# ZK Proof Performance and Security Characteristics by Brian Wilkes, CFA | Devcon Bogotá

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-07
- Duration: 28:39
- Watch: https://streameth.org/watch/yt-b1jZZmfcyiY
- YouTube: https://www.youtube.com/watch?v=b1jZZmfcyiY

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/zk-proof-performance-and-security-characteristics/

ZK tech gets almost mystifying treatment from both regular users & devs. However, beyond the moon math, quantifiable differences between the zkps deployed in the Ethereum ecosystem can help users and builders understand what they are interacting with. Join me as I explain our methodology for collecting and quantifying these differences in a format digestible for the non-math professor.

Speaker(s): Brian Wilkes, CFA
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: ZKP,performance and security metrics,data analysis

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] welcome back so our next speaker is Brian Wilkes and he'll be comparing the performance and security characteristics of some zero knowledge proofs that are commonly deployed in the ethereum ecosystem so Brian hello wow that's loud so who are my data scientists in the room raise hands very few devs devs out there lots of devs nice investors d-gens yes put it down um how about expertise um who's a beginner in zero knowledge just got the basics cool um who knows what's going on but has not written a circuit before true ZK expert knows a ton about ZK you perfect all right um well um thanks for having me my name is Brian um I am a grantee with the ethereum foundation on privacy scaling exploration team so um today I'm going to be talking about um ZK proof performance and security characteristics so um so what's in the docket for the day search for me to go over some background so we'll just give some background on what zkps are I'm try and work through what they actually mean for on-chain data then we're going to look at how to actually find those um zero knowledge proofs and verifiers on circuits on and off chain then we'll look at some of the characteristics behind those and what they mean so unfortunately Waldo's not going to be with us today so this is the second best piece of art I've ever done so I hope you appreciate it everyone so what are zkps of our high level first we'll go through this quick and then move on but um we have Alice Alice wants a drink she's a prover we have Bob Bob is the bartender is a verifier um Alice does not want to give all of her information to Bob and so therefore she can put in her birthday the circuit will output a proof Bob can verify that proof is correct that she is old enough to drink and the cerveza will flow so um what's important for this is you have approver you have inputs you have the circuit itself you have the proof popping out and then Bob decides if it's true or false and then does an action based on whether that verification is true so um why do we need zero knowledge proofs in ethereum so the first thing that we struggle with is scalability so right now we can do about on main chain 13 transactions per second um and we really need to get into that 13k transactions per second if not significantly higher to get in the Visa range so um how is your knowledge proofs help us that you can separate they can take fully separate chains um and they can impart the full security of ethereum to those chains so privacy as well um is something that's a hotbed issue to me uh ethereum's public if you're a data scientist um as a few of you are you can go online or you can go on ethereum and see anyone ever everyone ever does um so I don't want to live in a world where you have scalability and everything sits on that platform without having the Privacy behind it so let's talk about on chain so this is what it looks like you have your layer 2 blockchain here um so uh they have the blocks going you aggregate some of the transactions together um and then you batch them into a ZK circuit so you take those transactions they go into the circuit the circuit produces a proof this is all off chain so then you have your ethereum main chain on where things are expensive um so you're able to take your proof and post that to the verifier smart contract um and then the layer 2 State source of Truth can get updated so that's what happens with the scalability side of things now let's talk privacy um it's very similar I won't have reveals for you I'll just go right to it there's a secret there's the ZK circuit um you put the secret through it produces a proof and then that proof goes on chain to the verifier smart contract and funds are released so that's very similar that's going to be your mixers your channel caches different things um what's important for both of these two is that you have um off chain and on chain and on chain is where the verifier in the proof gets posted I mean off chain is with the circuit and the proofs are so this is the best piece of artwork I've ever done so I appreciate it while you can so let's find some ZK proofs on chain and figure out where they're at so um this is called the search for verifiers so why are we searching for verifiers the important characteristics of a zero knowledge proof are in the circuit so the circuit is going to generate um they're going to have the different characteristics that are important to us let's look at a particular DK sync um transaction flow for instance so between September 26th and September or September 20th and September 26th there were two thousand one hundred and seventy one two thousand one hundred and seventy blocks 265 000 transactions um which were batched together into 214 inputs proofs brought on chain so what you want the ZK circuit did not change but those inputs and the proofs did um so each circuit has a unique verifier on chain so for each circuit or circuit systems they have their own unique verifier that's there and the um if you want to know about circuits and you want to use on-chain data you need to go through the verifier so going through the verifier um you use the L1 on chain data um so let's talk about how to find verifiers so the first section is um if you guys haven't used bigquery on from Google I highly recommend it um it's a great tool it allows you to search through lots more data than things like Doom do as much as I love Dune so um different queries that time out within 30 minutes for Dune will go in about two seconds for bigquery so um check it out um the three tables that I used um for this project were contracts traces and transactions since you're almost all devs I won't go over traces versus transactions but start versus end of things so okay um so the first way to try and search through bytecode um is to go for constants constants will show up in byte code as a big hex so if you can get a big enough number that's unique enough for what you're looking for you can take that in search with very simple SQL queries um in through the byte code so this is both a big and unique value it's the finite field um so the finite field is the range at which you modulate over when you're doing different cryptography cryptographic things for um knowledge so this is it in HEX form um it's massive so the first way that I look through the data was to search for this finite field unfortunately it didn't exactly give me all the verifiers so it gave me a lot of different noise there's 558 contracts on that have the finite field constant um and after checking every one of them manually most of them are not verifiers so I moved on to trying to get into method IDs so the second tool that I think is really important and apparently it's new according to etherscan it is the transaction decoder so the transaction decoder um what it does if you look through it is if you go through and look at a transaction it will tell you the exact flow of what happened on through that transaction so looking at this here is another ZK sync example um first it proves the blocks after going through some proxies and then in the verifier contract it does it calls a function called verify aggregate block proof so after doing some modular Edition down below it outputs true and the state gets updated so method IDs the method IDs are the first 10 characters or four bytes that come through with any input or transaction call for traces or transactions so just going through them briefly um you can see that this function here is for startware um and it's a fry verifier so this is what is actually verifying the proofs um so if you want to know what the method ID is for this particular function here then you take you take out all the chaff if you will from inside and then you run the kcac 256 and you take the first four bytes plus the indicator that it's hex so that there the ox E85 A6 a28 is the method ID it'll be the first 10 characters in any call that when you look through the data so um a great resource again um I'd like to show the resources that I get to use um the four byte.directory is fantastic um you can input any method ID and it will tell you what the um text signature for what it should be is so um now what do we find essentially there's about 65 confirmed verifiers on main chain now there's probably a few more on maybe 30 more that are not on verified public contracts so um in those 65 confirmed verifiers have done over 600 000 verifications so um of those there are about 16 that are active still um that's active according to me and some of them are very minor projects if you're trying to squint it's because I made it small so you'd have to go on the GitHub at some point so sorry um I was surprised by how few verifiers there are actually on main chain but moving on to the characteristics so we'll look at proving systems um so you're proving systems here that are actually being verified on main chain um you have your your Classics I'm sure you guys have all heard of these but your growth 16 from 2016. um that runs your tornado cash your Hermes your Loop ring um in a bunch other uh different uh privacy functions you have plonk um which is asked to connect ZK sync um then you have turbo plug which is the original Aztec um Aztec connect uses turbo Planck before it gets on chain but then it uses Planck on chain if that makes any sense then you have Halo 2 which is coming out zcash uses it um and then also scroll is going to deploy with it most people I talk to are really moving towards that Halo 2 move it seems like it's a really good proving system so um it's not on main chain yet that I've seen so then you have your Starks on and that includes all your starboard projects so Starks versus snarks snarks the succinct non-interactive argument of knowledge and that then there's Starks which are scalable transparent arguments of knowledge and the major difference between the two there's a bunch of them these are the base level for what happens but Quantum Computing is probably going to be able to take down snarks or but Starks will probably be resistant to it so what is quantum Computing when will it come I have no idea but um if it does this is what will happen so looking at these different um proving systems you have graph 16 which is in blue um really taking off that's on the back of tornado cache as well as loopering and then you have down below you have your Stark um fries that are coming through those are the starkware projects um they have really taken off dydx posts a lot of data to chain often and then you have your plonks and unknowns are probably blocks um but I didn't wasn't quite confident enough to say that so um okay let's talk about trusted setups so a trusted setup is where on the elliptic curve um you should evaluate the different ZK proof so it's it's kind of an agreement and a spot that um approver and a verifier can done kind of verify through um what that snark's going to look like so I'd like to think of it like a trustful how many people have done trust Falls before in their life a couple yeah it's scary um so you get up there on a big standing and then you fall backwards and as long as one strong person below you is there to catch you then you should be good so as long as the trusted setup is kind of similar if everybody's toxic waste gets collected together if everyone gives their secret out um it doesn't want to catch you or is distracted then um the snark can be um then the chest is set up um will not work and someone will be able to write proofs that will um be false positives and they'll be able to take money from you if that makes sense so um this requires one honest participant from the mo from the MPC um ceremony I also like to think of it like Thanos um if you have enough Infinity Stones if you have them all you can destroy the proof and it'll be good so uh it's bad actually okay so um what are the trusted setups um we have um growth 16 over there on the end um it has a two-phase trusted setup um and then the universal setups came in and that's Planck and turbo plunk and that only requires one so whereas Roth 16 needs a new ZK circuit or needs a new Pro needs a new entrusted ceremony for the um each circuit that it produces um Planck and turbo Planck have a universal setup and that allows them to only have one total ceremony so if anyone here wanted to create a plonk you could use the universal ceremony that's already been created um and already been done and then you have Halo 2 and Starks um they do not require trusted setups so that's obviously you want the least amount of trusted setups as you can so moving on on the actual projects themselves you have um graph 16s are Loop ring polygon Hermes their withdrawal and then tornado cash um those are the major ones that are currently being in operation so the number these are trusted setups they use the Perpetual powers of Tau um which is um basically an on-chain on step one for the different uh trusted setups then they had a step two that step two these are the number of participants that were in those ceremonies so if you can get to 16 people from the loop ring that did it if they all compromised then that will not be a valid just the setup and then those funds will be able to be taken so um you have 16 for Loop ring you have six participants in the polygon hermesis then um tornado cache had a whopping 1114. um moving on to plaques um so like I said there's you only need one trusted setup ceremony to be correct and then anyone can use it so they're all using the Aztec clock Universal setup um it is all these you can see asset stations um on GitHub to see how they worked but they had 176 participants on in that so that's all your your ZK sync your ZK space as to connect Aztec Tom all the way down the line but then you have your Starks um which do not have um any trusted setups um we'll start by recursion this is the other major thing that um people are looking for for performance so as you go through performance a recursion is the ability to take you know a big computation and break it up into a bunch of little ones into them um together and then recursively proof back to the firm back to the top so um what this allows you to do is parallelization of proof generation so you can decentralize and have a bunch of provers doing this in parallel um so get out your Asics because you just got rid of them for the merge but uh and then it also lets you do proof chaining um so you can have the output of one proof be the input for the next proof um so what provides recursion pretty much everything but graph 16 is now doing recursion and they're doing it in better ways I guess as you move forward so um that was the other the why would anyone use graph 16 if you can't do recursion and you have a big trusted setup you it's faster um and there's it's cheaper to verify so it's the OG it's been there for a long time um but people are moving on because of those two problems mostly so now I guess we can talk about my favorite topic which is data availability as a data scientist um so uh we'll talk this is going to be about l1s and l2s so for um for the purists out there l2s would only be Roll-Ups but I'll use both back and forth so Zeke validiums validiums um they have their state route is on the bridge contract um and then they have their state reconstruction that's off chain it goes through a data availability committee to go on chain to be able to make it so you have that data but it is permissioned on that side of things then the alternative which is in supposed to be gold it kind of looks like bronze so forget that um is you have your state reconstruction and your state route um for the ZK Roll-Ups um down on the bridge roll up or down on the bridge contract so that allows you to um always have that data to be able to generate a proof um in case you need to escape so um why would you do oblidium over a roll-up it's many more transactions per second so your imxs and your different Stark X projects are able to be a lot cheaper um so moving forward um let's look at your validiums that are currently operating you have Stark X which is on immutable X um you have rindify so rare Apex um other ones that are coming out you have um ziki Porter almost coming out from ZK sync um and then your roll ups I'll run through these because you guys probably all know them but um you have to idx Loop ring ZK sync V1 usdk space um starknet so I'll pause for the camera then moving on there's a couple more that are um the newer ones that are coming up for Roll-Ups that are exciting um you have ZK sync V2 um which I think is under 30 days now which is exciting to mainnet um you have scroll um which is going for a higher level of evm compatibility um and then uh let's see what's next then you have all of polygons projects um which are all exciting in their own right so um let's talk about what it means to be a roll-up so everyone talks constantly about how the full security of ethereum is being inherited by these Roll-Ups so what does it mean to have the full security of ethereum you need to have the right to be able to force exit from that chain so if you have on your Layer Two if they have um decide to be against you you need to be able to submit your transactions directly on layer one to the ethereum bridge contract and get your funds so right now you have your happy user down here um that's from Walmart it's kind of creepy actually the more you look at it so don't stare at it too long um but the transaction goes to this uh the happy sequencers here they put the transaction into the layer two those transactions are batched on into the ZK circuit it produces the proof and it goes to the ethereum bridge contract as as we talked about before so um this is how it's supposed to function so let's say that the sequencers become evil and start smoking cigars um you get unhappy so your transactions can't make it to Layer Two and your funds are frozen so what do you do you take your transaction and you go directly onto layer one to the bridge contract so when you take your layer to transaction go directly to it then the validators have a certain amount of time to actually include your transaction on into the layer twos so usually it's between 7 and 14 days so if they don't do it within that amount of time then Hell Freezes Over and um the chain freezes so your layer 2 cannot update State on layer one and the serial knowledge circuit um then you as a user can produce a proof from the circuit then that proof will provide you the ability to get your funds back um so that sounds great but it's also kind of difficult how does the average user especially when these proofs are off chain um in usually sometimes proprietary how do you generate that proof um that's one of there's a few things that you have to really do to inherit full ethereum security so let's go through them to have the available data on layer one so if you don't have that available data then you can't reconstruct the state proof and therefore you won't be able to properly get your funds back from the L1 contract um secondly you need to have functional and accessible Force exits so those Force exits have to be in code and they have to be accessible for the average person they need to be able to generate those proofs they need to be able to take that data um and Pull and directly send it to that L1 contract um that for a lot of devs it's not a big deal that um there's the the front ends are all centralized but we need decentralized front ends to allow people to escape um in the case of one of the sequencers um going evil so then thirdly you need time delays for the L1 contracts so if the layer 1 contracts aren't have time delays or if they're immutable um then it gives people the chance to actually exit from that later one but if they don't have time delays then they can just change the contract and everyone's funds will be frozen from there so um and then late then last is um this is a nuanced one but the the amount of money that you can secure from L1 is really based upon the amount of locked funds on layer one so if if everyone Force exits then the layer one contract which is the bridge contract with all the assets um they will impart all their assets to the people but if there's more total locked value above on Layer Two then somebody's going to be out of luck so the best way to think about this is a lot of the l2s are starting to get traction with direct transfers to them um they might even have their own state from different contracts and Native tokens if you have a native token on an L2 and you don't have assets backing it up on the layer 1 Bridge contract then the ability for you to inherit ethereum security and take your assets off um isn't there so it's really important that um as we move forward that any state that is native to the L2 is um is known as for that risk that it has so now um let's get in I guess this is the end of my talk so I'm going to try and implore you to get into the data directly um don't be like Waldo um and be sad because other people tell you what's true and what's not um so we have um I I tell you I I'm very impressed with these projects I think you guys should all check them out they're all open you have bigquery you have Dune um the dunes getting better and better um and then the bigqueries of public database that has all the ethereum layer one posted there they'll give you 300 credits to go on query through it um and you can really differentiate yourself especially as a data scientist um you have that the project that I actually completed um please check it out on just the QR code for it I'll have it at the end too so obviously miss it it's no big deal but um please go check out the data tables all the SQL queries on any of the different things um please uh feel free to let me know what I screwed up and it'll be good um and then L2 beat is just such a great resource I'm sure everyone's heard of them and I'm sure you've been to their Booth yesterday but um they categorize all a lot of risks and a lot of specific things happening within these different projects and I just can't recommend them enough to check them out they're doing Bridges now too which is exciting um and then the layer twos um I haven't got to the data on layer twos so I I it would be really great for everyone to check out the different we're going to a different layer modular blockchain where you have layer ones layer twos and layer threes and these layer threes are going to be deployed on layer twos in the Privacy things already are for like semaphore so um I highly recommend that I really like to see somebody on check out layer twos and be able to do the same data type projects for that so um I have some thank yous I'd like to get get ahead of um so I'd like to thank the daily Discord Channel and and podcast for being so great um that's my favorite Discord Channel there is um if you need stud to know things there's so many helpful people um there's the zero knowledge podcast um it's so good for all the new pressing things I highly recommend them as well um l2b I'll show them again and then on the ethereum on Foundation privacy scaling exploration team um that's not their symbol but I think that there's their new logo for Defcon is really cool so I put it up there and then I'd like to thank Justin Martin um for all of his help and getting me into this um and I'd also like to thank Mark for all your help getting me through this stuff and really brainstorming through it all and I'm trying to get through all those issues so wow so I got thank you very much uh I will take quite yes please I'm sure yeah they'll have a mic for you unless you're really loud and then you can just go for it I was wondering if you comment a little bit more on the security considerations when dealing with Native assets on l2s like I get that you can't withdraw the funds on the other one but can you double spend or can eat out there like Forge a balance or things like that given the stage rolled up no I you know I I don't think that those are concerns um to do double spends and things but I do think um because your state is the state source of Truth is really sitting on layer one so um you're not going to be able to uh one of the reasons they do some of the delays and things I believe is to stop double spend from happening um but the um and that's why they freeze the state route on layer once um but I I don't think that um yeah if you understand I won't go back over the ideas of but if you have tokens that are here um and the values more are there than on the bridge contract then you won't be able to get your money back off of there so if it makes sense hello so when you're talking about State on layer one have you had any thoughts in regards to uh upcoming State expiry not yet but I I would love that I'd love to hear your thoughts on at some point I'm kind of practical on the side of things as far as what that should look like and what colorful even yeah please go ahead sorry um yeah I don't have any particular thoughts just that I think current plans are to expire estate after a year or so yeah um you know some other way to get the state I my understanding is there will be I mean zero knowledge proofs that we'll be able to construct that and prove that that's true um but then you'll also have um so you're kind of using the same different different technology but I'm not going to speak to you about a turn on what I don't know it's not about it's a great question though um I'll definitely I can look into it and get in touch with you about it