Well thank you for coming. This talk is going to be the first time we do it. So hopefully you cut us some slack, but you know feel free to ask questions. I mean you know so don't make it easy. So I'll introduce us quickly. So this is my colleague Paul. He's a senior engineer at IBM and does all kinds of things.  But now he's working with me on OpenQuantum at IBM. So Max, some people call me Dr. Max, but Max is fine. Yes, I do have a PhD, but it's not in quantum physics. So this is new territory for me. And I'm a distinguished engineer at IBM and I also used to do Open Serverless. So I did contribute to Knative as well, pioneering the CLI. So you know we can talk about that. And the quantum effort came because as you'll see, there's a little bit overlap, but not too much. So that's that. Okay, so the talk is divided into three parts. I'm gonna do the first part and Paul is actually gonna go over how. So I'm gonna try to give you my best intuition of quantum computing or quantum computers. And more importantly, why are they important? Why should you care? And Paul is gonna get into a little bit more details by going over how you actually program a quantum computer, at least using some of the tools that we have at IBM, and then how Kubernetes can actually play into this emerging field. And there was gonna be some live demos as well, so hopefully it works. Okay, so what is quantum computing?  And sometimes I don't speak too much. And of course, we all have supercomputers in our pockets. And quantum computers are actually very different. But fundamentally, there's some similarities as well. So we're gonna try to at least give you the intuition behind them. So first is thinking of problems, right? So if you've taken a complexity theory class, you know that computers are great at solving problems. But believe it or not, there's a lot of problem that you cannot solve. Or at least it would take you so much time to solve them that the best computers we have right now, even supercomputers much bigger than the ones you have in your pocket, would not be able to solve them. And part of the reason is because the best algorithms that we know tend to require a lot of operations. And computers are pretty straightforward, they just compute operations. And you could resolve, you could take any operation, all of the computers that you have in your pocket to reduce them to essentially doing additions. So at the end of the day, that's pretty much what you're doing. But if those numbers to actually solve a problem are very big, then you can't use the classical class of computers to solve them. And this is not theoretical. It's actually very practical. And we're gonna get into an example that we all use and you use every day. Okay. For people that have taken complexity theory classes, you understand this. But for some people, it might be a surprise, but it's very true. And the class that we cannot solve is actually significantly big. And we're gonna get into some example of this. Quantum computers will try, you know, help you solve not all of them. So we're not gonna be doing TikTok on quantum computers. Okay. So don't be, don't worry about that. But there are some problems where you can actually solve it significantly faster. And this is, and because some of those problems are critical, this is why you should care. One of the problems, and it's not just one, but it's one example, is trying to do a lot of research around, you know, solid state or any molecule that are kind of complex, even biological, you know, research in that space, because you have to compute the state or the energy state of some of those ions or the molecules.  And you have to understand the state of it. And it, the physics is actually well understood. But the number of computation that you need to do tends to be so large that classical computers would take forever. And quantum computers can do it like this. Another example of this that's more, that's closer to us is, you know, classic traveling salesman, you know, that's a very classic problem in complexity theory that you can actually do with quantum computers very fast. So it's logistics. And there are real companies right now using quantum computers to solve some of those problems. Now, another problem that I want to get into a little bit more after is essentially cryptography. So the basic primer in cryptography is that they're all, especially the recent ones, the ones that we all use, like say, for instance, RSA is based on a symmetric keys, okay, cryptography. So basically, you have two numbers, you multiply them, typically primes, and you have now a, another number. And that other number, you can make it public. And that's your public key. And the reason this works, that you can use that multiplied number to encrypt data is because it's very hard to find the primes from an existing number. Okay, so given any number, if I ask you, give me the two primes when you multiply them, it gives you that initial number, it's extremely hard.  I mean, it's basically more time than, than we have to live, you know, in the current computers. So if you get big, large enough primes, and you create these public keys, I'm simplifying a lot, but you can essentially encrypt everything. So the whole world, you know, you could say all of, you know, commerce right now on the web is essentially using these kind of cryptography. The sad part, and this is where computer computers come in, is that with, I guess there's another example of this. Right. So it's part of the reason it takes so long to find the primes is because the best known algorithm right now tends to be exponential. So you essentially would need a really large number of time because of the nature of exponential, it goes very fast. So the larger your number that you're using for your keys, the more time it would take you for the best known algorithm right now to solve it. So how do quantum computers come in and solve these problems? So this is the part where I'm going to ask you to, I guess I'm going to try to give you the intuition behind it. So if you think of, I mentioned at the beginning that all of your, you know, the phone that we have, all of it is based on these classical computers, where basically you have gates and you can build, let's say for instance, an adder, because pretty much everything else will build on that. And you can put two bits, let's say you're adding two numbers, you know, one or zero and one or zero.  So one, one will give you three would give you two, one, zero, zero, one will give you one, right. And so on. And that's because the bits are either one or zero in a quantum computer. You don't have that you have these notion of qubits. Now what's a qubit? It builds on quantum physics where matter, a lot of matter or at least the initial representation is in this sort of, you know, in this state where all of the possible spins, you know, zeroes or one can be at the same time. So what ends up happening is if you have, like, say full qubits, like this is represented here, the qubits can be in any of the different states. So that's interesting, but that's not really not enough. What's important is that in addition to being in those states is you can also have them be, so this is called superposition of the state, you can also have them be entangled. And that's what's important. So the qubits, if you can entangle them, then it means that when you run them to a gate, so this is a circuit, a quantum circuit, you can actually specify the ones that you want to entangle and get one result because otherwise what would end up happening is, let's say this was an adder and you had four, you know, bits, then you would get a result that you would not know. But with the quantum circuits that we can build today, assuming those qubits are perfect, so they don't have errors, you could actually solve them, you could, with the circuit, get a result that you want. What ends up happening, typically, though, is that the qubits are not perfect, so even though they can be in 0 and 1, they tend to get out of coherence. So basically, instead of being in superposition and entangled, some of them will get out of entanglement. So what you end up having to do, let's say this was an adder, it's a simple circuit, you would have additional numbers, so you're adding more to use that to error correct. And in many ways, it's not too hard to get few numbers of qubits, but for real problems, like for instance, what we talked about, you need large numbers. So let's kind of look into this. So in, I think, 1994, Peter Schor, I think he was doing his post-doctorate at Berkeley, he came up with an algorithm that goes by his name, Schor's algorithm, that actually can factor numbers and almost pretty much constant time. So this is the blue part. And the best known algorithm right now for factoring numbers is Number Field, and you can see it's exponential. So what does that mean? That means that for what you would do, like say on your WhatsApp, which is about 256 bits, you would need 2 to the 25, or more than that. So 225 is for about 220, and if you go to 256, you can see it goes to about 10 to 25, 10 to maybe about 30. And those numbers don't mean too much to you maybe, but if you think how many stars in the universe, it's 10 to the 50. So the problem with the existing algorithms is that it would take pretty much this number of operations to be able to factor from the public key. With a quantum computer and using Schor's algorithm, you're basically at constant time. So you can keep increasing it. So it doesn't matter how big the key is, you can factor in almost constant time. Now, you shouldn't be too worried because in order for you to solve this algorithm, you need, I think it's in the order of about 8,000 qubits that are perfect. But that's where we are today. When Schor's created his algorithm, I think it was in the order of 2 million qubits. So that's what people expected that you needed to do. So what the point is that the technology is improving much faster and the qubits are better and better, meaning that they are more perfect, meaning that you don't have to do error correction. So the number of operations is getting close to what you would expect in Schor's algorithm. So for some problems, and that's the key thing, quantum computers will make solving those problems extremely, extremely fast. Just as a last thing, and I will go to Paul, around November of last year, there was a group of Chinese researchers that claimed that they were able to decrypt WhatsApp messages over a couple hours. It turned out that there were some problems in their experiment, but there are lots of people doing this right now. And why is that a problem?  You encrypt and you use 256, 300 RSA, it won't matter very soon. So a lot of bad actors, what they're doing is they're keeping this encrypted beta to decrypt later. So that's one of the reasons why quantum computers matter. So hopefully you're convinced, but if you're not convinced, Paul will try to do a better job of showing you how you can program them and real problems and then how Kubernetes plays into this space. Just to be clear, I don't have a quantum computer in my pocket or anything like that. That's the picture. I think that's the one that we had at the Cleveland Clinic right now.  They have electrons that have been had spin put on them that are kept at like basically almost as cold as you can possibly make a thing like down here, like absolute zero. That's what we use to run these quantum calculations. So how do we do that? We don't expect people to have PhDs in quantum mechanics or physics to be able to write quantum programs. Similar to what we've done with classical computers where we started off, we wrote things in assembly and then we developed higher level languages like C and things that let us abstract away and write for different architectures. We've done similar things with quantum computing. So how we do quantum computing is we use SDKs. The most popular one that we have is something called QuizKit. QuizKit is an open source quantum computing SDK. It's been around since 2017. We've got over 100 contributors, 3,000 stars on GitHub, really a lot of stuff going on there, the links on there, quizkit.org. We'll have links and things at the end as well that people can access if they want those things. What QuizKit does is it provides you tools to write and run quantum code kind of at the most basic. It gives you tools for building these quantum programs out of the circuits that we had showed earlier. There's also a collection of quantum algorithms. You don't have to re-implement every quantum algorithm. A lot of them are there for you that you could just call it as functions and methods. There's a number of applications for different industry use cases. There's a lot of quantum machine learning. We have algorithms for that that people can use. In chemistry and things like that, as Max was saying, some of these chemical reactions, there are applications out there that you can use that you can pull in. We're going to demo one of those a little later. Finance is big in quantum optimization. The traveling sales person that Max mentioned, there's algorithms out there for that that you can use in the QuizKit toolkit. Lastly, running quantum programs. There's both simulators. If you don't have access to a quantum computer, you can simulate these and still run them kind of on your laptop with a little less power. Or you can call out to different quantum computers from different quantum providers. There's a provider tool you put. You pick the provider. You attach to your quantum computer and run it. That's what QuizKit is. How do we do it? Again, it's like regular software development. There's a four-step process for doing this. The first thing you do is you build your quantum circuit. QuizKit's Python tool, so you can write some Python to build out your circuit. We'll look at that here in a minute. Like any other, well, not like every, but any compiled language, the next thing you do is you're going to compile your circuit for the particular architecture you're going to run it on. Different computers have different architectures, so in quantum, it's a similar thing.  That's how you run a quantum workload. We're going to do a demo here. This is live, so this may or may not. We're going to run kind of by the seat of our pants here a little bit. Okay. Now, of course, I can't see it on this screen, but again, for people in the back of the room, can you read anything on this? How about now? I feel like an eye doctor. All right, cool. All right, so I'm not going to, whoops, bear with me once I've got to find which screen I'm on. There we go. Okay. Now, where's the mouse? Okay. All right, so given, what time are we at? We got like 15 minutes. I'm going to go a little quick here. So the build step, first thing we're going to do is we're going to just declare a circuit. Again, this is, because the thing is, is regular Python, it should look fairly simple. We're going to declare a circuit with two qubits that we're going to have two regular bits at the end. So we're going to have our two kind of quantum atoms here that we're going to do some stuff to, and we're going to measurement at the end. So we're going to do that here. And then we're going to build a little circuit. And rather than go over, so we're putting gates on the gates are just simple, like circuit dot gate name. So at H gate is an H, C not gate is a C X. And then we're going to measure it. And this, if you want to see what that looks like, we can make that look pretty, well, we can make it look pretty when it's on the screen entirely. And there you go. So you've got two qubits, q zero, q one, we've got two measurements, we're going to get a zero or one at the end. So we're going to have a zero, zero or a one, one when we run this thing. And the way this quantum gate works, not to get two of the weeds, but it's basically going to give us, you know, we've, the H gates going to put our qubit in our superposition so we don't know what it is, we're going to entangle it with a C not gate, which means basically our output when we measure is going to be 50 50, give or take a little bit if it's a zero or one. So that's we, this is our circuit, we built it. Now let's compile it. Given that networks are always fun. I'm going to do a simulator today, but we're going to simulate this. And then compile it, our compiler is just a call to transpile with the circuit in the back end we want to build it for. We're going to run it is just again, simulator dot run, nice and easy. It runs, and then it's done.  We can see we ran zero zero one one. That's our, you know, zero and one, roughly split evenly 49 to 5 11. And then if we want to, you know, we're in a notebook so we could do notebook driven development and build some histograms at the end there. That's a trivial example or a fairly simple example, but you can obviously how you could build this up to much more depth. If you wanted to giving a nice little visual toolkit to work your way through that. So that's kind of quiz kit as a demo. Now I'm going to try to get back to the slides if I can find them. There we go. And then just come back to the, pull the presenters notes back up.  Don't blame Linux. We're the Linux foundation event. Don't don't blame Linux. All right. So that's our demo. Just come back over here. All right. So we're 20 minutes in. We're at cloud native con cube con. We haven't talked about Kubernetes yet. Let's rectify that. How do we make quantum computing cloud native? Or also known as why are we here talking about quantum at cube con cloud native con? You know, so what's the role? What role does Kubernetes play?  And we can use Kubernetes to run a whole bunch of different workloads. So we're all familiar with running Kubernetes on cloud. You can use Kubernetes to run on prem workloads. You can call out to high performance computers. Kind of the takeaway here is you can use Kubernetes to run a whole bunch of different heterogeneous computes. And quantum is just another kind of heterogeneous compute that we can add into these particular workflows. And we can use the one that makes the most sense for the problem or the part of the problem that we're attempting to build. So if it makes sense to build part of our program or our algorithm as a quantum algorithm, let's do that. If it makes more sense to run it on HPC, let's run it on HPC, so on and so forth. And so to kind of think about this, let's use something that's a bit more complex than the last example I showed. Let's take an application at the outset. It's a big problem, but we can break that problem down into smaller pieces. And each of those pieces can be broken down into smaller pieces. Some of those pieces may be best served by building a quantum algorithm, building a quantum circuit to build our calculation if we have a quantum algorithm and enough qubits to do so. But we can break this down into a bunch of smaller problems, compute those results, and then combine those results back up to get the final result. This should be familiar to anybody who's grinded leak code recently. This is divide and conquer, right?  But you need something to kind of orchestrate that. That's where Kubernetes comes in. And that's where kind of what we've called quantum serverless, quantum middleware plays a role. So this is an open source software that we built that's out there people are contributing to that's used to make tools to build and orchestrate these quantum and classical workloads for people to run it in the optimal place. So again, if you've got a quantum workload, and again, it's not quantum or classical, it's quantum and classical.  Does it need to be run classically, in HBC, whatever, so on and so forth? It'll kind of go out and do that. So that's a lot of abstract stuff. We've got 10 minutes. Let's see if we can get through a couple of examples. So simply, so what does this look like in practice? Let's take, you know, the first example. Let's say we want to calculate the ground state energy for lithium hydride. This is a kind of a basic chemistry example where we're going to, and this can be done as a quantum algorithm. There's a quantum equation you can solve. And you can also, and you can do it for different parameters. So maybe you want to solve it where your atoms are this far apart, maybe this far apart, this far apart. So you can kind of run this as, you know, a parameterized equation where you're the bond length would be your variable. So what might this look like in quantum serverless? We could take that program and that set of parameters, ship it off to Kubernetes. We can let quantum serverless kind of parallelize it, run each quantum algorithm individually on separate quantum hardware as individual processes, take those results, pull them back and return them to the user. So it's, we're going to attempt to demo now. Let's see if we can jump back and forth again. All right, let's try this again. Okay. So now we got notebook two. All right. We can still read this. Perfect. So let me do this. We build a writer program in Python that's going to do the things we want to do, which for, you know, to summarize this kind of quickly, we're going to build our atom using some of the quantum nature tooling we're going to do here. That's this, you know, driver equals, etc. Then we're going to do our quantum transformations. We're going to take our quantum algorithm, which is down here where we're going to build a VQE, which is what we use to calculate the ground state energy of this molecule at this particular bond length. And then we'll return the results, package it up in a Python script, and we can then ship that off to Kubernetes and run it. So let's see how are we going to do this? Oh, we're going to do it from a notebook. So we're going to import our stuff. We're going to make so we're going to, we have a, there's a gateway that's just in front of the Kubernetes that we use to send the things to, for resource management and that kind of thing. But we're going to declare an instance of quantum serverless that uses that gateway provider, which we shall do here. Then we are going to define our program. Our program, it takes, again, the Python input, some dependencies. These are, you know, Python dependencies that we're going to add in, Kiskit nature, our arguments, you know, which we're going to use as basically just a, we're going to run a for loop with different bond lengths, and then we will pull those results back into a list of jobs. So let's do that. We've got three jobs. And this is where it gets fun. We're going to see if this thing is actually going to run. Awesome. We're actually running. And now we wait. And that was quick. Again, these are small examples, you know, real workloads can take longer, hence why the parallelization and the running things independently matters. And then we can pull our results back. So we can see that, you know, for bond length 2.55, we got a ground state energy of negative 7.58, where three go threes down here, we got a negative 7.59 3.55 is going to be negative 7.6. So again, as you're getting a little bit further apart, a little bit different thresholds of energy. So that's kind of the parallelization bit. All right, let's, all right. So that's that example. Last example, I think we're going to have time to get through circuit knitting. So again, kind of Max mentioned, we've only got like so many qubits in quantum hardware. I think we're like 433 right now. And that means we can build, you know, circuits that have less than 433 qubits in them. But maybe we want to solve problems that are bigger than that. We can use some kind of, in certain instances, we can actually split a circuit in half into two smaller circuits that are mathematically equivalent to the larger circuit. So we can basically decompose this into smaller workloads, run those smaller workloads, recombine the results, and get the final result. And what's nice about this is when we split our circuit, we're able to split it into a smaller number of qubits, so it can fit on the hardware that we have. So that's what we call circuit cutting. It's part of this circuit knitting toolkit that we have, which is also open source. And again, Kubernetes is our orchestrator. We're going to ship the job out to Kubernetes. It's going to run the circuit cutting. It will then farm those subcircuits out to a quantum machine, pull those results back, recombine them in Kubernetes, and ship them back to us as the user. So we're going to demo this even quicker than we did the last one, since we're running low on time, if I can find my mouse. There it is. All right. So circuit cutting. So what we're going to do is we're going to, and again, this is a small example. We can build bigger ones, but we're going to build an eight qubit circuit. And obviously that could, in real life, could fit on a quantum computer, but for our purposes, we're going to pretend it can't. So we've got an eight qubit thing. We're going to build our quantum serverless instance. And what we're going to do in this case is we're going to run this locally. So we're going to run our quantum in our notebook. And then we're going to make, we're going to send remote calls out to Kubernetes. We're going to run our individual functions. So instead of building it as like one Python script that we run in Kubernetes, here we're going to make individual calls that will run out to Kubernetes. This is kind of more of like a, you know, data scientist type worker might be doing more stuff in a notebook as opposed to building out kind of a full program. Just what we use here, we use this at quiz, get remote function to basically declare this as a remote function. That's going to do its thing. Then we're going to cut it. So we'll run this cut circuit wires remote. That's going to take a little bit of time. We'll watch that kind of run its thing here. It'll give us some outputs. So right now what happens is we've shipped this off to Kubernetes. It's running its thing. It's done some cutting. And now we've got, it's done a lot of cutting. And eventually we're going to get there. There we go. So now we've got two circuits. And we can, if we take a look at this, we'll see that we've got one circuit that's five qubits, another circuit that's five qubits. So we've taken that eight qubit circuit and made it into five. Now we'll run it. And I know I'm running through this stuff really quickly. This stuff's all available online. And we've got links at the end. So you can see it, but we're going to, you know, evaluate it. We'll build a back end.  And this is going to be our evaluate subcircuits. And we're done. Yep. Now we're going to reconstruct it. So again, split it in half, run each individual half, pull them back. And then let's run this again. Now, so this is going to verify the results. So the nice thing about this being a small example is we can actually run the full thing and we can compare the results of our split to the results of the full piece. And so that's what we're going to do here with this verify method. And what we can happen is, again, it's quantized, there's probability distributions and we can pair the distributions of solutions from the full example to the two, to the circuit cut example. And as you'll see down here at the bottom, they're exactly the same. So each use case has exactly the same probabilities or the same probability distribution for that. That's a way that's, again, how we can kind of parallelize big workloads, dividing, conquer them using Kubernetes to orchestrate them. So run low on time. So take away points here. Three kind of big things I think to take away from this. One, we can use quantum to solve those hard problems that we kind of mentioned. Some of those hard problems, not everyone, but some of those hard problems we can solve with quantum. And if we combine quantum and classical, we're able to solve some of those bigger problems much faster. It kind of gives us, that's kind of the optimal way to this. It's not just quantum, it's not just classical. It's quantum and classical together. And, you know, Kubernetes really is kind of the natural orchestrator for these types of workloads. So, yeah, that's kind of takeaways. We've got some links. I'm going to put these, I think these things are online. There's QR codes. The links are at the bottom. And then we've got the feedback slide at the end. So I'll leave this up here for a minute to give people a chance to take pictures and maybe, do we have time for questions or you got a, we got a, yeah. Got it. So what, thank you Paul. Oh yeah. Thank you for the great talk. My question would be the Kubernetes. There's actually running your serverless workloads on which infrastructure on which provider is this using? Where are you running this? We're IBMs, we run ours on IBM cloud, but they can run any cloud. Anything that can run containers. I think they want an open shift. Yeah. Open shift. Yes. Yes. So those are in different locations and then they're connected. The example that you just run, did it run also or it took the decision to run in a quantum computer or it was completely simulated? Because Yeah. So today I simulated them because networks, what could go wrong? But just to make sure that it was, so I've got a local cluster. So what I showed today was a local Kubernetes cluster running on my laptop. But to make it run on, you know, AWS or IKS or any Kubernetes, you just would, it's the same deploy, use Helm deploy it, and then you would just change the backend from simulator to quantum computer. You need an account and so on. But for experimentation, I think IBM gives you time when there's a series of quantum computers that we have all over. So you can just apply for it and get access to it. Okay. Last question. Thank you. If I remember back to the times where I was writing five bit programs at IBM, that was kind of a batch process. So I send them in and I got the results in the next morning. So that's probably not what fits in that classic concept that you have just provided. So if I download that, then I'm running the simulation, right? We showed very simple circuits. As I mentioned, like if you were to try to run shores or any kind of, you know, real problems, you'd need a lot more circuit, a much bigger circuit. And then you'd have to cut it multiple times and then use a real computer to combine. But this is what we're doing right now. So I think in the slides, we showed where you can actually go in. And if you wanted to contribute and try this, a lot of those Jupiter notebooks are there. So you can actually run them yourself. And then more importantly, all of the Qiskit, the circuit, sorry, the quantum server less, all of that is open source. And you can start using it right now. And if we had tried to run bigger things, we would have very quickly run out of time, as I think we are being noticed that we are out of time. So thanks everybody for coming. Really appreciate it. We have a question afterwards.


men's conferences. And the reason why is because we don't have to have all the extra stuff like they have at the women's conferences. We don't need flowers. We don't need tablecloths. We don't need no stinking badges. All we need is the Bible and maybe some duct tape and we can see everything put back together. And so I love getting together with men, searching out the heart of God, seeing the heart of God. And we've seen that in these first two sessions. The heart of God depicted with Pastor Raul, the heart of God, is at the cross to nine ourselves with Pastor David, the heart of God, and men that seek after the heart of God. And I'm really humbled by the opportunity that I would even be asked to share with you. Because I admire you and respect so many of you so much that I feel like I still need to be sitting and learning from you. But yet I believe that God has something that is placed upon my heart. That if we would have ears that would hear, what the Spirit would want to speak, I believe that we can receive something that God wants to do in our lives in a powerful way. And so as we gather together we know that the Word of God will not return void in the hearts and the lives of His people. As we open up His Word we know that God's Word will open up our lives and do the surgery, the open heart surgery that only the great physician can do. And so I'm looking forward to what God is going to continue to do in our lives. Are you guys ready for what God is going to do today and continue through these sessions? Let's do this. Let's stand together. I know you've been sitting for a while now. Let's stand together.  And while you're turning there, I just want to say one thing. My dad is with me today. I brought my dad with me. It's his birthday today. And so I asked him to come with me today. And so he's here, Brian.   And so I want to thank you, Dad, for being the man of God and an example to me. And happy birthday. I hope you liked that because I didn't get you anything for your birthday. No, I'm kidding. Oh, so thankful for men that stand up for righteousness. I wasn't planning on sharing this. I actually edited it out of my study. If you've ever prepared something to share, you know that it goes through the editing of the Holy Spirit. And sometimes it's the editing of your self where you don't think it fits in. But as you're standing, I think you'll thank me in the next three hours when we conclude this study. But as we're standing, I just feel prompted by the Lord to share this with you again, the importance of a man being the man of God as Pastor David shared so perfectly. Because what's missing in our society and now secular sociologists and psychologists are discovering that the problem with our society in our country is the demise of the family unit, the family unit. And that begins, starts and ends with the presence or absence of the father in the home. This is against secular statistics. But it says there's a crisis in America, according to the US Census Bureau, 19.7 million children more than one in four live without a father in their home. Consequently, there is a father factor in nearly all of the social ills facing America today. Research shows that when a child is raised in a father absent home, he or she is affected in great ways. Then it goes on to list all these various ways, but I want to share just a few of them with you. Children are more likely to commit crimes, violent crimes with deadly weapons, seven times more likely to become pregnant as a teen, more likely to face abuse and neglect, more likely to abuse drugs and alcohol, two times more likely to suffer obesity, two times more likely to drop out of high school, two times at a greater risk of infant mortality, more likely to have behavioral problems, four times greater risk of poverty and much more likely to go to prison. Why? Because men aren't being men that God has called men to be. And in this day and age, we need godly men. We need godly young men to be examples like Timothy was, where Paul would say to Timothy, don't let them despise your youth. And that wasn't say, Oh, don't despise me, older men. I'm a younger guy. Don't think of me.  And we need more young, godly men to rise up and say, I want to lead. I want to be like Christ. Though none go with me, I still will follow. We need more older men to be the patriarchs, do not put it in cruise control. It's interesting. Over 75% of the people that fell in the Bible throughout from Genesis to Revelation, 75% of the men who fell in their life fell in the second half of their life. When they were older, when did David fall? When he was 40 years, when kings would normally go to battle, David stayed behind. Why? Because he put it into cruise control and he wasn't doing what he was supposed to be doing, what he should be doing. He stopped fighting the battles. He stopped being the warrior. He stopped being a more than conqueror. We need more men, older men, young men, middle-aged men, really, really old guys, really, really young guys. There's no such thing as old men. There's just older men because we're always in our prime as men. About to hit my prime. But we need men to be men after God's heart. We need men to take what God has called us to be seriously from the pages of his Word. He created us. He knows who we're supposed to be. And it's time that we start acting out and living out the lives that God has called us to live as men. Amen? That's not my message. That was just something that God put on my heart that wasn't in there. But I believe the Spirit wanted at least somebody to hear that today. Because God calls us to be more than conquerors. Well, Romans chapter 8 verse 37 says this, yet in all these things we are more than conquerors. Through him, Jesus Christ. Through him, not through you, not through your efforts, not through your energies, but through Jesus, who loves us. And Father, we thank you so much for your love for us. That you would be willing to give your life for us, that we could have life and live life. The life that you've created us to live. Today I pray that you would empower us as men to be the godly men that our country needs, that our worlds need, that our families need, that our wives, those who are married needs, those who have children, the fathers that our children need. Lord, that you desire us to be. So help us, God, we pray to see you from the pages of this your living word. So that we could see you, so that we could know you more, so that we could become more like you as you change and transform our lives. We give you our lives. We surrender our lives to you today. You accomplish the work that you want to do in our lives. In Jesus' name we pray. And all God's people say, Amen. You may be seated. Warrior. Yes, we can do it. Yes, I'm a conqueror. The theme. We wear the shirts. Conqueror. We like the sound of that. Conqueror. You can have victory. Conqueror. You can overcome. Conqueror. You can succeed. But what do you do when you don't? What do you do when you get to the point where you've tried everything and no matter what you do it seems like you don't conquer you failure. When you try to conquer but you are defeated in the relationship, the situation, what do you do? You're seeing any given situation we can be faced with our own inability. Our inability to right the wrong. Our inability to fix the problem. Reconcile the relationship to be set free from the addiction to accomplish the goal. And our lives can become characterized by our inability.  Welcome to church.  And yes, we would like to be a conqueror. But the fact of the matter is we are no match for our adversary, the enemy. He can sift us like wheat in our own strength. You see, we try to be strong. We try to do better in our own strength, in our own efforts, in our own energies to change, to do better, to stop doing that and doing this. But the problem is our spirit is willing, but our flesh is weak. That's why Paul said, Why do I do the things I don't want to do? And I don't do the things that I want to do. And so in our own strength, we find ourselves limited. We find ourselves unable. We find ourselves defeated. But it's interesting to me that throughout the pages of this book, sitting in our laps that we often take so for granted of, the living word of God, that in the pages of this book, the story after story after story were a person or the nation of Israel was brought to a point of certain defeat. The odds were impossible for them to be a conqueror was unlikely at best. But then something happens story after story, when they come to a point of certain defeat, when there was no way, when seemingly all was lost. But then there's two words that are given in the Bible. I believe it's the two most powerful words in all of the Bible. It's a phrase that's used and when it's used, we should take a note of. Because after this phrase is used, you see God do something supernatural, something impossible, something miraculous. These two words that I'm talking about are these, but God. And when you see those two words, these powerful words, these words are paired together more than 45 times in the Bible. And when you see these words, God brings about radical change. It might look like impossible to you, but God. You see, a great theologian, Martin Lloyd-Jones, said this and I quote, in those two words contain the whole gospel of Christ. You see, no matter who you are, what you've done, how you've lived, no matter the mistakes you've made, no matter the addictions you have, no matter the failures you've made, you would experience certain defeat, but God can give you victory. But God can allow you to be a conqueror and a more than conqueror. You see, there's something so important to understand as it relates to us as conquerors. And that is, you're not. You're not a conqueror. No, we're not. We can't, but God. And that's why it says in Romans 837, yet in all of these things, what things? In all of everything that's going good. No, listen, Paul talks about this in verse 35, in tribulation and in distress, in persecution, in famine, in nakedness, in peril, in sword, in anything that we go through, no matter the difficulty, no matter the opposition. Then he says in all of these things, we are more than conquerors. But then notice what he goes on to say through Christ, through him, Jesus. You see, we aren't conquerors in our own strength, but when you don't miss this point, this fact, that it's through Christ that we can have victory, that victory is already promised to us, then you realize even though it seems impossible, but God. You say, Pastor Brennan, that sounds great. That sounds nice. That's nice, but you don't know my situation. It doesn't seem like right now I'm a conqueror. No, I've actually been defeated. All hope is lost. It's too far gone. You don't know my situation. You haven't been where I've been. Maybe when you're a little bit older, like when you turn 15, you'll know. Maybe when you've gone through the life experience that I've gone through. Listen, here's what God's word says. For some of you, you might say it's my marriage. My marriage, it's been this way for a long time. It's not going to change. It's actually getting worse. You don't know my wife, Pastor. Good. But I know who Job's wife was. Job's wife? Oh, she had to be a real doozy. Could you imagine? Satan comes to God and says, oh, I've considered your servant, Joe, but you don't, you don't let me touch him. Your hand of protection's on him. If you would just let me get him, I could get him to curse you. God says, okay, do what you think you need to do. He's going to be faithful. So Satan goes after him. Everything he could do to ruin his life. He kills his children, his servants, his livestock. But when it comes to his wife, his wife did not die. Could you imagine the demons? Hey, Satan, Satan, we took everything. Lucifer, we killed everything, but his wife, we got to go after his wife and say, he goes, no, no, no, leave her. I know what I'm doing.  You might say, Pastor, the problem wasn't my wife, if we're going to be honest. I like to blame her, but the problem was actually me.  Most people that know you know that. And you might say, there's no hope. My marriage, it's falling apart. I want to share with you a couple of stories throughout the Bible, some situations that seem like all hope was lost. But God, one is Genesis chapter 20, where Abraham and Sarah were traveling. And as they were traveling, Abraham, this great man of faith, the father of faith, Abraham, the patriarch of the nation of Israel, this man of faith makes a big mess of his marriage. You see, he says to Sarah, you see, when we get there, a bimilech who's king, he's going to see you. And because baby sweetheart, you're so beautiful.   So babe, let's just lie and let's just say you're my sister. Yeah, he'll take you and you won't see me anymore, but I'll live.  So they get there and a bimilech hears of this most beautiful woman. And so he says, who is she? And so he inquires about her. And Abraham says, huh, yeah, that's just my sister. That's funny. I've never kissed my sister that way. And you're right. Yeah, that's my sister. And so a bimilech takes her into his harem to make her one of his. Seemed like all hope was lost. The marriage was over. They were separated literally. And in Genesis chapter 20, verse two, it says Abraham said of Sarah, his wife, she is my sister. And a bimilech king of Garar sent and took Sarah. Their marriage seemed to be over. But God, verse three, came to a bimilech in a dream by night and said to him, indeed you are a dead man. A bimilech has this dream where God says you are dead.  He would die physically, sexually. She's not worth it. And so he sends her back and he says, why did you lie to me?  You man of faith? And that was Abraham.  They were separated literally. But God brought them back together miraculously. Abraham made a mess of their marriage. Their marriage was fallen apart, but God moved in to their marriage. And when God moves into the mess, God gives you a message to take from the mess. And you won't have the message without the mess. And so God will take that mess, redeem that mess, and give you a message from that mess to share with other people who are going through the mess.  You know, growing up, I always heard, you need to think before you speak. But we never really learned that lesson.  And she says, well, God made me beautiful, so you would marry me.  So many times we say hurtful things to the people around us, mean things. We don't act out of love. And because of it, we cause issues, problems, separations. You might say, you don't know, pastor, what I've done. I don't, but I know God. And I know God can move in the mess, even when your marriage looks dead. But God, maybe you might say, but it's not my marriage. It's actually, my marriage is fine. It's my kids. It's our kids that aren't walking with the Lord. I try to talk to them. I try to get through to them, but they're not listening. I can't communicate to them. And I don't have the answers for them. It's the parenting that's causing me the issue. It seems like my children are so far gone. Genesis chapter 48 verse 21, Jacob said to his son, Joseph, behold, I am dying.    You won't always be there in the way that you need to be there. And you might be kicking yourself because you felt you haven't been there in the way that you need to be there. Maybe you haven't been the present father that you've needed to be in the past, but God can bring them to the promised land. The promised land is a type and biblical typology of the spirit-filled life. They might seem so far gone that all hope is lost, but God, their heavenly father, your heavenly father, maybe you're a young man who has been a prodigal. Maybe you've walked away from God.  Listen, maybe your dad hasn't been for you in the way that you've needed a dad to be there for you. Listen, God has always been there for you. He's always loved you. He's never left your side. He promises to never leave you nor forsake you. And God promises to carry you on to completion, to bring you to the spirit-filled life. You see, you might think all hope is lost, but God, it's not life insurance. It's life assurance. The promise of life for those who are in Christ Jesus. You might say, but Brennan, in my family, it's not our marriage. It's not my kids. It's actually my mother-in-law. If it wasn't for her pastor, everything in life would be perfect in laws. How do you think Jacob felt?  Laban. But yet he talks to his wife and he says, yet your father has deceived me. He doesn't say, I'm not going to have anything to do with him. Yet he's lied to me. I'm going to stop honoring my commitment. He says, yet your father has deceived me and changed my wages 10 times, but God did not allow him to hurt me. You might say, well, it's not in laws. I come from a dysfunctional family. I come from a family, a lot of turmoil in the home, completely dysfunctional, a lot of abuse there. Let's talk about Joseph for a minute. Joseph with his big brothers who took him and threw him in a pit, left him for dead there. Talk about some PTSD, emotional trauma. I'm emotional now because of my past. What did Joseph do? Did he become a victim or was he a victor?  Let's just sell Joseph. That way his blood's not on our hands.  So they sell Joseph into slavery. But what does God do? He gets to Egypt. He honors God. He's elevated in Potiphar's household. He continues to honor God when Potiphar's wife throws himself at Joseph. And it's interesting, Joseph, when talking about Joseph, the Bible says that he was well in appearance and stature, meaning he had a handsome face and he had the body. Usually for us men, it's one or the other. If we have the face, we don't need to work out and get the body. But if we don't have the face and we're ugly, we need to get the body so we work out. But for Joseph, he was well-built, good-looking young man. And it says he was tempted daily by Potiphar's wife. It was a temptation.  Don't think of like baggy sweats and a t-shirt. It's like every day, day after day, there was a new temptation for Joseph. Potiphar's wife jumps out in like a little tennis outfit. Hey, Joe, want to go play? Joseph's like, no! Tennis is of the devil. The next day, something more seductive, something more seductive got to the point where she's in her Victoria's Secret outfit and she grabs them, literally throws them down onto her bed, begins ripping his clothes off. What does he do? I'll tell you what he didn't do. He didn't have the conversation should I or shouldn't I? Because once you have that conversation with Satan, you've already lost because you're no match for Satan. Once you begin opening that conversation and he could have, he could have justified his actions or tried to at least. Well, you see Potiphar's wife, she's neglected. She doesn't have anybody.  Now, if she was my wife, I would never leave her. I would be with her. She has needs. I have needs. No, you know what he does? He runs for his life, literally for his life. He runs. He hightails it. And as she's grabbing his robe off of him, he's literally pulling away from her, pulls out of his robe as he's running away now in his chonies. And he's running down in a way to get as far as he can.  Now, Joseph's imprisoned for 13 years, still honoring God, still doing what's right. Talk about a dysfunctional life. What did Joseph do when he was in prison? You know, if it wasn't for my dysfunctional family, if it wasn't for my past abuse and being thrown in that pit, I wouldn't be in this mess. No, he never became the victim, but continued to look to God for the victory. 13 years later, Joseph is delivered out of prison, elevated to the second command in over all of Egypt. And now there's a famine in the land. If you don't know the story, you'll have to read it. I don't have time to get into it. But it's interesting in Acts chapter seven, verse nine. It says, as the patriarchs, that is, Joseph's brother is becoming envious, sold Joseph into Egypt. But God was with him and delivered him out of all his troubles. It's time for us to no longer be the victims of our past, but to be victors in the present and the future of what God has for us in our lives. I'm not nullifying what you've gone through. I'm not saying what you've been through isn't horrendous, isn't evil, isn't sick. I'm not saying the abuse you've endured isn't horrible. No, but I can tell you this, but God, God can restore, God can heal, God can redeem. It's what God can do. God will be with you and deliver you out of all your troubles. Finally, Joseph's brothers come as Joseph's the prime minister. They need food and Egypt has a lot of it because of Joseph being able to interpret the dreams. And Joseph, there in Genesis 50, 19, Joseph says to his brothers, do not be afraid. For am I in the place of God? But as for you, you meant evil against me, but God meant it for good in order to bring it about as it is in this day to save many people. You see, you did it for evil, but God allowed it to save many people. You might say, Brennan, it's not a family issue. I'm not married. I don't have in-laws. I don't have kids. I don't come from a dysfunctional family, but listen, I'm a sinner. I know that and people that know me know that. I've done a lot of wrong things and I don't know how God can ever turn my life around after what I've done. I'm carrying the shame and the guilt from the past. And it seems like my past is always trying to chase me down. First Samuel chapter 23, verse 14, David's being chased by Saul. Saul was trying to kill David with every ounce of energy he had. Let me ask you, what's chasing you down? What temptation is trying to destroy you?   But Peter doesn't leave it there. We all have heard that verse before we've know that verse, but then Peter goes on to say, but God, the God of grace will perfect, establish, strengthen and settle you. What's seeking you? What sin in the past do you feel like you can't be free from? See, I've made so many mistakes. I've done so much wrong. I've hurt so many people.  You see, God promises to perfect, to establish, to strengthen and settle you. But, but Brennan, but Brennan, but Brennan, no, but God.  This is a very difficult temptation though. How do I overcome it? 1 Corinthians 10, 13, no temptation has overtaken you except such as is as common to man. The things that overtake us, the things that we fall to, it's common to everybody. Everyone faces those temptations, but God is faithful who will not allow you to be tempted beyond what you are able, but the temptation will also make a way of escape that you may be able to bear it. Yes, you might be tempted, but God promises to give a way of escape. God did not allow Saul to get to David and God will not allow Satan to get to you. Perhaps you're in a situation where you think, I don't know if God can use me anymore. I don't know after what I've done. What's your excuse? Why you can't serve the Lord? Why you can't be the leader, the man that God's called you to be? Well, after what I've done, I don't think God wants me. Listen, Saul was a Christian killer. Jacob was a cheater. Peter had a temper. David had an affair. Noah got drunk. Jonah ran from God. Gideon was insecure. Miriam was a gossiper. Martha a warrior. Thomas a doubter. Sarah impatient. Elijah was depressed. Moses stammered. Zacchaeus was short. Abraham was old. Lazarus was dead. What's your excuse? But God, and I want to say to the husbands who are ready to give up on their marriages that are in a mess, but God to the dads who are worried about their children feeling like time is running out. I don't know how much longer I'll be on earth and I would love to see them saved before I go to be with the Lord. But God, the men that are being chased down with their past sin, but God, you are a more than conqueror. That phrase is interesting just to close to leave you with this. A conqueror or a victor or someone that has victory, but there's a battle and whoever comes up on top is the conqueror or the victor. It's like the raptors versus the warriors. No quicker way to divide a church than mention the finals. I've been rooting for the warriors for a while. I'm sorry. Don't throw any vegetables if you have them or breakfast burritos. Salsa I will take. That salsa was good. But you see the raptors are up three to one. They've been victorious over Golden State Warriors. It's not over yet because but God. And if you're rooting for a Canadian team, we're going to pray for you to be a little bit more national pride. But anyways, that's what a victor or conqueror means. It's someone that wins. It's a battle. But a more than conqueror is like if if you put all the all stars together on the NBA and we in this room put our own team together and we played them, they would win without competition.  More than a conqueror means that there is no battle. You're winning not with overwhelming odds, but there are no odds against you. That the victory that has promised to you through Christ, the victory has already been won. There is no more war. Jesus claimed victory over our sin over our death when he died on the cross for our sin. He paid the price so that we wouldn't have to so that we who accept him as our Lord, who walked closely with him, who seek after him, we can be in any situation, no matter what life brings your way, whatever the enemy allows, whatever God says, okay, this is going to accomplish my perfect will in your life, whatever that is, we can be in that situation a more than conqueror. Where it's not a battle, it's not I hope I come out on top. It is there is no battle. I am already on top even before I get through this, because God promises to see me through it. So many times we pray that God would get us out of it when God says I'm going to walk with you through it, because it's in the fire that we see Jesus. Hashtag Shadrach, Meshach could have been to go. Why didn't they try to get out of the fire? They were throwing the fire. They didn't burn up. They could have stepped out any time and been like, and one of those like, I'm the man back down, intimidating. If anybody ever had done that to me in the past, that's like wide open, just hit me. That's what that means. They could have, and all the soldiers had no doubt would have back down, but they stayed in the fire. Why?   Two words, men, on the count of three, what are they? One, two, three.


This, I will try to explain to you how it is possible to verify the correct execution of a computation without re-executing. Of course, just so a computation is in this sense a fixed procedure that runs on a certain input and results in a certain output and the computation itself is deterministic so whenever you run it on the same input you always get the same output and of course the obvious way to do that is to just run the program again and that is what is currently done in blockchains. If you sync a blockchain you just rerun all the computation that the miners have already done. I mean you don't rerun the search that is done in mining but you rerun executing the transactions and on the horizon there are new research results which might allow you to do some things which then result in checking a computation and being reasonably sure that it's correct faster than re-executing them. Okay and as an outline of this talk I will start with explaining why that might be useful for blockchains already started a little on that and then there are yeah basically two popular approaches to that problem one of them is called snark and the other one is called stark and they share some properties and they then in some other regards they are fundamentally different and since there were already talks about snarks I will focus on Starks for the rest of the talk and yeah I'll try to explain how they work and the first component of Starks are running the computation and generating something that's called a computation trace and this is then encoded into a polynomial and the second component is something called IOPP interactive oracle proof of proximity first two already bored can understand that and this is used for low-degree testing and then in the end we'll see how you can add zero knowledge to the whole thing I am in no way responsible for any of the results explained here and this is a long yeah line of research that started in the 90s and the names here are just some of the contributors and I already warn you that I will leave out some details quite a lot actually but I hope it's still you can still see the the main breakthrough ideas there and I yeah I already have warned you that it might be a little dry so if you have any questions in between please ask to to yeah make it a bit less dry okay where I find blockchain when you look at a blockchain it always starts with a block with a number zero which contains the Genesis state which might be completely empty or contain some pre-allocated funds and then you add a new block and this block number one then contains a list of transactions and sometimes also something called a post-state route so this is you take the the state of the blockchain so kind of the the account balances and create a mercury of it and in in the block or in the block header you store the root hash of that mercury and now assuming we have this technology and it is practical this stark technology this verifying computations without re-executing them or faster than re-executing them then we might be able to attach a proof to that block which can convince a verifier that the transition from the Genesis state to the state in block one by the given transactions was done correctly so that this post-state route is the post-state route you actually get when you run the transactions and but we assume that it's possible to verify this proof without actually re-executing the transactions without actually finding out the effect of the transactions and so if this block comes in and you want to verify it you just run the proof you don't re-execute the transactions and this is a little boring but it gets more exciting when we add block number two this block number two looks similar it also has transactions and it also has a post-state route it also has a proof but now the proof does not only prove that the transactions took the state from the state in block number one to the state in block number two but it also proves that the verification of the proof in block number one was done correctly okay so this proof does not prove that the transition from Genesis state to block number one was correct it only proves that the proof in block number one was verified correctly and that's a big big difference because especially as the blockchain grows the amount of work that is required there stays the same so we only verify the transition from block two to block three and the checking of the proof in block two we don't verify the checking of the proof in block number one and the transition from 0 to 1 so what we only do is we have a proof that the state transition from the previous block to the current was correct and the previous proof is correct and this means that syncing a blockchain if we have the technology then syncing a blockchain just means downloading the state and verifying the proof in the highest block that's it that's all you need to do so you don't need to rerun all the previous transactions so yeah and to warn you so this does not yet work in practice and it does not solve the problem of data availability and it does not solve yeah you only know that the block that you have is correct you don't know whether it's the highest or the one with the with the most proof of work so that that's similar to data availability so somewhere out there so you might be disconnected from the network and the rest of the network might see a much longer chain and you're on the wrong block that's something you can't do here you can only see that the block you have is correct and the whole history is correct okay so that's what might be possible in the future and now how does how do these yeah computation verifiers work almost always those start with something that is called an interactive protocol in an active protocol you always have two parties one party or yeah you might also have more parties but most of the time you have two parties one of them is called a prover and the other one is called a verifier the prover is usually much more powerful than the verifier so think of that prover is someone who creates a transaction and the verifier is just a smart contract on the blockchain so the prover has a tremendous amount of memory tremendous amount of disk space access to network and the verifier is extremely limited and they exchange messages prover sends a message to the verifier verifier reads that message answers with her own message prover reads that message again answers with her own message and so on and the verifier is allowed to use remnants and so on correct input so think of it as for a fixed computation input and output pair and this this is correct if the computation on that input yields that output if that's the case then the verifier has to accept after the exchange messages and on incorrect input if the computation was wrong then the verifier has to reject with high probabilities a verifier uses randomness so we have to say with with high probability here and not with the certainty okay and you might already see that this is not really suitable for blockchains because I can't really exchange messages with blockchains I mean I can but it would be a hassle because it takes multiple blocks and so on and because of that interactive protocols can often be made non-interactive by a technique called or named after Fiat and Shamir we might take a look at that later okay and now let's compare snarks and Starks so just name the the acronym snarks is succinct non-interactive arguments of knowledge and Starks is succinct transparent arguments of knowledge although Starks are also non-interactive most of the time but it doesn't really matter what these acronyms mean the thing is that the proof size so proof size means the length of the exchange messages and usually when they are non-interactive this means the prove it just sends one single message to the verifier the verifier processes this message and says I accept or I reject and since it's just a single message it's also called proof for snarks they are very short so something like 188 bytes mostly regardless of the size of the computation and for Starks they are longer currently in the range of 400 kilobytes something like that Snarks are not run once this means Snarks require a quite costly setup phase but this setup phase has only has to be done once for one type of computation and then it's extremely fast so you have to invest it in the setup and then you can repeat it multiple times and for Starks that's not the case there's no setup so it's in generates a little slower but you can do it multiple times on different functions transparent that's quite important that means that for Snarks you need random numbers and you need to keep them secret so in this so-called trusted setup setup phase that you just do once in the beginning random numbers are generated and they have to be kept secret or you have to pick it secret kept secret at all cost but they are not lead needed any more later so you can also destroy them that's why you might have seen videos of people drilling holes in their computers and things like that for Starks that's not the case anything that happens in Starks is public so of course Starks can also have zero knowledge but so there are private parts but you don't need this trusted setup you don't need the the toxic ways the random numbers that you need to destroy and Snarks rely on some assumptions about cryptography for example that elliptic curves are secure and also something like knowledge of exponent which is in practice not true anymore once we have scalable yeah scalable actual quantum computers so because quantum computers can break elliptic curve cryptography for Starks that's also better because they only rely on the existence of collision resistant hash functions and I think this is something that is reasonably true for yeah quite a long time okay both technologies here and many others start with encoding computations as statements about the equality of polynomials and this is so encoding computations as polynomials is quite useful because you can easily check whether two polynomials are equal or not but evaluating them on some points and the reason is that if two polynomials are not equal then they are different at almost all points so in the rest of the talk we will always talk about polynomials over finite fields and this means you can actually have numbers there so they are two different polynomials are only equal at a number of points that is equal to their degree and different all other points of the fields and so the problem is that we want to avoid the proof we're having to send the full polynomial to the verify because the polynomial is usually rather large and we want the messages to keep small because these messages are stuff then it's then to be encoded into the blockchain so the verifyer wants to check that two polynomials the prover claims something about are equal and has to evaluate them for that but she doesn't know the polynomial so she kind of has to ask the prover to evaluate the polynomial for her and then check that the numbers are equal but she has to kind of trust the prover that this evaluation was done correctly or the prover has to convince her that she did it correctly and Snarks and Stark take two different approaches there Snarks use partially homomorphic encryption for that and it works by the prover evaluating the polynomial at an unknown point or an encrypted point and this encrypted point is the thing that is generated during this trusted setup so some randomness that is later destroyed is used to create a random but later secret point where the polynomials will be evaluated and since so this is homomorphic encryption so if the if the value at the encrypted point which is the encryption of the value at the point so if those are different then also the decrypted versions are different and because of that you can throw away the randomness so you don't need the decrypted point anymore you can just work with the encrypted point okay and Starks are don't use cryptography they just use hash functions not sure if you can't test cryptography and here the rough idea is that the prover commits to the full evaluation of the polynomial so they take the polynomial evaluated at all points in the field or at least a large number of points and then create a mockery of these function values and send the root hash to the verify it just the root hash and then the verifier can request the prover to send some values and these values then of course come with mercury proofs and the only flaw is that as I said earlier the verify has no control about how the prover actually evaluates this function and because of that we need a second component where the prover proves the verifier that this gigantic array of values she has is actually the value set of a polynomial and this is done in something called IOPP interactive oracle proof of proximity okay so let's get into detail what is a computation as I said it starts with it starts with an input so let us simplify computations here rather strongly and let's assume we have a computer that only has three registers these registers are a 1 a 2 and a 3 the input at the beginning of computation is present in these registers at step 0 this is 1 4 and 2 and then we have a fixed program that does something on these registers so for example at step 1 we take the value of a 2 and a 3 add them and store it in a 3 and then at step 2 we take the value at register 2 register 3 add them and store that in register 1 at step 3 we take the value in register 1 and register 2 multiply that and store it in register 3 and so on we do that for 8,000 steps of course the program is not a list of 8,000 instructions but it's somehow more compressed so it has loops and things like that so the description of the program is much shorter but at every step of the computation you kind of know which operation to perform on which registers okay and yes so we have an input of 1 4 2 and the prover claims that the output is 15 3 34 and of course the computation is correct if it is correct at every single step and the idea now is that verifying a single step is easy in comparison to running the whole thing and now yeah we wanted to encode that in polynomial so what the prover does is she takes this sequence of values for a 1 and turns that into a function so the function a 1 at point 0 is 1 a 1 at point 1 is 1 a 1 at point 2 is 10 a 1 and point 3 is 40 and so on these are 8,001 points and because of that you can create a degree 8,000 polynomial that behaves exactly as that function at these points so the polynomial at 0 is 1 the polynomial at 1 is 1 and so on degree 8,000 might sign might sound a lot here but yeah that's how it works and yeah I mean in the paper they actually go to degree I think 10 million or something like that I mean the number of steps of a computation yeah and we do that with all three registers and now there is another polynomial called C and this kind of encodes the the program so and it can be used to check the correctness of a single step in the following way okay so this is the first complicated formula I'm sorry about that so the computation is correct if and only if the inputs and the outputs are correct so that's something we have to check in addition and I mean output is correct as here does not mean that output and all the preceding stuff is correct but just the output and in addition to that for all x in between 0 and 8,000 so these steps we run C or we evaluate C the which is the step correctness checker and as inputs it gets x the step and then a 1 of x a 2 of x a 3 of x the values of the registers at the beginning of the step and the values of the registers after the step so that is all you need if you know the program that is all you need to verify the correctness of a single step and it has to be zero and yeah we assume that this can be encoded as a polynomial since the program is finite this is always the case clear so far any questions who's already asleep good there was graphics here okay that's there's a table it has actual numbers okay let's continue so that's again repetition of what we had in the bottom the condition for computation being correct now something happens that's a simplification but you might not think of it as a simplification simplification let's see so we have these three registers and what we do so we have three registers and one polynomial per register and we combine these three polynomials into a single polynomial by just kind of stretching it so we call the single polynomial a and so perhaps it's better to explain it on the table again we build it such that a at 0 is this one here this is a at 1 a at 3 a at 4 a at 5 a at 6 a at 7 and so on so it's basically just encoding the whole table into a single sequence of values and yeah so and we need these lowercase a's to perform the mapping between the indices here so and if we look at that and replace all the a i's by the single a we get this here so c of x then a at the first index a at the second index a at the third index and then a at the first index at x plus one second index at x plus one and third index at x plus one okay question I have a question when you execute the program and you have different values for the interest then you every time have a different polynomial right so yeah so this is stuff the crew has to do of course that has to be repeated for every single execution yes okay but once you execute the whole program and you interpolated the polynomial once you have polynomial so every if you want this basically what you want to do it so you don't have to run the whole program again exactly so this is so yeah this is stuff the proof has to do but that stuff the verify does not have to do right so and the idea is verifying the computation is faster than re-executing it but generating the proof of course takes longer than just re-executing it or just executing it did I answer the question a little or not yet okay I will I will have an overview of the whole protocol later perhaps it gets clear then okay and now so what the statement here that's a statement about a polynomial on the left-hand side and a number on the right-hand side and it's a statement at 8,000 discrete points of this polynomial 8,000 discrete input points of the polynomial and what we now want to do to get it fully algebraic is to turn this into a statement not about discrete points but a statement about two polynomials and statement about them being identical and so yeah I'll just okay what we do is so we say that the polynomial on the left-hand side here is zero at these points and this means on the right-hand side if you want to have a polynomial here at the right hand side we have to find a polynomial that is zero at these points and that is this polynomial here so the polynomial z is zero at exactly the point zero one two until seven nine nine nine and nowhere else and if you just put z here then this will not capture the full polynomial here so we need to add another polynomial factor or multiply a different explanation is we take this polynomial and it has some zeros we know that it has zeros here so if we have a field that is algebraically close like the complex number or a proper finite field then we can factor out these factors x minus zero and if we do that then these factors we removed are z and the rest is d yes so the degree of c is higher than 8000 because I mean if you take a look at it the degree of a1 is exactly 8000 and that's a argument of c so and has more stuff so it will probably be higher okay the important thing here is that so we have the same left-hand side here and replace the zero by a product of two polynomials and now we can say that this equality is not only hold for all x in this discrete set but for all x in the whole field so we have actual polynomial identity everywhere and because of that we can apply the stuff we talked about earlier checking equality of two polynomials by evaluating them at some points and checking that the value is the same yeah right so all polynomials here have small degree and small here means small in comparison to the size of the field so size of the field is something like two to the 80 and the degree of the polynomials is something like between 8000 and 10 million or something like that and this will be important later okay now we've come until here and I see still see some open eyes that's great because now I will describe the full interactive protocol that is run now between proven verifier and as a reminder this is the property you want to show at the end okay given so this means this is a shared input that is available to the prover and the verifier C is available to go to both because this is kind of encoded in the program that's the the function the program they want to verify then these a 1 a 2 a 3 these are simple functions 3x plus 2 or something like that and then Z that's the polynomial that has zeros exactly at the point 0 1 2 and so on this is a polynomial of rather high degree especially for the verifier but it has a very simple structure okay the prover now computes the polynomials and these are gigantic beasts and we do not want to send them to the verifier she computes a by basically running the computation and looking at the values of the registers running polynomial interpolation and yeah that's how she gets a and then D is obtained by evaluating this expression here and dividing it by Z using polynomial division or yeah something like first fast Fourier transform there are quite efficient algorithms for that and now the prover actually wants to send the full A and the full D to the verifier but that is way too long so we do something that is almost like sending the full thing to the verifier and it's that this is creating a mercury of all these eight thousand or yeah of all these values and sending the mercury route to the verifier I actually we have to evaluate a and D not only on these 8000 points but actually on way more and the reason for that is if we compare polynomials by evaluating them at some points and these these points can only be points can only be from this set of 8000 points then they will always match so we have to evaluate the polynomials on way more points okay always match why if you only evaluate these functions at 8000 points and assume that they are degree 8000 then to two polynomials of degree 8000 that are different can still be equal at 8000 points because of that we need way more than 8000 points to get the right probability so if the verifier is unlucky she might hit one of these points where the different polynomials are actually equal and but if there are one million points to choose from and only 8000 are unlucky then the probability is rather low so we probably want to wrap that up to 10 million okay that's a very large mercury but it still seems to work so yeah what the verifier now does she requests so she picks a random x prime from these one million points and requests the values of the polynomials at these points there's some weird notation here and the reason is that the verifier requests the requests a and d to be evaluated but if you look at this formula here then it the x prime doesn't directly go into a it's first transformed why are these lower case a functions and this means we have to request we have to first transform this x prime by a one that's actually wrong this minus one shouldn't be there right okay and then the next step is the proof of course provides these values again don't remove this minus one here and she provides these values together with the Merkel proof inside the Merkel tree where the root of which she sent earlier and the verify of course checks the the Merkel proofs and also checks that yeah basically this equation adds up when you in when you insert the values that the approver just provided in this model we just assumed that I mean this is still interactive so it is the model is much more powerful it's interactive and the verify has randomness yeah I don't have a slide for that because of reasons so I can talk about that now the way you remove both interaction randomness is similar and the reason is so if you take a close look then everything the verifier sends to the prover is actually just a random number so it's it's just I mean the the verifier could also just send this x prime and then check that the prover computed these things correctly so and it is also important that this random number is public so the the ver the prover can have access to the random number because the prover pre-committed to the root of the mercury so and if the prover first commits the root of the mercury and then gets a randomness then she cannot modify the mercury anymore and the way you remove both interaction randomness now is you so if it's not interactive then this means the prover just generates a single string a single message and then this is verified once on the blockchain for example and this means this message is basically everything that is sent to the prover as to the verifier so the the roots of the mercury's and then to get randomness you basically just evaluate a hash function on these two roots and take the randomness from there because this is the same thing so if the prover first sends the mercury roots and then receives the randomness she cannot modify the mercury any more and if the if the randomness just depends on the mercury then any modification the mercury will also change the randomness but in the beginning you said you just expect when you talk about the assumptions you just expect the collision resistance and now all of a sudden you expect the random orbital access from the hash function, right? Is this much more to ask from the hash function? You know at the beginning? Yeah, I know what you're talking about might be that I confused some terms here so but it's is it enough if the hash function is uniformly distributed? Yeah it might be that you need to assume stronger hash functions but usually this is what should suffice and just there was another question but let me just finish now we have this random number and then the the prover can just use that random number and continue and provide that stuff and then perform this check and now the verifier which and then this proof is complete we send it to the blockchain and the blockchain just reruns the steps of the verifier and that's how we remove both interaction questions it doesn't matter and it's actually not I mean these are finite fields so there's no really a concept of inside or outside or smaller and larger I mean that is but there is no danger of polynomials going away on the yeah it's a finite field so you don't get overflow problems or something like that so you don't get problem precision that's what you're asking me no I'm kind of asking since you're evaluating a polynomial and the value of the polynomial and I kind of is it possible for the polynomial for the interpolation function of the polynomial to go away to infinity on the edges of the board of the interval that you compute. No because the field is finite so the values of the polynomials polynomials are always elements of a finite field to be a mathematical thing without any means of variability or I can answer it as you said it's a finite field yeah another thing of using hash factor polynomials of course is that this thing gets put into this which is also important for various fields. Okay what is missing from here? Actually said it on the first slide yeah that we can stop it on top yes so we just said that the polynomial is approved that the polynomial is a small size so small three I guess. And why is that important? otherwise the the prover can just I mean the prover computes this a and creates a merkle tree of the values and these values can just be anything they don't have to be so just just from the merkle root you don't really see whether the values are the values of a polynomial and if they are not the values of a polynomial we lose this property that two different functions are different at almost all points. Okay so yeah that's the question the IOPP will solve that and yeah as I already said the prover can cheat unless A and D are polynomials of low degree and low degree in this case is 8000 and the interactive oracle proof of proximity will help us I will actually give a very simplified presentation of IOPP especially we will just ignore the proximity part in our simplified version we have a merkle tree of the values of a function and we want to prove that this function is a polynomial of degree at most D. We actually don't care which polynomial and that's also important that the prover doesn't have to prove that this is that this A is a certain polynomial she just needs to prove that is some polynomial and if we do it properly then we add if we add this proximity thing then we actually show that it's either a polynomial of degree at most D or it's far away from all polynomials of degree D and far away here means it differs at many points at many values but that's a little bit more complicated so we'll do the simpler thing and the main idea so we will also this will also be an interactive protocol because inside an interactive protocol we can invoke another interactive protocol as a subroutine and the main idea is divide and conquer here so we what we do is so we assume of course that F is a polynomial so it has it's a sum of coefficients times x to the power of k and we take these powers of k and regroup them into odd and even ones in the following way so we have our polynomial f of x and we state that it's equal to g of x square these are the even coefficients plus x time h of x square these are the odd coefficients and then g and h are again polynomials but the degree is d half now it's d half because the input is already x squared it's clear that that is possible so we just move all even coefficients to the left group them and interpret them as expressions in x square instead of x and move all odd to the right factor out one x and also interpret interpret them as coefficients in x square and what is also important that the domain size so that the domain is always a finite field and this is also half because we only have squares here okay and now what we do is again the prover commits to a mercury of all values of g and h and the verifier requests a random check that this equality actually holds we already have the proof already committed to all values of x she does the same for g and h and then we just evaluate this equality at a single point at a single random point and so we know that this actually holds with high probability and now we do the same thing recursively for g and h but now the degree is only d half and this recursion will terminate at some point where the degree is one at which point where the and at that point where it's zero and that point the verify I can just check that by looking at it exactly so the only randomness the verify request is just so the randomness doesn't depend on any previous messages that's also important it's just a random in a certain range any random number it's achieved in the same way exactly okay we're almost through so the exciting part the next talk it's not far away how do we add zero knowledge that is also simplified again because we ignore the fact that this this proximity thing what is your knowledge they have been so you can have a different talk about the whole concept of their knowledge a very simple explanation is that in such an interactive project all the prover convinces the verify about the fact that the computation is true without revealing anything else about the computation so in our specific example the verifier never learns these intermediate values in the computation of course the verifiers yeah it's a bit more since the verifier can actually compute these intermediate values this is not really true here so the actual concept is a bit more complex because you can add hidden inputs but yeah let's take a look at Sudoku for example there's an interactive protocol for Sudoku where I can prove to you that I know that this Sudoku is solvable without you actually learn learning the actual solution I can't do it now but because I don't know the solution but there is a protocol that does that so at the end you're convinced that it is solvable without knowing how to solve it okay and how does it work with Starks or actually so I we will only look at the zero-knowledge aspect of this IOPP and all of the Starks the full-stark zero-knowledge so again the task is to show that these two polynomials A and D are arbitrary low-degree polynomials I said that before it doesn't we don't want to know we don't want to convince the verify that they are have a specific they are specific polynomials it just suffices to show that they are arbitrary polynomials of a certain maximum degree and so if we say that P is the set of all polynomials of degree at most D then the following is true for any polynomial U in P so for any polynomial of degree at most D and any function F F is in P if and only if F plus U is in P the reason is so if F is a polynomial of degree at most D then adding a polynomial of degree at most D will not yield a polynomial with higher degree and if F plus U has degree at most D then you can subtract U and this will yield F and of course a polynomial with degree at most D minus a polynomial with degree at most D yields a polynomial with degree at most D good and we use that now to show how we can get an IOPP with zero-knowledge and yeah we will almost show that there's some tiny point that doesn't really work out the proof it chooses so we want to show that a is a polynomial with degree at most D and but what we do is instead the proof it uses randomness here and chooses a random polynomial with a degree at most D and adds it to a and then creates the mercury of values for a plus U and then both run the IOPP for a prime and the thing is now since U was chosen uniformly at random from P this a prime is actually just a random polynomial of degree at most D and the the verify I cannot reduce anything about a from that yeah so clear more or less and yeah it works because of this lemma here all right again something I forgot of course the proof I still has to convince the verifier that this equality here holds and this is the kind of small hole here in the zero-knowledge thing because for that we again have to evaluate them at random point and because of that the verifier learns at least a single point of a actually the verify also learns the root hash of the values of a but in the full star construction this so the reason why this doesn't matter in the full star construction is that it has a property that if you learn up to T bits of the proof for a certain small constant T you learn nothing about the the actual witness and this is because of that you can it actually is fine to evaluate this at one point this will not yield anything about the actual thing the proof is about okay I don't have any more slides are there questions So you bring up this part, you argue that there are less talked about than the snarx. But if you also do less talked about than the snarx, they give less attention than you make the angle. But do you think that they are more applicable to the theory than the snarx? Actually, it's the opposite. So snarx are already possible in a theorem because we have these precompiles. And also because the proofs are only 188 bytes, which fits easily into a transaction. And for snarx, we have proofs of size, I don't know, 500 kilobytes, which is way too large for a transaction. So I could think of a specialist blockchain that only has snarx, where 500 kilobytes is not that large, because we have one megabyte blocks in Bitcoin. But I don't think it's practical for Ethereum at the current point in time. Are there benefits to snarx? Yeah, the benefits of snarx are no trusted setup. They are quantum resistant. What else did I say? Yeah, quantum resistant, transparent. That means no trusted setup. That's about it, yeah. And also, they don't make any unproven assumptions. Crypto assumptions does not only mean not quantum resistant, but snarx assume this knowledge of exponent thingy, which might just turn out to be not true. It's a setup for the one-on-one's property and for the one-on-one's transaction setup. The question was, were the setup for the one-on-one's thing and the transparent is the same? Yes, it is the same. Yeah, yeah. So in snarx, there's an initial setup that generates a certain amount of data. And that data is then reused for every single transaction to verify every single transaction. Yep. Can you tell me your thoughts about the one-on-one? But they need a trusted setup. I know at least one-on-one scheme, but that's the one-on-one's properties. And everything else is the share-charm here. So it's going to be longer because you make many challenges, right? And do you think it's possible to have both to ever have a constant scheme that doesn't have a trusted setup? You're saying snarx are mainly longer because they have interaction and because of Fiat-Charmier and the Merkle proofs, the proofs are longer? Yeah. I mean, Eli Ben-Sasson is confident that that can be considerably improved. I don't have that much insight, so... I hope. Is there a combined arrangement of snarx and Ilemon? There are implementations on GitHub for the whole thing. I'm not sure what the actual input is, but they... It's not as... So snarx, for snarx, usually have to create arithmetic circuits and then compile them. And for snarx, they start with register machines. So they actually use computation traces. And the paper says that it is better to run on register machines than create arithmetic circuits because when you start with arithmetic circuits, you end up with polynomials of degree two. And this is important for snarx because they can only handle polynomials of degree two, but snarx can handle polynomials with higher degree. And if you start with computation traces, you get polynomials of degree eight. And because of that, it's more efficient than going through circuits. Yep. Just a little bit of curiosity. I heard that quantum computers are a little bit far away. I mean, I think they can be 50 qubits now in that universities. But once you decide for one of them, say, for snarx, and we get a quantum computer, then you change the snarx because then you're holding the computer and it breaks down, right? I'm not really up to date, but I doubt that they can handle 50 qubits. Right, so there might be, so there's, so in popular articles, they usually say quantum computers part, but actually there are two vastly different types of quantum computers. And one of them is adiabatic quantum computers. And they cannot break discrete logarithm. They can just do some optimization problems probably quite fast, but actually there's not a lot of theory about that. And I think those have 50 qubits, and the others I think might have 10 or something like that. And so the number of qubits you need is basically the key size. If you have a full quantum computer with a key size up to your private key, then you can recover that just from a public key. Whether you can switch from snarx to snarx, I mean, they are fundamentally different things, but if you build your system flexible enough, then of course you can switch. I mean, yeah. And I mean, if you start with a system like Ethereum, then you can have smart contracts and I can have both at the same time. If either the EVM is performant enough to implement starks or starks are improved as much as such that they can be run on the EVM. Okay, then sorry for boring you for an hour and thanks for your attention.