ZK HACK IV - ZK Jargon Decoder

Transcript

today I want to Welcome to the stage Nico from geometry research Nico you may know him as my sometimes co-host of the zero knowledge podcast and he is one of the members of the newly formed geometry research hi Nico hello how are you I'm I'm good I'm we're behind schedule but I'm but I hope I hope we can still Jam in as much as ZK jargon as as possible into this session um is geometry research I mean folks have heard geometry before but maybe you should tell them a little bit about what geometry research is yeah um so it's a new organization it's a new company it's the same old research team you might

have known from geometry um but we are now collaborating sort of independently um so we'll still be working on open source cryptography protocol design implementation um and security analysis um and I invite you to go check out our website geometry. deev or we have Kobe wrote this very nice thread of explaining the stuff we do uh on Twitter x uh and the handle isore geometry Dev underscore underscore cool um today we're going to be talking about the ZK uh jargon decoder this is a website that you built some time ago I remember when I

discovered I was like this is so useful can you share a little bit about what inspired that and actually I think we just shared the link if people want to see what we're talking about here with the CK great decoder um yeah this was something I started writing out kind of for myself as I was learning ZK jargon and as I was finding all these like words that were very specific to ZK but somehow weren't to use in the same way many times um and the goal was just to have kind of like a little reference for myself and event actually I thought you know what let's just put it online see if it's useful to anyone nice um I thought of it sort of like a glossery of terms is that correct is that a good way to think about it or yeah I'm worried

about saying that it's too much of a dictionary because it's not like the definition is aren perfect the point is like to be a bit more informal a bit more practical like to make sure you can read and quickly grasp the concept that is behind the word and then yeah you might need like the specific mathematical definition they won't be there okay okay got it um so we in in prep for this maybe just to describe what we're going to be doing we're kind of doing a live version of the ZK jargon decoder so our goal here is to talk about terms in ZK that you may have heard but aren't completely familiar with maybe comparisons um conflicts of naming where like two things sound similar but might not be we have a few I mean we have

quite a few questions ready to go but we are relying on you as an audience to also give us questions that we can talk about on the air on here um we tried on Twitter to get some questions and there were a few but it was a bit of a fail so please please share some questions here um and just so you know what will happen when you do we are able to bring up your chat your comments uh onto the screen itself so for an example someone oh someone really liked your paper teras thank you for mentioning that um and so this is kind of how we're going to be interacting with you folks so please do think of great questions put them in the

chat we're going to be you know trying to keep our eyes on it if say if there's too many questions and you feel like yours is may be lost feel free to post it again as well all right um to start off I know we had some questions that we wanted so we wanted to sort of take the ZK jargon decoder site and at least start from there and then we can kind of expand so the first question was actually a question you thought you know you felt you wanted to start with which was what does it mean to prove we talk about proving a lot but what does it actually mean um yeah it was also like the reason I wrote that one was because I found that was there was a lot of vocabulary

and there was a lot of like context that I needed for some of the other definitions and I've had to put that on um I do have some slides if you can BR those up let's do it amazing cool one second sorry does this show up to prove okay awesome um so what we have is like in mathematics we have statements that are either true or false and the problems we're confronted with is like decisions like can I decide whether the statement is true so sometimes that's easy like you'll have a statement like the number 54 is even sure I can look at it and figure that out and sometimes it's hard the number this

this big old thing can be factored and by just staring at it I can't really find the answer but if someone knows it they can prove it to me so in this case yes the statement true is true and here is my proof and I'll give you the actually the actual factorization of a number and you know you can go and type that into a calculator and see that works and that's a proof that is it I am giving this extra information that allow you to decide your statement nice all right next up we have another question that you also mentioned in your website which is probabilistic and interactive proofs what are these yeah so this is kind of like the next

logical step is like okay a proof is I give you this information you check if your statement was true the problem is sometimes proofs are going to be long and I took like this screenshot uh like list of long mathematical proofs and some of them are like 500 pages 200 um and this is actually one of the motivations for like zero large proofs that's one point in Academia it's like how can we make proofs that are shorter or easier to verify um and one way of doing this is by having interactive proofs so rather than just like oh I give you all the information you need to verify the statement we'll have sort of a conversation and the verifier is going to ask questions and I put those into quotation marks um to check that the

prover keeps her story straight right so you can think of it like as a an interrogation and you ask question the pro gives an answer you ask another question and we keep going and at the end you check all right are these answers consistent with each other so that's one way of doing it um essentially rather than you giving me a proof we're going to have a conversation and you explain to me why something is correct the other way of doing it is a probabilistic proof so in this case we're sort of relaxing our requirements I'm like all right I don't care if once in a while I'll accept a wrong proof but as long as that's you know just once in a while and in that Paradigm I can get away with not read the whole proof you

know like sort of how we sort of you know as high schoolers that's how we think of our teachers like reading through our our exams and like ning the whole thing be like a sure fine close enough um yeah uh so that's probalistic proofs and then we can also combine both and that's what we call iops Interactive Oracle proofs and that's what we mostly use in ZK today I remember just as an aside I remember when I first you know the red what is it the billiard ball example where you're like putting things so it's that's like an interactive proof but it's also probabilistic like you're kind of you're I'm wondering is it like you're you're interacting with someone but you're also kind of like showing

that like it would be very unlikely that they were able to lie that much yeah I so I'm not sure what analogy you're referring to the one I knew of Bard barels was for elliptic curves and the discrete logarithm problem in which case it's more about like why is a problem hard rather than what is proving okay maybe I'm maybe something else but okay all right um someone knows that yeah if someone should say in the comments if that is an interactive probabilistic proof or not maybe it's not um one of the questions that we have is what is the zero knowledge proof and on the CK jargon decoder it is not defined uh Gaylord noticed this one why why is

that um so you'll see also what I just said now about like um probabilistic proofs and interactive proofs is not there yet either um and so essentially I I sat down to write the zero knowledge proof and I was like sure that's going to be easy zero knowledge right uh and I realized I needed all this context and so I started writing the what does it mean to prove and I'm now doing the interactive and probabilistic proofs and once we have all that baggage we can go to zero knowledge there we go what is zero knowledge proof it's a proof where the Pro's messages don't leak information about the stuff the Prov knows very vague but yeah uh all right what is the difference

between a proof and an argument um that's a good one and a confusing one um it's basically a question of we have these protocols uh someone is producing a proof and maybe they have incentive in tricking the verifier right like if you produce a proof and get some money based off of that you might want to trck the verifier and so the question is who are we protected against like can what security guarantee that we get um is the attacker anyone in the world is the attacker like something specific and so in the case of a proof yeah the adversary is anyone has unlimited computational power like I don't care

how many computers you have I don't care if you have a quantum computer you will not be able to break this um and again let's be careful about what assumptions we make you know you can have proofs assuming that uh hash functions cannot be reversed I don't know um so that's a proof an argument is a bit weaker we're only protected against someone who has a bounded computational power so this is someone who uses regular Hardware um and so for most things arguments are fine because we have the sort of assumption that no one will ever

get like huge huge Hardware essentially um and in that sense proof is an argument because a proof protects you against these weaker adversaries and these stronger ones but the argument is not a proof is that does that make sense sure cool maybe for the audience I actually want to ask uh I want to bring up one of the questions that folks have asked in the chats because I feel like we have some interesting ones and I don't know if you're ready to do it because this is a little bit you know spontaneous but okay one is about I wonder if you can if you could do this so this is from Nicholas hi Nico could

you please explain in non-technical in a non-technical way why why we need elliptic curve pairings and how they work yeah so give you the why we need them the high work is going to be a bit harder um why we need them so in the first place we use elliptic curves because we have this thing called the discrete logarithm problem so I take a point on a curve you know it's like you draw a circle and you take a point on the circle so here it's not a circle it's just this big elliptic curve and we've designed a rule about like if I have two points I can add them together and get to a third Point great um I can add as many times as I want and I'm I'll just

cycle around the curve we can't multiply though and so in our protocols when we commit to things and want to add them together we can do that but if we want to multiply commitments we cannot with an exception if you have pairings you're allowed one multiplication just one um so that's the why we need pairings they give us this magical like in a Land of additions we get one multiplication interesting how they work is a lot harder all right here's one what is a polinomial IOP yeah there's further questions to that but maybe we just start with what

is a polinomial IOP so we saw earlier um what is an IOP interactive Oracle proof it's this combination of interactive proofs and probabilistic proofs so it's multiple rounds and with every round the prover says something but the verifier only checks a small part of what the prover said um in a polinomial IOP the pro can only say pols so the pro sends polom and the verifier doesn't need to read the whole polom and could just evaluate the polom at a specific point can you explain NTTS and ffts in the usage yes um they

are so fft is is many things but it is amongst all its uses an algorithm that takes a polinomial in its coefficient form and evaluates it over a bunch of different points or we could go the other way around we take the evaluations of a polinomial and go back to its uh coefficients um if we work in finite Fields Etc we don't no longer call it an fft we call it a ntity but it's it's kind of conceptually the same thing it's just two different names and entity is the more precise way of saying it but no one is going to be mad at you if say fft are they both the same

direction uh I always get it wrong but yes NTT is the same direction as fft and inverse fft is the same direction as inverse nt Okay but I always forget who's I think fft is from coefficient for evaluation and inverse fft is the other way around but yeah correct me if that was wrong yeah someone in the chat might know this cool I actually I have a question that sort of follows on this one which is polinomial IOP and polinomial commitment so we've heard those terms is there anything that is nonp poomi that could be used instead yeah why are we saying Pol both in both these cases it seems like there might be non polinomial IOP or non

polinomial commitment and yeah you're absolutely right the reason we like polinomial so much it's because they have this sort of uh error amplification property or distance amplification that's what people like to say so say I take two pols that are the same except for like one of the coefficients and I evaluate those two pols at some random Point what happens is I'm going to end up with widely different evaluations even though the pols were super close except for like one difference um so that's why we like polins but there are other objects that have this sort of amplification property um one of them are like more generic

error correcting codes and that's sort of if we go back to the earlier like I think Le hero uh or like the original Stark paper that's sort of what it was based on even though the codes they use are like polinomial based uh but you wouldn't say it is it uses a polinomial commitment scheme for example okay and Fry generally is always lumped in this polinomial commitment category but I always hear it's like not exactly a polinomial commitment so what like is that would that be an example of a non-p polinomial yeah um so fry tells you whether or

not a commitment is indeed a commitment to the evaluations of a polinomial but it's not exactly a polinomial commitment scheme right because in a commitment scheme I want to be able to evaluate the polinomial anywhere else so to build a commitment scheme from fry you do need to do a bit of extra work um so fry is lumed in as long as you do that bit of extra work and that you you do things correctly is it mimicking a polinomial commitment or is it like you're adding a polinomial part on top of it or something you are H I'm not sure uh how I would like give you the image it's more okay it's I

run Fry on something that was not the polinomial I intended but something that tells me something about the polinomial intended okay so for those who are familiar with kzg proofs kzg has like this opening quotient and when we want to do polinomial commitment schemes from fry we do Fry on this quotient but that is guess an answer for people who know kzg other Jon term that people might want to ask about there was a a question that we had actually someone just asked a question and we had kind of prepared a very similar question so I'm going to I'm going to do our part and then add theirs so um we often hear of a zkp as being of

consisting of three Pro three parts completeness soundness and zero knowledge there's sometimes a criticism of people calling ZK snarks ZK snarks when they're actually not using that zero knowledge part of the zkp but um yeah someone asked let me just find this can you please explain the difference between General soundness and knowledge soundness so in in the kind of list I shared that's General soundness soundness completeness and zero knowledge so maybe we should start with like a definition of what knowledge soundness is and then why are there these two kinds of

soundness Y glad you asked the slide is ready to go yeah we were ready for this one um and so here the difference between soundness and knowledge soundness is what does the system guarantee so earlier we had who are we protected against but what's the guarantee that we get so in the case of sness we know that if an Hest verifier accepts a proof then there exists a witness that satisfies the instance and I'm throwing in these words witness instance um this is sort of stuff I cover in the what does it mean to prove but if we go back to are sorry I'm jumping around a bit but hopefully this will have a nice

payoff um our statement two earlier that we wanted to prove we say the number something can be factored this something we could actually plug it in out and put something in right I could say the number five can be factored or the number nine can be factored um some of these will be false some of these will be true um so this thing that I plug in is what we call the instance the witness is what we would call the proof in the sort of non-interactive nonprobabilistic setting the witness is this proof is this information that tells me that my instance could be in a true statement or is in a true statement all right so I guess we can

stay here for the example soundness says if I've accepted a proof that the number thingy can be factored then this thing must exist this witness must exist great whoops knowledge soundness is a stronger requirement now I'm saying if the verifier accepts the proof then the prover knows the witness so back to earlier yeah it's not good enough that the factorization exists I need the proof it to know it to know the the like answer to it the actual numbers know the actual answer so you can't use like AIS like it will

likely beable but I don't know how I don't know what it exactly is in this case you need to actually know yeah the values exactly yeah say our instance was a super large number that adds into a two and I ask you can this be factored you can very quickly say yes and prove it to me but you don't need to know the factorization right so that's a difference and again knowledge soundness means you also have soundness because you know if someone knows the witness then the witness must also exist but the other way around is not true the witness exists but maybe you don't know it in which cases do you need knowledge soundness yeah um I actually have a little example case and this is

something that came from the ZK whiteboard sessions you know like there's a study club that you run in like the ZK hack Discord and this question this question came across I came across a lot and so we we sort of came up with this example so let's say I want to prove that I know the private key X for some public key capital Y so this is like a very concrete like blockchain example um so the valid key pair should have y equals g to the X and discret log it's hard if I give you y it's hard to find X great so we have this instance which is Y and G and we have a witness which is X and the question is do I need a protocol with soundness or knowledge soundness h

are you asking me no I'm asking either you or the chat I guess okay I don't think I can answer it but let's we can we can leave it in the chat yeah in this case do you need a do you need a protocol with soundness or knowledge soundness I'm curious if the crowd can answer this that'll be interesting there are some other good examples I see in the chat actually really yeah knowledge soundness first answer yeah why all right um that is correct uh why so the witness the private key always exists like if someone gives you some

public key y there is always a private key that corresponds to it and it doesn't matter whether the pro the prover knows that private key or not like it always exists so if we had only soundness then anyone could make a proof that the private key exists because that's true if we have knowledge on this on the other hand only someone who knows the private key can make the valid proof funny in the group there's definitely been some people who who understood it differently but uh thanks for defining that Nico I feel like we've gotten a whole conversation going it's really fun to see everyone debating this it's

awesome shall we move on yeah something I just realized we forgot to do at the beginning of this was give a little bit of a framing for the kinds of questions we're choosing so you may have noticed I've been picking some and maybe not picking others um generally we're looking for a little bit more general questions something you know definitions jargon decoder kind of stuff Nico maybe you can also share what we're what we're not going to be looking for what's Maybe not really suitable for the jargon decoder I mean right now like the the coder itself we won't explain like in detail how plon works right we we might say what plon is uh but I won't give the inner workings

of it similarly I'm not going to look at like it's very ZK and cryptography specific I'm not going to look at like system stuff or consensus stuff so questions like rollups or validium like completely for me like out of my knowledge essentially cool so we have I have another one I want to kind of continue with yeah um that we had pre-prepared which is about oh actually wait wait sorry before we move on there was this one thing I really wanted to show um summarizing uh this conversation of proof versus argument and soundness versus knowledge soundness um so on one axis I have um how who are we defending against who's our adversary and people

like to use these terms computational statistical so when theover has unlimited computation we have statistical guarantees like essentially if the verifier goes wrong it means that the pro got very lucky and in the argument model we talk about computational guarantees because we only have guarantees if the prover is computationally bounded and then on the other side we have soundness the witness exist exists or knowledge soundness the prover knows was the witness and so now you can start coming up with all these different words right like if your adversary is unlimited and you just need soundness

that's a proof if your adversary is limited and you just need soundness you have an argument if your adversary is unlimited and you need to prove knowledge that's a proof of knowledge and people like to use p and if your adversary has limited power but you still need to prove knowledge on this you have sorry yeah knowledge Honus you have an argument of knowledge but the reason I drew this is because there's a bunch of other acronyms that we usually find and I wanted sort of place them on this map so cool um so hopefully yeah people will recognize some of these like zkp well all right it's a zero knowledge proof so I have that in the proof box but it's not a proof of knowledge yeah and that for that we have

a ZK P um and the snar like I remember that definition from actually I think it was the first DK hack we had alesandro who was using that term and I remember being like why don't you just say snark is because it's a different concept slightly they prove different things yeah yeah um n is one that people often see non-interactive Zero knowledge and this one I have it on the border because the acronym itself doesn't specify if it's a proof or an argument usually when people say NS they mean a non-interactive zero knowledge proof so it's usually more on the proof side um but yeah it's sort of ambivalent very cool this is such a great graph um I know a lot of folks are asking for uh

like there will be a video of this I feel we could probably share these slides after right Nico yeah we will be sharing the the jargon decoder we did share that link earlier in the chat maybe we can share it again here so people can keep their eyes on it um we're going to keep going and we're seeing some really good questions come through uh one person asked I think this we could talk about here which is uh finite Fields what is oh let me pull it up so what is a finite field because we hear that finite field a lot in in this world and why is it important in proof generation or verification yeah um so finite field you might have worked with them so you

worked with fields for sure um because the real numbers like the the numbers that we use all the time uh the numbers used in high school math form a field so that means you're allowed to add them together multiply them together uh you can divide uh everything except you can't divide by zero big no no um there are a few more rules of what forms a field um but yeah I want if this is not a math pass right like that was the point of the jarg de finite means that you there is a fixed number so again the real numbers the ones we used in high school they go up to Infinity

they're not finite they're infinite finite fields we have a cap and what happens is when we reach the cap we Lube back to the beginning and that's a very important property for us this looping back means that if I ask you to take a number aroundand them within that finite field it is there there are no numbers that are more likely to be picked than others because we have that back and if I ask you to pick a number pick another number add them together it still looks completely random which you wouldn't have in something that's not finite U so that's why they're important they give us this um this property that we can sample things at random process

them and the output will still be sort of random looking the other property that they have um is that the discrete logarithm problem is hard so we have these hard problems that come from finite fields and we can also build curves elliptic curves over finite fields and get even harder problems and cryptography relies on hard problems to work what is a alternative to a finite field like are there other systems built on other things this is where I'm exposed for having no cryptography culture um let me see no I think um most of cryptography is based on on

finite fields and when maybe when we talk about things like small fields are they all actually have a question for this one are these always small finite Fields still yeah yeah yeah they're still finite okay and they're well that's why they're small right but like not all finite they are finite but they're even more sorry right not all finite fields are small Fields no exactly but the small ones have to be finite okay otherwise you know if it's infinite then it's right all right so it's just a matter of um you know how I said when we pick a finite field we choose like a maximum and then we wrap around small fields are ones where the maximum is small okay yeah so that's I

guess that sort of defines here what what is when we talk about what is a small field is like we we choose our maximum value to be something small enough usually we like to keep it small we usually mean under 64 bits or under 32 bits so stuff that we can store nicely on our Hardware maybe a followup there is why small Fields yeah well I guess I sort of alluded to it here but we can store it nicely on our Hardware um so why small Fields yeah why did we not use small small fields at first because we we do like picking things at random and then you know what was the chance that you picked that thing is one over the total number of elements so if your thing is too small

this chance becomes quite small uh quite big right if our field has just two elements and I ask you all right pick a random number between zero and one I have a 5050 chance of guessing which one you picked H for now if I ask you i' pick a random number between zero and 10,000 yeah this gets a lot harder for me to now guess so that's why for security reasons we like big fields okay things get lost for efficiency like small Fields interesting cool that's a good tradeoff yeah or good to know that's that's actually super interesting like part of the recent advancements in zero Lage is like how do

we benefit from both how can we still use small Fields but not lose security that's cool I have another question that I from the crowd um this is about blinded polinomial are you familiar with blinded pols Nico yeah so how does if it is what I think they mean then yes okay how how do blinded polinomial work can you please explain how roots of unity help in a domain yeah so let's start with this idea of blinded polinomial so let's say um for some kind of proof um let me figure out how to phrase this

all right um let's say for my proof system I need um I have a bunch of values like 10 values a vector of 10 values and I I can take these values and get a polinomial from it great now that polom reveals information about my values can I somehow change the polom but still make sure that it represents the right values uh and that's what we do when we blind these polins and this is something you'll see for those who are familiar with plon round with plon this is what happens we blind our pols and so how do we do this we multiply our

polinomial by something else um that doesn't affect our polinomial on the values we care about but affects it everywhere else and that's how we sort of blined what it was because we we now multiplied it by something it's a bit hidden uh it didn't change the important property that our evaluations are still the ones we wanted over that small Vector um but we're not revealing your polinomial hopefully not too hand wavy um roots of unity how do they help in a domain um well like we just said like this finite field is this nice thing

that loops around roots of unity in a finite field is just saying like Okay I still want to Loop but I don't want to go through every step so I'm going to take just uh four steps such that like going from one to the next to the next to the next I've looped back to the beginning that's our roots of unity and you can draw that like on you know the unit circle I don't know if you're are familiar with this from high school or maybe a bit after I don't know uh so that's how they help they allow us to work in smaller sets of our finite field but still keeps a nice loopiness all right I want to ask another question on uh that we had

prepared one this is about circuits so y a circuit is mentioned a lot what is a circuit and are all ZK systems built as a circuit yeah I guess the tab I have open next to the slid sort of gives it away circuit jargon decoder yeah I thought I would use it and I guess you know Shameless plug I guess this whole thing is a Shameless plug um so circuit usually we mean arithmetic circuit so it's like unordered collection of additions and multiplications so this little diagram shows you the circuit sorry so we have at the bottom

these inputs x0 to X2 we have up here a single output to our circuit Y and we see like there are some built-in Gates these multiplication additions and there are some you can even have like hardcoded values inside it and now each of these wires has a value on it and we can we can walk our way through it and and um evaluate things so down here we have X1 plus X2 then it gets multiplied by three on the other side we have 5 plus X Z and oh sorry time x0 and then we add it and so we could also write it as an expression right

um so that's what a circuit is essentially like a sequence of operations why do we care about them was that the rest of the question are all systems built as the circuit yeah so I guess actually relating this back to um what are we proving we can prove many things with the circuit we can say is 10 a possible output for this circuit and in that case theover would have to find these X values that make it go to 10 or you could say what is or you could be more strict with it like is 10 the output when X is five X1 like you and you can you get to choose

essentially all these values that stick out of the circuit you get to to ask questions about um are all ZK proofs built on circuits no um or built as circuits like are they all like is that the underlying mechanism for all zkps no so the reason we like circuits is because we have found that any provable statement can be expressed as a circuit and then if you can make a proof of a proof or a proof of knowledge or an argument or an argument of knowledge for a circuit then you can do it for any provable question H so that's why we like C

um but it's sort of inefficient right because maybe my state like if I have something I'm trying to prove to you and it's something simple I don't need to convert it to a circuit and then prove the circuit maybe I can just prove it without going through that extra circuit step so are all ZK systems built a circuit no one example is um if people have heard of schnor signatures those are actually based from like they're the non-interactive version of a ZK protocol that we call the schnore identification protocol and that thing doesn't use circuits for example I had a like a follow-up to this is actually is our air-based system still considered circuits because what

we learned from like the ZK whiteboard sessions was you know they had like what you what we have in front of us looks like a circuit works like a circuit but air has this very different looking thing like it's yeah it looks like a table right yeah so is it still a circuit um or is it still built on a circuit I think I want to try to use the terminology right there so you know how we're saying circuits capture all provable statements um air captures all circuits therefore captures all provable statements but similarly R1 CS captures all circuits and therefore all provable statements like you have the sort of these boxes so in a way they're not the same but

they're the same like that's the sort of unsatisfying answer um you can express any circuit as an air you can express any air as a circuit it's just a translation um so it's hard to answer are they the same right okay um there's a really good article actually so actually no first let me backtrack a bit they do Express circuits and yes Airbase system does prove something about a circuit but the circuit is not in this pretty diagram form it's in this table form got it I'm going to close that one down um we have a lot of questions coming in the chat so I feel like we should go

through some of them yeah so um somebody asked about folding which I don't think have you defined folding in the Jon decoder I have not there's a whole to-do list there's a whole to-do list all right all right I wonder actually Nico do you need help with the jargon decoder would you be open to people yeah absolutely people want to like uh contribute collaborate happily definitely cool because even in the chat here I see some people answering other people's questions and there's some interesting stuff there we might be able to dig up I mean the rules are simple as long as basically I I always try to keep this one one liner or one sentence let's say

yeah um for quick reference and then a bit of a more bit more of an explanation and then that's it cool and yeah from this page you can get to the repo and there you can start like contributing so folding um if we go back let me go back to here our approval statement statement two so in this case we had one instance and the the proof is like one witness great but what if we had I don't know 20 of these cand thing be factored and um the verifier doesn't want to every time it's given a witness

check the multiplication and see if it works um so how do we sort of solve this or how do we get more efficient we fold we take two instances combine them into one new instance so in circuit land it would be let's say we assign specific values to x0 X1 X2 and Y and we assign I don't know 10 different sets of these values we can fold them all into one single circuit and prove that circuit yeah recent progress um we have a bunch of different variants of folding I guess um and the progress is usually

in how many things can I fold together or how fast can I fold two things together or what kind of things can I fold and folding folding somewhat like isn't folding limited to kzg based I want to see if I'm correct here like there's certain kinds of snarks that can use folding but not all yeah uh folding is so the way we sort of combine two instances into one requires to add commitments together and not every commitment scheme allows that uhuh so elliptic curve stuff we can add them together any hash based commitment we can't add them together is this where like it needs

I'm gonna see if I can say this additive homomorphism y cool um someone asked this this is when we have actually a bunch of questions around the polinomial stuff we were talking about so yeah can we say circuit plus knowledge equals polinomial um no because you could have circuit pols uh but no knowledge you could have a polinomial IOP for example so we're back to polinomial land um but that just has soundness that does not have knowledge

soundness so in that case you're we wouldn't have knowledge in that little equality there and then in what you need okay here's another one um this is just more theoretical can you explain why any of these things are using polinomial at all yeah um so we touched upon it a bit earlier and it was this idea of distance amplification if I have two polinomial that are the same except for um one coefficient and I take a random point and evaluate both of these polins at that random point they probably won't have the same evaluation and that's what the property that we like about them is even if you

change the tiniest thing about a polom it's going to be very hard to match my expectations as in to match the unchanged polom huh and I remember I think someone asked [Music] um uh oh did he close the browser well give him a second to come back this is good because I'm actually trying to sort hey Nico hi I was trying to go through the questions and um yeah um you got you got to load your slides Again by the way yeah yeah

someone was talking about when when we last spoke of polinomial and this sort of distance amplification property um someone rightfully asked but wouldn't error correcting codes correct the error rather than amplify it um that's true but to correct the error you first detect it and to detect the error you use this amplification property all right yeah and someone uh I think a few minutes back talked about the short zle inma which is kind of what I'm alluding to with this thing of distance amplification if I take two pols that are different evaluate them at a random point it's extremely unlikely that they

will have the same evaluation cool um let's see so now there's a few on Gates and I know that this is this is a question from a little bit earlier but um what is this so because we're kind of flipping around a little bit I think the questions to the gate stuff came after the polinomial ones um context switching yes how can a custom gate be represented in a current circuit graph so I'll bring back the current circuit graph um let's say I this no let's say very often I I'll take my

inputs and apply I don't know a hash then I and yeah sorry let's say I very often do some hashing um and if I were to write a hash with these plus and times it would be I don't know thousands of them so rather than having every time I need a hash copy pasting thousands of gates I can say all right I bundle them into one and this is my custom gate and the cost of doing this is now just like one application of my custom gate it might be a very slow Gates but it's just this one thing so that's how you would represented here a box with a different symbol um it's no longer strictly an

arithmetic circuit because now we have custom Gates and that's sort of the flexibility we get from um air or plish and was it pron that pioneered this actually uh I at least in modern snarks yes um I don't know if you know in this history of computing like I would be surprised okay there is a very good article by Ariel and I'll try to find the link and probably posted in the Discord for ZK hack this article that sort of explains how do you go from air to what plish is and it shows actually how they're related and how a is just a special case

of funish okay cool this one's about circuits as well is there always two inputs and one output for circuits yeah what is the difference between games and gadgets so is there always two inputs and one output no you can have as many inputs as you want and as many outputs as you want and here I've drawn yes what we call these fan in two fan out one Gates so fan in two means two inputs ban out one one output uh but you can have whatever you like and the nice thing is actually our proof system doesn't see a difference between inputs and outputs out it doesn't even know that there's a direction it just cares is the value y related to the

value to all these X values in the way we expected um yeah that's I think that answers what's the difference between Gates and gadgets um this is kind of specific to libraries and Everyone likes to use Gadgets in in their own way um but usually a gadget will be a collection of gates that have a specific use a specific functionality like all right I've used gates to create something that um I don't know checks that a number is less than 10 this is now my less than 10 Gadget cool um I don't know if this

is something you can answer over here but can you explain how plon replaces elliptic curve pairings in proof is this true uh no no no Clon uses pairings needs that sort of one multiplication that we were talking about earlier so it's not replacing it no no and it's yeah okay well actually plon that uses kzg needs pairing plun with a different polinomial compl scheme might not need parings um okay so actually let's dig into it um PL so the pairing doesn't come from plonk the proof system it comes

from the commitment scheme you can commit in other ways and you can plug that out and replace the pairing the proof system itself doesn't need that one multiplication but yeah the the how this now gets into like sort of how Punk works okay which we don't have time to cover whiteboard sessions I think it's episodes episodes one to three that very well I think five we actually do I mean there there's like plon detail um true although actually I don't know if he does he definitely does custom Gates and gadgets but I don't know if he does elliptic curve stuff okay okay cool um just so everyone knows we have five

minutes or so yeah so we may have to uh like we have I have a lot of your questions selected but I don't know if we actually get to all of them by the way just want to say like thank you so much for like going through this with us this is the first time we do a live ZK jargon decoder and we'd love to hear at the end of this how you feel about it but let's continue because we have a little bit of time we can also take some of the questions into the ZK hack Discord I know you have a channel for ZK hack 4 and I think I'd happily stay there for a bit and CH nice cool cool okay this is one that kind of goes back to the U circuit question in like air so what does the rank in R1 CS

denote yeah so this is again like so when I mention air it's a different format R1 like I always think of R1 CS Air as like these are two flavors of well they're different actually right they're like you're going to choose one depiction or the other yeah you can move between them though right could you depict something okay you can but in this case we're looking at R1 CS um rank one this is constraint constraint system yeah um can bring it up R1 CS um and again in the Whiteboard sessions there's a good session unrelated to r1s but where um Mary Maller goes over how to use R1 CS or how to do it by hand um

and I have a link there um sadly the rank is uh like property of matrices um and I am not good with my linear algebra so this is a question for guo if you ever find him um he was doing this uh linear algebra and succinct proofs um class in the ZK HK Discord uh I think his handle is at at gear maybe you want to fire that question at him cool should I keep going should I add some more do you want yeah okay I mean it depends we are getting dangerously close to the puzzle release time true

exactly yeah so just to remind everyone in seven minutes we release the puzzle and there is a little announcement about the puzzle and sort of the description that we still have to get to but I think this one is quite General so from Lori which are the unique properties of ZK technology which which unique properties provided that can't be accomplished by other easier cryptography yeah kind of like why ZK here yeah and I guess are we using ZK in the strict ZK sense or what toin likes to call Royal ZK um sayk let's use the strict actually like why ZK um this was well I guess

it's in the name right zero knowledge and it's this privacy property that nothing leaks um and this you can't get elsewhere um like even encryption Al the MPC folks argue that zero knowledge is not zero knowledge because someone knows the secret whereas in MPC no one knows the secret apparently so in zero knowledge yes we're we're not saying No One Ever Knows the secret we are saying my secrets remain mine as long as I want it um the question of can we create values that no one knows is a completely different problem

um but NPC will use zero knowledge often in these protocols because if we're interacting together you have part of a secret I have part of a secret but we don't want to reveal our parts to each other but we can't trust each other guess what zero knowledge proofs yeah yeah it does though there's sometimes like use cases that are proposed for ZK for example like private compute where certain systems if they were more efficient like FHA would make and this I'm I'm super quoting FHA people here because they argue but like they would argue that actually for certain kinds of private computation it is actually better to be in a completely sort of blackbox private area and not be

um just sort of shielding parts of it maybe for complexity or yeah how how so they they do different things right um FHA is about all right I have some encrypted data can you compute for me on that data whereas a zero knowledge proof is I have some hidden data and it can convince you about properties of that data the other thing we have to be careful about is encryption is not perfect um they rely on hard problems they uh um like okay even let's say encryption that is not susceptible to like a quantum computer will be weak over the years

right if I hack at it for 50 years and send my computer for it for 50 years I'm eventually going to decrypt your message with zero knowledge the zero knowledge property is perfect there is no chance for you to learn something about what I hid in my proof I see I think you're looking at the time there yeah I'm kind of looking at the time also I'm trying to find out if there's one more question I could put I might actually grab one of mine um or maybe one of the ones actually let's so this was one that came in through the Discord um which I think would be cool to answer but let me just I have to hide the current and then I'll pull this one up so this one came earlier today regarding the front end and the back end

of a snark so we didn't really talk about this did we like the it's not polinomial and pol those this is a different separation okay are those both backend polinomial commitment and IOP they or they're just totally different Paradigm no no they are yeah they're both in the back end okay they are the back end okay yeah so in this case regarding the front end and back end of a snark is the front end basically just the arithmatic circuit and arithmetization and everything else is the back end yeah so the front end you can think of interfacing with the world so let's say how do I convert like all right I have a statement how do I make that statement snark and that's the front end and what is it to be snorable

so each snar has a different format let's say so you can use R1 CS as a format you can use um air as a format you can use whatever um the back end is once the proof system is given this sort of filled up circuit or this filled up air or this filled up R1 CS prove it h so yeah fronted is sort of arithmetization and let's say I write a circuit in circom I use the circum compiler that's the front end the output of that compiler can now be sent to a back end approv cool all right I'm hearing uh I I think we have to get moving because

people want to do the puzzle from what I've heard um yeah I think the puzzle yeah so the repo is private but the placeholders up um I'm going to share something that uh yeah puzzle time exactly Nico thank you so much for doing the ZK jargon decoder thanks for having me on an it yes and thanks everyone for participating I think this was great yeah next time we do this we use the Whiteboard we didn't touch it there was a whiteboard idea but it didn't happen thanks thanks everyone for those amazing questions too it was really fun to see you're kind of like jumping into these topics thanks Nico