▲▲▲

Paralelní Polis is a one-­of-­a-­kind nonprofit organization that brings together art, social sciences, and modern technologies. The ideas of liberty, independence, and innovative thinking and development of society are the main underlying foundations the whole project is built upon.

The project intends to remain state-free as it operates entirely without support from the government, and most of the funds come from voluntary contributions of our donors and partly from commercial activities such as running a unique co­working space and the world’s first bitcoin-­only cafe.

It was founded by members of a contemporary-­art group Ztohoven, and Slovak and Czech hacker­spaces. Its main goal is to promote economic, social, and digital freedom. We try to be a vocal voice of freedom in order to shape the public discourse, and ultimately work towards a freer future.

I'm a smart contract developer for the last 6 years.

I've also recently taken a real deep dive into AI, large language models running locally, things like this.

I'm also a musician, and I'm just all around a nerd, so if you ever want to chat about literally any nerdy topic, I'm up for it.

They're a fully decentralized derivatives platform running on a tenement base.

And the big news is Alpha Mainnet is live after 5 years.

We've been at this for 5 years, since 2018.

So Vega.xyz, that's all the shilling I'll do.

Well, there's been a lot of talks on ZK 0 knowledge proofs here over the week and whatnot.

So long story short, a 0 knowledge proof is just an ability to prove that you have a piece of information or you have done a piece of compute without showing the information or without showing the compute, but just handing a proof of that to a verifier.

And they know for a fact, because of black magic math, that it is accurate.

So that's effectively what a ZK proof is.

Well, you can use this offloading of compute to massively scale Ethereum.

Last time I was here I gave a talk on how to scale Ethereum doing actual like you know real world examples of how to do it and yeah it's it's useful it's great Everybody talks about that it can scale Ethereum, but no 1 says how you can scale Ethereum.

Because again, everybody says, oh, well, with 0 knowledge stuff, because there's 0 knowledge transferred from me to someone else.

You can use it for privacy, but no 1 says how.

So I'm going to start with a quote from Edward Snowden.

Arguing that you don't care about the rights of privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.

To which I would like to point out Eric Schmidt, the former CEO of Google, if you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.

So the main way, or at least the way I make the ZK rollups at the moment is with a technology called ZK-SNARKS.

You can put the validators on Ethereum, and, or the verifiers on Ethereum, and you can verify a proof with very little gas cost.

And the language we use for this, or that I use for this, there's a couple languages that compile to this, but it's Circum.

But You can protect user privacy and protect all the data, which is great.

And the verifications are very, very efficient.

To verify on Ethereum, it doesn't cost a lot of gas, and the input values are only 4 UN256s, and then whatever parameters you need to do business logic.

All right, so we're going to start with a toy example.

So if you go to the United States and you go to a bar, you've got to be over 21 to drink at that bar, which I know for most of you in here, like, really, 21?

Well, the bartender is going to ask you for your ID.

Now, think for a second how much data is on your passport.

There's your name, your phone number, there's just, or maybe not your phone number.

But what's actually required from the bartender.

They need an image to know that you are the person that's that you say you are and that's that's the person in front of them and they need a simple Boolean value a thumbs up or a thumbs down, are they over 21?

You leak your name, your address, your signature, your donor status, your veteran status, your gender, your height, weight, hair color, eye color, place of residence, everything.

I mean, this is all the information you leak just to get a beer.

OK, so using ZK Rollups, you can do this.

So first up, the user will submit all of their demographic information, all of their ID information to some authority figure, some third party, who will verify that, yes, this is who you say you are.

They'll salt the data information, and they'll hash it.

And they'll store it on a smart contract.

Well, After you do that, the user, when they go to the bar or go to wherever, they can, on their phone, on their device, they can put in all their information, all the information that's on their ID card, on their device, and they can generate a proof.

And all that comes out of the proof is the actual proof, the 4 UINT256s, and the hash of the image that they just handed the bartender.

Well, they give the user hands the proof and the image to the bartender.

Bartender verifies the image hash and then runs the proof through the smart contract.

And the smart contract will validate and will verify that it's an accurate proof.

And if it verifies, the person must be of age.

All you've given them is just that image, and that's it.

That's all the knowledge they have, which is much better than leaking all your other information.

Well, you keep your personal information under your control.

And if you've got a secure enclave and whatnot, it's safe.

But yeah, we're not going to talk about that.

Anyway, it hides all unnecessary demographic information, which lowers your individual attack profile because your data, less of your information is out there.

But the interesting 1 that a lot of people that have not heard anyone else talk about is cover your ass works both ways.

So all of these hacks, all of these breaches, all of these data, all the data getting leaked everywhere, if they didn't have the data, it couldn't get leaked.

Well, as I said, it requires a one-time third-party authority, which is slightly a problem for a lot of the people out here, given that we're fairly authority-averse.

There's like internet of trust and things like that, or network of trust, whatever.

Plus, there's always the authority and the law and whatnot that you have to deal with.

There's no guarantee that a verifier deleted your picture.

So the bartender might keep your picture.

So you did leak a little bit of information, and they might not delete it, and that might be a problem.

And then I did put this on here, the potential repetition attack.

I put it up there because I was thinking, hey, if you try to go to the bar and it says no, well, you've signaled no, that you can't do it.

Well, then, hey, they now have your birthday.

However, if you build the circuit in such a way that it doesn't even generate a proof unless the user is over 21, then you're good.

And so the repetition attack isn't even an option.

OK, so toy example 2, a more realistic problem.

Say you are of a demographic, you are of a minority, you are of something that is typically discriminated against.

Well, you go to buy a house And what is the required information that the loan officer needs?

They only need to know if you qualify for the loan.

And in the process, if any of you have ever bought a home, you leak all of the things on your ID, plus job history, relationship status, blood type, everything.

You leak all of your information, which can be and has been used against people.

And it allows people to discriminate, because now we know everything about you.

So solution to this problem is actually less complicated than the previous 1.

So the user submits all their documents through the circuit again on their device to the� which generates the proof.

And all that comes out of the proof is the document hash and the 4 UN-256s again.

So the user takes that, the loan officer takes that proof and puts it into the ZK, the verification contract.

The verification contract says, yep, this is valid.

And then afterwards, you can audit all of that data.

The user can then, after they're already approved, prove every document to the loan officer, which is great.

So you've already made the decision whether or not you approve of this loan, and it's already too late to discriminate.

All the data is hidden during the approval process.

It protects the user's right to privacy, especially if they get declined because they don't meet the requirements.

So The loan, the bank and everything can be happy that, yes, we did our due diligence and everything is as they said it was, none of them are forged documents or whatever.

But the great thing is verifiers, the loan officers, the bank and whatever, can't discriminate despite themselves.

So even if they want to, even if that individual loan officer wants to discriminate, it protects the bank as well as protecting the person applying for the loan.

Remaining challenges here, it requires that all the documents be available to be audited, or you'd go back to the previous problem where you verify each document through a trusted authority.

So either way, you end up having this potential of data leakage elsewhere, but you can mitigate that.

But there is no guarantee that once you reveal the information that it will be deleted.

There's no way to deal with that as of now, although I do know a good cryptographer who probably has some good examples or good solutions to that problem.

And as of now, there is nothing that currently compels parties to abide by the output of the proof.

So, you know, we make the agreement, it's approved, they see, you know, I'm something they don't like, and they go, oh, well, no, Never mind.

There's nothing to force them to do that.

And worst of all, the regulatory frameworks are super slow to adapt.

And if you look at things like mortgages, at least in the United States, I know that's 1 of the most regulated things ever.

You can have a software publisher prove that their software meets certain requirements.

It doesn't do certain other things based on how you build up this proof.

And so you, as the downloader who needs to use the software, you can trust the software.

You know you can trust the software because it meets your requirements without having to look at the source code or anything like that.

I'm a big fan of open source software, but it's not 100% necessary.

If you set it up right, you can prove that all the moves that all the players are using are legal moves, everything's accurate, everything's fair, and not leak the information of each of the players, which of course is necessary because people get really angry during these games.

And people have literally shrugged other people down and killed them because someone looted the wrong World of Warcraft item.

Medical research, obviously there's all this demographic information in there and it's highly confidential and there's lots and lots of laws protecting this but the researchers need the data and they need to know that it's accurate so this is another potential use of this.

And the 1 I'm most excited about is neural networks.

And Say that you have a specific prompt, and you need a specific output, or you need the output from a very specific model.

But say, like OpenAI, they don't want to give their models out publicly.

As of right now, they can make any changes they want to it, and you have no control.

You have no knowledge of which specific model they're putting your information through, they're running your prompt through.

Well, you can use a zero-knowledge proof to guarantee that the output you received was based on the input you put in and came from that exact model.

The 0 knowledge proofs are very expensive to compute.

There's always going to be the data availability problem.

I mean, it's kind of this chicken egg thing, like, do we want to hide the data?

So if you need to recompute things, it gets a little hectic there.

There's not a lot of people looking at this right now.

It's much better than it was last year, but it's still a problem.

The stack overflow isn't super robust for CIRCOM at the moment.

There's no auditors, which of course, you in crypto, if you've ever done a smart contract in 1, You need auditing.

Like, If you have any interest in any of these things I just said or 0 knowledge proofs in general or if you have a cool application, come try it.

Come out, play, because that's the only way we're gonna get the community.

That's the only way we're gonna get past these hurdles.

We are with 0 knowledge stuff where the whole Ethereum ecosystem was when I first started in 2017.

So we can get there, but people have to come and play.

It is a unit of liquidity we call the Cisco because of the guy who figured out the equation.

He doesn't like that we use that name, and that's why we use that name.

I'm trying to still formulate the question, but I'm wondering, like, you talk to a lot of people, you must do, about 0 knowledge, and yet there are still a lot of people who have 0 knowledge about 0 knowledge.

And is there any wisdom you feel you can share about like if we want to, if people want to start or people want, I mean this has been a great talk to give some sort of primitives, but like How can we all get better at 0 knowledge?

Because clearly everyone thinks it's going to be a big thing.

Watch my talk from last year, because it was about how to apply it and to scale Ethereum.

So there's some code in there, there's some very specific like toy examples and whatnot.

Start asking the questions, because every Stack Overflow thing starts with a question.

And if you find something, let me know and I'll add it for the next time I give this.

So, if there is no further questions, thank you.

I go by sacrificialpancakes on Twitter and everywhere else.

And again, with VEGA protocol, please come try.

We've got this great test net that allows you to play around and whatnot.


Speaker 0: Hi, everybody. I'm Danny Holland. I'm with Vega Protocol. I'm a smart contract developer for the last 6 years. Full-time, that's all I've been doing.

The main job I've been doing. I've also recently taken a real deep dive into AI, large language models running locally, things like this. I'm also a musician, and I'm just all around a nerd, so if you ever want to chat about literally any nerdy topic, I'm up for it. As I said, I'm with Vivega Protocol. They're a fully decentralized derivatives platform running on a tenement base.

And the big news is Alpha Mainnet is live after 5 years. We've been at this for 5 years, since 2018. So this is a big deal. So Vega.xyz, that's all the shilling I'll do. And next.

OK, so whoa, hey now. Back. The clicker's dead, guys. Come on. Yeah, this is fun.

OK. Help? Is it? OK. Good.

Back 1. Here we go. OK. What are ZK proofs? Well, there's been a lot of talks on ZK 0 knowledge proofs here over the week and whatnot.

So long story short, a 0 knowledge proof is just an ability to prove that you have a piece of information or you have done a piece of compute without showing the information or without showing the compute, but just handing a proof of that to a verifier. And they know for a fact, because of black magic math, that it is accurate. So that's effectively what a ZK proof is. OK. So why does it matter for Ethereum?

Well, you can use this offloading of compute to massively scale Ethereum. Last time I was here I gave a talk on how to scale Ethereum doing actual like you know real world examples of how to do it and yeah it's it's useful it's great Everybody talks about that it can scale Ethereum, but no 1 says how you can scale Ethereum. So I did that last year. This year I'm talking about ZK privacy. Because again, everybody says, oh, well, with 0 knowledge stuff, because there's 0 knowledge transferred from me to someone else.

You can use it for privacy, but no 1 says how. So I'm going to start with a quote from Edward Snowden. Arguing that you don't care about the rights of privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say. To which I would like to point out Eric Schmidt, the former CEO of Google, if you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. So obviously, Eric has nothing to say.

All right. So the main way, or at least the way I make the ZK rollups at the moment is with a technology called ZK-SNARKS. It's been talked about a lot. It comes from, it works with Ethereum. You can put the validators on Ethereum, and, or the verifiers on Ethereum, and you can verify a proof with very little gas cost.

And the language we use for this, or that I use for this, there's a couple languages that compile to this, but it's Circum. It's fairly complicated. It's really niche. It doesn't work like most languages. Kind of a pain.

But You can protect user privacy and protect all the data, which is great. And the verifications are very, very efficient. To verify on Ethereum, it doesn't cost a lot of gas, and the input values are only 4 UN256s, and then whatever parameters you need to do business logic. All right, so we're going to start with a toy example. The first 1 is age verification.

So if you go to the United States and you go to a bar, you've got to be over 21 to drink at that bar, which I know for most of you in here, like, really, 21? Come on. Well, the bartender is going to ask you for your ID. Now, think for a second how much data is on your passport. There's your name, your phone number, there's just, or maybe not your phone number.

There's all the demographic information. But what's actually required from the bartender. They need an image to know that you are the person that's that you say you are and that's that's the person in front of them and they need a simple Boolean value a thumbs up or a thumbs down, are they over 21? Or 18 if you're in Europe. This is the information you leak.

This is the information you leak. You leak your name, your address, your signature, your donor status, your veteran status, your gender, your height, weight, hair color, eye color, place of residence, everything. I mean, this is all the information you leak just to get a beer. Probably not helpful. OK, so using ZK Rollups, you can do this.

Oh, good, it shows up pretty well here. So first up, the user will submit all of their demographic information, all of their ID information to some authority figure, some third party, who will verify that, yes, this is who you say you are. And they will hash that. They'll salt the data information, and they'll hash it. And they'll store it on a smart contract.

Well, After you do that, the user, when they go to the bar or go to wherever, they can, on their phone, on their device, they can put in all their information, all the information that's on their ID card, on their device, and they can generate a proof. And all that comes out of the proof is the actual proof, the 4 UINT256s, and the hash of the image that they just handed the bartender. Well, they give the user hands the proof and the image to the bartender. Bartender verifies the image hash and then runs the proof through the smart contract. And the smart contract will validate and will verify that it's an accurate proof.

And if it verifies, the person must be of age. You don't need to know anything else. All you've given them is just that image, and that's it. That's all the knowledge they have, which is much better than leaking all your other information. So what are the benefits of this?

Well, you keep your personal information under your control. It's on your device. It never leaves your device. And if you've got a secure enclave and whatnot, it's safe. I mean, except for the NSA.

But yeah, we're not going to talk about that. Anyway, it hides all unnecessary demographic information, which lowers your individual attack profile because your data, less of your information is out there. But the interesting 1 that a lot of people that have not heard anyone else talk about is cover your ass works both ways. You can't leak what you don't have. So all of these hacks, all of these breaches, all of these data, all the data getting leaked everywhere, if they didn't have the data, it couldn't get leaked.

So there's benefits here. OK, What are some of the challenges? Well, as I said, it requires a one-time third-party authority, which is slightly a problem for a lot of the people out here, given that we're fairly authority-averse. But There's not really good solutions. There's like internet of trust and things like that, or network of trust, whatever.

But it's not super useful. So you end up needing an authority. Plus, there's always the authority and the law and whatnot that you have to deal with. There's no guarantee that a verifier deleted your picture. So the bartender might keep your picture.

So you did leak a little bit of information, and they might not delete it, and that might be a problem. But it's minimal. And then I did put this on here, the potential repetition attack. I put it up there because I was thinking, hey, if you try to go to the bar and it says no, well, you've signaled no, that you can't do it. And then 1 day it works.

Well, then, hey, they now have your birthday. However, if you build the circuit in such a way that it doesn't even generate a proof unless the user is over 21, then you're good. And so the repetition attack isn't even an option. OK, so toy example 2, a more realistic problem. So you go to buy a house.

Say you are of a demographic, you are of a minority, you are of something that is typically discriminated against. Well, you go to buy a house And what is the required information that the loan officer needs? They only need to know if you qualify for the loan. Nothing else. Literally nothing else.

And in the process, if any of you have ever bought a home, you leak all of the things on your ID, plus job history, relationship status, blood type, everything. You leak all of your information, which can be and has been used against people. And it allows people to discriminate, because now we know everything about you. So solution to this problem is actually less complicated than the previous 1. So the user submits all their documents through the circuit again on their device to the� which generates the proof.

And all that comes out of the proof is the document hash and the 4 UN-256s again. So the user takes that, the loan officer takes that proof and puts it into the ZK, the verification contract. The verification contract says, yep, this is valid. And then afterwards, you can audit all of that data. The user can then, after they're already approved, prove every document to the loan officer, which is great.

So you've already made the decision whether or not you approve of this loan, and it's already too late to discriminate. So what are the benefits? All the data is hidden during the approval process. It protects the user's right to privacy, especially if they get declined because they don't meet the requirements. And everything is post hoc auditable.

So The loan, the bank and everything can be happy that, yes, we did our due diligence and everything is as they said it was, none of them are forged documents or whatever. But the great thing is verifiers, the loan officers, the bank and whatever, can't discriminate despite themselves. So even if they want to, even if that individual loan officer wants to discriminate, it protects the bank as well as protecting the person applying for the loan. So not too bad. Remaining challenges here, it requires that all the documents be available to be audited, or you'd go back to the previous problem where you verify each document through a trusted authority.

So either way, you end up having this potential of data leakage elsewhere, but you can mitigate that. But there is no guarantee that once you reveal the information that it will be deleted. There's no way to deal with that as of now, although I do know a good cryptographer who probably has some good examples or good solutions to that problem. And as of now, there is nothing that currently compels parties to abide by the output of the proof. So, you know, we make the agreement, it's approved, they see, you know, I'm something they don't like, and they go, oh, well, no, Never mind.

There's nothing to force them to do that. And worst of all, the regulatory frameworks are super slow to adapt. And if you look at things like mortgages, at least in the United States, I know that's 1 of the most regulated things ever. So there's that. So here's a couple of potential ideas.

There's software integrity. You can have a software publisher prove that their software meets certain requirements. It does certain calculations. It doesn't do certain other things based on how you build up this proof. And so you, as the downloader who needs to use the software, you can trust the software.

You know you can trust the software because it meets your requirements without having to look at the source code or anything like that. I'm a big fan of open source software, but it's not 100% necessary. And this is a way to good middle ground. Another 1 is online gaming. If you set it up right, you can prove that all the moves that all the players are using are legal moves, everything's accurate, everything's fair, and not leak the information of each of the players, which of course is necessary because people get really angry during these games.

And people have literally shrugged other people down and killed them because someone looted the wrong World of Warcraft item. So there's that. Medical research, obviously there's all this demographic information in there and it's highly confidential and there's lots and lots of laws protecting this but the researchers need the data and they need to know that it's accurate so this is another potential use of this. And the 1 I'm most excited about is neural networks. So everyone's used GPT-4.

Everyone have used these tools by now. And Say that you have a specific prompt, and you need a specific output, or you need the output from a very specific model. But say, like OpenAI, they don't want to give their models out publicly. As of right now, they can make any changes they want to it, and you have no control. You have no knowledge of which specific model they're putting your information through, they're running your prompt through.

Well, you can use a zero-knowledge proof to guarantee that the output you received was based on the input you put in and came from that exact model. So challenges remaining. The 0 knowledge proofs are very expensive to compute. There's always going to be the data availability problem. I mean, it's kind of this chicken egg thing, like, do we want to hide the data?

Or do we not want to hide the data? So if you need to recompute things, it gets a little hectic there. There's not a lot of people looking at this right now. It's much better than it was last year, but it's still a problem. We don't have the infrastructure.

The stack overflow isn't super robust for CIRCOM at the moment. There's no auditors, which of course, you in crypto, if you've ever done a smart contract in 1, You need auditing. And it's all new crypto. So it's new hash functions. It's new signing functions.

And what's the first rule of crypto? Don't roll your own crypto. So these are the challenges that remain. So my call to action is come experiment. Like, If you have any interest in any of these things I just said or 0 knowledge proofs in general or if you have a cool application, come try it.

Come out, play, because that's the only way we're gonna get the community. That's the only way we're gonna get past these hurdles. We are with 0 knowledge stuff where the whole Ethereum ecosystem was when I first started in 2017. So we can get there, but people have to come and play. So come and play.

All right, any questions? All right, any questions? OK. Oh. It is a unit of liquidity we call the Cisco because of the guy who figured out the equation.

He's a member of the team. He doesn't like that we use that name, and that's why we use that name.

Speaker 1: Thanks Danny. Great talk. I'm trying to still formulate the question, but I'm wondering, like, you talk to a lot of people, you must do, about 0 knowledge, and yet there are still a lot of people who have 0 knowledge about 0 knowledge. And is there any wisdom you feel you can share about like if we want to, if people want to start or people want, I mean this has been a great talk to give some sort of primitives, but like How can we all get better at 0 knowledge? Because clearly everyone thinks it's going to be a big thing.

Speaker 0: Watch my talk from last year, because it was about how to apply it and to scale Ethereum. So there's some code in there, there's some very specific like toy examples and whatnot. So yeah, watch my talk last year. Back to the community thing. Start posting on forums.

Start asking the questions, because every Stack Overflow thing starts with a question. So ask that question. Otherwise, I don't know. And if you find something, let me know and I'll add it for the next time I give this. So, if there is no further questions, thank you.

Again, I'm Danny. I go by sacrificialpancakes on Twitter and everywhere else. I also make music. I'm on all the streaming if you want to. And again, with VEGA protocol, please come try.

It's fun. We've got this great test net that allows you to play around and whatnot. That's it. Thank you. That's it.

Thank you. Thank you. Thank you. You

See all Parallel Polis transcripts on Youtube

ZK Rollups: Applied Privacy / Danny Holland