WEBVTT Kind: captions Language: en 00:00:00.120 --> 00:00:02.989 align:start position:0% hello<00:00:00.780> everyone<00:00:01.079> that's<00:00:01.739> great<00:00:02.070> to<00:00:02.280> see<00:00:02.520> so 00:00:02.989 --> 00:00:02.999 align:start position:0% hello everyone that's great to see so 00:00:02.999 --> 00:00:06.889 align:start position:0% hello everyone that's great to see so many<00:00:03.239> people<00:00:03.389> on<00:00:04.109> our<00:00:05.330> purely<00:00:06.330> mathematical 00:00:06.889 --> 00:00:06.899 align:start position:0% many people on our purely mathematical 00:00:06.899 --> 00:00:09.400 align:start position:0% many people on our purely mathematical and<00:00:07.020> cryptographically<00:00:07.500> talk<00:00:07.830> so<00:00:08.430> I<00:00:08.460> try<00:00:08.970> to 00:00:09.400 --> 00:00:09.410 align:start position:0% and cryptographically talk so I try to 00:00:09.410 --> 00:00:12.080 align:start position:0% and cryptographically talk so I try to rule<00:00:10.410> out<00:00:10.590> as<00:00:10.980> many<00:00:11.400> foreign<00:00:11.790> laws<00:00:11.940> as 00:00:12.080 --> 00:00:12.090 align:start position:0% rule out as many foreign laws as 00:00:12.090 --> 00:00:13.580 align:start position:0% rule out as many foreign laws as possible<00:00:12.540> but<00:00:12.690> so<00:00:12.870> many<00:00:13.080> of<00:00:13.200> them<00:00:13.380> are<00:00:13.500> left 00:00:13.580 --> 00:00:13.590 align:start position:0% possible but so many of them are left 00:00:13.590 --> 00:00:15.500 align:start position:0% possible but so many of them are left here<00:00:13.950> so<00:00:14.100> this<00:00:14.700> talk<00:00:15.000> is<00:00:15.030> of<00:00:15.270> course 00:00:15.500 --> 00:00:15.510 align:start position:0% here so this talk is of course 00:00:15.510 --> 00:00:18.050 align:start position:0% here so this talk is of course intentionally<00:00:16.139> scientific<00:00:17.070> to<00:00:17.279> show<00:00:17.669> up<00:00:17.789> that 00:00:18.050 --> 00:00:18.060 align:start position:0% intentionally scientific to show up that 00:00:18.060 --> 00:00:20.749 align:start position:0% intentionally scientific to show up that we<00:00:18.269> are<00:00:18.359> doing<00:00:18.599> something<00:00:18.810> serious<00:00:19.259> but<00:00:20.039> there 00:00:20.749 --> 00:00:20.759 align:start position:0% we are doing something serious but there 00:00:20.759 --> 00:00:22.849 align:start position:0% we are doing something serious but there will<00:00:20.849> be<00:00:20.910> also<00:00:21.179> like<00:00:21.689> important<00:00:22.349> numbers<00:00:22.679> will 00:00:22.849 --> 00:00:22.859 align:start position:0% will be also like important numbers will 00:00:22.859 --> 00:00:24.679 align:start position:0% will be also like important numbers will be<00:00:23.009> on<00:00:23.220> the<00:00:23.369> very<00:00:23.579> last<00:00:23.789> slides<00:00:24.179> that<00:00:24.480> like 00:00:24.679 --> 00:00:24.689 align:start position:0% be on the very last slides that like 00:00:24.689 --> 00:00:26.239 align:start position:0% be on the very last slides that like this<00:00:24.900> slide<00:00:25.470> before<00:00:25.650> last 00:00:26.239 --> 00:00:26.249 align:start position:0% this slide before last 00:00:26.249 --> 00:00:28.249 align:start position:0% this slide before last so<00:00:26.579> like<00:00:26.730> number<00:00:27.240> of<00:00:27.329> constraints<00:00:27.810> and<00:00:28.169> this 00:00:28.249 --> 00:00:28.259 align:start position:0% so like number of constraints and this 00:00:28.259 --> 00:00:30.140 align:start position:0% so like number of constraints and this sort<00:00:28.470> of<00:00:28.560> stuff<00:00:28.650> will<00:00:28.919> be<00:00:28.949> in<00:00:29.310> the<00:00:29.609> very<00:00:29.789> end<00:00:29.999> so 00:00:30.140 --> 00:00:30.150 align:start position:0% sort of stuff will be in the very end so 00:00:30.150 --> 00:00:31.849 align:start position:0% sort of stuff will be in the very end so if<00:00:30.269> you<00:00:30.419> are<00:00:30.539> just<00:00:30.749> coming<00:00:31.199> just<00:00:31.470> for<00:00:31.589> that<00:00:31.739> you 00:00:31.849 --> 00:00:31.859 align:start position:0% if you are just coming just for that you 00:00:31.859 --> 00:00:38.120 align:start position:0% if you are just coming just for that you can<00:00:31.890> wait<00:00:34.880> so<00:00:35.880> this<00:00:36.060> is<00:00:36.120> a<00:00:36.240> joint<00:00:36.540> work<00:00:36.660> of<00:00:37.620> the 00:00:38.120 --> 00:00:38.130 align:start position:0% can wait so this is a joint work of the 00:00:38.130 --> 00:00:40.490 align:start position:0% can wait so this is a joint work of the companies<00:00:38.490> I'm<00:00:38.700> involved<00:00:39.000> with<00:00:39.210> every<00:00:40.080> Manta 00:00:40.490 --> 00:00:40.500 align:start position:0% companies I'm involved with every Manta 00:00:40.500 --> 00:00:43.880 align:start position:0% companies I'm involved with every Manta BDK<00:00:40.860> consulting<00:00:41.340> and<00:00:41.930> also<00:00:42.930> our<00:00:43.350> colleagues 00:00:43.880 --> 00:00:43.890 align:start position:0% BDK consulting and also our colleagues 00:00:43.890 --> 00:00:46.580 align:start position:0% BDK consulting and also our colleagues from<00:00:44.240> universities<00:00:45.240> of<00:00:45.450> Britain<00:00:45.900> grads<00:00:46.260> are 00:00:46.580 --> 00:00:46.590 align:start position:0% from universities of Britain grads are 00:00:46.590 --> 00:00:49.010 align:start position:0% from universities of Britain grads are now<00:00:47.310> Florence<00:00:47.790> a<00:00:47.940> Christian<00:00:48.390> Sebastian<00:00:48.900> and 00:00:49.010 --> 00:00:49.020 align:start position:0% now Florence a Christian Sebastian and 00:00:49.020 --> 00:00:52.550 align:start position:0% now Florence a Christian Sebastian and Marcus<00:00:49.380> so<00:00:50.250> this<00:00:50.940> kind<00:00:51.150> of<00:00:51.270> work<00:00:52.170> that<00:00:52.410> was 00:00:52.550 --> 00:00:52.560 align:start position:0% Marcus so this kind of work that was 00:00:52.560 --> 00:00:54.200 align:start position:0% Marcus so this kind of work that was conducted<00:00:53.100> a<00:00:53.160> bit<00:00:53.280> independently<00:00:54.000> and<00:00:54.120> then 00:00:54.200 --> 00:00:54.210 align:start position:0% conducted a bit independently and then 00:00:54.210 --> 00:00:56.600 align:start position:0% conducted a bit independently and then later<00:00:54.510> merged<00:00:54.900> and<00:00:55.260> still<00:00:55.950> it's<00:00:56.130> kind<00:00:56.250> of<00:00:56.400> work 00:00:56.600 --> 00:00:56.610 align:start position:0% later merged and still it's kind of work 00:00:56.610 --> 00:00:58.280 align:start position:0% later merged and still it's kind of work in<00:00:56.730> progress<00:00:56.760> we<00:00:57.270> even<00:00:57.480> haven't<00:00:57.750> invented<00:00:57.990> the 00:00:58.280 --> 00:00:58.290 align:start position:0% in progress we even haven't invented the 00:00:58.290 --> 00:01:01.130 align:start position:0% in progress we even haven't invented the proper<00:00:58.710> name<00:00:58.920> for<00:00:58.950> the<00:00:59.250> hash<00:00:59.400> function<00:01:00.140> so 00:01:01.130 --> 00:01:01.140 align:start position:0% proper name for the hash function so 00:01:01.140 --> 00:01:05.810 align:start position:0% proper name for the hash function so that's<00:01:02.360> okay<00:01:03.360> so<00:01:04.429> you'll<00:01:05.429> probably<00:01:05.519> remember 00:01:05.810 --> 00:01:05.820 align:start position:0% that's okay so you'll probably remember 00:01:05.820 --> 00:01:07.819 align:start position:0% that's okay so you'll probably remember what<00:01:06.149> the<00:01:06.240> head<00:01:06.390> function<00:01:06.570> is<00:01:06.990> what<00:01:07.409> property 00:01:07.819 --> 00:01:07.829 align:start position:0% what the head function is what property 00:01:07.829 --> 00:01:09.649 align:start position:0% what the head function is what property should<00:01:07.979> have<00:01:08.189> the<00:01:09.060> good<00:01:09.450> hash<00:01:09.630> function 00:01:09.649 --> 00:01:09.659 align:start position:0% should have the good hash function 00:01:09.659 --> 00:01:11.569 align:start position:0% should have the good hash function should<00:01:10.259> process<00:01:10.619> arbitrary<00:01:11.039> large<00:01:11.189> input 00:01:11.569 --> 00:01:11.579 align:start position:0% should process arbitrary large input 00:01:11.579 --> 00:01:13.880 align:start position:0% should process arbitrary large input well<00:01:12.149> up<00:01:12.359> to<00:01:12.539> some<00:01:12.899> extent<00:01:12.929> but<00:01:13.380> pretty<00:01:13.649> like 00:01:13.880 --> 00:01:13.890 align:start position:0% well up to some extent but pretty like 00:01:13.890 --> 00:01:15.319 align:start position:0% well up to some extent but pretty like that<00:01:13.920> you<00:01:14.280> get<00:01:14.399> by<00:01:14.490> it<00:01:14.549> should<00:01:14.789> handle<00:01:15.149> it 00:01:15.319 --> 00:01:15.329 align:start position:0% that you get by it should handle it 00:01:15.329 --> 00:01:17.029 align:start position:0% that you get by it should handle it should<00:01:15.960> be<00:01:16.049> collision<00:01:16.380> resistant<00:01:16.799> meaning 00:01:17.029 --> 00:01:17.039 align:start position:0% should be collision resistant meaning 00:01:17.039 --> 00:01:19.279 align:start position:0% should be collision resistant meaning that<00:01:17.189> it<00:01:17.850> should<00:01:17.999> be<00:01:18.090> difficult<00:01:18.329> to<00:01:18.509> find<00:01:18.719> X&Y 00:01:19.279 --> 00:01:19.289 align:start position:0% that it should be difficult to find X&Y 00:01:19.289 --> 00:01:21.349 align:start position:0% that it should be difficult to find X&Y difference<00:01:19.979> so<00:01:20.219> that<00:01:20.249> the<00:01:20.789> hashes<00:01:21.119> of<00:01:21.210> them 00:01:21.349 --> 00:01:21.359 align:start position:0% difference so that the hashes of them 00:01:21.359 --> 00:01:22.219 align:start position:0% difference so that the hashes of them are<00:01:21.509> identical 00:01:22.219 --> 00:01:22.229 align:start position:0% are identical 00:01:22.229 --> 00:01:26.270 align:start position:0% are identical well<00:01:22.890> as<00:01:23.310> long<00:01:23.399> as<00:01:23.460> hash<00:01:23.819> function<00:01:25.280> converts 00:01:26.270 --> 00:01:26.280 align:start position:0% well as long as hash function converts 00:01:26.280 --> 00:01:28.279 align:start position:0% well as long as hash function converts arbitrary<00:01:27.060> large<00:01:27.210> inputs<00:01:27.689> to<00:01:27.810> fixed<00:01:28.109> sized 00:01:28.279 --> 00:01:28.289 align:start position:0% arbitrary large inputs to fixed sized 00:01:28.289 --> 00:01:30.559 align:start position:0% arbitrary large inputs to fixed sized outputs<00:01:28.740> collisions<00:01:29.520> are<00:01:29.670> unavoidable<00:01:30.210> but 00:01:30.559 --> 00:01:30.569 align:start position:0% outputs collisions are unavoidable but 00:01:30.569 --> 00:01:32.809 align:start position:0% outputs collisions are unavoidable but there<00:01:30.780> must<00:01:31.079> be<00:01:31.170> difficult<00:01:31.499> to<00:01:31.560> find<00:01:31.819> per 00:01:32.809 --> 00:01:32.819 align:start position:0% there must be difficult to find per 00:01:32.819 --> 00:01:35.029 align:start position:0% there must be difficult to find per image<00:01:32.999> resistant<00:01:33.479> means<00:01:34.020> that<00:01:34.229> given<00:01:34.649> Y<00:01:34.979> it 00:01:35.029 --> 00:01:35.039 align:start position:0% image resistant means that given Y it 00:01:35.039 --> 00:01:38.179 align:start position:0% image resistant means that given Y it must<00:01:35.490> be<00:01:35.639> difficult<00:01:35.789> to<00:01:36.030> find<00:01:36.499> X<00:01:37.499> so<00:01:37.859> that<00:01:37.979> H<00:01:38.159> of 00:01:38.179 --> 00:01:38.189 align:start position:0% must be difficult to find X so that H of 00:01:38.189 --> 00:01:43.160 align:start position:0% must be difficult to find X so that H of X<00:01:38.399> is<00:01:38.579> y<00:01:40.520> well<00:01:41.520> hash<00:01:41.969> functions<00:01:42.450> theorem 00:01:43.160 --> 00:01:43.170 align:start position:0% X is y well hash functions theorem 00:01:43.170 --> 00:01:45.590 align:start position:0% X is y well hash functions theorem everything<00:01:44.039> is<00:01:44.159> hedge<00:01:44.310> funds<00:01:44.520> everywhere<00:01:45.359> of 00:01:45.590 --> 00:01:45.600 align:start position:0% everything is hedge funds everywhere of 00:01:45.600 --> 00:01:49.609 align:start position:0% everything is hedge funds everywhere of course<00:01:45.630> mainly<00:01:46.170> Shah<00:01:47.359> 303<00:01:48.359> or<00:01:48.509> ketchup<00:01:48.869> the 00:01:49.609 --> 00:01:49.619 align:start position:0% course mainly Shah 303 or ketchup the 00:01:49.619 --> 00:01:52.370 align:start position:0% course mainly Shah 303 or ketchup the hash<00:01:50.100> function<00:01:50.249> designed<00:01:50.729> by<00:01:51.259> Belgian<00:01:52.259> de 00:01:52.370 --> 00:01:52.380 align:start position:0% hash function designed by Belgian de 00:01:52.380 --> 00:01:55.940 align:start position:0% hash function designed by Belgian de Belgian<00:01:52.889> team<00:01:53.100> in<00:01:53.659> lead<00:01:54.659> by<00:01:54.810> Yann<00:01:55.049> diamond<00:01:55.409> in 00:01:55.940 --> 00:01:55.950 align:start position:0% Belgian team in lead by Yann diamond in 00:01:55.950 --> 00:01:58.660 align:start position:0% Belgian team in lead by Yann diamond in about<00:01:56.520> ten<00:01:56.729> years<00:01:56.759> ago<00:01:57.209> so<00:01:57.779> sherry<00:01:58.170> is<00:01:58.229> built 00:01:58.660 --> 00:01:58.670 align:start position:0% about ten years ago so sherry is built 00:01:58.670 --> 00:02:01.399 align:start position:0% about ten years ago so sherry is built is<00:01:59.670> used<00:01:59.939> to<00:01:59.999> build<00:02:00.149> a<00:02:00.240> patricia<00:02:00.509> tree<00:02:00.869> to 00:02:01.399 --> 00:02:01.409 align:start position:0% is used to build a patricia tree to 00:02:01.409 --> 00:02:02.809 align:start position:0% is used to build a patricia tree to construct<00:02:01.770> the<00:02:01.829> wrists<00:02:02.159> out<00:02:02.219> of<00:02:02.399> the<00:02:02.490> public 00:02:02.809 --> 00:02:02.819 align:start position:0% construct the wrists out of the public 00:02:02.819 --> 00:02:04.760 align:start position:0% construct the wrists out of the public key<00:02:02.999> and<00:02:03.209> so<00:02:03.389> on<00:02:03.479> and<00:02:03.600> so<00:02:03.689> forth<00:02:03.899> so<00:02:04.079> if<00:02:04.590> it's 00:02:04.760 --> 00:02:04.770 align:start position:0% key and so on and so forth so if it's 00:02:04.770 --> 00:02:07.489 align:start position:0% key and so on and so forth so if it's not<00:02:04.920> like<00:02:05.069> the<00:02:05.429> best<00:02:05.729> like<00:02:06.329> terms<00:02:06.719> often<00:02:07.259> not 00:02:07.489 --> 00:02:07.499 align:start position:0% not like the best like terms often not 00:02:07.499 --> 00:02:10.029 align:start position:0% not like the best like terms often not the<00:02:07.679> fastest<00:02:08.159> hash<00:02:08.340> function<00:02:08.759> in<00:02:09.269> the<00:02:09.569> world 00:02:10.029 --> 00:02:10.039 align:start position:0% the fastest hash function in the world 00:02:10.039 --> 00:02:12.949 align:start position:0% the fastest hash function in the world but<00:02:11.039> it<00:02:11.220> still<00:02:11.430> can<00:02:11.580> handle<00:02:11.879> up<00:02:12.180> to 00:02:12.949 --> 00:02:12.959 align:start position:0% but it still can handle up to 00:02:12.959 --> 00:02:19.929 align:start position:0% but it still can handle up to like<00:02:13.530> 500<00:02:14.959> baits<00:02:15.959> per<00:02:16.349> megabytes<00:02:16.859> per<00:02:17.069> second 00:02:19.929 --> 00:02:19.939 align:start position:0% 00:02:19.939 --> 00:02:22.699 align:start position:0% well<00:02:20.939> to<00:02:21.719> understand<00:02:22.230> why<00:02:22.379> we<00:02:22.530> need<00:02:22.680> a 00:02:22.699 --> 00:02:22.709 align:start position:0% well to understand why we need a 00:02:22.709 --> 00:02:24.979 align:start position:0% well to understand why we need a different<00:02:22.920> hash<00:02:23.250> function<00:02:23.640> I'll<00:02:23.879> go<00:02:24.239> a<00:02:24.269> bit<00:02:24.510> to 00:02:24.979 --> 00:02:24.989 align:start position:0% different hash function I'll go a bit to 00:02:24.989 --> 00:02:26.390 align:start position:0% different hash function I'll go a bit to the<00:02:25.109> introduction<00:02:25.560> how<00:02:25.709> hash<00:02:25.920> functions<00:02:26.310> are 00:02:26.390 --> 00:02:26.400 align:start position:0% the introduction how hash functions are 00:02:26.400 --> 00:02:29.390 align:start position:0% the introduction how hash functions are used<00:02:26.640> in<00:02:26.959> snarks<00:02:27.959> so<00:02:28.560> this<00:02:28.769> is<00:02:28.890> some<00:02:29.040> sort<00:02:29.189> of<00:02:29.219> a 00:02:29.390 --> 00:02:29.400 align:start position:0% used in snarks so this is some sort of a 00:02:29.400 --> 00:02:31.879 align:start position:0% used in snarks so this is some sort of a petition<00:02:29.730> a<00:02:30.090> bit<00:02:30.689> of<00:02:30.840> the<00:02:30.930> previous<00:02:31.290> stark 00:02:31.879 --> 00:02:31.889 align:start position:0% petition a bit of the previous stark 00:02:31.889 --> 00:02:36.140 align:start position:0% petition a bit of the previous stark talk<00:02:32.159> well<00:02:32.819> in<00:02:33.060> Bitcoin<00:02:33.859> we<00:02:34.859> sign<00:02:35.609> because 00:02:36.140 --> 00:02:36.150 align:start position:0% talk well in Bitcoin we sign because 00:02:36.150 --> 00:02:38.449 align:start position:0% talk well in Bitcoin we sign because usually<00:02:36.780> I<00:02:37.230> still<00:02:37.769> have<00:02:37.950> to<00:02:38.069> start<00:02:38.280> with 00:02:38.449 --> 00:02:38.459 align:start position:0% usually I still have to start with 00:02:38.459 --> 00:02:41.089 align:start position:0% usually I still have to start with Bitcoin<00:02:38.819> unfortunately<00:02:39.269> because<00:02:39.920> there<00:02:40.920> has 00:02:41.089 --> 00:02:41.099 align:start position:0% Bitcoin unfortunately because there has 00:02:41.099 --> 00:02:43.580 align:start position:0% Bitcoin unfortunately because there has the<00:02:41.430> zeroes<00:02:41.790> proofs<00:02:42.209> apply<00:02:42.750> usually<00:02:43.109> to<00:02:43.290> a 00:02:43.580 --> 00:02:43.590 align:start position:0% the zeroes proofs apply usually to a 00:02:43.590 --> 00:02:46.099 align:start position:0% the zeroes proofs apply usually to a transaction<00:02:44.159> output<00:02:44.909> you<00:02:45.599> take<00:02:45.750> so<00:02:45.900> based 00:02:46.099 --> 00:02:46.109 align:start position:0% transaction output you take so based 00:02:46.109 --> 00:02:49.759 align:start position:0% transaction output you take so based systems<00:02:46.950> so<00:02:47.579> we<00:02:48.419> sign<00:02:48.569> the<00:02:48.720> transaction<00:02:49.230> with 00:02:49.759 --> 00:02:49.769 align:start position:0% systems so we sign the transaction with 00:02:49.769 --> 00:02:51.679 align:start position:0% systems so we sign the transaction with some<00:02:49.919> output<00:02:50.459> and<00:02:50.609> hash<00:02:51.209> function<00:02:51.599> of 00:02:51.679 --> 00:02:51.689 align:start position:0% some output and hash function of 00:02:51.689 --> 00:02:52.879 align:start position:0% some output and hash function of production<00:02:52.109> is<00:02:52.230> glued<00:02:52.409> it's<00:02:52.560> in<00:02:52.620> the<00:02:52.680> block 00:02:52.879 --> 00:02:52.889 align:start position:0% production is glued it's in the block 00:02:52.889 --> 00:02:55.670 align:start position:0% production is glued it's in the block and<00:02:53.040> after<00:02:53.579> some<00:02:53.760> point<00:02:54.060> we<00:02:54.569> spent<00:02:54.989> the<00:02:55.590> out 00:02:55.670 --> 00:02:55.680 align:start position:0% and after some point we spent the out 00:02:55.680 --> 00:02:59.509 align:start position:0% and after some point we spent the out but<00:02:56.099> by<00:02:57.109> signing<00:02:58.109> the<00:02:58.469> transaction<00:02:58.980> and<00:02:59.159> the 00:02:59.509 --> 00:02:59.519 align:start position:0% but by signing the transaction and the 00:02:59.519 --> 00:03:03.649 align:start position:0% but by signing the transaction and the output<00:03:00.030> with<00:03:00.989> the<00:03:01.530> private<00:03:02.189> key<00:03:02.430> that<00:03:02.609> was<00:03:03.120> in 00:03:03.649 --> 00:03:03.659 align:start position:0% output with the private key that was in 00:03:03.659 --> 00:03:06.229 align:start position:0% output with the private key that was in the<00:03:03.840> hash<00:03:04.019> and<00:03:04.290> the<00:03:05.129> crucial<00:03:05.370> point<00:03:05.730> here<00:03:05.849> is 00:03:06.229 --> 00:03:06.239 align:start position:0% the hash and the crucial point here is 00:03:06.239 --> 00:03:09.530 align:start position:0% the hash and the crucial point here is that<00:03:07.310> the<00:03:08.310> hash<00:03:08.639> of<00:03:08.909> the<00:03:09.000> transaction<00:03:09.450> is 00:03:09.530 --> 00:03:09.540 align:start position:0% that the hash of the transaction is 00:03:09.540 --> 00:03:11.709 align:start position:0% that the hash of the transaction is referred<00:03:09.900> in<00:03:10.169> clear-text 00:03:11.709 --> 00:03:11.719 align:start position:0% referred in clear-text 00:03:11.719 --> 00:03:14.959 align:start position:0% referred in clear-text when<00:03:12.719> you<00:03:12.980> want<00:03:13.980> introduces<00:03:14.519> their<00:03:14.639> knowledge 00:03:14.959 --> 00:03:14.969 align:start position:0% when you want introduces their knowledge 00:03:14.969 --> 00:03:17.000 align:start position:0% when you want introduces their knowledge payment<00:03:15.389> system 00:03:17.000 --> 00:03:17.010 align:start position:0% payment system 00:03:17.010 --> 00:03:19.309 align:start position:0% payment system this<00:03:17.370> is<00:03:17.489> concealed<00:03:17.940> the<00:03:18.239> hash<00:03:18.510> is<00:03:18.870> concealed 00:03:19.309 --> 00:03:19.319 align:start position:0% this is concealed the hash is concealed 00:03:19.319 --> 00:03:20.990 align:start position:0% this is concealed the hash is concealed to<00:03:19.500> break<00:03:19.769> up<00:03:20.040> the<00:03:20.250> link<00:03:20.459> between<00:03:20.699> the 00:03:20.990 --> 00:03:21.000 align:start position:0% to break up the link between the 00:03:21.000 --> 00:03:22.939 align:start position:0% to break up the link between the original<00:03:21.389> transaction<00:03:21.659> to<00:03:22.019> send<00:03:22.319> and<00:03:22.590> the 00:03:22.939 --> 00:03:22.949 align:start position:0% original transaction to send and the 00:03:22.949 --> 00:03:24.649 align:start position:0% original transaction to send and the direction<00:03:23.250> to<00:03:23.489> spend<00:03:23.879> so<00:03:24.449> when<00:03:24.569> the 00:03:24.649 --> 00:03:24.659 align:start position:0% direction to spend so when the 00:03:24.659 --> 00:03:26.599 align:start position:0% direction to spend so when the transaction<00:03:25.079> is<00:03:25.199> sent<00:03:25.560> it's<00:03:26.099> not<00:03:26.430> only 00:03:26.599 --> 00:03:26.609 align:start position:0% transaction is sent it's not only 00:03:26.609 --> 00:03:28.520 align:start position:0% transaction is sent it's not only included<00:03:27.060> in<00:03:27.180> a<00:03:27.239> block<00:03:27.449> but<00:03:27.690> also<00:03:27.840> added<00:03:28.349> to 00:03:28.520 --> 00:03:28.530 align:start position:0% included in a block but also added to 00:03:28.530 --> 00:03:30.800 align:start position:0% included in a block but also added to especially<00:03:28.769> crafted<00:03:29.489> Merkel<00:03:29.909> treaty<00:03:30.510> and 00:03:30.800 --> 00:03:30.810 align:start position:0% especially crafted Merkel treaty and 00:03:30.810 --> 00:03:33.800 align:start position:0% especially crafted Merkel treaty and when<00:03:31.500> you<00:03:31.590> want<00:03:31.739> to<00:03:31.799> spend<00:03:32.310> it<00:03:32.579> you<00:03:32.760> prove<00:03:33.449> that 00:03:33.800 --> 00:03:33.810 align:start position:0% when you want to spend it you prove that 00:03:33.810 --> 00:03:36.409 align:start position:0% when you want to spend it you prove that there<00:03:34.379> is<00:03:34.470> you<00:03:34.769> know<00:03:34.799> a<00:03:35.010> transaction<00:03:35.819> age 00:03:36.409 --> 00:03:36.419 align:start position:0% there is you know a transaction age 00:03:36.419 --> 00:03:40.039 align:start position:0% there is you know a transaction age which<00:03:37.169> is<00:03:37.379> in<00:03:38.069> the<00:03:38.310> miracle<00:03:38.669> treaty<00:03:39.150> that<00:03:39.840> it 00:03:40.039 --> 00:03:40.049 align:start position:0% which is in the miracle treaty that it 00:03:40.049 --> 00:03:42.979 align:start position:0% which is in the miracle treaty that it has<00:03:40.260> special<00:03:40.590> structure<00:03:41.310> and<00:03:41.549> you<00:03:42.180> know<00:03:42.209> the 00:03:42.979 --> 00:03:42.989 align:start position:0% has special structure and you know the 00:03:42.989 --> 00:03:47.270 align:start position:0% has special structure and you know the private<00:03:43.530> key<00:03:43.799> that<00:03:44.009> is<00:03:45.650> that<00:03:46.650> corresponds<00:03:47.220> to 00:03:47.270 --> 00:03:47.280 align:start position:0% private key that is that corresponds to 00:03:47.280 --> 00:03:49.309 align:start position:0% private key that is that corresponds to the<00:03:47.459> public<00:03:48.000> key<00:03:48.180> that<00:03:48.209> is<00:03:48.540> is<00:03:48.870> in<00:03:49.169> this 00:03:49.309 --> 00:03:49.319 align:start position:0% the public key that is is in this 00:03:49.319 --> 00:03:51.679 align:start position:0% the public key that is is in this transaction<00:03:49.620> and<00:03:49.979> here<00:03:50.759> the<00:03:51.030> transaction<00:03:51.509> age 00:03:51.679 --> 00:03:51.689 align:start position:0% transaction and here the transaction age 00:03:51.689 --> 00:03:55.159 align:start position:0% transaction and here the transaction age is<00:03:51.930> referred<00:03:52.349> to<00:03:52.379> in<00:03:52.560> zero<00:03:53.370> knowledge<00:03:53.579> and<00:03:54.169> the 00:03:55.159 --> 00:03:55.169 align:start position:0% is referred to in zero knowledge and the 00:03:55.169 --> 00:03:57.530 align:start position:0% is referred to in zero knowledge and the most<00:03:55.680> computational<00:03:56.189> expensive<00:03:56.669> part<00:03:56.970> in<00:03:57.299> all 00:03:57.530 --> 00:03:57.540 align:start position:0% most computational expensive part in all 00:03:57.540 --> 00:04:00.890 align:start position:0% most computational expensive part in all protocols<00:03:57.959> is<00:03:58.470> to<00:03:58.859> prove<00:03:59.220> that<00:03:59.579> the<00:04:00.299> hash<00:04:00.540> is 00:04:00.890 --> 00:04:00.900 align:start position:0% protocols is to prove that the hash is 00:04:00.900 --> 00:04:03.229 align:start position:0% protocols is to prove that the hash is part<00:04:01.560> of<00:04:01.680> the<00:04:01.799> miracle<00:04:02.159> tree<00:04:02.310> so<00:04:02.879> all<00:04:03.090> the 00:04:03.229 --> 00:04:03.239 align:start position:0% part of the miracle tree so all the 00:04:03.239 --> 00:04:06.289 align:start position:0% part of the miracle tree so all the others<00:04:04.189> parts<00:04:05.189> of<00:04:05.310> the<00:04:05.430> proof<00:04:05.669> are<00:04:05.879> rather 00:04:06.289 --> 00:04:06.299 align:start position:0% others parts of the proof are rather 00:04:06.299 --> 00:04:09.379 align:start position:0% others parts of the proof are rather fast<00:04:06.689> they<00:04:06.900> all<00:04:07.159> even<00:04:08.159> with<00:04:08.489> previous<00:04:08.909> the 00:04:09.379 --> 00:04:09.389 align:start position:0% fast they all even with previous the 00:04:09.389 --> 00:04:11.569 align:start position:0% fast they all even with previous the original<00:04:09.930> Z<00:04:10.109> cache<00:04:10.290> they<00:04:10.500> can<00:04:11.069> be<00:04:11.220> managed 00:04:11.569 --> 00:04:11.579 align:start position:0% original Z cache they can be managed 00:04:11.579 --> 00:04:14.420 align:start position:0% original Z cache they can be managed within<00:04:12.090> one<00:04:12.900> second<00:04:13.379> but<00:04:13.590> when<00:04:13.859> you<00:04:13.979> have<00:04:14.159> like 00:04:14.420 --> 00:04:14.430 align:start position:0% within one second but when you have like 00:04:14.430 --> 00:04:17.330 align:start position:0% within one second but when you have like 29<00:04:15.389> or<00:04:15.629> 32<00:04:16.079> layers<00:04:16.320> in<00:04:16.650> the<00:04:16.709> miracle<00:04:17.009> tree<00:04:17.130> this 00:04:17.330 --> 00:04:17.340 align:start position:0% 29 or 32 layers in the miracle tree this 00:04:17.340 --> 00:04:21.310 align:start position:0% 29 or 32 layers in the miracle tree this becomes<00:04:17.759> difficult<00:04:18.000> to<00:04:19.519> to<00:04:20.519> prove<00:04:20.789> because 00:04:21.310 --> 00:04:21.320 align:start position:0% becomes difficult to to prove because 00:04:21.320 --> 00:04:24.800 align:start position:0% becomes difficult to to prove because their<00:04:22.340> performance<00:04:23.340> of<00:04:23.969> zero-knowledge 00:04:24.800 --> 00:04:24.810 align:start position:0% their performance of zero-knowledge 00:04:24.810 --> 00:04:26.510 align:start position:0% their performance of zero-knowledge proving<00:04:25.169> protocols<00:04:25.680> they 00:04:26.510 --> 00:04:26.520 align:start position:0% proving protocols they 00:04:26.520 --> 00:04:28.670 align:start position:0% proving protocols they scale<00:04:26.789> linearly<00:04:27.419> or<00:04:27.780> even<00:04:28.020> super<00:04:28.289> linearly 00:04:28.670 --> 00:04:28.680 align:start position:0% scale linearly or even super linearly 00:04:28.680 --> 00:04:31.640 align:start position:0% scale linearly or even super linearly with<00:04:29.009> the<00:04:29.310> number<00:04:29.789> of<00:04:30.629> invocations<00:04:31.229> of<00:04:31.379> a<00:04:31.470> hash 00:04:31.640 --> 00:04:31.650 align:start position:0% with the number of invocations of a hash 00:04:31.650 --> 00:04:35.240 align:start position:0% with the number of invocations of a hash function<00:04:32.099> and<00:04:33.110> it<00:04:34.110> turns<00:04:34.349> out<00:04:34.590> turned<00:04:35.099> out 00:04:35.240 --> 00:04:35.250 align:start position:0% function and it turns out turned out 00:04:35.250 --> 00:04:36.619 align:start position:0% function and it turns out turned out very<00:04:35.310> quickly<00:04:35.759> that<00:04:36.030> traditional<00:04:36.479> hash 00:04:36.619 --> 00:04:36.629 align:start position:0% very quickly that traditional hash 00:04:36.629 --> 00:04:38.270 align:start position:0% very quickly that traditional hash function<00:04:36.990> like<00:04:37.110> regular<00:04:37.440> hash<00:04:37.590> function<00:04:37.949> are 00:04:38.270 --> 00:04:38.280 align:start position:0% function like regular hash function are 00:04:38.280 --> 00:04:40.999 align:start position:0% function like regular hash function are not<00:04:38.430> quite<00:04:38.610> suited<00:04:39.030> for<00:04:39.330> snarks<00:04:40.229> starks<00:04:40.860> or 00:04:40.999 --> 00:04:41.009 align:start position:0% not quite suited for snarks starks or 00:04:41.009 --> 00:04:43.490 align:start position:0% not quite suited for snarks starks or bulletproof<00:04:41.520> because<00:04:42.210> their<00:04:42.389> circuits<00:04:42.870> they 00:04:43.490 --> 00:04:43.500 align:start position:0% bulletproof because their circuits they 00:04:43.500 --> 00:04:47.330 align:start position:0% bulletproof because their circuits they are<00:04:43.620> optimized<00:04:44.250> for<00:04:45.409> Intel<00:04:46.409> or<00:04:47.310> AMD 00:04:47.330 --> 00:04:47.340 align:start position:0% are optimized for Intel or AMD 00:04:47.340 --> 00:04:49.850 align:start position:0% are optimized for Intel or AMD processors<00:04:48.150> for<00:04:48.360> modern<00:04:48.659> architecture<00:04:48.860> but 00:04:49.850 --> 00:04:49.860 align:start position:0% processors for modern architecture but 00:04:49.860 --> 00:04:54.050 align:start position:0% processors for modern architecture but they<00:04:50.340> are<00:04:50.550> not<00:04:51.240> optimized<00:04:51.750> for<00:04:52.940> for<00:04:53.940> the 00:04:54.050 --> 00:04:54.060 align:start position:0% they are not optimized for for the 00:04:54.060 --> 00:04:56.029 align:start position:0% they are not optimized for for the environment<00:04:54.569> where<00:04:54.810> Starks<00:04:55.319> or<00:04:55.530> snarks 00:04:56.029 --> 00:04:56.039 align:start position:0% environment where Starks or snarks 00:04:56.039 --> 00:04:58.700 align:start position:0% environment where Starks or snarks operate<00:04:56.610> in<00:04:56.849> this<00:04:57.210> environments<00:04:57.870> are<00:04:58.050> big 00:04:58.700 --> 00:04:58.710 align:start position:0% operate in this environments are big 00:04:58.710 --> 00:05:02.930 align:start position:0% operate in this environments are big fields<00:04:59.400> so<00:05:00.590> the<00:05:01.590> fields<00:05:02.039> are<00:05:02.220> either<00:05:02.430> prime 00:05:02.930 --> 00:05:02.940 align:start position:0% fields so the fields are either prime 00:05:02.940 --> 00:05:03.649 align:start position:0% fields so the fields are either prime fields 00:05:03.649 --> 00:05:03.659 align:start position:0% fields 00:05:03.659 --> 00:05:07.490 align:start position:0% fields meaning<00:05:04.319> that<00:05:04.789> all<00:05:05.789> now<00:05:06.060> all<00:05:06.509> kind<00:05:07.020> of<00:05:07.110> our 00:05:07.490 --> 00:05:07.500 align:start position:0% meaning that all now all kind of our 00:05:07.500 --> 00:05:11.059 align:start position:0% meaning that all now all kind of our state<00:05:07.919> is<00:05:08.159> a<00:05:08.400> vector<00:05:08.880> of<00:05:09.090> integers<00:05:09.960> models<00:05:10.860> and 00:05:11.059 --> 00:05:11.069 align:start position:0% state is a vector of integers models and 00:05:11.069 --> 00:05:13.850 align:start position:0% state is a vector of integers models and prime<00:05:11.250> number<00:05:11.580> this<00:05:11.789> prime<00:05:12.000> number<00:05:12.360> is<00:05:12.860> 256 00:05:13.850 --> 00:05:13.860 align:start position:0% prime number this prime number is 256 00:05:13.860 --> 00:05:17.300 align:start position:0% prime number this prime number is 256 bit<00:05:14.099> or<00:05:14.630> 384-bit<00:05:15.630> depends<00:05:16.199> how<00:05:16.349> afraid<00:05:17.130> you 00:05:17.300 --> 00:05:17.310 align:start position:0% bit or 384-bit depends how afraid you 00:05:17.310 --> 00:05:19.430 align:start position:0% bit or 384-bit depends how afraid you are<00:05:17.490> of<00:05:17.669> recent<00:05:17.909> discoveries<00:05:18.900> and<00:05:19.050> complexity 00:05:19.430 --> 00:05:19.440 align:start position:0% are of recent discoveries and complexity 00:05:19.440 --> 00:05:21.589 align:start position:0% are of recent discoveries and complexity estimates<00:05:19.819> this<00:05:20.819> for<00:05:21.030> snarks<00:05:21.419> and 00:05:21.589 --> 00:05:21.599 align:start position:0% estimates this for snarks and 00:05:21.599 --> 00:05:26.920 align:start position:0% estimates this for snarks and bulletproof<00:05:21.900> and<00:05:22.610> for<00:05:23.610> Starks<00:05:24.300> they<00:05:25.020> are<00:05:25.620> most 00:05:26.920 --> 00:05:26.930 align:start position:0% bulletproof and for Starks they are most 00:05:26.930 --> 00:05:33.230 align:start position:0% bulletproof and for Starks they are most helpful<00:05:28.099> filled<00:05:29.099> most<00:05:30.800> better<00:05:32.060> operators<00:05:33.060> and 00:05:33.230 --> 00:05:33.240 align:start position:0% helpful filled most better operators and 00:05:33.240 --> 00:05:36.170 align:start position:0% helpful filled most better operators and stent<00:05:33.990> is<00:05:34.289> a<00:05:34.800> binary<00:05:35.039> field<00:05:35.460> but<00:05:35.639> not<00:05:35.819> that<00:05:35.940> big 00:05:36.170 --> 00:05:36.180 align:start position:0% stent is a binary field but not that big 00:05:36.180 --> 00:05:39.740 align:start position:0% stent is a binary field but not that big so<00:05:36.539> it's<00:05:36.690> like<00:05:36.870> to<00:05:37.349> the<00:05:37.500> 32<00:05:37.889> to<00:05:38.039> the<00:05:38.069> 64<00:05:38.819> that's 00:05:39.740 --> 00:05:39.750 align:start position:0% so it's like to the 32 to the 64 that's 00:05:39.750 --> 00:05:41.629 align:start position:0% so it's like to the 32 to the 64 that's like<00:05:40.110> the<00:05:40.469> easiest<00:05:40.710> to<00:05:41.099> construct 00:05:41.629 --> 00:05:41.639 align:start position:0% like the easiest to construct 00:05:41.639 --> 00:05:47.330 align:start position:0% like the easiest to construct reed-solomon<00:05:43.400> proofs<00:05:44.479> so<00:05:45.529> we<00:05:46.529> can<00:05:46.710> say<00:05:47.009> we<00:05:47.190> can 00:05:47.330 --> 00:05:47.340 align:start position:0% reed-solomon proofs so we can say we can 00:05:47.340 --> 00:05:49.850 align:start position:0% reed-solomon proofs so we can say we can simplify<00:05:47.699> and<00:05:48.150> say<00:05:48.389> that<00:05:48.599> in<00:05:48.750> snarks<00:05:49.259> a 00:05:49.850 --> 00:05:49.860 align:start position:0% simplify and say that in snarks a 00:05:49.860 --> 00:05:52.879 align:start position:0% simplify and say that in snarks a trusted<00:05:50.639> party<00:05:51.120> just<00:05:51.360> kind<00:05:52.110> of<00:05:52.229> applies<00:05:52.860> a 00:05:52.879 --> 00:05:52.889 align:start position:0% trusted party just kind of applies a 00:05:52.889 --> 00:05:56.570 align:start position:0% trusted party just kind of applies a secret<00:05:53.460> input<00:05:53.969> to<00:05:54.719> the<00:05:54.840> circuit<00:05:55.080> and<00:05:55.560> we<00:05:56.430> can 00:05:56.570 --> 00:05:56.580 align:start position:0% secret input to the circuit and we can 00:05:56.580 --> 00:05:58.459 align:start position:0% secret input to the circuit and we can say<00:05:56.759> that<00:05:56.789> like<00:05:57.300> all<00:05:57.659> intermediate<00:05:57.960> states 00:05:58.459 --> 00:05:58.469 align:start position:0% say that like all intermediate states 00:05:58.469 --> 00:06:01.760 align:start position:0% say that like all intermediate states are<00:05:58.830> hashed<00:05:59.210> true<00:06:00.210> but<00:06:00.419> still<00:06:00.599> and<00:06:00.930> all<00:06:01.590> of 00:06:01.760 --> 00:06:01.770 align:start position:0% are hashed true but still and all of 00:06:01.770 --> 00:06:03.680 align:start position:0% are hashed true but still and all of them<00:06:01.919> are<00:06:01.949> published<00:06:02.580> as<00:06:02.759> a<00:06:02.789> proven<00:06:03.210> key<00:06:03.449> and 00:06:03.680 --> 00:06:03.690 align:start position:0% them are published as a proven key and 00:06:03.690 --> 00:06:07.010 align:start position:0% them are published as a proven key and then<00:06:04.319> bulletproof<00:06:04.860> Starks<00:06:05.370> this<00:06:06.020> secret 00:06:07.010 --> 00:06:07.020 align:start position:0% then bulletproof Starks this secret 00:06:07.020 --> 00:06:08.450 align:start position:0% then bulletproof Starks this secret input<00:06:07.319> does<00:06:07.409> not<00:06:07.560> need<00:06:07.740> it<00:06:07.860> so<00:06:07.979> the<00:06:08.099> proven<00:06:08.370> key 00:06:08.450 --> 00:06:08.460 align:start position:0% input does not need it so the proven key 00:06:08.460 --> 00:06:10.580 align:start position:0% input does not need it so the proven key is<00:06:08.520> just<00:06:08.759> the<00:06:08.849> circuit<00:06:09.180> itself<00:06:09.330> and<00:06:09.779> for<00:06:10.469> each 00:06:10.580 --> 00:06:10.590 align:start position:0% is just the circuit itself and for each 00:06:10.590 --> 00:06:14.300 align:start position:0% is just the circuit itself and for each proof<00:06:10.919> there<00:06:11.930> to<00:06:12.930> Kunda<00:06:13.199> to<00:06:13.500> present<00:06:13.979> to<00:06:14.069> prove 00:06:14.300 --> 00:06:14.310 align:start position:0% proof there to Kunda to present to prove 00:06:14.310 --> 00:06:16.309 align:start position:0% proof there to Kunda to present to prove the<00:06:14.460> creative<00:06:14.819> proof<00:06:15.060> you<00:06:15.509> have<00:06:15.719> to<00:06:15.930> kind<00:06:16.229> of 00:06:16.309 --> 00:06:16.319 align:start position:0% the creative proof you have to kind of 00:06:16.319 --> 00:06:19.370 align:start position:0% the creative proof you have to kind of match<00:06:16.590> your<00:06:17.279> execution<00:06:18.029> your<00:06:18.779> computation 00:06:19.370 --> 00:06:19.380 align:start position:0% match your execution your computation 00:06:19.380 --> 00:06:21.800 align:start position:0% match your execution your computation with<00:06:19.830> the<00:06:19.949> proven<00:06:20.250> key<00:06:20.460> so<00:06:20.669> with<00:06:21.060> a<00:06:21.090> circuit<00:06:21.569> or 00:06:21.800 --> 00:06:21.810 align:start position:0% with the proven key so with a circuit or 00:06:21.810 --> 00:06:24.860 align:start position:0% with the proven key so with a circuit or with<00:06:22.349> the<00:06:22.529> circuit<00:06:22.919> on<00:06:23.009> secretin<00:06:23.569> so<00:06:24.569> you<00:06:24.659> have 00:06:24.860 --> 00:06:24.870 align:start position:0% with the circuit on secretin so you have 00:06:24.870 --> 00:06:27.580 align:start position:0% with the circuit on secretin so you have to<00:06:24.990> like<00:06:25.110> combine<00:06:25.409> the<00:06:25.830> two<00:06:25.949> traces<00:06:26.370> and 00:06:27.580 --> 00:06:27.590 align:start position:0% to like combine the two traces and 00:06:27.590 --> 00:06:30.290 align:start position:0% to like combine the two traces and that's<00:06:28.590> why<00:06:28.830> the<00:06:29.400> bigger<00:06:29.550> the<00:06:29.789> circuit<00:06:30.120> is 00:06:30.290 --> 00:06:30.300 align:start position:0% that's why the bigger the circuit is 00:06:30.300 --> 00:06:32.600 align:start position:0% that's why the bigger the circuit is that<00:06:30.690> longer<00:06:31.020> it<00:06:31.259> takes<00:06:31.469> to<00:06:31.710> construct<00:06:32.490> the 00:06:32.600 --> 00:06:32.610 align:start position:0% that longer it takes to construct the 00:06:32.610 --> 00:06:36.409 align:start position:0% that longer it takes to construct the proof<00:06:32.849> and<00:06:34.219> it<00:06:35.219> depends<00:06:35.729> on<00:06:35.789> the<00:06:35.940> circuit<00:06:36.240> size 00:06:36.409 --> 00:06:36.419 align:start position:0% proof and it depends on the circuit size 00:06:36.419 --> 00:06:39.469 align:start position:0% proof and it depends on the circuit size it<00:06:36.990> also<00:06:37.199> depends<00:06:37.680> on<00:06:37.770> like<00:06:37.979> if<00:06:38.310> it's<00:06:38.669> a<00:06:38.880> break 00:06:39.469 --> 00:06:39.479 align:start position:0% it also depends on like if it's a break 00:06:39.479 --> 00:06:40.360 align:start position:0% it also depends on like if it's a break trace<00:06:39.870> like 00:06:40.360 --> 00:06:40.370 align:start position:0% trace like 00:06:40.370 --> 00:06:42.490 align:start position:0% trace like can<00:06:40.490> snarks<00:06:40.940> like<00:06:41.419> a<00:06:41.449> starch<00:06:41.840> then<00:06:42.139> and 00:06:42.490 --> 00:06:42.500 align:start position:0% can snarks like a starch then and 00:06:42.500 --> 00:06:45.370 align:start position:0% can snarks like a starch then and depends<00:06:42.949> on<00:06:43.010> the<00:06:43.100> width<00:06:43.340> of<00:06:43.460> the<00:06:43.699> size<00:06:44.419> of<00:06:45.169> the 00:06:45.370 --> 00:06:45.380 align:start position:0% depends on the width of the size of the 00:06:45.380 --> 00:06:47.620 align:start position:0% depends on the width of the size of the state<00:06:45.590> operates<00:06:46.040> with<00:06:46.190> on<00:06:46.550> the<00:06:46.790> degree<00:06:47.180> if<00:06:47.449> you 00:06:47.620 --> 00:06:47.630 align:start position:0% state operates with on the degree if you 00:06:47.630 --> 00:06:50.070 align:start position:0% state operates with on the degree if you permit<00:06:48.050> arbitrary<00:06:48.620> degree<00:06:48.770> so<00:06:49.430> different 00:06:50.070 --> 00:06:50.080 align:start position:0% permit arbitrary degree so different 00:06:50.080 --> 00:06:52.689 align:start position:0% permit arbitrary degree so different parameters<00:06:51.080> are<00:06:51.350> invoked<00:06:51.740> and<00:06:52.100> the<00:06:52.310> foremost 00:06:52.689 --> 00:06:52.699 align:start position:0% parameters are invoked and the foremost 00:06:52.699 --> 00:06:55.360 align:start position:0% parameters are invoked and the foremost might<00:06:52.970> not<00:06:53.240> be<00:06:53.419> very<00:06:54.290> simple<00:06:54.710> but<00:06:54.740> there 00:06:55.360 --> 00:06:55.370 align:start position:0% might not be very simple but there 00:06:55.370 --> 00:06:58.180 align:start position:0% might not be very simple but there there's<00:06:55.790> still<00:06:56.060> some<00:06:56.210> metric<00:06:56.570> to<00:06:56.720> to<00:06:57.260> optimize 00:06:58.180 --> 00:06:58.190 align:start position:0% there's still some metric to to optimize 00:06:58.190 --> 00:07:01.090 align:start position:0% there's still some metric to to optimize and<00:06:58.540> we<00:06:59.540> know<00:06:59.690> this<00:06:59.900> metrics<00:07:00.440> approximately 00:07:01.090 --> 00:07:01.100 align:start position:0% and we know this metrics approximately 00:07:01.100 --> 00:07:03.100 align:start position:0% and we know this metrics approximately for<00:07:01.250> snarks<00:07:01.639> we<00:07:02.090> know<00:07:02.240> such<00:07:02.570> metrics<00:07:02.960> for 00:07:03.100 --> 00:07:03.110 align:start position:0% for snarks we know such metrics for 00:07:03.110 --> 00:07:04.800 align:start position:0% for snarks we know such metrics for bullet<00:07:03.350> proof<00:07:03.500> so<00:07:03.680> no<00:07:03.800> such<00:07:03.949> metrics<00:07:04.280> for 00:07:04.800 --> 00:07:04.810 align:start position:0% bullet proof so no such metrics for 00:07:04.810 --> 00:07:09.879 align:start position:0% bullet proof so no such metrics for starks<00:07:06.850> so<00:07:07.850> the<00:07:08.690> question<00:07:09.050> is<00:07:09.199> the<00:07:09.590> question 00:07:09.879 --> 00:07:09.889 align:start position:0% starks so the question is the question 00:07:09.889 --> 00:07:12.820 align:start position:0% starks so the question is the question that<00:07:09.919> should<00:07:10.280> have<00:07:10.460> been<00:07:11.169> put 00:07:12.820 --> 00:07:12.830 align:start position:0% that should have been put 00:07:12.830 --> 00:07:15.490 align:start position:0% that should have been put when<00:07:13.250> snarks<00:07:13.820> and<00:07:13.970> tark's<00:07:14.210> were<00:07:14.360> designed<00:07:14.810> so 00:07:15.490 --> 00:07:15.500 align:start position:0% when snarks and tark's were designed so 00:07:15.500 --> 00:07:17.290 align:start position:0% when snarks and tark's were designed so kind<00:07:15.889> of<00:07:15.979> we<00:07:16.190> cryptographic<00:07:16.550> community<00:07:16.820> bit 00:07:17.290 --> 00:07:17.300 align:start position:0% kind of we cryptographic community bit 00:07:17.300 --> 00:07:21.010 align:start position:0% kind of we cryptographic community bit missed<00:07:17.600> this<00:07:18.289> question<00:07:19.570> this<00:07:20.570> requirement 00:07:21.010 --> 00:07:21.020 align:start position:0% missed this question this requirement 00:07:21.020 --> 00:07:22.870 align:start position:0% missed this question this requirement that<00:07:21.260> we<00:07:21.590> there<00:07:22.100> is<00:07:22.190> a<00:07:22.220> need<00:07:22.520> in<00:07:22.699> hash 00:07:22.870 --> 00:07:22.880 align:start position:0% that we there is a need in hash 00:07:22.880 --> 00:07:25.000 align:start position:0% that we there is a need in hash functions<00:07:23.360> that<00:07:23.840> operate<00:07:24.080> in<00:07:24.530> big<00:07:24.710> prime 00:07:25.000 --> 00:07:25.010 align:start position:0% functions that operate in big prime 00:07:25.010 --> 00:07:27.790 align:start position:0% functions that operate in big prime fields<00:07:25.460> or<00:07:25.639> big<00:07:26.060> binary<00:07:26.300> fields<00:07:26.870> that<00:07:27.590> are 00:07:27.790 --> 00:07:27.800 align:start position:0% fields or big binary fields that are 00:07:27.800 --> 00:07:29.950 align:start position:0% fields or big binary fields that are best<00:07:27.979> in<00:07:28.130> certain<00:07:28.430> metrics<00:07:28.610> like<00:07:29.120> circuit 00:07:29.950 --> 00:07:29.960 align:start position:0% best in certain metrics like circuit 00:07:29.960 --> 00:07:32.830 align:start position:0% best in certain metrics like circuit size<00:07:30.139> or<00:07:30.560> degree<00:07:31.250> size<00:07:31.729> products<00:07:32.479> like<00:07:32.660> in 00:07:32.830 --> 00:07:32.840 align:start position:0% size or degree size products like in 00:07:32.840 --> 00:07:35.140 align:start position:0% size or degree size products like in Starks<00:07:33.199> and<00:07:33.410> that<00:07:34.130> there<00:07:34.460> of<00:07:34.550> course<00:07:34.699> secure 00:07:35.140 --> 00:07:35.150 align:start position:0% Starks and that there of course secure 00:07:35.150 --> 00:07:36.939 align:start position:0% Starks and that there of course secure because<00:07:35.510> the<00:07:36.169> first<00:07:36.350> two<00:07:36.560> are<00:07:36.650> easy<00:07:36.770> to 00:07:36.939 --> 00:07:36.949 align:start position:0% because the first two are easy to 00:07:36.949 --> 00:07:39.219 align:start position:0% because the first two are easy to construct<00:07:37.190> it's<00:07:37.970> difficult<00:07:38.750> to<00:07:38.900> create<00:07:39.110> a 00:07:39.219 --> 00:07:39.229 align:start position:0% construct it's difficult to create a 00:07:39.229 --> 00:07:42.610 align:start position:0% construct it's difficult to create a secure<00:07:39.620> one<00:07:39.830> and<00:07:41.260> fortunately<00:07:42.260> our 00:07:42.610 --> 00:07:42.620 align:start position:0% secure one and fortunately our 00:07:42.620 --> 00:07:44.290 align:start position:0% secure one and fortunately our cryptographic<00:07:43.220> encryption<00:07:43.699> oolitic 00:07:44.290 --> 00:07:44.300 align:start position:0% cryptographic encryption oolitic 00:07:44.300 --> 00:07:46.270 align:start position:0% cryptographic encryption oolitic experience<00:07:44.900> allows<00:07:45.260> us<00:07:45.470> to<00:07:45.620> create<00:07:45.919> really 00:07:46.270 --> 00:07:46.280 align:start position:0% experience allows us to create really 00:07:46.280 --> 00:07:47.770 align:start position:0% experience allows us to create really fast<00:07:46.639> hash<00:07:46.880> functions<00:07:47.240> because<00:07:47.479> we<00:07:47.599> know 00:07:47.770 --> 00:07:47.780 align:start position:0% fast hash functions because we know 00:07:47.780 --> 00:07:49.450 align:start position:0% fast hash functions because we know certain<00:07:48.410> constructions<00:07:49.130> that<00:07:49.190> are 00:07:49.450 --> 00:07:49.460 align:start position:0% certain constructions that are 00:07:49.460 --> 00:07:52.870 align:start position:0% certain constructions that are reasonably<00:07:49.849> that<00:07:50.500> certainly<00:07:51.500> fast<00:07:51.860> and<00:07:52.280> that 00:07:52.870 --> 00:07:52.880 align:start position:0% reasonably that certainly fast and that 00:07:52.880 --> 00:07:57.370 align:start position:0% reasonably that certainly fast and that we<00:07:53.539> have<00:07:55.180> analyzed<00:07:56.180> them<00:07:56.450> with<00:07:56.599> crypto<00:07:57.020> noses 00:07:57.370 --> 00:07:57.380 align:start position:0% we have analyzed them with crypto noses 00:07:57.380 --> 00:07:59.710 align:start position:0% we have analyzed them with crypto noses for<00:07:57.560> years<00:07:57.979> for<00:07:58.220> decades<00:07:58.370> and<00:07:58.849> we<00:07:58.910> know<00:07:59.210> like 00:07:59.710 --> 00:07:59.720 align:start position:0% for years for decades and we know like 00:07:59.720 --> 00:08:01.360 align:start position:0% for years for decades and we know like the<00:07:59.960> methods<00:08:00.289> that<00:08:00.410> could<00:08:00.620> work<00:08:00.830> the<00:08:01.039> methods 00:08:01.360 --> 00:08:01.370 align:start position:0% the methods that could work the methods 00:08:01.370 --> 00:08:02.800 align:start position:0% the methods that could work the methods that<00:08:01.430> usually<00:08:01.789> do<00:08:01.910> not<00:08:02.060> work<00:08:02.330> and<00:08:02.510> we<00:08:02.690> can 00:08:02.800 --> 00:08:02.810 align:start position:0% that usually do not work and we can 00:08:02.810 --> 00:08:04.659 align:start position:0% that usually do not work and we can quickly<00:08:03.020> make<00:08:03.289> a<00:08:03.560> hash<00:08:03.950> function<00:08:03.979> that<00:08:04.490> is 00:08:04.659 --> 00:08:04.669 align:start position:0% quickly make a hash function that is 00:08:04.669 --> 00:08:07.320 align:start position:0% quickly make a hash function that is secure<00:08:05.030> and<00:08:05.270> that<00:08:05.680> satisfies<00:08:06.680> this 00:08:07.320 --> 00:08:07.330 align:start position:0% secure and that satisfies this 00:08:07.330 --> 00:08:10.270 align:start position:0% secure and that satisfies this requirements<00:08:08.470> so<00:08:09.470> one<00:08:09.620> the<00:08:09.800> first<00:08:09.949> approach 00:08:10.270 --> 00:08:10.280 align:start position:0% requirements so one the first approach 00:08:10.280 --> 00:08:13.540 align:start position:0% requirements so one the first approach was<00:08:10.639> mi<00:08:11.050> mc3<00:08:12.050> years<00:08:12.320> ago<00:08:12.590> and<00:08:12.770> there<00:08:12.949> the<00:08:13.250> ideas 00:08:13.540 --> 00:08:13.550 align:start position:0% was mi mc3 years ago and there the ideas 00:08:13.550 --> 00:08:16.659 align:start position:0% was mi mc3 years ago and there the ideas from<00:08:13.760> my<00:08:13.940> MC<00:08:14.240> was<00:08:14.360> pretty<00:08:14.630> simple<00:08:15.110> so<00:08:15.949> in<00:08:16.520> the 00:08:16.659 --> 00:08:16.669 align:start position:0% from my MC was pretty simple so in the 00:08:16.669 --> 00:08:17.890 align:start position:0% from my MC was pretty simple so in the core<00:08:16.970> of<00:08:17.000> the<00:08:17.180> mind<00:08:17.479> see<00:08:17.660> there<00:08:17.810> is<00:08:17.870> a 00:08:17.890 --> 00:08:17.900 align:start position:0% core of the mind see there is a 00:08:17.900 --> 00:08:20.770 align:start position:0% core of the mind see there is a permutation<00:08:18.520> so<00:08:19.520> originally<00:08:20.000> it<00:08:20.060> appears<00:08:20.599> as 00:08:20.770 --> 00:08:20.780 align:start position:0% permutation so originally it appears as 00:08:20.780 --> 00:08:23.409 align:start position:0% permutation so originally it appears as a<00:08:20.810> cipher<00:08:21.260> but<00:08:21.520> if<00:08:22.520> you<00:08:22.669> want<00:08:22.849> hash<00:08:23.000> function 00:08:23.409 --> 00:08:23.419 align:start position:0% a cipher but if you want hash function 00:08:23.419 --> 00:08:26.790 align:start position:0% a cipher but if you want hash function decide<00:08:23.690> the<00:08:23.840> key<00:08:24.139> can<00:08:24.380> be<00:08:24.590> a<00:08:24.620> random<00:08:24.979> number 00:08:26.790 --> 00:08:26.800 align:start position:0% decide the key can be a random number 00:08:26.800 --> 00:08:30.700 align:start position:0% decide the key can be a random number it's<00:08:27.800> okay<00:08:27.979> here<00:08:28.220> so<00:08:29.229> the<00:08:30.229> idea<00:08:30.530> is<00:08:30.650> very 00:08:30.700 --> 00:08:30.710 align:start position:0% it's okay here so the idea is very 00:08:30.710 --> 00:08:36.510 align:start position:0% it's okay here so the idea is very simple<00:08:30.919> so<00:08:31.520> you<00:08:31.959> have<00:08:33.789> you<00:08:34.789> add<00:08:35.000> some<00:08:35.330> constant 00:08:36.510 --> 00:08:36.520 align:start position:0% simple so you have you add some constant 00:08:36.520 --> 00:08:40.269 align:start position:0% simple so you have you add some constant then<00:08:37.520> you<00:08:37.760> and<00:08:38.659> you<00:08:38.839> operate<00:08:39.229> in<00:08:39.620> a<00:08:39.800> big<00:08:39.979> field 00:08:40.269 --> 00:08:40.279 align:start position:0% then you and you operate in a big field 00:08:40.279 --> 00:08:44.230 align:start position:0% then you and you operate in a big field by<00:08:41.209> default<00:08:41.719> some<00:08:41.990> prime<00:08:42.950> field<00:08:43.310> and<00:08:43.640> then<00:08:44.120> you 00:08:44.230 --> 00:08:44.240 align:start position:0% by default some prime field and then you 00:08:44.240 --> 00:08:46.240 align:start position:0% by default some prime field and then you raise<00:08:44.510> your<00:08:44.930> result<00:08:45.500> of<00:08:45.620> the<00:08:45.680> power<00:08:45.830> of<00:08:46.040> three 00:08:46.240 --> 00:08:46.250 align:start position:0% raise your result of the power of three 00:08:46.250 --> 00:08:48.490 align:start position:0% raise your result of the power of three in<00:08:46.370> this<00:08:46.490> field<00:08:46.790> so<00:08:47.540> you<00:08:47.570> Square<00:08:48.080> and<00:08:48.350> then 00:08:48.490 --> 00:08:48.500 align:start position:0% in this field so you Square and then 00:08:48.500 --> 00:08:51.579 align:start position:0% in this field so you Square and then multiply<00:08:49.040> again<00:08:49.420> then<00:08:50.420> you<00:08:50.600> add<00:08:50.810> the<00:08:51.050> constant 00:08:51.579 --> 00:08:51.589 align:start position:0% multiply again then you add the constant 00:08:51.589 --> 00:08:53.770 align:start position:0% multiply again then you add the constant then<00:08:51.920> use<00:08:52.160> then<00:08:52.790> you 00:08:53.770 --> 00:08:53.780 align:start position:0% then use then you 00:08:53.780 --> 00:08:55.660 align:start position:0% then use then you put<00:08:54.080> to<00:08:54.500> the<00:08:54.620> power<00:08:54.800> raised<00:08:55.220> to<00:08:55.310> the<00:08:55.400> power<00:08:55.520> of 00:08:55.660 --> 00:08:55.670 align:start position:0% put to the power raised to the power of 00:08:55.670 --> 00:08:57.820 align:start position:0% put to the power raised to the power of three<00:08:55.880> then<00:08:56.540> at<00:08:56.810> constant<00:08:57.380> to<00:08:57.500> the<00:08:57.590> power<00:08:57.740> of 00:08:57.820 --> 00:08:57.830 align:start position:0% three then at constant to the power of 00:08:57.830 --> 00:09:00.340 align:start position:0% three then at constant to the power of three<00:08:57.980> and<00:08:58.010> so<00:08:58.250> on<00:08:58.280> and<00:08:58.610> each<00:08:59.600> time<00:08:59.990> they'd 00:09:00.340 --> 00:09:00.350 align:start position:0% three and so on and each time they'd 00:09:00.350 --> 00:09:03.160 align:start position:0% three and so on and each time they'd agree<00:09:00.680> so<00:09:01.190> if<00:09:01.310> you<00:09:01.460> express<00:09:01.790> actually<00:09:02.480> it's 00:09:03.160 --> 00:09:03.170 align:start position:0% agree so if you express actually it's 00:09:03.170 --> 00:09:06.640 align:start position:0% agree so if you express actually it's easy<00:09:03.590> to<00:09:03.800> show<00:09:04.070> that<00:09:04.100> typical<00:09:05.650> Cryptologic 00:09:06.640 --> 00:09:06.650 align:start position:0% easy to show that typical Cryptologic 00:09:06.650 --> 00:09:08.260 align:start position:0% easy to show that typical Cryptologic attacks<00:09:06.890> are<00:09:07.040> differential<00:09:07.580> linear<00:09:07.910> kernels 00:09:08.260 --> 00:09:08.270 align:start position:0% attacks are differential linear kernels 00:09:08.270 --> 00:09:10.960 align:start position:0% attacks are differential linear kernels don't<00:09:08.540> work<00:09:08.780> here<00:09:09.080> because<00:09:09.920> of<00:09:10.310> algebraic 00:09:10.960 --> 00:09:10.970 align:start position:0% don't work here because of algebraic 00:09:10.970 --> 00:09:12.550 align:start position:0% don't work here because of algebraic structure<00:09:11.300> because<00:09:11.540> the<00:09:11.570> state<00:09:11.810> is<00:09:11.960> very<00:09:12.080> wide 00:09:12.550 --> 00:09:12.560 align:start position:0% structure because the state is very wide 00:09:12.560 --> 00:09:15.730 align:start position:0% structure because the state is very wide but<00:09:13.460> algebraic<00:09:14.180> attacks<00:09:14.510> work<00:09:14.810> and<00:09:15.080> the<00:09:15.590> thing 00:09:15.730 --> 00:09:15.740 align:start position:0% but algebraic attacks work and the thing 00:09:15.740 --> 00:09:18.850 align:start position:0% but algebraic attacks work and the thing is<00:09:15.860> we<00:09:15.980> have<00:09:16.160> to<00:09:16.450> make<00:09:17.450> our<00:09:17.690> the<00:09:17.930> degree<00:09:18.290> of<00:09:18.560> the 00:09:18.850 --> 00:09:18.860 align:start position:0% is we have to make our the degree of the 00:09:18.860 --> 00:09:22.240 align:start position:0% is we have to make our the degree of the polynomial<00:09:19.040> that<00:09:20.530> corresponds<00:09:21.530> to<00:09:21.620> this<00:09:21.950> to 00:09:22.240 --> 00:09:22.250 align:start position:0% polynomial that corresponds to this to 00:09:22.250 --> 00:09:23.380 align:start position:0% polynomial that corresponds to this to the<00:09:22.340> output<00:09:22.670> of<00:09:22.700> the<00:09:22.850> function<00:09:23.000> you<00:09:23.210> have<00:09:23.240> to 00:09:23.380 --> 00:09:23.390 align:start position:0% the output of the function you have to 00:09:23.390 --> 00:09:25.210 align:start position:0% the output of the function you have to make<00:09:23.630> that<00:09:23.810> the<00:09:24.260> polynomial<00:09:24.740> is<00:09:24.920> of<00:09:25.100> high 00:09:25.210 --> 00:09:25.220 align:start position:0% make that the polynomial is of high 00:09:25.220 --> 00:09:26.860 align:start position:0% make that the polynomial is of high degree<00:09:25.580> to<00:09:26.030> prevent<00:09:26.360> various<00:09:26.630> sorts<00:09:26.840> of 00:09:26.860 --> 00:09:26.870 align:start position:0% degree to prevent various sorts of 00:09:26.870 --> 00:09:29.020 align:start position:0% degree to prevent various sorts of attacks<00:09:27.140> and<00:09:27.440> the<00:09:27.920> degree<00:09:28.220> increases<00:09:28.880> like 00:09:29.020 --> 00:09:29.030 align:start position:0% attacks and the degree increases like 00:09:29.030 --> 00:09:31.090 align:start position:0% attacks and the degree increases like degree<00:09:29.450> multiplies<00:09:29.930> by<00:09:29.960> three<00:09:30.410> each<00:09:30.530> time<00:09:30.830> and 00:09:31.090 --> 00:09:31.100 align:start position:0% degree multiplies by three each time and 00:09:31.100 --> 00:09:37.360 align:start position:0% degree multiplies by three each time and the<00:09:31.580> maximum<00:09:31.910> possible<00:09:33.910> degree<00:09:34.910> is<00:09:36.370> actually 00:09:37.360 --> 00:09:37.370 align:start position:0% the maximum possible degree is actually 00:09:37.370 --> 00:09:39.520 align:start position:0% the maximum possible degree is actually two<00:09:37.490> to<00:09:37.640> the<00:09:37.730> n<00:09:37.850> when<00:09:38.150> n<00:09:38.330> is<00:09:38.510> their<00:09:38.750> width<00:09:39.020> or 00:09:39.520 --> 00:09:39.530 align:start position:0% two to the n when n is their width or 00:09:39.530 --> 00:09:43.590 align:start position:0% two to the n when n is their width or the<00:09:39.560> state<00:09:40.070> and<00:09:40.340> we<00:09:40.490> have<00:09:40.520> to<00:09:41.470> execute<00:09:42.470> like<00:09:42.830> a 00:09:43.590 --> 00:09:43.600 align:start position:0% the state and we have to execute like a 00:09:43.600 --> 00:09:47.080 align:start position:0% the state and we have to execute like a bit<00:09:44.600> less<00:09:44.780> than<00:09:45.080> n<00:09:45.350> steps<00:09:45.860> to<00:09:46.610> achieve<00:09:46.880> maximum 00:09:47.080 --> 00:09:47.090 align:start position:0% bit less than n steps to achieve maximum 00:09:47.090 --> 00:09:49.540 align:start position:0% bit less than n steps to achieve maximum degree<00:09:47.540> well<00:09:48.050> actually<00:09:48.260> actually<00:09:48.890> a<00:09:49.160> bit<00:09:49.310> more 00:09:49.540 --> 00:09:49.550 align:start position:0% degree well actually actually a bit more 00:09:49.550 --> 00:09:51.550 align:start position:0% degree well actually actually a bit more but<00:09:49.730> this<00:09:49.850> is<00:09:50.030> like<00:09:50.210> the<00:09:50.390> order<00:09:50.840> so<00:09:51.350> that<00:09:51.380> you 00:09:51.550 --> 00:09:51.560 align:start position:0% but this is like the order so that you 00:09:51.560 --> 00:09:53.560 align:start position:0% but this is like the order so that you understand<00:09:52.010> like<00:09:52.160> if<00:09:52.220> you<00:09:52.460> if<00:09:52.670> you<00:09:52.850> if<00:09:53.060> your 00:09:53.560 --> 00:09:53.570 align:start position:0% understand like if you if you if your 00:09:53.570 --> 00:09:58.180 align:start position:0% understand like if you if you if your permutation<00:09:54.260> is<00:09:54.530> I<00:09:54.920> know<00:09:56.020> 250<00:09:57.020> bits<00:09:57.230> wide<00:09:57.740> then 00:09:58.180 --> 00:09:58.190 align:start position:0% permutation is I know 250 bits wide then 00:09:58.190 --> 00:10:01.750 align:start position:0% permutation is I know 250 bits wide then you<00:09:58.370> need<00:09:58.610> kind<00:09:59.570> of<00:09:59.780> at<00:10:00.350> least<00:10:00.620> 100<00:10:01.370> sounds<00:10:01.550> and 00:10:01.750 --> 00:10:01.760 align:start position:0% you need kind of at least 100 sounds and 00:10:01.760 --> 00:10:06.550 align:start position:0% you need kind of at least 100 sounds and steps<00:10:02.030> to<00:10:02.480> achieve<00:10:02.720> maximum<00:10:03.170> degree<00:10:04.930> okay<00:10:05.930> so 00:10:06.550 --> 00:10:06.560 align:start position:0% steps to achieve maximum degree okay so 00:10:06.560 --> 00:10:11.740 align:start position:0% steps to achieve maximum degree okay so there<00:10:07.400> were<00:10:07.550> also<00:10:08.589> Patterson<00:10:09.589> hash<00:10:10.750> proposals 00:10:11.740 --> 00:10:11.750 align:start position:0% there were also Patterson hash proposals 00:10:11.750 --> 00:10:14.950 align:start position:0% there were also Patterson hash proposals but<00:10:12.050> we<00:10:12.440> can<00:10:12.589> directly<00:10:13.040> go<00:10:13.420> to<00:10:14.420> our 00:10:14.950 --> 00:10:14.960 align:start position:0% but we can directly go to our 00:10:14.960 --> 00:10:17.400 align:start position:0% but we can directly go to our contributions<00:10:15.620> because<00:10:15.950> the<00:10:16.250> others<00:10:16.520> are<00:10:16.730> not 00:10:17.400 --> 00:10:17.410 align:start position:0% contributions because the others are not 00:10:17.410 --> 00:10:19.780 align:start position:0% contributions because the others are not exact<00:10:18.410> so<00:10:18.500> they're<00:10:18.860> in<00:10:19.100> different<00:10:19.250> paradigm 00:10:19.780 --> 00:10:19.790 align:start position:0% exact so they're in different paradigm 00:10:19.790 --> 00:10:21.490 align:start position:0% exact so they're in different paradigm constructed<00:10:20.420> and<00:10:20.600> kind<00:10:21.140> of<00:10:21.200> not<00:10:21.380> so 00:10:21.490 --> 00:10:21.500 align:start position:0% constructed and kind of not so 00:10:21.500 --> 00:10:25.420 align:start position:0% constructed and kind of not so interesting<00:10:22.400> for<00:10:22.520> us<00:10:23.050> so<00:10:24.050> our<00:10:24.890> contributions 00:10:25.420 --> 00:10:25.430 align:start position:0% interesting for us so our contributions 00:10:25.430 --> 00:10:27.370 align:start position:0% interesting for us so our contributions consist<00:10:25.730> of<00:10:25.820> two<00:10:25.940> parts<00:10:26.270> so<00:10:26.810> the<00:10:26.960> first<00:10:27.110> part 00:10:27.370 --> 00:10:27.380 align:start position:0% consist of two parts so the first part 00:10:27.380 --> 00:10:30.310 align:start position:0% consist of two parts so the first part as<00:10:27.880> more<00:10:28.880> generic<00:10:29.300> so<00:10:29.660> it's<00:10:29.780> about<00:10:29.930> it's<00:10:30.170> about 00:10:30.310 --> 00:10:30.320 align:start position:0% as more generic so it's about it's about 00:10:30.320 --> 00:10:32.620 align:start position:0% as more generic so it's about it's about miracle<00:10:30.800> trees<00:10:31.010> and<00:10:31.280> it<00:10:31.820> turns<00:10:32.000> out<00:10:32.180> that<00:10:32.360> we 00:10:32.620 --> 00:10:32.630 align:start position:0% miracle trees and it turns out that we 00:10:32.630 --> 00:10:35.200 align:start position:0% miracle trees and it turns out that we can<00:10:32.780> do<00:10:32.960> we<00:10:33.860> can<00:10:33.890> handle<00:10:34.640> miracle<00:10:35.030> tree 00:10:35.200 --> 00:10:35.210 align:start position:0% can do we can handle miracle tree 00:10:35.210 --> 00:10:37.600 align:start position:0% can do we can handle miracle tree substantially<00:10:35.720> better<00:10:35.810> than<00:10:36.320> before<00:10:36.610> recall 00:10:37.600 --> 00:10:37.610 align:start position:0% substantially better than before recall 00:10:37.610 --> 00:10:39.579 align:start position:0% substantially better than before recall well<00:10:38.120> this<00:10:38.360> is<00:10:38.510> like<00:10:38.690> three<00:10:38.930> layer<00:10:39.110> miracle 00:10:39.579 --> 00:10:39.589 align:start position:0% well this is like three layer miracle 00:10:39.589 --> 00:10:42.190 align:start position:0% well this is like three layer miracle trees<00:10:39.800> vertical<00:10:40.550> tree<00:10:40.730> that<00:10:41.089> handles<00:10:41.960> eight 00:10:42.190 --> 00:10:42.200 align:start position:0% trees vertical tree that handles eight 00:10:42.200 --> 00:10:44.770 align:start position:0% trees vertical tree that handles eight messages<00:10:43.120> well<00:10:44.120> suppose<00:10:44.540> for<00:10:44.720> simplicity 00:10:44.770 --> 00:10:44.780 align:start position:0% messages well suppose for simplicity 00:10:44.780 --> 00:10:49.680 align:start position:0% messages well suppose for simplicity that<00:10:45.200> the<00:10:45.890> hash<00:10:46.070> function<00:10:46.339> it<00:10:46.790> takes<00:10:47.089> like<00:10:47.390> two 00:10:49.680 --> 00:10:49.690 align:start position:0% that the hash function it takes like two 00:10:49.690 --> 00:10:52.480 align:start position:0% that the hash function it takes like two we<00:10:50.690> consider<00:10:51.050> a<00:10:51.410> compression<00:10:51.800> function<00:10:52.310> that 00:10:52.480 --> 00:10:52.490 align:start position:0% we consider a compression function that 00:10:52.490 --> 00:10:54.220 align:start position:0% we consider a compression function that compresses<00:10:52.940> with<00:10:53.300> the<00:10:53.420> ratio<00:10:53.660> two<00:10:53.810> to<00:10:53.839> one<00:10:54.080> and 00:10:54.220 --> 00:10:54.230 align:start position:0% compresses with the ratio two to one and 00:10:54.230 --> 00:10:56.680 align:start position:0% compresses with the ratio two to one and every<00:10:55.160> message<00:10:55.520> is<00:10:55.640> of<00:10:55.850> the<00:10:56.000> size<00:10:56.240> of<00:10:56.450> the<00:10:56.570> hash 00:10:56.680 --> 00:10:56.690 align:start position:0% every message is of the size of the hash 00:10:56.690 --> 00:10:58.570 align:start position:0% every message is of the size of the hash function<00:10:56.720> output<00:10:57.470> and<00:10:57.650> then<00:10:58.070> in<00:10:58.220> this<00:10:58.310> case 00:10:58.570 --> 00:10:58.580 align:start position:0% function output and then in this case 00:10:58.580 --> 00:11:01.540 align:start position:0% function output and then in this case you<00:10:58.940> need<00:10:59.240> any<00:10:59.480> layers<00:10:59.810> to<00:11:00.110> hash<00:11:00.380> to<00:11:01.250> the<00:11:01.400> end 00:11:01.540 --> 00:11:01.550 align:start position:0% you need any layers to hash to the end 00:11:01.550 --> 00:11:06.460 align:start position:0% you need any layers to hash to the end messages<00:11:03.520> okay<00:11:04.520> and<00:11:05.180> the<00:11:05.420> thing<00:11:05.570> is<00:11:05.780> the<00:11:06.290> very 00:11:06.460 --> 00:11:06.470 align:start position:0% messages okay and the thing is the very 00:11:06.470 --> 00:11:07.480 align:start position:0% messages okay and the thing is the very nice<00:11:06.650> thing<00:11:06.920> is 00:11:07.480 --> 00:11:07.490 align:start position:0% nice thing is 00:11:07.490 --> 00:11:11.740 align:start position:0% nice thing is you<00:11:07.670> can<00:11:07.820> do<00:11:07.910> better<00:11:08.029> because<00:11:08.959> you<00:11:09.770> can<00:11:10.750> when 00:11:11.740 --> 00:11:11.750 align:start position:0% you can do better because you can when 00:11:11.750 --> 00:11:13.750 align:start position:0% you can do better because you can when you<00:11:11.839> have<00:11:11.870> form<00:11:12.740> when<00:11:13.100> you<00:11:13.190> have<00:11:13.339> two<00:11:13.550> layers 00:11:13.750 --> 00:11:13.760 align:start position:0% you have form when you have two layers 00:11:13.760 --> 00:11:15.730 align:start position:0% you have form when you have two layers you<00:11:14.420> can<00:11:14.450> process<00:11:14.810> more<00:11:15.110> than<00:11:15.170> four<00:11:15.529> messages 00:11:15.730 --> 00:11:15.740 align:start position:0% you can process more than four messages 00:11:15.740 --> 00:11:18.519 align:start position:0% you can process more than four messages you<00:11:16.550> can<00:11:16.730> take<00:11:16.910> fifth<00:11:17.240> one<00:11:17.510> and<00:11:17.779> then<00:11:18.350> jet 00:11:18.519 --> 00:11:18.529 align:start position:0% you can take fifth one and then jet 00:11:18.529 --> 00:11:22.930 align:start position:0% you can take fifth one and then jet carefully<00:11:19.339> we<00:11:19.880> XOR<00:11:20.360> in<00:11:21.339> several<00:11:22.339> hash 00:11:22.930 --> 00:11:22.940 align:start position:0% carefully we XOR in several hash 00:11:22.940 --> 00:11:27.910 align:start position:0% carefully we XOR in several hash function<00:11:23.300> outputs<00:11:23.720> in<00:11:24.110> three<00:11:24.500> and<00:11:26.500> well<00:11:27.500> you 00:11:27.910 --> 00:11:27.920 align:start position:0% function outputs in three and well you 00:11:27.920 --> 00:11:32.829 align:start position:0% function outputs in three and well you have<00:11:28.130> two<00:11:28.339> and<00:11:30.100> using<00:11:31.100> that<00:11:31.250> you<00:11:31.520> can<00:11:31.880> for 00:11:32.829 --> 00:11:32.839 align:start position:0% have two and using that you can for 00:11:32.839 --> 00:11:35.949 align:start position:0% have two and using that you can for every<00:11:33.260> like<00:11:33.470> two<00:11:34.070> layers<00:11:34.279> you<00:11:34.730> can<00:11:34.959> process 00:11:35.949 --> 00:11:35.959 align:start position:0% every like two layers you can process 00:11:35.959 --> 00:11:37.449 align:start position:0% every like two layers you can process not<00:11:36.110> four<00:11:36.410> messages<00:11:36.620> about<00:11:37.010> five<00:11:37.220> messages 00:11:37.449 --> 00:11:37.459 align:start position:0% not four messages about five messages 00:11:37.459 --> 00:11:39.699 align:start position:0% not four messages about five messages and<00:11:37.940> that's<00:11:38.089> give<00:11:38.300> you<00:11:38.450> well<00:11:38.959> not<00:11:39.140> so<00:11:39.290> big<00:11:39.500> but 00:11:39.699 --> 00:11:39.709 align:start position:0% and that's give you well not so big but 00:11:39.709 --> 00:11:42.550 align:start position:0% and that's give you well not so big but something<00:11:40.520> like<00:11:40.670> 20%<00:11:41.120> in<00:11:41.600> 15-20<00:11:42.440> percent 00:11:42.550 --> 00:11:42.560 align:start position:0% something like 20% in 15-20 percent 00:11:42.560 --> 00:11:45.760 align:start position:0% something like 20% in 15-20 percent increase<00:11:43.149> in<00:11:44.149> performance<00:11:44.360> should<00:11:45.260> give<00:11:45.470> and 00:11:45.760 --> 00:11:45.770 align:start position:0% increase in performance should give and 00:11:45.770 --> 00:11:49.000 align:start position:0% increase in performance should give and this<00:11:46.100> works<00:11:46.399> for<00:11:46.610> every<00:11:47.089> hash<00:11:48.020> function<00:11:48.470> and 00:11:49.000 --> 00:11:49.010 align:start position:0% this works for every hash function and 00:11:49.010 --> 00:11:50.710 align:start position:0% this works for every hash function and collisions<00:11:49.580> are<00:11:49.640> pretty<00:11:50.120> much<00:11:50.180> resistance<00:11:50.450> if 00:11:50.710 --> 00:11:50.720 align:start position:0% collisions are pretty much resistance if 00:11:50.720 --> 00:11:53.680 align:start position:0% collisions are pretty much resistance if it<00:11:50.810> decreases<00:11:51.320> but<00:11:52.300> collision<00:11:53.300> resistance 00:11:53.680 --> 00:11:53.690 align:start position:0% it decreases but collision resistance 00:11:53.690 --> 00:11:57.730 align:start position:0% it decreases but collision resistance remains<00:11:54.110> at<00:11:54.560> the<00:11:54.770> same<00:11:55.270> point<00:11:56.270> so<00:11:57.260> generalize 00:11:57.730 --> 00:11:57.740 align:start position:0% remains at the same point so generalize 00:11:57.740 --> 00:11:59.079 align:start position:0% remains at the same point so generalize birth<00:11:57.920> defect<00:11:58.220> also<00:11:58.459> doesn't<00:11:58.730> seem<00:11:58.790> to<00:11:58.940> work 00:11:59.079 --> 00:11:59.089 align:start position:0% birth defect also doesn't seem to work 00:11:59.089 --> 00:12:01.660 align:start position:0% birth defect also doesn't seem to work and<00:11:59.560> this<00:12:00.560> construction<00:12:00.950> works<00:12:01.220> for<00:12:01.370> any<00:12:01.520> hash 00:12:01.660 --> 00:12:01.670 align:start position:0% and this construction works for any hash 00:12:01.670 --> 00:12:05.620 align:start position:0% and this construction works for any hash function<00:12:02.890> even<00:12:03.890> more<00:12:04.130> efficiently<00:12:04.670> if<00:12:05.390> we 00:12:05.620 --> 00:12:05.630 align:start position:0% function even more efficiently if we 00:12:05.630 --> 00:12:08.350 align:start position:0% function even more efficiently if we have<00:12:05.899> a<00:12:05.930> hash<00:12:06.230> function<00:12:06.770> that<00:12:06.950> takes<00:12:07.610> that<00:12:07.970> can 00:12:08.350 --> 00:12:08.360 align:start position:0% have a hash function that takes that can 00:12:08.360 --> 00:12:11.199 align:start position:0% have a hash function that takes that can consume<00:12:08.810> our<00:12:09.050> bit<00:12:09.260> very<00:12:09.649> large<00:12:10.040> input<00:12:10.399> well 00:12:11.199 --> 00:12:11.209 align:start position:0% consume our bit very large input well 00:12:11.209 --> 00:12:12.790 align:start position:0% consume our bit very large input well with<00:12:11.480> regular<00:12:11.930> hash<00:12:12.110> functions<00:12:12.440> we<00:12:12.529> already 00:12:12.790 --> 00:12:12.800 align:start position:0% with regular hash functions we already 00:12:12.800 --> 00:12:16.510 align:start position:0% with regular hash functions we already have<00:12:13.040> that<00:12:13.310> like<00:12:13.970> we<00:12:14.240> can<00:12:14.420> we<00:12:14.930> can<00:12:15.079> feed<00:12:15.520> very 00:12:16.510 --> 00:12:16.520 align:start position:0% have that like we can we can feed very 00:12:16.520 --> 00:12:20.199 align:start position:0% have that like we can we can feed very big<00:12:16.670> input<00:12:16.820> to<00:12:17.120> sha-3<00:12:17.329> but<00:12:18.140> it<00:12:18.290> will<00:12:18.500> be<00:12:18.730> yes<00:12:19.730> a 00:12:20.199 --> 00:12:20.209 align:start position:0% big input to sha-3 but it will be yes a 00:12:20.209 --> 00:12:24.040 align:start position:0% big input to sha-3 but it will be yes a sort<00:12:20.630> of<00:12:21.190> sequential<00:12:22.190> on<00:12:22.399> vacation<00:12:22.880> and<00:12:23.060> here 00:12:24.040 --> 00:12:24.050 align:start position:0% sort of sequential on vacation and here 00:12:24.050 --> 00:12:26.079 align:start position:0% sort of sequential on vacation and here suppose<00:12:24.649> that<00:12:24.860> our<00:12:24.980> hash<00:12:25.399> function<00:12:25.430> is 00:12:26.079 --> 00:12:26.089 align:start position:0% suppose that our hash function is 00:12:26.089 --> 00:12:30.730 align:start position:0% suppose that our hash function is tailored<00:12:26.870> to<00:12:27.140> where<00:12:28.420> large<00:12:29.420> input<00:12:30.140> size<00:12:30.380> so 00:12:30.730 --> 00:12:30.740 align:start position:0% tailored to where large input size so 00:12:30.740 --> 00:12:33.610 align:start position:0% tailored to where large input size so the<00:12:30.860> output<00:12:31.850> size<00:12:32.060> is<00:12:32.329> small<00:12:32.660> but<00:12:33.140> what<00:12:33.350> the 00:12:33.610 --> 00:12:33.620 align:start position:0% the output size is small but what the 00:12:33.620 --> 00:12:37.240 align:start position:0% the output size is small but what the input<00:12:34.010> size<00:12:34.220> is<00:12:34.550> big<00:12:35.000> and<00:12:35.300> we<00:12:36.079> use<00:12:36.290> this<00:12:36.529> large 00:12:37.240 --> 00:12:37.250 align:start position:0% input size is big and we use this large 00:12:37.250 --> 00:12:40.050 align:start position:0% input size is big and we use this large with<00:12:37.610> to<00:12:38.329> achieve<00:12:38.720> cryptographic<00:12:39.440> security 00:12:40.050 --> 00:12:40.060 align:start position:0% with to achieve cryptographic security 00:12:40.060 --> 00:12:42.670 align:start position:0% with to achieve cryptographic security thing<00:12:41.060> is<00:12:41.240> we<00:12:41.480> can<00:12:41.630> then<00:12:41.870> decrease<00:12:42.290> the<00:12:42.440> number 00:12:42.670 --> 00:12:42.680 align:start position:0% thing is we can then decrease the number 00:12:42.680 --> 00:12:44.560 align:start position:0% thing is we can then decrease the number of<00:12:42.709> layers<00:12:43.459> of<00:12:43.610> course<00:12:44.029> so<00:12:44.209> if<00:12:44.329> for<00:12:44.510> example 00:12:44.560 --> 00:12:44.570 align:start position:0% of layers of course so if for example 00:12:44.570 --> 00:12:47.470 align:start position:0% of layers of course so if for example you<00:12:45.250> process<00:12:46.250> the<00:12:46.459> ratio<00:12:46.820> is<00:12:46.940> four<00:12:47.180> to<00:12:47.360> one 00:12:47.470 --> 00:12:47.480 align:start position:0% you process the ratio is four to one 00:12:47.480 --> 00:12:52.319 align:start position:0% you process the ratio is four to one that<00:12:47.750> you<00:12:47.870> need<00:12:48.050> to<00:12:48.200> twice<00:12:48.529> fewer<00:12:49.279> layers<00:12:49.570> and 00:12:52.319 --> 00:12:52.329 align:start position:0% that you need to twice fewer layers and 00:12:52.329 --> 00:12:56.290 align:start position:0% that you need to twice fewer layers and what<00:12:53.329> do<00:12:53.450> we<00:12:53.540> need<00:12:53.810> how<00:12:54.440> can<00:12:54.709> we<00:12:54.890> do<00:12:55.370> that<00:12:55.579> so 00:12:56.290 --> 00:12:56.300 align:start position:0% what do we need how can we do that so 00:12:56.300 --> 00:12:59.380 align:start position:0% what do we need how can we do that so what's<00:12:56.600> the<00:12:57.230> most<00:12:57.410> optimal<00:12:57.920> way<00:12:57.950> of<00:12:58.820> Parisian 00:12:59.380 --> 00:12:59.390 align:start position:0% what's the most optimal way of Parisian 00:12:59.390 --> 00:13:02.560 align:start position:0% what's the most optimal way of Parisian and<00:12:59.660> it<00:13:00.620> turns<00:13:00.860> out<00:13:01.040> that<00:13:01.310> if<00:13:02.060> we<00:13:02.209> want<00:13:02.450> to 00:13:02.560 --> 00:13:02.570 align:start position:0% and it turns out that if we want to 00:13:02.570 --> 00:13:05.110 align:start position:0% and it turns out that if we want to process<00:13:02.870> some<00:13:03.320> very<00:13:03.770> wide<00:13:04.160> input<00:13:04.670> with<00:13:04.880> a<00:13:04.910> hash 00:13:05.110 --> 00:13:05.120 align:start position:0% process some very wide input with a hash 00:13:05.120 --> 00:13:08.880 align:start position:0% process some very wide input with a hash function<00:13:05.500> then<00:13:06.500> a<00:13:06.950> very<00:13:07.339> secure<00:13:08.300> and 00:13:08.880 --> 00:13:08.890 align:start position:0% function then a very secure and 00:13:08.890 --> 00:13:11.319 align:start position:0% function then a very secure and construction<00:13:09.890> is<00:13:10.100> the<00:13:10.160> framework<00:13:10.820> it's<00:13:11.240> a 00:13:11.319 --> 00:13:11.329 align:start position:0% construction is the framework it's a 00:13:11.329 --> 00:13:13.269 align:start position:0% construction is the framework it's a cold<00:13:11.510> spawns<00:13:11.810> mode<00:13:12.050> of<00:13:12.200> operation<00:13:12.680> and<00:13:12.890> it's 00:13:13.269 --> 00:13:13.279 align:start position:0% cold spawns mode of operation and it's 00:13:13.279 --> 00:13:15.699 align:start position:0% cold spawns mode of operation and it's based<00:13:13.490> on<00:13:13.760> permutations<00:13:14.600> very<00:13:15.410> wide 00:13:15.699 --> 00:13:15.709 align:start position:0% based on permutations very wide 00:13:15.709 --> 00:13:17.890 align:start position:0% based on permutations very wide permutation<00:13:16.250> means<00:13:16.670> permutation<00:13:17.120> I<00:13:17.480> mean 00:13:17.890 --> 00:13:17.900 align:start position:0% permutation means permutation I mean 00:13:17.900 --> 00:13:20.380 align:start position:0% permutation means permutation I mean that<00:13:18.400> it's<00:13:19.400> transformation<00:13:20.120> is<00:13:20.270> the 00:13:20.380 --> 00:13:20.390 align:start position:0% that it's transformation is the 00:13:20.390 --> 00:13:22.000 align:start position:0% that it's transformation is the invertible<00:13:20.900> transformation<00:13:20.959> that<00:13:21.650> applies 00:13:22.000 --> 00:13:22.010 align:start position:0% invertible transformation that applies 00:13:22.010 --> 00:13:24.819 align:start position:0% invertible transformation that applies to<00:13:22.040> very<00:13:22.430> wide<00:13:22.670> block<00:13:23.199> here<00:13:24.199> the<00:13:24.350> blur<00:13:24.529> the 00:13:24.819 --> 00:13:24.829 align:start position:0% to very wide block here the blur the 00:13:24.829 --> 00:13:30.550 align:start position:0% to very wide block here the blur the permutation<00:13:25.699> is<00:13:26.029> of<00:13:26.270> with<00:13:26.540> like<00:13:28.839> 768<00:13:29.839> bits<00:13:30.350> or 00:13:30.550 --> 00:13:30.560 align:start position:0% permutation is of with like 768 bits or 00:13:30.560 --> 00:13:32.920 align:start position:0% permutation is of with like 768 bits or more<00:13:30.949> thousand<00:13:31.730> bits<00:13:31.880> to<00:13:32.150> thousand<00:13:32.600> bits<00:13:32.720> four 00:13:32.920 --> 00:13:32.930 align:start position:0% more thousand bits to thousand bits four 00:13:32.930 --> 00:13:34.630 align:start position:0% more thousand bits to thousand bits four thousand<00:13:33.290> bits<00:13:33.410> we<00:13:33.560> know<00:13:33.800> how<00:13:34.040> such 00:13:34.630 --> 00:13:34.640 align:start position:0% thousand bits we know how such 00:13:34.640 --> 00:13:39.040 align:start position:0% thousand bits we know how such permutations<00:13:35.240> can<00:13:35.420> be<00:13:35.570> constructed<00:13:36.230> and<00:13:38.050> the 00:13:39.040 --> 00:13:39.050 align:start position:0% permutations can be constructed and the 00:13:39.050 --> 00:13:41.199 align:start position:0% permutations can be constructed and the idea<00:13:39.350> of<00:13:39.500> how<00:13:39.890> they<00:13:40.040> operate<00:13:40.339> is<00:13:40.730> very<00:13:40.910> simple 00:13:41.199 --> 00:13:41.209 align:start position:0% idea of how they operate is very simple 00:13:41.209 --> 00:13:44.110 align:start position:0% idea of how they operate is very simple so<00:13:41.329> message<00:13:41.660> is<00:13:41.810> sort<00:13:42.290> not<00:13:42.980> on<00:13:43.459> to<00:13:43.670> the<00:13:43.790> entire 00:13:44.110 --> 00:13:44.120 align:start position:0% so message is sort not on to the entire 00:13:44.120 --> 00:13:47.380 align:start position:0% so message is sort not on to the entire state<00:13:44.570> but<00:13:44.870> all<00:13:45.709> the<00:13:45.980> state<00:13:46.220> but<00:13:46.670> some 00:13:47.380 --> 00:13:47.390 align:start position:0% state but all the state but some 00:13:47.390 --> 00:13:49.660 align:start position:0% state but all the state but some so-called<00:13:47.600> capacity<00:13:48.500> bits<00:13:48.709> capacities<00:13:49.339> twice 00:13:49.660 --> 00:13:49.670 align:start position:0% so-called capacity bits capacities twice 00:13:49.670 --> 00:13:51.970 align:start position:0% so-called capacity bits capacities twice the<00:13:49.880> security<00:13:50.329> level<00:13:50.600> here<00:13:50.930> if<00:13:51.079> you<00:13:51.199> security 00:13:51.970 --> 00:13:51.980 align:start position:0% the security level here if you security 00:13:51.980 --> 00:13:54.310 align:start position:0% the security level here if you security level<00:13:52.310> is<00:13:52.400> 128-bit<00:13:53.300> that<00:13:53.449> capacity<00:13:54.020> should<00:13:54.079> be 00:13:54.310 --> 00:13:54.320 align:start position:0% level is 128-bit that capacity should be 00:13:54.320 --> 00:13:57.939 align:start position:0% level is 128-bit that capacity should be 206<00:13:55.100> and<00:13:55.310> the<00:13:56.000> rest<00:13:56.150> risks<00:13:56.449> orcs<00:13:56.779> or<00:13:57.020> sort<00:13:57.500> then 00:13:57.939 --> 00:13:57.949 align:start position:0% 206 and the rest risks orcs or sort then 00:13:57.949 --> 00:13:59.500 align:start position:0% 206 and the rest risks orcs or sort then they<00:13:58.100> call<00:13:58.339> permutation<00:13:58.760> Authority<00:13:59.390> called 00:13:59.500 --> 00:13:59.510 align:start position:0% they call permutation Authority called 00:13:59.510 --> 00:14:00.939 align:start position:0% they call permutation Authority called permutation<00:13:59.900> story<00:14:00.230> called<00:14:00.440> permutation<00:14:00.709> ten 00:14:00.939 --> 00:14:00.949 align:start position:0% permutation story called permutation ten 00:14:00.949 --> 00:14:03.460 align:start position:0% permutation story called permutation ten messages<00:14:01.510> consumed<00:14:02.510> and<00:14:02.720> then<00:14:02.810> you<00:14:02.930> output 00:14:03.460 --> 00:14:03.470 align:start position:0% messages consumed and then you output 00:14:03.470 --> 00:14:05.800 align:start position:0% messages consumed and then you output this<00:14:04.370> with<00:14:04.699> the<00:14:04.820> same<00:14:05.000> rate<00:14:05.270> as<00:14:05.449> you<00:14:05.480> consume 00:14:05.800 --> 00:14:05.810 align:start position:0% this with the same rate as you consume 00:14:05.810 --> 00:14:08.410 align:start position:0% this with the same rate as you consume in<00:14:05.930> messages<00:14:06.350> and<00:14:06.610> of<00:14:07.610> course<00:14:07.820> permutation 00:14:08.410 --> 00:14:08.420 align:start position:0% in messages and of course permutation 00:14:08.420 --> 00:14:10.720 align:start position:0% in messages and of course permutation should<00:14:08.600> be<00:14:08.810> like<00:14:09.380> ideal<00:14:09.980> permutation<00:14:10.430> the 00:14:10.720 --> 00:14:10.730 align:start position:0% should be like ideal permutation the 00:14:10.730 --> 00:14:13.870 align:start position:0% should be like ideal permutation the sense<00:14:10.970> that<00:14:11.560> issued<00:14:12.560> this<00:14:12.709> to<00:14:13.610> some<00:14:13.850> extent 00:14:13.870 --> 00:14:13.880 align:start position:0% sense that issued this to some extent 00:14:13.880 --> 00:14:15.730 align:start position:0% sense that issued this to some extent and<00:14:14.360> essential<00:14:14.779> from<00:14:15.020> a<00:14:15.170> random<00:14:15.500> permutation 00:14:15.730 --> 00:14:15.740 align:start position:0% and essential from a random permutation 00:14:15.740 --> 00:14:18.579 align:start position:0% and essential from a random permutation well<00:14:16.190> it's<00:14:16.399> a<00:14:16.490> constant<00:14:16.850> function<00:14:17.329> but<00:14:17.750> you 00:14:18.579 --> 00:14:18.589 align:start position:0% well it's a constant function but you 00:14:18.589 --> 00:14:21.660 align:start position:0% well it's a constant function but you should<00:14:19.120> understand<00:14:20.120> what<00:14:20.240> this<00:14:20.300> means<00:14:20.540> okay 00:14:21.660 --> 00:14:21.670 align:start position:0% should understand what this means okay 00:14:21.670 --> 00:14:23.769 align:start position:0% should understand what this means okay so<00:14:22.670> the<00:14:22.760> question<00:14:23.029> is<00:14:23.089> how<00:14:23.209> to<00:14:23.270> construct<00:14:23.480> the 00:14:23.769 --> 00:14:23.779 align:start position:0% so the question is how to construct the 00:14:23.779 --> 00:14:25.540 align:start position:0% so the question is how to construct the permutation<00:14:24.140> so<00:14:24.649> that<00:14:24.800> it<00:14:24.920> will<00:14:25.040> be<00:14:25.190> starts 00:14:25.540 --> 00:14:25.550 align:start position:0% permutation so that it will be starts 00:14:25.550 --> 00:14:30.100 align:start position:0% permutation so that it will be starts narcho<00:14:25.970> start<00:14:26.209> friendly<00:14:27.880> okay<00:14:28.880> and<00:14:29.240> the<00:14:29.899> goal 00:14:30.100 --> 00:14:30.110 align:start position:0% narcho start friendly okay and the goal 00:14:30.110 --> 00:14:34.750 align:start position:0% narcho start friendly okay and the goal is<00:14:30.140> to<00:14:30.760> come<00:14:31.760> up<00:14:31.910> with<00:14:32.750> with<00:14:33.649> the<00:14:33.709> design<00:14:34.070> that 00:14:34.750 --> 00:14:34.760 align:start position:0% is to come up with with the design that 00:14:34.760 --> 00:14:36.519 align:start position:0% is to come up with with the design that will<00:14:34.910> be<00:14:35.029> both<00:14:35.240> stark<00:14:35.660> and<00:14:35.810> snark<00:14:36.050> friendly<00:14:36.410> to 00:14:36.519 --> 00:14:36.529 align:start position:0% will be both stark and snark friendly to 00:14:36.529 --> 00:14:38.319 align:start position:0% will be both stark and snark friendly to some<00:14:36.709> extent<00:14:37.100> because<00:14:37.790> the<00:14:37.910> difference<00:14:38.209> we 00:14:38.319 --> 00:14:38.329 align:start position:0% some extent because the difference we 00:14:38.329 --> 00:14:42.610 align:start position:0% some extent because the difference we know<00:14:38.480> that<00:14:38.720> in<00:14:39.260> snarks<00:14:39.800> we<00:14:40.370> optimize<00:14:41.350> we<00:14:42.350> work 00:14:42.610 --> 00:14:42.620 align:start position:0% know that in snarks we optimize we work 00:14:42.620 --> 00:14:44.560 align:start position:0% know that in snarks we optimize we work in<00:14:42.829> the<00:14:42.920> prime<00:14:43.160> field<00:14:43.430> in<00:14:43.610> stark<00:14:43.970> we<00:14:44.060> optimize 00:14:44.560 --> 00:14:44.570 align:start position:0% in the prime field in stark we optimize 00:14:44.570 --> 00:14:48.730 align:start position:0% in the prime field in stark we optimize on<00:14:45.790> we<00:14:46.790> work<00:14:46.970> in<00:14:47.089> binary<00:14:47.270> fields<00:14:47.750> but<00:14:48.199> part<00:14:48.589> on 00:14:48.730 --> 00:14:48.740 align:start position:0% on we work in binary fields but part on 00:14:48.740 --> 00:14:50.769 align:start position:0% on we work in binary fields but part on that<00:14:48.920> our<00:14:49.250> permutation<00:14:50.240> can<00:14:50.390> be<00:14:50.480> built<00:14:50.690> very 00:14:50.769 --> 00:14:50.779 align:start position:0% that our permutation can be built very 00:14:50.779 --> 00:14:55.300 align:start position:0% that our permutation can be built very similarly<00:14:51.610> the<00:14:52.610> first<00:14:52.820> attempt<00:14:54.100> what<00:14:55.100> if<00:14:55.220> we 00:14:55.300 --> 00:14:55.310 align:start position:0% similarly the first attempt what if we 00:14:55.310 --> 00:15:00.189 align:start position:0% similarly the first attempt what if we modify<00:14:55.520> my<00:14:55.970> MC<00:14:56.329> and<00:14:56.600> replace<00:14:57.470> the<00:14:58.660> power<00:14:59.660> of<00:14:59.930> 3 00:15:00.189 --> 00:15:00.199 align:start position:0% modify my MC and replace the power of 3 00:15:00.199 --> 00:15:03.189 align:start position:0% modify my MC and replace the power of 3 with<00:15:00.860> an<00:15:01.010> inversion<00:15:01.339> and<00:15:01.750> this<00:15:02.750> is<00:15:02.870> of<00:15:02.990> course 00:15:03.189 --> 00:15:03.199 align:start position:0% with an inversion and this is of course 00:15:03.199 --> 00:15:08.889 align:start position:0% with an inversion and this is of course a<00:15:03.680> very<00:15:04.070> tempting<00:15:04.610> step<00:15:04.970> and<00:15:05.890> it's<00:15:06.890> not<00:15:07.899> it's 00:15:08.889 --> 00:15:08.899 align:start position:0% a very tempting step and it's not it's 00:15:08.899 --> 00:15:12.670 align:start position:0% a very tempting step and it's not it's not<00:15:08.930> actually<00:15:10.029> trivial<00:15:11.029> so<00:15:11.600> when<00:15:12.260> the<00:15:12.500> MC 00:15:12.670 --> 00:15:12.680 align:start position:0% not actually trivial so when the MC 00:15:12.680 --> 00:15:15.850 align:start position:0% not actually trivial so when the MC wasn't<00:15:13.220> was<00:15:13.459> invented<00:15:13.940> the<00:15:14.810> author's<00:15:15.320> tried 00:15:15.850 --> 00:15:15.860 align:start position:0% wasn't was invented the author's tried 00:15:15.860 --> 00:15:18.939 align:start position:0% wasn't was invented the author's tried this<00:15:16.130> approach<00:15:17.000> and<00:15:17.570> it<00:15:17.720> doesn't<00:15:18.050> work<00:15:18.230> let's 00:15:18.939 --> 00:15:18.949 align:start position:0% this approach and it doesn't work let's 00:15:18.949 --> 00:15:21.550 align:start position:0% this approach and it doesn't work let's work<00:15:19.040> why<00:15:19.339> because<00:15:20.329> it's<00:15:21.020> actually<00:15:21.440> very 00:15:21.550 --> 00:15:21.560 align:start position:0% work why because it's actually very 00:15:21.560 --> 00:15:23.829 align:start position:0% work why because it's actually very interesting<00:15:21.980> exercise<00:15:22.449> that<00:15:23.449> you<00:15:23.810> can 00:15:23.829 --> 00:15:23.839 align:start position:0% interesting exercise that you can 00:15:23.839 --> 00:15:28.720 align:start position:0% interesting exercise that you can demonstrate<00:15:24.199> that<00:15:25.240> if<00:15:26.709> that<00:15:27.709> no<00:15:28.339> matter<00:15:28.520> how 00:15:28.720 --> 00:15:28.730 align:start position:0% demonstrate that if that no matter how 00:15:28.730 --> 00:15:31.329 align:start position:0% demonstrate that if that no matter how many<00:15:28.790> rounds<00:15:29.060> you<00:15:29.270> have<00:15:29.300> if<00:15:30.110> you<00:15:30.530> do<00:15:31.010> in<00:15:31.130> just 00:15:31.329 --> 00:15:31.339 align:start position:0% many rounds you have if you do in just 00:15:31.339 --> 00:15:32.710 align:start position:0% many rounds you have if you do in just the<00:15:31.520> constant<00:15:31.910> addition 00:15:32.710 --> 00:15:32.720 align:start position:0% the constant addition 00:15:32.720 --> 00:15:36.340 align:start position:0% the constant addition between<00:15:32.899> the<00:15:33.699> inversions<00:15:34.699> that<00:15:35.350> the 00:15:36.340 --> 00:15:36.350 align:start position:0% between the inversions that the 00:15:36.350 --> 00:15:37.840 align:start position:0% between the inversions that the resultant<00:15:36.709> function<00:15:37.040> would<00:15:37.160> be<00:15:37.220> a<00:15:37.339> rational 00:15:37.840 --> 00:15:37.850 align:start position:0% resultant function would be a rational 00:15:37.850 --> 00:15:41.379 align:start position:0% resultant function would be a rational function<00:15:38.000> of<00:15:38.329> the<00:15:38.420> input<00:15:38.689> of<00:15:38.839> degree<00:15:39.709> 1<00:15:40.389> the 00:15:41.379 --> 00:15:41.389 align:start position:0% function of the input of degree 1 the 00:15:41.389 --> 00:15:44.170 align:start position:0% function of the input of degree 1 the thing<00:15:41.509> is<00:15:41.689> you<00:15:42.230> can<00:15:42.410> interpret<00:15:43.129> your<00:15:43.579> state<00:15:43.879> as 00:15:44.170 --> 00:15:44.180 align:start position:0% thing is you can interpret your state as 00:15:44.180 --> 00:15:46.660 align:start position:0% thing is you can interpret your state as a<00:15:44.240> fraction<00:15:45.230> of<00:15:45.350> like<00:15:45.589> a<00:15:45.860> little<00:15:46.339> too<00:15:46.459> linear 00:15:46.660 --> 00:15:46.670 align:start position:0% a fraction of like a little too linear 00:15:46.670 --> 00:15:48.970 align:start position:0% a fraction of like a little too linear one<00:15:47.149> linear<00:15:47.449> over<00:15:47.689> another<00:15:47.930> X<00:15:48.379> plus<00:15:48.740> B<00:15:48.949> over 00:15:48.970 --> 00:15:48.980 align:start position:0% one linear over another X plus B over 00:15:48.980 --> 00:15:51.490 align:start position:0% one linear over another X plus B over six<00:15:49.699> plus<00:15:49.879> D<00:15:50.149> and<00:15:50.269> of<00:15:50.720> course<00:15:50.930> when<00:15:51.110> you<00:15:51.199> invert 00:15:51.490 --> 00:15:51.500 align:start position:0% six plus D and of course when you invert 00:15:51.500 --> 00:15:54.100 align:start position:0% six plus D and of course when you invert then<00:15:51.980> the<00:15:52.250> nominator<00:15:52.910> and<00:15:53.060> denominator<00:15:53.870> that 00:15:54.100 --> 00:15:54.110 align:start position:0% then the nominator and denominator that 00:15:54.110 --> 00:15:56.319 align:start position:0% then the nominator and denominator that just<00:15:54.439> swaps<00:15:54.740> and<00:15:54.949> when<00:15:55.579> you<00:15:55.670> add<00:15:55.759> the<00:15:55.850> constant 00:15:56.319 --> 00:15:56.329 align:start position:0% just swaps and when you add the constant 00:15:56.329 --> 00:15:58.689 align:start position:0% just swaps and when you add the constant the<00:15:57.139> nominator<00:15:57.589> changes<00:15:58.129> but<00:15:58.370> the<00:15:58.459> degree 00:15:58.689 --> 00:15:58.699 align:start position:0% the nominator changes but the degree 00:15:58.699 --> 00:16:00.999 align:start position:0% the nominator changes but the degree doesn't<00:15:58.879> change<00:15:59.149> and<00:15:59.529> unfortunately<00:16:00.529> the 00:16:00.999 --> 00:16:01.009 align:start position:0% doesn't change and unfortunately the 00:16:01.009 --> 00:16:03.249 align:start position:0% doesn't change and unfortunately the state<00:16:01.300> will<00:16:02.300> be<00:16:02.449> raised<00:16:02.660> in<00:16:02.750> a<00:16:02.779> function<00:16:03.110> of 00:16:03.249 --> 00:16:03.259 align:start position:0% state will be raised in a function of 00:16:03.259 --> 00:16:05.259 align:start position:0% state will be raised in a function of degree<00:16:03.620> one<00:16:03.889> and<00:16:04.189> collisions<00:16:04.639> are<00:16:05.000> easy 00:16:05.259 --> 00:16:05.269 align:start position:0% degree one and collisions are easy 00:16:05.269 --> 00:16:08.019 align:start position:0% degree one and collisions are easy because<00:16:05.810> they're<00:16:06.259> like<00:16:06.819> simple<00:16:07.819> linear 00:16:08.019 --> 00:16:08.029 align:start position:0% because they're like simple linear 00:16:08.029 --> 00:16:09.699 align:start position:0% because they're like simple linear equations<00:16:08.569> or<00:16:08.750> even<00:16:08.930> quadratics<00:16:09.470> but<00:16:09.589> they 00:16:09.699 --> 00:16:09.709 align:start position:0% equations or even quadratics but they 00:16:09.709 --> 00:16:13.300 align:start position:0% equations or even quadratics but they can<00:16:09.889> be<00:16:10.009> solved<00:16:10.699> easily<00:16:11.240> so<00:16:11.889> and<00:16:12.889> there<00:16:13.100> isn't 00:16:13.300 --> 00:16:13.310 align:start position:0% can be solved easily so and there isn't 00:16:13.310 --> 00:16:15.970 align:start position:0% can be solved easily so and there isn't design<00:16:13.550> Jarvis<00:16:14.000> they<00:16:14.480> decided<00:16:15.470> to<00:16:15.500> put<00:16:15.769> some 00:16:15.970 --> 00:16:15.980 align:start position:0% design Jarvis they decided to put some 00:16:15.980 --> 00:16:18.850 align:start position:0% design Jarvis they decided to put some additional<00:16:16.819> linear<00:16:17.629> transformations<00:16:18.379> after 00:16:18.850 --> 00:16:18.860 align:start position:0% additional linear transformations after 00:16:18.860 --> 00:16:22.179 align:start position:0% additional linear transformations after the<00:16:19.519> inversion<00:16:20.209> but<00:16:20.870> it's<00:16:21.410> yet<00:16:21.620> not<00:16:21.860> unclear 00:16:22.179 --> 00:16:22.189 align:start position:0% the inversion but it's yet not unclear 00:16:22.189 --> 00:16:24.389 align:start position:0% the inversion but it's yet not unclear for<00:16:22.519> me<00:16:22.639> if<00:16:22.879> this<00:16:23.060> is<00:16:23.300> secure<00:16:23.629> enough<00:16:23.750> but<00:16:24.139> I 00:16:24.389 --> 00:16:24.399 align:start position:0% for me if this is secure enough but I 00:16:24.399 --> 00:16:28.840 align:start position:0% for me if this is secure enough but I haven't<00:16:25.399> managed<00:16:25.610> to<00:16:25.790> break<00:16:26.000> it<00:16:26.149> yet<00:16:27.850> the 00:16:28.840 --> 00:16:28.850 align:start position:0% haven't managed to break it yet the 00:16:28.850 --> 00:16:31.059 align:start position:0% haven't managed to break it yet the solution<00:16:29.240> that<00:16:29.480> is<00:16:29.750> still<00:16:30.500> obvious<00:16:30.829> to<00:16:30.980> me 00:16:31.059 --> 00:16:31.069 align:start position:0% solution that is still obvious to me 00:16:31.069 --> 00:16:33.910 align:start position:0% solution that is still obvious to me because<00:16:31.370> I<00:16:31.550> would<00:16:31.699> like<00:16:31.970> to<00:16:32.209> work<00:16:32.810> with<00:16:32.920> wide 00:16:33.910 --> 00:16:33.920 align:start position:0% because I would like to work with wide 00:16:33.920 --> 00:16:36.900 align:start position:0% because I would like to work with wide permutation<00:16:34.629> because<00:16:35.629> I<00:16:35.779> would<00:16:35.990> like<00:16:36.199> to 00:16:36.900 --> 00:16:36.910 align:start position:0% permutation because I would like to 00:16:36.910 --> 00:16:41.319 align:start position:0% permutation because I would like to leverage<00:16:37.910> the<00:16:38.180> permutation<00:16:38.540> with<00:16:38.899> to<00:16:39.970> get<00:16:40.970> a 00:16:41.319 --> 00:16:41.329 align:start position:0% leverage the permutation with to get a 00:16:41.329 --> 00:16:44.650 align:start position:0% leverage the permutation with to get a more<00:16:42.019> efficient<00:16:42.529> circuit<00:16:43.370> for<00:16:44.000> a<00:16:44.029> tree 00:16:44.650 --> 00:16:44.660 align:start position:0% more efficient circuit for a tree 00:16:44.660 --> 00:16:47.819 align:start position:0% more efficient circuit for a tree not<00:16:45.589> for<00:16:45.800> one<00:16:45.980> hash<00:16:46.160> function<00:16:46.519> for<00:16:46.550> a<00:16:46.970> tree 00:16:47.819 --> 00:16:47.829 align:start position:0% not for one hash function for a tree 00:16:47.829 --> 00:16:50.199 align:start position:0% not for one hash function for a tree because<00:16:48.829> that's<00:16:49.040> the<00:16:49.189> bottleneck<00:16:49.579> and<00:16:49.819> that 00:16:50.199 --> 00:16:50.209 align:start position:0% because that's the bottleneck and that 00:16:50.209 --> 00:16:52.929 align:start position:0% because that's the bottleneck and that is<00:16:50.360> that<00:16:50.540> why<00:16:51.410> wouldn't<00:16:51.949> we<00:16:52.160> use<00:16:52.339> multiple<00:16:52.579> as 00:16:52.929 --> 00:16:52.939 align:start position:0% is that why wouldn't we use multiple as 00:16:52.939 --> 00:16:55.119 align:start position:0% is that why wouldn't we use multiple as boxes<00:16:53.389> and<00:16:53.600> use<00:16:54.230> a<00:16:54.319> very<00:16:54.500> wide<00:16:54.649> permutation 00:16:55.119 --> 00:16:55.129 align:start position:0% boxes and use a very wide permutation 00:16:55.129 --> 00:16:56.860 align:start position:0% boxes and use a very wide permutation then<00:16:55.490> our<00:16:55.670> function<00:16:55.939> will<00:16:56.269> be<00:16:56.360> very<00:16:56.569> similar 00:16:56.860 --> 00:16:56.870 align:start position:0% then our function will be very similar 00:16:56.870 --> 00:16:59.530 align:start position:0% then our function will be very similar to<00:16:57.050> what<00:16:57.259> we<00:16:57.589> already<00:16:57.740> have<00:16:58.100> for<00:16:58.970> example<00:16:59.000> in<00:16:59.360> a 00:16:59.530 --> 00:16:59.540 align:start position:0% to what we already have for example in a 00:16:59.540 --> 00:17:05.350 align:start position:0% to what we already have for example in a es<00:16:59.720> or<00:17:00.170> other<00:17:01.129> designs<00:17:01.670> and<00:17:03.939> well<00:17:04.939> let's<00:17:05.179> call 00:17:05.350 --> 00:17:05.360 align:start position:0% es or other designs and well let's call 00:17:05.360 --> 00:17:08.559 align:start position:0% es or other designs and well let's call it<00:17:05.539> for<00:17:05.720> example<00:17:06.020> inversion<00:17:06.409> hash<00:17:06.589> and<00:17:07.569> if 00:17:08.559 --> 00:17:08.569 align:start position:0% it for example inversion hash and if 00:17:08.569 --> 00:17:10.029 align:start position:0% it for example inversion hash and if this<00:17:08.780> inversion<00:17:09.079> hash<00:17:09.380> the<00:17:09.589> parades<00:17:09.890> as 00:17:10.029 --> 00:17:10.039 align:start position:0% this inversion hash the parades as 00:17:10.039 --> 00:17:14.740 align:start position:0% this inversion hash the parades as follows<00:17:10.400> so<00:17:10.959> it's<00:17:12.069> you<00:17:13.069> see<00:17:13.339> like<00:17:14.150> there<00:17:14.630> are 00:17:14.740 --> 00:17:14.750 align:start position:0% follows so it's you see like there are 00:17:14.750 --> 00:17:17.649 align:start position:0% follows so it's you see like there are rounds<00:17:14.959> and<00:17:15.409> in<00:17:16.039> this<00:17:16.189> rounds<00:17:16.669> we<00:17:16.880> alternate 00:17:17.649 --> 00:17:17.659 align:start position:0% rounds and in this rounds we alternate 00:17:17.659 --> 00:17:19.870 align:start position:0% rounds and in this rounds we alternate nonlinear<00:17:18.500> transformations<00:17:19.159> which<00:17:19.730> are 00:17:19.870 --> 00:17:19.880 align:start position:0% nonlinear transformations which are 00:17:19.880 --> 00:17:23.079 align:start position:0% nonlinear transformations which are denoted<00:17:20.120> by<00:17:20.329> s<00:17:20.839> so<00:17:21.589> each<00:17:21.860> s<00:17:22.130> is<00:17:22.459> an<00:17:22.699> inversion 00:17:23.079 --> 00:17:23.089 align:start position:0% denoted by s so each s is an inversion 00:17:23.089 --> 00:17:26.140 align:start position:0% denoted by s so each s is an inversion in<00:17:23.510> some<00:17:23.900> field<00:17:24.319> it's<00:17:25.309> not<00:17:25.520> actually 00:17:26.140 --> 00:17:26.150 align:start position:0% in some field it's not actually 00:17:26.150 --> 00:17:28.539 align:start position:0% in some field it's not actually important<00:17:26.929> for<00:17:27.319> the<00:17:27.439> design<00:17:27.589> which<00:17:28.100> filled<00:17:28.370> it 00:17:28.539 --> 00:17:28.549 align:start position:0% important for the design which filled it 00:17:28.549 --> 00:17:32.610 align:start position:0% important for the design which filled it is<00:17:29.590> because<00:17:30.590> many<00:17:31.220> attacks<00:17:31.610> they<00:17:31.850> apply 00:17:32.610 --> 00:17:32.620 align:start position:0% is because many attacks they apply 00:17:32.620 --> 00:17:35.590 align:start position:0% is because many attacks they apply similarly<00:17:33.620> so<00:17:33.980> of<00:17:34.400> course<00:17:34.580> you<00:17:34.880> substitute<00:17:35.390> as 00:17:35.590 --> 00:17:35.600 align:start position:0% similarly so of course you substitute as 00:17:35.600 --> 00:17:38.350 align:start position:0% similarly so of course you substitute as a<00:17:35.630> parameter<00:17:36.230> the<00:17:36.409> field<00:17:36.710> size<00:17:36.980> and<00:17:37.400> in<00:17:38.179> some 00:17:38.350 --> 00:17:38.360 align:start position:0% a parameter the field size and in some 00:17:38.360 --> 00:17:41.470 align:start position:0% a parameter the field size and in some cases<00:17:38.570> the<00:17:38.840> binary<00:17:39.400> for<00:17:40.400> binder<00:17:40.820> filled<00:17:41.059> some 00:17:41.470 --> 00:17:41.480 align:start position:0% cases the binary for binder filled some 00:17:41.480 --> 00:17:43.870 align:start position:0% cases the binary for binder filled some attacks<00:17:41.809> work<00:17:42.260> just<00:17:42.679> a<00:17:42.830> bit<00:17:42.980> differently<00:17:43.399> but 00:17:43.870 --> 00:17:43.880 align:start position:0% attacks work just a bit differently but 00:17:43.880 --> 00:17:45.909 align:start position:0% attacks work just a bit differently but not<00:17:44.030> tremendously<00:17:44.480> different<00:17:44.780> so<00:17:45.230> generally 00:17:45.909 --> 00:17:45.919 align:start position:0% not tremendously different so generally 00:17:45.919 --> 00:17:46.700 align:start position:0% not tremendously different so generally if<00:17:45.980> your<00:17:46.100> function<00:17:46.309> is 00:17:46.700 --> 00:17:46.710 align:start position:0% if your function is 00:17:46.710 --> 00:17:48.710 align:start position:0% if your function is this<00:17:47.159> construction<00:17:47.399> is<00:17:47.820> secure<00:17:48.149> for<00:17:48.390> binary 00:17:48.710 --> 00:17:48.720 align:start position:0% this construction is secure for binary 00:17:48.720 --> 00:17:52.269 align:start position:0% this construction is secure for binary felt<00:17:48.960> it<00:17:49.169> will<00:17:49.740> be<00:17:49.919> like<00:17:50.370> almost<00:17:50.730> secure<00:17:51.120> with 00:17:52.269 --> 00:17:52.279 align:start position:0% felt it will be like almost secure with 00:17:52.279 --> 00:17:56.750 align:start position:0% felt it will be like almost secure with the<00:17:53.450> prime<00:17:54.450> field<00:17:54.720> unless<00:17:55.500> your<00:17:56.010> primes<00:17:56.399> or 00:17:56.750 --> 00:17:56.760 align:start position:0% the prime field unless your primes or 00:17:56.760 --> 00:17:59.000 align:start position:0% the prime field unless your primes or benefit<00:17:57.210> is<00:17:57.390> very<00:17:57.570> small<00:17:57.840> but<00:17:58.830> the 00:17:59.000 --> 00:17:59.010 align:start position:0% benefit is very small but the 00:17:59.010 --> 00:18:01.070 align:start position:0% benefit is very small but the construction<00:17:59.370> is<00:17:59.549> like<00:17:59.700> this<00:17:59.850> so<00:18:00.149> HS<00:18:00.779> is<00:18:00.960> an 00:18:01.070 --> 00:18:01.080 align:start position:0% construction is like this so HS is an 00:18:01.080 --> 00:18:03.669 align:start position:0% construction is like this so HS is an inversion<00:18:01.380> in<00:18:01.620> the<00:18:01.710> field<00:18:01.950> and<00:18:02.220> each<00:18:02.909> a<00:18:03.270> is<00:18:03.539> a 00:18:03.669 --> 00:18:03.679 align:start position:0% inversion in the field and each a is a 00:18:03.679 --> 00:18:06.380 align:start position:0% inversion in the field and each a is a fine<00:18:04.679> is<00:18:04.950> enough<00:18:05.190> fine<00:18:05.429> transformation<00:18:06.210> in 00:18:06.380 --> 00:18:06.390 align:start position:0% fine is enough fine transformation in 00:18:06.390 --> 00:18:08.450 align:start position:0% fine is enough fine transformation in this<00:18:06.809> field<00:18:07.140> that's<00:18:07.740> basically<00:18:08.130> a<00:18:08.250> linear 00:18:08.450 --> 00:18:08.460 align:start position:0% this field that's basically a linear 00:18:08.460 --> 00:18:11.690 align:start position:0% this field that's basically a linear combination<00:18:08.760> of<00:18:09.210> inputs<00:18:09.740> invertible<00:18:10.740> one<00:18:10.919> its 00:18:11.690 --> 00:18:11.700 align:start position:0% combination of inputs invertible one its 00:18:11.700 --> 00:18:15.950 align:start position:0% combination of inputs invertible one its and<00:18:12.330> the<00:18:13.169> another<00:18:13.740> very<00:18:14.159> nice<00:18:14.340> idea<00:18:14.850> is<00:18:15.299> that 00:18:15.950 --> 00:18:15.960 align:start position:0% and the another very nice idea is that 00:18:15.960 --> 00:18:18.320 align:start position:0% and the another very nice idea is that for<00:18:16.679> the<00:18:16.830> middle<00:18:16.980> of<00:18:17.309> this<00:18:17.610> construction<00:18:18.029> we 00:18:18.320 --> 00:18:18.330 align:start position:0% for the middle of this construction we 00:18:18.330 --> 00:18:21.560 align:start position:0% for the middle of this construction we do<00:18:18.450> not<00:18:18.570> need<00:18:19.279> full<00:18:20.279> as<00:18:20.490> box<00:18:20.850> layer<00:18:21.090> because 00:18:21.560 --> 00:18:21.570 align:start position:0% do not need full as box layer because 00:18:21.570 --> 00:18:24.380 align:start position:0% do not need full as box layer because the<00:18:21.899> degree<00:18:22.260> so<00:18:22.679> the<00:18:23.520> algebraic<00:18:23.909> functions 00:18:24.380 --> 00:18:24.390 align:start position:0% the degree so the algebraic functions 00:18:24.390 --> 00:18:26.769 align:start position:0% the degree so the algebraic functions their<00:18:24.860> algebraic<00:18:25.860> attacks<00:18:26.130> will<00:18:26.279> work<00:18:26.429> with 00:18:26.769 --> 00:18:26.779 align:start position:0% their algebraic attacks will work with 00:18:26.779 --> 00:18:31.010 align:start position:0% their algebraic attacks will work with they<00:18:27.779> they<00:18:28.740> can<00:18:29.580> be<00:18:29.730> kind<00:18:30.120> of<00:18:30.210> mitigated<00:18:30.809> they 00:18:31.010 --> 00:18:31.020 align:start position:0% they they can be kind of mitigated they 00:18:31.020 --> 00:18:33.710 align:start position:0% they they can be kind of mitigated they can<00:18:31.169> be<00:18:31.289> controlled<00:18:31.740> even<00:18:32.370> when<00:18:32.610> with<00:18:33.120> one<00:18:33.390> s 00:18:33.710 --> 00:18:33.720 align:start position:0% can be controlled even when with one s 00:18:33.720 --> 00:18:37.490 align:start position:0% can be controlled even when with one s box<00:18:34.100> in<00:18:35.100> the<00:18:35.340> middle<00:18:35.640> or<00:18:35.789> two<00:18:36.240> but<00:18:36.990> with<00:18:37.169> one<00:18:37.320> is 00:18:37.490 --> 00:18:37.500 align:start position:0% box in the middle or two but with one is 00:18:37.500 --> 00:18:41.570 align:start position:0% box in the middle or two but with one is fine<00:18:38.039> and<00:18:38.840> the<00:18:39.840> parameters<00:18:40.409> of<00:18:40.440> this<00:18:40.799> design 00:18:41.570 --> 00:18:41.580 align:start position:0% fine and the parameters of this design 00:18:41.580 --> 00:18:44.779 align:start position:0% fine and the parameters of this design are<00:18:41.850> of<00:18:42.000> course<00:18:42.270> the<00:18:42.570> width<00:18:42.870> of<00:18:43.140> an<00:18:43.649> S<00:18:44.190> box<00:18:44.490> and 00:18:44.779 --> 00:18:44.789 align:start position:0% are of course the width of an S box and 00:18:44.789 --> 00:18:46.850 align:start position:0% are of course the width of an S box and I<00:18:45.120> say<00:18:45.330> that<00:18:45.600> this<00:18:45.809> S<00:18:45.990> box<00:18:46.020> can<00:18:46.380> be<00:18:46.409> prime 00:18:46.850 --> 00:18:46.860 align:start position:0% I say that this S box can be prime 00:18:46.860 --> 00:18:49.730 align:start position:0% I say that this S box can be prime Filton<00:18:47.340> version<00:18:47.789> for<00:18:48.299> snarks<00:18:48.809> or<00:18:49.020> this<00:18:49.500> can<00:18:49.679> be 00:18:49.730 --> 00:18:49.740 align:start position:0% Filton version for snarks or this can be 00:18:49.740 --> 00:18:52.039 align:start position:0% Filton version for snarks or this can be binary<00:18:50.429> field<00:18:50.669> inversion<00:18:51.179> for<00:18:51.390> starks 00:18:52.039 --> 00:18:52.049 align:start position:0% binary field inversion for starks 00:18:52.049 --> 00:18:54.320 align:start position:0% binary field inversion for starks and<00:18:52.169> each<00:18:52.620> by<00:18:52.890> you<00:18:52.950> can<00:18:53.340> take<00:18:53.549> whatever<00:18:53.760> binary 00:18:54.320 --> 00:18:54.330 align:start position:0% and each by you can take whatever binary 00:18:54.330 --> 00:18:57.260 align:start position:0% and each by you can take whatever binary field<00:18:54.539> to<00:18:54.720> one<00:18:54.929> so<00:18:55.140> if<00:18:55.260> you<00:18:55.409> realize<00:18:56.130> that<00:18:56.270> if 00:18:57.260 --> 00:18:57.270 align:start position:0% field to one so if you realize that if 00:18:57.270 --> 00:18:59.299 align:start position:0% field to one so if you realize that if you<00:18:57.419> think<00:18:57.630> now<00:18:57.779> that<00:18:57.809> two<00:18:58.140> to<00:18:58.260> two<00:18:59.070> binary 00:18:59.299 --> 00:18:59.309 align:start position:0% you think now that two to two binary 00:18:59.309 --> 00:19:02.360 align:start position:0% you think now that two to two binary field<00:18:59.760> is<00:19:00.029> good<00:19:00.690> for<00:19:01.140> stark<00:19:01.679> you<00:19:01.860> can<00:19:01.980> use<00:19:02.190> it 00:19:02.360 --> 00:19:02.370 align:start position:0% field is good for stark you can use it 00:19:02.370 --> 00:19:04.370 align:start position:0% field is good for stark you can use it if<00:19:02.520> later<00:19:02.730> you<00:19:02.880> realize<00:19:03.390> that<00:19:03.419> for<00:19:03.840> like<00:19:04.169> root 00:19:04.370 --> 00:19:04.380 align:start position:0% if later you realize that for like root 00:19:04.380 --> 00:19:07.070 align:start position:0% if later you realize that for like root zone<00:19:04.559> on<00:19:04.710> performance<00:19:05.250> you<00:19:05.669> need<00:19:05.929> 128-bit<00:19:06.929> you 00:19:07.070 --> 00:19:07.080 align:start position:0% zone on performance you need 128-bit you 00:19:07.080 --> 00:19:09.320 align:start position:0% zone on performance you need 128-bit you can<00:19:07.320> choose<00:19:07.980> a<00:19:08.010> bit<00:19:08.279> different<00:19:08.610> function<00:19:09.000> they 00:19:09.320 --> 00:19:09.330 align:start position:0% can choose a bit different function they 00:19:09.330 --> 00:19:12.919 align:start position:0% can choose a bit different function they will<00:19:09.510> work<00:19:09.720> fine<00:19:10.020> and<00:19:10.230> then<00:19:10.380> Ellis's<00:19:11.929> analysis 00:19:12.919 --> 00:19:12.929 align:start position:0% will work fine and then Ellis's analysis 00:19:12.929 --> 00:19:15.560 align:start position:0% will work fine and then Ellis's analysis remains<00:19:13.200> well<00:19:13.529> at<00:19:13.679> the<00:19:14.130> most<00:19:14.309> extent<00:19:14.789> so<00:19:15.419> of 00:19:15.560 --> 00:19:15.570 align:start position:0% remains well at the most extent so of 00:19:15.570 --> 00:19:18.649 align:start position:0% remains well at the most extent so of course<00:19:15.779> we<00:19:16.049> conducted<00:19:16.950> like<00:19:17.510> mainly<00:19:18.510> my 00:19:18.649 --> 00:19:18.659 align:start position:0% course we conducted like mainly my 00:19:18.659 --> 00:19:20.000 align:start position:0% course we conducted like mainly my colleagues<00:19:19.020> conducted<00:19:19.230> a<00:19:19.559> number<00:19:19.890> of 00:19:20.000 --> 00:19:20.010 align:start position:0% colleagues conducted a number of 00:19:20.010 --> 00:19:21.919 align:start position:0% colleagues conducted a number of different<00:19:20.520> sorts<00:19:20.730> of<00:19:20.789> attacks<00:19:21.059> on<00:19:21.360> this 00:19:21.919 --> 00:19:21.929 align:start position:0% different sorts of attacks on this 00:19:21.929 --> 00:19:23.840 align:start position:0% different sorts of attacks on this design<00:19:22.320> because<00:19:22.860> we<00:19:22.890> already<00:19:23.309> know<00:19:23.549> this 00:19:23.840 --> 00:19:23.850 align:start position:0% design because we already know this 00:19:23.850 --> 00:19:27.049 align:start position:0% design because we already know this design<00:19:24.210> from<00:19:24.630> like<00:19:25.289> 20<00:19:26.190> years<00:19:26.370> old<00:19:26.669> just<00:19:26.940> this 00:19:27.049 --> 00:19:27.059 align:start position:0% design from like 20 years old just this 00:19:27.059 --> 00:19:30.590 align:start position:0% design from like 20 years old just this s<00:19:27.330> boxes<00:19:27.779> were<00:19:27.899> smaller<00:19:28.230> and<00:19:29.600> apparently 00:19:30.590 --> 00:19:30.600 align:start position:0% s boxes were smaller and apparently 00:19:30.600 --> 00:19:32.510 align:start position:0% s boxes were smaller and apparently algebraic<00:19:31.049> attacks<00:19:31.320> become<00:19:31.679> the<00:19:32.340> most 00:19:32.510 --> 00:19:32.520 align:start position:0% algebraic attacks become the most 00:19:32.520 --> 00:19:36.200 align:start position:0% algebraic attacks become the most effective<00:19:33.000> here<00:19:33.360> but<00:19:34.169> when<00:19:34.980> you<00:19:35.130> are<00:19:35.700> six 00:19:36.200 --> 00:19:36.210 align:start position:0% effective here but when you are six 00:19:36.210 --> 00:19:38.180 align:start position:0% effective here but when you are six ourselves<00:19:36.690> for<00:19:36.840> example<00:19:37.140> to<00:19:37.260> 128-bit 00:19:38.180 --> 00:19:38.190 align:start position:0% ourselves for example to 128-bit 00:19:38.190 --> 00:19:40.730 align:start position:0% ourselves for example to 128-bit security<00:19:38.700> you<00:19:39.179> don't<00:19:39.210> need<00:19:39.570> many<00:19:39.899> rounds<00:19:40.350> here 00:19:40.730 --> 00:19:40.740 align:start position:0% security you don't need many rounds here 00:19:40.740 --> 00:19:43.190 align:start position:0% security you don't need many rounds here so<00:19:40.890> we<00:19:41.039> are<00:19:41.130> talking<00:19:41.250> about<00:19:41.490> like<00:19:42.299> six<00:19:43.049> to 00:19:43.190 --> 00:19:43.200 align:start position:0% so we are talking about like six to 00:19:43.200 --> 00:19:45.620 align:start position:0% so we are talking about like six to eight<00:19:43.380> rounds<00:19:44.010> four<00:19:44.370> outer<00:19:44.850> rounds<00:19:45.480> with 00:19:45.620 --> 00:19:45.630 align:start position:0% eight rounds four outer rounds with 00:19:45.630 --> 00:19:48.380 align:start position:0% eight rounds four outer rounds with fullest<00:19:46.289> boxes<00:19:46.679> fourth<00:19:47.039> box<00:19:47.340> layers<00:19:47.549> and<00:19:47.789> I'd 00:19:48.380 --> 00:19:48.390 align:start position:0% fullest boxes fourth box layers and I'd 00:19:48.390 --> 00:19:51.260 align:start position:0% fullest boxes fourth box layers and I'd know<00:19:48.570> 5<00:19:48.840> 10<00:19:49.169> 15<00:19:49.679> middle<00:19:50.070> rounds<00:19:50.460> so<00:19:50.909> the<00:19:51.120> total 00:19:51.260 --> 00:19:51.270 align:start position:0% know 5 10 15 middle rounds so the total 00:19:51.270 --> 00:19:53.210 align:start position:0% know 5 10 15 middle rounds so the total number<00:19:51.659> of<00:19:51.690> S<00:19:51.899> boxes<00:19:52.230> is<00:19:52.380> not<00:19:52.559> terribly<00:19:52.919> big 00:19:53.210 --> 00:19:53.220 align:start position:0% number of S boxes is not terribly big 00:19:53.220 --> 00:19:55.879 align:start position:0% number of S boxes is not terribly big but<00:19:53.970> it's<00:19:54.480> interesting<00:19:54.779> to<00:19:55.049> optimize<00:19:55.559> it<00:19:55.740> it's 00:19:55.879 --> 00:19:55.889 align:start position:0% but it's interesting to optimize it it's 00:19:55.889 --> 00:19:57.649 align:start position:0% but it's interesting to optimize it it's interesting<00:19:56.100> to<00:19:56.549> try<00:19:56.730> to<00:19:56.789> expand<00:19:57.389> our 00:19:57.649 --> 00:19:57.659 align:start position:0% interesting to try to expand our 00:19:57.659 --> 00:20:00.440 align:start position:0% interesting to try to expand our permutation<00:19:58.350> to<00:19:58.529> see<00:19:58.830> how<00:19:59.340> big<00:19:59.639> it<00:19:59.669> should<00:20:00.029> be 00:20:00.440 --> 00:20:00.450 align:start position:0% permutation to see how big it should be 00:20:00.450 --> 00:20:03.680 align:start position:0% permutation to see how big it should be to<00:20:00.530> give<00:20:01.530> us<00:20:01.680> the<00:20:01.980> best<00:20:02.210> circuits<00:20:03.210> for<00:20:03.390> trees 00:20:03.680 --> 00:20:03.690 align:start position:0% to give us the best circuits for trees 00:20:03.690 --> 00:20:08.950 align:start position:0% to give us the best circuits for trees and<00:20:04.700> for<00:20:05.700> Starks<00:20:06.060> I<00:20:06.210> think<00:20:06.390> what<00:20:06.570> we<00:20:06.690> have<00:20:06.960> so 00:20:08.950 --> 00:20:08.960 align:start position:0% and for Starks I think what we have so 00:20:08.960 --> 00:20:13.430 align:start position:0% and for Starks I think what we have so in<00:20:09.960> our<00:20:10.110> inversion<00:20:10.470> hash<00:20:11.870> here<00:20:12.870> in<00:20:13.170> the<00:20:13.290> left 00:20:13.430 --> 00:20:13.440 align:start position:0% in our inversion hash here in the left 00:20:13.440 --> 00:20:16.820 align:start position:0% in our inversion hash here in the left column<00:20:13.620> there's<00:20:13.890> width<00:20:14.190> and<00:20:15.680> we<00:20:16.680> can 00:20:16.820 --> 00:20:16.830 align:start position:0% column there's width and we can 00:20:16.830 --> 00:20:18.980 align:start position:0% column there's width and we can calculate<00:20:17.220> the<00:20:18.060> formula 00:20:18.980 --> 00:20:18.990 align:start position:0% calculate the formula 00:20:18.990 --> 00:20:20.390 align:start position:0% calculate the formula Bertie<00:20:19.410> much<00:20:19.620> the<00:20:19.740> same<00:20:19.860> formula<00:20:20.370> that 00:20:20.390 --> 00:20:20.400 align:start position:0% Bertie much the same formula that 00:20:20.400 --> 00:20:24.190 align:start position:0% Bertie much the same formula that alabanza<00:20:20.940> son<00:20:21.270> is<00:20:21.420> used<00:20:21.660> has<00:20:22.410> used<00:20:22.680> for 00:20:24.190 --> 00:20:24.200 align:start position:0% alabanza son is used has used for 00:20:24.200 --> 00:20:27.080 align:start position:0% alabanza son is used has used for approximating<00:20:25.200> stark<00:20:25.560> approver<00:20:26.520> performance 00:20:27.080 --> 00:20:27.090 align:start position:0% approximating stark approver performance 00:20:27.090 --> 00:20:30.340 align:start position:0% approximating stark approver performance and<00:20:28.040> the<00:20:29.040> resultant<00:20:29.460> performance 00:20:30.340 --> 00:20:30.350 align:start position:0% and the resultant performance 00:20:30.350 --> 00:20:33.110 align:start position:0% and the resultant performance predictable<00:20:31.350> performance<00:20:31.560> is<00:20:32.100> on<00:20:32.940> the 00:20:33.110 --> 00:20:33.120 align:start position:0% predictable performance is on the 00:20:33.120 --> 00:20:35.810 align:start position:0% predictable performance is on the rightmost<00:20:33.330> column<00:20:33.810> and<00:20:34.230> its<00:20:34.920> logarithm<00:20:35.250> of 00:20:35.810 --> 00:20:35.820 align:start position:0% rightmost column and its logarithm of 00:20:35.820 --> 00:20:40.240 align:start position:0% rightmost column and its logarithm of time<00:20:36.740> formula<00:20:37.740> so<00:20:38.070> this<00:20:38.790> should<00:20:39.330> be<00:20:39.360> read<00:20:39.660> that 00:20:40.240 --> 00:20:40.250 align:start position:0% time formula so this should be read that 00:20:40.250 --> 00:20:44.960 align:start position:0% time formula so this should be read that if<00:20:41.250> you<00:20:41.430> use<00:20:41.520> sha-256<00:20:42.770> for<00:20:43.770> a<00:20:43.800> tree<00:20:44.130> of<00:20:44.370> two<00:20:44.850> to 00:20:44.960 --> 00:20:44.970 align:start position:0% if you use sha-256 for a tree of two to 00:20:44.970 --> 00:20:47.690 align:start position:0% if you use sha-256 for a tree of two to 32<00:20:45.330> elements<00:20:45.510> then<00:20:46.410> and<00:20:46.860> you<00:20:47.160> need<00:20:47.370> 100 00:20:47.690 --> 00:20:47.700 align:start position:0% 32 elements then and you need 100 00:20:47.700 --> 00:20:51.320 align:start position:0% 32 elements then and you need 100 because<00:20:48.480> resistance<00:20:48.780> then<00:20:49.290> I<00:20:49.670> your<00:20:50.670> that 00:20:51.320 --> 00:20:51.330 align:start position:0% because resistance then I your that 00:20:51.330 --> 00:20:54.620 align:start position:0% because resistance then I your that proven<00:20:51.840> time<00:20:52.110> should<00:20:52.500> be<00:20:52.650> about<00:20:53.280> to<00:20:53.670> the<00:20:53.790> 32:3 00:20:54.620 --> 00:20:54.630 align:start position:0% proven time should be about to the 32:3 00:20:54.630 --> 00:20:57.860 align:start position:0% proven time should be about to the 32:3 of<00:20:54.870> something<00:20:55.700> if<00:20:56.700> you<00:20:56.880> use<00:20:56.970> Patterson<00:20:57.660> hash 00:20:57.860 --> 00:20:57.870 align:start position:0% of something if you use Patterson hash 00:20:57.870 --> 00:21:01.940 align:start position:0% of something if you use Patterson hash then<00:20:58.650> it<00:20:58.800> should<00:20:59.010> be<00:20:59.190> like<00:20:59.760> to<00:21:00.000> the<00:21:00.240> 22<00:21:00.810> so<00:21:01.290> you 00:21:01.940 --> 00:21:01.950 align:start position:0% then it should be like to the 22 so you 00:21:01.950 --> 00:21:04.310 align:start position:0% then it should be like to the 22 so you see<00:21:02.100> like<00:21:02.220> almost<00:21:02.660> thousand<00:21:03.660> times<00:21:03.870> faster 00:21:04.310 --> 00:21:04.320 align:start position:0% see like almost thousand times faster 00:21:04.320 --> 00:21:06.350 align:start position:0% see like almost thousand times faster but<00:21:04.500> of<00:21:04.650> course<00:21:05.120> unfortunately<00:21:06.120> in<00:21:06.180> the<00:21:06.330> real 00:21:06.350 --> 00:21:06.360 align:start position:0% but of course unfortunately in the real 00:21:06.360 --> 00:21:08.570 align:start position:0% but of course unfortunately in the real in<00:21:06.870> the<00:21:07.080> real<00:21:07.260> world<00:21:07.530> per<00:21:08.160> for<00:21:08.370> the 00:21:08.570 --> 00:21:08.580 align:start position:0% in the real world per for the 00:21:08.580 --> 00:21:10.460 align:start position:0% in the real world per for the performance<00:21:09.120> increase<00:21:09.450> from<00:21:09.660> chapter<00:21:09.960> 56<00:21:10.230> is 00:21:10.460 --> 00:21:10.470 align:start position:0% performance increase from chapter 56 is 00:21:10.470 --> 00:21:13.160 align:start position:0% performance increase from chapter 56 is not<00:21:10.620> that<00:21:11.370> big<00:21:11.670> because<00:21:12.170> astrophysicist 00:21:13.160 --> 00:21:13.170 align:start position:0% not that big because astrophysicist 00:21:13.170 --> 00:21:18.350 align:start position:0% not that big because astrophysicist circuit<00:21:13.590> is<00:21:13.680> very<00:21:13.890> sparse<00:21:15.230> but<00:21:16.230> still<00:21:17.300> if<00:21:18.300> we 00:21:18.350 --> 00:21:18.360 align:start position:0% circuit is very sparse but still if we 00:21:18.360 --> 00:21:22.220 align:start position:0% circuit is very sparse but still if we use<00:21:19.020> our<00:21:19.260> inversion<00:21:19.740> hash<00:21:20.100> we<00:21:20.820> can<00:21:21.030> if<00:21:21.750> we<00:21:22.050> use 00:21:22.220 --> 00:21:22.230 align:start position:0% use our inversion hash we can if we use 00:21:22.230 --> 00:21:25.250 align:start position:0% use our inversion hash we can if we use like<00:21:22.410> default<00:21:22.890> width<00:21:23.400> of<00:21:23.730> 1000<00:21:24.390> bits<00:21:24.540> we<00:21:25.080> can 00:21:25.250 --> 00:21:25.260 align:start position:0% like default width of 1000 bits we can 00:21:25.260 --> 00:21:28.430 align:start position:0% like default width of 1000 bits we can still<00:21:25.530> be<00:21:25.740> like<00:21:25.980> four<00:21:26.280> times<00:21:26.520> faster<00:21:27.440> should 00:21:28.430 --> 00:21:28.440 align:start position:0% still be like four times faster should 00:21:28.440 --> 00:21:31.990 align:start position:0% still be like four times faster should be<00:21:28.560> four<00:21:28.920> times<00:21:29.130> faster<00:21:29.520> than<00:21:29.640> Patterson<00:21:30.120> hash 00:21:31.990 --> 00:21:32.000 align:start position:0% be four times faster than Patterson hash 00:21:32.000 --> 00:21:38.630 align:start position:0% be four times faster than Patterson hash if<00:21:33.000> we<00:21:34.580> if<00:21:35.580> we<00:21:35.640> use<00:21:36.500> and<00:21:37.500> interesting<00:21:38.310> we<00:21:38.400> if<00:21:38.490> we 00:21:38.630 --> 00:21:38.640 align:start position:0% if we if we use and interesting we if we 00:21:38.640 --> 00:21:41.090 align:start position:0% if we if we use and interesting we if we increase<00:21:38.970> the<00:21:39.240> width<00:21:39.420> then<00:21:40.140> we<00:21:40.680> can<00:21:40.830> do<00:21:40.950> better 00:21:41.090 --> 00:21:41.100 align:start position:0% increase the width then we can do better 00:21:41.100 --> 00:21:45.620 align:start position:0% increase the width then we can do better and<00:21:41.490> for<00:21:42.920> 1500<00:21:43.920> bits<00:21:44.100> and<00:21:44.490> to<00:21:44.700> two<00:21:44.820> hundred<00:21:45.210> two 00:21:45.620 --> 00:21:45.630 align:start position:0% and for 1500 bits and to two hundred two 00:21:45.630 --> 00:21:49.450 align:start position:0% and for 1500 bits and to two hundred two thousand<00:21:45.990> bits<00:21:46.170> we<00:21:46.620> can<00:21:46.650> get<00:21:47.010> best<00:21:47.880> results<00:21:48.000> so 00:21:49.450 --> 00:21:49.460 align:start position:0% thousand bits we can get best results so 00:21:49.460 --> 00:21:53.140 align:start position:0% thousand bits we can get best results so 1536<00:21:50.460> is<00:21:50.670> the<00:21:51.600> best<00:21:51.780> we<00:21:51.990> can<00:21:52.110> get<00:21:52.320> it's<00:21:52.530> like 00:21:53.140 --> 00:21:53.150 align:start position:0% 1536 is the best we can get it's like 00:21:53.150 --> 00:21:59.300 align:start position:0% 1536 is the best we can get it's like 60%<00:21:54.150> faster<00:21:54.770> than<00:21:55.770> the<00:21:56.580> smaller<00:21:56.880> one<00:21:57.380> so<00:21:58.380> our 00:21:59.300 --> 00:21:59.310 align:start position:0% 60% faster than the smaller one so our 00:21:59.310 --> 00:22:05.120 align:start position:0% 60% faster than the smaller one so our current<00:21:59.640> proposal<00:22:00.270> is<00:22:00.420> to<00:22:00.690> use<00:22:01.400> this<00:22:02.660> with<00:22:04.130> how 00:22:05.120 --> 00:22:05.130 align:start position:0% current proposal is to use this with how 00:22:05.130 --> 00:22:07.880 align:start position:0% current proposal is to use this with how many<00:22:05.310> like<00:22:05.780> not<00:22:06.780> very<00:22:06.990> big<00:22:07.110> number<00:22:07.440> of<00:22:07.470> rounds 00:22:07.880 --> 00:22:07.890 align:start position:0% many like not very big number of rounds 00:22:07.890 --> 00:22:10.850 align:start position:0% many like not very big number of rounds like<00:22:08.070> eight<00:22:08.340> outer<00:22:09.240> rounds<00:22:09.870> and<00:22:10.050> not<00:22:10.500> that<00:22:10.680> big 00:22:10.850 --> 00:22:10.860 align:start position:0% like eight outer rounds and not that big 00:22:10.860 --> 00:22:11.880 align:start position:0% like eight outer rounds and not that big number<00:22:11.250> of 00:22:11.880 --> 00:22:11.890 align:start position:0% number of 00:22:11.890 --> 00:22:14.950 align:start position:0% number of rounds<00:22:12.890> and<00:22:13.010> the<00:22:13.549> tree<00:22:13.789> will<00:22:14.030> be<00:22:14.059> twice<00:22:14.510> as 00:22:14.950 --> 00:22:14.960 align:start position:0% rounds and the tree will be twice as 00:22:14.960 --> 00:22:20.169 align:start position:0% rounds and the tree will be twice as smaller<00:22:16.750> for<00:22:17.750> snarks<00:22:18.350> we<00:22:19.039> can<00:22:19.220> estimate<00:22:19.640> the 00:22:20.169 --> 00:22:20.179 align:start position:0% smaller for snarks we can estimate the 00:22:20.179 --> 00:22:21.820 align:start position:0% smaller for snarks we can estimate the number<00:22:20.419> of<00:22:20.450> constraints<00:22:20.990> which<00:22:21.320> is<00:22:21.590> also 00:22:21.820 --> 00:22:21.830 align:start position:0% number of constraints which is also 00:22:21.830 --> 00:22:25.750 align:start position:0% number of constraints which is also interesting<00:22:22.309> so<00:22:23.049> suppose<00:22:24.049> that<00:22:24.080> we<00:22:24.230> use<00:22:24.760> 255 00:22:25.750 --> 00:22:25.760 align:start position:0% interesting so suppose that we use 255 00:22:25.760 --> 00:22:28.930 align:start position:0% interesting so suppose that we use 255 bit<00:22:26.059> as<00:22:26.270> boxes<00:22:26.750> if<00:22:27.080> you<00:22:27.530> want<00:22:28.070> to<00:22:28.220> use<00:22:28.370> snarks 00:22:28.930 --> 00:22:28.940 align:start position:0% bit as boxes if you want to use snarks 00:22:28.940 --> 00:22:33.580 align:start position:0% bit as boxes if you want to use snarks on<00:22:29.710> elliptic<00:22:30.710> curves<00:22:30.950> with<00:22:31.840> 255<00:22:32.840> bit<00:22:33.169> primes 00:22:33.580 --> 00:22:33.590 align:start position:0% on elliptic curves with 255 bit primes 00:22:33.590 --> 00:22:38.320 align:start position:0% on elliptic curves with 255 bit primes if<00:22:34.100> you<00:22:34.460> want<00:22:36.400> 3384<00:22:37.400> bit<00:22:37.580> primes<00:22:37.880> then<00:22:38.179> you 00:22:38.320 --> 00:22:38.330 align:start position:0% if you want 3384 bit primes then you 00:22:38.330 --> 00:22:41.830 align:start position:0% if you want 3384 bit primes then you should<00:22:38.570> kind<00:22:39.230> of<00:22:39.700> substitute<00:22:40.700> them<00:22:40.909> and<00:22:41.150> it 00:22:41.830 --> 00:22:41.840 align:start position:0% should kind of substitute them and it 00:22:41.840 --> 00:22:44.710 align:start position:0% should kind of substitute them and it will<00:22:42.049> be<00:22:42.220> somewhat<00:22:43.220> similar<00:22:43.580> and<00:22:43.850> we<00:22:44.600> can 00:22:44.710 --> 00:22:44.720 align:start position:0% will be somewhat similar and we can 00:22:44.720 --> 00:22:46.890 align:start position:0% will be somewhat similar and we can calculate<00:22:45.110> the<00:22:45.230> number<00:22:45.320> of<00:22:45.500> constraints<00:22:46.010> and 00:22:46.890 --> 00:22:46.900 align:start position:0% calculate the number of constraints and 00:22:46.900 --> 00:22:49.930 align:start position:0% calculate the number of constraints and we<00:22:47.900> can<00:22:48.080> compare<00:22:48.620> with<00:22:48.860> paterson<00:22:49.370> hash<00:22:49.580> which 00:22:49.930 --> 00:22:49.940 align:start position:0% we can compare with paterson hash which 00:22:49.940 --> 00:22:52.419 align:start position:0% we can compare with paterson hash which is<00:22:50.120> like<00:22:50.740> 40,000<00:22:51.740> constraints<00:22:52.220> for<00:22:52.370> the 00:22:52.419 --> 00:22:52.429 align:start position:0% is like 40,000 constraints for the 00:22:52.429 --> 00:22:55.330 align:start position:0% is like 40,000 constraints for the entire<00:22:52.669> trees<00:22:52.970> and<00:22:53.240> if<00:22:53.720> I<00:22:54.280> counted<00:22:55.280> correctly 00:22:55.330 --> 00:22:55.340 align:start position:0% entire trees and if I counted correctly 00:22:55.340 --> 00:22:59.440 align:start position:0% entire trees and if I counted correctly and<00:22:56.030> for<00:22:56.809> this<00:22:57.380> sort<00:22:58.340> of<00:22:58.460> hash<00:22:58.669> for<00:22:58.940> the<00:22:59.030> entire 00:22:59.440 --> 00:22:59.450 align:start position:0% and for this sort of hash for the entire 00:22:59.450 --> 00:23:06.220 align:start position:0% and for this sort of hash for the entire tree<00:22:59.929> if<00:23:00.559> we<00:23:00.830> use<00:23:02.169> if<00:23:03.169> we<00:23:03.440> use<00:23:03.679> 6<00:23:04.490> s<00:23:05.110> boxes<00:23:06.110> in 00:23:06.220 --> 00:23:06.230 align:start position:0% tree if we use if we use 6 s boxes in 00:23:06.230 --> 00:23:11.289 align:start position:0% tree if we use if we use 6 s boxes in parallel<00:23:06.620> and<00:23:08.740> for<00:23:09.820> 127<00:23:10.820> bit<00:23:10.940> collision 00:23:11.289 --> 00:23:11.299 align:start position:0% parallel and for 127 bit collision 00:23:11.299 --> 00:23:16.860 align:start position:0% parallel and for 127 bit collision resistance<00:23:11.720> then<00:23:12.470> we<00:23:13.280> should<00:23:13.720> have<00:23:14.720> only<00:23:15.520> 666 00:23:16.860 --> 00:23:16.870 align:start position:0% resistance then we should have only 666 00:23:16.870 --> 00:23:18.880 align:start position:0% resistance then we should have only 666 constraints<00:23:17.870> well<00:23:18.049> maybe<00:23:18.230> indeed<00:23:18.530> for<00:23:18.710> a<00:23:18.740> fair 00:23:18.880 --> 00:23:18.890 align:start position:0% constraints well maybe indeed for a fair 00:23:18.890 --> 00:23:20.860 align:start position:0% constraints well maybe indeed for a fair comparison<00:23:19.190> we<00:23:19.490> should<00:23:19.640> use<00:23:19.820> bigger<00:23:20.450> prime 00:23:20.860 --> 00:23:20.870 align:start position:0% comparison we should use bigger prime 00:23:20.870 --> 00:23:23.770 align:start position:0% comparison we should use bigger prime but<00:23:21.500> I<00:23:21.830> think<00:23:22.039> the<00:23:22.190> order<00:23:22.760> of<00:23:22.820> fact<00:23:23.000> order<00:23:23.600> will 00:23:23.770 --> 00:23:23.780 align:start position:0% but I think the order of fact order will 00:23:23.780 --> 00:23:26.980 align:start position:0% but I think the order of fact order will be<00:23:23.929> the<00:23:24.740> same<00:23:24.950> so<00:23:25.400> I<00:23:25.429> think<00:23:25.730> this<00:23:25.880> is<00:23:26.030> quite 00:23:26.980 --> 00:23:26.990 align:start position:0% be the same so I think this is quite 00:23:26.990 --> 00:23:28.000 align:start position:0% be the same so I think this is quite promising 00:23:28.000 --> 00:23:28.010 align:start position:0% promising 00:23:28.010 --> 00:23:32.789 align:start position:0% promising and<00:23:29.650> well<00:23:30.650> of<00:23:31.190> course<00:23:31.280> we<00:23:31.789> advocate<00:23:32.179> some 00:23:32.789 --> 00:23:32.799 align:start position:0% and well of course we advocate some 00:23:32.799 --> 00:23:35.230 align:start position:0% and well of course we advocate some additions<00:23:33.799> to<00:23:33.890> a<00:23:34.039> VM<00:23:34.400> or<00:23:34.669> whatever<00:23:35.030> will<00:23:35.210> be 00:23:35.230 --> 00:23:35.240 align:start position:0% additions to a VM or whatever will be 00:23:35.240 --> 00:23:38.230 align:start position:0% additions to a VM or whatever will be used<00:23:35.600> to<00:23:36.130> support<00:23:37.130> natively<00:23:37.789> support<00:23:38.150> the 00:23:38.230 --> 00:23:38.240 align:start position:0% used to support natively support the 00:23:38.240 --> 00:23:40.450 align:start position:0% used to support natively support the operations<00:23:38.690> in<00:23:38.840> the<00:23:38.870> field<00:23:39.280> basically<00:23:40.280> for 00:23:40.450 --> 00:23:40.460 align:start position:0% operations in the field basically for 00:23:40.460 --> 00:23:42.970 align:start position:0% operations in the field basically for verifiers<00:23:40.970> because<00:23:41.539> verifiers<00:23:41.990> in<00:23:42.440> stars<00:23:42.740> and 00:23:42.970 --> 00:23:42.980 align:start position:0% verifiers because verifiers in stars and 00:23:42.980 --> 00:23:44.620 align:start position:0% verifiers because verifiers in stars and bulletproof<00:23:43.250> they<00:23:43.580> need<00:23:43.850> some<00:23:44.150> parts<00:23:44.450> of<00:23:44.539> the 00:23:44.620 --> 00:23:44.630 align:start position:0% bulletproof they need some parts of the 00:23:44.630 --> 00:23:48.820 align:start position:0% bulletproof they need some parts of the circuit<00:23:45.020> and<00:23:46.270> some<00:23:47.320> some<00:23:48.320> field<00:23:48.590> operations 00:23:48.820 --> 00:23:48.830 align:start position:0% circuit and some some field operations 00:23:48.830 --> 00:23:51.760 align:start position:0% circuit and some some field operations should<00:23:49.280> be<00:23:49.370> supported<00:23:49.880> and<00:23:50.140> optional<00:23:51.140> I<00:23:51.470> don't 00:23:51.760 --> 00:23:51.770 align:start position:0% should be supported and optional I don't 00:23:51.770 --> 00:23:53.919 align:start position:0% should be supported and optional I don't know<00:23:51.830> if<00:23:52.190> the<00:23:52.460> inter<00:23:52.820> entire<00:23:53.299> permutation 00:23:53.919 --> 00:23:53.929 align:start position:0% know if the inter entire permutation 00:23:53.929 --> 00:23:55.419 align:start position:0% know if the inter entire permutation should<00:23:54.110> be<00:23:54.260> as<00:23:54.350> a<00:23:54.380> precompiled<00:23:55.039> contract 00:23:55.419 --> 00:23:55.429 align:start position:0% should be as a precompiled contract 00:23:55.429 --> 00:23:58.029 align:start position:0% should be as a precompiled contract maybe<00:23:55.580> it's<00:23:55.760> not<00:23:55.850> necessary<00:23:55.960> but<00:23:56.960> we<00:23:57.440> will<00:23:57.770> see 00:23:58.029 --> 00:23:58.039 align:start position:0% maybe it's not necessary but we will see 00:23:58.039 --> 00:24:01.690 align:start position:0% maybe it's not necessary but we will see those<00:23:58.280> depending<00:23:58.760> on<00:23:58.900> whether<00:23:59.900> some<00:24:00.700> checks 00:24:01.690 --> 00:24:01.700 align:start position:0% those depending on whether some checks 00:24:01.700 --> 00:24:04.260 align:start position:0% those depending on whether some checks against<00:24:02.510> the<00:24:02.600> entire<00:24:02.780> permutation<00:24:03.470> are 00:24:04.260 --> 00:24:04.270 align:start position:0% against the entire permutation are 00:24:04.270 --> 00:24:06.460 align:start position:0% against the entire permutation are performed<00:24:05.270> to<00:24:05.419> the<00:24:05.539> performance<00:24:06.169> in<00:24:06.350> the 00:24:06.460 --> 00:24:06.470 align:start position:0% performed to the performance in the 00:24:06.470 --> 00:24:08.529 align:start position:0% performed to the performance in the contract<00:24:06.890> and<00:24:07.039> if<00:24:07.190> so<00:24:07.370> then<00:24:07.580> indeed<00:24:07.909> a<00:24:08.120> per 00:24:08.529 --> 00:24:08.539 align:start position:0% contract and if so then indeed a per 00:24:08.539 --> 00:24:12.909 align:start position:0% contract and if so then indeed a per compile<00:24:08.900> contract<00:24:09.350> would<00:24:09.470> help<00:24:10.150> so<00:24:11.799> this<00:24:12.799> is 00:24:12.909 --> 00:24:12.919 align:start position:0% compile contract would help so this is 00:24:12.919 --> 00:24:14.770 align:start position:0% compile contract would help so this is just<00:24:13.159> the<00:24:13.250> beginning<00:24:13.640> just<00:24:13.820> begin<00:24:14.600> that's 00:24:14.770 --> 00:24:14.780 align:start position:0% just the beginning just begin that's 00:24:14.780 --> 00:24:16.240 align:start position:0% just the beginning just begin that's kind<00:24:15.020> of<00:24:15.080> the<00:24:15.440> hash<00:24:15.620> function<00:24:15.980> that<00:24:16.010> we 00:24:16.240 --> 00:24:16.250 align:start position:0% kind of the hash function that we 00:24:16.250 --> 00:24:18.909 align:start position:0% kind of the hash function that we cryptographers<00:24:16.850> can<00:24:17.059> design<00:24:17.450> within<00:24:18.200> a<00:24:18.470> short 00:24:18.909 --> 00:24:18.919 align:start position:0% cryptographers can design within a short 00:24:18.919 --> 00:24:21.130 align:start position:0% cryptographers can design within a short time<00:24:19.429> period<00:24:19.820> but<00:24:20.390> I<00:24:20.450> think<00:24:20.720> there<00:24:20.929> can<00:24:21.080> be 00:24:21.130 --> 00:24:21.140 align:start position:0% time period but I think there can be 00:24:21.140 --> 00:24:22.750 align:start position:0% time period but I think there can be designed<00:24:21.559> better<00:24:21.890> or<00:24:22.070> better<00:24:22.190> ones<00:24:22.490> can<00:24:22.640> be 00:24:22.750 --> 00:24:22.760 align:start position:0% designed better or better ones can be 00:24:22.760 --> 00:24:25.900 align:start position:0% designed better or better ones can be found<00:24:23.000> so<00:24:23.690> we<00:24:24.020> can<00:24:24.260> try 00:24:25.900 --> 00:24:25.910 align:start position:0% found so we can try 00:24:25.910 --> 00:24:29.770 align:start position:0% found so we can try start<00:24:26.750> friendly<00:24:27.050> fields<00:24:27.380> we<00:24:27.950> can<00:24:28.600> work<00:24:29.600> better 00:24:29.770 --> 00:24:29.780 align:start position:0% start friendly fields we can work better 00:24:29.780 --> 00:24:32.560 align:start position:0% start friendly fields we can work better with<00:24:30.170> algebraic<00:24:31.070> attacks<00:24:31.430> for<00:24:31.670> example<00:24:31.730> the 00:24:32.560 --> 00:24:32.570 align:start position:0% with algebraic attacks for example the 00:24:32.570 --> 00:24:34.000 align:start position:0% with algebraic attacks for example the corner<00:24:32.840> burger<00:24:33.230> burger<00:24:33.410> business<00:24:33.560> attacks 00:24:34.000 --> 00:24:34.010 align:start position:0% corner burger burger business attacks 00:24:34.010 --> 00:24:36.780 align:start position:0% corner burger burger business attacks are<00:24:34.310> sort<00:24:35.000> of<00:24:35.120> an<00:24:35.480> offender<00:24:35.750> explored<00:24:36.260> and 00:24:36.780 --> 00:24:36.790 align:start position:0% are sort of an offender explored and 00:24:36.790 --> 00:24:41.620 align:start position:0% are sort of an offender explored and because<00:24:39.040> and<00:24:40.040> as<00:24:40.430> far<00:24:40.640> as<00:24:40.700> they<00:24:41.000> claim<00:24:41.360> to<00:24:41.390> be 00:24:41.620 --> 00:24:41.630 align:start position:0% because and as far as they claim to be 00:24:41.630 --> 00:24:43.660 align:start position:0% because and as far as they claim to be the<00:24:42.110> best<00:24:42.140> and<00:24:42.560> in<00:24:42.770> the<00:24:42.920> settings<00:24:43.340> should<00:24:43.460> be 00:24:43.660 --> 00:24:43.670 align:start position:0% the best and in the settings should be 00:24:43.670 --> 00:24:45.940 align:start position:0% the best and in the settings should be very<00:24:43.910> interesting<00:24:44.420> to<00:24:44.450> apply<00:24:44.840> exist<00:24:45.770> in 00:24:45.940 --> 00:24:45.950 align:start position:0% very interesting to apply exist in 00:24:45.950 --> 00:24:48.480 align:start position:0% very interesting to apply exist in Grosvenor<00:24:46.490> best<00:24:46.760> labor<00:24:47.090> a<00:24:47.360> libraries<00:24:47.810> to 00:24:48.480 --> 00:24:48.490 align:start position:0% Grosvenor best labor a libraries to 00:24:48.490 --> 00:24:51.040 align:start position:0% Grosvenor best labor a libraries to attacks<00:24:49.490> and<00:24:49.670> see<00:24:49.850> if<00:24:50.000> the<00:24:50.210> indeed<00:24:50.480> kind<00:24:50.840> of 00:24:51.040 --> 00:24:51.050 align:start position:0% attacks and see if the indeed kind of 00:24:51.050 --> 00:24:54.130 align:start position:0% attacks and see if the indeed kind of perform<00:24:51.500> as<00:24:51.650> we<00:24:51.770> expect<00:24:52.160> and<00:24:52.810> it<00:24:53.810> would<00:24:54.020> be 00:24:54.130 --> 00:24:54.140 align:start position:0% perform as we expect and it would be 00:24:54.140 --> 00:24:56.860 align:start position:0% perform as we expect and it would be also<00:24:54.260> cool<00:24:55.160> have<00:24:55.490> some<00:24:55.760> to<00:24:56.120> fix<00:24:56.300> some<00:24:56.480> metrics 00:24:56.860 --> 00:24:56.870 align:start position:0% also cool have some to fix some metrics 00:24:56.870 --> 00:24:59.680 align:start position:0% also cool have some to fix some metrics and<00:24:57.050> have<00:24:57.710> some<00:24:58.070> kind<00:24:58.280> of<00:24:58.370> competition<00:24:58.970> that 00:24:59.680 --> 00:24:59.690 align:start position:0% and have some kind of competition that 00:24:59.690 --> 00:25:02.260 align:start position:0% and have some kind of competition that like<00:25:00.410> everyone<00:25:01.070> can<00:25:01.250> suggest<00:25:01.460> hash<00:25:01.850> function 00:25:02.260 --> 00:25:02.270 align:start position:0% like everyone can suggest hash function 00:25:02.270 --> 00:25:03.760 align:start position:0% like everyone can suggest hash function that<00:25:02.300> optimize<00:25:02.840> the<00:25:03.200> number<00:25:03.290> of<00:25:03.500> constraints 00:25:03.760 --> 00:25:03.770 align:start position:0% that optimize the number of constraints 00:25:03.770 --> 00:25:06.820 align:start position:0% that optimize the number of constraints somewhere<00:25:04.520> and<00:25:04.990> withstands<00:25:05.990> security 00:25:06.820 --> 00:25:06.830 align:start position:0% somewhere and withstands security 00:25:06.830 --> 00:25:11.080 align:start position:0% somewhere and withstands security attacks<00:25:07.070> up<00:25:07.310> to<00:25:07.490> know<00:25:08.090> 2<00:25:08.300> to<00:25:08.420> the<00:25:08.680> 128th<00:25:10.090> maybe 00:25:11.080 --> 00:25:11.090 align:start position:0% attacks up to know 2 to the 128th maybe 00:25:11.090 --> 00:25:12.910 align:start position:0% attacks up to know 2 to the 128th maybe designs<00:25:11.450> a<00:25:11.630> miracle<00:25:11.960> tree<00:25:12.080> oriented<00:25:12.530> hashing 00:25:12.910 --> 00:25:12.920 align:start position:0% designs a miracle tree oriented hashing 00:25:12.920 --> 00:25:15.480 align:start position:0% designs a miracle tree oriented hashing they<00:25:13.820> already<00:25:14.090> exist<00:25:14.420> to<00:25:14.480> based<00:25:14.750> hashing<00:25:15.200> but 00:25:15.480 --> 00:25:15.490 align:start position:0% they already exist to based hashing but 00:25:15.490 --> 00:25:17.860 align:start position:0% they already exist to based hashing but maybe<00:25:16.490> there<00:25:16.880> can<00:25:17.060> be<00:25:17.090> something<00:25:17.510> more 00:25:17.860 --> 00:25:17.870 align:start position:0% maybe there can be something more 00:25:17.870 --> 00:25:21.370 align:start position:0% maybe there can be something more optimal<00:25:18.380> and<00:25:19.510> also<00:25:20.510> for<00:25:20.930> example<00:25:21.230> maybe 00:25:21.370 --> 00:25:21.380 align:start position:0% optimal and also for example maybe 00:25:21.380 --> 00:25:24.190 align:start position:0% optimal and also for example maybe 128-bit<00:25:22.340> security<00:25:22.760> is<00:25:22.820> not<00:25:23.000> need<00:25:23.720> that<00:25:23.750> much 00:25:24.190 --> 00:25:24.200 align:start position:0% 128-bit security is not need that much 00:25:24.200 --> 00:25:30.010 align:start position:0% 128-bit security is not need that much maybe<00:25:24.590> if<00:25:26.080> the<00:25:27.080> hash<00:25:27.230> function<00:25:27.500> if<00:25:28.460> the<00:25:29.020> proof 00:25:30.010 --> 00:25:30.020 align:start position:0% maybe if the hash function if the proof 00:25:30.020 --> 00:25:33.730 align:start position:0% maybe if the hash function if the proof should<00:25:30.950> be<00:25:31.880> like<00:25:32.450> secure<00:25:32.900> for<00:25:33.230> only<00:25:33.350> short 00:25:33.730 --> 00:25:33.740 align:start position:0% should be like secure for only short 00:25:33.740 --> 00:25:36.130 align:start position:0% should be like secure for only short period<00:25:34.130> of<00:25:34.220> time<00:25:34.460> then<00:25:35.420> maybe<00:25:35.810> a<00:25:35.930> lower 00:25:36.130 --> 00:25:36.140 align:start position:0% period of time then maybe a lower 00:25:36.140 --> 00:25:39.370 align:start position:0% period of time then maybe a lower security<00:25:36.710> level<00:25:37.300> would<00:25:38.300> be<00:25:38.420> nice<00:25:38.630> for<00:25:38.960> example 00:25:39.370 --> 00:25:39.380 align:start position:0% security level would be nice for example 00:25:39.380 --> 00:25:41.620 align:start position:0% security level would be nice for example 64-bit<00:25:39.950> security<00:25:40.310> level<00:25:40.550> I'd<00:25:40.640> know<00:25:40.790> maybe<00:25:41.090> 56 00:25:41.620 --> 00:25:41.630 align:start position:0% 64-bit security level I'd know maybe 56 00:25:41.630 --> 00:25:43.270 align:start position:0% 64-bit security level I'd know maybe 56 bit<00:25:41.780> security<00:25:42.140> level<00:25:42.380> that's<00:25:42.830> like<00:25:42.980> this<00:25:43.130> than 00:25:43.270 --> 00:25:43.280 align:start position:0% bit security level that's like this than 00:25:43.280 --> 00:25:46.030 align:start position:0% bit security level that's like this than we<00:25:43.400> have<00:25:43.640> we<00:25:43.820> can<00:25:44.000> have<00:25:44.240> much<00:25:45.080> again<00:25:45.830> more 00:25:46.030 --> 00:25:46.040 align:start position:0% we have we can have much again more 00:25:46.040 --> 00:25:48.430 align:start position:0% we have we can have much again more compact<00:25:46.520> designs<00:25:47.330> and<00:25:47.600> maybe<00:25:47.750> with<00:25:48.020> faster 00:25:48.430 --> 00:25:48.440 align:start position:0% compact designs and maybe with faster 00:25:48.440 --> 00:25:52.530 align:start position:0% compact designs and maybe with faster proofs<00:25:48.710> and<00:25:49.070> since<00:25:49.850> first<00:25:50.480> certifications 00:25:52.530 --> 00:25:52.540 align:start position:0% proofs and since first certifications 00:25:52.540 --> 00:25:54.910 align:start position:0% proofs and since first certifications thank<00:25:53.540> you<00:25:53.630> very<00:25:53.750> much 00:25:54.910 --> 00:25:54.920 align:start position:0% thank you very much 00:25:54.920 --> 00:26:00.680 align:start position:0% thank you very much [Applause] 00:26:00.680 --> 00:26:00.690 align:start position:0% [Applause] 00:26:00.690 --> 00:26:08.580 align:start position:0% [Applause] we<00:26:01.690> have<00:26:01.780> time<00:26:01.960> for<00:26:01.990> maybe<00:26:02.230> one<00:26:02.380> question<00:26:07.590> so 00:26:08.580 --> 00:26:08.590 align:start position:0% we have time for maybe one question so 00:26:08.590 --> 00:26:10.500 align:start position:0% we have time for maybe one question so I'm<00:26:08.920> sure<00:26:09.160> you've<00:26:09.310> heard<00:26:09.490> about<00:26:09.580> the<00:26:10.000> new 00:26:10.500 --> 00:26:10.510 align:start position:0% I'm sure you've heard about the new 00:26:10.510 --> 00:26:13.290 align:start position:0% I'm sure you've heard about the new designs<00:26:11.320> coming<00:26:11.920> out<00:26:12.130> for<00:26:12.340> the<00:26:12.520> Starks<00:26:13.090> with 00:26:13.290 --> 00:26:13.300 align:start position:0% designs coming out for the Starks with 00:26:13.300 --> 00:26:15.420 align:start position:0% designs coming out for the Starks with Jarvis<00:26:14.050> and<00:26:14.320> Friday<00:26:14.560> although<00:26:14.980> they're 00:26:15.420 --> 00:26:15.430 align:start position:0% Jarvis and Friday although they're 00:26:15.430 --> 00:26:18.510 align:start position:0% Jarvis and Friday although they're confined<00:26:15.910> to<00:26:16.720> the<00:26:16.870> binary<00:26:17.260> field<00:26:17.470> how<00:26:18.430> would 00:26:18.510 --> 00:26:18.520 align:start position:0% confined to the binary field how would 00:26:18.520 --> 00:26:19.500 align:start position:0% confined to the binary field how would you<00:26:18.610> describe<00:26:18.790> the<00:26:19.000> relationship<00:26:19.030> between 00:26:19.500 --> 00:26:19.510 align:start position:0% you describe the relationship between 00:26:19.510 --> 00:26:20.940 align:start position:0% you describe the relationship between your<00:26:19.750> work<00:26:19.900> in<00:26:20.080> that<00:26:20.110> hmm 00:26:20.940 --> 00:26:20.950 align:start position:0% your work in that hmm 00:26:20.950 --> 00:26:23.130 align:start position:0% your work in that hmm how<00:26:21.790> what<00:26:22.030> how<00:26:22.570> would<00:26:22.690> you<00:26:22.780> describe<00:26:22.990> the 00:26:23.130 --> 00:26:23.140 align:start position:0% how what how would you describe the 00:26:23.140 --> 00:26:24.600 align:start position:0% how what how would you describe the relationship<00:26:23.560> between<00:26:23.710> your<00:26:24.070> work<00:26:24.220> and<00:26:24.400> that 00:26:24.600 --> 00:26:24.610 align:start position:0% relationship between your work and that 00:26:24.610 --> 00:26:25.800 align:start position:0% relationship between your work and that how<00:26:24.910> do<00:26:24.970> you<00:26:25.090> see<00:26:25.300> them 00:26:25.800 --> 00:26:25.810 align:start position:0% how do you see them 00:26:25.810 --> 00:26:27.810 align:start position:0% how do you see them I've<00:26:26.080> just<00:26:26.380> seen<00:26:26.620> them<00:26:26.830> two<00:26:27.070> days<00:26:27.250> ago<00:26:27.460> and 00:26:27.810 --> 00:26:27.820 align:start position:0% I've just seen them two days ago and 00:26:27.820 --> 00:26:32.910 align:start position:0% I've just seen them two days ago and basically<00:26:28.390> their<00:26:29.290> idea<00:26:29.830> is<00:26:30.190> in<00:26:30.610> the<00:26:31.410> am<00:26:32.410> IMC 00:26:32.910 --> 00:26:32.920 align:start position:0% basically their idea is in the am IMC 00:26:32.920 --> 00:26:35.640 align:start position:0% basically their idea is in the am IMC with<00:26:33.130> only<00:26:33.310> one<00:26:33.550> register<00:26:34.090> to<00:26:34.120> insert<00:26:34.750> a<00:26:35.050> fine 00:26:35.640 --> 00:26:35.650 align:start position:0% with only one register to insert a fine 00:26:35.650 --> 00:26:39.150 align:start position:0% with only one register to insert a fine layer<00:26:35.950> and<00:26:36.930> that's<00:26:37.930> not<00:26:38.170> yet<00:26:38.380> clear<00:26:38.620> for<00:26:38.890> me<00:26:38.980> if 00:26:39.150 --> 00:26:39.160 align:start position:0% layer and that's not yet clear for me if 00:26:39.160 --> 00:26:41.940 align:start position:0% layer and that's not yet clear for me if this<00:26:39.370> and<00:26:39.610> it<00:26:39.730> withstands<00:26:40.300> algebraic<00:26:40.950> tax 00:26:41.940 --> 00:26:41.950 align:start position:0% this and it withstands algebraic tax 00:26:41.950 --> 00:26:44.160 align:start position:0% this and it withstands algebraic tax because<00:26:42.370> I<00:26:42.640> have<00:26:43.030> some<00:26:43.180> doubt<00:26:43.390> but<00:26:43.720> I<00:26:43.780> haven't 00:26:44.160 --> 00:26:44.170 align:start position:0% because I have some doubt but I haven't 00:26:44.170 --> 00:26:46.320 align:start position:0% because I have some doubt but I haven't found<00:26:44.470> an<00:26:44.710> actual<00:26:44.980> attack<00:26:45.250> so<00:26:45.490> maybe<00:26:45.700> maybe 00:26:46.320 --> 00:26:46.330 align:start position:0% found an actual attack so maybe maybe 00:26:46.330 --> 00:26:49.410 align:start position:0% found an actual attack so maybe maybe it's<00:26:46.570> indeed<00:26:46.750> secure<00:26:47.110> but<00:26:47.410> I<00:26:47.860> would<00:26:48.400> be<00:26:48.580> very 00:26:49.410 --> 00:26:49.420 align:start position:0% it's indeed secure but I would be very 00:26:49.420 --> 00:26:51.330 align:start position:0% it's indeed secure but I would be very careful<00:26:49.660> I<00:26:49.930> think<00:26:50.170> that<00:26:50.440> third-party<00:26:50.860> reviews 00:26:51.330 --> 00:26:51.340 align:start position:0% careful I think that third-party reviews 00:26:51.340 --> 00:26:54.630 align:start position:0% careful I think that third-party reviews I<00:26:51.520> needed<00:26:53.040> another<00:26:54.040> round<00:26:54.310> of<00:26:54.370> applause 00:26:54.630 --> 00:26:54.640 align:start position:0% I needed another round of applause 00:26:54.640 --> 00:26:55.730 align:start position:0% I needed another round of applause please 00:26:55.730 --> 00:26:55.740 align:start position:0% please 00:26:55.740 --> 00:27:04.430 align:start position:0% please [Applause] 00:27:04.430 --> 00:27:04.440 align:start position:0% 00:27:04.440 --> 00:27:06.500 align:start position:0% you