WEBVTT Kind: captions Language: en 00:00:04.460 --> 00:00:06.849 align:start position:0% thanks<00:00:05.060> for<00:00:05.180> coming<00:00:05.420> so<00:00:05.870> I'm<00:00:06.230> going<00:00:06.560> to<00:00:06.620> talk 00:00:06.849 --> 00:00:06.859 align:start position:0% thanks for coming so I'm going to talk 00:00:06.859 --> 00:00:09.129 align:start position:0% thanks for coming so I'm going to talk about<00:00:07.330> transparent<00:00:08.330> snacks<00:00:08.600> from<00:00:08.840> dark 00:00:09.129 --> 00:00:09.139 align:start position:0% about transparent snacks from dark 00:00:09.139 --> 00:00:10.959 align:start position:0% about transparent snacks from dark compiler<00:00:09.469> tips<00:00:09.740> today<00:00:10.129> and<00:00:10.430> this<00:00:10.549> is<00:00:10.730> joint 00:00:10.959 --> 00:00:10.969 align:start position:0% compiler tips today and this is joint 00:00:10.969 --> 00:00:13.270 align:start position:0% compiler tips today and this is joint work<00:00:11.030> with<00:00:11.150> Alan<00:00:11.510> Japan<00:00:11.750> Jack<00:00:11.900> and<00:00:12.110> Ben<00:00:13.040> fish 00:00:13.270 --> 00:00:13.280 align:start position:0% work with Alan Japan Jack and Ben fish 00:00:13.280 --> 00:00:17.650 align:start position:0% work with Alan Japan Jack and Ben fish and<00:00:14.410> the<00:00:15.410> the<00:00:15.889> main<00:00:16.070> problem<00:00:16.970> that<00:00:17.150> zero 00:00:17.650 --> 00:00:17.660 align:start position:0% and the the main problem that zero 00:00:17.660 --> 00:00:19.210 align:start position:0% and the the main problem that zero knowledge<00:00:17.779> proof<00:00:17.900> solvers<00:00:18.619> is<00:00:18.800> something 00:00:19.210 --> 00:00:19.220 align:start position:0% knowledge proof solvers is something 00:00:19.220 --> 00:00:21.429 align:start position:0% knowledge proof solvers is something that<00:00:19.849> you<00:00:20.480> can<00:00:20.630> see<00:00:20.779> here<00:00:20.960> in<00:00:21.050> a<00:00:21.140> Bitcoin 00:00:21.429 --> 00:00:21.439 align:start position:0% that you can see here in a Bitcoin 00:00:21.439 --> 00:00:22.839 align:start position:0% that you can see here in a Bitcoin transaction<00:00:22.009> and<00:00:22.220> the<00:00:22.340> same<00:00:22.520> holds<00:00:22.790> for 00:00:22.839 --> 00:00:22.849 align:start position:0% transaction and the same holds for 00:00:22.849 --> 00:00:25.240 align:start position:0% transaction and the same holds for aetherium<00:00:23.300> transactions<00:00:23.869> it's<00:00:24.529> that<00:00:24.800> if<00:00:25.099> I 00:00:25.240 --> 00:00:25.250 align:start position:0% aetherium transactions it's that if I 00:00:25.250 --> 00:00:27.010 align:start position:0% aetherium transactions it's that if I want<00:00:25.430> to<00:00:25.520> check<00:00:25.730> the<00:00:26.029> validity<00:00:26.239> of<00:00:26.630> a<00:00:26.869> Bitcoin 00:00:27.010 --> 00:00:27.020 align:start position:0% want to check the validity of a Bitcoin 00:00:27.020 --> 00:00:32.830 align:start position:0% want to check the validity of a Bitcoin transactions<00:00:27.770> then<00:00:28.520> I<00:00:29.410> need<00:00:30.410> to<00:00:30.590> know<00:00:30.800> the<00:00:31.840> you 00:00:32.830 --> 00:00:32.840 align:start position:0% transactions then I need to know the you 00:00:32.840 --> 00:00:34.120 align:start position:0% transactions then I need to know the you know<00:00:32.870> the<00:00:32.989> check<00:00:33.320> it<00:00:33.469> for<00:00:33.590> a<00:00:33.649> bit<00:00:33.770> content 00:00:34.120 --> 00:00:34.130 align:start position:0% know the check it for a bit content 00:00:34.130 --> 00:00:36.360 align:start position:0% know the check it for a bit content section<00:00:34.399> is<00:00:34.489> that<00:00:34.670> the<00:00:34.820> sum<00:00:35.059> of<00:00:35.090> the<00:00:35.300> inputs<00:00:35.660> is 00:00:36.360 --> 00:00:36.370 align:start position:0% section is that the sum of the inputs is 00:00:36.370 --> 00:00:38.829 align:start position:0% section is that the sum of the inputs is greater<00:00:37.370> or<00:00:37.519> equal<00:00:37.550> than<00:00:37.879> the<00:00:38.059> sum<00:00:38.539> of<00:00:38.570> the 00:00:38.829 --> 00:00:38.839 align:start position:0% greater or equal than the sum of the 00:00:38.839 --> 00:00:41.799 align:start position:0% greater or equal than the sum of the outputs<00:00:39.230> and<00:00:39.500> to<00:00:40.489> do<00:00:40.640> this<00:00:40.820> check<00:00:41.149> to<00:00:41.449> check 00:00:41.799 --> 00:00:41.809 align:start position:0% outputs and to do this check to check 00:00:41.809 --> 00:00:43.630 align:start position:0% outputs and to do this check to check that<00:00:41.989> the<00:00:42.109> transaction<00:00:42.589> as<00:00:42.679> well<00:00:42.829> as<00:00:43.039> I<00:00:43.190> need 00:00:43.630 --> 00:00:43.640 align:start position:0% that the transaction as well as I need 00:00:43.640 --> 00:00:45.970 align:start position:0% that the transaction as well as I need to<00:00:43.760> know<00:00:44.149> these<00:00:44.359> amounts<00:00:44.899> right<00:00:45.530> I<00:00:45.620> need<00:00:45.859> to 00:00:45.970 --> 00:00:45.980 align:start position:0% to know these amounts right I need to 00:00:45.980 --> 00:00:48.090 align:start position:0% to know these amounts right I need to know<00:00:46.100> how<00:00:46.249> much<00:00:46.399> money<00:00:46.730> is<00:00:47.059> being<00:00:47.269> sent<00:00:47.629> and 00:00:48.090 --> 00:00:48.100 align:start position:0% know how much money is being sent and 00:00:48.100 --> 00:00:51.399 align:start position:0% know how much money is being sent and very<00:00:49.100> similar<00:00:49.519> in<00:00:49.699> etherium<00:00:50.210> I<00:00:50.390> need<00:00:51.109> to<00:00:51.199> check 00:00:51.399 --> 00:00:51.409 align:start position:0% very similar in etherium I need to check 00:00:51.409 --> 00:00:53.229 align:start position:0% very similar in etherium I need to check that<00:00:51.440> the<00:00:51.649> person<00:00:52.339> who's<00:00:52.519> sending<00:00:52.760> some<00:00:53.089> money 00:00:53.229 --> 00:00:53.239 align:start position:0% that the person who's sending some money 00:00:53.239 --> 00:00:54.910 align:start position:0% that the person who's sending some money has<00:00:53.449> enough<00:00:53.749> balance<00:00:54.079> in<00:00:54.230> the<00:00:54.320> account<00:00:54.350> to 00:00:54.910 --> 00:00:54.920 align:start position:0% has enough balance in the account to 00:00:54.920 --> 00:00:58.059 align:start position:0% has enough balance in the account to send<00:00:55.159> the<00:00:55.249> money<00:00:55.780> the<00:00:56.780> the<00:00:57.620> difference<00:00:57.920> is 00:00:58.059 --> 00:00:58.069 align:start position:0% send the money the the difference is 00:00:58.069 --> 00:01:00.309 align:start position:0% send the money the the difference is actually<00:00:58.190> the<00:00:58.579> fee<00:00:58.760> see<00:00:58.940> a<00:00:58.969> bit<00:00:59.179> but<00:00:59.510> the 00:01:00.309 --> 00:01:00.319 align:start position:0% actually the fee see a bit but the 00:01:00.319 --> 00:01:02.829 align:start position:0% actually the fee see a bit but the problem<00:01:00.739> is<00:01:00.829> that<00:01:01.789> this<00:01:01.999> is<00:01:02.059> actually<00:01:02.359> really 00:01:02.829 --> 00:01:02.839 align:start position:0% problem is that this is actually really 00:01:02.839 --> 00:01:09.730 align:start position:0% problem is that this is actually really bad<00:01:02.989> for<00:01:03.319> privacy<00:01:03.859> and<00:01:06.190> the<00:01:07.190> the<00:01:07.850> the<00:01:08.740> because 00:01:09.730 --> 00:01:09.740 align:start position:0% bad for privacy and the the the because 00:01:09.740 --> 00:01:12.070 align:start position:0% bad for privacy and the the the because everything<00:01:10.310> is<00:01:10.430> public<00:01:10.580> so<00:01:11.240> what<00:01:11.750> this<00:01:11.870> means 00:01:12.070 --> 00:01:12.080 align:start position:0% everything is public so what this means 00:01:12.080 --> 00:01:16.060 align:start position:0% everything is public so what this means is<00:01:12.260> if<00:01:12.440> I<00:01:12.590> get<00:01:12.650> my<00:01:13.190> salary<00:01:13.760> in<00:01:14.890> Bitcoin<00:01:15.890> for 00:01:16.060 --> 00:01:16.070 align:start position:0% is if I get my salary in Bitcoin for 00:01:16.070 --> 00:01:18.850 align:start position:0% is if I get my salary in Bitcoin for example<00:01:16.490> in<00:01:16.610> etherium<00:01:17.120> then<00:01:17.870> my<00:01:18.200> salary<00:01:18.650> will 00:01:18.850 --> 00:01:18.860 align:start position:0% example in etherium then my salary will 00:01:18.860 --> 00:01:20.080 align:start position:0% example in etherium then my salary will be<00:01:18.890> public<00:01:19.370> on<00:01:19.490> the<00:01:19.670> blockchain<00:01:19.850> and 00:01:20.080 --> 00:01:20.090 align:start position:0% be public on the blockchain and 00:01:20.090 --> 00:01:21.580 align:start position:0% be public on the blockchain and everybody<00:01:20.570> can<00:01:20.750> see<00:01:20.810> it<00:01:20.990> and<00:01:21.200> that's<00:01:21.410> not 00:01:21.580 --> 00:01:21.590 align:start position:0% everybody can see it and that's not 00:01:21.590 --> 00:01:24.220 align:start position:0% everybody can see it and that's not something<00:01:21.920> that<00:01:22.160> I<00:01:22.280> want<00:01:22.520> to<00:01:22.610> have<00:01:23.270> so<00:01:24.110> for 00:01:24.220 --> 00:01:24.230 align:start position:0% something that I want to have so for 00:01:24.230 --> 00:01:26.770 align:start position:0% something that I want to have so for example<00:01:24.650> also<00:01:24.860> if<00:01:25.250> I'm<00:01:25.430> a<00:01:25.460> supplier<00:01:26.150> then<00:01:26.510> you 00:01:26.770 --> 00:01:26.780 align:start position:0% example also if I'm a supplier then you 00:01:26.780 --> 00:01:30.010 align:start position:0% example also if I'm a supplier then you know<00:01:26.900> if<00:01:27.020> I<00:01:27.140> buy<00:01:27.290> some<00:01:27.680> some<00:01:28.160> if<00:01:29.090> I'm<00:01:29.300> a<00:01:29.420> company 00:01:30.010 --> 00:01:30.020 align:start position:0% know if I buy some some if I'm a company 00:01:30.020 --> 00:01:32.530 align:start position:0% know if I buy some some if I'm a company right<00:01:30.290> and<00:01:30.560> I<00:01:30.620> buy<00:01:30.770> some<00:01:31.100> supplies<00:01:31.850> for<00:01:32.390> my 00:01:32.530 --> 00:01:32.540 align:start position:0% right and I buy some supplies for my 00:01:32.540 --> 00:01:34.990 align:start position:0% right and I buy some supplies for my company<00:01:32.990> then<00:01:33.500> all<00:01:33.680> of<00:01:33.860> my<00:01:33.980> competitors<00:01:34.670> will 00:01:34.990 --> 00:01:35.000 align:start position:0% company then all of my competitors will 00:01:35.000 --> 00:01:37.000 align:start position:0% company then all of my competitors will exactly<00:01:35.540> see<00:01:35.810> how<00:01:36.080> much<00:01:36.260> I'm<00:01:36.470> paying<00:01:36.680> for 00:01:37.000 --> 00:01:37.010 align:start position:0% exactly see how much I'm paying for 00:01:37.010 --> 00:01:39.400 align:start position:0% exactly see how much I'm paying for these<00:01:37.100> suppliers<00:01:37.550> and<00:01:37.790> that's<00:01:38.390> a<00:01:38.540> important 00:01:39.400 --> 00:01:39.410 align:start position:0% these suppliers and that's a important 00:01:39.410 --> 00:01:41.200 align:start position:0% these suppliers and that's a important business<00:01:39.770> secret<00:01:40.070> and<00:01:40.220> you<00:01:40.670> know<00:01:40.790> this<00:01:40.970> this 00:01:41.200 --> 00:01:41.210 align:start position:0% business secret and you know this this 00:01:41.210 --> 00:01:42.850 align:start position:0% business secret and you know this this really<00:01:41.420> leads<00:01:41.810> to<00:01:41.930> this<00:01:42.140> maybe<00:01:42.560> slightly 00:01:42.850 --> 00:01:42.860 align:start position:0% really leads to this maybe slightly 00:01:42.860 --> 00:01:44.740 align:start position:0% really leads to this maybe slightly controversial<00:01:43.400> statement<00:01:43.940> but<00:01:44.060> that<00:01:44.120> Bitcoin 00:01:44.740 --> 00:01:44.750 align:start position:0% controversial statement but that Bitcoin 00:01:44.750 --> 00:01:46.690 align:start position:0% controversial statement but that Bitcoin in<00:01:45.050> the<00:01:45.410> way<00:01:45.530> that<00:01:45.770> works<00:01:46.010> now<00:01:46.190> it's<00:01:46.460> really 00:01:46.690 --> 00:01:46.700 align:start position:0% in the way that works now it's really 00:01:46.700 --> 00:01:51.970 align:start position:0% in the way that works now it's really unusable<00:01:47.270> for<00:01:48.850> businesses<00:01:49.850> and<00:01:50.500> in<00:01:51.500> a<00:01:51.620> similar 00:01:51.970 --> 00:01:51.980 align:start position:0% unusable for businesses and in a similar 00:01:51.980 --> 00:01:54.160 align:start position:0% unusable for businesses and in a similar way<00:01:52.010> for<00:01:52.190> aetherium<00:01:53.090> you<00:01:53.630> know<00:01:53.750> if<00:01:53.840> I<00:01:53.960> run 00:01:54.160 --> 00:01:54.170 align:start position:0% way for aetherium you know if I run 00:01:54.170 --> 00:01:56.020 align:start position:0% way for aetherium you know if I run maybe<00:01:54.500> some<00:01:54.770> some<00:01:55.130> investment<00:01:55.610> fund<00:01:55.790> on<00:01:55.940> me 00:01:56.020 --> 00:01:56.030 align:start position:0% maybe some some investment fund on me 00:01:56.030 --> 00:01:57.940 align:start position:0% maybe some some investment fund on me theorem<00:01:56.450> right<00:01:56.810> then<00:01:57.080> then<00:01:57.350> everybody<00:01:57.740> can 00:01:57.940 --> 00:01:57.950 align:start position:0% theorem right then then everybody can 00:01:57.950 --> 00:02:00.310 align:start position:0% theorem right then then everybody can see<00:01:58.190> exactly<00:01:58.730> what<00:01:59.030> my<00:01:59.060> investing<00:01:59.780> strategy 00:02:00.310 --> 00:02:00.320 align:start position:0% see exactly what my investing strategy 00:02:00.320 --> 00:02:03.000 align:start position:0% see exactly what my investing strategy is<00:02:00.440> right<00:02:00.680> now<00:02:00.860> my<00:02:01.610> whole<00:02:01.790> billion<00:02:02.180> secret<00:02:02.600> is 00:02:03.000 --> 00:02:03.010 align:start position:0% is right now my whole billion secret is 00:02:03.010 --> 00:02:05.620 align:start position:0% is right now my whole billion secret is the<00:02:04.010> whole<00:02:04.160> secret<00:02:04.340> sauce<00:02:04.670> is<00:02:04.940> my<00:02:05.300> investment 00:02:05.620 --> 00:02:05.630 align:start position:0% the whole secret sauce is my investment 00:02:05.630 --> 00:02:07.240 align:start position:0% the whole secret sauce is my investment strategy<00:02:05.780> but<00:02:06.560> if<00:02:06.650> this<00:02:06.800> fund<00:02:07.010> is<00:02:07.100> on<00:02:07.220> e 00:02:07.240 --> 00:02:07.250 align:start position:0% strategy but if this fund is on e 00:02:07.250 --> 00:02:08.650 align:start position:0% strategy but if this fund is on e theorem<00:02:07.580> then<00:02:07.730> everybody<00:02:08.030> can<00:02:08.209> exactly<00:02:08.479> see 00:02:08.650 --> 00:02:08.660 align:start position:0% theorem then everybody can exactly see 00:02:08.660 --> 00:02:10.029 align:start position:0% theorem then everybody can exactly see if<00:02:08.929> it's<00:02:09.080> a<00:02:09.170> melon<00:02:09.500> or<00:02:09.619> something<00:02:09.890> then 00:02:10.029 --> 00:02:10.039 align:start position:0% if it's a melon or something then 00:02:10.039 --> 00:02:11.440 align:start position:0% if it's a melon or something then everybody<00:02:10.340> can<00:02:10.459> exactly<00:02:10.879> see<00:02:11.060> what<00:02:11.360> I'm 00:02:11.440 --> 00:02:11.450 align:start position:0% everybody can exactly see what I'm 00:02:11.450 --> 00:02:13.569 align:start position:0% everybody can exactly see what I'm investing<00:02:11.900> in<00:02:12.019> they<00:02:12.499> confront<00:02:12.950> money<00:02:13.159> you 00:02:13.569 --> 00:02:13.579 align:start position:0% investing in they confront money you 00:02:13.579 --> 00:02:15.819 align:start position:0% investing in they confront money you know<00:02:13.670> that<00:02:13.700> creates<00:02:14.359> all<00:02:14.599> sort<00:02:14.870> of<00:02:14.930> prominent 00:02:15.819 --> 00:02:15.829 align:start position:0% know that creates all sort of prominent 00:02:15.829 --> 00:02:17.860 align:start position:0% know that creates all sort of prominent and<00:02:16.040> this<00:02:16.189> really<00:02:16.400> means<00:02:16.609> that<00:02:16.700> a<00:02:16.999> theorem<00:02:17.719> is 00:02:17.860 --> 00:02:17.870 align:start position:0% and this really means that a theorem is 00:02:17.870 --> 00:02:18.220 align:start position:0% and this really means that a theorem is a<00:02:17.900> new 00:02:18.220 --> 00:02:18.230 align:start position:0% a new 00:02:18.230 --> 00:02:20.500 align:start position:0% a new suitable<00:02:18.470> for<00:02:18.530> for<00:02:19.099> many<00:02:19.610> financial<00:02:20.120> services 00:02:20.500 --> 00:02:20.510 align:start position:0% suitable for for many financial services 00:02:20.510 --> 00:02:23.559 align:start position:0% suitable for for many financial services well<00:02:21.470> luckily<00:02:21.650> we<00:02:22.069> sort<00:02:23.000> of<00:02:23.060> know<00:02:23.269> how<00:02:23.510> to 00:02:23.559 --> 00:02:23.569 align:start position:0% well luckily we sort of know how to 00:02:23.569 --> 00:02:26.520 align:start position:0% well luckily we sort of know how to solve<00:02:24.049> this<00:02:24.170> problems<00:02:24.650> and<00:02:24.970> that<00:02:25.970> is<00:02:26.120> by<00:02:26.269> using 00:02:26.520 --> 00:02:26.530 align:start position:0% solve this problems and that is by using 00:02:26.530 --> 00:02:28.690 align:start position:0% solve this problems and that is by using cryptography<00:02:27.530> and<00:02:27.680> especially<00:02:28.190> something 00:02:28.690 --> 00:02:28.700 align:start position:0% cryptography and especially something 00:02:28.700 --> 00:02:31.330 align:start position:0% cryptography and especially something called<00:02:28.909> zero<00:02:29.150> knowledge<00:02:29.780> and<00:02:30.200> there<00:02:31.010> the<00:02:31.190> idea 00:02:31.330 --> 00:02:31.340 align:start position:0% called zero knowledge and there the idea 00:02:31.340 --> 00:02:33.940 align:start position:0% called zero knowledge and there the idea is<00:02:31.700> that<00:02:31.730> instead<00:02:32.690> of<00:02:33.019> having<00:02:33.440> you<00:02:33.799> know<00:02:33.830> a 00:02:33.940 --> 00:02:33.950 align:start position:0% is that instead of having you know a 00:02:33.950 --> 00:02:35.559 align:start position:0% is that instead of having you know a Bitcoin<00:02:34.370> transaction<00:02:34.879> that<00:02:35.030> looks<00:02:35.209> like<00:02:35.360> this 00:02:35.559 --> 00:02:35.569 align:start position:0% Bitcoin transaction that looks like this 00:02:35.569 --> 00:02:39.490 align:start position:0% Bitcoin transaction that looks like this I'm<00:02:35.840> going<00:02:36.560> to<00:02:36.739> hide<00:02:37.549> all<00:02:37.879> of<00:02:37.910> the<00:02:38.150> amounts<00:02:38.660> so 00:02:39.490 --> 00:02:39.500 align:start position:0% I'm going to hide all of the amounts so 00:02:39.500 --> 00:02:41.289 align:start position:0% I'm going to hide all of the amounts so I'm<00:02:39.890> going<00:02:40.190> to<00:02:40.310> use<00:02:40.489> something<00:02:40.790> called<00:02:40.970> a 00:02:41.289 --> 00:02:41.299 align:start position:0% I'm going to use something called a 00:02:41.299 --> 00:02:44.319 align:start position:0% I'm going to use something called a cryptographic<00:02:41.660> commitment<00:02:42.530> to<00:02:43.400> hide<00:02:43.970> all<00:02:44.299> of 00:02:44.319 --> 00:02:44.329 align:start position:0% cryptographic commitment to hide all of 00:02:44.329 --> 00:02:47.140 align:start position:0% cryptographic commitment to hide all of these<00:02:44.599> amounts<00:02:44.810> so<00:02:45.140> no<00:02:45.319> one<00:02:45.500> can<00:02:45.709> can<00:02:46.069> see<00:02:46.400> what 00:02:47.140 --> 00:02:47.150 align:start position:0% these amounts so no one can can see what 00:02:47.150 --> 00:02:48.610 align:start position:0% these amounts so no one can can see what these<00:02:47.299> amounts<00:02:47.599> are<00:02:47.900> they're<00:02:48.379> they're 00:02:48.610 --> 00:02:48.620 align:start position:0% these amounts are they're they're 00:02:48.620 --> 00:02:52.119 align:start position:0% these amounts are they're they're basically<00:02:48.829> encrypted<00:02:49.640> and<00:02:50.739> the<00:02:51.739> question 00:02:52.119 --> 00:02:52.129 align:start position:0% basically encrypted and the question 00:02:52.129 --> 00:02:54.520 align:start position:0% basically encrypted and the question though<00:02:52.280> is<00:02:52.340> then<00:02:52.640> how<00:02:52.940> do<00:02:53.000> I<00:02:53.209> check<00:02:53.629> that<00:02:54.349> the 00:02:54.520 --> 00:02:54.530 align:start position:0% though is then how do I check that the 00:02:54.530 --> 00:02:56.650 align:start position:0% though is then how do I check that the transaction<00:02:55.040> is<00:02:55.160> valid<00:02:55.489> how<00:02:55.730> do<00:02:55.790> I<00:02:55.940> check<00:02:56.209> that 00:02:56.650 --> 00:02:56.660 align:start position:0% transaction is valid how do I check that 00:02:56.660 --> 00:03:00.009 align:start position:0% transaction is valid how do I check that you<00:02:57.560> know<00:02:57.680> the<00:02:57.890> the<00:02:58.129> sum<00:02:58.910> of<00:02:59.000> inputs<00:02:59.150> is<00:02:59.660> equal 00:03:00.009 --> 00:03:00.019 align:start position:0% you know the the sum of inputs is equal 00:03:00.019 --> 00:03:02.099 align:start position:0% you know the the sum of inputs is equal to<00:03:00.140> the<00:03:00.230> sum<00:03:00.410> of<00:03:00.440> outputs<00:03:00.859> past<00:03:01.099> apiece<00:03:01.730> and 00:03:02.099 --> 00:03:02.109 align:start position:0% to the sum of outputs past apiece and 00:03:02.109 --> 00:03:04.330 align:start position:0% to the sum of outputs past apiece and similarly<00:03:03.109> in<00:03:03.410> a<00:03:03.500> theorem<00:03:03.859> how<00:03:03.980> do<00:03:04.040> I<00:03:04.160> check 00:03:04.330 --> 00:03:04.340 align:start position:0% similarly in a theorem how do I check 00:03:04.340 --> 00:03:05.680 align:start position:0% similarly in a theorem how do I check that<00:03:04.549> the<00:03:04.670> sender<00:03:04.940> has<00:03:05.060> enough<00:03:05.329> money<00:03:05.540> in 00:03:05.680 --> 00:03:05.690 align:start position:0% that the sender has enough money in 00:03:05.690 --> 00:03:08.020 align:start position:0% that the sender has enough money in their<00:03:05.840> account<00:03:06.079> to<00:03:06.200> sent<00:03:06.530> the<00:03:07.489> transaction 00:03:08.020 --> 00:03:08.030 align:start position:0% their account to sent the transaction 00:03:08.030 --> 00:03:10.750 align:start position:0% their account to sent the transaction and<00:03:08.269> the<00:03:09.230> way<00:03:09.349> to<00:03:09.410> do<00:03:09.650> that<00:03:09.829> is<00:03:10.069> using 00:03:10.750 --> 00:03:10.760 align:start position:0% and the way to do that is using 00:03:10.760 --> 00:03:12.099 align:start position:0% and the way to do that is using something<00:03:11.120> called<00:03:11.450> a<00:03:11.540> zero<00:03:11.750> knowledge<00:03:11.930> proof 00:03:12.099 --> 00:03:12.109 align:start position:0% something called a zero knowledge proof 00:03:12.109 --> 00:03:15.309 align:start position:0% something called a zero knowledge proof and<00:03:12.829> this<00:03:13.819> is<00:03:14.000> really<00:03:14.299> a<00:03:14.329> magical 00:03:15.309 --> 00:03:15.319 align:start position:0% and this is really a magical 00:03:15.319 --> 00:03:18.640 align:start position:0% and this is really a magical cryptographic<00:03:15.859> tool<00:03:16.340> where<00:03:17.379> Peggy<00:03:18.379> can 00:03:18.640 --> 00:03:18.650 align:start position:0% cryptographic tool where Peggy can 00:03:18.650 --> 00:03:20.860 align:start position:0% cryptographic tool where Peggy can convince<00:03:19.190> Victor<00:03:19.970> so<00:03:20.209> the<00:03:20.329> prover<00:03:20.690> can 00:03:20.860 --> 00:03:20.870 align:start position:0% convince Victor so the prover can 00:03:20.870 --> 00:03:24.059 align:start position:0% convince Victor so the prover can convince<00:03:21.260> a<00:03:21.410> verify<00:03:21.829> that<00:03:22.669> something<00:03:23.239> is<00:03:23.359> true 00:03:24.059 --> 00:03:24.069 align:start position:0% convince a verify that something is true 00:03:24.069 --> 00:03:26.710 align:start position:0% convince a verify that something is true without<00:03:25.069> giving<00:03:25.549> up<00:03:25.669> any<00:03:25.819> information<00:03:26.599> about 00:03:26.710 --> 00:03:26.720 align:start position:0% without giving up any information about 00:03:26.720 --> 00:03:29.500 align:start position:0% without giving up any information about why<00:03:27.290> it's<00:03:27.560> true<00:03:27.919> so<00:03:28.669> for<00:03:28.849> example<00:03:29.329> I<00:03:29.450> can 00:03:29.500 --> 00:03:29.510 align:start position:0% why it's true so for example I can 00:03:29.510 --> 00:03:31.539 align:start position:0% why it's true so for example I can convince<00:03:29.989> you<00:03:30.169> that<00:03:30.319> you<00:03:31.220> know<00:03:31.340> I'm 00:03:31.539 --> 00:03:31.549 align:start position:0% convince you that you know I'm 00:03:31.549 --> 00:03:33.729 align:start position:0% convince you that you know I'm committing<00:03:32.359> to<00:03:32.389> a<00:03:32.599> positive<00:03:33.380> number<00:03:33.530> right 00:03:33.729 --> 00:03:33.739 align:start position:0% committing to a positive number right 00:03:33.739 --> 00:03:35.710 align:start position:0% committing to a positive number right like<00:03:34.190> the<00:03:34.400> remaining<00:03:35.000> balance<00:03:35.150> that<00:03:35.480> I<00:03:35.510> have 00:03:35.710 --> 00:03:35.720 align:start position:0% like the remaining balance that I have 00:03:35.720 --> 00:03:39.610 align:start position:0% like the remaining balance that I have is<00:03:35.900> positive<00:03:37.510> but<00:03:38.510> I<00:03:38.870> reveal<00:03:39.260> no<00:03:39.410> other 00:03:39.610 --> 00:03:39.620 align:start position:0% is positive but I reveal no other 00:03:39.620 --> 00:03:40.930 align:start position:0% is positive but I reveal no other information<00:03:40.220> and<00:03:40.459> especially<00:03:40.609> I<00:03:40.880> don't 00:03:40.930 --> 00:03:40.940 align:start position:0% information and especially I don't 00:03:40.940 --> 00:03:43.569 align:start position:0% information and especially I don't reveal<00:03:41.510> what<00:03:41.870> my<00:03:42.200> balances<00:03:42.769> right<00:03:43.220> all<00:03:43.430> of 00:03:43.569 --> 00:03:43.579 align:start position:0% reveal what my balances right all of 00:03:43.579 --> 00:03:45.759 align:start position:0% reveal what my balances right all of that<00:03:43.730> remains<00:03:44.150> private<00:03:44.599> and<00:03:44.840> the<00:03:45.380> way<00:03:45.530> that 00:03:45.759 --> 00:03:45.769 align:start position:0% that remains private and the way that 00:03:45.769 --> 00:03:48.220 align:start position:0% that remains private and the way that this<00:03:45.889> works<00:03:46.160> is<00:03:46.370> basically<00:03:46.609> you<00:03:46.970> know<00:03:47.690> one<00:03:48.109> way 00:03:48.220 --> 00:03:48.230 align:start position:0% this works is basically you know one way 00:03:48.230 --> 00:03:50.259 align:start position:0% this works is basically you know one way to<00:03:48.260> imagine<00:03:48.650> it<00:03:48.950> is<00:03:49.130> through<00:03:49.760> sort<00:03:50.060> of<00:03:50.090> this 00:03:50.259 --> 00:03:50.269 align:start position:0% to imagine it is through sort of this 00:03:50.269 --> 00:03:52.300 align:start position:0% to imagine it is through sort of this interactive<00:03:50.780> challenge<00:03:51.380> response<00:03:51.620> protocol 00:03:52.300 --> 00:03:52.310 align:start position:0% interactive challenge response protocol 00:03:52.310 --> 00:03:55.990 align:start position:0% interactive challenge response protocol where<00:03:53.120> Victor<00:03:53.480> gets<00:03:53.720> to<00:03:53.930> ask<00:03:54.079> questions<00:03:55.000> that 00:03:55.990 --> 00:03:56.000 align:start position:0% where Victor gets to ask questions that 00:03:56.000 --> 00:03:58.270 align:start position:0% where Victor gets to ask questions that Peggy<00:03:56.359> wouldn't<00:03:57.230> know<00:03:57.349> the<00:03:57.500> answer<00:03:57.530> to 00:03:58.270 --> 00:03:58.280 align:start position:0% Peggy wouldn't know the answer to 00:03:58.280 --> 00:04:00.580 align:start position:0% Peggy wouldn't know the answer to if<00:03:58.340> this<00:03:58.849> wasn't<00:03:59.120> true<00:03:59.510> right<00:04:00.109> she<00:04:00.260> could<00:04:00.470> not 00:04:00.580 --> 00:04:00.590 align:start position:0% if this wasn't true right she could not 00:04:00.590 --> 00:04:02.440 align:start position:0% if this wasn't true right she could not answer<00:04:00.829> these<00:04:01.099> questions<00:04:01.549> if<00:04:01.790> the<00:04:02.060> statement 00:04:02.440 --> 00:04:02.450 align:start position:0% answer these questions if the statement 00:04:02.450 --> 00:04:04.119 align:start position:0% answer these questions if the statement wasn't<00:04:02.599> true<00:04:02.840> of<00:04:02.959> the<00:04:03.109> transit<00:04:03.829> if<00:04:03.950> the 00:04:04.119 --> 00:04:04.129 align:start position:0% wasn't true of the transit if the 00:04:04.129 --> 00:04:07.539 align:start position:0% wasn't true of the transit if the balance<00:04:04.790> was<00:04:04.970> negative<00:04:05.739> but<00:04:06.739> the<00:04:07.190> answers 00:04:07.539 --> 00:04:07.549 align:start position:0% balance was negative but the answers 00:04:07.549 --> 00:04:09.430 align:start position:0% balance was negative but the answers don't<00:04:07.849> reveal<00:04:08.180> any<00:04:08.450> information<00:04:08.569> whatsoever 00:04:09.430 --> 00:04:09.440 align:start position:0% don't reveal any information whatsoever 00:04:09.440 --> 00:04:18.580 align:start position:0% don't reveal any information whatsoever about<00:04:09.709> what<00:04:12.220> what<00:04:13.220> the<00:04:13.250> statement<00:04:13.760> is<00:04:15.099> so<00:04:17.590> what 00:04:18.580 --> 00:04:18.590 align:start position:0% about what what the statement is so what 00:04:18.590 --> 00:04:19.900 align:start position:0% about what what the statement is so what we<00:04:18.709> really<00:04:18.979> need<00:04:19.160> though<00:04:19.340> in<00:04:19.609> a<00:04:19.699> blockchain 00:04:19.900 --> 00:04:19.910 align:start position:0% we really need though in a blockchain 00:04:19.910 --> 00:04:22.210 align:start position:0% we really need though in a blockchain setting<00:04:20.449> is<00:04:20.570> not<00:04:20.599> this<00:04:21.079> this<00:04:21.530> sort<00:04:22.130> of 00:04:22.210 --> 00:04:22.220 align:start position:0% setting is not this this sort of 00:04:22.220 --> 00:04:25.800 align:start position:0% setting is not this this sort of interactive<00:04:22.910> proof<00:04:23.210> we<00:04:23.979> and<00:04:24.979> in<00:04:25.099> the<00:04:25.220> end<00:04:25.340> the 00:04:25.800 --> 00:04:25.810 align:start position:0% interactive proof we and in the end the 00:04:25.810 --> 00:04:28.120 align:start position:0% interactive proof we and in the end the victor<00:04:26.810> has<00:04:26.930> no<00:04:27.080> idea<00:04:27.320> what<00:04:27.440> X<00:04:27.590> is<00:04:27.740> but<00:04:27.979> it's 00:04:28.120 --> 00:04:28.130 align:start position:0% victor has no idea what X is but it's 00:04:28.130 --> 00:04:31.810 align:start position:0% victor has no idea what X is but it's positive<00:04:28.550> and<00:04:28.700> Pena's<00:04:29.450> know<00:04:29.599> it<00:04:29.719> and 00:04:31.810 --> 00:04:31.820 align:start position:0% positive and Pena's know it and 00:04:31.820 --> 00:04:33.310 align:start position:0% positive and Pena's know it and what<00:04:31.940> we<00:04:32.060> really<00:04:32.300> need<00:04:32.480> in<00:04:32.600> this<00:04:32.720> interactive 00:04:33.310 --> 00:04:33.320 align:start position:0% what we really need in this interactive 00:04:33.320 --> 00:04:36.370 align:start position:0% what we really need in this interactive setting<00:04:33.530> is<00:04:33.770> a<00:04:34.450> music<00:04:35.450> and<00:04:35.660> non<00:04:35.870> interactive 00:04:36.370 --> 00:04:36.380 align:start position:0% setting is a music and non interactive 00:04:36.380 --> 00:04:38.200 align:start position:0% setting is a music and non interactive zero<00:04:36.560> knowledge<00:04:36.710> proof<00:04:36.830> of<00:04:37.130> knowledge<00:04:37.400> where 00:04:38.200 --> 00:04:38.210 align:start position:0% zero knowledge proof of knowledge where 00:04:38.210 --> 00:04:39.820 align:start position:0% zero knowledge proof of knowledge where basically<00:04:38.780> the<00:04:38.960> prover<00:04:39.230> can<00:04:39.380> just<00:04:39.560> write<00:04:39.800> down 00:04:39.820 --> 00:04:39.830 align:start position:0% basically the prover can just write down 00:04:39.830 --> 00:04:41.800 align:start position:0% basically the prover can just write down the<00:04:40.190> proof<00:04:40.430> and<00:04:40.760> the<00:04:40.880> verify<00:04:41.240> can<00:04:41.420> read<00:04:41.570> it<00:04:41.690> and 00:04:41.800 --> 00:04:41.810 align:start position:0% the proof and the verify can read it and 00:04:41.810 --> 00:04:43.300 align:start position:0% the proof and the verify can read it and check<00:04:42.020> it<00:04:42.200> and<00:04:42.320> everybody<00:04:42.680> can<00:04:42.860> read<00:04:43.040> it<00:04:43.130> and 00:04:43.300 --> 00:04:43.310 align:start position:0% check it and everybody can read it and 00:04:43.310 --> 00:04:45.900 align:start position:0% check it and everybody can read it and check<00:04:43.460> it<00:04:43.490> it's<00:04:43.760> publicly<00:04:44.270> verifiable<00:04:44.480> and 00:04:45.900 --> 00:04:45.910 align:start position:0% check it it's publicly verifiable and 00:04:45.910 --> 00:04:48.880 align:start position:0% check it it's publicly verifiable and this<00:04:46.910> relies<00:04:47.480> on<00:04:47.510> some<00:04:48.200> common<00:04:48.740> reference 00:04:48.880 --> 00:04:48.890 align:start position:0% this relies on some common reference 00:04:48.890 --> 00:04:50.410 align:start position:0% this relies on some common reference string<00:04:49.340> that<00:04:49.490> both<00:04:49.700> the<00:04:49.850> prover<00:04:50.180> and<00:04:50.330> the 00:04:50.410 --> 00:04:50.420 align:start position:0% string that both the prover and the 00:04:50.420 --> 00:04:53.170 align:start position:0% string that both the prover and the verify<00:04:50.750> have<00:04:50.870> access<00:04:51.260> to<00:04:51.440> and<00:04:51.790> there's<00:04:52.790> many 00:04:53.170 --> 00:04:53.180 align:start position:0% verify have access to and there's many 00:04:53.180 --> 00:04:55.150 align:start position:0% verify have access to and there's many different<00:04:53.300> kinds<00:04:54.080> of<00:04:54.140> zero<00:04:54.350> knowledge<00:04:54.530> proves 00:04:55.150 --> 00:04:55.160 align:start position:0% different kinds of zero knowledge proves 00:04:55.160 --> 00:04:57.460 align:start position:0% different kinds of zero knowledge proves there's<00:04:55.520> maybe<00:04:55.940> you've<00:04:56.270> heard<00:04:56.450> of<00:04:56.600> snarks<00:04:57.110> you 00:04:57.460 --> 00:04:57.470 align:start position:0% there's maybe you've heard of snarks you 00:04:57.470 --> 00:04:59.530 align:start position:0% there's maybe you've heard of snarks you have<00:04:57.590> heard<00:04:57.830> of<00:04:57.950> stark<00:04:58.280> sort<00:04:58.790> of<00:04:58.880> bullet 00:04:59.530 --> 00:04:59.540 align:start position:0% have heard of stark sort of bullet 00:04:59.540 --> 00:05:00.880 align:start position:0% have heard of stark sort of bullet proofs<00:04:59.750> and<00:05:00.020> then<00:05:00.230> there's<00:05:00.410> also<00:05:00.560> a<00:05:00.680> bunch<00:05:00.830> of 00:05:00.880 --> 00:05:00.890 align:start position:0% proofs and then there's also a bunch of 00:05:00.890 --> 00:05:02.770 align:start position:0% proofs and then there's also a bunch of others<00:05:01.160> right<00:05:01.850> you<00:05:02.420> know<00:05:02.510> there's<00:05:02.690> a 00:05:02.770 --> 00:05:02.780 align:start position:0% others right you know there's a 00:05:02.780 --> 00:05:04.420 align:start position:0% others right you know there's a tremendous<00:05:02.990> development<00:05:03.470> happening<00:05:04.160> in<00:05:04.280> this 00:05:04.420 --> 00:05:04.430 align:start position:0% tremendous development happening in this 00:05:04.430 --> 00:05:07.330 align:start position:0% tremendous development happening in this space<00:05:04.640> and<00:05:05.000> I'm<00:05:05.540> gonna<00:05:06.080> like<00:05:06.350> vastly 00:05:07.330 --> 00:05:07.340 align:start position:0% space and I'm gonna like vastly 00:05:07.340 --> 00:05:11.890 align:start position:0% space and I'm gonna like vastly oversimplified<00:05:09.250> who<00:05:10.300> it's<00:05:11.300> been<00:05:11.420> wrong<00:05:11.600> the 00:05:11.890 --> 00:05:11.900 align:start position:0% oversimplified who it's been wrong the 00:05:11.900 --> 00:05:13.270 align:start position:0% oversimplified who it's been wrong the the<00:05:12.140> orange<00:05:12.410> ones<00:05:12.620> should<00:05:12.800> be<00:05:12.830> green<00:05:13.100> the 00:05:13.270 --> 00:05:13.280 align:start position:0% the orange ones should be green the 00:05:13.280 --> 00:05:15.910 align:start position:0% the orange ones should be green the orange<00:05:13.520> ones<00:05:13.700> are<00:05:13.790> good<00:05:14.200> so<00:05:15.200> the<00:05:15.530> vast 00:05:15.910 --> 00:05:15.920 align:start position:0% orange ones are good so the vast 00:05:15.920 --> 00:05:19.840 align:start position:0% orange ones are good so the vast oversimplification<00:05:16.370> is<00:05:17.300> that<00:05:18.490> you<00:05:19.490> know<00:05:19.610> like 00:05:19.840 --> 00:05:19.850 align:start position:0% oversimplification is that you know like 00:05:19.850 --> 00:05:21.580 align:start position:0% oversimplification is that you know like looking<00:05:20.060> just<00:05:20.390> it's<00:05:20.600> snark<00:05:20.960> Starks<00:05:21.350> and<00:05:21.470> Bowa 00:05:21.580 --> 00:05:21.590 align:start position:0% looking just it's snark Starks and Bowa 00:05:21.590 --> 00:05:23.800 align:start position:0% looking just it's snark Starks and Bowa proves<00:05:21.860> is<00:05:22.070> that<00:05:22.100> snarks<00:05:23.000> and<00:05:23.090> bulla<00:05:23.510> proves 00:05:23.800 --> 00:05:23.810 align:start position:0% proves is that snarks and bulla proves 00:05:23.810 --> 00:05:26.440 align:start position:0% proves is that snarks and bulla proves they're<00:05:24.380> good<00:05:24.560> on<00:05:24.680> the<00:05:24.770> proof<00:05:24.980> size<00:05:25.450> starts 00:05:26.440 --> 00:05:26.450 align:start position:0% they're good on the proof size starts 00:05:26.450 --> 00:05:29.140 align:start position:0% they're good on the proof size starts not<00:05:26.690> so<00:05:26.840> much<00:05:27.190> the<00:05:28.190> verification<00:05:28.850> is<00:05:28.940> great 00:05:29.140 --> 00:05:29.150 align:start position:0% not so much the verification is great 00:05:29.150 --> 00:05:32.440 align:start position:0% not so much the verification is great for<00:05:29.360> snarks<00:05:29.630> and<00:05:29.720> Starks<00:05:30.170> and<00:05:31.360> you<00:05:32.360> know 00:05:32.440 --> 00:05:32.450 align:start position:0% for snarks and Starks and you know 00:05:32.450 --> 00:05:34.330 align:start position:0% for snarks and Starks and you know Starks<00:05:32.780> are<00:05:32.900> great<00:05:33.080> now<00:05:33.260> but<00:05:33.740> unfortunately 00:05:34.330 --> 00:05:34.340 align:start position:0% Starks are great now but unfortunately 00:05:34.340 --> 00:05:35.920 align:start position:0% Starks are great now but unfortunately they<00:05:34.400> have<00:05:34.550> this<00:05:34.730> thing<00:05:34.970> called<00:05:35.150> trusted 00:05:35.920 --> 00:05:35.930 align:start position:0% they have this thing called trusted 00:05:35.930 --> 00:05:40.620 align:start position:0% they have this thing called trusted setup<00:05:36.230> where<00:05:37.000> you<00:05:38.000> know<00:05:38.090> someone<00:05:38.510> needs<00:05:38.780> to 00:05:40.620 --> 00:05:40.630 align:start position:0% setup where you know someone needs to 00:05:40.630 --> 00:05:43.360 align:start position:0% setup where you know someone needs to perform<00:05:41.630> a<00:05:42.200> trust<00:05:42.440> set<00:05:42.680> up<00:05:42.740> I'll<00:05:43.130> talk<00:05:43.340> about 00:05:43.360 --> 00:05:43.370 align:start position:0% perform a trust set up I'll talk about 00:05:43.370 --> 00:05:44.800 align:start position:0% perform a trust set up I'll talk about the<00:05:43.640> trusted<00:05:43.970> setup<00:05:44.240> and<00:05:44.360> why<00:05:44.450> this<00:05:44.510> is<00:05:44.780> a 00:05:44.800 --> 00:05:44.810 align:start position:0% the trusted setup and why this is a 00:05:44.810 --> 00:05:46.690 align:start position:0% the trusted setup and why this is a problem<00:05:45.260> in<00:05:45.380> a<00:05:45.470> second<00:05:45.830> but<00:05:46.400> basically 00:05:46.690 --> 00:05:46.700 align:start position:0% problem in a second but basically 00:05:46.700 --> 00:05:49.870 align:start position:0% problem in a second but basically there's<00:05:47.030> this<00:05:47.240> party<00:05:47.660> who<00:05:47.810> creates<00:05:48.200> a<00:05:48.880> proving 00:05:49.870 --> 00:05:49.880 align:start position:0% there's this party who creates a proving 00:05:49.880 --> 00:05:52.210 align:start position:0% there's this party who creates a proving key<00:05:50.090> and<00:05:50.330> a<00:05:50.390> verification<00:05:50.720> key<00:05:51.290> and<00:05:51.560> if<00:05:52.040> that 00:05:52.210 --> 00:05:52.220 align:start position:0% key and a verification key and if that 00:05:52.220 --> 00:05:54.400 align:start position:0% key and a verification key and if that party<00:05:52.670> cheats<00:05:52.970> then<00:05:53.270> really<00:05:53.750> bad<00:05:53.960> things<00:05:54.260> are 00:05:54.400 --> 00:05:54.410 align:start position:0% party cheats then really bad things are 00:05:54.410 --> 00:05:56.950 align:start position:0% party cheats then really bad things are going<00:05:54.620> to<00:05:54.710> happen<00:05:55.040> and<00:05:55.210> you<00:05:56.210> know<00:05:56.330> maybe<00:05:56.840> a 00:05:56.950 --> 00:05:56.960 align:start position:0% going to happen and you know maybe a 00:05:56.960 --> 00:05:58.210 align:start position:0% going to happen and you know maybe a little<00:05:57.050> bit<00:05:57.380> more<00:05:57.530> and<00:05:57.680> more<00:05:57.830> in-depth 00:05:58.210 --> 00:05:58.220 align:start position:0% little bit more and more in-depth 00:05:58.220 --> 00:06:00.340 align:start position:0% little bit more and more in-depth comparison<00:05:58.430> that<00:05:59.330> I<00:05:59.360> don't<00:05:59.600> want<00:05:59.750> you<00:05:59.870> to<00:06:00.080> read 00:06:00.340 --> 00:06:00.350 align:start position:0% comparison that I don't want you to read 00:06:00.350 --> 00:06:02.290 align:start position:0% comparison that I don't want you to read but<00:06:00.680> you<00:06:00.710> know<00:06:00.950> this<00:06:01.100> is<00:06:01.220> a<00:06:01.250> recent<00:06:01.580> comparison 00:06:02.290 --> 00:06:02.300 align:start position:0% but you know this is a recent comparison 00:06:02.300 --> 00:06:05.980 align:start position:0% but you know this is a recent comparison and<00:06:02.590> basically<00:06:03.590> there's<00:06:04.430> no<00:06:04.820> snark<00:06:05.600> without 00:06:05.980 --> 00:06:05.990 align:start position:0% and basically there's no snark without 00:06:05.990 --> 00:06:08.620 align:start position:0% and basically there's no snark without trusted<00:06:06.410> set-up<00:06:06.770> that<00:06:07.180> doesn't<00:06:08.180> have<00:06:08.330> our<00:06:08.510> no 00:06:08.620 --> 00:06:08.630 align:start position:0% trusted set-up that doesn't have our no 00:06:08.630 --> 00:06:10.210 align:start position:0% trusted set-up that doesn't have our no proof<00:06:08.900> system<00:06:09.110> without<00:06:09.560> trust<00:06:09.770> and<00:06:09.950> set<00:06:10.100> up 00:06:10.210 --> 00:06:10.220 align:start position:0% proof system without trust and set up 00:06:10.220 --> 00:06:13.540 align:start position:0% proof system without trust and set up that<00:06:10.430> has<00:06:10.940> logarithmic<00:06:11.480> crew<00:06:11.810> size<00:06:12.110> or<00:06:12.560> and 00:06:13.540 --> 00:06:13.550 align:start position:0% that has logarithmic crew size or and 00:06:13.550 --> 00:06:15.610 align:start position:0% that has logarithmic crew size or and logarithmic<00:06:14.150> verification<00:06:14.900> time<00:06:15.050> and<00:06:15.230> this 00:06:15.610 --> 00:06:15.620 align:start position:0% logarithmic verification time and this 00:06:15.620 --> 00:06:16.930 align:start position:0% logarithmic verification time and this is<00:06:15.770> exactly<00:06:15.920> what<00:06:16.250> I'm<00:06:16.460> going<00:06:16.640> to<00:06:16.730> present 00:06:16.930 --> 00:06:16.940 align:start position:0% is exactly what I'm going to present 00:06:16.940 --> 00:06:19.450 align:start position:0% is exactly what I'm going to present today<00:06:17.330> the<00:06:17.480> first<00:06:17.810> practical<00:06:18.440> snark<00:06:18.830> with 00:06:19.450 --> 00:06:19.460 align:start position:0% today the first practical snark with 00:06:19.460 --> 00:06:21.220 align:start position:0% today the first practical snark with logarithmic<00:06:20.060> proof<00:06:20.420> size<00:06:20.660> and<00:06:20.930> logarithmic 00:06:21.220 --> 00:06:21.230 align:start position:0% logarithmic proof size and logarithmic 00:06:21.230 --> 00:06:26.170 align:start position:0% logarithmic proof size and logarithmic verification<00:06:21.920> time<00:06:23.170> so<00:06:24.910> Snorks<00:06:25.910> have<00:06:26.060> this 00:06:26.170 --> 00:06:26.180 align:start position:0% verification time so Snorks have this 00:06:26.180 --> 00:06:28.420 align:start position:0% verification time so Snorks have this trusted<00:06:26.600> set<00:06:26.810> up<00:06:26.930> so<00:06:27.350> what<00:06:27.530> is<00:06:27.650> the<00:06:27.890> trusted 00:06:28.420 --> 00:06:28.430 align:start position:0% trusted set up so what is the trusted 00:06:28.430 --> 00:06:30.160 align:start position:0% trusted set up so what is the trusted set<00:06:28.610> up<00:06:28.730> it<00:06:28.850> means<00:06:29.030> that<00:06:29.240> there's<00:06:29.450> some<00:06:29.720> party 00:06:30.160 --> 00:06:30.170 align:start position:0% set up it means that there's some party 00:06:30.170 --> 00:06:33.270 align:start position:0% set up it means that there's some party you<00:06:30.620> know<00:06:30.740> some<00:06:31.370> really<00:06:31.850> nice<00:06:32.120> guy<00:06:32.330> who 00:06:33.270 --> 00:06:33.280 align:start position:0% you know some really nice guy who 00:06:33.280 --> 00:06:35.530 align:start position:0% you know some really nice guy who creates<00:06:34.280> a<00:06:34.430> proving<00:06:34.820> key<00:06:34.970> and<00:06:35.180> a<00:06:35.240> verification 00:06:35.530 --> 00:06:35.540 align:start position:0% creates a proving key and a verification 00:06:35.540 --> 00:06:37.420 align:start position:0% creates a proving key and a verification key<00:06:35.990> and<00:06:36.170> the<00:06:36.320> prover<00:06:36.590> uses<00:06:36.830> the<00:06:36.950> proving<00:06:37.250> key 00:06:37.420 --> 00:06:37.430 align:start position:0% key and the prover uses the proving key 00:06:37.430 --> 00:06:38.920 align:start position:0% key and the prover uses the proving key to<00:06:37.610> create<00:06:37.850> the<00:06:37.940> proof<00:06:38.120> and<00:06:38.330> the<00:06:38.390> verify<00:06:38.690> uses 00:06:38.920 --> 00:06:38.930 align:start position:0% to create the proof and the verify uses 00:06:38.930 --> 00:06:40.860 align:start position:0% to create the proof and the verify uses the<00:06:38.990> verification<00:06:39.560> key<00:06:39.680> to<00:06:39.890> check<00:06:40.460> the<00:06:40.610> proof 00:06:40.860 --> 00:06:40.870 align:start position:0% the verification key to check the proof 00:06:40.870 --> 00:06:43.900 align:start position:0% the verification key to check the proof but<00:06:41.870> if<00:06:42.050> that<00:06:42.290> party<00:06:42.860> colludes<00:06:43.460> with<00:06:43.640> the 00:06:43.900 --> 00:06:43.910 align:start position:0% but if that party colludes with the 00:06:43.910 --> 00:06:45.709 align:start position:0% but if that party colludes with the prover<00:06:44.300> if<00:06:44.510> that<00:06:44.840> party<00:06:45.169> cheats 00:06:45.709 --> 00:06:45.719 align:start position:0% prover if that party cheats 00:06:45.719 --> 00:06:47.749 align:start position:0% prover if that party cheats then<00:06:46.080> it<00:06:46.199> can<00:06:46.349> break<00:06:46.529> math<00:06:46.830> then<00:06:47.279> it<00:06:47.399> can<00:06:47.580> say 00:06:47.749 --> 00:06:47.759 align:start position:0% then it can break math then it can say 00:06:47.759 --> 00:06:49.939 align:start position:0% then it can break math then it can say that<00:06:47.969> three<00:06:48.239> plus<00:06:48.509> three<00:06:48.539> is<00:06:48.899> equal<00:06:49.199> to<00:06:49.469> four 00:06:49.939 --> 00:06:49.949 align:start position:0% that three plus three is equal to four 00:06:49.949 --> 00:06:53.839 align:start position:0% that three plus three is equal to four or<00:06:50.159> seven<00:06:50.459> or<00:06:50.849> whatever<00:06:51.269> and<00:06:52.249> why<00:06:53.249> is<00:06:53.309> this<00:06:53.789> a 00:06:53.839 --> 00:06:53.849 align:start position:0% or seven or whatever and why is this a 00:06:53.849 --> 00:06:55.999 align:start position:0% or seven or whatever and why is this a problem<00:06:54.149> well<00:06:54.989> if<00:06:55.169> the<00:06:55.349> trusted<00:06:55.709> setup<00:06:55.919> is 00:06:55.999 --> 00:06:56.009 align:start position:0% problem well if the trusted setup is 00:06:56.009 --> 00:06:57.439 align:start position:0% problem well if the trusted setup is averted<00:06:56.309> the<00:06:56.549> prover<00:06:56.789> can<00:06:56.939> create<00:06:57.209> fake 00:06:57.439 --> 00:06:57.449 align:start position:0% averted the prover can create fake 00:06:57.449 --> 00:07:01.100 align:start position:0% averted the prover can create fake proofs<00:06:57.749> and<00:06:58.189> what<00:06:59.189> this<00:06:59.339> means<00:06:59.579> is<00:06:59.819> if<00:07:00.059> we<00:07:00.509> have 00:07:01.100 --> 00:07:01.110 align:start position:0% proofs and what this means is if we have 00:07:01.110 --> 00:07:03.769 align:start position:0% proofs and what this means is if we have subversion<00:07:01.709> then<00:07:01.860> I<00:07:01.949> can<00:07:02.299> create<00:07:03.299> money<00:07:03.659> out 00:07:03.769 --> 00:07:03.779 align:start position:0% subversion then I can create money out 00:07:03.779 --> 00:07:06.109 align:start position:0% subversion then I can create money out of<00:07:03.899> thin<00:07:04.049> air<00:07:04.319> I<00:07:04.589> can<00:07:04.860> have<00:07:05.039> you<00:07:05.399> know<00:07:05.429> one<00:07:05.789> Z 00:07:06.109 --> 00:07:06.119 align:start position:0% of thin air I can have you know one Z 00:07:06.119 --> 00:07:08.929 align:start position:0% of thin air I can have you know one Z cash<00:07:06.389> coin<00:07:06.929> and<00:07:07.309> create<00:07:08.309> a<00:07:08.339> million<00:07:08.729> out<00:07:08.909> of 00:07:08.929 --> 00:07:08.939 align:start position:0% cash coin and create a million out of 00:07:08.939 --> 00:07:10.999 align:start position:0% cash coin and create a million out of them<00:07:09.209> because<00:07:09.719> I<00:07:09.839> can<00:07:09.989> break<00:07:10.169> math<00:07:10.379> and<00:07:10.619> that's 00:07:10.999 --> 00:07:11.009 align:start position:0% them because I can break math and that's 00:07:11.009 --> 00:07:13.639 align:start position:0% them because I can break math and that's really<00:07:11.489> problematic<00:07:11.969> because<00:07:12.809> you<00:07:13.499> know 00:07:13.639 --> 00:07:13.649 align:start position:0% really problematic because you know 00:07:13.649 --> 00:07:15.529 align:start position:0% really problematic because you know suddenly<00:07:13.889> we<00:07:14.129> have<00:07:14.249> undetectable<00:07:15.059> inflation 00:07:15.529 --> 00:07:15.539 align:start position:0% suddenly we have undetectable inflation 00:07:15.539 --> 00:07:17.179 align:start position:0% suddenly we have undetectable inflation the<00:07:15.749> privacy<00:07:16.229> still<00:07:16.469> holds<00:07:16.799> it's<00:07:16.949> really 00:07:17.179 --> 00:07:17.189 align:start position:0% the privacy still holds it's really 00:07:17.189 --> 00:07:19.279 align:start position:0% the privacy still holds it's really really<00:07:17.429> bad<00:07:17.610> you<00:07:18.449> can<00:07:18.659> alleviate<00:07:18.899> that 00:07:19.279 --> 00:07:19.289 align:start position:0% really bad you can alleviate that 00:07:19.289 --> 00:07:21.469 align:start position:0% really bad you can alleviate that through<00:07:19.529> a<00:07:19.589> distributed<00:07:20.579> set<00:07:21.059> up<00:07:21.209> which<00:07:21.360> is 00:07:21.469 --> 00:07:21.479 align:start position:0% through a distributed set up which is 00:07:21.479 --> 00:07:23.629 align:start position:0% through a distributed set up which is what<00:07:21.599> Z<00:07:21.779> cash<00:07:21.989> did<00:07:22.229> and<00:07:22.469> they<00:07:22.649> did<00:07:22.800> a<00:07:22.829> really 00:07:23.629 --> 00:07:23.639 align:start position:0% what Z cash did and they did a really 00:07:23.639 --> 00:07:25.579 align:start position:0% what Z cash did and they did a really good<00:07:23.879> job<00:07:24.089> with<00:07:24.419> it<00:07:24.599> and<00:07:24.749> those<00:07:24.899> are<00:07:24.929> like<00:07:25.289> the 00:07:25.579 --> 00:07:25.589 align:start position:0% good job with it and those are like the 00:07:25.589 --> 00:07:27.889 align:start position:0% good job with it and those are like the smartest<00:07:26.129> and<00:07:26.309> the<00:07:26.399> absolute<00:07:27.179> words<00:07:27.419> ackward 00:07:27.889 --> 00:07:27.899 align:start position:0% smartest and the absolute words ackward 00:07:27.899 --> 00:07:30.649 align:start position:0% smartest and the absolute words ackward expert<00:07:28.319> in<00:07:28.469> in<00:07:28.709> in<00:07:28.979> in<00:07:29.189> snarks<00:07:29.610> and<00:07:29.669> they<00:07:30.360> still 00:07:30.649 --> 00:07:30.659 align:start position:0% expert in in in in snarks and they still 00:07:30.659 --> 00:07:32.389 align:start position:0% expert in in in in snarks and they still messed<00:07:30.869> it<00:07:31.019> up<00:07:31.110> right<00:07:31.499> there<00:07:31.889> were<00:07:31.979> the<00:07:32.189> the 00:07:32.389 --> 00:07:32.399 align:start position:0% messed it up right there were the the 00:07:32.399 --> 00:07:34.639 align:start position:0% messed it up right there were the the setup<00:07:32.669> was<00:07:32.759> broken<00:07:33.239> they<00:07:33.869> luckily<00:07:34.079> caught<00:07:34.499> it 00:07:34.639 --> 00:07:34.649 align:start position:0% setup was broken they luckily caught it 00:07:34.649 --> 00:07:36.469 align:start position:0% setup was broken they luckily caught it before<00:07:34.769> something<00:07:35.309> bad<00:07:35.579> happened<00:07:36.029> or<00:07:36.209> at 00:07:36.469 --> 00:07:36.479 align:start position:0% before something bad happened or at 00:07:36.479 --> 00:07:39.049 align:start position:0% before something bad happened or at least<00:07:36.659> we<00:07:36.809> think<00:07:36.839> so<00:07:37.139> we<00:07:37.289> don't<00:07:37.589> know<00:07:37.739> and<00:07:38.129> but 00:07:39.049 --> 00:07:39.059 align:start position:0% least we think so we don't know and but 00:07:39.059 --> 00:07:40.759 align:start position:0% least we think so we don't know and but you<00:07:39.269> know<00:07:39.360> this<00:07:39.539> set<00:07:39.689> up<00:07:39.809> was<00:07:39.929> broken<00:07:40.289> so<00:07:40.319> it's 00:07:40.759 --> 00:07:40.769 align:start position:0% you know this set up was broken so it's 00:07:40.769 --> 00:07:42.529 align:start position:0% you know this set up was broken so it's really<00:07:41.309> difficult<00:07:41.489> to<00:07:41.789> get<00:07:41.939> this<00:07:42.119> right<00:07:42.329> and 00:07:42.529 --> 00:07:42.539 align:start position:0% really difficult to get this right and 00:07:42.539 --> 00:07:44.329 align:start position:0% really difficult to get this right and one<00:07:43.139> other<00:07:43.349> thing<00:07:43.589> that<00:07:43.619> is<00:07:43.769> really<00:07:44.129> annoying 00:07:44.329 --> 00:07:44.339 align:start position:0% one other thing that is really annoying 00:07:44.339 --> 00:07:46.929 align:start position:0% one other thing that is really annoying is<00:07:44.610> for<00:07:44.849> the<00:07:44.939> most<00:07:45.149> efficient<00:07:45.599> snarks<00:07:45.959> you 00:07:46.929 --> 00:07:46.939 align:start position:0% is for the most efficient snarks you 00:07:46.939 --> 00:07:49.489 align:start position:0% is for the most efficient snarks you every<00:07:47.939> time<00:07:48.149> you<00:07:48.360> have<00:07:48.479> a<00:07:48.509> new<00:07:48.779> functionality 00:07:49.489 --> 00:07:49.499 align:start position:0% every time you have a new functionality 00:07:49.499 --> 00:07:52.699 align:start position:0% every time you have a new functionality you<00:07:49.829> need<00:07:49.979> a<00:07:50.009> new<00:07:50.219> setup<00:07:50.489> so<00:07:51.419> for<00:07:51.809> example<00:07:52.289> if<00:07:52.499> i 00:07:52.699 --> 00:07:52.709 align:start position:0% you need a new setup so for example if i 00:07:52.709 --> 00:07:56.329 align:start position:0% you need a new setup so for example if i want<00:07:53.429> to<00:07:53.489> have<00:07:53.610> one<00:07:53.669> snort<00:07:54.419> per<00:07:55.129> my<00:07:56.129> contract 00:07:56.329 --> 00:07:56.339 align:start position:0% want to have one snort per my contract 00:07:56.339 --> 00:07:58.129 align:start position:0% want to have one snort per my contract and<00:07:56.849> i<00:07:56.879> need<00:07:57.059> to<00:07:57.149> have<00:07:57.269> a<00:07:57.300> new<00:07:57.539> set<00:07:57.779> of<00:07:57.809> every 00:07:58.129 --> 00:07:58.139 align:start position:0% and i need to have a new set of every 00:07:58.139 --> 00:07:59.869 align:start position:0% and i need to have a new set of every time<00:07:58.319> and<00:07:58.559> every<00:07:58.709> time<00:07:58.979> that<00:07:59.339> setup<00:07:59.550> can<00:07:59.789> be 00:07:59.869 --> 00:07:59.879 align:start position:0% time and every time that setup can be 00:07:59.879 --> 00:08:05.299 align:start position:0% time and every time that setup can be broken<00:08:00.169> so<00:08:02.239> this<00:08:03.239> is<00:08:03.389> quite<00:08:04.309> quite 00:08:05.299 --> 00:08:05.309 align:start position:0% broken so this is quite quite 00:08:05.309 --> 00:08:07.399 align:start position:0% broken so this is quite quite problematic<00:08:05.550> so<00:08:06.149> really<00:08:06.809> the<00:08:06.959> goal<00:08:06.989> is<00:08:07.379> to 00:08:07.399 --> 00:08:07.409 align:start position:0% problematic so really the goal is to 00:08:07.409 --> 00:08:09.259 align:start position:0% problematic so really the goal is to remove<00:08:07.979> this<00:08:08.159> need<00:08:08.399> for<00:08:08.610> a<00:08:08.639> trusted<00:08:08.969> set<00:08:09.149> up 00:08:09.259 --> 00:08:09.269 align:start position:0% remove this need for a trusted set up 00:08:09.269 --> 00:08:11.239 align:start position:0% remove this need for a trusted set up and<00:08:09.419> bulletproof<00:08:10.110> for<00:08:10.469> example<00:08:10.829> does<00:08:10.979> that 00:08:11.239 --> 00:08:11.249 align:start position:0% and bulletproof for example does that 00:08:11.249 --> 00:08:14.959 align:start position:0% and bulletproof for example does that but<00:08:11.939> bulla<00:08:12.149> proves<00:08:12.479> works<00:08:13.469> for<00:08:13.769> small<00:08:14.009> and 00:08:14.959 --> 00:08:14.969 align:start position:0% but bulla proves works for small and 00:08:14.969 --> 00:08:18.529 align:start position:0% but bulla proves works for small and medium<00:08:15.809> complexity<00:08:16.769> transactions<00:08:17.459> but<00:08:18.239> for 00:08:18.529 --> 00:08:18.539 align:start position:0% medium complexity transactions but for 00:08:18.539 --> 00:08:20.389 align:start position:0% medium complexity transactions but for large<00:08:18.719> complexity<00:08:19.319> transactions<00:08:19.889> it<00:08:20.099> just 00:08:20.389 --> 00:08:20.399 align:start position:0% large complexity transactions it just 00:08:20.399 --> 00:08:22.819 align:start position:0% large complexity transactions it just takes<00:08:20.699> too<00:08:20.969> long<00:08:20.999> to<00:08:21.209> verify<00:08:21.809> it<00:08:22.379> doesn't<00:08:22.709> have 00:08:22.819 --> 00:08:22.829 align:start position:0% takes too long to verify it doesn't have 00:08:22.829 --> 00:08:25.459 align:start position:0% takes too long to verify it doesn't have the<00:08:23.039> succinctness<00:08:23.639> property<00:08:24.179> where<00:08:24.869> proofs 00:08:25.459 --> 00:08:25.469 align:start position:0% the succinctness property where proofs 00:08:25.469 --> 00:08:27.439 align:start position:0% the succinctness property where proofs are<00:08:25.679> very<00:08:25.889> efficient<00:08:26.279> to<00:08:26.339> verify<00:08:26.729> even<00:08:27.329> if 00:08:27.439 --> 00:08:27.449 align:start position:0% are very efficient to verify even if 00:08:27.449 --> 00:08:30.139 align:start position:0% are very efficient to verify even if they're<00:08:27.629> very<00:08:27.899> complex<00:08:28.349> and<00:08:28.939> snarks<00:08:29.939> have 00:08:30.139 --> 00:08:30.149 align:start position:0% they're very complex and snarks have 00:08:30.149 --> 00:08:32.659 align:start position:0% they're very complex and snarks have that<00:08:30.360> so<00:08:30.779> this<00:08:31.349> is<00:08:31.469> why<00:08:31.589> we<00:08:31.769> build<00:08:32.009> dart<00:08:32.430> proofs 00:08:32.659 --> 00:08:32.669 align:start position:0% that so this is why we build dart proofs 00:08:32.669 --> 00:08:35.149 align:start position:0% that so this is why we build dart proofs and<00:08:32.819> supersonic<00:08:33.389> so<00:08:34.319> how<00:08:34.500> does<00:08:34.680> that<00:08:34.949> work 00:08:35.149 --> 00:08:35.159 align:start position:0% and supersonic so how does that work 00:08:35.159 --> 00:08:37.040 align:start position:0% and supersonic so how does that work well<00:08:35.550> the<00:08:35.819> main<00:08:36.000> thing<00:08:36.029> that<00:08:36.269> we<00:08:36.509> build<00:08:36.750> is<00:08:37.019> a 00:08:37.040 --> 00:08:37.050 align:start position:0% well the main thing that we build is a 00:08:37.050 --> 00:08:39.019 align:start position:0% well the main thing that we build is a new<00:08:37.289> polynomial<00:08:37.649> commitment<00:08:38.370> so<00:08:38.729> what<00:08:38.909> is 00:08:39.019 --> 00:08:39.029 align:start position:0% new polynomial commitment so what is 00:08:39.029 --> 00:08:42.170 align:start position:0% new polynomial commitment so what is this<00:08:39.240> so<00:08:40.110> this<00:08:40.349> is<00:08:40.529> a<00:08:41.009> cryptographic<00:08:41.669> tool 00:08:42.170 --> 00:08:42.180 align:start position:0% this so this is a cryptographic tool 00:08:42.180 --> 00:08:44.449 align:start position:0% this so this is a cryptographic tool where<00:08:42.930> the<00:08:43.019> prove<00:08:43.199> it<00:08:43.319> has<00:08:43.439> some<00:08:43.740> polynomial 00:08:44.449 --> 00:08:44.459 align:start position:0% where the prove it has some polynomial 00:08:44.459 --> 00:08:49.129 align:start position:0% where the prove it has some polynomial so<00:08:45.029> you<00:08:45.569> know<00:08:45.689> 3<00:08:46.559> plus<00:08:46.980> 2x<00:08:47.459> plus<00:08:48.209> 5<00:08:48.720> x<00:08:48.990> squared 00:08:49.129 --> 00:08:49.139 align:start position:0% so you know 3 plus 2x plus 5 x squared 00:08:49.139 --> 00:08:50.540 align:start position:0% so you know 3 plus 2x plus 5 x squared and<00:08:49.559> so<00:08:49.649> on 00:08:50.540 --> 00:08:50.550 align:start position:0% and so on 00:08:50.550 --> 00:08:53.749 align:start position:0% and so on of<00:08:50.939> degree<00:08:51.360> D<00:08:51.569> so<00:08:52.019> it<00:08:52.110> has<00:08:52.230> D<00:08:52.500> plus<00:08:53.069> 1<00:08:53.250> terms<00:08:53.459> and 00:08:53.749 --> 00:08:53.759 align:start position:0% of degree D so it has D plus 1 terms and 00:08:53.759 --> 00:08:55.819 align:start position:0% of degree D so it has D plus 1 terms and the<00:08:54.269> prover<00:08:54.540> senses<00:08:54.959> commitment<00:08:55.439> which<00:08:55.649> is<00:08:55.679> a 00:08:55.819 --> 00:08:55.829 align:start position:0% the prover senses commitment which is a 00:08:55.829 --> 00:08:57.650 align:start position:0% the prover senses commitment which is a small<00:08:56.160> value<00:08:56.550> even<00:08:56.790> though<00:08:57.059> the<00:08:57.209> polynomial 00:08:57.650 --> 00:08:57.660 align:start position:0% small value even though the polynomial 00:08:57.660 --> 00:08:58.840 align:start position:0% small value even though the polynomial is<00:08:57.720> large<00:08:57.929> the<00:08:58.589> very 00:08:58.840 --> 00:08:58.850 align:start position:0% is large the very 00:08:58.850 --> 00:09:01.180 align:start position:0% is large the very I<00:08:58.880> can<00:08:59.300> send<00:08:59.569> the<00:08:59.750> point<00:09:00.319> Z<00:09:00.560> and<00:09:00.829> then<00:09:01.040> the 00:09:01.180 --> 00:09:01.190 align:start position:0% I can send the point Z and then the 00:09:01.190 --> 00:09:03.189 align:start position:0% I can send the point Z and then the prover<00:09:01.550> can<00:09:01.759> tell<00:09:02.029> you<00:09:02.240> the<00:09:02.600> polynomial 00:09:03.189 --> 00:09:03.199 align:start position:0% prover can tell you the polynomial 00:09:03.199 --> 00:09:06.160 align:start position:0% prover can tell you the polynomial evaluated<00:09:03.769> at<00:09:04.040> Z<00:09:04.430> is<00:09:04.459> equal<00:09:04.639> to<00:09:04.970> Y<00:09:05.209> and<00:09:05.509> give<00:09:06.139> a 00:09:06.160 --> 00:09:06.170 align:start position:0% evaluated at Z is equal to Y and give a 00:09:06.170 --> 00:09:08.110 align:start position:0% evaluated at Z is equal to Y and give a small<00:09:06.380> proof<00:09:06.740> that<00:09:06.920> this<00:09:07.069> is<00:09:07.130> true<00:09:07.430> so<00:09:07.850> this<00:09:08.000> is 00:09:08.110 --> 00:09:08.120 align:start position:0% small proof that this is true so this is 00:09:08.120 --> 00:09:11.350 align:start position:0% small proof that this is true so this is a<00:09:08.149> polynomial<00:09:09.019> commitment<00:09:09.620> and<00:09:10.360> recently 00:09:11.350 --> 00:09:11.360 align:start position:0% a polynomial commitment and recently 00:09:11.360 --> 00:09:13.990 align:start position:0% a polynomial commitment and recently there<00:09:12.019> was<00:09:12.560> this<00:09:12.709> cool<00:09:12.980> new<00:09:13.250> proof<00:09:13.639> system 00:09:13.990 --> 00:09:14.000 align:start position:0% there was this cool new proof system 00:09:14.000 --> 00:09:16.389 align:start position:0% there was this cool new proof system called<00:09:14.209> Sonic<00:09:14.630> which<00:09:15.380> is<00:09:15.529> a<00:09:15.560> new<00:09:16.069> kind<00:09:16.250> of 00:09:16.389 --> 00:09:16.399 align:start position:0% called Sonic which is a new kind of 00:09:16.399 --> 00:09:18.460 align:start position:0% called Sonic which is a new kind of snark<00:09:16.670> by<00:09:16.970> I<00:09:17.240> dropped<00:09:17.870> the<00:09:17.990> reference<00:09:18.319> there 00:09:18.460 --> 00:09:18.470 align:start position:0% snark by I dropped the reference there 00:09:18.470 --> 00:09:20.800 align:start position:0% snark by I dropped the reference there but<00:09:18.709> Mary<00:09:19.699> Muller<00:09:19.940> and<00:09:20.089> and<00:09:20.480> Shambo<00:09:20.779> and 00:09:20.800 --> 00:09:20.810 align:start position:0% but Mary Muller and and Shambo and 00:09:20.810 --> 00:09:24.040 align:start position:0% but Mary Muller and and Shambo and others<00:09:21.170> and<00:09:21.610> and<00:09:22.610> it's<00:09:22.970> it's<00:09:23.329> a<00:09:23.449> snark<00:09:23.660> system 00:09:24.040 --> 00:09:24.050 align:start position:0% others and and it's it's a snark system 00:09:24.050 --> 00:09:26.860 align:start position:0% others and and it's it's a snark system that<00:09:24.199> uses<00:09:24.440> a<00:09:24.850> polynomial<00:09:25.850> commitment<00:09:26.630> scheme 00:09:26.860 --> 00:09:26.870 align:start position:0% that uses a polynomial commitment scheme 00:09:26.870 --> 00:09:30.280 align:start position:0% that uses a polynomial commitment scheme and<00:09:27.170> it<00:09:28.040> has<00:09:28.250> a<00:09:28.279> trusted<00:09:28.940> set<00:09:29.120> up<00:09:29.240> still<00:09:29.540> but 00:09:30.280 --> 00:09:30.290 align:start position:0% and it has a trusted set up still but 00:09:30.290 --> 00:09:32.139 align:start position:0% and it has a trusted set up still but this<00:09:30.380> trusted<00:09:31.040> set<00:09:31.190> up<00:09:31.279> is<00:09:31.399> only<00:09:31.850> for<00:09:32.060> the 00:09:32.139 --> 00:09:32.149 align:start position:0% this trusted set up is only for the 00:09:32.149 --> 00:09:34.240 align:start position:0% this trusted set up is only for the polynomial<00:09:32.449> commitments<00:09:33.170> game<00:09:33.350> so<00:09:33.920> nothing 00:09:34.240 --> 00:09:34.250 align:start position:0% polynomial commitments game so nothing 00:09:34.250 --> 00:09:36.400 align:start position:0% polynomial commitments game so nothing else<00:09:34.399> requires<00:09:34.880> a<00:09:34.970> trusted<00:09:35.389> set<00:09:35.569> and<00:09:35.899> it's 00:09:36.400 --> 00:09:36.410 align:start position:0% else requires a trusted set and it's 00:09:36.410 --> 00:09:38.800 align:start position:0% else requires a trusted set and it's also<00:09:36.589> it<00:09:37.160> already<00:09:37.519> is<00:09:37.790> universal<00:09:38.509> so<00:09:38.690> it 00:09:38.800 --> 00:09:38.810 align:start position:0% also it already is universal so it 00:09:38.810 --> 00:09:40.180 align:start position:0% also it already is universal so it already<00:09:38.959> removes<00:09:39.500> this<00:09:39.709> problem<00:09:40.040> that<00:09:40.130> you 00:09:40.180 --> 00:09:40.190 align:start position:0% already removes this problem that you 00:09:40.190 --> 00:09:42.340 align:start position:0% already removes this problem that you need<00:09:40.399> a<00:09:40.430> new<00:09:40.670> trusted<00:09:41.060> set<00:09:41.209> upper<00:09:41.480> circuit<00:09:41.839> so 00:09:42.340 --> 00:09:42.350 align:start position:0% need a new trusted set upper circuit so 00:09:42.350 --> 00:09:44.470 align:start position:0% need a new trusted set upper circuit so it<00:09:42.380> already<00:09:42.560> is<00:09:42.889> great<00:09:43.220> and<00:09:43.579> it<00:09:44.209> got<00:09:44.360> even 00:09:44.470 --> 00:09:44.480 align:start position:0% it already is great and it got even 00:09:44.480 --> 00:09:46.449 align:start position:0% it already is great and it got even improved<00:09:44.990> you<00:09:45.589> know<00:09:45.709> the<00:09:45.860> constants<00:09:46.310> got 00:09:46.449 --> 00:09:46.459 align:start position:0% improved you know the constants got 00:09:46.459 --> 00:09:48.370 align:start position:0% improved you know the constants got improved<00:09:46.759> by<00:09:47.060> by<00:09:47.329> new<00:09:47.509> proof<00:09:47.720> systems<00:09:48.139> called 00:09:48.370 --> 00:09:48.380 align:start position:0% improved by by new proof systems called 00:09:48.380 --> 00:09:50.499 align:start position:0% improved by by new proof systems called Plunket<00:09:48.829> Marlin<00:09:49.160> but<00:09:49.699> they're<00:09:49.970> you<00:09:50.209> know<00:09:50.240> all 00:09:50.499 --> 00:09:50.509 align:start position:0% Plunket Marlin but they're you know all 00:09:50.509 --> 00:09:54.189 align:start position:0% Plunket Marlin but they're you know all the<00:09:50.810> same<00:09:51.050> family<00:09:51.529> of<00:09:51.620> proofs<00:09:52.040> and<00:09:52.899> what<00:09:53.899> we<00:09:54.050> do 00:09:54.189 --> 00:09:54.199 align:start position:0% the same family of proofs and what we do 00:09:54.199 --> 00:09:56.559 align:start position:0% the same family of proofs and what we do is<00:09:54.470> we<00:09:54.949> build<00:09:55.130> a<00:09:55.310> new<00:09:55.519> polynomial<00:09:55.850> commitment 00:09:56.559 --> 00:09:56.569 align:start position:0% is we build a new polynomial commitment 00:09:56.569 --> 00:10:03.999 align:start position:0% is we build a new polynomial commitment scheme<00:09:57.970> which<00:10:00.370> uses<00:10:02.259> so-called<00:10:03.259> do<00:10:03.589> fifteen 00:10:03.999 --> 00:10:04.009 align:start position:0% scheme which uses so-called do fifteen 00:10:04.009 --> 00:10:06.790 align:start position:0% scheme which uses so-called do fifteen arguments<00:10:04.790> of<00:10:04.880> knowledge<00:10:05.240> so<00:10:05.800> integers 00:10:06.790 --> 00:10:06.800 align:start position:0% arguments of knowledge so integers 00:10:06.800 --> 00:10:09.189 align:start position:0% arguments of knowledge so integers integer<00:10:07.550> equations<00:10:08.000> and<00:10:08.240> that's<00:10:08.750> why<00:10:08.899> we<00:10:09.019> call 00:10:09.189 --> 00:10:09.199 align:start position:0% integer equations and that's why we call 00:10:09.199 --> 00:10:11.800 align:start position:0% integer equations and that's why we call it<00:10:09.230> a<00:10:09.380> dark<00:10:09.589> and<00:10:09.920> it<00:10:10.730> uses<00:10:11.120> these<00:10:11.269> so-called 00:10:11.800 --> 00:10:11.810 align:start position:0% it a dark and it uses these so-called 00:10:11.810 --> 00:10:14.439 align:start position:0% it a dark and it uses these so-called class<00:10:12.139> groups<00:10:12.470> and<00:10:12.649> it<00:10:12.829> has<00:10:13.449> logarithmic 00:10:14.439 --> 00:10:14.449 align:start position:0% class groups and it has logarithmic 00:10:14.449 --> 00:10:15.850 align:start position:0% class groups and it has logarithmic communication<00:10:15.110> time<00:10:15.290> and<00:10:15.560> logarithmic 00:10:15.850 --> 00:10:15.860 align:start position:0% communication time and logarithmic 00:10:15.860 --> 00:10:18.280 align:start position:0% communication time and logarithmic verification<00:10:16.579> trend<00:10:16.819> and<00:10:17.029> most<00:10:17.779> importantly 00:10:18.280 --> 00:10:18.290 align:start position:0% verification trend and most importantly 00:10:18.290 --> 00:10:20.769 align:start position:0% verification trend and most importantly it<00:10:18.500> doesn't<00:10:18.800> have<00:10:18.889> a<00:10:18.920> trusted<00:10:19.339> cetera<00:10:19.610> so<00:10:20.600> what 00:10:20.769 --> 00:10:20.779 align:start position:0% it doesn't have a trusted cetera so what 00:10:20.779 --> 00:10:26.240 align:start position:0% it doesn't have a trusted cetera so what does<00:10:20.930> this<00:10:21.079> give<00:10:21.259> us<00:10:21.319> well<00:10:22.990> the<00:10:23.990> the 00:10:26.240 --> 00:10:26.250 align:start position:0% does this give us well the the 00:10:26.250 --> 00:10:28.999 align:start position:0% does this give us well the the we<00:10:26.879> have<00:10:27.000> sonic<00:10:27.480> right<00:10:27.839> and<00:10:28.079> now<00:10:28.259> then<00:10:28.589> we<00:10:28.740> plug 00:10:28.999 --> 00:10:29.009 align:start position:0% we have sonic right and now then we plug 00:10:29.009 --> 00:10:31.749 align:start position:0% we have sonic right and now then we plug in<00:10:29.190> this<00:10:29.339> new<00:10:29.550> dark<00:10:29.790> proofs<00:10:30.089> and<00:10:30.300> then<00:10:30.839> we<00:10:31.019> get 00:10:31.749 --> 00:10:31.759 align:start position:0% in this new dark proofs and then we get 00:10:31.759 --> 00:10:35.900 align:start position:0% in this new dark proofs and then we get this<00:10:32.759> sort<00:10:33.000> of<00:10:33.060> messed<00:10:33.269> up<00:10:33.389> but<00:10:33.839> we<00:10:34.139> get<00:10:34.910> it 00:10:35.900 --> 00:10:35.910 align:start position:0% this sort of messed up but we get it 00:10:35.910 --> 00:10:41.350 align:start position:0% this sort of messed up but we get it happened<00:10:36.209> here<00:10:36.920> I'm<00:10:37.920> gonna<00:10:38.069> fix<00:10:38.459> this 00:10:41.350 --> 00:10:41.360 align:start position:0% 00:10:41.360 --> 00:10:44.840 align:start position:0% these<00:10:42.360> for<00:10:42.569> this<00:10:42.660> night<00:10:43.550> we're<00:10:44.550> gonna<00:10:44.670> get 00:10:44.840 --> 00:10:44.850 align:start position:0% these for this night we're gonna get 00:10:44.850 --> 00:10:48.949 align:start position:0% these for this night we're gonna get supersonic<00:10:46.579> which<00:10:47.579> you<00:10:48.000> know<00:10:48.089> is<00:10:48.329> the<00:10:48.360> first 00:10:48.949 --> 00:10:48.959 align:start position:0% supersonic which you know is the first 00:10:48.959 --> 00:10:51.079 align:start position:0% supersonic which you know is the first snark<00:10:49.889> with<00:10:50.100> short<00:10:50.279> proves<00:10:50.519> in<00:10:50.670> no<00:10:50.759> chess<00:10:50.970> it 00:10:51.079 --> 00:10:51.089 align:start position:0% snark with short proves in no chess it 00:10:51.089 --> 00:10:52.819 align:start position:0% snark with short proves in no chess it set<00:10:51.240> up<00:10:51.360> the<00:10:51.569> proof<00:10:51.779> says<00:10:51.990> is<00:10:52.139> about<00:10:52.259> is<00:10:52.589> less 00:10:52.819 --> 00:10:52.829 align:start position:0% set up the proof says is about is less 00:10:52.829 --> 00:10:55.220 align:start position:0% set up the proof says is about is less than<00:10:52.980> 10<00:10:53.160> kilobytes<00:10:53.870> verification<00:10:54.870> time<00:10:55.050> is 00:10:55.220 --> 00:10:55.230 align:start position:0% than 10 kilobytes verification time is 00:10:55.230 --> 00:10:58.069 align:start position:0% than 10 kilobytes verification time is less<00:10:55.410> than<00:10:55.560> 100<00:10:55.889> milliwatts<00:10:56.569> milliseconds<00:10:57.569> so 00:10:58.069 --> 00:10:58.079 align:start position:0% less than 100 milliwatts milliseconds so 00:10:58.079 --> 00:11:01.160 align:start position:0% less than 100 milliwatts milliseconds so it's<00:10:58.230> very<00:10:58.410> nice<00:10:59.240> so<00:11:00.240> how<00:11:00.540> do<00:11:00.600> we<00:11:00.689> build<00:11:00.930> this 00:11:01.160 --> 00:11:01.170 align:start position:0% it's very nice so how do we build this 00:11:01.170 --> 00:11:03.590 align:start position:0% it's very nice so how do we build this well<00:11:02.009> we<00:11:02.459> built<00:11:02.610> this<00:11:02.850> something<00:11:03.329> you<00:11:03.509> know 00:11:03.590 --> 00:11:03.600 align:start position:0% well we built this something you know 00:11:03.600 --> 00:11:06.170 align:start position:0% well we built this something you know now<00:11:03.779> it<00:11:03.959> gets<00:11:04.110> now<00:11:04.829> we're<00:11:05.009> getting<00:11:05.279> into<00:11:05.430> so 00:11:06.170 --> 00:11:06.180 align:start position:0% now it gets now we're getting into so 00:11:06.180 --> 00:11:07.939 align:start position:0% now it gets now we're getting into so the<00:11:06.360> technical<00:11:06.779> part<00:11:07.110> trying<00:11:07.350> to<00:11:07.439> understand 00:11:07.939 --> 00:11:07.949 align:start position:0% the technical part trying to understand 00:11:07.949 --> 00:11:10.220 align:start position:0% the technical part trying to understand how<00:11:08.129> this<00:11:08.279> actually<00:11:08.490> works<00:11:08.689> so<00:11:09.689> we're 00:11:10.220 --> 00:11:10.230 align:start position:0% how this actually works so we're 00:11:10.230 --> 00:11:12.019 align:start position:0% how this actually works so we're building<00:11:10.379> this<00:11:10.709> using<00:11:11.129> something<00:11:11.399> called<00:11:11.579> a 00:11:12.019 --> 00:11:12.029 align:start position:0% building this using something called a 00:11:12.029 --> 00:11:14.480 align:start position:0% building this using something called a polynomial<00:11:12.420> IOP<00:11:13.079> so<00:11:13.769> what<00:11:13.980> is<00:11:14.100> a<00:11:14.129> polynomial 00:11:14.480 --> 00:11:14.490 align:start position:0% polynomial IOP so what is a polynomial 00:11:14.490 --> 00:11:18.619 align:start position:0% polynomial IOP so what is a polynomial eiope<00:11:15.149> well<00:11:16.019> basically<00:11:16.879> think<00:11:17.879> of<00:11:18.029> it<00:11:18.180> as<00:11:18.360> if 00:11:18.619 --> 00:11:18.629 align:start position:0% eiope well basically think of it as if 00:11:18.629 --> 00:11:20.720 align:start position:0% eiope well basically think of it as if the<00:11:18.899> prover<00:11:19.379> and<00:11:19.529> the<00:11:19.620> verifier<00:11:20.040> have<00:11:20.279> access 00:11:20.720 --> 00:11:20.730 align:start position:0% the prover and the verifier have access 00:11:20.730 --> 00:11:23.509 align:start position:0% the prover and the verifier have access to<00:11:20.910> some<00:11:21.180> polynomial<00:11:22.050> may<00:11:22.889> be<00:11:22.949> in<00:11:23.129> multiple 00:11:23.509 --> 00:11:23.519 align:start position:0% to some polynomial may be in multiple 00:11:23.519 --> 00:11:27.559 align:start position:0% to some polynomial may be in multiple variables<00:11:24.829> in<00:11:25.829> the<00:11:26.040> sky<00:11:26.279> and<00:11:26.519> then<00:11:27.120> in<00:11:27.389> every 00:11:27.559 --> 00:11:27.569 align:start position:0% variables in the sky and then in every 00:11:27.569 --> 00:11:29.329 align:start position:0% variables in the sky and then in every round<00:11:27.899> to<00:11:28.199> prove<00:11:28.410> your<00:11:28.560> sense<00:11:28.800> maybe<00:11:29.040> a<00:11:29.160> new 00:11:29.329 --> 00:11:29.339 align:start position:0% round to prove your sense maybe a new 00:11:29.339 --> 00:11:31.429 align:start position:0% round to prove your sense maybe a new polynomial<00:11:29.670> the<00:11:30.240> verify<00:11:30.600> sense<00:11:30.839> challenged 00:11:31.429 --> 00:11:31.439 align:start position:0% polynomial the verify sense challenged 00:11:31.439 --> 00:11:32.960 align:start position:0% polynomial the verify sense challenged and<00:11:31.620> you<00:11:31.680> get<00:11:31.800> some<00:11:31.980> new<00:11:32.100> polynomials<00:11:32.699> and<00:11:32.850> so 00:11:32.960 --> 00:11:32.970 align:start position:0% and you get some new polynomials and so 00:11:32.970 --> 00:11:34.910 align:start position:0% and you get some new polynomials and so on<00:11:33.089> so<00:11:33.300> there's<00:11:33.480> some<00:11:33.660> interaction<00:11:34.230> where<00:11:34.829> the 00:11:34.910 --> 00:11:34.920 align:start position:0% on so there's some interaction where the 00:11:34.920 --> 00:11:36.980 align:start position:0% on so there's some interaction where the prover<00:11:35.310> and<00:11:35.430> the<00:11:35.519> verifier<00:11:35.970> you<00:11:36.630> know<00:11:36.750> send 00:11:36.980 --> 00:11:36.990 align:start position:0% prover and the verifier you know send 00:11:36.990 --> 00:11:39.579 align:start position:0% prover and the verifier you know send you<00:11:37.079> some<00:11:37.579> polynomials<00:11:38.579> and<00:11:38.730> then<00:11:38.880> you<00:11:39.089> sent 00:11:39.579 --> 00:11:39.589 align:start position:0% you some polynomials and then you sent 00:11:39.589 --> 00:11:43.040 align:start position:0% you some polynomials and then you sent the<00:11:40.589> the<00:11:41.360> verifier<00:11:42.360> sense<00:11:42.689> is<00:11:42.870> some 00:11:43.040 --> 00:11:43.050 align:start position:0% the the verifier sense is some 00:11:43.050 --> 00:11:45.410 align:start position:0% the the verifier sense is some challenges<00:11:44.009> and<00:11:44.250> these<00:11:44.639> polynomials<00:11:45.209> may<00:11:45.360> be 00:11:45.410 --> 00:11:45.420 align:start position:0% challenges and these polynomials may be 00:11:45.420 --> 00:11:48.199 align:start position:0% challenges and these polynomials may be large<00:11:45.920> but<00:11:46.920> what<00:11:47.100> we<00:11:47.220> can<00:11:47.430> then<00:11:47.639> do<00:11:47.819> if<00:11:48.000> we<00:11:48.120> have 00:11:48.199 --> 00:11:48.209 align:start position:0% large but what we can then do if we have 00:11:48.209 --> 00:11:50.210 align:start position:0% large but what we can then do if we have a<00:11:48.240> proof<00:11:48.540> system<00:11:48.899> like<00:11:49.050> this<00:11:49.230> and<00:11:49.529> sonic<00:11:50.040> is<00:11:50.189> a 00:11:50.210 --> 00:11:50.220 align:start position:0% a proof system like this and sonic is a 00:11:50.220 --> 00:11:53.720 align:start position:0% a proof system like this and sonic is a proof<00:11:50.550> system<00:11:50.730> like<00:11:51.029> this<00:11:51.439> then<00:11:52.439> we<00:11:52.709> can<00:11:52.920> use<00:11:53.370> a 00:11:53.720 --> 00:11:53.730 align:start position:0% proof system like this then we can use a 00:11:53.730 --> 00:11:56.030 align:start position:0% proof system like this then we can use a polynomial<00:11:54.660> commitment<00:11:55.110> scheme<00:11:55.350> to<00:11:55.620> not<00:11:55.769> send 00:11:56.030 --> 00:11:56.040 align:start position:0% polynomial commitment scheme to not send 00:11:56.040 --> 00:11:57.790 align:start position:0% polynomial commitment scheme to not send the<00:11:56.130> polynomials<00:11:56.790> but<00:11:57.029> just<00:11:57.240> sent<00:11:57.480> the 00:11:57.790 --> 00:11:57.800 align:start position:0% the polynomials but just sent the 00:11:57.800 --> 00:12:00.379 align:start position:0% the polynomials but just sent the commitments<00:11:58.800> to<00:11:58.889> the<00:11:58.980> polynomials<00:11:59.490> and<00:11:59.639> it 00:12:00.379 --> 00:12:00.389 align:start position:0% commitments to the polynomials and it 00:12:00.389 --> 00:12:02.449 align:start position:0% commitments to the polynomials and it turns<00:12:00.600> out<00:12:00.810> you<00:12:01.019> know<00:12:01.050> this<00:12:01.740> is<00:12:01.860> interactive 00:12:02.449 --> 00:12:02.459 align:start position:0% turns out you know this is interactive 00:12:02.459 --> 00:12:04.579 align:start position:0% turns out you know this is interactive there's<00:12:02.730> a<00:12:02.790> generic<00:12:03.269> transformation<00:12:04.230> called 00:12:04.579 --> 00:12:04.589 align:start position:0% there's a generic transformation called 00:12:04.589 --> 00:12:08.509 align:start position:0% there's a generic transformation called the<00:12:04.740> Fourier<00:12:05.209> transform<00:12:06.209> to<00:12:07.040> transform<00:12:08.040> this 00:12:08.509 --> 00:12:08.519 align:start position:0% the Fourier transform to transform this 00:12:08.519 --> 00:12:10.340 align:start position:0% the Fourier transform to transform this from<00:12:08.730> an<00:12:08.850> interactive<00:12:09.420> proof<00:12:09.660> to<00:12:10.110> a<00:12:10.139> non 00:12:10.340 --> 00:12:10.350 align:start position:0% from an interactive proof to a non 00:12:10.350 --> 00:12:12.740 align:start position:0% from an interactive proof to a non interactive<00:12:10.889> proof<00:12:11.100> so<00:12:11.790> basically<00:12:12.180> all<00:12:12.300> we 00:12:12.740 --> 00:12:12.750 align:start position:0% interactive proof so basically all we 00:12:12.750 --> 00:12:15.650 align:start position:0% interactive proof so basically all we need<00:12:12.959> now<00:12:12.990> is<00:12:13.439> is<00:12:13.889> this<00:12:14.220> thing<00:12:14.519> and<00:12:14.790> then<00:12:15.509> we 00:12:15.650 --> 00:12:15.660 align:start position:0% need now is is this thing and then we 00:12:15.660 --> 00:12:18.679 align:start position:0% need now is is this thing and then we can<00:12:15.689> focus<00:12:16.050> on<00:12:16.410> you<00:12:16.740> know<00:12:17.180> kind<00:12:18.180> of<00:12:18.240> compiling 00:12:18.679 --> 00:12:18.689 align:start position:0% can focus on you know kind of compiling 00:12:18.689 --> 00:12:20.569 align:start position:0% can focus on you know kind of compiling these<00:12:18.959> things<00:12:19.230> down<00:12:19.470> so<00:12:19.620> this<00:12:19.800> is<00:12:19.860> the<00:12:20.160> this 00:12:20.569 --> 00:12:20.579 align:start position:0% these things down so this is the this 00:12:20.579 --> 00:12:22.429 align:start position:0% these things down so this is the this general<00:12:21.029> recipe<00:12:21.209> of<00:12:21.689> how<00:12:21.809> we<00:12:21.870> can<00:12:22.110> build<00:12:22.290> these 00:12:22.429 --> 00:12:22.439 align:start position:0% general recipe of how we can build these 00:12:22.439 --> 00:12:25.519 align:start position:0% general recipe of how we can build these snacks<00:12:22.740> and<00:12:23.180> a<00:12:24.180> lot<00:12:24.660> of<00:12:24.689> different<00:12:24.959> snarks 00:12:25.519 --> 00:12:25.529 align:start position:0% snacks and a lot of different snarks 00:12:25.529 --> 00:12:27.170 align:start position:0% snacks and a lot of different snarks actually<00:12:25.829> fall<00:12:26.069> into<00:12:26.370> this<00:12:26.519> category<00:12:26.699> of 00:12:27.170 --> 00:12:27.180 align:start position:0% actually fall into this category of 00:12:27.180 --> 00:12:29.749 align:start position:0% actually fall into this category of polynomial<00:12:28.050> I<00:12:28.139> hope<00:12:28.259> ease<00:12:28.439> so<00:12:29.160> if<00:12:29.279> we<00:12:29.399> build<00:12:29.579> a 00:12:29.749 --> 00:12:29.759 align:start position:0% polynomial I hope ease so if we build a 00:12:29.759 --> 00:12:31.369 align:start position:0% polynomial I hope ease so if we build a new<00:12:29.879> polynomial<00:12:30.449> a<00:12:30.480> commitment<00:12:30.990> scheme<00:12:31.199> it 00:12:31.369 --> 00:12:31.379 align:start position:0% new polynomial a commitment scheme it 00:12:31.379 --> 00:12:33.439 align:start position:0% new polynomial a commitment scheme it helps<00:12:31.709> improve<00:12:31.949> all<00:12:32.220> of<00:12:32.370> these<00:12:32.490> snarks<00:12:33.240> and 00:12:33.439 --> 00:12:33.449 align:start position:0% helps improve all of these snarks and 00:12:33.449 --> 00:12:35.210 align:start position:0% helps improve all of these snarks and make<00:12:33.569> them<00:12:33.779> or<00:12:34.199> all<00:12:34.410> of<00:12:34.439> these<00:12:34.589> proof<00:12:34.829> systems 00:12:35.210 --> 00:12:35.220 align:start position:0% make them or all of these proof systems 00:12:35.220 --> 00:12:37.519 align:start position:0% make them or all of these proof systems and<00:12:35.370> make<00:12:35.519> them<00:12:35.699> have<00:12:36.509> no<00:12:36.750> trusted<00:12:37.139> set<00:12:37.290> up<00:12:37.380> so 00:12:37.519 --> 00:12:37.529 align:start position:0% and make them have no trusted set up so 00:12:37.529 --> 00:12:40.130 align:start position:0% and make them have no trusted set up so that's<00:12:37.709> exactly<00:12:38.040> what<00:12:38.279> we<00:12:38.370> did<00:12:38.519> and<00:12:38.699> sonic 00:12:40.130 --> 00:12:40.140 align:start position:0% that's exactly what we did and sonic 00:12:40.140 --> 00:12:42.560 align:start position:0% that's exactly what we did and sonic you<00:12:40.260> know<00:12:40.350> as<00:12:40.470> I<00:12:40.500> already<00:12:40.770> said<00:12:41.420> gives<00:12:42.420> you<00:12:42.540> a 00:12:42.560 --> 00:12:42.570 align:start position:0% you know as I already said gives you a 00:12:42.570 --> 00:12:46.490 align:start position:0% you know as I already said gives you a five-round<00:12:43.230> IP<00:12:43.650> with<00:12:44.040> 24<00:12:44.960> Oracle's<00:12:45.960> but<00:12:46.260> in 00:12:46.490 --> 00:12:46.500 align:start position:0% five-round IP with 24 Oracle's but in 00:12:46.500 --> 00:12:48.550 align:start position:0% five-round IP with 24 Oracle's but in general<00:12:46.920> you<00:12:47.280> know<00:12:47.370> we<00:12:47.490> can<00:12:47.670> we<00:12:47.940> can<00:12:48.090> make<00:12:48.120> this 00:12:48.550 --> 00:12:48.560 align:start position:0% general you know we can we can make this 00:12:48.560 --> 00:12:51.410 align:start position:0% general you know we can we can make this work<00:12:49.560> so<00:12:49.800> let's<00:12:50.580> focus<00:12:50.880> on<00:12:51.150> the<00:12:51.270> main 00:12:51.410 --> 00:12:51.420 align:start position:0% work so let's focus on the main 00:12:51.420 --> 00:12:55.340 align:start position:0% work so let's focus on the main construction<00:12:51.810> so<00:12:53.210> the<00:12:54.210> first<00:12:54.450> thing<00:12:54.690> of<00:12:54.870> this 00:12:55.340 --> 00:12:55.350 align:start position:0% construction so the first thing of this 00:12:55.350 --> 00:12:57.140 align:start position:0% construction so the first thing of this polynomial<00:12:55.980> commitment<00:12:56.550> scheme<00:12:56.730> right<00:12:56.910> so 00:12:57.140 --> 00:12:57.150 align:start position:0% polynomial commitment scheme right so 00:12:57.150 --> 00:12:58.700 align:start position:0% polynomial commitment scheme right so this<00:12:57.300> is<00:12:57.390> why<00:12:57.510> we're<00:12:57.660> trying<00:12:57.810> to<00:12:57.960> do<00:12:58.050> we've 00:12:58.700 --> 00:12:58.710 align:start position:0% this is why we're trying to do we've 00:12:58.710 --> 00:13:00.500 align:start position:0% this is why we're trying to do we've boiled<00:12:59.130> it<00:12:59.340> down<00:12:59.370> to<00:12:59.520> we<00:12:59.910> just<00:13:00.120> have<00:13:00.270> to<00:13:00.420> build 00:13:00.500 --> 00:13:00.510 align:start position:0% boiled it down to we just have to build 00:13:00.510 --> 00:13:02.510 align:start position:0% boiled it down to we just have to build this<00:13:00.720> problem<00:13:00.960> on<00:13:01.050> my<00:13:01.140> commitment<00:13:01.530> scheme<00:13:01.710> so 00:13:02.510 --> 00:13:02.520 align:start position:0% this problem on my commitment scheme so 00:13:02.520 --> 00:13:04.490 align:start position:0% this problem on my commitment scheme so you<00:13:03.120> know<00:13:03.270> let's<00:13:03.450> recall<00:13:03.750> what<00:13:03.930> a<00:13:03.960> polynomial 00:13:04.490 --> 00:13:04.500 align:start position:0% you know let's recall what a polynomial 00:13:04.500 --> 00:13:07.670 align:start position:0% you know let's recall what a polynomial looks<00:13:04.650> like<00:13:04.830> and<00:13:05.870> so<00:13:06.870> what<00:13:07.020> we're<00:13:07.170> going<00:13:07.320> to<00:13:07.440> do 00:13:07.670 --> 00:13:07.680 align:start position:0% looks like and so what we're going to do 00:13:07.680 --> 00:13:10.430 align:start position:0% looks like and so what we're going to do is<00:13:08.070> we're<00:13:08.550> going<00:13:08.700> to<00:13:08.790> take<00:13:09.150> this<00:13:09.440> polynomial 00:13:10.430 --> 00:13:10.440 align:start position:0% is we're going to take this polynomial 00:13:10.440 --> 00:13:14.630 align:start position:0% is we're going to take this polynomial and<00:13:11.720> encode<00:13:12.720> it<00:13:12.870> as<00:13:12.990> an<00:13:13.170> integer<00:13:13.440> so<00:13:14.100> what<00:13:14.490> we 00:13:14.630 --> 00:13:14.640 align:start position:0% and encode it as an integer so what we 00:13:14.640 --> 00:13:17.260 align:start position:0% and encode it as an integer so what we do<00:13:14.820> is<00:13:15.000> we<00:13:15.510> pick<00:13:15.750> simply<00:13:16.230> pick<00:13:16.470> a<00:13:16.500> large<00:13:16.770> queue 00:13:17.260 --> 00:13:17.270 align:start position:0% do is we pick simply pick a large queue 00:13:17.270 --> 00:13:20.540 align:start position:0% do is we pick simply pick a large queue so<00:13:18.270> all<00:13:18.780> of<00:13:18.960> these<00:13:19.400> normally<00:13:20.400> these 00:13:20.540 --> 00:13:20.550 align:start position:0% so all of these normally these 00:13:20.550 --> 00:13:23.450 align:start position:0% so all of these normally these polynomials<00:13:21.270> are<00:13:21.480> in<00:13:21.750> a<00:13:21.780> field<00:13:22.320> in<00:13:22.590> a<00:13:22.710> prime<00:13:23.430> or 00:13:23.450 --> 00:13:23.460 align:start position:0% polynomials are in a field in a prime or 00:13:23.460 --> 00:13:26.000 align:start position:0% polynomials are in a field in a prime or a<00:13:23.610> field<00:13:23.910> CP<00:13:24.420> but<00:13:25.170> what<00:13:25.320> we're<00:13:25.470> going<00:13:25.650> to<00:13:25.710> do<00:13:25.890> is 00:13:26.000 --> 00:13:26.010 align:start position:0% a field CP but what we're going to do is 00:13:26.010 --> 00:13:27.680 align:start position:0% a field CP but what we're going to do is we're<00:13:26.160> going<00:13:26.310> to<00:13:26.460> represent<00:13:27.060> it<00:13:27.420> over<00:13:27.600> the 00:13:27.680 --> 00:13:27.690 align:start position:0% we're going to represent it over the 00:13:27.690 --> 00:13:30.650 align:start position:0% we're going to represent it over the integers<00:13:28.020> and<00:13:28.410> pick<00:13:28.740> a<00:13:28.770> queue<00:13:29.430> this<00:13:30.150> is<00:13:30.300> larger 00:13:30.650 --> 00:13:30.660 align:start position:0% integers and pick a queue this is larger 00:13:30.660 --> 00:13:32.870 align:start position:0% integers and pick a queue this is larger than<00:13:30.780> each<00:13:30.990> of<00:13:31.140> the<00:13:31.260> coefficients<00:13:31.890> and<00:13:32.070> then 00:13:32.870 --> 00:13:32.880 align:start position:0% than each of the coefficients and then 00:13:32.880 --> 00:13:36.170 align:start position:0% than each of the coefficients and then just<00:13:33.120> simply<00:13:33.600> evaluate<00:13:34.110> the<00:13:34.260> polynomial<00:13:34.530> Q<00:13:35.180> so 00:13:36.170 --> 00:13:36.180 align:start position:0% just simply evaluate the polynomial Q so 00:13:36.180 --> 00:13:37.850 align:start position:0% just simply evaluate the polynomial Q so this<00:13:36.750> might<00:13:36.960> seem<00:13:37.140> a<00:13:37.200> little<00:13:37.230> bit<00:13:37.440> weird<00:13:37.470> why 00:13:37.850 --> 00:13:37.860 align:start position:0% this might seem a little bit weird why 00:13:37.860 --> 00:13:39.500 align:start position:0% this might seem a little bit weird why are<00:13:38.430> we<00:13:38.550> doing<00:13:38.730> this<00:13:38.850> what<00:13:39.090> does<00:13:39.180> this<00:13:39.330> mean 00:13:39.500 --> 00:13:39.510 align:start position:0% are we doing this what does this mean 00:13:39.510 --> 00:13:42.110 align:start position:0% are we doing this what does this mean well<00:13:39.990> let's<00:13:40.110> think<00:13:40.980> about<00:13:41.100> very<00:13:41.490> concrete<00:13:41.700> so 00:13:42.110 --> 00:13:42.120 align:start position:0% well let's think about very concrete so 00:13:42.120 --> 00:13:44.270 align:start position:0% well let's think about very concrete so our<00:13:42.510> polynomial<00:13:42.840> is<00:13:43.110> 4<00:13:43.620> X<00:13:43.740> cubed<00:13:43.980> plus<00:13:44.130> 2<00:13:44.250> x 00:13:44.270 --> 00:13:44.280 align:start position:0% our polynomial is 4 X cubed plus 2 x 00:13:44.280 --> 00:13:48.860 align:start position:0% our polynomial is 4 X cubed plus 2 x squared<00:13:45.150> plus<00:13:45.210> X<00:13:45.540> plus<00:13:45.630> 3<00:13:45.930> and<00:13:46.910> then<00:13:47.910> we<00:13:48.210> take<00:13:48.420> Q 00:13:48.860 --> 00:13:48.870 align:start position:0% squared plus X plus 3 and then we take Q 00:13:48.870 --> 00:13:52.250 align:start position:0% squared plus X plus 3 and then we take Q equals<00:13:49.200> to<00:13:49.380> 10<00:13:49.560> and<00:13:49.830> we<00:13:50.580> evaluate<00:13:51.240> f<00:13:51.420> hat<00:13:51.780> at<00:13:52.020> 10 00:13:52.250 --> 00:13:52.260 align:start position:0% equals to 10 and we evaluate f hat at 10 00:13:52.260 --> 00:13:55.880 align:start position:0% equals to 10 and we evaluate f hat at 10 well<00:13:53.010> what<00:13:53.160> do<00:13:53.280> we<00:13:53.310> get<00:13:53.550> we<00:13:54.510> get<00:13:54.630> 4<00:13:54.930> 2<00:13:55.080> 1<00:13:55.110> 3<00:13:55.290> it's 00:13:55.880 --> 00:13:55.890 align:start position:0% well what do we get we get 4 2 1 3 it's 00:13:55.890 --> 00:13:57.500 align:start position:0% well what do we get we get 4 2 1 3 it's literally<00:13:56.190> just<00:13:56.220> the<00:13:56.550> coefficients<00:13:57.210> written 00:13:57.500 --> 00:13:57.510 align:start position:0% literally just the coefficients written 00:13:57.510 --> 00:14:00.160 align:start position:0% literally just the coefficients written next<00:13:57.780> to<00:13:57.870> each<00:13:57.960> other<00:13:58.080> right<00:13:58.410> because<00:13:58.770> 10<00:13:59.490> is<00:13:59.760> a 00:14:00.160 --> 00:14:00.170 align:start position:0% next to each other right because 10 is a 00:14:00.170 --> 00:14:02.090 align:start position:0% next to each other right because 10 is a you<00:14:01.170> know<00:14:01.260> where<00:14:01.440> we're<00:14:01.680> thinking<00:14:02.010> in 00:14:02.090 --> 00:14:02.100 align:start position:0% you know where we're thinking in 00:14:02.100 --> 00:14:03.890 align:start position:0% you know where we're thinking in decimals<00:14:02.550> so<00:14:02.760> with<00:14:02.940> 10<00:14:03.150> it<00:14:03.330> looks<00:14:03.480> really<00:14:03.750> nice 00:14:03.890 --> 00:14:03.900 align:start position:0% decimals so with 10 it looks really nice 00:14:03.900 --> 00:14:05.630 align:start position:0% decimals so with 10 it looks really nice but<00:14:04.560> you<00:14:04.590> can<00:14:04.830> do<00:14:04.920> this<00:14:05.070> with<00:14:05.250> any<00:14:05.430> other 00:14:05.630 --> 00:14:05.640 align:start position:0% but you can do this with any other 00:14:05.640 --> 00:14:08.180 align:start position:0% but you can do this with any other number<00:14:06.000> you<00:14:06.120> know<00:14:06.240> if<00:14:06.390> I<00:14:06.510> had<00:14:07.020> chosen<00:14:07.290> 8<00:14:07.620> or<00:14:07.980> 5 00:14:08.180 --> 00:14:08.190 align:start position:0% number you know if I had chosen 8 or 5 00:14:08.190 --> 00:14:10.070 align:start position:0% number you know if I had chosen 8 or 5 or<00:14:08.550> whatever<00:14:08.670> this<00:14:09.060> would<00:14:09.240> have<00:14:09.360> worked<00:14:09.900> as 00:14:10.070 --> 00:14:10.080 align:start position:0% or whatever this would have worked as 00:14:10.080 --> 00:14:15.230 align:start position:0% or whatever this would have worked as well<00:14:10.460> okay<00:14:11.460> or<00:14:11.640> 100<00:14:12.030> you<00:14:12.990> know<00:14:13.080> so<00:14:13.940> what<00:14:14.940> we<00:14:15.060> do 00:14:15.230 --> 00:14:15.240 align:start position:0% well okay or 100 you know so what we do 00:14:15.240 --> 00:14:17.750 align:start position:0% well okay or 100 you know so what we do here<00:14:15.570> is<00:14:15.720> we<00:14:15.990> transform<00:14:16.680> our<00:14:16.800> polynomial<00:14:17.430> into 00:14:17.750 --> 00:14:17.760 align:start position:0% here is we transform our polynomial into 00:14:17.760 --> 00:14:20.900 align:start position:0% here is we transform our polynomial into an<00:14:17.850> integer<00:14:18.980> so<00:14:19.980> why<00:14:20.130> do<00:14:20.190> we<00:14:20.310> do<00:14:20.490> that<00:14:20.640> well 00:14:20.900 --> 00:14:20.910 align:start position:0% an integer so why do we do that well 00:14:20.910 --> 00:14:22.730 align:start position:0% an integer so why do we do that well this<00:14:21.270> integer<00:14:21.600> encoding<00:14:22.170> has<00:14:22.200> very<00:14:22.590> nice 00:14:22.730 --> 00:14:22.740 align:start position:0% this integer encoding has very nice 00:14:22.740 --> 00:14:26.090 align:start position:0% this integer encoding has very nice properties<00:14:23.250> so<00:14:24.210> if<00:14:24.540> this<00:14:24.840> Q<00:14:25.290> is<00:14:25.320> large<00:14:25.770> enough 00:14:26.090 --> 00:14:26.100 align:start position:0% properties so if this Q is large enough 00:14:26.100 --> 00:14:28.940 align:start position:0% properties so if this Q is large enough and<00:14:26.310> there's<00:14:26.490> no<00:14:26.670> overflow<00:14:27.320> then<00:14:28.320> actually 00:14:28.940 --> 00:14:28.950 align:start position:0% and there's no overflow then actually 00:14:28.950 --> 00:14:31.370 align:start position:0% and there's no overflow then actually this<00:14:29.100> has<00:14:29.310> homomorphic<00:14:30.090> properties<00:14:30.660> additive 00:14:31.370 --> 00:14:31.380 align:start position:0% this has homomorphic properties additive 00:14:31.380 --> 00:14:34.250 align:start position:0% this has homomorphic properties additive properties<00:14:31.890> so<00:14:32.790> I<00:14:33.180> have<00:14:33.390> a<00:14:33.420> you<00:14:33.990> know<00:14:34.110> one 00:14:34.250 --> 00:14:34.260 align:start position:0% properties so I have a you know one 00:14:34.260 --> 00:14:37.130 align:start position:0% properties so I have a you know one polynomial<00:14:34.760> 4-2-3-1<00:14:35.760> you<00:14:36.360> know<00:14:36.480> I<00:14:36.510> just<00:14:36.930> give 00:14:37.130 --> 00:14:37.140 align:start position:0% polynomial 4-2-3-1 you know I just give 00:14:37.140 --> 00:14:38.390 align:start position:0% polynomial 4-2-3-1 you know I just give you<00:14:37.230> the<00:14:37.380> integer<00:14:37.680> representation<00:14:38.310> and 00:14:38.390 --> 00:14:38.400 align:start position:0% you the integer representation and 00:14:38.400 --> 00:14:41.330 align:start position:0% you the integer representation and another<00:14:38.670> one<00:14:38.850> 1<00:14:39.390> 4<00:14:39.600> 4<00:14:39.720> 3<00:14:39.780> and<00:14:40.410> it<00:14:41.010> turns<00:14:41.190> out 00:14:41.330 --> 00:14:41.340 align:start position:0% another one 1 4 4 3 and it turns out 00:14:41.340 --> 00:14:43.790 align:start position:0% another one 1 4 4 3 and it turns out that<00:14:41.400> if<00:14:41.670> I<00:14:41.790> add<00:14:41.970> these<00:14:42.270> integers<00:14:42.660> I<00:14:43.140> get<00:14:43.680> the 00:14:43.790 --> 00:14:43.800 align:start position:0% that if I add these integers I get the 00:14:43.800 --> 00:14:47.510 align:start position:0% that if I add these integers I get the encoding<00:14:44.430> of<00:14:44.610> another<00:14:45.390> polynomial<00:14:46.340> which<00:14:47.340> is 00:14:47.510 --> 00:14:47.520 align:start position:0% encoding of another polynomial which is 00:14:47.520 --> 00:14:49.490 align:start position:0% encoding of another polynomial which is literally<00:14:47.850> the<00:14:48.090> sum<00:14:48.390> of<00:14:48.420> the<00:14:48.750> the<00:14:49.080> original 00:14:49.490 --> 00:14:49.500 align:start position:0% literally the sum of the the original 00:14:49.500 --> 00:14:52.370 align:start position:0% literally the sum of the the original polynomials<00:14:50.190> right<00:14:50.610> so<00:14:51.210> if<00:14:51.570> I<00:14:51.870> add<00:14:52.110> the 00:14:52.370 --> 00:14:52.380 align:start position:0% polynomials right so if I add the 00:14:52.380 --> 00:14:53.510 align:start position:0% polynomials right so if I add the polynomials<00:14:53.010> and<00:14:53.130> then 00:14:53.510 --> 00:14:53.520 align:start position:0% polynomials and then 00:14:53.520 --> 00:14:56.090 align:start position:0% polynomials and then code<00:14:53.730> it's<00:14:54.450> exactly<00:14:54.960> the<00:14:55.170> same<00:14:55.380> as<00:14:55.680> if<00:14:55.920> I 00:14:56.090 --> 00:14:56.100 align:start position:0% code it's exactly the same as if I 00:14:56.100 --> 00:14:58.550 align:start position:0% code it's exactly the same as if I encode<00:14:56.490> and<00:14:56.760> then<00:14:56.910> add<00:14:57.120> the<00:14:57.300> integers<00:14:57.720> so<00:14:58.410> this 00:14:58.550 --> 00:14:58.560 align:start position:0% encode and then add the integers so this 00:14:58.560 --> 00:15:00.410 align:start position:0% encode and then add the integers so this is<00:14:58.680> what<00:14:58.830> we<00:14:58.950> call<00:14:59.160> a<00:14:59.370> homomorphic<00:15:00.000> property 00:15:00.410 --> 00:15:00.420 align:start position:0% is what we call a homomorphic property 00:15:00.420 --> 00:15:02.780 align:start position:0% is what we call a homomorphic property so<00:15:01.050> this<00:15:01.230> is<00:15:01.290> an<00:15:01.380> additive<00:15:01.860> homomorphism<00:15:02.610> and 00:15:02.780 --> 00:15:02.790 align:start position:0% so this is an additive homomorphism and 00:15:02.790 --> 00:15:04.360 align:start position:0% so this is an additive homomorphism and it<00:15:03.180> turns<00:15:03.390> out<00:15:03.570> there's<00:15:03.750> also<00:15:03.900> a 00:15:04.360 --> 00:15:04.370 align:start position:0% it turns out there's also a 00:15:04.370 --> 00:15:06.470 align:start position:0% it turns out there's also a multiplicative<00:15:05.370> harmon<00:15:05.820> orphism<00:15:06.180> or 00:15:06.470 --> 00:15:06.480 align:start position:0% multiplicative harmon orphism or 00:15:06.480 --> 00:15:09.050 align:start position:0% multiplicative harmon orphism or monomial<00:15:07.350> homomorphism<00:15:08.100> so<00:15:08.550> if<00:15:08.670> I<00:15:08.730> want<00:15:08.940> to 00:15:09.050 --> 00:15:09.060 align:start position:0% monomial homomorphism so if I want to 00:15:09.060 --> 00:15:11.330 align:start position:0% monomial homomorphism so if I want to shift<00:15:09.330> the<00:15:09.630> the<00:15:09.990> polynomial<00:15:10.560> by<00:15:10.650> a<00:15:10.680> degree<00:15:11.040> X 00:15:11.330 --> 00:15:11.340 align:start position:0% shift the the polynomial by a degree X 00:15:11.340 --> 00:15:14.330 align:start position:0% shift the the polynomial by a degree X to<00:15:11.700> the<00:15:11.820> K<00:15:12.000> you<00:15:12.570> know<00:15:12.690> say<00:15:12.900> x<00:15:13.110> squared<00:15:13.410> then 00:15:14.330 --> 00:15:14.340 align:start position:0% to the K you know say x squared then 00:15:14.340 --> 00:15:15.890 align:start position:0% to the K you know say x squared then this<00:15:14.520> is<00:15:14.700> simply<00:15:15.060> equivalent<00:15:15.600> to<00:15:15.750> just 00:15:15.890 --> 00:15:15.900 align:start position:0% this is simply equivalent to just 00:15:15.900 --> 00:15:19.850 align:start position:0% this is simply equivalent to just multiplying<00:15:16.500> it<00:15:16.740> with<00:15:16.800> Q<00:15:17.790> to<00:15:17.940> the<00:15:17.970> K<00:15:18.090> so<00:15:18.860> x 00:15:19.850 --> 00:15:19.860 align:start position:0% multiplying it with Q to the K so x 00:15:19.860 --> 00:15:22.040 align:start position:0% multiplying it with Q to the K so x squared<00:15:19.980> times<00:15:20.430> H<00:15:20.580> of<00:15:20.610> X<00:15:20.880> is<00:15:21.090> 5x<00:15:21.450> squared<00:15:21.720> plus 00:15:22.040 --> 00:15:22.050 align:start position:0% squared times H of X is 5x squared plus 00:15:22.050 --> 00:15:24.710 align:start position:0% squared times H of X is 5x squared plus 6<00:15:22.290> 6<00:15:22.530> to<00:15:22.800> the<00:15:22.890> fourth<00:15:23.070> and<00:15:23.670> you<00:15:24.360> know<00:15:24.450> this<00:15:24.600> is 00:15:24.710 --> 00:15:24.720 align:start position:0% 6 6 to the fourth and you know this is 00:15:24.720 --> 00:15:26.240 align:start position:0% 6 6 to the fourth and you know this is simply<00:15:25.020> equivalent<00:15:25.470> to<00:15:25.590> just<00:15:25.710> multiplying 00:15:26.240 --> 00:15:26.250 align:start position:0% simply equivalent to just multiplying 00:15:26.250 --> 00:15:29.600 align:start position:0% simply equivalent to just multiplying hundred<00:15:26.700> times<00:15:26.970> the<00:15:27.150> encoding<00:15:27.600> right<00:15:27.830> X<00:15:28.830> is<00:15:29.160> 10 00:15:29.600 --> 00:15:29.610 align:start position:0% hundred times the encoding right X is 10 00:15:29.610 --> 00:15:33.860 align:start position:0% hundred times the encoding right X is 10 or<00:15:29.850> Q<00:15:30.150> is<00:15:30.210> 10<00:15:30.590> 10<00:15:31.590> squared<00:15:31.890> is<00:15:31.980> 100<00:15:32.130> so<00:15:33.120> all<00:15:33.750> of 00:15:33.860 --> 00:15:33.870 align:start position:0% or Q is 10 10 squared is 100 so all of 00:15:33.870 --> 00:15:36.980 align:start position:0% or Q is 10 10 squared is 100 so all of this<00:15:33.990> works<00:15:34.850> so<00:15:35.850> now<00:15:35.970> we've<00:15:36.270> transformed<00:15:36.870> our 00:15:36.980 --> 00:15:36.990 align:start position:0% this works so now we've transformed our 00:15:36.990 --> 00:15:39.980 align:start position:0% this works so now we've transformed our polynomial<00:15:37.470> to<00:15:37.560> integers<00:15:38.060> so<00:15:39.060> why<00:15:39.240> why<00:15:39.660> does 00:15:39.980 --> 00:15:39.990 align:start position:0% polynomial to integers so why why does 00:15:39.990 --> 00:15:41.660 align:start position:0% polynomial to integers so why why does this<00:15:40.140> help<00:15:40.350> well<00:15:41.070> there's<00:15:41.310> these 00:15:41.660 --> 00:15:41.670 align:start position:0% this help well there's these 00:15:41.670 --> 00:15:43.670 align:start position:0% this help well there's these cryptographic<00:15:42.300> tools<00:15:42.810> called<00:15:43.230> a<00:15:43.350> group<00:15:43.500> of 00:15:43.670 --> 00:15:43.680 align:start position:0% cryptographic tools called a group of 00:15:43.680 --> 00:15:45.620 align:start position:0% cryptographic tools called a group of unknown<00:15:43.830> order<00:15:44.310> right<00:15:44.910> these<00:15:45.060> integers<00:15:45.330> are 00:15:45.620 --> 00:15:45.630 align:start position:0% unknown order right these integers are 00:15:45.630 --> 00:15:47.690 align:start position:0% unknown order right these integers are still<00:15:45.840> large<00:15:46.080> in<00:15:46.410> my<00:15:46.620> polynomials<00:15:47.250> large<00:15:47.460> the 00:15:47.690 --> 00:15:47.700 align:start position:0% still large in my polynomials large the 00:15:47.700 --> 00:15:49.700 align:start position:0% still large in my polynomials large the integer<00:15:48.030> is<00:15:48.060> large<00:15:48.330> so<00:15:48.900> I<00:15:48.930> cannot<00:15:49.260> send<00:15:49.560> you 00:15:49.700 --> 00:15:49.710 align:start position:0% integer is large so I cannot send you 00:15:49.710 --> 00:15:51.170 align:start position:0% integer is large so I cannot send you the<00:15:49.890> integer<00:15:50.220> that<00:15:50.400> would<00:15:50.550> be<00:15:50.670> much<00:15:50.850> too<00:15:51.030> like 00:15:51.170 --> 00:15:51.180 align:start position:0% the integer that would be much too like 00:15:51.180 --> 00:15:52.940 align:start position:0% the integer that would be much too like it<00:15:51.360> would<00:15:51.630> be<00:15:51.750> way<00:15:51.870> too<00:15:51.900> large<00:15:52.140> but<00:15:52.800> now 00:15:52.940 --> 00:15:52.950 align:start position:0% it would be way too large but now 00:15:52.950 --> 00:15:55.400 align:start position:0% it would be way too large but now cryptography<00:15:53.670> comes<00:15:53.880> into<00:15:54.120> play<00:15:54.300> and<00:15:54.600> we<00:15:55.260> have 00:15:55.400 --> 00:15:55.410 align:start position:0% cryptography comes into play and we have 00:15:55.410 --> 00:15:58.850 align:start position:0% cryptography comes into play and we have this<00:15:55.560> thing<00:15:55.800> called<00:15:55.860> a<00:15:57.590> group<00:15:58.590> of<00:15:58.710> unknown 00:15:58.850 --> 00:15:58.860 align:start position:0% this thing called a group of unknown 00:15:58.860 --> 00:16:00.950 align:start position:0% this thing called a group of unknown order<00:15:59.280> and<00:15:59.490> all<00:16:00.030> you<00:16:00.240> need<00:16:00.390> to<00:16:00.480> know<00:16:00.660> is<00:16:00.930> that 00:16:00.950 --> 00:16:00.960 align:start position:0% order and all you need to know is that 00:16:00.960 --> 00:16:02.630 align:start position:0% order and all you need to know is that basically<00:16:01.650> this<00:16:01.830> is<00:16:01.980> a<00:16:02.010> commitment<00:16:02.550> to 00:16:02.630 --> 00:16:02.640 align:start position:0% basically this is a commitment to 00:16:02.640 --> 00:16:04.940 align:start position:0% basically this is a commitment to integers<00:16:03.090> which<00:16:03.630> shrinks<00:16:04.110> down<00:16:04.380> the<00:16:04.620> integer 00:16:04.940 --> 00:16:04.950 align:start position:0% integers which shrinks down the integer 00:16:04.950 --> 00:16:06.770 align:start position:0% integers which shrinks down the integer it<00:16:05.310> doesn't<00:16:05.670> matter<00:16:05.850> how<00:16:05.970> large<00:16:06.180> the<00:16:06.390> integers 00:16:06.770 --> 00:16:06.780 align:start position:0% it doesn't matter how large the integers 00:16:06.780 --> 00:16:09.740 align:start position:0% it doesn't matter how large the integers you<00:16:07.200> know<00:16:07.350> could<00:16:07.980> be<00:16:08.130> hundreds<00:16:09.120> of<00:16:09.300> millions 00:16:09.740 --> 00:16:09.750 align:start position:0% you know could be hundreds of millions 00:16:09.750 --> 00:16:11.930 align:start position:0% you know could be hundreds of millions of<00:16:10.080> digits<00:16:10.470> it<00:16:10.680> shrinks<00:16:11.400> it<00:16:11.490> down<00:16:11.550> to 00:16:11.930 --> 00:16:11.940 align:start position:0% of digits it shrinks it down to 00:16:11.940 --> 00:16:15.260 align:start position:0% of digits it shrinks it down to something<00:16:12.300> that<00:16:12.330> is<00:16:12.570> constant<00:16:13.080> size<00:16:13.610> but<00:16:14.610> the 00:16:15.260 --> 00:16:15.270 align:start position:0% something that is constant size but the 00:16:15.270 --> 00:16:17.030 align:start position:0% something that is constant size but the homomorphic<00:16:15.840> properties<00:16:16.320> these<00:16:16.560> additive 00:16:17.030 --> 00:16:17.040 align:start position:0% homomorphic properties these additive 00:16:17.040 --> 00:16:20.150 align:start position:0% homomorphic properties these additive properties<00:16:17.490> are<00:16:17.820> still<00:16:18.420> preserved<00:16:18.780> so<00:16:19.680> I<00:16:19.980> can 00:16:20.150 --> 00:16:20.160 align:start position:0% properties are still preserved so I can 00:16:20.160 --> 00:16:23.600 align:start position:0% properties are still preserved so I can give<00:16:20.310> you<00:16:20.490> a<00:16:21.060> commitment<00:16:21.840> to<00:16:21.930> integer<00:16:22.320> 3<00:16:23.220> and<00:16:23.490> I 00:16:23.600 --> 00:16:23.610 align:start position:0% give you a commitment to integer 3 and I 00:16:23.610 --> 00:16:25.700 align:start position:0% give you a commitment to integer 3 and I 1<00:16:23.820> to<00:16:23.970> 4<00:16:24.270> and<00:16:24.510> then<00:16:24.660> if<00:16:24.900> I<00:16:25.080> add<00:16:25.230> these<00:16:25.470> things 00:16:25.700 --> 00:16:25.710 align:start position:0% 1 to 4 and then if I add these things 00:16:25.710 --> 00:16:30.230 align:start position:0% 1 to 4 and then if I add these things then<00:16:25.980> I<00:16:26.040> get<00:16:26.220> a<00:16:26.250> commitment<00:16:26.580> to<00:16:28.160> 7<00:16:29.160> right<00:16:29.970> and 00:16:30.230 --> 00:16:30.240 align:start position:0% then I get a commitment to 7 right and 00:16:30.240 --> 00:16:33.320 align:start position:0% then I get a commitment to 7 right and so<00:16:31.080> what<00:16:31.830> I<00:16:31.860> can<00:16:31.980> do<00:16:32.220> now<00:16:32.430> to<00:16:32.670> commit<00:16:33.090> to<00:16:33.210> my 00:16:33.320 --> 00:16:33.330 align:start position:0% so what I can do now to commit to my 00:16:33.330 --> 00:16:36.800 align:start position:0% so what I can do now to commit to my polynomials<00:16:33.930> I<00:16:34.760> lift<00:16:35.760> it<00:16:35.940> to<00:16:36.060> the<00:16:36.150> integers<00:16:36.540> I 00:16:36.800 --> 00:16:36.810 align:start position:0% polynomials I lift it to the integers I 00:16:36.810 --> 00:16:39.080 align:start position:0% polynomials I lift it to the integers I evaluated<00:16:37.590> at<00:16:37.710> Pew<00:16:37.980> and<00:16:38.220> then<00:16:38.340> I<00:16:38.370> compute<00:16:38.760> G<00:16:38.970> to 00:16:39.080 --> 00:16:39.090 align:start position:0% evaluated at Pew and then I compute G to 00:16:39.090 --> 00:16:41.540 align:start position:0% evaluated at Pew and then I compute G to the<00:16:39.210> F<00:16:39.300> of<00:16:39.450> Q<00:16:39.600> so<00:16:40.500> now<00:16:40.650> I<00:16:40.680> have<00:16:40.950> a<00:16:41.010> way<00:16:41.190> and<00:16:41.460> then 00:16:41.540 --> 00:16:41.550 align:start position:0% the F of Q so now I have a way and then 00:16:41.550 --> 00:16:43.190 align:start position:0% the F of Q so now I have a way and then I<00:16:41.700> can<00:16:41.880> still<00:16:42.090> do<00:16:42.270> all<00:16:42.300> of<00:16:42.540> these<00:16:42.750> additive 00:16:43.190 --> 00:16:43.200 align:start position:0% I can still do all of these additive 00:16:43.200 --> 00:16:45.920 align:start position:0% I can still do all of these additive operations<00:16:43.770> up<00:16:44.190> to<00:16:44.490> a<00:16:44.520> certain<00:16:44.730> amount<00:16:44.930> so 00:16:45.920 --> 00:16:45.930 align:start position:0% operations up to a certain amount so 00:16:45.930 --> 00:16:48.500 align:start position:0% operations up to a certain amount so this<00:16:46.740> is<00:16:46.920> the<00:16:47.040> way<00:16:47.160> that<00:16:47.340> we<00:16:47.520> commit<00:16:48.060> to<00:16:48.300> the 00:16:48.500 --> 00:16:48.510 align:start position:0% this is the way that we commit to the 00:16:48.510 --> 00:16:50.210 align:start position:0% this is the way that we commit to the polynomial<00:16:49.050> and<00:16:49.230> this<00:16:49.530> is<00:16:49.680> the<00:16:49.830> main<00:16:50.040> tool 00:16:50.210 --> 00:16:50.220 align:start position:0% polynomial and this is the main tool 00:16:50.220 --> 00:16:52.760 align:start position:0% polynomial and this is the main tool that<00:16:50.430> will<00:16:50.580> you<00:16:50.760> that<00:16:51.120> we're<00:16:51.270> using<00:16:51.450> and<00:16:51.770> then 00:16:52.760 --> 00:16:52.770 align:start position:0% that will you that we're using and then 00:16:52.770 --> 00:16:54.560 align:start position:0% that will you that we're using and then so<00:16:53.460> what<00:16:53.640> are<00:16:53.760> these<00:16:53.850> groups<00:16:54.120> of<00:16:54.300> unknown 00:16:54.560 --> 00:16:54.570 align:start position:0% so what are these groups of unknown 00:16:54.570 --> 00:16:57.260 align:start position:0% so what are these groups of unknown order<00:16:55.100> well<00:16:56.100> you<00:16:56.580> know<00:16:56.700> there's<00:16:56.970> there's 00:16:57.260 --> 00:16:57.270 align:start position:0% order well you know there's there's 00:16:57.270 --> 00:16:59.270 align:start position:0% order well you know there's there's different<00:16:57.480> ones<00:16:57.780> but<00:16:58.230> one<00:16:58.500> that<00:16:58.680> you<00:16:58.830> could 00:16:59.270 --> 00:16:59.280 align:start position:0% different ones but one that you could 00:16:59.280 --> 00:17:02.150 align:start position:0% different ones but one that you could use<00:16:59.490> is<00:16:59.730> this<00:16:59.940> class<00:17:00.240> groups<00:17:00.540> which<00:17:01.040> you<00:17:02.040> know 00:17:02.150 --> 00:17:02.160 align:start position:0% use is this class groups which you know 00:17:02.160 --> 00:17:03.710 align:start position:0% use is this class groups which you know in<00:17:02.400> general<00:17:02.610> cryptography<00:17:03.360> is<00:17:03.420> it's 00:17:03.710 --> 00:17:03.720 align:start position:0% in general cryptography is it's 00:17:03.720 --> 00:17:06.470 align:start position:0% in general cryptography is it's important<00:17:04.140> to<00:17:04.260> think<00:17:04.770> about<00:17:05.130> abstractions<00:17:05.790> so 00:17:06.470 --> 00:17:06.480 align:start position:0% important to think about abstractions so 00:17:06.480 --> 00:17:07.430 align:start position:0% important to think about abstractions so don't<00:17:06.780> go<00:17:06.959> look 00:17:07.430 --> 00:17:07.440 align:start position:0% don't go look 00:17:07.440 --> 00:17:08.930 align:start position:0% don't go look class<00:17:07.770> groups<00:17:08.040> it's<00:17:08.220> not<00:17:08.400> worth<00:17:08.550> your<00:17:08.760> time 00:17:08.930 --> 00:17:08.940 align:start position:0% class groups it's not worth your time 00:17:08.940 --> 00:17:11.770 align:start position:0% class groups it's not worth your time right<00:17:09.300> like<00:17:09.840> just<00:17:10.110> use<00:17:10.740> them<00:17:10.920> as<00:17:11.010> a<00:17:11.070> tool<00:17:11.310> and 00:17:11.770 --> 00:17:11.780 align:start position:0% right like just use them as a tool and 00:17:11.780 --> 00:17:15.040 align:start position:0% right like just use them as a tool and but<00:17:12.780> there<00:17:13.260> are<00:17:13.410> a<00:17:13.440> group<00:17:13.920> of<00:17:14.100> unknown<00:17:14.250> order 00:17:15.040 --> 00:17:15.050 align:start position:0% but there are a group of unknown order 00:17:15.050 --> 00:17:17.930 align:start position:0% but there are a group of unknown order and<00:17:16.050> so<00:17:16.620> we<00:17:16.740> believe<00:17:16.890> that<00:17:17.040> computing<00:17:17.850> the 00:17:17.930 --> 00:17:17.940 align:start position:0% and so we believe that computing the 00:17:17.940 --> 00:17:19.220 align:start position:0% and so we believe that computing the order<00:17:18.150> is<00:17:18.210> hard<00:17:18.420> we<00:17:18.600> believe<00:17:18.840> that<00:17:18.990> taking 00:17:19.220 --> 00:17:19.230 align:start position:0% order is hard we believe that taking 00:17:19.230 --> 00:17:21.230 align:start position:0% order is hard we believe that taking routes<00:17:19.530> is<00:17:19.710> hard<00:17:19.890> and<00:17:20.040> most<00:17:20.550> importantly<00:17:21.090> they 00:17:21.230 --> 00:17:21.240 align:start position:0% routes is hard and most importantly they 00:17:21.240 --> 00:17:23.660 align:start position:0% routes is hard and most importantly they do<00:17:21.300> not<00:17:21.690> require<00:17:21.930> a<00:17:22.140> trusted<00:17:22.590> set<00:17:22.740> up<00:17:22.860> so<00:17:23.400> I<00:17:23.430> can 00:17:23.660 --> 00:17:23.670 align:start position:0% do not require a trusted set up so I can 00:17:23.670 --> 00:17:25.250 align:start position:0% do not require a trusted set up so I can generate<00:17:23.880> this<00:17:24.210> group<00:17:24.450> I<00:17:24.630> only<00:17:24.780> need<00:17:25.020> to<00:17:25.110> do<00:17:25.230> it 00:17:25.250 --> 00:17:25.260 align:start position:0% generate this group I only need to do it 00:17:25.260 --> 00:17:27.980 align:start position:0% generate this group I only need to do it once<00:17:25.590> and<00:17:26.300> it<00:17:27.300> doesn't<00:17:27.600> have<00:17:27.720> to<00:17:27.780> have<00:17:27.960> a 00:17:27.980 --> 00:17:27.990 align:start position:0% once and it doesn't have to have a 00:17:27.990 --> 00:17:30.950 align:start position:0% once and it doesn't have to have a trusted<00:17:28.230> set<00:17:28.560> up<00:17:29.030> and<00:17:30.030> they're<00:17:30.450> a<00:17:30.480> little<00:17:30.690> bit 00:17:30.950 --> 00:17:30.960 align:start position:0% trusted set up and they're a little bit 00:17:30.960 --> 00:17:32.630 align:start position:0% trusted set up and they're a little bit you<00:17:31.170> know<00:17:31.260> compared<00:17:31.710> to<00:17:31.770> say<00:17:32.010> elliptic<00:17:32.430> curse 00:17:32.630 --> 00:17:32.640 align:start position:0% you know compared to say elliptic curse 00:17:32.640 --> 00:17:36.800 align:start position:0% you know compared to say elliptic curse which<00:17:33.630> by<00:17:33.930> the<00:17:33.990> way<00:17:34.160> elliptic<00:17:35.160> curves<00:17:35.480> are<00:17:36.480> not 00:17:36.800 --> 00:17:36.810 align:start position:0% which by the way elliptic curves are not 00:17:36.810 --> 00:17:39.440 align:start position:0% which by the way elliptic curves are not an<00:17:36.990> integer<00:17:37.260> commitment<00:17:37.890> because<00:17:38.490> I<00:17:39.030> do<00:17:39.090> know 00:17:39.440 --> 00:17:39.450 align:start position:0% an integer commitment because I do know 00:17:39.450 --> 00:17:41.480 align:start position:0% an integer commitment because I do know the<00:17:39.660> order<00:17:39.960> so<00:17:40.320> you<00:17:40.680> know<00:17:40.770> if<00:17:40.860> I<00:17:40.980> commit<00:17:41.280> to 00:17:41.480 --> 00:17:41.490 align:start position:0% the order so you know if I commit to 00:17:41.490 --> 00:17:43.760 align:start position:0% the order so you know if I commit to some<00:17:41.880> large<00:17:42.090> integer<00:17:42.540> I<00:17:42.690> can<00:17:42.870> reduce<00:17:43.200> it<00:17:43.410> mod 00:17:43.760 --> 00:17:43.770 align:start position:0% some large integer I can reduce it mod 00:17:43.770 --> 00:17:46.310 align:start position:0% some large integer I can reduce it mod these<00:17:44.160> so-called<00:17:44.790> order<00:17:45.210> of<00:17:45.300> the<00:17:45.420> group<00:17:45.540> but 00:17:46.310 --> 00:17:46.320 align:start position:0% these so-called order of the group but 00:17:46.320 --> 00:17:48.050 align:start position:0% these so-called order of the group but the<00:17:47.070> problem<00:17:47.340> is<00:17:47.400> that<00:17:47.550> these<00:17:47.670> groups<00:17:47.910> have 00:17:48.050 --> 00:17:48.060 align:start position:0% the problem is that these groups have 00:17:48.060 --> 00:17:49.700 align:start position:0% the problem is that these groups have unknown<00:17:48.300> order<00:17:48.570> to<00:17:48.720> be<00:17:48.840> secured<00:17:49.200> they<00:17:49.410> need<00:17:49.590> to 00:17:49.700 --> 00:17:49.710 align:start position:0% unknown order to be secured they need to 00:17:49.710 --> 00:17:52.130 align:start position:0% unknown order to be secured they need to be<00:17:49.800> quite<00:17:50.100> large<00:17:50.280> but<00:17:50.730> that's<00:17:51.630> unfortunately 00:17:52.130 --> 00:17:52.140 align:start position:0% be quite large but that's unfortunately 00:17:52.140 --> 00:17:55.760 align:start position:0% be quite large but that's unfortunately something<00:17:52.290> that<00:17:52.740> we<00:17:52.920> have<00:17:53.040> to<00:17:53.250> deal<00:17:53.700> with<00:17:54.770> so 00:17:55.760 --> 00:17:55.770 align:start position:0% something that we have to deal with so 00:17:55.770 --> 00:17:57.620 align:start position:0% something that we have to deal with so how<00:17:56.130> do<00:17:56.190> we<00:17:56.370> build<00:17:56.520> a<00:17:56.670> polynomial<00:17:57.180> commitment 00:17:57.620 --> 00:17:57.630 align:start position:0% how do we build a polynomial commitment 00:17:57.630 --> 00:17:59.990 align:start position:0% how do we build a polynomial commitment so<00:17:58.140> let's<00:17:58.740> think<00:17:58.890> of<00:17:59.070> this<00:17:59.190> again<00:17:59.520> just<00:17:59.820> you 00:17:59.990 --> 00:18:00.000 align:start position:0% so let's think of this again just you 00:18:00.000 --> 00:18:02.120 align:start position:0% so let's think of this again just you know<00:18:00.120> in<00:18:00.270> terms<00:18:00.480> of<00:18:00.710> polynomials<00:18:01.710> so<00:18:01.950> what<00:18:02.100> I 00:18:02.120 --> 00:18:02.130 align:start position:0% know in terms of polynomials so what I 00:18:02.130 --> 00:18:03.620 align:start position:0% know in terms of polynomials so what I want<00:18:02.340> to<00:18:02.400> do<00:18:02.520> is<00:18:02.670> I<00:18:02.820> have<00:18:02.910> a<00:18:03.000> polynomial<00:18:03.270> of 00:18:03.620 --> 00:18:03.630 align:start position:0% want to do is I have a polynomial of 00:18:03.630 --> 00:18:06.200 align:start position:0% want to do is I have a polynomial of degree<00:18:03.690> D<00:18:04.590> so<00:18:05.130> with<00:18:05.280> deep<00:18:05.460> terms<00:18:05.760> so<00:18:05.940> it's<00:18:06.090> as 00:18:06.200 --> 00:18:06.210 align:start position:0% degree D so with deep terms so it's as 00:18:06.210 --> 00:18:09.260 align:start position:0% degree D so with deep terms so it's as large<00:18:06.330> polynomial<00:18:06.960> and<00:18:07.110> then<00:18:08.040> we're<00:18:08.970> going<00:18:09.120> to 00:18:09.260 --> 00:18:09.270 align:start position:0% large polynomial and then we're going to 00:18:09.270 --> 00:18:12.170 align:start position:0% large polynomial and then we're going to use<00:18:09.420> recursion<00:18:09.600> so<00:18:10.470> to<00:18:11.190> reuse<00:18:11.700> recursion 00:18:12.170 --> 00:18:12.180 align:start position:0% use recursion so to reuse recursion 00:18:12.180 --> 00:18:14.150 align:start position:0% use recursion so to reuse recursion we'll<00:18:12.540> split<00:18:12.870> it<00:18:13.050> up<00:18:13.140> into<00:18:13.350> two<00:18:13.560> parts<00:18:13.770> the 00:18:14.150 --> 00:18:14.160 align:start position:0% we'll split it up into two parts the 00:18:14.160 --> 00:18:16.520 align:start position:0% we'll split it up into two parts the left<00:18:14.580> half<00:18:14.820> and<00:18:14.940> the<00:18:15.030> right<00:18:15.090> half<00:18:15.270> so<00:18:15.960> F<00:18:16.080> L<00:18:16.260> of<00:18:16.380> X 00:18:16.520 --> 00:18:16.530 align:start position:0% left half and the right half so F L of X 00:18:16.530 --> 00:18:19.550 align:start position:0% left half and the right half so F L of X and<00:18:16.740> f<00:18:16.830> of<00:18:16.950> X<00:18:17.160> such<00:18:18.030> that<00:18:18.060> F<00:18:18.420> L<00:18:18.570> of<00:18:18.720> X<00:18:18.900> plus<00:18:19.230> X<00:18:19.440> to 00:18:19.550 --> 00:18:19.560 align:start position:0% and f of X such that F L of X plus X to 00:18:19.560 --> 00:18:21.770 align:start position:0% and f of X such that F L of X plus X to the<00:18:19.620> D<00:18:19.680> over<00:18:19.950> 2<00:18:19.980> times<00:18:20.460> f<00:18:20.580> of<00:18:20.730> X<00:18:20.970> is<00:18:21.180> equal<00:18:21.330> to<00:18:21.630> f 00:18:21.770 --> 00:18:21.780 align:start position:0% the D over 2 times f of X is equal to f 00:18:21.780 --> 00:18:25.580 align:start position:0% the D over 2 times f of X is equal to f of<00:18:21.930> X<00:18:22.460> the<00:18:23.460> proven<00:18:23.850> then<00:18:24.030> sense<00:18:24.570> F<00:18:24.840> L<00:18:25.020> of<00:18:25.140> X<00:18:25.320> and 00:18:25.580 --> 00:18:25.590 align:start position:0% of X the proven then sense F L of X and 00:18:25.590 --> 00:18:28.670 align:start position:0% of X the proven then sense F L of X and f<00:18:25.710> of<00:18:25.800> X<00:18:26.040> to<00:18:26.280> the<00:18:26.370> verifier<00:18:26.780> the<00:18:27.780> verify<00:18:28.170> checks 00:18:28.670 --> 00:18:28.680 align:start position:0% f of X to the verifier the verify checks 00:18:28.680 --> 00:18:30.740 align:start position:0% f of X to the verifier the verify checks that<00:18:28.920> this<00:18:29.100> equation<00:18:29.430> holds<00:18:29.820> right<00:18:30.390> checks 00:18:30.740 --> 00:18:30.750 align:start position:0% that this equation holds right checks 00:18:30.750 --> 00:18:33.680 align:start position:0% that this equation holds right checks that<00:18:30.900> f<00:18:31.050> of<00:18:31.170> X<00:18:31.350> is<00:18:31.470> equal<00:18:31.620> to<00:18:31.860> this<00:18:32.450> using<00:18:33.450> again 00:18:33.680 --> 00:18:33.690 align:start position:0% that f of X is equal to this using again 00:18:33.690 --> 00:18:35.800 align:start position:0% that f of X is equal to this using again in<00:18:33.870> the<00:18:33.960> end<00:18:34.080> this<00:18:34.260> will<00:18:34.440> use<00:18:34.770> the<00:18:35.040> this 00:18:35.800 --> 00:18:35.810 align:start position:0% in the end this will use the this 00:18:35.810 --> 00:18:39.470 align:start position:0% in the end this will use the this homomorphisms<00:18:36.900> and<00:18:37.520> then<00:18:38.520> the<00:18:38.700> verify<00:18:39.060> sends 00:18:39.470 --> 00:18:39.480 align:start position:0% homomorphisms and then the verify sends 00:18:39.480 --> 00:18:41.330 align:start position:0% homomorphisms and then the verify sends a<00:18:39.570> random<00:18:40.050> challenge<00:18:40.470> so<00:18:40.830> this<00:18:40.950> is<00:18:41.040> a<00:18:41.100> random 00:18:41.330 --> 00:18:41.340 align:start position:0% a random challenge so this is a random 00:18:41.340 --> 00:18:45.200 align:start position:0% a random challenge so this is a random alpha<00:18:41.910> and<00:18:42.440> then<00:18:43.440> the<00:18:43.770> prover<00:18:44.400> combines<00:18:44.880> these 00:18:45.200 --> 00:18:45.210 align:start position:0% alpha and then the prover combines these 00:18:45.210 --> 00:18:47.600 align:start position:0% alpha and then the prover combines these two<00:18:45.660> polynomials<00:18:45.990> just<00:18:46.650> using<00:18:47.100> the<00:18:47.220> linear 00:18:47.600 --> 00:18:47.610 align:start position:0% two polynomials just using the linear 00:18:47.610 --> 00:18:50.900 align:start position:0% two polynomials just using the linear combination<00:18:48.270> F<00:18:48.510> L<00:18:48.810> plus<00:18:49.170> alpha<00:18:49.800> times<00:18:49.950> f<00:18:50.220> of<00:18:50.310> X 00:18:50.900 --> 00:18:50.910 align:start position:0% combination F L plus alpha times f of X 00:18:50.910 --> 00:18:53.900 align:start position:0% combination F L plus alpha times f of X and<00:18:51.180> this<00:18:51.930> gives<00:18:52.170> us<00:18:52.380> you<00:18:52.800> know<00:18:52.920> F<00:18:53.130> prime<00:18:53.610> of<00:18:53.640> X 00:18:53.900 --> 00:18:53.910 align:start position:0% and this gives us you know F prime of X 00:18:53.910 --> 00:18:58.070 align:start position:0% and this gives us you know F prime of X and<00:18:54.410> importantly<00:18:55.410> now<00:18:55.680> after<00:18:56.220> these<00:18:56.370> this<00:18:57.150> one 00:18:58.070 --> 00:18:58.080 align:start position:0% and importantly now after these this one 00:18:58.080 --> 00:19:00.380 align:start position:0% and importantly now after these this one step<00:18:58.410> we<00:18:59.130> now<00:18:59.310> have<00:18:59.580> a<00:18:59.610> polynomial<00:19:00.300> of<00:19:00.330> degree 00:19:00.380 --> 00:19:00.390 align:start position:0% step we now have a polynomial of degree 00:19:00.390 --> 00:19:02.870 align:start position:0% step we now have a polynomial of degree D<00:19:00.840> over<00:19:01.050> 2<00:19:01.200> so<00:19:01.620> we<00:19:01.830> reduce<00:19:02.070> something<00:19:02.490> from 00:19:02.870 --> 00:19:02.880 align:start position:0% D over 2 so we reduce something from 00:19:02.880 --> 00:19:05.270 align:start position:0% D over 2 so we reduce something from degree<00:19:03.150> D<00:19:03.330> to<00:19:03.930> something<00:19:04.260> to<00:19:04.350> a<00:19:04.380> degree<00:19:04.680> over<00:19:04.710> D 00:19:05.270 --> 00:19:05.280 align:start position:0% degree D to something to a degree over D 00:19:05.280 --> 00:19:08.540 align:start position:0% degree D to something to a degree over D over<00:19:05.490> 2<00:19:05.520> and<00:19:05.910> then<00:19:06.540> we<00:19:06.720> can<00:19:06.870> just<00:19:07.020> repeat<00:19:07.550> right 00:19:08.540 --> 00:19:08.550 align:start position:0% over 2 and then we can just repeat right 00:19:08.550 --> 00:19:11.750 align:start position:0% over 2 and then we can just repeat right and<00:19:09.560> if<00:19:10.560> you<00:19:10.680> do<00:19:10.800> the<00:19:10.920> math<00:19:11.040> and<00:19:11.220> you<00:19:11.310> have<00:19:11.460> how 00:19:11.750 --> 00:19:11.760 align:start position:0% and if you do the math and you have how 00:19:11.760 --> 00:19:14.150 align:start position:0% and if you do the math and you have how often<00:19:11.940> do<00:19:12.120> we<00:19:12.180> need<00:19:12.360> to<00:19:12.480> repeat<00:19:12.990> well<00:19:13.350> we<00:19:14.010> need 00:19:14.150 --> 00:19:14.160 align:start position:0% often do we need to repeat well we need 00:19:14.160 --> 00:19:17.600 align:start position:0% often do we need to repeat well we need to<00:19:14.280> repeat<00:19:14.610> log<00:19:15.360> 2<00:19:15.720> of<00:19:16.110> D<00:19:16.440> times<00:19:16.680> so<00:19:17.310> say<00:19:17.460> the 00:19:17.600 --> 00:19:17.610 align:start position:0% to repeat log 2 of D times so say the 00:19:17.610 --> 00:19:19.940 align:start position:0% to repeat log 2 of D times so say the polynomials<00:19:18.120> of<00:19:18.180> degree<00:19:18.240> a<00:19:18.690> million<00:19:19.230> we<00:19:19.800> need 00:19:19.940 --> 00:19:19.950 align:start position:0% polynomials of degree a million we need 00:19:19.950 --> 00:19:21.379 align:start position:0% polynomials of degree a million we need to<00:19:20.010> repeat<00:19:20.310> 22 00:19:21.379 --> 00:19:21.389 align:start position:0% to repeat 22 00:19:21.389 --> 00:19:23.749 align:start position:0% to repeat 22 degree<00:19:22.019> a<00:19:22.049> billion<00:19:22.470> we<00:19:22.710> need<00:19:22.860> to<00:19:22.950> repeat<00:19:23.220> 30 00:19:23.749 --> 00:19:23.759 align:start position:0% degree a billion we need to repeat 30 00:19:23.759 --> 00:19:28.340 align:start position:0% degree a billion we need to repeat 30 times<00:19:24.889> so<00:19:26.120> of<00:19:27.120> course<00:19:27.330> we<00:19:27.659> cannot<00:19:27.960> send<00:19:28.169> these 00:19:28.340 --> 00:19:28.350 align:start position:0% times so of course we cannot send these 00:19:28.350 --> 00:19:29.989 align:start position:0% times so of course we cannot send these photo<00:19:28.559> moments<00:19:28.740> in<00:19:28.980> the<00:19:29.039> clear<00:19:29.340> so<00:19:29.669> what<00:19:29.850> we're 00:19:29.989 --> 00:19:29.999 align:start position:0% photo moments in the clear so what we're 00:19:29.999 --> 00:19:31.879 align:start position:0% photo moments in the clear so what we're going<00:19:30.120> to<00:19:30.240> do<00:19:30.419> we<00:19:30.749> really<00:19:31.259> send<00:19:31.559> you<00:19:31.769> know 00:19:31.879 --> 00:19:31.889 align:start position:0% going to do we really send you know 00:19:31.889 --> 00:19:34.549 align:start position:0% going to do we really send you know these<00:19:32.039> these<00:19:32.399> encoding<00:19:33.029> right<00:19:33.330> again<00:19:34.049> we 00:19:34.549 --> 00:19:34.559 align:start position:0% these these encoding right again we 00:19:34.559 --> 00:19:36.710 align:start position:0% these these encoding right again we evaluate<00:19:35.129> the<00:19:35.220> polynomial<00:19:35.460> Q<00:19:35.970> we<00:19:36.269> raise<00:19:36.480> it<00:19:36.629> to 00:19:36.710 --> 00:19:36.720 align:start position:0% evaluate the polynomial Q we raise it to 00:19:36.720 --> 00:19:40.789 align:start position:0% evaluate the polynomial Q we raise it to the<00:19:36.749> power<00:19:36.870> and<00:19:37.200> so<00:19:37.350> on<00:19:37.470> and<00:19:37.620> so<00:19:37.679> forth<00:19:37.860> but<00:19:39.799> you 00:19:40.789 --> 00:19:40.799 align:start position:0% the power and so on and so forth but you 00:19:40.799 --> 00:19:41.899 align:start position:0% the power and so on and so forth but you know<00:19:40.889> it's<00:19:41.009> it's<00:19:41.159> important<00:19:41.580> to<00:19:41.639> think<00:19:41.789> about 00:19:41.899 --> 00:19:41.909 align:start position:0% know it's it's important to think about 00:19:41.909 --> 00:19:44.539 align:start position:0% know it's it's important to think about this<00:19:42.320> interactive<00:19:43.320> thing<00:19:43.470> but<00:19:43.950> I<00:19:43.980> also<00:19:44.220> want 00:19:44.539 --> 00:19:44.549 align:start position:0% this interactive thing but I also want 00:19:44.549 --> 00:19:46.279 align:start position:0% this interactive thing but I also want to<00:19:44.610> evaluate<00:19:45.029> the<00:19:45.480> polynomial<00:19:45.659> at<00:19:46.049> a<00:19:46.110> point 00:19:46.279 --> 00:19:46.289 align:start position:0% to evaluate the polynomial at a point 00:19:46.289 --> 00:19:48.950 align:start position:0% to evaluate the polynomial at a point right<00:19:46.620> this<00:19:46.830> doesn't<00:19:47.070> you<00:19:47.519> know<00:19:47.779> there's<00:19:48.779> no 00:19:48.950 --> 00:19:48.960 align:start position:0% right this doesn't you know there's no 00:19:48.960 --> 00:19:51.259 align:start position:0% right this doesn't you know there's no evaluation<00:19:49.440> here<00:19:50.129> so<00:19:50.519> what<00:19:50.909> I'm<00:19:50.999> going<00:19:51.179> to 00:19:51.259 --> 00:19:51.269 align:start position:0% evaluation here so what I'm going to 00:19:51.269 --> 00:19:53.899 align:start position:0% evaluation here so what I'm going to give<00:19:51.480> you<00:19:51.720> is<00:19:52.350> additionally<00:19:53.190> I'll<00:19:53.460> give<00:19:53.730> you 00:19:53.899 --> 00:19:53.909 align:start position:0% give you is additionally I'll give you 00:19:53.909 --> 00:19:56.080 align:start position:0% give you is additionally I'll give you you<00:19:54.119> know<00:19:54.240> I'll<00:19:54.929> claim<00:19:55.289> that<00:19:55.499> the<00:19:55.619> polynomial 00:19:56.080 --> 00:19:56.090 align:start position:0% you know I'll claim that the polynomial 00:19:56.090 --> 00:19:59.060 align:start position:0% you know I'll claim that the polynomial evaluated<00:19:57.090> that<00:19:57.299> Z<00:19:57.539> mod<00:19:57.749> P<00:19:57.960> is<00:19:58.080> equal<00:19:58.379> to<00:19:58.499> Y<00:19:58.649> and 00:19:59.060 --> 00:19:59.070 align:start position:0% evaluated that Z mod P is equal to Y and 00:19:59.070 --> 00:20:01.580 align:start position:0% evaluated that Z mod P is equal to Y and then<00:19:59.850> basically<00:20:00.240> in<00:20:00.539> parallel<00:20:01.049> to<00:20:01.230> sending 00:20:01.580 --> 00:20:01.590 align:start position:0% then basically in parallel to sending 00:20:01.590 --> 00:20:03.470 align:start position:0% then basically in parallel to sending these<00:20:01.740> things<00:20:02.009> I<00:20:02.220> always<00:20:02.399> also<00:20:02.730> send<00:20:03.149> you<00:20:03.269> you 00:20:03.470 --> 00:20:03.480 align:start position:0% these things I always also send you you 00:20:03.480 --> 00:20:07.279 align:start position:0% these things I always also send you you know<00:20:03.570> if<00:20:04.230> L<00:20:04.470> of<00:20:04.619> Z<00:20:04.769> in<00:20:05.220> Z<00:20:05.730> P<00:20:05.940> and<00:20:06.269> F<00:20:06.389> R<00:20:06.659> of<00:20:06.809> Z<00:20:06.960> and<00:20:07.110> Z 00:20:07.279 --> 00:20:07.289 align:start position:0% know if L of Z in Z P and F R of Z and Z 00:20:07.289 --> 00:20:10.759 align:start position:0% know if L of Z in Z P and F R of Z and Z P<00:20:07.499> and<00:20:07.919> these<00:20:08.460> things<00:20:08.700> are<00:20:08.909> constant<00:20:09.899> size<00:20:10.080> so 00:20:10.759 --> 00:20:10.769 align:start position:0% P and these things are constant size so 00:20:10.769 --> 00:20:12.680 align:start position:0% P and these things are constant size so these<00:20:10.950> things<00:20:11.220> are<00:20:11.429> small<00:20:11.700> and<00:20:11.999> you<00:20:12.509> can 00:20:12.680 --> 00:20:12.690 align:start position:0% these things are small and you can 00:20:12.690 --> 00:20:16.430 align:start position:0% these things are small and you can efficiently<00:20:13.049> check<00:20:14.570> and<00:20:15.570> then<00:20:15.720> again<00:20:16.110> you<00:20:16.289> can 00:20:16.430 --> 00:20:16.440 align:start position:0% efficiently check and then again you can 00:20:16.440 --> 00:20:18.080 align:start position:0% efficiently check and then again you can efficiently<00:20:16.830> you<00:20:17.039> know<00:20:17.159> check<00:20:17.429> this<00:20:17.639> equation 00:20:18.080 --> 00:20:18.090 align:start position:0% efficiently you know check this equation 00:20:18.090 --> 00:20:21.739 align:start position:0% efficiently you know check this equation right<00:20:18.330> so<00:20:18.600> this<00:20:19.049> would<00:20:19.259> be<00:20:19.409> yl<00:20:20.070> +<00:20:20.429> Z<00:20:21.210> to<00:20:21.240> the<00:20:21.480> D 00:20:21.739 --> 00:20:21.749 align:start position:0% right so this would be yl + Z to the D 00:20:21.749 --> 00:20:26.749 align:start position:0% right so this would be yl + Z to the D over<00:20:21.990> 2<00:20:22.019> is<00:20:22.710> equal<00:20:23.279> to<00:20:23.309> yr<00:20:24.559> plus<00:20:25.559> yr<00:20:25.769> x<00:20:26.220> yr<00:20:26.460> is 00:20:26.749 --> 00:20:26.759 align:start position:0% over 2 is equal to yr plus yr x yr is 00:20:26.759 --> 00:20:28.899 align:start position:0% over 2 is equal to yr plus yr x yr is equal<00:20:27.029> to<00:20:27.119> Y<00:20:27.269> so<00:20:27.929> I<00:20:27.960> can<00:20:28.169> check<00:20:28.379> this<00:20:28.559> equation 00:20:28.899 --> 00:20:28.909 align:start position:0% equal to Y so I can check this equation 00:20:28.909 --> 00:20:31.519 align:start position:0% equal to Y so I can check this equation both<00:20:29.909> for<00:20:30.210> the<00:20:30.299> polynomials<00:20:30.899> and<00:20:31.080> for<00:20:31.440> the 00:20:31.519 --> 00:20:31.529 align:start position:0% both for the polynomials and for the 00:20:31.529 --> 00:20:34.700 align:start position:0% both for the polynomials and for the evaluation<00:20:32.119> very<00:20:33.119> efficiently<00:20:33.570> and<00:20:33.809> then<00:20:34.409> I 00:20:34.700 --> 00:20:34.710 align:start position:0% evaluation very efficiently and then I 00:20:34.710 --> 00:20:37.340 align:start position:0% evaluation very efficiently and then I can<00:20:35.429> compute<00:20:35.820> my<00:20:36.029> Y<00:20:36.179> Prime<00:20:36.509> and<00:20:36.809> the<00:20:36.960> last 00:20:37.340 --> 00:20:37.350 align:start position:0% can compute my Y Prime and the last 00:20:37.350 --> 00:20:39.919 align:start position:0% can compute my Y Prime and the last round<00:20:37.619> I<00:20:37.740> compute<00:20:38.100> my<00:20:38.129> Y<00:20:38.340> prime<00:20:38.899> which<00:20:39.899> is 00:20:39.919 --> 00:20:39.929 align:start position:0% round I compute my Y prime which is 00:20:39.929 --> 00:20:43.730 align:start position:0% round I compute my Y prime which is equal<00:20:40.200> to<00:20:40.470> F<00:20:40.619> prime<00:20:40.649> of<00:20:41.100> Z<00:20:42.230> which<00:20:43.230> is<00:20:43.259> equal<00:20:43.440> to 00:20:43.730 --> 00:20:43.740 align:start position:0% equal to F prime of Z which is equal to 00:20:43.740 --> 00:20:47.659 align:start position:0% equal to F prime of Z which is equal to Y<00:20:43.919> L<00:20:44.129> plus<00:20:44.399> alpha<00:20:44.700> times<00:20:44.820> y<00:20:45.059> ax<00:20:45.090> sorry<00:20:46.669> maybe 00:20:47.659 --> 00:20:47.669 align:start position:0% Y L plus alpha times y ax sorry maybe 00:20:47.669 --> 00:20:49.070 align:start position:0% Y L plus alpha times y ax sorry maybe that<00:20:47.879> was<00:20:47.999> a<00:20:48.029> little<00:20:48.179> bit<00:20:48.330> too<00:20:48.419> fast<00:20:48.600> but<00:20:48.869> it 00:20:49.070 --> 00:20:49.080 align:start position:0% that was a little bit too fast but it 00:20:49.080 --> 00:20:52.580 align:start position:0% that was a little bit too fast but it turns<00:20:49.289> out<00:20:49.440> that<00:20:49.499> basically<00:20:50.309> you<00:20:50.940> know<00:20:51.029> I<00:20:51.590> send 00:20:52.580 --> 00:20:52.590 align:start position:0% turns out that basically you know I send 00:20:52.590 --> 00:20:54.169 align:start position:0% turns out that basically you know I send you<00:20:52.679> these<00:20:52.799> polynomials<00:20:53.490> I<00:20:53.639> split<00:20:53.909> them<00:20:54.029> in 00:20:54.169 --> 00:20:54.179 align:start position:0% you these polynomials I split them in 00:20:54.179 --> 00:20:56.389 align:start position:0% you these polynomials I split them in half<00:20:54.210> take<00:20:55.049> a<00:20:55.080> random<00:20:55.289> linear<00:20:55.889> combination 00:20:56.389 --> 00:20:56.399 align:start position:0% half take a random linear combination 00:20:56.399 --> 00:20:58.580 align:start position:0% half take a random linear combination and<00:20:56.580> then<00:20:56.789> recurs<00:20:57.179> and<00:20:57.480> if<00:20:58.230> I<00:20:58.320> want<00:20:58.529> to 00:20:58.580 --> 00:20:58.590 align:start position:0% and then recurs and if I want to 00:20:58.590 --> 00:21:00.590 align:start position:0% and then recurs and if I want to evaluate<00:20:58.799> this<00:20:59.159> polynomial<00:20:59.369> I<00:20:59.940> also<00:21:00.179> do<00:21:00.389> this 00:21:00.590 --> 00:21:00.600 align:start position:0% evaluate this polynomial I also do this 00:21:00.600 --> 00:21:03.889 align:start position:0% evaluate this polynomial I also do this on<00:21:00.809> the<00:21:00.960> evaluation<00:21:01.590> and<00:21:02.269> then<00:21:03.269> in<00:21:03.480> the<00:21:03.570> final 00:21:03.889 --> 00:21:03.899 align:start position:0% on the evaluation and then in the final 00:21:03.899 --> 00:21:06.320 align:start position:0% on the evaluation and then in the final step<00:21:04.110> I<00:21:04.409> have<00:21:04.740> a<00:21:04.950> polynomial<00:21:05.309> which<00:21:05.730> is<00:21:05.850> just<00:21:06.090> a 00:21:06.320 --> 00:21:06.330 align:start position:0% step I have a polynomial which is just a 00:21:06.330 --> 00:21:08.299 align:start position:0% step I have a polynomial which is just a constant<00:21:06.720> degree<00:21:07.289> right<00:21:07.559> it's<00:21:07.799> just<00:21:07.889> a<00:21:08.129> single 00:21:08.299 --> 00:21:08.309 align:start position:0% constant degree right it's just a single 00:21:08.309 --> 00:21:11.739 align:start position:0% constant degree right it's just a single element<00:21:08.600> doesn't<00:21:09.600> have<00:21:09.840> an<00:21:09.960> X<00:21:10.139> term<00:21:10.379> anymore 00:21:11.739 --> 00:21:11.749 align:start position:0% element doesn't have an X term anymore 00:21:11.749 --> 00:21:13.940 align:start position:0% element doesn't have an X term anymore and<00:21:12.749> I<00:21:12.869> also<00:21:13.019> have<00:21:13.200> the<00:21:13.320> commitment<00:21:13.619> to<00:21:13.860> the 00:21:13.940 --> 00:21:13.950 align:start position:0% and I also have the commitment to the 00:21:13.950 --> 00:21:15.560 align:start position:0% and I also have the commitment to the polynomial<00:21:14.429> and<00:21:14.549> I<00:21:14.759> have<00:21:14.879> the<00:21:15.029> proposed 00:21:15.560 --> 00:21:15.570 align:start position:0% polynomial and I have the proposed 00:21:15.570 --> 00:21:17.869 align:start position:0% polynomial and I have the proposed evaluation<00:21:16.230> so<00:21:17.070> the<00:21:17.159> proof<00:21:17.309> which<00:21:17.460> is<00:21:17.490> since 00:21:17.869 --> 00:21:17.879 align:start position:0% evaluation so the proof which is since 00:21:17.879 --> 00:21:21.289 align:start position:0% evaluation so the proof which is since then<00:21:18.149> F<00:21:18.330> 0<00:21:18.690> in<00:21:18.960> the<00:21:19.110> clear<00:21:19.440> degrees<00:21:19.980> 0<00:21:20.220> and<00:21:20.490> the 00:21:21.289 --> 00:21:21.299 align:start position:0% then F 0 in the clear degrees 0 and the 00:21:21.299 --> 00:21:23.149 align:start position:0% then F 0 in the clear degrees 0 and the verified<00:21:21.720> checks<00:21:21.990> that<00:21:22.200> F<00:21:22.379> 0<00:21:22.409> is<00:21:22.769> a<00:21:22.830> small 00:21:23.149 --> 00:21:23.159 align:start position:0% verified checks that F 0 is a small 00:21:23.159 --> 00:21:27.259 align:start position:0% verified checks that F 0 is a small constant<00:21:23.700> and<00:21:24.110> that<00:21:25.110> C<00:21:25.679> is<00:21:25.860> equal<00:21:26.190> to<00:21:26.369> G<00:21:27.059> to<00:21:27.240> the 00:21:27.259 --> 00:21:27.269 align:start position:0% constant and that C is equal to G to the 00:21:27.269 --> 00:21:33.230 align:start position:0% constant and that C is equal to G to the F<00:21:27.480> 0<00:21:29.419> and<00:21:30.419> that<00:21:31.049> F<00:21:31.470> 0<00:21:31.740> is<00:21:32.129> equal<00:21:32.460> to<00:21:32.549> Y<00:21:32.700> right 00:21:33.230 --> 00:21:33.240 align:start position:0% F 0 and that F 0 is equal to Y right 00:21:33.240 --> 00:21:34.460 align:start position:0% F 0 and that F 0 is equal to Y right where<00:21:34.110> F 00:21:34.460 --> 00:21:34.470 align:start position:0% where F 00:21:34.470 --> 00:21:37.490 align:start position:0% where F mod<00:21:35.039> P<00:21:35.370> is<00:21:35.549> actually<00:21:35.760> equal<00:21:36.150> to<00:21:36.210> Y<00:21:36.390> but<00:21:36.630> you 00:21:37.490 --> 00:21:37.500 align:start position:0% mod P is actually equal to Y but you 00:21:37.500 --> 00:21:40.399 align:start position:0% mod P is actually equal to Y but you know<00:21:37.590> that's<00:21:37.799> a<00:21:37.890> detail<00:21:38.159> and<00:21:39.020> so<00:21:40.020> what<00:21:40.289> this 00:21:40.399 --> 00:21:40.409 align:start position:0% know that's a detail and so what this 00:21:40.409 --> 00:21:43.760 align:start position:0% know that's a detail and so what this gives<00:21:40.590> us<00:21:40.799> is<00:21:40.860> a<00:21:41.549> polynomial<00:21:42.150> commitment<00:21:42.870> with 00:21:43.760 --> 00:21:43.770 align:start position:0% gives us is a polynomial commitment with 00:21:43.770 --> 00:21:46.270 align:start position:0% gives us is a polynomial commitment with two<00:21:44.400> lagdi<00:21:44.789> group<00:21:45.059> elements<00:21:45.510> in<00:21:45.600> every<00:21:45.720> round 00:21:46.270 --> 00:21:46.280 align:start position:0% two lagdi group elements in every round 00:21:46.280 --> 00:21:50.029 align:start position:0% two lagdi group elements in every round to<00:21:47.280> look<00:21:47.429> the<00:21:47.610> field<00:21:47.940> elements<00:21:48.510> and<00:21:48.890> we<00:21:49.890> can 00:21:50.029 --> 00:21:50.039 align:start position:0% to look the field elements and we can 00:21:50.039 --> 00:21:52.310 align:start position:0% to look the field elements and we can use<00:21:50.190> lots<00:21:50.429> of<00:21:50.549> matching<00:21:50.970> tricks<00:21:51.240> to<00:21:52.020> make<00:21:52.169> this 00:21:52.310 --> 00:21:52.320 align:start position:0% use lots of matching tricks to make this 00:21:52.320 --> 00:21:54.649 align:start position:0% use lots of matching tricks to make this really<00:21:52.590> efficient<00:21:52.980> and<00:21:53.330> you<00:21:54.330> know<00:21:54.450> there's 00:21:54.649 --> 00:21:54.659 align:start position:0% really efficient and you know there's 00:21:54.659 --> 00:21:56.779 align:start position:0% really efficient and you know there's this<00:21:54.900> some<00:21:55.860> more<00:21:56.039> tricks<00:21:56.220> that<00:21:56.429> you<00:21:56.520> need<00:21:56.549> to 00:21:56.779 --> 00:21:56.789 align:start position:0% this some more tricks that you need to 00:21:56.789 --> 00:21:59.180 align:start position:0% this some more tricks that you need to apply<00:21:57.000> to<00:21:57.030> to<00:21:57.720> make<00:21:58.169> the<00:21:58.289> verifier<00:21:58.740> efficient 00:21:59.180 --> 00:21:59.190 align:start position:0% apply to to make the verifier efficient 00:21:59.190 --> 00:22:01.159 align:start position:0% apply to to make the verifier efficient so<00:21:59.370> for<00:21:59.520> example<00:21:59.940> you<00:22:00.450> know<00:22:00.570> you<00:22:00.600> need<00:22:00.840> to<00:22:00.960> use 00:22:01.159 --> 00:22:01.169 align:start position:0% so for example you know you need to use 00:22:01.169 --> 00:22:03.620 align:start position:0% so for example you know you need to use some<00:22:01.409> tricks<00:22:01.650> to<00:22:01.890> make<00:22:02.039> sure<00:22:02.220> that<00:22:02.429> that<00:22:03.390> this 00:22:03.620 --> 00:22:03.630 align:start position:0% some tricks to make sure that that this 00:22:03.630 --> 00:22:06.590 align:start position:0% some tricks to make sure that that this check<00:22:03.960> here<00:22:04.230> is<00:22:04.409> efficient<00:22:04.860> but<00:22:05.570> using<00:22:06.570> some 00:22:06.590 --> 00:22:06.600 align:start position:0% check here is efficient but using some 00:22:06.600 --> 00:22:09.560 align:start position:0% check here is efficient but using some some<00:22:07.230> recent<00:22:07.950> work<00:22:08.130> in<00:22:08.340> the<00:22:08.460> space<00:22:08.610> of<00:22:08.669> VDS<00:22:09.059> we 00:22:09.560 --> 00:22:09.570 align:start position:0% some recent work in the space of VDS we 00:22:09.570 --> 00:22:17.120 align:start position:0% some recent work in the space of VDS we can<00:22:09.720> also<00:22:09.870> do<00:22:10.080> that<00:22:10.260> and<00:22:11.120> yeah<00:22:12.320> so<00:22:13.340> I<00:22:15.409> am<00:22:16.409> done 00:22:17.120 --> 00:22:17.130 align:start position:0% can also do that and yeah so I am done 00:22:17.130 --> 00:22:18.529 align:start position:0% can also do that and yeah so I am done with<00:22:17.159> the<00:22:17.370> main<00:22:17.520> part<00:22:17.640> of<00:22:17.789> the<00:22:17.909> talk<00:22:18.120> I<00:22:18.299> think 00:22:18.529 --> 00:22:18.539 align:start position:0% with the main part of the talk I think 00:22:18.539 --> 00:22:21.380 align:start position:0% with the main part of the talk I think maybe<00:22:18.900> it's<00:22:19.309> I<00:22:20.309> can<00:22:20.940> talk<00:22:21.120> about<00:22:21.270> some 00:22:21.380 --> 00:22:21.390 align:start position:0% maybe it's I can talk about some 00:22:21.390 --> 00:22:22.970 align:start position:0% maybe it's I can talk about some optimizations<00:22:22.080> but<00:22:22.230> maybe<00:22:22.380> you<00:22:22.740> know<00:22:22.830> there 00:22:22.970 --> 00:22:22.980 align:start position:0% optimizations but maybe you know there 00:22:22.980 --> 00:22:25.789 align:start position:0% optimizations but maybe you know there are<00:22:23.039> some<00:22:23.190> questions<00:22:23.580> and<00:22:23.880> I<00:22:24.840> think<00:22:25.500> I'll<00:22:25.620> just 00:22:25.789 --> 00:22:25.799 align:start position:0% are some questions and I think I'll just 00:22:25.799 --> 00:22:29.370 align:start position:0% are some questions and I think I'll just take<00:22:26.190> the<00:22:26.309> questions<00:22:26.640> now<00:22:26.820> thank<00:22:27.360> you 00:22:29.370 --> 00:22:29.380 align:start position:0% take the questions now thank you 00:22:29.380 --> 00:22:41.049 align:start position:0% take the questions now thank you [Applause] 00:22:41.049 --> 00:22:41.059 align:start position:0% 00:22:41.059 --> 00:22:43.120 align:start position:0% you