PlonK: The Proving Scheme on Aztec

Transcript

[Music] That's a long story. Uh let me try to condense. Um we started out in 2017. We wanted to build a traditional financial product on Ethereum. Uh and we realized we needed privacy on chain. we needed to put these multi-billion dollar portfolios uh with all this compliance stuff. We wanted to put it on a blockchain network but in such a way that not everybody could see what's going on. And we realized that that was kind of hard to do and that it required a rather strange technology called zero cryptography which allows for

computations of encrypted information. And um the state-of-the-art wasn't really good enough to do what we needed. uh it was too complicated, too cumbersome, too slow and not secure enough. So um I along with Ariel Gabazon, we did original research to develop um a novel new form of this cryptography that would enable the kind of um practical high-quality privacy technology that we needed for our for our business. So back in the day, these ZK snark technologies, if you constructed some program that you wanted to snarkify so you could prove stuff about encrypted information, you needed to perform something called a trusted setup ceremony where you generated some

secret numbers and uh did a bunch of computation and then ideally you destroyed those secret numbers. And if you did not destroy those secret numbers, if you kept them, then your cryptographic system would be insecure and you could uh break it. You could fake proofs, you could steal money, which is bad. And you had to do these setup ceremonies for every single application. And Plonc was the first practical technology where you didn't have to do this. It's universal because you only need to do one trusted setup for the entire proving system and then you can write any application you want.

And so we did that setup ceremony in 2019. We involved multiple hundreds of participants. The idea is um every single participant has to collude or cheat in order for the system to be insecure. Why did we call it plonk? Well, plonk stands for permutations over the lrange base for ecumenical using the archaic spelling of eumenical with an o non-interactive arguments. Um the a is silent uh of knowledge. The real reason is uh okay so when Ariel and I were putting this thing together we were thinking of a name and I knew that this was going to be a relatively big deal as in that this was

this was a powerful piece of technology a lot it solved a lot of problems that a lot of people in the in our industry wanted to get solved. So, I suspected it would get used and I suspected that there would be a world where relatively serious people doing serious uh serious jobs uh in serious settings would be sitting in a boardroom and and going to themselves and talking about this technology. So, plunk is is British slang for cheap lowquality wine, but in an endearing way. You know, if you if you're going around to meet friends for dinner and you know, you're all good friends, you don't need to um stand on ceremony. you know, you'd bring around a bottle of plunk or if you're a poor student, you would grab a bottle of plunk and like the cryptography we work with, you know,

getting to the bottom of it, um, will give you a big headache the day after. Yeah. And I just a thought popped into my head, you know, what if what if I got all these important people to say plunk? Wouldn't that be funny? Wouldn't Wouldn't it be funny if that turned up in a transcript somewhere it shouldn't? Uh, so that's that's why I named it that. What optimizations in Plunk make it fast enough to support real applications? Well, it's been about six years of optimizations really. We we we really bet back to first principles back to you know number theory prime field arithmetic. How do you implement this stuff in software?

How do you do polomial arithmetic in software? How do you do curve arithmetic in software? How do you execute on this complicated process of taking a an imperative computer program turning it into this weird thing called polomial algebra so that you can construct zk proofs and at every level of this stack we'd be making constant improvements to the to the algorithms to the implementations of those algorithms to the theory to the research it's quite hard to list them all out it would uh it would be quite an in-depth technical article uh we're constantly evolving it so originally it was plunk then uh we made some improvements in 2020 we called Turbo Plunk and then we made some more uh and we called them ultra plunk and then we made some more and we called it Mega Plunk and then we made some more

improvements and we call this Goblin Plunk. So yes, uh the names are from a the names are a little strange. Um but yes, um it's a constantly evolving um piece of technology.