 Good morning, I'm Jordi Bailina, I'm the technical leader at Polygon Hermes. So I'm going to explain a small piece of the CKBM that's how we are verifying a stark with a snark. As I explained it before in the panel, the last piece of the prover is mainly converting we have a stark and then we want to prove that on chain and what we do is we create a circuit that verifies this stark and then we will prove it in the snark, okay? Well this is the CKBM that we are building mainly we are using PIL, this polynomial identity language to build all the full system and at the end what we have is a set of polynomials with a set of identities that needs to fulfill with this can generate automatically the idea of this is that once you have this PIL you can generate automatically a stark and not only that with this a stark you can also automatically generate a stark that verifies that other stark, okay? So we have our recursion starks and we can do that many times and we can even aggregate we can even aggregate and then we can build a system that looks something like that we can have many proofs of many blocks and then we can pack them together in a kind of a tree and then at the end in the last step before sending to the Ethereum we just convert this stark to the snark and this is done quite automatically so you need to care just about building the PIL and the rest is quite a strike forward, okay? So let's see how we do that, okay? So what we want to do is we want to build the circuit actually we want to build this circum circuit that as an input you have a stark proof, okay? So this is the stark proof so in the circuit you have to validate this stark proof so we need to deep in what's inside the stark proof what what's what stark proof what means this of a stark proof well the first thing that things that you have the first thing that you have is have the transcript transcript are mainly hashes okay so you need to have these random numbers that goes back and forth this is something that we need to compute inside the inside the circuit these are mainly hashes okay as a transcript in this case we are using well a hash function in this case we are using for the stark we're bringing a stark with a hash function that's a fairly hash function in this case a Poseidon with a BN corp we're just using this hash function to compute the to compute the randomness of the transcript okay another piece is well if you have a polynomial evaluations and then you need to check you need to check that these polynomials evaluations are are okay that they are fitting that means that you need to do a lot of arithmetic and in the case of us we are using the Goldilocks prime prime field and but here we are in the BN so we need to work with this cross prime field we need to do this cross prime field operations we need to do cross prime field inside the inside the inside the circuit the next thing that we have to do is we need to do openings okay so the stark mainly is a miracle trees and we need to just validate these miracle trees here the trick is again use the Poseidon hash function so if you use a Poseidon so as not friendly hash function then doing that that inside this inside the circuit is relatively cheap so we do that for the for the openings itself okay once you have the openings you need to evaluate this opening polynomial which is a derivative polynomial you need to evaluate those openings at that point okay so you need here more arithmetic operations okay and finally we have the fry okay fry is openings again so lots of openings that's one thing so every time that you go to us back in the step you do openings so this is again Poseidon here and then you have to do polynomial evaluations but this is our in the cross prime we are this is in the Goldilocks prime field okay the best way to do a polynomial evaluation is mainly doing an FFT kind of kind of an FFT okay so and finally in the last start we also need to do an FFT for the for the final polynomial we need to check that the final polynomial for a certain degree mainly you do an FFT and check that the half of the or that part of the bits are zero okay so this is a structure of the of the of the star so here the I'm gonna jump this so here the the well the trick here is how much so how we do this cross prime field operation this is probably the most simple thing and they there is where we are just doing in a naive so in a very naive way okay so we just doing an operation like that like a multiplication in this case is well we just do a couple of rain checks okay that means that more or less prime across so a multiplication with a gold deluxe multiplication it costs 146 constraints okay the fry and this is a one thing that's a specific on the fry the Goldilocks is a very small prime field so once you work with a random number you cannot work with the base field because it's very small so you need to work with extension fields so you work with extension in this in our case we're working with an extension three of the Goldilocks okay so that means that doing a multiplication in the extension field three this is something that's 400 438 constraints which is a lot you know compared to one but it's not that much okay so here the thing is okay let's let's do some numbers of some examples of some starks how it would look like okay well this is the the the for the hash functions we are using a 16 inputs so we can do trees that goes at 4 at 4 and then constraints just 612 constraints just doing a single hash which is quite optimal if we do it in that way okay so let's put some example this is these numbers are not exactly but are similar to the ones that we are using for the CKDM circuit in this case we are talking about let's talk about 1,000 polynomials okay we have a let's do a blow up factor of 2 that means that we need to do a lot of queries in the in the in the snark in this case is 128 queries this is we have that it's important this law factor of 2 because if you go for example blow a factor of 4 that means that we are doubling the proving the proving time okay so we need to go to the minimal especially when we have so many polynomials here so that's why we use a blow up factor of 2 okay so let's talk with the sites of a polynomials of 2 to 24 after the law factors of 2 to 23 to 224 okay and of course we have constraints let's assume that the number of constraints is more or less the same number of polynomials this is just just a subjections and then we have in each constraint we have like two multiplications for each constraint okay these numbers of course depend on the circuit and depend what you're doing and so on but this is just would say it would be a good example of a CKDM circuit like okay it's a big circuit okay so for this is okay here let's see how much he booted cost this in in in number of constraints here of course the transcript is not that much the checking the polynomial constraints at random point well it's start to be important number but not that much the number of queries we have so many polynomials so we need there are so many polynomials so mainly what we do is the linear hash of the evaluations and then do the Merckleites but this is this is just for the queries the first query is not in the fry yet but for the first queries of all the polynomials this is our dot and here is the big probably the biggest part okay the biggest part is when we need to compute this opening polynomial there are so many polynomials and we need to do so many multiplications out of the field that this is a number that grows a lot okay and here is the the big part of the proof is this 112 millions what else we have we have the what this is a queries of the fry here are the FFTs the the polynomial evaluations the entities to going deep in the fry and the final and the final and the final polynomial evaluation so this gives us something that's huge is 127 million constraints but it's doable this is a circuit that's for example the Hermes one circuit had this number of constraints more or less so and you can do that in about 100 seconds in a big CPU okay so in rapid snark so that's something that's doable but you know it's gonna be a big circuit okay the thing is that with what we can do the technique that we are using is that in a state of having a snark so we have a we have this big circuit so in a state of this proving directly with a snark what you can do is you can do different level of different levels of recursion so you can build a stark that verifies another stark so you get a proof that's much smaller maybe you can to repeat that again you do another stark that verifies the stark so you get even a smaller proof and at the end you can have a final proof that can be much much much much smaller okay and this is this is actually more or less what we are doing here is here I put you the real numbers of the current structure this is a structure of the prover that we are running right now in the public test net okay so this is a three steps okay the first step is this number of polynomials but you need to call that this is about 1000 polynomials but then we have 43 block ups one permutation check what we have different different properties so this is a big circuit we are working with 22 23 blow a factor of 2 here you see the structure the way that the structure we are of the fry so who we are building the fry okay so this goes to another point so it goes to another proof second proof is a proof that's much smaller it's just 20 polynomials with sorry 12 polynomials 20 of them are constant 10 intermediary polynomials no block ups just one connection check and yeah and 23 23 entities and then we do go to the third one this is also you see here is the GL GL means Goldilocks this is a star does build it with Goldilocks but the last one is built with VN 128 okay and the last one is just a smaller it's just 20 it has only 12 polynomials but the and the size of the polynomial is 2 to the this is just 224 so 224 it's 222 and the block factor of 4 in this case we could do it is smaller okay but at the end here is a compromise sometimes you get it smaller but then the proving time of this smaller is bigger so at the end is better maybe to have a bigger last circuit that it's a bigger last circuit than that just squeezing to the end for the smaller and keeping and keeping bigger so this is our balances and checking what's the best structure on that okay so if we go to more something that we can go far so that we can squeeze more the last circuit you can do well five can this game let me just with something that's 60 polynomials with a blow-up factor of 16 so 224 and this with this you just require 16 queries which is to having the same 120 128 bits security you can go a polynomial after a blow-up factor of 224 so we'll be a polynomial of 2220 that goes to 224 and yeah this is our number of constraints and if we do the numbers with this see that the numbers are getting much much much smaller at the end we can if we add them all together we can have something that's below two million constraints and this is something that can be built in less than two seconds it's really it's quite insignificant compared to the proving to the proving to the proving time so this is very much the the the conclusion I just put this a slide from the CKBM but this is the full just to to explain you what are the current times of the full CKBM prover okay so currently in an in a big machine you know this is a 192 course machine it's a $10 per hour machine more or less in AWS okay this proof it takes nine minutes okay we can process four million gas in this proof so this would be equivalent more or less a cost per transaction would be less than a cent so 0.07 cents per dollar but you see that this is actually it's a proof that's actually running public test net is running so and you can see the code and see how the prover works and when you can build your proof in there okay this is just a CPU prover and here there is lots of margins to to improve here from GPU we expect maybe one order of magnitude faster and FPGAs new CPUs are doing are performing much better yeah there are a lot of things that are happening but this is just a have you and some numbers some idea of where the proving times are and the recursion another thing that's not here but somebody already put it in before and is that verifying a growth 16 in EVM this is 200 K but around 200 K gas which is probably the cheapest way the cheapest thing that you can that you can do plonk is 300 K which is not that much you say if the process wrap so probably it's gonna be the options that we will put it in mainnet and yeah that's mainly my presentation I don't know if there are questions