Latest / TezTalks Radio - Tezos Ecosystem Podcast / 122: Inside TzEL and the Future of Private Payments on Tezos

Transcript

122: Inside TzEL and the Future of Private Payments on Tezos · TezTalks Radio - Tezos Ecosystem Podcast

• 0:13
  SPEAKER_00: Today I am joined by Arthur Breitman, co-founder of Tezos.
• 0:18
  SPEAKER_00: We're here to talk about Zell, an experimental project exploring private post-quantum payments on Tezos Testnet.
• 0:26
  SPEAKER_00: The question behind it is simple.
• 0:28
  SPEAKER_00: If public blockchain data can remain available indefinitely, what would it take for private transactions to stay private years from now?
• 0:38
  SPEAKER_00: Arthur, thanks for joining us.
• 0:41
  SPEAKER_01: Thank you for having me.
• 0:43
  SPEAKER_00: It's our pleasure.
• 0:45
  SPEAKER_00: Most people think about blockchain privacy as a present-day question.
• 0:50
  SPEAKER_00: Can someone see this transaction right now?
• 0:53
  SPEAKER_00: But public blockchain data can stick around indefinitely.
• 0:57
  SPEAKER_00: Is the right starting point here that blockchain privacy has a time problem?
• 1:04
  SPEAKER_01: Uh so the the answer is partially yes.
• 1:08
  SPEAKER_01: And I used to think that it didn't.
• 1:10
  SPEAKER_01: And let me explain a little bit.
• 1:13
  SPEAKER_01: So most of the systems which have been used to provide privacy on blockchains have relied on zero knowledge proofs.
• 1:23
  SPEAKER_01: And a zero knowledge proof, the zero knowledge part that you get, it comes from information theory.
• 1:30
  SPEAKER_01: So the information is just not there.
• 1:32
  SPEAKER_01: It's not encrypted in a way that you can't find it, it's just not there.
• 1:35
  SPEAKER_01: And so it doesn't matter if you have quantum computers or whatever you have, the laws of physics tell or not even mathematics tells you like you can't access it.
• 1:44
  SPEAKER_01: So I thought, okay, this is all safe.
• 1:46
  SPEAKER_01: You might be able to forge fake proofs in the future, but you won't be able to see the data.
• 1:52
  SPEAKER_01: And the picture is a little more complex than this.
• 1:55
  SPEAKER_01: Because when you make those transactions on most systems today, I don't just go and tell you, hey, by the way, uh I've made a transaction and you know you should check your your your balance.
• 2:08
  SPEAKER_01: You have a transaction for convenience.
• 2:11
  SPEAKER_01: Um, an encrypted memo is added to the blockchain.
• 2:16
  SPEAKER_01: And it's way more convenient like this because I don't have to like, you know, if I receive a payment from you, I don't have to give you my email address, I don't have to give you a way to reach me with information, I can just receive it.
• 2:27
  SPEAKER_01: That's important.
• 2:29
  SPEAKER_01: But it means you have an encrypted memo that sticks around.
• 2:32
  SPEAKER_01: And that memo is encrypted with a key that can itself be cracked by quantum computers.
• 2:40
  SPEAKER_01: So if you look at a system like um the sapling circuit on Tezos today, and of course, sapling came from Zcash, so it applies to Zcash as well.
• 2:49
  SPEAKER_01: Um it's not as bad as, oh my god, everything is going to be decryptable.
• 2:55
  SPEAKER_01: The scenario is the following.
• 2:56
  SPEAKER_01: If you know someone's public key and you have a quantum computer, you'll be able to decrypt the memos, which is why usually it's recommended to like not reuse your public key, give every single person a different public key.
• 3:08
  SPEAKER_01: It's not always practical.
• 3:09
  SPEAKER_01: People don't always do this.
• 3:10
  SPEAKER_01: And so, unless you have really, really good hygiene today in using the systems, um, there's a risk that if you use someone with your public key and access to quantum computers, maybe not you know, not next month, maybe in 10 years, maybe in three years, um, can decrypt those messages.
• 3:30
  SPEAKER_00: Permanence is the part worth staying with for a moment.
• 3:33
  SPEAKER_00: If encrypted private transaction data remains part of the public record, privacy has to be judged across time, not only at the moment the transaction happens.
• 3:43
  SPEAKER_00: So, what does it mean for a private transaction to have a long memory?
• 3:49
  SPEAKER_01: Well, that that that's the thing is uh every transaction on a blockchain is essentially like broadcast publicly, and and and and a trick to to to you know it it's it's an it's an abnormal type of affair, right?
• 4:03
  SPEAKER_01: That before blockchains, there are no system in which all the transactions are public.
• 4:07
  SPEAKER_01: It's kind of it's it's kind of weird.
• 4:09
  SPEAKER_01: Uh and privacy preserving solutions on blockchain restore some normalcy, right?
• 4:14
  SPEAKER_01: What they do is say, look, we're going, you know, if we're not going to like broadcast it for everyone, we're going to encrypt it.
• 4:19
  SPEAKER_01: And then because it's encrypted and we still need to check it that it's valid, we'll have a proof that it's valid.
• 4:24
  SPEAKER_01: So you'll have an encrypted transaction with a proof that it's valid.
• 4:27
  SPEAKER_01: Uh and and that can restore a little bit like the status quo.
• 4:30
  SPEAKER_01: What would you expect out of like a normal payment system?
• 4:34
  SPEAKER_01: Uh it's not a radical thing, it's it's fairly normal thing to do, uh, although it's it's been framed a bit differently.
• 4:40
  SPEAKER_01: Uh now on a block, you know, on a blockchain, typically, if your information is public, the fact that it sticks around forever doesn't really make a difference because I would say like as long as your information is public once, we should assume it's going to stick around forever.
• 4:58
  SPEAKER_01: Like you should not, like your privacy should not rely on the fact that someone is going to kindly delete the data.
• 5:03
  SPEAKER_01: Uh and it gets a bit different once you start talking about data that is encrypted.
• 5:10
  SPEAKER_01: Um, there's a concept that people talk about for quantum computers called harvest now, decrypt later, where an adversary could you know get a bunch of encrypted messages and they can't decrypt them now, but later on with quantum computers they have access to it and they can uh decrypt it uh retroactively.
• 5:28
  SPEAKER_01: And usually it's not really a problem that blockchains have, because in general, there is nothing to decrypt, right?
• 5:35
  SPEAKER_01: The problem that blockchains have is at some point in the future you can forge transactions, but as long as you migrate before that, the old transactions are what they are, they're not going to change, they're in past blocks, they're not they're not.
• 5:46
  SPEAKER_01: So as long as you migrate to your keys, you'll be fine.
• 5:49
  SPEAKER_01: It's a bit different once you start having encryption come into play, and that's where you know like the privacy-preserving systems do involve some encryption, and so to some extent, they are subject to this harvest now decrypt later problem.
• 6:04
  SPEAKER_00: Well, this turns a general cryptocurrency concern into a specific engineering problem: private payments, long-term data exposure, post-quantum assumptions, and a roll-up-based implementation.
• 6:18
  SPEAKER_00: What made this problem interesting enough for you to work on personally?
• 6:24
  SPEAKER_01: Oh, I mean, it's it's it's super interesting to begin with.
• 6:27
  SPEAKER_01: I think it's like it's it's it's a really interesting uh engineering challenge to be in with.
• 6:33
  SPEAKER_01: It hasn't really been done.
• 6:34
  SPEAKER_01: I think like I don't want to make a blanket statement because a lot of people are doing a lot of crypto projects.
• 6:39
  SPEAKER_01: I haven't heard of any crypto projects having um quantum resistance uh privacy.
• 6:44
  SPEAKER_01: There may be some tests out there, and and you know, Tell itself is only uh a test net right now, so it's not it's not in production.
• 6:51
  SPEAKER_01: Um but I wanted to challenge myself a little bit.
• 6:55
  SPEAKER_01: Uh and I also thought that you know, part of the problem with the systems is that the proofs from uh post-quantum systems are a bit heavier than what you can get with a lot of like the elliptic curve family of you know of constructions will give you more efficient proofs.
• 7:16
  SPEAKER_01: So because they're a bit heavy, people have considered that this was not very practical.
• 7:20
  SPEAKER_01: But then I remembered that Tizzos has a DAL, a datability layer that actually lets us put a lot of like, you know, is the data you don't really need to know what to do on the blockchain, but to check that it's valid.
• 7:32
  SPEAKER_01: And that's exactly what a proof is.
• 7:33
  SPEAKER_01: And so I figured, wait a second, we can actually put those proofs on the DAO, the data ability layer, and because we have this, it makes it like a really interesting fit.
• 7:43
  SPEAKER_01: Um, I also wanted to um, you know, I I've been doing more uh more agent coding uh uh as of late, um, it's given me an opportunity to to go back and to like uh and and find the time to actually do direct uh direct contribution.
• 7:59
  SPEAKER_01: And it was quite interesting.
• 8:01
  SPEAKER_01: I think there's a misconception that uh if you use agency coding somehow you're going to like make a lot of bugs and have all these problems, and it's certainly possible uh to fall into that trap.
• 8:13
  SPEAKER_01: Um, I don't think it works like this.
• 8:15
  SPEAKER_01: I think I think what it does is that it makes it a lot easier um to develop.
• 8:20
  SPEAKER_01: And uh there was actually uh this is inspired by by something like Vidalek Butterin was actually saying this morning, but it's I think it's completely true.
• 8:29
  SPEAKER_01: It's like it made like programming with bugs went from like normal to extremely easy, and programming with like a high level of security came from extremely hard to now like just moderate.
• 8:42
  SPEAKER_01: And I think if you you know if you use the right approaches, uh in particular if you use you know you can use tools for informal verification, um, you can uh do multiple uh implement separate implementations, uh, you can rely on very, very strong unit tests.
• 8:55
  SPEAKER_01: So if you have all of this like knowledge of good security practices for writing robust code, you can actually elicit really, really strong uh systems out of it.
• 9:04
  SPEAKER_01: Uh, I also wanted to be more familiar with uh some of the post-quantum uh you know proving uh tools that exist out there.
• 9:13
  SPEAKER_01: You know, and part of this also stemmed from a general push um that or drives that I've had to really try to figure out the post-quantum situation for Tezos.
• 9:25
  SPEAKER_01: So I would think I don't think you know that there's today there's not a lot of like people using um the sampling tools that are available on Tezos.
• 9:33
  SPEAKER_01: So this is not a burning need.
• 9:36
  SPEAKER_01: Uh more pressing is uh converting Baker signatures into post-quantum signatures and having like aggregation around it.
• 9:43
  SPEAKER_01: Uh the DAO itself, you know, it's it's the DAO itself also needs to be moved to a post-quantum system.
• 9:49
  SPEAKER_01: We have some pretty good ideas on how to do this.
• 9:51
  SPEAKER_01: I wanted to become more familiar with it.
• 9:53
  SPEAKER_01: Um and so I've I've been making experiments.
• 9:56
  SPEAKER_01: So Zale now is like available as a as a as a test net, it's something that can be used, but uh actually I've spent quite a bit of time on data availability layers uh and and and proof aggregation for uh for bakers as well, which is you know less visible, uh less fun, but probably a bigger priority as well.
• 10:16
  SPEAKER_00: The less visible updates we I we find ourselves often going, what's going on?
• 10:21
  SPEAKER_00: We only feel the work, we never see the results, but we do appreciate them.
• 10:25
  SPEAKER_00: So thank you.
• 10:27
  SPEAKER_00: Post-quantum cryptography makes long-term protocol design very concrete.
• 10:32
  SPEAKER_00: The assumptions underneath the system can change.
• 10:35
  SPEAKER_00: Does post-quantum cryptography make the need for long-term protocol adaptability more concrete?
• 10:43
  SPEAKER_01: Uh it does.
• 10:44
  SPEAKER_01: I mean, I I think that that need has always been present, and to a large extent, I would say a lot of protocol designs have converged.
• 10:54
  SPEAKER_01: I think there's like a consensus.
• 10:56
  SPEAKER_01: Well, among a small group of people, there's a consensus as to what constitutes a good design for a blockchain.
• 11:04
  SPEAKER_01: Um that consensus is not reached like Solana, for example.
• 11:08
  SPEAKER_01: I but uh there's a group, you know, among like I would say, like, you know, blockchain researchers, uh, I think there's a general idea on how to scale.
• 11:17
  SPEAKER_01: So to some extent, uh when I started working on Tezos, there was a lot to be discovered, a lot to be done.
• 11:25
  SPEAKER_01: It wasn't even clear how to do proof of stake.
• 11:28
  SPEAKER_01: It wasn't even clear what form smart contracts should have.
• 11:31
  SPEAKER_01: A lot of these questions have been answered.
• 11:33
  SPEAKER_01: Um, and but for the longest time, you know, post-quantum was a big one.
• 11:36
  SPEAKER_01: Uh, and it's one that everyone will eventually have to face.
• 11:40
  SPEAKER_01: Uh once you have like systems that completely scale and are post-quantum, will there be problems that you need to uh yes, probably they're harder to foresee.
• 11:49
  SPEAKER_01: I think you always needed adaptability.
• 11:52
  SPEAKER_01: Uh the difference is that at one point uh the problems you were gonna have were kind of foreseeable.
• 11:57
  SPEAKER_01: And then you know, once you have systems that like completely scale, are private, are secure, uh, and are you know quantum resistant, it's we don't know what the uh what the what the what the topics will be.
• 12:11
  SPEAKER_00: The oh you're fine.
• 12:14
  SPEAKER_00: The claims around Zell need a careful boundary.
• 12:17
  SPEAKER_00: People can hear post-quantum or private payments and run too far with the claim.
• 12:22
  SPEAKER_00: What should people be careful not to claim about Zell?
• 12:25
  SPEAKER_01: Oh boy, oh well, first of all, that is you know production ready.
• 12:29
  SPEAKER_01: Uh, I think it needs like, I mean, there's been quite a bit of work actually going on into like ensuring the the the security of it, but it's still proper audits, uh, it still needs proper integration into wallets before it could be uh before it can be used uh on chain.
• 12:45
  SPEAKER_01: Um there's also the fact that um whilst you know the entire system is is post-quantum, one solution to the um decrypt now and harvest later problem would have been to not make the entire system post-quantum, but just the encryption part.
• 13:00
  SPEAKER_01: So like just the part where you encrypt it.
• 13:03
  SPEAKER_00: Oh no.
• 13:04
  SPEAKER_01: Oops, sorry, I dropped.
• 13:06
  SPEAKER_01: Uh can you still see me?
• 13:08
  SPEAKER_00: Yes.
• 13:09
  SPEAKER_01: Yeah, so I was saying uh one possibility would have been to just do the encryption part in a post-quantum way and not the you know the whole rest.
• 13:18
  SPEAKER_01: It was interesting, right?
• 13:19
  SPEAKER_01: As a as a bit of a proof of concept to say, like, can we do the whole stack post-quantum?
• 13:23
  SPEAKER_01: With that said, it runs as a rollup on Tezos and which itself has a not a post-quantum you know architecture, it still has like elliptic curve or maker signatures.
• 13:33
  SPEAKER_01: The DAO itself relies on on the KCG proof.
• 13:35
  SPEAKER_01: So whilst like by itself is fully you know like quantum resistant, it runs on a non-quantum resistant system, right?
• 13:42
  SPEAKER_01: So that that that that's something to bear in mind.
• 13:44
  SPEAKER_01: Uh, so it's it's definitely uh about starting to get familiar with this technology and you know demonstrating it, getting used to it.
• 13:54
  SPEAKER_01: Uh, it was also a way to experiment with like um different technologies around um like what is a good circuit uh for uh uh for uh for um sorry for shielded transactions.
• 14:10
  SPEAKER_01: So there's a lot of good ideas in sapling, like uh um you know viewing keys, like inbound viewing keys, outbound viewing keys, delegated proving.
• 14:19
  SPEAKER_01: There were others that came from other circuits.
• 14:20
  SPEAKER_01: So Penombra had this concept of um detection key where you can scan the blockchain and see if a transaction is probably yours or like probably of interest to you, but you don't know anything of the content.
• 14:35
  SPEAKER_01: And that's very useful if you have like a wallet service.
• 14:37
  SPEAKER_01: You can just give it this key and say, like, hey, you might be interested in this, and then and then you can take it and look at it, as opposed to giving them a fuel, a full viewing key.
• 14:46
  SPEAKER_01: Um, and yeah, at some point, like you can you can start building all this like Legos, and uh it's it's really interesting to be able to like construct the circuits and have all the properties you uh uh you want.
• 14:58
  SPEAKER_00: A working prototype can be valuable without being a finished product, it can show a design path is real while still leaving review, testing, and hardening ahead.
• 15:08
  SPEAKER_00: What does this prototype prove and what does it still leave unproven?
• 15:12
  SPEAKER_01: Uh well, one, it proves we can do it.
• 15:15
  SPEAKER_01: Uh two, it proves uh intent and interest in doing it.
• 15:19
  SPEAKER_01: I think a lot of people are not going to bother uh doing this, and this is you know, I think something that at some point uh should be a part of uh Tezos X in the same way that you know if you wanted to create um chiclet transaction as part of a smart contract on Tezos, you've been you know able to do that for a few years.
• 15:34
  SPEAKER_01: Uh, you know, that should remain possible uh on you know on a post-quantum system.
• 15:39
  SPEAKER_01: When we've discussed transaction to post-quantum, we identified the list of let's say with some you know different core teams working on uh on a on a Tezos protocol, uh have identified the parts that you need replacing, and you know, there were signatures for transactions, uh aggregation of signatures for bakers, the databability layer, the randomness generation from uh the VDF, and then certain vehicles and primitives like sapling.
• 16:06
  SPEAKER_01: So that's a drop-in replacement for that, and uh uh some um uh some time lock puzzles, which are are really used.
• 16:16
  SPEAKER_01: So I don't think this one is like a big uh a big priority.
• 16:19
  SPEAKER_01: So this is like one one brick uh out of uh out of what comes.
• 16:25
  SPEAKER_00: So what had to be built for this to become sort of an end-to-end system rather than just a paper design?
• 16:32
  SPEAKER_01: Tasles have to be built.
• 16:34
  SPEAKER_01: That's the thing.
• 16:35
  SPEAKER_01: It's like it's um we had to have uh database layer, we had to have uh a L1 blockchain, we had to have a rollup stack.
• 16:45
  SPEAKER_01: But it is interesting, it is uh you know exciting that it is actually like now quite pragmatic to go out and like build a rollup kernel.
• 16:55
  SPEAKER_01: I just you know that that just works, and there's extremely good documentation for doing it.
• 16:59
  SPEAKER_01: It's a lot of good code examples, so you can build your rollup kernel now and uh and try a lot of things, and you have you know you have the infrastructure in place to do it.
• 17:09
  SPEAKER_01: But internally, um the you know the the parts about it are essentially they are there there's there are the circuit the circuit parts, which are about like making the proofs that you want to make, a bit of wiring uh around uh around the proofs and around encryption of notes, a bit of infrastructure around like how to send transactions, how to have like remote provers, uh and uh uh and a bit of uh uh smart contract code to do bridging of assets between uh uh L1 and uh uh and the roll-up.
• 17:43
  SPEAKER_00: Now, once something becomes a running system, the clean design meets friction.
• 17:48
  SPEAKER_00: Some parts get harder, some parts get clearer, some assumptions get tested in ways a spec can't fully show.
• 17:56
  SPEAKER_00: What did you only learn once this became a working prototype?
• 18:10
  SPEAKER_01: I mean they were there were learnings around uh around the way.
• 18:13
  SPEAKER_01: Like I made some mistakes and I fixed them and realized like I had like thought of thought of it like you know, you know, so sort of things in the right way, sort of other things in the wrong way.
• 18:22
  SPEAKER_01: Um but I don't think at the end there was like a particularly like salient lesson.
• 18:30
  SPEAKER_01: You know, it's like the small lessons, but you know, the lessons are the fact of like, ah yes, you really need a two-phase commit for bridging, otherwise, you know, your your your tokens can get stuck on a bridge, like this type of like bug that are easy, you know, like that you can make easily with uh with a roll-up.
• 18:45
  SPEAKER_01: So like very, very lessons very, very specific to roll-up construction and not like particularly of general interest.
• 18:53
  SPEAKER_00: Perfect.
• 18:54
  SPEAKER_00: Well, proof size is one of the hardest constraints here.
• 18:57
  SPEAKER_00: Post-quantum friendly privacy can bring heavier proof data and larger proof data changes when the system needs it underneath.
• 19:04
  SPEAKER_00: Why does proof size matter so much on a blockchain?
• 19:08
  SPEAKER_01: Well, on a typical blockchain, if you don't have a tabability layer, everyone needs to download all the data.
• 19:16
  SPEAKER_01: And so, you know, the the proofs are about 300 kilobytes per transaction.
• 19:21
  SPEAKER_01: And so if you only have like 10 transactions per second in a system like this, that would already be three megabytes per second that everyone has to download.
• 19:30
  SPEAKER_01: If you have 100 transactions per second, that's like 300 megabytes.
• 19:34
  SPEAKER_01: So it's it's too much to push on a on a layer one.
• 19:37
  SPEAKER_01: It's far more appropriate to do this on uh a data ability layer because what the data availability layer does is that it shards this responsibility so that many people download small pieces of the data and can reconstruct it together.
• 19:53
  SPEAKER_01: It still requires a rollup operator to download all the data, but or any rollup operator, it's not a single operator, but anyone running in a rollup node needs to download all of the data.
• 20:04
  SPEAKER_01: However, that's fewer people and they may have more performant hardware, more performant bandwidth in order to do that.
• 20:12
  SPEAKER_00: What does the Tesos Dow change about the design space?
• 20:16
  SPEAKER_01: I think it opens it up to uh uh to systems which need more data to run, like more witness data, bigger proofs, these type of things.
• 20:26
  SPEAKER_01: And and what people have contemplated in the past is doing proof aggregation.
• 20:31
  SPEAKER_01: So where you'd have like a roll-up upper, you know, a roll-up sequencer which does more than sequencing, which also takes the proofs, aggregates them, and then puts an aggregated proof.
• 20:41
  SPEAKER_01: Um, but that gives a lot of like power, uh, not so much power, but it it gives a lot of importance to that to that sequencer.
• 20:50
  SPEAKER_01: There's no sequencer right now in this uh in Zell.
• 20:53
  SPEAKER_01: And I think like people can be shy to be a sequencer for a system that does shield the, you know, that that purely does shield the transactions.
• 21:05
  SPEAKER_00: Yeah, that's fair.
• 21:07
  SPEAKER_00: Uh this also raises the question.
• 21:09
  SPEAKER_00: Zell puts heavier cryptographic work in a roll-up rather than forcing every detail onto layer one.
• 21:15
  SPEAKER_00: Is this the broader pattern?
• 21:17
  SPEAKER_00: Heavier cryptographic systems run in roll-ups while the Tezos protocol provides settlement and data availability?
• 21:24
  SPEAKER_01: So the load isn't that much.
• 21:27
  SPEAKER_01: Like verifying some verifying a proof is fairly fast.
• 21:31
  SPEAKER_01: Uh, it's not as fast as verifying a signature, but it's not messy.
• 21:34
  SPEAKER_01: Like the computational cost is really on the side of the prover.
• 21:37
  SPEAKER_01: Like building the proof takes a lot of RAM, takes a lot of CPU.
• 21:41
  SPEAKER_01: Verifying the proof is fairly, fairly fast and fairly easy.
• 21:44
  SPEAKER_01: Um, but in general, I would say it's it's it's it's it's all com you know, all computation, all of that can go on uh is much more efficient to put that into uh um it's in into construct it at at a layer two system rather than at the layer one system.
• 21:59
  SPEAKER_01: So, you know, like uh A clean separation is that your layer one focuses on consensus uh and stacking.
• 22:06
  SPEAKER_01: So that that gives you a platform where you can like basically timestamp your and decide that and and have a data ability.
• 22:14
  SPEAKER_01: So you can say, like at this point, you know, like this blob of data was available, and then behind that, you have systems figure out like where is the data, download the data, execute the data, do all of this.
• 22:23
  SPEAKER_01: But the point is, like you need a single honest participant to do this.
• 22:27
  SPEAKER_01: Whereas on a rollup, you would need like sorry, not on the L1, you need an honest majority.
• 22:34
  SPEAKER_01: So, like for the L1, you want to be more conservative, you want people to do, you know, you want the validators to do less to really focus on like data line security of the system, less so on the performance.
• 22:45
  SPEAKER_01: So it's kind of like a you know, you separate your security in your performance, and that's a really elegant way to scale.
• 22:53
  SPEAKER_00: Private payments still need practical controls.
• 22:57
  SPEAKER_00: Users need ways to detect payments, recover information, and reveal specific details when needed.
• 23:03
  SPEAKER_00: How should people think about viewing keys, detector keys, and selective disclosure in a private payment system?
• 23:11
  SPEAKER_01: Yeah, so you know, there's there's the version of all these protocols where you don't have viewing keys, you don't have any of this.
• 23:18
  SPEAKER_01: Everyone just runs a node that always listens to the uh to the blockchain and that all that happens.
• 23:24
  SPEAKER_01: And that's not very practical if you're not always online, if you want to use a wallet on your phone, if you do different things.
• 23:31
  SPEAKER_01: And I think that was one of the like one of one bit of um of Zcash early on that was really inspired was thinking through all these different keys and all these different delegations that you might need.
• 23:41
  SPEAKER_01: And you have this idea of like a master key that gives you that lets you do everything, and then you can derive and devolve like small powers to different parties.
• 23:50
  SPEAKER_01: So the idea of the viewing keys, for instance, is like look, you don't want to listen to every single block on the on the chain.
• 23:56
  SPEAKER_01: So you could give someone your viewing key or give a wallet your viewing key without your spending key.
• 24:00
  SPEAKER_01: Maybe your spending key stays on the hardware and like your computer only has your viewing key, but then it can download all this transaction and tell user yours.
• 24:07
  SPEAKER_01: If you have a detection key, you can even do something a bit better.
• 24:09
  SPEAKER_01: You have a service you give the detection key to, and with some error rates, we say, like, oh, maybe that transaction is yours, right?
• 24:16
  SPEAKER_01: So you get a subset of the transactions.
• 24:18
  SPEAKER_01: Then maybe you have another service which has a little more, which has your viewing key and say, like, oh yeah, that's that's what's happening here.
• 24:25
  SPEAKER_01: And then you can spend and you can do all the things.
• 24:28
  SPEAKER_01: So it really lets you use external services, but only give like a minimal amount of power to these services.
• 24:35
  SPEAKER_01: Likewise, there's a possibility to use an external prover.
• 24:38
  SPEAKER_01: I think that's important because the prover does take a lot of CPUs.
• 24:41
  SPEAKER_01: Like on a beefy machine, you can do prof the proofs in seconds, but it will still they will still still take like loads and loads of RAM, more RAM than people might have even on their laptop, for example.
• 24:51
  SPEAKER_01: So you want to, if you want to use an external prover, um that maybe you're going to disclose some stuff to the prover.
• 24:56
  SPEAKER_01: The prover might know what the transaction is, but you don't want a prover to be able to spend your funds.
• 25:00
  SPEAKER_01: So you only trust the prover not to go around and like tell everyone a statement that they proved, uh, but not to not spend your money.
• 25:07
  SPEAKER_01: So, like again, that's a proving key.
• 25:10
  SPEAKER_01: Uh in terms of the selective disclosure, I think it's also uh, and this is again something that was introduced by by Zcash culturally, this idea of thinking about privacy not as hiding, but as selective disclosure.
• 25:26
  SPEAKER_01: And that's a default.
• 25:27
  SPEAKER_01: You know, when you when you when you have documents, you know, in in your home, when you have emails, all of that, you know, they're not like hidden, it's just that it's disclosure.
• 25:37
  SPEAKER_01: You choose who you're going to disclose to.
• 25:40
  SPEAKER_01: And legal systems are completely already well equipped with dealing with this type of information.
• 25:46
  SPEAKER_01: You know, it's called a subpoena, or it's called discovery.
• 25:49
  SPEAKER_01: You know, if uh if the if the police seems, you know, like thinks you've done something wrong, and you know, they can go uh to your uh they can go to your email provider and try to subpoena the emails, for example.
• 26:01
  SPEAKER_01: Uh or they can, you know, they can they they they can so in the US, for example, uh it's the legal system most people are familiar with because of the because of movies and and and and TV shows.
• 26:14
  SPEAKER_01: If they're not being familiar with their own legal systems, because they may not have faced it.
• 26:18
  SPEAKER_01: But like you'll have this thing where you say, like, well, you know, you might not have to testify against you, but like if you want to defend yourself, you better be able to like actually like show up evidence, and so you have to disclose these things.
• 26:27
  SPEAKER_01: Um, that's a concept of selective disclosure.
• 26:29
  SPEAKER_01: You choose who you disclose to.
• 26:31
  SPEAKER_01: And from uh even from a regulatory perspective, you can think of regulation this way.
• 26:35
  SPEAKER_01: You can tell people, like, look, maybe you know, you get audited.
• 26:40
  SPEAKER_01: For example, you get a tax audit, and they might come in and say, like, well, you know, you have to show us those words, sir.
• 26:44
  SPEAKER_01: Never well, you know, it's very, it's it's it's it's a very uh it's like it's very high-stake paperwork, it's very annoying.
• 26:52
  SPEAKER_01: I've I've had tax audits, it's uh it's not it's not pleasant, just takes a long time.
• 26:58
  SPEAKER_01: Um, I do have a note on this, but I'll I'm gonna I'm gonna put a pin on it.
• 27:02
  SPEAKER_01: Um, but let's say you know this happened.
• 27:04
  SPEAKER_01: Yeah, they can they can make you disclose it when we see your transaction, you show your key.
• 27:08
  SPEAKER_01: And on a blockchain, it's weird because on a blockchain by default you disclose it to everyone.
• 27:13
  SPEAKER_01: And so I think this notion of selective disclosure is important to get people to understand that there's nothing weird about the privacy, you're not hiding it.
• 27:20
  SPEAKER_01: You're not hiding it.
• 27:21
  SPEAKER_01: You're saying, like, no, I'm just like not giving it to everyone.
• 27:24
  SPEAKER_01: And you know, if you want to know what a transaction is, uh, you know, like and you have a legal right to know, then you can go and assert the legal right, and then you can compel me, you know, and and and then you know, like you can either like put me in contempt of court for not showing my key, you do whatever you want, but like by default, you're not just going to like force me to like broadcast it to the entire world to see.
• 27:45
  SPEAKER_01: And I think that's like a very reasonable way to look at the uh uh to look at the question.
• 27:51
  SPEAKER_01: I'm actually saying assuming we have the you know, as assuming, you know, first of all, it's it's it's very silly to to cheat on your taxes.
• 27:58
  SPEAKER_01: Don't don't don't don't don't do it, it's just it's it's it's not it's not worth it, it's not worth it.
• 28:04
  SPEAKER_01: Uh, but with that said, even if you don't, even if you've done everything right and you get audited, it's still a massive pain in the eyes.
• 28:09
  SPEAKER_01: Um the thing that's really useful though is like age, you know, coding agents really, really good at chasing paperwork throughout your inbox and through your documents.
• 28:20
  SPEAKER_01: And a thing that used to be extremely proof painful in terms of like chasing everything, chasing you know, like finding all the receipt, finding all of this.
• 28:28
  SPEAKER_01: Um, you can now do it for a fraction of the cost and a fraction of the time.
• 28:31
  SPEAKER_01: And so I think that reduces the pain immensely if it, you know, if you know, if God forbid it happens to anyone.
• 28:36
  SPEAKER_01: Uh are you using cloud code?
• 28:38
  SPEAKER_01: Are you using OpenClaw, Hermes agent?
• 28:41
  SPEAKER_01: No, I use mostly cloud code and uh and and codecs uh quite a bit.
• 28:44
  SPEAKER_01: And with some frameworks that I have around them.
• 28:48
  SPEAKER_00: Okay, interesting.
• 28:49
  SPEAKER_00: Yeah, I'm just curious what you sorry, aside.
• 28:53
  SPEAKER_01: No, I mean it's it's it that's the thing.
• 28:55
  SPEAKER_01: It's like people think of them as coding agents.
• 28:56
  SPEAKER_01: They're actually quite good at um admin tax task, admin task and chasing paperwork.
• 29:02
  SPEAKER_00: Right, yeah.
• 29:03
  SPEAKER_00: I'm seeing like I think Anthrooptic just dropped a legal seal for Claude recently.
• 29:07
  SPEAKER_01: So there's uh yeah, but we know without even without even this, it's like you know, a simple question is like I don't know how many, like how many, how many days have you spent in this country?
• 29:20
  SPEAKER_01: If you travel a lot, then again, it can actually be a tricky question.
• 29:24
  SPEAKER_01: Um, you know, here's my calendar, here's my email.
• 29:28
  SPEAKER_01: Figure it out.
• 29:30
  SPEAKER_00: Well, Zell shows one side of what can be built on Tezos, other use cases bring out different parts of the infrastructure.
• 29:38
  SPEAKER_00: Outside of Zell, is there anything being built right now that's got your attention as well?
• 29:44
  SPEAKER_01: Uh, I mean, I I I I took a particular interest in like the post-quantum stuff.
• 29:48
  SPEAKER_01: So, like um, there's really interesting uh techniques for doing data availability in a post-quantum way, which are actually quite uh quite efficient.
• 29:56
  SPEAKER_01: Uh so I'm looking uh I'm looking at that.
• 29:59
  SPEAKER_01: Uh it's really fun because it's really like you know like deep core engineering.
• 30:04
  SPEAKER_01: Uh, but there's also you know uh activity happening on the app stuff.
• 30:07
  SPEAKER_01: I'm also like I really like the developments with metals.io uh which like are are pushing more metals and more more products out there.
• 30:15
  SPEAKER_01: That's quite interesting.
• 30:16
  SPEAKER_01: It's very, very different type of uh of work from like the deep, nerdy core engineering work.
• 30:24
  SPEAKER_00: Well, Zell may change over time.
• 30:26
  SPEAKER_00: Later versions may look different from this prototype, but research implementations they they help show what part of the problems are real.
• 30:35
  SPEAKER_00: If later versions look different years from now, what would still make this prototype an important experiment?
• 30:44
  SPEAKER_00: Sorry, if if what I can guess if if later versions were to look different than the current iteration right now, what would that look like in the future?
• 30:54
  SPEAKER_01: Um I think it would look pretty similar.
• 30:57
  SPEAKER_01: I think maybe different proving systems.
• 30:59
  SPEAKER_01: So um Zale uses um work done by Starkware, uh, so Cairo uh S2.
• 31:06
  SPEAKER_01: Uh and there's a new type of proving systems which are very similar to Stark, which are using multivariate polynomial um as opposed to univariate polynomial and different techniques which are maybe a bit more efficient.
• 31:20
  SPEAKER_01: Um and they are part of a project called um lean VM, which is developed uh in the Ethereum community.
• 31:27
  SPEAKER_01: So I've been playing with lean vm, it's very efficient, uh, it works very well.
• 31:31
  SPEAKER_01: So it's I think it's a it's it's quite a um it's it's really good um replacement for the the stockware libraries.
• 31:39
  SPEAKER_01: However, um it really focuses on proving it doesn't do zero knowledge yet.
• 31:45
  SPEAKER_01: Uh it's it's it's doable, it's not a it's not a massive like endeavor to to to turn this like Lin VM into something that does zero knowledge, but it's not been their priority because it's mostly used for for scaling.
• 31:57
  SPEAKER_01: However, I would say if and when uh lean vm becomes useful for uh zero knowledge uh proofs, it can be a drop-in replacement.
• 32:06
  SPEAKER_01: What's interesting is that you're not you know you're not tied to a proof system.
• 32:10
  SPEAKER_01: At the end of the day, what you're what a an encrypted ledger looks like is essentially a Merkle tree of hidden commitments to like to little nodes.
• 32:21
  SPEAKER_01: That's what it looks like.
• 32:22
  SPEAKER_01: Any in and you can use any proving system on top of this.
• 32:26
  SPEAKER_01: That's the thing.
• 32:27
  SPEAKER_01: You're not you're not necessarily tied to one.
• 32:28
  SPEAKER_01: As long as you can prove some statement about like, hey, I know you know, like a pre-image of this hash that has this and this and this property, you can accept that.
• 32:37
  SPEAKER_01: So you don't have to like you don't you're not stuck with one.
• 32:43
  SPEAKER_00: Well, Arthur, I really do appreciate you taking the time out today to share with us and explain this.
• 32:48
  SPEAKER_00: Uh it it's a lot to go over and it's a lot for the average person.
• 32:53
  SPEAKER_00: And I think you really did make this a lot clearer for a lot of us.
• 32:56
  SPEAKER_00: Thank you so much for your time today.
• 32:58
  SPEAKER_01: Well, thank you.
• 32:58
  SPEAKER_01: And you know, I I I I know uh we haven't like put out a uh a post yet, but you know, look look look out for it.
• 33:04
  SPEAKER_01: You'll be able to uh you know give uh uh give Zell a try and uh and uh uh and and launch it and uh and play with the code is already out there, uh, but there will be a bit of a bit of infrastructure for everyone who wants to play with it to play with it.
• 33:19
  SPEAKER_00: Well, thanks again, Arthur and uh I look forward to the opportunity to do this again.
• 33:25
  SPEAKER_00: Thank you very much.