Next generation ZK applications with SP1

Transcript

[Music] let's get ready for our third session and third Talk of the day for this one I'd like to bring on Uma from succinct to tell you about all the things that they're doing with sp1 so please give Uma a big round of applause hello uh my name is Zuma I am one of the co-founders of succinct and today I'm going to be talking about ZK what we're doing with sp1 and some cool hackathon ideas that you can build on top of

it so let's start off with a very high level overview of what ZK enables it's obviously a very popular term and buzzword and it's often made out to be pretty complicated but I actually think there's a way to talk about it that's very simple fundament l in ZK systems you have aover that wants to prove that when you do some sort of computation on a certain set of inputs that you get a output so they generate a proof that when you run a function f on a series of inputs X it results in an answer Y and then the verifier can verify the proof and then accept it or reject it and critically ZK has this succinctness property where verifying the proof of the original computation is a lot more

efficient then re-executing the computation so that's a succinctness property and also what our company is named after now the other cool part about ZK is the zero knowledge part where you can basically hide the inputs to the actual computation so this is important for use cases like privacy onchain that I'll go into a little bit and this is kind of like the magical part about ZK is that you can prove a statement or a computation has a certain answer without even revealing what inputs when into it and that's the part that people find very magical um and it has a lot of interesting math as to how you actually accomplish this result so in the context of blockchains let's talk about why ZK is powerful and

necessary so the first property this disness property is really important for scalability intrinsically you can think of in decentralized systems there's an inherent overhead because you have all these nodes across the world re-executing transactions and verifying the results and making sure that you know the balances are computed properly so there's overhead from this redundant computation now in a ZK world uh you can basically have those nodes verify proofs of the computation and they don't have to reexecute them and that's how we scale all these blockchain systems and in particular ethereum's rollup Centric road map really Embraces ZK as a kind of solution to having decentralized systems that scale but are still verifiable and

there's a bunch of Topics in the ethereum ecosystem that a lot of people have been talking about recently like Fast finality interoperability across all these rollups unified liquidity bridging that will be solved by adoption of ZK in the ethereum stack the other thing ZK is useful for in the context of blockchains is privacy so today in systems like ethereum or Bitcoin they're fully transparent ledgers where you can see what the history of what all accounts have done and with ZK you can now hide the inputs to transactions and you can enable privacy on chain while still preserving verifiability so for example take systems like tornado cach where you can hide the recipient of a transfer now ZK is also powerful outside

of blockchains and that's also a big area of interest um so for example those two same properties privacy and verifiability can help systems outside of ethereum or Bitcoin or the blockchains we know so just to go through some concrete examples that are talked about less in kind of these these um sorts of conferen that I still think are really interesting is today uh in web 2 or any of the systems we interact with if you want to prove in any sort of information to external parties users are expected to reveal all their data so to take a really concrete example uh if you've ever done a rental agreement and your landlord wants to know that you have enough income to cover your rent you

have to provide your entire bank statement and income history which is very invasive you can imagine with zero knowledge proofs you just provide a proof that your income is above a certain threshold to your landlord and they learn the information that they need to know without revealing any extra details that you might want to keep private similarly for proving age um on any internet system you have to provide all the details of your driver's license or passport and with ZK you could just prove that my age is over 21 or over 25 without revealing your exact birth date and then finally when you whenever you want to log into a system and prove that you have some sort of Twitter account or any other social media account today um you have to actually provide access to your entire Twitter account and reveal

exactly who you are but you could imagine that uh people want to include Twitter accounts in just a set and you wouldn't have to reveal that you're a particular Twitter user you could just Reveal Your in a set of accounts that are approved in a ZK future verifiability is also pretty interesting so today uh you have a lot of you know these agencies that have Regulatory Compliance uh but they have no true verifi so to give a concrete example in a credit scoring agency um that determines people's credit scores which is super important for use cases like getting a mortgage or determining your interest rate uh today they can just update your credit score based on whatever information they want there's

no true accountability other than the government regulator stepping in but in a ZK world you could imagine that instead these credit scoring agencies every time they update your credit score they have to provide a proof that it was done according to a certain ml model that's fair and you know not racist or sexist and also you know is an ml model we all agree upon um that does correct stuff um that has like the proper inputs according to you know your loans or whatever other information goes into updating your credit score so there's a bunch of examples today where instead of having Regulators having to spot check these agencies they could use verifiability to ensure that they're doing things properly and in a fair way so that's kind of the use cases of

ZK and then now I'm going to talk about what we're building at cinct which is a ZK VM that makes ZK really easy to use so what is sp1 it's our ZK VM it's really it's a really fast ZK VM and it enables any developer to use ZK by just writing normal rust code so how it works underneath the hood is you have an sp1 program that is just normal rust it compiles to this Isa called risk five and then we generate a proof of your program with certain inputs using a bunch of you know cryptography and math that I won't go into and at the end you get the proof of your program with some inputs results and some output similar to my first slide where I outlined what

does ZK at a high level look like so that seems pretty straightforward and simple you write some program or computation that you want to approve and then sp1 helps you generate a proof of it uh but I'm going to talk about why sp1 is super awesome and for that we have to go through the old way of doing CK so sp1 seems very very intuitive you just write your program in normal code but the old way of doing ZK was not this at all basically in the old way of ZK and I have some screenshots that look you know pretty scary and that's because the old way of ZK was very difficult you had to write these things called circuits where you could write your computation that you want to generate a proof of and break it down into very lowlevel almost like assembly additions and

multiplications that we call a circuit and you had to learn all these specialized languages and DSL to actually do all this stuff and often it ended up not being a very nice situation you had to know a lot of math and cryptography so in the old way of ZK to do anything you had to have a really big team that was really specialized with cryptography expertise to actually use ZK at all and this had a lot of problems uh obviously one big one is you require specialized expertise so it's not that accessible another thing is it's really hard to customize and maintain and upgrade systems because every time you want to like maybe do an Fe new feature you'd have to spend a lot of engineering effort to add it to your system also auditing these systems is really

difficult because it requires a lot of specialized expertise and it's all very complicated and then in general it was also expensive and hard to implement generic applications with this old model of ZK and then with sp1 though because you can just use normal code uh anyone can now use ZK and you can actually prove basically any statement that you want so this is is an example of the sp1 program and for those of you you who are familiar with rust uh this is Computing the nth Fibonacci number in sp1 which is kind of the hello world of ZK and you can see that it looks just like totally normal code and it's all very simple you don't need to understand any of the math or any of the cryptography and so that's why sp1 is super awesome you can just write normal

rust you can reuse existing libraries from existing software stacks and really build anything with ZK and be any developer you don't need to know any advanc math so sp1 is also kind of a breakthrough because it has really fast performance and so at our team on our team we did a lot of Novel cryptography stuff to make sp1 really fast so in particular uh one of the biggest use cases of ZK today is ZK rollups in the ethereum ecosystem as I was touching upon before and one interesting fact we noticed is that in the ZK rollup Paradigm most of the ZK overhead is spent in really repetitive cryptographic operations like hash functions and verifying elliptic Cur C cryptography

for verifying digital signatures and so we introduced this system that we call our promile Centric architecture where there's a way to have specialized circuits for those really intensive operations that connect to our main risk 5 CPU approver and accelerate everything by an order of magnitude so sp1 is basically the fastest zvm by an order of magnitude especially for these rollup in blockchain use cases because of this pre-compile Centric architecture that philosophically you can kind of think of as ZK native assembly we also implemented an optimized GPU prover uh that helps improve the cost and latency uh by another order of magnitude and then we have a bunch of other

algorithmic optimizations in cryptography that makes sp1 really fast especially for these blockchain use cases so now that I've kind of covered ZK what it's useful for and then also yp1 makes ZK easy and is super fast uh I'm going to kind of go through a bunch of applications that I'm excited about um that we've built with sp1 so as I was talking about before one of the biggest applications of ZK today is ZK rollups and in the ethereum Centric road map for those of you that are familiar there's kind of this world where every rollup in ethereum is going to be a ZK rollup and so with sp1 we were able to take ref which is a rust implementation of an ethereum client and

we were able to stick it an sp1 and run it and there's the actual program that actually implements a ZK evm in sp1 and in 1100 lines of code which is actually a very small amount you're able to make a full zkm that verifies ethereum blocks and ethereum transactions using sp1 plus the rust implementation of ethereum in a weekend so that's pretty awesome and that's something we put out there and one really cool thing uh just to give some numbers on SP 1's blazing fast performance is if you look at executing real ethereum blocks you can see that the proving costs per transaction are really cheap in this case you can see that on average the proven cost per transactions between 0.1

to 0.2 sometimes. 3 cents which is really very little and this kind of demonstrates that with sp1 today ZK is not only really easy to use right you just take WTH run an sp1 but it's also really cheap and really fast and practical another thing we recently did with sp1 is we took the op stock which is a really popular rollup framework on ethereum and then we took their state transition function which is what's needed to make the op stack rollup actually be settled on ethereum and we ran it in sp1 and what this lets us do is it lets us convert any op stack chain to a full type 1 zkm with the really simple integration using the power of

sp1 uh and that's the repository for it so it's related to the previous work running R the scp1 and in this case it's taking an existing very popular rollup framework that rollups like bass use uh if you guys have heard of that and taking it and making it into a full ZK rollup and then finally another big category of work we've done is we've made ZK like clients with sp1 so in general today there's a really big problem of you have all these different chains ethereum salana a bunch of Cosmos chains and moving money and interoperating between them is a really big challenge and ZK helps solve that because you can verify the consensus of one chain in the execution layer of another chain and then you can have

really trustless interoperability and so we've built a bunch of ZK like clients with sp1 to talk between ethereum tender based chains in the cosmos ecosystem and then even chains in the polka dot ecosystem and again I have some code examples here that show with sp1 you can just import existing libraries like tender or Helios which is an a rust ethereum like client and make all of these DK like clients in very few lines of code very easily using rust plus sp1 so that's some of the stuff we've built um with sp1 and that's kind of to show that you know those are the practical use cases people are using them today it's really easy it's really fast but now I want to talk about since

obviously there's the eth global hackathon coming up this weekend what are some other ideas for things we're excited to see being built with sp1 so the first set of ideas I kind of want to talk about is in the same theme of upgrading the current blockchain stack with sp1 and ZK and kind of getting ZK everywhere it needs to be with it to help blockchain scale so one interesting idea is you can Implement new consensus algorithms in sp1 to connect more ecosystems for example we've already connected ethereum and the cosmos ecosystem with our tender like client but there's a bunch more chains uh that could benefit from having ZK light client implementations that would be pretty straightforward to

implement in sp1 there's also a bunch of bridges these days that support modular security verification and it would be really interesting to take all these DK light clients and actually integrate them into the existing Bridge Frameworks so that existing Bridges can be upgraded to have ZK light client security as opposed to the multisig they have today another interesting project not in the ethereum ecosystem but in the Bitcoin ecosystem and actually I think someone has worked on at a previous hackathon is you're taking the entire Bitcoin chain and generating a proof of its state transition function and proof of work to basically prove the entire history of the chain from Genesis till now and that would be possible to do an

sp1 I think actually some people have done it in the past with the ZK circuit method but it was very cumbersome and had a lot of you know complex code and I think this would be real relatively simple to do an sp1 and then in general there's been a few talks um The Talk by rushi from move um two talks ago uh talking about the move VM which is an alternative State machine that's not the evm and in general there's been a lot of different state machines move VM svm the cosmos SDK that can all be proven in sp1 and you can kind of Imagine a future where every single blockchain execution environment is proven in a ZK VM so that they can all interoperate and have verifiability there's some category of

fun onchain applications that can be possible with sp1 so one thing that's really cool about sp1 is not only can you just prove State machines you can actually prove any piece of software so for example if you have a rust implementation of a video game like Nintendo or Pokemon or do Doom you can take that code and run it an sp1 and now you can have provable video games that settle on chain so that's like a fun idea that I'm excited about you could also imagine that you can have certain types of nfts with really comp Le Lex properties uh using ZK and sp1 so for example you can make an nft where you can prove that the art was generated According to some complex model normally that would be prohibitively expensive to

do on chain but you can just write the rest function for it prove it an sp1 and then do a conditional mint uh based on the proof um and I think that's also a really fun idea and another category in a related vein that I'm excited about is bringing ml models on chain using ZK so normally uh it's very expensive have things like mnist or you know gpt1 or gpt2 or logistic regression on chain you also probably don't want to write that stuff in solidity because there's no existing ml libraries and solidity but thankfully because you can just take normal code and rust and run it an sp1 now you can start bringing more pieces of software and especially ML on chain that I think would also be pretty interesting and then the last category

of ideas that I'm excited to talk about is real world ZK applications kind of in the non-blockchain use cases of ZK that I covered in my first few slides so one idea that I think is really really cool that I would love to see built is a tested image editing today on the internet if you go on Twitter there's no telling whether an image was from a real camera or an iPhone or just made up by something like mid Journey or Dolly it would be very interesting to basically take a the signature um that signs an image so if you have a test if you have verifiable Hardware that signs the the fact that the image was used from a real camera uh the iPhone already does this today you can prove that the image was generated

from a real camera on real hardware and then transformed through cropping or jpeg compression to the image that you see that's being served on Twitter and I think ZK will be a really important part of how we can tell um authenticity of images and in general other data on the internet in the future so that would be a very cool demo another thing a lot of people want to do with sp1 is they want to run it on their mobile phone and no one's really done that yet and that would also be really cool to explore like can you take sp1 run it in Swift or run it on iPhone and see how it performs there's some other really cool examples of taking web 2 data and bringing it to web 3 so for example verifying emails or verifying passports

uh in sp1 and bringing that data on chain today actually most all almost all emails are signed by a cryptographic protocol by the issuing name server of the email so for example if you get an email from Twitter the Twitter public key for their email server will sign that email attesting that a real person from Twitter sent it and you can verify that signature in asp1 and prove that you received an email from a certain Source you can also do the same thing with passports passports are signed generally by the issuing country and the passport Authority and there's a public key registry so you can verify that oh I have a passport that's issued by the United States and reveal certain information for example to prove that you're a citizen on chain so all that stuff would be cool to do and sp1 in

general I think there's a potentially a lot of other sources of digital signatures uh across you know various different data sources so emails and passports are just two examples uh what are other areas that have signatures that we can prove in ZK and then selectively reveal information about and bring it onchain or also use it in offchain context to selectively reveal only the information that we want to reveal instead of having to dox our entire identity and then finally things like PDF documents or taking images and running ml models on it I think is also a really interesting real world ZK use case where you can start bringing this data on chain or even use it in offchain contexts so those are some of the

examples of um sp1 that I'm really excited to see built across a bunch of different applications and ecosystems um and yeah hopefully that was interesting um if you're interested uh you can this is my information you can reach out uh those are the repos as I mentioned and yeah in general really excited to see ZK now that it's much more accessible get a lot more adoption and a lot more people building with it thank you [Music]