Big zkSNARKs circuits for zkrollups with circom

Transcript

okay right we're ready to get started again this is the last one in this room for the day so I'll welcome Jordi up here works yeah here we go good afternoon everybody i'm jordi valina and the technical leader five and three project have a lot of things to announce today some of them very interesting so I will ask you to stay tuned it because there are important things to explain today so well let's start this is the first plane that

actually flow the bright brother in North Carolina see if I get you see here nice flight control it flight it works this actually was the first Jean that this airplane half you may not realize but this looks very much like an ethereal blockchain in many years aviation were was improving and getting better but we saw the the the people saw

that at some point there were limitations in this aviation and if you wanted to go fast if you wanted to do transatlantic flights you need to improve you need to make an important an important change on that at that point we had this technology this is the first to win the gas turbine that was invented so we had the technology and they there was to try to put this engine in the plane but as you can imagine if you put this to beam in a you know in one of those whole planes it will not work at all mainly we had to go to design to the full design and redesign the full planes and make them make them more robust so that we can plug this

kind of turbine well I explained you this story because right now we are in a very similar situation in the blockchain space we have a nice block chains we can do smart contracts we can do many things from them but they with but we need to go fast we need to scale we need we need to go faster and actually we have the turbine we have right now we see that all the roll-up without this zero knowledge with all these sixteen proof of computations more than zero knowledge we can solve that so we get that engine but if we plug this engine to this tool or blockchain it will not work why

because it's not only about verifying transactions there are a lot of things that needs to be redesigned nothing that cannot be done but a lot of work and a lot of things that needs to be done just think for a moment two thousand transactions per second you cannot process that in a raspberry P or even in an normal desktop place an operator that's taking these transactions first needs to have infrastructure to receive two two thousand transactions per second it needs to get these transactions is needs to verify all the signatures for

example you need to store them imagine the back lock the back pull that will be that will have this infrastructure we need to select which transactions needs to be included in each block or in each new mind this optimization problem is not about 100 transactions or that we may do it right now or 200 transactions ease with thousands of transactions that we need to that we need to do this this process once we have those transactions we need actually to process them to calculate all these states to compute on you news huh discussion news has roads of the state and then after that we need to compute the witness that's

something that we'll talk later that's one of the bottlenecks that we had and that we solve and I want to talk in this presentation but then we need to compute the proof the proof is actually this need this innovation that we saw well it's a hard computing problem but solvable but it's not only about the proof it's about everything that's going that and not only that ok we get the proof we put it on chain but then we need explorers we need we need transaction explorers blockchain explorers if it scans like well when you have 2,000 transactions per second going on continuously this is the technology that you need for example to write a

block Explorer that's handling all these information is not obvious we can do it we have technology but this needs to be built so that's what I want to give you awareness of what means the scalability it's not only about computing proofs so well let's first maybe from the people that don't know but I'm gonna go very quick but mainly what's a roll up here a roll up what we are taking advantage is well in a normal blockchain what we have mainly is we have a state you can imagine for example that the balances of all the of all the of all the for the

accounts we want to process a single transaction and then we compute a new estate mainly with some a couple of balances switch it to some move some of them one of those will be subtracted another we added that's mainly what we are doing and this is this transaction processor if we see now a very simple if we imagine for example a very simple blockchain that just process one transaction per block well this process of computing the new estate this needs to be done for all the net all the computers in the network this is what we call the the verification part okay so mainly what we are doing in in a rollup is instead that everybody runs

exactly the same process of validating a transaction what we do is we have one Operator or one set of operators like a miner if you want that will process that will process it and we generate also a proof proof you know we will compute a huge proof well it's a future difficult to compute proof a highly computational power proof and then the remaining the remaining people in the blockchain will be able to validate this transaction very easy but of course we are not going to do it with a single

transaction we are going to do it with many transactions we will have a block that process 2,000 transactions or whatever number a huge number of transactions a big so an operator with a big cluster will process the transactions will compute this proof using you know very expensive computer power and with this proof then everybody in the in the network will be able to validate these two thousand transactions in a time concern or something that's very sixteen something that's very fast and this is what allows us to scale okay so this is mainly what roll up and what

we see what we have inside this transaction just as an idea what we do when mainly is we need we need to verify the signature we need to really verify that we have enough funds so that we cannot overspend we need to do normal validation that we need to do in a normal transaction but of course we need to do it in huge rocks in a lot of transactions so how do we compute these proofs what's the way to compute this proof actually there is a huge and important machinery cryptographic machinery that allows us to build that okay but this this proof actually this computation if you want it can be

understood as a function you know it's a function or mathematical function that actually has two inputs mainly the state and the transactions that we want to process and we as a know what we have the new state and you can think that as a function as a mathematical function so these systems for 16 Ness what as an input you need to tell them which is this function what are you what do you want to compute okay this is a white paper the theorem white paper and in very in the beginning we see you see you see here the for this this dysfunction it's a very non function in in any block chain okay so and this is a

deterministic function this is a function that given an input you you have an exact output we have different opposed you will have a problem of consensus there okay so you have a given an input you have exactly an output so it's a mathematical a perfectly defined function on that okay and these systems to compute this you know if I want to compute the output of this function the result of this function given an input and I want to compute a proof that the output actually is the one with the input but in a sixteen manner what this cryptographic system requires well

requires us to tell them this function and how we have to tell them well we need to use one thing that's called our 1cs constraint system that's mainly let's put an example of what's this constraint system here we have a function we are started we are not putting this validation this is state transition function we are putting as normal a more simple example so that we can understand how this works so mainly imagine a function that's something like that you have three function that depends on three inputs s1 s2 s3 and the result is gonna be s4 okay and well you see here is 1 to the 5 plus as

1 to the 2 times s 2 plus s2 s3 okay so the way is that we need to put a constraint mainly we need to put a relationship between the output and the input a normal way of doing that would be this just for exams just saying that s4 must be this we are done ok the problem is that this is not our one CSS it's not another one CS why because in this constraint there is more than one multiplication ok so we need to convert mathematically this in something that's a constraint system that has only

one multiplication per constraint so we do mainly what we do is this trick so we create new intermediary values intermediary signals if you want for example we create this we create this as 5 we say that as 5 faces as 2 times 3 then we say that a 6e says one is to a 7 is as one as one as 87 a 7 and as for is as 1 but this and you see that this four actually holds and if you hold all these constraint system you actually will hold the first the first statement and the nice thing of these is that if you see here there is only one multiplication per constraint that's actually what an r1 CS is now one CS mainly what we are

doing is doing a relationship of a function of the output of the function given an input of a function that must halt and we need to compare that the antis is the input of this cryptographic machinery that allows to compute 16 the proof that we that we actually that the output is this input but without having to it executes all the order to compute all this function altogether another way to see this is with what we call it an aromatic circuit dramatic Silkwood you see here is exactly the same just multiply compute these new things but do we see it in

this nice diagram let's call an aromatic circuit okay so when we are talking about a circuit when we are talking about a deterministic program when we are talking about predicates when we are talking about well there are different names for that we are always talking about the same we are talking about the function that's given an output so given an input you compute an output and you do you have the relationship between this and this and this constraint system in a you know in a standardized format this is what we can send to the cryptography to the machine to the machinery that allows to compute this proof okay let's see how this circuit would be for example in circum for any

of you that don't know silicon is a language that we created in item 3 is a dsl language that allows us to create these full dysfunctions to create these circuits and allows us to convert you just create a circuit like this and then it will convert automatically to this constraints system okay so here you see we define the signals in this case the three inputs as 1 s 2 s 3 and now put s 4 3 intermediary intermediary values and then you see here something that goes with a double arrow well this is means two things first is that there is a

constraint that s 5 must be as 2 times s 3 but it also explains how to compute this intermediary signal why because when we want to compute a proof we need two things we need the constraint system but we also need to compute all these intermediary values this is what we call to compete the winners computation or the witness calculation we need to do this calculus so when we are talking about winners computation or winners calculation we are talking about mainly executing computing the function and computing all these intermediary values in order to compute the function if you do it you take these intermediary values

of course they will fulfill the constraint system okay so in silico mainly what it does when we have a circuit like that we have two outputs one is the constraint system so given a circuit you will have a constraint system the circuit of here you will have five the output is going to be a constraint system of five constraint systems and the silh comb also generates what we call a witness computation that is when you give an input so a witness computation is a normal program can be in wasum C or with a program or a JavaScript it's a program that you give three inputs and it will

compute all the witness it will compute all the intermediary signals plus the output okay and this is with this you with the result of this you can then apply all cryptography machinery or the zika's nartz in order to compute these proofs okay but to go in there so this is important okay so let's put another example of a circuit imagine a NAND gate and gate has two inputs and now put interesting thing of a NAND gate well here we have the truth table you see that if s1 or s2 is 0 the result is 1 but if s 1 is 2 both

are ones the result is 0 ok what's the constraint system that fulfills this output values can see here as 3 is 1 minus s1 s2 here we are working in binary fields travel in a normal snark we will have to add some other constraints in order to warranty that but for for this example it works in the in the right side we see the circle how would you write that you see that you have two inputs one output and then you just assign st and you you will get this just let me put another example for example what happened when you want to do a division and it's more a bunch

topic but I think it's interesting here okay you can how do you consume you cannot you cannot create a node with just multiplications so here we do it we do a trick you see well instead of telling that out divided by B so sorry a divided by B is out what we say is the divisor might be we put it in the other side of the of the question and then we say that the old times V must be 8 ok how we would write that in in in circum well here we use the single arrow just to compute 2 here we are telling how we compute this signal but then we are adding by hand the constraint that we

add that we want to add and this is one of the cool things of theorem that allows us to build this this can be very insecure you know single arrow if somebody is listening hit this single arrow should not be used in circum unless you know exactly what you are doing but if you know what you're doing it allows to build to do things like this for example a normal division okay so here is you see they they are of all the circuits creating a circuit works okay okay we have a none but let's do a more more complex circuit right now let's put two nuns while we join them together okay so well here we have the odd man and here we can we can do in

circum is just join them together create these two nuns we instantiate here you see the component g1 Company G to instantiate them and we connect all the signals the output so we do all the connections to the signals so this composition this allows us to compose a to compose I and there is one interesting rule in electronics that's if you are able to build a nun and you are able to use as many nuns as you want means that you can build anything anything any function you want it can be built with that so this is important that's why it is important is none so okay let's build circuits we start with

a small component with a small component we put them together we create bigger components we put them together we create bigger components and so on so we can build very very big circles actually we have this circum lip that's a set of basic circuits that we can use for many ugly in many applications here we have hash functions we have murca trees we have multiplexers we have comparators we have a curve you know an elliptic curve that we can work inside thing we can do anything that we want we can do any competition that we want in this function in this circuit and all this is

already part a so ivory with a small pieces that you can build bigger pieces and bigger pieces and you end up having the roll-up so you just create a transaction like these you create a component that's a transaction you put a lot of these components and you create a full roll up of course with thousands what's actually with millions of constraints out of there but you can have the built this DSL this is very much like building electronics this is very much like putting components together with a small components so this is what we are doing here okay so circum

know network and Sikkim i want to just highlight some of the new features that we are working for sale in circum just to know one of the things is for example one of the bottlenecks that we have is this witness computation when you have millions of constraints you have a circuits that are huge very very big computing these computing this witness is you know it takes it takes a long time it's very expensive so we need to optimize that so in this case circum the the program that computes is rhiness right now in a new version will be a c c++ we have built also an assembly an assembly library that works with finite field that's quite

fast and when we plug them together it goes really fast just to make sure here is that well right now it works in C++ it also will work we are working on that but we're working in wasum so we will generate directly what some code to generate this witness important to mention also that this computation of the witness is going to be in parallel so if you have a Multi multi thread computer you will be able to use all of them we'll talk a little bit more later on that well right now you can build big circuits some of them maybe could take a

while but actually it's possible we have to tune a lot the the compiler in order to be able to build these circuits right now it's also interesting that works with it with any curve not only that with a BN 128 it works with the cash Corp and nmt curves and other any curve that you can you can imagine and also interesting is about this circum lib is out it is it sounded that this has to be now so audited this is thank you to the theory foundation for doing a lot of this a lot of this work there is still a lot of work in progress we are trying to stabilize you know a definition you know functionality of silk ohm we have a free

single paper so that we can freeze this and more convert this language as a reference language and having this version on that we are also working in our faster rust implementation with of this language and yeah we need to improve also what great a lot of more into amplifier create more circum lip more more libraries or more circuits to work on that also it's important that with circum it should be able we will work on that to pluck not only to the cosmetics butterflix

we want to block it in plunk or we want to plug it in bulletproof or any other cryptography machine that allows to compute these zero knowledge proof okay so let's go back to the roll up example right now we have a circuit that as you can even see here it process one transaction after the other okay so this is well if you see the witness computation and I'm going to focus now especially to the optimization of the witness computation for a rollup circuit if you see this witness what here this can be 2000 transactions and if you do it just in a naive way the problem that we have if we have a dependency problem

so mainly in order to process the transaction - you need to process first a transaction 1 and not have to process transaction 3 you need to process a transaction 2 so we cannot paralyze that because we have this dependency so how we fix that well in a case of a circuit is quite easy we just could them we just we supply we do a kind of trick here we just supply as an input what should be there and then we just add a constraint that this input should be the output ok so if we do this actually we can compute all these witness in parallel well

actually we didn't solve the problem what we did is just we just move the problem to the input to this circuit but at least from the witness computation point of view if we accept that we have these inputs we are ready paralyze and this is believe me this is a an important improvement on that so how we compute all the inputs here how to compute these intermediary states this intermediary states for many of you that don't know and this is a little bit more advanced but mainly are siblings of a miracle tree have a state that we want to process in each transaction and the

most of the time it spends just by computing just going back and forth in America tree just to restore a state computing your state and compute the new route on that so mainly when we are inserting something for exactly what to modify when we want to modify some leaf in the state like this blue this dark blue here well we need to compute the hash function so we need to compute a new hash function for the fathers of this until we computer of a last function here so we can when we can do when we build that is instead of actually doing the computation we just take note we just say that we have a

dependency in order to compute this you need this in order to compute this you will need this rash in order to compute the first you need this hash and this is the this is the arrows that you you see here when you process an external section actually well you have exactly the dependencies of this field but you see in the in the second the second line you have also the dependency of this one that this one actually is exactly this one so you build you can build this dependency graph and you have a third transaction you have exactly the same but you have this other dependency here so if we analyze what's the dependency of the last one here you see that well it do not depend of the number of

transactions but depends only on the number of the levels so if you want to build the siblings we can paralyze also that very much so these allows to compute the witness of the transactions and to process transactions in a way that's not linear it's logarithmic if you have enough parallel parallel computation on that so you can paralyze that very much so that's it and now the announcement that I promised at the beginning of the talk we just today we just we have been working a lot but today we just launched a first version of

roll up in test net so you can connect here and you can start doing your transactions you can start testing that it's a very it's common line interface very primitive for sure it's going to pair a lot of bugs so do not just it's not even a beta it's just but right now we have all the pieces put it together that works and of course no is still a lot of work to do in order to maybe optimize some of these pieces making them better maybe some of them replacing them it's still house it in them and we hope that at some point this will be launched it in the main net but right

now we have all these pieces together and we are working and we are inviting to anybody that wants to connect please goes here we have have open also a telegram group for helping the people so if you want to connect here it here it is this is a QR code of the of the of this it's not the truth that's setup it's not the trust community one so anybody wants to connect the trust community just please later just ask me but that's this is you can't connect here and that's it so guys let's go scale wait if anyone has any questions you can raise in her then now if there are any questions right there how much I mean time so what

are we building basically is just a DSL which translates down to correctly we are using lipstick right sorry I mean as your back-end you're using lip snart no we are using right now we are using we are using snark GS and we are using it there is a connection with bellman and it can be connected to the person or if you want actually they there is that the output should be transferring to any of those but right now is mostly we also develop snark Jas and webinar which is a native implementation in webassembly that works very fast especially in the browser if you want to use leave a snark in the browser is quite hard but the

whole goal is that of the project has to to have this here come language which will translate down to whatever is the backend yeah it's to work another back-end we also develop you know this snarky yes but I have not been talking about the backends I've been talking about just the silicon here but it should work to any back-end and so you are very similar to a one-lap snarky snarky is another language is similar to circum it's I think it's based in no comma it just to put it a cure that's like yeah there is like two kind of languages here just to have an idea when in one side would be snarky and circum that are more ESL kind language that

actually it what it just connects components as we saw and you connect a lot of the components and you create that and then there are other set of languages here we have a Socrates news Inc and well some other languages like battery that are more high-level languages that they do is that you should be able to write any any line any with like a normal programming language and and the compiler would do the magic for you these are more low-level you know this is you just designed this component you just connect them together put it this way so this is that the two maybe in the future the high level languages make a lot of sense but

I think that in the current state of the technology these low-level languages are very good especially for auditing and for knowing exactly what you are doing what what constraints are you building so yeah III I think the both are useful and playing with both is a good thing and like weeds with schemes do you support now right now there is of course that's not yes because we built this not yes and that for sure seems like yeah it's growth 16 mainly the grass 16 is the mind that's most used this one is OT some Korean guys also that it gives it

allows you to build you know a proof uh normally about proof but the problem of this scheme is that you need to do some computation CG to so this does not work very good in in the theory for example and but mainly this is the interesting is this that you can generate with as naturally as you can very you can create a very fire for a theorem and so growth there is also this btv fourteenth but it's like it makes no sense to use it so it's gross sixteen problem what makes more sense I hope that in the future plunk should be easy to port it and well there are a lot of many other schemas

that that are appearing that it's possible to port it's like this is the the back is the front it's it's it's another piece this is not a cryptographic piece that is you can you should be able to plug it yeah so like for the back and support you say that I mean your target is mainly a start yes but later on you're adding I mean yeah you just start to support something else here that the big difference that and here is the the difference done and I think that's what makes a lot of difference with problem with other languages is that we are generating so we are generating code so we are not running so most of them of the systems is that when you want to compute the

competition in some way you need to run the circuit in some way what you are not running any circum we are just generating a code yes but currently like the the SIL come on Lisa I mean the full support is only for the lipsticks I saw yes yes not yes and the resource for Porto bellman full one already like I can I have no right than that I need to check but I know that there is people that's using bellman as back oh thank you yes there any more questions one question so I saw on the website that you have years the

20 support for this roll-up chain for the side chain yes honey and how you know how long would it take to make this generic smart kind of computation possible what depends on the number of transactions right now in in I think it's 700 transactions in the chain it takes like one minute if you go to but depending but that's that could be a reference but we believe that we can improve that a lot more kind of like how many what's the scale up at yeah you good parameter that you can think is a two thousand transactions okay right now

10 minutes like a Bitcoin schema that's good good reference right now but as I tell you we are improving those numbers there are other teams that are so working on this and there are also improving I don't know if you saw the last looping paper they are also doing a great job in improving this proof generation and we believe that we can go really low so we will do a lot of work engineering work to low that and I believe that's possible that in not many times we can have we can compute those proof in few seconds yeah but currently currently cannot generate a generic smart contract in

this transaction it's like a custom-made here's a 20 thing ya up for it disease this roll-up is for transfers okay so you can do transfers and that's it it's not a smart contract on that in order to build a smart contract you need to that did this roll-up you need to have some entrance e on there because you need to verify some something that inside so every a very fire inside the very fire there are some projects like 6 or while you would need some other curbs actually they are not implemented in the precompiled smart contracts on ethereum right now but they are planet to build on that and with these reentrant c

curves you should be able to run anything you want inside the snarks so you should be able to run smart contracts but we I think we are still a little bit far away there are teams that are actually start working on that but we are a little bit I would I want to see first roll-up running full speed and and and that we will see step by step thanks thanks yeah if there's any more questions okay thank you very much [Applause]