 Guys, I'm really excited to present to you our new new ZK snark It's it's a joint effort with With two other guys with Helger Lipma and Janosim from Simula. So We in our paper we presented a new ZK snark Called vampire. It's a it's a ZK snark for Arithmeticization called as R1CS light It's universal and updateable that means that you can have like one trusted setup for For every circuits up to given size and if you don't trust that the trusted setup was generated Correctly or non maliciously you can always update the setup by your own It it based on Marlin another ZK snark, but it's like really highly optimized. I would say it's a Marlin on steroids It's it's so optimized that the proof is Only four group elements and to field elements like compared to Marlin Which has like seven group elements or plonk, which also requires seven seven group elements So communication wise this ZK snark is really close to graph 16 So the difference in the proof size is about the 500 bytes But graph 16 is neither universal nor updateable And it uses only two some checks and why I want to talk about some checks is because this optimization was possible thanks to the fact that we We invented a new sum check which we doubt count and say univariate sum check It has great communication efficiency because the proof for the sum check is only one group element furthermore the complexity of of this sum check is really Really good is almost linear. What is much better than? A standard sum check we use in snarks called aurora, which which requires FFT Okay, so let me tell you how to make snarks shorter and how it was possible to Do to deliver a snark that is only four group elements long? so Snarks Like a class of snarks. We we are we were investigating Has a number of of building blocks. So so first there's a relation So we need to to pick what relation for snark We are proving and for example the relation could be our one CS It could be our one CS light in our case long has its own relation So arithmetization matters the arithmetization Also tells you well The proof size really highly depends on the arithmetization you pick then we have a sum check So basically the question is how many sum checks do you need to show your result then we have lean check? So the question here is do we even need a lean check and the last but not least the famous polynomial commitment scheme which Also like defines the the size of the proof so we need to tell which polynomials are we committing to and What polynomial what commitments do we do we open? Can we batch openings? Can we batch? Commitments so to compare To compare marlin with our vampire. So there are some several differences. So first of all Marlin is for our one CS while vampire is for our one CS light and why it matters I will say in a bit in a few In a few slides then we have a sum check both Marlin and vampire need two sum checks, but but Marlin uses Aurora sum check and the vampire uses count and Aurora Regarding clean check Marlin acquires it. We don't Then there's a batching of of KZG a cat a polynomial commitment scheme So in case of Marlin it is batched, but we managed to batch it better Okay, so let me tell you about the difference between our one CS and our one CS light so we start with arithmetic circuit as usual and and We we have some left the input gates in the circuit. We have some right input gates We have some output gates and These gates are encoded into three matrices. So matrix a corresponds to left input gates B corresponds to to the right inputs and C corresponds to outputs and Then we have that that corresponds to evaluations on these gates Okay, and that's our one CS light And the fact that we have three matrices Basically means that we need to send three polynomial commitments to each of of these Multiplications here while in our one CS light The situation is a bit different because we are able to encode the whole circuit into a single matrix So we have only one matrix that need to be need to be sent and we want to show that That the vector with evaluations times this matrix gives gives zero. Okay, so let's look at this for a moment so so W times z equals zero basically means that for all x's sum over y of W x y so the elements of the w matrix times element of a z vector equals zero and With some mathematical trickery we can say, okay, so let's not talk about vectors. Let's talk about polynomials and Let's talk about some Of some polynomials some over some y for some polynomial f and here comes the sum check So count is a new sum check so so sum check argument Basically, it states that if you have a polynomial f and you evaluate it at some elements a Belonging to a set H and you sum over all these elements Then you get some value v and compared to Aurora As I mentioned a Aurora needs two group elements. We need only one group element so I'm not going into details of of the sum check maybe Maybe some other time. So let me only say about batching KZG very quickly So there are like two two ways of batching polynomial commitments. First of all We can batch openings of multiple polynomials Evaluated at the same point and that's what Planck is doing. That's also what what was done in Marlin. However due to some new results, we can also batch openings of multiple polynomials at multiple points If you want to learn more, please check our paper and now I can take some questions Thank you so much, Mihaly A lot of data and formula were there, but people can talk to you after the talk. Thank you so much