Protocol Description

[iAmMichaelConnor]

Tracking Issue.

This issue (and its sub-issues) is a WIP

We need to:

• Write up the parts of the protocol that we already know;
• Solve unknown parts of the protocol;
  • Write up the solutions, once solved.

See more guiding info here: https://github.com/AztecProtocol/aztec-packages/blob/master/yellow-paper/docs/intro.md

---

Task Lists

This Issue contains a task list of major sections.
Each of those will link to an issue with further sub-sections. Each tasklist (and sub tasklist) will have an 'assignee' who owns that section. That doesn't mean they have to write all the content, but they oversee that the content is being written :)

The layout of the paper will naturally change as we get into it. This is just an initial outline. Please feel free to make modifications to these tasklists (and their sub task lists) after consultation, if it helps you explain the protocol more easily.

Major Sections

Beta Give feedback

1. Overview
2. Cryptography
3. Protocol: Addresses & Keys #3084
   A-documentation A-protocol +2
   
4. Protocol: State #3087
   A-documentation A-protocol +2
   

   
5. Protocol: Transaction #3089
   A-documentation A-protocol +2
   
6. Protocol: Bytecode #3099
   A-documentation A-protocol +2
   
7. Protocol: Contract Deployment #3104
   A-documentation A-protocol +2
   
8. Protocol: Calls #3108
   A-documentation A-protocol +2
   
9. Protocol: Notes & Nullifiers #3105
   A-documentation A-protocol +2
   
10. Protocol: Logs #3106
    A-documentation A-protocol +2
    
11. Protocol: Private Message Delivery #3102
    A-documentation A-protocol +2
    
12. Protocol: Gas & Fees #3086
    A-documentation A-protocol +2
    
13. (Chaining Txs)
14. Protocol: EIP-4844 #3107
    A-documentation A-protocol +2
    
15. Protocol: Decentralisation #3110
    0 of 6
    A-documentation A-protocol +2
    
16. Block Finalisation
17. Protocol: Protocol Statements #3109
    15 of 17
    A-documentation A-protocol T-tracking +3
18. Acknowledgements
19. DA solution #3645
    A-documentation A-protocol +2
    

Here's a nested list (which might get rearranged, as we progress)

• Overview
• Constants?
• Cryptography [Dont do yet - Not a focus for Q4]
  • Fields & Curves
  • Hash functions
    • Properties of different hash functions / pseudo-random functions
    • Pedersen
    • Poseidon
    • Blake
    • Sha256
    • Domain separation
  • zk-SNARKs
    • (Don't open this can of worms yet... this is for the crypto team to do, one day)
  • The Data Bus
    • This probably should be explained now, because it'll be used a lot in the 'Protocol Statements' section, below.
• Addresses & Keys
  • Requirements
  • Addresses
    • Still undecided whether this should be a hash or a public key. A public key is nice for EoAs.
    • Embedding Bytecode
    • Updating Bytecode
    • Stealth/Diversified address derivation different from master address derivation?
  • Keys
    • Master keys
    • App-siloed keys
      • Security assumptions of each key
        • I.e. Which software/hardware is allowed to see each secret?
        • Example flows, to validate (and illustrate usage of) the keys.
      • BIP32
        • Normal key derivation
        • Hardened key derivation
        • Deviations from BIP32
    • Stealth keys vs Diversified keys
    • Updating keys
• State
  • L2 State
    • Trees
      • Note Hash Tree
      • Indexed merkle trees
      • Nullifier tree(s)
      • Public Data Tree
      • Slow Updates Tree (if enshrined) [Lasse]
      • Contract Tree (if still around)
      • Transactions / Receipts Trees?
      • Block hashes tree
      • Tree Epochs
  • L1 State [Lasse]
  • Contract State
  • State Hash
    • Explain the structure of the preimage of the state hash
• Transaction
  • Tx request data
  • Tx Nonce
  • Tx Hash
• Bytecode
  • ACIR
  • Brillig
  • VM Opcodes
• Contract Deployment
  • Computing a contract address
  • Nullifying a contract address
  • Broadcasting Bytecode (under various scenarios) and other contract info
  • Committing to VM bytecode
• Calls
  • Private function call
  • Public function call
  • Enqueued public function call
  • Delegatecall (if decided)
  • Staticcall (if decided)
  • Protocol Function Call (if decided)
  • Inter-layer messaging
    • L1->L2 messaging
    • L2->L1 messaging
    • Public->Private messaging
• Notes & Nullifiers
  • Custom Notes?
    • Standardised Encoding of Encrypted Logs?
  • Custom Nullifiers?
  • Siloing
  • Uniqueness
• Logs
  • Unencrypted
  • Encrypted
  • Optimisation considerations
    • Logs submitted on-chain need to be sha256-hashed/blob-committed somewhere. In which circuit should this happen? Should each circuit enable n log fields, instead of 1, and forward those log fields via the Bus?
• Private Message Delivery
  • To constrain or not to constrain?
  • Constrain in apps or in account contracts?
  • Encryption & decryption
    • This might already be covered in 'keys' above.
    • Which encryption scheme(s)?
    • Types of message
      • Initial Handshakes
      • Incoming messages
      • Internal incoming messages
      • Outgoing messages
    • Algorithms
      • Encryption & decryption algorithms, for each type of message (incoming/outgoing/etc).
  • Note Discovery
    • Abstracting note identification to a 'tag' of bytes
    • etc.
• Gas & Fees
  • Gas Metering
    • Categories of 'things' that contribute to compute effort
    • Benchmarking compute effort
    • Measuring 'gas used' at the protocol level
  • Fees
    • L2 fees vs L1 fees
    • What currency is gas measured in / fee abstraction?
    • Paying fees, and receiving rebates
    • Paying fees privately
    • Etc.\
• Chaining Transactions
• EIP-4844
• Decentralisation
  • P2P network
    • Data that is sent between parties
      • Users to the tx pool
      • Sequencers to provers (and back)
      • Sequencers to L1
  • Sequencer selection protocol
  • Prover selection protocol
  • Upgrading the protocol
  • Training Wheels
  • Economics
• Block Finalisation
• Protocol Statements
  • Describe the logic of the protocol.
  • Describe the assertions that must be in place.
    • The constraints (assertions) of the system are spread across many circuits and L1 contracts, but they should be described as a whole, in one place. Where the assertions are located (i.e. in which circuit/contract) is a matter of optimisation, which might change over time. This can then serve as a checklist, to ensure those assertions are included in at least one of the circuits/contracts.
    • In particular, exhaustively explain what shouldn't be possible.
  • Sub-protocols
    • It might help to describe certain sub-protocols, which need to be sound in their own right.
    • E.g.:
      • Contract Deployment
      • (Account abstraction)
      • A private function call
        • Nested private function calls
      • A public function call
        • Nested public function calls
      • Private -> Public function calls
      • Enqueueing many public function calls
      • Private -> Internal Public function calls
      • Side-effect ordering
      • Note/Nullifier squashing optimisations
      • Upgrading contract bytecode
      • Upgrading keys
      • Gas metering
      • Fee payments
      • Sequencer Selection
      • Prover Selection
      • Initiating an upgrade
  • Circuits
    • For each: Explain / justify the requirements. Describe the Public Inputs ABI & the Bus ABI. Explain the statements logic and assertions.
    • High-level topology [David/Leila?]
    • Private Circuits [David/Leila?]
      • General features a private circuit must adhere-to.
      • Why not a private VM?
    • Public VM Cicuit [David] <-- big section
    • Kernel Circuits
      • Private [David/Leila?]
        • Initial Private Kernel Circuit
        • Inner Private Kernel Circuit
        • Ordering Private Kernel Circuit
      • Public [David/Leila?]
        • Initial Public Kernel Circuit
        • Inner Public Kernel Circuit
        • (Ordering Public Kernel Circuit???)
      • Future Kernel Optimisations
        • Delegating chunks of compute to 'gadget' circuits
        • A Merkle Tree of Private Kernel iterations
    • Rollup Circuits [Lasse/Leila?]
      • Base Rollup Circuit
      • Merge Rollup Circuit
      • Root Rollup Circuit
    • Squisher Circuits [???]
      • Honk -> UltraPlonk
      • UltraPlonk -> Standard Plonk / Fflonk
    • Circuits for sequencer/prover selection? [Palla]
    • EIP-4844 circuit [???]
    • Bytecode commitment circuit [???]
  • Smart Contracts [Lasse]
    • ...
• Acknowledgements