ZK Circuit Development Using Circom, Halo2, Noir, and Plonky2

[00:00:05]uh yeah let's start yeah yeah so this is gonna be focused on just circuit building so if you're into ziki cryptography or um anything else uh yeah we're not gonna cover all of that so um our main characters for this session are gonna be Addison Bob and we'll go through a bit of CK snarks and then dive into circum and Noir um so just to get into the zika snarks part um so how did this all start so let's say Alice has a secret area of eight alphabets and she wants to check if Bob has the same Secret so Alice could do one thing so Alice could go to Bob and say hey uh just let me know what is the second letter uh of this secret and uh Bob could say yeah like Alice could say is it t or is it h and Bob would say yes or no and um hit or miss uh Bob might get a few answers right and Bob might get a few answers wrong and in this process the secret is gonna be elite so you're actually giving Bob the letters the secret and this is not really an efficient way of communicating uh passing Secrets I would say or the second way would be um to say hey Bob just send me the hash of the second alphabet and Alice could compute the hash of the second alphabet which is T and Alex could see if the hashes match each other this way uh we don't Leak with the secret yes which is a more efficient way and if you just want to see how the historians just refer to Justin Taylor's First Chapter which is uh in his book proofs and arguments um so this is how we start the ZK snarks problem um what we just did the second approach to this problem is that we hashed it we hashed the secret and we um talked to Bob we uh we were in a conversation with Bob to see if we have the same secret or not and this process can be now um divided into two parts so the part one is going to be hashing of pathowitz uh the secrets and part two is gonna be interaction with Bob and again this is just a Layman's description of what Z chaos or anything uh is and if you want to watch more about this we can go through the mooc lectures uh which were released in March so the hashing of the alphabets we have a message which we're going to turn into polynomials so if you're new to this just think message is going to be 1 comma 3 comma four and to turn it into a polynomial you're just gonna do x squared plus 3x plus 4 and what we do is we multiply um coefficients with random numbers and squares of random numbers so this specially is called a polynomial commitment scheme this is very close to hashing so there are cryptographic commitment schemes there are cryptographic hashes but commitment in gen uh in specific means that you can commit to something you can hide the value of something and you can um reveal the value of the polynomial each so this is called opening a commitment so that uh the process of hiding a secret in layman's terms would be um PCS for a normal commitment scheme and the interaction part where you ask Bob hey um what just happened to your second hash send me your commitments is the IOP or interactive Oracle proof now um we don't want to collude with power we don't want Bob to convince us something which is not obviously the truth so we try to make it non-attractive and that is why snarks are nothing but succinct so a short proof and it is non-attractive so we don't actually interact with and uh when does it become ZK so zero knowledge it becomes your knowledge when we don't reveal anything about the commitments or the secrets so um to make it zero knowledge the commitment scheme has to abide by these two properties which are hiring and binding um hiding means that it reveals nothing about the committed polynomial and binding means that they cannot be like two polynomials which when committed produce the same commitment or when you open a commitment um there cannot be two valid openings so this is about just ziki snarks and I'm this is not even um the surface of it so yeah feel free to dive in and know about this later now yeah cool so now we have a bigger problem now we're not just dealing with Alice and Bob and their secrets and their small Petty issues now we're dealing with a bigger problem like we um so if you're familiar with evm uh you know that every new node has to verify all the transactions done by all the previous nodes and this is sort of a bigger issue and and um what are devs CK devs and the evm in the blockchain sector thought that it would be a good idea to use ZK snars over here and just write a program to get all the transactions or this is just an example this could be applied to anything so we developed This Modern CK snark system where you could write a ZK program feed it into a proof system and generate a proof so this proof system that you see is what um we had here so modern snarks have a PCS and iops PCS is the polynomial commitment scheme and IOP is the interactive Oracle proofs and even you combined it you get a CK snark and that makes up for your proof system so uh yeah this one yeah yeah so we had part one where you hide the secret and part two where you interact and generate a proof saying oh yeah it's true or if it's no that's not true this is actually what a snark is so a snob just just hides whatever witness values you have and generates a proof a non-tracked away mostly and this is what snark is so it's like very simple a snar could be broken down into PCS and IOP yeah so yeah so if you've come from a development background like um front-end back-end if you understand that um circuit could be called as a front end of uh the ZK system and the proof system could be called the back end of um the process going on here so um there are a lot of proof systems like Route 16 flunk we'll dive into it much later but for now um we're gonna look into circuits so uh just to recap second is just a ZK program that you write to generate a proof using a proof system and that proof system which uses VK snarks is made up of iops and PCs PCS we use it to hide values uh so these are polynomial commitment schemes and iops are interactive Oracle proofs which obviously interact with the truer and the verifier they get they go to and fro to get us the proof so um I hope that's clear and I'm not like going too fast or too slow so let's just discard our main characters Alice and Bob and get into Brewers and verifiers so we're not no longer in with Alison Bob um yeah so our first second language is uh circum many of you would be familiar with this language it's sort of very a popular language so um circum takes inputs and outputs takes input values and generates output signals so uh just like um variables but not exactly variables it takes in signals so you could give a b c anything as m and you could generate outputs as well so this circuit over here which you see on the left is a very simple circuit so um you instantiate the circuit so you start writing The Circuit by using the keyword template and you have a circuit name you have signal input a single input B which means that we're going to take two signals which are inputs and we're gonna get an output signal C there can be as many inputs and as many outputs as you want and uh yeah the next thing is we are adding a and b and we are assigning it to C and also constraining it to C now uh this word constraining constraints under constrained is used a lot in the ZK circuit building space so it just means cool um yeah so you would come across this term constraints a lot um so this is the constraints are limitations or bounds so let's say to generate a valid proof you have to you have to satisfy all the constraints um so if you go back to the Addison Bob problem the constraint was that for whichever letter or whichever index Alice says Bob has to give the correct hash so it would be hash given by Bob should be equal to Hash produced by Alice that was the constraint there so here we say that when we do a plus b and assign it to C it has to be so those two variables have to be equal so in circum there are two operators which is like a bit confusing we have the assignment operator over here and we have like three equals which is which actually generates the constraints and if you just combine these both operators you get the assignment and the constrainment operator so I just used that one where you assign and constrain in the same line so uh these assignments are done by the plur and the verifier only calculates the constraints so if you just cue the single Arrow where you just assign something the verifier is not going to see that um so yeah that's an issue um then the next line moving to the next line we created an additional constraint which is that c has to be equal to 77.

[00:12:25]now now just to sum it up we have a circuit which takes two inputs um it adds A and B and it says that the output C has to be equal to a number 77.

[00:12:40]now now if you pass the incorrect inputs such as this circuit would generate the incorrect proof or this will not go through so this constraint would fail and your verifier would not accept your proof so uh there are two mainly used tools in foreign I use it almost every day if I'm coding in circum and the other one is circumscribe uh it's um it's a really great tool to visualize all your constraints so if you just feed this circuit in circumscribe it's going to give you this exact output it says that circuit a circuit dot a which means the input of circuit a plus the input of second B minus the input of circuit C has to be zero so that is how it creates constraints and polynomials so let's dive into ZK referencing how we run our circuits so I have my circuit here and to run the circuit I just have to do shift and enter and it says I have one linear constraint which is this one and I have two wires four labels that's all fine and the output is 77. the c here is 77.

[00:14:28]now if you want to try to come scribe okay so I'm using example as the name over here you can use any name so that is how you write circum circuits so I thought it'd be a good idea to go through the process of proof generation and then verifying the proof on chain um and there are two ways to go about it the first way is to use a z gear Apple yeah so before that let's just complete circle so um yeah so there are just three types of signals in circum one is the input signal next is the output signal and you have intermediate signals so you can just let's say you want to use signals and um somewhere in the middle you can just create one and these signals are immutable so let's say you assign a signal once you cannot reassign those signals later and um to people coming from fpga backgrounds or something with to chip building um or verilog uh this might be very familiar um there is a concept of variables but you can like use it to build constraints and not do calculations and all operations have to be of the form um multiplication or addition and the multiplication have to has to be non um quadratic sorry the multiplication has to be quadratic and not non-quadratic now to people what is quadratic quadratic is nothing but um something of degree two linear would be something of degree one and non quadratic Ruby anything that is not of part two so um X into X would give you x square and this is quadratic and anything other than this form is not really allowed so you can use these assign but not constrain um yeah and circum has a constant computation graph so if you come from a tensorflow startup a sort of background where you have a static computation graph um you cannot run endless Loops or um yeah Loops of your choice or um the variable computation graph I would say like in normal programming the last point is that the scalar field is around 2 bar 254 so this is not the exact number and why this is important is that the maximum number you can use inside this version of circum is around two part 254 so if you use any variable any number um like 2.55 what would happen is that um the number used in the calculations would be 2 power 255 modulo 2.254 so that's not what you want and if you want to change this you can you can just work circum and go and change the scale out wheel there uh uh yeah that is about circum and yeah so there are some there are a few security issues such as um there are going to be malicious Brewers so um you've got the right sound code or proper code and um do not use the single assignment operator the single Arrow uh unless you know what you're doing and some of the other security issues that if you leave your inputs unassigned a malicious Brewer could insert um his or her preferred value and generate a malleable proof uh yeah and for the shoe I just explained that so if you use an integer of 2 bar 255 bits this leads to an overflow yeah and always check your bit lens and um yeah there are a lot of precautionary measure measures you would see while using circum but yeah these are some of these um yeah so now let's just generally the proof and verify it using a smart contract so to do this locally in your system using yes code you will have to have um circum installed and it's not JS installed and um if you cannot follow through this video feel free to check out any of these tutorials by Rare skills or the other one um they've got like really good tutorials on that yeah all the code that we do is in my repository so yeah you could check that out as well so um yeah a shortcut to do this is to go to see careful and this is how I do it um you can do any of those you can either generate a proof using lot 16.

[00:20:00]or you could generate a proof using Planck so these are proof systems which you could use so I'm choosing the Planck way right so I've got a proving key and the solidity file is what I want right now um because yeah let's see okay I can download this is copy that contract and paste it into my remix so if you guys can see my screen I have a Planck verifier contract I'm just gonna remove this so yeah sure sure so as I said we'll be using multiple proof systems so if you just got the concept of snarks and proof systems one of the proof system is planck so um long is also the name of the iup and the polynomial commitment scheme that we use here is kzg um so let's say you're generating a proof using the Planck proof system you would get a verifier con generated by the same proof system and that is what we have here the Planck verifier contract um you could just and pilot okay there's some issue identifier not found or not unique what is this is deployed that contract and we have a function over here called verify true so what is the proof I mean what are we generating a proof for we're generating a proof to say that we know two inputs A and B uh which when added equates to 77 and we're going to generate the proof um using our command line so we would have a good idea of what's not jsr how we could do we could use snark JS so I have over here uh can you see my vs code okay okay and shows so I'm just gonna paste that um the clip we just did and let's just remove this so there are a few commands uh first one is to compile the circuit um have a YouTube training for you to circum circuit so um our file's name is circuit.secum and I'm gonna Open my command line and paste that push it oh okay so okay so everything went okay circumcise so the next thing we've got to do is um yeah we could do what we could do is generate an R1 CS5 so if you just go back to uh what we did before like 10 minutes um we said that the message would be turned into a polynomial so before turning into a polynomial um circum circuits would be boiled down to something called r1cs um r1cs is nothing but Gates and wires um it's something we'll see later so um we could do that okay so we just generated an R1 CS file with um a DOT Sim file which has all our signals um what else could we do okay we so uh if you just click on the R1 CS file um it won't be displayed because it's a bunch of binary stuff and uh not really visible in vs code so we could turn into a more readable form so let's do so it's using the BN 128 curve it has two wires one constraints two private inputs all labels one output yeah that's our information about the R1 CS5 uh the next thing is to turn your all right yeah to generate a Javascript file to create your witness vector go here paste this we just created a circuit um underscore JS file it has three files one is to generate your witness vector you just have to use this command which I have told here but before that you would have to create an input file to specify your inputs so if you see here we just have our circuits and our inputs there's the values for A and B are and where to be found so um what we could do is go and create input.json specify our inputs in this way like the JavaScript object and the next thing is that we have to export this as a witness file so just do we have to run this generate Witnesses file we do we just copy this command and paste it on our terminal there are witness file over here again a bunch of binary um yeah if you want uh if we can see the same file in Json format uh just copy this you have a Json file over here and yeah coming to the section you've been waiting for is to create a proof so to create a proof um we're doing it using plonk and plonk does something called Universal trusted setup so growth 16 is another proof system which uses a trusted setup for every circuit so if you have to if you want to generate a proof using rot16 you have to do a trusted setup for every circuit but now we're using plonk and we just have to do it once no matter how many circuits you use so over here I have a p Tau file now P Tau stands for powersoft Tau I have it over here and um it's 28 oh so the eighth one which means that the maximum that means I could use this 255 so if you just look at the number of constraints we use over here it's just one so um just look at your circuits and as per your constraint requirements you could use the positive Tau file um yeah so I just downloaded this passive top file earlier and I'm gonna use it to do my trusted setup now why do we need trusted setup and what is all this um so um just go back in PCS um what we did was multiply the coefficients of a polynomial with some random element g g Square those G and G Square elements come from our this beta of Pi so I have a whole blog listen uh blog version for this um so you could uh know more about that um yeah sure we just paste it here so we just uh generated r dot Z key this is like a proven key and you could verify if you have the right probing key using this command oh Z key file is not got 16 what did I do [Music] wait let's try this one okay this one works reading a proof this over here we just have to move it here so I hope we have proof.json oh okay we're getting the proof rotation all right so we could do two things um so there's our proving key and our verification key if you want we could just verify it using our command line or we could deploy that we could use our deployed contract and verify it using a solitary contract so let's just do this one first okay so it gave us okay which means yeah you're good next thing is generating a civil defile so um if you just rewind back to 10 minutes we generate a solidity file using ZK Ripple and we're gonna do it again now using our command line so this is we have our Sony D5 now um we're gonna transform our proof which we have into a more uh readable format like an array of un254 numbers so we could feed it to R so the contract so it's just messing around with our proof here we go so if you just this is a proof uh just a bunch of numbers um if you see the last one it is 0x bunch of zeros and the last thing uh the last two um letters are for d and if I'm not wrong 40 is 77 and what it's saying is that here's your proof and here's your public output for that circuit so let's just copy this by pasting it in this contract why is it not working there's some error so let's use this one maybe we're using different contracts yeah perfect [Music] um this contract need this one oh okay wait so whenever I try to share my entire screen it just doesn't work so I try to do it in tabs uh can you see my screen right now now oh let's just try to combine deploy okay um copy our proof once again verify proof so if you can see there's a Boolean returned saying true yeah so it says that yeah you gave us the right inputs and your proof is correct and um so if you're gonna verify anything on chain you do it this way you deploy this contract on chain and um no information will be linked if you want to prove something this way so yeah congratulations you just um went through a whole lot of tutoring um yeah that was circum and smart contracts so um if we have time maybe we could look at other proof systems and um yeah just let me know if I'm taking too much of time that's all the time you need you know as long as you want to stay I we also have a few questions from our community uh one question that I have here from work Hook is where is the public inputs and the verifier should take I'm sorry can you just do that again say that again where is the public input oh so if you just look here we we have your verify proof and you click on this drop down you see public signals and you see proof so proof is all that uh huge array from here to here and public input sorry public output which is 77 is what you give your verifier say hey I got the output so um if I'm not wrong 40 77 and what you give here in public settings yeah 14 I hope that's clear or oh cool uh yeah that was um circum a lot of smart contracts blank and ZK snarks and just to move forward so the ZK circuit development ecosystem is evolving and we have a few languages we just had a look at circum there's no R Socrates Leo Cairo lurk um so um most of the times docket is not used uh Indio is used by alio that's an another chain Cairo as you know is Darkness uh language um lurg is used by look Labs which is like a a ZK sectional file coin um then you have libraries the famous Bellman Library Arc works and all these libraries which you could use to write circuits and prove to people whatever you want and um proof systems so um as I said we just used long and there are other proof stems like growth 16 plonky2 and Buju which many people will be looking into this week or for the next month because ZK sync uses boojam and boojim is nothing but plunk IOP with a polynomial conference scheme as fry so yeah so if you want to get into zika Singh contest just go look at boojim and try building set it's with bujam um and yeah obviously look at the evm structure as well so yeah that would be my two cents [Music] yeah so I just mentioned rncs a while ago that if you have a message and you wanna and converted into a bottle now I mean um the first thing it boils down into is r1cs so um if you are circuit this constant 77 so while building our chip we could say yeah it's going to be 77 we could like enter the value over here um the next is our selector columns where we specify if the following gate has to be on or off so mostly the value is 0 or 1.

[00:41:25]and if you have a gate which defines oh a0 plus A1 has to be equal to F1 there has to be a selector over here specifying or you have to do this you have to perform this application so this is about Halo 2 uh yeah so just um doing a recap every column is a polynomial so all the witness values you have ball boils down to polynomials um and okay this is very technical instruments okay yeah and if you want to have a look at the Halo 2 circuits um I have that as well so let's just close the circle one and go to 02 yeah so this Halo 2 Library which I'm using uh has been developed by the zcash team um and uh yeah you just have to import their library and Define columns so this might be a bit buggy because I didn't check it so let's say you want to have your input a and then your input B these two inputs come under the advice column if you just recall advice column is where your private inputs come in the so yeah so column A and B is for that then you have your selector and instance columns um then you create a chip and you create a gate saying oh I want an addition gate and what I want to do is I'm going to add a and b and the output which is C um so when you do a plus B minus C it has to be zero so we create a constraint this way and we sort of use our layout to assign I'm not going too deep into this because yeah it would take a lot of time but feel free to just come in and check this so yeah this is how you create a circuit using Halo 2.

[00:43:47]um which is another Library um the third one is Noir Noir is Noir was developed by the Aztec team and Noir is still in the development um and they have this out of all these I would say this is like most easiest language to start your circuit development Journey it's very much like rust you have to Define it's very much very much like a normal program or you would write a normal script so I just do the same circuit in all the blue systems all the circuit building tools um so here we take yeah yeah these are on my GitHub yeah so we're doing the same thing adding a and b and saying it has to be equal to 77 and returning C so um in Noir all the outputs have to be public and you specify that keyword orals it would give you like an error if it won't specify this is missing Bob keyword so um yeah and I just wrote a small test to see if it can read passes and if you just check the directory structure of Noir there is um the novel file where you have just basic information and then you have your profile where you specify your inputs so A and B I'm giving here as 4 and 73.

[00:45:30]and the verifier file because we say that C has to be equal to 77 or I got too many files [Music] so yeah that's your verifier um dot terminal and this is your prover.com and you give your inputs to approve so um try to run this so the last time I tried to run it just got stuck and it was like this for like two days there's some issue with Noir since they are actively developing it oh yeah um Noir test so nargo tests runwell yeah it says all tests passed verified to hold on or prove which is what you which is the command you do you give to generate a proof it just gets stuck well yeah just try it some other day it's very easy and very um yeah very easy for picking as I would say and here's my Noir cheat sheet it's just like a few instructions or commands that we could use to generate proofs verify those proofs um compile circuits c um yeah initiative project or just like in um long where we uh just like in snark.js and silica where we created a solidity smart contract to verify that we have the right proof you can create a verifier contract and no r and the command for that is Cargo sorry cargo code generator so yeah I just try these out and it's going to be very easy no on coming to our last section which is splunky two again just going to go over the same one um so plonky 2 is a bit different from the other circuit systems and plonky to um is very similar to Google say um though I haven't looked at the Z case BCS and IOP they just have different names in my it so plankey2 uses Fri as the PCS polynomial commitment scheme and long as it's IOP and it operates over the whole Deluxe field so if I'm not from Goldilocks field is something like 64.

[00:48:32]minus 2 pi almost E2 plus one um this is the Goldilocks field and this is a small field so the proof generation verification is very passed and um there are not many applications or circuits using this so if you just search over GitHub you wouldn't find many full-bone applications um though main protocol or polygon 0 uses this um but yeah it's it's evolving and many four a building over it such as succinct Labs um they are building a wrapper called platform um yeah again very similar to Halo 2 if you go through Halo 2 you would find that there is the circuit config you initialize a new circuit and you get a builder object and you add labels um here the labels are called targets so you say oh I have an put a hover and put B and there's going to be a label c as well you add it and you try to create constraints so um yeah that's how plonky2 works the one thing which separates wrongly to from the other ones is that the verification is also done inside the circuit so um it uses recursion so just explain it in a simpler way you have your circuit you generate a proof saying you um had your yeah you computed the values um in a correct way and you have a verifier inside the circuit and you feed that proof to that verifier inside the circuit and you can read another proof so here what you see is called recursion of proofs so this way you get a proof size and aware the verification cost in the book cost is um like lesser compared to other circuit libraries so yeah we just covered like four do languages and two libraries I gotta say this is very cool a very cool presentation thank you so much you know for doing that for us very enlightening and to see all the different applications and into different languages it's also very important I have a few questions from by the way keep going I think you still you still have it you still have slides uh no I just have resources so if you want to get started with circum um just go ahead you know our plan more plunk level two are you making these presentation available so we can click on these links yeah sure sure why not thank you so much um I have a few questions here from Community um the first question actually here okay you just answer one effect easy KVM nzk I think similar um if we are familiar with the ZK VM workflow can we participate in this Decay Sim contest oh we need more info ones in Daily zinc only nice question I've been getting that question a lot today um so there are multiple types of zkavm um if you're familiar with psycho scroll or the ZK VM which PSC is building um so yeah there are multiple approaches to building KVM and CK sync is just one of those one of those ZK VM so um if you're familiar with evm itself or how opcodes um and read write operations work in APM I think it'd be good to go with the CK sync um contest because um what CK Singh has done is that they've created a KVM um very similar to our AVM and they might not support a few op codes or they may not support a few operations but if you know evm well you would do good yeah awesome awesome answer how does the concept of universal setup in CK snarks impact their security and applicability in your work scenarios a really good question so um um if you just go back to polynomial commitment schemes um which I find over here you see g g Square um G Cube these are supposed to be kept Secrets like when a trusted setup happens I'm sure you might have seen a lot of tweets saying participate in this trusted setup and what you do is everybody comes together to contribute randomness and um a random set of points are generated and used in generating the commitments so in terms of security let's say um we all all of us reveal our Randomness or somehow these random parameters are compromised and gets into the hands of some bad person that person could use um the secret information to exploit the proof or generate Malibu so it's extremely important that we try to randomize our trusted setup process as much as possible so one of the very famous trusted setup process which is which just got closed like a week ago was the with kzg process from ethereum um not certainly a few uh you guys participated in that yeah um military effect this is it this was really enlightening uh thank you so much for this presentation I wanted to know if you have any closing thoughts or any message when you leave for people that will see this in the future um I would say I would say this participate more in such um budding Technologies like trusted setups or show your support for people who are building these EK VMS they are working really hard and um if you're interested in learning uh yeah do give it a try