ZK Study Club - RSA Accumulators

Transcript

all right it looks so everyone this is the zero knowledge study group called number something five number five again my name is Georges today we'll talk about RSA accumulators and my focus is primarily on scalable and security but this time we're looking into their knowledge proofs which can be used for scalability if we don't always have the zero knowledge aspect of them so I gave some links in the preparation of them screen share like let me just share my screen it shows that it works okay so I I will write this back to this in a way

that I would like walk you through a post but I wrote a couple of weeks ago which describes a RSA accumulators like I will explain why they're interesting and whether or not and perhaps at the end we can have a discussion like on what are some possible use cases and what are their limitations so yeah there are decided to move labels they're pretty old like we've been around since 1994 there are a few like different types of accumulators so we all know I guess like what a metal tree is which is we use their metal tree hush the root of the tree to commit the set of data and

then we have like a sort of larger proof which is which is used to verify that an element is part of that data or not and so they are say later or any accumulator is exactly that it's a way to commit to a set of data and then be able to use it but the one that we will see right now it has a few nice features such as that you can also prove like membership and non membership which like the usual medical tray structure does not support for example non-membership proofs and also we can do aggregation and batching and anytime I use the word aggregation and

that we take essentially we have many proofs and we put them all in one constant size proof and when I say budging I mean that we have multiple proofs and we all and we can verify them all at once faster than if we verified each one of them separately and I just want to say that this is not my work this is all essentially summary and the hash of the work that the Stanford graphic group recently did so yeah I'll get to it right now so firstly there is a very important building block here that is used and that is a proof of knowledge of exponentiation which is used in the accumulators and so this is also I should say that this is also used

in the verifiable delay functions research which is like very popular lately particularly for the next iteration of a theorem and for multiple other projects as far as I know are looking into it and so the proofs of for hidden order groups they can be used essentially to we have a number we have like the number of 16 and I want to prove to you that I know it's discrete log like base 2 so for example in this case it leaves four and left two parts that you need to do is that okay firstly you need I need to send you the number that I need to send you for and I hope you also need to perform the operation you need to do 2 to the 4 equals 16 be sure that I'm sure that I actually know but for actually large numbers this is

not like practical so for this one low-key it's very easy but if we have like if you want to calculate a huge number like even transmitting that number can be a lot to do it for example if you wanted to put like 2,000 bit numbers on the EVM it costs a lot of gas and you cannot do it consistently so firstly the paper that describes a very like a new scheme which is the proof of exponentiation which essentially okay I have like the value X we and we basically we have the value W that is their full value we have the base which is known also of the U in the X which is what the proven is trying to convince the verifier

and what happens is that their verifier sends a friendly this is an interactive protocol by the way and break and non interactive we have a fearsome Eric mystic so which I will explain a bit in case this is not known so firstly the verifier sends a large L to the prover which is a challenge and this challenge is basically and it must be a prime number because otherwise the prover can do some sort of attack which I would love to get into it in a bit with which they can fool the verifier and what happens is that when I receiver so like let's say Anna wants to prove to me that

I I want to prove to another that I know some discrete log she sends me well and then I calculate I do like Euclidean division so if if I receive a challenge L which is like 5 and my number is 16 I will produce Q equals 3 and R equals 1 which is the Q and R which make up the cotan in the registers with you and then what I will do is that I will send you the the base to the Q then you will calculate the R on your own and you will check that this equation holds and when you do this you end up like by doing their math which I have right here you end up we exploit all the extra initiations here and you end up like

being convinced that I sent you less data but you actually were able to verify that them but that I actually know the X that actually does this computation and so is it clear like so far or so they think I should also like maybe describe the use cases now or do you want to do get into this later I would love some use cases just to ground it right yeah yeah yeah because I lost my flow in that so ok firstly the use cases for this are for stateless block chains and whereby the stateless block chain is essentially like a very very light it looks inward like maybe if you know cobra like so instead of like

having to verify the whole block scene from Genesis you just get one succeed like whatever like digest some proof and view cubes and you can be sure that this is the state of the blockchain and did not need to stare to store anything else in your local store ads so this is very useful because okay you have like a very small very compact blockchain which is a good thing to have in my books and also instead of that you can also this can also be used to you do a short there interactive Oracle proofs which I think that you guys have studied in the past in their Starks workshops so generally when they're active Oracle proofs they work that essentially I have a very large

digest like a very large amount of they some very large amount of data that is the proof and this Tendo fair having to like you having to get any happy to send you the whole proof you send me challenges eight parts of the proof and statistically if I if I am able to answer a lot of your challenges correctly it probably means that I know the whole proof however this requires a lot of like number of interactions and and I also need to send you a lot of data because I need to send you one medical branch for its proof so instead with this construction you can aggregate all the proofs you can put them in one succeed like proof instead of having to

do the multiple steps or in multiple parts you do it all in once so all this essentially it doesn't allow you to do new things it allows you to do things that we know already didn't do much much more efficiently so is it okay what are the screams okay cool so turns out that the previous team that I described it's good we can can avoid the seneschal you have to perform the exponentiation but we still need to send over the x value to the verifier so what if we could do better so like why instead of like sending x we can the in the previous example we see

that the verifier computes they are so what we can do in the alternatives that we can calculate the are ourselves but this opens up to an attack which like essentially the approval can calculate some X they prove it can can pick a value X the biscuits log and if that X turns out to be co-prime with the challenge which in this case it's very easy to do because you pick the are you can fool any verifier arbitrarily so for any value can you can make them you can persuade them that you know that this could load without knowing it so what we need to is

that and this is an attack that works only for like when the attacker picks the base so what you can do is that you get you augment the protocol so instead of just like you also send our but instead of just the very first end of just checking there the first equation that we had the in the previous example and they also check one more equation so they check that you know the verifier pays the arbitrary base so you know that this could log with the arbitrary base but you also need to know you also need to prove that this is also in this could also need to you also know if this could log for the base G where the best seats and known base and but and so this is basically like how would that the whole

goal here is to make a small proof about the knowledge of n of a little bit log which is like the building blocks that we have and the the small problem with this is that now the proof it's two elements it's there it's this element and this element so alternatively and we can we can reduce the proof to just one group element by making it by adding one more step of interaction so I'm just like glossing over the mass like very quick so that I can just get to the actual like emulator so that all this starts to make some actual sense and so then the proof becomes like it's just one element it's just this one thing and

after we have this proof like we can be sure that we can prove we can be sure that like in two steps like we convince a verifier so firstly let me just like very quickly say why the challenge that the way that the very five signs to the prove it must be a prime number it is because in the attacker can basically do some sort of pre-computation attack so the attack would be like I have some huge number like this whatever X that I want to prove and okay I indeed know that this could log of the W base Y and but while knowing this discrete log I also say I also claimed but I know another discrete load like let's say G to the X the X

base the discrete log of Y base G and so when the verifier sends me the challenge if I am able to produce two values such that the challenge divides my original number and basically there is no residue if they are equal zero I can fool any verifier about them about me knowing some about me knowing that this good log and this happens and if this happens basically the protocol is broken so we do not work with it so basically the coracle or the corollary from all this is that the challenge needs to be a prime number and this sets

some limitation to basically their how to construct the protocol because then you're bound like by you need to pick a large prime numbers that the attacker cannot predict and this exactly is why it becomes harder when we want to convert the proof to non-interactive one because if they fetch from a heuristic basically says that whenever you have some interactive protocol you can replace the that has some sort of randomness that or some sort of value that gets sent from the verify to approval you use a hash function which Maps the current data of the of the protocol to the value that you need to find and this

is secured only if the hash function cannot be is exactly the proper term is is if it's secured the random Oracle model or if the value basically cannot be man related from the inside so basically in this example the protocol becomes non interactive but we need to have it in hash to prime function so that basically you give it some input and it gives you out like a prime number and this it turns out you can either like basically just keep crashing like do a catch a cache or something and you it will give you a prime number eventually and you always check that it's a prime number and this works but again if you want to do a unique sorry do the prime numbers

have to be really unique across the entire range at or no no so the prime number must not be an element of accumulated set so essentially what you would do is that you would put a barrier to the biggest number that is in the set and your prime number must be larger than that because because otherwise I will show you why because otherwise if you're trying to prove basically if you want to prove the discrete log of 7 and the challenge comes and it is 7 you can produce the attack that I wrote above where you just divide so here it doesn't matter like we just want it to be a prime now we just want it here even if

it wasn't basically here what happens is that that the challenge is a part of the of the X so if the accumulated elements are include the challenge inside it and you you can produce this attack potentially so it's better that we pick like a challenge that is not that is larger than that because otherwise and a packet can potentially fool you right so so let's say that this works and now what we have is that we have a protocol that in one step I can just send you one like succinct proof like one group element and this proof it can prove it can convince you that I know the

discrete log of some number based some other number ok fine why is always useful and let just say that these proofs can also be done in zero knowledge without like revealing information I say verifier about like what you were proving and I and this can be used for constructing blind accumulators which I'll also get into it so the rather say accumulator so firstly and I say to later we need to initialize it data set you later it it's basically defined by a function which has this property that quasi commutative property which all jargon

aside like you can just say that is like you exponentiate one number to another and that works because it holds this function and when you initialize the answer at you later if you need to pick a number that is labs but you do not know the factorization of so similarly to how you have like your public key your RSA public key but you cannot do you your P and Q the private values they are like your priority so what happens is that if somebody knows the factorization of the number of the mod of the of the modules and if somebody knows it then they can produce fake proofs so how can we battle that like

how can we generate essentially the question here is you have two to two small number do you have two prime numbers you multiply them you get the modules on and then you forget there is none two numbers how can you prove that you forgot these two original numbers and there is a couple of weapons to do this like firstly you can either take the RSA 2048 number which has two hundred thousand dollars bounty on it for its factorization or you can do some secure multi-party computation similar to what Rakesh does or say in that sense and there is another way to do it which is called a mathematical concept called class groups which is currently being

studied there's a competition made by Chia as far as I know which they're basically trying to benchmark and create and be able to generate this type of number in a very very fast way so okay we have our function we say that we will use this function we have our Alassane modules what is that you me later so that you later is basically something of this form like you have an original element and when you want to add an element that you may later you just erase the accumulator to the value so if I have let's say that we have some element so initially we said that you may later to be some generate or value let's say that is G whatever like it's some number we agree upon in the beginning which is put in the common

reference string when I want to add the element five to the accumulator I take the previous value and I raise it to the fifth when I want to add element three I think the previous value in that is to the three and so on and so forth this is why like we call them later because like you basically keep adding and adding and adding stuff on to it and then like now we will see why the proof of knowledge of exponent is is required like and then what you in order to prove that your element let's say that you want to prove membership of three in this accumulator here to do that you would need to show three and you will need to also show that you know there is a cofactor like that the verifier you can check that they add up to the total accumulated

because if you cannot show that so if I wanted to prove seven into this accumulator I wouldn't be able to because if I divide it 165 by seven it would give me some number which is not a product of the primes that where of the other primes in the set so does this make sense like how I'm describing their membership proof if I think just one thing is how far into the summary are you because oh in terms of time sixty percent sixty percent all right can you go faster through there yeah yeah yeah sorry and so yeah you prove membership this way and the thing is that when they this witness

right now it's fifty five and three it's easy to calculate but it turns out that if we have like millions of numbers and if you want to prove see if your V is like a huge like mm bit number and then nuclear factor will be an even bigger number you got no terms with neither the number nor the cofactor so what you do is that you utilize the proof of knowledge of exponent protocol so that you can just like send this accent proof that you know the cofactor that you know there and that is the proof of membership okay so in the same way you can calculate you can do a similar protocol and you can show like non-membership I will skip like this part and there's also there's also a few ways that you can hash like

to the prime number and the problem is that the elements in the RSA to me later they must be prime numbers because let's say that we have like a six inside of the accumulator so five six eleven like I can I can prove knowledge of three I can like convince you that I know that three is in the dataset without it being in the data set because it is three as part of six but yeah I hope this makes sense yeah so we can also aggregate this proofs so instead of like proving just three separately 577 separately I can just take 3 7 11 and multiply them and they get the cofactor like out of all of them together and this is like when vapor there with a

succinct proofs I described earlier start to make sense because you start batching you start aggregating all the elements together and also you can like do a few other tricks to verify basically batch the verification but there is no efficient way to do the aggregation of the non-membership proofs because you cannot do it because it can't leave if you want to take multiple non-membership proofs it keeps growing like some more elements your thank you group for removing that and set up there is this class groups construction which is in the tree a competition that you may check and yeah and in addition to they are a circulator there's also like

what is called the vector commitment that they describe which basically the vector commitment it allows you like to instead of committing to just like a metal tree basically commits to the data set if you if you are able and in the metal a metal is basically a vector commitment because you say that I know an element at the fifth index let's say of the melting tree and there's no way that there is another element in that fifth index and this is what they're using the interactive horrible books but if you want to open the word choose open when I open essentially a commitment like affair maple tree I'm opening at the specific slope and but if I want to do this for multiple indexes this is not possible I need to

send you one metal proof separately so this the vector commitment them scheme it allows you to take all these and do them in one step and yeah and I have some reference here like in case you guys are interesting work yeah nice a bit more the proof sets exceeds my discussion wooden sixteen no it's good I think yeah I mean in general we want like a summary of it because we assume that people have like also done some work on it but I think it's a dense

topic so I understand that you wanted to like actually cover a lot of it yeah great so then so then we'll open it up to those on the call to ask to ask questions and yeah I'll record them so I can kind of diss it can guide us through the discussion part so I'll start with a little naive question I'm trying to connect the notion of sort of you TXO data how does it get into this right so I'm sorry which sort of form or where does the you TXO data sort of come into this to make

sure that it's included or how is it transform in order to be included in one of these proofs you are truly purveyor you get ideal the using so the house oh there you T Excel so in the case of coda because that was my question was about like how coda is different because I sorry I just used it as an example of why a stateless blockchain or y avait 16 doctrine is useful oh it's okay it's not yeah I know that I do not think that they you know totally uses smoke I don't know okay I see it's okay but the end goal is the same that you want to be able to be able to verify the state of the blockchain like in a very small frame

now so in big and because this is based on hashes does not based on houses it's the innocent contractor it's also the input but the input can be a hash of the UK chose is correct if if you if you design it to be like this so here I'm not describing like the the actual like how you take that you take so set and put it in that unit later and you could put you you could I just thought you could take a hash to Prime so essentially you have some u T so you have sit to prime you produce an ID and this ID is the you th soul and your to make that ID in there in the data set so

let me just say this is okay this was the part of maybe I didn't make here this does not remove them the need for full nodes food somewhere yes yes yeah exactly exactly yeah this allows so stateless blocks I said they look it allows stateless light clients this is like a huge difference actually so it allows for stateless like clients in the sense that you do not need to get the whole blockchain but yes sure when our client then needs to be there full data somewhere yo or or clients that might just contain or store the transactions that they care about yeah also it exactly exactly medium clients call them yeah so this is

exactly why this is very useful in plasma because you basically you do not make any date in plasma you must not make any data availability assumptions because you can never know if the data will be available or not because you are shown that there is some evil database manager who will never of the data available so what you can do is that you can instead just keep you only keep the parts of the data that you care about so this is like where it matches with the plasma so Dakota they're because they're the same they also get all the data Bob will you pick so that you care about yeah exactly and the very useful thing here is that the non-membership proofs they can be used to essentially say that from block

1 block 100 widget EXO was not spent with just one with just like one proof well otherwise I would need to send you 100 make the proofs and I want to say it was not included the block 1 2 3 4 and so on but then the notion of inclusion is much easier to calculate based on the last thing you said yes exactly and then notion basically when you want to calculate to calculate and membership proof it's just you get the cofactor and you do and you need to prove knowledge of the cofactor which is very easy if you know if you know actually element because you just do a division and while

for the non membership proof you need to do like a couple more steps and this is the part that I kind of glossed over which is this thing they called their base root coefficients you just break down a number to two other numbers and the verifier tries to you send these two under added numbers to the verifier and these two numbers they're used by the verifier to check that your item was not included so one more question then I'll shut up because and I think of sort of utx shows is a very simple notion of state and because this is sort of this one of the applications this could be sort of hashing auth0 and then hashing to prime using this is there anything that stops

you from hashing a more complex state and then sort of marking or and using the more complex state sort of as proof that it's there so I'm not sure if this makes sense for the RSA accumulator because what you're essentially saying is that you're just attesting to some state okay you said that this state was in this state was part of the accumulator why is this useful though what you can alternatively do is that this is where the vector commitment comes in and you can basically just say that this account

with this address has this balance this other account with this address as this balance and so on and this becomes and then you make a commitment out of this like I think this is what you had in mind like to basically make a numerator so like and basically you want to make an accumulator for an account based model perhaps instead of you TXO based yeah and then that's further work where my mind is wandering in terms of yeah so imagine that you have a vector like let's say M slots and like it's one of the items in the vector like the 0th index is like the 0th address let's say like its address if you like its let's

say that it's one three five seven nine eleven eight one three five seven eleven and like the one it's a hash to prime of some of some address so that is the index index of the element and they value inside it is your accounts balance so you can essentially make an accumulator out of a key value store and you can use that also for life clients but this is not like this in the paper and this is like very rarely briefly described but it's definitely possible I was thinking actually even more complex in terms of you know if there's a more complex state beyond just a balance of multiple key value pairs but it sounds

like this can be supported okay I think I broke up now we can hear you I think George's and I like you George is lagging yeah okay yeah and I'll just say that bill schemes are not also because they're based on the a let's say like factorization that they're not quantum secure if anybody cares about this at this year basically yeah if there is a quantum computer like

this scheme breaks because they can factorize their modules and they can create fake proofs so it's a very neat skin-like but if you're looking to be like quantum systems like stacks and there's also hash based accumulators which I believe that's driger like the author of the lightning Network paper has written about in the in a technique called the you 3xo like you TXO tree and yeah you can look into that if you want to check on maybe an accumulator that's a pointer middle ism so one question I'd like to ask about RSA accumulated say what's the complexity like to the preview for the approver like what it's just calculating the cofactor so

it's it's all fun everything is all fun there's no one important it's okay bacteria it doesn't sound like I want to me yeah okay so you okay I'll give that so so yeah I had something else in mind yeah okay so this protocol is all only useful if you can produce the residue if you can perform the division when you're producing the the queue of the queue and there's values when you need to produce the proof it's only useful it's as slow as the division is basically so you know the exponent is the true thing yes mr.

binder okay yeah which be log but then you still need to compute these exponents right can you like to describe it step by step so that because I don't get your question the exponentiation no you know it already oh okay that's what you're saying that's all effective yeah yeah yeah so yes you need to do the experimentation but this is you can you can analyze it so it can be log time or something yes you can because you're there the proof of exponentiation scheme the generation of the proof it can be parallelized yes and you can do it like in a similar way like me divide and

conquer similar to how the fast Fourier transform works and yeah you can do it in long time is that answer your question yes it does I mean it still should have won that whether you can apply this to stops which most of the the stark proof is the Merkel route is the Merkel proof but also you men like today so you mean replacing the miracle tree in the start with another accumulator I say as you good question yeah yeah something something I wasn't sure about

maybe you have an ID on this when we're saying that the L you know that L must be prime or at least factored to large primes but then we don't want it too small because it shouldn't be inside of the set of elements that could be in the accumulator um is there a minimum or like is there some kind of you know you need to define what is the biggest it's a security parameter basically you define a security parameter that shows how many Prime's that you will some do from essentially that's it but also you need to like bound it from the start so that they lower bound is bigger than all the accumulated elements so for example for example if

dataset would be numbers 3 5 7 11 yeah it would it would need to be bigger than 11 okay so yeah so this was it like having having 2 plus 1 like the plus 1 prime number which would be okay in this protocol yeah yeah yeah there's me and yeah so and I don't think there's an easier way like currently run just like iterating basically you just keep cutting and cutting in fashion and you always do the Miller adapt in time I'll be pissed until you find that until you find the prime that's that suits your needs so this is this I'm sure is gonna

go with it that sounds I know that doesn't sound very good that you're just gonna yeah somewhat rounds of hashing and additionally you need to do a prime check this way to speed that up so what you could do is that you could so normally if you run this in the theorem virtual machine for example they verifier because you if you're doing this like on a computer will you just don't have like that much constraint that many constraints on your computational power it's not that expensive I think I mean oh well maybe they may be the primary test actually becomes that expensive but basically the moment that you need to do this on the

VM or something similar it becomes very very expensive so what you could leverage is that you have somebody commit their like to the prime and if somebody finds a factorization of the prime they submit the challenge and they slash you or something hey like you would do this in the very like like sloppy waiting like that that instead of like doing it straight forward like it is a prime you will say it is a prime until proven otherwise maybe I don't know if the RSA challenge is still on cuz maybe that's the next version of this right is to put some bounties on chain and say hey if you can if you can crack this and you know your

reward is submit the transaction yeah exactly okay essentially like if you don't do the prime verification long chain you essentially you would say that this guy gets to make this withdrawal if they factorize this number okay I know that because they're able to fake an RSA proof right one one other another question that I had when you were saying we have a hashing function that's growing into you know like a like a prime set that that is that is only doing this hashing until you you detect

that you have a prime rate there's no there's no Kanto like magical construct that I'm missing or you would just maybe build a lookup table ahead of time so you were mapping yeah vector indexes onto this lookup table of primes yeah you can deliver as like memory computation you can do pre-computation to maybe reduce the computational time but then you do the story you have a storage right yeah okay yeah if you're doing it as a smart contract yeah yeah sorry I'm always thinking of it in there like when if if it would be implemented in something like now and just you need to store the number somewhere right yeah

yeah okay anybody else have questions or any other I guess any of those thoughts that came up either could also be from from Joe Joe so I was a little bit wondering like so the history you mentioned you sort of said like Oh something in 1994 and then we don't know and then Benedict so I'm just curious what happened in that middle like I work I'm curious has this has been used further on it I don't think that I

haven't so the thing is that previously like these accumulator schemes they work with a tastic database my mother so usually you'd have like somebody who maintains that emulator and they give you the proofs and everything so this is like there has been work that work has been done like towards like making this work without the task identity so that you're able to verify that the accumulator state is valid also like previous constructions so basically what did these guys add the previous contractions they did not have like this aggregation of the proofs you weren't able to aggregate or batch as efficiently and also the vector commitment skin like usually like you need to initialize it somehow so when

you initialize it previous schemes they had like complexity of orphan or more while they state it has like constant complexity and also it also has like proofs of a constant size so there is like various improvements it's literally it's not a new technique it's basically just improvements on previous techniques but the improvements are big and there have been multiple papers and there is also another type of fact emulator called the painting base that you mutilators where they utilize like they have to care present they use that to perform like more efficient operations and I imagine but it maybe just confirm this it doesn't have anything to do with

Benedict blintzes work on bulletproof does it I didn't think oh okay I didn't think so either but I just wondered if there was any connection there should probably ask him okay if there's no if there's no other questions then I guess we could wrap up for today you have any any closing any closing remarks from your side Giorgio maybe I mean maybe if people are interested in this RSA accumulator in practice you mentioned something about translating this plantation so there are a few like

people who are working on implementations but they all require that you do arithmetic on 2,000 bit numbers which are like very costly to do so and we interested in that for plasma I'm not sure if this will have like practical applications because it's very very expensive like two because normally we say that in plasma you need to commit every block that happens on the side chain on the maintenance and this costs like forty thousand gasps this forty thousand gasps over a year it is some large number in dollars yeah and this is just for storing one word and if you want to do the verification with the accumulator for each state transition because you

need to do it on chain there are the costs to maintain the chain they go up like tenfold or twenty fold so it's it's interesting like to design I think it's interesting to design a chain that support these supports this natively but I'm not sure like about the I'm not like getting very optimistic about the actual protocol okay I can I ask you one other question it's like what got you excited about this specifically what was it I was excited for plasma but it there no yeah but it's very interesting like scheme nonetheless yeah well I'll give you some quality data advice when one

door closes hopefully another one opens yeah and basically now I'm just preparing a post well I'm just like going to describe like each technique that has been proposed to use this in plasma and what I it's not like very optimal basically what we need currently it's just a way to make the UT Exocet more compact evenly and that's all that's needed and it's basically this technique was a way to do you txoko commitments like much more efficiently but it turns out that it's still too expensive okay and it's good also that there wasn't or it didn't need to have a

trusted setup that there is a way a way to do a naked trustless set up the multi part of the computation is fine like I I don't know I find it fine I think I think it's not it's definitely not bad it's just annoying when you're gonna need to do a ceremony each time you change this setup I agree on that but the ceremony basically the present setup the problem is the effort needed to make that the setup trustless yeah yeah yeah everything looks good on paper and then and then these humans get involved man yeah all right well that's a strange note to end on there today so

thank you everybody for for joining the study session thank you to to Jo Jo's for leading the session that was great totally alright so yeah thanks for everybody who's watching later you can find us in telegram and we'll be we'll be sending out the schedule for for the next weeks we have to I think so right there is right yeah we're just confirming everything I think in the next two weeks we will have one talk on Sigma protocols and we will have another talk looking into Fiat Shamir heuristic instead so what what is this how it's working I mean we kind of

lean on this a lot as we're exploring these different as your knowledge set up so yeah looking forward to both of those sessions and day wise I think we're still finding our exact groove and like timing so it might move around a little bit but we are gonna try to cater as much as we can to the west coast so doing these later evening European time things that's like your morning in the west coast thank you I think that I am appreciated greatly yeah we're gonna we're gonna keep doing that if it's just day wise I know that like over the next two weeks I think it might flip around a little bit maybe eventually we actually get a fixed point but I think we're gonna probably

do this until until that happens so she's here with us a bit nice cool so I'm gonna I'm gonna stop it now thanks everybody for joining yeah thank you can continue were there any open questions actually I think the the one open question was if we can swap and Starks you know instead of having a commuter former coach if we could use a vector so that might be something worth dropping and maybe worth dropping in the chat anytime there's anyone who's right now so that the reason so that the stocks guys love that transparency trusted set up and other nice properties they don't want to use all this cryptic we know the answer but just just in

general if we do like for future sessions if we do end up with like these open questions that's what we end up doing with them as we just drop them in the group and we see if there's like something there seems to be a conversation almost every time we do that at least a little bit so that's that's our plan cool oh yeah and if anyone wants to lead one of these that is also something that we are encouraging people to do so get in touch with us if that's interesting just leave it out there coach reach out to NRI on telegram or any other this fine online websites but probably telegram is your best bet yeah cool thanks guys see you later thank you very much