Building ZK dApps: A Practical Introduction to Zero-Knowledge Proofs

[00:00:09]so okay so i will bring this session in english because uh sometimes there are some non koreans here so i'm sorry for the koreans and it's 4 30 so i want to start my session here so uh is there anyone who yet two gonna get this link i want to proceed okay then all right so my name is jen and i'm working here inside the slv as i'm writing some inviting the technical stuffs and running some codes and doing some whatever the relationship of kind of the webster area so well the reason i choose uh the general knowledge proof stuff is that well this is so difficult i don't i don't well honestly i don't know much about this but it seems like very interesting uh stuff i think that um the the next big thing in crypto will be on the general proof so that drives me to understudy more and uh in this session i really want you guys to gonna get grab something like the basic concept of the gkps in in practical manner and you're gonna have a think of some interest in getting to learning this and i'm going to advertise what uh my my study sessions in boom labs which is um the crypto developer community in korea so yeah i have this nfd so i officially represent this one and so i'm right i'm working at this dslv here and i started my the journey to learn of zk by just on thanks to the on general knowledge university which is provided by the harmony protocol i graduated in the second court and it provided kind of really of awesome the educational materials for those who have never ever heard about the generous proof but to have any kind of some experiences in writing some the contract in solidity so before i i'll just started my journey into the web stream i was some of the kind of the java spring the bargain developer i really love to underwrite some codes in spring boot i'm using jpas and like the kinds of things i really love that the wiring framework though there's so much yeah some sophisticated concept on it and then here i'm at three i'm just exploring the possibility of the how the new generation of internet can just blow up the existing the legacy systems well yeah that's me so let's proceed um is there anybody who can define what journalist proof is if you um interested in kind of the the layer one or the layer to any kind of bridges you guys might easy to undergrab something like the keywords called while we do some decay in this dk bridge yeah just freaking great yeah scalability awesome due to the this is amazing the cryptographic technology so then is there any anybody here can define what the general truth is raise your hand okay [Music] and so one person said the other person something by a certain route and the person who receives that thing doesn't know about their purpose of the receiving things so he or she doesn't know where he comes from but with the general report even though he or she doesn't know where they come from there is a cryptographic proof that there is only one case where that thing is compromised one side might be scrappy but this is what how i understand this universal yeah that that that's right so well what to to to to to say in in concise manner i think it's kind of the ability to prove an honest computation yeah without revealing input right so although the fact that input is not uh the fully concealed to the verifier the verifier can do kind of uh the proof by the doing something like the honest computation so the how these kinds of uh the magic can happen so let's kind of take something like the easy example to kind of graph the example here's the idea so that's a wild example you guys may be heard about so let's say so so well well let's find the waldo in this amazing map right so the ls might can say i know where the relative is but elders do not want to reveal the exact location of weldo right so the bomb might ask well alice can be a liar right so prove yourself but alice do not want to reveal its exact location but to prove that alice know where the welder is right so the artist can say yeah i can prove to you where he is without rippling his location right so alice has two ways to defend her integrity that he knew she knows the location of the welder right so one the easy thing is that let's just put shadow welder in this piece and it only shows the bob the welder snippet yeah i know i know the router so i just crop it but well they bob right so bob mike can say that wow you just can just copy the snippet of the welder right how can we how can i know this how can i how can you verify that you did not a copy of the router so then the one can what what what else can do is that to put a something like the large kind of large or proquest sheet of the dashboard the cardboard on the top of the dc right so the cardboard is much much larger than the scene right so what else can do is the crop from it what it means is that well the artist can hide the exact location the xy coordinate how because the cardboard is much larger than the origin scene by doing that the artists can easily yeah to hide the location so that is the basic idea of the general proof so easy right so as is that the the coordinates relative to the rest of scene is still unknown that's the basic concept of the general proof so what is journal for exactly uh we can't define the two actors in this process there is a proverb and the other guy is a verifier so is those who the executor computation and those who really want to prove to any thought party the verifier that the the approvers computation was valid and there's very fire the verifier literally verifies the proof the computated from the approver right so the very first role is just to verify the computation done by someone else's was valid right so we have the two players here is prover and the very far so how can the improver can make each proof that can be on there will be um kind of the past to the verifier in the later process uh the prover needs to kind of compute in deterministic way right there's a blockchain so so uh so the computation is basically on the deterministic program so it gets inputs and it returns the outputs so when it comes to this thing it's a verifier to verify a computation the dom buyer third party was valid would be to run the same program with the same input and check if the output is the same so which means that this determines the program so if you put the same input the same output will become will will be returned right so true is always true so false is always false so the approver needs to want to write the deterministic program called circuit so that's the responsibility of the approval so that as i say the circuit that is the deterministic program that proven is right so prover excuse the computation on the circuit and the compute the output of the program circuit right so the pro so the profile itself starting from the circuit so they compute the proof right what it means is that if you write something like the computation like deterministic program circuit and if you put the certain a certain kind of the proof which is the declared in the json file you can't make your own proof right so if you put the input on the circuit the output which is the proof will be returned from the circuit and you can't give this proof to the verifier so if you say that your input is a private thing well there is some kind of combination of the public inputs and private inputs right you can't describe which kinds of the inputs to be to be um concealed not to be concealed so that is kind of things that you can um i'm going to say don't define when you're gonna run the circuit right so after that as i said earlier you can just computer proof okay so just simply is to give it to the verifier so verifier can now run whether the your um the proof is valid or not by just running the verif uh the contract uh that is exported in a solidity way you wrote the circuit and you can on the compile to the solidity solution and if and the the improver might um be deployed that's already piled to the ethereum network for example then the verifier who receives the proof can just put to the um the contract as some code data and send those input argument so then your solid on the approvers solidity contract will say it's right or wrong so what i mean is that well the approver writes the circuit improver um kind of computer proof from the circuit and the verifier who receives kind of the circus receives the proof from the verifier of the received from the approver can just easily put its code data to the solid contract then to easily know whether the proof is valid or not regardless of the the [Music] to not to know about the what the input is exactly like this so it is um to to be known that the verifier can just run a kind of lightweight computation so which means is that the verifier's computation uh the resources is much lighter than that of the proofer the proofer needs to gonna compute in more with more energy and the more kind of on the resources to generate the proof but the verifier can easily validate the proof it's an all one kind of uh how let's say yeah tasks right so in in that sense the verifier does not need to know the whole set of the inputs right so that is the um kind of the pro things that the proofer can have so that is kind of the non interactive knowledge proof however works so we we call it as a snark jk snark so given a circuit it's input which is private and the public the approver can run the circuit and generate the proof as i said earlier right so the verifier will run the proof on the circuit and well to know whether it's valid or not with regardless of the waterproof kind of what the real the exact value of the input is so the the magic of this um [Music] yeah the generous proof is is required to take on these processes so it so we are now just running off time when we just look over into the each of the processes but the whole thing of the conversion logic to the um um circuit is to gonna give the strict restriction and kind of represent your code into a quadratic form which mean is that the your circuit your code on on on on generous proof is strongly strictly restricted when you write some codes i will talk in later so anyhow in this process your code will be converted to the quadratic form okay so that is whole point so if you really kind of wanted to the how the your the code can be converted into the general proof kind of circuit you can just take it into this link to get to know uh much deeper on the mathematical concepts so um yeah i wrote this kind of diagram but it's really difficult to understand but let me just try to explain this so um imagine you guys have a task to hash a certain string in 5 000 times in a kind of unsolicited contract it's a literally impossible task right if you do so in using the four state for statement and solidarity it will take on the the really burdensome the gas fees on sort of the contract right so um if you want to really want to do this you can just um just pass the responsibility of hash the string on the off chain and what the on chain contract do is to kind of validate whether the off chains or work is valid or not so you can just kind of write some contract that can verify whether the the hashed string is variable not it's in in a circuit which an end in the compiled circuit to the solid contract um make your contract to verify to given string is fed or not that's what the approver needs to do and and write some contracts or front-end that does do kind of the hash hashing on string responsibility on the off chain server for example and after the off chain uh finishes each task well just make your front-end code to the verify or before just proceeding into the next business logic to the solidity contract so just two so i mean is to just pass your the output of the offchain servers on the hash stream to the to the solidity contract then the your already deployed approvers already deployed contract will say it's valid or not and after received those um the output you can proceed with the the rest of the business logic so that's some basic idea if you want to really do something that has a string in the five thousand times on kind of kind of dealing with in within the solid contract so if you write your circuit which is the general proof's um specific the cause you can just as you can just compile it to solid control contract that's what i mentioned before right so um that is um the verifying contract right so literally the contract that verifies the input well if you wrote the circuit and the prover can um inject a input right for example you write whether um the the the the a multiply b is the solitary 33 and you put the a is gonna three and b is eleven right so well it's really easy to compute but let's say the a is private input and b is the public input you want to do not to disclose the a as a public input right well then you can just um put your the private input a and problem to b into a in in the form of the input.json and to put in inject the input.json into the circuit then the circuit will create the um proving key which is the specific the for your input then the proving key can be converted into solidus code data which is um available to the put to the on your verified verifiers approvers verifying contract which is already deployed then the verified contract can know whether your the proving key is valid or not okay so it's all about the running circuit okay so within this single circuit the uh the prover needs to deploy the contract that can verify can easily use and the printer itself is going to put the input well to not to disclose the ones or the private input so yeah so the problem is you're trying to prove something on solidity but because doing a lot of computation is hard you want to do offline computation and just publish the proof on the smart contract yeah with let's say a verifier in our case a node we'll take it and then if the contract says okay the input is verified whatever yeah is okay and the data is stored on the blockchain and we continue yeah so who designs the circuit is the circuit the contract what exactly is the circuit box well um i uh basically this circuit is it is written from the um the designer of the contract right so if you're the app service or provider wanted to put this service into an zk fashion way well the developer of the decay to shoot the writer circuit and deploy the contract before you want to deploy your own dm right so so let's say you have a problem you are trying to find out where model is yeah so now a verifier whoever wants to verify whether you found it or not i want to deploy a contract and convert into circuit and deploy the all of the things in the world well the you you can't reuse the already deployed contract okay yeah because well do to find out the welder will take the same um the mathematical logic yeah if we if we assume that the like the kind of kind of the we added more jet coordinate from the existing soi for example so basically the service provider will um deploy the circuit uh along with kind of the already in the ordinary solid contract so if you want to write a circuit as i told earlier the circuit requires to be represented as some quadratic form right so this means that you need another language that puts a strong um restriction in a compiled level so the third point language is prevalent to be used in the z case north environment okay so i will talk about what is the case notice in later in in in short time but we use circum language so if you write circle language if you compile over the m1cs system you can have the in the web assembly file that a welcome symbol file is a kind of bytecode of your circuit so you can just um generate the verifying key and proving key from your web assembly file then you can generate your um the own solid contract to verify the input of the proofer from the verifying key the json which is compiled from the wasm and that wasn't filed is originally written from this circuit okay or that that is kind of the general the the process of the writings of circuit story so first you you guys know the tornado caches yeah attorney location is written and the circum language um there's kind of the another kind of the alternatives in stars like um when you say that there's a minor portal snaps and typescript well i originally introduced this session to be right in the minor protocol but um unfortunately the minor protocols test net which is me on berkeley qa net is currently unavailable so that is why i wrote out that protocol to be used today so what's the thing is right i asked the discord when to be recovered they say just you know they are working on it but yeah that they just say the billion people's trained will be back soon so i don't know so that is a basic idea so let's talk about something more deeper okay so um so someone would say yeah i i got your point but when it comes to the um the um in the realistic way in in the programmatic way what kinds of libraries you use right so we use not such a yes when we when we do play in the gk smart environment so snark js you can just go into the github repository by clicking this link it's a full feature tool to generate a proven key and verifying the key the from your circuit right circuit from the circuit so it has kind of full feature that is already already to be on the compile your circuit into the webassembly file so it can also generate the smart contract from your watson file too okay so take a note that start.js is well used in in the gkp world so let's talk about how this node.js is used okay so this is the journey to create the proof so if you write something like the in in your on general knowledge proof stuff in the um circle language you mean that you write circuit okay so sir the circum has kind of somewhat um the different the grammar to that of the solidly i think it's somewhat similar to that of um rest of it but it has something like kind of some peculiar grammar syntax so it's much better for you guys to want to take a look at the the getting started in the documentation of circum2 is really well um explained so after you compile the circuit using snapchat yes well you can have the this kinds of the three files the one instructor wasn't which is the webassembly file that i mentioned earlier right so it use this it is used to generate a witness okay so i will talk about what witnesses and the second one is that r1cs which is represented as a qualitative fashion but um you you can just use um okay so while there are some developers using all of the cs but um when i just look into the ddt something like um example the repositories it wasn't file is um it's preventable to be used and you can have a circular sim which is um makes you want to debug your kind of circum code but i will not gonna talk this so well you can't make that this wasn't to be representative in json file okay so while the the compiler compilation the start.js needs to choose the which kind of implementation of methods of the snare js sdk snarts to be used so one is the growth 16 okay so group 16 is some kind of um the things that you require to have a kind of pre-conditioned thing which is called the trusted setup so what is trusted setup is yeah let me just put this much simpler is to put a randomness to your socket why because the circuit itself um it should be representative and some kind of um uh the hashit or in in in a hashed version to be um uh to be encrypted so you need to put a randomness but um the thing is kind of weird is that the growth 16 requires the two steps of the setting of trust setup which means that you need to do a two set setups in your telstra setup so what are two stages of the trusted setup when it comes to growth 16 when you regardless of which circuit you write when you kind of install this node.js you need to install the you need to know you need to do something like trust setup before and just after the install instrument of the snartjs library but if you do the trust setup in your computer it will take all tons of the launch of the times like so if you do your trust setup in your computer i i bet you guys do you're gonna be more than a day in your m1 macbook okay so um trust setup initial trust setup is kind of the common one for all guys who uses the snapchat js so search.js is is made by the g cache you guys have ever heard jks the ig cache is important which cache has kind of its own implementation of 416 and they gonna provide their own implementation of the pro 16 initial setup and they provide their own um the initial trusted setups of file on the guitar repository so um when you use yes just not to do your own trust setup but to just download from on the um the gcash guitar repository and then if you write the circuit you need to do another trusted setup the second second step of the trust setup which is specifically for your own circuit so the growth 16 requires the two phases of stress to setup compared to that of the growth 16 the planck requires only one trusted setup so only the initial setup which is global one who uses the prong system on the start.js library then this whole thing is a blue okay so you can just download it and just boom there's no another the trust setup is required to for the specific on the circuit so anyhow after you put some randomness by doing some detroit setup you can just compile your circuit the wasm into the proving kit.json and verify verification.json okay so but so by combining this you can just have kind of the generated solidity file you can just come just deploy your solid file to all that node which is provided in this yeah the company okay i just do something advertisement okay so anyhow you can just just deploy solid file to the ethereum network that is the thing to verify of the approver's input that is the on the process of the deploying the verification yeah a certain kind of contract and from the prover side if uh the the responsibility of approver is to make your own proof itself right to just not to disclose your um private inputs right so well the proverb itself is the user of the app right user might want to not to disclose your kind of the user's input this mean is that user can choose to which input to be disclosed and which inputs to be not to be disclosed so you can just put your input.json let's say on the a3 b11 that's the example that i already mentioned before you put your input adjacent into the circuit of awesome yes the circuit wasn't is recalled by both um the the guys who write the contract and do something like provide the service and the from the proper side which means is that if you're at the front end of the on decentralized application we want to make a make a proof for the user your on the the react application for example needs to be be deployed in the any kind of ddt server or version of the app and the any kind of static website with the circuit that wasn't yeah so it needs to to be deployed with the webassembly file so the the users the input to be represented in the json file and the react site via the website to inc to be injected with impetus json okay so the circuit wasn't on the front-end front-end website to portray the witness okay what is witness witness is the all the possibilities of a and b of the combination of a and b so when you put the a is 3 and b is 11 12 we don't know which is a which is b but it just says oh the multiplication of 3 and 11 is 33 well boom right 33 but it could be um 1 to 11 right so that's 11 it could be on 3 and 1 3 and yeah so there's all the possibilities of the the combination of the results of the results and that is within the json okay then the written dot json to the car to gonna generate the proof so we finally have the two files the one is the public adjacent to disclose the user's input as some public one then you can't have your proof.json which is the encrypted uh the input of the public one and the private one that's all combination of the whole inputs and you can just generate it as a proof.json so the front the front and side will finally get the proof.json and the public adjacent that is the side of the prover and that is the side of the front end for the flow of the user so the thing is how can we make this two kinds of the json files to be um injected on the solid contract which is verifiers one right so let's talk about the verifier side the a set from of the proper side on the front end code is to have the two json as i told earlier then this proof.json and property.json should be represented as a verification key dot json this which is on kind of this thing to one from that of the verification verification kit.json in the previous slides so you can just compile your verification key.json using this node.js library which means is that your front-end application should have its dependency to the snartjs library and if you wanna uh if if the user the for example to collect the summit button for example then the snark jesus library comes into here and we're going to compile your proof.json and property.json to be on the verification.json okay so well the snapchat es the can um itself to verify whether your verification key.json is valid or not with if your does not js have the dm wasn't filed okay but the thing is your verification should be done on your own chain to be on transparently do the computation on the ethereum's global machine right so what we want to do is to make the proof.json and the public.json to be um converted with these kinds of the weird arrays this to be on the core data to be injected in this solid contract to verify but very verification contract okay so if you put this uh the code data into this abc input which is just defined in the verification contract then if you the proceed with the print just just on doing some call the verify proof function it will return whether it's valid or not your proof is better than not so that's the general way of how this kind of contract works okay so so simply put user a which is front and side generates a proof locally on the front end with web assembly file in the node.js application or the real-time prediction or whatever whatever that's almost approved to the smart contract and smart contracts the verified proof method will say whether the proof is valid or not okay so that's a general idea so i just said about the trusted setups and perceptro um we often use this growth 16 when we what the compost wasn't filed into this the proven kit.json the group 16 is some general as gold standard in the gkp world in 2010 too it has kind of very efficient prover time and constant proof size while has something like the um relatively fast verification time to compare to the to the competitors and it has lots of tools like the circumlet the smart js is very easy to use however as i said earlier we are the growth 16 requires two phases of trust setups one is for the global setup and second is for the specific the circuit but as i said earlier the global setup is not required to buy to run by or your own machine but you can just download which is already done from the gkc foundation which is already public to the um yeah guitar repository so go so get to so if you really want to get to know what's deeper so take out these links okay so there's alternatives as i told earlier there's a plonk right that's a universal choice setup it does not require another setup for a specific circuit but it's lower than growth 16. and the curve proof size is bigger verification time is lower and tools is now evolving and they are now just working in progress so the aussie and mina and the mirror is working on the plunk okay so this is kind of the uh some existing example of the zkp in ethereum network so tornado cache is really yeah the well known well known to want to hide your transaction the recipient and the balance and there's a dark forest which is mmorpg game which is um represented uh with the first mmorpg game um deployed on the ethereum contract with the power of the lg case nurse so um if you play this game you can just of secretly um the the you know the opens your arsenal to the others other game players without gonna write the exact location on the blockchain site so that's so fun so if you are interested so take the start first yeah if you want to really kind of join on the understa on the the game you're going to put your some something like stable coins there and the winner winner of the game will take some stable coins that's a bit that's a basic logic of the game and there are some kind of some examples here it's there's a gk photo what sdk photo is the gk photo is to gonna upload a low resolution image which is extracted converted from the high resolution image what i mean is that if you want to gonna sell your high resolution image 4k photos that depict this gun this this game landscape if you you know what what want to sell this uh just that 4k image well let's say you unload the 4k image to the open c well then someone can just simply turn out the the download image from the website right however um you want to just say you want to just prove that you have a high resolution image but not to kind of let's say they unload the link of the 4k image or just unload the 4k image to the ipfs to this not to disclose your their own image but to just unload the low resolution image with the um mathematical proof the dk version proof that you have you had already converted your um high resolution image to the low resolution image that would be on proof that you have a high resolution image without this clothing right so that's a really amazing um project this project is done by the hong kong university professor in cryptography so i do not know how this works exactly because the code is really difficult but it's really an interesting project and my one is the zika identity which is a graduate project radiation project from the nz general knowledge university um i have this um video here so let's take this so this is the concept of that comes from the dark forest um dark forest is consists of the rounds for each game but each game the for the sake of the um the enjoyment of the game the on the the 33 percent from the bottom to be um rolled out on the next stage then the rest of the game uh the rest of the game players should not disclose who is the first stage or who is the five fifth states so they need to not to disclose the exact rank of their or previous stage so that um brings more enjoyment to the game so how can we yeah achieve this so i gotta do this in a clone coding so if you so if you have kind of the designated of the winner of the game the the contract already knows there's a hard coded in in the github repository then who is the winner of this then um the winner can take a claim nfd anonymously to another address which mean is that you can verify that you are the winner of the existing address then you can mint your nfp to the different address different eoa address so that kind of the zk project is um yeah i i just um submit submitted this greater project to the dku so let's see so you can claim your only word by connecting your wallet okay we want to use this address to connect to oled this address is the winner okay so contract knows this when this contract is in the winner and there's the the list of the winner is represented as a marquetry's route so the third party cannot know easily and uh if you verify yourself as the winner the front-end tool might create a proof okay so you can just copy your proof and you can claim to the address that you want to gonna claim your entity to a specific address okay so put your what put your on the proof here and to put your the recipient of the nfd that represented you were the winner of the previous round to here then you can only mostly to claim to address without the request without need needing to disclose the response of address to the blockchain okay you can just hide the response on the public blockchain yeah and treasure transaction has sent and you can chart the transition here so the key of this is to hide the respite okay though it was a public blockchain you can just hydrate spend that's a measure of gk okay so well i have this simple example but we're just running off time i'm gonna skip this so interrupt is the on the the service that to prove that you are for example you have more than 5 000 um comments to date without letting you know the which github repository that you are okay so this can be used to be on the the uf3 social network to hide your own identity while proving that you are in a certain condition okay so it's on the interrupt link so it's really easy to use so yeah take this okay it's a good example so the moonshot some ideas that the decay pro the general rules proof application can be used okay it's based on the scalability and the privacy so what kinds of ideas can be um can be derived from the zen knowledge proof like the secret data marketplaces as i told earlier in the jdk photo project okay this centralizes motion learning or oracles okay so you might know you you might not to disclose the certain your personal data to the facebook for example but to say yeah i love to 200 shopping the apple products but i do not want to disclo disclose they i i have bought my mac pro in third 30 times for example right so you can just do that and the tape is the golf shifters of statica and he is kind of the lead kind of the leader of the um the ddj general x plrc which is a working group for the writing some generalized proof applications in that uh the develops the snore js and sarcom so take this off step for getting more ideas of the gkp okay so what is too long for them read so snarls as the gold standard for writing general knowledge proof for existing just ordinary solidity developers like with any proof systems there's approver verifier and a challenge which is proof okay so to make change not interactive which is not to on an interrupt before the very very to do verification there is some hard-coded common reference string that is the randomness okay so randomness which is set up during the trusted setup okay and this the random random string is encrypted to be reused and it is really important for those who are the inject the random string to hide their string okay not to just um do to recompute it's the proof um to make make the verification make the verifier to say that something proof is valid which is not valid so the zk jet cache um literally on the ddd the uh creates the um this in initial phase setup with with the kind of hundreds of particulars to put their each one of them on different string then concatenate that string and put it as a randomness and uh gcash has made gonna uh the transparent um on the proof that each of the the particulars participants of the initial phase setup to literally burn the string of what they have what they have input okay so that's what the gcash says while we are decentralized why because we prove that each of the participants already deleted this string from their own machine and well they try to prove that but this mean is that we have something like kind of the yeah to the single point of failure if the sum someone can just lie right by just manipulating their mathematical proof if they're possible to do so so that's why this the the some guys are really the developers are really looking forward to the implementation the practical implementation of the plonk or the starks which doesn't does not need or which one which requires only one initial um trusted setup so the initial setup is a really key point to kind of to do to keep the dk to be on decay okay so there are some cool tools for the zebra noise proof running your own application one is the semaphore protocol which tries to unwrap your circum library into a typescript one which is um along with the zk kit they they try to wrap your circle library into a typescript or javascript but this means that it lacks something like features you cannot use your full features of a circle but which means is that you can just easily implement this the telonor's proof idea into your application and the media protocol which just suspends is not i don't know an allow which it tries to be under another layer one that's specifically designed for the generalized proof and software is which is really famous i will not mention it okay so let's do some quick tutorial so you can just clone your repository on here the samples okay app i already um try to uh write the z case doku yeah which means is that the players can submit your own answer without revealing to the public blockchain to ethereum blockchain so the other third parties like for other game players cannot know which answer was submitted from the submitter right so the vivian she was um my colleague on general university um wrote the initial idea of the sudoku so i really thank her and you can take the basic website here samples is in case look the versatile app okay so let's play a little bit okay so connector wallet is boom okay so let's place goku okay well i'm not good at sloku so let's just i'll type some something like arbitrary one so it's empty one so eight so let's verify stoku or wrong not wrong solution okay wrong solution okay so this is okay let's look basically wait a bit so take your yeah repository here and clone it i'm gonna shortly describe how this code is written okay so let's talk about circle okay circum is all about the kind of restaurant okay it's all rather kind of giving putting a strong restriction on writing your own variables what i have already mentioned is that the circuits should be written in a quadratic form which mean is that if you write in the linear function linear form or more than on the um the more than a quadratic form this the compiler will reject your code okay so you can easily take your code on the web id like remix one in ethereum on the zkrdpl.dev okay so you can easily the test and compile your the circumcode on here okay so this one so this one let's talk about a little bit this is a quadratic form okay a multiply b then it puts the variable the output to c okay um when you say when you put the right in this way this means is to gonna assign the output of a multiply b to the new variable c but it does not mean which is not equal character in here just a single line here it's just the assigned parameter parameter not to not verify whether each the c should be a multiply b so the reason why we write circum is to verify one to put a strong restriction on the variable so you need to do and this way that's a common way okay so a multiply b should be variable c and and this will be on strong restriction so let's compile it anyhow it compiled one with r1cs and srm and main dawson so you will need to do play with this main awesome but let's say let's do kind of some like the triple form okay like the uh okay so does it possible to multiply a b and b the answer is no right it only accepts the quadratic form so let's say we have a b and d as the input if you if if you say a is some cereal input that's a public one you can put this as a private okay so anyhow let's say a multiply b multiply b can be or variable c when you compile this it returns that the constraints with the non-quadratic form is allowed so how can we make this how can we um assign variable with multiplying a b and d to represent this one in a quadratic form that's a really difficult sophisticated that's why we say oh the writing gk circuit and writing the general knowledge proof something like it's really difficult to kind of implement in the existing protocol that's why in this way that's why this um the reason to um represent your code just simply on the quadratic way it's really difficult so i just put some tweet that how can i make it so let's take this one yeah here is a simple circuit domain with circumlet i will just enlarge this website screen okay so let's say we have a basic template that allows you to check if a given number is there or not so there's an in there's out let's say this trinary operator can be assigned to imv okay well as i said um this um equals character with on this four it's not one right it's just some just a plus plus just a proline singer right this means is that we do not give um restriction on imv just uh the pro assignment of the output of this one but the out is gonna run out the burdened with the constraints that should be on quadratic form okay and anyhow the you want to do is that well the your input in is general not and the output is to say well your one is your not okay but it will not work because of the trinary operator trinary operator is not allowed in the certain way because it's not represented in which way quadratic form okay so you might believe that yeah this ternary operator to compare whether the number is general now seems to be a simple way but compared to user error why because the constraint needs to be quadratic and constraints can only have the quadratic form so how can we make it is on oh there it is isn't here okay so this is this this was the answer this was answer the wrong thing was here okay i was kind of mistake the wrong thing was here oh the input was in israel not it is not yeah right in the kind of the quadratic format but the correct answer is this one because imv does not have its its constraints to be on quadratic form but out which is an output of the circuit is written in the quadratic four way how we make this because we inverse the on the input of the public okay so we inverse the input so that we can just um modify the original launch version than the inverse version to um to kind of make it as a quadratic form so that's a trick that's a mimic but you need to do this if you want to use your circum language which is gold which which is clay to be on gold standard of the zen knowledge proof so how can i turn it off where's my mouse okay so let's back to the slide that's the way why we say the circum is difficult because of the restriction of the z case nurse implementation so anyhow let's take some example of the z case of the coup we will not go into the department supported because of the shortage of time but let's do our own test so i will give up you guys have already the clone repository or to put your own id so this one is for [Music] let me do something like the adjustment of our the phone size so clone the repository oh is it okay right let's see um it's difficult to read this one in the left side okay then here so um we have stupid awesome which is compiled from the circuit here there's a slow cool circuit here is dukkuda circle so that is the code um the very verifies the users on input well let's um make this circumfile anyhow to compile okay so let's compile this um i have a file that compiles automatically with using the shell script as a compiled sh the simple one just um compile the circuit with a circle command so let's do like compile that sh it the the shell script writes the r1cs srem and the watson file okay so let's put some input file we have info here okay so to be on the proofer side let's put this input to the wasm file to generate a proof so this one is unsolved one which is an answer and this one is to be submitted answer to not to be disclosed on the public blockchain so we have input json then we can generate the witness um the generator witness file is here okay so we have the generator with that return.js which is automatically um generated from the circumlet if after you decompile the circuit so if you run on what generate witness dot sh oh i just forgot how can i just give them permission so you plus something okay so then yeah so we generate the witness okay increase the yeah goodness then you can just download your go 16 file by running in this shell script you download the initial the the trusted setup or from this link okay this link is provided from the jet cache then it compiles circuit again and does within the wtns which is we downloaded the same logic then it generates generate the they did that key file and we put the second ceremony which is the specific for the circuit we put some random text here so it's not a thing for a practical kind of the production level because if you really want to gonna do in in in a production level you need to decentralize the way of putting the random text okay so the export verification key then generates the dk proof and verified proof and generate the solid verifier which to be undeployed in the solid contract then the print parameters of the call so we're gonna the input the output of the generated call function method on the verify that store which can be say is valid or not okay so let's run then i already have the file of this the initial setup but the download takes a lot of time and you can see that the generation of the uh the the zk file which is to be unproproofed it's really slow so as i mentioned earlier the prover takes some computation time while verifier can do the computation with all one fashion yeah you can just put this on yeah just kind of writing the whole data to the solid contract so we can just test the circuit also we have a test and in which files here maybe yeah it's a test of the verifying contract so this the verifying contract might return true for the bulletproof on chain [Music] and from the front-end side this will touch the front-end side to the test code so it has wasn't file and z-key file and after inject that it can have the output of the verified proof okay so take a look at this test testing function how it works so let me just show whether it works or not let's um npm test it passes right so this the test function verifies whether the the verify contract work well or not in the front-end side so this kind of the way to generate generate a call data to be put on the solid contract it's generated from this um unsolved and solved array by just running this on code export code data pro 16 which is declared in this nurse js which is to be a dependency of the frontend code then the um the verified proof which is to be deployed in the local blockchain then it returns value a lot so well we just have for enough time so i will just uh just keep the rest of the yeah the explanation of this but i think that this kind of example is really great to understand this decay um implementation in the front-end side and for the proverbial side so well i'm also learning that this the the dk-1 so it's really interesting for me it's really difficult to grasp and i do not fully understand of this but it's really interesting from my side okay so that's what i told earlier okay on the test side so i want to recommend something materials to study more is that well first of all the zku study session is really amazing so uh there will be um the another cohort starting from the september so take a look and the um jlx park parc which is some working group of the generation proof which kind of develops is not touch snark js they really do amazing thing and they gonna do something like um the offline conference in silicon valley in september so take a look and the generations podcast and gk have um provides regularly a really amazing materials for it and you can take something like the awesome generation proof kit repository that provides you a full um example to get into it and i'm currently i'm kind of operating something like study session on the on generation proof writing something examples or with snark js and starcom we now do kind of uh the the follow following we're not following the documentation of circle right now in the boom last boomers is a crypto developer community in korea and we have the zika evms basics um contract session ndk session and so on session also so we are trying to be on developer dial uh that brings the web to developers to the bridge into the web three and do they to find their own colleague to gonna to do your own business or to find a police on to go into a hackathon for example so we try to be on the committee crypto community developer community in korea and to understand global in afterwards so if you're interested in studying more with uh with me or our colleagues so take the link of this this course to join the boom labs okay so take a look it's really amazing our guys are kind of this this um maintaining our community so i'm really thank you to be on the final session of the dslv builders house so i really so yeah thanks thank you very much to take the session thank you [Applause]