because what's happening on ZK login is we're giving a short period of time where you can reuse the the result from Google. We don't want you to to reuse this for for years, right? Because the sessions are expiring on Google and so on.

So we created a new system that is called ZK Auth. This is Anna, this is the the new innovation that we had, right? ZK authenticator. ZK authenticator but because it's ZK Auth Auth like form of authentication, we call it ZK Auth because it's easier to spell it. Now, ZK Auth came exactly for for the question that Haroon made that Haroon made here about the complexity and how we're changing policies, how we can provide new updatable formats because we might say look, it's two out of three but tomorrow I want to make it one out of two and the day after tomorrow because I I had a divorce with my fiance I need to make it an one out of one and I have to make some changes, right? Yes, these

are these are things that are coming. I agree with you. So ZK Auth ZK Auth is pretty much an evolution of ZK login to provide custom and updatable logic. Which previously was very difficult because by the time you're updating your key, technically you're changing your address. How do you keep your address and still maintaining your key, right? There are two ways. One is you're doing it with account abstraction. So you have a way that there is a smart contract that you control and you're changing there the logic. But every single time that you're updating the logic, people can see it. Probably they will know, "Oh, you had a divorce." Why did you send your authentication? Because everything is public on the blockchain. Even if your authentication has to be protected from the blockchain. Do you know how many people I heard that I wanted to have a

safe uh safe wallet, uh which is the multi-sig wallet. Like, you remember what happened with with Yes, on Ethereum and what happened with Bybit and all of this stuff. But, I don't want people to know how many keys are there. And if there are any extra rules, like after $1,000, you need three out of five. After $10,000, you need something else. Zcash is actually solving these problems because at the moment, we don't have great MPC solutions that are working with conditions. Yes, there is the threshold MPC model where you can only do K out of N. But, by the time you're adding more complexity, we don't have good MPC protocols, right? So, you need to find another way to do that. And then we had a few banks as partners who asked, "Whatever we do,

we cannot easily use an account abstraction multi-sig wallet because people will see we're seven out of 10. We want to hide even this. But, we they we also want to hide the conditions when five out of 10 are signing, when seven, when the uh the condition is becoming very strict and you need 10 out of 10. You know, all of this stuff. And then we we tried uh Tarun to create a new system. It was very difficult. Originally, we thought it's impossible, to tell you the truth. Because you cannot solve it with STARKs, by the way. It can only be solved at the moment with uh things like uh Groth16 that has a trusted setup.

Oh. Believe it or not, for the first time, we said, "People believe that Groth16 is dead because there is a trusted setup and there are all of these like, you know, complexities how who is who is running the committee for for the setup and everything." But, then we said, "Look, let's use this as a feature." Why it can be used as a feature? Do we Do we understand here why Zcash of the you could run another trusted setup in a way to like Because it's your account, Anna. And because it's your account, you can run the setup in your head. Oh.

You don't need other people to run the the the ceremony for you. It's your account. So, you are running the circuit. You are running the public parameters. You are running the verification key. You are keeping the toxic waste because it's yours. And then, you can define the circuit to be two out of three with other two entities that are helping you, but you don't give them the toxic waste. So, it's only you that you can update the policy. Hm. Because in the first place, we want to protect only you. So, in all of the other crypto systems, what's happening on L2s, right? You don't trust the issue of the circuit because you might believe that this bridging L2 actually will steal your money. But now, we're talking about your authentication. So, for the first time,

you control even your circuit. Hm. So, we said, "Wow, we need a place where people can control their circuits." Can we go to Starks where there is no uh like common reference thing? No, we cannot because you don't control anything. There is one place where you control something, and this is called a trusted Something with the trusted setup. Interesting. Yes, you control the trusted setup because it's your trusted setup. So, technically, we said, "Wow, Zcash for the first time gets the toxic waste, and the toxic waste is converted into potable water. You can you can drink it now. It's You need it. You need the toxic waste now."

need it. Yeah. I mean, this is a very interesting feature, but I just want to check like the question that Tarun was asking now is like really about agents. And I'm wondering like does this satisfy your question Tarun? I think the reason it it kind of is it somewhat satisfies it, but I do think there's going to be this kind of thing where people probably really don't want to think about their policy settings, right? That's true. That that's true. And like I don't I'm not sure how you You know, I think in a world where people have this interaction where like I I go to a new app, I log in, I have to click authorize, whatever, and then I use it. That you don't have to think that much about complex policies. Like, yes, maybe for, you know, like some big company like type of thing, right? Like

Who do you think will help you on this? Do you know what I personally think? AI will help you on this. I have a feeling all of the wallets of the future have to have AI embedded. For sure. But but in order There's a chicken and the egg problem. Like, in order to get the AI to do all these things on your behalf, you also need to have it have a policy for like which accounts you're giving it permission to, right? You may today be like, "Cursor, you're allowed to log into my GitHub and Twitter cuz you're allowed to post whenever I make a pull request." But oh, my Twitter credentials got hacked, so I need to actually remove Cursor tomorrow or something, right?

Like My point is there's also there's like almost like a meta learning thing of like how much delegation you want to give to each AI, and that part is the part I guess I'm still not sure how you would do. a 100% Okay. Now Now I agree with uh with your like extending view of this. Look, we have the mechanism In my opinion, when I say the wallets have to be smart, it has to have You have to have an agent that you trust. This agent that you trust will have to do all of the digging on the web. Hey, you're using You trust it, right? It's running on your phone. It's not running somewhere else.

It tells you Cursor is hacked or something is hacked. We have to Hey, Tarun, we have to change the policy. I know we're using it for connecting to GitHub. And then the agent will tell you to do all of the stuff, and maybe by the time we're trusting so much the agent, the agent can even take decisions without you knowing about it. Eventually, we're getting into a cyborg uh situation, right? People are going to think with their their brain, but we're going to have aided decisions because of AI running in our devices or inside our body. I've even seen companies now doing embedded AI, literally under your skin pretty much like a tattoo.

And and we're going to see this. I I I have a feeling that the current landscape of wallets has been built before AI's like supremacy. Mhm. And we have to go into a state that Phantom and all of the big like wallet vendors out there, they have to give you an agent. That this agent will help you on taking these decisions because humans are impossible to maintain this this knowledge in their head. I mean, Tarun is right that we're giving so much access to to to agents here and there and that is becoming more common. You don't you cannot even work you cannot even operate. I cannot even imagine one of my engineers not using AI anymore to to to code.

On the other hand, every time I use cursor, I don't even know what tools I'm using. Like I can't even tell where where would you write like Like if I look at the tool calls that are being made and then I go like look at my, you know, IP out like netstat packet sniffing. I'm like, okay, this is making like 500 million more out going calls than I expected. Well, maybe cursor needs needs to have a personal agent as well or people will have their personal agents that they can connect them to any software that they're using. And this agent is pretty much your other your other self.

I I think of it as like your your your key management concierge. That's like That's a nice way to put But but that's I guess what I'm saying is like there needs almost be like a separate AI to dictate what the AI's key key management should be. And this AI is your AI, right? That you it has to run on your devices. You have to trust it. You have to do all of this stuff. Pretty much your your PA, like your personal assistant. Yeah. But going to your your point Kostas about like to in order to update it, you could change the access control because of this feature of Groth16 because you could, you know, do a new trusted setup and you keep the toxic waste. But could the AI agent be updating on your behalf?

Wouldn't that be very dangerous? Cuz then you don't have But you don't have that toxic waste. I totally agree and probably for accessing the toxic waste it might ask you. I don't know what is the UX there for the average population who are not like financially literal or technically literal. We have to to this, right? Obviously we're getting into a world where we have to coexist with another species that humans created. It's AI. Now, that's why we see there is a lot of like different work streams. Other people are building robots. Other people are building personal assistants.

Everybody tries to find a niche market to to to have a startup there. I have a feeling that we we will find eventually a solution. And eventually, we have we have the cryptography, right? The cryptography of MPC, the cryptography of zero knowledge, maybe you will have multiple personal assistants. All of them are independent, coming from different companies. And then they have to take a collaborative decision. Look, Tarun, we have to change our our strategy because Google was hacked. And Google is used in 20 different places in your profile. I'm not I'm voting. And then ask your other personal assistants, which are AI agents, to vote on this.

And then they will take it collaborative decision for you. It happened It will happen. And then we have MPC. They can communicate with MPC and probably some zero knowledge proofs because the other problem we have is the computations. This cannot easily happen on the blockchain, right? We might want a zero knowledge to prove that you run the AI logic and there was no human hand intervening on the result of the AI. This is another thing that we're working, by the way, here. We're having ZK verification of off-chain computations. Mhm. But our computations that are not in Move necessarily. They're not in the Move language. It might be on something else.

Right? So, yeah. Another application of ZK. Yeah, before we I want to I want to just make sure we fully cover ZK, though. So, you've introduced it. I do want to now like I think if you can explain a bit more cuz I think you introduced it in this context of like Yeah. updating um access control. But like if you wanted like yeah, what is it? You've sort of said there are MPC uh like multi-sig type wallets, but they're too public. This I'm guessing this is not MPC? Let me explain how it works.

So, let's assume that you want to have your own custom logic. You create a circuit. Now, we have many ways to create circuits. I mean, we have languages like Succinct, Cairo. There are many different languages, high-level languages where people can write their uh their logic even I think Succinct is Rust, actually. Even in Rust, yes. Even in Rust, you run whatever logic you want. And then you convert it, you get a circuit, and then you can get your public parameters, you can get the verification key and everything, right? Or you can you can fold it eventually to a Groth16, and the Groth16 is is folding into whatever you want.

Now, after you create the circuit, let's assume that you created some logic, right? You have the toxic waste because assuming that we're using Groth16, you run the ceremony in your head, you created the toxic waste for this particular ceremony, you keep it, and then you know, let's assume that the logic was a two out of three. So, in this two out of three, you ping the public keys from the collaborators of you, the other two entities that are helping you to recover. You are asking them every single time Sorry, it's it's a two out of three implemented as a zero-knowledge proof circuit. Like, internally the circuit is verifying two out of three signatures from this particular three public keys, right?

And then, you're having the verification key, and the verification key is hashed into an address. That's your address. The address is the hash of your verification key that you are the only person who can create it, and you are the only person who can verify against this verification key. Now, whenever you need to sign, Mhm. the other people don't know what you're doing. There is no MPC, right? You're just asking them, "Give me two signatures because I want to sign this message." And then it'll be hashed. And then No, you you're getting the signatures from them. There is not MPC. You are putting them in your in your prover. You are also putting your signature in your prover. If you have two out of three, the prover will give a good result, and so it will verify on chain.

So, imagine we created a logic where the uh verification key is your is your address. If you satisfy the logic off-chain, you just provide as as a as a signature, you just provide this as an input to the transaction, and along with the transaction, the blockchain verifies it. Nobody knows your logic though. Like only probably your collaborators, if you if they ask you, right? Are you using a two out of three? But you might even hide this from them. You might do something else that they don't know. Right? But let's assume that it's a two out of three, and at least your collaborators, they know the logic. And one day you might say, "Look, I want to change the logic from now on. I want to use something else." So, what you're doing is you have the toxic waste. You can now go back, create another circuit

that results to the same verification key. Oh, interesting, but not a two out of three. You're basically like it's you're using the fact that like these systems, if you have the toxic waste, are kind of hackable, can be changed. Exactly. you're hacking it yourself, and have multiple proving keys going to the same verification key. That's the whole idea. And then, because of this, now you can have another logic which goes to another proving key, and then this proving key is is different logic now. How complicated can the logic be though in such a system? Can you actually create something like these thresholds? Like if we're doing XYZ, then I only need two out of three, but if it's something else, then I want Anything.

four out of five. You can create like a more com- It's not that you have to go in each time and like update it. Well, you you update it only if you need to update it, right? I believe most of the but I'm I mean like could you create like a whole list of logic? Yeah, you can do whatever you want. Depending on context, and then just like do one update with the toxic waste, and in- include all of that. Exactly. The reality is you can do you can do many things. You can even do updates on things that you haven't predicted before. That's the other idea, right? I mean, it's possible with ZK-SNARK. You can just create a new proving key because you you just added a new condition that you never had at the very beginning, and you can convert your scheme into the new

condition, right? And And that's how we can we can personally uh have an updatable circuit, updatable authentication logic. If you're asking me though most of the companies, they don't care about the update. They do care about the private authentication logic. This is more important for most of them. Like, I believe if the if you end up into a point that you want to change your your your conditions like down the road, maybe you're also comfortable on switching addresses. It's fine. But if you're not, yes, ZK has a version that is called ZK plus. You can also do the update if you hold the the toxic waste. Some people might decide with ZK not to keep the toxic waste because they don't want this to be updatable.

Okay. So, ZK works with either updatable circuits or if you want updatable, you use a version that is called ZK plus. And the ZK plus has the update updateability as well. Mhm, interesting. Is that in the original paper? Yes, both of them. Both of them are. You gave You gave me an idea for a sort of odd thing, which is imagine I actually wanted to have a random number of signers because I have I have say some set of agents that are working on my behalf. But I only need a random subset of them to sign. And my security model is that like hey, as long as like enough of them are live, I should get a real signature.

What What One way I think you kind of see this happening when you're using AI tools is you'll oftentimes see, you know, when you look at these things that are routing across multiple models, you will see an aggregation that comes back and you could imagine that that gets signed like the aggregation of like a joint step by fanning out and joining back in. Can you do random numbers of signers like where you don't know ahead of time, but you kind of cuz like there is a sense in which yeah, in this model where like the the number of signatories could be, you know, not known ahead of time.

Something that you can do. I don't know if if this works for the random signers, but I will give you an example. Let's assume that I started with a one out of one. It was only me. I'm using Zcash. Nobody knows it's one out of one. Some people might believe I do it on purpose that I have a threshold wallet. Nobody knows, but and then suddenly I need to add more people. I don't know the number originally, but then you tell me when you say random, it's converted into three out of three or something else, right? For audits, they tell you me as a Deloitte, I need to sign the transaction and I need you to sign the transaction and only then I know it's you.

Then probably with your toxic waste, you can update your your circuit into something. However, imagine that you have a toxic waste. You as a user, you can still cheat, right? You can still use the one out of one because you you know everything. It's your account. So, in that sense, if it's like something in your logic that is controlled by the auditor and not you, it's a one of the applications that Zcash doesn't work for you because we need to find authentication logics where you control everything and nobody else can dictate to you what they want to to to sign on behalf of you.

Right? This is one of the limitations because by the time you're having the toxic waste, you can just replace the circuit to something else. Yeah yeah yeah. It doesn't It doesn't even require a signature, so you bypass the prerequisite that they ask you a random number of signers. Yes, you can convert this to to that, but if you hold the toxic waste, you cannot. If you don't hold the toxic waste and you have the toxic waste between you and the auditor, then it is possible. So, we might ask some users that you are creating accounts where the toxic waste beforehand even on day one, it's only between you and some auditor or some issuer or someone else.

Nobody can see it, right? You have to collude both of you, but at at the same time you can both use Zcash plus to update the circuit anytime you want in the future because the auditor wants to add another auditor or they want to do something else. This is possible. Zcash, although we say yes, the user has the toxic waste in their head and they don't need the ceremony. The nice benefit of Zcash another property is you can have the limited size committees for your like circuits between you and other entities that they are helping your account. In this particular case, it might be an auditor. So yes, if your account sorry, the the ceremony between you and the auditor, yes, we have some trust that if both of you don't collude, you can still update the Zcash circuit

in the future. It is possible for this to happen. And in the future it has to be a game the two of you that will run the new ceremony probably with some MPC now because now I have two users running a a new ceremony, right? Yeah. But without this step, without this step, you cannot do it unfortunately. Yeah, yeah, yeah, that makes sense. I I I I'm only asking this type of stuff because I think like the traditional crypto interaction has been assumed it was like one user one key, right? Or like one user many keys. But it might actually be one user many users and the number of users is these people you delegate keys to and that's dynamically changing, right?

certain number of those random like the total number that might be issuing something could change? but you need to like hit a threshold. I I can I can answer that I think. So, Karun, he's right. There are two reasons to have a multi-sig, Anna. One is because you want to protect against yourself losing the key, but it's still your account. You're helping you're helping guardians that you're helping people who help your account. But there are indeed if you go to your bank account now, sometimes you can have a bank where it's you and your partner are owners of this account. So it's now two people owning this multi-sig.

In the second part where it's multiple owners of a multi-sig account, they are not just guardians of your account, they own part of the account. Then you need the trusted setup to happen between all of the owners. Mhm. Otherwise, because now it's not only one person that owns the account, right? So, imagine what's happening now with the There is a wallet that is using MPC. I think it's called ZenGo, right? I I don't know if you know ZenGo, the the wallet. The ZenGo wallet is your account, and you need to other places, to other parties to help you recover, but it's your account. ZK is a great application for this. You are creating the circuit. You are having two guardians that are helping you recover, but there might be another type of multi-sig, which is me, my son, and my wife, and we have a two out of three

ownership over the account. It's still the same multi-sig, but conceptually, the ownership is not only on me now to create the circuit. It's also in my wife, and it's also in my kid. So, we need to try to run a ceremony between the three of us. I still don't know if this answers that question though of like the random number. So, the reason I say random number, right, is like you go into Again, I don't know why I keep only using Cursor, but Cursor is like a good interface cuz it's easy to kind of imagine how it works. Like, so Cursor right now has their own model, which farms out different coding tasks, sub-coding tasks to different models, right? So, like, okay, Claude is really good at debugging stuff, but it's horrible at doing numerical math, so like

I'll only farm the kind of like run test case small context things to Claude. The large things I'll send to Gemini or or OpenAI. Now, the number of calls it makes depends on the structure of the code it's writing, but the structure of the code it's writing actually it's learning incrementally. So, it might be like, okay, in the beginning I'm farming everything to Claude. Now, I'm farming everything to five different workers, one Claude, one Gemini, three OpenAI, and then, you know, a few steps later, okay, maybe I'm going to run a a deep seek thing. And my point is like the number of people who are involved in like if you wanted your code signed by each of them incrementally, the number of participants is like dynamically changing based on the code it's outputting, right? So, you might not actually be able to know ahead of time

in this type of case. That's indeed Look, if you don't know the owners of the account, but if it's your account by the way, it's your account, right? In this particular case, you just need other people to help you again. Yeah, you're delegating somehow. Yes, it's fine. It's fine that you provide the new circuit for them. Now it works. If all of them, however, had access some financial access on this account, which is not the case if I understand correctly in the case, for example, Mhm. then it's more complicated, right? We cannot if we have an updatable committee of ownership, like originally it was myself alone in that account. And then my wife has to my account. And then my my my kid has access to the account.

Then we're talking about change of ownership because the ownership changes. One day I might also leave. I was originally, but now I'm not a part of the account. So for this, it's a more difficult problem. I don't believe humanity has a solution to this. Um unless you're you're having another ceremony that the the toxic waste is is shared between the ceremony and you trust this ceremony to do the updates on the circuit. Only then this is compatible with ZK. Mhm. But he's talking about delegation, so he's not talking about ownership. Yeah, if it's delegation, it's fine. You can delegate.

Yeah. So but would it be I mean it would probably be kind of clunky, right? Cuz you'd have to like run the thing again. You basically have to do an upgrade once you know the number, but it sort of still doesn't solve your problem, Torem, because you're saying like you won't know the number beforehand. Here it's like you have to wait till you know the number, I think, to update it. Yes, but you will know the number. I mean, they will tell you that it's deep six now. Create a new circuit with deep six. I was as part This is Yeah, yeah, yeah. It is It is random, but at the time you're creating the circuit, you already know the number.

Yeah, it's like you know it's almost like it's random, but you know the seed. You're getting the sequence of seeds, you know, so like you're like I I I get that that works. I'm just I'm just I guess I'm just trying to think through like in a world where your financial transactions are done this way, where you're not you're not signing ever, right? You're you're only delegating and then you're delegating infrequently and then these things are running your behalf. You do have to construct this kind you know, how do you manage that? And that was sort of what I was saying. Look, all of this should happen in your wallet seamlessly. You shouldn't even see this is happening.

Now, do you trust this? Do you trust it? I don't know that it will happen. Exactly, exactly. I don't know. Like like you do run into this kind of like who watches the watchman problem of like who watches the who trusts the policy choosing agent whatever right like and and and no cryptography alone can really help you with that. Sorry for the very random hypotheticals. no, it's it's a good it's a good question actually. Maybe I should update the paper with all of these questions from now. I will go back and hear the podcast and I will ask my team, let's have a Q&A at the end of the day. think about this one.

Yeah. Yeah, work it through. I I mean the the other thing is like I I think to me this is kind of the interesting use case of Zcash is is these types of like situations where you maybe want to update because in general I think even after say hacks of like by that style things, there is a long time before people can actually do these updates and it becomes very annoying to do like like you know, if you looked at kind of people's changes in those safe policies post by that hack, it was like it was kind of slow to actually occur right?

And I do feel like if you imagine you had a a circuit ready that was like in emergency change signers to X. Oh. Right? That was already pre-signed. You would already you you know stuff like that I think is enabled by this that is like currently kind of not really around. That I agree but imagine that if you are running the ceremony in your head is by far faster than a real ceremony. It's it's only you. So technically it's not like hours to to compute the the common reference string. You can you can do it faster now. Yeah, I just think there's a lot of security stuff also like this like this like in response to attacks automatically adjust policy type thing.

Right? Like like if more than X% of this wallet moves, which is likely a hack, then like adjust the policy to be N of N from K of N. That would be cool. I don't know is that already I mean this would be in your logic though, right? This is this would be something you would decide Yeah, you have to decide that ahead of time, right? Like By the way, if if Zcash existed and let's assume that Bybit had this in in their hands, technically they could have another logic that if there is an amount that we haven't seen in the past and imagine your your providing the transaction history as an input, be a bit more aggressive and try to ask why, right? Don't sign it blindly. You probably need all of the signers or you

probably need to have a different alert on the wallet that this is this is not common. Anyway, many things went wrong in the Bybit situation, if you ask me. I I have my own opinion on this. I don't want to get into that now. I I mean I will say I I in this world where you can delegate like access, you shouldn't have wallets with like a billion dollars on them. Single wallets with a billion Yeah, exactly. The first the first problem there it was it was their mistake in my opinion that they didn't split the balances, right? You cannot have one wallet on everything on one wallet. Who does this?

I Bybit does it it seems, but I I I don't want to see that again. And and imagine I'm I'm very because I don't know as you know, I'm also very sensitive on proof of solvency and all of this stuff. I feel really bad why why we're still doing the same mistakes. Yeah, I I I I guess like another point is like I could compose a proof of solvency a proof of insolvency like below some threshold and use that to adjust my my off parameters, right? Like somehow I don't understand how cuz like a lot of the MPC centralized MPC wallets do that, right? Like you know, you go to Fireblocks or something, there's there's like the policy. You you can choose your policies and then they get executed, right? Like oh, this means someone else hacked, so like stop pause my account.

Somehow that hasn't really hit a lot of and and I to me that seems like very easy to do the cut. But correct me if I'm wrong. That seems kind of like is easy. In ZK cut you can define all of these policies originally. If you don't like something you added down the road, it's your account, right? You can add whatever you want down the road and then eventually there will be a final state where it feels safe to continue with that. I mean, I also not I'm not to keep harping on this cursor thing. But I tried to write a circom circuit in cursor that I did and it worked. It only took me like half an hour. I was like actually pretty impressed that I compiled. I like I'm look, I'm not going to say it was a secure circuit and that there was no

attacks and whatever. I'm just saying like I got it to compile and do like and it was just doing some like basic D5 thing. But I was actually I feel like people aren't going to write circuits anyway. Like like I know I know the like ZK VM version of the world where people aren't going to write circuits cuz they write it for a VM. But I don't even think they're going to write that. I think it's like it's like one level higher. Uh you make an interesting point. So what I believe will happen, these circuits will exist. The problem is ZK what it solves is you don't even know what circuit am I using. Even if you created your your own circuit Tarun, I can get it, but I can seed it with my own stuff. So nobody knows we're using the same logic.

So if we have templates, people can can do all of the composition and do whatever they want eventually with by far easier like logic. Because I I sense that most of the conditions will be very similar, right? I mean, we we want I don't know, 100 different flavors of authentication. It's not like millions and billions of authentication logic. And then uh maybe we're going to have a a repository of all of the known authentication logics and then people will will have like to compose between them or use them as they are, right? The problem is ZK doesn't reveal what did you use as a proving key.

That's that's the benefit. What is ZK today? A paper. It's a paper, exactly. I just wondered if it was like implemented. Or is it It's a concept right now still? There is implementation internally, but uh it's not it's not live in Sui yet, right? Well, How will it be like how will it be rolled out? Will it be like part of ZK login in a way? Like will a new a new authenticator. So, in Sui Okay. in Sui we do have I mean pretty much like Bitcoin, right? Bitcoin uh two means something, three means something, four means tap root. I mean, you know, you have some flags. So, in Sui we already have five, six flags. There is the EDDSA flag, the ECDSA K1, the ECDSA K2, multi-sig, ZK login. There are already five flags.

Mhm. You are adding a new authenticator. This will be, for example, the sixth flag. And the sixth flag will say, "Okay, I accept ZK addresses." And then there will be a seventh like authenticator, which is, "Oh, this is the post-quantum algorithm for Sui." And then there will be an eighth, which might be something else, right? So, it's That's that's how it works on Sui. Got it. Um and would it be mostly like a developer building on Sui with Move, I guess? Like Like who uses it? Cuz like does the end user directly use ZK or is ZK built into a system, like a wallet?

We have to launch SDKs on JavaScript and Rust for people to use it. Okay. Every single time this is what you do, right? Even on Bitcoin and Ethereum, you do have JavaScript libraries where they work as the SDK for the people to do signatures either on their apps or on their wallets. We're going to have a JavaScript version of ZK where people are going to take it and and use it directly. People I mean, the actual the the end user doesn't even know what's happening, right? It's just a JavaScript file running on your wallet. You uh did tweet about the and you sort of mentioned it here, the ZK off flavors, different types of ZK off, I guess. Do you Are you building a lot of these? Like will you be adding these

into a lot Or are you expecting sort of the community to build them themselves? It's It's It's collaborative again. So, as you can imagine coming from Silicon Valley and having like people that used to be at Stanford, Berkeley, you know, all of the big Cornell and many other universities, we do have cryptographers. It's actually very heavy on on on research the team. So, we have an internal team that is working alone, but we have the research grants where we're working with other universities. I know for sure uh some of them that have been granted already are doing other types of authentication. For example, we do have pass pass code now like pass keys. You know, pass keys is logging with your face and then automatically you have an account. Um, but at the same time we found another magic version of

pass key where you log in with your face and we delegate your face into an ephemeral public key and then for the session, let's assume that you're playing you're doing a DeFi or you're playing a game, you don't want your face every single time you're making a transaction. So, you have to to create a delegation mechanism that that for this DeFi is giving you access for 1 hour up to the amount of $5,000, right? Wow. So, we're going to create these types of logic and then everybody can use whatever that it works for them, right? That's That's the whole idea, but it's not alone. Alone, yes, we're doing some big researches like ZK and others, but I have a feeling that the the feedback lately is coming more often than I expected from existing universities that

they're also doing ZK or pass keys or MPC. These are typically the technologies we're using, right? There might be even a TEE authentication like trusted executed environment authentication, why not? Mhm. Uh where people can write their authentication logic into Python or Java and then you run it on Sui because there is either zero knowledge or you have a top trusted executed environment signature for this. So, many I believe at the end of the the two three year trip in the future we might have even 10 authenticators at Sui based on the requirements.

Nice. It does seem like there's something that has been missing. You know, I I sort of see like the ZK and generally, yeah, the ZK teams are sort of like thinking of this bottoms-up of like how do I generate the the right auths and signatures for these types of systems? How do I like give you proof of like in set inclusion of a prior of membership of like some public key or some set of public keys, whatever. But there's a top-down approach, which is, you know, I think how like decentralized authentication companies oftentimes think of things, which is like I have a graph of interactions of like nodes that are holding resources, assets, whatever, and I have a set of users, and I and the graph is changing

over time, and how do I construct an auth scheme based on that usage pattern versus making auth schemes then mapping a usage pattern to an auth scheme, right? So, like there's sort of the a difference between how people in decentralized world think of auths versus people in centralized world where they're like, "Here's a bunch of usages, so we're going to make policies that match those usages." So, I'm I'm just kind of curious how you think about bridging that gap because like I I do think like that that is something I always like I think Web 2 people have a lot of trouble understanding about crypto, but then crypto people also like don't exactly have the solution for, in my opinion.

This is 100% true. Uh I don't know if you noticed, but very recently the Google team introduced a new wallet that is using Ligeiro. Did you notice that? The who? They just came on the show last week. Okay, of course, of course. So, as you can imagine, in my opinion, things like ZK login inspired some of them because with ZK login, uh there was also a like a collaborative post with Google because we work with Google originally. Google was, even if I'm coming from Facebook, the first uh company that I tried uh ZK login against was Google. And then we had so many back-to-back meetings to explain to them, "Okay, we need to to how your OAuth works," and so on. So, in my opinion, we also see that the element of guys do ZK even for your own wallet in the Web 2

world. And Tarun, to tell you the truth, they they didn't take it like negatively originally. I mean, they said, "Okay, look, if ZK login works, we are also doing a lot of stuff in the in the very beginning they didn't do ZK, by the way. I know for sure because I was interacting with the team. But then eventually, you see, they they go into the ZK the ZK part. In my opinion, we're influencing the crypto one of the best things that it has done to the society is not necessarily into trading. I think because a lot of money has been spent to hiring the best cryptographers, the best engineers in the world, more than what NSA is doing, more than Web 2 companies are doing. The innovations that are happening on crypto are now coming into Web 2.

Mhm. And I'm very happy about this, right? I love it. I love the fact that Google is using now even for Web 2 authentication zero knowledge. Yeah. So, how do you bridge the gap? ZK email, ZK login, and probably ZK TLS are the three and ZK now, right? Are the three four like ways of eventually interacting with Web 2, even if it's part of the authentication. As we see companies like Google and probably some others in the future, even Worldcoin and others that they are trying to do ZK for for for user identification authentication, but also the identity part because we didn't talk about identity, but eventually it will go into identity. Right? We can talk as much as we want about new authentication

logics and other things. If you go to to developing countries, you go to Southeast Asia in the jungle, or you go to some jungles in Africa, people don't have even a a phone, right? We need to to to do some authentication even for these folks. ZK will be part of this of this story. We haven't found the perfect matching. Totally agree. That's why we're still exploring. I have a feeling that there is convergent evolution at the moment between Web 2 and Web 3. One day we're going to see better solutions. It's not fully there yet, but I see signal. I don't know if you see it. I personally see signals that we're evolving similarly now. They're going to use it or not. I believe the fact that NIST that NIST also put the pushed the trigger of post quantum, they they need

all of the companies, you know, some some of the biggest like platforms on the card payments, they're switching into quantum as well. I don't know if you know already right? Did you hear the rumors? Which ones? Darun, you know the rumors. I don't want to reveal the rumors. is uh MasterCard? You mean those? Yeah yeah yeah. Are going post quantum? Yes, yes, it's happening. I mean, I think the NIST standards kind of starting to exist does kind of make people begrudgingly have to do it, right? And they're the first ones historically. Although I guess they like lost a lot of their best cryptographers, but yeah, historically I feel like Visa and MasterCard were like stockpiling cryptographers.

Mhm. I don't know. I I personally have seen a shift on what they're focusing on. I I don't want to reveal who and what, but at the same time I was disappointed by the fact that they they shifted a few people from crypto crypto research into quantum research. Mhm. At the same time they're driven because of regulations, and if this becomes a rule and you cannot transact with the government just because NIST say from now on only quantum safe algorithms, what do you do if you are such a big institute, right? You have to switch. Mhm. However, however, for the first time you see like companies Google did Lihero, I believe I don't know Visa, MasterCard, Amex, all of them are going to do something else.

We are going to see more more zero knowledge proofs. Uh although we discussed about Groth16 and ZK today, eventually I'm expecting um STARKs and Lihero to to to be pretty much at the top of the of the equation. Just because we have to comply on the zero knowledge proofs as well. We have to wait 5 10 years, but the next 5 10 years we're going to find another ZK that is quantum safe. We are going to find a ZK login that is quantum safe, ZK mail, and then ZK TLS, everything will be quantum safe. Not because the quantum computer will break it. I don't believe in this story to tell you the truth. I I worked on this topic for for many years, even seen quantum computers in my life.

But the regulation has to go faster than the hacking activity, right? So, they will pretty much demand from people to switch. But this opens the door for web two companies to do web three research. And I believe that web three will serve them all of the tools to do web two. Maybe ZK is on a different plane from web two and web three. I think we equate sort of ZK as being in web three. But when I talk to like ZK researchers who've been around for a long time, they're like, ZK's been around longer than this word.

I disagree. I disagree. Even if it was around, the first time that it became wasn't there. Yes, the demand wasn't there. And the research wasn't there. The performance wasn't there. the money that was spent on the blockchain space for hiring the best people, go see who is working for NSA NIST, and compare them with the people who are in this room today. Come on. The there is a huge difference. There is a huge difference. Right? On on the quality. And because of this quality, and you will see the same thing will happen with AI. Money will flow into AI, and the AI the AI will evolve by far faster than in the past.

Yeah. True. True. And and web three was unfortunately or fortunately the the the arena of cryptographers for many years, more than anything else across the world. It definitely was the thing that funded it. Yes exactly. of it. I do think my kind of very abstract view of ZK from like the value prop, if you were trying to sell you had to sell both sides, like the crypto side and the non-crypto side, or web three, whatever, depends on how you want to call it, but is zero knowledge proofs with without privacy are just like an interoperability solution where like you have you can have any virtual machine talk to any Turing machine talk to any other Turing machine, right? Like that's the most abstract definition.

And then they happen to also have the ability to do that privately. And in some ways that just means that you don't have to think about what system you're using. Like the value prop to the end user developer is like I can maybe in in some future world especially with people writing less code and AI writing all the code, I don't have to think about translation ever again. And ZK is the like is sort of the universal translator, right? And then some ways that type of thing is sometimes lost cuz everyone wants to jump into like technical details and like what what field am I over like what genus curve am I using whatever, right? That's true but like I think if you zoom out like the value prop is this translation thing that people kind of always seem to to miss but that's universal. Like that

doesn't 100% agree with Tarun by the way. That's reality. What part of the story like cryptographers and everybody who's working on new innovations there but at the same time this is the end goal. This is what we're heading to. Uh speaking of these translations, one of the projects that I think you have are called ZK tunnels. Yes. Are these like one Turing system talking to another? Are they basically like a bridge kind of thing? Exactly. By the way, ZK is is related to ZK tunnels. Imagine we want to open a tunnel like lightning tunnel on It's like a channel. Okay, yeah.

Yes, imagine the lightning channel of Bitcoin, right? Some people are familiar with lightning channel. At the moment it's only used for payments. You don't do anything, right? But what if you wanted to in the channel to play poker or you wanted to play chess or you wanted to do other things? You need ZK now, right? Because this logic might be very expensive and it's not easy. I mean the the lightning channel the original version of fraud proof on lightning channel might work or might not work because the fraud proof might be very expensive to verify on chain. Mhm. Right? So you need to to snark it. And sometimes you want the fact that someone is is buying something from a grocery store or playing poker. You don't want this to be visible on chain. Yes, right?

Zcash. Welcome to Zcash. But now Zcash when we're opening a channel and we're playing chess, we are creating the ceremony together. We're running the ceremony together. And nobody else apart from the two of us know what we're doing from the channel. Okay. So, that's why I told you at the very beginning, even if we're talking about authentication for Zcash, You can use it for the ZK tunnel. Yes, for the ZK tunnel. It's also usable because you're still hiding the logic. The only difference is now you're not you're not the only person who is running the ceremony in your head. You are two people now. Because both of you have an incentive to hide your your activity. Or or even how the the amount is is happening. And then if you want to also have audits, you add the viewing key on this and then the

regulator can come and see if if you're doing something illegal. Nice. So, ZK tunnels is another application of Zcash. Very nice. I didn't actually know that. I thought it was sort of like a standalone, but it makes sense. Going back to this conversation about how it not only acts as a technical bridge, but also could be bridging, you know, like previous web data on chain or just, you know, proving things about web data, the fact that ZK could be used by more traditional business as well as new business. What about when it comes to governments? You know, you talked about some credit card companies. You talked about regulation, but could governments themselves start using ZK? And or are you seeing that?

Well, with Suits happening already, as you know, because the very recently we had the announcement of the Greek stock market that said, "Okay, everything that is happening in the previous world where we had the full control, everything was running in our systems, we need to have access to the blockchain." Why? Do you know why, by the way, a stock market wants to go to the crypto space? No. Can you imagine? Can you imagine? Tarun, can you imagine why Yes. They want to trade 24 hours a day. Tons of reasons. Give me one reason. Give me one reason. There's a lot of very annoying structured products that are too expensive to make in traditional finance and are only enforced by legal contract that you could do much more easily.

Oh. Like why why do I need to pay a broker to do to like hold a straddle for me? That like should should be done automatically. And I think that's the dream of all these tokenized stock companies right now and is that hey, DeFi people have figured out how to do all the structured products things that historically you needed banks to do and once you have the tokenized stock do all that. And you're kind of seeing that stuff happening right now. Interesting. That's you know that unfortunately that's the other thing that's like I haven't been much on ZK. It's like I've been doing this type of stuff. Exactly. It's 100% true and I will give you another two reasons why this happened and why I personally had to to meet the you know the leadership people team of the Greek stock market and they explained to me right the reasons. One

is this. The other is when many things were not very automated at the very at the past and you are moving to a new technology in 2025 in their head the broader database in the world and the most compatible with many other systems in the world. It is the blockchain. Mhm. They cannot use again a centralized version because they want to also interact with people that are not uh like they're they're crypto users. They are already doing DeFi. They know what is trading and they want to come into their systems as well because now you're using the database. I mean imagine the public ledger of the blockchain this this this particular feature didn't exist before.

We didn't have public databases in the past that uh like were accessible by multiple platforms even if it wasn't your own product. So the Greek stock market might go on chain and then the Serbian stock market will go on chain and then the UK stock market will go on chain but you can reuse the users between the three, huh? Oh. How do you do that in in this world? This was one thing one what Arun mentioned like obviously complexity of creating new products or even the products that they have sometimes is very complex to do it. There is a third element that I was not prepared for this when I heard about it.

And you know what is it? It's Revolut. Revolut? Do you know Revolut, the company, the Revolut and Venmo and all of these? Ah. WeChat and all of these things. What do you think it's happening now? The new generation, people are they 18, 22. For the first time in using that. in their time, for the first time, they have a single click and they can buy Apple, Google, Facebook stock. Now, do you know what it takes to buy a Greek stock? I know. Is it You need to be registered. You need to use another trying to be in the in in the world, kind of. Like, they feel like they're sort of them down. Revolut will probably result to default on some countries because Wow.

the local economy cannot sell. If you are 20 years old, You're not going on would you buy a Greek stock or Apple? Wow. You will buy Apple because Apple is a single click and Apple is American. And you don't want to buy a Greek stock. Why should you buy a Greek stock? So, the only way for all of the the local stock markets from small economies in this global globalized world is to go on chain. You know, you go on chain. You want the Mexican, you want the Korean, you want the I don't know, the the British to be able to buy a Greek stock with a single click. Hm. I mean, some of the bigger ones are, like the UK and Germany. Like, you can those are easy-ish to access. You can get them through apps. But, it's true.

Like, the Greek like, I wouldn't I wouldn't know where to start. countries So, small countries are in a big trouble because these Yeah. Like, I can go to DAX, uh the the the German uh index, and I can Probably, I can find a way to buy a Greek stock. that would let you buy it, actually. Uh you might have to be in Germany or something, but yeah. But, you see, even this. Imagine even even them, they need to go to the blockchain. Huh. Because there is another there is another particular element of the crypto user. The crypto user is a typical spender user who is trying different things. It's a good audience for them. And there are also cycles on crypto.

You're going from bull market to bear market and so on. What do you do in the bear market? Obviously, you have to if you if you sell crypto, you have to buy something. And then you buy more stable stuff. Yes, and this is stable tokens. This is I don't tokenize gold. This is probably real estate, but it's also stocks. Mhm. Right? So, if we see it like from the perspective of someone who is running a stock market a nation's stock market, you need to think about survival as well in the next few years. So, tell me what your conversations gave you. And do they need ZK tech somehow?

Exactly. Exactly. Look, Kostas. Do whatever you want, but don't reveal all of the prices and everything contained because at least the worst thing to will happen to us is some of the institutional investors, their balances and everything is visible on the blockchain because we know blockchain is public, but at the same time it's sacrificing some of the privacy we used to have before. Mhm. Centralized, yes, but there was privacy against other people. So, we we created a custom circuit to do all of the options when a company goes IPO to to hide all of the balances in the you know, we have the confidential amounts, all of these confidential transactions and all of this stuff. So, we created a ZK stack that focuses on getting a a stock market into the

blockchain. Wow. They came to me because the options were two. Let's use trusted executed environments, SGX or cloud services, but there are wars happening, many things are happening. You don't want to go centralized. Mhm. The only technology at the moment that is not centralized is based on math, and you don't have any dependencies is ZK. Wow. So, the only way to escape was using a custom circuit. We work with like many cryptographers, even with them to go to their systems, see what are the flows, what do we need to hide, what identities need to hide. And we have proofs of solvency as well that are also using like zero knowledge proofs, right? The the newest ones. And they decided to to pick zero knowledge. And to one day the COO of the stock market came to me and

say we would never believe that this is possible cryptographically, but now you you gave us a dream, right? You gave us a new a new thing to consider and we build it on on ZK. It will create very different dynamics though, right? Like if it's private like that the fact that wallets are public in DeFi, it's kind of a feature not a bug right? Not necessarily for us, but if you are an institutional investor and you are taking a position to buy many millions of uh dollars in stocks, yeah, you are you are revealing your financial status and probably some other can do an MEV on you because they know you put all of the money on Apple, so you might not have money to compete with me on HSBC.

Mhm. Right? So there are MEV I mean we're talking about investors and we're talking about other people and there are societies. I'm telling you about a particular thing I realized. I had a discussion about Egypt, like Cairo. And there are some cultural things there where when you're donating money, the person who is receiving the donation, they shouldn't know your balance. Mhm. Because it's it's considered harassment, like it's it's not considered good, right? So we in some situations we have to think about it. Yes, it has to be regulated, audited with a viewing key, with something, but you need some privacy. Eventually I believe there will be selective privacy in the future for all of the blockchain transactions.

How far along is the Greek project? The Greek stock market. We already passed the the second phase and now we're working on the POC. It's happening. We're having Interesting. Yes. Which ZK system and do they feel safe with and which blockchain are they going to be on? I'm assuming Sui, but on Sui, of course. Yeah. We're using because the circuit is quite complicated, we're using uh in this like Rust, we convert I'm not mentioning the company, but we're converting Rust into circuits and then from the circuit you are going into a Groth16 folding and this is what is verified on Sui.

But is it then going to be also be made post-quantum somehow? Yes, in the future it's going to be first post quantum. Okay interesting. I turn and I'm really curious what you make of like bringing a stock market on chain with ZK. I guess like I see the centralized side of this a lot. Right now where like people are issuing stocks on chain but that already exists and kind of like a like stable coins like kind of the second you know boom of real world assets right now. You know it's like kind of gone from 2 billion to 20 billion over the last year. But I would say at least and this is a US centric view of this.

I think they get pitched a lot by ZK companies and ZK tools but like none of them seem to care. They end of the day I think like whoever has the most regulatory license stuff ends up winning in this type of market now. I think she's right. I agree for frontier markets that's not true. Like like I'm giving the frontier markets that may not be true. For for for the US though it's like I I've seen how hard it has been for ZK companies and like cryptography companies to break in versus like someone who has an FCM license. Yeah, it sounds almost like it's these like but I like how you call them the frontier networks or frontier markets where it's like the Apples and those stocks they are already integrated into the Revoluts because it's what people

want. And so those those centralized stock markets they're not they're not really going to be motivated to try anything else for now. The US doesn't have the survival problem. All of the other markets do have the survival problems. If you open the market to American stocks to any society in the world, most of the people will buy American stocks. We have to accept it. Yeah, for now at least but that's the reality right because these are the companies they're interacting with in their everyday life. They're interacting with Apple, Google, Facebook, Netflix, Tesla. Tesla is not but Familiar.

Yes, they're familiar with with these companies and this is what someone will buy at their 18 and 20. Mhm. We We a new generation right? The new generation is exposed to the things know. Like when I think of the Greek stock market, I'm assuming there's a lot of like shipping companies. There are shipping companies that are banking. There is a very small tech, but you're right. I mean, they will die off if we don't do something to bring fresh blood into the system. One thing that that is sort of compounding here is that frontier markets tend to have like heavy private concentration in their stock markets where they have a lot of bunch of public listed companies where it's like 5% of the float is liquid. 80% is owned by a family and then 15 is like sort of some investors going away. And this shipping

is the greatest example of that where it's like all inside ownership. There's not really like there's no ETFs buying. There's no like investment funds buying. So I think there's also that aspect that means there won't be that much volume anyway. Like like who's actually There's not There's not like you know, a four retirement fund trying to buy these stocks because there's like not that much available for for sale. companies there start to create businesses that are more friendly to you. businesses maybe, but the existing businesses I kind of think it's And so that's where there's this chicken and the egg problem of like the existing businesses actually have zero incentive for a more liquid stock market. They prefer the lack of transparency or trading because it means that they can borrow more against their holdings.

Um no, I'm just I'm being blunt. That's the kind of the truth, right? This is true. This is true. And that These are These were actually discussions we had internally. But there was another another point and probably like that one you're familiar with this. They everybody because I didn't I didn't connect it with a real estate market. Everybody wants this illiquid assets to go into the agentic world. Huh. Some of these are now happening with users or like centralized systems where you you don't have many flexibilities even on the agents you want to run. If you go to crypto for the first time, you can define an agent that actually buys a Greek stock and because they're doing arbitrage and other things like you can even make money or or the company itself might allow for

flow. Like imagine someone buying with Bitcoin the stock now. You might bring new liquidity to the system, right? It's happening. I mean we're we're a millions now. Billions are not just a small audience anymore. It's it's more than this. I feel proud about I was one of the first being in the space. Like since the very very beginning, right? 2009. And I sense it now we're millions. Back then we were 20 people. Yeah. Long time. market it's a market. And coming from Facebook, companies are looking to because the the Greek stock market is also a private company.

Mhm. It is government like partially owned. It's not just government. They want everybody wants the crypto the crypto users these days. I believe we're having a big a big like power and Interesting. We have to use it we have to use it properly. I I guess I see the other side of this where I'm like just kind of looks like banks are going to win again. At least in the in the big countries it feels like it feels a little bit like that. Like So so I I I I think it's it's interesting to see the the the you know the dialectic here. Cuz like side.

Yeah yeah. Cuz like yeah it's just kind of like in the US and and actually even Europe I kind of feel like in like Germany, UK and stuff like I feel like the regulation actually disincentivizes the big players more. Mhm. It it has like not really helped the small ones at all. So I I I don't know. I'm I'm I'm I'm sorry for being cynical. I should I should have more It's fine. It's fine. It's fine. We want this we still has a golden future from what we've heard today. I I think the case a future beyond crypto, right? Clearly clearly, right? Like the fact that everyone I'm I'm not sure it's like monetizable, but that's fine. It's a good public uh agree.

I I think it it clearly it clearly has a bright future. I just am not sure that like the stocks on the blockchain thing won't just be like three companies that control the KYC process for like the market makers. So then And is effectively centralized. Huh. I again that's it's it maybe it's cynical because of like in the US I feel like you see that happening pretty aggressively right now. It does almost seem though that like the innovation may just not happen there. Like maybe that's what happens. It sort of has to flow out. It goes to these like edges. The places where there is no big central player and the banks aren't as powerful.

I mean it is still a form of regulatory arbitrage cuz like a blockchain Greek stock if there's like a non-Greek buyer, realistically the reason for that is like you found some weird way to emulate a Greek buyer who registered and businesses whatever had that naps to whatever Greek KYC is for for portrayed in but you're able to get them to avoid doing it fully, right? Because you're able to sell it to them on chain. I think that it will be KYC that you're going to get an NFT that where you are allowed to trade Greek stocks. That's that's the whole idea here. So but the weird thing though is like you're talking about Revolut, right?

Like if I'm a Revolut user in the UK and I buy a Greek stock Mhm. the Greek KYC and the London KYC are not the same and they're not really interoperable cannot buy a Greek stock in Revolut though. That's the thing. Yeah, yeah, yeah. But my point is we could if you could buy a synthetic if it's on chain and then and then then people will arbitrage this great. Like that's what always happens. And so Yeah. it it ends up being reg arb. Like that fundamentally. It's just that you know, no one wants to say that but it it is really often times that. It'll just be a different type. Yeah, it it's basically like KYC not being interoperable, you're creating this arbitrage for people who want to like who own both KYCs to trade with each other.

Interesting. Sorry yeah. Okay. Crazy. We've gone more into like global trade more stock market conversation here. But Kostas, I do want to say a big thank you for sharing so much about like the ZK work that's happening in Sui. Uh anything we should that should be on our radar that's coming up soon? If you check my tweets probably every two months you're going to see a new algorithm for CK coming from us. That's that's important. I cannot reveal everything at the moment, but there are there are some very good things uh that people are working on.

Are you doing things in the Lejero track? Like using some of those techniques? We're doing many things. We're we're even trying We're even trying to compress some of the existing schemes, by the way. Ah nice. It is funny that everyone is going on this like Lejero Yeah, Lejero's very very exciting at the moment. A lot of people have found It's just kind of funny cuz it's like I think this is the first time I've seen like the the thing that you often see in in like machine learning or AI where like some technique that didn't get cited for 10 years suddenly comes back and then like a million things like 100% I feel like it's always been like the frontrunner thing has like existed and then it kind of got usurped by something

in the back the ones in the back don't ever come back to the front, but this feels like somehow I don't think it ever had its moment like when it was in Yeah, yeah, yeah, yeah, that's that's that's I guess that's true, but maybe it was like a little early also. But that that that's what I'm saying that it is kind of like the science or AI thing where that that happens whereas I think cryptography has found that to happen a lot less. So, I don't know just like a meta observation. Nice. All right. Kostas, thank you so much for being on. Always fun to hear your excitement and all of these ideas that you have going on around CK.

Likewise. Thank you so much. Eran, thanks for the good questions. You will see some updates on the ZK paper based on your feedback. Great. No, hey look look look look I only exist to ask these dumb questions, you know, so it's it's not there's not much We we will make an acknowledgement, don't worry. Nice. Thank you so much. All right. I want to say thank you to the podcast team, Rachel, Hendrik, Tanya, and Kai. And to our listeners, thanks for listening.