Vampire, a Novel, Cheap to Verify, zkSNARK by Michal Zajac | Devcon Bogotá

foreign [Music] guys I'm really excited to to present you our new music a snark uh it's a it's a joint effort with uh with two other guys with helger lipma and janosim from simula so um we in our paper we presented a new zika snark uh called vampire it's uh it's a zika snark for arithmetization called as r1cs light it's Universal and updatable that means that you can have like one trusted setup for for every circuits up to given size and if you don't trust that the trusted setup was generated correctly or non-maliciously you can always update the setup by your own it's it's based on Marlin another ZK snark but it's like really highly optimized I would say it's a Marlin on steroids uh it's uh it's so optimized that the proof is only four group elements and to filled elements like compared to Marlin which has like seven group elements or Planck which also requires uh seven seven group elements so communication wise this ZK snark is really close to Grove 16. so the difference in the proof size is about 500 bytes but graph 16 is 9 either Universal nor updatable and it uses only two subjects and why I want to talk about some checks is because this optimization was possible thanks to the fact that we uh we invented a new subject which we adapted account it's a universe some check it has great communication efficiency because the proof for the subject is only one group element furthermore the complexity of of this subject is really really good is almost linear what is much better than a standard subject we use in snarks called Aurora which which requires ffd okay so um let me tell you how to make snarks shorter how it was possible to um to to do to deliver a snark that is only four group elements long um so snarks uh like a class of snarks we we are we were investigating uh has a number of of building blocks so so first there's a relation so we need to to pick What relation for snark we are proving and for example the relation could be r1cs it could be r1cs light in our case long hair has its own relation so arithmetization matters the ultimatization also uh tells you well the proof size really highly depends on the arithmetization you pick then we have a subject so basically the question is how many subjects do you need to show your result then we have lean check so the question here is do we even need a line check and the last but not least the famous polynomial commitment scheme which uh also like defines the the size of the proof so we need to tell which polynomials are we committing to and what polynomial what commitments do we open can we batch openings can we batch commitments so to compare to compare Marlin with our vampire so there are some several differences so first of all Marlin is for r1cs while vampire is for r1cs Lite and why it matters I will say uh in a bit in a few uh in a few slides then we have a sub check both Marlin and vampire need two subjects but but Marlin uses Aurora some check and the vampire uses count and Aurora regarding clean check martinin acquires it we don't then there is a batching of of kcg a cut a polynomial commitment scheme so in case of marlin it is batched but we managed to budget better okay so let me tell you about the difference between r1cs and r1c as slight so we start with arithmetic circuit as usual and and we we have some left input gates in the circuit we have some right input Gates we have some output Gates and these gates are encoded into three matrices so Matrix a corresponds to left input Gates uh B corresponds to to the right inputs and C corresponds to outputs and then we have Z that corresponds to evaluations on these Gates okay and that's r1cs light and the fact that we have three matrices basically means that we need to send free polynomial commitments to each of uh of these multiplications here while in a r1cs slide the situation is a bit different because we are able to encode the whole circuit into a single Matrix so we have only one Matrix that need to be need to be sent and we want to show that that the vector with evaluations times this Matrix gives gives zero okay so uh let's look at this uh for a moment so so um W Times Z equals zero basically means that for all X's uh sum over y of w x y so the elements of the W Matrix times element of a z Vector equals zero and with some mathematical trickery we can say Okay so let's not talk about vectors let's talk about polynomials um and let's talk about some of some polynomials some over some y for some polynomial F and here comes the subject so count is a new subject uh so subject argument basically states that if you have a polynomial F and you evaluate it at some elements a belonging to a set H and you sum over all these elements then you get some value V and compared to Aurora as I mentioned I Aurora needs two group elements we need only one group element so I'm not going into details of uh of this subject maybe maybe some other time so let me only say about batching kcg very quickly so there are like two uh two ways of batching polynomial commitments first of all we can batch openings of multiple polynomials evaluated at the same point and that's what Planck is doing that's also what what was done in Marlin however due to some new results we can also batch openings of multiple polynomials at multiple points if you want to learn more please check our paper and now I can take some questions thank you so much [Music] a lot of data and formula over there but if people can talk to you after the talk thank you so much foreign