Episode 290: Exploring, Teaching and Auditing ZK with David Wong
Aug 30, 2023
auto_awesome
David Wong, author of Real-World Cryptography book and cofounder of zksecurity.xyz, discusses his interest in cryptography, auditing techniques, common bugs in ZK code, and his work on Facebook crypto project and Mina project.
David Wong discusses his background in math and his journey into cryptography, including his work at Facebook and contributions to the Mina protocol.
zksecurity.xyz, a zk auditing firm, aims to enhance security in the zk space through effective auditing techniques and continuous research.
The advancements in folding protocols may make Starks obsolete in the future, highlighting the importance of structured hash functions in cryptography.
Deep dives
Background in Math and Interest in Cryptography
David Wong, author of the Real World Cryptography Book and co-founder of zksecurity.xyz, discusses his background in math and how he became interested in cryptography. He shares his experience working as a security consultant, his time at Facebook and O of One Labs, and his contribution to the Mina protocol.
The Launch of zksecurity.xyz and Security in the zk Space
David Wong talks about the establishment of zksecurity.xyz, a zk auditing firm, and their goals. He delves into the topic of security in the zk space, covering auditing techniques, potential directions for the industry, and areas of research that excite him.
Writing Real World Cryptography Book and Importance of Cryptographic Education
David Wong shares his experience writing the Real World Cryptography Book and the motivation behind it. He discusses the importance of understanding cryptographic concepts and the role the book plays in providing accessible and practical knowledge in cryptography, including a chapter on cryptocurrencies.
Folding Protocols and the Future of Starks
David discusses his fascination with folding protocols like Protosar and Protodolaxy, as well as the advancements being made in that area. He speculates that these advancements may eventually make Starks obsolete due to the limitations of using hash functions. While he acknowledges that there is still interesting work to be done in this field, he believes that the future lies in hash functions that are more structured than SHA256. However, he emphasizes that this doesn't diminish the value of projects currently using Starks, but rather highlights the ongoing progress and breakthroughs in the field.
Ethical Dilemmas in Security Research
David reflects on the ethical challenges in security research and the disclosure of vulnerabilities. He discusses the responsibility researchers have in balancing the need to find and report bugs with the potential risks of exploitation. He also highlights the difficulties in effectively communicating and warning all affected parties, citing examples like the Zcash bug and the challenges faced by auditors when vulnerabilities are found in widely used libraries. David acknowledges the complexity of the ethics surrounding security research while emphasizing the importance of manual auditing and responsible disclosure.
They chat about what first got him interested in cryptography, his early work as a security consultant, his work on the Facebook crypto project and the Mina project, zksecurity.xyz, auditing techniques and their efficacy in a ZK context, what common bugs are found in ZK code, and much more.