Sean Bowe：用遞迴證明擴大 Zcash 隱私交易量
Scaling Zcash
- Sean Bowe Tachyon
影片
影片與逐字稿來源：Network State Podcast （CC BY）
場次摘要
Tachyon 執行董事 Sean Bowe 介紹團隊如何以遞迴證明擴充 Zcash 的隱私交易容量。這項技術可合併交易所需的證明，減少區塊空間與驗證節點的狀態負擔。他估計，在近期規劃的區塊大小下，至少可達每秒約 150 筆交易；團隊仍在進行驗證與審計。
值得記下的 5 件事
- Tachyon 團隊專注移除 Zcash 隱私支付的密碼學擴充瓶頸。
- 遞迴證明可以把區塊中的交易證明合併成約 17 KB 的單一證明。
- 現有或近期規劃的區塊大小，目標至少支援每秒約 150 筆交易。
- 遞迴證明可以限制驗證節點的狀態膨脹，降低隱私交易的長期擴充成本。
- 形式化驗證與安全審計仍是部署前的工作，測試進度不能直接當成正式上線。
逐字稿
開場
我是 Sean Bowe，Tachyon 執行長。大約一年前我在新加坡，宣布要招募一支密碼工程團隊，做 Zcash 密碼學的下一迭代，我們做到了。我們從 Celestia、Penumbra、Espresso 等處招到很棒的工程師，過去一年左右幾乎都在做一件事：擴展 Zcash。So I'm Sean Bowe. I'm the executive director of Tachyon, and I was here about a year ago in Singapore, and we announced that we were going to hire for a team of cryptographic engineers to work on sort of the next iteration of Zcash's cryptography, and we did. We hired these fantastic engineers from, like, Celestia and Penumbra and Espresso, and we've been working really hard for the last year or so on essentially scaling Zcash.
我們處理協議裡私有支付核心的密碼學，把內部的密碼瓶頸全部拿掉。如果要簡短描述，我們基本上是在 Zcash 既有的 SNARK 上，加上所謂的遞迴證明（recursive proof）。We're taking the cryptography that's at the core of the private payments that take place in our protocol, and we're removing all the cryptographic bottlenecks that are on the inside. So. If I had to really describe what we're doing kind of briefly, it's that we're basically taking SNARKs, which are these things that we have inside of Zcash, and we're adding something called a recursive proof to them.
這東西很酷，我簡短說明。舉個例子：現在在 Zcash 發私有支付，一筆交易裡往往有多件事同時發生。And these are really cool. I can explain real briefly. So one example of this, just sort of an illustration, is that. You can basically—so right now in Zcash, when you send private payments, invariably you're going to have multiple different things happening inside your transaction.
所以放進去的證明相當大，一般支付平均約 7KB，有時還會因一些無關緊要的隨機因素更大。在我們的設計裡，因為用遞迴證明，這些證明是在證明「其他證明已正確驗證」，這就是核心運作方式。And so the proofs that you put inside them are quite large. They're like seven kilobytes on average for like a standard payment. And sometimes they're a little bit larger because of— random reasons that aren't that interesting. Inside of our thing, because we use recursive proofs, these proofs prove that other proofs have validated properly, and that's sort of the essence of how they work.
遞迴證明一路到底
所以是證明一路到底。證明可以證明其他同類證明，層層下去，你能用這做出各種瘋狂應用。簡單例子是：在 Tachyon 裡你建交易，大小不會隨邊際增加。So it's like proofs all the way down. The proofs can prove other instances of themselves, and so on and so on. And you can build all sorts of crazy applications with this. And one simple example is just this. So in Tachyon, when you create a transaction, it actually doesn't have a marginal increase in the size of the transaction.
在我們的具體設計裡，它不會比 Orchard 現在做的大。同一原理可以套在區塊裡多筆交易：礦工把所有交易裡的證明（或叫 stamp）抽出來，聚合成一個約 17KB 的證明。So it actually, in our specific design, it's not any larger than what we do in Orchard already. So we can do the same principle with multiple transactions in a block. So a miner will take all the transactions and take all the proofs out, or these things called stamps, and combine them together into one proof, an aggregate that's about 17 kilobytes in size.
我們可以在區塊裡塞進盡可能多交易；以現有或不到一個月後的區塊大小，至少約 150 TPS。真正目標是開啟漸近式改善。我們也能用類似或不同方式、但同樣的遞迴證明技術，處理現在驗證節點上交易造成的狀態成長。And we can shove as many transactions as possible into the block, actually with the current block size or the block size that we're going to have in less than a month. You should be able to at least do about 150 TPS with that. But the real goal is just to enable the sort of asymptotic improvement here. Now we can do something similar, or something totally different actually, but using similar technology, using these recursive proofs, where right now we have this state increase in our transaction, in our, like, our validators on our network.
我們可以壓低這部分，讓客戶端負責用遞迴證明證明鏈上不存在某些物件，從而證明沒有雙花。And we can actually reduce this and make it so that all of the clients are responsible for proving that these objects haven't existed on the chain in order to prove that we haven't double-spent, using the same recursive proofs.
解除狀態成長瓶頸
結果是實際狀態成長有上限。這只是遞迴證明能做的事之一；這兩項基本上拿掉 Zcash 屏蔽交易裡那些不理想的漸近成本。And as a result, there's a cap on the actual state growth. So. This is just another example of what we can do with the recursive proofs. And this actually, these two sort of remove all the asymptotic costs, like the unfortunate asymptotic costs, to shielded transactions in Zcash.
快速講我們的建構（這是我們要發的標準提案）：運作方式其實比現行 Zcash 簡單不少，時間不夠細講，但底下這個 stamp 會從所有交易裡拿掉。So just real quick, like, basically inside of our construction—this is a standards proposal that we're posting. For how these things work, they're actually quite a bit simpler than how they work in Zcash today. I don't really have that much time to go into them, but this thing on the bottom, the stamp, is the thing that actually gets removed from all the transactions.
交易只剩上面這些資料，很酷的是你可以得到完全屏蔽、超私密的 Zcash 交易，只需要上面這些。So you're only left with this stuff in the top, and it's actually really cool that you get a fully shielded transaction, like a super private transaction in Zcash, and you only need this stuff on the top.
其實相當小。我們也簡化了協議運作：鏈上有新東西時，不再像現行 Zcash 那樣維護大型 Merkle 樹，而是加進叫 anchor chain 的雜湊鏈。It's actually quite small. So we also simplified the way the protocol works. So whenever there are new things happening in the chain, instead of having this big Merkle tree like we have in Zcash today, we actually just add it to a hash chain called the anchor chain.
使用者基本上要證明：自資金創建以來，還沒花掉。做法是遞迴證明，取得 certificate。新交易上鏈後，不同節點用遞迴證明處理整條鏈，結果放進 bucket，And so the user is basically trying to prove that they haven't spent their money in the time since their money was created. And so the way that they do that, they do that with the recursive proofs. They get these certificates. So after new transactions are accepted on-chain, the entire chain is processed by different nodes using recursive proofs, and these things are put into buckets, and
規格測試網與上線
bucket 再變成可用來證明「未包含在鏈上」的 certificate。接下來幾個月，完整規格已經寫完，遞迴證明也完成，內部測試網在跑、尚未公開，但月底前會放出。these buckets are turned into certificates that can be used for proving non-inclusion in the chain. So, over the next few months, we have a specification for everything. That's done now. We have the recursive proofs that are finished. We have a testnet that's running that we haven't put out publicly yet, but we're going to be doing that by the end of the month.
我們會做正式驗證；今年夏天也為 Zooko 剛提到的 Ironwood 另一協議做過一批。接下來並行、積極審計、改善效能並排程，好把這些推進 Zcash。We're going to be doing formal verification. We did a bunch of that over the summer for another protocol for Ironwood that Zooko was talking about just now. And then we're kind of parallelizing and sort of really aggressively auditing and optimizing and scheduling everything so that we can get this stuff shipped into Zcash.
我沒有 thank-you 投影片，但……就這樣，謝謝。So I don't have a thank-you slide, but... There you go. Thanks.
