# Hands-on Applications of Zero-Knowledge Signaling by Wei Jie Koh (Devcon5)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 54:50
- Topics: blockchain, smart contracts, distributed ledger, ethereum, Science & Technology
- Watch: https://streameth.org/watch/yt-7wd2aAN2jXI
- YouTube: https://www.youtube.com/watch?v=7wd2aAN2jXI

## Transcript

[Applause] so they sing along I do 1910 foundation of advocacy and large applications and today I tested myself on Sunday night working on our past two weeks in collaboration with and then Steve that's Patricia right there thank you so much Patricia yeah so today is all about how we use these proven tennis tokens to enable anonymous voting using civilization and I am finished and go into the demo I'm gonna go into the code I'm gonna explain my system works and talk about how these two applications of oxytane technology I'll give you so that's just think about like a juicer so let's say if even there's always drama that's always nice and controller issue and there's always like like Precious about where that we're going to include this get into this handful all right everyone to come to second and community consensus and some issue and some people say okay we can try to use an election or moving to together to get some kind of fight resolution but that's that's fine in candy but they're too far sir you can vote as long as you have an address which is not so good because it printed us free and if you vote you can find out other people's but anybody can see all more than one and there's a lack of privacy so for this use case we solve for privacy using 7/4 which is a civil knowledge signaling gadget which I explain a bit later and we saw identity by using the Pope of it because for example a bass part everybody present Agri tourism officials team with hand upon these tokens and each was an early experiment we will make it available to your address and I want that energy the DSD 71 token which proves that you had an event and you could combine these tokens and say that I said at your house a single one of the DEF CON fact that so we combine these two components until do a very similar so let's do a demo everybody is on the laptop and you already have the energy mobility I will encourage you to go to one another app is a main happy so okay mask mask one on the address that owns an opening and click on register and your time in your your pop-up ID which you can find an even scan so for example if I go to my pen and ask forgiveness can I look at right yes II 721 tokens you see that three days ago I played by both token so this is my zone IDs for tonight five wishes for my fishes for DEFCON 5 I would like this organizing into the box and I'm register so that's just one protection should cost less than a person twice by five cents and then once you do that you can go to post and you'll be able to see the list of questions I hardly need to see that it with and you can know things might look at answers so so we can see like the function of people voting yes or no and now is just gonna do it with them or by adding a question and answer a question any suggestions for highly controversial topics that happen [Music] so so it's just a sign of encryption and that we submitted to my auction database and now I'm gonna do the one team I mean a real Airport on admission and this is where the menu items I'm gonna prove that I am in a set of registered identities and also at the same time send a signal which disturb answer yes to to the back end the bank is gonna verify that I am a participant of a little debt they don't know which identity I unless I'm the only one that is obvious but if there were like ten people who registered and I made a proof it only shows that like one of these times so this is like basically a schnapps and the a snacks basically I wait for you to verify commutation without running the computation itself and so there's like two main steps the first step is to generate proof and this is something for the converse of the things like how many to do that the improvement vacation have it done in relational time and it can also be done for trade for the sake of this demo the industry the recognition of objects in the MIT someone that and you can generate crews any possible and so what happens is that each other into that process into an API sensor that I can I can verify the truth updates the database if it was previously we also have a mechanism where you cannot vote twice and this mimics these on chain behavior of is my contract that prevents you from forty twice so this will take a comment and I can Germany to like me mechanisms that city sucks how you can see this next website I haven't got my let's say I have the set of the website deposited and then my means the new plugin because I came like the dead fun does it have to update your registry you just have to register it well it just will be also if it's be able to just pull from the 7:21 untrackable interactive update you'll have we the miss of interest of my dentist who ever registered through this app so if so even take the don't get immunity of the register I use this app alright so the answers yes and I reach anybody when I talk to try this out unfortunately it's not super mobile friendly so I don't think that it woke up all of its the URL one of us at this point any questions before I [Music] actually make a trend left endpoint and directly but travelin API so that you're asleep okay so in this case we send the vote to object to the again but that's the reason for that is because as a demo and just for the demonstrate way votes you know in a better in like a production application the you would send that vote like through tall Sunday to an API of a realtor that would really that prove to the contract and receive a reward from the transaction that that was something that would cover with here yeah by this case we're sending through an API in not because we are not because when piracy but because first of all is a demo and second of all even in production we were selling fruit okay and then the relay would send money obviously I'm just gonna try to do division syllable but make the transaction directly then people will you are able to use it so that we are aware right so the only transaction that can be linked to your address is the registration transaction or the on the transaction that adds an impression to the system but may answer the question we generated proven Center to a third party video that does the transaction it is against for you and that really is rewarded by so this is like on a tangent but I'm just going to anyway in the content version one idea that we have is to is that when you and you ask your question you would have to send some along the question and it need to be stored in the contact and when you answer the question the contract needs that small reward to be really understand the transaction and that's why as Holliday is incentivized to relate intersection offenders so that's how you get away with not made against for fully because the people of expression could subsidize the case without follow the recipe but for this demo is and how the opportunity I don't know this so there's no comment on that okay so now I just come in to my America is my nation of Pakistan okay so right so just to summarize what is false and telling a free registration have Asante but that's only one that goes on chain that's a back-end server that checks whether the word user and as a token it does the is it is not proof verification of train and those installing SQL database and as also a they also check the cache of the the answer and the identity to prevent our synthetic so I can explain what a pixel antivirus fail this is what prevents the same user from signaling twice to a question or to avoid a 2008 crash and this effect this mechanism is Pompey is what I'm doing to mimic what the contract with the contractor so one chain as messages now this if that we later we want a chasm and the spot contract right feisty it is not true and only drop has a signal on both big food is bad so what is great on yet so we have two layers the first layer is basically the toy player it's a smart contract that it's in the question and answer and traitor but that's the interface when atomic what we call semaphore and semaphore is like the base layer for decades now osteo knowledge applications like this so semaphores what we also use posnick so smoke simplify so if i stupid generalize what it does basically is two things first thing is that it allows you to register your identity second thing allows anybody in this poor identities to signal registry by signal and means like comcast any string to these will not change but when they do that they have to prove that they are one of the registered identities that had measures on their self study so from an attackers wannabe all they know is that this list of registered identities and that's the base of signals but you don't know which singer is linked to which identity so in the same way and an attack that noses that they stopped attendees who have registered on his lap they notice a bunch of votes but I don't know which identity is meant to wish vote unless everybody was yes to having that consistent well Cyrus or unless there is only one percent voting they're somewhat obvious so this offensive depends on fire to succeed invested half depends on having a lot of poor participants in school otherwise you can use two restrictions I got over it or not and semaphore is basically to reiterate is a base layers for these applications other applications are like a mixer anonymous pocket even probabilistic micro payments so there's a few ideas so this comes from very high pan and Quebec and from here and they've been like I think it under stock states have been talking about some beforehand this is just one application yeah okay so if I have it go even deeper into the Sun the Sun opposing a star circuit and any questions about this seem to do like conventional election you first have to register everyone expect oh well I I can't think that this would be useful for national induction just because that's what the logistics way to have these securities the stakes are way too high and I if someone if this gets hacked then then the country actually gets a that is not so fun oh but what is like analogous to like so it's for example Singapore and from that's this way so Singapore's independence was like 1965 and even then when there was there were elections people weren't all that they were secret and after today and we hear this I mean I mean every five years of the connection the government says you're vollis secret because they want to instill certain a lot of trust that network will not be attractive and and it's likes to like to believe that because if they don't believe that they're not gonna vote in the way that they want to become feel out of some kind of my sense of anything if we don't have that in New Zealand than plenty but on the Dow you know not necessarily going for the best interest of the doubt we might be voting for some kind of some other generic sensitive which we don't really want to rather than like incentives to try to spend so this is just one option that might be able to have that but I don't anything it might election then it's saying how they burn three votes every time is interaction I mean they'd won the votes have been one after the election so so you don't know who work as long as ya telling it to a friend you want yes yeah yes yeah managing the user will be interesting to let me use this other these like to create them yourself so my greatest the other is myself right yeah I can G isn't but it's a special so that's gladness that will be done suffered of the affinities up it was the salt all six people ready for what a serious problem so I put a bridge is literally there this six thousand tokens I could've registered like a couple other one that's why I purchased at my I'm certain I date and then I learned I mean we are assuming that each of us only has one poor talking now unless you steal someone else's condition but nothing I do about that I think he met that registry registry he has yeah yeah yeah yeah that's enough something that we assume that there's no collusion yeah okay so this is officially the last light because I expect everything to diving into nzk stocks might be a bit complex I was gonna do this very slowly and the survey server so it is audience how familiar are you with Stevie snacks have you at least heard about it alright as anybody you go to see a star circuit okay if anybody's alright so let's just drop into the coal chubby [Music] we'll listen you know how he is not food what so who doesn't know like the ABCs of disaster I go into the pipe wall and like talk about ruining my vacation key thing again okay I think that's just I just divided up on one I think it is [Music] I mean [Music] okay so just to recap Zika snacks are basically the ability to verify conversation without right so Zika snacks and basically the ability to verify interpretation in a initial amount of time dependent understand how the national competition is without revealing certain inputs to the commutation so for example let's say you want to say that you have a function that I have some text and now see this is a hash function right so let's say that you want to give this hash function the Hedgehog W is some consideration so the first thing we do is that you can call this function in two variables socket and now we have now we have a circuit and the two inputs the first thing what is W in a second is take the code of F is incorrect in inliner to make specific specific language as used to program the circuit but as a as an input of you and an input H so we want to be able to prove that we know W you want to prove that we know that we that we know the in hex of a hash without rebuilding one in Texas so this matrix is a single angle and this is a common input so even though I say that this is function and this is a socket it's important to know that we don't think about circuits like like black boxes we don't think about them as input and output it's something that we thing in terms of whether this equality holds we want we want this basically encoding a bunch of SS statements Antichrist statements inside the socket so that this circuit or this proof of you valid if and only if all the constraints over so we're not like it's not like a function in the in the traditional sense so we take a circuit and requires circuit C and for C it's not going to do is something kind of trusted set up so we were just a setup you will take in the socket and then you run this process but you can you get two keys and you get some toxic waste so you might this process contrast set up you get verification key of proving key and it also produces some toxic waste which you must discard otherwise you can prove you can generate figures and I get Tom on how to do this how to discount this in a way that's less non-transitive so when you want to generate the exam proof you need a piggy so with a pinky so in generate proof you need a circuit ended up proving key and you need the witness the witness is a secret agent good do we need a public input don't things alright well major it proved to me in the public I don't I don't think really verify it when you need anybody's money money let's just go a bit thank you yeah so this it's so it's so many details I just have to go up there so we generate improve this wait and then let me get the truth and when you want to verify the proof be they use the verification key and the funding inputs H so if this is true it means that I know that I know that witness I know the plain text of the of the hatch H given the unification key and the proof it was fast and I don't know if so that's C it's not 101 the big problem with taking snacks is that you have this classic setup where you need to generate a proving gamification key but you also need to this can't be toxic waste and this is something that is really troublesome to do because the way that the best way to do this is to multiply plan accommodation where you have a bunch of people to do the Chester setup in step by step phrases and you only need one person to be honest on a Polish people who do this transit setup it's part of House of Taos everybody and for semaphore we are doing this increment potential house hotel where we are coordinating with 120 people so far to take part in the ceremony to generate to do the multi-party computation for transit setup so as long as at least as long as only one of these people is honest the whole thing can be trusted and c-catch did this in two years ago without sampling of thousand calorie trance L so this stuff is not new the can be a bit like mine Danny so is this be patient well it trying to navigate all this complex stuff so we're gonna take this and apply this to semaphore so just let me mentioned how circuit this is super simple circuit that the function that hashes is attacks there returns a hash so the semaphore is basically so make the circuit checks whether the hash nasty the hash input with the dominant good measures the hash of the witness or the secret but semaphore is doing something a bit more complex what we're doing is semaphore is proving three things the first thing is that we are proving that we have and we have the valid lover proof to the maca root starting the smart contract given given the identity commitment that we might improve knowledge on so what is an identity commitment so earlier when we've registered our identity into the app we what we did was not just some a transaction on the transaction thus the hash of an EDD as a colicky and two random strings so this is these are these all these identity commitments installed in your country as an leaves of a motor free and they've Ruthann about the free store in a contract it's not at the Center for contract when we generate the burglar-proof we download all the leaves we generate the marathas and that's the maka proof and we see when we earned let me generate the proof the one of the private inputs it goes into a circuit and the circuit verifies the locket proof and only analog approve along the two other conditions it would be a very truth so this that's the first thing we do to prove that the user is indeed those are the first condition that needs to hold for this any questions so far how does it help in terms of complexity how much more complex is this then this is like wasting that is eternal really yeah ZK is a super complex right because this is just like one note if on a single denomination so what I mean is that for mixer each leaf only represents a fixed amount [Music] in this case it's just so another thing a little bit with sequence but this is recently and so before the is Michael can fall if we use a circuit which was above the treetops 25 us so that's to the company leaves that can be stories and a contract which is facing into the company registrations that takes like 30 seconds to generate proof on a laptop and that takes like 800 K yes - very very fun yeah I think it's what I wonder it has to be positive but for this year's case we lower the number of these know that about nervous in a tree to 12 so to Travis like 4,000 basics and that's likely the attendance of that car once of the second concussion without driving the power of the polynomial so you're choosing if your power is not high enough right then the verification is necessary even if it's as true is actually false because we go theory because because this is only true up to an epsilon and the axle on is is a function of a of the power of the polynomial all right I think I'm sure the D for their customers we most have met right not super sure like he catches like it started I will have to check with people who know the details all right so anyway so that was just the first part of the proof now we want to prove to other things the second thing gotta prove is that the signal was winning broadcast at once which means that we want to prove that there were no cover that we were to ensure an economical price so that is something called nullified hash which is a hash of the identity image file which is one of the rented marrow cells has along with the monkey and when you when you register it was a contract you also had a passion along with the external which is a hassle that question masked by the users and finally the top so the contracts thoughts or the enzyme size mattress and the circuit also ensures that the hatch is valid just like my passion in this episode and finally we also do EVPs a syndrome gratification to ensure that the public key that was that's that the whole name of the the registrant has is valid and this is a median EVPs be a kid not at ECDSA tamaki so the reason for that is that in DDS a common keys are much more friendly and much of some it was a guess not and not so much so far ECDSA keys which means that zk stop applications on if you have some challenges in terms of UI UX because these keys have to be stored somewhere other than users wallet such as such as in local storage but just yesterday they're also big announcement made meta masks when they have a plugin system that as you have something fun at keys so there's something that you can explore and figure out if there's possibility use instead of storing their keys and office operation so just a recap this time across subject proves three things that the users identity is one of the set of register identities that signal was one intercept ones and that the user truly almost in here there was used to that like to Leo Esaki because they had a sign a message that is the circuit the circuit breaker is the angel so and also that we have the signal that we are broadcasting ahead answer we are broadcasting a signal to a question which is hatch to become a excellent modifier the semaphore contract supports multiple identifiers and s how many other questions yeah so Before we jump into more code can be any questions yeah okay yeah okay but I will join it to the maybe I will join it to the flow of how this whole thing works from start to finish from the UI all the way to the secrets of it just look at it hope some good all right so that's staff in the front and look at what we do when we register so customs at first everything basically this is like a yeah rather when we register we generate an identity commitment and this function basically hashes together those three things right so we are using a Peterson hash I mean a pleasant commitment to have the public key of the user and and two random values and this UI is using something that lifts and publishes the like and iam might be extracts over a lot of people graphic populations that need to use to use and so it says it to be contract just a transaction when it's done we just have a user and then when you submit a question this is where [Music] and it's like a so we have to question that the user sign it you think it was an inside function and we studied up to the backend database I think much more interesting if I show you what happens of a Vista project if it's done on training registration is a safe because we already do that huh train for one train registrations basically you instead you just pass along the identity commitment to the Center for contract when you submit a question what we're doing is we're adding it we're adding an external modifier to these and of our project and we also for this version of the building we require the user to send some keys along with the transaction and this is what pays to be the hospital so this fact this is this fee could be any about but it should be enough to cover is a field of pupils and then when you answer that question we have to answer and we first of all check whether the question that is answered two x's and then we submit this to this semaphore contract and along physique is not proof whose terminals are a BST cosmic why is my agency and and but also these are the public influence to the Ziggy stock hash functions are second yeah [Music] yeah but as far as every times identity bites right so now let's go one nearly fell by the exception dimensional we're going into the center format right so all this is all it's all value so if you won't if if you think if you have nice I'm not an occasion that wants to use ideal knowledge but you don't want to play around with building a whole new circuit this might be why keep it also helps that warm it through p.m. also doing like that trust set up an audit for the central code so what was I done you wouldn't have to run your trust as a set of audit for this component alright so insert identity this is the function s elephanta LT identity to be poetry one tree and broadcasting a signal is where we first base V check whether it's signal whether this security system through this valid and then we just added to the mapping of Cygnus in Astana track and this function to check whether the star proof is valid is here [Music] so my proof is it's like this my contract HUD verified also this contract is auto-generated by a library called circle and circle is the JavaScript based by B by an f3 unless you're right ziggy-zag circuits and when you buy the circuit you can complain compound a circuit you can also also generate this solidity contract that allows you to write haikus so now let's go one but one Monday deeper into the set of all Z K star circuit [Music] so in this case we looking at [Music] alright so circuits available motors and me come on it in this case a main component is the phone this is very defined the signals so these are public inputs and these are private inputs so a permanent list included the identity the public key as a component propose the identity commitment as well as the second child that was generated and the mother constant as for the timing was those police actually single and B X on a non-fire so this is where I get really detailed and a lot of projects using cell phone such as CT lower-right also to a lot well country verification I mean signature verification about Madrid about the truth but also it but just in a different way because they're using it for verification so this so that students in my example so let's say what to verify that the identity commitment is valid which is going to check whether the hash of the three components for the key identity trap dog energy amplifier matches the given intensity competent so circuits have inputs and outputs no submissive inputs and as long as the inputs are valid then this occurs well right so we have a component color person come on it doesn't commitment which is like the - function that's for need for staffs and what we do is that it be publicly the bits on the public key we do that and assign them into the Edison hash component and we do the same with the identifier and intractable so thinking about this DSL is that you need to do a lot like bit level operations which is super tedious and so credits all go to college someone raised mother right and we do the same for other components it's not and another day if all these all these constraints check out then if also get kissed and the and moving on the stack you'll see that this you'll see this it's not on trying to verify approved potential will go back to the semaphore contract that will pass this function will execute successfully and and that's the only rule with semaphore so yeah I'd like to cover a lot of tight detail in this and there's so much Monica so I would encourage I'm ready to join the semaphore society pentagram so this is where a lot of the research and development in to see this Knox's company and this is also where he thinks a party that mixer that gives us a fastball it's just yeah Internet's not working for me right now but don't deal [Music] yeah so be good when we go kind of github you can see the link to the Democrat group and how much anybody to approach me for different questions about how to use simple and if one is not real and if you wanna apply a file applications I am writing myself an ellipse and publishes a and compact method as you use it more easily and doesn't write blog posts and a comment Asia to help developers to integrate this into yes challenges it's not in two weeks because I company said by one code from the mixer by Gooden itself this is my different covet test that you see that the UI the UI build is like almost the same yeah so this is like what another application of all fishes the pizza I never talked about this two days ago you can basically write when you deposit F into the mixer what you're doing this which measures the relative identity and then you draw your senator sitter and because he cannot send us things like that price you cannot expect and because we have and because it cannot link deposits to signals it because it cannot link signals to identities it's not being controllers from deposits and it's how the mixer works using semaphore the base value yeah so just a given to demonstrate but just how it's going to download the be use of the elderly generally the book improve something that proved to be a young which sends the transaction and is a guest users behalf and the user gets better so it's like a safe design for identification any challenges or right there's a ton of challengers because I guess I guess the first thing is like subscribing a head around all the different types of materials and the types of photographic primitives that I use but you can even use like sha-256 hash even though it's fastened traditional with us that super slowly stocks and get into them understanding or like the fact that the understand hash functions at the top perform differently is itself like one of the colors that that people have to get you to understand this whole thing because it in stocks and Memphis kind of different so that's one of the extractions that we want to help people not have to worry about and they use their cell phone initially the name certifies its I'm still working documentation and guides but it's an idea and so all these functions should help developers to use this system I will have by 7 minutes to go maybe I'll take like two more questions [Music] like they thought about people like like sellout down to Miami but it's it Wow the juicer is around telling about the book what is there is through that the ability to any maybe you know if Elvis fan example my critics of my features need to like let me spend once but inviting it might be multiple times right some of us official but it was looking and under the petition that lead that's [Music] yeah this is like a separate project when you also using his lungs to prevent pollution in Dallas so I think that ideally - is that using a safety stock you can make it one plus to buy a boat because someone could pull together and make you all you're powerful right now I'd rather but it's like I don't think it's to do a little bit of wiping this is using I could completely this red circle but it's using similar videos and similar concepts did you see Phil Diane stop it I followed his research is basically how can you prove that you can likewise nestle this is a very similar collision stuff yeah there's a bunch of people trying to do this thank you so much [Applause]