Behind Zupass: Applied Cryptography For Consumers by Richard Liu | Devcon SEA

[Music] um as as you said there's going to be a bit of a surprise for you all I know it's getting close to lunch towards hungry times so we'll make sure this is uh worth the wait um yeah I'm Richard I work at Zer Park and I'm here to talk about zo pass but before I get into zoo pass I actually want to first talk about ethereum um we are an ethereum conference and one theme that we've seen popping up over you know the past I think few years especially and few months even more specifically is how do we get to things that people can use right not just interesting ideas in theory but um you know as vitalic says this blog post this is a decade where we actually have to build things that are useful um and I think there's been a lot of really exciting directions in the staple coins the prediction markets uh defi in general right I think um that kind of world has been really exciting to see things come to fruition uh but there's this broader world of you know uh the promise of ethereum Beyond just you know more ways to use money more ways to increase Financial access there's this vision of uh Computing being a different sort of Paradigm because of decentralized Technology because of cryptography so I think that's where I want to focus on and and I want to approach specifically this problem from uh the usefulness lens and I think one interesting thing about uh Devcon and AUM conferences is that um conferences can serve often times as ground zero for new technology breakthroughs um their early Glimpse is what's possible you have a bunch of sort of really bought in excited people you know caring a lot about coins or frog hats right and it's a chance to sort of show what you can really do um in a short amount of time and two examples that people might know of are one is this 1968 this guy unknown Professor from Cornell Doug Englebert introduced modern Computing the personal computer the mouse the spreadsheets it was all hardcoded there was no like actual product but it was a sort of vision for researchers at Xerox Park and for um Bell labs and these folks to sort of actually innovate and build the thing that we now know as uh probably the most important industry the past 50 years um the one on the right is Twitter at southby Southwest in 7 just another example of like how um we've seen early glimpses of social media and it's changed our lives for better and For Worse um so I want to start with this prompt which is what did going to an ethereum conference feel like 5 to 10 years ago and uh I actually wasn't part of the ethereum ecosystem 5 10 years ago so I'm just kind of guessing but let's let's play along um and let's target it from the technology perspective of the conference so you're at a conference uh there's a few things you know features or products that are important right um there's ticketing you need to be able to get in there's Communications I want to meet people I want to sort of expand my network I want to sort of hear what's going on and I want to go to talks right um and you can roughly map this out in a data way with you have all these sorts of like objects for example you have your tickets in this ticketing server you have communications and messages and other you have some other stuff going with talks um it's pretty standard sort of uh thing you do for any kind of web application um and and one thing I want to explore this is you know five 10 years ago what does it feel like in 2023 I chose last year because this year's you know a little different um but it's basically the same picture um you know like the one thing that's changed is oh now we can you know buy tickets with ethereum right uh and that's pretty amazing and Powerful how that happened but it feels like we could do be doing a lot better right not because we're trying to like make the best conference it's because conferences are where um folks from the community should sort of see what's going on at the bleeding edge uh yeah so basically nothing has changed much and you know what could it look like in the future right what could the reality of being part of the ethereum community look like in the future um this is a bit more complicated a diagram but essentially you know all those pieces of data right that are being held in servers oh why aren't they being held by me right and and not just for you know privacy reasons but also for the fact that I can Port them across different applications um you know applications themselves could live as smart contracts right be publicly auditable be composable all that good stuff um and I I think here's a here's my take which is like if we can't do this um if we can't actually just run the biggest and most important event on ethereum in a few years like something's really wrong right and I think that's sort of a red flag almost um and and here's one exercise which is like what would it actually take to run ethereum conferences on ethereum right uh you know first off what are the benefits I think most people here are familiar I won't sort of spend too much time but you have all these sorts of like data ownership composability permissionless um everything's verifiable right and this is powerful because you can have these sort of new behaviors that emerge um that are only possible when you have very strong guarantees now what's holding us back right um yeah basically all state is public that really sucks you can't really have any sort of um you know secrecy or privacy that you want sort of just because you want to build you know organizers don't want I don't want somebody else knowing my information right it's not sort of a ideological thing it's a very practical thing um most of the world's data is still on web to it's not very portable yet uh building and solidity is still really really hard right um and uh you know computation expensive and high latency I mean RBS make this better uh the you know resources in development have made the third Point better but I think we're still it's still pretty tough to build an actual like high load application on ethereum yeah so I think it's at this point it's still too high of friction to go all in but we don't have to go all in right I think there's this tendency to like be like oh it has to be fully decentralized or private or it has to be nothing but I think there's there's ways to sort of like 8020 this right um and the question is like how do we get to sort of 80% of the benefits there's a lot of clicks um with only 20% of the cost of you know using this Tech right um and one thing that I'll I'll note uh is that things like zup pass among other you know really great applications in the past few years have made this more possible right and through uh different types of you know through certain data formats but also through encouraging a certain type of application um so simply data is not stored directly in ethereum however it's easily portable to ethereum because it's cryptographic right and not only is it portable to ethereum but it's portable to basically anything cu you just need to be a person or a computer that speaks math right it's kind of the universal language um and just to kind of go through some vocabulary uh my colleagues will probably inundate you guys with these phrases more later on but a pod is uh essentially you can think of as a Json that has some proof attached to it it's a statement about the world um zaps are these things we're calling which are applications that operate over pods and they connect to your zup pass which is a store for pods um and it stores and also manipulates and these are all stored locally uh you might hear this thing called a GPC it's basically it stands for general purpose circuit essentially it's a kind of a ZK fpga um where you can sort of configure a circuit or a proof through Json rather than having to like write circom or you know learn uh functional programming and um you can make proofs that are really really efficient like two to three seconds on a mobile phone okay so some examples um pods so your Devcon ticket which I'm sure all of you uh used maybe struggled with a bit but um and other sort of uh events zo in the zul ecosystem which is where zoo pass got its name from um for example Edge City zuo connect which was before Dev connect last year your frogs and uh other pods from applications like questions and answers like mircat is one example um which will be used at the end end of this talk that QR code to WR there um in terms of zaps we have uh there's just a lot of stuff on this page but briefly right there's um things that help with communication like the telegram there's things that are just fun games in their own right like frog crypto um and actually have their own extensions right like the necklaces um these guys and uh you know there's some apparently there's a game where we can juice the Frog and put it on chain um just hearing all kinds of stuff now and then uh also faucets right so I think the meong facet came out and that's using Devcon gating um so all kinds of different things are highly you know all kinds of really complicated logic is highly flexible because you're just you're essentially just writing a typescript app that checks some cryptography rather than having to write a whole smart contract um and and given these sort of like new technologies and capabilities right you know what do feeling a Devcon go life what is what does going con feel like um it feels a lot like well I have some application that stores my own data uh it's issued by you know trusted services like Devcon but I can now use that across a whole bunch of different zaps um I can get you know and not not just tickets right I can get my frogs and those frogs are useful for all kinds of like extension apps the juicing stuff this another one where you can sort of like put your frog in a lab um there's like more gated chats right uh I think this is just very very fascinating and interesting um of a way you can sort of engage with an event uh because you have this technology where everyone has uh software that can process pods they can make proofs and developers can build applications that interact with these okay so here's where we get a bit more experimental and um if we project this with you know High uncertainty bars because uh no one can know the future what does this look like what does this mean Beyond just okay it's a cool fun conference experience well I think that um you know if we sort of just literally take each of these boxes and do like the more serious version of it right check-in is basically how uh you know Customs or traveling across any sort of like High um you know high stakes reputation thing where you're going through and you're checking that you're you are who you say you are that's essentially what's going on uh with ticketing right and it carries over to the highest Stakes things like I want to enter a country or I want to like do something that's you know highly restricted uh messages you know every email has a deim signature and that can be ported all on chain portable within this sort of cryptographic environment um voting uh that's been said a lot before so I won't go into it you know faucets right what's the sort of bigger version of a faucet or you know a bank it's it's it's an actual bank think right and then I think this direction of apps building on apps is reminiscent of um two things one is like in the early Facebook days there would just be a ton of like Facebook games right I mean same with Twitter there was a Twitter API and there's like all these kinds of like aggregators you know like or there' be like you know check my face Instagram followers do some sort of like you know query over them I mean Tik Tok there's like the remix Behavior where someone can sort of like take a Tik Tok and like build on top of it and you get sort of like recur of Tik toks like six down and I think like these kinds of things are are really fascinating um I think you see in defi as well right but it extends far beyond like derivatives and financial applications okay so this is all cool um but how do we actually get here right cuz uh I think like we can all dream and sort of Imagine right but I think what's important is like what what needs to get done um and we have three main ideas right now in directions that are I think pretty concrete uh so the first one is we just need to get better technology right um there's been a lot that's changed so zup pass was first launched in 2023 it's built in six weeks uh which is crazy there were like all kinds of crazy stories that happened from there but um basically was built that assuming that hey we have what we have at March 2023 and so many things have changed right so pods was not even a thing until early this year here and now we have um a lot of developments in recursion which have made so many different kind of things possible um you can basically make proofs of proofs of proofs in sort of arbitrarily long you know arbitrarily long chains of proofs in under two seconds on a consumer laptop and we have not adapted zath yet to this new paradigm um and you know that gives us the ability to also work with data that's not so nicely like ZK friendly so like ZK email uh ZK VMS they just take they take really long and they're just not very feasible on phones right now but that's something we can actually just solve given how much uh things have progressed over the last year yeah I think we want to continue improve performance um we have uh for example we've done a lot of open- source fixes and Feature work with snark JS and semor which um are two of the libraries we depend on and a lot of it is because uh both of these libraries have not really experienced the level of load that uh before something like zass emerged right like um I'll give you one example which is there's this memory leak issue in snark JS that caused people's screens to freeze up but it only happened when when um they tried to make really big proofs and it was a really you know simple bug that we went we just sort of it was allocating too many pages but my point is like there's a lot of lwh hanging fruit because a lot of this stuff has not been tested Ed in production even though these are sort of like the you know the classic libraries you use um and there's all kinds of like new updates too there's delegated approving which seems to be uh the direction of a lot of the future of client side stuff um essentially you blind it on the client and you send it the server to make it succinct there's um new apis like web GPU uh Native proving which has been exciting um and more of a reason to actually get a mobile app right so things like m proo and explorations of alternative kind of zoo pass or pod clients um for example there's one experiment we've been doing on you know Mac native with a Mac native app uh and that allows us to do a lot more like complicated proofs than you can on just your zoo pass which is ultimately Bound by the web browser and your phone okay yeah we need to get more valuable data into this ecosystem as well right we can't you know frogs are fun uh conferences are fun but it can't just sort of stay in our little bubble we have to really like we have to actually go out there engage with real world data right um and you know I think there's there's passports have been talked about there's all kinds of other data that's highly valuable right um and I think this is where we're kicking off conversations with Builders who are working on this sort of like import problem right how do you take data that's either cryptographic or not and import it into a format where it can be used in this way right um TLS notary and ZK email I think are the great examples because there's just so many emails and uh you know websites out there but I think what we want to focus on is how can we sort of take these uh you know new imported data and like find sort of a use case that makes sense um and then also let devs build further applications on top of this right how do we enable like the Frog crypto of something Beyond Devcon or an ethereum conference right that's still an open question that uh I think will be very very interesting to solve um yeah I think that's where like Partnerships with universities governments financial service providers I think this is still um it's starting to get to the point where this makes more sense right um you know there's there's like there's a lot of cool stuff you can do at universities right people want to make apps uh at you know the stanfords and the sort of berkeleys of the world and um they want to make social apps dating apps and these this is sort of like a great uh way to get off the ground with a lot of these um you know new technologies we can sort of work with portability of social media or ethereum has been one but also like farcaster blue sky X um there's all kinds of directions and this is like not a complete list by any means wrong button cool and then last is we want to empower U this is Devcon we want to empower developers to build the most interesting apps and the most powerful ones so um you know here's an example of how you can sort of push insert a pod to somebody's zoo pass in basically five lines of code um we try to make these things very simple we try to make these things very at the end of the day we're we're pragmatic and we we want to ship a lot of things um so I think this has been uh a really you know we spent some time basically in the past few months rushing together in SDK that you know so that someone can actually come in and build a zap without much guidance um we will have a workshop on Friday uh where we'll go over and just literally build it together you can build frog battling frog you know dating or like whatever kind of app that that comes to mind um yeah and and crucially I think no cryptography experience is required because uh a lot of what we're doing with these libraries is focusing on how can you just describe the behavior you want and then we'll take care of the actual implementation and um yeah there's some documentation pod org it's six letters easy to remember um and we have a telegram group as well we haven't shared it too much publicly because we're worried of spam but I think everyone should join everyone should um you know ask our developers with questions and you know you know help us help you guys figure out what to build um yeah some upcoming sessions from my colleagues and then uh crucially tomorrow we're going to have a full day of programming there's going to be some cool Keynotes in the morning um and then workshops in the afternoon afterno right so that workshop with uh building zaps with Pods at 2:15 um and as promised here is a froggy surprise I'll just let you guys figure out what's going on and that's all all right thank you Richard excited to see what zaps all you folks build out in the wild um looks like we got a couple questions when native mobile app yeah great question um I think we've probably said uh soon like too many times um I think we're really excited for you know uh how fast you can get with Native improving um like rapid snark and uh mpro have just been you know really exciting to see the progress I think there's a few things um most of most of it is honestly just you know where we're a small team and we uh you know have to sort of I think we had a lot more people if we had um a very strong sort of like you know uh mobile direction that would be something we we' certainly do I I will say like you know 2025 is a great time to like we we have already explored a native mat client um so I would be very surprised if there's no native app next year but don't don't quote me on that um looks like a question around breaking down parts of the app um parts of z pass like built on primatives like snark js on semaphor um versus what is driven directly by zpass yeah that's a good question so um I'll separate snark JS and semafor so I'll talk about semor first um semaphor is uh at least the latest version V4 is essentially a key pair uh which is super useful for us and essentially a semaphor uh identity is a zass identity they're they're one to one um and it's what you use for signing pods it's what you use for uh also like you know if pods are soulbound to you right or like Watermark to you they put your we put your semaphor public key in that pod to signify that um snark JS is used for uh proving it's um mostly for if you remember gpcs uh it is I think still the fastest web-based library that we've found and to be reliable enough um although we're very open to sort of change it it's crazy because it was built mainly for educational purposes but now it's being used for like huge use cases um yeah and a lot of the rest of zup pass functions similar to a traditional web app um I think the the pods being stored locally rather than being stored in a server is a really big difference and looks like curiosity around you know zup pass building this data wallet is there any plans for association with an ethereum wallet I'm guessing and or ZK email like like functionality or authentication yeah we're really excited about um we've been really excited about I think all of the sort of zkx you know movements right um TLS notary i' put in this as well I think like we finally have the technology to actually do this it's it's pretty crazy but um uh with with these things we're we're terming pod 2 right we essentially anything that has a verification function um which is any cryptography really can be put in a zoo pass so I think this is something we're we're going to um yeah it's going to happen and now we finally have the resources to do it love it um got some more question questions sounds like people should show up at the workshop tomorrow uh but curious integrating pods with traditional web2 stuff what that might look like so one interesting thing that um happens for frog crypto is that we created this new data format called the pwt it's a pod web token um JWT is Json web token so pod is essentially a superet of Json it can also be serialized to other formats right but uh anyway as in the side just to point out like that um it's very easy it's almost like asking is Json um you know compatible it's it's mostly a serialization format um with some opinion this around like how do you verify the data and but um yeah these are all like very easily Poss because they're cryptographic sources of identity at least gbts I think um oaf and I'm not familiar with oidc but there are ways to Port import those over to cryptographic data types for example with notes one last question I see hi can you go back to the Frog QR code page again please and thanks I mean I don't I don't think I can unable to do it unable to do that it was there it was gone those frogs are slippery yes um