# Scalability is Boring, Privacy is Dead: ZK-Proofs, What are They Good for? by Ian Miers

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-07
- Duration: 25:14
- Watch: https://streameth.org/watch/yt-AX7eAzfSB6w
- YouTube: https://www.youtube.com/watch?v=AX7eAzfSB6w

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/scalability-is-boring-privacy-is-dead-zk-proofs-what-are-they-good-for/

The first mainstream uses of zero-knowledge(zk) proofs were for private payments in systems like Zcash and then scalability. In both, we hide data to improve privacy or validation costs. But private payments, unfortunately, have seen limited direct demand. And scalability needs faster proofs but not even zero-knowledge. What are practical zk proofs good for? This talk considers zk proofs + blockchains as a tool both for cryptocurrency and broader applications.

Speaker(s): Ian Miers
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zero-knowledge,transparency

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] I wrote the first papers on using zero knowledge proofs and then ZK snarks for blockchains this was the work on zerocoin and zero cash this turned into Z cash and it also happens to be the protocols that underpin basically every second generation privacy coin that's coming online now in other words I've spent about the last 10 years working on zero knowledge proofs for privacy in blockchains and today I'm going to give you a talk entitled privacy is dead scalability is boring water ZK proofs good for uh so obviously uh privacy and dead is dead is clickbait uh apologies if they got you in here for the wrong reasons um privacy is really important I spent the last 10 years of my life working on this stuff but we haven't seen a large amount of demand for private consumer payments right Monero launched zcash launched other things launched they exist they're great they aren't really moving the needle and so I've found myself wondering as I work as a professor I'm like What's the next thing we do you know what happens if demand for this kind of stuff is 10 years plus out one of my co-authors Iran trommer sort of described it as follows selling privacy for people for blockchain payments is kind of like selling seat belts for cars in the 1920s sure we can all kind of figure out that in the future you're going to need it but until you end up with the actual interstate highway system and people crashing cars at 60 miles an hour it's kind of hard to sell people in the future so what do we do right second problem is in terms of research right for everybody who likes to get excited about new technical stuff and new cryptography there isn't much here anymore the techniques to do this are known they're done we worked them out and this is now a thing to work out in industrial applications right the approach for how you build private payments is that zero knowledge proof plus an accumulator typically ZK snark plus a Merkle tree this was developed in zero cache and my PhD thesis it ended up in Z cash it's now in you know pretty much every single other thing that's coming online now Aztec andoma penumbra railgun they all have features on top of this they're not clones but that's the base thing for privacy for payments um and so sure you can build tweaks you can change the accumulator you can change the proof systems you can claim it something completely new uh you know you can add extra features that's quite valid but this kind of feels to me like we're leaving behind the main things that make zero and all it proves really cool because the thing to me that's fascinated me since I was 12 is the zero knowledge bits that we're hiding things and if nobody cares about privacy well we should move to something else as an application obviously privacy's not dead everywhere uh it's definitely not dead everywhere in cryptocurrency uh so if you're one of these second gen privacy coins don't you know kill me for killing your pitch deck uh there are other things that are happening probably we need privacy for defy it seems like Traders do need that um you might be able to use ZK proofs to get out of Mev or front running Jerry's still out on that you can have an interesting argument with Phil Diane if you don't believe me um but nonetheless the core protocols for doing zero knowledge proofs are still like the same as far as private payments go even for these applications so from a research perspective there's nothing new here so what do we do well I hope this isn't too offensive to any of you are but uh blockchains are slow so that's a whole problem and well okay zero knowledge proofs are supposed to be everything a growing blockchain needs so a lot of people working on scalability for blockchains doing ZK Roll-Ups dkvms right this is a lot of research it's a lot of funding it's probably several billion dollars worth of value from ventral capital for this and this is where all the excitement is right now but if you haven't seen this well you know how do these things work uh in a row up you have a server that is taking transactions that users generate users submit those transactions to the server the server takes them and compresses them down using a zero knowledge proof does anyone know which proof says hey all these transactions are correct uh and then the server generates this proof and sort of throws it over the wall to the blockchain and so the server is in effect saving the blockchain work this proof is succinct at least somewhat uh and so it's easier for the blockchain to check that than this to check all the proofs and so then it doesn't matter if your blockchain is slow and does 10 transactions per second if each one of those transactions is a zero knowledge proof saying that 10 000 transactions are correct in payments that's the theory that's the pitch deck everyone's raising off of okay this is great there's really nothing wrong with here this is a lot of brilliant work has been done on this I don't mean to Bly people on it there's just as a cryptography Professor the thing that kind of bothers me uh Z kpms and ZK Roll-Ups aren't zero knowledge uh they compress transactions on blockchains you don't need to hide what's going on to do that you just need things that are faster and smaller to verify there's no notion that this has to hide what's going on and in fact they likely aren't going to hide your data and so this is going to be surprising to some of you um of course ZK Roll-Ups usually reveal the miracle hash of the data they're dealing with that's kind of obvious there's a zero knowledge proof about it but they're reviewing the miracle hash and that hash actually reveals a bunch of data in much the same way that uh say publishing the hash of your password is going to reveal your password people can Brute Force these things and it wouldn't matter if you when you publish the hash of your passwords that uses zero knowledge proof that it meets whatever ridiculous password policy there is you know three uppercase characters a symbol and hey let's throw into my Emojis for good effort that's not going to help with the Privacy problem here and so this is going to become an issue now maybe it's just in theory maybe it's hard to Brute Force this stuff uh on the other hand ethereum just moved to proof of stake so there were a lot of angry miners which a bunch of hashing Hardware who don't know what to do with it so if this ends up being an Mev thing you might have some problems um either way it's not zero knowledge and so in my perspective this is kind of boring from a ZK standpoint because it just isn't using the thing that's cool and fascinating about zero knowledge proofs sure you need faster proofs that's quite nice this will get you all kinds of cool technology and I'm glad it exists but it's it's skipping the interesting bits right and so at the end of the day zkvms are not a significant source of zero knowledge they're sort of nutritionally defunct from this perspective they don't give us what we want um and again this is not to say this stuff isn't useful it's driving serious Innovation and zero knowledge proofs the things I worked on in 2012 in 2017 when we wrote sexy which were like implausibly slow at the time are now practical in part because of the r d that's been funded by the companies doing this and so that's incredibly useful it's a bunch of tooling that I as a researcher can use um and so I sort of think about this like the 1980s and 1990s when people are building faster computer processors these things were tools we could use to do anything we wanted what was driving people doing them was you know faster spreadsheets for offices uh kind of like what's driving people now is faster spreadsheets on a blockchain uh so you can do this that's great there's nothing wrong with it you can also nerd out on exactly what you're going to do for the zero knowledge proofs and just go I don't care what anyone's voting on an application that's also fine but some people should dream bigger right just like we did with microprocessors you know build the internet build the metaverse build something I don't know what it is but we should be thinking about it like and so we need to figure out what the combination of ZK proofs plus blockchains can do that isn't just faster spreadsheets on a blockchain um it's going to be part of it but it's not going to be everything so this brings me to the question and this is where the sort of technical content of this Talk Stops this is this sort of theory question what is this stuff good for right what are we going to do with the zero knowledge proof and if you went and took a cryptography class uh probably even if you took my cryptography class because I'm lazy about writing slides you would get a definition like this which that is zero knowledge proof is a thing with correctness soundness and zero knowledge and this is a very sort of textbook academic thing it's very dry it does not relate what these things really do so I think we kind of should start thinking about them in different terms uh so in deliberately non-standard terminology what is a zero knowledge proof doing well in my mind it's three things the first one is confidentiality it hides data and so that's how we got Z cash that's how we got tornado cash that's how you get Aztec you get everything else we're trying to hide data to get private payments because blockchains or Twitter for your bank account and that sounds like a horrendous idea okay that's thing one thing two for ZK snark specifically is compression right they take a bunch of data and it's easier to verify than doing the linear paths that the actual verification would do without the proof that's nice that's how you get scalability right this is what's driving people's quests to save money on gas for blockchains but the third point is to provide something which we can think of as credibility right so zero knowledge proof from the cryptography standpoint is sound it gives you some guarantee that some statement is correct it doesn't tell you anything about what you can do with it credibility is this point if I give you a piece of data I can use a zero knowledge proof to show to you that it really is the data you're supposed to be looking at it really was computed on correctly um and this actually Okay so uh the idea here comes from a piece of research done by some of my collaborators back before I knew them uh called proof carrying data in 2010 and this was really before blockchains were a major thing at least in Academia and the idea was you have data never mind where again they didn't know about blockchains and the data has proofs attached to it that the computations are correct that was done to produce the data so you have some data proof here says data whatever someone comes along computes a function on the data gives you the output gives the proof that that's correct and then later somebody else can come along compute another function on the result of that give you a proof that that's correct and you can just sort of imagine some kind of state machine going forwards looks kind of like a smart contract I guess but it involves zero knowledge proofs and of course because it involves your knowledge proofs you can also hide anything you want in the process of doing this uh so this is great it's a nice piece of work but you know first of all how do you agree on what this data is did everyone saw it second of all what is this good for this paper does not answer that question this proposes this academic mechanism so we're back to the question of what does your knowledge proofs good for and so in my mind the thing that a zero knowledge proof combined with the blockchain and that combination is crucial gives you is credibility right that piece of data if it's on a blockchain can tell you uh that everyone agreed on this right this is what's out there and then I can give you a proof that it was correct that you know I didn't see anything else that I wasn't supposed to when I was Computing on it and that you know the operation I did was done correctly and then we all get a share consensus on this because it's on a blockchain I can't equivocate on what I did I can't double spin something if there's something in this data you know this is privacy preserving smart contracts for any of you have looked at this stuff but at a level of what's the property that a normal person might care about right so what do we do with this well in general what is your knowledge proof it's good for and in this talk I'm going to give you some low-level things of like immediate problems some very high level things that are you know what was on my mind at the time and then back to some low-level things of identity so the first thing that you really do need zero knowledge proofs for is credible safety for or from depending on how cynical you all roll up operators right the Bitcoin people would call this censorship resistance uh because if you have a have a roll-up right the roll-up is taking these transactions the service sitting here it sees everything that's in those transactions right these are normal ethereum or Bitcoin or whatever it is transactions they are completely uh transparent to the server server can see what's going on okay fine why does that matter blockchains are that way anyway the problem is the server is getting these from a bunch of people and it gets to choose which ones it takes and which ones it doesn't and the problem is that that's going to be obvious to everybody and so the server is going to be held responsible at some point by somebody for something it failed to exclude um in other words zkvms and ZK Roll-Ups at least if you naively do them in a single server model aren't censorship resistant the consequence of this is you really better not mint any enfps if some meme a government doesn't like you probably shouldn't take payments to activists that the government doesn't like if you're all a roll-up operator sitting in Texas I probably wouldn't take donations to an abortion fund right now might get you in a bit of trouble um because if you do your nice ZK uh block compact trying to make things efficient isn't going to be a block compactor it's going to be a trash compactor on fire you're going to just have major problems with transactions you process so this is not safe this is not good and this is a major problem for all people trying to get blockchains to scale so what do you do about this well you replace the individual user transactions with zero knowledge proofs so that those transactions are now uh opaque and as a result the roll-up operator can't see what's going on and so they have they're a dumb pipe and they have some limited ability to manipulate transaction ordering but again they don't really know what's going on they have a degree of of deniability uh and so this gives you a minimal amount of safety it doesn't solve everything but this is the thing that you need to be building into your ZK Roll-Ups um and this is things that various people are building I believe the original people who came up with this idea uh I don't follow these things too closely Aztec currently has this out there um Elio company I'm involved with is also building this I'm sure there are others but nobody's really broadcasting these features as a thing that goes on very well and part of that's because that's a really bad name right this gets called a ZK ZK roll-up which is kind of a mouthful and every time I hear it all I can think of is this bad meme from like not quite the 90s but it's pretty old um so you should be doing this and somebody should please please come up with a better name for this that's catchy so that people can Market it um because I'm sure I left off some people who are building this um but this poses an interesting problem for those of you who are working on zero knowledge proofs because uh these proofs need to be built on phones and that doesn't necessarily work with every ZK proof system that's out there right I don't know the full breadth of these things I don't play with most of them most of my stuff's still in graph16 but I do know that some of these things are slower than others and are suited to other cases and so there's some risk factors that you might want to consider if you're looking at ZK Tech and trying to figure out what we should use a lot of these systems the approvers are architected to running data centers on Big Iron right this may be fundamental to the way the proof system works it may just be who your devs were and what they knew how to do but either way it's not clear they're going to run efficiently on a mobile phone or a laptop um secondly for the proof systems they may be amortized uh only over lots of transactions right so they're not really efficient unless you put a thousand transactions into this proof and check them and then you get some amortized savings which is fine for a server compressing transactions to do a roll-up but again in these cases you need phones to be generating proof so laptops to be generating proof so the server doesn't see what's going on and that's only going to have one transaction in it and lastly the proofs in a lot of these things are very large which is going to cause all kinds of problems for mobile data for your gossip protocols for transaction distributions this is also a warning sign and so the way to think about this or at least I think about this is you may remember that there's been this big problem with Intel and x86 for the past about 15 years where Intel built these wonderful server chips and then they found out the future of the world was mobile devices and they've been trying to play catch-up with getting their chips to work on mobile and there's some business development things there there's some fundamental technical things or some business positioning that have causing them problems and so we may end up in a similar situation with ZK proofs where you can't get these to work in the right settings you want and then you're gonna have to do a nested ZK thing you have to add another ZK proof under your ZK proof in a different system that's going to drop your costs and up your complexity so Food For Thought for those of you who are working on these things um so okay that's the basic like pressing issue today but looking more broadly what else can we use as your knowledge proofs for right if we have this notion of credibility carrying data right what can we use it for and I think you can more broadly do this for markets uh like competition uh decentralization uh migrating data around is going to be a big one and obviously you can also use it for like preventing money laundering so starting with the last one of those cryptocurrency has a theft problem right this is uh stuff gets stolen now by nation states the nation states actually go get in trouble tornado cash got taken down because of this actually the tornado developer is in prison right now in the Netherlands because of this which is kind of crazy for you know thing that came out of a paper I started writing 10 years ago but this is what's going on um and it would be good if we had some way to deal with this so what if you wanted to prove uh to somebody when you make a payment the money you had wasn't stolen and you wanted to show them that the money wasn't stolen when you got it from somebody and when that person got it from somebody that money wasn't stolen then either right add infinitum all the way back this is impossible if you're just asking questions you can't do this without cryptography right if you just do kyc or whatever you'll stop at just who you are who who's giving you the money and you won't really get a good notion of what's going on but ZK proofs compose recursively right so I actually can build a zero knowledge proof that not only is my money not on a list of stolen money but it wasn't on a list of stolen money when it was paid to me and that wasn't on a list of stolen money before that before that all the way back in time so we can have this sort of credible money where despite the fact that I'm anonymous you actually know that it's not stolen all right so that's one thing you could build details are somewhat complex by the way but it is possible um right more broadly you can do all kinds of compliance right you want to comply with anti-money laundering rules uh currency transaction reports that you're sending you're not sending more than ten thousand dollars uh through a system you can do that right in theory we knew how to do this in in 2016 so the paper I wrote at Financial cryptography uh but now there are actually companies building this because again we have more practical zero knowledge proofs in part because of the people working on Roll-Ups um you want to show you're not on the sanctions list we can do that so this is again you can get credibility for what's going on with money um more broadly though right let's not just think about payments what else could you do what could you possibly want to prove to somebody well we're all trying to build decentralized ecosystems right there's a whole question of whether those are really going to be on a blockchain or is it going to be some oligopoly of servers where people try to move from one server to another to another migrate their data from one thing to another and in those settings it would probably be pretty useful if when you took your data from server a to server B you sort of said that here I can prove to you it's correct all right similarly speaking you might want to prove that an auction you're doing is not tampered with Google recently got in trouble because allegedly according to several States Attorney General they will manipulating their ad auctions instead of running a they said they were running a second price sealed bid auction where if you win you pay with the second price is and so you should bid your value and instead they were running something that was approximately a first price seal bit auction because if you won they lied and said there was a bid right right underwear yours wasn't basically charged you what you were willing to pay uh and this is a problem with Google you know a semi-trusted guy in a legal setting where there are places to prosecute them if you try to run an auction on you know decentralized wild west of blockchains this is going to come up so you probably want to be able to prove your options are correct similarly you might want to run a matching rocket for some Rideshare system like uber you can do this with a zero knowledge proof in theory right thinking even more broadly you might want to be able to say like hey if we're running a decentralized social media system I have a news feed I'd like to know that my news feed wasn't manipulated that somebody isn't for example feeding the outrageous stuff just because it generates clicks uh oh you know making clickbait titles for you know ethereum Devcon talks uh you might want zero knowledge proof to do that and the thing here is these are all sort of Pie in the Sky dreams but we're going to need to do things like this because if you're trying to decentralize existing Services organizations and institutions it's kind of essential because people kind of trust these essential existing things for better or worse and so if you move to something that's completely crazy and new you're going to need to convince those people to trust your new thing and you can't just publish everything that's not how the world Works um so this is sort of hard to think about as a concrete thing so he was a you know a concrete version of this standard tale about internet gaming right there's some awesome game it's an online game there's a server there's a great Community everybody loves the thing and then it gets a little too popular thing goes down the toilet uh the devs get greedy or bought by some company um blizzard uh and um they somehow ruin the game never mind how uh and so you know in classic Futurama binder we're going to make our own with better things um what you want to do is like take all your data and go to a new server with the same game but your existing game state and you know for this to work the game has to be open source but even if it is you're going to run into some problems here right when you take that level 50 sword or whatever it is from server a to server B why is anyone going to believe that you actually earned that that you didn't just make it up right for the server how are we going to know that they weren't playing funny business I'm secretly running a pay-to-play game right how are you going to know that the economy of that server and the way the items are distributed is correct right you want to be able to prevent these guys from like toileting this game you want to be able to move to another server but you need all of your data to be credible when you do this and move it around and so the only way you're going to do this is by committing to the data on a blockchain and attaching zero knowledge proofs to all this stuff again Pie in the Sky you can't get this to scale now but it's an interesting idea uh and this approach is broadly feasible to not just gaming you don't need to just do this about a sword you could do this about any number of things right if you're running a crowdfronting platform that has like Awards something like patreon patreon goes under you can move to another server and take the awards you've gotten improve you actually got them um so okay well what if we thought even bigger um recently there was a headline uh that the IRS had gotten in trouble for manipulating uh their audit process and under the Trump Administration auditing senior FBI officials who mysteriously had also been investigating the Trump Administration so this was regardless than tampering with those other stuff um what would it take to make tax audit processes credible and this is just sort of a hypothetical right how would you know that this is working uh you'd have to commit to an audit policy in advance you'd have to put up all of the tax returns committed on in some blockchain and permissioned Ledger and then you have to show that your audit process was applied correctly and the thing is in the process of doing this you cannot reveal any of that data can't tell people what will get your taxes out of it you can't tell people what other people's tax returns are but if you want everybody to know and trust that when they get audited by the IRS or some other institution that it was actually done according to a fixed procedure in the rule of law or whatever it is you're going to have to do something and so maybe again hypothetically if you're at a zero knowledge proof on a blockchain you could do this um so as I was writing this talk uh I kept thinking of this idea that like verifiability enables uh cooperation so during the Cold War the US and the USSR wanted to disarm somewhat they wanted to have less nukes because they could save money on it and it was better for the planet um but there was this problem of if you the U.S gets rid of their nukes they want to verify the Russians are also getting aware of theirs and that was kind of hard so one of the limits for arms control treaties was that it was hard to verify what was going on and what happened was as spy satellites got better and then spy planes got better and more pervasive the Russians in the uh and the US were capable of verifying that disarmament was happening and so they could actually cooperate and there actually are now treaties about being able to fly planes over other people's territory to verify this stuff it's called the open spies act it's open Skies act excuse me so technical advances can enable better verification and more cooperation uh but of course spy satellites don't work for this kind of stuff on on the internet we can't just publish everyone's data ever out there for everyone to see and so to do this in this case we'd need zero knowledge groups um so you know what is your knowledge proof's good for these three things uh on a more you know concrete thing you can also use them for identity moderation decentralization um so we need to prove all kinds of things about our identity online uh that we're not North Korean money launderers for example that were not a bot Elon Musk um or that we're over 18 to view a video um and so that's time but I have some work on this that would kind of be interesting so with that uh I guess I will take questions