▲▲▲

Paralelní Polis is a one-­of-­a-­kind nonprofit organization that brings together art, social sciences, and modern technologies. The ideas of liberty, independence, and innovative thinking and development of society are the main underlying foundations the whole project is built upon.

The project intends to remain state-free as it operates entirely without support from the government, and most of the funds come from voluntary contributions of our donors and partly from commercial activities such as running a unique co­working space and the world’s first bitcoin-­only cafe.

It was founded by members of a contemporary-­art group Ztohoven, and Slovak and Czech hacker­spaces. Its main goal is to promote economic, social, and digital freedom. We try to be a vocal voice of freedom in order to shape the public discourse, and ultimately work towards a freer future.

Morning guys, let's see so many people in the crowd with begin another day,

and it will be full of conversations about 0 knowledge at the first half of the day Small announcement we have live stream right now happening So if you have communities friends who are not here with us in Prague, please encourage them to go to live.ethprague.com and they can watch and if they get a token, so they can connect their wallet and have a question asked and then participate in quadratic voting.

It's a bit complicated thing to get the token.

So if you need this token, please reach me, and I will explain how to get it.

We will now have a very cool conversation about the zero-knowledge protocols for dummies, right?

For people who really do not understand how it works.

And give a round of applause to Daniel Loomy, who is going to explain this topic to you.

So first of all, welcome to my speech on 0 Knowledge Proofs 101.

A little bit about me, my name is Daniel Lumi.

I'm a researcher and consultant specializing in ZK, L2s, privacy, and DAOs.

Today we'll be talking about why should you care about ZK proofs?

How do they actually work in applications for ZK proofs?

ZK is essentially a PhD level mathematics.

And for many years, there was a small select group of us math nerds that really loved ZK and no 1 really paid attention.

ZK this, ZK that, but no 1 really knows what it does.

So this talk is actually aimed for not just dummies but regular non-mathematicians to understand ZK.

So maybe you start, you go to 1 of my friends, 1 of the cryptographers, and you ask them what is ZK, and they essentially start talking about point-omial commitments or Freibas recursion, right?

Or maybe you get a little bit more into it and you start doing some research online, you bump into Ariel's speech on Hassam's theorem, he tends to

forget that most people don't have PhDs in mathematics.

Or maybe just follow some shitty YouTuber and he says, you can make money on ZK.

But you might say, okay, I like math, but who studies it for fun?

Stay tuned, hopefully I'll get you excited for them.

And just to get you a little bit of context for this, Vitalik recently said on Bankos that he thinks ZK snarks are as big of a deal as blockchain.

I think it's much bigger than blockchain.

A couple thousand years ago when we invented what's considered the modern form of algebra, there were some farmers that thought, great, I can farm carrots a bit more efficiently, or I can calculate the largest common denominator of a square to figure out what size the tile on the floor should be.

But thousands of years later, algebra is literally everything we do, right?

We couldn't have gone to space, we couldn't have manufacturing, we couldn't build buildings the way we do, we would not have definitely blockchain or internet, right?

And proofs actually have existed for a long time, right?

But previously, proofs to prove any single thing, you had to have this massive book

of calculations just proving that that conjecture is true.

Around 2016 to 2018, we invented the first form of what's called non-interactive generalized ZK proofs, right?

When were you last around when they invented a new field of math?

And so today we're the farmer, and we think, great, we can

make a theorem a bit faster, or great, we

can log into a website without showing a password.

But thousands of years from now, they'll be talking about the moment that we first invented non-generalized, sorry, interactive generalized ZK proofs.

And so in today's world, for us to show that anyone did a calculation or execution correctly, essentially you need to prove, you need to redo the execution to check that they did it correctly.

Right, so in a grocery receipt, you need to list cucumber, it's price, ice, lemon, it's price, and then eventually, you get to this total, right?

In the zero-knowledge paradigm, you don't need to show any of your execution, right?

You can just show the total, and people know for a fact that you calculated it correctly, right?

So ZK is a new field of cryptographic proofs that essentially 1 party, the prover, can show to another party, the verifier, that they did calculations or execution correctly without actually showing them how they did it.

The most common example is where's Waldo?

This French game, you try to find Waldo in there.

And let's say that you found Waldo, you have your friend there, He also wants to find Waldo, but you're not going to give him the answer.

you actually show to him that you found Waldo?

It took me a really long time to find Waldo for this example.

Yeah, so how do you actually show to him that you found him, right?

You can cut out the picture of Waldo, and then you can send it

People don't seem to really get it, right?

And this is very accurate because that's actually what plunkage systems do underneath, essentially Sudoku.

It's not quite the same, but essentially it's the same construct, right?

So again, you have your friend and you, you're both trying to complete this Sudoku puzzle.

You solved it, you want to show to him that You solved it, but fuck that guy, he has to do

Essentially, you cut each row and column, you put those in a list, maybe you shuffle those numbers around a bit, you flip them upside down, And then that's what you actually send to

And the verifier can start flipping random rows and see, okay, he has 123456789, and he didn't cheat.

Right, And the verifier doesn't actually have to flip every single row.

If you randomly flip it, the chance of them cheating is extremely low.

And you might ask, okay, great, that sounds good, but how do you actually create a proof?

She was sitting there scratching her head like Sudoku.

Honestly, it's a bit hard to explain without going deep into math, right?

The way that you can think about this is like, it's hard to understand how computers and circuit boards work with zeros and ones.

But essentially, you have zeros and ones.

And magic picture appears on your computer.

ZKs are kind of like a virtual circuit board.

It's not actually zeros and ones that goes through there.

And you can show that the way that you shuffled or cut the Sudoku rows

So we can zoom a bit more into the ZK proof.

So this example is, let's say that you want to show that you have a valid passport, you're over a certain age, but you don't want

For example, I don't know, your date of birth, or sorry, your expiry of the document,

So what you can do is you can hide some of the inputs in your passport, assuming it's a digital passport.

And then we have something called witness data.

So essentially you take all of that together, you

do some calculations on it, that's the witness data.

Right, and here essentially you stick into the prover, the private inputs, the public inputs, and then

you do some, you have a relational circuit.

And maybe you get a digital certificate from your government showing this is a real passport.

Stick that into a prover, it creates a proof, and then the verifier can just check true or false, like is it a real passport, or do these conditions match?

Because my hope is that ZK will become kind of like DOS, right?

And the explanation behind that is before we had Mac OS or Windows for every single different type of computer architecture that you had, different type of CPU, different type of GPU, you needed a new custom operating system, right?

And then Microsoft invented DOS, and now it works as a general basis on any computer with any architecture, right?

And with some things like ZKEVM or Circum or Noir, which are languages, like a programmer does not actually need to know how the math underneath works.

They can still write zero-knowledge programs.

And this is a common question that I get.

What is the difference between snark and stark and honestly, it doesn't really matter for you the reality is Snarks are much cheaper to verify on a theorem.

They're harder to prove but they're cheaper to verify and that's a good thing because transactions on Ethereum are very expensive, right?

Starks are more expensive to verify, but they're cheaper to prove.

you really need to know is snarks use something called elliptic curves.

Those are not quantum resistant or quantum computer resistant.

Starks essentially use collision resistant hashes, which at least for now we have not figured out a way to, like, essentially break with quantum computers.

Starks are scalable, transparent arguments of knowledge.

Snarks are succinct, non-interactive arguments of knowledge.

So the first and most important thing that

you really need to know about ZK in general is it's verifiable computation, right?

And here's just kind of explanation on that.

So here's how current blockchains work, like Ethereum or Bitcoin or some

Every operator in that network needs to re-execute every single transaction that comes in.

If they don't, we can't form consensus around what the truth of the blockchain is.

So let's say you have a network with 3, 000 nodes.

Each node takes 5 seconds to process a block.

That means there's around the world, there's computers doing 4 hours of re-executing the same information over and over and over, which is honestly just wasteful, right?

ZK is a new paradigm in computing where essentially, no, you don't need

You can just verify that the 1 person did their job.

They cannot lie, so if you check the proof, you know for a fact that they did the computation correctly without consensus.

Right, so you could actually have Bitcoin, instead of having 16, 000 nodes re-executing over and over again and playing this really power-hungry game, you could have 1 node that verifies, and you get the same level of security.

Maybe you want more than 1, maybe you could have 10 or more in case, because if the 1 fails, essentially there's a liveness failure.

There's not a security failure, but a liveness failure.

And everyone else on the network just verifies, they did it.

So the most common use that people in blockchain know for ZK scaling, right?

And here's kind of how current blockchain works, right?

The more transactions you get into a block, each of these white dots is another transaction, that you linearly have more work to do to process that block.

But the problem is we want a MacBook to be able to run this network so it can be decentralized.

So Ethereum and Bitcoin propose or enforce something called a block limit.

in every block, you can make sure that a specific type of computer or a cheap enough computer can actually execute that block.

The 1 prover, the more transactions you get, it scales quasi-linear.

But essentially, you can have 1 supercomputer, or just a normal server, doing blocks,

And then every single other node just needs to verify those transactions.

Maybe you can have a mobile phone actually verifying this network.

And that difference between the verification and the proving

is essentially the scalability limit, the benefit of ZK for scaling, right?

And for Ethereum to become the the back end of the Internet of Value,

we at least need more than what Visa processes, right?

And Visa processes 20 to 60, 000 transactions per second.

So here's sort of how much ZK can scale Ethereum, for example.

It's actually taking into consideration a lot of optimizations in the future but essentially today if they're in processes 15 to 30 transactions per second with 1 ZKL 2 you essentially get a 10 to 100 X scale on top of it right maybe you get 3, 000 transactions

After we have something called proto-dank sharding, which

is Ethereum's plan for essentially providing more data in each block, you get another 10 to 100x scalability.

So now you have like 3, 000 transactions per second, right?

And with full dank sharding, we'll get actually probably around 10 to 100x more, right?

And the thing to note is that's for 1L2, right?

We also have Arbitrium and Optimism, ZKSync and Scroll and

And then there's this idea of fractal scaling, right?

Or for optimism they call it hyperchain, right?

And the idea is we can keep building layers on top of that.

And with each layer you get another order of magnitude more scalability, right?

And that's like at that point with a couple of L2s and some L3s we're already over 60, 000 transactions per second.

And the important thing to note about this is, unlike some blockchains, ahem, Solana, some blockchains, this is sustainable scaling, right?

You only need that 1 prover to actually execute those transactions.

And even if the prover goes down, it's not a security incident, it's a liveness failure, right?

And with some optimizations like data and transaction compression,

us making the provers more efficient, we'll actually scale the blockchain even more.

And I do have a speech coming out, probably in Paris, for scaling ETH.

have quotes, the infinitely, but it didn't fit on the slide.

How do we essentially scale ETH infinitely without having issues with UX across all these L3s and without having liquidity fragmentation?

Another example for ZK is for the purpose of interoperability.

So example, this is ZK-like client bridge.

And essentially, it provides you like ZK-IBC.

It provides you minimal trust assumptions outside of

the consensus of the 2 blockchains, right?

And it essentially allows you slightly safer bridging between cross-chain applications.

An important thing to note on this though is it's still not secure.

Essentially, you need to verify what state, the state of Ethereum on Solana, for example, for it to be a secure transaction.

And to do that, to make sure that someone didn't just fork Ethereum and say this is the truth, you need to verify every single validator signature, which is like 400, 000 signatures.

So people take shortcuts and or have multi-sigs or other things testifying which is the correct version of Ethereum.

In the fractal landscape, we also have something called hyperbridges.

And the idea of every 1 of those L2s, L3s, L4s use exactly the same circuit for bridging.

So now you actually have as long as the L2 bridge is secure, all of those other bridges are completely secure without having any additional trust assumptions.

And the nice thing is, for example, on zk-sync, there's 1 common bridge.

from somewhere up here to over here, you don't need to bridge it all the way down.

You can essentially do some math like accounting and just change the location down here where the assets are.

An important part of blockchain is 1 of the main reasons why we have Ethereum is called atomic composability.

The idea is 1 contract can trigger another contract in the same transaction.

And with cross-chain world of having Solana or Ethereum, we can't really have atomic composability.

There is always going to be additional trust assumptions.

With ZK in the L2, L3 world, we can essentially have from Arbitrem to ZK Sync a sort of pseudo-atomic composability where you bridge through L1, and you can trigger a transaction asynchronously.

With something called shared sequencers, which I'm working on with projects right now, maybe in zk-sync, you could essentially have atomic composability between all the L3.

So you could trigger 1 contract from 1 L3 directly on another 1 in the same block.

I do have a whole speech on the next generation of safer cross-chain bridges and how all bridges still suck, which is actually surprisingly important for the community because they don't understand the security assumptions they're taking.

So currently, for signing up for any application, random website, random porn site, like any app, you have to provide all of your information, or at least your email address, a password.

And this isn't great, because if any 1 of those websites or applications gets hacked or sells your information, you're doxxed, not even in the anonymous way.

It's just like, this affects everyone in the world.

And currently, the way that you prove, for example, you're

over 18 is you send them the user's 32, right?

And this isn't great because, again, any 1 of those gets hacked or they just choose to sell the information, people know this person is

With ZK, essentially we can create a proof of a digital driver's license, showing just the users over 18.

And Still now, this website will still store the fact that they're over 18, but you could be 100, you could be 72, so it's a lot less useful information.

Same thing for a country, maybe you have to show that you're a Finnish citizen so you can use that exchange.

With ZK, we can essentially just show that this person is not from a sanctioned country.

Again, less useful information, there's a lot of countries in the world.

Right now the way that you do it is you actually show which board-ape NFT you have, which isn't great because maybe you bought that on the wrong wallet and now everyone sees all of your financial history.

With ZK, you can just show a proof of membership that you have an NFT which belongs to a set and now you can enter the party and you can choose whether you want to actually give that to your friends or not, which 1 you have.

And like all of these identity things kind of lead to this example of 1 KYC, 1 identity, to rule them all, right?

And currently Like if you sign up for Coinbase, you sign up for a bank, like you sign up as a Uber driver, you have to provide them all of your information, your tax documents, your passport, like literally like a 3D facial scan.

And again, that's really bad if any of them decide to sell it or get hacked.

With ZK, maybe your bank or your government could attest to the fact that this is a legal person.

And then you just send the proof to Coinbase or Binance or to Buy a House.

Or Maybe you could have a tornado cache where you actually have privacy and you could actually show the fact that you're not a hacker or money launderer, right?

Important note here is ZK does not necessarily ZK does not essentially mean privacy.

these implementations, like Starquare or Polygon ZK EVM are not actually private blockchains, right?

And in this case, think of zk0 knowledge as the fact that it's verifiable computation.

You can just see that the state is correct.

See all Parallel Polis transcripts on Youtube

Zero Knowledge Proofs 101 / Daniel Lumi