ZKPodcast: Sharding Update With Prysmatic Labs

Transcript

[Music] welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik [Music] in this episode we sit down phonetic buns to deep dive into bullet proofs and verifiable silly functions hello and welcome to Benedict burns to this

episode on bullet proof I'm super excited about this topic I know you work on not only bulletproof but a lot of other interesting things I mean we'll get some of that too but maybe you can just start with a little bit of an intro of yourself and talk a little bit about what bullet proofs are yeah cool thanks for having me here and yeah my name is Ben burns and I just finished basically the second year of my PhD at Stanford where I work with Dan Binet on you know sort of generally applied cryptography with a special focus on crypto current currency it's really sort of you know the technical details of cryptocurrencies and and the

cryptography of the things that you know make it secure so my focus on is on that and and you know in recent times I've been for example working on bullet proves that I guess we're going to cover today and then also you know other stuff like verify will delay foreigners you know light Cline's and sort of a whole variety of topics cool and this is actually the second time you're on this podcast we had a very short interview with you on the secon 0 episode I'm really excited to get a chance to continue our sort of series on actual zero knowledge proof since your knowledge technologies bulletproof very much fits into that category do you want to maybe just start off by helping us

understand what bulletproof SAR yeah so bulletproof is a zero knowledge proof so you know they're zero knowledge proof is sort of the general technology and then there's sort of many different flavors of it like one flavor of it is a snark another one is a stark and yet another one is bulletproof and you know maybe as a recap what is a zero knowledge proof like in a zero knowledge proof I can prove you that something is true without telling you why it's true so I can prove to you for example that I know where Waldo is without giving you any information about where Waldo is and you will be convinced that this picture has

Waldo on it like there's a Waldo here but and you you're also convinced that I know where wall is but you have no idea where it is unless you know you figure it out yourself and one way that this is like used this is using Bitcoin is that I can have an transaction which doesn't have or in cryptocurrencies that I have like a cryptographic transaction where a lot of the details are hidden but I can still prove to you that the transaction is valid without giving you any information about why it's valid and bullet proof is one particular zero knowledge proves that has sort of different traders to other other zero

knowledge truths so the proves are are very short they're not quite as efficient as snarks but they snarks have this downside that when you use snark stays this this sort of trusted set up which creates toxic waste and and the problem is if this is not done correctly or if someone you know you need basically you need to trust someone to create a so-called proving key and a verification key and if they cheat then they can create proofs about statements that aren't true so they can for example prove to you that they know where Waldo is without actually knowing where Waldo is or without their even being a wall or they can prove to you

that a transaction is valid but actually they just created money out of thin air so that is obviously not a very good thing and you know this you can sort of try to circumvent that but it's it's really really difficult sort of with snarks and bulletproof doesn't do not have this trusted set up so that is sort of the the big benefit of them yeah I want to dig in to trust the trusted set up in more detail soon but you just mentioned something that CK snark they generate a toxic waste what mean by that what is this is what this is the trust and setup and sort of you know this is sort of the the the terminology that z cash uses is that the the set up this ceremony like generates

you know toxic waste in the sense that if that toxic waste isn't discarded if the person who does the trust set up doesn't you know delete that then yeah then you know this trust this toxic waste can be used to create the faults disprove the toxic waste like software and hardware and it's it's it's it's a secret key a secret special key you know like 32-byte key and if you have that then you can prove whatever you want and the way that it's usually done to sort of you know prevent like you know you could trust you know you could get another the Dalai Lama to do this and and you know everybody trusts that he's a computer expert and will you know do

this properly that the the other way to do this is to say like you know we'll get a bunch of people together and they have to do the trust that setup together in such a way that as long as one of them is honest so if as long as they don't all cheat or like collude together then you know the the toxic waste is sort of properly discarded and but you know this is extremely complicated and and you know takes a lot of time and has you know it's basically costly and but doable Suzy cash did this and you know Z cash works but you know the sort of this downside suit and bulletproof do not

have this downside they don't have trusted setups they don't produce this toxic waste they are faster so that's a very you know right like faster is you know let's sort of like a 10 dimensional question right and in some ways they're clearly slower and in other ways there is sort of their faster well we have the we have the whole episode to kind of go into the nuances of this but maybe we start with a little bit of a history of what where the bulletproof idea came from so so the VidCon core developers peter wooly and reports regret maxwell they sort of approaches with this

problem they had invented this thing called wreck mags well had invented this thing called a confidential transaction so what is a confidential transaction it is a confidential transaction looks like a Bitcoin transaction with the one difference that the amounts that are being transferred are encrypted so no one is able to see you know how much is being transferred the problem now is obviously how do - check that the transaction is valid and you know now if you listen to maybe a couple of the previous episodes right you should know the solution for this is a zero knowledge proof I prove to you that the transaction is valid I prove to you that you know the sum of the inputs to the transaction is equal to the sum of the

outputs so there's no new money created and I do this without giving you any additional information the problem is that the zero knowledge proof that they used and it's called is like a special case and it's called a range proof they were very sort of they were pretty large you know it would mean like that every transaction is like eight kilobytes which really isn't you know sort of limit scalability which is another big issues in cryptocurrencies you know really would have made transactions a lot more costly and the fees would be higher and sort of the question that they came to us with is is there is your knowledge proof and

especially one without a trusted set up where the proofs are shorter you know can can you come up with with a problem so they approached my adviser Dan Binet and me and and and sort of gave us this problem and I was a new PhD proud student sort of looking for you know interesting problems in that space and then when we started working on this and when we found this this amazing prior work by people from the University College London Ian's gravis group and which had sort of you know gotten us a lot of the way there and then you know we sort of improved on that work and used sort of techniques from that work to develop bullet proofs which happened to work extremely well

for confidential transactions but it then turned out that you know this is also not just doesn't just work for confidential transactions but you could sort of use it for for anything like anything where you can use the snark you can use a bulletproof inset and that doesn't mean that you should use a bulletproof instead because you know snarks are in some ways they are way more efficient but at least you can and and you know so that's how sort of this started what so what year was that this is two years ago no no this was like a year ago so well like you know you work on it for a year and then a year ago we published it haha so we we we I think we put out

the paper in late November 2017 which is you know it's it's quite cool and amazing about the space how quickly things you know get deployed in practice and and you know this is not not usually the case for academic work that things get you know rolled out that quickly get get that much attention that quickly and I think you know this speaks to so if the cryptocurrency space really being being interested and open into new academic ideas which i think is amazing yeah an eagerness to sort of explore new stuff and and try to innovate yeah right yeah and university is a big issue or this hasn't been been a big issue for

blockchain so I think everyone is sort of keen on trying to use whatever they can to to just make it better yeah we also we spoke yesterday briefly about this the naming and how that was very well thought I don't know bulletproof says it's awesome sound to it and it's like I don't know there's something I know this is gonna sound sort of funny but it's like I wonder like how did you come up with that name yeah so yeah no I'm sure that branding is important you know the it's it's I think it it actually is really important the yeah another friend of mine I was like you know we had written the paper I had the idea and then you know I was talking

to a friend of mine Shashank a girl who is also a crypto researcher that I work with and and he you know I was like saying like hey we have this new zero knowledge proof like do you have any ideas like you know spitballing ideas and for for names and and he said yeah why don't you may have bulletproof switch because it's it's a short proof you know and then sort of it's it's fast I guess and but it's also it's secure right like yeah you know it doesn't have the the toxic waste the sort of the hole there and and you know so that was sort of the name which you know in some ways it's a little bit gimmicky but you know

in other ways it's sort of it eases up the the conversation about it right you know otherwise often papers get referred to by you you know you take the initials of the authors and and at the year which which makes it you know like g'kar 87 or whatever and like you know if you're if you're really into the community you might know what that is I think GK hours later but but you know the the sort of for for the general public sort of you know nice names like snarks or Starks or bulletproof right like you know that that that definitely helps so digging in a little bit more into how bulletproof actually work in like what the details are I'm just

curious I mean if we set it in this landscape we've talked a little bit about in the inter up so how there's interactive zero knowledge proof sand then non interactive zero knowledge proves the case narcs are non interactive so are like most other popular ones bullet post is non interactive yeah it's actually interesting it's a so it's it's not that's not 1000% true technically because it's it's an interactive proof that you can turn into a non interactive one and and that's actually true for a lot of the protocols there's sort of a generic way of turning these interactive protocols into non interactive protocols but it seems like really you know that non into

to proves especially in the blockchain settings have a lot more advantages because the idea is write an interactive proof requires a specific person like it's you know me trying to convince someone else and they get to sort of ask questions and you know then I answer them but in the blockchain setting right like you know everybody wants to check the proof right it's not just one person that wants to check it so you really need something that you can just write down like a prove that you can write down and then everybody can read the proof and check it and that's sort of what a non-interactive proof is so zero knowledge proof or like proving functions are built on these circuits

it's usually something like implementers of this talk about like this circuitry and when these circuits are slow or they're hard to construct or whatever what is it in a bulletproof that separates it from like a snark is it is it some some aspect of this circuit structure or is it something else yeah so the circuit is usually the way that you express what you're trying to prove so say I want to prove that you know the this transaction is valid you know this is sort of a very generic statement so you need to make it more specific and basically the way like the circuit is almost like the programming

language or the almost like it's more like the assembly then so you know you write down that statement in terms of like multiplications and additions right you know you really break it down to the core and then you can take that circuit and then create a proof sort of you know the basically the what you do is you write down the circuit and the zero knowledge proof is I know secrets inputs to the circuit that at the end of the circuit you know in if you speak in electronics like the light turns on or in math right you know that the output is one off the circuit right you know it's it's a bunch of multiplication gates and addition gates and then at the end what comes out is one and what I

prove to use that I know values to the circuit such that the output is one I'm not going to tell you what these values are but I know them and so this circuit architecture and you know this works for you know you can take the circuit and then produce a snart that you know the inputs for the circuit or you can produce a bullet-proof so what is different the differences are in the properties like how long is the proof how long does it take to check it how complicated is it or like how long does it take to create it and you know though there that is really where the differences are and for example like snarks are usually shorter and easier to

check then bulletproof but bullet proofs are still sort of you know still still very short you know that's the main sort of property that we're aiming for especially compared to more like you know the solutions that were used before that didn't have a trusted set up there they're way way shorter so this is sort of the the key property that we were aiming for and why do we care about short proofs well you know they sort of in a blockchain everybody you know it's it's decentralized so everybody is supposed to have the blockchain and read it and if suddenly the blockchain gets bigger and bigger then you know everybody needs to download it and send it to each other and that really creates bottlenecks and and that's why we care about making the

everything that is on the blockchain so for example the the transactions and and the proofs as short as possible so it shorts here means like few bytes few bytes yeah that's it literally means you know bullet proofs are basically like less than you know one there one to two kilobytes is like the order of magnitude and snarks are like 200 bytes you know Todd and but so conceptually it's sort of like you avoid this trusted set up by including more information in the proof you say that no that's I mean it's not impossible that we could have a proof that is as short as a snark without a trusted set up but you know it just sort

of we just don't know yet how to do it of course like you know basically a trusted set up gives the the designer of the proof more freedom right you know this is a thing that you can do now and the the trusted set up can do some things and like once you remove that freedom you make the task harder so it sort of seems natural that you have to do some Trados there but you know like there's no you know there's no reason to say you know we can't get even better right so we'll see sort of what what happens so going back to like placing this in in the universe of zero knowledge proof how does this compare to you know we've talked a little bit

already about snarks but there are Starks and there's there's these other things like where does it live in and how does it compare to these things I would say you know right like compared to snarks I would say you should sort of use a bulletproof when you want to use a snart but you don't want to do the trust it set up and it's okay if the proofs are a little bit like bigger and and take longer to check and so for example compared to Starks the proofs are a lot shorter than starts so Starks is another proof system that doesn't have a trusted set up and they're the comparison is a little bit more difficult because Starks are even larger you know they're significantly larger you know and I'm the order of like 100 or 200 kilobytes and this

becomes you know something that what you wouldn't want to do one stark per transaction that you know like if every transaction is 200 kilobytes then you know this this really becomes a problem but Starks and snarks have this amazing property that you can prove sort of I can prove to you that some really really complicated statements so for example I can prove to you that I've checked the whole block chain or I've checked all of the transactions on blockchain and all of them work were valid and now to check the proof this is faster than if you've even had all the transaction and checked

them individually so right I can I can go through all of the transactions you know one by one and you know check that they're correct check the signature check that you know the inputs and outputs are correct and the amazing thing the amazing property that both snarks and Starks have and bulletproof do not have is that you can create a proof that is a that is shorter than all of these transactions that's also true for bulletproof but what's even more important is that checking the proof might take a millisecond versus checking all of the transactions takes an hour so now you have this compression property where I can and I don't even need to write I can give you sort of the

blockchain or I came to give you just that the the the head of the blockchain and then prove that everything before that that you don't even need to look at was done correctly and this sort of allows for amazing you know cool new applications where you have you have sort of clients that don't even sort of they don't even see the whole blockchain but they know that you know this this this one hash of the blockchain is the correct hash so I can you know now you have the blocked basically the whole blockchain and you checked it and it's like a 32 byte hash and and this is really where you know for example Starks shine and snarks can

also do that but again you have the trust etcetera something we've touched on a little bit on this podcast before it's stateless clients and when you start talking about stateless clients usually some sort of zero knowledge proof comes in in the discussion because of exactly this property that it's sort of a compression exactly so that is exactly what I was talking about and and the amazing thing is here you you don't need to so here comes another sort of technicality is that for these stateless clients you don't even care about the zero knowledge you care about the proof part right so I don't want to hide it from you the rest of the blockchain it's not that I don't want to give it to you

it just is more efficient to give you proof that was correctly right so you don't need sort of all of these proofs have servers your knowledge of area and a non zero knowledge variant and the for a lot of these applications you don't even there's your knowledge part of it you just care about the compression part of it and so bullet proves are not you know you can shrink the size but checking the proof will still be sort of if I give you a proof that you know I checked the whole blockchain then I can give you sort of checking that will be as as long as checking the whole blockchain or maybe even you know maybe even longer

them so so for stateless clients bullet proves are not a good application they are not a good tool and but for something like a transaction you know I want to prove to you that a transact where I actually want to do the zero-knowledge part right where I want to hide the details that is where we're bulletproof are really valuable and going back to snarks and Starks the image I have of Starks I I'm not actually sure where I've gotten this from but that Starks is more intended for general computation like prove that this program was executed correctly I mean that's that's what all of them do but that Starks allow for larger programs so yeah you know it's it's

really hard to you know sort of their you know the the differences are nuanced and and I wouldn't necessarily say that the weird thing is that Starks aren't necessarily sort of they aren't the only thing that work for larger programs right or doing that sort of a larger general-purpose computation it works the thing though is that that Starks a fairly large right so they only really make sense for larger programs it's not that they only work for that but they sort of this is where they sort of shine and where they make sense so you can do that with a end you can do that with a snark and you you you know but I feel like this is sort of the reason why why

Starks are sort of presented in that way is because this is where they they shine the most right that make sense and so this is sort of their distinction you've mentioned snarks Starks is there anything else yeah there's a very good question you know there's a lot of other things for example this high there's Leggero for example you know hi Rex like the thing is they're sort of in the more in the middle of the trade of space so you know hi Rex has like a good trade of between you know the size of the proof and the verification time and and Leggero for example is really interesting because it's it's creating the proof is very short right you know

follow the other ones sort of creating the proof is somewhat tedious you know there again bullet proof has for example compared to snarks bullet proofs has the advantage it takes maybe roughly the same time but it requires a lot less memory so you can sort of do it on a smaller machine which which may be nice and Leggero for example yeah is fast to compute and you know this is a really hot space so you know a new stuff is coming out and I know lots of people are working on it and the academic community and you know partially driven driven by cryptocurrencies right like zero knowledge groups have been around for like since the 80s I think and you know this is really being driven by by sort

of these new applications because previously you know it was a cute sort of theoretical concept and and now you know this can actually be used in public and and secure sort of billions of dollars which yeah it's motivating right you know this I have heard of I was talking to Howard and he mentioned they had worked with a big bank that was like they had a Sarah knowledge proof structure to basically interact with on behalf of customers with other entities so if like an insurance firm will only give you an insurance if you have more than a million bucks in your bank accounts then the bank can generate a zero

knowledge proof that they have that without saying how much money they have yeah no they're definitely a lot of other applications to to and your knowledge cruise and for example one is voting is like a common one that is referred to right I wanted to prove to you that my vote is it was done correctly and that but I don't want to tell you what I voted for right and so that's a very like sort of an application but you know as you were talking about bangs so we have this paper on how Bitcoin banks or Bitcoin exchanges basically can prove that they're solvent without giving up any information about you know how much does

each customer have how much Bitcoin do they have in total which addresses do they control all of that remains private but they can still prove that they have more money in their Bitcoin addresses than they owe to their customers and the cool thing is that what I really liked about this paper is that this is something that you might want for your normal like you feel a bank right but there's sort of no way like even even conceptually there's no way that they could do that because there's no not like this public ledger right the blockchain which you can sort of make prove the statement against and you know here are sort of the the idea that that bitcoin and and and all these other

currencies are cryptocurrencies you know that they have this cryptographic ledger and really makes this possible and and yeah I have a little side question before we move on something that I know is like a problem in this space and that I was fascinating about when I first found out was that we spoke a little bit about these circuits and you said like yeah you could design your circuit and sort of use any proving you know structure to to run it kind of but there's no standardized format of how to write such a circuit so you can't actually like to find it ones and use difference yeah algorithms on it yeah so I mean and the same thing that I said

was was was true in theory and practice you know it's probably not you know have you seen any work towards like trying to standardize that assembly language so there was a just a couple months ago there was a workshop in in Boston and Cambridge where a lot of the people that work on zero knowledge proof you know a lot of the academic and people from industry came together and the goal was to standardize their knowledge groups there was exactly that sort of work on that and all of the big names you know Shafi Goldwasser who was who got the Turing award the Nobel Prize for computer science

partially for inventing zero knowledge proves was there and we you know we started sort of working and we've put out some documents and you know like working to its standardization I'm a little bit while I think you know this in some ways I think it's a good idea in other ways I think I'm you should be cautious because sort of you don't want to stifle innovation right and you don't want to say you know this is the one thing that we use and no one you know should should use anything else I think it's a little bit it's a little bit premature right because they're so you know these papers still coming out you know there's still being developed and and we don't know what you know what

what will come out in the future so I think you have to be sort of strike a good balance and I think you know a lot of work is just has to go and and it's going to in into sort of tooling so you know application developer making it easy to use these tools right like you know abstracting away this this language I hope that you know in the future right you know you shouldn't write like spent as much time writing these circuits or these things should become right like maybe you can write you zero knowledge proof system and rust or whatever and then it gets compiled down there's some work on this you know taking see but you know it's just not not efficient and and doesn't work as well as you would hope

but this is sort of I think this is still coming like a little bit more patience but I think this is sort of really important we're making it easier to use so we've been talking sort of that general bullet proofs and where it lives in comparison to other zero knowledge actually what you call the zero knowledge so there's a patient you know it proves you just called bulletproof zero knowledge proof yeah so the and then there's also like technically it's a zero knowledge argument there's like proves an argument arguments and everything sort of that you see like so snark means succinctness

active argument of knowledge and both losses technically also an argument but that's sort of the it's really only a technical detail and it doesn't matter all of these things are zero knowledge proof okay so well more technically there's zero knowledge proof systems and then you can use them to create a zero knowledge proof so so far we've been talking about zero knowledge proof systems but we're like at what point is a supply to blockchain and because I as we've heard there's all these examples that are not blockchain how is that interacting how are you seeing these systems starting to interact more with

luck yeah so so sort of you have these zero knowledge proof systems and then you have applications that sort of requires your knowledge group and a lot of these applications are for block chains right so you can prove that you know as I was saying or the you can prove that a transaction is valid without giving up any information about why it is valid right and and and everybody is convinced and and and you know it's sort of you know all the miners need to check transactions right they need to check that a transaction is valid they need to check the signature and and in some ways a signature so

cryptographic signature is a zero knowledge is a special kind of zero knowledge proof where you prove that you know you basically prove that I know the private key to this Bitcoin or this cryptocurrency address and but I'm not going to tell you what the key is because the otherwise you know you could sort of create signatures yourself you know I don't want to give that up and but but here's sort of you know this is this proves to you that that I know this and and also you know and through that I can authorize the transaction and that's it was that sort of the first about applying zero knowledge proof sin to blockchain no that's you know that's sort of just uh you know saying that even even block chains that don't use

your knowledge proofs they basically use something very that comes from zero knowledge groups like yeah I can do it right these the signatures that I use are basically zero knowledge proof and the other thing is you know once you so in in Bitcoin a transaction is so most cryptocurrencies a transactions you can see you know everybody says like in the beginning everybody says you know bitcoin is private or whatever you know it's it has a lot of privacy but that's actually not really true because you can see which address spends to which address and how much is being sent and there's been a lot of work on you know showing that you might not know who this address belongs

to but there's been a lot of work showing on D anonymizing them like you know showing this this address belongs to Silk Road or this drug market or if this address belongs to this company you know once the coin base or whatever and so and there's been love academic and work and also now there's companies and the FBI actually kind of likes Bitcoin for that reason because it's able to trace the payments really well and then you know say you receive and some may be distant maybe not so distant future you receive your payment your your salary in your favorite crypto currency and then that payment is is public on the blockchain right so your salary is public on the blockchain so

everybody can see how much you making or say your company and you want to buy I don't know you want to buy your supplies right yeah say you McDonald's and you want to buy ketchup from Heinz right like they probably get a wage cheaper price than their competitors and and Burger King would like to know how much they're paying right this is an important business secret right that that that neither McDonald's nor Heinz would like to give up but if it's done on the blockchain everybody can basically tell how much it is so this makes it really almost unusable sort of for for people to use the block and then there's the whole sort of you know if you say you're a political

dissident right or you say you're you know you're somehow you know you you don't want the government you know your your payments like even if then they can you know they can see who you're paying to right and and you say you're sending money to to Snowden right and in Russia then you know the US government can see that that that that may be a problem because they don't like that and for all of these reasons we would like to hide all of this information right we would like to hide who's playing whom and and also you know sometimes you don't care about hiding who's paying whom and then you would still like to hide how much you pay and I think sort of the best example for that is you know there's in

the US is the the popular payment service wendel and where you can pay people which is really popular and even there there you can choose whether you want to make your payment who you paying you want whether you want to make that public but sort of the default is like oh you can't even change sort of you you can never sort of show how much you're paying because no one would want that right like you wouldn't want to you know let the public know how much you're paying your body for rent right this is just sort of not this seems very naturally like we don't want this information out in the public but in Bitcoin and then and most of the cryptocurrencies it is so zero knowledge proof are sort of the workhorse here that can help us prevent this because

you now want to prove right it's this this is the economy the you want to have the transaction be private so use say encryption to hide some of this information but you still want everybody to be able to check which transactions are valid and what is not so here this is where your knowledge proof systems come in I can prove to you that the transaction is valid without telling you why so bullet proof like you mentioned it's sort of driven a little bit by the Bitcoin core developers and it can be used to implement confidential transactions on Bitcoin yeah and I think they were actually sort of the main thing that what they were thinking about is member wendel and which is a new blockchain design like a very

sort of simple in some ways simple but beautiful blockchain design like a sort of minimal which also uses confidential transactions at the core of it and and you know lots of people have been been working on that and there's been a lot of interest in that and you know there they were memorable aoz you to sort of shrink the size of the blockchain law but then they were like yeah we can shrink all of that but what we're left with is sort of these confidential transactions and currently before bulla proves they were you know eight or ten kilobytes or whatever per transactions and and now with bulletproof so you can get that down to like you know less than a kilobyte and it really it depends on

the parameters right like you know it can shrink by like a factor of ten or even more and that made it a lot more feasible yeah so that's what I was gonna ask is like where do you see implementations of bulletproof and like what what do you see now what do you expect to see in the future like which specific projects do you think will implement anything so right now someone era has implemented bulletproof and they will sort of because they already use confidential transactions and and for them it was just a clear win you know it's it's sort of faster it's smaller than what they previously use it will

lower the fees that Manero users will have to pay and so they've they're doing security audits right now they've done security audits and and to make sure that the implementation is correct right there's always two things you know there's sort of the the theory behind it being correct but then you can implement it and you can screw that up like massively and that's where actually a lot of the problems and and computer security come from is this sort of bad implementations or faulty influent Asians and so they've done you know a lot of work on making sure that that is correct and then they will deploy it I think they will try to deploy this year so sort of you know within a year of

publishing the paper [Music] you know bulletproof will secure how much manera is worth like a billion dollars I don't know what about what about something like Zee cash it already had I mean it's all it's built very much around ZK snarks mm-hmm is there a way for ZK like would it make sense for Z cached also be using bulletproof yeah so that's a that's a very good question so we've I guess you know we saw each other as equal zero and and present a bullet proof because they're certainly interested in it right and and for Zee cash is it's not as clear-cut as for manera from an arrow it makes it's clearly better to use bullet proof for Z

cash there's a trade-off so basically using bullet proof would make verifying the transaction and checking the transactions so would make the work for the miners more difficult but it would remove the trusted setup and so there is sort of the trade off and they are like I think it just requires more exploration I don't know what the answer is you know I think it depends on many many different things and but I think it's definitely worth worth exploring and and you know I've been in contact with them sort of you know exploring that idea what about you mentioned member Wimble are they also going to be using bullet press or is it or do they already have sort of enough confidentiality built

into the no they call no so so so mimimum will already uses a zero knowledge proof a circle like busy it's it's it's called a sigma protocol and or closely related to something called a sigma protocol and or the the original design I mean mwamba doesn't exist yet the sort of days memorable was just for a sort of historical reference it's actually a great story there it was this random guy that just dropped the link on one of these these IRC channels like you know a tor network link sort of a hidden link and this guy was named it was a

call it was like the French named for @j juice or something it was like the French name for Tom Riddle from Harry Potter and which we know how old this person is for sure yeah yeah you know and the the name has to be Elvis jedrus or because right like Tom Riddle is like you know you can make I am Valda more out of sort of these things and just we you know this is in the French version the name had to be different either way so this way all of this came up and this guy just you know anonymous we don't know who he is like just like

Satoshi he just dropped sort of this this new design of a blockchain called member one bow which is also spell from Harry Potter it's like all very Harry Potter themed and so you know he just dropped this design which which turned out to actually be a quite neat idea and then you know other people like Andrew Pereira for example have sort of kept driving that idea forward and formalizing it and yeah so they use zero-knowledge as your knowledge proof and the sort of the best one for them available is also bulletproof so they will they will use I mean I'm pretty sure that any sort of reasonable implementation of the

protocol should use use bulletproof would they do something like take bullet person run with it well let chaebol they change it um no I think they should basically just you know take take it and run with it you know you sort of there's I don't know you know what they will do for their implementation whether they will implement it in code themselves or whether they will take one of the existing implementations I honestly don't don't don't know how that's going to work but you know in general when you when you design sort of these systems you just you shouldn't you know it's better to not design it with like one specific you should just design it like to say like here I need a zero knowledge

proof and then later you know you can pick the one that is best right it should be sort of there's a you you shouldn't say you know z cash like zero cash the the is based on an academic work and there they also say like you know we use a zero knowledge proof to to to create this so they already had sort of this abstraction in mind and then they say sort of the best one that we can use to make this practical is ZK snarks right but you know they already sort of acknowledge that you could use any zero knowledge proof to do this and so this sort of speaks to something currently like we've talked about a few different protocols block chains and how they're

using these different zero knowledge proof different zero knowledge proof systems but they're not necessarily tied to each other like they're interchangeable yeah exactly right like you know one is sort of the this is like like you know saying you know I think the Bitcoin bitcoin is mostly written and see and I think you know the main a theory inclined is it's like one of them is written and go and you know whatever but like you know Bitcoin and see you have like you know that's not you know that those are just completely orthogonals things and and a theorem go all right I can arrest or you know the those are just you know one is the tool and the other one is sort of the application and you know I think angel

yeah they're into at least to some degree right like you know it might make the most sense to use one with another and that's clearly the case but they sort of still you know I think having this this abstraction and keeping those things separate I think is really important and not get those things sort of conflated with each other and yeah you were also saying sort of I want to say one one other thing you were saying earlier you know how which projects are currently using it and which projects might be using it I really hope that you know in the future sort of everyone like right now there's privacy coins right there's like mineiro and and and sea cash that so if the focus is on privacy I really hope that sort of you know that

they that privacy will become the default that sort of everyone will have at least sort of some level of privacy at least like confidential transactions like that should be the norm rather than the exception right because the problem right now if you're using one our Z cache and to some degree like you might get asked like why using this are you using this to buy drugs right you know you you sort of like you make yourself almost more suspicious by just using these coins even if you're just using them for your everyday payments which is sort of a bad state but if sort of this becomes the if privacy is the default which I think in general should be the norm then you know it everybody benefits from it this it

becomes a public good and we're we're sort of everybody has has the benefits of you know not being you know suspicious and just saying like hey I'm you know this is sort of what what happened when what's that became and like you know and signal and sort of all of these messages became end-to-end encrypted now you don't have to be previously there was were also end-to-end encrypted messengers but suddenly as soon as you use that you know you probably get put on some CIA lists I don't know making things up here but now it becomes the default and everybody uses in and everybody expects it and that's a great thing you know so I hope we see that for sort of transactions also becoming private private in the future but you know I

think this will still take a couple years so at the beginning of this episode I said like we're talking about bulletproof and maybe some other things you obviously work on a lot of other things than bulletproof even though that's been the main topic here could you give us just like the quick pitch on what other stuff you had going yeah so one thing that that I focus on we focus on sort of recently has been these things called verifiable delay functions and this is something yeah very technical which has a lot of surprising applications so what is a verifiable delay function so in a nutshell it's

just a function that takes a long time to compute no matter whether you're Amazon and have a bunch of like data centers or whether you have an ASIC or whether you're just on a single computer the the idea is that you cannot speed it up and why can you not speed it up because you cannot use parallelism it's a sort of sequential function so you just compute one step after another and the way that you know a six speed things up is by paralyzing things massively so verify with a function is a function that takes a long time to compute but it's easy once you've done it it's easy to check that you've computed it correctly so you know sort of maybe inverting it is really really fast so why like why in the world would I would

I care about this well it lets you sort of you know it has has a lot of applications where and you know for example I can prove to you that I this blockchain has existed for a long long time right and the way that I do that is I just take sort of you know or this block has existed for you know ten minutes and the way that I do this is I take the block chain and then I computer verify with lay function and if I give you a verifiable a function that you know you sort of know how long it will take me to compute you know like it's it's almost of almost like a clock you know that it's not an exact clock but it almost is like that and if I so sort of

if I give you verify with a function off of it and and you know you know it took me 10 minutes to compute then you know that this block must have existed ten minutes ago so I can use this too for example you know prevent in these proof of stake protocol it's like there's one attack where you know create a sort of block chain out of thin air from from the beginning I like you know because now suddenly it doesn't take me it doesn't take proof-of-work anymore like you know it's not expensive to create a proof of stake chain it can be a long long range attack exactly a long range attack is sort of the name and and with the VDS you know that's one way to for example prevent that because you know that you know I need to if I have this

vdf running on this buck chain and you know that okay this block chain must have existed a year ago right this massive exist the two years ago but checking you know computing the function takes two years but checking it as like milliseconds and another a really really cool application that was maybe our initial motivation is that comes from from lotteries and so there's this idea that you can use sort of Bitcoin and it doesn't actually even have to be Bitcoin it's like you know say I want to run a lottery okay and and you should all Google this video on I think it's a Romanian lottery where the the you know usually the way that we run lotteries is like we have these public

drawings right you know someone draw some balls and out of out of you know like whatever this this tube or this this spinning thing and you can see sort of this this they are drawing the balls and you can see that three balls have been drawn but sort of on the on the digital display it shows like five faults right and then and the reporter is like really confused because she also sees it and even though it's a life long drawing and then the next two balls come sort of the thing and surprise surprise they're the exactly the same balls that have been shown that they were shown on the digital thing before so you know maybe they sort of rigged the system and and someone got really lucky and won the

lottery you know like really lucky and they just sort of messed up the graphics on the thing and how can we you know trust these drawings how can you know you know or if you shuffle cards right you know there's sleight of hands and there's magicians that can do things so the question is like how can we run the lottery where everybody can trust the random you know without having again a trusted party you know this again we're a trusted party makes the thing easy you know if you have a trusted party that tells you random number or that rolls you know the dice and does it correctly then then everything's good but maybe we don't want to trust anyone and and these lotteries you know they come up all the time for example in smart contracts you might have sort of random like every

time you know randomness comes into the way and the idea was that you know you can for example take you can take a block header and extract some randomness from it or you can like also take you know another one is you can guess on tomorrow's NBA games right and say like you know whatever you know I you know the scores of the NBA games they will sort of determine the digits of the random number the problem is that you know in an NBA game like you know I can bribe the players I can bribe the refs in sort of a blockchain I can bribe the miners to you know whenever the block header doesn't give me good randomness they will throw it away

you know they will sort of decide to you know when we say we do a billion dollar a coin flip determined on and you know the the block header like you know I'll just take you know take up the loan of a million dollars and bribe the the the the miners until I get you know I could get heads and one the billion dollars so that sort of doesn't really work and the idea is that you can now use the verifiable a function by sort of saying okay we'll take we'll take the scores from the NBA games or we'll take the block headers and then on top of that will you know compute an hour-long delay or a day-long delay and then only then and only then you know this will be sort

of the random number and what that means is that it's impossible it's impossible because you know I don't know which numbers will be good for me because I haven't been able I wasn't able to compute this this vdf verifiable a function on top of it so how will I you know how do I know who to bribe or what to do and you know I can the the NBA games will be over by the time the verifiable today functions by the time how I I know how to influence this course the the sort of the game will be over and or the games will be over so that's that's sort of where VeriFone a function can be used to run a lottery

you know and and this has many applications again improve of stake where where again right like Anna proof of stake it's a things are a little bit more complicated but but there I basically need to pick random you know some random people people randomly who are the next sort of block validators right you know everybody has some some mistake and then one of them are some of them need to are the next leaders and how do I pick them for that any good randomness and here sort of a vdf can can help yeah so in mistake systems like you say there's a problem and like the problem is not the consensus algorithm like you can have pbft that's been around for a

long time the problem is if you have a validator set of 10,000 you can't run pbft among 10,000 people so you need to choose some subsets and that that's the hard problem but you also have a bunch of other hard problems which is essentially like civil resistance which was why we were talking about before so yeah that's that's an aspect of it that I'm really interested in its using delay functions as a civil resistance mechanism mmm-hmm maybe just to wrap up let's go back to bullet proof for a second what's the future of bullet proof what are you working on that you know I I hope sort of one future will be a lot more people using it sort of also maybe you know people developing new libraries to make the usage of it easier and then

you know there's so interesting academic questions you know how can we make sort of the the time to check the proof can we sort of bring that down you know is there can we make the proofs even smaller you know so can we combine proof systems and some crazy way to to sort of get new properties and so both unlike this sort of site can we improve the proof system and can we find also new applications you know can we say here is this this problem and now we can solve this really nicely using your knowledge proofs or using bullet groups and so that's sort of you know the questions that that I'm interested in and I really really hope that other people are going

to work on you also mentioned that there's a conference coming up that you really yeah I did about yeah I definitely want to pitch that so we have the Stanford blockchain conference or formerly known as be pace which is so the third edition is going to come up in I think it's January 30th and right now you can submit academic papers so it's an academic conference on blockchain research the Stanford blockchain conference just Google that you will find it or I think it's Seibert stanford.edu slash SBC 19 so you know you know right now they're sort of the submission process of academic papers

and will select the best papers and presentations that will then get presented at the conference and you can still you can also attend it I'm I don't know what I'm sure it's going to be cheap you know so it's it's not about you know like sort of it it's going to be very academic and really trying to sort of push on on the edge of research and sort of the cutting-edge researchers is hopefully going to be presented there and this is all part of the you know so Stanford announced that or the computer science department or announced the the Center for blockchain research what this basically is is sort of a concerted effort into blockchain research by you

know professors from the computer science department and also you know some some lawyers from the law school and so I think you know that that they have you know sort of notice block chains which I'm excited about and sort of our our notice that it's interesting from an academic point of view and and are trying to you know sort of push the cutting edge yeah well I think on that note thank you so much for sitting down with us and exploring this sort of advanced zero knowledge proof system bullet proofs and helping us get inside it I think it's been really informative yeah thanks for having me thank you very much and to our listeners thanks for listening thanks for listening

you [Music]