บทถอดความฉบับเต็มของ #81 - Zac Williamson: Aztec, PLONK, zkSNARKs, zkProofs, Cryptography, Provers, Schedulers, Narratives

was very naive about, I thought, oh, well, you just split up your transactions 69 00:03:50,720 --> 00:03:54,080 into lots of little chunks and spread them around the blockchain. 70 00:03:54,080 --> 00:03:55,280 You should be able to hide it. 71 00:03:55,280 --> 00:03:58,880 And it took until the winter of 2017. 72 00:03:58,880 --> 00:04:02,640 It dawned on me and Tom just how much of a problem we had on our hands 73 00:04:03,200 --> 00:04:07,680 with actually getting privacy guarantees on chain without actually genuinely being able to 74 00:04:07,680 --> 00:04:12,320 hide key information required for transactions to execute. 75 00:04:12,320 --> 00:04:16,320 So I started looking into cryptography because I'm like, well, I really enjoy this startup thing. 76 00:04:16,320 --> 00:04:17,280 I like doing what I do. 77 00:04:17,280 --> 00:04:18,800 I don't want to go back to my old job. 78 00:04:18,800 --> 00:04:21,440 So for me, it was basically, you know, do or die. 79 00:04:21,440 --> 00:04:23,040 I had to solve this privacy problem. 80 00:04:23,040 --> 00:04:26,960 So I started looking into Zeronal cryptography and my physics background helped because I had 81 00:04:26,960 --> 00:04:31,920 a, I had that fluency with mathematics and I kind of, I kind of became addicted to, 82 00:04:31,920 --> 00:04:37,440 because I didn't, I never understood, I didn't really appreciate it before I'd studied it. 83 00:04:37,440 --> 00:04:43,120 Just how impressive it is that you can prove statements about encrypted information. 84 00:04:43,120 --> 00:04:47,760 I can give you some random scrambled garbage that looks like nothing, 85 00:04:47,760 --> 00:04:50,160 but I can still prove that somehow under the hood. 86 00:04:50,160 --> 00:04:55,040 If you were to decrypt it, you know, it would, it would contain like certain properties, 87 00:04:55,040 --> 00:04:58,480 for example, like digital signatures, passwords, stuff like that. 88 00:04:58,480 --> 00:05:03,040 And, and so I realized that when you, if you've paired this with a distributed ledger, 89 00:05:03,040 --> 00:05:07,680 then you know, you really do unlock a tremendous potential because you, 90 00:05:08,240 --> 00:05:12,720 you solve one of the critical vulnerabilities of distributed ledgers, which is that everything 91 00:05:12,720 --> 00:05:13,920 has to be transparent. 92 00:05:13,920 --> 00:05:17,280 That is not how we conduct ourselves in our day to day lives. 93 00:05:17,280 --> 00:05:21,840 And if we're trying to create technological infrastructure that can replace existing 94 00:05:21,840 --> 00:05:26,160 industries, existing technologies, the most of the technologies require some kind of 95 00:05:26,160 --> 00:05:30,320 user privacy guarantees are simply needed for Web3 to compete on a level playing field. 96 00:05:30,320 --> 00:05:32,240 So I became addicted to cryptography. 97 00:05:32,240 --> 00:05:35,200 I got, I had some wonderful influences in my journey. 98 00:05:35,200 --> 00:05:39,200 I was connected with the ends growth, who is the one of the OG cryptography space. 99 00:05:39,200 --> 00:05:44,240 He basically invented something called pairing based cryptography, which is extremely 100 00:05:44,240 --> 00:05:45,360 foundational. 101 00:05:45,360 --> 00:05:49,360 And he was very kind enough to effectively mentor me and teach me the ropes. 102 00:05:49,360 --> 00:05:54,880 So with his help, I managed to produce a cryptography protocol, which solved 103 00:05:55,440 --> 00:05:57,120 credit minutes, privacy problem. 104 00:05:57,120 --> 00:06:01,760 But then we realized very quickly that what we had on our hands was much more lucrative 105 00:06:01,760 --> 00:06:06,480 than just for credit minutes and that it was worth pivoting to becoming a infrastructure 106 00:06:06,480 --> 00:06:11,600 provider to provide privacy, preserving technologies for chain in general. 107 00:06:11,600 --> 00:06:12,640 So that's what we did. 108 00:06:12,640 --> 00:06:15,200 And we pivoted credit minutes into Aztec. 109 00:06:15,200 --> 00:06:16,480 Very interesting background. 110 00:06:17,040 --> 00:06:18,480 Such a great backstory. 111 00:06:18,480 --> 00:06:18,800 Wow. 112 00:06:18,800 --> 00:06:19,040 Okay. 113 00:06:19,040 --> 00:06:23,120 So let's, let's run through Aztec real quick at a high level. 114 00:06:23,120 --> 00:06:23,600 What is it? 115 00:06:23,600 --> 00:06:26,640 And then we'll break down each minute part of it. 116 00:06:27,520 --> 00:06:27,840 Okay. 117 00:06:27,840 --> 00:06:32,240 So at a high level, I'm going to talk about what I want Aztec to accomplish. 118 00:06:32,240 --> 00:06:36,800 So if you have a, if you have a smart contracts, your smart contract has a bunch of variables. 119 00:06:36,800 --> 00:06:41,680 They can do things like record token balances or certificates or identities. 120 00:06:41,680 --> 00:06:44,480 And you have a bunch of functions that can operate on those variables. 121 00:06:44,480 --> 00:06:45,600 So these defines transactions. 122 00:06:45,600 --> 00:06:50,000 You can define, you know, cryptocurrency, you can find entities, you can define identity 123 00:06:50,000 --> 00:06:53,600 documents, you can find games, you can find anything you want that contains some kind 124 00:06:53,600 --> 00:06:58,960 of value, but you want some single source of truth that defines like who owns these assets 125 00:06:58,960 --> 00:06:59,760 you're creating. 126 00:06:59,760 --> 00:07:00,720 What do I want to do? 127 00:07:00,720 --> 00:07:03,040 I want those, that information to be private. 128 00:07:03,040 --> 00:07:06,880 I want that information to be able to be structured such that, you know, you get all the benefits 129 00:07:06,880 --> 00:07:10,880 of a programmable network like Ethereum, but you don't splash that information all over 130 00:07:10,880 --> 00:07:11,200 the internet. 131 00:07:11,200 --> 00:07:14,960 Whenever you make a transaction, effectively private programmable money, I guess you could 132

00:07:14,960 --> 00:07:15,440 say. 133 00:07:15,440 --> 00:07:16,800 So technically, what does this look like? 134 00:07:16,800 --> 00:07:19,680 So Aztec is a layer two specifically, whereas EK rollout. 135 00:07:19,680 --> 00:07:23,280 So the idea is instead of sending transactions to a network like Ethereum, 136 00:07:23,280 --> 00:07:24,960 you send them to a layer two like Aztec. 137 00:07:24,960 --> 00:07:30,000 And then what happens is block producers will construct a proof of correctness of the entire 138 00:07:30,000 --> 00:07:33,440 block and send that proof to the Ethereum network. 139 00:07:33,440 --> 00:07:37,760 These validity proofs effectively massively increase the amount of transactions that you 140 00:07:37,760 --> 00:07:41,600 can put through a network because now you don't have a scenario where every single 141 00:07:41,600 --> 00:07:45,680 Ethereum node has to manually evaluate every transaction in an Aztec block. 142 00:07:45,680 --> 00:07:47,920 They just have to verify the proof and that's very efficient. 143 00:07:47,920 --> 00:07:52,160 So that's one cornerstone of Aztec, but the other one that doesn't give you privacy, 144 00:07:52,160 --> 00:07:54,080 that just gives you scalability. 145 00:07:54,080 --> 00:07:58,880 The privacy aspect comes from the fact that every Aztec transaction is itself a zero 146 00:07:58,880 --> 00:07:59,760 knowledge proof. 147 00:07:59,760 --> 00:08:04,320 So if I'm a user and I want to transact with the Aztec network, so I wanted to send a token 148 00:08:04,320 --> 00:08:09,200 or interact with some DeFi protocol, I won't send, unlike Ethereum, where for Ethereum, 149 00:08:09,200 --> 00:08:13,360 you just send an instruction to the transaction network that records what you want to do. 150 00:08:13,360 --> 00:08:16,560 So you want to send a transaction to a certain contract. 151 00:08:16,560 --> 00:08:18,400 With Aztec, you construct a proof. 152 00:08:18,400 --> 00:08:23,600 Basically, you evaluate that transaction locally and construct a proof of correctness that 153 00:08:23,600 --> 00:08:26,480 says, well, here's what's going to happen effectively. 154 00:08:26,480 --> 00:08:30,400 So here's like you have some state that's associated with your account. 155 00:08:30,400 --> 00:08:32,880 So you say here's some input state, here's some output state, it's all encrypted, so 156 00:08:32,880 --> 00:08:33,600 you don't know what's going on. 157 00:08:33,600 --> 00:08:36,800 You don't even know what account it belongs to, but you send a proof, a zero knowledge 158 00:08:36,800 --> 00:08:39,360 proof that proves that you follow the rules of the network. 159 00:08:39,360 --> 00:08:45,760 And so using that, and I am massively oversimplifying here, but using those kinds of techniques, 160 00:08:45,760 --> 00:08:50,240 you can provide strong privacy guarantees to users because everything is end-to-end 161 00:08:50,240 --> 00:08:55,120 encrypted, but you still have these mathematical proofs that prove that the rules of the network 162 00:08:55,120 --> 00:08:58,480 will follow, so that the smart contracts that have been in, that you're basically interacting 163 00:08:58,480 --> 00:09:01,120 with one or more of the smart contracts that have been deployed to the network. 164 00:09:01,760 --> 00:09:06,240 And are the other smart contracts checking that that proof is legit? 165 00:09:06,240 --> 00:09:07,040 The protocol does. 166 00:09:07,040 --> 00:09:14,160 So the idea is that the smart contracts themselves are ZK SNARK circuits, and the Aztec protocol 167 00:09:14,160 --> 00:09:18,000 is also a bunch of SNARK circuits, but the Aztec critical SNARK circuits validate that 168 00:09:18,000 --> 00:09:24,160 the smart contract proofs that you've provided are correct, and then you send the proof of 169 00:09:24,160 --> 00:09:26,640 the Aztec critical circuits to the Aztec network. 170 00:09:26,640 --> 00:09:29,840 Let me try to step back because I'm kind of diving into the weed says. 171 00:09:29,840 --> 00:09:31,600 Privacy is a bit of a nebulous term. 172 00:09:31,600 --> 00:09:35,040 In reality, there's really three types of privacy in a blockchain network. 173 00:09:35,040 --> 00:09:39,760 You have user privacy, which is hiding who is transacting, who the message center is. 174 00:09:39,760 --> 00:09:45,440 You have data privacy, which is like what information are you updating in the blockchain? 175 00:09:45,440 --> 00:09:48,960 For example, account balances or token ownerships. 176 00:09:49,840 --> 00:09:50,640 Is that data hidden? 177 00:09:51,360 --> 00:09:52,880 So observers can't see what's going on. 178 00:09:52,880 --> 00:09:57,040 And then you have function privacy, which is where you don't even know which smart 179 00:09:57,040 --> 00:10:00,240 contracts are being called in a given transaction. 180 00:10:00,240 --> 00:10:04,320 And via the use of ZK SNARK, since they are knowledge proofs, Aztec provides all three 181 00:10:04,320 --> 00:10:05,600 privacy guarantees. 182 00:10:05,600 --> 00:10:06,160 Very interesting. 183 00:10:06,160 --> 00:10:11,120 I remember Madaya talking about this before, one of the past episodes is talking about, 184 00:10:11,760 --> 00:10:14,720 I think we're discussing MEV and the high level of Aztec as well. 185 00:10:15,280 --> 00:10:19,760 How you can do, I think if I remember correctly, it might be different now, but 186 00:10:19,760 --> 00:10:25,920 you have transactions that you can see data and some that you cannot see data. 187 00:10:25,920 --> 00:10:26,560 Is that correct? 188 00:10:26,560 --> 00:10:27,920 So that is correct. 189 00:10:27,920 --> 00:10:35,760 So Aztec is a hybrid system where what I described is an end to end encrypted transaction on Aztec. 190 00:10:35,760 --> 00:10:41,760 But the nature of privacy adds an extra complication because if data is private, 191 00:10:41,760 --> 00:10:45,600 that means it's encrypted and therefore has an owner. 192 00:10:45,600 --> 00:10:47,760 The

owner is somebody who holds the decryption key. 193 00:10:47,760 --> 00:10:52,080 So you can use multi-party computation techniques to give an encrypted object multiple owners, 194 00:10:52,080 --> 00:10:53,760 but that number is going to be small. 195 00:10:53,760 --> 00:10:58,240 And so that presents a problem with things like DeFi, because if you have something like 196 00:10:58,240 --> 00:11:02,800 a Uniswap protocol, then you have liquidity pools and every transaction updates its liquidity 197 00:11:02,800 --> 00:11:07,200 pools and you need to know the sizes of those liquidity pools to perform things like price 198 00:11:07,200 --> 00:11:08,880 matching, price computation. 199 00:11:08,880 --> 00:11:12,240 So that's global state effectively, and that's not owned by anyone. 200 00:11:12,240 --> 00:11:13,680 And so how do you make that private? 201 00:11:13,680 --> 00:11:18,080 Well, there's many ways you can try to do this, but we think that you can get the best 202 00:11:18,080 --> 00:11:25,280 of both worlds by creating a hybrid platform where for protocols that are more DeFi oriented, 203 00:11:25,280 --> 00:11:26,400 those protocols are public. 204 00:11:26,400 --> 00:11:32,640 But the way I describe it is privacy for the user, transparency of the protocol. 205 00:11:32,640 --> 00:11:36,960 So all the information about a user, so who they are, what they own, et cetera, that's 206 00:11:36,960 --> 00:11:37,600 all private. 207 00:11:37,600 --> 00:11:43,600 But protocols that operate on user interactions are public. 208 00:11:43,600 --> 00:11:48,320 So the way this would work is, for example, in Uniswap, the tokens going through Uniswap 209 00:11:48,320 --> 00:11:53,760 would all be public, like the values of prices, but the owners of those tokens would be hidden. 210 00:11:53,760 --> 00:11:54,880 I remember this. 211 00:11:54,880 --> 00:11:55,680 OK, interesting. 212 00:11:55,680 --> 00:12:01,680 And since we're on the topic of this cryptography stuff, you mentioned ZKSnarks. 213 00:12:01,680 --> 00:12:03,040 We can get into that. 214 00:12:03,040 --> 00:12:04,320 All right, so let's see. 215 00:12:04,320 --> 00:12:08,800 At the very end, starting at the bottom, you have the cryptography stack, which is basically 216 00:12:08,800 --> 00:12:10,080 the zero-node proving system. 217 00:12:10,080 --> 00:12:11,680 So we call it Honk. 218 00:12:11,680 --> 00:12:13,600 It's a combination of multiple cryptography protocols. 219 00:12:13,600 --> 00:12:16,160 We have the Honk's zero-node proving system, which is derivative of Plonk. 220 00:12:16,160 --> 00:12:17,120 We have Goblin Plonk. 221 00:12:17,120 --> 00:12:22,320 One of the key innovations of Plonk is basically providing several abstraction layers that 222 00:12:22,320 --> 00:12:27,600 one can use or defining several abstraction layers that one can use to build ZKSnarks. 223 00:12:27,600 --> 00:12:28,720 They're made of three systems. 224 00:12:28,720 --> 00:12:34,080 So fundamentally, what

we're trying to do is we're converting computer programs, so 225 00:12:34,080 --> 00:12:39,120 imperative statements, into polynomial equations. 226 00:12:39,120 --> 00:12:40,240 Why are we doing this? 227 00:12:40,240 --> 00:12:45,200 It's because we know we have ways of efficiently proving in zero-knowledge the correctness 228 00:12:45,200 --> 00:12:46,160 of polynomial equations. 229 00:12:46,160 --> 00:12:47,760 Basically, you can hide some of the inputs. 230 00:12:47,760 --> 00:12:51,760 The way we do this is, OK, so the first set one, you have this concept of self-proclaimed 231 00:12:51,760 --> 00:12:53,680 algorithm, this concept of circuit algorithmization. 232 00:12:53,680 --> 00:13:02,480 So this is a technique of converting some high-level imperative programming structure 233 00:13:02,480 --> 00:13:04,880 into polynomial algebra. 234 00:13:04,880 --> 00:13:07,840 So generally, this will be in the form of things like converting your program into 235 00:13:07,840 --> 00:13:12,720 arithmetic gates, like addition gates, multiplication gates, which you can then convert into a formula 236 00:13:12,720 --> 00:13:14,400 over polynomials. 237 00:13:14,400 --> 00:13:18,800 By polynomials, basically, the next step of it is something called a polynomial commitment 238 00:13:18,800 --> 00:13:19,800 scheme. 239 00:13:19,800 --> 00:13:24,800 It's a way of encoding an enormous amount of information into a polynomial equation 240 00:13:24,800 --> 00:13:29,600 and then providing a succinct representation of that polynomial. 241 00:13:29,600 --> 00:13:34,320 You may have a polynomial with a million terms in it, which is effectively going to be used 242 00:13:34,320 --> 00:13:35,320 polynomials to encode vectors. 243 00:13:35,320 --> 00:13:38,040 So that basically means I've got a vector of a million terms. 244 00:13:38,040 --> 00:13:41,360 That's going to be a polynomial with a degree size of 1 million. 245 00:13:41,360 --> 00:13:45,360 And I want to represent that with a very small amount of information, a few hundred bytes 246 00:13:45,360 --> 00:13:46,360 at best. 247 00:13:46,360 --> 00:13:50,880 So the utility polynomial commitment schemes is that you can... 248 00:13:50,880 --> 00:13:54,920 It's kind of a way of compressing information that preserves some of its properties. 249 00:13:54,920 --> 00:13:59,760 Because if you provide a commitment to a polynomial, then given mainstream polynomial commitment 250 00:13:59,760 --> 00:14:04,520 schemes, what happens with them is then you can then, given any kind of evaluation point, 251 00:14:04,520 --> 00:14:09,000 you can provide the evaluation of that polynomial and a very small proof that that evaluation 252 00:14:09,000 --> 00:14:15,080 is correct without having to have the verifier perform extremely intensive computations over 253 00:14:15,080 --> 00:14:16,480 these giant polynomials. 254 00:14:16,480 --> 00:14:22,560 That's a very interesting 1 million, let's say 1 million terms, and it goes into 100 255 00:14:22,560 --> 00:14:23,560 bytes. 256 00:14:23,560 --> 00:14:24,560 That's incredible. 257 00:14:24,560 --> 00:14:25,560 Oh, it is. 258 00:14:25,560 --> 00:14:26,560 It really is. 259 00:14:26,560 --> 00:14:29,440 I mean, the most efficient proving system when it comes to proof size is something called 260 00:14:29,440 --> 00:14:33,640 Groth 16 from Jens Groth, my old mentor, who... 261 00:14:33,640 --> 00:14:38,280 The proofs are 128 bytes and you can fit billions of constraints. 262 00:14:38,280 --> 00:14:41,320 So you can form out vectors with billions and billions of terms and then it's a tiny 263 00:14:41,320 --> 00:14:42,880 little piece of information. 264 00:14:42,880 --> 00:14:43,880 It's very impressive. 265 00:14:43,880 --> 00:14:49,640 The final missing piece, the third component in a SNARK is this concept of a polynomial 266 00:14:49,640 --> 00:14:53,200 interactive oracle proof, which is kind of the meat of a SNARK. 267 00:14:53,200 --> 00:14:58,760 What PIOP does is it is a cryptographic protocol run between a... 268 00:14:58,760 --> 00:15:04,080 It's run between a so-called prover and a verifier, but in our case, the verifier is 269 00:15:04,080 --> 00:15:09,320 either a smart contract or another ZKSNARK program, where basically the prover will 270 00:15:09,320 --> 00:15:16,560 prove that, wants to prove that some giant equation over polynomials is equal to zero. 271 00:15:16,560 --> 00:15:21,080 And this implies that all of your arithmetic gates in your circuit are satisfied. 272 00:15:21,080 --> 00:15:27,040 And what it does is it's a protocol that converts a test about whether a polynomial is... 273 00:15:27,040 --> 00:15:32,000 A polynomial relation is zero into a test about whether evaluations of that polynomial 274 00:15:32,000 --> 00:15:33,000 are zero. 275 00:15:33,000 --> 00:15:38,000 So for example, instead of checking A of X times B of X minus C of X equals zero, you 276 00:15:38,000 --> 00:15:43,000 generate some random point alpha and you check A of alpha times B of alpha minus C of alpha 277 00:15:43,000 --> 00:15:44,320 equals zero. 278 00:15:44,320 --> 00:15:50,040 And the latter check is much easier to do because then if your polynomial has billions 279 00:15:50,040 --> 00:15:55,600 of terms in them, then well, the evaluation of those polynomials is just a single term. 280 00:15:55,600 --> 00:16:02,120 So the idea is that you commit to your polynomials, you run a polynomial interactive oracle proof, 281 00:16:02,120 --> 00:16:07,440 reduce your basically checking every constraint, every gate in your N-circuit is satisfied 282 00:16:07,440 --> 00:16:11,680 to checking a single relation over evaluated polynomials, and then you use your polynomial 283 00:16:11,680 --> 00:16:16,120 commitment scheme to provide the verify with evaluations of those polynomials so that the 284 00:16:16,120 --> 00:16:19,440 verify can efficiently test the relation is correct. 285 00:16:19,440 --> 00:16:21,120 It's kind of hard

to explain in just words. 286 00:16:21,120 --> 00:16:25,240 There's a wonderful blog article called Plunk by Hand by David Wong, which explains the 287 00:16:25,240 --> 00:16:27,360 Plunk Seekers' Lark very, very efficiently. 288 00:16:27,360 --> 00:16:28,720 I highly recommend it. 289 00:16:28,720 --> 00:16:29,720 Okay. 290 00:16:29,720 --> 00:16:30,720 Okay. 291 00:16:30,720 --> 00:16:31,720 We'll take a look at that. 292 00:16:31,720 --> 00:16:32,720 And when... 293 00:16:32,720 --> 00:16:33,720 That's okay. 294 00:16:33,720 --> 00:16:38,840 So the commitment scheme goes to the interactive oracle proof, and then the commitment scheme 295 00:16:38,840 --> 00:16:41,960 goes to the prover to verify. 296 00:16:41,960 --> 00:16:44,200 How do these provers actually verify? 297 00:16:44,200 --> 00:16:45,200 The provers don't verify. 298 00:16:45,200 --> 00:16:49,520 The provers construct proofs that the verifier then check. 299 00:16:49,520 --> 00:16:50,600 The idea is that we... 300 00:16:50,600 --> 00:16:52,800 So for example, take Noir. 301 00:16:52,800 --> 00:16:55,720 Noir is our programming language that we use to convert programs to circuits. 302 00:16:55,720 --> 00:16:59,040 If you write a Noir program, it's going to spit out a verifier smart contract, which 303 00:16:59,040 --> 00:17:03,920 is basically just the algorithm that runs that will check that your proof is correct. 304 00:17:03,920 --> 00:17:06,480 And it's going to do all of these components I just mentioned. 305 00:17:06,480 --> 00:17:09,280 It's going to run the polynomial interactive oracle proof. 306 00:17:09,280 --> 00:17:11,000 It's going to evaluate the polynomial commitment scheme. 307 00:17:11,000 --> 00:17:13,080 It's going to evaluate polynomial relations. 308 00:17:13,080 --> 00:17:14,080 Okay. 309 00:17:14,080 --> 00:17:15,880 Either accept your proof or reject it. 310 00:17:15,880 --> 00:17:16,880 Interesting. 311 00:17:16,880 --> 00:17:24,240 What are the InfoSec security things to consider with all of these actually? 312 00:17:24,240 --> 00:17:26,680 Cryptography security seems quite interesting. 313 00:17:26,680 --> 00:17:27,680 It is. 314 00:17:27,680 --> 00:17:35,440 The attack surface is very vast because what a zero-node proof does is it guarantees that 315 00:17:35,440 --> 00:17:38,120 your proof is basically impossible. 316 00:17:38,120 --> 00:17:40,920 It's computationally unfeasible to fake a proof. 317 00:17:40,920 --> 00:17:46,080 So basically, unless you have a quantum computer, then you need to run... 318 00:17:46,080 --> 00:17:49,000 You need all the computational power that the humanity possesses running until the heat 319 00:17:49,000 --> 00:17:51,200 of the universe to fake a proof. 320 00:17:51,200 --> 00:17:52,880 So it's not feasible. 321 00:17:52,880 --> 00:17:57,040 And some of the proving systems around today are also quantum secure. 322 00:17:57,040 --> 00:17:59,680 However, that's making a few assumptions. 323 00:17:59,680 --> 00:18:04,360

The first of them is there are several cryptographic assumptions around where we assume certain 324 00:18:04,360 --> 00:18:08,080 computational operations are hard, hard to perform. 325 00:18:08,080 --> 00:18:10,920 And if these assumptions are wrong, then the cryptography is insecure. 326 00:18:10,920 --> 00:18:13,440 You then have assumptions around the actual... 327 00:18:13,440 --> 00:18:16,760 You assume that the cryptography paper hasn't got any flaws in it. 328 00:18:16,760 --> 00:18:17,760 Nobody's infallible. 329 00:18:17,760 --> 00:18:21,920 For example, the paper that Zcash was based around had a flaw in it, which rendered it 330 00:18:21,920 --> 00:18:22,920 insecure briefly. 331 00:18:22,920 --> 00:18:26,500 And then you've also got to assume the implementation of your cryptography is secure. 332 00:18:26,500 --> 00:18:31,900 There isn't a bug that your code lines up with mathematics in the paper. 333 00:18:31,900 --> 00:18:35,040 And the attack surface here is extremely large. 334 00:18:35,040 --> 00:18:38,520 Our cryptographic backend has got, I don't know, 100,000 lines of code, which all needs 335 00:18:38,520 --> 00:18:39,760 to be audited. 336 00:18:39,760 --> 00:18:42,560 So that's rather difficult as well. 337 00:18:42,560 --> 00:18:45,260 You then have the issue of... 338 00:18:45,260 --> 00:18:50,080 Have you correctly converted your program into constraints, basically? 339 00:18:50,080 --> 00:18:53,560 There's a class of bug in Zcash called the Numb to Constraints Bug, which is where you 340 00:18:53,560 --> 00:18:57,260 think you're considering parts of your program and you actually aren't. 341 00:18:57,260 --> 00:18:59,640 It's very easy to make these kinds of mistakes. 342 00:18:59,640 --> 00:19:02,660 And it's a new class of bug you don't really find in traditional programming. 343 00:19:02,660 --> 00:19:04,640 How do you identify this bug? 344 00:19:04,640 --> 00:19:07,200 The best technique is fuzzing. 345 00:19:07,200 --> 00:19:08,200 You can fuzz. 346 00:19:08,200 --> 00:19:11,400 Other than that, it's just audits and a lot of code review. 347 00:19:11,400 --> 00:19:13,520 What exactly is happening with this bug? 348 00:19:13,520 --> 00:19:15,200 So the bug is... 349 00:19:15,200 --> 00:19:17,140 It's a subtle type of bug. 350 00:19:17,140 --> 00:19:18,140 One of them... 351 00:19:18,140 --> 00:19:21,540 Where, for example, let's say you're doing some basic accounting in a program. 352 00:19:21,540 --> 00:19:26,360 So you have a balance and you're subtracting a value from that balance to produce a new 353 00:19:26,360 --> 00:19:27,360 balance. 354 00:19:27,360 --> 00:19:31,240 So one bug would be you don't check for integer underflow. 355 00:19:31,240 --> 00:19:36,960 In a Snark Sec it's quite easily if you're not careful because you need to do a bunch 356 00:19:36,960 --> 00:19:37,960 of range checks. 357 00:19:37,960 --> 00:19:41,720 And if you don't apply those range checks, then your circuit is under constrained, basically, 358 00:19:41,720 --> 00:19:43,680 because you haven't checked for that underflow. 359 00:19:43,680 --> 00:19:44,680 That's one example. 360 00:19:44,680 --> 00:19:49,320 It's just that those types of issues are much more common in Snark Sec than they are in regular 361 00:19:49,320 --> 00:19:50,320 programs. 362 00:19:50,320 --> 00:19:51,320 Okay. 363 00:19:51,320 --> 00:19:54,480 So what actually makes the cryptography scheme... 364 00:19:54,480 --> 00:19:56,800 Is that the correct terminology? 365 00:19:56,800 --> 00:19:58,240 Quantum resistant. 366 00:19:58,240 --> 00:19:59,240 Quantum resistant. 367 00:19:59,240 --> 00:20:03,120 Well, it depends on the underlying cryptographic primitives you're using. 368 00:20:03,120 --> 00:20:08,080 So for example, the technology we're using is fundamentally based on elliptic curves. 369 00:20:08,080 --> 00:20:11,280 And we know that elliptic curves are not quantum resistant. 370 00:20:11,280 --> 00:20:16,160 As in, there are algorithms that exist that we know of that if a sufficiently advanced 371 00:20:16,160 --> 00:20:21,680 quantum computer existed could run these algorithms and basically break a lot of the elliptic 372 00:20:21,680 --> 00:20:23,200 curve cryptography that's being used. 373 00:20:23,200 --> 00:20:26,800 However, there are some primitives that we don't believe are currently affected by quantum 374 00:20:26,800 --> 00:20:27,800 computers. 375 00:20:27,800 --> 00:20:30,640 So for example, a lot of hash based schemes. 376 00:20:30,640 --> 00:20:37,760 So things like SHA256, SHA3, Blake3, things like Starks and the kinds of Snarks that are 377 00:20:37,760 --> 00:20:42,880 used in software like Plonky 2 and Plonky 3, they use it like hash. 378 00:20:42,880 --> 00:20:46,840 Hash is their basic cryptographic primitive and so they are secure against quantum computers, 379 00:20:46,840 --> 00:20:49,640 but they also have other trade-offs as well. 380 00:20:49,640 --> 00:20:50,640 So these are hash based. 381 00:20:50,640 --> 00:20:51,640 Yeah. 382 00:20:51,640 --> 00:20:54,520 And before we started, you mentioned also folding schemes. 383 00:20:54,520 --> 00:20:55,520 Yeah. 384 00:20:55,520 --> 00:20:56,520 What are they? 385 00:20:56,520 --> 00:20:57,880 So a folding scheme is a way of... 386 00:20:57,880 --> 00:21:00,440 It's a proxy for something we call recursion. 387 00:21:00,440 --> 00:21:02,360 So recursion is basically if you... 388 00:21:02,360 --> 00:21:06,560 Imagine you have a ZK-SNARK circuit and within that circuit, you want to run the verification 389 00:21:06,560 --> 00:21:10,240 algorithm for a ZK-SNARK protocol. 390 00:21:10,240 --> 00:21:13,200 So you're verifying a proof kind of inside a proof. 391 00:21:13,200 --> 00:21:16,200 That's recursion and it's a famously hard problem. 392 00:21:16,200 --> 00:21:22,280 And folding schemes are quite an elegant way of tackling it where you, instead of directly 393 00:21:22,280 --> 00:21:27,600 verifying proofs

inside proofs inside proofs, you have a very elegant way of effectively 394 00:21:27,600 --> 00:21:30,040 combining multiple proofs into a single proof. 395 00:21:30,040 --> 00:21:31,680 Like concatenating proofs in some way. 396 00:21:31,680 --> 00:21:32,680 Yeah, sort of. 397 00:21:32,680 --> 00:21:34,160 It's a bit like using random linear combinations. 398 00:21:34,160 --> 00:21:40,120 It's basically you take two circuit descriptions and you kind of multiply them by some randomness 399 00:21:40,120 --> 00:21:41,680 and combine them together. 400 00:21:41,680 --> 00:21:45,400 I'm not explaining it that well, but there are techniques that allow you to do that in 401 00:21:45,400 --> 00:21:50,440 a way that preserves the structure of this circuit such that if you verify the folded 402 00:21:50,440 --> 00:21:55,760 proof, doing so implicitly means that every other circuits that were folded into that 403 00:21:55,760 --> 00:21:58,720 into the object were correctly satisfied. 404 00:21:58,720 --> 00:22:03,080 So this seems to sit a bit a layer above the ZK-SNARK protocol. 405 00:22:03,080 --> 00:22:07,400 So we use something called protoget and we use it to fold honk instances. 406 00:22:07,400 --> 00:22:09,400 And honk is a derivative of plonk. 407 00:22:09,400 --> 00:22:10,400 Oh, okay. 408 00:22:10,400 --> 00:22:11,400 Okay. 409 00:22:11,400 --> 00:22:17,320 So now that we've, we've touched on the cryptography in the stack, what else is in the stack? 410 00:22:17,320 --> 00:22:18,840 Let's go a step above that. 411 00:22:18,840 --> 00:22:20,280 And we have NOIR. 412 00:22:20,280 --> 00:22:23,520 So NOIR is our language front end that we use to write circuits. 413 00:22:23,520 --> 00:22:27,960 That it compiles through intermediate representation, what we call ACIR, abstract circuit intermediate 414 00:22:27,960 --> 00:22:28,960 representation. 415 00:22:28,960 --> 00:22:32,280 And that gets converted in by our cryptography backend into SNARK circuits. 416 00:22:32,280 --> 00:22:36,680 And this is what allows like circuits to be written by engineers and not cryptographers 417 00:22:36,680 --> 00:22:40,860 because it's a nice rust based language with clear, clean syntax. 418 00:22:40,860 --> 00:22:43,840 We then have our protocol circuits that are written in NOIR. 419 00:22:43,840 --> 00:22:47,560 So these are the circuits that define what the ASIC protocol is doing. 420 00:22:47,560 --> 00:22:51,620 It's a bit like writing a chunk of the geth client as a SNARK circuit. 421 00:22:51,620 --> 00:22:55,120 And so our protocol circuits evaluate the correctness of user transactions and then 422 00:22:55,120 --> 00:22:59,360 they also aggregate multiple user transactions together inside a roll up. 423 00:22:59,360 --> 00:23:02,300 Then above that, we have our ASIC node. 424 00:23:02,300 --> 00:23:08,600 So it's a bit like, well, the rest of geth that isn't in the protocol circuits. 425 00:23:08,600 --> 00:23:15,360 So it can be run by node operators, creates a peer to peer transaction network. 426 00:23:15,360 --> 00:23:19,800 It can produce blocks, it syncs to the network, it exposes an RPC interface that can be used 427 00:23:19,800 --> 00:23:22,240 to extract information from the network. 428 00:23:22,240 --> 00:23:26,840 And within the node, we also have something we call the PIXI, private execution environment. 429 00:23:26,840 --> 00:23:34,080 So this is basically a little kind of a encapsulated part of the node which handles users private 430 00:23:34,080 --> 00:23:35,720 state, which is quite... 431 00:23:35,720 --> 00:23:40,560 So if you consider something like Metamask, so if you want to send a transaction to the 432 00:23:40,560 --> 00:23:42,920 Ethereum network, you don't run a node personally. 433 00:23:42,920 --> 00:23:44,040 I mean, almost never. 434 00:23:44,040 --> 00:23:48,440 You generally, you will be interacting with a wallet like Metamask, which we'll be talking 435 00:23:48,440 --> 00:23:52,520 to you in Fiora, which is an infrastructure provider that runs nodes on the behalf of 436 00:23:52,520 --> 00:23:53,840 users. 437 00:23:53,840 --> 00:23:58,120 You can't do that completely with Aztec because... 438 00:23:58,120 --> 00:24:01,160 You can do that for everything except the private parts of Aztec, because then your 439 00:24:01,160 --> 00:24:07,760 state as a user, you don't want to be decrypting that on some server that you don't control 440 00:24:07,760 --> 00:24:09,800 unless you're comfortable leaking information. 441 00:24:09,800 --> 00:24:14,080 So the private execution environment is the part of the Aztec node that contains user 442 00:24:14,080 --> 00:24:15,680 secrets that has to run client side. 443 00:24:15,680 --> 00:24:18,860 So it's an extremely minimal component of the node, but a very important one with very 444 00:24:18,860 --> 00:24:20,360 important security properties. 445 00:24:20,360 --> 00:24:22,400 We also have an Aztec virtual machine. 446 00:24:22,400 --> 00:24:25,640 So this isn't even something I've touched on yet. 447 00:24:25,640 --> 00:24:29,640 I mentioned before we have this hybrid system where you have private state, but you also 448 00:24:29,640 --> 00:24:36,480 have public state that can be handled to create protocols like Uniswap. 449 00:24:36,480 --> 00:24:40,560 Transactions that involve calling public components of contracts will be executed within a virtual 450 00:24:40,560 --> 00:24:42,640 machine that must be proved. 451 00:24:42,640 --> 00:24:46,880 So we have a ZKSNOX circuit that proves the correctness of our virtual machine execution. 452 00:24:46,880 --> 00:24:49,680 So we call it the AVM, Aztec virtual machine. 453 00:24:49,680 --> 00:24:52,440 That's another giant component of our technology stack. 454 00:24:52,440 --> 00:24:53,800 Where else do we go from here? 455 00:24:53,800 --> 00:24:54,800 So we then have... 456 00:24:54,800 --> 00:24:55,800 Cover the node, cover the AVM. 457 00:24:55,800 --> 00:24:56,800 Yeah.

458 00:24:56,800 --> 00:24:58,800 So we have the sequencer network. 459 00:24:58,800 --> 00:25:04,180 So we need a network of entities that will actually produce Aztec blocks and to be able 460 00:25:04,180 --> 00:25:07,440 to coordinate them as in who gets to produce an Aztec block. 461 00:25:07,440 --> 00:25:10,320 We use effectively proof of stake via Ethereum. 462 00:25:10,320 --> 00:25:14,320 You stake on Ethereum, but that all needs to be sequenced. 463 00:25:14,320 --> 00:25:15,880 Is that decentralized? 464 00:25:15,880 --> 00:25:17,360 It is decentralized, yes. 465 00:25:17,360 --> 00:25:21,320 So anyone can become a sequencer and it's kind of like block building on Ethereum? 466 00:25:21,320 --> 00:25:22,320 Yeah, yeah. 467 00:25:22,320 --> 00:25:23,320 So it's... 468 00:25:23,320 --> 00:25:24,320 Well, we do have... 469 00:25:24,320 --> 00:25:26,600 We have this kind of block-proposer-block-builder separation. 470 00:25:26,600 --> 00:25:33,440 So the idea is some random entity can propose a block to be made and the sequences are the 471 00:25:33,440 --> 00:25:35,560 ones that are actually making that block. 472 00:25:35,560 --> 00:25:37,440 And they have the right to do that because they have been... 473 00:25:37,440 --> 00:25:41,320 They're staking tokens on Ethereum or staking something of value. 474 00:25:41,320 --> 00:25:45,600 And the more that a stake, the greater your likelihood is of being sacked as a sequencer. 475 00:25:45,600 --> 00:25:53,120 So we have a whole sequence of proposer protocol called Finnet as well to handle this. 476 00:25:53,120 --> 00:25:54,760 And when... 477 00:25:54,760 --> 00:26:00,000 So when someone creates a block as a sequencer, let's say they're chosen, how does this land 478 00:26:00,000 --> 00:26:01,000 on Ethereum? 479 00:26:01,000 --> 00:26:03,320 Well, it lands on Ethereum. 480 00:26:03,320 --> 00:26:04,880 So the sequencer will... 481 00:26:04,880 --> 00:26:08,800 Because they'll be running an Aztec node, they will have access to the Aztec peer-to-peer 482 00:26:08,800 --> 00:26:09,800 transaction network. 483 00:26:09,800 --> 00:26:13,520 So they'll basically extract transactions that they want to build a block out of from 484 00:26:13,520 --> 00:26:14,920 that network. 485 00:26:14,920 --> 00:26:18,920 And then that block, once they've made it, needs to be proved because it's the proof 486 00:26:18,920 --> 00:26:20,800 that gets sent to the Ethereum network. 487 00:26:20,800 --> 00:26:22,680 And this is where a proven network comes in. 488 00:26:22,680 --> 00:26:27,120 So the idea is that the sequencer doesn't make the proof themselves because you need 489 00:26:27,120 --> 00:26:31,120 a lot of computational resources to make that block proof and we don't want that to be a 490 00:26:31,120 --> 00:26:33,320 barrier for running a sequencer. 491 00:26:33,320 --> 00:26:37,320 Also there's lots of third-party proven networks that are being produced now to provide proofing 492 00:26:37,320 --> 00:26:38,320 as a service. 493 00:26:38,320 --> 00:26:41,300 So we're just going to outsource proof construction to those networks. 494 00:26:41,300 --> 00:26:46,480 So we don't really define in protocol how the proofs are made, just that some entity 495 00:26:46,480 --> 00:26:47,480 needs to make them. 496 00:26:47,480 --> 00:26:50,000 There's an entity that creates the block. 497 00:26:50,000 --> 00:26:52,240 There's an entity that proves the block. 498 00:26:52,240 --> 00:26:57,400 And if I'm a builder, if I'm building a building block, I want to make the best possible, right? 499 00:26:57,400 --> 00:27:02,440 Can you actually see account balances, transfers, any of that swaps? 500 00:27:02,440 --> 00:27:06,080 You can see the public components, but not the public components, which means that it 501 00:27:06,080 --> 00:27:12,040 does limit some of the MEV that's available, which is nice, but there is still going to 502 00:27:12,040 --> 00:27:15,480 be MEV because of the public components. 503 00:27:15,480 --> 00:27:18,080 Which would be like the account balances, right? 504 00:27:18,080 --> 00:27:20,680 Well not necessarily account balances. 505 00:27:20,680 --> 00:27:22,680 It'll be protocol balances. 506 00:27:22,680 --> 00:27:26,240 So you'll be able to see in-flows and out-flows from Uniswap. 507 00:27:26,240 --> 00:27:30,400 But you wouldn't know who's doing it, but you'll know that they are occurring and therefore 508 00:27:30,400 --> 00:27:33,720 we'll be able to extract. 509 00:27:33,720 --> 00:27:38,160 Without knowing the reserves of a pool, you can't really do a swap, right? 510 00:27:38,160 --> 00:27:43,240 Well yeah, you can with multi-party computations or fully homomorphic encryption. 511 00:27:43,240 --> 00:27:44,520 That's another kettle of fish. 512 00:27:44,520 --> 00:27:47,960 We did that with Xamarin, with Rand a few weeks ago. 513 00:27:47,960 --> 00:27:49,640 That was very interesting. 514 00:27:49,640 --> 00:27:54,120 So then you have this block, you send it to a prover, and then what happens with the prover? 515 00:27:54,120 --> 00:27:59,320 How does it go from there to like in a theory invalidator to actually become a block? 516 00:27:59,320 --> 00:28:02,920 Well the prover, once the prover is made, the proof goes back to the SQL server and 517 00:28:02,920 --> 00:28:05,040 the SQL server constructs an Ethereum transaction. 518 00:28:05,040 --> 00:28:08,400 That gets sent to the Aztec rollup smart contract. 519 00:28:08,400 --> 00:28:11,600 Oh, so it lands as just a single transaction. 520 00:28:11,600 --> 00:28:12,600 I see what you're saying. 521 00:28:12,600 --> 00:28:14,520 Well, yeah, not technically. 522 00:28:14,520 --> 00:28:20,960 So we're likely going to be doing a block, will likely be multiple transactions just 523 00:28:20,960 --> 00:28:23,320 so that we're not profiled by data. 524 00:28:23,320 --> 00:28:27,520 Because we may want to, for blocks that are particularly large, we may want to include 525

00:28:27,520 --> 00:28:32,900 the information that that block contains across multiple EIP 4844 blocks. 526 00:28:32,900 --> 00:28:37,040 But it can kind of be abstracted away as a single transaction, as in, you know, if the 527 00:28:37,040 --> 00:28:41,360 Ethereum block space was large enough, it would just be one transaction. 528 00:28:41,360 --> 00:28:44,120 So it could be multi-block on Ethereum to settle. 529 00:28:44,120 --> 00:28:47,320 So it's like kind of asynchronous then, in that sense. 530 00:28:47,320 --> 00:28:50,960 Well it's not as asynchronous as it is lower latency. 531 00:28:50,960 --> 00:28:56,480 So the settlement time for Aztec is not going to be one Ethereum block. 532 00:28:56,480 --> 00:28:59,040 It'll likely be multiple Ethereum blocks. 533 00:28:59,040 --> 00:29:03,600 Just filling the entire block or just like maybe one or two transactions in each block. 534 00:29:03,600 --> 00:29:06,440 Yeah, yeah, we're not going to be filling the entire Ethereum block space. 535 00:29:06,440 --> 00:29:07,440 Yeah, that's at all. 536 00:29:07,440 --> 00:29:08,440 Interesting. 537 00:29:08,440 --> 00:29:11,200 Because I'm thinking that you could probably do some cross domain stuff right there. 538 00:29:11,200 --> 00:29:15,600 If you're running a sequencer, but also a builder. 539 00:29:15,600 --> 00:29:17,400 It's very interesting. 540 00:29:17,400 --> 00:29:18,480 It is, yeah. 541 00:29:18,480 --> 00:29:21,480 This is where these kind of shared sequencing networks are kind of ideas are cropping up 542 00:29:21,480 --> 00:29:26,200 because you know, if you have lots of networks with lots of blocks being built, then if you 543 00:29:26,200 --> 00:29:31,080 have eyes on all of the state, block state that's being updated, you can make much more 544 00:29:31,080 --> 00:29:32,560 profitable blocks. 545 00:29:32,560 --> 00:29:33,560 Yeah. 546 00:29:33,560 --> 00:29:37,120 And I think the decentralized version of that is, well, kind of essential, but you don't 547 00:29:37,120 --> 00:29:39,000 want any centralized party. 548 00:29:39,000 --> 00:29:42,480 And this will be this entire network where you completely decentralized as well, right? 549 00:29:42,480 --> 00:29:43,480 Yep. 550 00:29:43,480 --> 00:29:44,480 That's the plan. 551 00:29:44,480 --> 00:29:47,680 So day one on launch, it'll be, we'll launch it decentralized. 552 00:29:47,680 --> 00:29:50,480 Very, very exciting. 553 00:29:50,480 --> 00:29:55,840 This is something I'm quite curious about because this is obviously groundbreaking revolutionary 554 00:29:55,840 --> 00:30:01,200 technology where if it's completely decentralized and you don't know who's trading what, I mean, 555 00:30:01,200 --> 00:30:02,800 what's going to happen with governments, right? 556 00:30:02,800 --> 00:30:05,000 It's something that completely shuts them down. 557 00:30:05,000 --> 00:30:06,000 Yeah. 558 00:30:06,000 --> 00:30:07,880 So it is a very good question. 559 00:30:07,880 --> 00:30:12,540 And there's a spectrum of views on this from the Monero, Burnett to the ground view to 560 00:30:12,540 --> 00:30:14,520 more conservative views. 561 00:30:14,520 --> 00:30:15,520 Here's the thing, right? 562 00:30:15,520 --> 00:30:19,440 Like privacy is, in my opinion, very misunderstood as a technology in this space because it's 563 00:30:19,440 --> 00:30:23,300 because previously the technology has not really been sufficiently advanced to do anything 564 00:30:23,300 --> 00:30:25,600 more than basic cryptocurrency mixes. 565 00:30:25,600 --> 00:30:27,680 But here's the thing about privacy. 566 00:30:27,680 --> 00:30:33,120 If you have privacy on a blockchain network, that means you can link an identity to a cryptocurrency 567 00:30:33,120 --> 00:30:34,120 account. 568 00:30:34,120 --> 00:30:37,680 You can link things like passports, social security numbers, bank details, proofs of 569 00:30:37,680 --> 00:30:39,340 address, et cetera, et cetera. 570 00:30:39,340 --> 00:30:41,120 And you can do that because it's all encrypted. 571 00:30:41,120 --> 00:30:43,960 And so therefore, you're not leaking that information. 572 00:30:43,960 --> 00:30:49,260 And if you can do that, then paradoxically, it does actually allow you to create financial 573 00:30:49,260 --> 00:30:53,900 systems where you have a lot more ability to distinguish between good and bad actors. 574 00:30:53,900 --> 00:31:00,320 Because you can create preemptive checks where, in order to, for example, use an off ramp 575 00:31:00,320 --> 00:31:05,080 to an exchange, then you must possess a KYC token from that exchange. 576 00:31:05,080 --> 00:31:09,000 And that whole interaction can be performed completely privately. 577 00:31:09,000 --> 00:31:13,520 So no one knows that you possess such a token, but you can still prove that you have it. 578 00:31:13,520 --> 00:31:18,320 Or similarly, you can use a signature from a passport to prove that you are a citizen 579 00:31:18,320 --> 00:31:22,640 of a certain country and therefore that you're not violating certain sanctions or actions. 580 00:31:22,640 --> 00:31:26,880 If you can prove your identity, you can prove you're not on an no-fact list. 581 00:31:26,880 --> 00:31:31,440 If you can link identities to cryptocurrency accounts, that gives you uniqueness checks, 582 00:31:31,440 --> 00:31:33,760 which means you can do things like transfer limits. 583 00:31:33,760 --> 00:31:40,760 So you can prove that you've not spent more than $50,000 or something in a certain currency, 584 00:31:40,760 --> 00:31:46,200 which means you can prove that you do not need to undergo certain compliance checks 585 00:31:46,200 --> 00:31:48,000 because you're under some kind of threshold. 586 00:31:48,000 --> 00:31:53,560 So I do think that there is going to be an organic evolution of these kinds of identity 587 00:31:53,560 --> 00:31:58,400 protocols on Aztec that can be used to distinguish between good and bad actors. 588 00:31:58,400 --> 00:32:04,640 And so the way

we think about it as a network is we want to be able to provide the tools 589 00:32:04,640 --> 00:32:11,280 and technologies that allow application developers to be compliant in the region they're located 590 00:32:11,280 --> 00:32:12,280 in. 591 00:32:12,280 --> 00:32:13,280 But we want to be neutral about it. 592 00:32:13,280 --> 00:32:20,560 We do not want to mandate such tools are used because that would require placing a centralized 593 00:32:20,560 --> 00:32:27,120 access of control of the network and then it's no longer centralized. 594 00:32:27,120 --> 00:32:35,120 So I think that the idea that these are going to be completely black markets and bad places 595 00:32:35,120 --> 00:32:38,200 for bad actors to congregate, I don't believe that. 596 00:32:38,200 --> 00:32:43,160 If I thought that Aztec was going to be used, that's how Aztec was going to be used. 597 00:32:43,160 --> 00:32:44,280 I wouldn't be building Aztec. 598 00:32:44,280 --> 00:32:50,160 I'm building Aztec because I can see that you can, what we want to do is create a global 599 00:32:50,160 --> 00:32:53,920 marketplace for assets, programmable money. 600 00:32:53,920 --> 00:32:57,600 So anything which in the real world, which has some kind of perceived value, if you can 601 00:32:57,600 --> 00:33:02,360 create a digital fingerprint of it on Aztec, that's like that tracks on the real world 602 00:33:02,360 --> 00:33:07,160 assets where you have, where the owners of that asset are identified not just by a cryptocurrency 603 00:33:07,160 --> 00:33:10,320 account, but through other real world links. 604 00:33:10,320 --> 00:33:18,160 Then you create a very dynamic world where you don't have all these fiefdoms of assets 605 00:33:18,160 --> 00:33:23,120 and money spread around with the traditional banking system and all these different jurisdictions. 606 00:33:23,120 --> 00:33:27,320 It really becomes a much more dynamic environment where the barriers to entry to providing these 607 00:33:27,320 --> 00:33:32,120 kinds of financial services, it's the whole becoming unbanked hypothesis in a way that 608 00:33:32,120 --> 00:33:34,240 I think is much more achievable. 609 00:33:34,240 --> 00:33:35,720 That's just one angle to it. 610 00:33:35,720 --> 00:33:40,760 That's the Aztec as money angle, but there's also far more to it than that because there's 611 00:33:40,760 --> 00:33:46,600 a lot, there's an enormous fundamental value around being able to prove things about data 612 00:33:46,600 --> 00:33:51,880 you hold so that that data can stay with you and doesn't have to be given to servers that 613 00:33:51,880 --> 00:33:53,880 can then be sold to data brokers. 614 00:33:53,880 --> 00:33:54,880 Yeah. 615 00:33:54,880 --> 00:33:56,440 Very, I completely agree. 616 00:33:56,440 --> 00:34:02,040 Especially in healthcare, for example, with what Xamarin.ai is doing with Randy Hinde, 617 00:34:02,040 --> 00:34:08,120 the homomorphic encryption, they can use that private data and all the hospitals can share 618 00:34:08,120 --> 00:34:14,840 the medical records without actually linking it to anyone and train an AI to help do stuff 619 00:34:14,840 --> 00:34:15,840 with that. 620 00:34:15,840 --> 00:34:18,840 You can do that with everything that's related to whatever. 621 00:34:18,840 --> 00:34:23,800 It guarantees privacy between the hospitals, but they all benefit from it and society benefits 622 00:34:23,800 --> 00:34:27,400 from it completely, which is very interesting use case. 623 00:34:27,400 --> 00:34:34,800 Hopefully it gets adopted quite quickly and waiting promptly for the Aztec release when 624 00:34:34,800 --> 00:34:35,800 main net. 625 00:34:35,800 --> 00:34:39,080 When main net, we're working hard on it. 626 00:34:39,080 --> 00:34:42,520 We're working on our test nets currently. 627 00:34:42,520 --> 00:34:46,640 Our development protocol are a little longer than other ladies because we're launching 628 00:34:46,640 --> 00:34:47,640 fully decentralized. 629 00:34:47,640 --> 00:34:51,840 Our test net is going to also be decentralized because the whole point of the test net is 630 00:34:51,840 --> 00:34:56,480 to test the main net, but we're confident we can get that done this year and it's still 631 00:34:56,480 --> 00:34:57,480 early days. 632 00:34:57,480 --> 00:35:02,080 I'm confident that we'll get something out on the Ethereum main net early to mid 2025. 633 00:35:02,080 --> 00:35:03,080 Okay. 634 00:35:03,080 --> 00:35:05,080 I have a few questions with testing then. 635 00:35:05,080 --> 00:35:07,720 How do you actually test a blockchain? 636 00:35:07,720 --> 00:35:08,720 How do you test a blockchain? 637 00:35:08,720 --> 00:35:12,640 In a decentralized way. 638 00:35:12,640 --> 00:35:20,920 First of all, we're creating an internal test net where the architecture and technology 639 00:35:20,920 --> 00:35:21,920 is decentralized. 640 00:35:21,920 --> 00:35:27,240 We internally run all of the nodes and all of the sequences so we can see where things 641 00:35:27,240 --> 00:35:28,240 break. 642 00:35:28,240 --> 00:35:29,240 Right. 643 00:35:29,240 --> 00:35:32,520 You've got to run each part of the infrastructure to really test it. 644 00:35:32,520 --> 00:35:33,520 Exactly. 645 00:35:33,520 --> 00:35:39,160 Obviously, the way we're going about it, you can mock out every core components. 646 00:35:39,160 --> 00:35:42,560 You can fake sequences, you can fake blocks, you can fake proofs. 647 00:35:42,560 --> 00:35:46,040 You can fake whatever you need to test one individual component while still getting some 648 00:35:46,040 --> 00:35:48,040 kind of end-to-end experience. 649 00:35:48,040 --> 00:35:52,360 The proof is you only truly test it when you have full end-to-end transactions. 650 00:35:52,360 --> 00:35:56,560 You only test it truly when you have a full decentralized test net because then that's 651 00:35:56,560 --> 00:36:04,840 when things like latency issues, coordination issues, they really start to become

apparent. 652 00:36:04,840 --> 00:36:06,680 It's not trivial, that's for sure. 653 00:36:06,680 --> 00:36:13,400 On the topic of testing blockchains, what are your thoughts on the future of L2s and 654 00:36:13,400 --> 00:36:15,120 where blockchain is going now? 655 00:36:15,120 --> 00:36:22,640 I was at a event before and they were talking about shared sequences and super builders 656 00:36:22,640 --> 00:36:28,680 and I think the discussion of Ethereum is just now a settlement layer and everything 657 00:36:28,680 --> 00:36:31,280 else is just L2s. 658 00:36:31,280 --> 00:36:32,280 What are your thoughts on this? 659 00:36:32,280 --> 00:36:33,280 Where do you see it going? 660 00:36:33,280 --> 00:36:35,800 Where do you hope to see it go? 661 00:36:35,800 --> 00:36:42,320 Yeah, it's a complicated space and predictions are always fraught with danger because usually 662 00:36:42,320 --> 00:36:43,320 they're wrong. 663 00:36:43,320 --> 00:36:44,600 But I will make some predictions. 664 00:36:44,600 --> 00:36:51,620 So I do think that the Ethereum as a pure settlement layer is likely how things are 665 00:36:51,620 --> 00:36:56,680 going to trend because the demand for block space is so much higher than supply. 666 00:36:56,680 --> 00:36:59,120 And so L2s can fulfill that demand. 667 00:36:59,120 --> 00:37:02,820 But then it means if you want to transact directly on Ethereum, your transaction is competing 668 00:37:02,820 --> 00:37:10,280 against L2 block transactions where the purchasing power of a L2 block is going to be substantially 669 00:37:10,280 --> 00:37:16,960 higher than a single individual, which means that the more layer 2s come on stream, the 670 00:37:16,960 --> 00:37:20,760 less likely it is that people will be directly transacting with Ethereum. 671 00:37:20,760 --> 00:37:25,080 That being said, I still see Networks like Ethereum as being the place where fundamental 672 00:37:25,080 --> 00:37:26,080 value is represented. 673 00:37:26,080 --> 00:37:30,080 So if you have a token, you create it on Ethereum and then you bridge it into L2s. 674 00:37:30,080 --> 00:37:34,760 But the fundamental statement of who it is is exactly. 675 00:37:34,760 --> 00:37:40,560 But also, I do think on the topic of that, just before we start this one on the topic 676 00:37:40,560 --> 00:37:44,840 of the L2s, all like let's say we had 100 L2s now all competing for the block space 677 00:37:44,840 --> 00:37:47,040 on just one block of Ethereum. 678 00:37:47,040 --> 00:37:50,800 Imagine if just like all the L2s just fizzle out because one is just providing so much 679 00:37:50,800 --> 00:37:51,800 more value. 680 00:37:51,800 --> 00:37:53,440 And it's a good question. 681 00:37:53,440 --> 00:37:57,640 Then it would never really work as in hundreds of, you know, and then thousands of L2s. 682 00:37:57,640 --> 00:37:59,160 It would just go to like a small amount. 683 00:37:59,160 --> 00:38:00,160 Okay. 684 00:38:00,160 --> 00:38:06,680 But I need to give a spicy take here and that is that L2s have become a narrative in this 685 00:38:06,680 --> 00:38:13,860 industry in a similar way to how previously NFTs were a narrative and DeFi was a narrative. 686 00:38:13,860 --> 00:38:17,320 And before that, ICOs and tokens were a narrative. 687 00:38:17,320 --> 00:38:22,560 And these narratives provide compelling stories that one can use to effectively create, I'm 688 00:38:22,560 --> 00:38:26,200 going to be a little bit, this is a little bit, I don't mean this in a disparaging way, 689 00:38:26,200 --> 00:38:31,040 but to create a meme coin effectively where the idea is that why does the coin have, why 690 00:38:31,040 --> 00:38:32,400 does the token have value? 691 00:38:32,400 --> 00:38:36,720 It doesn't have value because there's anything of fundamental economic utility that's being 692 00:38:36,720 --> 00:38:40,840 provided but there is a compelling narrative that people are buying into where they think 693 00:38:40,840 --> 00:38:44,200 that narrative is compelling after other people buy in and buy the token and make the price 694 00:38:44,200 --> 00:38:45,200 go up. 695 00:38:45,200 --> 00:38:46,200 It's an absolute firmer effect. 696 00:38:46,200 --> 00:38:49,280 And right now, layer 2s are the firmer effect. 697 00:38:49,280 --> 00:38:52,880 Before it was NFTs, then it was DeFi, then it was tokens and ICOs. 698 00:38:52,880 --> 00:38:55,080 And so, I mean, like for example, you know, bearer chain. 699 00:38:55,080 --> 00:38:56,080 I love that project. 700 00:38:56,080 --> 00:38:58,160 They believe they recently raised $100 million. 701 00:38:58,160 --> 00:39:00,760 There's a lot to learn from them in terms of execution. 702 00:39:00,760 --> 00:39:04,720 But I don't think anyone can deny that they are a meme coin, but they're also a layer 703 00:39:04,720 --> 00:39:05,720 2. 704 00:39:05,720 --> 00:39:07,320 And there's a reason why they're a layer 2. 705 00:39:07,320 --> 00:39:10,960 So I guess what I'm trying to say is that I don't think this is going to last. 706 00:39:10,960 --> 00:39:18,280 I think that just like in evolution, no two species can occupy the same ecological niche 707 00:39:18,280 --> 00:39:20,480 without one out competing the other and making the other extinct. 708 00:39:20,480 --> 00:39:25,280 In a similar way, no two products can occupy the same economic niche. 709 00:39:25,280 --> 00:39:27,920 So you have to provide some kind of unique value proposition. 710 00:39:27,920 --> 00:39:30,160 You have to provide some distinguishability. 711 00:39:30,160 --> 00:39:33,480 And there is absolutely scope for distinguishability between layer 2s. 712 00:39:33,480 --> 00:39:35,520 I mean, we do privacy. 713 00:39:35,520 --> 00:39:36,840 That's a big factor for us. 714 00:39:36,840 --> 00:39:40,440 But there's also, you know, there's various spectrums where you can trade security for 715 00:39:40,440 --> 00:39:41,440 throughput. 716 00:39:41,440 --> 00:39:42,520 You can use different

languages. 717 00:39:42,520 --> 00:39:46,400 You can have even maybe even like just different geographic communities. 718 00:39:46,400 --> 00:39:50,200 But there needs to be a difference between you and somebody else, another layer 2. 719 00:39:50,200 --> 00:39:52,800 And if there isn't, one of you is going to die. 720 00:39:52,800 --> 00:39:58,320 And so I do suspect that 2025, 2026 is going to see a process of consolidation. 721 00:39:58,320 --> 00:40:00,680 On top of that, I think we're going to see the rise of something else. 722 00:40:00,680 --> 00:40:03,400 They've sometimes be called layer 3s, but I don't think that's a very good word for 723 00:40:03,400 --> 00:40:04,400 it. 724 00:40:04,400 --> 00:40:06,040 Application specific roll ups. 725 00:40:06,040 --> 00:40:08,520 Because take a layer 2, right? 726 00:40:08,520 --> 00:40:12,800 For layer 2, block space is still not going to be cheap eventually. 727 00:40:12,800 --> 00:40:18,280 Like right now they are, but that's because they're being unutilized and EIP 4 is new, 728 00:40:18,280 --> 00:40:20,240 so not everyone's tapped into them. 729 00:40:20,240 --> 00:40:23,520 But if you want to create a world where you have throughputs of hundreds of thousands 730 00:40:23,520 --> 00:40:28,680 of transactions a second, there's still going to be limited block space on layer 2s because 731 00:40:28,680 --> 00:40:32,040 layer 2s have properties that affect their throughput. 732 00:40:32,040 --> 00:40:33,040 They have sensitive resistance. 733 00:40:33,040 --> 00:40:35,040 You have strong data availability guarantees. 734 00:40:35,040 --> 00:40:37,080 You have strong liveness guarantees. 735 00:40:37,080 --> 00:40:40,920 And for a lot of applications, you don't need all these three properties. 736 00:40:40,920 --> 00:40:47,160 For example, imagine you're an application vendor that handles micro payments on the 737 00:40:47,160 --> 00:40:48,160 internet. 738 00:40:48,160 --> 00:40:53,520 So you're doing something like Stripe or Vend for online websites using a browser extension. 739 00:40:53,520 --> 00:40:56,680 So let's say you've got a throughput of you're doing hundreds of thousands of transactions 740 00:40:56,680 --> 00:40:59,960 a day, maybe a thousand transactions a second, but they're all tiny amounts. 741 00:40:59,960 --> 00:41:01,600 And users trust you for small amounts, right? 742 00:41:01,600 --> 00:41:06,320 It's not like people are going to be worried about you running off with their $10. 743 00:41:06,320 --> 00:41:07,920 So what are you going to do? 744 00:41:07,920 --> 00:41:13,020 You want ideally the benefit of a blockchain network because you care about composability 745 00:41:13,020 --> 00:41:16,880 with the world of assets on blockchain and it provides a very convenient and efficient 746 00:41:16,880 --> 00:41:18,040 on and off ramp. 747 00:41:18,040 --> 00:41:20,880 And it basically is your transaction network. 748 00:41:20,880 --> 00:41:23,320 But you don't really need the

data variability costs. 749 00:41:23,320 --> 00:41:25,720 You don't want to pay for the liveness guarantees. 750 00:41:25,720 --> 00:41:28,460 You don't want to pay for the sensitive resistance. 751 00:41:28,460 --> 00:41:29,460 So what do you do? 752 00:41:29,460 --> 00:41:30,460 You run an application-specific rollup. 753 00:41:30,460 --> 00:41:31,460 You basically run a rollup. 754 00:41:31,460 --> 00:41:32,460 It could be the OP stack. 755 00:41:32,460 --> 00:41:35,920 It could be eventually we're going to be doing the ASSEC stack. 756 00:41:35,920 --> 00:41:37,120 But it's one way it's configurable. 757 00:41:37,120 --> 00:41:39,680 So the idea is you don't have decentralized sequences. 758 00:41:39,680 --> 00:41:40,680 You're the sequencer. 759 00:41:40,680 --> 00:41:41,680 You don't have data availability. 760 00:41:41,680 --> 00:41:43,400 Your data is on your server. 761 00:41:43,400 --> 00:41:46,840 And it means that your throughput of your little mini network can be really, really fast. 762 00:41:46,840 --> 00:41:50,920 And then you create roller blocks and you settle your roller blocks on another layer 763 00:41:50,920 --> 00:41:51,920 two, like ASSEC. 764 00:41:51,920 --> 00:41:59,040 And this provides a very decent compromise between long-term security properties, which 765 00:41:59,040 --> 00:42:02,560 you do want to pay for, and the short term where you don't really need the security properties 766 00:42:02,560 --> 00:42:06,560 on an hour-to-hour basis. 767 00:42:06,560 --> 00:42:10,480 And so the difference between an application-specific rollup and a layer three is a bit subtle. 768 00:42:10,480 --> 00:42:11,480 They use the same technology. 769 00:42:11,480 --> 00:42:15,760 But an application-specific rollup is a layer three where you just have one DAP deployed 770 00:42:15,760 --> 00:42:16,760 to it. 771 00:42:16,760 --> 00:42:18,520 It's a diverse landscape of applications. 772 00:42:18,520 --> 00:42:22,440 It's being run by a specific application vendor for a specific purpose. 773 00:42:22,440 --> 00:42:27,120 So it's kind of like the Cosmos ecosystem where each app is its own chain. 774 00:42:27,120 --> 00:42:28,400 Yeah, it is. 775 00:42:28,400 --> 00:42:30,800 And I do see application-specific rollups. 776 00:42:30,800 --> 00:42:36,120 Once the tooling advances enough and the technology advances enough, I see those exploding in 777 00:42:36,120 --> 00:42:37,120 use. 778 00:42:37,120 --> 00:42:41,000 Just to come back again to the narratives, I'm curious, how do you think these are actually 779 00:42:41,000 --> 00:42:46,120 created and what actually makes them become so volcanic? 780 00:42:46,120 --> 00:42:47,800 I think it's the hype cycle. 781 00:42:47,800 --> 00:42:50,360 These narratives are based around real utility. 782 00:42:50,360 --> 00:42:52,560 Why were ICOs a compelling narrative? 783 00:42:52,560 --> 00:42:58,680 Because it's a very efficient, pluralistic way of fundraising. 784 00:42:58,680 --> 00:43:01,560 If

you're Joe Average, you don't get to invest in startups. 785 00:43:01,560 --> 00:43:04,520 You're not an accredited investor. 786 00:43:04,520 --> 00:43:08,800 You're kept out of those markets through a bunch of walls, ostensibly to protect you. 787 00:43:08,800 --> 00:43:10,160 In reality, maybe not. 788 00:43:10,160 --> 00:43:14,040 And the ICOs are a very efficient way of raising capital. 789 00:43:14,040 --> 00:43:17,880 All based on the utility and then backing that up with a story. 790 00:43:17,880 --> 00:43:20,400 Yeah, so there is some nexus of value there. 791 00:43:20,400 --> 00:43:23,000 And similarly to why was DeFi a powerful narrative? 792 00:43:23,000 --> 00:43:24,800 Well, because it's useful. 793 00:43:24,800 --> 00:43:28,320 It's a radical new way of doing finance where you don't have centralized actors. 794 00:43:28,320 --> 00:43:30,080 It's going to be a big deal. 795 00:43:30,080 --> 00:43:31,080 It is a big deal. 796 00:43:31,080 --> 00:43:32,440 It's going to be more of a big deal in the future. 797 00:43:32,440 --> 00:43:35,400 And similarly, like NFTs, they're really powerful. 798 00:43:35,400 --> 00:43:40,360 The idea of having a digital fingerprint that represents something, whether it's a ticket 799 00:43:40,360 --> 00:43:43,520 or ownership of an asset or even if it's just digital art. 800 00:43:43,520 --> 00:43:44,520 It's a compelling story. 801 00:43:44,520 --> 00:43:48,160 And similarly with layer twos, they solve one of the existential problems of blockchain, 802 00:43:48,160 --> 00:43:49,920 which is they don't scale very well. 803 00:43:49,920 --> 00:43:51,200 So it's a compelling narrative. 804 00:43:51,200 --> 00:43:54,200 And so they create their own hyper cycles. 805 00:43:54,200 --> 00:43:56,840 And so at the peak, you're going to get to get a lot of people opportunistically using 806 00:43:56,840 --> 00:44:01,160 that narrative to kind of tack onto that project without it being fundamental to what they're 807 00:44:01,160 --> 00:44:02,160 doing. 808 00:44:02,160 --> 00:44:06,480 And I'll tell you something, I suspect that one of the next cycles, it's going to be around 809 00:44:06,480 --> 00:44:08,720 privacy if it hasn't already started. 810 00:44:08,720 --> 00:44:14,880 The Shiba Inu chain, I believe, raised a bunch of money to do privacy, which is interesting 811 00:44:14,880 --> 00:44:15,880 for sure. 812 00:44:15,880 --> 00:44:17,640 I look forward to competing with the dog. 813 00:44:17,640 --> 00:44:18,640 Dog called Shibu. 814 00:44:18,640 --> 00:44:19,640 I do. 815 00:44:19,640 --> 00:44:20,640 Yeah. 816 00:44:20,640 --> 00:44:21,640 I think we need to get with the times. 817 00:44:21,640 --> 00:44:24,520 We need to, you know, our logo is far too minimalistic. 818 00:44:24,520 --> 00:44:25,680 We need to turn it into something else. 819 00:44:25,680 --> 00:44:26,680 Maybe like a Pepe. 820 00:44:26,680 --> 00:44:27,680 Pepe. 821 00:44:27,680 --> 00:44:28,680 Pepe. 822 00:44:28,680 --> 00:44:29,680 Maybe trains. 823 00:44:29,680 --> 00:44:33,320 I think trains are underutilized in the current meme marketplace. 824 00:44:33,320 --> 00:44:34,320 But what do I know? 825 00:44:34,320 --> 00:44:35,320 I'm more a tech guy than a meme guy. 826 00:44:35,320 --> 00:44:37,320 I think Pepe for Pepe privacy. 827 00:44:37,320 --> 00:44:38,320 Yeah. 828 00:44:38,320 --> 00:44:40,720 And I'm sure regular users will love that. 829 00:44:40,720 --> 00:44:41,720 Yes. 830 00:44:41,720 --> 00:44:45,800 Aztec is an legitimate core piece of decentralized financial infrastructure with a Pepe frog 831 00:44:45,800 --> 00:44:46,800 as its logo. 832 00:44:46,800 --> 00:44:47,800 Bullish. 833 00:44:47,800 --> 00:44:48,800 It's a bull signal. 834 00:44:48,800 --> 00:44:49,800 It's a bull signal. 835 00:44:49,800 --> 00:44:55,360 So just to come back to this point of the evolution with two different species competing 836 00:44:55,360 --> 00:44:58,200 for the same thing, right? 837 00:44:58,200 --> 00:45:02,280 Speaking of that, who are the competitors and what are they doing? 838 00:45:02,280 --> 00:45:03,600 There's no competitors right now? 839 00:45:03,600 --> 00:45:05,080 I mean, no, there are. 840 00:45:05,080 --> 00:45:06,080 Okay. 841 00:45:06,080 --> 00:45:07,080 There's three kinds of competitors. 842 00:45:07,080 --> 00:45:12,360 There's privacy focused L2s, there's privacy focused L1s, and there's L2s that could eventually 843 00:45:12,360 --> 00:45:14,120 incorporate privacy into the tech stack. 844 00:45:14,120 --> 00:45:20,920 However, I don't see it as being very, very productive to focus on competitors. 845 00:45:20,920 --> 00:45:24,720 And that's because right now this space is not PvP, it's PvE. 846 00:45:24,720 --> 00:45:25,720 The way I see it. 847 00:45:25,720 --> 00:45:30,360 Like the market for what we're doing at the moment is absolutely tiny because the technology 848 00:45:30,360 --> 00:45:34,880 we're producing doesn't really yet exist in production in any meaningful way. 849 00:45:34,880 --> 00:45:40,120 So I could focus on beating competition and getting more throughput than them or transactions. 850 00:45:40,120 --> 00:45:44,560 But I don't really care because what I care about is growing the market because the market 851 00:45:44,560 --> 00:45:48,160 is multiple orders of magnitude smaller than what it can be. 852 00:45:48,160 --> 00:45:49,320 And that's far more important. 853 00:45:49,320 --> 00:45:53,880 And so right now I think we are in a positive sum game where we all benefit from sharing 854 00:45:53,880 --> 00:45:58,340 technology, sharing research, sharing ideas, sharing innovation, because we're all trying 855 00:45:58,340 --> 00:45:59,880 to grow that pie. 856 00:45:59,880 --> 00:46:04,440 And right now that's far more productive and valuable than fighting over the pie. 857 00:46:04,440 --> 00:46:09,280 So trying to take it all, help others, and then the pie grows in general. 858 00:46:09,280 --> 00:46:11,480 And

then there's more for your share. 859 00:46:11,480 --> 00:46:12,480 Perfect. 860 00:46:12,480 --> 00:46:16,160 And just for our final questions, two final questions actually. 861 00:46:16,160 --> 00:46:21,520 If someone wanted to get into math and get into cryptography and even to your level to, 862 00:46:21,520 --> 00:46:26,320 let's say, go to Aztec or do their own thing, how would you recommend they take that path 863 00:46:26,320 --> 00:46:28,800 to get to this level? 864 00:46:28,800 --> 00:46:30,440 That's a really interesting question. 865 00:46:30,440 --> 00:46:34,440 And honestly, I hate to be a bit wishy washy. 866 00:46:34,440 --> 00:46:39,440 I'm not sure I'm the best person to answer that question because the path I took to where 867 00:46:39,440 --> 00:46:47,760 I am was a rough path, basically, because I was learning about zero knowledge in 2018 868 00:46:47,760 --> 00:46:50,760 when everything was much more primitive, much more undefined. 869 00:46:50,760 --> 00:46:52,280 The learning resources were much cruder. 870 00:46:52,280 --> 00:46:57,920 And so I can't in good faith recommend my path because my path was basically read cryptography 871 00:46:57,920 --> 00:47:05,320 stack exchange and read cryptography papers 18 hours a day, trying to glean some kind 872 00:47:05,320 --> 00:47:06,320 of understanding. 873 00:47:06,320 --> 00:47:09,560 If there's something you don't understand in a paper, but it references another paper, 874 00:47:09,560 --> 00:47:12,040 look at that reference. 875 00:47:12,040 --> 00:47:14,600 And basically follow the trail of references until you go back far enough that you actually 876 00:47:14,600 --> 00:47:16,400 understand something and then keep going. 877 00:47:16,400 --> 00:47:22,440 It was fun, but my God, it was not an efficient way of acquiring information given what we 878 00:47:22,440 --> 00:47:23,800 know today. 879 00:47:23,800 --> 00:47:25,600 So what would I recommend? 880 00:47:25,600 --> 00:47:26,880 I can recommend a few things. 881 00:47:26,880 --> 00:47:29,960 We can even go back to just math in general, right? 882 00:47:29,960 --> 00:47:30,960 Yeah. 883 00:47:30,960 --> 00:47:36,160 I mean, yeah, I've been having some facility with prime fields, like elliptic curves, understanding 884 00:47:36,160 --> 00:47:37,440 what hashes are. 885 00:47:37,440 --> 00:47:39,440 But generally, what would a starting point be? 886 00:47:39,440 --> 00:47:42,360 There's a book called Real World Cryptography by David Wong. 887 00:47:42,360 --> 00:47:43,360 It's very good. 888 00:47:43,360 --> 00:47:44,360 I'd recommend that. 889 00:47:44,360 --> 00:47:50,240 I'd recommend there is a Stanford course that's available for everybody. 890 00:47:50,240 --> 00:47:51,240 I think it's called MOOC. 891 00:47:51,240 --> 00:47:52,240 It's run by Dan Bonet. 892 00:47:52,240 --> 00:47:54,600 It's a pretty intense introduction. 893 00:47:54,600 --> 00:47:58,560 So it's ZKP-MOOC, it's a pretty intense introduction to zero knowledge. 894 00:47:58,560 --> 00:47:59,560 It is thorough. 895 00:47:59,560 --> 00:48:03,240 For something a bit lighter, if you just want to understand this a bit better, I would highly 896 00:48:03,240 --> 00:48:05,440 recommend Anna Rose's ZK podcast. 897 00:48:05,440 --> 00:48:06,440 Oh yes. 898 00:48:06,440 --> 00:48:07,440 Yep, yep. 899 00:48:07,440 --> 00:48:08,440 It is. 900 00:48:08,440 --> 00:48:09,440 Absolutely. 901 00:48:09,440 --> 00:48:14,160 And basically everyone she has on the show, look at what they're doing, look into them, 902 00:48:14,160 --> 00:48:17,840 follow the trail of kind of references and connections. 903 00:48:17,840 --> 00:48:22,800 And also just search around for, there's a bunch of like awesome ZKP zero knowledge lists 904 00:48:22,800 --> 00:48:24,800 which have a bunch of learning resources. 905 00:48:24,800 --> 00:48:28,280 But yeah, that's about the best I can offer, I'm afraid. 906 00:48:28,280 --> 00:48:29,600 What about for just math in general? 907 00:48:29,600 --> 00:48:34,900 Let's say someone is either, hasn't really dabbled in math since like let's say high 908 00:48:34,900 --> 00:48:38,600 school or college and they're down the road doing engineering and they want to get into 909 00:48:38,600 --> 00:48:42,800 math because I know it's very difficult to get into this field if you've never done it 910 00:48:42,800 --> 00:48:46,400 before or even if you've just had spent like years away from it. 911 00:48:46,400 --> 00:48:47,920 Any advice on that front? 912 00:48:47,920 --> 00:48:49,360 It's a good question. 913 00:48:49,360 --> 00:48:54,840 So I'm not sure I can directly answer because I got my mathematics background from a physics 914 00:48:54,840 --> 00:48:55,840 undergraduate degree. 915 00:48:55,840 --> 00:48:59,280 So it's a, which is a slow way of doing it. 916 00:48:59,280 --> 00:49:02,080 You know, if you just want the mathematics background, I can't recommend spending four 917 00:49:02,080 --> 00:49:03,880 years doing physics. 918 00:49:03,880 --> 00:49:07,120 But I can give some general advice, which is don't get too bogged down on the maths 919 00:49:07,120 --> 00:49:11,800 because if you want to understand everything about cryptography, about like all of the 920 00:49:11,800 --> 00:49:15,720 technologies that are being used today in web three from first principles, you're going 921 00:49:15,720 --> 00:49:17,440 to be studying for a very long time. 922 00:49:17,440 --> 00:49:18,880 The trick is to build up abstraction. 923 00:49:18,880 --> 00:49:19,880 For example, elliptic curves. 924 00:49:19,880 --> 00:49:23,160 What do you need to know about an elliptic curve to use them in protocols? 925 00:49:23,160 --> 00:49:25,080 Well, not that much actually. 926 00:49:25,080 --> 00:49:26,560 You need to understand group theory a little bit. 927 00:49:26,560 --> 00:49:29,840 You need to know what a group is and you need to know that elliptic curves, there's an operation 928 00:49:29,840 -->

00:49:34,520 that we call like the elliptic curve group operation, which forms a group under addition. 929 00:49:34,520 --> 00:49:38,920 Once you do that, then you basically, you can treat elliptic curve points like integers 930 00:49:38,920 --> 00:49:39,920 effectively. 931 00:49:39,920 --> 00:49:44,460 You'll see in a lot of cryptography papers when elliptic curve formulas are being described, 932 00:49:44,460 --> 00:49:46,680 they will often have numbers of square brackets. 933 00:49:46,680 --> 00:49:51,520 So like a square brackets for one, square brackets surrounded by like wrapping two. 934 00:49:51,520 --> 00:49:53,840 What that's basically saying is those are equivalence classes. 935 00:49:53,840 --> 00:49:58,040 This is saying this is an elliptic curve point that is equivalent to the integer one or equivalent 936 00:49:58,040 --> 00:50:00,760 to integer two or equivalent to some integer variable X. 937 00:50:00,760 --> 00:50:03,800 And you just treat them like integers. 938 00:50:03,800 --> 00:50:06,680 So do you need to know what a pairing is to do pairing-based cryptography? 939 00:50:06,680 --> 00:50:10,120 Well, at a high level, yes, but you don't need to know how they work. 940 00:50:10,120 --> 00:50:14,480 I've implemented elliptic curve pairing algorithms and I couldn't give you a good explanation 941 00:50:14,480 --> 00:50:18,680 of how they work because it wasn't relevant to my research. 942 00:50:18,680 --> 00:50:19,960 So I never bothered learning. 943 00:50:19,960 --> 00:50:25,200 So I guess it's like my advice would be try to build up abstraction layers. 944 00:50:25,200 --> 00:50:31,440 Often it can help to look at a cryptographic protocol and see kind of the math that is 945 00:50:31,440 --> 00:50:36,080 required and then going back and learning that because like the mathematical grounding 946 00:50:36,080 --> 00:50:40,140 you need for to be a cryptographer, it's number field theory. 947 00:50:40,140 --> 00:50:44,400 But if I tell you, oh, go learn number field theory, you'll be lost in books for a year. 948 00:50:44,400 --> 00:50:49,600 But learning far more than you actually need to just understand the crypt techniques that 949 00:50:49,600 --> 00:50:50,600 are used in Web3. 950 00:50:50,600 --> 00:50:51,600 Got you. 951 00:50:51,600 --> 00:50:55,520 So learn the minimal amounts to actually apply it. 952 00:50:55,520 --> 00:50:56,520 Yeah, basically. 953 00:50:56,520 --> 00:50:57,520 Interesting. 954 00:50:57,520 --> 00:51:03,680 And is there any, for the final question, any general advice for people in general? 955 00:51:03,680 --> 00:51:05,680 In general, just what life advice? 956 00:51:05,680 --> 00:51:06,680 Life advice. 957 00:51:06,680 --> 00:51:07,680 Yeah. 958 00:51:07,680 --> 00:51:09,360 Give us some life advice. 959 00:51:09,360 --> 00:51:12,880 I'm a failed physicist and a cryptographer and a tech entrepreneur. 960 00:51:12,880 --> 00:51:15,000 I am not outside of those domains. 961 00:51:15,000 --> 00:51:17,520 I have no desire to give anyone any advice. 962 00:51:17,520 --> 00:51:19,880 I am afraid those are my expertise. 963 00:51:19,880 --> 00:51:21,520 So why is anyone listening to your podcast? 964 00:51:21,520 --> 00:51:23,100 They're probably interested in Web3. 965 00:51:23,100 --> 00:51:29,800 If you are, then you're already onto a good thing because this is a very dynamic scene 966 00:51:29,800 --> 00:51:33,600 to be a part of because blockchain is still an emerging technology. 967 00:51:33,600 --> 00:51:40,000 It's still an enormous amount to discover and to apply that what we're going to be using 968 00:51:40,000 --> 00:51:43,240 as tech for in three decades will look nothing like what it's being used for today. 969 00:51:43,240 --> 00:51:46,640 So generally, a lot of the people that are attracted to this space are kind of people 970 00:51:46,640 --> 00:51:51,520 who don't really fit in to, you could say the mainstream, right? 971 00:51:51,520 --> 00:51:55,760 People who maybe you've tried jobs in other careers, they just don't click with you. 972 00:51:55,760 --> 00:51:58,040 You get the sense of impending dread or doom about your life. 973 00:51:58,040 --> 00:51:59,520 You're like, I have to do something else. 974 00:51:59,520 --> 00:52:01,560 And you're here because blockchain is interesting. 975 00:52:01,560 --> 00:52:02,840 Now I may be projecting it a little bit. 976 00:52:02,840 --> 00:52:06,080 This isn't everyone, but I do think it covers a lot of people. 977 00:52:06,080 --> 00:52:09,440 And I guess, where am I going with this? 978 00:52:09,440 --> 00:52:15,880 Basically, this is a very special place in a very special moment in time that's going 979 00:52:15,880 --> 00:52:19,160 to not be here in 10 years. 980 00:52:19,160 --> 00:52:21,480 So make the most of it. 981 00:52:21,480 --> 00:52:24,280 Don't run away because it's scary and it's fellow degenerates. 982 00:52:24,280 --> 00:52:27,880 There's gold in these hills if people are willing to dig to find it. 983 00:52:27,880 --> 00:52:28,880 Definitely. 984 00:52:28,880 --> 00:52:32,520 Well, man, Zach, I appreciate the time very much. 985 00:52:32,520 --> 00:52:34,360 And I've learned a lot about cryptography. 986 00:52:34,360 --> 00:52:35,960 I was never really into it. 987 00:52:35,960 --> 00:52:37,320 And this was very interesting. 988 00:52:37,320 --> 00:52:38,320 I'm glad. 989 00:52:38,320 --> 00:52:39,320 Thank you. 990 00:52:39,320 --> 00:52:42,920 I hope to see the future of Aztec and future of your career as well. 991 00:52:42,920 --> 00:52:46,080 Probably will have you on later down the road for the mainet. 992 00:52:46,080 --> 00:52:47,080 Hopefully. 993 00:52:47,080 --> 00:52:48,920 I look forward to it. 994 00:52:48,920 --> 00:52:54,680 When privacy is the main narrative in the crypto scene, quite soon. 995 00:52:54,680 --> 00:52:56,680 And call me out if that doesn't happen. 996 00:52:56,680 --> 00:52:58,040 I'll call you out. 997 00:52:58,040 --> 00:52:59,040 Don't worry. 998 00:52:59,040 --> 00:53:00,040 I got you. 999 00:53:00,040 --> 00:53:01,360 Otherwise, it's been a pleasure, Zach. 1000 00:53:01,360 --> 00:53:02,360 Thank you so much. 1001 00:53:02,360 --> 00:53:03,800 Thank you for having me on. 1002 00:53:03,800 --> 00:53:04,800 Of course. 1003 00:53:04,800 --> 00:53:05,800 And take care. 1004 00:53:05,800 --> 00:53:10,600 Bye.