WEBVTT Kind: captions Language: en 00:00:09.190 --> 00:00:17.400 align:start position:0% [Music] 00:00:17.400 --> 00:00:17.410 align:start position:0% 00:00:17.410 --> 00:00:21.820 align:start position:0% hi<00:00:18.410> so<00:00:18.800> my<00:00:19.280> name<00:00:19.910> is<00:00:20.330> Jakob<00:00:20.660> Eva<00:00:21.020> Hut<00:00:21.200> and<00:00:21.440> I 00:00:21.820 --> 00:00:21.830 align:start position:0% hi so my name is Jakob Eva Hut and I 00:00:21.830 --> 00:00:23.680 align:start position:0% hi so my name is Jakob Eva Hut and I work<00:00:22.070> at<00:00:22.310> the<00:00:22.340> information<00:00:23.150> systems 00:00:23.680 --> 00:00:23.690 align:start position:0% work at the information systems 00:00:23.690 --> 00:00:26.110 align:start position:0% work at the information systems engineering<00:00:24.380> group<00:00:24.770> at<00:00:25.010> T<00:00:25.490> Berlin<00:00:25.910> in<00:00:26.090> Germany 00:00:26.110 --> 00:00:26.120 align:start position:0% engineering group at T Berlin in Germany 00:00:26.120 --> 00:00:28.710 align:start position:0% engineering group at T Berlin in Germany and<00:00:26.690> I'm<00:00:27.230> here<00:00:27.500> today<00:00:27.680> to<00:00:27.860> talk<00:00:28.280> about 00:00:28.710 --> 00:00:28.720 align:start position:0% and I'm here today to talk about 00:00:28.720 --> 00:00:32.619 align:start position:0% and I'm here today to talk about Socrates<00:00:29.720> which<00:00:30.680> is<00:00:30.920> a<00:00:30.950> toolbox<00:00:31.670> for<00:00:32.000> CK 00:00:32.619 --> 00:00:32.629 align:start position:0% Socrates which is a toolbox for CK 00:00:32.629 --> 00:00:36.850 align:start position:0% Socrates which is a toolbox for CK snarks<00:00:33.170> on<00:00:33.590> a<00:00:34.130> theorem<00:00:34.990> so<00:00:35.990> let's<00:00:36.320> first<00:00:36.680> look 00:00:36.850 --> 00:00:36.860 align:start position:0% snarks on a theorem so let's first look 00:00:36.860 --> 00:00:40.210 align:start position:0% snarks on a theorem so let's first look at<00:00:37.220> how<00:00:37.550> transaction<00:00:38.420> processing<00:00:39.200> works<00:00:39.829> and 00:00:40.210 --> 00:00:40.220 align:start position:0% at how transaction processing works and 00:00:40.220 --> 00:00:42.340 align:start position:0% at how transaction processing works and traditional<00:00:40.760> blockchain<00:00:41.300> networks<00:00:41.660> as<00:00:41.870> you 00:00:42.340 --> 00:00:42.350 align:start position:0% traditional blockchain networks as you 00:00:42.350 --> 00:00:44.290 align:start position:0% traditional blockchain networks as you can<00:00:42.530> see<00:00:42.739> on<00:00:42.890> the<00:00:43.010> left<00:00:43.220> the<00:00:43.460> transaction<00:00:44.120> is 00:00:44.290 --> 00:00:44.300 align:start position:0% can see on the left the transaction is 00:00:44.300 --> 00:00:47.470 align:start position:0% can see on the left the transaction is sent<00:00:45.050> to<00:00:45.320> the<00:00:45.530> network<00:00:45.860> it<00:00:46.250> that<00:00:46.579> then<00:00:47.120> gets 00:00:47.470 --> 00:00:47.480 align:start position:0% sent to the network it that then gets 00:00:47.480 --> 00:00:49.690 align:start position:0% sent to the network it that then gets validated<00:00:48.260> at<00:00:48.410> the<00:00:48.530> first<00:00:48.770> node<00:00:49.070> understand 00:00:49.690 --> 00:00:49.700 align:start position:0% validated at the first node understand 00:00:49.700 --> 00:00:52.180 align:start position:0% validated at the first node understand broadcast<00:00:50.239> to<00:00:50.540> the<00:00:50.660> other<00:00:50.810> nodes<00:00:51.110> and<00:00:51.470> at<00:00:51.920> some 00:00:52.180 --> 00:00:52.190 align:start position:0% broadcast to the other nodes and at some 00:00:52.190 --> 00:00:55.090 align:start position:0% broadcast to the other nodes and at some point<00:00:52.489> it<00:00:52.730> gets<00:00:52.760> included<00:00:53.660> into<00:00:54.380> some<00:00:54.710> block 00:00:55.090 --> 00:00:55.100 align:start position:0% point it gets included into some block 00:00:55.100 --> 00:00:57.340 align:start position:0% point it gets included into some block after<00:00:55.340> someone<00:00:56.210> solved<00:00:56.690> the<00:00:56.930> proof-of-work 00:00:57.340 --> 00:00:57.350 align:start position:0% after someone solved the proof-of-work 00:00:57.350 --> 00:01:01.540 align:start position:0% after someone solved the proof-of-work problem<00:00:58.690> now<00:00:59.690> imagine<00:01:00.290> if<00:01:00.469> we<00:01:00.770> had<00:01:00.800> a<00:01:00.980> system 00:01:01.540 --> 00:01:01.550 align:start position:0% problem now imagine if we had a system 00:01:01.550 --> 00:01:03.639 align:start position:0% problem now imagine if we had a system like<00:01:01.969> on<00:01:02.210> the<00:01:02.450> right<00:01:02.600> side<00:01:02.930> where<00:01:03.620> a 00:01:03.639 --> 00:01:03.649 align:start position:0% like on the right side where a 00:01:03.649 --> 00:01:06.460 align:start position:0% like on the right side where a transaction<00:01:04.519> is<00:01:04.790> sent<00:01:05.180> to<00:01:05.479> the<00:01:05.810> nodes<00:01:06.020> in<00:01:06.320> a 00:01:06.460 --> 00:01:06.470 align:start position:0% transaction is sent to the nodes in a 00:01:06.470 --> 00:01:09.039 align:start position:0% transaction is sent to the nodes in a network<00:01:06.500> but<00:01:07.400> instead<00:01:07.850> of<00:01:08.090> directly<00:01:08.659> being 00:01:09.039 --> 00:01:09.049 align:start position:0% network but instead of directly being 00:01:09.049 --> 00:01:12.370 align:start position:0% network but instead of directly being validated<00:01:09.530> on<00:01:09.920> chain<00:01:10.250> they<00:01:10.880> get<00:01:11.120> forwarded<00:01:11.990> to 00:01:12.370 --> 00:01:12.380 align:start position:0% validated on chain they get forwarded to 00:01:12.380 --> 00:01:14.440 align:start position:0% validated on chain they get forwarded to a<00:01:12.409> third<00:01:12.710> party<00:01:13.220> the<00:01:13.460> yellow<00:01:13.729> box<00:01:13.970> here<00:01:14.299> and 00:01:14.440 --> 00:01:14.450 align:start position:0% a third party the yellow box here and 00:01:14.450 --> 00:01:17.109 align:start position:0% a third party the yellow box here and that's<00:01:15.440> where<00:01:15.710> the<00:01:15.830> transaction<00:01:16.430> processing 00:01:17.109 --> 00:01:17.119 align:start position:0% that's where the transaction processing 00:01:17.119 --> 00:01:20.109 align:start position:0% that's where the transaction processing happens<00:01:17.570> after<00:01:18.470> the<00:01:18.650> processing<00:01:19.369> off<00:01:19.580> chain 00:01:20.109 --> 00:01:20.119 align:start position:0% happens after the processing off chain 00:01:20.119 --> 00:01:23.230 align:start position:0% happens after the processing off chain is<00:01:20.630> done<00:01:21.020> the<00:01:21.650> result<00:01:22.070> is<00:01:22.280> written<00:01:22.580> back<00:01:22.820> to 00:01:23.230 --> 00:01:23.240 align:start position:0% is done the result is written back to 00:01:23.240 --> 00:01:23.890 align:start position:0% is done the result is written back to the<00:01:23.330> blockchain 00:01:23.890 --> 00:01:23.900 align:start position:0% the blockchain 00:01:23.900 --> 00:01:26.950 align:start position:0% the blockchain and<00:01:24.080> on<00:01:24.590> chain<00:01:24.950> it<00:01:25.190> is<00:01:25.700> verified<00:01:26.270> to<00:01:26.780> be 00:01:26.950 --> 00:01:26.960 align:start position:0% and on chain it is verified to be 00:01:26.960 --> 00:01:29.910 align:start position:0% and on chain it is verified to be correct 00:01:29.910 --> 00:01:29.920 align:start position:0% 00:01:29.920 --> 00:01:32.920 align:start position:0% only<00:01:30.920> that<00:01:31.130> verification<00:01:31.580> will<00:01:32.360> then<00:01:32.570> happen 00:01:32.920 --> 00:01:32.930 align:start position:0% only that verification will then happen 00:01:32.930 --> 00:01:35.320 align:start position:0% only that verification will then happen redundantly<00:01:33.890> and<00:01:34.220> not<00:01:34.520> the<00:01:34.729> transaction 00:01:35.320 --> 00:01:35.330 align:start position:0% redundantly and not the transaction 00:01:35.330 --> 00:01:39.070 align:start position:0% redundantly and not the transaction processing<00:01:36.049> itself<00:01:36.970> so<00:01:37.970> what<00:01:38.720> would<00:01:38.869> be 00:01:39.070 --> 00:01:39.080 align:start position:0% processing itself so what would be 00:01:39.080 --> 00:01:41.410 align:start position:0% processing itself so what would be gained<00:01:39.290> through<00:01:39.320> that<00:01:39.830> one<00:01:40.670> thing<00:01:41.000> will<00:01:41.270> be 00:01:41.410 --> 00:01:41.420 align:start position:0% gained through that one thing will be 00:01:41.420 --> 00:01:44.820 align:start position:0% gained through that one thing will be scalability<00:01:42.320> if<00:01:42.770> the<00:01:43.610> verification<00:01:43.909> is 00:01:44.820 --> 00:01:44.830 align:start position:0% scalability if the verification is 00:01:44.830 --> 00:01:48.850 align:start position:0% scalability if the verification is cheaper<00:01:45.830> than<00:01:45.860> redoing<00:01:46.580> or<00:01:47.530> executing<00:01:48.530> the 00:01:48.850 --> 00:01:48.860 align:start position:0% cheaper than redoing or executing the 00:01:48.860 --> 00:01:50.980 align:start position:0% cheaper than redoing or executing the transaction<00:01:49.460> in<00:01:49.549> the<00:01:49.640> first<00:01:49.880> place<00:01:50.180> if<00:01:50.450> you 00:01:50.980 --> 00:01:50.990 align:start position:0% transaction in the first place if you 00:01:50.990 --> 00:01:53.020 align:start position:0% transaction in the first place if you only<00:01:51.200> have<00:01:51.530> to<00:01:51.740> do<00:01:51.890> the<00:01:52.040> verification<00:01:52.310> on 00:01:53.020 --> 00:01:53.030 align:start position:0% only have to do the verification on 00:01:53.030 --> 00:01:55.289 align:start position:0% only have to do the verification on chain<00:01:53.299> then<00:01:53.840> you<00:01:54.049> can<00:01:54.229> increase<00:01:54.500> throughput 00:01:55.289 --> 00:01:55.299 align:start position:0% chain then you can increase throughput 00:01:55.299 --> 00:01:58.510 align:start position:0% chain then you can increase throughput also<00:01:56.299> there<00:01:56.540> is<00:01:56.630> no<00:01:56.659> such<00:01:57.110> thing<00:01:57.470> as<00:01:57.680> a<00:01:57.770> block 00:01:58.510 --> 00:01:58.520 align:start position:0% also there is no such thing as a block 00:01:58.520 --> 00:02:00.700 align:start position:0% also there is no such thing as a block cast<00:01:58.820> limit<00:01:59.299> that<00:01:59.540> comes<00:01:59.930> into<00:02:00.170> play<00:02:00.259> here 00:02:00.700 --> 00:02:00.710 align:start position:0% cast limit that comes into play here 00:02:00.710 --> 00:02:02.859 align:start position:0% cast limit that comes into play here because<00:02:01.159> there's<00:02:01.430> no<00:02:01.670> need<00:02:02.119> to<00:02:02.180> circumvent 00:02:02.859 --> 00:02:02.869 align:start position:0% because there's no need to circumvent 00:02:02.869 --> 00:02:06.340 align:start position:0% because there's no need to circumvent the<00:02:03.170> halting<00:02:03.619> problem<00:02:03.650> a<00:02:04.689> second<00:02:05.689> aspect<00:02:05.990> is 00:02:06.340 --> 00:02:06.350 align:start position:0% the halting problem a second aspect is 00:02:06.350 --> 00:02:08.919 align:start position:0% the halting problem a second aspect is the<00:02:06.860> private<00:02:07.369> information<00:02:08.060> that<00:02:08.329> gets<00:02:08.509> used 00:02:08.919 --> 00:02:08.929 align:start position:0% the private information that gets used 00:02:08.929 --> 00:02:12.130 align:start position:0% the private information that gets used on<00:02:09.140> that<00:02:09.439> external<00:02:09.890> node<00:02:10.250> can<00:02:10.970> if<00:02:11.209> we<00:02:11.599> use<00:02:11.989> the 00:02:12.130 --> 00:02:12.140 align:start position:0% on that external node can if we use the 00:02:12.140 --> 00:02:14.620 align:start position:0% on that external node can if we use the right<00:02:12.290> tools<00:02:12.620> be<00:02:13.160> kept<00:02:13.400> private<00:02:13.670> and 00:02:14.620 --> 00:02:14.630 align:start position:0% right tools be kept private and 00:02:14.630 --> 00:02:16.240 align:start position:0% right tools be kept private and do<00:02:14.780> not<00:02:14.960> have<00:02:15.230> to<00:02:15.380> be<00:02:15.470> published<00:02:15.980> to<00:02:16.220> the 00:02:16.240 --> 00:02:16.250 align:start position:0% do not have to be published to the 00:02:16.250 --> 00:02:18.100 align:start position:0% do not have to be published to the Blackshear<00:02:16.700> network<00:02:17.030> which<00:02:17.300> is<00:02:17.480> also<00:02:17.660> what<00:02:17.990> we 00:02:18.100 --> 00:02:18.110 align:start position:0% Blackshear network which is also what we 00:02:18.110 --> 00:02:21.130 align:start position:0% Blackshear network which is also what we not<00:02:18.290> have<00:02:18.590> at<00:02:18.860> the<00:02:19.070> moment<00:02:19.660> so<00:02:20.660> what<00:02:20.990> our 00:02:21.130 --> 00:02:21.140 align:start position:0% not have at the moment so what our 00:02:21.140 --> 00:02:23.020 align:start position:0% not have at the moment so what our approach<00:02:21.380> is<00:02:21.710> for<00:02:21.890> that<00:02:22.070> we've<00:02:22.610> heard<00:02:22.880> an 00:02:23.020 --> 00:02:23.030 align:start position:0% approach is for that we've heard an 00:02:23.030 --> 00:02:24.910 align:start position:0% approach is for that we've heard an excellent<00:02:23.450> talk<00:02:23.660> by<00:02:23.870> Jason<00:02:24.350> earlier<00:02:24.740> about 00:02:24.910 --> 00:02:24.920 align:start position:0% excellent talk by Jason earlier about 00:02:24.920 --> 00:02:27.070 align:start position:0% excellent talk by Jason earlier about Ruben<00:02:25.610> and<00:02:25.760> true--but<00:02:26.120> is<00:02:26.300> one<00:02:26.570> such<00:02:26.870> approach 00:02:27.070 --> 00:02:27.080 align:start position:0% Ruben and true--but is one such approach 00:02:27.080 --> 00:02:30.610 align:start position:0% Ruben and true--but is one such approach where<00:02:28.070> you<00:02:28.250> gain<00:02:29.240> scalability<00:02:30.200> by<00:02:30.440> off 00:02:30.610 --> 00:02:30.620 align:start position:0% where you gain scalability by off 00:02:30.620 --> 00:02:32.770 align:start position:0% where you gain scalability by off training<00:02:30.980> computations<00:02:31.820> and<00:02:32.000> then<00:02:32.480> there's 00:02:32.770 --> 00:02:32.780 align:start position:0% training computations and then there's 00:02:32.780 --> 00:02:35.680 align:start position:0% training computations and then there's that<00:02:32.930> verification<00:02:33.380> game<00:02:34.090> played<00:02:35.090> on<00:02:35.120> chain 00:02:35.680 --> 00:02:35.690 align:start position:0% that verification game played on chain 00:02:35.690 --> 00:02:39.300 align:start position:0% that verification game played on chain and<00:02:36.050> with<00:02:36.800> that<00:02:37.040> you<00:02:37.490> gain<00:02:37.930> scalability 00:02:39.300 --> 00:02:39.310 align:start position:0% and with that you gain scalability 00:02:39.310 --> 00:02:42.160 align:start position:0% and with that you gain scalability another<00:02:40.310> approach<00:02:40.790> is<00:02:41.090> a<00:02:41.600> non-interactive 00:02:42.160 --> 00:02:42.170 align:start position:0% another approach is a non-interactive 00:02:42.170 --> 00:02:46.210 align:start position:0% another approach is a non-interactive thorough<00:02:43.160> knowledge<00:02:43.400> crews<00:02:44.500> in<00:02:45.500> that<00:02:45.560> case 00:02:46.210 --> 00:02:46.220 align:start position:0% thorough knowledge crews in that case 00:02:46.220 --> 00:02:48.250 align:start position:0% thorough knowledge crews in that case you<00:02:46.760> additionally<00:02:47.450> have<00:02:47.480> certain<00:02:48.080> knowledge 00:02:48.250 --> 00:02:48.260 align:start position:0% you additionally have certain knowledge 00:02:48.260 --> 00:02:50.620 align:start position:0% you additionally have certain knowledge that<00:02:48.440> means<00:02:48.890> the<00:02:49.430> private<00:02:49.880> information<00:02:50.030> you 00:02:50.620 --> 00:02:50.630 align:start position:0% that means the private information you 00:02:50.630 --> 00:02:52.540 align:start position:0% that means the private information you use<00:02:50.870> during<00:02:51.230> your<00:02:51.440> processing<00:02:52.340> on<00:02:52.520> that 00:02:52.540 --> 00:02:52.550 align:start position:0% use during your processing on that 00:02:52.550 --> 00:02:56.500 align:start position:0% use during your processing on that external<00:02:53.330> node<00:02:53.690> they<00:02:54.200> are<00:02:54.530> not<00:02:55.210> revealed<00:02:56.210> to 00:02:56.500 --> 00:02:56.510 align:start position:0% external node they are not revealed to 00:02:56.510 --> 00:03:01.230 align:start position:0% external node they are not revealed to the<00:02:56.630> network<00:02:57.730> okay<00:02:58.730> so<00:02:58.790> what<00:02:59.720> could<00:03:00.440> those 00:03:01.230 --> 00:03:01.240 align:start position:0% the network okay so what could those 00:03:01.240 --> 00:03:05.050 align:start position:0% the network okay so what could those non-interactive<00:03:02.240> sir<00:03:02.390> knowledge<00:03:02.810> proofs<00:03:04.060> b1y 00:03:05.050 --> 00:03:05.060 align:start position:0% non-interactive sir knowledge proofs b1y 00:03:05.060 --> 00:03:07.720 align:start position:0% non-interactive sir knowledge proofs b1y a<00:03:05.570> proven<00:03:06.080> mechanism<00:03:06.680> is<00:03:06.800> ckase<00:03:07.190> narcs<00:03:07.580> I 00:03:07.720 --> 00:03:07.730 align:start position:0% a proven mechanism is ckase narcs I 00:03:07.730 --> 00:03:09.820 align:start position:0% a proven mechanism is ckase narcs I think<00:03:07.970> many<00:03:08.270> of<00:03:08.450> you<00:03:08.660> are<00:03:08.900> aware<00:03:09.260> of<00:03:09.620> that 00:03:09.820 --> 00:03:09.830 align:start position:0% think many of you are aware of that 00:03:09.830 --> 00:03:12.430 align:start position:0% think many of you are aware of that technology<00:03:10.430> and<00:03:10.610> it's<00:03:11.120> 10<00:03:11.360> for<00:03:11.630> zero 00:03:12.430 --> 00:03:12.440 align:start position:0% technology and it's 10 for zero 00:03:12.440 --> 00:03:14.710 align:start position:0% technology and it's 10 for zero knowledge<00:03:12.730> succeed<00:03:13.730> on<00:03:14.060> interactive 00:03:14.710 --> 00:03:14.720 align:start position:0% knowledge succeed on interactive 00:03:14.720 --> 00:03:16.810 align:start position:0% knowledge succeed on interactive arguments<00:03:15.260> of<00:03:15.380> knowledge<00:03:15.830> and<00:03:16.070> here<00:03:16.640> are 00:03:16.810 --> 00:03:16.820 align:start position:0% arguments of knowledge and here are 00:03:16.820 --> 00:03:19.900 align:start position:0% arguments of knowledge and here are several<00:03:17.810> key<00:03:18.350> properties<00:03:19.040> of<00:03:19.280> seek<00:03:19.490> a<00:03:19.640> snark 00:03:19.900 --> 00:03:19.910 align:start position:0% several key properties of seek a snark 00:03:19.910 --> 00:03:22.000 align:start position:0% several key properties of seek a snark so<00:03:20.180> the<00:03:20.630> proofs<00:03:20.930> are<00:03:21.080> short<00:03:21.380> and<00:03:21.590> non 00:03:22.000 --> 00:03:22.010 align:start position:0% so the proofs are short and non 00:03:22.010 --> 00:03:24.070 align:start position:0% so the proofs are short and non interactive<00:03:22.670> that<00:03:23.090> essentially<00:03:23.720> means<00:03:23.930> you 00:03:24.070 --> 00:03:24.080 align:start position:0% interactive that essentially means you 00:03:24.080 --> 00:03:26.920 align:start position:0% interactive that essentially means you can<00:03:24.380> simply<00:03:24.890> take<00:03:25.460> approve<00:03:25.850> generated<00:03:26.810> by 00:03:26.920 --> 00:03:26.930 align:start position:0% can simply take approve generated by 00:03:26.930 --> 00:03:28.690 align:start position:0% can simply take approve generated by approvers<00:03:27.440> send<00:03:27.770> it<00:03:27.920> over<00:03:28.160> the<00:03:28.340> network<00:03:28.520> to 00:03:28.690 --> 00:03:28.700 align:start position:0% approvers send it over the network to 00:03:28.700 --> 00:03:30.580 align:start position:0% approvers send it over the network to verifier<00:03:29.540> and<00:03:29.840> without<00:03:30.320> further 00:03:30.580 --> 00:03:30.590 align:start position:0% verifier and without further 00:03:30.590 --> 00:03:33.130 align:start position:0% verifier and without further communication<00:03:31.550> it<00:03:31.700> can<00:03:32.180> then<00:03:32.420> be<00:03:32.450> verified 00:03:33.130 --> 00:03:33.140 align:start position:0% communication it can then be verified 00:03:33.140 --> 00:03:34.900 align:start position:0% communication it can then be verified also<00:03:34.070> we<00:03:34.280> have<00:03:34.430> a<00:03:34.460> certain<00:03:34.790> knowledge 00:03:34.900 --> 00:03:34.910 align:start position:0% also we have a certain knowledge 00:03:34.910 --> 00:03:37.150 align:start position:0% also we have a certain knowledge property<00:03:35.540> that<00:03:35.930> means<00:03:36.200> some<00:03:36.560> information 00:03:37.150 --> 00:03:37.160 align:start position:0% property that means some information 00:03:37.160 --> 00:03:40.930 align:start position:0% property that means some information that<00:03:37.400> goes<00:03:37.730> into<00:03:37.760> the<00:03:38.300> processing<00:03:38.980> is<00:03:39.980> not 00:03:40.930 --> 00:03:40.940 align:start position:0% that goes into the processing is not 00:03:40.940 --> 00:03:44.250 align:start position:0% that goes into the processing is not revealed<00:03:41.630> to<00:03:41.900> the<00:03:42.020> network<00:03:42.380> later<00:03:43.040> on 00:03:44.250 --> 00:03:44.260 align:start position:0% revealed to the network later on 00:03:44.260 --> 00:03:46.810 align:start position:0% revealed to the network later on verification<00:03:45.260> cost<00:03:45.890> and<00:03:46.160> that's<00:03:46.310> a<00:03:46.430> big<00:03:46.610> one 00:03:46.810 --> 00:03:46.820 align:start position:0% verification cost and that's a big one 00:03:46.820 --> 00:03:49.500 align:start position:0% verification cost and that's a big one is<00:03:47.030> independent<00:03:47.990> of<00:03:48.170> the<00:03:48.530> computational 00:03:49.500 --> 00:03:49.510 align:start position:0% is independent of the computational 00:03:49.510 --> 00:03:53.590 align:start position:0% is independent of the computational complexity<00:03:50.510> of<00:03:50.720> the<00:03:51.590> initial<00:03:52.310> computation<00:03:53.090> so 00:03:53.590 --> 00:03:53.600 align:start position:0% complexity of the initial computation so 00:03:53.600 --> 00:03:55.840 align:start position:0% complexity of the initial computation so no<00:03:53.930> matter<00:03:54.140> how<00:03:54.410> complex<00:03:54.920> your<00:03:55.160> computation 00:03:55.840 --> 00:03:55.850 align:start position:0% no matter how complex your computation 00:03:55.850 --> 00:03:58.590 align:start position:0% no matter how complex your computation is<00:03:56.030> the<00:03:56.810> cost<00:03:57.110> of<00:03:57.380> verifying<00:03:57.890> a<00:03:58.040> proof<00:03:58.280> is 00:03:58.590 --> 00:03:58.600 align:start position:0% is the cost of verifying a proof is 00:03:58.600 --> 00:04:01.990 align:start position:0% is the cost of verifying a proof is always<00:03:59.600> the<00:03:59.870> same<00:04:00.080> ok<00:04:00.800> so<00:04:00.860> that's<00:04:01.220> a<00:04:01.430> key 00:04:01.990 --> 00:04:02.000 align:start position:0% always the same ok so that's a key 00:04:02.000 --> 00:04:05.170 align:start position:0% always the same ok so that's a key aspect<00:04:02.500> now<00:04:03.500> a<00:04:03.530> little<00:04:04.100> inconvenience<00:04:04.970> is 00:04:05.170 --> 00:04:05.180 align:start position:0% aspect now a little inconvenience is 00:04:05.180 --> 00:04:09.340 align:start position:0% aspect now a little inconvenience is that<00:04:05.420> to<00:04:05.810> specify<00:04:08.020> computations<00:04:09.020> in<00:04:09.170> a<00:04:09.230> way 00:04:09.340 --> 00:04:09.350 align:start position:0% that to specify computations in a way 00:04:09.350 --> 00:04:11.080 align:start position:0% that to specify computations in a way that<00:04:09.620> you<00:04:09.740> can<00:04:09.920> do<00:04:10.070> certain<00:04:10.580> all<00:04:10.700> that<00:04:10.820> proves 00:04:11.080 --> 00:04:11.090 align:start position:0% that you can do certain all that proves 00:04:11.090 --> 00:04:14.410 align:start position:0% that you can do certain all that proves on<00:04:11.270> you<00:04:11.870> have<00:04:12.110> to<00:04:12.670> think<00:04:13.670> in<00:04:13.850> an<00:04:13.970> abstraction 00:04:14.410 --> 00:04:14.420 align:start position:0% on you have to think in an abstraction 00:04:14.420 --> 00:04:16.330 align:start position:0% on you have to think in an abstraction that's<00:04:14.810> not<00:04:15.020> very<00:04:15.200> convenient<00:04:15.680> to<00:04:16.130> most 00:04:16.330 --> 00:04:16.340 align:start position:0% that's not very convenient to most 00:04:16.340 --> 00:04:19.270 align:start position:0% that's not very convenient to most developers<00:04:16.970> so<00:04:17.630> for<00:04:18.140> example<00:04:18.709> you<00:04:19.070> can 00:04:19.270 --> 00:04:19.280 align:start position:0% developers so for example you can 00:04:19.280 --> 00:04:21.220 align:start position:0% developers so for example you can specify<00:04:19.480> computations<00:04:20.480> as<00:04:20.660> arithmetic 00:04:21.220 --> 00:04:21.230 align:start position:0% specify computations as arithmetic 00:04:21.230 --> 00:04:24.100 align:start position:0% specify computations as arithmetic circuits<00:04:22.100> or<00:04:22.430> rank<00:04:22.910> one<00:04:23.120> constraint<00:04:23.600> systems 00:04:24.100 --> 00:04:24.110 align:start position:0% circuits or rank one constraint systems 00:04:24.110 --> 00:04:26.230 align:start position:0% circuits or rank one constraint systems of<00:04:24.350> course<00:04:25.040> you<00:04:25.220> can<00:04:25.400> do<00:04:25.520> it<00:04:25.669> but<00:04:25.970> it's<00:04:26.120> just 00:04:26.230 --> 00:04:26.240 align:start position:0% of course you can do it but it's just 00:04:26.240 --> 00:04:28.120 align:start position:0% of course you can do it but it's just not<00:04:26.600> convenient<00:04:27.110> to<00:04:27.410> do<00:04:27.590> and 00:04:28.120 --> 00:04:28.130 align:start position:0% not convenient to do and 00:04:28.130 --> 00:04:33.120 align:start position:0% not convenient to do and that's<00:04:28.250> what<00:04:28.840> impact<00:04:30.310> usability<00:04:31.450> negatively 00:04:33.120 --> 00:04:33.130 align:start position:0% that's what impact usability negatively 00:04:33.130 --> 00:04:35.800 align:start position:0% that's what impact usability negatively let's<00:04:34.130> take<00:04:34.460> a<00:04:34.490> brief<00:04:34.820> look<00:04:34.850> at<00:04:35.150> the<00:04:35.330> process 00:04:35.800 --> 00:04:35.810 align:start position:0% let's take a brief look at the process 00:04:35.810 --> 00:04:38.170 align:start position:0% let's take a brief look at the process of<00:04:36.020> using<00:04:36.560> CK's<00:04:37.130> knowledge<00:04:37.460> before<00:04:37.820> we<00:04:37.970> move 00:04:38.170 --> 00:04:38.180 align:start position:0% of using CK's knowledge before we move 00:04:38.180 --> 00:04:40.300 align:start position:0% of using CK's knowledge before we move on<00:04:38.390> to<00:04:38.630> the<00:04:38.780> tool<00:04:38.990> itself<00:04:39.380> because<00:04:40.130> it's 00:04:40.300 --> 00:04:40.310 align:start position:0% on to the tool itself because it's 00:04:40.310 --> 00:04:43.480 align:start position:0% on to the tool itself because it's necessary<00:04:40.820> background<00:04:41.060> so<00:04:42.040> here<00:04:43.040> on<00:04:43.160> the<00:04:43.280> Left 00:04:43.480 --> 00:04:43.490 align:start position:0% necessary background so here on the Left 00:04:43.490 --> 00:04:45.520 align:start position:0% necessary background so here on the Left we<00:04:43.670> have<00:04:43.700> a<00:04:43.850> circuit<00:04:44.360> or<00:04:44.540> rank<00:04:44.870> one<00:04:45.080> constraint 00:04:45.520 --> 00:04:45.530 align:start position:0% we have a circuit or rank one constraint 00:04:45.530 --> 00:04:47.740 align:start position:0% we have a circuit or rank one constraint system<00:04:45.890> that<00:04:46.190> encodes<00:04:46.730> a<00:04:46.880> computation<00:04:47.540> in 00:04:47.740 --> 00:04:47.750 align:start position:0% system that encodes a computation in 00:04:47.750 --> 00:04:50.650 align:start position:0% system that encodes a computation in that<00:04:48.350> case<00:04:48.710> we<00:04:49.400> just<00:04:49.430> multiply<00:04:50.300> two<00:04:50.360> numbers 00:04:50.650 --> 00:04:50.660 align:start position:0% that case we just multiply two numbers 00:04:50.660 --> 00:04:54.430 align:start position:0% that case we just multiply two numbers and<00:04:51.970> demand<00:04:52.970> that<00:04:53.210> that<00:04:53.240> equals<00:04:53.960> another 00:04:54.430 --> 00:04:54.440 align:start position:0% and demand that that equals another 00:04:54.440 --> 00:04:57.250 align:start position:0% and demand that that equals another number<00:04:54.860> and<00:04:55.250> for<00:04:56.000> example<00:04:56.330> RSA<00:04:57.080> encryption 00:04:57.250 --> 00:04:57.260 align:start position:0% number and for example RSA encryption 00:04:57.260 --> 00:05:03.720 align:start position:0% number and for example RSA encryption uses<00:04:58.190> a<00:04:58.610> different<00:04:59.500> similar<00:05:01.690> construction 00:05:03.720 --> 00:05:03.730 align:start position:0% uses a different similar construction 00:05:03.730 --> 00:05:06.730 align:start position:0% uses a different similar construction from<00:05:04.730> that<00:05:05.060> circuit<00:05:05.750> or<00:05:05.930> rank<00:05:06.200> one<00:05:06.380> constraint 00:05:06.730 --> 00:05:06.740 align:start position:0% from that circuit or rank one constraint 00:05:06.740 --> 00:05:08.410 align:start position:0% from that circuit or rank one constraint system<00:05:07.130> the<00:05:07.250> first<00:05:07.490> step<00:05:07.790> is<00:05:08.060> a<00:05:08.120> so-called 00:05:08.410 --> 00:05:08.420 align:start position:0% system the first step is a so-called 00:05:08.420 --> 00:05:13.000 align:start position:0% system the first step is a so-called setup<00:05:08.990> phase<00:05:09.260> which<00:05:09.920> is<00:05:10.190> needed<00:05:10.730> to<00:05:11.740> arrive<00:05:12.740> at 00:05:13.000 --> 00:05:13.010 align:start position:0% setup phase which is needed to arrive at 00:05:13.010 --> 00:05:15.430 align:start position:0% setup phase which is needed to arrive at the<00:05:13.190> proving<00:05:13.640> key<00:05:14.000> and<00:05:14.300> a<00:05:14.480> verification<00:05:14.840> key 00:05:15.430 --> 00:05:15.440 align:start position:0% the proving key and a verification key 00:05:15.440 --> 00:05:17.950 align:start position:0% the proving key and a verification key that<00:05:15.770> are<00:05:15.890> then<00:05:16.070> later<00:05:16.610> on<00:05:16.730> needed<00:05:17.390> in<00:05:17.600> the 00:05:17.950 --> 00:05:17.960 align:start position:0% that are then later on needed in the 00:05:17.960 --> 00:05:21.100 align:start position:0% that are then later on needed in the proving<00:05:18.350> process<00:05:18.890> so<00:05:19.700> this<00:05:20.270> setup<00:05:20.540> has<00:05:20.840> to<00:05:20.990> be 00:05:21.100 --> 00:05:21.110 align:start position:0% proving process so this setup has to be 00:05:21.110 --> 00:05:24.220 align:start position:0% proving process so this setup has to be performed<00:05:21.560> once<00:05:21.740> for<00:05:22.490> a<00:05:22.520> circuit<00:05:23.030> or<00:05:23.210> rank<00:05:24.020> one 00:05:24.220 --> 00:05:24.230 align:start position:0% performed once for a circuit or rank one 00:05:24.230 --> 00:05:26.140 align:start position:0% performed once for a circuit or rank one constraint<00:05:24.620> system<00:05:25.040> and<00:05:25.220> then<00:05:25.430> it<00:05:25.850> can<00:05:26.090> be 00:05:26.140 --> 00:05:26.150 align:start position:0% constraint system and then it can be 00:05:26.150 --> 00:05:30.340 align:start position:0% constraint system and then it can be reused<00:05:26.780> over<00:05:26.960> and<00:05:27.230> over<00:05:27.740> again<00:05:28.660> on<00:05:29.660> the<00:05:29.720> right 00:05:30.340 --> 00:05:30.350 align:start position:0% reused over and over again on the right 00:05:30.350 --> 00:05:32.800 align:start position:0% reused over and over again on the right side<00:05:30.620> here<00:05:30.950> you<00:05:31.550> see<00:05:31.820> the<00:05:32.120> verification 00:05:32.800 --> 00:05:32.810 align:start position:0% side here you see the verification 00:05:32.810 --> 00:05:34.930 align:start position:0% side here you see the verification process<00:05:32.840> based<00:05:33.800> on<00:05:34.070> the<00:05:34.340> proving<00:05:34.760> key 00:05:34.930 --> 00:05:34.940 align:start position:0% process based on the proving key 00:05:34.940 --> 00:05:39.130 align:start position:0% process based on the proving key approver<00:05:35.480> could<00:05:35.840> for<00:05:36.140> example<00:05:37.660> first<00:05:38.660> find 00:05:39.130 --> 00:05:39.140 align:start position:0% approver could for example first find 00:05:39.140 --> 00:05:41.260 align:start position:0% approver could for example first find the<00:05:39.290> solution<00:05:39.830> for<00:05:40.010> the<00:05:40.280> problem<00:05:40.310> at<00:05:40.760> hand<00:05:40.970> and 00:05:41.260 --> 00:05:41.270 align:start position:0% the solution for the problem at hand and 00:05:41.270 --> 00:05:44.380 align:start position:0% the solution for the problem at hand and then<00:05:41.870> generate<00:05:42.740> a<00:05:42.770> proof<00:05:43.100> that<00:05:43.130> it<00:05:43.550> correctly 00:05:44.380 --> 00:05:44.390 align:start position:0% then generate a proof that it correctly 00:05:44.390 --> 00:05:47.050 align:start position:0% then generate a proof that it correctly executed<00:05:45.200> that<00:05:45.650> computation<00:05:46.400> and<00:05:46.640> found<00:05:46.940> a 00:05:47.050 --> 00:05:47.060 align:start position:0% executed that computation and found a 00:05:47.060 --> 00:05:49.750 align:start position:0% executed that computation and found a solution<00:05:47.240> and<00:05:47.720> the<00:05:48.350> cool<00:05:48.560> thing<00:05:48.590> is<00:05:48.800> it<00:05:49.190> could 00:05:49.750 --> 00:05:49.760 align:start position:0% solution and the cool thing is it could 00:05:49.760 --> 00:05:52.270 align:start position:0% solution and the cool thing is it could optionally<00:05:50.300> supply<00:05:51.230> all<00:05:51.500> the<00:05:51.530> information 00:05:52.270 --> 00:05:52.280 align:start position:0% optionally supply all the information 00:05:52.280 --> 00:05:54.100 align:start position:0% optionally supply all the information that<00:05:52.430> went<00:05:52.610> into<00:05:52.790> the<00:05:53.000> processing<00:05:53.600> but<00:05:53.990> it 00:05:54.100 --> 00:05:54.110 align:start position:0% that went into the processing but it 00:05:54.110 --> 00:05:55.780 align:start position:0% that went into the processing but it could<00:05:54.260> also<00:05:54.440> keep<00:05:54.770> some<00:05:55.010> of<00:05:55.040> the<00:05:55.220> information 00:05:55.780 --> 00:05:55.790 align:start position:0% could also keep some of the information 00:05:55.790 --> 00:05:58.150 align:start position:0% could also keep some of the information to<00:05:56.030> itself<00:05:56.330> in<00:05:56.600> that<00:05:56.990> example<00:05:57.440> here<00:05:57.890> the 00:05:58.150 --> 00:05:58.160 align:start position:0% to itself in that example here the 00:05:58.160 --> 00:06:00.970 align:start position:0% to itself in that example here the prover<00:05:58.580> only<00:05:59.000> supplies<00:05:59.390> set<00:05:59.960> which<00:06:00.380> is<00:06:00.650> the 00:06:00.970 --> 00:06:00.980 align:start position:0% prover only supplies set which is the 00:06:00.980 --> 00:06:03.340 align:start position:0% prover only supplies set which is the result<00:06:01.610> of<00:06:01.760> the<00:06:01.880> multiplication<00:06:02.000> and<00:06:02.750> not<00:06:03.170> the 00:06:03.340 --> 00:06:03.350 align:start position:0% result of the multiplication and not the 00:06:03.350 --> 00:06:05.410 align:start position:0% result of the multiplication and not the factors<00:06:03.860> themselves<00:06:04.280> that<00:06:04.790> went<00:06:04.970> into<00:06:05.150> it<00:06:05.390> and 00:06:05.410 --> 00:06:05.420 align:start position:0% factors themselves that went into it and 00:06:05.420 --> 00:06:07.360 align:start position:0% factors themselves that went into it and the<00:06:05.900> verifier<00:06:06.380> can<00:06:06.680> then<00:06:06.830> check<00:06:07.160> the 00:06:07.360 --> 00:06:07.370 align:start position:0% the verifier can then check the 00:06:07.370 --> 00:06:09.760 align:start position:0% the verifier can then check the correctness<00:06:07.790> of<00:06:08.030> the<00:06:08.450> computation<00:06:09.140> without 00:06:09.760 --> 00:06:09.770 align:start position:0% correctness of the computation without 00:06:09.770 --> 00:06:12.750 align:start position:0% correctness of the computation without redoing<00:06:10.190> it<00:06:10.460> and<00:06:10.640> that<00:06:10.970> is<00:06:11.150> much<00:06:11.540> cheaper<00:06:12.020> that 00:06:12.750 --> 00:06:12.760 align:start position:0% redoing it and that is much cheaper that 00:06:12.760 --> 00:06:16.210 align:start position:0% redoing it and that is much cheaper that verification<00:06:13.760> process<00:06:14.210> then<00:06:14.720> the<00:06:15.470> proving 00:06:16.210 --> 00:06:16.220 align:start position:0% verification process then the proving 00:06:16.220 --> 00:06:18.340 align:start position:0% verification process then the proving process<00:06:16.670> and<00:06:16.940> with<00:06:17.300> that<00:06:17.510> the<00:06:17.660> execution<00:06:18.260> of 00:06:18.340 --> 00:06:18.350 align:start position:0% process and with that the execution of 00:06:18.350 --> 00:06:20.320 align:start position:0% process and with that the execution of the<00:06:18.530> computation<00:06:19.130> itself<00:06:19.940> in<00:06:20.090> the<00:06:20.180> first 00:06:20.320 --> 00:06:20.330 align:start position:0% the computation itself in the first 00:06:20.330 --> 00:06:25.480 align:start position:0% the computation itself in the first place<00:06:22.060> so<00:06:23.060> Curtis<00:06:23.480> so<00:06:24.290> with<00:06:24.620> byzantium 00:06:25.480 --> 00:06:25.490 align:start position:0% place so Curtis so with byzantium 00:06:25.490 --> 00:06:28.510 align:start position:0% place so Curtis so with byzantium theorem<00:06:26.450> added<00:06:26.840> three<00:06:27.290> new<00:06:27.320> pre<00:06:27.800> composite 00:06:28.510 --> 00:06:28.520 align:start position:0% theorem added three new pre composite 00:06:28.520 --> 00:06:30.700 align:start position:0% theorem added three new pre composite enable<00:06:28.970> seek<00:06:29.210> a<00:06:29.390> snark<00:06:29.720> verification<00:06:30.560> on 00:06:30.700 --> 00:06:30.710 align:start position:0% enable seek a snark verification on 00:06:30.710 --> 00:06:33.310 align:start position:0% enable seek a snark verification on chain<00:06:31.010> so<00:06:31.460> we<00:06:31.490> have<00:06:31.790> elliptic<00:06:32.390> curve<00:06:32.660> addition 00:06:33.310 --> 00:06:33.320 align:start position:0% chain so we have elliptic curve addition 00:06:33.320 --> 00:06:36.250 align:start position:0% chain so we have elliptic curve addition scalar<00:06:33.970> multiplication<00:06:34.970> and<00:06:35.150> so<00:06:35.990> called 00:06:36.250 --> 00:06:36.260 align:start position:0% scalar multiplication and so called 00:06:36.260 --> 00:06:38.680 align:start position:0% scalar multiplication and so called parity<00:06:36.650> check<00:06:36.890> but<00:06:37.460> the<00:06:37.580> big<00:06:37.729> question<00:06:37.880> is<00:06:38.300> how 00:06:38.680 --> 00:06:38.690 align:start position:0% parity check but the big question is how 00:06:38.690 --> 00:06:41.290 align:start position:0% parity check but the big question is how do<00:06:38.750> we<00:06:38.870> use<00:06:39.169> that<00:06:39.200> and<00:06:39.880> that's<00:06:40.880> where<00:06:41.120> it's 00:06:41.290 --> 00:06:41.300 align:start position:0% do we use that and that's where it's 00:06:41.300 --> 00:06:41.860 align:start position:0% do we use that and that's where it's okay 00:06:41.860 --> 00:06:41.870 align:start position:0% okay 00:06:41.870 --> 00:06:44.260 align:start position:0% okay comes<00:06:42.170> in<00:06:42.380> so<00:06:42.890> the<00:06:43.040> vision<00:06:43.250> of<00:06:43.550> this<00:06:43.940> toolbox 00:06:44.260 --> 00:06:44.270 align:start position:0% comes in so the vision of this toolbox 00:06:44.270 --> 00:06:47.740 align:start position:0% comes in so the vision of this toolbox is<00:06:44.660> to<00:06:44.960> provide<00:06:45.260> a<00:06:45.320> usable<00:06:45.920> abstraction<00:06:46.750> and 00:06:47.740 --> 00:06:47.750 align:start position:0% is to provide a usable abstraction and 00:06:47.750 --> 00:06:50.710 align:start position:0% is to provide a usable abstraction and tooling<00:06:48.440> to<00:06:49.100> support<00:06:49.700> CKD<00:06:50.090> snarks<00:06:50.450> Ani 00:06:50.710 --> 00:06:50.720 align:start position:0% tooling to support CKD snarks Ani 00:06:50.720 --> 00:06:53.590 align:start position:0% tooling to support CKD snarks Ani theorem<00:06:51.170> to<00:06:51.410> actually<00:06:51.920> make<00:06:52.130> them<00:06:52.310> usable<00:06:52.640> the 00:06:53.590 --> 00:06:53.600 align:start position:0% theorem to actually make them usable the 00:06:53.600 --> 00:06:56.290 align:start position:0% theorem to actually make them usable the goal<00:06:53.810> is<00:06:54.050> to<00:06:54.350> support<00:06:54.890> the<00:06:55.250> complete<00:06:55.670> process 00:06:56.290 --> 00:06:56.300 align:start position:0% goal is to support the complete process 00:06:56.300 --> 00:07:00.280 align:start position:0% goal is to support the complete process from<00:06:56.870> program<00:06:57.830> code<00:06:58.150> specification<00:06:59.150> to<00:06:59.840> on 00:07:00.280 --> 00:07:00.290 align:start position:0% from program code specification to on 00:07:00.290 --> 00:07:03.550 align:start position:0% from program code specification to on chain<00:07:00.890> verification<00:07:01.790> of<00:07:01.970> the<00:07:02.750> execution<00:07:03.410> of 00:07:03.550 --> 00:07:03.560 align:start position:0% chain verification of the execution of 00:07:03.560 --> 00:07:06.010 align:start position:0% chain verification of the execution of that<00:07:03.650> program<00:07:04.460> code<00:07:04.730> it's<00:07:05.450> supposed<00:07:05.840> to 00:07:06.010 --> 00:07:06.020 align:start position:0% that program code it's supposed to 00:07:06.020 --> 00:07:07.930 align:start position:0% that program code it's supposed to seamlessly<00:07:06.680> integrate<00:07:07.220> with<00:07:07.280> the<00:07:07.550> theorem 00:07:07.930 --> 00:07:07.940 align:start position:0% seamlessly integrate with the theorem 00:07:07.940 --> 00:07:09.940 align:start position:0% seamlessly integrate with the theorem and<00:07:08.060> how<00:07:08.750> it<00:07:08.930> does<00:07:09.110> that<00:07:09.320> we'll<00:07:09.560> see<00:07:09.800> in<00:07:09.890> a 00:07:09.940 --> 00:07:09.950 align:start position:0% and how it does that we'll see in a 00:07:09.950 --> 00:07:11.790 align:start position:0% and how it does that we'll see in a minute 00:07:11.790 --> 00:07:11.800 align:start position:0% minute 00:07:11.800 --> 00:07:14.980 align:start position:0% minute so<00:07:12.800> cretons<00:07:13.160> comprises<00:07:13.910> several<00:07:14.150> things<00:07:14.570> one 00:07:14.980 --> 00:07:14.990 align:start position:0% so cretons comprises several things one 00:07:14.990 --> 00:07:17.440 align:start position:0% so cretons comprises several things one is<00:07:15.320> a<00:07:15.380> domain-specific<00:07:16.090> high-level<00:07:17.090> language 00:07:17.440 --> 00:07:17.450 align:start position:0% is a domain-specific high-level language 00:07:17.450 --> 00:07:19.870 align:start position:0% is a domain-specific high-level language that<00:07:18.260> allows<00:07:18.560> you<00:07:18.770> to<00:07:18.860> specify<00:07:19.310> your 00:07:19.870 --> 00:07:19.880 align:start position:0% that allows you to specify your 00:07:19.880 --> 00:07:22.570 align:start position:0% that allows you to specify your computation<00:07:20.630> in<00:07:20.780> a<00:07:21.050> more<00:07:21.230> abstract<00:07:21.440> way<00:07:21.950> than 00:07:22.570 --> 00:07:22.580 align:start position:0% computation in a more abstract way than 00:07:22.580 --> 00:07:24.910 align:start position:0% computation in a more abstract way than arithmetic<00:07:23.390> circuits<00:07:23.840> or<00:07:24.020> Anquan<00:07:24.470> constraint 00:07:24.910 --> 00:07:24.920 align:start position:0% arithmetic circuits or Anquan constraint 00:07:24.920 --> 00:07:27.940 align:start position:0% arithmetic circuits or Anquan constraint systems<00:07:25.310> which<00:07:25.850> are<00:07:26.120> inconvenient<00:07:26.810> then<00:07:27.710> we 00:07:27.940 --> 00:07:27.950 align:start position:0% systems which are inconvenient then we 00:07:27.950 --> 00:07:30.220 align:start position:0% systems which are inconvenient then we have<00:07:28.070> a<00:07:28.100> compiler<00:07:28.640> which<00:07:29.150> transforms<00:07:29.990> these 00:07:30.220 --> 00:07:30.230 align:start position:0% have a compiler which transforms these 00:07:30.230 --> 00:07:32.860 align:start position:0% have a compiler which transforms these programs<00:07:30.770> into<00:07:31.240> provable<00:07:32.240> constraint 00:07:32.860 --> 00:07:32.870 align:start position:0% programs into provable constraint 00:07:32.870 --> 00:07:36.190 align:start position:0% programs into provable constraint systems<00:07:33.350> and<00:07:34.030> then<00:07:35.030> there's<00:07:35.300> support<00:07:35.690> for<00:07:35.840> the 00:07:36.190 --> 00:07:36.200 align:start position:0% systems and then there's support for the 00:07:36.200 --> 00:07:38.050 align:start position:0% systems and then there's support for the different<00:07:36.560> phases<00:07:36.980> we<00:07:37.340> need<00:07:37.520> to<00:07:37.640> go<00:07:37.790> through 00:07:38.050 --> 00:07:38.060 align:start position:0% different phases we need to go through 00:07:38.060 --> 00:07:40.180 align:start position:0% different phases we need to go through with<00:07:38.330> our<00:07:38.570> CKD<00:07:38.960> Snorks<00:07:39.320> so<00:07:39.470> the<00:07:39.620> setup<00:07:39.950> phase 00:07:40.180 --> 00:07:40.190 align:start position:0% with our CKD Snorks so the setup phase 00:07:40.190 --> 00:07:42.640 align:start position:0% with our CKD Snorks so the setup phase finding<00:07:41.150> a<00:07:41.210> solution<00:07:41.750> to<00:07:41.960> our<00:07:41.990> constraint 00:07:42.640 --> 00:07:42.650 align:start position:0% finding a solution to our constraint 00:07:42.650 --> 00:07:45.160 align:start position:0% finding a solution to our constraint system<00:07:43.100> which<00:07:43.880> is<00:07:44.060> the<00:07:44.180> witness<00:07:44.480> computation 00:07:45.160 --> 00:07:45.170 align:start position:0% system which is the witness computation 00:07:45.170 --> 00:07:47.980 align:start position:0% system which is the witness computation the<00:07:45.710> proof<00:07:45.920> generation<00:07:46.460> itself<00:07:46.760> and<00:07:47.090> then<00:07:47.660> we 00:07:47.980 --> 00:07:47.990 align:start position:0% the proof generation itself and then we 00:07:47.990 --> 00:07:50.260 align:start position:0% the proof generation itself and then we can<00:07:48.170> also<00:07:48.380> using<00:07:49.010> the<00:07:49.100> tool<00:07:49.340> export<00:07:50.120> the 00:07:50.260 --> 00:07:50.270 align:start position:0% can also using the tool export the 00:07:50.270 --> 00:07:52.150 align:start position:0% can also using the tool export the solidity<00:07:50.720> smart<00:07:51.140> contract<00:07:51.620> that<00:07:51.770> can<00:07:51.920> then<00:07:52.100> be 00:07:52.150 --> 00:07:52.160 align:start position:0% solidity smart contract that can then be 00:07:52.160 --> 00:07:55.860 align:start position:0% solidity smart contract that can then be used<00:07:52.490> to<00:07:53.060> verify<00:07:53.210> the<00:07:53.600> computation<00:07:54.530> on<00:07:54.740> chain 00:07:55.860 --> 00:07:55.870 align:start position:0% used to verify the computation on chain 00:07:55.870 --> 00:07:59.860 align:start position:0% used to verify the computation on chain let's<00:07:56.870> briefly<00:07:57.200> look<00:07:57.440> at<00:07:57.710> the<00:07:58.430> language<00:07:58.940> so 00:07:59.860 --> 00:07:59.870 align:start position:0% let's briefly look at the language so 00:07:59.870 --> 00:08:01.540 align:start position:0% let's briefly look at the language so the<00:08:00.080> language<00:08:00.440> at<00:08:00.680> this<00:08:00.950> point<00:08:01.280> is<00:08:01.400> pretty 00:08:01.540 --> 00:08:01.550 align:start position:0% the language at this point is pretty 00:08:01.550 --> 00:08:03.730 align:start position:0% the language at this point is pretty close<00:08:01.910> to<00:08:01.940> the<00:08:02.270> constraint<00:08:02.780> system<00:08:03.260> but 00:08:03.730 --> 00:08:03.740 align:start position:0% close to the constraint system but 00:08:03.740 --> 00:08:04.960 align:start position:0% close to the constraint system but provides<00:08:04.130> some<00:08:04.370> more<00:08:04.580> convenient 00:08:04.960 --> 00:08:04.970 align:start position:0% provides some more convenient 00:08:04.970 --> 00:08:07.840 align:start position:0% provides some more convenient abstractions<00:08:05.750> to<00:08:05.840> specify<00:08:06.440> circuits<00:08:06.890> so<00:08:07.490> the 00:08:07.840 --> 00:08:07.850 align:start position:0% abstractions to specify circuits so the 00:08:07.850 --> 00:08:10.270 align:start position:0% abstractions to specify circuits so the data<00:08:08.060> type<00:08:08.390> we<00:08:08.600> have<00:08:08.630> is<00:08:09.170> prime<00:08:09.560> field<00:08:09.830> element 00:08:10.270 --> 00:08:10.280 align:start position:0% data type we have is prime field element 00:08:10.280 --> 00:08:13.810 align:start position:0% data type we have is prime field element you<00:08:10.550> can<00:08:10.580> just<00:08:11.030> think<00:08:11.480> of<00:08:11.720> these<00:08:12.260> as<00:08:12.820> positive 00:08:13.810 --> 00:08:13.820 align:start position:0% you can just think of these as positive 00:08:13.820 --> 00:08:16.810 align:start position:0% you can just think of these as positive numbers<00:08:14.240> smaller<00:08:15.140> than<00:08:15.560> a<00:08:15.800> huge<00:08:16.160> prime<00:08:16.460> number 00:08:16.810 --> 00:08:16.820 align:start position:0% numbers smaller than a huge prime number 00:08:16.820 --> 00:08:18.790 align:start position:0% numbers smaller than a huge prime number so<00:08:17.030> essentially<00:08:17.510> think<00:08:17.840> of<00:08:17.960> it<00:08:18.080> as<00:08:18.290> positive 00:08:18.790 --> 00:08:18.800 align:start position:0% so essentially think of it as positive 00:08:18.800 --> 00:08:21.010 align:start position:0% so essentially think of it as positive numbers<00:08:19.250> then<00:08:19.910> we<00:08:20.090> have<00:08:20.300> imparative 00:08:21.010 --> 00:08:21.020 align:start position:0% numbers then we have imparative 00:08:21.020 --> 00:08:23.980 align:start position:0% numbers then we have imparative statements<00:08:21.800> which<00:08:22.430> is<00:08:22.640> the<00:08:23.150> abstraction<00:08:23.570> most 00:08:23.980 --> 00:08:23.990 align:start position:0% statements which is the abstraction most 00:08:23.990 --> 00:08:25.570 align:start position:0% statements which is the abstraction most of<00:08:24.140> you<00:08:24.290> should<00:08:24.770> be<00:08:24.800> used<00:08:25.160> to<00:08:25.280> when 00:08:25.570 --> 00:08:25.580 align:start position:0% of you should be used to when 00:08:25.580 --> 00:08:29.500 align:start position:0% of you should be used to when programming<00:08:26.620> we<00:08:27.620> have<00:08:27.650> assertions<00:08:28.370> we<00:08:29.330> have 00:08:29.500 --> 00:08:29.510 align:start position:0% programming we have assertions we have 00:08:29.510 --> 00:08:33.190 align:start position:0% programming we have assertions we have loops<00:08:30.100> we<00:08:31.100> have<00:08:31.130> conditionals<00:08:32.060> and<00:08:32.360> we<00:08:33.050> have 00:08:33.190 --> 00:08:33.200 align:start position:0% loops we have conditionals and we have 00:08:33.200 --> 00:08:35.710 align:start position:0% loops we have conditionals and we have functions<00:08:33.770> which<00:08:34.220> allow<00:08:34.550> you<00:08:34.610> to<00:08:35.030> structure 00:08:35.710 --> 00:08:35.720 align:start position:0% functions which allow you to structure 00:08:35.720 --> 00:08:38.020 align:start position:0% functions which allow you to structure your<00:08:35.900> code<00:08:36.080> and<00:08:36.680> keep<00:08:36.950> it<00:08:37.190> a<00:08:37.400> bit<00:08:37.790> less 00:08:38.020 --> 00:08:38.030 align:start position:0% your code and keep it a bit less 00:08:38.030 --> 00:08:41.710 align:start position:0% your code and keep it a bit less redundant<00:08:39.250> so<00:08:40.250> let's<00:08:40.610> look<00:08:40.850> at<00:08:41.030> an<00:08:41.180> example 00:08:41.710 --> 00:08:41.720 align:start position:0% redundant so let's look at an example 00:08:41.720 --> 00:08:45.250 align:start position:0% redundant so let's look at an example here<00:08:42.220> for<00:08:43.220> answers<00:08:43.760> K<00:08:44.000> or<00:08:44.270> a<00:08:44.330> binomial 00:08:45.250 --> 00:08:45.260 align:start position:0% here for answers K or a binomial 00:08:45.260 --> 00:08:48.700 align:start position:0% here for answers K or a binomial coefficient<00:08:46.570> the<00:08:47.570> upper<00:08:47.990> function<00:08:48.470> here 00:08:48.700 --> 00:08:48.710 align:start position:0% coefficient the upper function here 00:08:48.710 --> 00:08:50.830 align:start position:0% coefficient the upper function here computes<00:08:49.250> the<00:08:49.430> factorial<00:08:49.970> will<00:08:50.240> not<00:08:50.450> look<00:08:50.630> at 00:08:50.830 --> 00:08:50.840 align:start position:0% computes the factorial will not look at 00:08:50.840 --> 00:08:52.840 align:start position:0% computes the factorial will not look at that<00:08:51.080> in<00:08:51.560> detail<00:08:51.830> because<00:08:52.160> it's<00:08:52.520> just<00:08:52.700> not 00:08:52.840 --> 00:08:52.850 align:start position:0% that in detail because it's just not 00:08:52.850 --> 00:08:54.430 align:start position:0% that in detail because it's just not important<00:08:53.240> what's<00:08:53.420> more<00:08:53.690> interesting<00:08:53.870> here 00:08:54.430 --> 00:08:54.440 align:start position:0% important what's more interesting here 00:08:54.440 --> 00:08:55.180 align:start position:0% important what's more interesting here is<00:08:54.590> too<00:08:54.920> low 00:08:55.180 --> 00:08:55.190 align:start position:0% is too low 00:08:55.190 --> 00:08:58.000 align:start position:0% is too low is<00:08:55.670> the<00:08:55.820> main<00:08:56.030> function<00:08:56.510> as<00:08:56.750> you<00:08:57.290> can<00:08:57.500> see<00:08:57.710> the 00:08:58.000 --> 00:08:58.010 align:start position:0% is the main function as you can see the 00:08:58.010 --> 00:09:00.310 align:start position:0% is the main function as you can see the main<00:08:58.190> function<00:08:58.640> here<00:08:58.670> takes<00:08:59.240> two<00:08:59.510> arguments<00:08:59.900> N 00:09:00.310 --> 00:09:00.320 align:start position:0% main function here takes two arguments N 00:09:00.320 --> 00:09:03.130 align:start position:0% main function here takes two arguments N and<00:09:00.710> K<00:09:01.250> and<00:09:01.520> then<00:09:02.390> there's<00:09:02.660> a<00:09:02.720> return 00:09:03.130 --> 00:09:03.140 align:start position:0% and K and then there's a return 00:09:03.140 --> 00:09:08.680 align:start position:0% and K and then there's a return statement<00:09:04.270> now<00:09:05.270> in<00:09:05.600> Socrates<00:09:06.850> the<00:09:07.850> arguments 00:09:08.680 --> 00:09:08.690 align:start position:0% statement now in Socrates the arguments 00:09:08.690 --> 00:09:10.780 align:start position:0% statement now in Socrates the arguments of<00:09:08.810> the<00:09:08.870> main<00:09:09.110> function<00:09:09.620> and<00:09:09.770> the<00:09:10.340> value<00:09:10.370> of 00:09:10.780 --> 00:09:10.790 align:start position:0% of the main function and the value of 00:09:10.790 --> 00:09:13.270 align:start position:0% of the main function and the value of the<00:09:10.910> return<00:09:11.240> statement<00:09:11.570> are<00:09:12.020> public<00:09:12.950> that 00:09:13.270 --> 00:09:13.280 align:start position:0% the return statement are public that 00:09:13.280 --> 00:09:16.060 align:start position:0% the return statement are public that means<00:09:13.550> when<00:09:14.360> you<00:09:14.480> prove<00:09:14.750> that<00:09:15.260> computation 00:09:16.060 --> 00:09:16.070 align:start position:0% means when you prove that computation 00:09:16.070 --> 00:09:18.130 align:start position:0% means when you prove that computation you<00:09:16.220> use<00:09:16.400> that<00:09:16.580> code<00:09:16.850> to<00:09:17.090> prove<00:09:17.330> the<00:09:17.720> correct 00:09:18.130 --> 00:09:18.140 align:start position:0% you use that code to prove the correct 00:09:18.140 --> 00:09:22.240 align:start position:0% you use that code to prove the correct execution<00:09:18.460> execution<00:09:19.460> of<00:09:19.880> that<00:09:20.450> code<00:09:20.780> and<00:09:21.250> K 00:09:22.240 --> 00:09:22.250 align:start position:0% execution execution of that code and K 00:09:22.250 --> 00:09:25.000 align:start position:0% execution execution of that code and K and<00:09:22.490> the<00:09:23.210> return<00:09:23.570> value<00:09:23.960> become<00:09:24.320> public<00:09:24.770> if 00:09:25.000 --> 00:09:25.010 align:start position:0% and the return value become public if 00:09:25.010 --> 00:09:26.980 align:start position:0% and the return value become public if you<00:09:25.520> do<00:09:25.670> not<00:09:25.820> want<00:09:26.090> that<00:09:26.300> to<00:09:26.420> happen<00:09:26.570> if<00:09:26.840> you 00:09:26.980 --> 00:09:26.990 align:start position:0% you do not want that to happen if you 00:09:26.990 --> 00:09:28.390 align:start position:0% you do not want that to happen if you want<00:09:27.200> to<00:09:27.290> keep<00:09:27.470> that<00:09:27.650> private<00:09:27.950> that 00:09:28.390 --> 00:09:28.400 align:start position:0% want to keep that private that 00:09:28.400 --> 00:09:30.640 align:start position:0% want to keep that private that information<00:09:29.060> you<00:09:29.390> can<00:09:29.570> simply<00:09:29.930> not<00:09:30.080> list<00:09:30.410> it 00:09:30.640 --> 00:09:30.650 align:start position:0% information you can simply not list it 00:09:30.650 --> 00:09:34.390 align:start position:0% information you can simply not list it as<00:09:31.250> arguments<00:09:32.000> but<00:09:32.420> still<00:09:32.780> use<00:09:33.290> the<00:09:33.620> variables 00:09:34.390 --> 00:09:34.400 align:start position:0% as arguments but still use the variables 00:09:34.400 --> 00:09:37.120 align:start position:0% as arguments but still use the variables in<00:09:34.610> the<00:09:35.030> processing<00:09:35.690> as<00:09:35.870> we<00:09:36.080> do<00:09:36.200> here<00:09:36.440> and<00:09:36.620> then 00:09:37.120 --> 00:09:37.130 align:start position:0% in the processing as we do here and then 00:09:37.130 --> 00:09:40.890 align:start position:0% in the processing as we do here and then when<00:09:37.760> you<00:09:38.090> supply<00:09:38.780> the<00:09:38.930> proof<00:09:39.380> and<00:09:39.710> the<00:09:40.040> inputs 00:09:40.890 --> 00:09:40.900 align:start position:0% when you supply the proof and the inputs 00:09:40.900 --> 00:09:44.140 align:start position:0% when you supply the proof and the inputs and<00:09:41.900> on<00:09:42.230> K<00:09:42.470> do<00:09:42.680> not<00:09:42.710> appear<00:09:43.250> in<00:09:43.370> there<00:09:43.580> and<00:09:43.820> all 00:09:44.140 --> 00:09:44.150 align:start position:0% and on K do not appear in there and all 00:09:44.150 --> 00:09:45.880 align:start position:0% and on K do not appear in there and all the<00:09:44.330> person<00:09:44.780> verifying<00:09:45.290> the<00:09:45.440> thing<00:09:45.680> would 00:09:45.880 --> 00:09:45.890 align:start position:0% the person verifying the thing would 00:09:45.890 --> 00:09:48.940 align:start position:0% the person verifying the thing would know<00:09:46.100> is<00:09:46.370> that<00:09:47.090> you<00:09:47.330> computed<00:09:48.110> the<00:09:48.410> binomial 00:09:48.940 --> 00:09:48.950 align:start position:0% know is that you computed the binomial 00:09:48.950 --> 00:09:51.250 align:start position:0% know is that you computed the binomial coefficient<00:09:49.610> and<00:09:49.700> what<00:09:50.150> the<00:09:50.270> result<00:09:50.660> was<00:09:50.870> but 00:09:51.250 --> 00:09:51.260 align:start position:0% coefficient and what the result was but 00:09:51.260 --> 00:09:56.260 align:start position:0% coefficient and what the result was but NK<00:09:51.920> will<00:09:52.220> not<00:09:52.430> be<00:09:52.640> known<00:09:54.550> let's<00:09:55.550> look<00:09:55.940> at<00:09:56.120> the 00:09:56.260 --> 00:09:56.270 align:start position:0% NK will not be known let's look at the 00:09:56.270 --> 00:09:58.420 align:start position:0% NK will not be known let's look at the user<00:09:56.510> perspective<00:09:56.900> and<00:09:57.710> command-line 00:09:58.420 --> 00:09:58.430 align:start position:0% user perspective and command-line 00:09:58.430 --> 00:10:01.090 align:start position:0% user perspective and command-line interface<00:09:59.120> or<00:09:59.390> purchase<00:09:59.750> provides<00:10:00.170> you<00:10:00.410> so 00:10:01.090 --> 00:10:01.100 align:start position:0% interface or purchase provides you so 00:10:01.100 --> 00:10:03.490 align:start position:0% interface or purchase provides you so you<00:10:01.220> start<00:10:01.640> with<00:10:01.760> high<00:10:02.270> level<00:10:02.570> code<00:10:02.810> you<00:10:03.320> write 00:10:03.490 --> 00:10:03.500 align:start position:0% you start with high level code you write 00:10:03.500 --> 00:10:05.710 align:start position:0% you start with high level code you write that<00:10:03.740> high<00:10:03.950> level<00:10:04.280> code<00:10:04.490> and<00:10:04.730> it<00:10:04.970> gets 00:10:05.710 --> 00:10:05.720 align:start position:0% that high level code and it gets 00:10:05.720 --> 00:10:08.410 align:start position:0% that high level code and it gets compiled<00:10:06.200> to<00:10:06.890> a<00:10:06.920> set<00:10:07.460> of<00:10:07.490> conditions<00:10:07.940> were 00:10:08.410 --> 00:10:08.420 align:start position:0% compiled to a set of conditions were 00:10:08.420 --> 00:10:11.590 align:start position:0% compiled to a set of conditions were also<00:10:08.810> called<00:10:09.200> flatten<00:10:09.710> code<00:10:10.150> based<00:10:11.150> on<00:10:11.390> that 00:10:11.590 --> 00:10:11.600 align:start position:0% also called flatten code based on that 00:10:11.600 --> 00:10:15.300 align:start position:0% also called flatten code based on that you<00:10:11.780> can<00:10:11.960> then<00:10:12.170> find<00:10:12.470> a<00:10:12.680> very<00:10:13.870> valid<00:10:14.870> variable 00:10:15.300 --> 00:10:15.310 align:start position:0% you can then find a very valid variable 00:10:15.310 --> 00:10:18.130 align:start position:0% you can then find a very valid variable assignment<00:10:16.310> for<00:10:16.730> that<00:10:16.910> code<00:10:17.330> which<00:10:17.930> is 00:10:18.130 --> 00:10:18.140 align:start position:0% assignment for that code which is 00:10:18.140 --> 00:10:20.140 align:start position:0% assignment for that code which is basically<00:10:18.560> a<00:10:18.710> solution<00:10:19.250> to<00:10:19.490> your<00:10:19.520> program<00:10:20.000> and 00:10:20.140 --> 00:10:20.150 align:start position:0% basically a solution to your program and 00:10:20.150 --> 00:10:23.230 align:start position:0% basically a solution to your program and that's<00:10:20.780> called<00:10:21.290> a<00:10:21.500> witness<00:10:21.680> so<00:10:22.490> you<00:10:22.550> can<00:10:22.880> use 00:10:23.230 --> 00:10:23.240 align:start position:0% that's called a witness so you can use 00:10:23.240 --> 00:10:25.810 align:start position:0% that's called a witness so you can use the<00:10:23.390> tool<00:10:23.600> to<00:10:23.900> find<00:10:24.830> solutions<00:10:25.430> for<00:10:25.550> your 00:10:25.810 --> 00:10:25.820 align:start position:0% the tool to find solutions for your 00:10:25.820 --> 00:10:28.570 align:start position:0% the tool to find solutions for your programs<00:10:26.240> and<00:10:26.540> it<00:10:27.290> also<00:10:27.470> supports<00:10:28.100> you<00:10:28.340> with<00:10:28.520> a 00:10:28.570 --> 00:10:28.580 align:start position:0% programs and it also supports you with a 00:10:28.580 --> 00:10:31.800 align:start position:0% programs and it also supports you with a setup<00:10:29.180> phase<00:10:29.570> so<00:10:30.200> you<00:10:30.230> can<00:10:30.590> use<00:10:30.800> a<00:10:30.830> tool<00:10:31.160> to 00:10:31.800 --> 00:10:31.810 align:start position:0% setup phase so you can use a tool to 00:10:31.810 --> 00:10:35.080 align:start position:0% setup phase so you can use a tool to compute<00:10:32.810> a<00:10:32.990> verification<00:10:33.440> key<00:10:34.070> and<00:10:34.340> approving 00:10:35.080 --> 00:10:35.090 align:start position:0% compute a verification key and approving 00:10:35.090 --> 00:10:37.360 align:start position:0% compute a verification key and approving key<00:10:35.330> which<00:10:35.780> you<00:10:35.990> will<00:10:36.230> need<00:10:36.590> later<00:10:36.830> on 00:10:37.360 --> 00:10:37.370 align:start position:0% key which you will need later on 00:10:37.370 --> 00:10:40.540 align:start position:0% key which you will need later on based<00:10:38.000> on<00:10:38.270> the<00:10:38.570> verification<00:10:39.320> key<00:10:39.560> you<00:10:40.310> can 00:10:40.540 --> 00:10:40.550 align:start position:0% based on the verification key you can 00:10:40.550 --> 00:10:42.880 align:start position:0% based on the verification key you can derive<00:10:40.940> a<00:10:41.300> solidity<00:10:41.870> smart<00:10:42.350> contract 00:10:42.880 --> 00:10:42.890 align:start position:0% derive a solidity smart contract 00:10:42.890 --> 00:10:45.700 align:start position:0% derive a solidity smart contract deployed<00:10:43.640> to<00:10:44.060> the<00:10:44.089> network<00:10:44.480> and<00:10:44.720> then<00:10:45.170> verify 00:10:45.700 --> 00:10:45.710 align:start position:0% deployed to the network and then verify 00:10:45.710 --> 00:10:48.190 align:start position:0% deployed to the network and then verify proves<00:10:46.190> that<00:10:46.790> were<00:10:47.060> generated<00:10:47.690> with<00:10:48.170> the 00:10:48.190 --> 00:10:48.200 align:start position:0% proves that were generated with the 00:10:48.200 --> 00:10:50.470 align:start position:0% proves that were generated with the proving<00:10:48.740> key<00:10:48.980> that<00:10:49.430> came<00:10:49.700> out<00:10:49.910> of<00:10:50.089> the<00:10:50.270> same 00:10:50.470 --> 00:10:50.480 align:start position:0% proving key that came out of the same 00:10:50.480 --> 00:10:53.470 align:start position:0% proving key that came out of the same set<00:10:50.810> of<00:10:50.839> face<00:10:51.200> and<00:10:51.470> to<00:10:52.430> generate<00:10:52.910> a<00:10:53.180> proof 00:10:53.470 --> 00:10:53.480 align:start position:0% set of face and to generate a proof 00:10:53.480 --> 00:10:57.940 align:start position:0% set of face and to generate a proof there's<00:10:54.170> that<00:10:54.589> generate<00:10:55.040> proof<00:10:56.230> ya<00:10:57.230> command 00:10:57.940 --> 00:10:57.950 align:start position:0% there's that generate proof ya command 00:10:57.950 --> 00:11:00.760 align:start position:0% there's that generate proof ya command which<00:10:58.730> takes<00:10:59.210> a<00:10:59.360> given<00:10:59.660> witness<00:11:00.050> that<00:11:00.589> you 00:11:00.760 --> 00:11:00.770 align:start position:0% which takes a given witness that you 00:11:00.770 --> 00:11:03.520 align:start position:0% which takes a given witness that you computed<00:11:01.400> previously<00:11:01.640> and<00:11:02.330> to<00:11:02.930> proving<00:11:03.260> key 00:11:03.520 --> 00:11:03.530 align:start position:0% computed previously and to proving key 00:11:03.530 --> 00:11:06.130 align:start position:0% computed previously and to proving key and<00:11:03.800> together<00:11:04.280> you<00:11:05.089> generate<00:11:05.510> a<00:11:05.540> proof<00:11:05.839> that 00:11:06.130 --> 00:11:06.140 align:start position:0% and together you generate a proof that 00:11:06.140 --> 00:11:09.160 align:start position:0% and together you generate a proof that can<00:11:06.320> then<00:11:06.500> be<00:11:07.089> verified<00:11:08.089> by<00:11:08.390> the<00:11:08.420> smartphone 00:11:09.160 --> 00:11:09.170 align:start position:0% can then be verified by the smartphone 00:11:09.170 --> 00:11:12.670 align:start position:0% can then be verified by the smartphone correct<00:11:09.440> you<00:11:09.889> created<00:11:10.430> beforehand<00:11:11.680> the 00:11:12.670 --> 00:11:12.680 align:start position:0% correct you created beforehand the 00:11:12.680 --> 00:11:14.949 align:start position:0% correct you created beforehand the internal<00:11:13.130> architecture<00:11:13.279> of<00:11:13.880> tool<00:11:14.240> looks<00:11:14.690> like 00:11:14.949 --> 00:11:14.959 align:start position:0% internal architecture of tool looks like 00:11:14.959 --> 00:11:18.190 align:start position:0% internal architecture of tool looks like this<00:11:15.200> so<00:11:15.649> we<00:11:15.889> start<00:11:16.279> with<00:11:16.899> code<00:11:17.899> in<00:11:18.170> that 00:11:18.190 --> 00:11:18.200 align:start position:0% this so we start with code in that 00:11:18.200 --> 00:11:20.829 align:start position:0% this so we start with code in that domain-specific<00:11:18.829> language<00:11:19.700> and<00:11:19.970> that<00:11:20.660> goes 00:11:20.829 --> 00:11:20.839 align:start position:0% domain-specific language and that goes 00:11:20.839 --> 00:11:24.460 align:start position:0% domain-specific language and that goes into<00:11:21.050> part<00:11:21.470> powder<00:11:22.279> is<00:11:22.779> then<00:11:23.779> flattened<00:11:24.350> and 00:11:24.460 --> 00:11:24.470 align:start position:0% into part powder is then flattened and 00:11:24.470 --> 00:11:27.449 align:start position:0% into part powder is then flattened and then<00:11:25.100> we<00:11:25.250> have<00:11:25.430> an<00:11:25.610> interpreter<00:11:26.300> which 00:11:27.449 --> 00:11:27.459 align:start position:0% then we have an interpreter which 00:11:27.459 --> 00:11:31.449 align:start position:0% then we have an interpreter which computes<00:11:28.459> solution<00:11:29.060> to<00:11:29.420> the<00:11:29.600> program<00:11:30.560> here 00:11:31.449 --> 00:11:31.459 align:start position:0% computes solution to the program here 00:11:31.459 --> 00:11:34.240 align:start position:0% computes solution to the program here you<00:11:31.670> can<00:11:31.940> decide<00:11:32.300> which<00:11:33.139> part<00:11:33.560> of<00:11:33.740> the 00:11:34.240 --> 00:11:34.250 align:start position:0% you can decide which part of the 00:11:34.250 --> 00:11:36.970 align:start position:0% you can decide which part of the solution<00:11:35.060> will<00:11:35.570> become<00:11:36.110> publicly<00:11:36.740> available 00:11:36.970 --> 00:11:36.980 align:start position:0% solution will become publicly available 00:11:36.980 --> 00:11:39.699 align:start position:0% solution will become publicly available and<00:11:37.490> which<00:11:37.880> part<00:11:38.269> will<00:11:38.600> remain<00:11:38.930> private<00:11:39.320> so 00:11:39.699 --> 00:11:39.709 align:start position:0% and which part will remain private so 00:11:39.709 --> 00:11:43.210 align:start position:0% and which part will remain private so here<00:11:39.889> you<00:11:40.040> have<00:11:40.220> the<00:11:40.820> control<00:11:41.240> and<00:11:41.420> then<00:11:42.220> after 00:11:43.210 --> 00:11:43.220 align:start position:0% here you have the control and then after 00:11:43.220 --> 00:11:46.329 align:start position:0% here you have the control and then after that<00:11:43.399> we<00:11:44.329> do<00:11:44.630> just<00:11:45.110> some<00:11:45.320> format<00:11:45.769> conversions 00:11:46.329 --> 00:11:46.339 align:start position:0% that we do just some format conversions 00:11:46.339 --> 00:11:51.759 align:start position:0% that we do just some format conversions to<00:11:47.980> yeah<00:11:48.980> to<00:11:49.480> interface<00:11:50.480> with<00:11:50.930> the<00:11:51.290> lip<00:11:51.470> snark 00:11:51.759 --> 00:11:51.769 align:start position:0% to yeah to interface with the lip snark 00:11:51.769 --> 00:11:55.800 align:start position:0% to yeah to interface with the lip snark library<00:11:52.250> which<00:11:52.579> we<00:11:53.029> use<00:11:53.269> for<00:11:53.510> the<00:11:54.110> CK<00:11:55.100> snark 00:11:55.800 --> 00:11:55.810 align:start position:0% library which we use for the CK snark 00:11:55.810 --> 00:11:59.620 align:start position:0% library which we use for the CK snark operations<00:11:56.810> themselves<00:11:58.149> then<00:11:59.149> there's<00:11:59.449> the 00:11:59.620 --> 00:11:59.630 align:start position:0% operations themselves then there's the 00:11:59.630 --> 00:12:04.199 align:start position:0% operations themselves then there's the contract<00:12:00.139> Explorer<00:12:00.709> which<00:12:01.550> can<00:12:01.880> be<00:12:02.060> used<00:12:02.329> to 00:12:04.199 --> 00:12:04.209 align:start position:0% contract Explorer which can be used to 00:12:04.209 --> 00:12:07.810 align:start position:0% contract Explorer which can be used to export<00:12:05.209> solidity<00:12:05.810> smart<00:12:06.320> contracts<00:12:07.040> to 00:12:07.810 --> 00:12:07.820 align:start position:0% export solidity smart contracts to 00:12:07.820 --> 00:12:10.750 align:start position:0% export solidity smart contracts to verify<00:12:08.240> proofs<00:12:08.949> okay 00:12:10.750 --> 00:12:10.760 align:start position:0% verify proofs okay 00:12:10.760 --> 00:12:17.079 align:start position:0% verify proofs okay the<00:12:11.269> on<00:12:11.750> Jam<00:12:12.260> proof<00:12:14.829> verification<00:12:15.829> looks<00:12:16.820> like 00:12:17.079 --> 00:12:17.089 align:start position:0% the on Jam proof verification looks like 00:12:17.089 --> 00:12:19.650 align:start position:0% the on Jam proof verification looks like this<00:12:17.480> so<00:12:17.810> on<00:12:18.050> the<00:12:18.079> left<00:12:18.470> side<00:12:18.860> here<00:12:19.160> we<00:12:19.370> have 00:12:19.650 --> 00:12:19.660 align:start position:0% this so on the left side here we have 00:12:19.660 --> 00:12:23.130 align:start position:0% this so on the left side here we have what<00:12:20.660> the<00:12:20.899> circuit<00:12:21.350> is<00:12:21.500> to<00:12:21.649> generated<00:12:22.550> is<00:12:22.790> a 00:12:23.130 --> 00:12:23.140 align:start position:0% what the circuit is to generated is a 00:12:23.140 --> 00:12:26.500 align:start position:0% what the circuit is to generated is a proof<00:12:24.140> it<00:12:24.649> consists<00:12:25.579> of<00:12:25.640> eight<00:12:25.880> elliptic 00:12:26.500 --> 00:12:26.510 align:start position:0% proof it consists of eight elliptic 00:12:26.510 --> 00:12:31.810 align:start position:0% proof it consists of eight elliptic curve<00:12:26.750> points<00:12:27.290> and<00:12:28.300> inputs<00:12:29.709> on<00:12:30.709> the<00:12:31.160> other 00:12:31.810 --> 00:12:31.820 align:start position:0% curve points and inputs on the other 00:12:31.820 --> 00:12:34.990 align:start position:0% curve points and inputs on the other side<00:12:32.269> we<00:12:32.660> have<00:12:32.899> a<00:12:33.500> verification<00:12:34.190> contract 00:12:34.990 --> 00:12:35.000 align:start position:0% side we have a verification contract 00:12:35.000 --> 00:12:36.630 align:start position:0% side we have a verification contract which<00:12:35.180> we<00:12:35.360> also<00:12:35.540> generated<00:12:36.320> and<00:12:36.500> that 00:12:36.630 --> 00:12:36.640 align:start position:0% which we also generated and that 00:12:36.640 --> 00:12:40.449 align:start position:0% which we also generated and that contains<00:12:37.640> a<00:12:38.180> verification<00:12:38.839> key<00:12:39.470> seven 00:12:40.449 --> 00:12:40.459 align:start position:0% contains a verification key seven 00:12:40.459 --> 00:12:43.509 align:start position:0% contains a verification key seven elliptic<00:12:40.880> curve<00:12:41.120> point<00:12:41.510> is<00:12:42.380> what<00:12:42.709> that<00:12:43.310> is 00:12:43.509 --> 00:12:43.519 align:start position:0% elliptic curve point is what that is 00:12:43.519 --> 00:12:46.150 align:start position:0% elliptic curve point is what that is made<00:12:43.790> up<00:12:43.970> of<00:12:44.149> and<00:12:44.449> then<00:12:45.260> there's<00:12:45.560> a<00:12:45.620> verify 00:12:46.150 --> 00:12:46.160 align:start position:0% made up of and then there's a verify 00:12:46.160 --> 00:12:49.420 align:start position:0% made up of and then there's a verify function<00:12:46.690> which<00:12:47.690> uses<00:12:48.290> the<00:12:48.529> new<00:12:48.709> precompile 00:12:49.420 --> 00:12:49.430 align:start position:0% function which uses the new precompile 00:12:49.430 --> 00:12:53.710 align:start position:0% function which uses the new precompile that<00:12:49.790> came<00:12:50.089> with<00:12:50.360> Byzantium<00:12:51.079> -<00:12:52.180> yeah<00:12:53.180> check 00:12:53.710 --> 00:12:53.720 align:start position:0% that came with Byzantium - yeah check 00:12:53.720 --> 00:12:58.180 align:start position:0% that came with Byzantium - yeah check the<00:12:54.350> validity<00:12:54.890> of<00:12:55.550> the<00:12:56.240> proof<00:12:56.510> and<00:12:56.829> also<00:12:57.829> make 00:12:58.180 --> 00:12:58.190 align:start position:0% the validity of the proof and also make 00:12:58.190 --> 00:13:03.430 align:start position:0% the validity of the proof and also make sure<00:12:58.220> that<00:12:58.399> the<00:12:58.730> inputs<00:12:59.149> were<00:12:59.779> correct<00:13:02.079> at<00:13:03.079> the 00:13:03.430 --> 00:13:03.440 align:start position:0% sure that the inputs were correct at the 00:13:03.440 --> 00:13:06.309 align:start position:0% sure that the inputs were correct at the moment<00:13:03.890> a<00:13:04.190> verification<00:13:04.699> like<00:13:05.300> that<00:13:05.569> costs 00:13:06.309 --> 00:13:06.319 align:start position:0% moment a verification like that costs 00:13:06.319 --> 00:13:09.100 align:start position:0% moment a verification like that costs around<00:13:06.500> about<00:13:07.149> 1.6<00:13:08.149> million<00:13:08.480> gasps<00:13:08.810> so 00:13:09.100 --> 00:13:09.110 align:start position:0% around about 1.6 million gasps so 00:13:09.110 --> 00:13:12.340 align:start position:0% around about 1.6 million gasps so actually<00:13:09.620> a<00:13:09.649> lot<00:13:10.389> that<00:13:11.389> means<00:13:11.630> on<00:13:11.870> a<00:13:11.899> robson 00:13:12.340 --> 00:13:12.350 align:start position:0% actually a lot that means on a robson 00:13:12.350 --> 00:13:14.680 align:start position:0% actually a lot that means on a robson test<00:13:12.589> net<00:13:12.800> we<00:13:13.069> can<00:13:13.279> do<00:13:13.430> four<00:13:13.790> in<00:13:13.940> one<00:13:14.180> block<00:13:14.420> on 00:13:14.680 --> 00:13:14.690 align:start position:0% test net we can do four in one block on 00:13:14.690 --> 00:13:16.629 align:start position:0% test net we can do four in one block on the<00:13:14.959> may<00:13:15.110> net<00:13:15.319> it's<00:13:15.529> currently<00:13:15.920> six<00:13:16.310> in<00:13:16.490> one 00:13:16.629 --> 00:13:16.639 align:start position:0% the may net it's currently six in one 00:13:16.639 --> 00:13:19.930 align:start position:0% the may net it's currently six in one block<00:13:16.850> the<00:13:17.810> gas<00:13:17.990> cost<00:13:18.319> varies<00:13:18.860> a<00:13:18.890> bit<00:13:19.010> with<00:13:19.430> the 00:13:19.930 --> 00:13:19.940 align:start position:0% block the gas cost varies a bit with the 00:13:19.940 --> 00:13:22.900 align:start position:0% block the gas cost varies a bit with the amount<00:13:20.449> of<00:13:20.660> input<00:13:20.930> parameters<00:13:21.350> we 00:13:22.900 --> 00:13:22.910 align:start position:0% amount of input parameters we 00:13:22.910 --> 00:13:26.970 align:start position:0% amount of input parameters we we<00:13:23.750> give<00:13:24.080> with<00:13:24.500> proof<00:13:24.920> but<00:13:25.700> the<00:13:25.910> main<00:13:26.150> cost<00:13:26.540> is 00:13:26.970 --> 00:13:26.980 align:start position:0% we give with proof but the main cost is 00:13:26.980 --> 00:13:33.700 align:start position:0% we give with proof but the main cost is constant<00:13:27.980> and<00:13:28.610> n<00:13:28.910> rather<00:13:29.480> I<00:13:30.910> a<00:13:32.590> couple<00:13:33.590> of 00:13:33.700 --> 00:13:33.710 align:start position:0% constant and n rather I a couple of 00:13:33.710 --> 00:13:36.670 align:start position:0% constant and n rather I a couple of challenges<00:13:34.040> an<00:13:34.670> outlook<00:13:35.300> of<00:13:35.540> how<00:13:35.600> we<00:13:36.140> want<00:13:36.590> to 00:13:36.670 --> 00:13:36.680 align:start position:0% challenges an outlook of how we want to 00:13:36.680 --> 00:13:38.950 align:start position:0% challenges an outlook of how we want to proceed<00:13:37.040> with<00:13:37.420> circulars<00:13:38.420> what<00:13:38.690> would<00:13:38.840> be 00:13:38.950 --> 00:13:38.960 align:start position:0% proceed with circulars what would be 00:13:38.960 --> 00:13:42.640 align:start position:0% proceed with circulars what would be cool<00:13:39.410> in<00:13:39.590> the<00:13:39.680> future<00:13:39.880> so<00:13:40.880> I<00:13:41.300> think<00:13:41.660> for<00:13:42.500> the 00:13:42.640 --> 00:13:42.650 align:start position:0% cool in the future so I think for the 00:13:42.650 --> 00:13:45.180 align:start position:0% cool in the future so I think for the language<00:13:42.860> to<00:13:43.310> be<00:13:43.490> more<00:13:44.240> usable<00:13:44.900> more 00:13:45.180 --> 00:13:45.190 align:start position:0% language to be more usable more 00:13:45.190 --> 00:13:47.470 align:start position:0% language to be more usable more convenient<00:13:46.190> we<00:13:46.610> would<00:13:46.940> want<00:13:47.180> additional 00:13:47.470 --> 00:13:47.480 align:start position:0% convenient we would want additional 00:13:47.480 --> 00:13:49.890 align:start position:0% convenient we would want additional types<00:13:47.960> so<00:13:48.320> for<00:13:48.560> example<00:13:49.070> boolean<00:13:49.400> types 00:13:49.890 --> 00:13:49.900 align:start position:0% types so for example boolean types 00:13:49.900 --> 00:13:54.280 align:start position:0% types so for example boolean types everything<00:13:51.910> you<00:13:52.910> can<00:13:53.270> do<00:13:53.420> with<00:13:53.450> boolean<00:13:53.990> types 00:13:54.280 --> 00:13:54.290 align:start position:0% everything you can do with boolean types 00:13:54.290 --> 00:13:56.470 align:start position:0% everything you can do with boolean types can<00:13:54.650> be<00:13:54.710> done<00:13:55.040> now<00:13:55.250> that's<00:13:55.610> just<00:13:55.910> not<00:13:56.210> as 00:13:56.470 --> 00:13:56.480 align:start position:0% can be done now that's just not as 00:13:56.480 --> 00:13:58.960 align:start position:0% can be done now that's just not as convenient<00:13:57.020> to<00:13:57.620> do<00:13:57.740> it<00:13:57.920> on<00:13:58.100> prime<00:13:58.700> field 00:13:58.960 --> 00:13:58.970 align:start position:0% convenient to do it on prime field 00:13:58.970 --> 00:14:03.340 align:start position:0% convenient to do it on prime field elements<00:13:59.510> and<00:13:59.690> then<00:14:00.620> some<00:14:02.320> integers<00:14:03.320> that 00:14:03.340 --> 00:14:03.350 align:start position:0% elements and then some integers that 00:14:03.350 --> 00:14:07.560 align:start position:0% elements and then some integers that have<00:14:03.860> a<00:14:03.890> binary<00:14:04.370> representation<00:14:05.770> internally 00:14:07.560 --> 00:14:07.570 align:start position:0% have a binary representation internally 00:14:07.570 --> 00:14:09.700 align:start position:0% have a binary representation internally what's<00:14:08.570> very<00:14:08.810> important<00:14:09.350> and<00:14:09.590> that's 00:14:09.700 --> 00:14:09.710 align:start position:0% what's very important and that's 00:14:09.710 --> 00:14:11.890 align:start position:0% what's very important and that's basically<00:14:10.280> implementation<00:14:11.180> work<00:14:11.360> ahead<00:14:11.630> of 00:14:11.890 --> 00:14:11.900 align:start position:0% basically implementation work ahead of 00:14:11.900 --> 00:14:14.620 align:start position:0% basically implementation work ahead of us<00:14:12.050> is<00:14:12.430> domain-specific<00:14:13.430> library<00:14:14.390> with 00:14:14.620 --> 00:14:14.630 align:start position:0% us is domain-specific library with 00:14:14.630 --> 00:14:17.080 align:start position:0% us is domain-specific library with important<00:14:15.110> functions<00:14:15.530> so<00:14:15.800> next<00:14:16.520> thing<00:14:16.940> we 00:14:17.080 --> 00:14:17.090 align:start position:0% important functions so next thing we 00:14:17.090 --> 00:14:19.750 align:start position:0% important functions so next thing we need<00:14:17.240> in<00:14:17.420> my<00:14:17.540> opinion<00:14:17.900> is<00:14:18.050> a<00:14:18.710> hash<00:14:18.980> function<00:14:19.010> so 00:14:19.750 --> 00:14:19.760 align:start position:0% need in my opinion is a hash function so 00:14:19.760 --> 00:14:22.300 align:start position:0% need in my opinion is a hash function so we<00:14:19.940> can<00:14:19.970> do<00:14:20.330> commitments<00:14:21.140> in<00:14:21.350> circuits<00:14:22.070> and 00:14:22.300 --> 00:14:22.310 align:start position:0% we can do commitments in circuits and 00:14:22.310 --> 00:14:25.780 align:start position:0% we can do commitments in circuits and then<00:14:23.290> signature<00:14:24.290> encryption<00:14:25.190> that<00:14:25.490> would<00:14:25.670> be 00:14:25.780 --> 00:14:25.790 align:start position:0% then signature encryption that would be 00:14:25.790 --> 00:14:28.150 align:start position:0% then signature encryption that would be nice<00:14:25.970> to<00:14:26.180> have<00:14:26.300> also<00:14:26.990> we<00:14:27.530> want<00:14:27.740> to<00:14:27.830> look<00:14:27.980> at 00:14:28.150 --> 00:14:28.160 align:start position:0% nice to have also we want to look at 00:14:28.160 --> 00:14:30.760 align:start position:0% nice to have also we want to look at integration<00:14:28.790> of<00:14:28.910> other<00:14:29.120> front<00:14:29.570> ends<00:14:30.170> that<00:14:30.590> can 00:14:30.760 --> 00:14:30.770 align:start position:0% integration of other front ends that can 00:14:30.770 --> 00:14:33.430 align:start position:0% integration of other front ends that can also<00:14:30.950> be<00:14:31.100> used<00:14:31.400> to<00:14:31.700> arrive<00:14:32.090> at<00:14:32.420> rank<00:14:33.260> one 00:14:33.430 --> 00:14:33.440 align:start position:0% also be used to arrive at rank one 00:14:33.440 --> 00:14:38.310 align:start position:0% also be used to arrive at rank one constraint<00:14:33.920> systems<00:14:34.460> for<00:14:34.730> example<00:14:35.020> Buffett<00:14:36.520> a 00:14:38.310 --> 00:14:38.320 align:start position:0% constraint systems for example Buffett a 00:14:38.320 --> 00:14:41.860 align:start position:0% constraint systems for example Buffett a generic<00:14:39.320> CK<00:14:40.130> snark<00:14:40.460> challenge<00:14:41.150> that<00:14:41.510> is<00:14:41.660> not 00:14:41.860 --> 00:14:41.870 align:start position:0% generic CK snark challenge that is not 00:14:41.870 --> 00:14:46.150 align:start position:0% generic CK snark challenge that is not specific<00:14:42.620> to<00:14:42.670> Socrates<00:14:43.670> but<00:14:43.970> rather<00:14:45.160> yeah 00:14:46.150 --> 00:14:46.160 align:start position:0% specific to Socrates but rather yeah 00:14:46.160 --> 00:14:48.700 align:start position:0% specific to Socrates but rather yeah always<00:14:46.490> comes<00:14:47.180> up<00:14:47.360> when<00:14:47.630> speaking<00:14:48.140> about<00:14:48.320> the 00:14:48.700 --> 00:14:48.710 align:start position:0% always comes up when speaking about the 00:14:48.710 --> 00:14:52.930 align:start position:0% always comes up when speaking about the case<00:14:48.920> Norquist<00:14:49.460> trusted<00:14:50.390> set<00:14:50.900> up<00:14:51.050> phase<00:14:51.520> so<00:14:52.520> if 00:14:52.930 --> 00:14:52.940 align:start position:0% case Norquist trusted set up phase so if 00:14:52.940 --> 00:14:56.110 align:start position:0% case Norquist trusted set up phase so if you<00:14:53.390> supply<00:14:54.130> verification<00:14:55.130> smart<00:14:55.520> contract 00:14:56.110 --> 00:14:56.120 align:start position:0% you supply verification smart contract 00:14:56.120 --> 00:15:00.370 align:start position:0% you supply verification smart contract and<00:14:56.480> you<00:14:57.140> want<00:14:57.410> to<00:14:57.560> verify<00:14:58.210> something<00:14:59.380> someone 00:15:00.370 --> 00:15:00.380 align:start position:0% and you want to verify something someone 00:15:00.380 --> 00:15:02.350 align:start position:0% and you want to verify something someone else<00:15:00.410> proves<00:15:00.890> to<00:15:01.040> you<00:15:01.190> and<00:15:01.460> you<00:15:01.670> only<00:15:02.000> want<00:15:02.300> to 00:15:02.350 --> 00:15:02.360 align:start position:0% else proves to you and you only want to 00:15:02.360 --> 00:15:04.240 align:start position:0% else proves to you and you only want to be<00:15:02.450> convinced<00:15:03.050> you<00:15:03.200> don't<00:15:03.410> have<00:15:03.590> any<00:15:03.770> problem 00:15:04.240 --> 00:15:04.250 align:start position:0% be convinced you don't have any problem 00:15:04.250 --> 00:15:06.580 align:start position:0% be convinced you don't have any problem you<00:15:04.670> run<00:15:04.850> the<00:15:05.030> setup<00:15:05.420> and<00:15:05.630> you<00:15:05.990> know<00:15:06.200> that<00:15:06.440> you 00:15:06.580 --> 00:15:06.590 align:start position:0% you run the setup and you know that you 00:15:06.590 --> 00:15:09.070 align:start position:0% you run the setup and you know that you did<00:15:06.740> it<00:15:06.890> correctly<00:15:07.070> and<00:15:07.700> thus<00:15:08.360> you<00:15:08.540> can<00:15:08.750> trust 00:15:09.070 --> 00:15:09.080 align:start position:0% did it correctly and thus you can trust 00:15:09.080 --> 00:15:10.960 align:start position:0% did it correctly and thus you can trust approves<00:15:09.590> and<00:15:09.890> you<00:15:09.950> know<00:15:10.130> that<00:15:10.370> the<00:15:10.760> person 00:15:10.960 --> 00:15:10.970 align:start position:0% approves and you know that the person 00:15:10.970 --> 00:15:13.240 align:start position:0% approves and you know that the person proving<00:15:11.480> to<00:15:11.630> you<00:15:11.810> cannot<00:15:12.260> take<00:15:12.560> Bruce<00:15:12.830> because 00:15:13.240 --> 00:15:13.250 align:start position:0% proving to you cannot take Bruce because 00:15:13.250 --> 00:15:15.880 align:start position:0% proving to you cannot take Bruce because you<00:15:13.670> were<00:15:13.850> in<00:15:14.000> control<00:15:14.360> of<00:15:14.510> the<00:15:14.690> setup<00:15:14.960> but<00:15:15.710> if 00:15:15.880 --> 00:15:15.890 align:start position:0% you were in control of the setup but if 00:15:15.890 --> 00:15:20.050 align:start position:0% you were in control of the setup but if you<00:15:16.130> want<00:15:16.400> to<00:15:16.610> use<00:15:16.880> these<00:15:17.720> proofs<00:15:18.200> to<00:15:19.060> also 00:15:20.050 --> 00:15:20.060 align:start position:0% you want to use these proofs to also 00:15:20.060 --> 00:15:23.160 align:start position:0% you want to use these proofs to also convinced<00:15:20.600> third<00:15:21.050> parties<00:15:21.620> other<00:15:22.070> parties 00:15:23.160 --> 00:15:23.170 align:start position:0% convinced third parties other parties 00:15:23.170 --> 00:15:25.300 align:start position:0% convinced third parties other parties observing<00:15:24.170> these<00:15:24.290> proofs<00:15:24.620> on<00:15:24.800> on<00:15:25.040> the 00:15:25.300 --> 00:15:25.310 align:start position:0% observing these proofs on on the 00:15:25.310 --> 00:15:28.480 align:start position:0% observing these proofs on on the blockchain<00:15:26.080> then<00:15:27.080> they<00:15:27.380> would<00:15:27.590> have<00:15:28.010> to<00:15:28.190> trust 00:15:28.480 --> 00:15:28.490 align:start position:0% blockchain then they would have to trust 00:15:28.490 --> 00:15:30.400 align:start position:0% blockchain then they would have to trust you<00:15:28.670> with<00:15:28.880> the<00:15:29.030> setup<00:15:29.390> phase<00:15:29.570> so<00:15:30.110> what<00:15:30.290> would 00:15:30.400 --> 00:15:30.410 align:start position:0% you with the setup phase so what would 00:15:30.410 --> 00:15:32.620 align:start position:0% you with the setup phase so what would be<00:15:30.590> great<00:15:30.770> if<00:15:31.160> we<00:15:31.400> could<00:15:31.640> eliminate<00:15:31.910> some<00:15:32.600> of 00:15:32.620 --> 00:15:32.630 align:start position:0% be great if we could eliminate some of 00:15:32.630 --> 00:15:35.710 align:start position:0% be great if we could eliminate some of that<00:15:32.780> trust<00:15:33.380> by<00:15:34.040> integrating<00:15:35.030> a<00:15:35.120> distributed 00:15:35.710 --> 00:15:35.720 align:start position:0% that trust by integrating a distributed 00:15:35.720 --> 00:15:37.240 align:start position:0% that trust by integrating a distributed set<00:15:35.930> of<00:15:36.080> phase 00:15:37.240 --> 00:15:37.250 align:start position:0% set of phase 00:15:37.250 --> 00:15:39.700 align:start position:0% set of phase it<00:15:37.550> just<00:15:38.300> would<00:15:38.630> have<00:15:38.660> to<00:15:38.990> become<00:15:39.350> a<00:15:39.380> bit<00:15:39.680> more 00:15:39.700 --> 00:15:39.710 align:start position:0% it just would have to become a bit more 00:15:39.710 --> 00:15:43.300 align:start position:0% it just would have to become a bit more efficient<00:15:40.490> than<00:15:40.760> it<00:15:40.940> was<00:15:41.270> in<00:15:42.070> C<00:15:43.070> cash 00:15:43.300 --> 00:15:43.310 align:start position:0% efficient than it was in C cash 00:15:43.310 --> 00:15:45.370 align:start position:0% efficient than it was in C cash multi-party<00:15:43.970> computation<00:15:44.210> protocol<00:15:44.900> for 00:15:45.370 --> 00:15:45.380 align:start position:0% multi-party computation protocol for 00:15:45.380 --> 00:15:48.160 align:start position:0% multi-party computation protocol for example<00:15:45.860> which<00:15:46.430> they<00:15:46.790> employed<00:15:47.210> to<00:15:47.660> do<00:15:47.900> their 00:15:48.160 --> 00:15:48.170 align:start position:0% example which they employed to do their 00:15:48.170 --> 00:15:51.790 align:start position:0% example which they employed to do their trusted<00:15:49.130> set<00:15:49.340> up<00:15:49.520> so<00:15:50.390> I<00:15:50.810> think<00:15:50.990> we'll<00:15:51.620> hear 00:15:51.790 --> 00:15:51.800 align:start position:0% trusted set up so I think we'll hear 00:15:51.800 --> 00:15:55.090 align:start position:0% trusted set up so I think we'll hear more<00:15:52.040> about<00:15:52.100> that<00:15:52.370> on<00:15:53.140> Friday<00:15:54.140> in<00:15:54.500> the<00:15:54.530> CK 00:15:55.090 --> 00:15:55.100 align:start position:0% more about that on Friday in the CK 00:15:55.100 --> 00:15:59.050 align:start position:0% more about that on Friday in the CK snark<00:15:55.460> breakout<00:15:55.970> session<00:15:56.480> hopefully<00:15:57.610> okay<00:15:58.610> so 00:15:59.050 --> 00:15:59.060 align:start position:0% snark breakout session hopefully okay so 00:15:59.060 --> 00:16:01.540 align:start position:0% snark breakout session hopefully okay so the<00:15:59.450> code<00:15:59.840> is<00:16:00.170> open<00:16:00.530> source<00:16:00.770> it's<00:16:01.310> available 00:16:01.540 --> 00:16:01.550 align:start position:0% the code is open source it's available 00:16:01.550 --> 00:16:04.240 align:start position:0% the code is open source it's available on<00:16:01.910> github<00:16:02.060> you're<00:16:02.780> all<00:16:02.960> welcome<00:16:03.260> to<00:16:03.530> try<00:16:04.190> it 00:16:04.240 --> 00:16:04.250 align:start position:0% on github you're all welcome to try it 00:16:04.250 --> 00:16:06.540 align:start position:0% on github you're all welcome to try it out<00:16:04.490> I'm<00:16:04.790> happy<00:16:05.150> to<00:16:05.450> receive<00:16:05.810> your<00:16:06.020> feedback 00:16:06.540 --> 00:16:06.550 align:start position:0% out I'm happy to receive your feedback 00:16:06.550 --> 00:16:09.790 align:start position:0% out I'm happy to receive your feedback keep<00:16:07.550> in<00:16:07.700> mind<00:16:07.940> it's<00:16:08.150> proof<00:16:08.870> of<00:16:08.990> concept<00:16:09.470> and<00:16:09.770> a 00:16:09.790 --> 00:16:09.800 align:start position:0% keep in mind it's proof of concept and a 00:16:09.800 --> 00:16:12.300 align:start position:0% keep in mind it's proof of concept and a research<00:16:10.340> prototype<00:16:10.850> at<00:16:11.210> this<00:16:11.390> place<00:16:11.720> we're 00:16:12.300 --> 00:16:12.310 align:start position:0% research prototype at this place we're 00:16:12.310 --> 00:16:15.850 align:start position:0% research prototype at this place we're actively<00:16:13.310> developing<00:16:14.030> it<00:16:14.240> and<00:16:14.590> we're<00:16:15.590> always 00:16:15.850 --> 00:16:15.860 align:start position:0% actively developing it and we're always 00:16:15.860 --> 00:16:18.790 align:start position:0% actively developing it and we're always happy<00:16:16.340> for<00:16:16.880> people<00:16:17.600> who<00:16:17.810> want<00:16:18.320> to<00:16:18.410> contribute 00:16:18.790 --> 00:16:18.800 align:start position:0% happy for people who want to contribute 00:16:18.800 --> 00:16:21.580 align:start position:0% happy for people who want to contribute to<00:16:19.340> the<00:16:19.490> further<00:16:19.850> development<00:16:20.290> you<00:16:21.290> can<00:16:21.440> also 00:16:21.580 --> 00:16:21.590 align:start position:0% to the further development you can also 00:16:21.590 --> 00:16:24.460 align:start position:0% to the further development you can also contact<00:16:22.010> me<00:16:22.310> by<00:16:22.430> email<00:16:22.460> and<00:16:22.970> I<00:16:23.660> want<00:16:23.990> to<00:16:24.140> give 00:16:24.460 --> 00:16:24.470 align:start position:0% contact me by email and I want to give 00:16:24.470 --> 00:16:27.640 align:start position:0% contact me by email and I want to give credits<00:16:25.460> to<00:16:25.580> Christian<00:16:26.300> right<00:16:26.630> Wiesner<00:16:27.140> who 00:16:27.640 --> 00:16:27.650 align:start position:0% credits to Christian right Wiesner who 00:16:27.650 --> 00:16:30.040 align:start position:0% credits to Christian right Wiesner who always<00:16:28.000> provided<00:16:29.000> very<00:16:29.210> valuable<00:16:29.600> feedback 00:16:30.040 --> 00:16:30.050 align:start position:0% always provided very valuable feedback 00:16:30.050 --> 00:16:32.530 align:start position:0% always provided very valuable feedback and<00:16:30.530> input<00:16:30.680> in<00:16:31.130> discussions<00:16:31.730> and<00:16:31.880> also<00:16:32.330> to 00:16:32.530 --> 00:16:32.540 align:start position:0% and input in discussions and also to 00:16:32.540 --> 00:16:35.170 align:start position:0% and input in discussions and also to Dennis<00:16:33.170> cüneyt<00:16:33.590> who<00:16:34.040> contributed<00:16:34.640> a<00:16:34.910> lot<00:16:35.120> to 00:16:35.170 --> 00:16:35.180 align:start position:0% Dennis cüneyt who contributed a lot to 00:16:35.180 --> 00:16:37.810 align:start position:0% Dennis cüneyt who contributed a lot to the<00:16:35.600> existing<00:16:36.020> implementation<00:16:36.860> thank<00:16:37.730> you 00:16:37.810 --> 00:16:37.820 align:start position:0% the existing implementation thank you 00:16:37.820 --> 00:16:46.290 align:start position:0% the existing implementation thank you very<00:16:37.940> much 00:16:46.290 --> 00:16:46.300 align:start position:0% 00:16:46.300 --> 00:16:53.890 align:start position:0% [Music]