WEBVTT Kind: captions Language: en 00:00:00.000 --> 00:00:04.350 align:start position:0% foreign 00:00:04.350 --> 00:00:04.360 align:start position:0% 00:00:04.360 --> 00:00:12.789 align:start position:0% [Music] 00:00:12.789 --> 00:00:12.799 align:start position:0% 00:00:12.799 --> 00:00:16.790 align:start position:0% I'm<00:00:13.799> Nolan<00:00:14.219> I'm<00:00:15.059> ingtong<00:00:15.660> and<00:00:16.440> today<00:00:16.560> we're 00:00:16.790 --> 00:00:16.800 align:start position:0% I'm Nolan I'm ingtong and today we're 00:00:16.800 --> 00:00:18.769 align:start position:0% I'm Nolan I'm ingtong and today we're going<00:00:16.980> to<00:00:17.100> talk<00:00:17.220> about<00:00:17.400> recursive<00:00:18.000> ZK<00:00:18.300> snarks 00:00:18.769 --> 00:00:18.779 align:start position:0% going to talk about recursive ZK snarks 00:00:18.779 --> 00:00:20.529 align:start position:0% going to talk about recursive ZK snarks the<00:00:19.199> kinds<00:00:19.380> of<00:00:19.440> applications<00:00:19.859> they<00:00:20.220> unlock 00:00:20.529 --> 00:00:20.539 align:start position:0% the kinds of applications they unlock 00:00:20.539 --> 00:00:23.630 align:start position:0% the kinds of applications they unlock and<00:00:21.539> how<00:00:21.720> we<00:00:21.840> can<00:00:21.960> Implement<00:00:22.260> them<00:00:22.500> so<00:00:23.400> first 00:00:23.630 --> 00:00:23.640 align:start position:0% and how we can Implement them so first 00:00:23.640 --> 00:00:25.250 align:start position:0% and how we can Implement them so first we<00:00:23.880> should<00:00:24.060> talk<00:00:24.240> about<00:00:24.359> what<00:00:24.779> recursive 00:00:25.250 --> 00:00:25.260 align:start position:0% we should talk about what recursive 00:00:25.260 --> 00:00:27.470 align:start position:0% we should talk about what recursive proofs<00:00:25.619> even<00:00:25.800> are<00:00:26.039> so<00:00:26.880> in<00:00:27.060> the<00:00:27.119> context<00:00:27.300> of 00:00:27.470 --> 00:00:27.480 align:start position:0% proofs even are so in the context of 00:00:27.480 --> 00:00:29.810 align:start position:0% proofs even are so in the context of snork<00:00:27.779> recursion<00:00:28.500> is<00:00:28.920> usually<00:00:29.340> the<00:00:29.519> ability 00:00:29.810 --> 00:00:29.820 align:start position:0% snork recursion is usually the ability 00:00:29.820 --> 00:00:31.970 align:start position:0% snork recursion is usually the ability to<00:00:30.060> verify<00:00:30.420> a<00:00:30.660> smart<00:00:30.840> proof<00:00:31.260> inside<00:00:31.679> of 00:00:31.970 --> 00:00:31.980 align:start position:0% to verify a smart proof inside of 00:00:31.980 --> 00:00:34.430 align:start position:0% to verify a smart proof inside of another<00:00:32.099> snug<00:00:32.579> proof<00:00:32.880> so<00:00:33.540> this<00:00:33.899> is<00:00:34.079> the 00:00:34.430 --> 00:00:34.440 align:start position:0% another snug proof so this is the 00:00:34.440 --> 00:00:36.650 align:start position:0% another snug proof so this is the ability<00:00:34.680> to<00:00:34.920> say<00:00:35.100> something<00:00:35.340> like<00:00:35.640> I<00:00:36.300> know<00:00:36.420> is 00:00:36.650 --> 00:00:36.660 align:start position:0% ability to say something like I know is 00:00:36.660 --> 00:00:38.930 align:start position:0% ability to say something like I know is not<00:00:36.960> proof<00:00:37.380> that<00:00:38.100> when<00:00:38.340> I<00:00:38.460> run<00:00:38.579> the<00:00:38.760> smart 00:00:38.930 --> 00:00:38.940 align:start position:0% not proof that when I run the smart 00:00:38.940 --> 00:00:40.850 align:start position:0% not proof that when I run the smart verification<00:00:39.360> algorithm<00:00:39.899> on<00:00:40.140> it<00:00:40.440> returns 00:00:40.850 --> 00:00:40.860 align:start position:0% verification algorithm on it returns 00:00:40.860 --> 00:00:44.330 align:start position:0% verification algorithm on it returns true<00:00:41.040> inside<00:00:41.460> of<00:00:41.879> another<00:00:42.300> is<00:00:42.660> not<00:00:42.780> proof<00:00:43.340> and 00:00:44.330 --> 00:00:44.340 align:start position:0% true inside of another is not proof and 00:00:44.340 --> 00:00:46.130 align:start position:0% true inside of another is not proof and the<00:00:44.760> sort<00:00:44.940> of<00:00:45.059> key<00:00:45.180> part<00:00:45.420> here<00:00:45.660> is<00:00:45.899> that 00:00:46.130 --> 00:00:46.140 align:start position:0% the sort of key part here is that 00:00:46.140 --> 00:00:48.290 align:start position:0% the sort of key part here is that verification<00:00:46.680> of<00:00:46.920> regressive<00:00:47.340> ZK<00:00:47.579> snarks<00:00:48.059> is 00:00:48.290 --> 00:00:48.300 align:start position:0% verification of regressive ZK snarks is 00:00:48.300 --> 00:00:51.290 align:start position:0% verification of regressive ZK snarks is usually<00:00:48.780> not<00:00:49.160> significantly<00:00:50.160> slower<00:00:50.579> than 00:00:51.290 --> 00:00:51.300 align:start position:0% usually not significantly slower than 00:00:51.300 --> 00:00:55.729 align:start position:0% usually not significantly slower than ordinary<00:00:52.219> regular<00:00:53.219> CK<00:00:53.579> smart<00:00:53.820> verification 00:00:55.729 --> 00:00:55.739 align:start position:0% ordinary regular CK smart verification 00:00:55.739 --> 00:00:57.950 align:start position:0% ordinary regular CK smart verification so<00:00:56.699> now<00:00:56.879> that<00:00:57.059> we<00:00:57.180> have<00:00:57.300> this<00:00:57.420> primitive<00:00:57.719> in 00:00:57.950 --> 00:00:57.960 align:start position:0% so now that we have this primitive in 00:00:57.960 --> 00:01:00.290 align:start position:0% so now that we have this primitive in mind<00:00:58.140> we<00:00:58.680> should<00:00:58.800> think<00:00:59.039> about<00:00:59.160> the<00:00:59.940> sort<00:01:00.180> of 00:01:00.290 --> 00:01:00.300 align:start position:0% mind we should think about the sort of 00:01:00.300 --> 00:01:02.150 align:start position:0% mind we should think about the sort of natural<00:01:00.480> question<00:01:00.899> is<00:01:01.260> why<00:01:01.800> would<00:01:01.920> you<00:01:02.039> want 00:01:02.150 --> 00:01:02.160 align:start position:0% natural question is why would you want 00:01:02.160 --> 00:01:04.369 align:start position:0% natural question is why would you want to<00:01:02.219> make<00:01:02.399> recursive<00:01:02.879> smart<00:01:03.120> proofs<00:01:03.539> so 00:01:04.369 --> 00:01:04.379 align:start position:0% to make recursive smart proofs so 00:01:04.379 --> 00:01:06.469 align:start position:0% to make recursive smart proofs so typically<00:01:04.860> regular<00:01:05.400> ZK<00:01:05.760> snarks<00:01:06.240> you<00:01:06.299> know<00:01:06.360> we 00:01:06.469 --> 00:01:06.479 align:start position:0% typically regular ZK snarks you know we 00:01:06.479 --> 00:01:08.690 align:start position:0% typically regular ZK snarks you know we think<00:01:06.600> of<00:01:06.780> them<00:01:06.900> as<00:01:07.140> having<00:01:07.380> two<00:01:07.799> uh<00:01:08.400> sort<00:01:08.640> of 00:01:08.690 --> 00:01:08.700 align:start position:0% think of them as having two uh sort of 00:01:08.700 --> 00:01:10.310 align:start position:0% think of them as having two uh sort of properties<00:01:09.060> such<00:01:09.600> signals<00:01:10.080> and<00:01:10.200> their 00:01:10.310 --> 00:01:10.320 align:start position:0% properties such signals and their 00:01:10.320 --> 00:01:12.830 align:start position:0% properties such signals and their knowledge<00:01:10.740> so<00:01:11.400> recursion<00:01:12.000> in<00:01:12.180> fact<00:01:12.299> unlocks 00:01:12.830 --> 00:01:12.840 align:start position:0% knowledge so recursion in fact unlocks 00:01:12.840 --> 00:01:15.170 align:start position:0% knowledge so recursion in fact unlocks powerful<00:01:13.320> versions<00:01:13.740> of<00:01:14.340> both<00:01:14.880> of<00:01:15.000> these 00:01:15.170 --> 00:01:15.180 align:start position:0% powerful versions of both of these 00:01:15.180 --> 00:01:16.090 align:start position:0% powerful versions of both of these properties 00:01:16.090 --> 00:01:16.100 align:start position:0% properties 00:01:16.100 --> 00:01:19.910 align:start position:0% properties in<00:01:17.100> the<00:01:17.220> form<00:01:17.400> of<00:01:17.820> compression<00:01:18.659> which<00:01:19.200> is<00:01:19.740> a 00:01:19.910 --> 00:01:19.920 align:start position:0% in the form of compression which is a 00:01:19.920 --> 00:01:21.710 align:start position:0% in the form of compression which is a stronger<00:01:20.159> version<00:01:20.340> of<00:01:20.580> the<00:01:20.640> cygnus<00:01:21.119> and 00:01:21.710 --> 00:01:21.720 align:start position:0% stronger version of the cygnus and 00:01:21.720 --> 00:01:24.530 align:start position:0% stronger version of the cygnus and multi-party<00:01:22.380> composibility<00:01:23.060> from<00:01:24.060> zero 00:01:24.530 --> 00:01:24.540 align:start position:0% multi-party composibility from zero 00:01:24.540 --> 00:01:26.210 align:start position:0% multi-party composibility from zero knowledge 00:01:26.210 --> 00:01:26.220 align:start position:0% knowledge 00:01:26.220 --> 00:01:29.030 align:start position:0% knowledge so<00:01:26.880> first<00:01:27.119> let's<00:01:27.420> talk<00:01:27.659> about<00:01:27.780> compression<00:01:28.500> we 00:01:29.030 --> 00:01:29.040 align:start position:0% so first let's talk about compression we 00:01:29.040 --> 00:01:30.530 align:start position:0% so first let's talk about compression we think<00:01:29.220> of<00:01:29.340> compression<00:01:29.759> as<00:01:29.939> supercharging 00:01:30.530 --> 00:01:30.540 align:start position:0% think of compression as supercharging 00:01:30.540 --> 00:01:33.350 align:start position:0% think of compression as supercharging succinctness<00:01:31.200> and<00:01:32.159> in<00:01:32.280> particular<00:01:32.640> usually 00:01:33.350 --> 00:01:33.360 align:start position:0% succinctness and in particular usually 00:01:33.360 --> 00:01:35.090 align:start position:0% succinctness and in particular usually the<00:01:33.540> applications<00:01:33.900> of<00:01:34.200> compression<00:01:34.619> tend<00:01:34.979> to 00:01:35.090 --> 00:01:35.100 align:start position:0% the applications of compression tend to 00:01:35.100 --> 00:01:37.190 align:start position:0% the applications of compression tend to share<00:01:35.340> a<00:01:35.579> sort<00:01:35.759> of<00:01:35.880> common<00:01:36.000> pattern 00:01:37.190 --> 00:01:37.200 align:start position:0% share a sort of common pattern 00:01:37.200 --> 00:01:38.569 align:start position:0% share a sort of common pattern um<00:01:37.259> and<00:01:37.560> this<00:01:37.680> common<00:01:37.860> pattern<00:01:38.159> looks<00:01:38.520> like 00:01:38.569 --> 00:01:38.579 align:start position:0% um and this common pattern looks like 00:01:38.579 --> 00:01:40.310 align:start position:0% um and this common pattern looks like you<00:01:38.939> know<00:01:39.060> let's<00:01:39.180> say<00:01:39.360> we<00:01:39.540> have<00:01:39.659> a<00:01:39.780> prover<00:01:40.020> who 00:01:40.310 --> 00:01:40.320 align:start position:0% you know let's say we have a prover who 00:01:40.320 --> 00:01:42.170 align:start position:0% you know let's say we have a prover who wants<00:01:40.500> to<00:01:40.560> show<00:01:40.740> a<00:01:40.979> verifier 00:01:42.170 --> 00:01:42.180 align:start position:0% wants to show a verifier 00:01:42.180 --> 00:01:44.270 align:start position:0% wants to show a verifier um<00:01:42.240> some<00:01:42.540> n<00:01:42.780> pieces<00:01:43.140> of<00:01:43.320> knowledge<00:01:43.619> how<00:01:44.159> do 00:01:44.270 --> 00:01:44.280 align:start position:0% um some n pieces of knowledge how do 00:01:44.280 --> 00:01:45.490 align:start position:0% um some n pieces of knowledge how do they<00:01:44.460> do<00:01:44.640> this 00:01:45.490 --> 00:01:45.500 align:start position:0% they do this 00:01:45.500 --> 00:01:49.190 align:start position:0% they do this they<00:01:46.500> make<00:01:46.680> a<00:01:46.860> proof<00:01:47.100> showing<00:01:47.720> two<00:01:48.720> sort<00:01:49.079> of 00:01:49.190 --> 00:01:49.200 align:start position:0% they make a proof showing two sort of 00:01:49.200 --> 00:01:51.109 align:start position:0% they make a proof showing two sort of things<00:01:49.560> first<00:01:49.979> they<00:01:50.340> show<00:01:50.579> one<00:01:50.820> piece<00:01:51.000> of 00:01:51.109 --> 00:01:51.119 align:start position:0% things first they show one piece of 00:01:51.119 --> 00:01:53.569 align:start position:0% things first they show one piece of knowledge<00:01:51.420> and<00:01:52.320> then<00:01:52.380> they<00:01:52.740> also<00:01:52.979> show<00:01:53.100> you 00:01:53.569 --> 00:01:53.579 align:start position:0% knowledge and then they also show you 00:01:53.579 --> 00:01:55.010 align:start position:0% knowledge and then they also show you know<00:01:53.640> Additionally<00:01:53.939> the<00:01:54.240> N<00:01:54.420> minus<00:01:54.720> one<00:01:54.780> other 00:01:55.010 --> 00:01:55.020 align:start position:0% know Additionally the N minus one other 00:01:55.020 --> 00:01:56.929 align:start position:0% know Additionally the N minus one other pieces<00:01:55.380> of<00:01:55.500> knowledge<00:01:55.799> but<00:01:56.340> for<00:01:56.640> these<00:01:56.820> n 00:01:56.929 --> 00:01:56.939 align:start position:0% pieces of knowledge but for these n 00:01:56.939 --> 00:01:59.330 align:start position:0% pieces of knowledge but for these n minus<00:01:57.240> one<00:01:57.360> pieces<00:01:57.799> instead<00:01:58.799> of<00:01:58.860> showing<00:01:59.159> each 00:01:59.330 --> 00:01:59.340 align:start position:0% minus one pieces instead of showing each 00:01:59.340 --> 00:02:01.670 align:start position:0% minus one pieces instead of showing each piece<00:01:59.640> individually<00:02:00.060> they<00:02:00.479> will<00:02:00.659> show<00:02:01.439> that 00:02:01.670 --> 00:02:01.680 align:start position:0% piece individually they will show that 00:02:01.680 --> 00:02:05.270 align:start position:0% piece individually they will show that they<00:02:01.860> know<00:02:02.040> a<00:02:02.399> another<00:02:02.759> smart<00:02:03.420> proof<00:02:03.840> of<00:02:04.439> these 00:02:05.270 --> 00:02:05.280 align:start position:0% they know a another smart proof of these 00:02:05.280 --> 00:02:07.249 align:start position:0% they know a another smart proof of these n<00:02:05.399> minus<00:02:05.700> one<00:02:05.820> pieces 00:02:07.249 --> 00:02:07.259 align:start position:0% n minus one pieces 00:02:07.259 --> 00:02:09.109 align:start position:0% n minus one pieces so<00:02:07.799> the<00:02:08.039> next<00:02:08.160> question<00:02:08.280> is<00:02:08.459> how<00:02:08.759> do<00:02:08.880> you<00:02:09.000> make 00:02:09.109 --> 00:02:09.119 align:start position:0% so the next question is how do you make 00:02:09.119 --> 00:02:10.550 align:start position:0% so the next question is how do you make the<00:02:09.360> smart<00:02:09.539> pool<00:02:09.780> for<00:02:09.959> the<00:02:10.020> N<00:02:10.200> minus<00:02:10.440> one 00:02:10.550 --> 00:02:10.560 align:start position:0% the smart pool for the N minus one 00:02:10.560 --> 00:02:12.530 align:start position:0% the smart pool for the N minus one pieces<00:02:10.860> of<00:02:10.979> knowledge 00:02:12.530 --> 00:02:12.540 align:start position:0% pieces of knowledge 00:02:12.540 --> 00:02:14.270 align:start position:0% pieces of knowledge um<00:02:12.599> and<00:02:12.900> in<00:02:13.140> fact<00:02:13.260> we<00:02:13.500> use<00:02:13.680> the<00:02:13.860> same<00:02:14.040> kind<00:02:14.160> of 00:02:14.270 --> 00:02:14.280 align:start position:0% um and in fact we use the same kind of 00:02:14.280 --> 00:02:16.850 align:start position:0% um and in fact we use the same kind of strategy<00:02:14.640> again<00:02:14.900> the<00:02:15.900> N<00:02:16.080> minus<00:02:16.319> one<00:02:16.440> pieces<00:02:16.739> of 00:02:16.850 --> 00:02:16.860 align:start position:0% strategy again the N minus one pieces of 00:02:16.860 --> 00:02:18.470 align:start position:0% strategy again the N minus one pieces of knowledge<00:02:17.160> we<00:02:17.459> show<00:02:17.640> one<00:02:17.879> piece<00:02:18.060> of<00:02:18.180> knowledge 00:02:18.470 --> 00:02:18.480 align:start position:0% knowledge we show one piece of knowledge 00:02:18.480 --> 00:02:19.729 align:start position:0% knowledge we show one piece of knowledge and<00:02:18.780> additionally<00:02:19.080> we<00:02:19.260> show<00:02:19.440> that<00:02:19.560> we<00:02:19.620> know 00:02:19.729 --> 00:02:19.739 align:start position:0% and additionally we show that we know 00:02:19.739 --> 00:02:21.830 align:start position:0% and additionally we show that we know another<00:02:19.920> proof<00:02:20.340> of<00:02:20.580> n<00:02:20.819> minus<00:02:21.180> two<00:02:21.300> pieces<00:02:21.720> of 00:02:21.830 --> 00:02:21.840 align:start position:0% another proof of n minus two pieces of 00:02:21.840 --> 00:02:22.990 align:start position:0% another proof of n minus two pieces of knowledge 00:02:22.990 --> 00:02:23.000 align:start position:0% knowledge 00:02:23.000 --> 00:02:25.369 align:start position:0% knowledge and<00:02:24.000> so<00:02:24.180> then<00:02:24.300> you<00:02:24.540> know<00:02:24.660> you<00:02:24.780> just<00:02:24.900> Cascade 00:02:25.369 --> 00:02:25.379 align:start position:0% and so then you know you just Cascade 00:02:25.379 --> 00:02:27.290 align:start position:0% and so then you know you just Cascade down<00:02:25.560> this<00:02:25.800> sort<00:02:25.980> of<00:02:26.099> strategy<00:02:26.459> and<00:02:26.879> you<00:02:27.120> end 00:02:27.290 --> 00:02:27.300 align:start position:0% down this sort of strategy and you end 00:02:27.300 --> 00:02:28.430 align:start position:0% down this sort of strategy and you end up<00:02:27.360> with<00:02:27.540> the<00:02:27.660> situation<00:02:27.959> where<00:02:28.260> you're 00:02:28.430 --> 00:02:28.440 align:start position:0% up with the situation where you're 00:02:28.440 --> 00:02:32.630 align:start position:0% up with the situation where you're verifying<00:02:29.040> uh<00:02:29.580> one<00:02:30.060> uh<00:02:30.480> snark<00:02:31.040> proof<00:02:32.040> and<00:02:32.340> in 00:02:32.630 --> 00:02:32.640 align:start position:0% verifying uh one uh snark proof and in 00:02:32.640 --> 00:02:34.850 align:start position:0% verifying uh one uh snark proof and in that<00:02:32.819> it's<00:02:33.660> automatically<00:02:34.140> verifying<00:02:34.560> these 00:02:34.850 --> 00:02:34.860 align:start position:0% that it's automatically verifying these 00:02:34.860 --> 00:02:37.910 align:start position:0% that it's automatically verifying these n<00:02:35.040> items<00:02:35.459> of<00:02:35.580> knowledge<00:02:36.420> another<00:02:37.319> instance<00:02:37.739> of 00:02:37.910 --> 00:02:37.920 align:start position:0% n items of knowledge another instance of 00:02:37.920 --> 00:02:39.350 align:start position:0% n items of knowledge another instance of compression<00:02:38.340> that's<00:02:38.580> particularly<00:02:39.000> helpful 00:02:39.350 --> 00:02:39.360 align:start position:0% compression that's particularly helpful 00:02:39.360 --> 00:02:42.710 align:start position:0% compression that's particularly helpful to<00:02:39.480> point<00:02:39.660> out<00:02:39.840> is<00:02:40.819> the<00:02:41.819> setting<00:02:42.180> where<00:02:42.420> you 00:02:42.710 --> 00:02:42.720 align:start position:0% to point out is the setting where you 00:02:42.720 --> 00:02:44.990 align:start position:0% to point out is the setting where you want<00:02:42.959> to<00:02:43.560> compose<00:02:43.860> between<00:02:44.160> different<00:02:44.519> proof 00:02:44.990 --> 00:02:45.000 align:start position:0% want to compose between different proof 00:02:45.000 --> 00:02:47.570 align:start position:0% want to compose between different proof systems<00:02:45.360> or<00:02:45.480> arithmetizations<00:02:46.200> and<00:02:46.800> at<00:02:47.459> the 00:02:47.570 --> 00:02:47.580 align:start position:0% systems or arithmetizations and at the 00:02:47.580 --> 00:02:49.729 align:start position:0% systems or arithmetizations and at the time<00:02:47.700> also<00:02:48.420> pick<00:02:48.599> the<00:02:48.840> good<00:02:48.959> features<00:02:49.260> of<00:02:49.500> each 00:02:49.729 --> 00:02:49.739 align:start position:0% time also pick the good features of each 00:02:49.739 --> 00:02:51.890 align:start position:0% time also pick the good features of each of<00:02:49.920> them<00:02:50.040> so<00:02:50.700> for<00:02:50.940> instance<00:02:51.239> you<00:02:51.599> can<00:02:51.720> have 00:02:51.890 --> 00:02:51.900 align:start position:0% of them so for instance you can have 00:02:51.900 --> 00:02:53.390 align:start position:0% of them so for instance you can have some<00:02:52.260> setting<00:02:52.800> where<00:02:52.980> you<00:02:53.099> have<00:02:53.220> two 00:02:53.390 --> 00:02:53.400 align:start position:0% some setting where you have two 00:02:53.400 --> 00:02:55.490 align:start position:0% some setting where you have two different<00:02:53.580> proving<00:02:54.060> schemes<00:02:54.420> one<00:02:55.019> where<00:02:55.319> you 00:02:55.490 --> 00:02:55.500 align:start position:0% different proving schemes one where you 00:02:55.500 --> 00:02:57.350 align:start position:0% different proving schemes one where you have<00:02:55.620> a<00:02:55.739> fast<00:02:55.800> prover<00:02:56.160> but<00:02:56.760> unfortunately<00:02:57.180> the 00:02:57.350 --> 00:02:57.360 align:start position:0% have a fast prover but unfortunately the 00:02:57.360 --> 00:02:59.990 align:start position:0% have a fast prover but unfortunately the verifier<00:02:57.780> is<00:02:57.900> slow<00:02:58.140> and<00:02:58.980> another<00:02:59.220> where<00:02:59.640> the 00:02:59.990 --> 00:03:00.000 align:start position:0% verifier is slow and another where the 00:03:00.000 --> 00:03:02.030 align:start position:0% verifier is slow and another where the approver<00:03:00.360> is<00:03:00.599> lower<00:03:00.780> but<00:03:01.379> you<00:03:01.860> get<00:03:01.980> the 00:03:02.030 --> 00:03:02.040 align:start position:0% approver is lower but you get the 00:03:02.040 --> 00:03:03.949 align:start position:0% approver is lower but you get the trade-offs<00:03:02.459> that<00:03:02.519> the<00:03:02.580> verifier<00:03:02.940> is<00:03:03.060> fast<00:03:03.239> so 00:03:03.949 --> 00:03:03.959 align:start position:0% trade-offs that the verifier is fast so 00:03:03.959 --> 00:03:06.290 align:start position:0% trade-offs that the verifier is fast so using<00:03:04.440> recursion<00:03:04.980> you<00:03:05.519> can<00:03:05.580> compose<00:03:05.940> between 00:03:06.290 --> 00:03:06.300 align:start position:0% using recursion you can compose between 00:03:06.300 --> 00:03:08.089 align:start position:0% using recursion you can compose between the<00:03:06.720> proving<00:03:07.080> system<00:03:07.260> from<00:03:07.560> The<00:03:07.739> Wider 00:03:08.089 --> 00:03:08.099 align:start position:0% the proving system from The Wider 00:03:08.099 --> 00:03:10.850 align:start position:0% the proving system from The Wider setting<00:03:08.879> to<00:03:09.180> the<00:03:09.420> narrower<00:03:09.959> setting<00:03:10.379> and<00:03:10.739> get 00:03:10.850 --> 00:03:10.860 align:start position:0% setting to the narrower setting and get 00:03:10.860 --> 00:03:12.530 align:start position:0% setting to the narrower setting and get a<00:03:10.980> tiny<00:03:11.220> proof<00:03:11.459> output<00:03:11.760> as<00:03:12.239> well<00:03:12.420> as 00:03:12.530 --> 00:03:12.540 align:start position:0% a tiny proof output as well as 00:03:12.540 --> 00:03:14.570 align:start position:0% a tiny proof output as well as fast-provers<00:03:13.500> getting<00:03:13.920> sort<00:03:14.099> of<00:03:14.220> the<00:03:14.280> best<00:03:14.400> of 00:03:14.570 --> 00:03:14.580 align:start position:0% fast-provers getting sort of the best of 00:03:14.580 --> 00:03:16.670 align:start position:0% fast-provers getting sort of the best of the<00:03:14.700> Both<00:03:14.879> Worlds 00:03:16.670 --> 00:03:16.680 align:start position:0% the Both Worlds 00:03:16.680 --> 00:03:18.410 align:start position:0% the Both Worlds um a<00:03:16.920> concrete<00:03:17.280> sort<00:03:17.519> of<00:03:17.640> instantiation<00:03:18.180> of 00:03:18.410 --> 00:03:18.420 align:start position:0% um a concrete sort of instantiation of 00:03:18.420 --> 00:03:20.449 align:start position:0% um a concrete sort of instantiation of this<00:03:18.720> interoperability<00:03:19.500> is<00:03:19.980> the<00:03:20.159> setting 00:03:20.449 --> 00:03:20.459 align:start position:0% this interoperability is the setting 00:03:20.459 --> 00:03:22.910 align:start position:0% this interoperability is the setting which<00:03:20.580> starts<00:03:21.060> and<00:03:21.239> grot16<00:03:21.780> in<00:03:22.680> particular 00:03:22.910 --> 00:03:22.920 align:start position:0% which starts and grot16 in particular 00:03:22.920 --> 00:03:25.910 align:start position:0% which starts and grot16 in particular grads<00:03:23.459> grad<00:03:23.940> 16<00:03:24.120> is<00:03:24.599> very<00:03:24.900> cheap<00:03:25.319> to<00:03:25.500> verify 00:03:25.910 --> 00:03:25.920 align:start position:0% grads grad 16 is very cheap to verify 00:03:25.920 --> 00:03:28.729 align:start position:0% grads grad 16 is very cheap to verify whereas<00:03:26.519> Starks<00:03:26.879> are<00:03:27.060> very<00:03:27.480> easy<00:03:27.659> to<00:03:27.900> prove<00:03:28.200> so 00:03:28.729 --> 00:03:28.739 align:start position:0% whereas Starks are very easy to prove so 00:03:28.739 --> 00:03:30.530 align:start position:0% whereas Starks are very easy to prove so if<00:03:28.980> you<00:03:29.099> verify<00:03:29.400> a<00:03:29.519> stark<00:03:29.760> roof<00:03:30.000> inside<00:03:30.180> of<00:03:30.420> a 00:03:30.530 --> 00:03:30.540 align:start position:0% if you verify a stark roof inside of a 00:03:30.540 --> 00:03:32.330 align:start position:0% if you verify a stark roof inside of a graphics<00:03:30.900> scene<00:03:31.080> snark<00:03:31.440> you<00:03:31.739> end<00:03:31.860> up<00:03:31.980> with<00:03:32.159> a 00:03:32.330 --> 00:03:32.340 align:start position:0% graphics scene snark you end up with a 00:03:32.340 --> 00:03:34.130 align:start position:0% graphics scene snark you end up with a proof<00:03:32.819> of<00:03:32.940> the<00:03:33.060> original<00:03:33.180> statement<00:03:33.780> with<00:03:33.959> the 00:03:34.130 --> 00:03:34.140 align:start position:0% proof of the original statement with the 00:03:34.140 --> 00:03:35.990 align:start position:0% proof of the original statement with the fast-prover<00:03:34.620> as<00:03:34.920> well<00:03:35.099> as<00:03:35.220> a<00:03:35.340> fast<00:03:35.459> verifier 00:03:35.990 --> 00:03:36.000 align:start position:0% fast-prover as well as a fast verifier 00:03:36.000 --> 00:03:38.930 align:start position:0% fast-prover as well as a fast verifier so<00:03:36.959> generally<00:03:37.440> compression<00:03:38.040> has<00:03:38.459> this<00:03:38.760> sort 00:03:38.930 --> 00:03:38.940 align:start position:0% so generally compression has this sort 00:03:38.940 --> 00:03:41.330 align:start position:0% so generally compression has this sort of<00:03:39.060> property<00:03:39.360> that<00:03:39.599> is<00:03:39.720> very<00:03:39.900> mechanical<00:03:40.379> and 00:03:41.330 --> 00:03:41.340 align:start position:0% of property that is very mechanical and 00:03:41.340 --> 00:03:42.949 align:start position:0% of property that is very mechanical and usually<00:03:41.640> you're<00:03:41.819> rolling<00:03:42.180> up<00:03:42.299> some<00:03:42.540> giant 00:03:42.949 --> 00:03:42.959 align:start position:0% usually you're rolling up some giant 00:03:42.959 --> 00:03:45.410 align:start position:0% usually you're rolling up some giant list<00:03:43.140> of<00:03:43.379> computation<00:03:43.920> or<00:03:44.340> items<00:03:45.299> of 00:03:45.410 --> 00:03:45.420 align:start position:0% list of computation or items of 00:03:45.420 --> 00:03:48.170 align:start position:0% list of computation or items of knowledge<00:03:46.159> increment<00:03:47.159> into<00:03:47.459> a<00:03:47.700> single<00:03:47.940> proof 00:03:48.170 --> 00:03:48.180 align:start position:0% knowledge increment into a single proof 00:03:48.180 --> 00:03:50.330 align:start position:0% knowledge increment into a single proof so<00:03:49.019> just<00:03:49.140> to<00:03:49.319> give<00:03:49.379> a<00:03:49.560> flavor<00:03:49.799> for<00:03:50.040> sort<00:03:50.220> of 00:03:50.330 --> 00:03:50.340 align:start position:0% so just to give a flavor for sort of 00:03:50.340 --> 00:03:52.970 align:start position:0% so just to give a flavor for sort of what<00:03:50.459> applications<00:03:51.060> this<00:03:51.540> unlocks<00:03:52.080> let's 00:03:52.970 --> 00:03:52.980 align:start position:0% what applications this unlocks let's 00:03:52.980 --> 00:03:54.410 align:start position:0% what applications this unlocks let's look<00:03:53.220> at<00:03:53.340> things<00:03:53.519> that<00:03:53.760> are<00:03:53.940> interesting<00:03:54.299> to 00:03:54.410 --> 00:03:54.420 align:start position:0% look at things that are interesting to 00:03:54.420 --> 00:03:58.850 align:start position:0% look at things that are interesting to roll<00:03:54.659> up<00:03:55.220> so<00:03:56.220> first<00:03:56.640> is<00:03:56.879> signatures<00:03:57.680> over<00:03:58.680> the 00:03:58.850 --> 00:03:58.860 align:start position:0% roll up so first is signatures over the 00:03:58.860 --> 00:04:01.009 align:start position:0% roll up so first is signatures over the summer<00:03:59.040> we<00:03:59.280> built<00:03:59.519> applications<00:04:00.000> using<00:04:00.659> sort 00:04:01.009 --> 00:04:01.019 align:start position:0% summer we built applications using sort 00:04:01.019 --> 00:04:02.589 align:start position:0% summer we built applications using sort of<00:04:01.080> this<00:04:01.200> primitive<00:04:01.560> of<00:04:01.860> recursive 00:04:02.589 --> 00:04:02.599 align:start position:0% of this primitive of recursive 00:04:02.599 --> 00:04:04.729 align:start position:0% of this primitive of recursive compression<00:04:03.599> of<00:04:03.900> signatures<00:04:04.440> called 00:04:04.729 --> 00:04:04.739 align:start position:0% compression of signatures called 00:04:04.739 --> 00:04:07.610 align:start position:0% compression of signatures called isocratia<00:04:05.519> where<00:04:06.420> we<00:04:06.720> end<00:04:06.959> up<00:04:07.080> with<00:04:07.260> a<00:04:07.500> low 00:04:07.610 --> 00:04:07.620 align:start position:0% isocratia where we end up with a low 00:04:07.620 --> 00:04:10.550 align:start position:0% isocratia where we end up with a low trust<00:04:07.980> low<00:04:08.340> cost<00:04:08.640> sort<00:04:09.360> of<00:04:09.420> roll-up<00:04:10.140> of 00:04:10.550 --> 00:04:10.560 align:start position:0% trust low cost sort of roll-up of 00:04:10.560 --> 00:04:13.309 align:start position:0% trust low cost sort of roll-up of off-chain<00:04:11.040> modes<00:04:11.540> and<00:04:12.540> end<00:04:12.780> up<00:04:12.900> securing 00:04:13.309 --> 00:04:13.319 align:start position:0% off-chain modes and end up securing 00:04:13.319 --> 00:04:15.649 align:start position:0% off-chain modes and end up securing governance<00:04:13.860> and<00:04:14.700> then<00:04:14.760> more<00:04:15.000> related<00:04:15.360> to<00:04:15.540> sort 00:04:15.649 --> 00:04:15.659 align:start position:0% governance and then more related to sort 00:04:15.659 --> 00:04:18.110 align:start position:0% governance and then more related to sort of<00:04:15.720> blockchain<00:04:16.019> land<00:04:16.680> you<00:04:17.579> can<00:04:17.699> do<00:04:17.820> the<00:04:18.000> same 00:04:18.110 --> 00:04:18.120 align:start position:0% of blockchain land you can do the same 00:04:18.120 --> 00:04:20.990 align:start position:0% of blockchain land you can do the same kind<00:04:18.239> of<00:04:18.359> trick<00:04:18.660> with<00:04:18.840> light<00:04:19.680> climb<00:04:20.100> boots<00:04:20.220> and 00:04:20.990 --> 00:04:21.000 align:start position:0% kind of trick with light climb boots and 00:04:21.000 --> 00:04:23.330 align:start position:0% kind of trick with light climb boots and in<00:04:21.120> fact<00:04:21.239> plumo<00:04:21.780> which<00:04:22.380> is<00:04:22.560> solos<00:04:22.979> light 00:04:23.330 --> 00:04:23.340 align:start position:0% in fact plumo which is solos light 00:04:23.340 --> 00:04:25.310 align:start position:0% in fact plumo which is solos light client<00:04:23.699> is<00:04:23.820> based<00:04:24.060> on<00:04:24.180> this<00:04:24.300> sort<00:04:24.419> of<00:04:24.540> idea<00:04:24.840> and 00:04:25.310 --> 00:04:25.320 align:start position:0% client is based on this sort of idea and 00:04:25.320 --> 00:04:27.890 align:start position:0% client is based on this sort of idea and there's<00:04:25.440> also<00:04:25.740> another<00:04:25.860> group<00:04:26.419> named<00:04:27.419> Axiom 00:04:27.890 --> 00:04:27.900 align:start position:0% there's also another group named Axiom 00:04:27.900 --> 00:04:30.469 align:start position:0% there's also another group named Axiom which<00:04:28.080> is<00:04:28.139> exploring<00:04:28.560> sort<00:04:28.800> of<00:04:28.919> more<00:04:29.479> cooler 00:04:30.469 --> 00:04:30.479 align:start position:0% which is exploring sort of more cooler 00:04:30.479 --> 00:04:32.450 align:start position:0% which is exploring sort of more cooler use<00:04:30.660> cases<00:04:30.840> for<00:04:31.080> this<00:04:31.259> with<00:04:31.500> aggregating<00:04:32.100> and 00:04:32.450 --> 00:04:32.460 align:start position:0% use cases for this with aggregating and 00:04:32.460 --> 00:04:35.150 align:start position:0% use cases for this with aggregating and providing<00:04:33.120> historical<00:04:33.540> data<00:04:34.020> through<00:04:34.979> the 00:04:35.150 --> 00:04:35.160 align:start position:0% providing historical data through the 00:04:35.160 --> 00:04:37.969 align:start position:0% providing historical data through the use<00:04:35.280> of<00:04:35.460> recursive<00:04:35.940> snarks<00:04:36.560> and<00:04:37.560> then<00:04:37.680> finally 00:04:37.969 --> 00:04:37.979 align:start position:0% use of recursive snarks and then finally 00:04:37.979 --> 00:04:40.550 align:start position:0% use of recursive snarks and then finally the<00:04:38.340> sort<00:04:38.580> of<00:04:38.699> Hot<00:04:39.120> Topic<00:04:39.540> in<00:04:39.900> blockchain<00:04:40.320> land 00:04:40.550 --> 00:04:40.560 align:start position:0% the sort of Hot Topic in blockchain land 00:04:40.560 --> 00:04:42.350 align:start position:0% the sort of Hot Topic in blockchain land these<00:04:40.860> days<00:04:40.919> is<00:04:41.160> making<00:04:41.759> roll<00:04:42.000> ups<00:04:42.300> of 00:04:42.350 --> 00:04:42.360 align:start position:0% these days is making roll ups of 00:04:42.360 --> 00:04:44.629 align:start position:0% these days is making roll ups of transactions<00:04:42.960> two<00:04:43.800> particular<00:04:44.160> ones<00:04:44.520> that 00:04:44.629 --> 00:04:44.639 align:start position:0% transactions two particular ones that 00:04:44.639 --> 00:04:46.070 align:start position:0% transactions two particular ones that are<00:04:44.820> sort<00:04:44.940> of<00:04:45.060> interesting<00:04:45.419> to<00:04:45.540> point<00:04:45.660> out<00:04:45.780> are 00:04:46.070 --> 00:04:46.080 align:start position:0% are sort of interesting to point out are 00:04:46.080 --> 00:04:48.590 align:start position:0% are sort of interesting to point out are Mina<00:04:46.680> who<00:04:47.160> sort<00:04:47.280> of<00:04:47.340> use<00:04:47.520> this<00:04:47.820> recursion 00:04:48.590 --> 00:04:48.600 align:start position:0% Mina who sort of use this recursion 00:04:48.600 --> 00:04:50.629 align:start position:0% Mina who sort of use this recursion primitive<00:04:49.500> as<00:04:49.740> a<00:04:49.919> consensus<00:04:50.280> player 00:04:50.629 --> 00:04:50.639 align:start position:0% primitive as a consensus player 00:04:50.639 --> 00:04:54.110 align:start position:0% primitive as a consensus player primitive<00:04:51.419> and<00:04:52.139> polygon<00:04:52.860> Hermes<00:04:53.220> who<00:04:53.699> use<00:04:53.940> the 00:04:54.110 --> 00:04:54.120 align:start position:0% primitive and polygon Hermes who use the 00:04:54.120 --> 00:04:56.749 align:start position:0% primitive and polygon Hermes who use the exact<00:04:54.419> strategy<00:04:54.780> of<00:04:54.960> like<00:04:55.139> using<00:04:55.740> Starks<00:04:56.220> for 00:04:56.749 --> 00:04:56.759 align:start position:0% exact strategy of like using Starks for 00:04:56.759 --> 00:04:59.150 align:start position:0% exact strategy of like using Starks for fast-prover<00:04:57.300> settings<00:04:57.540> and<00:04:58.080> grad<00:04:58.740> 16<00:04:58.860> or 00:04:59.150 --> 00:04:59.160 align:start position:0% fast-prover settings and grad 16 or 00:04:59.160 --> 00:05:02.150 align:start position:0% fast-prover settings and grad 16 or snarks<00:04:59.759> for<00:05:00.000> fast<00:05:00.720> verification<00:05:01.199> settings 00:05:02.150 --> 00:05:02.160 align:start position:0% snarks for fast verification settings 00:05:02.160 --> 00:05:04.969 align:start position:0% snarks for fast verification settings next<00:05:02.880> let's<00:05:03.419> talk<00:05:03.600> about<00:05:03.780> composability<00:05:04.380> my 00:05:04.969 --> 00:05:04.979 align:start position:0% next let's talk about composability my 00:05:04.979 --> 00:05:06.710 align:start position:0% next let's talk about composability my personal<00:05:05.100> favorite<00:05:05.400> property<00:05:05.940> unlocked<00:05:06.600> by 00:05:06.710 --> 00:05:06.720 align:start position:0% personal favorite property unlocked by 00:05:06.720 --> 00:05:09.530 align:start position:0% personal favorite property unlocked by recursive<00:05:07.259> Snooks<00:05:07.759> so<00:05:08.759> to<00:05:08.880> give<00:05:09.060> some<00:05:09.240> context 00:05:09.530 --> 00:05:09.540 align:start position:0% recursive Snooks so to give some context 00:05:09.540 --> 00:05:11.930 align:start position:0% recursive Snooks so to give some context for<00:05:09.840> this<00:05:10.080> let's<00:05:10.500> take<00:05:10.680> a<00:05:10.800> step<00:05:10.979> back<00:05:11.160> let's 00:05:11.930 --> 00:05:11.940 align:start position:0% for this let's take a step back let's 00:05:11.940 --> 00:05:14.810 align:start position:0% for this let's take a step back let's think<00:05:12.120> about<00:05:12.240> what<00:05:12.720> a<00:05:13.259> normal<00:05:13.500> ZK<00:05:13.979> proof<00:05:14.400> uh 00:05:14.810 --> 00:05:14.820 align:start position:0% think about what a normal ZK proof uh 00:05:14.820 --> 00:05:16.189 align:start position:0% think about what a normal ZK proof uh you<00:05:15.000> know<00:05:15.120> what's<00:05:15.419> the<00:05:15.600> context<00:05:15.840> of<00:05:16.020> a<00:05:16.080> normal 00:05:16.189 --> 00:05:16.199 align:start position:0% you know what's the context of a normal 00:05:16.199 --> 00:05:17.870 align:start position:0% you know what's the context of a normal ziki<00:05:16.680> proof<00:05:16.860> we<00:05:17.220> usually<00:05:17.460> think<00:05:17.580> of<00:05:17.699> you<00:05:17.820> know 00:05:17.870 --> 00:05:17.880 align:start position:0% ziki proof we usually think of you know 00:05:17.880 --> 00:05:19.790 align:start position:0% ziki proof we usually think of you know DK<00:05:18.180> proofs<00:05:18.479> in<00:05:18.540> this<00:05:18.660> context<00:05:18.840> where<00:05:19.139> approver 00:05:19.790 --> 00:05:19.800 align:start position:0% DK proofs in this context where approver 00:05:19.800 --> 00:05:21.230 align:start position:0% DK proofs in this context where approver is<00:05:20.040> showing<00:05:20.280> knowledge<00:05:20.520> to<00:05:20.699> a<00:05:20.820> verifier 00:05:21.230 --> 00:05:21.240 align:start position:0% is showing knowledge to a verifier 00:05:21.240 --> 00:05:24.409 align:start position:0% is showing knowledge to a verifier without<00:05:22.139> revealing<00:05:22.860> the<00:05:23.100> underlying<00:05:23.639> fact<00:05:23.880> of 00:05:24.409 --> 00:05:24.419 align:start position:0% without revealing the underlying fact of 00:05:24.419 --> 00:05:27.230 align:start position:0% without revealing the underlying fact of the<00:05:24.600> knowledge<00:05:25.020> with<00:05:25.620> recursion<00:05:26.160> in<00:05:26.340> fact<00:05:26.460> you 00:05:27.230 --> 00:05:27.240 align:start position:0% the knowledge with recursion in fact you 00:05:27.240 --> 00:05:28.450 align:start position:0% the knowledge with recursion in fact you can<00:05:27.300> unlock<00:05:27.419> something<00:05:27.780> more<00:05:28.080> powerful 00:05:28.450 --> 00:05:28.460 align:start position:0% can unlock something more powerful 00:05:28.460 --> 00:05:30.469 align:start position:0% can unlock something more powerful approver<00:05:29.460> can<00:05:29.759> show<00:05:29.940> knowledge<00:05:30.240> to<00:05:30.360> a 00:05:30.469 --> 00:05:30.479 align:start position:0% approver can show knowledge to a 00:05:30.479 --> 00:05:33.170 align:start position:0% approver can show knowledge to a verifier<00:05:30.780> without<00:05:31.560> fully<00:05:32.220> knowing<00:05:32.580> the 00:05:33.170 --> 00:05:33.180 align:start position:0% verifier without fully knowing the 00:05:33.180 --> 00:05:35.810 align:start position:0% verifier without fully knowing the underlying<00:05:33.720> facts<00:05:34.380> themselves 00:05:35.810 --> 00:05:35.820 align:start position:0% underlying facts themselves 00:05:35.820 --> 00:05:38.150 align:start position:0% underlying facts themselves so<00:05:36.360> this<00:05:36.600> is<00:05:36.660> a<00:05:36.780> bit<00:05:36.840> hard<00:05:37.020> to<00:05:37.199> model<00:05:37.320> so<00:05:37.680> I'll 00:05:38.150 --> 00:05:38.160 align:start position:0% so this is a bit hard to model so I'll 00:05:38.160 --> 00:05:40.189 align:start position:0% so this is a bit hard to model so I'll just<00:05:38.400> lead<00:05:38.639> with<00:05:38.880> an<00:05:39.000> example<00:05:39.300> over<00:05:40.020> the 00:05:40.189 --> 00:05:40.199 align:start position:0% just lead with an example over the 00:05:40.199 --> 00:05:41.450 align:start position:0% just lead with an example over the summer<00:05:40.320> we<00:05:40.560> build<00:05:40.740> this<00:05:40.860> application<00:05:41.160> called 00:05:41.450 --> 00:05:41.460 align:start position:0% summer we build this application called 00:05:41.460 --> 00:05:44.510 align:start position:0% summer we build this application called eat<00:05:41.820> dos<00:05:42.360> which<00:05:43.199> is<00:05:43.380> a<00:05:43.740> dash<00:05:44.039> number<00:05:44.220> is<00:05:44.400> on 00:05:44.510 --> 00:05:44.520 align:start position:0% eat dos which is a dash number is on 00:05:44.520 --> 00:05:46.310 align:start position:0% eat dos which is a dash number is on social<00:05:44.639> graphs<00:05:45.000> so<00:05:45.419> these<00:05:45.660> social<00:05:45.780> graphs<00:05:46.199> are 00:05:46.310 --> 00:05:46.320 align:start position:0% social graphs so these social graphs are 00:05:46.320 --> 00:05:48.890 align:start position:0% social graphs so these social graphs are sort<00:05:46.620> of<00:05:46.740> graphs<00:05:47.340> of<00:05:47.520> relationships<00:05:48.479> of 00:05:48.890 --> 00:05:48.900 align:start position:0% sort of graphs of relationships of 00:05:48.900 --> 00:05:51.710 align:start position:0% sort of graphs of relationships of people<00:05:49.740> saying<00:05:50.220> I<00:05:50.520> am<00:05:50.699> your<00:05:50.880> friend<00:05:51.120> kinds<00:05:51.660> of 00:05:51.710 --> 00:05:51.720 align:start position:0% people saying I am your friend kinds of 00:05:51.720 --> 00:05:54.050 align:start position:0% people saying I am your friend kinds of things<00:05:52.039> and<00:05:53.039> for<00:05:53.280> instance<00:05:53.460> here<00:05:53.699> we<00:05:53.880> have 00:05:54.050 --> 00:05:54.060 align:start position:0% things and for instance here we have 00:05:54.060 --> 00:05:56.930 align:start position:0% things and for instance here we have this<00:05:54.180> graph<00:05:54.539> and<00:05:55.320> vitalik<00:05:55.919> sent<00:05:56.160> someone<00:05:56.520> who 00:05:56.930 --> 00:05:56.940 align:start position:0% this graph and vitalik sent someone who 00:05:56.940 --> 00:05:58.730 align:start position:0% this graph and vitalik sent someone who sends<00:05:57.300> someone<00:05:57.419> who<00:05:57.720> sends<00:05:58.020> someone<00:05:58.080> and 00:05:58.730 --> 00:05:58.740 align:start position:0% sends someone who sends someone and 00:05:58.740 --> 00:06:01.610 align:start position:0% sends someone who sends someone and finally<00:05:59.039> I<00:05:59.639> ended<00:05:59.880> up<00:06:00.000> with<00:06:00.180> a<00:06:00.780> four<00:06:01.259> degree 00:06:01.610 --> 00:06:01.620 align:start position:0% finally I ended up with a four degree 00:06:01.620 --> 00:06:04.249 align:start position:0% finally I ended up with a four degree path<00:06:01.860> to<00:06:02.160> vitalik<00:06:02.699> now<00:06:03.300> I<00:06:03.419> can<00:06:03.539> prove<00:06:03.780> that<00:06:03.960> I 00:06:04.249 --> 00:06:04.259 align:start position:0% path to vitalik now I can prove that I 00:06:04.259 --> 00:06:06.010 align:start position:0% path to vitalik now I can prove that I have<00:06:04.380> a<00:06:04.680> four<00:06:04.919> degree<00:06:05.160> path<00:06:05.400> of<00:06:05.580> italic 00:06:06.010 --> 00:06:06.020 align:start position:0% have a four degree path of italic 00:06:06.020 --> 00:06:08.629 align:start position:0% have a four degree path of italic without<00:06:07.020> reviewing<00:06:07.620> any<00:06:07.740> or<00:06:07.979> without<00:06:08.160> knowing 00:06:08.629 --> 00:06:08.639 align:start position:0% without reviewing any or without knowing 00:06:08.639 --> 00:06:10.850 align:start position:0% without reviewing any or without knowing any<00:06:08.880> of<00:06:09.060> the<00:06:09.180> intermediate<00:06:09.720> parties<00:06:10.560> in<00:06:10.740> this 00:06:10.850 --> 00:06:10.860 align:start position:0% any of the intermediate parties in this 00:06:10.860 --> 00:06:14.330 align:start position:0% any of the intermediate parties in this path<00:06:11.100> so<00:06:11.400> how<00:06:11.580> do<00:06:11.699> I<00:06:11.820> do<00:06:11.940> this<00:06:12.080> I<00:06:13.080> say<00:06:13.259> I<00:06:14.039> am<00:06:14.160> a 00:06:14.330 --> 00:06:14.340 align:start position:0% path so how do I do this I say I am a 00:06:14.340 --> 00:06:17.450 align:start position:0% path so how do I do this I say I am a friend<00:06:14.460> of<00:06:14.699> adhian<00:06:15.320> and<00:06:16.320> adyan<00:06:16.860> has<00:06:17.039> a<00:06:17.160> ZK 00:06:17.450 --> 00:06:17.460 align:start position:0% friend of adhian and adyan has a ZK 00:06:17.460 --> 00:06:19.070 align:start position:0% friend of adhian and adyan has a ZK proof<00:06:17.759> that<00:06:18.000> he<00:06:18.180> is<00:06:18.360> three<00:06:18.600> degrees<00:06:18.780> from 00:06:19.070 --> 00:06:19.080 align:start position:0% proof that he is three degrees from 00:06:19.080 --> 00:06:21.830 align:start position:0% proof that he is three degrees from italic<00:06:19.620> so<00:06:20.400> in<00:06:20.639> this<00:06:20.759> process<00:06:21.060> I<00:06:21.419> do<00:06:21.479> not<00:06:21.660> know 00:06:21.830 --> 00:06:21.840 align:start position:0% italic so in this process I do not know 00:06:21.840 --> 00:06:24.770 align:start position:0% italic so in this process I do not know the<00:06:22.199> three<00:06:22.560> degrees<00:06:22.740> that<00:06:23.460> precede<00:06:23.819> adyan<00:06:24.240> and 00:06:24.770 --> 00:06:24.780 align:start position:0% the three degrees that precede adyan and 00:06:24.780 --> 00:06:27.469 align:start position:0% the three degrees that precede adyan and I<00:06:25.020> have<00:06:25.139> still<00:06:25.380> convinced<00:06:26.039> any<00:06:26.280> external<00:06:26.819> as 00:06:27.469 --> 00:06:27.479 align:start position:0% I have still convinced any external as 00:06:27.479 --> 00:06:29.749 align:start position:0% I have still convinced any external as well<00:06:27.600> as<00:06:27.720> myself<00:06:27.840> that<00:06:28.680> there<00:06:28.979> is<00:06:29.160> a<00:06:29.400> valid 00:06:29.749 --> 00:06:29.759 align:start position:0% well as myself that there is a valid 00:06:29.759 --> 00:06:31.610 align:start position:0% well as myself that there is a valid path<00:06:30.060> of<00:06:30.300> four<00:06:30.479> degree<00:06:30.900> between<00:06:31.199> me<00:06:31.440> and 00:06:31.610 --> 00:06:31.620 align:start position:0% path of four degree between me and 00:06:31.620 --> 00:06:34.370 align:start position:0% path of four degree between me and vidalic<00:06:32.160> so<00:06:33.000> of<00:06:33.300> course<00:06:33.419> this<00:06:33.780> is<00:06:33.900> not<00:06:34.139> the 00:06:34.370 --> 00:06:34.380 align:start position:0% vidalic so of course this is not the 00:06:34.380 --> 00:06:36.350 align:start position:0% vidalic so of course this is not the only<00:06:34.440> application<00:06:34.919> you<00:06:35.160> can<00:06:35.280> build<00:06:35.699> um<00:06:35.759> in 00:06:36.350 --> 00:06:36.360 align:start position:0% only application you can build um in 00:06:36.360 --> 00:06:37.790 align:start position:0% only application you can build um in general<00:06:36.479> we<00:06:36.840> think<00:06:37.020> composability<00:06:37.560> is 00:06:37.790 --> 00:06:37.800 align:start position:0% general we think composability is 00:06:37.800 --> 00:06:40.129 align:start position:0% general we think composability is particularly<00:06:38.280> cool<00:06:38.759> to<00:06:39.000> think<00:06:39.180> of<00:06:39.300> in<00:06:39.600> sort<00:06:40.020> of 00:06:40.129 --> 00:06:40.139 align:start position:0% particularly cool to think of in sort of 00:06:40.139 --> 00:06:41.870 align:start position:0% particularly cool to think of in sort of incomplete<00:06:40.860> information<00:06:41.039> game<00:06:41.460> kinds<00:06:41.819> of 00:06:41.870 --> 00:06:41.880 align:start position:0% incomplete information game kinds of 00:06:41.880 --> 00:06:45.469 align:start position:0% incomplete information game kinds of settings<00:06:42.560> and<00:06:43.560> of<00:06:44.220> course<00:06:44.340> the<00:06:44.639> sort<00:06:45.180> of<00:06:45.300> very 00:06:45.469 --> 00:06:45.479 align:start position:0% settings and of course the sort of very 00:06:45.479 --> 00:06:47.270 align:start position:0% settings and of course the sort of very typical<00:06:45.780> example<00:06:46.139> the<00:06:46.440> the<00:06:46.680> phrase<00:06:47.100> starting 00:06:47.270 --> 00:06:47.280 align:start position:0% typical example the the phrase starting 00:06:47.280 --> 00:06:49.309 align:start position:0% typical example the the phrase starting point<00:06:47.460> we<00:06:47.759> thought<00:06:47.940> of<00:06:48.180> was<00:06:48.419> games<00:06:49.080> like 00:06:49.309 --> 00:06:49.319 align:start position:0% point we thought of was games like 00:06:49.319 --> 00:06:51.830 align:start position:0% point we thought of was games like telephone<00:06:49.560> or<00:06:50.100> Chinese<00:06:50.400> Whispers<00:06:51.000> where<00:06:51.360> you 00:06:51.830 --> 00:06:51.840 align:start position:0% telephone or Chinese Whispers where you 00:06:51.840 --> 00:06:53.330 align:start position:0% telephone or Chinese Whispers where you know<00:06:51.900> you<00:06:52.020> pass<00:06:52.199> a<00:06:52.380> word<00:06:52.500> around<00:06:52.800> or<00:06:53.160> something 00:06:53.330 --> 00:06:53.340 align:start position:0% know you pass a word around or something 00:06:53.340 --> 00:06:55.730 align:start position:0% know you pass a word around or something and<00:06:53.699> you<00:06:53.940> want<00:06:54.120> to<00:06:54.240> make<00:06:54.360> edits<00:06:54.780> to<00:06:54.900> it<00:06:55.080> uh 00:06:55.730 --> 00:06:55.740 align:start position:0% and you want to make edits to it uh 00:06:55.740 --> 00:06:58.070 align:start position:0% and you want to make edits to it uh incrementally<00:06:56.340> and<00:06:57.120> then<00:06:57.240> you<00:06:57.539> can<00:06:57.600> make<00:06:57.780> more 00:06:58.070 --> 00:06:58.080 align:start position:0% incrementally and then you can make more 00:06:58.080 --> 00:07:00.650 align:start position:0% incrementally and then you can make more complex<00:06:58.380> applications<00:06:58.860> like<00:06:59.819> party<00:07:00.360> games 00:07:00.650 --> 00:07:00.660 align:start position:0% complex applications like party games 00:07:00.660 --> 00:07:03.230 align:start position:0% complex applications like party games like<00:07:00.840> Mafia<00:07:01.319> those<00:07:01.919> kinds<00:07:02.160> of<00:07:02.220> things<00:07:02.340> and 00:07:03.230 --> 00:07:03.240 align:start position:0% like Mafia those kinds of things and 00:07:03.240 --> 00:07:04.610 align:start position:0% like Mafia those kinds of things and then<00:07:03.300> more<00:07:03.539> relevant<00:07:03.900> to<00:07:04.020> blockchain<00:07:04.380> land 00:07:04.610 --> 00:07:04.620 align:start position:0% then more relevant to blockchain land 00:07:04.620 --> 00:07:06.890 align:start position:0% then more relevant to blockchain land you<00:07:05.160> can<00:07:05.280> build<00:07:05.400> private<00:07:05.880> State<00:07:06.060> channels<00:07:06.539> and 00:07:06.890 --> 00:07:06.900 align:start position:0% you can build private State channels and 00:07:06.900 --> 00:07:09.529 align:start position:0% you can build private State channels and roll<00:07:07.740> ups<00:07:08.160> of<00:07:08.280> that<00:07:08.460> sort 00:07:09.529 --> 00:07:09.539 align:start position:0% roll ups of that sort 00:07:09.539 --> 00:07:13.010 align:start position:0% roll ups of that sort so<00:07:10.380> now<00:07:10.560> that<00:07:10.800> we<00:07:10.979> have<00:07:11.160> some<00:07:11.639> intuition<00:07:12.360> for 00:07:13.010 --> 00:07:13.020 align:start position:0% so now that we have some intuition for 00:07:13.020 --> 00:07:15.590 align:start position:0% so now that we have some intuition for the<00:07:13.380> high<00:07:13.620> level<00:07:13.800> properties<00:07:14.639> of<00:07:15.120> recursive 00:07:15.590 --> 00:07:15.600 align:start position:0% the high level properties of recursive 00:07:15.600 --> 00:07:18.230 align:start position:0% the high level properties of recursive proofs<00:07:15.960> and<00:07:16.740> now<00:07:16.919> that<00:07:17.100> we've<00:07:17.340> seen<00:07:17.699> some 00:07:18.230 --> 00:07:18.240 align:start position:0% proofs and now that we've seen some 00:07:18.240 --> 00:07:21.050 align:start position:0% proofs and now that we've seen some classes<00:07:18.900> of<00:07:19.080> applications<00:07:19.620> that<00:07:20.460> are<00:07:20.580> enabled 00:07:21.050 --> 00:07:21.060 align:start position:0% classes of applications that are enabled 00:07:21.060 --> 00:07:23.330 align:start position:0% classes of applications that are enabled by<00:07:21.240> them<00:07:21.479> you<00:07:22.319> might<00:07:22.500> be<00:07:22.740> feeling<00:07:22.979> that 00:07:23.330 --> 00:07:23.340 align:start position:0% by them you might be feeling that 00:07:23.340 --> 00:07:24.830 align:start position:0% by them you might be feeling that recursive<00:07:23.819> proofs<00:07:24.180> are<00:07:24.419> kind<00:07:24.720> of 00:07:24.830 --> 00:07:24.840 align:start position:0% recursive proofs are kind of 00:07:24.840 --> 00:07:27.290 align:start position:0% recursive proofs are kind of unreasonable<00:07:25.560> we<00:07:26.520> get<00:07:26.699> unlimited 00:07:27.290 --> 00:07:27.300 align:start position:0% unreasonable we get unlimited 00:07:27.300 --> 00:07:29.930 align:start position:0% unreasonable we get unlimited compression<00:07:28.020> and<00:07:28.319> compostability 00:07:29.930 --> 00:07:29.940 align:start position:0% compression and compostability 00:07:29.940 --> 00:07:32.930 align:start position:0% compression and compostability so<00:07:30.660> I<00:07:31.319> guess<00:07:31.440> the<00:07:31.620> natural<00:07:31.860> question<00:07:32.280> now<00:07:32.639> is 00:07:32.930 --> 00:07:32.940 align:start position:0% so I guess the natural question now is 00:07:32.940 --> 00:07:36.350 align:start position:0% so I guess the natural question now is how<00:07:33.720> do<00:07:33.840> we<00:07:34.020> Implement<00:07:34.440> and<00:07:34.800> construct<00:07:35.360> these 00:07:36.350 --> 00:07:36.360 align:start position:0% how do we Implement and construct these 00:07:36.360 --> 00:07:38.270 align:start position:0% how do we Implement and construct these systems 00:07:38.270 --> 00:07:38.280 align:start position:0% systems 00:07:38.280 --> 00:07:41.990 align:start position:0% systems so<00:07:39.060> right<00:07:39.360> now<00:07:39.539> there's<00:07:40.460> broadly<00:07:41.460> three 00:07:41.990 --> 00:07:42.000 align:start position:0% so right now there's broadly three 00:07:42.000 --> 00:07:44.330 align:start position:0% so right now there's broadly three classes<00:07:42.660> of<00:07:43.139> recursive<00:07:43.680> proofs<00:07:44.039> in 00:07:44.330 --> 00:07:44.340 align:start position:0% classes of recursive proofs in 00:07:44.340 --> 00:07:47.450 align:start position:0% classes of recursive proofs in production<00:07:44.780> and<00:07:45.780> as<00:07:46.199> we<00:07:46.440> descend<00:07:47.039> the 00:07:47.450 --> 00:07:47.460 align:start position:0% production and as we descend the 00:07:47.460 --> 00:07:50.270 align:start position:0% production and as we descend the hierarchy<00:07:48.000> we<00:07:48.900> are<00:07:49.080> relaxing<00:07:49.860> the 00:07:50.270 --> 00:07:50.280 align:start position:0% hierarchy we are relaxing the 00:07:50.280 --> 00:07:53.629 align:start position:0% hierarchy we are relaxing the requirements<00:07:51.000> on<00:07:51.660> the<00:07:51.780> proof<00:07:52.080> systems<00:07:52.639> which 00:07:53.629 --> 00:07:53.639 align:start position:0% requirements on the proof systems which 00:07:53.639 --> 00:07:57.770 align:start position:0% requirements on the proof systems which are<00:07:53.819> eligible<00:07:54.380> for<00:07:55.580> recursive<00:07:56.580> schemes 00:07:57.770 --> 00:07:57.780 align:start position:0% are eligible for recursive schemes 00:07:57.780 --> 00:08:00.950 align:start position:0% are eligible for recursive schemes so<00:07:58.319> at<00:07:58.560> the<00:07:58.740> very<00:07:58.919> top<00:07:59.160> of<00:07:59.520> the<00:07:59.639> hierarchy<00:08:00.120> we 00:08:00.950 --> 00:08:00.960 align:start position:0% so at the very top of the hierarchy we 00:08:00.960 --> 00:08:02.450 align:start position:0% so at the very top of the hierarchy we have<00:08:01.139> really<00:08:01.440> the<00:08:01.740> most<00:08:01.919> stringent 00:08:02.450 --> 00:08:02.460 align:start position:0% have really the most stringent 00:08:02.460 --> 00:08:05.510 align:start position:0% have really the most stringent requirements<00:08:03.300> so<00:08:03.840> we<00:08:04.139> we<00:08:04.319> need<00:08:04.560> proof<00:08:04.979> systems 00:08:05.510 --> 00:08:05.520 align:start position:0% requirements so we we need proof systems 00:08:05.520 --> 00:08:08.870 align:start position:0% requirements so we we need proof systems with<00:08:05.960> verifiers<00:08:06.960> that<00:08:07.380> are<00:08:07.560> sub-linear<00:08:08.220> that 00:08:08.870 --> 00:08:08.880 align:start position:0% with verifiers that are sub-linear that 00:08:08.880 --> 00:08:11.150 align:start position:0% with verifiers that are sub-linear that are<00:08:09.060> succinct<00:08:09.599> in<00:08:10.440> the<00:08:10.620> size<00:08:10.800> of<00:08:11.039> the 00:08:11.150 --> 00:08:11.160 align:start position:0% are succinct in the size of the 00:08:11.160 --> 00:08:14.210 align:start position:0% are succinct in the size of the statement<00:08:11.400> being<00:08:11.699> proven<00:08:12.259> and<00:08:13.259> this<00:08:13.680> enables 00:08:14.210 --> 00:08:14.220 align:start position:0% statement being proven and this enables 00:08:14.220 --> 00:08:17.029 align:start position:0% statement being proven and this enables us<00:08:14.400> to<00:08:14.699> do<00:08:14.880> full<00:08:15.300> recursion<00:08:15.960> at<00:08:16.800> every 00:08:17.029 --> 00:08:17.039 align:start position:0% us to do full recursion at every 00:08:17.039 --> 00:08:18.650 align:start position:0% us to do full recursion at every recursive<00:08:17.639> step 00:08:18.650 --> 00:08:18.660 align:start position:0% recursive step 00:08:18.660 --> 00:08:22.309 align:start position:0% recursive step so<00:08:19.500> this<00:08:19.979> has<00:08:20.160> been<00:08:20.340> implemented<00:08:21.000> for<00:08:21.660> the 00:08:22.309 --> 00:08:22.319 align:start position:0% so this has been implemented for the 00:08:22.319 --> 00:08:27.589 align:start position:0% so this has been implemented for the growth<00:08:22.680> 16<00:08:23.039> and<00:08:23.759> Fry<00:08:24.740> priv<00:08:25.740> systems 00:08:27.589 --> 00:08:27.599 align:start position:0% growth 16 and Fry priv systems 00:08:27.599 --> 00:08:31.129 align:start position:0% growth 16 and Fry priv systems so<00:08:28.259> if<00:08:28.620> we<00:08:28.860> relax<00:08:29.280> our<00:08:29.940> requirements<00:08:30.660> a<00:08:31.020> little 00:08:31.129 --> 00:08:31.139 align:start position:0% so if we relax our requirements a little 00:08:31.139 --> 00:08:35.510 align:start position:0% so if we relax our requirements a little bit<00:08:31.760> and<00:08:32.760> we<00:08:33.120> say<00:08:33.360> even<00:08:34.260> if<00:08:34.560> we<00:08:34.800> don't<00:08:34.919> have<00:08:35.279> a 00:08:35.510 --> 00:08:35.520 align:start position:0% bit and we say even if we don't have a 00:08:35.520 --> 00:08:37.190 align:start position:0% bit and we say even if we don't have a succinct<00:08:35.940> verifier 00:08:37.190 --> 00:08:37.200 align:start position:0% succinct verifier 00:08:37.200 --> 00:08:40.070 align:start position:0% succinct verifier maybe<00:08:37.979> we're<00:08:38.399> happy<00:08:38.640> enough<00:08:38.940> just<00:08:39.479> with<00:08:39.839> a 00:08:40.070 --> 00:08:40.080 align:start position:0% maybe we're happy enough just with a 00:08:40.080 --> 00:08:43.790 align:start position:0% maybe we're happy enough just with a succinct<00:08:40.500> accumulator<00:08:41.479> so<00:08:42.479> intuitively<00:08:43.440> what 00:08:43.790 --> 00:08:43.800 align:start position:0% succinct accumulator so intuitively what 00:08:43.800 --> 00:08:46.389 align:start position:0% succinct accumulator so intuitively what this<00:08:44.039> means<00:08:44.399> is<00:08:44.820> that<00:08:45.120> we<00:08:45.420> want<00:08:45.600> a<00:08:45.899> verifier 00:08:46.389 --> 00:08:46.399 align:start position:0% this means is that we want a verifier 00:08:46.399 --> 00:08:50.210 align:start position:0% this means is that we want a verifier with<00:08:47.399> this<00:08:47.760> shape<00:08:48.320> that<00:08:49.320> they<00:08:49.560> have<00:08:49.800> a 00:08:50.210 --> 00:08:50.220 align:start position:0% with this shape that they have a 00:08:50.220 --> 00:08:53.150 align:start position:0% with this shape that they have a succinct<00:08:50.700> check<00:08:51.060> a<00:08:51.540> cheap<00:08:51.720> check<00:08:52.040> and<00:08:53.040> then 00:08:53.150 --> 00:08:53.160 align:start position:0% succinct check a cheap check and then 00:08:53.160 --> 00:08:55.250 align:start position:0% succinct check a cheap check and then separately<00:08:53.700> they<00:08:54.060> have<00:08:54.180> an<00:08:54.480> expensive<00:08:54.959> check 00:08:55.250 --> 00:08:55.260 align:start position:0% separately they have an expensive check 00:08:55.260 --> 00:08:59.150 align:start position:0% separately they have an expensive check and<00:08:56.220> so<00:08:56.459> here<00:08:56.880> we<00:08:57.300> can<00:08:57.480> instantiate<00:08:58.200> an<00:08:58.680> atomic 00:08:59.150 --> 00:08:59.160 align:start position:0% and so here we can instantiate an atomic 00:08:59.160 --> 00:09:01.970 align:start position:0% and so here we can instantiate an atomic accumulator<00:08:59.720> and<00:09:00.720> at<00:09:00.959> each<00:09:01.200> recursive<00:09:01.740> step 00:09:01.970 --> 00:09:01.980 align:start position:0% accumulator and at each recursive step 00:09:01.980 --> 00:09:05.410 align:start position:0% accumulator and at each recursive step we<00:09:02.580> only<00:09:02.820> perform<00:09:03.420> the<00:09:03.839> succinct<00:09:04.320> checks 00:09:05.410 --> 00:09:05.420 align:start position:0% we only perform the succinct checks 00:09:05.420 --> 00:09:10.009 align:start position:0% we only perform the succinct checks and<00:09:06.420> we<00:09:07.260> accumulate<00:09:08.120> the<00:09:09.120> expensive<00:09:09.720> check 00:09:10.009 --> 00:09:10.019 align:start position:0% and we accumulate the expensive check 00:09:10.019 --> 00:09:14.030 align:start position:0% and we accumulate the expensive check and<00:09:10.680> delay<00:09:11.339> checking<00:09:12.060> it<00:09:12.240> until<00:09:12.839> the<00:09:13.320> end<00:09:13.560> of<00:09:13.800> a 00:09:14.030 --> 00:09:14.040 align:start position:0% and delay checking it until the end of a 00:09:14.040 --> 00:09:16.970 align:start position:0% and delay checking it until the end of a long<00:09:14.459> batch<00:09:14.820> of<00:09:15.060> proofs<00:09:15.420> and<00:09:16.380> doing<00:09:16.680> this 00:09:16.970 --> 00:09:16.980 align:start position:0% long batch of proofs and doing this 00:09:16.980 --> 00:09:20.269 align:start position:0% long batch of proofs and doing this gives<00:09:17.399> us<00:09:18.140> amortization<00:09:19.140> of<00:09:19.680> the<00:09:19.800> expensive 00:09:20.269 --> 00:09:20.279 align:start position:0% gives us amortization of the expensive 00:09:20.279 --> 00:09:25.070 align:start position:0% gives us amortization of the expensive check<00:09:20.779> and<00:09:21.779> finally<00:09:22.260> if<00:09:22.740> we<00:09:22.920> relax<00:09:23.339> even<00:09:24.060> more 00:09:25.070 --> 00:09:25.080 align:start position:0% check and finally if we relax even more 00:09:25.080 --> 00:09:28.310 align:start position:0% check and finally if we relax even more um<00:09:25.200> we<00:09:25.920> don't<00:09:26.040> even<00:09:26.339> require<00:09:26.839> a<00:09:27.839> succinct 00:09:28.310 --> 00:09:28.320 align:start position:0% um we don't even require a succinct 00:09:28.320 --> 00:09:30.410 align:start position:0% um we don't even require a succinct accumulator<00:09:28.800> well<00:09:29.339> now<00:09:29.700> we're<00:09:29.940> just<00:09:30.120> happy 00:09:30.410 --> 00:09:30.420 align:start position:0% accumulator well now we're just happy 00:09:30.420 --> 00:09:34.190 align:start position:0% accumulator well now we're just happy with<00:09:30.959> a<00:09:31.500> succinct<00:09:31.920> public<00:09:32.279> accumulator<00:09:33.200> and 00:09:34.190 --> 00:09:34.200 align:start position:0% with a succinct public accumulator and 00:09:34.200 --> 00:09:37.210 align:start position:0% with a succinct public accumulator and the<00:09:34.740> idea<00:09:35.040> behind<00:09:35.580> this<00:09:35.940> split<00:09:36.480> accumulation 00:09:37.210 --> 00:09:37.220 align:start position:0% the idea behind this split accumulation 00:09:37.220 --> 00:09:40.190 align:start position:0% the idea behind this split accumulation is<00:09:38.220> simply<00:09:38.519> that<00:09:39.000> you<00:09:39.600> split<00:09:40.019> your 00:09:40.190 --> 00:09:40.200 align:start position:0% is simply that you split your 00:09:40.200 --> 00:09:42.110 align:start position:0% is simply that you split your accumulator<00:09:40.620> into<00:09:41.040> a<00:09:41.339> public<00:09:41.459> and<00:09:41.760> private 00:09:42.110 --> 00:09:42.120 align:start position:0% accumulator into a public and private 00:09:42.120 --> 00:09:46.009 align:start position:0% accumulator into a public and private part<00:09:42.380> and<00:09:43.380> the<00:09:43.560> public<00:09:43.680> part<00:09:44.100> is<00:09:44.519> short<00:09:45.060> and 00:09:46.009 --> 00:09:46.019 align:start position:0% part and the public part is short and 00:09:46.019 --> 00:09:48.230 align:start position:0% part and the public part is short and this<00:09:46.320> is<00:09:46.440> what<00:09:46.800> we<00:09:46.980> accumulate<00:09:47.640> at<00:09:48.000> each 00:09:48.230 --> 00:09:48.240 align:start position:0% this is what we accumulate at each 00:09:48.240 --> 00:09:50.150 align:start position:0% this is what we accumulate at each recursive<00:09:48.779> step 00:09:50.150 --> 00:09:50.160 align:start position:0% recursive step 00:09:50.160 --> 00:09:52.310 align:start position:0% recursive step um<00:09:50.220> where<00:09:50.880> whereas<00:09:51.420> we<00:09:51.660> delay<00:09:52.019> the 00:09:52.310 --> 00:09:52.320 align:start position:0% um where whereas we delay the 00:09:52.320 --> 00:09:54.590 align:start position:0% um where whereas we delay the verification<00:09:52.860> of<00:09:53.279> the<00:09:53.519> private<00:09:53.880> part<00:09:54.180> of<00:09:54.480> the 00:09:54.590 --> 00:09:54.600 align:start position:0% verification of the private part of the 00:09:54.600 --> 00:09:58.670 align:start position:0% verification of the private part of the accumulator<00:09:55.220> until<00:09:56.220> the<00:09:56.459> very<00:09:56.640> end<00:09:56.899> so<00:09:57.899> let's 00:09:58.670 --> 00:09:58.680 align:start position:0% accumulator until the very end so let's 00:09:58.680 --> 00:10:02.150 align:start position:0% accumulator until the very end so let's go<00:09:59.040> through<00:09:59.779> these<00:10:00.779> constructions<00:10:01.560> at<00:10:01.920> a<00:10:02.040> high 00:10:02.150 --> 00:10:02.160 align:start position:0% go through these constructions at a high 00:10:02.160 --> 00:10:04.970 align:start position:0% go through these constructions at a high level<00:10:02.339> one<00:10:03.180> by<00:10:03.360> one<00:10:03.540> just<00:10:04.080> so<00:10:04.260> you<00:10:04.500> can<00:10:04.620> see<00:10:04.800> the 00:10:04.970 --> 00:10:04.980 align:start position:0% level one by one just so you can see the 00:10:04.980 --> 00:10:08.930 align:start position:0% level one by one just so you can see the shape<00:10:05.399> of<00:10:05.880> it<00:10:06.120> so<00:10:07.019> probably<00:10:07.500> the<00:10:08.339> cleanest 00:10:08.930 --> 00:10:08.940 align:start position:0% shape of it so probably the cleanest 00:10:08.940 --> 00:10:12.650 align:start position:0% shape of it so probably the cleanest shape<00:10:09.600> is<00:10:10.380> the<00:10:11.220> the<00:10:11.459> cleanest<00:10:11.940> shape<00:10:12.180> would<00:10:12.480> be 00:10:12.650 --> 00:10:12.660 align:start position:0% shape is the the cleanest shape would be 00:10:12.660 --> 00:10:14.690 align:start position:0% shape is the the cleanest shape would be full<00:10:13.019> recursion<00:10:13.680> so 00:10:14.690 --> 00:10:14.700 align:start position:0% full recursion so 00:10:14.700 --> 00:10:17.449 align:start position:0% full recursion so over<00:10:15.240> here<00:10:15.480> we<00:10:15.839> start<00:10:16.080> with<00:10:16.560> our<00:10:16.920> application 00:10:17.449 --> 00:10:17.459 align:start position:0% over here we start with our application 00:10:17.459 --> 00:10:21.350 align:start position:0% over here we start with our application circuit<00:10:18.260> and<00:10:19.260> it's<00:10:19.620> f 00:10:21.350 --> 00:10:21.360 align:start position:0% circuit and it's f 00:10:21.360 --> 00:10:22.070 align:start position:0% circuit and it's f um 00:10:22.070 --> 00:10:22.080 align:start position:0% um 00:10:22.080 --> 00:10:26.449 align:start position:0% um F<00:10:22.620> of<00:10:23.240> w-i-z-i<00:10:24.240> gives<00:10:25.140> you<00:10:25.380> z<00:10:25.680> i<00:10:25.920> plus<00:10:26.100> one 00:10:26.449 --> 00:10:26.459 align:start position:0% F of w-i-z-i gives you z i plus one 00:10:26.459 --> 00:10:29.389 align:start position:0% F of w-i-z-i gives you z i plus one right<00:10:27.240> it's<00:10:27.540> a<00:10:27.779> normal<00:10:28.019> relation 00:10:29.389 --> 00:10:29.399 align:start position:0% right it's a normal relation 00:10:29.399 --> 00:10:32.870 align:start position:0% right it's a normal relation now<00:10:29.880> we<00:10:30.360> bundle<00:10:30.779> that<00:10:31.019> together<00:10:31.440> with<00:10:32.279> a 00:10:32.870 --> 00:10:32.880 align:start position:0% now we bundle that together with a 00:10:32.880 --> 00:10:34.550 align:start position:0% now we bundle that together with a recursive<00:10:33.420> verifier 00:10:34.550 --> 00:10:34.560 align:start position:0% recursive verifier 00:10:34.560 --> 00:10:35.930 align:start position:0% recursive verifier and 00:10:35.930 --> 00:10:35.940 align:start position:0% and 00:10:35.940 --> 00:10:38.870 align:start position:0% and um<00:10:36.300> basically<00:10:37.260> this<00:10:37.680> recursive<00:10:38.220> verifier 00:10:38.870 --> 00:10:38.880 align:start position:0% um basically this recursive verifier 00:10:38.880 --> 00:10:41.930 align:start position:0% um basically this recursive verifier takes<00:10:39.420> in<00:10:39.720> a<00:10:40.680> proof<00:10:41.040> instance<00:10:41.459> that<00:10:41.760> was 00:10:41.930 --> 00:10:41.940 align:start position:0% takes in a proof instance that was 00:10:41.940 --> 00:10:44.750 align:start position:0% takes in a proof instance that was produced<00:10:42.480> by<00:10:42.899> the<00:10:43.200> previous<00:10:43.320> instance<00:10:44.040> of<00:10:44.579> the 00:10:44.750 --> 00:10:44.760 align:start position:0% produced by the previous instance of the 00:10:44.760 --> 00:10:47.690 align:start position:0% produced by the previous instance of the recursive<00:10:45.300> circuit<00:10:45.779> and<00:10:46.620> so<00:10:46.800> if<00:10:47.100> if<00:10:47.220> we<00:10:47.459> look 00:10:47.690 --> 00:10:47.700 align:start position:0% recursive circuit and so if if we look 00:10:47.700 --> 00:10:50.870 align:start position:0% recursive circuit and so if if we look forward<00:10:48.200> we<00:10:49.200> we<00:10:49.440> need<00:10:49.680> to<00:10:49.860> generate<00:10:50.339> a<00:10:50.579> proof 00:10:50.870 --> 00:10:50.880 align:start position:0% forward we we need to generate a proof 00:10:50.880 --> 00:10:53.870 align:start position:0% forward we we need to generate a proof of<00:10:51.060> the<00:10:51.360> whole<00:10:51.660> recursive<00:10:52.320> circuit<00:10:52.800> in<00:10:53.760> order 00:10:53.870 --> 00:10:53.880 align:start position:0% of the whole recursive circuit in order 00:10:53.880 --> 00:10:57.110 align:start position:0% of the whole recursive circuit in order to<00:10:54.240> input<00:10:54.600> to<00:10:54.899> the<00:10:55.079> next<00:10:55.200> recursive<00:10:55.860> instance 00:10:57.110 --> 00:10:57.120 align:start position:0% to input to the next recursive instance 00:10:57.120 --> 00:10:59.569 align:start position:0% to input to the next recursive instance so<00:10:57.660> in<00:10:57.779> this<00:10:58.019> way<00:10:58.200> we're<00:10:58.500> chaining<00:10:59.040> recursive 00:10:59.569 --> 00:10:59.579 align:start position:0% so in this way we're chaining recursive 00:10:59.579 --> 00:11:01.970 align:start position:0% so in this way we're chaining recursive circuits<00:11:00.060> and<00:11:00.480> at<00:11:00.660> each<00:11:00.779> step<00:11:00.959> we<00:11:01.320> are<00:11:01.500> fully 00:11:01.970 --> 00:11:01.980 align:start position:0% circuits and at each step we are fully 00:11:01.980 --> 00:11:05.690 align:start position:0% circuits and at each step we are fully verifying<00:11:02.700> the<00:11:03.480> previous<00:11:03.600> instance<00:11:04.399> and<00:11:05.399> when 00:11:05.690 --> 00:11:05.700 align:start position:0% verifying the previous instance and when 00:11:05.700 --> 00:11:09.470 align:start position:0% verifying the previous instance and when we<00:11:05.820> get<00:11:06.060> to<00:11:06.360> the<00:11:06.720> final<00:11:07.100> verifier<00:11:08.240> we<00:11:09.240> no 00:11:09.470 --> 00:11:09.480 align:start position:0% we get to the final verifier we no 00:11:09.480 --> 00:11:11.870 align:start position:0% we get to the final verifier we no longer<00:11:09.720> need<00:11:10.079> to<00:11:10.380> bundle<00:11:11.220> it<00:11:11.399> with<00:11:11.700> the 00:11:11.870 --> 00:11:11.880 align:start position:0% longer need to bundle it with the 00:11:11.880 --> 00:11:14.150 align:start position:0% longer need to bundle it with the applications<00:11:12.300> are<00:11:12.720> getting<00:11:12.899> here<00:11:13.380> we<00:11:14.040> can 00:11:14.150 --> 00:11:14.160 align:start position:0% applications are getting here we can 00:11:14.160 --> 00:11:17.210 align:start position:0% applications are getting here we can just<00:11:14.399> perform<00:11:14.760> a<00:11:15.720> final<00:11:15.959> verification<00:11:16.740> of<00:11:17.100> the 00:11:17.210 --> 00:11:17.220 align:start position:0% just perform a final verification of the 00:11:17.220 --> 00:11:19.730 align:start position:0% just perform a final verification of the proof<00:11:17.640> outside<00:11:18.120> the<00:11:18.420> circuit<00:11:18.839> so<00:11:19.380> this<00:11:19.620> is 00:11:19.730 --> 00:11:19.740 align:start position:0% proof outside the circuit so this is 00:11:19.740 --> 00:11:24.050 align:start position:0% proof outside the circuit so this is full<00:11:19.920> recursion<00:11:21.000> is<00:11:21.660> is<00:11:22.019> the<00:11:22.260> cleanest<00:11:22.560> API 00:11:24.050 --> 00:11:24.060 align:start position:0% full recursion is is the cleanest API 00:11:24.060 --> 00:11:24.650 align:start position:0% full recursion is is the cleanest API um 00:11:24.650 --> 00:11:24.660 align:start position:0% um 00:11:24.660 --> 00:11:27.769 align:start position:0% um now<00:11:25.320> we're<00:11:25.620> gonna<00:11:25.800> get<00:11:26.100> slightly<00:11:26.700> more<00:11:27.360> messy 00:11:27.769 --> 00:11:27.779 align:start position:0% now we're gonna get slightly more messy 00:11:27.779 --> 00:11:31.610 align:start position:0% now we're gonna get slightly more messy and<00:11:28.140> we're<00:11:28.320> gonna<00:11:28.500> relax<00:11:28.980> our<00:11:29.880> requirements 00:11:31.610 --> 00:11:31.620 align:start position:0% and we're gonna relax our requirements 00:11:31.620 --> 00:11:34.730 align:start position:0% and we're gonna relax our requirements um<00:11:31.740> to<00:11:31.980> get<00:11:32.160> an<00:11:32.519> atomic<00:11:33.000> accumulation<00:11:33.660> scheme 00:11:34.730 --> 00:11:34.740 align:start position:0% um to get an atomic accumulation scheme 00:11:34.740 --> 00:11:38.750 align:start position:0% um to get an atomic accumulation scheme so<00:11:35.339> now<00:11:36.060> if<00:11:36.420> you<00:11:36.600> recall<00:11:37.140> here<00:11:37.620> an<00:11:38.100> atomic 00:11:38.750 --> 00:11:38.760 align:start position:0% so now if you recall here an atomic 00:11:38.760 --> 00:11:42.290 align:start position:0% so now if you recall here an atomic accumulation<00:11:39.480> scheme<00:11:40.079> our<00:11:40.860> verifier<00:11:41.519> is<00:11:42.060> not 00:11:42.290 --> 00:11:42.300 align:start position:0% accumulation scheme our verifier is not 00:11:42.300 --> 00:11:46.670 align:start position:0% accumulation scheme our verifier is not sublinear<00:11:43.079> so<00:11:43.920> in<00:11:44.339> fact<00:11:44.519> the<00:11:45.420> verifier<00:11:46.019> inside 00:11:46.670 --> 00:11:46.680 align:start position:0% sublinear so in fact the verifier inside 00:11:46.680 --> 00:11:49.790 align:start position:0% sublinear so in fact the verifier inside the<00:11:47.220> recursive<00:11:47.700> circuit<00:11:48.120> is<00:11:49.079> just<00:11:49.440> the 00:11:49.790 --> 00:11:49.800 align:start position:0% the recursive circuit is just the 00:11:49.800 --> 00:11:52.550 align:start position:0% the recursive circuit is just the accumulation<00:11:50.459> verifier<00:11:51.120> and<00:11:51.779> it<00:11:52.380> only 00:11:52.550 --> 00:11:52.560 align:start position:0% accumulation verifier and it only 00:11:52.560 --> 00:11:55.550 align:start position:0% accumulation verifier and it only concerns<00:11:53.160> itself<00:11:53.459> with<00:11:53.760> the<00:11:54.060> succinct<00:11:54.720> checks 00:11:55.550 --> 00:11:55.560 align:start position:0% concerns itself with the succinct checks 00:11:55.560 --> 00:11:58.490 align:start position:0% concerns itself with the succinct checks of<00:11:56.100> the<00:11:56.279> verifier 00:11:58.490 --> 00:11:58.500 align:start position:0% of the verifier 00:11:58.500 --> 00:12:00.530 align:start position:0% of the verifier um and<00:11:59.160> the<00:11:59.339> expensive<00:11:59.880> check<00:12:00.180> is 00:12:00.530 --> 00:12:00.540 align:start position:0% um and the expensive check is 00:12:00.540 --> 00:12:04.690 align:start position:0% um and the expensive check is accumulated<00:12:01.140> and<00:12:01.740> deferred<00:12:02.940> um<00:12:03.000> at<00:12:03.959> each<00:12:04.200> step 00:12:04.690 --> 00:12:04.700 align:start position:0% accumulated and deferred um at each step 00:12:04.700 --> 00:12:08.210 align:start position:0% accumulated and deferred um at each step so<00:12:05.700> here<00:12:06.600> we<00:12:06.839> are<00:12:06.959> chaining<00:12:07.500> basically 00:12:08.210 --> 00:12:08.220 align:start position:0% so here we are chaining basically 00:12:08.220 --> 00:12:12.230 align:start position:0% so here we are chaining basically instances<00:12:08.940> of<00:12:09.540> proofs<00:12:10.019> and<00:12:10.380> accumulators 00:12:12.230 --> 00:12:12.240 align:start position:0% instances of proofs and accumulators 00:12:12.240 --> 00:12:14.170 align:start position:0% instances of proofs and accumulators um<00:12:12.360> and<00:12:12.600> at<00:12:12.779> each<00:12:12.959> step<00:12:13.200> we're<00:12:13.560> just 00:12:14.170 --> 00:12:14.180 align:start position:0% um and at each step we're just 00:12:14.180 --> 00:12:16.910 align:start position:0% um and at each step we're just procrastinating<00:12:15.180> on<00:12:16.140> performing<00:12:16.800> the 00:12:16.910 --> 00:12:16.920 align:start position:0% procrastinating on performing the 00:12:16.920 --> 00:12:19.610 align:start position:0% procrastinating on performing the expensive<00:12:17.459> check<00:12:17.700> well<00:12:18.360> until<00:12:18.720> we're<00:12:19.200> finally 00:12:19.610 --> 00:12:19.620 align:start position:0% expensive check well until we're finally 00:12:19.620 --> 00:12:22.430 align:start position:0% expensive check well until we're finally satisfied<00:12:20.220> at<00:12:20.700> the<00:12:20.880> end<00:12:21.120> of<00:12:21.480> a<00:12:21.720> long<00:12:21.899> chain<00:12:22.200> of 00:12:22.430 --> 00:12:22.440 align:start position:0% satisfied at the end of a long chain of 00:12:22.440 --> 00:12:23.410 align:start position:0% satisfied at the end of a long chain of proofs 00:12:23.410 --> 00:12:23.420 align:start position:0% proofs 00:12:23.420 --> 00:12:27.310 align:start position:0% proofs we<00:12:24.420> perform<00:12:24.660> the<00:12:25.200> final<00:12:25.640> decider 00:12:27.310 --> 00:12:27.320 align:start position:0% we perform the final decider 00:12:27.320 --> 00:12:31.069 align:start position:0% we perform the final decider sub-particle<00:12:28.320> that<00:12:29.399> finally<00:12:30.300> bites<00:12:30.899> the 00:12:31.069 --> 00:12:31.079 align:start position:0% sub-particle that finally bites the 00:12:31.079 --> 00:12:34.150 align:start position:0% sub-particle that finally bites the bullet<00:12:31.440> and<00:12:31.740> does<00:12:31.920> the<00:12:32.160> linear<00:12:32.519> time<00:12:32.640> check 00:12:34.150 --> 00:12:34.160 align:start position:0% bullet and does the linear time check 00:12:34.160 --> 00:12:37.370 align:start position:0% bullet and does the linear time check but<00:12:35.160> at<00:12:36.060> this<00:12:36.180> point<00:12:36.360> we<00:12:36.600> can<00:12:36.720> do<00:12:36.899> it<00:12:37.019> outside 00:12:37.370 --> 00:12:37.380 align:start position:0% but at this point we can do it outside 00:12:37.380 --> 00:12:40.610 align:start position:0% but at this point we can do it outside the<00:12:37.860> circuit<00:12:38.279> and<00:12:38.940> at<00:12:39.240> this<00:12:39.360> point<00:12:39.660> the<00:12:40.440> cost 00:12:40.610 --> 00:12:40.620 align:start position:0% the circuit and at this point the cost 00:12:40.620 --> 00:12:42.889 align:start position:0% the circuit and at this point the cost of<00:12:40.860> the<00:12:41.040> linear<00:12:41.339> time<00:12:41.579> check<00:12:41.820> is<00:12:42.240> amortized 00:12:42.889 --> 00:12:42.899 align:start position:0% of the linear time check is amortized 00:12:42.899 --> 00:12:46.069 align:start position:0% of the linear time check is amortized across<00:12:43.500> a<00:12:43.980> big<00:12:44.100> batch<00:12:44.279> of<00:12:44.519> proofs<00:12:44.940> now<00:12:45.660> from 00:12:46.069 --> 00:12:46.079 align:start position:0% across a big batch of proofs now from 00:12:46.079 --> 00:12:49.910 align:start position:0% across a big batch of proofs now from here<00:12:46.380> to<00:12:46.740> Atomic<00:12:47.339> accumulation<00:12:48.000> is<00:12:48.620> just<00:12:49.620> a 00:12:49.910 --> 00:12:49.920 align:start position:0% here to Atomic accumulation is just a 00:12:49.920 --> 00:12:52.970 align:start position:0% here to Atomic accumulation is just a small<00:12:50.100> step<00:12:50.459> so<00:12:51.300> it's<00:12:51.839> just<00:12:52.139> splitting<00:12:52.800> up 00:12:52.970 --> 00:12:52.980 align:start position:0% small step so it's just splitting up 00:12:52.980 --> 00:12:55.629 align:start position:0% small step so it's just splitting up your<00:12:53.339> accumulator<00:12:53.820> and<00:12:54.720> your<00:12:54.899> proof<00:12:55.200> instance 00:12:55.629 --> 00:12:55.639 align:start position:0% your accumulator and your proof instance 00:12:55.639 --> 00:12:59.389 align:start position:0% your accumulator and your proof instance into<00:12:56.639> a<00:12:57.180> public<00:12:57.300> and<00:12:57.540> private<00:12:57.839> part<00:12:58.160> and<00:12:59.160> now 00:12:59.389 --> 00:12:59.399 align:start position:0% into a public and private part and now 00:12:59.399 --> 00:13:02.150 align:start position:0% into a public and private part and now the<00:12:59.820> verifier<00:13:00.480> the<00:13:00.839> recursive<00:13:01.200> verifier<00:13:01.740> gets 00:13:02.150 --> 00:13:02.160 align:start position:0% the verifier the recursive verifier gets 00:13:02.160 --> 00:13:05.030 align:start position:0% the verifier the recursive verifier gets even<00:13:02.399> smaller<00:13:03.000> and<00:13:03.600> it<00:13:03.779> concerns<00:13:04.200> itself<00:13:04.500> only 00:13:05.030 --> 00:13:05.040 align:start position:0% even smaller and it concerns itself only 00:13:05.040 --> 00:13:07.370 align:start position:0% even smaller and it concerns itself only with<00:13:05.399> accumulating<00:13:06.000> the<00:13:06.300> instances<00:13:06.839> the 00:13:07.370 --> 00:13:07.380 align:start position:0% with accumulating the instances the 00:13:07.380 --> 00:13:11.269 align:start position:0% with accumulating the instances the public<00:13:07.620> parts<00:13:08.300> and<00:13:09.300> it<00:13:09.480> does<00:13:09.720> not<00:13:09.959> perform<00:13:10.279> it 00:13:11.269 --> 00:13:11.279 align:start position:0% public parts and it does not perform it 00:13:11.279 --> 00:13:13.190 align:start position:0% public parts and it does not perform it does<00:13:11.399> not<00:13:11.579> have<00:13:11.760> access<00:13:12.060> to<00:13:12.600> the<00:13:12.839> private 00:13:13.190 --> 00:13:13.200 align:start position:0% does not have access to the private 00:13:13.200 --> 00:13:16.370 align:start position:0% does not have access to the private parts<00:13:13.440> of<00:13:14.040> the<00:13:14.220> accumulator<00:13:14.720> and<00:13:15.720> rather<00:13:15.959> it 00:13:16.370 --> 00:13:16.380 align:start position:0% parts of the accumulator and rather it 00:13:16.380 --> 00:13:18.530 align:start position:0% parts of the accumulator and rather it relies<00:13:16.740> on<00:13:16.920> the<00:13:17.100> Pervert<00:13:17.579> to<00:13:17.760> provide<00:13:18.120> some 00:13:18.530 --> 00:13:18.540 align:start position:0% relies on the Pervert to provide some 00:13:18.540 --> 00:13:21.190 align:start position:0% relies on the Pervert to provide some commitments<00:13:19.260> to<00:13:19.500> the<00:13:19.620> private<00:13:19.980> parts 00:13:21.190 --> 00:13:21.200 align:start position:0% commitments to the private parts 00:13:21.200 --> 00:13:23.990 align:start position:0% commitments to the private parts which<00:13:22.200> it<00:13:22.380> then<00:13:22.560> performs<00:13:23.160> accumulator 00:13:23.990 --> 00:13:24.000 align:start position:0% which it then performs accumulator 00:13:24.000 --> 00:13:25.790 align:start position:0% which it then performs accumulator checks<00:13:24.660> on 00:13:25.790 --> 00:13:25.800 align:start position:0% checks on 00:13:25.800 --> 00:13:29.449 align:start position:0% checks on so<00:13:26.700> a<00:13:27.360> lot<00:13:27.540> of<00:13:27.720> these<00:13:28.500> constructions<00:13:29.160> I've 00:13:29.449 --> 00:13:29.459 align:start position:0% so a lot of these constructions I've 00:13:29.459 --> 00:13:33.530 align:start position:0% so a lot of these constructions I've described<00:13:30.060> are<00:13:31.139> really<00:13:31.740> cutting<00:13:32.220> edge<00:13:32.540> and 00:13:33.530 --> 00:13:33.540 align:start position:0% described are really cutting edge and 00:13:33.540 --> 00:13:35.930 align:start position:0% described are really cutting edge and they<00:13:34.260> come<00:13:34.440> from<00:13:34.620> a<00:13:34.800> feature<00:13:35.220> of<00:13:35.579> our<00:13:35.760> modern 00:13:35.930 --> 00:13:35.940 align:start position:0% they come from a feature of our modern 00:13:35.940 --> 00:13:39.230 align:start position:0% they come from a feature of our modern proof<00:13:36.360> systems<00:13:36.839> that<00:13:37.200> are<00:13:37.920> very<00:13:38.279> modular<00:13:38.760> in 00:13:39.230 --> 00:13:39.240 align:start position:0% proof systems that are very modular in 00:13:39.240 --> 00:13:41.629 align:start position:0% proof systems that are very modular in design<00:13:39.420> and<00:13:40.320> as<00:13:40.560> we<00:13:40.740> get<00:13:41.040> a<00:13:41.459> better 00:13:41.629 --> 00:13:41.639 align:start position:0% design and as we get a better 00:13:41.639 --> 00:13:44.990 align:start position:0% design and as we get a better understanding<00:13:42.480> of<00:13:42.899> the<00:13:43.200> building<00:13:43.440> blocks<00:13:44.040> and 00:13:44.990 --> 00:13:45.000 align:start position:0% understanding of the building blocks and 00:13:45.000 --> 00:13:47.329 align:start position:0% understanding of the building blocks and the<00:13:45.180> components<00:13:45.660> of<00:13:45.839> our<00:13:45.959> proof<00:13:46.260> systems<00:13:46.680> this 00:13:47.329 --> 00:13:47.339 align:start position:0% the components of our proof systems this 00:13:47.339 --> 00:13:49.870 align:start position:0% the components of our proof systems this lets<00:13:47.760> us<00:13:47.880> customize<00:13:48.540> our<00:13:48.899> proving<00:13:49.320> Stacks 00:13:49.870 --> 00:13:49.880 align:start position:0% lets us customize our proving Stacks 00:13:49.880 --> 00:13:53.509 align:start position:0% lets us customize our proving Stacks with<00:13:50.880> a<00:13:51.180> lot<00:13:51.300> finer<00:13:51.839> granularity<00:13:52.620> and 00:13:53.509 --> 00:13:53.519 align:start position:0% with a lot finer granularity and 00:13:53.519 --> 00:13:57.290 align:start position:0% with a lot finer granularity and recursion<00:13:54.360> as<00:13:54.779> we<00:13:55.079> saw<00:13:55.380> also<00:13:56.220> allows<00:13:56.700> us<00:13:56.820> to 00:13:57.290 --> 00:13:57.300 align:start position:0% recursion as we saw also allows us to 00:13:57.300 --> 00:13:59.810 align:start position:0% recursion as we saw also allows us to compose<00:13:57.779> proof<00:13:58.260> systems<00:13:58.740> and<00:13:59.339> to<00:13:59.519> get<00:13:59.639> the 00:13:59.810 --> 00:13:59.820 align:start position:0% compose proof systems and to get the 00:13:59.820 --> 00:14:03.889 align:start position:0% compose proof systems and to get the best<00:14:00.000> of<00:14:00.240> both<00:14:00.420> worlds<00:14:00.959> in<00:14:01.440> many<00:14:01.620> cases<00:14:01.980> so 00:14:03.889 --> 00:14:03.899 align:start position:0% best of both worlds in many cases so 00:14:03.899 --> 00:14:07.310 align:start position:0% best of both worlds in many cases so here's<00:14:04.680> an<00:14:04.800> example<00:14:05.220> of<00:14:05.940> a<00:14:06.899> modular 00:14:07.310 --> 00:14:07.320 align:start position:0% here's an example of a modular 00:14:07.320 --> 00:14:10.370 align:start position:0% here's an example of a modular conception<00:14:08.160> of<00:14:08.700> a<00:14:08.820> proof<00:14:09.180> system<00:14:09.300> so<00:14:09.839> I<00:14:10.139> work 00:14:10.370 --> 00:14:10.380 align:start position:0% conception of a proof system so I work 00:14:10.380 --> 00:14:14.750 align:start position:0% conception of a proof system so I work on<00:14:10.940> the<00:14:11.940> proof<00:14:12.240> system<00:14:12.360> Halo<00:14:12.899> 2.<00:14:13.320> and<00:14:14.160> I<00:14:14.519> think 00:14:14.750 --> 00:14:14.760 align:start position:0% on the proof system Halo 2. and I think 00:14:14.760 --> 00:14:17.810 align:start position:0% on the proof system Halo 2. and I think of<00:14:14.880> Halo<00:14:15.300> 2<00:14:15.620> in<00:14:16.620> terms<00:14:16.860> of<00:14:16.980> these<00:14:17.579> four 00:14:17.810 --> 00:14:17.820 align:start position:0% of Halo 2 in terms of these four 00:14:17.820 --> 00:14:21.170 align:start position:0% of Halo 2 in terms of these four components<00:14:18.480> so<00:14:19.260> at<00:14:19.680> the<00:14:19.860> very<00:14:20.100> front<00:14:20.399> end<00:14:20.639> is 00:14:21.170 --> 00:14:21.180 align:start position:0% components so at the very front end is 00:14:21.180 --> 00:14:23.750 align:start position:0% components so at the very front end is where<00:14:21.600> you're<00:14:22.500> interfacing<00:14:23.160> with<00:14:23.519> your 00:14:23.750 --> 00:14:23.760 align:start position:0% where you're interfacing with your 00:14:23.760 --> 00:14:25.910 align:start position:0% where you're interfacing with your business<00:14:24.000> logic<00:14:24.540> so<00:14:24.839> you<00:14:25.079> take<00:14:25.260> a<00:14:25.560> relation 00:14:25.910 --> 00:14:25.920 align:start position:0% business logic so you take a relation 00:14:25.920 --> 00:14:29.449 align:start position:0% business logic so you take a relation and<00:14:26.820> you<00:14:27.000> arithmetize<00:14:27.600> it<00:14:27.839> into 00:14:29.449 --> 00:14:29.459 align:start position:0% and you arithmetize it into 00:14:29.459 --> 00:14:29.990 align:start position:0% and you arithmetize it into um 00:14:29.990 --> 00:14:30.000 align:start position:0% um 00:14:30.000 --> 00:14:32.930 align:start position:0% um so<00:14:30.660> in<00:14:30.839> in<00:14:31.019> Halo<00:14:31.440> 2's<00:14:31.800> case<00:14:31.920> we<00:14:32.220> encode<00:14:32.579> our 00:14:32.930 --> 00:14:32.940 align:start position:0% so in in Halo 2's case we encode our 00:14:32.940 --> 00:14:35.629 align:start position:0% so in in Halo 2's case we encode our values<00:14:33.360> in<00:14:33.720> the<00:14:33.839> LaGrange<00:14:34.260> basis<00:14:34.680> and<00:14:35.399> we 00:14:35.629 --> 00:14:35.639 align:start position:0% values in the LaGrange basis and we 00:14:35.639 --> 00:14:38.389 align:start position:0% values in the LaGrange basis and we encode<00:14:36.000> constraints<00:14:36.660> on<00:14:36.959> these<00:14:37.200> values<00:14:37.620> as 00:14:38.389 --> 00:14:38.399 align:start position:0% encode constraints on these values as 00:14:38.399 --> 00:14:40.670 align:start position:0% encode constraints on these values as polynomial<00:14:39.060> identities 00:14:40.670 --> 00:14:40.680 align:start position:0% polynomial identities 00:14:40.680 --> 00:14:43.550 align:start position:0% polynomial identities we<00:14:41.399> then<00:14:41.639> input<00:14:42.060> these<00:14:42.420> polynomials<00:14:43.079> into 00:14:43.550 --> 00:14:43.560 align:start position:0% we then input these polynomials into 00:14:43.560 --> 00:14:47.269 align:start position:0% we then input these polynomials into this<00:14:44.279> information<00:14:44.779> theoretic<00:14:46.279> polynomial 00:14:47.269 --> 00:14:47.279 align:start position:0% this information theoretic polynomial 00:14:47.279 --> 00:14:48.490 align:start position:0% this information theoretic polynomial IOP 00:14:48.490 --> 00:14:48.500 align:start position:0% IOP 00:14:48.500 --> 00:14:51.650 align:start position:0% IOP that<00:14:49.500> basically<00:14:49.980> checks<00:14:50.940> the<00:14:51.180> correctness 00:14:51.650 --> 00:14:51.660 align:start position:0% that basically checks the correctness 00:14:51.660 --> 00:14:55.189 align:start position:0% that basically checks the correctness and<00:14:52.019> the<00:14:52.199> consistency<00:14:52.880> of<00:14:53.880> the<00:14:54.660> polynomials 00:14:55.189 --> 00:14:55.199 align:start position:0% and the consistency of the polynomials 00:14:55.199 --> 00:14:57.889 align:start position:0% and the consistency of the polynomials encoding<00:14:55.620> our<00:14:55.800> circuit<00:14:56.220> and<00:14:56.820> then<00:14:56.940> we<00:14:57.360> realize 00:14:57.889 --> 00:14:57.899 align:start position:0% encoding our circuit and then we realize 00:14:57.899 --> 00:15:01.670 align:start position:0% encoding our circuit and then we realize this<00:14:58.940> polynomial<00:14:59.940> IOP<00:15:00.420> using<00:15:01.139> a 00:15:01.670 --> 00:15:01.680 align:start position:0% this polynomial IOP using a 00:15:01.680 --> 00:15:04.430 align:start position:0% this polynomial IOP using a cryptographic<00:15:02.399> compiler<00:15:03.060> so<00:15:03.839> in<00:15:04.079> this<00:15:04.260> case 00:15:04.430 --> 00:15:04.440 align:start position:0% cryptographic compiler so in this case 00:15:04.440 --> 00:15:07.069 align:start position:0% cryptographic compiler so in this case it's<00:15:04.740> the<00:15:04.980> inner<00:15:05.279> product<00:15:05.399> argument<00:15:05.940> that<00:15:06.839> and 00:15:07.069 --> 00:15:07.079 align:start position:0% it's the inner product argument that and 00:15:07.079 --> 00:15:09.230 align:start position:0% it's the inner product argument that and the<00:15:07.260> Fiat<00:15:07.560> Shamir<00:15:07.980> transform<00:15:08.519> that<00:15:08.880> allows 00:15:09.230 --> 00:15:09.240 align:start position:0% the Fiat Shamir transform that allows 00:15:09.240 --> 00:15:12.530 align:start position:0% the Fiat Shamir transform that allows the<00:15:09.420> proverb<00:15:10.040> to<00:15:11.040> Define<00:15:11.459> their<00:15:12.000> interaction 00:15:12.530 --> 00:15:12.540 align:start position:0% the proverb to Define their interaction 00:15:12.540 --> 00:15:15.710 align:start position:0% the proverb to Define their interaction with<00:15:13.320> the<00:15:13.500> verifier<00:15:14.040> and<00:15:14.760> at<00:15:14.940> the<00:15:15.120> very<00:15:15.300> end<00:15:15.540> of 00:15:15.710 --> 00:15:15.720 align:start position:0% with the verifier and at the very end of 00:15:15.720 --> 00:15:18.350 align:start position:0% with the verifier and at the very end of it<00:15:15.899> Halo<00:15:16.680> 2<00:15:16.800> is<00:15:17.160> a<00:15:17.459> recursive<00:15:17.880> group<00:15:18.060> system 00:15:18.350 --> 00:15:18.360 align:start position:0% it Halo 2 is a recursive group system 00:15:18.360 --> 00:15:22.430 align:start position:0% it Halo 2 is a recursive group system and<00:15:18.899> we<00:15:19.560> can<00:15:19.800> in<00:15:20.040> fact<00:15:20.300> instantiate<00:15:21.300> an<00:15:21.959> atomic 00:15:22.430 --> 00:15:22.440 align:start position:0% and we can in fact instantiate an atomic 00:15:22.440 --> 00:15:24.590 align:start position:0% and we can in fact instantiate an atomic accumulator<00:15:22.980> over<00:15:23.880> the<00:15:24.180> inner<00:15:24.480> product 00:15:24.590 --> 00:15:24.600 align:start position:0% accumulator over the inner product 00:15:24.600 --> 00:15:28.189 align:start position:0% accumulator over the inner product argument<00:15:25.560> so<00:15:26.160> these<00:15:26.579> are<00:15:26.699> the<00:15:27.000> four 00:15:28.189 --> 00:15:28.199 align:start position:0% argument so these are the four 00:15:28.199 --> 00:15:31.730 align:start position:0% argument so these are the four sort<00:15:28.860> of<00:15:28.920> modular<00:15:29.519> pieces<00:15:30.480> of<00:15:30.899> modern<00:15:31.079> proof 00:15:31.730 --> 00:15:31.740 align:start position:0% sort of modular pieces of modern proof 00:15:31.740 --> 00:15:35.689 align:start position:0% sort of modular pieces of modern proof systems<00:15:32.160> that<00:15:32.760> I<00:15:32.940> think<00:15:33.120> of<00:15:33.560> now<00:15:34.560> we<00:15:35.339> can<00:15:35.519> do 00:15:35.689 --> 00:15:35.699 align:start position:0% systems that I think of now we can do 00:15:35.699 --> 00:15:37.250 align:start position:0% systems that I think of now we can do pretty<00:15:36.000> funny<00:15:36.300> things 00:15:37.250 --> 00:15:37.260 align:start position:0% pretty funny things 00:15:37.260 --> 00:15:40.790 align:start position:0% pretty funny things um composing<00:15:38.040> these<00:15:38.579> pieces<00:15:38.940> so<00:15:39.600> I've<00:15:40.320> set<00:15:40.560> up 00:15:40.790 --> 00:15:40.800 align:start position:0% um composing these pieces so I've set up 00:15:40.800 --> 00:15:43.189 align:start position:0% um composing these pieces so I've set up three<00:15:41.459> cases 00:15:43.189 --> 00:15:43.199 align:start position:0% three cases 00:15:43.199 --> 00:15:43.790 align:start position:0% three cases um 00:15:43.790 --> 00:15:43.800 align:start position:0% um 00:15:43.800 --> 00:15:46.069 align:start position:0% um so<00:15:44.279> the<00:15:44.519> first<00:15:44.760> one<00:15:45.000> is<00:15:45.420> information 00:15:46.069 --> 00:15:46.079 align:start position:0% so the first one is information 00:15:46.079 --> 00:15:48.189 align:start position:0% so the first one is information theoretic<00:15:46.860> compilers 00:15:48.189 --> 00:15:48.199 align:start position:0% theoretic compilers 00:15:48.199 --> 00:15:51.889 align:start position:0% theoretic compilers and<00:15:49.199> an<00:15:49.380> example<00:15:49.740> of<00:15:49.980> this<00:15:50.279> is<00:15:50.699> MPC<00:15:51.480> in<00:15:51.720> the 00:15:51.889 --> 00:15:51.899 align:start position:0% and an example of this is MPC in the 00:15:51.899 --> 00:15:52.730 align:start position:0% and an example of this is MPC in the head 00:15:52.730 --> 00:15:52.740 align:start position:0% head 00:15:52.740 --> 00:15:56.629 align:start position:0% head um<00:15:53.279> what<00:15:54.060> this<00:15:54.240> does<00:15:54.480> is<00:15:54.899> it<00:15:55.680> converts<00:15:56.220> one 00:15:56.629 --> 00:15:56.639 align:start position:0% um what this does is it converts one 00:15:56.639 --> 00:15:59.090 align:start position:0% um what this does is it converts one information<00:15:56.940> theoretic<00:15:57.839> protocol<00:15:58.500> to 00:15:59.090 --> 00:15:59.100 align:start position:0% information theoretic protocol to 00:15:59.100 --> 00:16:01.629 align:start position:0% information theoretic protocol to another<00:15:59.339> one<00:15:59.639> and<00:16:00.060> in<00:16:00.360> this<00:16:00.540> case 00:16:01.629 --> 00:16:01.639 align:start position:0% another one and in this case 00:16:01.639 --> 00:16:05.629 align:start position:0% another one and in this case it's<00:16:02.639> the<00:16:02.880> proverb<00:16:03.480> sort<00:16:04.380> of<00:16:04.500> pretending<00:16:05.160> to 00:16:05.629 --> 00:16:05.639 align:start position:0% it's the proverb sort of pretending to 00:16:05.639 --> 00:16:08.329 align:start position:0% it's the proverb sort of pretending to run<00:16:05.940> a<00:16:06.600> multi-party<00:16:07.079> computation 00:16:08.329 --> 00:16:08.339 align:start position:0% run a multi-party computation 00:16:08.339 --> 00:16:10.670 align:start position:0% run a multi-party computation in<00:16:09.000> in<00:16:09.240> her<00:16:09.480> head 00:16:10.670 --> 00:16:10.680 align:start position:0% in in her head 00:16:10.680 --> 00:16:13.009 align:start position:0% in in her head um<00:16:10.800> so<00:16:11.339> she's<00:16:11.820> really<00:16:12.180> simulating<00:16:12.660> the 00:16:13.009 --> 00:16:13.019 align:start position:0% um so she's really simulating the 00:16:13.019 --> 00:16:16.550 align:start position:0% um so she's really simulating the multiple<00:16:13.440> views<00:16:13.920> in<00:16:14.579> an<00:16:14.760> NPC<00:16:15.240> and<00:16:16.139> committing 00:16:16.550 --> 00:16:16.560 align:start position:0% multiple views in an NPC and committing 00:16:16.560 --> 00:16:19.910 align:start position:0% multiple views in an NPC and committing to<00:16:16.740> those<00:16:16.920> views<00:16:17.339> and<00:16:17.519> now<00:16:18.180> the<00:16:18.420> verifier<00:16:19.079> is 00:16:19.910 --> 00:16:19.920 align:start position:0% to those views and now the verifier is 00:16:19.920 --> 00:16:22.610 align:start position:0% to those views and now the verifier is only<00:16:20.160> checking<00:16:20.760> the<00:16:21.360> outer<00:16:21.660> protocol<00:16:22.019> being 00:16:22.610 --> 00:16:22.620 align:start position:0% only checking the outer protocol being 00:16:22.620 --> 00:16:25.189 align:start position:0% only checking the outer protocol being the<00:16:22.920> NPC<00:16:23.339> instead<00:16:24.180> of<00:16:24.300> checking<00:16:24.720> the<00:16:24.899> inner 00:16:25.189 --> 00:16:25.199 align:start position:0% the NPC instead of checking the inner 00:16:25.199 --> 00:16:28.250 align:start position:0% the NPC instead of checking the inner protocol<00:16:25.560> which<00:16:26.100> is<00:16:26.220> the<00:16:26.399> ZK<00:16:26.699> proof<00:16:27.060> so<00:16:27.839> this 00:16:28.250 --> 00:16:28.260 align:start position:0% protocol which is the ZK proof so this 00:16:28.260 --> 00:16:31.670 align:start position:0% protocol which is the ZK proof so this is<00:16:28.440> one<00:16:28.800> very<00:16:29.279> interesting<00:16:29.699> way<00:16:30.380> to<00:16:31.380> compose 00:16:31.670 --> 00:16:31.680 align:start position:0% is one very interesting way to compose 00:16:31.680 --> 00:16:34.970 align:start position:0% is one very interesting way to compose proof<00:16:32.160> systems<00:16:32.779> another<00:16:33.779> way<00:16:34.079> that<00:16:34.440> we've 00:16:34.970 --> 00:16:34.980 align:start position:0% proof systems another way that we've 00:16:34.980 --> 00:16:38.569 align:start position:0% proof systems another way that we've seen<00:16:35.339> before<00:16:35.820> in<00:16:36.540> this<00:16:36.720> presentation<00:16:37.079> is<00:16:37.740> more 00:16:38.569 --> 00:16:38.579 align:start position:0% seen before in this presentation is more 00:16:38.579 --> 00:16:42.290 align:start position:0% seen before in this presentation is more or<00:16:38.699> less<00:16:38.820> just<00:16:39.300> implementing<00:16:40.160> verifier<00:16:41.160> X<00:16:41.820> and 00:16:42.290 --> 00:16:42.300 align:start position:0% or less just implementing verifier X and 00:16:42.300 --> 00:16:45.889 align:start position:0% or less just implementing verifier X and prover<00:16:42.660> Y<00:16:43.079> and<00:16:43.980> you<00:16:44.160> would<00:16:44.339> do<00:16:44.579> this<00:16:44.699> also<00:16:45.240> for 00:16:45.889 --> 00:16:45.899 align:start position:0% prover Y and you would do this also for 00:16:45.899 --> 00:16:49.490 align:start position:0% prover Y and you would do this also for efficiency<00:16:46.440> gains<00:16:47.360> and<00:16:48.779> um 00:16:49.490 --> 00:16:49.500 align:start position:0% efficiency gains and um 00:16:49.500 --> 00:16:52.850 align:start position:0% efficiency gains and um sort<00:16:50.040> of<00:16:50.220> the<00:16:50.579> last<00:16:50.759> Clause<00:16:51.240> of<00:16:52.079> composition 00:16:52.850 --> 00:16:52.860 align:start position:0% sort of the last Clause of composition 00:16:52.860 --> 00:16:55.550 align:start position:0% sort of the last Clause of composition that<00:16:53.220> I<00:16:53.399> came<00:16:53.519> up<00:16:53.699> with<00:16:53.940> was 00:16:55.550 --> 00:16:55.560 align:start position:0% that I came up with was 00:16:55.560 --> 00:16:57.730 align:start position:0% that I came up with was really<00:16:56.339> just<00:16:56.639> thinking<00:16:57.000> up<00:16:57.180> better 00:16:57.730 --> 00:16:57.740 align:start position:0% really just thinking up better 00:16:57.740 --> 00:17:00.710 align:start position:0% really just thinking up better cryptographic<00:16:58.740> compilers<00:16:59.399> so 00:17:00.710 --> 00:17:00.720 align:start position:0% cryptographic compilers so 00:17:00.720 --> 00:17:03.650 align:start position:0% cryptographic compilers so there's<00:17:01.259> this<00:17:01.560> recent<00:17:01.920> paper<00:17:02.160> by<00:17:02.759> a<00:17:03.300> group<00:17:03.420> at 00:17:03.650 --> 00:17:03.660 align:start position:0% there's this recent paper by a group at 00:17:03.660 --> 00:17:05.510 align:start position:0% there's this recent paper by a group at consensus 00:17:05.510 --> 00:17:05.520 align:start position:0% consensus 00:17:05.520 --> 00:17:09.069 align:start position:0% consensus um<00:17:05.579> and<00:17:06.120> they<00:17:06.419> they<00:17:06.780> took<00:17:07.199> this<00:17:07.439> protocol<00:17:07.880> gkr 00:17:09.069 --> 00:17:09.079 align:start position:0% um and they they took this protocol gkr 00:17:09.079 --> 00:17:13.189 align:start position:0% um and they they took this protocol gkr that's<00:17:10.079> highly<00:17:10.919> optimized<00:17:11.520> for<00:17:12.199> repetitive 00:17:13.189 --> 00:17:13.199 align:start position:0% that's highly optimized for repetitive 00:17:13.199 --> 00:17:15.470 align:start position:0% that's highly optimized for repetitive computations<00:17:13.679> like<00:17:13.980> hash<00:17:14.280> functions 00:17:15.470 --> 00:17:15.480 align:start position:0% computations like hash functions 00:17:15.480 --> 00:17:18.890 align:start position:0% computations like hash functions now<00:17:16.020> but<00:17:16.380> the<00:17:16.559> problem<00:17:16.740> of<00:17:16.980> gkr<00:17:17.579> is<00:17:18.480> that<00:17:18.720> it 00:17:18.890 --> 00:17:18.900 align:start position:0% now but the problem of gkr is that it 00:17:18.900 --> 00:17:21.710 align:start position:0% now but the problem of gkr is that it has<00:17:19.079> a<00:17:19.260> slow<00:17:19.439> verifier<00:17:20.040> and 00:17:21.710 --> 00:17:21.720 align:start position:0% has a slow verifier and 00:17:21.720 --> 00:17:22.730 align:start position:0% has a slow verifier and um 00:17:22.730 --> 00:17:22.740 align:start position:0% um 00:17:22.740 --> 00:17:26.329 align:start position:0% um so<00:17:23.640> and<00:17:24.120> it<00:17:24.299> also<00:17:24.540> uses<00:17:24.900> the<00:17:25.079> Fiat<00:17:25.439> Shamir<00:17:25.919> hash 00:17:26.329 --> 00:17:26.339 align:start position:0% so and it also uses the Fiat Shamir hash 00:17:26.339 --> 00:17:28.789 align:start position:0% so and it also uses the Fiat Shamir hash as<00:17:26.640> a<00:17:26.819> cryptographic<00:17:27.419> compiler<00:17:27.959> and<00:17:28.679> this 00:17:28.789 --> 00:17:28.799 align:start position:0% as a cryptographic compiler and this 00:17:28.799 --> 00:17:31.490 align:start position:0% as a cryptographic compiler and this makes<00:17:29.040> it<00:17:29.280> very<00:17:29.520> inefficient<00:17:30.240> in<00:17:31.080> the<00:17:31.200> context 00:17:31.490 --> 00:17:31.500 align:start position:0% makes it very inefficient in the context 00:17:31.500 --> 00:17:33.169 align:start position:0% makes it very inefficient in the context of<00:17:31.860> recursion 00:17:33.169 --> 00:17:33.179 align:start position:0% of recursion 00:17:33.179 --> 00:17:35.930 align:start position:0% of recursion so<00:17:33.660> what<00:17:33.900> the<00:17:34.080> team<00:17:34.260> at<00:17:34.440> consensus<00:17:34.980> did<00:17:35.280> was 00:17:35.930 --> 00:17:35.940 align:start position:0% so what the team at consensus did was 00:17:35.940 --> 00:17:38.049 align:start position:0% so what the team at consensus did was they<00:17:36.179> came<00:17:36.419> up<00:17:36.539> with<00:17:36.840> their<00:17:37.200> own 00:17:38.049 --> 00:17:38.059 align:start position:0% they came up with their own 00:17:38.059 --> 00:17:41.270 align:start position:0% they came up with their own cryptographic<00:17:39.059> compiler<00:17:39.720> that<00:17:40.620> was<00:17:40.860> custom 00:17:41.270 --> 00:17:41.280 align:start position:0% cryptographic compiler that was custom 00:17:41.280 --> 00:17:44.930 align:start position:0% cryptographic compiler that was custom made<00:17:41.640> for<00:17:42.240> their<00:17:43.140> target<00:17:43.380> proof<00:17:43.919> system<00:17:44.100> and 00:17:44.930 --> 00:17:44.940 align:start position:0% made for their target proof system and 00:17:44.940 --> 00:17:47.270 align:start position:0% made for their target proof system and the<00:17:45.179> target<00:17:45.360> proof<00:17:45.840> system<00:17:46.020> here<00:17:46.320> is<00:17:46.679> like<00:17:46.980> a 00:17:47.270 --> 00:17:47.280 align:start position:0% the target proof system here is like a 00:17:47.280 --> 00:17:48.490 align:start position:0% the target proof system here is like a growth<00:17:47.580> 16 00:17:48.490 --> 00:17:48.500 align:start position:0% growth 16 00:17:48.500 --> 00:17:50.289 align:start position:0% growth 16 r1cs 00:17:50.289 --> 00:17:50.299 align:start position:0% r1cs 00:17:50.299 --> 00:17:52.669 align:start position:0% r1cs per<00:17:51.299> system 00:17:52.669 --> 00:17:52.679 align:start position:0% per system 00:17:52.679 --> 00:17:56.450 align:start position:0% per system and<00:17:53.580> so<00:17:53.820> really<00:17:54.419> like<00:17:55.020> that's<00:17:55.440> going<00:17:55.799> in<00:17:56.340> the 00:17:56.450 --> 00:17:56.460 align:start position:0% and so really like that's going in the 00:17:56.460 --> 00:17:58.610 align:start position:0% and so really like that's going in the middle<00:17:56.580> and<00:17:57.179> making<00:17:57.480> changes<00:17:58.080> like 00:17:58.610 --> 00:17:58.620 align:start position:0% middle and making changes like 00:17:58.620 --> 00:18:00.650 align:start position:0% middle and making changes like customizing<00:17:59.220> proof<00:17:59.580> systems<00:17:59.880> at<00:18:00.240> a<00:18:00.360> very<00:18:00.480> low 00:18:00.650 --> 00:18:00.660 align:start position:0% customizing proof systems at a very low 00:18:00.660 --> 00:18:02.210 align:start position:0% customizing proof systems at a very low level 00:18:02.210 --> 00:18:02.220 align:start position:0% level 00:18:02.220 --> 00:18:07.130 align:start position:0% level um<00:18:02.340> for<00:18:02.580> efficiency<00:18:03.200> and<00:18:04.200> yeah<00:18:05.039> I<00:18:05.700> think<00:18:06.140> this 00:18:07.130 --> 00:18:07.140 align:start position:0% um for efficiency and yeah I think this 00:18:07.140 --> 00:18:09.409 align:start position:0% um for efficiency and yeah I think this this<00:18:07.440> leads<00:18:07.980> me<00:18:08.100> to<00:18:08.280> ask 00:18:09.409 --> 00:18:09.419 align:start position:0% this leads me to ask 00:18:09.419 --> 00:18:12.409 align:start position:0% this leads me to ask um<00:18:09.539> whether<00:18:10.320> or<00:18:10.500> not<00:18:10.620> we<00:18:11.520> can<00:18:11.700> systematize 00:18:12.409 --> 00:18:12.419 align:start position:0% um whether or not we can systematize 00:18:12.419 --> 00:18:15.350 align:start position:0% um whether or not we can systematize this<00:18:13.080> process<00:18:13.380> and 00:18:15.350 --> 00:18:15.360 align:start position:0% this process and 00:18:15.360 --> 00:18:17.750 align:start position:0% this process and um whether<00:18:16.020> or<00:18:16.200> not<00:18:16.200> we<00:18:16.740> can 00:18:17.750 --> 00:18:17.760 align:start position:0% um whether or not we can 00:18:17.760 --> 00:18:19.610 align:start position:0% um whether or not we can I<00:18:18.419> don't<00:18:18.539> know 00:18:19.610 --> 00:18:19.620 align:start position:0% I don't know 00:18:19.620 --> 00:18:23.930 align:start position:0% I don't know um<00:18:19.740> explore<00:18:20.640> this<00:18:21.240> optimization<00:18:21.960> space<00:18:22.460> in<00:18:23.460> a 00:18:23.930 --> 00:18:23.940 align:start position:0% um explore this optimization space in a 00:18:23.940 --> 00:18:25.850 align:start position:0% um explore this optimization space in a well-defined<00:18:24.720> way 00:18:25.850 --> 00:18:25.860 align:start position:0% well-defined way 00:18:25.860 --> 00:18:27.409 align:start position:0% well-defined way so 00:18:27.409 --> 00:18:27.419 align:start position:0% so 00:18:27.419 --> 00:18:30.049 align:start position:0% so you<00:18:28.020> can<00:18:28.080> think<00:18:28.260> of<00:18:28.500> this<00:18:28.919> as<00:18:29.160> kind<00:18:29.460> of<00:18:29.580> a<00:18:29.820> call 00:18:30.049 --> 00:18:30.059 align:start position:0% you can think of this as kind of a call 00:18:30.059 --> 00:18:31.270 align:start position:0% you can think of this as kind of a call to<00:18:30.299> action 00:18:31.270 --> 00:18:31.280 align:start position:0% to action 00:18:31.280 --> 00:18:35.029 align:start position:0% to action so<00:18:32.280> I<00:18:32.700> think<00:18:32.820> there's<00:18:33.600> certain 00:18:35.029 --> 00:18:35.039 align:start position:0% so I think there's certain 00:18:35.039 --> 00:18:38.930 align:start position:0% so I think there's certain nice<00:18:35.880> to<00:18:36.179> have<00:18:36.360> certain<00:18:36.660> to<00:18:37.020> Do's<00:18:37.440> that<00:18:38.160> all 00:18:38.930 --> 00:18:38.940 align:start position:0% nice to have certain to Do's that all 00:18:38.940 --> 00:18:40.730 align:start position:0% nice to have certain to Do's that all proof<00:18:39.360> system<00:18:39.480> implementers<00:18:40.140> would<00:18:40.500> really 00:18:40.730 --> 00:18:40.740 align:start position:0% proof system implementers would really 00:18:40.740 --> 00:18:44.210 align:start position:0% proof system implementers would really like<00:18:40.980> the<00:18:41.880> first<00:18:42.120> being<00:18:42.480> good<00:18:43.380> benchmarks 00:18:44.210 --> 00:18:44.220 align:start position:0% like the first being good benchmarks 00:18:44.220 --> 00:18:47.270 align:start position:0% like the first being good benchmarks Fair<00:18:44.880> benchmarks<00:18:45.720> of<00:18:46.559> heavily<00:18:47.100> used 00:18:47.270 --> 00:18:47.280 align:start position:0% Fair benchmarks of heavily used 00:18:47.280 --> 00:18:51.289 align:start position:0% Fair benchmarks of heavily used Primitives<00:18:47.940> like<00:18:48.419> hash<00:18:48.900> functions<00:18:49.700> like<00:18:50.700> big 00:18:51.289 --> 00:18:51.299 align:start position:0% Primitives like hash functions like big 00:18:51.299 --> 00:18:54.110 align:start position:0% Primitives like hash functions like big and<00:18:51.539> arithmetic<00:18:52.320> so<00:18:52.980> benchmarks<00:18:53.640> of<00:18:53.820> these 00:18:54.110 --> 00:18:54.120 align:start position:0% and arithmetic so benchmarks of these 00:18:54.120 --> 00:18:56.210 align:start position:0% and arithmetic so benchmarks of these Primitives<00:18:54.620> across<00:18:55.620> different<00:18:55.740> proving 00:18:56.210 --> 00:18:56.220 align:start position:0% Primitives across different proving 00:18:56.220 --> 00:18:59.930 align:start position:0% Primitives across different proving stacks<00:18:56.640> and<00:18:57.299> the<00:18:58.200> second<00:18:58.320> would<00:18:58.799> be<00:18:59.039> it's<00:18:59.760> a 00:18:59.930 --> 00:18:59.940 align:start position:0% stacks and the second would be it's a 00:18:59.940 --> 00:19:03.350 align:start position:0% stacks and the second would be it's a kind<00:19:00.120> of<00:19:00.240> a<00:19:00.480> meta<00:19:00.960> requirement<00:19:01.820> is<00:19:02.820> to<00:19:03.120> think 00:19:03.350 --> 00:19:03.360 align:start position:0% kind of a meta requirement is to think 00:19:03.360 --> 00:19:06.350 align:start position:0% kind of a meta requirement is to think of<00:19:03.660> like<00:19:04.080> what<00:19:04.620> metrics<00:19:05.340> we're<00:19:05.640> interested<00:19:06.179> in 00:19:06.350 --> 00:19:06.360 align:start position:0% of like what metrics we're interested in 00:19:06.360 --> 00:19:09.110 align:start position:0% of like what metrics we're interested in for<00:19:07.140> example<00:19:07.380> efficiency<00:19:08.039> for<00:19:08.400> example<00:19:08.700> proof 00:19:09.110 --> 00:19:09.120 align:start position:0% for example efficiency for example proof 00:19:09.120 --> 00:19:10.150 align:start position:0% for example efficiency for example proof size 00:19:10.150 --> 00:19:10.160 align:start position:0% size 00:19:10.160 --> 00:19:13.610 align:start position:0% size and<00:19:11.160> basically<00:19:11.760> how<00:19:12.059> to<00:19:12.240> optimize<00:19:12.720> towards 00:19:13.610 --> 00:19:13.620 align:start position:0% and basically how to optimize towards 00:19:13.620 --> 00:19:16.430 align:start position:0% and basically how to optimize towards these<00:19:13.919> Magics<00:19:14.220> so<00:19:14.520> on<00:19:14.760> what<00:19:14.940> basis<00:19:15.419> are<00:19:16.260> we 00:19:16.430 --> 00:19:16.440 align:start position:0% these Magics so on what basis are we 00:19:16.440 --> 00:19:19.070 align:start position:0% these Magics so on what basis are we comparing<00:19:17.220> different<00:19:17.940> compositions<00:19:18.840> and 00:19:19.070 --> 00:19:19.080 align:start position:0% comparing different compositions and 00:19:19.080 --> 00:19:23.029 align:start position:0% comparing different compositions and configurations<00:19:19.820> and<00:19:20.820> the<00:19:21.000> last<00:19:21.780> sort<00:19:22.559> of<00:19:22.679> call 00:19:23.029 --> 00:19:23.039 align:start position:0% configurations and the last sort of call 00:19:23.039 --> 00:19:25.370 align:start position:0% configurations and the last sort of call to<00:19:23.220> action<00:19:23.520> would<00:19:23.880> be<00:19:24.120> to<00:19:24.539> think<00:19:24.840> carefully 00:19:25.370 --> 00:19:25.380 align:start position:0% to action would be to think carefully 00:19:25.380 --> 00:19:28.909 align:start position:0% to action would be to think carefully about<00:19:26.000> how<00:19:27.000> security<00:19:27.299> properties<00:19:28.200> also 00:19:28.909 --> 00:19:28.919 align:start position:0% about how security properties also 00:19:28.919 --> 00:19:32.210 align:start position:0% about how security properties also compose<00:19:29.340> like<00:19:29.760> excuse<00:19:30.660> me<00:19:30.780> like<00:19:31.380> is<00:19:31.679> it<00:19:31.919> the 00:19:32.210 --> 00:19:32.220 align:start position:0% compose like excuse me like is it the 00:19:32.220 --> 00:19:34.130 align:start position:0% compose like excuse me like is it the least<00:19:32.340> secure<00:19:32.760> approved<00:19:33.120> system<00:19:33.299> the<00:19:33.900> the 00:19:34.130 --> 00:19:34.140 align:start position:0% least secure approved system the the 00:19:34.140 --> 00:19:36.890 align:start position:0% least secure approved system the the fewest<00:19:34.500> bits<00:19:34.740> of<00:19:34.799> secure<00:19:34.980> 30<00:19:35.400> or<00:19:35.940> like<00:19:36.360> some 00:19:36.890 --> 00:19:36.900 align:start position:0% fewest bits of secure 30 or like some 00:19:36.900 --> 00:19:38.570 align:start position:0% fewest bits of secure 30 or like some weird<00:19:37.200> composition 00:19:38.570 --> 00:19:38.580 align:start position:0% weird composition 00:19:38.580 --> 00:19:41.150 align:start position:0% weird composition when<00:19:39.120> we<00:19:39.240> mix<00:19:39.360> and<00:19:39.539> match<00:19:39.720> proof<00:19:40.140> systems<00:19:40.559> so 00:19:41.150 --> 00:19:41.160 align:start position:0% when we mix and match proof systems so 00:19:41.160 --> 00:19:44.029 align:start position:0% when we mix and match proof systems so all<00:19:41.460> these<00:19:41.760> are<00:19:42.000> questions<00:19:42.360> that<00:19:43.020> it<00:19:43.679> would<00:19:43.860> be 00:19:44.029 --> 00:19:44.039 align:start position:0% all these are questions that it would be 00:19:44.039 --> 00:19:47.510 align:start position:0% all these are questions that it would be great<00:19:44.460> to<00:19:45.059> have<00:19:45.360> everyone's<00:19:46.020> input<00:19:46.380> on 00:19:47.510 --> 00:19:47.520 align:start position:0% great to have everyone's input on 00:19:47.520 --> 00:19:50.990 align:start position:0% great to have everyone's input on like<00:19:48.059> even<00:19:48.360> this<00:19:49.100> taxonomy<00:19:50.100> that<00:19:50.520> I<00:19:50.700> came<00:19:50.820> up 00:19:50.990 --> 00:19:51.000 align:start position:0% like even this taxonomy that I came up 00:19:51.000 --> 00:19:54.590 align:start position:0% like even this taxonomy that I came up with<00:19:51.120> I'm<00:19:51.539> not<00:19:51.780> sure<00:19:52.080> that<00:19:52.559> it<00:19:52.740> captures 00:19:54.590 --> 00:19:54.600 align:start position:0% with I'm not sure that it captures 00:19:54.600 --> 00:19:56.930 align:start position:0% with I'm not sure that it captures um all<00:19:54.960> features<00:19:55.320> of<00:19:55.440> proof<00:19:55.740> systems<00:19:56.160> in<00:19:56.820> the 00:19:56.930 --> 00:19:56.940 align:start position:0% um all features of proof systems in the 00:19:56.940 --> 00:19:59.810 align:start position:0% um all features of proof systems in the best<00:19:57.120> way<00:19:57.360> so 00:19:59.810 --> 00:19:59.820 align:start position:0% best way so 00:19:59.820 --> 00:20:04.250 align:start position:0% best way so Nolan<00:20:00.539> and<00:20:00.840> I<00:20:01.020> actually<00:20:01.799> help<00:20:02.160> out<00:20:02.400> at<00:20:03.080> a<00:20:04.080> group 00:20:04.250 --> 00:20:04.260 align:start position:0% Nolan and I actually help out at a group 00:20:04.260 --> 00:20:07.130 align:start position:0% Nolan and I actually help out at a group called<00:20:04.679> Xerox<00:20:05.160> Park<00:20:05.700> oh<00:20:06.360> we<00:20:06.600> didn't<00:20:06.720> put<00:20:07.020> the 00:20:07.130 --> 00:20:07.140 align:start position:0% called Xerox Park oh we didn't put the 00:20:07.140 --> 00:20:11.510 align:start position:0% called Xerox Park oh we didn't put the name<00:20:07.260> on<00:20:07.500> the<00:20:07.620> slide<00:20:07.919> it's<00:20:08.580> 0x<00:20:09.480> Park 00:20:11.510 --> 00:20:11.520 align:start position:0% name on the slide it's 0x Park 00:20:11.520 --> 00:20:14.690 align:start position:0% name on the slide it's 0x Park um<00:20:11.640> and<00:20:12.299> there<00:20:12.780> we're<00:20:13.260> setting<00:20:13.679> up<00:20:13.799> this<00:20:14.280> task 00:20:14.690 --> 00:20:14.700 align:start position:0% um and there we're setting up this task 00:20:14.700 --> 00:20:18.909 align:start position:0% um and there we're setting up this task force<00:20:15.299> to<00:20:16.080> look<00:20:16.320> into<00:20:16.880> this<00:20:17.880> area<00:20:18.059> of 00:20:18.909 --> 00:20:18.919 align:start position:0% force to look into this area of 00:20:18.919 --> 00:20:23.029 align:start position:0% force to look into this area of recursion<00:20:19.919> aggregation<00:20:20.520> and<00:20:20.820> composition 00:20:23.029 --> 00:20:23.039 align:start position:0% recursion aggregation and composition 00:20:23.039 --> 00:20:26.029 align:start position:0% recursion aggregation and composition um<00:20:23.100> yeah<00:20:23.520> and<00:20:24.240> I<00:20:24.360> think<00:20:24.539> like<00:20:24.900> I<00:20:25.500> might<00:20:25.679> as<00:20:25.860> well 00:20:26.029 --> 00:20:26.039 align:start position:0% um yeah and I think like I might as well 00:20:26.039 --> 00:20:28.490 align:start position:0% um yeah and I think like I might as well take<00:20:26.400> this<00:20:26.580> opportunity<00:20:27.179> to<00:20:27.539> shout<00:20:27.780> out<00:20:27.960> Xerox 00:20:28.490 --> 00:20:28.500 align:start position:0% take this opportunity to shout out Xerox 00:20:28.500 --> 00:20:31.250 align:start position:0% take this opportunity to shout out Xerox Park<00:20:28.860> and<00:20:29.280> they<00:20:29.640> supported<00:20:30.120> a<00:20:30.600> lot<00:20:30.720> of<00:20:30.900> our 00:20:31.250 --> 00:20:31.260 align:start position:0% Park and they supported a lot of our 00:20:31.260 --> 00:20:34.490 align:start position:0% Park and they supported a lot of our work<00:20:31.559> a<00:20:32.280> lot<00:20:32.400> of<00:20:32.460> those<00:20:32.700> fun<00:20:33.059> apps<00:20:33.660> and<00:20:34.140> a<00:20:34.380> lot 00:20:34.490 --> 00:20:34.500 align:start position:0% work a lot of those fun apps and a lot 00:20:34.500 --> 00:20:37.010 align:start position:0% work a lot of those fun apps and a lot of<00:20:34.679> these<00:20:35.100> Community<00:20:35.280> efforts 00:20:37.010 --> 00:20:37.020 align:start position:0% of these Community efforts 00:20:37.020 --> 00:20:41.210 align:start position:0% of these Community efforts yeah<00:20:37.580> I<00:20:38.580> think<00:20:38.700> that<00:20:39.000> is<00:20:39.179> all<00:20:39.419> I<00:20:39.600> have<00:20:39.780> so<00:20:40.380> thank 00:20:41.210 --> 00:20:41.220 align:start position:0% yeah I think that is all I have so thank 00:20:41.220 --> 00:20:44.029 align:start position:0% yeah I think that is all I have so thank you<00:20:41.400> awesome<00:20:42.360> well<00:20:43.260> thank<00:20:43.440> you<00:20:43.559> so<00:20:43.679> much<00:20:43.799> we 00:20:44.029 --> 00:20:44.039 align:start position:0% you awesome well thank you so much we 00:20:44.039 --> 00:20:45.529 align:start position:0% you awesome well thank you so much we have<00:20:44.220> time<00:20:44.400> for<00:20:44.580> one<00:20:44.760> or<00:20:44.880> two<00:20:45.000> questions<00:20:45.179> if 00:20:45.529 --> 00:20:45.539 align:start position:0% have time for one or two questions if 00:20:45.539 --> 00:20:46.669 align:start position:0% have time for one or two questions if you<00:20:45.660> have<00:20:45.720> any<00:20:45.840> questions<00:20:46.020> please<00:20:46.260> raise<00:20:46.440> your 00:20:46.669 --> 00:20:46.679 align:start position:0% you have any questions please raise your 00:20:46.679 --> 00:20:48.169 align:start position:0% you have any questions please raise your hand<00:20:46.860> we've<00:20:47.160> got<00:20:47.220> a<00:20:47.400> question<00:20:47.520> here<00:20:47.820> on<00:20:48.000> this 00:20:48.169 --> 00:20:48.179 align:start position:0% hand we've got a question here on this 00:20:48.179 --> 00:20:51.350 align:start position:0% hand we've got a question here on this side<00:20:48.380> hi<00:20:49.460> I<00:20:50.460> didn't<00:20:50.520> think<00:20:50.700> this<00:20:50.880> would<00:20:51.059> work 00:20:51.350 --> 00:20:51.360 align:start position:0% side hi I didn't think this would work 00:20:51.360 --> 00:20:54.169 align:start position:0% side hi I didn't think this would work for<00:20:51.600> years<00:20:51.780> and<00:20:52.020> years<00:20:52.200> and<00:20:52.320> years 00:20:54.169 --> 00:20:54.179 align:start position:0% for years and years and years 00:20:54.179 --> 00:20:56.270 align:start position:0% for years and years and years um and<00:20:54.780> I<00:20:54.840> also<00:20:55.080> I'm<00:20:55.380> not<00:20:55.559> I'm<00:20:55.740> not<00:20:55.919> even<00:20:56.039> sure 00:20:56.270 --> 00:20:56.280 align:start position:0% um and I also I'm not I'm not even sure 00:20:56.280 --> 00:20:57.830 align:start position:0% um and I also I'm not I'm not even sure that<00:20:56.400> does<00:20:56.640> work<00:20:56.760> it<00:20:56.940> does<00:20:57.120> seem<00:20:57.299> way<00:20:57.480> too<00:20:57.660> good 00:20:57.830 --> 00:20:57.840 align:start position:0% that does work it does seem way too good 00:20:57.840 --> 00:21:01.010 align:start position:0% that does work it does seem way too good to<00:20:57.960> be<00:20:58.080> true<00:20:58.260> so<00:20:58.980> can<00:20:59.400> you<00:20:59.580> prove<00:21:00.120> and<00:21:00.660> how<00:21:00.900> do 00:21:01.010 --> 00:21:01.020 align:start position:0% to be true so can you prove and how do 00:21:01.020 --> 00:21:03.049 align:start position:0% to be true so can you prove and how do you<00:21:01.140> prove<00:21:01.559> that<00:21:01.980> that<00:21:02.220> it's<00:21:02.400> secure<00:21:02.700> to<00:21:02.880> do 00:21:03.049 --> 00:21:03.059 align:start position:0% you prove that that it's secure to do 00:21:03.059 --> 00:21:04.850 align:start position:0% you prove that that it's secure to do recursive<00:21:03.600> like<00:21:03.900> proofs<00:21:04.440> like<00:21:04.559> this<00:21:04.679> like 00:21:04.850 --> 00:21:04.860 align:start position:0% recursive like proofs like this like 00:21:04.860 --> 00:21:07.610 align:start position:0% recursive like proofs like this like where<00:21:05.700> where<00:21:06.000> is<00:21:06.240> the<00:21:06.360> security<00:21:06.480> proof 00:21:07.610 --> 00:21:07.620 align:start position:0% where where is the security proof 00:21:07.620 --> 00:21:09.770 align:start position:0% where where is the security proof you<00:21:07.980> know<00:21:08.100> I<00:21:08.340> don't<00:21:08.460> know<00:21:08.580> how<00:21:09.120> to<00:21:09.299> convince 00:21:09.770 --> 00:21:09.780 align:start position:0% you know I don't know how to convince 00:21:09.780 --> 00:21:11.750 align:start position:0% you know I don't know how to convince myself<00:21:09.900> that<00:21:10.260> this<00:21:10.440> works<00:21:10.679> actually 00:21:11.750 --> 00:21:11.760 align:start position:0% myself that this works actually 00:21:11.760 --> 00:21:14.510 align:start position:0% myself that this works actually yeah I<00:21:12.240> mean<00:21:12.360> that<00:21:12.840> is<00:21:12.960> a<00:21:13.140> good<00:21:13.320> question<00:21:13.679> it 00:21:14.510 --> 00:21:14.520 align:start position:0% yeah I mean that is a good question it 00:21:14.520 --> 00:21:16.850 align:start position:0% yeah I mean that is a good question it seems<00:21:14.820> very<00:21:15.059> unreasonable<00:21:15.900> that<00:21:16.500> you<00:21:16.679> can 00:21:16.850 --> 00:21:16.860 align:start position:0% seems very unreasonable that you can 00:21:16.860 --> 00:21:19.130 align:start position:0% seems very unreasonable that you can prove<00:21:17.220> like<00:21:17.520> an<00:21:17.760> arbitrarily<00:21:18.539> long<00:21:18.840> history 00:21:19.130 --> 00:21:19.140 align:start position:0% prove like an arbitrarily long history 00:21:19.140 --> 00:21:21.590 align:start position:0% prove like an arbitrarily long history of<00:21:19.440> computation<00:21:20.039> with<00:21:20.760> a<00:21:20.940> constant<00:21:21.299> size 00:21:21.590 --> 00:21:21.600 align:start position:0% of computation with a constant size 00:21:21.600 --> 00:21:23.210 align:start position:0% of computation with a constant size proof 00:21:23.210 --> 00:21:23.220 align:start position:0% proof 00:21:23.220 --> 00:21:25.909 align:start position:0% proof um<00:21:23.280> it<00:21:23.640> does<00:21:23.760> seem<00:21:24.000> unreasonable<00:21:24.600> so 00:21:25.909 --> 00:21:25.919 align:start position:0% um it does seem unreasonable so 00:21:25.919 --> 00:21:28.610 align:start position:0% um it does seem unreasonable so I<00:21:26.580> will<00:21:26.700> say<00:21:26.880> that<00:21:27.179> security<00:21:27.419> proves<00:21:28.080> exist 00:21:28.610 --> 00:21:28.620 align:start position:0% I will say that security proves exist 00:21:28.620 --> 00:21:30.890 align:start position:0% I will say that security proves exist there<00:21:29.460> in<00:21:29.700> papers 00:21:30.890 --> 00:21:30.900 align:start position:0% there in papers 00:21:30.900 --> 00:21:32.630 align:start position:0% there in papers um<00:21:30.960> but<00:21:31.320> now<00:21:31.440> and<00:21:31.740> do<00:21:31.860> you<00:21:31.980> have<00:21:32.100> like<00:21:32.280> some 00:21:32.630 --> 00:21:32.640 align:start position:0% um but now and do you have like some 00:21:32.640 --> 00:21:35.930 align:start position:0% um but now and do you have like some intuition<00:21:33.299> as<00:21:33.659> to<00:21:33.900> why<00:21:34.500> the<00:21:35.340> security<00:21:35.460> should 00:21:35.930 --> 00:21:35.940 align:start position:0% intuition as to why the security should 00:21:35.940 --> 00:21:39.529 align:start position:0% intuition as to why the security should hold<00:21:36.380> uh<00:21:37.380> yeah<00:21:37.500> for<00:21:37.740> sure<00:21:37.860> I<00:21:38.159> I<00:21:38.340> think<00:21:38.700> one<00:21:39.120> sort 00:21:39.529 --> 00:21:39.539 align:start position:0% hold uh yeah for sure I I think one sort 00:21:39.539 --> 00:21:41.149 align:start position:0% hold uh yeah for sure I I think one sort of<00:21:39.659> physics-based<00:21:40.320> view<00:21:40.440> that<00:21:40.740> we've<00:21:40.980> seen 00:21:41.149 --> 00:21:41.159 align:start position:0% of physics-based view that we've seen 00:21:41.159 --> 00:21:43.250 align:start position:0% of physics-based view that we've seen before<00:21:41.400> is<00:21:41.640> like<00:21:41.820> it's<00:21:42.000> like<00:21:42.299> oh<00:21:42.600> you're<00:21:42.840> 3D 00:21:43.250 --> 00:21:43.260 align:start position:0% before is like it's like oh you're 3D 00:21:43.260 --> 00:21:44.930 align:start position:0% before is like it's like oh you're 3D space<00:21:43.679> and<00:21:43.919> you're<00:21:44.039> collapsing<00:21:44.400> into<00:21:44.580> like<00:21:44.820> a 00:21:44.930 --> 00:21:44.940 align:start position:0% space and you're collapsing into like a 00:21:44.940 --> 00:21:46.190 align:start position:0% space and you're collapsing into like a 2d<00:21:45.120> surface 00:21:46.190 --> 00:21:46.200 align:start position:0% 2d surface 00:21:46.200 --> 00:21:47.690 align:start position:0% 2d surface um<00:21:46.260> I<00:21:46.440> forget<00:21:46.559> the<00:21:46.799> exact<00:21:47.039> name<00:21:47.220> of<00:21:47.400> this<00:21:47.520> but 00:21:47.690 --> 00:21:47.700 align:start position:0% um I forget the exact name of this but 00:21:47.700 --> 00:21:49.789 align:start position:0% um I forget the exact name of this but the<00:21:48.059> holographic<00:21:48.720> principle 00:21:49.789 --> 00:21:49.799 align:start position:0% the holographic principle 00:21:49.799 --> 00:21:52.610 align:start position:0% the holographic principle uh<00:21:50.520> so<00:21:51.000> I<00:21:51.179> I<00:21:51.299> think<00:21:51.840> there<00:21:51.960> is<00:21:52.140> like<00:21:52.260> some<00:21:52.440> sort 00:21:52.610 --> 00:21:52.620 align:start position:0% uh so I I think there is like some sort 00:21:52.620 --> 00:21:53.990 align:start position:0% uh so I I think there is like some sort of<00:21:52.740> meta<00:21:53.039> justification<00:21:53.460> you<00:21:53.640> can<00:21:53.760> come<00:21:53.880> up 00:21:53.990 --> 00:21:54.000 align:start position:0% of meta justification you can come up 00:21:54.000 --> 00:21:55.549 align:start position:0% of meta justification you can come up with<00:21:54.120> to<00:21:54.360> convince<00:21:54.659> yourself<00:21:54.780> if<00:21:55.200> that's<00:21:55.380> like 00:21:55.549 --> 00:21:55.559 align:start position:0% with to convince yourself if that's like 00:21:55.559 --> 00:21:57.770 align:start position:0% with to convince yourself if that's like this<00:21:55.860> sort<00:21:55.980> of<00:21:56.039> thing<00:21:56.159> but<00:21:56.400> there<00:21:57.240> is<00:21:57.419> fruits 00:21:57.770 --> 00:21:57.780 align:start position:0% this sort of thing but there is fruits 00:21:57.780 --> 00:21:59.210 align:start position:0% this sort of thing but there is fruits of<00:21:57.840> all<00:21:57.960> kind<00:21:58.200> that<00:21:58.919> are<00:21:59.100> actually 00:21:59.210 --> 00:21:59.220 align:start position:0% of all kind that are actually 00:21:59.220 --> 00:22:02.270 align:start position:0% of all kind that are actually substantial<00:22:00.000> it's<00:22:00.480> a<00:22:00.780> good<00:22:00.900> question 00:22:02.270 --> 00:22:02.280 align:start position:0% substantial it's a good question 00:22:02.280 --> 00:22:04.250 align:start position:0% substantial it's a good question any<00:22:02.700> last<00:22:03.059> minute<00:22:03.240> questions 00:22:04.250 --> 00:22:04.260 align:start position:0% any last minute questions 00:22:04.260 --> 00:22:05.870 align:start position:0% any last minute questions we<00:22:04.679> have<00:22:04.799> one<00:22:04.980> at<00:22:05.100> the<00:22:05.280> back<00:22:05.340> all<00:22:05.640> the<00:22:05.700> way<00:22:05.760> over 00:22:05.870 --> 00:22:05.880 align:start position:0% we have one at the back all the way over 00:22:05.880 --> 00:22:06.890 align:start position:0% we have one at the back all the way over there 00:22:06.890 --> 00:22:06.900 align:start position:0% there 00:22:06.900 --> 00:22:09.110 align:start position:0% there so<00:22:07.320> recursive<00:22:07.740> proofs<00:22:08.100> are<00:22:08.280> real<00:22:08.400> fun<00:22:08.700> but<00:22:08.940> if 00:22:09.110 --> 00:22:09.120 align:start position:0% so recursive proofs are real fun but if 00:22:09.120 --> 00:22:12.110 align:start position:0% so recursive proofs are real fun but if you<00:22:09.240> do<00:22:09.360> it<00:22:09.480> at<00:22:09.659> scale<00:22:10.080> then<00:22:10.919> you're<00:22:11.640> you<00:22:12.000> know 00:22:12.110 --> 00:22:12.120 align:start position:0% you do it at scale then you're you know 00:22:12.120 --> 00:22:14.630 align:start position:0% you do it at scale then you're you know it's<00:22:12.299> like<00:22:12.480> you<00:22:12.659> you<00:22:12.900> you<00:22:13.039> have<00:22:14.039> skill<00:22:14.460> and 00:22:14.630 --> 00:22:14.640 align:start position:0% it's like you you you have skill and 00:22:14.640 --> 00:22:17.390 align:start position:0% it's like you you you have skill and corruptus<00:22:15.360> snapping<00:22:15.900> at<00:22:16.080> your<00:22:16.200> heels<00:22:16.559> uh 00:22:17.390 --> 00:22:17.400 align:start position:0% corruptus snapping at your heels uh 00:22:17.400 --> 00:22:19.310 align:start position:0% corruptus snapping at your heels uh because<00:22:17.520> of<00:22:17.760> the<00:22:17.880> proof<00:22:18.120> carrying<00:22:18.480> data<00:22:18.900> right 00:22:19.310 --> 00:22:19.320 align:start position:0% because of the proof carrying data right 00:22:19.320 --> 00:22:23.090 align:start position:0% because of the proof carrying data right if<00:22:19.860> you<00:22:20.220> want<00:22:21.000> to<00:22:21.120> build<00:22:21.419> on<00:22:21.960> recursive<00:22:22.740> proofs 00:22:23.090 --> 00:22:23.100 align:start position:0% if you want to build on recursive proofs 00:22:23.100 --> 00:22:25.669 align:start position:0% if you want to build on recursive proofs and<00:22:23.280> it<00:22:23.460> doesn't<00:22:23.580> happen<00:22:24.059> at<00:22:24.659> the<00:22:25.200> same<00:22:25.440> time 00:22:25.669 --> 00:22:25.679 align:start position:0% and it doesn't happen at the same time 00:22:25.679 --> 00:22:28.310 align:start position:0% and it doesn't happen at the same time so<00:22:25.980> let's<00:22:26.159> say<00:22:26.280> you<00:22:26.520> do<00:22:26.700> a<00:22:26.940> proof<00:22:27.780> and<00:22:28.080> you<00:22:28.260> do 00:22:28.310 --> 00:22:28.320 align:start position:0% so let's say you do a proof and you do 00:22:28.320 --> 00:22:30.049 align:start position:0% so let's say you do a proof and you do recursive<00:22:28.799> proof<00:22:29.159> and<00:22:29.580> then<00:22:29.700> you<00:22:29.820> have<00:22:29.940> to 00:22:30.049 --> 00:22:30.059 align:start position:0% recursive proof and then you have to 00:22:30.059 --> 00:22:31.610 align:start position:0% recursive proof and then you have to wait<00:22:30.240> for<00:22:30.480> a<00:22:30.600> state<00:22:30.780> change<00:22:31.020> for<00:22:31.380> something 00:22:31.610 --> 00:22:31.620 align:start position:0% wait for a state change for something 00:22:31.620 --> 00:22:33.890 align:start position:0% wait for a state change for something else<00:22:31.860> it<00:22:32.039> might<00:22:32.280> happen<00:22:32.460> much<00:22:32.880> later<00:22:33.059> you<00:22:33.720> need 00:22:33.890 --> 00:22:33.900 align:start position:0% else it might happen much later you need 00:22:33.900 --> 00:22:35.510 align:start position:0% else it might happen much later you need to<00:22:34.020> keep<00:22:34.200> the<00:22:34.380> proof<00:22:34.620> carrying<00:22:35.039> data<00:22:35.340> around 00:22:35.510 --> 00:22:35.520 align:start position:0% to keep the proof carrying data around 00:22:35.520 --> 00:22:39.110 align:start position:0% to keep the proof carrying data around and<00:22:36.059> as<00:22:36.539> you<00:22:36.840> know<00:22:36.900> if<00:22:37.260> as<00:22:37.740> you<00:22:37.980> know<00:22:38.159> but<00:22:38.640> most 00:22:39.110 --> 00:22:39.120 align:start position:0% and as you know if as you know but most 00:22:39.120 --> 00:22:42.049 align:start position:0% and as you know if as you know but most here<00:22:39.659> that<00:22:40.559> is<00:22:40.860> typically<00:22:41.220> a<00:22:41.580> very<00:22:41.760> large 00:22:42.049 --> 00:22:42.059 align:start position:0% here that is typically a very large 00:22:42.059 --> 00:22:44.090 align:start position:0% here that is typically a very large amount<00:22:42.480> of<00:22:42.600> data 00:22:44.090 --> 00:22:44.100 align:start position:0% amount of data 00:22:44.100 --> 00:22:46.250 align:start position:0% amount of data um<00:22:44.159> so<00:22:44.640> it's<00:22:45.059> like<00:22:45.179> if<00:22:45.480> you're<00:22:45.600> doing<00:22:45.840> it<00:22:46.020> at 00:22:46.250 --> 00:22:46.260 align:start position:0% um so it's like if you're doing it at 00:22:46.260 --> 00:22:48.830 align:start position:0% um so it's like if you're doing it at scale<00:22:46.559> you're<00:22:47.220> really<00:22:47.580> running<00:22:47.820> into<00:22:48.299> the 00:22:48.830 --> 00:22:48.840 align:start position:0% scale you're really running into the 00:22:48.840 --> 00:22:52.549 align:start position:0% scale you're really running into the issues<00:22:49.260> of<00:22:49.740> data<00:22:50.159> provisioning<00:22:50.840> and<00:22:51.840> all<00:22:52.440> the 00:22:52.549 --> 00:22:52.559 align:start position:0% issues of data provisioning and all the 00:22:52.559 --> 00:22:55.669 align:start position:0% issues of data provisioning and all the fun<00:22:52.740> part<00:22:53.039> can<00:22:53.760> get<00:22:54.000> really<00:22:54.299> expensive<00:22:54.900> really 00:22:55.669 --> 00:22:55.679 align:start position:0% fun part can get really expensive really 00:22:55.679 --> 00:22:57.350 align:start position:0% fun part can get really expensive really really<00:22:55.860> quickly<00:22:56.280> not<00:22:56.580> even<00:22:56.700> talking<00:22:57.000> about 00:22:57.350 --> 00:22:57.360 align:start position:0% really quickly not even talking about 00:22:57.360 --> 00:22:59.390 align:start position:0% really quickly not even talking about like<00:22:58.200> the<00:22:58.500> the 00:22:59.390 --> 00:22:59.400 align:start position:0% like the the 00:22:59.400 --> 00:23:01.549 align:start position:0% like the the um<00:22:59.520> you<00:22:59.940> know<00:23:00.059> the<00:23:00.299> the<00:23:00.559> computational 00:23:01.549 --> 00:23:01.559 align:start position:0% um you know the the computational 00:23:01.559 --> 00:23:03.590 align:start position:0% um you know the the computational overhead<00:23:02.100> that<00:23:02.400> you<00:23:02.460> have 00:23:03.590 --> 00:23:03.600 align:start position:0% overhead that you have 00:23:03.600 --> 00:23:06.710 align:start position:0% overhead that you have yeah<00:23:04.260> yeah<00:23:04.500> for<00:23:05.039> sure<00:23:05.220> I<00:23:05.880> think<00:23:06.000> I<00:23:06.419> don't<00:23:06.539> think 00:23:06.710 --> 00:23:06.720 align:start position:0% yeah yeah for sure I think I don't think 00:23:06.720 --> 00:23:09.590 align:start position:0% yeah yeah for sure I think I don't think recursive<00:23:07.380> proofs<00:23:07.799> are<00:23:08.039> a<00:23:08.220> silver<00:23:08.400> bullet<00:23:09.059> and 00:23:09.590 --> 00:23:09.600 align:start position:0% recursive proofs are a silver bullet and 00:23:09.600 --> 00:23:11.570 align:start position:0% recursive proofs are a silver bullet and I<00:23:10.020> think<00:23:10.140> they're<00:23:10.380> better<00:23:10.620> suited<00:23:11.039> for<00:23:11.280> some 00:23:11.570 --> 00:23:11.580 align:start position:0% I think they're better suited for some 00:23:11.580 --> 00:23:14.210 align:start position:0% I think they're better suited for some shapes<00:23:12.120> of<00:23:12.299> applications<00:23:12.840> so<00:23:13.679> recursive 00:23:14.210 --> 00:23:14.220 align:start position:0% shapes of applications so recursive 00:23:14.220 --> 00:23:16.850 align:start position:0% shapes of applications so recursive proofs<00:23:14.640> are<00:23:14.880> very<00:23:15.179> commonly<00:23:15.539> used<00:23:15.780> to<00:23:16.200> reduce 00:23:16.850 --> 00:23:16.860 align:start position:0% proofs are very commonly used to reduce 00:23:16.860 --> 00:23:19.730 align:start position:0% proofs are very commonly used to reduce proverb<00:23:17.700> space<00:23:17.760> complexity<00:23:18.419> so<00:23:19.140> breaking<00:23:19.620> up 00:23:19.730 --> 00:23:19.740 align:start position:0% proverb space complexity so breaking up 00:23:19.740 --> 00:23:22.010 align:start position:0% proverb space complexity so breaking up a<00:23:19.919> large<00:23:20.100> circuit<00:23:20.640> into<00:23:21.000> many<00:23:21.539> smaller 00:23:22.010 --> 00:23:22.020 align:start position:0% a large circuit into many smaller 00:23:22.020 --> 00:23:26.330 align:start position:0% a large circuit into many smaller parallelizable<00:23:23.000> circuits<00:23:24.020> so<00:23:25.020> yeah<00:23:25.500> but<00:23:25.860> I<00:23:26.100> I 00:23:26.330 --> 00:23:26.340 align:start position:0% parallelizable circuits so yeah but I I 00:23:26.340 --> 00:23:28.909 align:start position:0% parallelizable circuits so yeah but I I agree<00:23:26.640> like<00:23:27.000> in<00:23:27.360> context<00:23:27.720> of<00:23:28.020> applications 00:23:28.909 --> 00:23:28.919 align:start position:0% agree like in context of applications 00:23:28.919 --> 00:23:32.149 align:start position:0% agree like in context of applications with<00:23:29.280> more<00:23:29.720> complicated<00:23:30.720> and<00:23:31.320> like<00:23:31.559> timely 00:23:32.149 --> 00:23:32.159 align:start position:0% with more complicated and like timely 00:23:32.159 --> 00:23:36.110 align:start position:0% with more complicated and like timely data<00:23:33.000> flows<00:23:33.360> it's<00:23:34.080> it's<00:23:34.500> we<00:23:35.280> have<00:23:35.400> to<00:23:35.520> put<00:23:35.820> some 00:23:36.110 --> 00:23:36.120 align:start position:0% data flows it's it's we have to put some 00:23:36.120 --> 00:23:39.950 align:start position:0% data flows it's it's we have to put some care<00:23:36.360> into<00:23:36.960> how<00:23:37.860> and<00:23:38.159> where<00:23:38.460> we<00:23:39.179> are<00:23:39.360> inserting 00:23:39.950 --> 00:23:39.960 align:start position:0% care into how and where we are inserting 00:23:39.960 --> 00:23:43.310 align:start position:0% care into how and where we are inserting this<00:23:40.500> proof<00:23:40.860> carrying<00:23:41.159> data<00:23:42.000> yeah 00:23:43.310 --> 00:23:43.320 align:start position:0% this proof carrying data yeah 00:23:43.320 --> 00:23:45.770 align:start position:0% this proof carrying data yeah right<00:23:43.860> and<00:23:44.039> also<00:23:44.280> just<00:23:44.460> to<00:23:44.640> add<00:23:44.880> uh<00:23:45.360> I<00:23:45.480> think 00:23:45.770 --> 00:23:45.780 align:start position:0% right and also just to add uh I think 00:23:45.780 --> 00:23:47.210 align:start position:0% right and also just to add uh I think there's<00:23:46.020> also<00:23:46.260> some<00:23:46.440> interesting<00:23:46.799> like<00:23:46.980> sort 00:23:47.210 --> 00:23:47.220 align:start position:0% there's also some interesting like sort 00:23:47.220 --> 00:23:49.310 align:start position:0% there's also some interesting like sort of<00:23:47.280> clean<00:23:47.460> separation<00:23:47.940> here<00:23:48.240> of<00:23:48.480> like<00:23:48.720> rules 00:23:49.310 --> 00:23:49.320 align:start position:0% of clean separation here of like rules 00:23:49.320 --> 00:23:51.169 align:start position:0% of clean separation here of like rules versus<00:23:49.559> data<00:23:50.159> availability<00:23:50.520> sort<00:23:51.000> of 00:23:51.169 --> 00:23:51.179 align:start position:0% versus data availability sort of 00:23:51.179 --> 00:23:53.090 align:start position:0% versus data availability sort of problems<00:23:52.020> um<00:23:52.080> and<00:23:52.320> if<00:23:52.500> you<00:23:52.620> just<00:23:52.740> look<00:23:52.799> at<00:23:52.919> you 00:23:53.090 --> 00:23:53.100 align:start position:0% problems um and if you just look at you 00:23:53.100 --> 00:23:54.710 align:start position:0% problems um and if you just look at you know<00:23:53.159> data<00:23:53.400> availability<00:23:53.640> as<00:23:54.059> a<00:23:54.299> sort<00:23:54.600> of 00:23:54.710 --> 00:23:54.720 align:start position:0% know data availability as a sort of 00:23:54.720 --> 00:23:56.210 align:start position:0% know data availability as a sort of Black<00:23:54.900> Box<00:23:55.080> problem<00:23:55.380> you<00:23:55.620> know<00:23:55.740> you<00:23:55.860> have<00:23:55.980> lots 00:23:56.210 --> 00:23:56.220 align:start position:0% Black Box problem you know you have lots 00:23:56.220 --> 00:23:57.770 align:start position:0% Black Box problem you know you have lots of blockchain<00:23:56.580> kinds<00:23:57.000> of<00:23:57.059> solutions<00:23:57.360> for<00:23:57.659> it 00:23:57.770 --> 00:23:57.780 align:start position:0% of blockchain kinds of solutions for it 00:23:57.780 --> 00:24:00.409 align:start position:0% of blockchain kinds of solutions for it and<00:23:58.140> for<00:23:58.440> instance<00:23:58.559> isocratia<00:23:59.280> explorers 00:24:00.409 --> 00:24:00.419 align:start position:0% and for instance isocratia explorers 00:24:00.419 --> 00:24:02.990 align:start position:0% and for instance isocratia explorers um one<00:24:00.960> sort<00:24:01.140> of<00:24:01.260> solution<00:24:01.679> that<00:24:02.400> um 00:24:02.990 --> 00:24:03.000 align:start position:0% um one sort of solution that um 00:24:03.000 --> 00:24:05.570 align:start position:0% um one sort of solution that um maybe<00:24:03.419> you<00:24:03.600> can<00:24:03.720> check<00:24:03.840> out<00:24:03.960> The<00:24:04.080> Blog<00:24:04.320> on 00:24:05.570 --> 00:24:05.580 align:start position:0% maybe you can check out The Blog on 00:24:05.580 --> 00:24:10.010 align:start position:0% maybe you can check out The Blog on yeah<00:24:05.780> also<00:24:06.780> to<00:24:07.320> add<00:24:07.500> on<00:24:07.679> to<00:24:07.860> that<00:24:08.220> like<00:24:08.940> I<00:24:09.720> I 00:24:10.010 --> 00:24:10.020 align:start position:0% yeah also to add on to that like I I 00:24:10.020 --> 00:24:12.430 align:start position:0% yeah also to add on to that like I I really<00:24:10.260> like<00:24:10.500> knowledge<00:24:11.159> thing<00:24:11.580> about 00:24:12.430 --> 00:24:12.440 align:start position:0% really like knowledge thing about 00:24:12.440 --> 00:24:15.830 align:start position:0% really like knowledge thing about composability<00:24:13.440> the<00:24:14.039> fact<00:24:14.340> that<00:24:15.240> um 00:24:15.830 --> 00:24:15.840 align:start position:0% composability the fact that um 00:24:15.840 --> 00:24:18.590 align:start position:0% composability the fact that um you<00:24:16.500> know<00:24:16.620> you<00:24:17.100> you<00:24:17.340> can<00:24:17.880> play<00:24:18.000> incomplete 00:24:18.590 --> 00:24:18.600 align:start position:0% you know you you can play incomplete 00:24:18.600 --> 00:24:21.230 align:start position:0% you know you you can play incomplete information<00:24:18.720> games<00:24:19.260> so<00:24:19.679> I<00:24:19.919> think<00:24:20.100> sort<00:24:20.760> of<00:24:21.000> fun 00:24:21.230 --> 00:24:21.240 align:start position:0% information games so I think sort of fun 00:24:21.240 --> 00:24:23.330 align:start position:0% information games so I think sort of fun applications<00:24:21.840> like<00:24:22.140> that<00:24:22.320> that<00:24:22.620> are<00:24:22.919> unique 00:24:23.330 --> 00:24:23.340 align:start position:0% applications like that that are unique 00:24:23.340 --> 00:24:26.930 align:start position:0% applications like that that are unique to<00:24:23.760> PCD<00:24:24.299> are<00:24:25.080> also<00:24:25.500> very<00:24:26.039> interesting<00:24:26.580> to 00:24:26.930 --> 00:24:26.940 align:start position:0% to PCD are also very interesting to 00:24:26.940 --> 00:24:27.950 align:start position:0% to PCD are also very interesting to explore 00:24:27.950 --> 00:24:27.960 align:start position:0% explore 00:24:27.960 --> 00:24:29.570 align:start position:0% explore amazing<00:24:28.440> that's<00:24:28.679> all<00:24:28.860> the<00:24:29.039> time<00:24:29.159> we<00:24:29.280> have<00:24:29.400> for 00:24:29.570 --> 00:24:29.580 align:start position:0% amazing that's all the time we have for 00:24:29.580 --> 00:24:31.430 align:start position:0% amazing that's all the time we have for today<00:24:29.700> please<00:24:30.059> give<00:24:30.299> Ian<00:24:30.659> and<00:24:30.780> Elaine<00:24:31.200> a<00:24:31.260> big 00:24:31.430 --> 00:24:31.440 align:start position:0% today please give Ian and Elaine a big 00:24:31.440 --> 00:24:32.110 align:start position:0% today please give Ian and Elaine a big round<00:24:31.559> of<00:24:31.740> applause 00:24:32.110 --> 00:24:32.120 align:start position:0% round of applause 00:24:32.120 --> 00:24:36.560 align:start position:0% round of applause [Applause]