# 'Achieving Practical Programmable Privacy with Noir' - Zac Williamson - Speakers: [Zac Williamson](https://streameth.org/speakers/zac-williamson) - Channel: [ETHGlobal](https://streameth.org/ethglobal) - Date: 2021-10-09 - Duration: 32:17 - Topics: Zac Williamson, Noir, Aztec, Ethereum, ETHGlobal - Watch: https://streameth.org/watch/yt-9Q4vP19lA5Y - YouTube: https://www.youtube.com/watch?v=9Q4vP19lA5Y ## Description Zac is the CTO & Co-Founder of Aztec, a scalable privacy protocol on Ethereum. In this talk, he gives a technical rundown of Aztec and Noir's scalable privacy features. ---------------------------------------------------- Follow us: https://twitter.com/ETHGlobal​ Check us out: https://ethglobal.co​ Email us at: hello@ethglobal.co ## Transcript uh all right so our next speaker is zach from aztec and we'll be going on with his talk achieving practical programmable privacy with noir so without further ado zach please take we're away to do so cool um just to check can people hear me just want to make sure my mic isn't isn't muted awesome uh great thanks um cool yeah so hi everyone i'm zach i'm the ceo of aztec and we are a privacy provider on um ethereum and our mission as we see it is to both scale ethereum but also mainly to deliver strong privacy guarantees to public blockchains uh so um i'll just share my screen now because uh to share a few slides that i have presented um to present uh cool right so our thesis is that the more that blockchain has reached the economic lives of individuals the more the privacy is going to move from being just a nice to have to utterly essential um to the functioning and purpose of a blockchain blockchains can be used i mean the great promise of blockchains we use as well global settlements there um for payments microtransactions and far more than that but if we live in a world where your salary is streamed on chain or we live in a world where the majority of your purchases and payments are being settled on blockchain people aren't going to be happy with uh their entire payment history being built up and assembled by some analytics firm so that their details can be sold to advertisers without their consent people aren't going to be happy with everybody being able to view how much they're getting paid at a glance on chain and so really i think that privacy is going to become a major issue in the future and we want to as we the way we see is we want to basically solve this problem and we're going to solve this problem using highly advanced state of the art zika snot tech uh plugged into a very uh advanced programming language that abstracts away all the cryptographic nonsense and make me presents a very like easy to use private smart contract printing um interface to developers so before i before we dive into that what might be useful to provide a little bit of context what are private transactions and how do they work because you know that they are they're they're not particularly simple that's for sure um if you want to be truly private they need they need three things what we call the triptych of privacy another completely stolen this from uh anna rose from the uk podcast uh you need data privacy obviously um values that you'll have been transferred ahead and any sensitive data is encrypted you need user privacy you need your um the identities of senders and recipients and counterparties to be completely anonymous and encrypted and you also ideally need code privacy so that the actual contract you're calling is not known to observers and you can even go one step further and actually uh have encrypted code itself so that only um a privileged number of people can actually see the smart contract code to begin with uh for for kind of specialized use cases where you're using proprietary algorithms but this presents a lot of problems if you're doing a cryptocurrency transfer you transfer now can't produce linkable database updates and by that i mean if you take the ethereum use case uh you have an account balance on the ethereum blockchain it's in a database somewhere your address has got a value link to it and that value changes when you send a transaction even if you encrypt that value field the fact that it changes reveals information about the transaction graph and exposes um a little bit of what's happening and so the way that we solve this and the way that it's commonly solved for example i think z cash really pioneered this for privacy is you you represent value in all bitcoin bitcoin style world where you have unspent transaction objects except this time they're encrypted so you have some notes that represents the value it has an owner but the value of the owner are encrypted and you'll balance as a summary of those enter notes that way you can describe a private transfer of value using this join split zika stock circuit the idea is you have some input notes that have owners and values and you have some output notes that have those values very much like bitcoin except everything's encrypted and the way that this transaction works is you use a zk smart to validate that the sum of the input is equal to some of the output nodes to validate that remote owners have consented to spending these notes by providing a digital signature and basically validating all the logic that requires sensitive information inside a zika snark circuit so that it's all hidden from the world and from observers and nobody other than the center the sender really knows what's going on and only recipients can decrypt the uh outfits along with the sender because they're creating them so that's how you do private transaction how do you do it at scale because that's important right you can't have it's not it's not sustainable for the ethereum blockchain to verify every private transaction um in a smart contract because zika start verification is crazy expensive um it costs you up to hundreds of dollars at the higher gas prices we've been experiencing and this is where our zkz cable architecture comes in effectively uh depositors and withdrawals into this architecture are public because you're depositing within cryptocurrency but the identities are uh unlinkable so the identity the depositor is not necessarily the same as the urban decay withdrawal um and you can also mix together values to provide even more investigation and any in internal transactions that you send within the royal architecture so um any any like purely private sense are completely obscured so senders and recipients identities and values are hidden the the kind of the strongest privacy guarantees you can get so the way this this works at scale is through the concept of representatives so you have a zika stock circuit which defines an individual private transaction and then you have another larger cpu stock circuit which aggregates together hundreds if not thousands of these private transactions and verifies that correctness by basically what you have is you have a zika stock circuit that verifies proofs made with other zika snacks because that's why it's recursive smarts and doing this on ethereum has been something of a difficult problem to solve because the cryptographic primitives available on theory are extremely limited um you could only do basic arithmetic over one electric curve soon to be two um and so what we've done in the last that using our turbo clock proving system is we've provided the first viable algorithm that can be used to perform requester snaps on ethereum that's how we've achieved uh this private rollup architecture and the value but one of the valuable things about this is that this roll-up that you need to make it's the proverb is completely untrusted it can be delegated to a third party they don't need any sensitive information because everything is hidden within those generous marks and it has more advantages over um other over other um similar roles in layer 2's because the raw provider can't mount incident attacks because from their perspective all of these transactions they just look like random numbers because everything is encrypted so they don't know what to censor so it's um from that point of perspective it's a relatively neat architecture um and then to go on further to get a little bit exceptionally balanced uh you can make volatile lots of pull-ups or roll-ups of roll-ups if you want to parallelize your roll-up construction to aggregate extremely large numbers of transactions so let's say you have a roll-up that verified that aggregates 32 prior transaction groups well then you can take create another rollout circuit that verifies 32 of the rollups that verify 32 transaction groups and levy then you've got 32 squared transactions compressed down into a single roller and you can scale this arbitrarily to produce massive roll-ups um which is again another value of this uh recursive zika star construction so that's how private transactions work and provides strong privacy guarantees but the title of this talk is programmable and privacy and that's not programmable that's just that's just basic value transfers so let's go one step up and say ask ourselves okay you know sends and receives that's cool you've got private bitcoin you've got busy cash type architecture nice but how do you do something more for example how do you tap into d5 but in a private privacy preserving way now this might seem on the surface of it not too hard right we have snarks they're programmable program d5 drop down but it's a little bit more complicated than that because when you want privacy protections then you then then everything changes basically you you live in a bit of a more constrained world uh because state variables storage variables the kind that have that exists in a civility smart contract you know while the privacy that will owned by individuals because they're all encrypted for example if you have a some some amm that you're crazy well you probably need some kind of like total liquidity supply variable in your amm but you can't update that um you can't keep a global variable like that and update it because that release information about what individual transactions are doing and so this this makes defined protocols in particular extraordinarily hard to do um in a previously preserving manner to actually make the default protocol itself private um another problem is that uh if you have a programmable private smart contract system so that that join split transaction i just described you you basically make that programmable by anybody so anybody can fiddle with the rules of that transit circuit well now you're adding untrusted code execution into a um into a zk roll up that's privacy preserving um and so that that's quite um from a crypto perspective that's quite uh dangerous because you know you need to somehow validate that that um you have that you you have relatively you have strong security guarantees that you know somebody can't create a malicious smart contract that manipulates or affects or corrupts other smart contracts so how do we do this how do we protect users from being deported with malicious circuits and how do we achieve the kind of the code privacy so that you don't even know which smart contract you're calling when you're interacting with this crypto system and so this is this this architecture that we're putting together is a lot of it is is inherited from the sexy critical that was um uh published in 2015 with a few modifications so the way you do it is this concept you have a concept of a kernel snark set a kernel stock circuit it's effectively it's a ziki snark circuit whose job it is is to verify the correctness of a single private smart contract transaction so you have a private smart contract which is defined by a zika stock circuit that's coded up by some developer could be anybody using this noir programming language and then this kernel snap circuit is designed to ensure that validate the correctness of it that you know the user has is interacting with a smart contract that's been kind of um uh deployed to the to the chain that the inputs and the outputs of this of the of the contracts uh are correct that any state variables that need to be modified are following the rules of the chain basically performing a very similar function to the evm on ethereum uh but with the except the difference that this isn't actually an actual virtual machine it's much higher level than that so the story so far is we have a way now of doing programmable private smart contracts you have this recursive extraction where you have a privacy proof that is user-defined and you have a kernel stock circuit which verifies the correctness of a single private transaction and then you have a roll-up circuit which aggregates kennel stock circuits so it's uh turtles all the way down here so how do we get from that to d5 or something a little bit more ambitious than private transaction just a private value transfer i mentioned earlier that one of the problems is state has to be private everything is encrypted it has to be owned by one or more people therefore you can't do things like track total supply you can't also trip you can't trigger out transactions algorithmically and by that i mean consider something like private maker down um you if you make it out you know if you create a cdp it becomes uncollateralized it automatically gets liquidated well if your cdp is encrypted the value is encrypted and how do you determine even if the thing is under collateralized and even if you can do that how do you liquidate it like the only person who knows how to do that is the owner of the cdp and they aren't going to help you because you're hurting them but you're forming this action so i guess to the the tldr of this is that you can't whilst you can't do private d5 in a completely private way where you actually make the default algorithm private it's quite hard and it requires a very advanced multi-party computation protocols to achieve and you might need to add in additional trust assumptions and that this is not um something which is particularly easy to deploy or even build if you're not a relatively sophisticated cryptographer so this might sound a little bit um a little bit weird because you know um and that's tech our goal is for example privacy this whole talk is about how do you do programming i'm privileging here i'm saying that's kind of hard you probably can't do it that's not actually true but we're at the halfway mark but it looks quite hard to do you can do more meaningful privacy preserving d5 type interactions without having to have advanced nbc premises and kind of completely getting around the fact that um the actual default protocol itself is very hard to encode as a in a previously presenting manner and the way you do that is you just you interface private transactions with public default protocols and by that i mean you you actually you go to the source of value you go to the tokens themselves and you ensure that they're private so that the owners of token state are encrypted they're positions of any one token holder that's also unknown then you can make your d5 protocol completely public and you can start a voice from privacy guarantees because if you have um people interacting with say for example uniform but you don't know the identities of people interacting you don't know who is depositing into the liquidity force you don't know who is performing trades then that's very that's privacy preserving it also it gives you very strong protections against some of the existing problems in d5 for example uh right now if you if you have a very large position in d fight it's very easy to to get your pretty much inevitable that you'll get frontline right if you start to um because you can use services like chain analytics to completely dissect and and descend and and understand everybody's relative holdings and defec protocol if something hap if somebody has a portfolio with large positions you can know about it and so if somebody starts to unwind that position they start they start to make a large trade um everyone knows about it and hey hey you can you can front on those trades you can do media sharing against but if the actual assets themselves are private then you can you can undo this because if you have a large position you can unwind it slowly you can drip you can you can slowly drip out drip it like um you know one thousand diet or one million by trade time and nobody knows that there's one thousand like traders are connected with one another so if it knows that somebody's dominated doing a large trade because from the perspective of the blockchain they're not and so this is this is kind of what we're which we're doing in asic this is kind of our focus right now um it's to basically provide a way of interfacing with public default protocols in a privacy preserving manner to provide the kind of programmability which makes this possible without having to basically reinvent the wheel and and require hd5 protocols to really invent themselves in a completely private way which requires very advanced multimodal computations in advanced cryptography which most d5 teams have the ability to do because it's quite niche and also perhaps probably the incarnation because it's it's it's extremely difficult to pull off so the summary this is basically if you want to do private d5 you create a previously preserving bridge to a layer on detail protocol from a layer to from a layer to private layer like aztec the idea is you can aggregate together fixed nomination notes they don't need to be fixed but it helps with the animating guarantees so for example if you want to you know you want to trade five eth and the dominant elimination is one eighth then you just split it up into five trades because there's a scaling solution that is relatively cheap to do and then you have an aggregation circuit and what an aggregation circuit will do is um it collects together trades of the same type from different users and bundles together into one mega trade that then gets sent off to the layer one um default protocol um and that way the the expensive layer one transaction gets amortized across a large number of users so whoops yep nope hang on this is somehow skipped together skipped about a dozen slides so over here weren't we let me yes so this is just a little flowchart of how this system will work so on the left we have the layer two robot architecture that's previously observing users have a bunch of ethereum they want to trade it for die you have an aggregation zika stock circuit this will be programmed by um by somebody using noir and these ethernets get added together into a giant pool of that can then get sent out to the public layer one to some to a bridging contract which um basically acts as the interface between the layer 2 roll up and the default protocol anyone can write this this is completely non-interactive you know the d5 protocol itself doesn't have to write this bridge we don't have to like as long as somebody writes it and it conforms to a standard interface that we're going to be publishing fairly soon then um then this just works and so the idea is that the rich contract would perform a swap with some defect protocol then the process will get sent back to the aggregation circuit inside the roll-up and then from that the circuit using because it's programmable will be programmed to disseminate the the dye that was exchanged in this in this example uh just submitted it back to the original depositors in the correct ratios um and this is both how you can you can interact with existing d4 protocols in a privately observing manner whether they're having to remember the d5 protocol and to do it at scale um uh at a at a price which is cheaper than just a basic level transaction itself so how do you how do you program this all out there because this is this is what we're building in aztec uh but um there's one thing there's one thing between this there's this having the aztec team which has you know got some very good photographers in it building this is a very different thing to getting the the community to build these things which is the end goal you previously can't achieve it's full potential unless the users themselves they're the ones deciding how best privacy can be utilized for their for their purposes and programming it up themselves and so part of this is the proving system the cryptography because if you when you when you have a private roller one of the m one of the big constraints one of the problems is that the privacy proofs that are constructed so these joint split transactions these these these kind of these aggregation proofs they need to be constructed client-side they need to be constructed by the user because they're privacy proofs if you if you delegate that proof construction to a third party then you'll have to then you're leaking information you'll you have to give them secrets you don't want to do that but if you're constructing these people's client side then you're constructing them with very wimpy constrained hardware you know old laptops old phones and worse than that probably running a dab in a web browser so you can't even have like tightly compiled optimized code you've got to run it in a web browser probably using web assembly so you have a lot of slow downs involved and snap proof construction is notoriously expensive typically the the the the difference between running a computer program and constructing a zk snot proof of that computer program it can scale up to a factor of a million and that's using the state-of-the-art tech which is which improves by one or one or two orders of magnitude on on um on what came before it but we're very confident with this ultra proofing system that we've developed in house at aztec that um it's fast enough to get the job done so one of the reasons why is because it's it's a completely state-of-the-art universal zika snack that's built on top of the original plant protocol which um aztec published in 2019 and it's far more efficient than blanc it can do recursion in less than 200 000 constraints we're going to get the number down to much lower than that in the future and it can do very um snark unfriendly things very efficiently so um if you're familiar with zika snacks you might know that stock circuit has to if you have to represent a program as a smart circuit you need to decompose your program into addition and multiplication gates um which is very hard and annoying to do um because uh that's quite that's quite primitive what we can do instead is um we've developed a way of very efficiently accessing lookup tables within a cpa snark circuit so you can do things like let's say you want to do a short 2.x6 cache well that's made up of a bunch of exclusive operations you can create a lookup table of 8x64 operations and just index get values out of pool values out of the lookup table instead of computing these exclusive awards which is quite hard to do in the start and similar things like that means that you can absolutely crush down the constraint cost of common cryptographic algorithms that you need for these kinds of advanced zika stocks as this table shares and the way that we're going to give the community the ability to actually work with this technology is through noir noir is a our private smart contract dsl being developed um the the the the lead developer is uh kev fedor and he's developing this as a fully open source product so the goal of this we're going to be using this to enable users to build state-of-the-art private smart contracts um as long circuits but the language itself can be used um can be in theory plugged into any cryptographic backend not just long so this is very much a community uh driven effort and the difference with this with well not with other smart permanent languages is this one is very much optimized for client-side group construction it's optimized for the goal is for it to compare that to very very highly tightly optimized circuits that can be where previously stretching only would be hardware which is quite critical for our use case so some of the some of the target features are things like efficient genetic arrays now if you're if you're uh if you're a software engineer or programmer you might think big whoop you know like dynamic arrays wow you know they've been around in traditional programming languages what the 60s maybe the 50s but doing you're doing this kind of thing inside of zeke snark is truly revolutionary to do it efficiently um like to do it with you know um one or two constraints per array axis um is not really been done before you can have a fresh effect recursive pre-composition which is essential for a private smart contract system because you need this kind of snack you need these roll-ups it doesn't there's lots of recursion going on here and also the the the end goal is just to have very efficient very very nice pleasant private semantics so it's very easy to create storage variables to have them be owned by users um and manipulate them without having to deal with the underlying encryption algorithms and and the typical cryptographic algorithms that you need to manipulate state and society is um merkle tree membership proofs and nullifier sets and a lot of uh a lot of horrible messiness that we want to completely abstract away from the user and also importantly pleasant cool semantics so that you can so that private smart contracts can call other private smart contracts and that private smart contracts can even make calls out to layer one smart contracts and get return results back which is needed for for example the aggregation example um earlier in the talk so the workflow for noir is that you have some application that you want so here i've got some examples like ziki money tornado cache um and then you program up your circuit in noir and then you basically normal spit out two things it spits out a proof um of your circuits that you can create on demand so you can put that in a in a web-based sdk and have users make those proofs and it also spits out for you a verification smart contract that you can deploy to ethereum um so these follow a fairly standard template the only thing that really changes a circuit is the verification key but the actual algorithm remains unchanged because it's a universal slot um and the obstruction there that we're using here to enable nor to plug into different complicated backhands is something that um uh is we're calling a c which is stands for abstract circuit dvd representation it's a little bit like llbm uh for for um for computers um the idea is it breaks down a complicated program primitive operations that are efficient to do perform inside ezekiel's snark circuit um uh so to give an example of currently how sc is structured um as much as possible we try and develop the basic operations into linear combinations um so a little bit like rank one constraint systems if you're familiar with that so this is basically just additions and multiplications uh but then we have black box algorithms for the complicated stuff so what we've done in aztec is we've built very very high tightly optimized um uh gadgets i guess you could say for common cryptographic algorithms like chart256 so we we've got this down to like 3600 constraints and it can be optimized further so that kind of stuff we really want users to be able to tap into that without having to um write it themselves because our version is extremely efficient because you know we've spent a lot of time working on these and so similarly you can do range very efficiently other cryptographic primitives and so the way it say works is you have these black box algorithms that you can tap into um and then everything else that can't be covered by the black boxes um gets turned into linear combinations which is a little bit more expensive to um to turn into into plot gates but the idea is that for the linear combinations that's kind of blue logic between the complicated black box algorithms that are kind of effectively can be considered they're a little bit like ethereum precompiles so i want to give this a roadmap of this all because i've this is this has kind of been a very like high level like how what a private transaction center how do we achieve them how do we make this programmable how do you get it done with noir uh but how do you use more well noah has been released it's in an alpha um so you can you can download it now tinker with it uh we've got a lot of work to do on it before before it's completely feature complete and ready to be used inside um uh like a roll-up architecture to create private smart contracts but the basics are all there um our roadmap for aztec is that well we've currently be really small we've got our we've released the first fully private roll-up on ethereum so it's it's um what we call zk money which is um it's a way of shielding ethereum and shielding erc20 tokens and then sending them around privately to uh other people um and right now um uh sorry that that i pinch and i'll slide on my talk so that that number is actually 128 transactions for block.896 um and it is powered by a slightly older version of our cryptography because we wanted to get this released um fairly quickly so we haven't yet migrated it to the latest state of the art but even with this um our privacy proofs can be constructed on a client like your web browser in 10 seconds so this is why we're very confident that we can get the full private smart contract architecture done in such a way that you can still make these proofs efficiently in the workforce phase two um which we're uh planning on releasing in a summer this year uh is this defy interaction stuff that i was talking about so because we want to get this into the hands of the community as quickly as possible we're going to be programming these circuits ourselves so that users can interact using our layer 2 privately with d5 protocols and that um users and developers can build these bridge contracts themselves so that if you have a default protocol that you particularly want to talk to um or pretty much any label or smart contract that could be modeled as a token swap so this includes things like dalvating you can write a bridge contract wire right into a wireless you and then send those to transactions directly to that to that smart contract and that'll be powered by our state-of-the-art ultra printing system and finally the apotheosis of what we're working towards is this final programmable private smart contract world um we're planning on launching either late this year early next year where we'll be releasing the 1.0 version of noir um and are re-architected aztec ruler critical which will enable users to program up private smart contracts directly on layer 2 and then use them for whatever they want but uh the idea is to create a very rich ecosystem of private cryptocurrencies private entities private financial instruments that interact with both with d5 protocols in a privacy preserving manner but also more traditional financial products and services of the type that can't even um can't even be deployed to blockchain today because they require strong privacy guarantees to work um to begin with to work uh so the status of noah at the moment is uh it's an alpha release here's that's the uh the link to the to the source code if you want to check it out and uh start tinkering around with the writing glass circuits the current supporter black end is pop but we're planning on supporting other cryptographic back-ends um eventually things like marlon and the smart contract verify generation is all working so you can um not only construct your circuits book proofs but you can spit out some contracts to verify them uh what's on our roadmap is uh lots of work and development tools to make this pleasant experience to have you know things like enter debugger that kind of thing as well as the developer sdk basically the aztec equivalent of what free.js so you can actually see something to wire to act as the interface between making a proof and then turning the output of that proof into anything which is actually getting it sent to a verified smart contract as well as support for multiple cryptographic backends and the semantics for um smart contract transactions and storage um state storage that doesn't require the developer to like mess around with merkle trees so um just one one final slide to give an ex like an example of the kind of dapps that we want to that we want that we want to incentivize a community to build this one we built we built ourselves with our current technology it's zk money um and it's a privacy preserving web wallet for ethereum where private cryptocurrency transfers are less than a layer one ethereum transaction because of our scalable wall uptake and because of our uh technology it's all completely previously present so yeah that's um that's the lightning tour of uh of of noah how to achieve practical programmable privacy and um yeah be super happy to if there's time to answer any anyone's questions thank you so much for this super interesting talk zach um we do have one question uh that came in mainly so the question privacy preserving bridge looks like mixnet for d5 if there aren't enough users traffic and anonym anonymity is not your entry um is that the case here so um actually uh it's it's complicated but you're on the news where the more people that the few people using the layer 2 the worse your privacy guarantees are one of the valuable things about about the about the the latest architecture there is that basically your anonymity set is pretty much everybody who's deposited into the roll-up architecture so even if you have a not very commonly used defect protocol let's say for example you're the only person who's interacted with the d5 protocol in the last six months if you have nobody does it to you they could be it could be you could be any of the other people that have deposited an aztec so um as long as the actual high level protocol has enough has a reasonable amount of of of traffic then um then you have a very strong strong anonymity guarantees but you'll create if it's like if the protocol is dead then and you know it's like one transaction a day then that's uh then you're gonna get very poor privacy guarantees however we're pretty confident that that's not gonna be the case um to give an example like we launched about six weeks ago um we have a water theory to pass a cap on aztec because uh experimental technology we want to make sure that you know people don't throw all their all their three minutes in one go but despite the deposit cap we have about one point we've had 1.7 million dollars of deposits in six weeks so even just post launch has got a very vibrant uh community of users um despite the limitations so uh i'm very confident that uh when we deploy our dd5 bridges the the that you our users will enjoy relatively strong anonymity that's amazing thank you um i think i hope that answers the questions if we were asked this um we're running a bit over time so unfortunately i won't be able to take much more question but thank you so much for your time zach that was great i hope everybody learned a lot and i did