ZKpodcast: Dive into Plonk

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik this week we talk with Zach Williamson and Arielle Gabi's on about the protocol plunk but before we start we want to share a message from this week's sponsor new cipher here it goes in 1778 during the American

Revolutionary War Colonel John Macintosh and the 127 continental soldiers repudiated the British system and of surrender with as to surrendering the fort receive this laconic reply come and take it now fast forward to 2020 stagers developers and node operators the world over cast off the shackles of Silicon Valley's great merchants of infrastructure with the cry come and stay kit in case you missed it this is the announcement for new ciphers incentivize test net coming to coin list which has the motto come and stake it if

you are interested be sure to pre-register now launch date structure and price details will be shared shortly all winners will need to complete kyc AML please go to new Cybercom to sign up so thank you again new cipher for sponsoring our show and for letting me try out my hardcore history impression for this ad spot so now here's our episode on plunk alright so today we're sitting with Arielle Gabi's on previously from Z cash and protocol labs and now at Aztec and Zach Williamston who is also at Aztec we've had you both on the show before

and we've done actually full episodes where we did get a chance to dig into your backgrounds we talked about all the work that our ELLs been doing and we talked about Aztec so yeah welcome to the show Thanks yeah thank you this episode we will be covering a lot of ground and there's a there's a number of podcasts that you might want to listen to for listening to this one for example should probably listen to the episode on Sonic's with shaunb oh definitely the episode with Arielle the episode with Zach and also one of the z case like in the Z case study club we actually have videos Justin Drake does a video series on polynomial commitments and that might be

also worth checking out because we talked about a lot of those concepts in this episode cool so let's get started so last time we talked to URL you worked at protocol labs and now you're working with Aztec I believe how did that move happen and then how what's been going on in your guys's lives the past a couple months yeah so I'm still gonna advise a file coin till launch I think it's a great project and I want to see it succeed I guess I was just thinking of death and you know life being short and I felt that plunk was sort of where my my natural focus

was so I wanted to use the the few years I have with you knows still having a clear mind to to get it like really get it off the ground I think it has it has really good potential like I know I don't want to say it's like sort of the final thing but there's a lot of simplification there and and I think it has potential to really take off it also it also has this slightly abrasive one syllable name like a lot of good Linux programs like git and rep so I'm hoping plunk will be like a similar Linux command line thing

people use with an abrasive one syllable name okay so first of all that's extremely I don't even know where to go with that it's like it's very it's very life stuff RL this is like like - I wanna I actually want to ask Zach so last time Zach we had you we talked about Aztec sort of the core Aztec business how does plunk fit into this like was plunk is so in this actually I'm not clear on this was plunk an Aztec initiative or was this like a separate research project that the two of you did how did plunk happen well focus from my perspective Locke was always kind of a

reaction to some of the limitations and shortfalls of our original Astra critical we tailored that protocol to be to be suited to some of the weaknesses of etherium so that it was for example extremely efficient severe effect proofs but it meant that it was not as general-purpose as we would have liked and so I started kind of trying to research how or to use existing techniques out there to create like a slim Orion of a universal way of doing things that kind of segwayed into a meeting area at the conference and kind of we started talking together about about some common ideas and eventually wound up on what was what then turned into clunk I think it's not it's not

fair to say that I kind of I had Punk in mind when we started developing it I had a kind of an outcome in mind that I really wanted like a an efficient universal type of pretty system which conference was it do you remember who it was a binary district zero knowledge workshop in London we knew each other beforehand but kind of we don't we don't need kind of talked a couple of times I think more specifically as Zack asked me a bunch of questions when we met at this event some of which I didn't know the answer to but he asked me one easy question one reason I knew the answer was because I worked with Ellie on on

Starks before they were called starts and there was this very common technique there of I'll get a bit technical of of using a generator of a multiplicative subgroup to sort of move between neighboring values so this this is a very common technique in in a lot of the arc slash PCP literature and it was sort of just this small missing piece in an idea of Zack and also in getting the permutation you know speaking a bit and precisely in getting the permutation

argument and in Sonic to be simpler and more more efficient but what is plonk like what is it exactly like maybe I don't know if you can summarize it in like a sentence or two for our listeners but do you want to try that well I have I have this non-technical analogy that puts plunk and some recent work sonic Marlon relative in a certain place relative to the previous Murchison starts so suppose that there's been a murder and you're you're a suspect and you're taking into interrogation and if it's too grim you can think of the

suspect as approver in the interrogator as the verifier and and forget the murder part but if you like it you can think about it so suppose you're taking into interrogation the stark version of the interrogation is the investigator just gives you a blank piece of paper and says you know write what you did last night in total free form and then after you finish the investigator can can ask you anything they want like the thing you wrote in the third line contradicts the thing you can ask you anything so that sort of starts in a sense and then these sort of classic pairing based snart's

that that z cache uses is instead of a blank piece of paper the investigator gives you sort of a survey form where you can't just write whatever you want you can't write well I was actually abducted by aliens yesterday so it couldn't have been me he just gives you sort of a like yesterday night I was either at the suspects house or at my house or at this bar like a drizzle choice question a multiple choice thing yeah but then also the investigator after you fill this form cannot ask you whatever he wants he's also limited to to certain like questions like Oh what you filled in

question to you know I think it contradicts what you filled in question five he can't ask you freeform questions and in a way this new wave of what we can call polynomial commitment scheme based schemes it's in in a way the best of both worlds in terms from the verifier or investigators point of view that the suspect needs to and fill the form and can't write what he what he wants but the investigator can then ask any question interesting oh cool this is a great sort of mapping Ariel thanks for doing that the only thing it's missing is the zero knowledge part right missing

that yeah I I guess what happens how does your knowledge maps is usually these systems you adding this your knowledge part is sort of easy by somehow randomizing the the answers but just to explain how it maps technically so so right in all these systems it always starts with you have some statement you want to prove and you do what's called arithmetic so we move from a statements of the forum this Z cash transaction is valid and I know the private keys of the input notes to a statement of the form I know some polynomials that satisfy some identity okay now the question is what you do

from here and sort of the stark approach was let the prover write whatever they want and then we will check that what he wrote is really a low degree polynomial in check at some random point that this polynomial or polynomials satisfy the the required equation sort of what happened in these pairing based snarks like Pinocchio and Grodd sixteen is we sort of used homomorphic and encryption or it's not exactly a morphic encryption but let's call it that to force the the prover to like or the suspect to write certain things in a

certain format but then what sort of we lost from this is that the only sort of practical homomorphic encryption like thing we know is these elliptic curve pairings and what that translates to is that then the verifier can only ask questions that corresponds to to what people call our one CS ah so our one CS is this form that you describe in a way it's these like this predefined clear like answers that have to fall into a certain format so after the prover writes the answers sort of the verifier

can ask consistency questions about the answers and our one CS is a type of verifier question now the sort of the general verifier question is a general like polynomial like is this polynomial zero on your points and in our one CS question is the polynomial has to be of the form this sum times this sum equals this third sum so for starters its degree two because it's a sometimes the sum beyond that but also it's a special form of a degree two thing and the

reason the verifier was limited to this form of question was because pairings are sort of a very limited form of homomorphic encryption and then now this third approach that started with Sonic is sort of saying we'll use the sort of pairing limited homomorphic encryption not for the whole thing well we'll just you for committing to a polynomial and then opening it okay I realized I forgot to say something so part of the thing that's going on in the snarks not the Starks is that the verifier is checking

the equation not an on a random point of his choosing but on a secret point that's encoded in the parameters in the common reference drink what what started from Sonic is we only use the pairing to commit to a polynomial and open it but then we can open it out of after we've opened it we can check not only these are 1cs constraints but a general verifier equation so that's that third that third example where the prover has to prove within a format yeah still within this sort of snarks pairing based paradigm but then the verifier can use is the verifier

actually using like a stark like technique to check that is more freeform or is it a different thing the verifiers is now checking some arbitrary polynomial equation yeah which is what the stark verifiers would do because yeah they were not limited to this R 1 CS format if if there also a connection to bullet proofs though and bullet proof techniques in some of these new polynomial commitment schemes or is that something else so the way that bullet proof kinds of you can be used to include a thematic setting this is quite different to what we're doing

so I don't think there are any direct parallels between bullet proof and plunk other than kind of like what people iterated on with like bullet Chris King Cameron silver years ago people iterated on it and produce different kinds of circuit structures McCrimmon schemes and eventually that iteration let's - among other things clunk so well so it's not a direct there's nothing there's nothing went to wreck that direct directly copied across and bulletproof I guess I guess kind of spiritually it sort of is raishin on some some concepts it's a great great second cousin yeah what what one thing I I should say so I think what

happened a little in these last two years which relates to bullet proofs so this work on polynomial commitment schemes came out this work of kitaev Arusha goldberg and that's been extremely influential so all these recent works sonic Marlon plonk are heavily based on that but a byproduct of that is that it made people realize what was not sort of explicitly maybe in people's heads that what's going on in the Starks you can think of it also as that one ingredient in the proving system is a polynomial commitment scheme and then sort of when people looked at this as a separate component they

thought okay so what else can i plug in is this component so in the context of bullet proof sort of a Zack maybe can correct me but a core they're there you're a part of that work is a polynomial commitment scheme whose efficiency is sort of in the middle between start the start based one and the one used in in plunk that doesn't require a trusted set up but it's not going to resistant and then also this this recent work this supersonic work asked what other sort of polynomial commitment schemes can we get without a trusted set up in in that that's sort of

that asking that question in looking at groups of unknown order was the basis for this supersonic work maybe it was a tangent from the original question but we should mention that the the work of mater Labs was maybe the first to sort of explicitly look at Starks as or the sort of low degree testing components of Starks as a polynomial commitments for the scheme without trusted setup I wanted to ask actually as you talk through all these different things being developed in the history where does plonk fit into that story like was it is

it something that's been worked on for a really long time or like an idea floating around is it an iteration on something as you mentioned there were Sonics and then SuperSonics and then there's you know clunks and now immediately something else building on clunks it the whole like past six months and the zero knowledge base has been very confusing for me because there's so many protocols in so many protocols building on other protocols are sometimes SuperSonics is an interesting one because I in in conversation with Ben and actually the presentation you did at the summit he made it very clear that like SuperSonics could also be super plonk or super Marlon it's like it's the other side of the of the equation so even though it sounds like

Sonic's plus it's actually not dealing with the same part of the problem that's what he explained oh how does this Punk fit into this world is it an iteration on something or is it a new innovation I guess that nothing is ever new but you know what I mean we started working on plunk about May in last year so and we've basically published the paper in three months so kind of the time between like fermenting the idea and publishing it was it was rather short was a rather fast turnaround obviously nothing this exists in a vacuum and plunk builds on a lot of techniques that were already in use and kind of assembles all of them in a

different way and provide something a little bit new to the mix so I think the idea of creating a permutation argument using multiplicative subgroups wasn't something that had been done before but the reason why that's useful is because of techniques developed for sonic developed by a Ian's growth and I believe a few others and internally the idea of using a simple and committed scheme to kind of evaluate an arithmetic circuit that had also been around for for a while and have been developed out of the commitment schemes by by Kathy and his colleagues so it was a melting plus of a lot of different ideas yeah may be applied in a slightly different way to create something something unique and that that sounds like how most you know new papers get written it's not

like some of these other things that are literally just like oh this paper was published and we saw how we could use this other polynomial with the same construction and now we have a third thing so so I'd like to maybe cast this a little in in terminology that people have been using so sort of what's been formalized both in the marlin paper and in the supersonic paper is that these recent proofing systems I guess that started with sonic but really you can look at all the proof systems from the early PCPs and starts like this they can be thought of as having two ingredients one is what's

called the polynomial IOP as it's called it's supersonic or the algebraic holographic proof as it's called in the marlin paper we define something similar in plunk just called a polynomial protocol so that's one ingredient and the other ingredient this is sort of that sort of the high-level protocol ingredient and the other more low-level ingredient is the polynomial commitment scheme so where I would fit it in is basically what sonic did is let's take the most efficient polynomial commitment scheme the the katay it's all one and plug it into the IOP in IOP that is a

polynomial IOP that is similar to the bullet proofs work and in the paper prior to bullet proofs whose name I forgot was it bottle I think that's the yeah it was food oh yeah food oil and a bunch of people people boodle truly a bunch of people and and and then bullet proofs was an optimization of that so sonic so again this works the works of bullet proof sin the prior work of boodle you can think of that is it's a certain polynomial IOP with polynomial commitments key that has no trusted setup based on discrete log and in a sense what sonic

did is let's take a similar a polynomial IOP but use this more efficient kzg polynomial commitment scheme to get sort of constant size proof that they had to do a lot of tricks to make it work so plunk is using the same polynomial commitment scheme as Sonic but heavily optimizing the polynomial ILP part is this where like the supersonic would actually be doing working more on the polynomial commitment side exactly so so supersonic is taking the plunk polynomial IOP and replacing the kzg polynomial commitment scheme by the one

they invented and the reason it's called supersonic and not super plunk is because supersonic sounds much better and I think at the time they they wrote the paper plot was not out yet so they were using the sonic IOP and then towards the their publication they saw that they could shave off some some kilobytes if they move to the plunk IOP how that's so illuminating I have to say and I think it's I this is very for our listeners I mean this is there is a lot of background I think that would be very

helpful there's the video series that like Justin's doing on polynomial commitments which I think would be a really helpful thing to check out is if this is interesting because it goes into some of the things you're just describing but with slides a lot of the talks from the summit and actually after this if we can maybe have a chat about some other links that we can share with people to help them get inside this should we get into talking about the properties of plunk maybe I feel like we're at a time where we kind of know a little bit what it is but putting in a high-level view of like what are the proving times the proof sizes what are the performance

properties we've already touched a little bit on like does that how much trust it set up or not how does that work but maybe we can run through these normal you know criteria that people look at when they look at zero knowledge groups yeah so it's always very difficult to do a direct apples to apples comparison but we do have some numbers for these for that for their basics for example for plunk the proof sizes are roughly 512 bytes if you can kind of compressor it up to care points which is kind of what other previous systems do when they represent exercises are they constant size or or what what's the complexity so to be a massive

pendant I guess it's probably over ethnic size basically the the security of your parameters of the elliptic curve changes affects the proof size but other than that it's constant so that 512 byte number was for the kind of the burette and Erik pairing friendly curves that aetherium natively supports gets a bit bigger like 768 by its overly adverse if you use the pls 12 381 okay but that size does not really increase with the complexity of your circuit yeah the verifier times well I guess it really depends on the verification algorithm how quickly is implemented our implementation does about 0.3 milliseconds to verify please what's the comparison there like what what was the

previous benchmark very good question so it's a little harder to come back because these are all done with different software implementations and something of a different hardware I believe like the kind of the growth 16 and similar previous systems like GM 17 or wouldn't the state of the same the same range like between like 2 to 10 milliseconds clock is generally slightly faster because it for two reasons one it requests your pairings to get one in the appendix and yet for the fourth pairings that we require are more primitive because a lot of the kind of a the the inputs pairings are effectively constant they don't change almost depending on your

circuit so you can do a lot of pre computations to speak for example mm-hmm and what's the complexity of the prover very good question I guess that's kind of in my opinion that's kind of the that's where the bottleneck is for these grading systems once you have a like a somewhat constant verifier on time and proof size you know once you get below like a precise ability kilobytes is kind of its small to small enough to small enough and in making a smaller is nice but not really critical and the verify runtime is also for these for these kind of point logarithmic systems they're all pretty they're all pretty efficient for pruvit time so that's the bottleneck and so we really some benchmarks recently that that kind of did as much of a head-to-head combat comparison as we

could where we where we kind of leave benchmarks plunk prove asanas versus got 16 preview times it's highly dependent on the second structure so again it's difficult to do an apples-to-apples comparison but uh when it comes to say mincing ashes out pretty system is roughly two and a half times faster than grodd sixteen which we were quite we were gonna happy with because we had very good reasons to think that we can replicate that performance advantage do it more generally for a much wider range of circuit types as the year progresses cool so if somebody wants to find out a little bit more about these metrics where do they actually look at it so we are privileged verify libraries all open source under our aesthetic organization

github profile the repository is called okay working title bur esenberg but i think we need to change it cuz the name is a bit what's the reference I get it what's what's the reservation the reference is a few months ago I maybe maybe in a fit of foolishness I decided to start naming some of our software libraries after Berry's confectionaries and so brettelmer originally was only looked at curved library for the breton eric curve theorem supports and so i think it it was a cross between a generic and Battenberg it's exactly check isn't it not even worth them not even worth the

love track from your Sunday alright okay where do we go from here ah so um there were a few kind of in

looking back at some of the videos and papers and and things that I could find on Sun plunk there were a few concepts that seemed to be introduced I mean I don't think they're introduced for the first time ever but may be introduced for the first time in this context there's some ideas like the Lagrange's --is you mentioned already the cat take commitment scheme and I realized that that's used in a lot of different constructions but maybe it would be a little bit helpful to first talk a little bit about that and maybe redefine these things for our listeners because yeah we we mentioned them but it's not always clear like why they're special so my kind of I came to this from the

perspective of a software engineer so I might mangle a few times at conventions please interject if I'm if I'm butchering things but so in the graph base is effectively it's a different way in code we uses it more even coding a polynomial so when when it comes to just save something like sonic the way that they included information within the polynomials was that's witness values so if you have a vector of values then they would create polynomial where each vector element was a coefficient in a city you wanted a vector that stored 1 5 and 10 you would do 1 + 5 X + 10 x squared and what we do instead is we take we use the VAR faces to a

conductors as polynomials effectively we find a multiplicative subject and so for example in these giant prime fields were working with we can use roots of unity so if we want to encode a backdoor for that is we would find for its immunity and I built this because we're working with prime fields of big integers that are modulus and Prime unlike integers what would normally be a complex number it's just an ax has an actual vanity you can find four numbers in this inner frame filled in this front fields where he'd be exponentially more to the power of four you'll get one and therefore they're all four it's of unity and so what we do is we create we create a polynomial where if you evaluate this polynomial at each

of the four it's of unity the result of the polynomial will be equal to each one of your vector elements effectively your polynomial is an interpolation polynomial where you're where kind of when you're when your x-coordinate is one of these elements of a multiplicative subgroup you'll work or whether it's going to be one of your vector elements and then you find interpolating polynomial that connects all the dots yeah maybe I can I can try to fit paraphrase so the standard way to represent a polynomial is by what we call the coefficients like you're right the polynomial is five times X plus 3 times x squared plus two times X cubed and sometimes so you can think of these

monomials these powers One X x squared X cubed they're the basis with which you're representing the the polynomial and sometimes it's convenient like for example in plug to represent your polynomial in terms of its values not its coefficients and that's what Lagrange's allows you to do so what exactly a Lagrange's is is its suppose you have some set of endpoints in your field so the lagrange basis for this set of points is like a set of n polynomials that the if-- one

is one on the I've point out of these n and 0 on all the rest the point is now if you write your polynomial is instead of a sum of these powers xx squared X cubed you write it as the sum of the lagrange basis polynomials you're in a sense representing the polynomial by its values because the sort of the coefficient of the I flag rajala Gnomeo will just be the value of the polynomial on the on the I've point right because if you'll try to evaluate it on the I've point and you have this sum then

everything will will become zero except this I flag run because the others are 0 on the I point so what the value you will get is just the coefficient of this that you put on this I flagrante Gnomeo cool so this is a this is like a technique where does it come from it's very heavily used when designing programs for Starks and so one reason it's it's very useful is so I was talking about just a general set of points and then doing a Lagrange's for them but usually what

people do they don't look at a general set of points they look at what's called a multiplicative subgroup and what that means it's just a set of points that are powers of the first point so the set of points will be G G squared G Q and G to the fourth up to G to the N which will be so you'll pick a G such that it's sort of what's called an end fruit of of unity so G to the N will just be one Wow so one thing that's very convenient in these sets of points is it allows you to sort of access a neighbor of a point very easily

because we can think of like for example G cubed as the the next point after G squared so suppose you're you want your a G cute the G squared you want to get to G cute you just multiply by G and generally wherever you are you you can get to the next point by just multiplying by G hmm so this seems maybe a little trivial so one reason is it's good is sort of in the context of these proving systems it's good to have things that fulfill the functions you need in our extremely low degree and what's good

about this neighbor function is that it's just degree one right it's the function that goes from X and maps it to x times G where G is just a fixed thing and and you could say why do we care about a neighbor of a point well one just I'll give the example of the rate the Fibonacci sequence I think that starker uses a lot right there it's like this you you want to check you have a bunch of values and you want to check that always the third any value is the sum of the preceding two so that's an example of where these sort of neighbor

functions are because I sort of need a way a way to say in math in low degree polynomials look at my value compared to like the next one or the preceding one and then these multiplicative subgroups this this notion of the next point it just corresponds to just multiplying by G or preceding point will just correspond to divide by G so yeah so this sort of thing has been it been been used a lot another small technical thing that is used useful in multiplicative subgroups is a lot of times you end up needing

even the verifier needs to compute this polynomial that is zero on all the points of the multiplicative subgroup is zero on geg squared up to cheat at the end so in general this is going to be some degree and polynomial which will take like n operations to compute but you have also this very convenient property that we use in plunk and many proving systems PCP is used it that this polynomial will just that vanishes on the subgroup will just have this very sparse form X to the n minus 1 so that's something that is very important and PCP

literature in in Starks that you're looking for things that although they have high degree they have a very sparse representation like here it's just two-month manimals X to the N minus 1 so of a verifier can really quickly compute them even though that their degree is much higher than what the verifier runtime should be so now this is cool cuz we now understand one of the main and as far as I understand L'Orange bases using that technique is one of the big differentiators in plunk right this is the thing I mean you just sort of mentioned this is a thing that changes plunk from the sonics construction what else changes what else has changed in

plunk it's mostly to do with how you structure your circuits like what the answer is it as metallization of the second is one of the things that's been quite consistent with in with the universal Snacks has been a desire to kind of replicate rank 1 constraint systems because the current like the non universal stage without user a Qantas Freight systems for the reason sorry I'll mentioned and there's a lot of corpus of work that constructs circuits are mostly s form and so there's been this desire to kind of replicate that in you know in the universal setting the second it was quite apparent to us early on was basically staring at this plot paper in try figure out how - make it fast efficient was that actually rent one castrate systems a

absolutely terrible way of representing a long circuit it's extremely inefficient and there was and there are much more efficient ways of representing your circuit structure that kind of take advantage of some of the unique properties of clunkers specifically one of them is that you can evaluate like a large number of different arithmetic expressions that are operating over the same state which is a sign of an abstract but maybe one way to kind of give an example of that is in stock circuits so imagine you have your your your circuits constructed with addition and multiplication gates so you have kind of two y's being into each gate in one wire feeding house and the Apple wire can then be fed it's like multiple

input wires there's a very common requirement that some of the a subset of all of these wires in a second need to be either 1 or 0 that boolean wires and typically this would requires basically one extra constraint from your circuit one extra case for every one that you want to constrain to be a pool however in plunk you can add another arithmetic expression into the into your into the plunk second structure so that effectively every gate can be either an addition gate or multiplication Kate and optionally also a boolean constraint it so you can just decide which like what subset of your wires are going to be one rules and currently get that property for free without adding any extra put riverbeds and you can then you can also

you can take this to quite an extreme degree which is why we managed to at the end of last year get benchmarks which evaluative MEMC hashes look at twice as fast as call 16 and this is because you can you can add this hep like a lot of custom stretching to gates so instead of a gate being an addition gauge and multiplication it can behave well it can be a minty hat around gate or gonna be a pedestal pass around gate or you can kind of um something that we realized realms very early on is that this discussed this kind of custom gate structure allows you to make hyper efficient proofs for very common secretary and it does

require completely abandoning our 1cs as a way of representing a circuit but so that's so this is one one I guess one area where plunk is devoting from from other priming systems does this is this any way related to turbo plunk which I've heard about through the grapevine I believe I gave it that your companies to California and for what are the best name is still what we're calling it but it's yeah turbo funk yes it's basically the form of formalizing this custom gate structure I'm defined basically creating a few a set of custom of these custom gauges that are highly desirable for common stereotypes and

kind of packing it up into a single pudding system mm-hmm is this what is it what state is turbo plunk at though it sounds like this is like you're working on it you're it's mid or does it have documentation does it exist somewhere so we're writing a book about it that we hope at least some sections to make public soon an interesting thing we've noticed very recently is that it's actually even you don't need to think of it as a circuit anymore like the way right now I'm thinking about these turbo

clunk programs and this is maybe also somewhat inspired by my sort of stark work with element many years ago that you have like a program with some state so the state has some width so say if the width is 3 then the state is like 3 field elements and then your program the program is defined by some polynomials and the polynomials are checking that some relation holds that the state transition is correct that the certain relation holds between the values in the i fro and the values in the I plus 1 through so you can think of program like this as

being sort of a program without memory that they're just like three registers and the the state is is needs to proceed according to certain rules but where the power of plong comes in is an ended sense gives you memory so now you have the provable show hey I know like a valid sequence of states for this program but now what what the the plunk permutation argument gives you is that you K you can also in a sense have memory in the program you can say for it for instance the second cell in the fourth row should be the same as the

fifteenth cell in the ninth row so you can make arbitrary demands like that and that you can think of it as it gives the program sort of a memory axis I do want to sidetrack a bit and and give credit so plunk is really heavily based on something called the Bayer Graz permutation argument I I would say plunk works well because we found a very concise version of that permutation argument using multiplicative subgroups and we sort of stripped out everything else we we didn't really really need so I think yeah I think these these

programs could with sort of this memory could could be a good way to design snarks hmm this is a circuit free model that you just start so yes circuits are a special case of this program of these programs where even you could say it even almost degenerate case of these programs where you're only checking the program typically checks things between this row in the next and in sort of the circuit case you're only checking things inside a row like the RO values will be the input out

left input right input and output of the gate and you'll have the sort of degenerate transition that only checks consistency inside a row but of course you will heavily use this sort of memory thing for the wiring constraints of the circuit so if for example that the second gates the output of that goes into the seventh gate then this will translate the sort of using the the memory constraints to to check that something on that the second row is equal to the the seventh row mm-hmm so these transition constraints that the RL

was describing they that are currently powerful and they allow you to represent circuits with far fewer constraints than say something librarian one constraint all the basic Plunkett's that we have in the paper last year and so that massively opens up what's practical to build with these structures which is then allowed us to massively expand the horizons of what we want to accomplish with this elastic and what we planning on building and this is all culminating in we are as a working type of calling a dark contracts this is really good that you mentioned this because that was something we definitely wanted to talk about in this episode was like how does all of this relate back to Aztec because

now are elves working at Aztec with you and we knew from our previous episode roughly what Aztecs goals were but yeah what's the connection then well the connection is we were using Aztec and the vertical which were about to launch on maintenance this month enables private value transfers like you can create private tokens and trade them in in a confidential way so the the values are encrypted but the identities are not what's that vertical to be developed we were looking for something much more general-purpose to take to take our sect to the next level specifically what we would very much like our privacy preserving smart contracts so a world where not only is the identity of a smart contract

sender hidden not only is the data that they're manipulating and updating encrypted and not viewable by anybody but also the smoke contract code that they're executing is also hidden and the act of calling one of these smart contracts is also hidden and despite basically having this kind of giant black box where you can't see anything still use a public blockchain and consensus mechanism to enforce the correct execution of these dark contracts so I can basically make a statement to you where I'm sick as a I'm not going to tell you who I am I'm not going to tell you what dark contract I'm calling and I'm not going to tell you about if the state variables that have

changed but I can prove to you beyond a shadow of a doubt that whatever that hell I was doing I followed rules I effectively I followed the the the protocol like the the the logic and semantics of the small contractor Ram whatever that may be so this is super interesting because like sexy they had this concept of data of privacy and then function privacy and what it sounds like is that like in their case this function privacy so the the actual functioning the purpose of the transaction is also made private in their case it's built into the blockchain the sexy blockchain concept but in your case you're acting on top of

an existing chain and it sounds like you're trying to bring this function privacy into a public chain which I don't understand how it works but it's very cool sounding that's exactly what we're trying to do yes bring brings excuse function primacy with a few other added features on top to public no chains starting like specifically aetherium and yeah it's it's quite an ambitious project something which is going to be it's not it's not what currently what we're currently implementing using plums because it's going to be a 12 month long project it is that's what we're building was so I want to say thank you so much to both of you for coming on and helping us to map

out this space to better understand plunk there's so much that I've actually learned over the tower that I think is going to be helpful for me to better understand the new kind of paradigms and new constructions that come out after this so I want to say thank you but before we sign off I actually wanted to ask you what is exciting like what are you excited about right now what new things coming out are you kind of like woo this is new this is neat well I just wanna see it be an actual absolute pleasure to be on surface if thank you for that what are we excited about well obviously I mean I'm biased to Hill so I'm not going to talk about the plong stuff I'm excited about with regards to

how the space is developing and I think the different kinds of proven in your commitment schemes that have been coming up recently particularly things like dark and being able to commit polynomials in a transparent way user groups phone in order using potentially class groups I it's it's um it's absolutely fascinating and I'm incredibly excited to see how that develops yeah for me personally I feel we've gotten to a point now where we have an efficient enough system and simple enough system with with plunk and I'm excited about seeing it like seeing it used in applications and how that's gonna develop in the next few years what

about these like so there's things like there's slunk that Justin Drake recently released which is a variation like are you also encouraging or excited about like people taking plunk in a different direction or well I'll give so it's really it's really great to see all the a lot of a lot of follow-up work it's really nice to see that specifically what I think has potential is this joint work with Justin called Blanc oh it's called really maybe that's a working title

perfect yeah plunk by the way plunk can we just define this is the very end of the episode but plunk as I read I looked it up it means like bad wine or something like this in British English yes English slang for cheap low-quality wine which I felt it was a service I thought it was appropriate because the plonk the cryptograph protocol monk the boost they both give me severe headache consuming them but it's used more generally as slang for various bad things so cheap it's gonna it's gonna it's gonna like an she's gone bad like a positive connotation it's like cheap and cheerful you know yeah but but available to everybody

maybe I will I will tell a story that I have for I have a habit of submitting things to ePrint before they're full before they're ready because then it puts pressure on me to work on them it usually takes ePrint 3 to 4 days to actually publish but so we put plot we submitted to ePrint with Blancas of working title and and this time it took them only half an hour not four days yeah that groped me in the morning I think I'm having buyer's remorse about it's already up well yeah this is entirely era I'm gonna blame Ariel on

this because yeah you told me is that you supposed to you people have a week so you know fix it up and figure out a name okay fine that sounds about right the next money like why are people messaging me about about this paper that's only print that so this is not be public yeah it kind of it kind of just took a while controller and now you're going in all sorts of fun other directions well I guess that means we have to keep our eyes out I want to say thank you again for hat for coming on the show and talking to us thank you very much thank you thank you I hope we get to have you back again pretty soon to hear what what comes of all of this and yeah to our listeners thanks for listening thanks for

listening [Music]