 Hi. I'm Madars. This is joint work with Aran Traumer and Marianna Raikawa. This is not a song. It's talk about zero-knowledge, but building upon previous talk. So zero-knowledge proofs have seen enormous deployment in recent years, mainly thanks to the blockchain. We now have privacy-preserving cryptocurrencies, smart contract systems, and so on. Many of them recently covered in the ZK-proof standardization workshop that Mutu will be talking about. And in the blockchain scenario, you need a particular kind of zero-knowledge proof. Ideally, it's non-interactive proof of knowledge, and especially useful if it's succinct one. So ZK-SNARK. But which SNARK should you use? Well, the most efficient ones are based on quadratic arithmetic programs, and they have extremely fast verification, just milliseconds, but they require a common reference string, or using this new terminology from the workshop, a structure difference string. And the soundness of the proof system crucially depends on SRS being correctly generated, and then the private randomness getting destroyed. So who should do this? Well, you could delegate to someone whom you trust, or you could use a multi-party computation ceremony. And the best ceremony is scaled to hundreds of participants, and this is, for example, what ZKR did. But ideally, you would want to use a proof system that doesn't require a common reference string of TAL. And we have such, for example, PCP-based systems, such as the SNARK system. They are asymptotically succinct, but generally have large constants. So the proofs are much larger in practice. If your statement is sufficiently simple, you could use a non-succinct zero-knowledge proof, say bullet proofs or high-racks or lecaro or ZKBOO. But as statement grows, so does the verification time, and in blockchain scenario, that might be unacceptable. So let's take a look. There's Alex and Steve, your favorite Minecraft characters, and Alex wants to send a transaction to Steve, and it includes zero-knowledge proof. So as transaction propagates through the blockchain, sorry, through the node network, to be included in the blockchain, it needs to be verified by every single node. So if verification is slow, Steve will see your transaction after a delay. It might seem like a usability problem, but it's actually a security issue, because miners, if the transaction verification is too slow, after a certain threshold, they'll just stop verifying them. So they'll include transactions in a block that are, in fact, invalid. And this has happened before in Bitcoin, and rational miners do this because they get a head start. Why should I verify if most likely it's going to be okay? And moreover, people will build upon your block and mine another invalid block. So in this work, we present a system called zero-knowledge sharks, succinct hybrid arguments of knowledge, which are short proofs that have dual verification mode. You can either verify them prudently, which is linear time verification, just like bullet proofs, but no SRS, or optimistically, which is fast, just as fast as snacks, but relies on an SRS. So in your favorite blockchain scenario, this is as good as snacks, because everyone will just verify everything optimistically, and the miners, during the proof of work, will do the prudent verification. This is incentive compatible. Note that we did rely on SRS, so what happens if optimistic verification succeeds, but prudent does not. It yields to an immediate detection that your SRS has been compromised, so you can go back and retroactively audit your old proofs, and you can recover by first revoking SRS, checking all the old proofs by doing the prudent verification, and after that, regenerating optimistic proof pairs. Note that if you just concatenated an ISIC and a snark, you wouldn't get this property. I go for five minutes. Oops. I'm sorry. So in a sense, we get the proof systems that combine best properties of music and snarks, compromise the SRS, doesn't yield to a break into the system. E-Princes for coming, but there is some local media coverage about sharks already. Thank you.