Ultrasound Privacy: How to harden web3 with Aztec

Okay. What have we got to start? Everyone, good afternoon. My name is Zach. I am the CEO and co-founder of Aztec.

We are a privacy-first, lazy proserium, and I'm here to talk about privacy. I'm here to talk about the same thing I've been talking about for seven years, which is how do we make Web3 mainstream with privacy? How do we harden it? How do we make it secure and prevent it from being easily manipulated by bad actors? So, here's the thesis.

This is the big brain rocket science that I've been talking about for seven years. I'm going to break it down. I know it's really hard to follow along, so I'm going to do it step by step. So, step one, if we want Web3 to be a big deal, it needs to interact with real people in their everyday lives and actually enable them to use products and services that they use in the real world. And in order to interact with real world assets and real world quantities, one needs to be able to link an identity to a cryptocurrency account.

And step three, to put identity on chain, we need privacy. Big deal, right? Anyway, so this is pretty basic, right? This is fairly straightforward. I saw this in 2017 when I wanted to build a transfer app on Ethereum and we lacked privacy.

So, I set out to solve that, and here we are today. Quick 20-minute job, really, you know? Privacy or not. Anyway, so, yes, privacy is important. For years, privacy has been almost thought of as like an addition to Web3, as in, you know, you have all these various different Web3 ecosystems and then, oh, you can have a private Web3.

That's not how it's going to be in the future. Privacy is as important to Web3 as decentralization. It is a core value, or at least it ought to be a core value of blockchain. And I'm working to make that a reality, along with many, many other hundreds of people, if not thousands. So, why does privacy really matter?

Just to take a step back, what do I mean by privacy? It's a nebulous word these days. So, at its core, information is symmetry. It's being able to prove something about information that you have that other people don't have, and you don't share that information. So, it could be as simple as saying, I know my password, and I'm not going to tell you what it is, or, you know, here is an e-passport.

This is a signature from my passport. I'm going to disclose to you that, A, this signature exists, and B, it shows I'm over 18, but I could not disclose anything else. At its core, privacy technology is identity technology, and gives you the ability to make attestations about what happens in the world, what happens in Web2. It allows you to create trustless oracles where you can, inside a Web3 smart contract, have some understanding of what's happening outside. For example, using ZKTLS, you can get information from websites.

Using ZKEmail, you can get information from your email. And at its core, really, it's trust infrastructure technology. It's making—I don't see it as trustlessness. I think blockchain is all about—it's not about removing the need for trust. It's about making it possible to rapidly gain trust in one another so that you can interact with each other seamlessly.

And this is what this kind of technology does. It's what privacy does. And so, to really drill down into it, like the final real reason, I think, why privacy is required, again, it goes back to identity, it goes back to real world stuff. Where's the fundamental value in Web3 coming from today? I think—hang on, do I have another slide here?

No, okay. Where's it coming from? And what's missing from this equation? I would argue that there's only really two fundamental sources of value on blockchain today. There's the value of dollar-backed stablecoins, and then there's the value of economic consensus.

And by that, I mean the price of consensus tokens like Ethereum or Bitcoin. How much is somebody willing to pay to get a trustless record of events? The reason I say there are only those two sources is because if the price of Ethereum went to zero, the price of every token on Ethereum, except the USDC and USDT, would also go to zero, and perhaps a lot of tokens outside of Ethereum as well. And so they are, in some ways, intrinsically fundamentally linked. They're sourcing their value from the same origin source.

And what's missing from here is anything that touches the real world. Real world assets, intellectual property, real property, certificates from the real world that have meaningful value. The complicated network of obligation and responsibilities that binds us to real world institutions, real world assets, none of that's present on the chain right now. And while that's the case, Web3 will never be able to scale beyond synthetic tokens and these quasi-casino games. And privacy is essential for solving this problem, because privacy allows you to put identities on the chain and prove things about yourself through smart contracts.

Forward. So how do we pierce this synthetic Web3 bubble? How do we make Web3 more mainstream again? Well, in my opinion, it's pretty straightforward. Step one, you need to be able to interface with Web2 meaningfully.

Again, I need to be able to talk to smart contracts and prove that certain things could happen in Web2. Things like... I can't read my own slides. Yeah, so like getting data from Web2 servers, plugging it into Web3, or being able to use Web2 authorization to solve account extraction. But most importantly, providing data provenance.

So being able to do things like prove I own a Twitter account that has over 100 followers. You can use that for some basic civil resistance. Prove, for example, I possess an account for the HMRC taxpayer website, which proves that I'm a UK taxpayer. Then once you have those kinds of attestations on chain securely... So when I say secure, when I say private, I mean this stuff is encrypted.

And you're proving the unencrypted data to smart contracts, but you're not revealing it to the world. Once you have that, you can start to link accounts to identities. And you can start to do this in a much more holistic way than having to rely on a unique source of truth. So, for example, I would say the alternative scenario is something like WorldCoin, where you have the world orb, which is basically a very unique attestation for your proof of humanity. What I'm talking about here is much more holistic, where your identity is composed of a very large, diverse set of sources that are coming from independent applications, products, services.

And this unlocks decentralized applications that can interface with the real world. For example, I want to be able to go to a smart contract and not say, like, I am 0x3FFQH22A or whatever the hell my text account is. I want to be able to say, hello, my name is Zachary Williamson. I am 37 years old. I am a citizen of the United Kingdom, and I live in London.

And I want the smart contract to know this so that it can act on that information. This is the fundamentals for how you interact with the real world from a blockchain. Once you have that, you can start to establish meaningful digital sovereignty. And what I mean by that is establishing precedent that ownership of digital assets implies a legal claim to property in the real world. This is the, in my opinion, hardest part.

This is the regulatory part. This is the part that is completely independent of technology. But we need to demonstrate that these kinds of things are useful and necessary and add value first. And that requires steps one and two to be fulfilled. Privacy technology bridges this divide.

It bridges the gap between where we are today, where we talk about these ideas, we've been talking about them for 10 years, and the reality when none of them have really been executed successfully in 10 years. So privacy is decentralization, highly aligned, because if you build this kind of ecosystem, like, for example, the ASIC network, where you have dApps that touch the real world, they need to understand things about who you are, which would normally require the possession of a lot of sensitive information. To remain custodial, these identity standards must use ZKM privacy, because otherwise your application of service is now, well, it's custody of, it's taken custody of its sensitive information. And to remain composable, the data being proven must remain client-side. What I mean by this is I want to create a universe of applications where your data remains client-side, you have encrypted attestations about that data that is on-chain, and then you have smart contracts that can interact with these attestations in a commissionless, composable way.

That way you can create applications, products, services, wallets, that are non-custodial that can still do very advanced compliance checks. But that requires super advanced ZK. You can't do this with data custodians, for example. And so how do we build this missing link? Well, spoiler alert, you build Aztec.

But I'll break it down. First of all, you really need a programming language that is adapted to the semantics of zero knowledge, that enables app developers to produce complicated applications without having advanced cryptography knowledge. Trying to distract as much of this complexity, this circuit writing, this privacy as possible. That's what we did with Noir. It's one of the fastest growing ecosystems in Web3.

We have a NoirCon later this week, so come check it out. Yeah, and it's a platform agnostic ZK programming language. And then once you have that language, you can integrate it into a meaningfully private blockchain. And by that I mean a blockchain where the actual state model itself is constructed to enable strong privacy. Because it's not just a matter of taking an existing blockchain architecture and adding ZK into it, because that doesn't really work.

For example, if you take an account-based architecture like Ethereum, let's say everything's encrypted with ZK. Well, if 50 different people send me money, then my account balance is going to update for every transaction. And even if my account balance is encrypted, you will still see a single encrypted variable in that database update for every transaction. And so you will be able to reconstruct the transaction graph. You need to change the state model to actually add privacy, and you need to change the transaction model.

You need to have the concept of private functions and public functions. And so we figured that it would actually be, instead of retrofitting privacy to an existing blockchain, it would be simpler to do it all from scratch. And so here we are seven years today with the ASIC network. And then on top of that all, you need a very state-of-the-art cryptographic engine to enable these advanced general proofs to be constructed on user devices, client-side hardware, things like phones. We have some exciting announcements about that soon because yes, client-side proofing is very much a practical possibility.

So I want to talk a bit about Noir. And how do you actually, it's DappCon, right? How do you build Dapps today that use privacy? So Noir has come along leaps and bounds since we created it in 2021. It is a feet-to-reach-rich, Rust-like programming language for ZK.

It's optimized for fast client-side proof generation. We have Noir 1.0 released, lots of advanced libraries, and an extremely vibrant developer ecosystem. Honestly, it's grown far beyond my original expectations. It enables composable privacy because every...

Hang on, this slide's out of... I'll go back to that. That slide's out of order. So here's just a few examples. I just pulled these mostly from NoirHack.

It was a hackathon that we ran with many, like dozens if not hundreds of submissions. So things like ZKFog of all games that you can play ZKDrop, which is basically a way of performing airdrops privately so that you can hide fundamental information that could be used by master manipulators. You can make it a lot more trusted. ZKPassport, which is available on the App Store today. We have, yes, apps on the actual App Store that use advanced knowledge.

It allows you to do identity attestations whilst keeping your data client-side. Things like Whistleblower websites, things like being able to try to push back against the reproducibility crisis in scientific research. As a former scientist, this is something which is very meaningful to me. And that's just the literal tip of the iceberg. I could spend an hour talking about all the interesting Noir projects that have been built today.

But I'll spend a bit more time talking about it. So we have, on top of all these hackathon ideas, we have a lot more serious ideas. Things like trustless peer-to-peer on and off-boarding with Europe's Open Banking API. So you can genuinely trustlessly exchange fiat for crypto. Bank-grade private security tokens.

I've already mentioned the ZK Passport. Passport-grade on-chain credentials. Anonymous social media posts with an on-cast. You have trustless pieces of email, the ZK email. And it's a very old screenshot.

It's from the city. And we have privacy-preserving wallets, which, on the ESSIG network, I'm very hopeful that are going to be the seeds of real, meaningful d-banks, where you can provide banking services to people all over the world, particularly in the third world, that don't just mimic regular banking tech but with synthetic tokens, but actually provide you with the real-world services that you want from a bank account. So this is an old slide from our roadmap. We're past that now. We're auditing.

We are old. It's underway now and is going relatively well. So yeah, we're on track for our roadmap, which is rare, but we're on target. It's nice. And, yeah, get involved with Noir.

I don't know how many people scan QR codes in conferences. I don't even know if this code is valid anymore. So, yeah, some feedback on that would be very helpful. And where's Aztec in 2025? So Noir is just a programming language.

It's just a programming language. Aztec is the actual network. And I'm happy to say I've got some real updates this time because since I last gave a talk about Aztec, our testnet is live. Public testnet. A real testnet, not some marketing thing.

Like, this thing is fully decentralized. We've coordinated network upgrades through it, through our sequences. We have, you know, fully decentralized block production, sequencer selection, validator selection. It enables genuine feature-rich end-to-end encrypted WebP transactions. And, yeah, you can do it all with client-side proving.

We're focusing very hard on improving the timings of this. Like, at the moment, with our very rough cut public testnet, you can do proofs of private transfers in less than 20 seconds. I think I saw on Twitter somebody did it in 12 seconds the other day. And, yeah, you can use it on most phones and laptops. You know, this is our playground, which just shows some of the basic examples of what you can do.

Account abstraction, we have that built in from day one. So you can use any kind of auth you want. It can be an Ethereum public-private key pair. You could use the hardware security module on your phone. You could even use OAuth if you want, as well as examples like private vesting and private tokens.

So this is a reality today. And we are, yeah, triggering our audits and ambitiously pushing to mainnet. Again, this is our, what is this, lock height. Yes, look, we make blocks and continue to make blocks. There was a little bit of a network outage.

But anyway, yes, this is all fully decentralized. We're working on some of the stability things. That's why it's just that. And, you know, to get to mainnet, our roadmap is fiercely complicated. We have to build a lot of novel solutions across the entire technology stack for the first time because no one's really done what we're trying to do here, where you have a feature-rich smart contract ecosystem like Ethereum, but you have private states, and it's fully decentralized.

And it just works out of the box. It's a gargantuan amount of complexity. But it's been seven years. We're almost there now. We're almost there.

And so I just want to leave with the note that, I think, not just AFTIC, but privacy technology in general, it's going to make Ethereum cyberpunk again. I was at a party the other day, and I was speaking to a venture capitalist who was not in the crypto scene. And she said to me, oh, crypto, I haven't heard from crypto in two years. What's happened? Has everyone gone away?

And on reflection about this, my answer to her was, well, you've heard about me because I am effectively a fossil. I'm a relic from that optimistic time from 2017 when people thought that crypto could change the world. That's when I started building. That's when AFTIC started building. And we haven't given up.

I know that a lot of, you know, crypto has had its ups and downs lately. And I think I agree very much with Vitalik, when he once said that the greatest challenge we have in this industry is nihilism. The idea that this is just a casino and we should just make do with what the casino can provide. I've never believed that. Nobody at AFTIC has ever believed that.

We think that the original idea of self-sovereign money, of being able to provide advanced financial primitives, to be able to coordinate human beings through things like decentralized autonomous organizations, these are valuable outcomes to pursue. And we can make them real. The problem from 2017 was that we lacked the full technology stack to do it. We didn't realize at the time that you really need strong privacy technology to make this happen. But that technology now exists, and we're using it to build these human-centric networks where you know that you're interacting with human beings, where you're enabling people, individuals, to better coordinate the allocation and distribution of their assets, where people can be their own agents, where you don't have to trust third parties whose incentives you have no idea about and are likely not aligned to yours, where your data is your own, and you choose how it gets used, and you don't just randomly hand it over to God knows who and for whatever purpose.

And that we can genuinely, meaningfully add autonomy and agency into people's lives through this technology. I still believe that, and one day we will make our voice heard collectively and people will see that this future can still come about. Anyway, that is me. Thank you very much for listening. Thank you.

Thank you, Zach. Thank you. We have time for a few questions. We have one question down here or right there. Yep.

Hey, Zach. Great presentation. You touched briefly on wanting to, I guess, deploy the test net completely decentralized. My understanding is you plan on doing the same thing for main net, something which I don't think really any Layer 2s have attempted to do. Can you speak more to why you think it's so important for the Aztec network to do that?

Yeah, happy to. So just to repeat the question, we're planning on launching our main net decentralized. No other L2 really does this, and why do we think it's important? As much as I'd like to claim that I have stronger values than other L2s, like, oh, we care so much about decentralization. Well, we do care, but it's because the incentives aren't aligned.

We are private L2s, and a network like ours very much acts like the Internet where we want to make sure that application developers have the tools and technologies to make sure that within their apps, good and bad actors can be distinguished from each other. We want to make sure that users of the network know that they're not helping bad actors, but this is very much a task and responsibility for the application developer and not the network, and for that, the network needs to genuinely remain neutral and not have centralized nodes of control. If we launch centralized, then the Aztec network itself is an application, and then that has many, many downstream problems. If you're launching a scaling L2 that doesn't have privacy, you don't have this issue, and so it's much easier to launch centralized, and to be honest, if we could launch centralized, maybe we would. It's a lot easier.

We've had a lot of sleepless nights at Aztec because of our focus on decentralization, but for me, simply, it's because we're aligned. Like, we need decentralization, and that's why we're doing it. We had another question over here. Yeah. I had a question regarding private state discovery.

How should it be managed on Aztec since when building a wallet for programmable privacy layer one or two, the main concern is do users have to do their own private state discovery, can they outsource it? Is it privacy preserving? Do they do it? Yeah. Good question.

So how should wallets handle private state discovery? It's a thorny issue. So when we launched Aztec Connect back in 2021, we did have the system. It was very much like Zcash where users had to effectively download the entire chain state and trial decrypt every single transaction to see if people were sending them money. That doesn't scale at all.

And so, particularly with the transaction throughputs we're targeting, that's not practical. And so the question is, what trade-offs can you make? The holy grail is that you use private information retrieval and fully homomorphic encryption to do state syncing by third parties off the chain where the idea is you have some big, chunky server that downloads all the state before you send it to you, but they're using fully homomorphic encryption so they don't actually know what state you possess. That's not really practical with today's technology. So what we're doing is, we call it handshaking.

Effectively, what it is is that we expect the sender and the recipients to communicate a bit of information to each other through side channels. Effectively, the sender sends a message to the recipient going, hey, expect something. Here's some encrypted tag. And then the recipient can use that tag to basically derive a bunch of identities that identification numbers that they can very quickly and rapidly scan the blockchain for. So it does leak a little bit of information, particularly if that side channel gets leaked.

Effectively, it means that if the side channel gets leaked, observers will know that a specific individual will be expecting to receive notes of some description from somebody, but we feel like that's a relatively reasonable trade-off. Please, a round of applause for Zach Williamson from Aztec Labs.