# ZoKrates - a zkSNARK toolbox - Jacob Eberhardt

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2018-10-09
- Duration: 32:47
- Topics: blockchain, smart contracts, zksnarks, privacy, scalability, ethereum, verification, zero knowledge
- Watch: https://streameth.org/watch/yt-_QyXreu64kQ
- YouTube: https://www.youtube.com/watch?v=_QyXreu64kQ

## Description

Slides: https://github.com/JacobEberhardt/documents/blob/master/talks/ZoKrates-EthereumMeetupBerlin.pdf

ZoKrates is a complete toolbox to use zkSNARKs on Ethereum. It features a high level language that can be used to write programs and later verify executions of these programs using zkSNARKs on Ethereum.

## Transcript

at the start I have one question who of you has heard about CK snarks okay so that's a majority who of you has the rough idea what they actually mean and do okay so yeah that's like that's good first time so my name is Jacob I'm PhD student here at tu Berlin and information systems engineering department and with me today especially who will help me out with the demo because of my browser remakes is not working as well as in his browser and I'm currently working on a compiler that compiles from a high level language to computations you can do a zero knowledge proof over basically and then verify that proof on the blockchain so to give a little context i've prepared a couple of slides i'm not too well prepared prepared because i just found out that i'll be giving this talk in the afternoon today so yeah so what's what's the basic idea what's the basic setting we're talking about i think its delegated computation what we have at the moment with watching systems is what we see on the left side so we usually have only onto in processing there's transaction being sent to the network and then it gets validated but every single node in the network and there are several proposals to change that with with a blasphemer christian we'll talk about later and other sharding techniques but there's also another idea that we do no longer do all the computation on chain but do part of it off chain so one proposal that did that was true bit for example so there was this idea of the computation marketplace and Austrian computations and then you published a result and in the troopers fraud can be detected and people who provide results that are invalid will be punished so that's one way of dealing with the problem that when you don't actually execute the computation on chain you cannot be certain that it's actually correct and another approach of doing the same thing is that you not only do the computation off chain but during the computation you create the proof and that proof proves that the computation was done correctly and then all you have to do is take the result on chain and validate that the proof is valid on chain so instead of doing the whole computation on the blockchain you do it off chain and only validate that it's actually okay on chain and that's the setting where we're talking about here okay so so Curtis we called the tool so protests seek a certain knowledge and ideas that you know the famous saying from Socrates I know that I know nothing here it's I know that I show nothing bit of a bad pun maybe but the idea is that when I do the computation of chain I can use private information in that computation with a out ever leaking that to the public and that's a serial knowledge property of these proofs okay so what is so Curtis I will give you a demo in a minute and it's a tool it takes a higher-level language it's not too super powerful just because it it is limited it's not Turing complete because of the underlying abstractions needed to do seek a snark song but it's a high-level language it can be yeah it's it's very understandable and and quite simple and then we have a compiler which transform stat in the representation you can do CK starts with basically so we have the high level language and then we compile these statements into the set of conditions these set of conditions they have a special for and they're called what they're called a rank one constraint system we just have a huge list of conditions and then you can transform that to a quadratic arithmetic program which is basically equal to a tree with only additions and multiplications on the nodes in the tree and from that using the sir knowledge work that has been developed you can generate approver a verifier and use these to actually do computations and with the computations ya find the proof okay so here's what the process looks like what those others live as well we have code we compile them to a rank one constraint system that gets compiled to a quadratic arithmetic program and then we generate a sequence knowledge base on that representation so this part is basically yeah well understood I would say and is covered in the library lip snark which is publicly available it's used by the C cash Network as well and this part is yeah it's like the main contribution in the compiler that we take the high level language and transform it to the set of conditions and here we have a little code sample at the bottom how such a program to look like we have positive integer variables and here we check some conditions depending on X and do computations based on these okay so that's the general setting and how it looks like and now I would like to move on to the demo but maybe we'll have time for quick questions regarding the whole process in CKD snarks if that wasn't clear from my introduction what the basic idea was so any questions at this point or do you first want to see the demo okay oh sure knowledge succinctness argument of knowledge let me take the very helpful question thank you so yeah these these proves they have several properties and the first proves that were able to verify or prove that computations were correct we're interactive proves that meant between the verifier and the prover several rounds of communication were necessary to actually reach a certain level of yeah certainty that the the computation was actually correct and these seek has North instruction they don't have that interactivity property so they're non interactive and that's part of the name with non interactive the succinct this property just means the proofs are short so that means they're cheap to send around the network they can be received yeah it's just a short format and the certain knowledge property is also a nice property and it basically comes for free in the construction that means when I do my computation off chain I can use data that will later be publicly visible but I can also use private data for example whatever my my ID or something use it in the computation to arrive at an outcome and that outcome can then be validated or verified without me leaking the private information so I keep my private information to myself and can still prove that I have that private information okay so one example a good example maybe is I have an ID and there is a hash of my D ID on the blockchain and now I can prove that I have that idea ID by hashing it off chain and providing certain knowledge proof that I have the value that means the idea that hashes to the value stored on check without ever really revealing my ID information so I keep the sense of information completely to myself and can still make statements about it and verify this statement so that's a CK part of C kiss marks I know the the computation requires much more amount of work the the verification is very cheap and that's a cool property because we use that here and we do the verification directly in solidity that means in the EVM and if that part was expensive that would not be possible so it's just several elliptic curve operations couple of pairings additions scalar multiplications and actual multiplications but it's it's a couple of operations it's cheap to do I think at the moment it's about half half the gas limit it takes to do one verification right I think wrong about that so it's it's still expensive but compared to the work you have to do off chain to generate the proof it's cheap and it's actually actually doable today on only theorem watching yes okay so yeah so one goal is privacy that was in the example I gave you that I can you know prove things on information that I do not reveal and we don't have that at the moment you need to make all information public and the blockchain will then you know do computations and and you references another thing I haven't seen that the boat because the proof generation is still quite expensive but what you can also do the special property of TC case not just that the verification is independent or the complexity of the verification is independent of the complexity of the computation you're proving so that means no matter how complex your off chain operations are the proof always costs you the same so at some point there's a break-even point we're doing a very complex computation off a chain and doing it on chain where the Austrian part becomes much cheaper than doing the same computation on chain and you can do operations that would exceed the gas limit that's off a block and still verify it on chains or you also enhance capabilities of the blockchain yes it depends on the number of inputs but it does not depend on the length or complexity of the computation whatsoever okay you'll see that in the demo it's it's not too powerful but you can do some things I'm currently still implementing a hash function it should be possible it's just not done yet so that would be very nice to have in the future at the moment you can just do condition checking loops function calls and arithmetic operations on field elements for people it's the the variables we use there elements of prime fields but it's easier to just imagine them as positive integers so that works for most operations unless there's overflows but I can't cover it in that detail okay let me show you something oh I'm in the room okay so what I have here is I just show you the file I go to the examples directory and show you very simple program which is a simple ad that's what it looks like we have a main function takes two parameters and it returns to some of those okay so that's a very basic example you can do much more complex but I'll just show you what you can do with that and the tool provides a command-line interface that allows you to compile such code to compute witnesses that means to derive solutions for the constraint system and with that derive solutions for the program in the first place you can then export the verification code to solidity smart contract so you can actually verify your computation you specified on the theorem blockchain and what the journalist was required at the moment is trust and setup face okay but there's ways around that there's several yeah efforts and community especially by the seat helps people to find a way around that so I want coverages now so basically what you can do is specify your program you compile it in a set of conditions you find a solution with that tool for your conditions and then you can compute proof and also you can compute a solidity source code that you publish to the network and with that source code you can verify the computations on chain and solutions of your new constraint system so let me compile this code okay that's what the compiled program looks like it looks exactly the same because all these conditions are already right format I can show you a more complex code sample for example okay so this program computes and choose K the binomial coefficient and after compiling that takes a while takes a long while now wondering that usually does wait here yes so you you can see it's just tons and tons of conditions so yeah our simple example works for now but usually it's it's useful strength at the sense they come from simple programs already okay and what I can then do our first compiled the act example again and then I will compute a witness that means a solution for the program and also a solidity smart contract which I can use to verify that computation on chain I do that using the shortcut operation which stand up witness computation and solidity code export in one step I provide two arguments let's say one and one I want to calculate the sum of a and B I do that and what I get let's go up okay first I get a witness that means I get a satisfying set of variables that satisfy my program so that means a is 1 and B is 1 I gave that to the compiler and the output is 2 so it computed that simple sound correctly but what it also did is it generated a verification key in solidity compliant format I can use that pasted in the template and deploy that to the network and then I can verify proofs with that that I can also generate with this tool and down here we also have approved which I can then use to validate stuff from salinity actually today we validated the first proof on the Rob spoon test nut and bettan we'll briefly yeah show us this process because it works better on this machine okay so the computation what we validate on share now is that one plus one is two but it could be an arbitrarily complex computation and the verification would always look the same exactly at this point we don't use private data what we could also have is that we say or that we prove that we have two numbers the sum of which equals two and then we would only provide the two and the proof and still would be sure that the person who generates a better proof was in possession of two numbers for example one and one that satisfy the constraint system yes pardon yeah you send the inputs that means in that case one one and two and then you send yeah a proof and that's said a couple of elliptic curve points essentially that are again used to check conditions on and they what they what they show what the what the validation logic verification logic checks is that you actually used the correct code basically the correct program and you did not just use another program to compute the result exactly and also the proof for that the answer is correct and that they have actually used the correct program code to generate that answer so you can't lie about the source code you use to arrive at that answer it's at the moment half the gas limit so lost 1.9 million that's that's fixed because you always do the same verification steps no matter how complex or often computation is it only depends slightly on the number of input variables so the gas cost actually grows a bit with the number of input variables you have but generally the the large part of the gas clause remains constant well someone would have to arrive at batteries in case narco would make to have would have to make the verification operations cheaper so ik or more efficient on Hardware so that the theorem Foundation cook reduced the gas cost for these operations but what it is it's elliptic curve operations and they are costly and there's several required so I think either you have music as marks that allow you to do less cost the operations or you have to like you have become more efficient but I don't see that but you could have computations often that you couldn't even fit in the block so in that case it would actually save gas yeah so it depends on use case and also of course there's surprise for privacy but at the moment you don't have privacy so you cannot make statements about your private data and you can do that of course at the moment it's expensive but it's a it's the thing you can't do without it okay let's continue with demo okay so we deployed that contract to the raftsmen test net radiation control the source code so that's what the solidity verification code looks like there's also some unnecessary testing code in there because we just stole that from Christian and then made some modifications yeah so that's the function you call when you want to provide the proof and have the proofs verified so you call verify the transaction and then you provide a number of elliptic curve points these are the a and a P and then they're always - yeah large numbers basically that make up one point in the case of the one truth we're using and in the case of the other truth it's even four points but it doesn't really matter you provide a number of points and then you provide input variables these are the parameters we gave to the compilers on our case one more - and then the conditions are checked on chain okay now we want to actually do do the transaction now and check whether one was one is actually - what I didn't mention yet dck snarks they're probabilistic proofs so we can only with a very high certainty that one does one is - we can't be 100% or IPA see that's the the parameters here so these are these elliptic curve points that come out of the CK snark stuff that we just need to make sure that the correct program was used and that nobody cheated with with the program and here are our input parameters at the very end and that our input we now take and pass to the solidity verify transaction functions we do that from remix here and then you just made a mask to send it to the Rothstein to Rob it takes a while but now yeah that's this for confirmation yes and then hopefully we can see the ether scan after it has been mine in a minute and we can actually see whether the validation has succeeded or failed [Music] yeah so wait until next week until the users on Dominion know I also have to say that at the moment it's an early prototype it's not secure not well tested we're just showing you first results and I would not use it for any production use cases at the moment okay and here you can see we actually have a transaction and it triggers an event and it said that the transaction was successfully verified and because we have two inputs one one and two we now know that it's most likely one one is most likely to so that's that's it with our short demo I think it was a lot and I could not cover the low-level details because they're actually quite complex but now we're we're open to any questions of 1.7 million yeah [Applause] it's it's free compiled contract so essentially it's it's not really machine codes but like machine codes it's things you cannot do in the EVM that or if they would be too costly to do in the VM that now having direct implementation and these operations can be called from EVM so you can think of it as if it was a new op code added to the EVM and that can do pairing operations that's a bi linear map on elliptic curves but it's needed for the verification and you can do multiplication of elliptic curve points yeah so that's basically the pre-compile christian road that are needed to do the verification so from next week on the verification of ck snarks will be possible in the main that and it's only elliptic curve operations yes well in the actual seek have setup face they had six people sitting in the room for like a day or something and copying DVDs and passing them around so no that's not what we're using at the moment we're actually using for this prototype a trusted setup face that's why I also say don't use introduction because you can only trust your own Bruce basically or proves by people you trust anyway so there's a much point in that but there is efforts of creating distributed setup phases that are more efficient scalable than the original distributed protocol that to see cash guys used during their set up phase so Stefan is currently looking at options of bringing that to you so you could do actually do the setup off shame but synchronized by a smart contracts so that there could be a set up of a number of people who then can be sure that if they themselves were honest then the proofs can never be faked or anything so that's ongoing research I think and also to see cash guys reached out and said they have a new protocol it's not published yet so we'll have to see where that goes I hope there will be more efficient distributed setups in the future and then that tool will create a benefit the IDS that include that with multiple people and there is some secret data being generated during this process and as long as one single person in this group to each their own as long as one single person TV chatter then the process worked so if they were actually with the the seek hat just said they were actually not sitting in the same room they were distribute or not with you or at least they tried a different location and there's an interesting article but Peter taught who participate in the setup and he was actually driving around the west coast of the United States never staying at the same place why write the DVD thing was just so you could do the computation and the networking on two different computers I don't know what recursive CK stocks are I'm not aware about you everywhere would say that a recursive system is a security lock that verifies another suitcase I mean a secure start is it's just the computation itself breaks so you can use the keys next very pressing this month and because the time needed the complexity need to do the verification does not depend on the actual computation can do this bootstrapping process and then yeah verifiability complex yeah so at the moment the set up phase is just local and then we actually it's identify meant that myself in this library for that so we hope that the library forgets or destroys the data or we can look at the source filter actually it seems to do it but if you have compromised device there's still the risk so distributed setup phase is definitely reason also so that I can convince others that the setup process has been performed correctly and they can trust the proofs I generate this tool no not yet because the CLI I haven't implemented all operations completely but I plan to have have a published version at Def Con so it's like half a month that's good yeah so ideally the tool works perfectly done and has a hash function in a minute but no promises [Applause]