Antonio Sanso:Hi, everyone. Welcome to the third call.
Transcript
Antonio Sanso:The post-quantum transaction signatures.
Antonio Sanso:I… Hope you'll see my slides, and… Let's start.
Antonio Sanso:If I manage to.
Antonio Sanso:Move this from my screen.
Antonio Sanso:Right.
Antonio Sanso:Do you see my slides, right? I think, like, yes. So, this third call, we had two calls so far.
Antonio Sanso:The first one was on, about lattice solution.
Antonio Sanso:The second one was about hash-based solution. Today, we have a special
Antonio Sanso:topic, but it's an NTT and non-per-compile.
Antonio Sanso:We'll have a kind of abstraction in the next call, and hopefully hardware support.
Antonio Sanso:And two goals.
Antonio Sanso:So, probably some of you seen this already. There's been this tweet by Justin Drake.
Antonio Sanso:Presenting this, long-term straw map org.
Antonio Sanso:the dislike, shows a bit of, idea for a potential Ethereum futures. Of course, this call, we're not gonna focus
Antonio Sanso:On all these boxes.
Antonio Sanso:And we probably are more interested about this… part.
Antonio Sanso:Specifically, like, native account abstraction that we don't focus, but we leverage it.
Antonio Sanso:And the really part… the meaty part for us is really… This NTT precompile.
Antonio Sanso:Or more than one. So, there was as well a tweet from Vitalik that, talks about a concept of non-peer compiled, and it's, like, more operation, not just NTT.
Antonio Sanso:So, I'd really like to, kind of try to
Antonio Sanso:launched this meme of Daisugi, and in my mind, we will have the NTT precompiles being there, down, and hopefully people will build on top of it.
Antonio Sanso:different signature schemes that are post-quantum or stark, because both starts and latte solutions, they have in common the fact that they heavily used polynomial rings, so operation on planet fields needs to be really efficient.
Antonio Sanso:The agenda for today is pretty lean, on purpose, because the first two calls, we set the stage, and so we had a lot of presentations. In the future, I will expect to have
Antonio Sanso:Some presentation, but mostly open discussions.
Antonio Sanso:And, the presentation of today is, I think, already in Advanced Renault, or Simon, I think Renault is a good percent.
Antonio Sanso:That will show, this NTT precompile that, ZKnox
Antonio Sanso:So, Simon and Renaud are ready.
Antonio Sanso:I presented, tried to launch last year, but now there's a revival.
Antonio Sanso:And with this, without further ado, I've passed the…
Antonio Sanso:the word Renault. I've seen you around before, Renault.
Antonio Sanso:I think you're still here.
Renaud-ZKNOX:Yep, yep, I am, so…
Antonio Sanso:Let me stop presenting, and…
Renaud-ZKNOX:Yeah, let me share my screen.
Renaud-ZKNOX:You… you have to shut your…
Antonio Sanso:Yeah, yeah, I'll try, I'm trying.
Renaud-ZKNOX:sharing, so I can launch mine.
Antonio Sanso:I have some issue with my mouth today, I don't know why.
Antonio Sanso:One second, I don't know what happened to my mouse.
Antonio Sanso:Alright, she'll be fine now.
Renaud-ZKNOX:Yep, yep, yep, let's meet…
Renaud-ZKNOX:Can you see it?
Antonio Sanso:Perfect, yep.
Renaud-ZKNOX:Okay.
Renaud-ZKNOX:Yeah, so… so this is a… this is an EIP we… we tried to… to launch last year as,
Renaud-ZKNOX:Antonio… Antonio said, we, we implemented it.
Renaud-ZKNOX:So I'm gonna present it. Actually, we were a bit surprised, to see the precompile appear,
Renaud-ZKNOX:In Justin, in a Justin tweet, last week, because we…
Renaud-ZKNOX:We actually didn't get too much eco on this one, but, yeah, so there was a sus mention for the straw map.
Renaud-ZKNOX:Not sure if Justin was intending here to directly target this precompile, or maybe it's related to another thing that Vitalik tweeted also last week.
Renaud-ZKNOX:Which is a numpy, NUMPI precompile, which, I will also…
Renaud-ZKNOX:Give some, insights, during, this, presentation.
Renaud-ZKNOX:So, starting with, with this, so, at first, yeah, the, the topic was a bit less hot, when we,
Renaud-ZKNOX:when we first, wrote this, this spray compile, we have two things in mind. So, of course, the post-contum threat.
Renaud-ZKNOX:Which is a very hot topic right now. So, okay, we, we talked, about it, during the previous, previous sessions.
Renaud-ZKNOX:the two EIPs that are,
Renaud-ZKNOX:that have been proposed, EIP8051 for Delitium and 8052 for Falcon.
Renaud-ZKNOX:And both share one common, core operation, which is a polynomial multiplication, in a ring, and this is, this can be efficiently computed, with NTT.
Renaud-ZKNOX:So… So this is, this is the core of,
Renaud-ZKNOX:of this precompile. And it also happens that this NTT is also used in the stock, verification, so I'm not sure if, for instance, Starknet is still,
Renaud-ZKNOX:is still, doing the L1 verification with the Stark directly on N1, or wrapping it in a KZG, but, the, this NTT we are pre-compiled could also, speed up, this part, so, to allow, fast
Renaud-ZKNOX:third verification of a ZK prover, even if… I guess that will… all the work that have been done since, we should, or we could have some…
Renaud-ZKNOX:pre-compile for the ZKVerify itself.
Renaud-ZKNOX:So I guess that, the other topic is a passcan to demonstrate.
Renaud-ZKNOX:So, if we…
Renaud-ZKNOX:The position of this precompile, so we have very specific, EIPs for the LTM and Falcom. Of course, they are optimal in terms of gas costs, because when you implement a precompile, this means that for the clients, for instance, gas, rest.
Renaud-ZKNOX:to call the precompiled, it means that there is a switch of context, which comes with a price. So, of course, having a monolithic implementation provides better gas costs, but, of course, it's also more rigid, and
Renaud-ZKNOX:if the choice has to be replaced, this means that you have to write a brand new EIP while having the NTT precompiled. You have some universal primitive for all lattice-based candidates, and more than this, because polynomial multiplication is not limited to…
Renaud-ZKNOX:To, to, to verifying a signature.
Renaud-ZKNOX:It does not include the ash, so as we presented for Falcons, if you have an EVM,
Renaud-ZKNOX:equivalent, where you replace the hash2Plane function by, EVM compatible. You have something that is
Renaud-ZKNOX:gas-efficient, otherwise you have to implement CHECK, and this is very expensive. Actually, when we implement the NIST versions of Delithium and Falcon. The ash is the most expensive part, so we will need a sheck precompile. We're also working on this.
Renaud-ZKNOX:So this is, this is here in the middle that, we have the NTT precompile, and another thing that has been introduced, by Vitalix recently is a NUMP precompile, we will, call it the NumPy precompile.
Renaud-ZKNOX:Which introduce, vectorized operation, for small, 32-bit, integral.
Renaud-ZKNOX:And so this has a maximum generality, many applications, so it's not limited to lattices, it could also speed up
Renaud-ZKNOX:matricial products, big integrals, implementation, poseden. This means that, for instance, even if you want to implement large, larger elliptic curve computation.
Renaud-ZKNOX:I knew there were some, some initiatives that were actually very, very, optimized, but still, to have a CDCAS384, it's like…
Renaud-ZKNOX:10 million guys, so this will also benefit, from this.
Renaud-ZKNOX:But, as it is not monolithic, this means that you will have
Renaud-ZKNOX:Many, many other bit manipulation, hashing, for the world primitive. So, to address a specific, primitive, you have something that is less efficient.
Renaud-ZKNOX:Okay, so back to EIP7885, so it introduced four opcodes in the precompiles, so we have the NTT forward and, inverse.
Renaud-ZKNOX:And, the multiplication and addition of, vectorized tap, types, which are VECMILMOD and VECAD, VecAddMod, so…
Renaud-ZKNOX:this polynomial multiplication, the NTT compared to the naive, naive approach as a complexity of n log m.
Renaud-ZKNOX:And in our implementation, the fields that we covered are, of course, the NIST primitives, but also the…
Renaud-ZKNOX:the ash fields, that are for sites for stocks, so Baby Beer, God Deluxe, I think we have Koala, and the stock curve.
Renaud-ZKNOX:So, benchmarking this, we have… Something…
Renaud-ZKNOX:So, the reference Solidity Falcon is 1.5 million gas.
Renaud-ZKNOX:Implementing it using the, the NTT precompiled, we were able to lower this cost to, 400,
Renaud-ZKNOX:Okay, guys.
Renaud-ZKNOX:So, this is a… this is a huge improvement.
Renaud-ZKNOX:I think this is close to twice, the strengths minus, that, were presented last, last time.
Renaud-ZKNOX:But the… the call data size, is, yeah, very small. Very small compared to the huge, I don't remember what was the size, the size is, obtained by the…
Renaud-ZKNOX:Sphinx minus proposition, but, like, yeah, I think 20K kilobytes, something, something like this.
Renaud-ZKNOX:So, we have this decrease, but, the remaining bottleneck is, yeah, the ash function.
Renaud-ZKNOX:So, while we… we could have something that…
Renaud-ZKNOX:that could be to KGAS, who is, the companion IP.
Renaud-ZKNOX:So… yup, yup, yep, so…
Renaud-ZKNOX:Yeah, I guess I already talked about the advantage of the specific compared to the more generic, more generic approach.
Renaud-ZKNOX:Yeah, and so this NumPy, so that's a promising parallel track, we started to work on.
Renaud-ZKNOX:So it's a NumPy-like frequency for the EVM, so it's introducing vectorized modular arithmetic for those who have followed, their proposition, which was kind of…
Renaud-ZKNOX:abandon, with the… with the deaths of, EOF, which was EVM max.
Renaud-ZKNOX:So, EVM Max was a powerful, but very complex precompiled. I think the problem with EVM Max, it was introducing too much things at a time, and was too…
Renaud-ZKNOX:Too complex, while, what NumPy is, is just, vectorization
Renaud-ZKNOX:And the input of the precompile is the size of the vectorization and the operation. The operation being either addition, multiplication, with or without modular reduction.
Renaud-ZKNOX:So… So, yeah, we, we just started, we just started this work.
Renaud-ZKNOX:So… NumPy would provide maximal, algorithmic, agility.
Renaud-ZKNOX:But, at the expense of higher gas costs, because, we would have more data manipulation between the different stages of the NTT.
Renaud-ZKNOX:So…
Renaud-ZKNOX:To conclude, EIP7885, it's a single precompile that enables a post-consume signature verification and speedup of stark verifiers.
Renaud-ZKNOX:Providing some cryptographic agility, so there are still some constants,
Renaud-ZKNOX:Around, tights to which, which is, prime field, we are working on.
Renaud-ZKNOX:Yeah, and so right now, we began, we began some benchmarks, on targets.
Renaud-ZKNOX:Yeah, so… So, not, not sure. The proposition is on the, the table, we…
Renaud-ZKNOX:We kind of, put it on pause, last year, but if… if the interest is back, maybe we can…
Renaud-ZKNOX:revive, and work a little more on this one. So, I don't know, Antonio, if you have more insights about the trauma.
Antonio Sanso:I have a bunch of questions, if, I mean, if someone has a question, can post on the chat or tell, but I have at least 3 questions, if you don't mind. Until today, I didn't… I didn't understand… I mean, I was not aware, or, like, maybe I'm not correctly. Is the NTT and the NumPy… no, the NumPy precompile.
Antonio Sanso:in… opposition. I mean, it's one or the other, or they can work together.
Renaud-ZKNOX:I guess they can work together, but as the SADA functions, the more candidates you have, the less…
Renaud-ZKNOX:probability you have for each of them to be accepted, so I'm not sure that we should push all of them, but instead, maybe…
Renaud-ZKNOX:Choose a… a champion.
Renaud-ZKNOX:So this NVM Pi, we have…
Renaud-ZKNOX:Yeah, we have promising, first, first results.
Renaud-ZKNOX:But it needs to be incorporated in the world scheme to see what are the final, final gas costs we obtain, for… compared to…
Renaud-ZKNOX:To a monolithic NTT.
Renaud-ZKNOX:But I don't think it's a good idea to push all of them at once.
Antonio Sanso:But can it, I mean, can it be one that includes both an MP and an NTT, or, like, really cannot stay together?
Renaud-ZKNOX:No, I mean… I mean, MPs really…
Renaud-ZKNOX:is really something that is a kind of trade-off. Before, we have the risk VM, because I think this is,
Renaud-ZKNOX:This is the endgamer, right?
Renaud-ZKNOX:It provides many, many potential speedups for values, values implementations. That's what is really interesting.
Renaud-ZKNOX:And it happens that, NTT is, is one of them, so… bets…
Renaud-ZKNOX:Yeah, so they are not… they are not antagonists. They are not antagonists at all. Okay.
Antonio Sanso:And…
Renaud-ZKNOX:I mean, the, the, the, the ACDE… .
Antonio Sanso:Oh, yeah. I'm well aware of it.
Renaud-ZKNOX:the way it works, I don't think that if we…
Renaud-ZKNOX:Okay, pushing a single, cryptographic, precompile is already hard.
Renaud-ZKNOX:They don't like it, because it's hard to evaluate.
Renaud-ZKNOX:It's… it has… yeah, looking at what happened with BLS, you know, one of the rare incidents.
Renaud-ZKNOX:that happened was in divergence between clients with BLS, so since then.
Renaud-ZKNOX:I guess at core there, they are really scared when you want to introduce a new cryptographic precompiled, so…
Renaud-ZKNOX:I would mainly say that that's the main reason
Renaud-ZKNOX:not a technical reason, or the fact that there are antagonists, but the fact that, okay, pushing too many, computational, pre-compile for the same fork, I guess…
Antonio Sanso:No, but I mean, it will be still one with many opcodes. I mean, you have on your… on this NTT, there were four opcodes. How many opcodes you will see more in the NumPy one?
Renaud-ZKNOX:Only one.
Antonio Sanso:Only one.
Renaud-ZKNOX:Yep.
Antonio Sanso:Because I was under the impression, I see Vitalik here, actually, I was under the impression that the NumPy one will be having, as well, plus, or more.
Renaud-ZKNOX:Yep, yep, but… It's,
Renaud-ZKNOX:It's a parameter inside the precompile, so… yeah, you could say that it's kind of cheating.
Renaud-ZKNOX:But actually, it's really, if you see how,
Renaud-ZKNOX:vectorized, op-code works, it's like…
Antonio Sanso:It's, like, flexible, I mean, the input is… okay.
Renaud-ZKNOX:Yeah, I mean, it's like changing the… having one parameter would be the operation. Is it multiplication, addition, or subtraction?
Renaud-ZKNOX:And then it's vectorized on all the cells.
Renaud-ZKNOX:That are the input and output of,
Renaud-ZKNOX:of the precompile. So it's a bit less complex than, than.
Renaud-ZKNOX:than, EVM Max, of course, bets.
Renaud-ZKNOX:Yeah, but still, still a… still a complex one.
Antonio Sanso:Alright, and the last question, then I will have two questions in the chat, I see as well, is… I've seen that you were supporting, like, five, six primes on your proposal. Will it be totally out of question to have, like, the prime being…
Antonio Sanso:Generic.
Renaud-ZKNOX:No, but.
Antonio Sanso:This means that in the cold data, you would have to provide the power of,
Renaud-ZKNOX:of a generator as lookup tables, because if you… if you have to compute, the power, to… to recompute on the fly, then you lose all the interest of, of the precompile.
Antonio Sanso:Makes sense.
Renaud-ZKNOX:It's like… it's like when you perform a Montgomery multiplication, you provide the Montgomery constants, and if you don't, you lose interest of Montgomery multiplication, because computing, the constants.
Renaud-ZKNOX:Imply some inversion.
Antonio Sanso:make a lot of sense. So it will be really about, like… I think, like, choosing, like, the standard primes plus 3 or 4, I mean, will be enough.
Antonio Sanso:Now, I see a bunch of questions here, and we can go in order, and Gotti, you will be the first one, if you want to repeat by voice, or I can read, I don't know.
Gottfried Herold:Yeah, I mean, that was just a question. I mean, you partially answered it. To what extent, actually, you utilize the fact that you have hardwired primes in your precompiles. You know, so it, I mean, it just has a bit of a different, sort of API, depending on whether you can have arbitrary primes, a special set of primes, and with pre-computed tables, and so on was just a question.
Gottfried Herold:To what extent this sort of matters here.
Renaud-ZKNOX:Yep.
Renaud-ZKNOX:Yeah, yeah, so for the NTT precompiled,
Renaud-ZKNOX:It's really hardwire… the hardwiring, is, really important, because you have to pre-compile, pre-compute all those, power of P.
Renaud-ZKNOX:So these are a large, lookup table. For the NumPy, precompile, it's, really small, because here it's, it's only a barrett, barrett multiplication.
Renaud-ZKNOX:So I don't know if you see how Barrett multiplication works, but here the, the constant is very fast.
Renaud-ZKNOX:Yeah, I know. So it's really fast amortized, so… and we think that, so there was discussion, should we provide the Montgomery constant and, implement the, the, the vectorized multiplication as Montgomery? And no, we, we think that, Barrett,
Renaud-ZKNOX:So Barrett is, like, 30%, more expensive than, than Montgomery, but if you look at the fact that, the precompile also provides some… Perform, the butterfly.
Renaud-ZKNOX:So the gather-scatter, layer. So this is, amortized, so Barrett, Barrett compared to Montgomery, when you have to, to have this, linear permutation layer, is very…
Renaud-ZKNOX:very close to Montgomery. So, using Barrett, Barrett multiplication, it's very fast to first, compute the approximation, of Barrett, Barrett constants, and then, proceed with the full,
Renaud-ZKNOX:With the full, yeah, bar rate multiplication, or… and also for,
Renaud-ZKNOX:For modular, modular addition, it's faster to, to use Barrett, than, conditional, yeah, the conditional, modular production, which is just a subtraction for, for addition, subtraction.
Renaud-ZKNOX:If it's clear.
Antonio Sanso:Makes a lot of sense.
Antonio Sanso:I see as well a question from Stefa. I don't know if you want to go by boss, I didn't read the questions. You want Steffa?
Stefano Gogioso:Sorry, it's… yeah, Stefano, this is Windows being silly and cutting.
Antonio Sanso:Okay, awesome.
Stefano Gogioso:All right. But I think Dano can go first, because that seems a bit more… a bit closer a question to what we're discussing now.
Antonio Sanso:Dana, you want to go?
Danno Ferrin - Tectonic.xyz:Sure. I wanted to know how the precompiler has been done dealing with multiple bit widths of the encoding. I didn't see any specification of strides or anything, and…
Renaud-ZKNOX:The percentile definition.
Danno Ferrin - Tectonic.xyz:And, like, the keys of the Lithium and Falcon, they don't fit into 8-bit buckets. You know, we've got 3-bit, 4-bit, 10-bit, 14, 20-bit, and they go back and forth between the different bits all the time. Are you going to expect people to decompress their keys and bit align them before they submit them?
Danno Ferrin - Tectonic.xyz:Or will you be taking the canonical keys and be able to use those within the precompiler, or will we have to massage them with EVM?
Renaud-ZKNOX:No, here, it means that this is a bit manipulation that would have to be performed.
Renaud-ZKNOX:I think that the decompression, because we had this same problem when we implemented our Falcon in full solidity, and I think that, the overall cost for decompression was something like $150K.
Renaud-ZKNOX:So, yeah, that's expensive, and also the question is, should it be performed, at the contract layer?
Renaud-ZKNOX:Or, because actually, for… for the, for the signer.
Renaud-ZKNOX:The signer could be the one, performing the, the decompression.
Renaud-ZKNOX:And actually, actually, what is, very annoying is to have the, the 14, the 14 bits, representation, instead of 16.
Renaud-ZKNOX:Because it implies a lot of bitwise manipulation.
Renaud-ZKNOX:But, yeah, the…
Renaud-ZKNOX:the decompression could be… could be done wallet side, because it's just an encoding, right? So, there is no secret handling,
Renaud-ZKNOX:The way you represent, the function to verify can be specified, either at signing level or at, verifying level.
Danno Ferrin - Tectonic.xyz:So, what we're undoing is what the designers of the… of the particular algorithms we're designing for, which was smaller key size and smaller signature size, specifically for blockchain solutions.
Danno Ferrin - Tectonic.xyz:So now we're asking end users to undo that, and use a much more expanded form of the key and the signature, on the blockchain and increasing our carriage costs.
Renaud-ZKNOX:Yeah, I mean…
Renaud-ZKNOX:I mean, if either we have a fully NIST-compliant precompile, and this is more, the specific EIP 8051, 8052, which can just straightforward push NIST-compliant verification.
Renaud-ZKNOX:Or you will have to… to have something that is more custom, and here, I would say you're,
Renaud-ZKNOX:The contract, developer, will…
Renaud-ZKNOX:Yeah, we'll have the freedom to decide where the complexity of encoding is handled.
Danno Ferrin - Tectonic.xyz:So, yeah, this, I guess, is probably a subject for next week's as well, but the odds of getting custom hardware for custom bit widths for NIST algorithms, I think, is pretty low.
Danno Ferrin - Tectonic.xyz:The further we drift from NIST and our recommendations, the harder it's going to be, to get better hardware wallets, to get better adoption from, institutions. I mean, if we're just doing cypherpunk freedom, great.
Renaud-ZKNOX:Yeah, but…
Danno Ferrin - Tectonic.xyz:But that's limiting our market adaptability.
Renaud-ZKNOX:if I can add a word here, you can have an adaptator, which can be in software between the hardware signer, because, I mean, an encoding is something that can just be handled by the companion wallet. I mean, this is a public,
Renaud-ZKNOX:A public, computation.
Renaud-ZKNOX:So, you are not able to forge on forge, so…
Danno Ferrin - Tectonic.xyz:That can be done on social.
Renaud-ZKNOX:Where over, over, over the, hardware signer.
Danno Ferrin - Tectonic.xyz:Right, and that adds friction for non-users, like auditors, who need to verify it as well. I'm just concerned the more friction we put on.
Danno Ferrin - Tectonic.xyz:The more difficult it's gonna be for institutions to adopt this.
Antonio Sanso:But, correct me if I'm wrong, guys. I mean, as long as I understood, like, we have this NTT precompile that is as generic as possible, so people writing contract will be able to use different pieces of LEGO, in this case it would be Entity and shake.
Antonio Sanso:to… to do, like, if… to do whatever, right? I mean, because we have as well, like, an abstraction, so they will be able to do, like.
Antonio Sanso:Falcon, or Dilithium that is standard, or…
Antonio Sanso:or less standard, depending on what they really kind of decide to do it. And of course, like.
Danno Ferrin - Tectonic.xyz:there's still missing pieces, like Falcon would still need the shape precompile.
Antonio Sanso:Yes, yes, indeed, like, I will go to this other piece of question for Renault. I was really impressed by the 2000 GAS, if you have the check precompile. This is really impressive. Like, I mean, if really, like…
Antonio Sanso:Shake is as well common between…
Antonio Sanso:the Litimate Falcon. If we really have the combo NTT shake, this, like…
Antonio Sanso:With 2,000 gas, it's really like…
Antonio Sanso:As competitive as… as the current signature scape.
Antonio Sanso:Right.
Renaud-ZKNOX:Yeah, but I… not at all, because EC Recover is 3K, and actually, EIP851, AT52, so this 200K doesn't include the call data, right? So, if we… if we leave apart, the… the data cost.
Renaud-ZKNOX:So here, it's a rule of thumb of the sizes.
Renaud-ZKNOX:Actually, verifying a Falcon signature, or a Delithium signature, it just,
Renaud-ZKNOX:benchmarking DLTM and Falcon compared to a CDSA, and actually, it's… it's… it's really close.
Antonio Sanso:Yeah, I mean, delegate maybe have to…
Renaud-ZKNOX:We have something that is the data cost plus, plus 3K, or… and actually, the computational part will be negligible, compared to the core data. A bit like, what Consini, presented us last time.
Renaud-ZKNOX:All the costs lie on the… on the…
Renaud-ZKNOX:Large, data size we have to handle.
Antonio Sanso:So, assuming you have Shake and Tdprecompile, how much will it cost to verify a file, can you say?
Antonio Sanso:With bulk precompiles.
Renaud-ZKNOX:No, no, that's what I said, around 200K.
Antonio Sanso:Okay. And where's the other cost come from?
Renaud-ZKNOX:So what?
Antonio Sanso:I mean, where are the other causes coming from? Like, assuming you have, instead, entities, shake, and Numpy, how much you can cut?
Renaud-ZKNOX:Now, I mean, numpy will not cut. NUMP will be a larger cost than NTT, but NUMP is very agile.
Renaud-ZKNOX:With, with NUMP, you, you can speed up Poseidon, you can speed up, NTT, you can speed up, big integers.
Renaud-ZKNOX:Begin togetherless computation, if you want to have some I don't know,
Renaud-ZKNOX:yeah, larger elliptic curve, and so on and so on. So, an MP… NIMP is not… Yeah, it's…
Renaud-ZKNOX:It's a very, yeah, it's a useful tool that will be used for, I guess, any cryptographic algorithm that is not a precompile would benefit from NumPy.
Antonio Sanso:Right. So, but you're saying that under $200K is kind of impossible to go?
Renaud-ZKNOX:Sorry?
Antonio Sanso:under… with these two pieces, under $200K is impossible to go.
Renaud-ZKNOX:Or you… if you don't, if you don't, implement a specific precompile, of course.
Antonio Sanso:Yeah, yeah, yeah, I mean, I'm in the…
Renaud-ZKNOX:The 18052, would be far cheaper.
Antonio Sanso:Sure, sure, I mean, what I'm saying, like, with, like, going with the route of NTTP precompile and shake to undercase the baseline.
Renaud-ZKNOX:Yeah.
Antonio Sanso:Right.
Antonio Sanso:Alright.
Danno Ferrin - Tectonic.xyz:So, my concern is that, anything with EVM cost exceeds the data carriage cost.
Danno Ferrin - Tectonic.xyz:I'm concerned it's not gonna be terribly… Economically viable.
Danno Ferrin - Tectonic.xyz:I mean, for all of these post-quantum signatures, data carriage cost is going to be 5 to 10x what it is for an ECDSA signature. That's unavoidable.
Danno Ferrin - Tectonic.xyz:But if there's ways to avoid making computation greater than the daily carriage costs.
Danno Ferrin - Tectonic.xyz:I think those should be considered strongly, and that, in this case, would be a direct NIST precompile, but just my opinion.
Antonio Sanso:So, Daniel, your… your point is, like, you're… you don't like this…
Antonio Sanso:NTT per compile check combo, you will go directly with the NIST per compile, that's what you're saying?
Danno Ferrin - Tectonic.xyz:Yeah, strictly for economic reasons, yeah, there's no way that we can get, you know, hundreds of signatures in a block if each signature costs $200K to solve.
Antonio Sanso:Right, right.
Antonio Sanso:It would be really interesting to…
Antonio Sanso:To at least have a proof of concept and see where the costs come from.
Antonio Sanso:If there's some other low-hanging fruit that we can cut.
Antonio Sanso:I'm talking about NTT plus shake approach.
Danno Ferrin - Tectonic.xyz:Right, right, and that's for computation, that's probably worth looking into. But I think, you know, for all these signatures.
Danno Ferrin - Tectonic.xyz:The elephant in the room is that data carriage costs are gonna go up
Danno Ferrin - Tectonic.xyz:5, 10, 20x, and that's… there's no signatures that we're not facing that.
Antonio Sanso:us, sorry.
Danno Ferrin - Tectonic.xyz:the cost of the data in the blockchain. The signatures are going to be, like, 500 to 2,000K, and that's on the low end.
Danno Ferrin - Tectonic.xyz:Bites.
Danno Ferrin - Tectonic.xyz:And…
Antonio Sanso:It's not avoidable, I mean, we know about that, right?
Danno Ferrin - Tectonic.xyz:Unless we're gonna do ski sign.
Antonio Sanso:No, no.
Antonio Sanso:I mean, I come from misogynist, I'm telling you, no, we're not going to ski side. It's too early, it's too early.
Danno Ferrin - Tectonic.xyz:Right, and unless we're ready to talk about signature aggregation with new lattice folds or whatever is being cooked up in the Ethereum Foundation, you know, those are the sort of things that we need to look at in addition.
Antonio Sanso:Lattice forward.
Danno Ferrin - Tectonic.xyz:Those abbreviennies.
Antonio Sanso:will not help here, let his fold, for signature segregation, will be something more like Labrador that might.
Danno Ferrin - Tectonic.xyz:Right, right. But those are the solutions that, for very large N,
Danno Ferrin - Tectonic.xyz:We might want to look at.
Antonio Sanso:Yeah, we'll have something in the next days that covers that, so just hold tight for a few more days.
Renaud-ZKNOX:Yeah, I think we need, we need, native, account abstraction for lattice-based candidates.
Renaud-ZKNOX:To avoid, to have this, transmission of the public key, which… which is the main problem.
Danno Ferrin - Tectonic.xyz:Probably key is about the same size as a signature, sometimes smaller.
Danno Ferrin - Tectonic.xyz:The signatures are pig.
Renaud-ZKNOX:Yeah, I mean, Falcon Signature, if you don't have to transmit, the public key is, 6…
Renaud-ZKNOX:666 bytes, good number. Yeah, so… That's not that.
Antonio Sanso:But the other question is, Renault, of this 200K, assuming you don't transmit the public key.
Antonio Sanso:How much down do you go?
Renaud-ZKNOX:No, here, here, the problem will be the bit manipulation, because you…
Renaud-ZKNOX:You will have to go on and forth between, the different precompiles, so… Actually.
Renaud-ZKNOX:You can't get that much lower.
Antonio Sanso:It will be, you know, personally, and I'm not sure if there's something you will, or…
Antonio Sanso:you can provide. I will be really happy to see the… this… where these 200K are spent, how much are spent in cold data, how much are spent in each operation, will be…
Antonio Sanso:Would be really interesting from my perspective, too.
Antonio Sanso:To understand.
Antonio Sanso:Because 200Ks, yeah, it's… it's got something, right?
Renaud-ZKNOX:Yeah, yeah. To… but this is work, though. To be honest, we are more focusing on the NumP precompile right now.
Renaud-ZKNOX:Because we have been asked to. And also, I think it's interesting to have a generic tool, so this is something else.
Renaud-ZKNOX:But yeah, that would be interesting, right?
Antonio Sanso:Is there… is there… is there anyone… I mean, it would be interesting to, like,
Antonio Sanso:to have anyone helping you with the NTT per compiler. I mean, at the moment, it's you and Simon. If someone else will join the effort, you will be accommodating.
Antonio Sanso:I'm talking about the existing NTT one.
Renaud-ZKNOX:Yeah, yeah. Yeah, but,
Renaud-ZKNOX:I think it would be interesting to understand what Justine was, aiming.
Renaud-ZKNOX:Because I'm not sure… actually, I kind of…
Renaud-ZKNOX:share, Dano conclusion about the NTT precompiled. So, even if I'm the co-author,
Renaud-ZKNOX:This is not the horse I will bet on right now.
Antonio Sanso:Right. And do you think that the NumPy way will produce… assume you have NumPy and Shake, you will have a cheaper gas cost?
Renaud-ZKNOX:No, it will be higher, but once again, NumPy is very versatile.
Renaud-ZKNOX:it's not limited to, to just, even if you remove all Lattice's candidates, because, for instance, when EVM Max, started, it was absolutely not to implement, Lattice candidates. So, it's more the high, genericity of,
Renaud-ZKNOX:of NumPy, rather than having a lower gas cost. So maybe having something in the middle is not that interesting. Either we go full specific with a NIST candidate.
Renaud-ZKNOX:And honestly, I would push MLDSS 6065 right now, because I think this is a Web2 way.
Renaud-ZKNOX:or you push something that is not limited to lattices. NumPy is not just Pascantum, it's, it's,
Renaud-ZKNOX:Yeah, when you, when you…
Renaud-ZKNOX:When you implement something, and for instance, in the modern architectures, you have vectorized operation, in a…
Renaud-ZKNOX:Be it in AVX2 or,
Renaud-ZKNOX:vectorized arm restrictions, and they did not, do it for… for Pascantum. They did it because,
Renaud-ZKNOX:Parallelism is the way to go.
Renaud-ZKNOX:With modern computations.
Antonio Sanso:It would be at least interesting, and maybe this is something you're… would be more interesting, given what you've been saying so far, to provide some data, at least how much will be… assuming you have shake, and assuming you have this NumPy precompile.
Renaud-ZKNOX:Nope.
Antonio Sanso:how much you have, right? I agree with what you said, but if this combo is gonna be, like, I don't know, 1 million, call me out, you know? If this combo is $300K, okay, I buy what you say. Because, like, okay, so you have more flexibility, and the cost to pay is not…
Antonio Sanso:so much more than when I pay with NTT, for example, so…
Renaud-ZKNOX:Yeah.
Renaud-ZKNOX:Give us some weeks, and we will provide the answer. We are on this topic right now.
Antonio Sanso:Okay, well, thank you. This will be real interesting to understand, and .
Renaud-ZKNOX:And we will provide the answer shortly.
Antonio Sanso:And Shake, you already implemented as well?
Renaud-ZKNOX:Shaq, there is nothing to do to implement Shaq. You take some C library, you put it as a guess for a new precompile, and…
Antonio Sanso:Yeah.
Renaud-ZKNOX:You ask it to close, and you have your precompiled in 15 minutes.
Antonio Sanso:No, but I mean, like, I was wondering where you can… took your data from, with the shade. That means that you already, kind of.
Renaud-ZKNOX:Yeah, no, the thing is not the check cost, because it's… a check is like K-check. There is no diff… quasi no difference between check and K-check, only some constants, so you can say that the cost of check should be the cost of K-check at the end.
Antonio Sanso:Okay, so you took the baseline from that. Okay, makes sense.
Renaud-ZKNOX:No. I'm not.
Renaud-ZKNOX:The thing is, in Falcon, you have many, yeah, you have some kind of PRNG that is using check, but it's not DI check. And this is all the data manipulation that you have to do around it.
Renaud-ZKNOX:That creates the cost.
Antonio Sanso:Right. I know, Stefano, if you want to go with your question now. It was probably more about aligning with what we are discussing now with the…
Stefano Gogioso:Yeah, I mean, I'm not sure it's so much a question as a list of longer-term derata, but I…
Stefano Gogioso:when I envisage what would benefit the…
Stefano Gogioso:the Ethereum ecosystem more broadly in terms of SIMed operations, vectorization, tensorization, and so on.
Stefano Gogioso:I do think of cryptography, of course. There is all the number of theoretic primitives, Stark, post-quantum.
Stefano Gogioso:they all benefit from it. But there's a lot of use cases. One of them was suggested also in the… in the chat. A lot of…
Stefano Gogioso:finance applications make large use of vectorized primitives, but not a small, specific subset, like a large sub-language of vectorized primitives. And more generally, we do have, right now,
Stefano Gogioso:a fairly stable set of tensorized primitives that I used in machine learning, AI deep learning applications.
Stefano Gogioso:Some of them are, of course, not the sort of thing that you would want on-chain, or perhaps you'd want them in a sort of succinct, proof way, rather than directly executed, but a lot of the lower-level sim primitives are things that CPUs today would execute fairly efficiently.
Stefano Gogioso:And they will make it possible to introduce quite a lot of new use cases for on-chain computation, but this wouldn't be a specific set. This would be a broader, like, subset of stable NumPy primitives, NumPy functions, or subset of stable functions from something like…
Stefano Gogioso:I don't know, TensorFlow, or any of these languages, ultimately, they all share the same kind of basic building blocks.
Stefano Gogioso:So that's what I… that's what I envisage when I think of a NumPy recompile, not something quite specific. Now, maybe I have misunderstood what the ultimate direction
Stefano Gogioso:of travelers for this, in which case, yeah, sorry. But it seems to be that a lot of the attention is to making a very small set of primitives that are of interest today.
Stefano Gogioso:more performant?
Antonio Sanso:Just no one interrupt you, it's like, Renault is asking, like, if you have some concrete example, and probably means as well, machine learning, it will be… it will be happy to…
Antonio Sanso:to benchmark. Am I correct, Renault?
Renaud-ZKNOX:Yeah, but honestly, machine learning, I'm not sure I see what, what should be done on-chain?
Stefano Gogioso:No, no, machine learning is a… I mean, I think many things that could be done on-chain, actually, but perhaps that's a broader goal for slightly later on. But certainly a lot of vectorized… there are a lot more vectorized operations than just
Stefano Gogioso:Additions, multiplication, and arithmetic operations.
Stefano Gogioso:And they are used in a lot of financial applications that could very much live on-chain and are today prohibitive to do in terms of gas. So we could have more complicated contracts that do more realistic on-chain finance if we had a broader subset of the non-bip primitives.
Renaud-ZKNOX:Yeah, so really, I would be really interested by a concrete example here.
Antonio Sanso:Reno, for this pre-compile, is the field generic, or you have as well a fixed field?
Renaud-ZKNOX:No, it's generic, so…
Antonio Sanso:Lyric, okay.
Renaud-ZKNOX:It's, Barrett,
Renaud-ZKNOX:The, the Barrett constants, the Barrett multiplication constants are evaluated, entering the, the precompile, so it's on the fly, and, so it can take any, any modulus, lesser than 2 to the power, 32.
Antonio Sanso:Alright, we're right.
Antonio Sanso:I see as well, try to wrap this topic now. I think we got enough about that.
Antonio Sanso:Thanks a lot, Renault, for presenting and answering so many questions. I'm looking forward to your future numbers.
Antonio Sanso:Honestly, I mean, it's, has been great work.
Antonio Sanso:And I see Dan know that they wanted to take a tangent, if I don't…
Antonio Sanso:If I'm not wrong, right?
Danno Ferrin - Tectonic.xyz:Right, so one of the things that was brought up was, you know.
Danno Ferrin - Tectonic.xyz:Try not to carry the public key with it.
Danno Ferrin - Tectonic.xyz:There's two questions that come with that. Number one, where do we store the public key? Will we store it on-chain like a 77 on 2 delegation? Will we put some sort of, data in the account tuple? But the next question, I think, is more,
Danno Ferrin - Tectonic.xyz:existential.
Danno Ferrin - Tectonic.xyz:Because with the current transaction, you can validate it with all the data in the byte string that the signature is valid. And if we remove the public key, you would need to have chain data associated with the address.
Danno Ferrin - Tectonic.xyz:that…
Danno Ferrin - Tectonic.xyz:on one hand, makes it more difficult, to verify, without any other reference data, but it also opens the door to things like key rotation, so where you could have your address and you could move between different keys.
Danno Ferrin - Tectonic.xyz:So, that's… I don't have a strong opinion which way to go with it, but I think it's a path that needs to be considered, because that'll absolutely help us save chain data, cut it in half in some cases, because the keys, especially with someone where the keys are…
Danno Ferrin - Tectonic.xyz:Any key that's, like, 43K is not viable, but there's a lot of… there's some signatures coming down the pipe where the signature is small, but the public key is large. And if we could cache the public key and chain data, we might be able to keep
Danno Ferrin - Tectonic.xyz:not chain data, storage data. We might be able to keep the growing of the chain data much more under control with these transactions using these small signatures.
Antonio Sanso:Before, like, Renault was pointing that, that kind of abstraction might actually bring something on the table. I am planning, like, the next two weeks, the call number four.
Antonio Sanso:to bring the account abstraction people in, to just, I think we should talk in general, like, at least, like.
Antonio Sanso:people that are interested about post-quantrum signatures should understand the future native account abstraction well and collaborate, so I'm planning to bring here this call. But I see that as well in the chat that Renault is saying that
Antonio Sanso:create tool, and I can abstraction might help.
Renaud-ZKNOX:I mean, today, because we don't have to, when using acrony abstraction.
Renaud-ZKNOX:Actually, if the accounts are deployed using Create2, you have a deterministic function, which is actually… can be seen as an hash function from… yeah, from your public material to… to the address where the contract will be deployed.
Antonio Sanso:facilities.
Renaud-ZKNOX:So if you look today, if you look today at Ethereum addresses.
Renaud-ZKNOX:you have your public key, it's hashed, and… but the thing is, for all accounts, it's the same way, but…
Renaud-ZKNOX:For… for account abstraction icons, you have the kind of same hashing mechanism, which is implicit with the Create2 you're using.
Antonio Sanso:But, as long as…
Antonio Sanso:A per discrete tool, right, with that kind of attraction, will there be a way to store the public key in the contract as well?
Renaud-ZKNOX:Yeah, sure. That's what we've done with the 4237 implementation, and actually, we don't have
Renaud-ZKNOX:you don't have, because you want to have this kind of hashing mechanism so you can send money for someone even if the contract is not deployed. But if you…
Renaud-ZKNOX:If you use the create2… Okay, the contract doesn't have to be deployed to already send fund, to it, if you check a deployment.
Renaud-ZKNOX:The consistency of the grade 2.
Antonio Sanso:I mean, that's what I mean before, I wonder, like, the framing transaction, like, so the native account abstraction will keep all these features.
Danno Ferrin - Tectonic.xyz:It sounds like it would become an option of a particular smart contract wall provider, because they could just assign random
Danno Ferrin - Tectonic.xyz:Create two addresses, and just tie the key to it.
Danno Ferrin - Tectonic.xyz:So having the key be a function of the hash as a convention is useful, and that's the discussion I want to have for stuff like counterfactual deposits.
Danno Ferrin - Tectonic.xyz:You know, what are we losing by untying this, or making the tying conditional?
Antonio Sanso:But do you agree on the statement that it will be really useful to have a collaboration with the people that are doing the framing transaction EIP, to be sure that they don't… that we or them are not missing anything?
Danno Ferrin - Tectonic.xyz:So…
Danno Ferrin - Tectonic.xyz:Yes, we should, and I think it's a bit concerning that frame transaction is being pushed as a post-quantum solution, and they're not on this call.
Danno Ferrin - Tectonic.xyz:All the time.
Antonio Sanso:I will try to solve this somehow. I mean, at least, like, for next call, it's gonna be really the topic, I can't abstraction.
Antonio Sanso:And, we'll try to improve on this.
Antonio Sanso:Probably my best.
Danno Ferrin - Tectonic.xyz:The fact they're not on the call, to me, shows it's not a post-quantum solution, it's account abstraction, it's independent of it, and they're just using post-quantum to push them over the line, which is fine, they need the momentum, but it's not post-quantum, it's account abstraction. Plain and simple, that's all frame is.
Antonio Sanso:Well…
matteo vicari:Yeah, but,
matteo vicari:sorry for interrupt, but the idea of all the frame transactions is to have some modularity when you do the transaction. So, the idea of the frame transaction is not important if,
matteo vicari:we converge in a post-quantum way to a specific type of signature. The important parties have the possibility to change the signature or run.
matteo vicari:So, it's like, some technology can…
matteo vicari:push forward this discussion, give the possibility to change,
matteo vicari:the signature scheme, like account abstraction, now work, for example, in the example of Renoir in the last few calls.
matteo vicari:The account abstraction in the frame transaction is like, some technology that can validate the possibility to change the protocol without, any, stress for, artwork or stuff like this.
matteo vicari:Right, but it's…
Danno Ferrin - Tectonic.xyz:presented as the only possible solution.
Danno Ferrin - Tectonic.xyz:Where, you know, there's, you know, press switch is pushing some, I have a solution that doesn't require full abstraction.
Danno Ferrin - Tectonic.xyz:Whereas protocol-level signatures. That's… what I don't like about it, is that it's being presented as the only way to get it done, as if the decision's been made.
matteo vicari:Absolutely.
Antonio Sanso:Anyway, like, I don't know, just as well to say, like, I'm trying to get more involved with the people that are doing frame transactions, but, I mean, actually, Vitalik was here, so he just left, but, I mean, he's as well one of the author of Frame Transactions, so they're for sure aware of what is going on.
Danno Ferrin - Tectonic.xyz:That's exactly my point, is that…
Danno Ferrin - Tectonic.xyz:the decision's been made. There's no debate.
Antonio Sanso:Again, I think, like, if there is something that should be accommodated off both sides, I mean, there's still things we can sort out. I mean, the decision from my Hego Taya are still way open, I mean, it's not on stone, so there is plenty of time to do modifications in case we need it.
Danno Ferrin - Tectonic.xyz:Have there been any other post-quantum transaction formats other than AA seriously considered?
Antonio Sanso:No, but I mean, what…
Danno Ferrin - Tectonic.xyz:Exactly, the decision's been made.
Antonio Sanso:Yeah, but I mean, with…
Fab:event.
Fab:Do you have an alternative solution? Because at this point, the reason why AA was picked is because many of the post-quantum standards are still relatively young, and to be honest, even if NIST-certified
Fab:three standards, you know, I personally do not feel, like, completely safe, in using
Fab:a post-quantum signature scheme that hasn't, I don't know, 15 years of battle testing under its belt, and at the moment, we have none. So, when we enter this framework, to be honest with you, I… I think we need a solution that allows us to swap
Fab:Signatures, if we so need.
Fab:So…
Danno Ferrin - Tectonic.xyz:Exactly what I proposed in the first meeting, if you looked at my slides. We put the signatures and we put the body in two separate places. We don't rely on account abstraction and pushing in the EVM. I agree with you. We need to have a…
Danno Ferrin - Tectonic.xyz:we need to have cryptographic agility, because at least one of these signatures that's being talked about is going to be broken in the next 15 years, whether by the base or by the construction of the keys. But we… the transaction format itself is independent from the signature, and we need to keep the signatures separate. That's… that was literally in my first slides on the first section.
Stefano Gogioso:Yeah, no one.
Antonio Sanso:And I agree perfectly with you, and I encourage you to be in touch with the account abstraction people. I don't know if you manage to eventually, but yeah, like, I will have them in the next call presenting frame transaction, so… but even, like, outside of this call, if you have some ideas, I don't see why you cannot be in touch.
Antonio Sanso:Stefano, you…
Stefano Gogioso:Yeah, sorry, I just wanted to, as somebody who thinks that account abstraction plays a pretty major role in this, I do agree with Dano that
Stefano Gogioso:that is not probably the only way to do this, and maybe not even the best way to do this. It does give us flexibility, but would I favor a mechanism where signatures are composable and independent of the transaction? Yes.
Stefano Gogioso:There's always the question of, and then what happens if somebody disagrees on the signature schemes? But that's solvable. So I just wanted to say, as an AA fan, that I do agree that separate… like, having an alternative mechanism with a sort of composable signature transaction separation is a good idea.
Stefano Gogioso:So I… he has my support.
Antonio Sanso:Yeah, but…
Stefano Gogioso:Pacific time.
Antonio Sanso:What I'm trying to say, like, maybe to use some synergies, like the idea that you guys have, or that you, Stefano Rodano, like, proposed to the frame transaction
Antonio Sanso:And maybe can be included. I mean, I don't see one against the other, you know, like, maybe…
Stefano Gogioso:No, no, I don't think they're against. I just think that both should be, like… they serve different purposes, and they have different advantages and disadvantages, and I'm just, like, publicly stating that I.
Antonio Sanso:Maybe it can be embraced.
Stefano Gogioso:Yeah, I like that.
Antonio Sanso:That's what I… from his presentation, actually, that was my feeling, that some of his idea could be, like, actually taken into account, into the.
Fab:By the way, guys, just like a very small remark, I think that the idea that we use account abstraction so that we do not have to decide on signatures is ultimately wrong.
Fab:I think that I'm very convinced that, you know, the user base, the non-tech-savvy user base, will ask for a go-to signature scheme. So in this sense, it's, you know, we kind of solve the problem technically, but we are just
Fab:kick in the can further down the road, because at some point, you know, the user base will ask, okay, cool, we can support all the signatures in the observable universe. This said, what do I use for my shitty wallet? And, you know, in that case, yes. Yes, users would be…
Fab:wallet providers, in a way, most likely. But still, you know, I think they will ask for guidelines. Like, no one… no wallet provider wants to risk implementing a signature scheme that doesn't work or has problems, so…
Stefano Gogioso:Yeah, but I think that, like, like it is in the case of, like, most Web2 applications, ultimately the choice of scheme falls onto either library providers or wallet providers.
Stefano Gogioso:And it can be that we have multiple choices living together, like we do today, as long as they are all broadly acceptable, and it can be left to the consensus layer to decide which ones are acceptable and which ones are not.
Stefano Gogioso:And then, ultimately, people will have to switch, and it will be for, you know, not the end user to decide which
Stefano Gogioso:which signature scheme to use, but they're intermediaries that provide software for them. Yeah, sure. I think it can be done in a way where the end user doesn't really have to worry.
Fab:Yeah, what I'm saying is that resorting to AA is not the end of the discussion. There will be a lot more discussing.
Stefano Gogioso:down the road.
Stefano Gogioso:I agree, I agree completely.
Antonio Sanso:Anyway, guys, I think we're out of time. Today was really a marvelous discussion.
Stefano Gogioso:That was marvelous, yeah. Thank you all.
Antonio Sanso:I… I will, I will wait for you in two weeks. Will be account abstraction, the topic, so will be really a good segue from this call, alright? Thanks a lot for attending. See you all, guys. Cheers. Thank you.
Fab:I bet.
matteo vicari:See you, guy.
Antonio Sanso:Love it.
Chat Logs
00:07:17
Renaud-ZKNOX:Whose notetaker is it ? Could you share the note after the meeting ?
00:07:31
Fireflies.ai Notetaker Andriia:Andriian invited Fireflies.ai here to record & take notes. View Security & Privacy info: https://fireflies.ai/policy
Type:
'/ff leave' - Remove Fireflies
View Realtime notes here: https://app.fireflies.ai/live/01KJWFJGA8M4F7QC5JHE6XRR6M?ref=live_chat
00:24:18
Gottfried Herold:quick question:
Do what extend do these precompiles utilize hardwiring the prime you work with?
00:26:20
Stefa:The way I always envisaged a development like a NumPy precompile would be to support a large set of vectorised — or, more broadly, tensorised — operations. It should be a universal extension to make SIMD programming feasible on the EVM, and this would feed into a lot of new potential AI-related use cases for Ethereum. The bigger vision is so much more interesting.
00:27:38
Danno Ferrin - Tectonic.xyz:How does the precompile plan on addressing the various bit widths of canonical public key and signaure format (3-bit, 4-bit, 10-bit, 14-bit,20-bit) and the huffman-style encoding of falcon signatures?
00:27:51
Ak:ML/finance primitives would benefit a lot from numpy precompile
00:28:29
Stefa:Replying to "ML/finance primitive..."
From a general-purpose one, I fully agree. From a specific one for selected vectorial operations, not so much I believe.
00:45:18
Simon ZKNOX:We have been helped by Yoon working on the NTT EIP :-)
00:46:27
Danno Ferrin - Tectonic.xyz:After we finish this discussion I’d like to go down that tangent of not carrying the publick key in the transaction. That has some intersting potential but we would lose some key properties of current transacitons
00:46:47
Danno Ferrin - Tectonic.xyz:Why ML-DSA65 and not 44?
00:50:15
Renaud-ZKNOX:if you have a precise algorithm/use case i am interested into benchmarking it
00:50:49
Renaud-ZKNOX:we plan to bench poseidon/ntt/falcon and maybe large ecc (secp384r1)
00:51:24
Renaud-ZKNOX:but please give concrete example, eager to add it to our use cases
00:51:32
Danno Ferrin - Tectonic.xyz:Replying to "we plan to bench pos..."
ECC has an expiration date, I hope that is just for reference and not inclusion
00:54:29
Renaud-ZKNOX:you can use create2 on your AA account
01:01:21
Renaud-ZKNOX:Répondre à "Why ML-DSA65 and n..."
because it seems that web2 is adopting it rather than 44
01:04:52
Gottfried Herold:Wouldn't those "users" be wallet providers?
01:04:58
Danno Ferrin - Tectonic.xyz:I’ve got a hard stop in 30 seconds. I’d love to stay longer
01:05:07
Gottfried Herold:Those should be somewhat tech-savvy, no?
01:05:10
Renaud-ZKNOX:Users will use audited library.
01:05:38
Renaud-ZKNOX:So this is not letting average joe vibecoding their wallet. Some natural candidates would rise.
01:06:29
Renaud-ZKNOX:see u all
Summary
13 highlights
· 3 action itemsExperimental
Summary
13 highlights · 3 action itemsExperimentalntt precompile proposal
- EIP-7885 NTT precompile: 4 opcodes for polynomial multiplication, supports lattice schemes and Stark verification00:11:48
- Falcon verification benchmarked at 400K gas with NTT precompile (down from 1.5M pure Solidity)00:18:30
- Shake precompile combo could achieve ~2K gas for Falcon; calldata cost remains dominant00:19:15
- NTT precompile hardwires 5-6 standard primes; generic primes require expensive lookup table transmission00:24:18
numpy precompile alternative
implementation challenges
- 14-bit Dilithium/Falcon encoding requires expensive bit manipulation in EVM (~150K gas decompression cost)00:31:41
- Under 200K gas computational floor with NTT+Shake; monolithic NIST precompile significantly cheaper00:39:00
- Data carriage cost dominates: 500-2000 bytes for PQ signatures (5-10x current ECDSA)00:57:10
account abstraction synergy
- Native AA with Create2 enables deterministic address derivation from public key hash00:53:38
- AA allows on-chain public key storage, enabling key rotation and reducing calldata transmission00:55:35
- Frame transactions provide signature modularity but need separate composable signature mechanisms01:01:48
Decisions
Action Items
- Renaud/Simon (ZKnox team): Benchmark NVMPI precompile with Falcon/Poseidon/large ECC and provide gas cost breakdown00:48:00
- Community (post examples to team): Collect concrete ML/finance vectorized operation use cases for NVMPI scope definition00:50:15
- Antonio (next call organizer): Coordinate with Frame Transaction/AA teams on signature separation and composability requirements01:02:22
Targets
- Next call (2 weeks): Account Abstraction focus with Frame Transaction team participation01:06:00