Liming is a small village nestled in the foothills of Yunnan, a province in southwestern China. It has one main street, its main economic activity is farming, and it lies three hours from the nearest airport in Lijiang. It has a really charming sleepy-town feel to it, except for on market days when it turns into a bustling trade center.

Julie, Marty, and I made plans to visit Liming over Thanksgiving break, when the weather would be perfect for some crisp fall climbing. Julie and I brushed up on our rusty Chinese, downloaded the guide book on Rakkup, and got excited for a grand adventure!

To paint a full picture of our trip, I’m including our “trip report” emails, which we sent to our friends and family at the end of each day. They were hastily written in the evening before going to bed, so they contain typos and some shorthand. But they hopefully also capture the raw experience of each day, minimally filtered and maximally stoked. Afterwards, I’ll also include some tips for if you want to plan your own climbing trip to Liming!

Day 1: Getting to Liming

We spent about 30 hours in transit to get from SF to Liming:

• San Francisco to Los Angeles (1.5 hour flight)
• Los Angeles to Guangzhou (16 hour flight). Our layover in Guangzhou was super tight, so we actually had a dedicated transfer escort lady who helped us cut all the customs/security lines and get a speedy airport cart to take us to our next gate. We made it just in the nick of time… But our luggage didn’t :o (more on that later).
• Guangzhou to Lijiang (3.5 hour flight)
• Lijiang to Liming (3 hour car ride) — we had a friendly chatty driver who told us about the local culture, agriculture, food, and everything in between.

Here are some photo highlights:

Marty’s proudest moment: in Lijiang, he bought snacks ALL BY HIMSELF while Julie and I went to the bathroom! They were really good snacks, we hounded them on the 3 hour drive to Liming.

Scenic rest stop on the drive from Lijiang to Liming, for our driver to take a smoke break. The car ran on natural gas, which was neat! We even got to watch the refueling process for the natural gas — there’s good infrastructure for it. Even some of the giant trucks run on supercooled natural gas!

We made it to Liming and got a scrumptious meal of veggies from the restaurant owner’s garden (there are a lot of cute little family plots in backyards): eggplant, beans and tofu, and bitter melon! Despite me telling them that Julie and Marty are vegetarian, they still sprinkled some dishes with meat chunks… I guess they don’t think of it as meat, just a garnish. :P

This is the view of the climbing, from the roof deck of the Faraway Inn which is where we’re staying! It’s gorgeous! The big formation on the right is called Dinner Wall and was one of the first areas to get developed for climbing. There’s also a really nice creek that runs through town, right under our windows at the Faraway Inn (I’m listening to it burble right now, it’s so peaceful!)

We couldn’t climb because all our climbing gear was in our luggage, but we went for a hike up a really well built stair system and found this crazy looking via ferrata! Check out those mega sketchy planks in place for the traverse right and back again… (shudder)

We went back down the staircase as the sun was setting, and saw some really gorgeous colors on the rock! Look how sturdy and beefy those stairs are — such good infrastructure. We all got pretty winded on the hike up — between the elevation, lack of sleep, and the fact that the stairs were never-ending, we had an uphill battle.

The conclusion to the luggage saga is that our checked in luggage had to catch the following flight from Guangzhou to Lijiang, which was later in the afternoon. The airline then sent a guy to drive it all the way out (3 hours drive) to Liming, and I wrote this update as I was waiting for him to arrive. He got here at 8pm sharp as planned, and I just picked the luggage up from him, so now it’s finally time for bed! The beds at Faraway Inn have little blanket heaters which are so cozy, we’re going to sleep so well!

Lots of love,
Cathie obo Julie and Marty

Day 2: Crag Classics at Lisu

We had a great day cragging at the Lisu area, which was the wall we looked at yesterday on the way up the staircase. A shorter update today since I’m going to bed soon, in preparation for a big day tomorrow!

We woke up bright and early after 12 glorious hours of sleep. The blanket warmers were so nice and toasty, and we slept so well. We got a breakfast of savory rice noodles, buns, and tomato-and-egg at the shop down the street, next to some young kids who were also wolfing down breakfast before school.

Cathie and Marty jumping for joy on our way to the crag. That’s Dinner Wall in the background, where we plan to climb tomorrow!

Julie got on “Faraway Corner” on a fixed rope / microtrax system, to feel out the moves before leading it. This was such a beautiful splitter finger crack layback! In general, the climbs have been really high quality, well bolted, and clean.

We made friends with some friendly crag dogs! No matter the country, some things never change.

Julie got on “Clam Digger” after me, this crazy whole body chimney with a hand crack in the back. Sorry for the lighting contrast, you can barely see her, but know that she was trying hard and making many noises :)

Marty had an EXTREMELY PROUD moment today too — Julie and I struggled so hard with the first few moves on this route, barn-dooring out or slipping off repeatedly, trying all kinds of crazy beta, until we both gave up and cheated a bit through the start. Then Marty hopped on it and got it first go, no takes, looking very casual! We cheered wildly :)

We found a karaoke bar. Unfortunately the songs and lyrics are all in Chinese, so there was no hope for us.

We’re going to get on “Soul’s Awakening” tomorrow, it’s a 4 pitch 5.10 and was actually the first route set in Liming, it’s a classic! Zzz for now

- Cathie obo Julie and Marty

Julie/Marty postscript

The painted wall behind us rose in its technicolor glory! The approach was up these tall stairs that we had taken yesterday, tho the last part involved some bushwhacking. You can fly halfway across the world to climb, but you’ll still somehow end up off trail tramping through the forest :).

Marty cruising (on lead!) up the first climb of the trip, a 5.9 layback jam.

The clam digger! A mega classic pitch that we reworked the lyrics to “she’s a man-eater” to. (She’s a clammmm digger make you dig hard make you pry hard make you want all of her clams.) Cathie couldn’t decide whether she wanted left or right side in but eventually said eh I’ll do both! Here she is switching sides!

Marty loved this little tree, and wanted to make sure everyone saw it.

At the end of the day we’d go load up on snacks for the next day. Cathie found the cutest little kittie in one of the corner stores. We have returned every night since to find this kitty for Cathie to cuddle.

Yayay hope you’re enjoying the Julie/Marty postscripts!

Day 3: “the 3 best sandstone pitches I’ve climbed in my entire life”

Today we climbed at Cretaceous Crag on Dinner Wall, the one that’s right above the climbers’ inn, which you can see in this photo I took at sunrise from the roof deck of the inn:

We got a really early start (7am breakfast, 8am departure) because we wanted to climb Soul’s Awakening, a mega classic 4 pitch climb which was actually the first route to get developed in Liming! We got there after a pleasant schlepp up the hill, and had an absolute blast. Some sections of the wall had a neat “honeycomb” texture, which was super interesting to climb on. Here’s Marty following up pitch 3!

Marty stopped at the top of pitch 3, and Julie and I climbed to the top of pitch 4, which had this absolutely crazy beautiful view of the valley under an arch:

We then rappelled, ran into some local climbers and hung out with them while eating lunch and watching a local goatherd herd his goats past us (Julie fed a goat her apple core and got some goat nibbles!) We learned from the local climbers that this Thursday through weekend will be a climbing community event at Liming, where people will come from all over to do crag development and outreach and teaching. Super cool, and I’m excited to overlap with that event for two days!

Next up, we went to Wind of the Valley, a long 30m ultra classic route which Julie climbed as a lieback, but Marty and I climbed with straight in jamming. The tree at the halfway point was so nice for a rest!

We set up a toprope for the local climbers, who wanted to try it but didn’t have any gear. They were very grateful and stoked.

Next up was The Firewall / Flying Buttress, which was a terrible 5.6 “jungle chimney” pitch, followed by the most beautiful epic 5.11 hand crack ever. Julie led the 5.11 with a few rests, I toproped it, then Julie toproped it clean!!! What a beast :) here’s a view of the 5.11 pitch from its base, it’s such a beautiful continuous crack with cool movement. Notice the interesting honeycomb texture to the right as well, and the crazy jungle vines on the right wall!

After coming down, Julie declared that today, she climbed the 3 best sandstone pitches she’s ever climbed in her entire life! The rock quality here is truly phenomenal, and it’s crazy how beautiful and varied and crisp the cracks are. By the end of the day, we were wiped and happy and ready for dinner!

For dinner we went to a place that served 炸锅菜, a soupy leafy green filled hot pot which hit the spot! (For less than $3 a person):

Now we are warm and cozy in bed and ready to hit the sack in preparation for another day of climbing tomorrow — we’re eyeing a single pitch crag at the “Yangshuo Sport Climbers’ Crag” (jokingly called that because there’s no approach, like in Yangshuo). Marty and I were hoping for a rest day tomorrow, but no luck there ;)

❤ Cathie obo Julie and Marty

Julie/Marty postscript

Here’s our super tasty noodle breakfast, Marty has been on the hunt for egg like noodles which we finally got at the one restaurant open at 7am. The lady that runs the restaurant there is definitely hustling. I went big on the hot pepper oil.

Here’s Marty rapping the absolutely beautiful fourth pitch of Soul’s Awakening. Cathie was desperately grunting in the bird poop covered offwidth up above and for some reason Marty said nah I’m good and headed down. Men, can’t understand them.

THIS IS MY NEW GOAT FRIEND! She ate an apple core out of my hand and then tested my fingers with a couple nibbles to see if I too was an apple.

Here’s Cathie starting up the jungle vine pitch. So brave. So strong. We found a great little tree bench to belay from!

The last pitch of the day (Flying Buttress) was quite possibly the best sandstone pitch I’ve ever climbed, as Cathie alluded to. I was worked by the end, but this little message refilled my resolve to try again.

A beautiful evening settling into the valley :)

Greg postscript

After receiving our email update, Greg made this beautiful watercolor sketch of Julie leading Wind of the Valley!

Day 4: “rest day”

For our “rest day” today, we went to the “Yangshuo Sport Climbers’ Crag” which was a bit further up the canyon from the last two days, so we hitched a ride with the innkeeper. This area mostly had single pitch cragging, with a very short approach, which was part of the appeal (after the last two days of somewhat hefty approaches).

Here’s the approach from the road — the crag is so close! Most importantly, check out all the melons by the wayside — so many juicy melons! We kind of walked through a farmer’s field to get to the crag, including ducking through some bean vines. It reminded Marty of the scene in Lord of the Rings where the hobbits steal food from the farmer’s garden, only to get chased out by the dog. No dog came to chase us though :)

We started out on uncensored wall, which was a crazy area with a ton of roofs. This route had three roofs you have to pull to get to the anchor! The last roof was the most wild, you could do a sinker heel hook above your head (I actually got two heel hooks). Here’s Marty toproping it:

And here’s a zoom-in of Julie pulling the roof, from a different vantage point (notice how her left leg is basically entirely in the crack — yes the crack was that deep, and it felt really secure once you got your foot/leg in there!)

Next up, we went to censored wall, where Julie got really worked on a 5.11c and then I set up a really cool undercling/layback offwidth crack. Unfortunately I didn’t get any good photos of either of those routes, but here’s a photo of an extremely tired Julie laying down after she got down from her 5.11c lead, happy to be back on the ground, with Marty coming over to give her a hug:

Maybe you have noticed that we’re not actually doing a lot of resting, for a “rest day”? Interesting observation… Because Julie kept saying that it was our rest day (and so, we should climb tomorrow) whereas Marty and I were a bit dubious of the “rest day” label and contend that today was actually a climbing day and therefore tomorrow should be a rest day…

For lunch, we had our breakfast lady make us some boiled eggs to go (Julie tried to say “hard boiled eggs” but the lady didn’t understand her, so I just said “boiled eggs” which she understood, so we ended up getting soft boiled eggs, some of which exploded during the hike in, getting egg yolk everywhere). The egg yolks were the most orange yolks I’ve ever seen, they were from the breakfast lady’s chickens! Julie snapped a photo of the delicious runny soft boiled egg yolks, maybe she can attach that photo… I think those were the tastiest soft boiled eggs I’ve ever had!

We walked back from the crag, and passed by the elementary school which is the joint elementary school for several villages in the area. A lot of the kids ran over to say hi to Marty, he was a local celebrity. Here’s the elementary school entrance, with the most beautiful cliffs as a backdrop:

This is the climbers’ inn’s dog, the sweetest little puppy who follows you around and asks for pets. We gave her a belly rub and then she got the zoomies and ran around the inn like a crazy dog for a few minutes. She’s so precious!

For dinner, we went to the “pine snack lodge”, which specializes in fish dishes (or so we presume, since they keep a big bucket of fish out front). When we walked by, they had a bucket with three big fish swimming around:

We ordered a mala fish… and then there were only two fish left in the bucket :( This guy was delicious though, the mala spices were so tasty and pungent. We thanked him for giving his life to feed us, and then ate him clean to the bone.

We got some snacks (including some crazy grape-and-peach flavored Oreos… Yes you read that right) and watched Asteroid City while eating snacks in bed (no parents no rules!!!) Now off to sleep (maybe with some crumbs in the sheets, hmm).

❤ Cathie obo Julie and Marty

Julie/Marty postscript

Hello Julie and Marty reporting in,

Cathie has been so good about these journal updates! I am just here to say that today was such a great rest day wow! We rested so hard and are feeling so well rested and ready to climb so much more tomorrow wow!

Here’s the world’s most orange yolk. We were crouched in the shade peeling eggshells and licking our hands clean of yolk, we have truly returned to our primitive ways.

Here’s Cathie absolutely crushing her lead! She first tried to do some crazy offwidth jamming shenanigans in the roof, then realized she could layback it!

Also re: dog at inn, she is the cutest dog ever, she stands by the door for when you return to get all the head scratches and belly rubs.

Day 5: a REAL rest day!!!

Hi friends and family! I’m writing from the other side of an amazing real rest day, it’s been so good to kick back for a day.

The reason we picked today as our rest day was because today was market day in Liming — it happens on the 1st, 11th, and 21st of every month so we just got lucky that we overlapped with it! Merchants from many towns over all congregate in Liming for market day, and we were told we couldn’t miss it.

We started out our day with some fresh baked bread from the innkeeper, then headed over to the market. It was a bit slow and sleepy at first, with many merchants still setting up their stalls, so we walked to the end of the road and wandered around the “official tourist center” until the market got more lively.

We got some 凉粉 (liangfen: fried bean cakes, with spicy oil and lots of toppings) and then some sugar cane for “dessert” — this lady peeled and chopped an entire sugar cane for us to munch on! It was such a sweet treat, but maybe too sweet. We couldn’t finish the whole sugar cane, even after sharing some with climbing friends from the youth hostel.

Some more scenes from the market — look at this amazing backdrop to the market tents!

Marty found this extremely good “North Faec” and Louis Vuitton branded vest. For some reason, Julie said he shouldn’t get it, I’m still confused why you wouldn’t buy this amazing piece of clothing.

There was a guy making these weird extruded baked goods, from a gas powered engine running in the back of his van. We got a bag of these and they were really tasty, like little sweet wheat crisps!

There were so many more market finds, but in the interest of time I’ll go to what we did next — we hiked up the same stairs we went on our first day, and climbed the via ferratas! There were two routes, and they were so cool (and very well maintained and safe!)

Here’s Julie on a wooden board traverse — you can see the route continuing above her. Don’t worry, she’s clipped into the steel cable with two leashes, so her life does not depend on the wooden plank. It still felt spooky to cross the plank though.

Here’s Julie and Marty on a really wobbly suspension bridge. Julie thought about shaking the bridge for Marty but didn’t, and was very grateful when it was her turn to cross the bridge and Marty didn’t shake the bridge for her.

We made it to the top, with this huge platform and amazing view!

We then took the stairs down, which brought us through this crazy huge cave:

We made many echo noises, watched the sparrows fly around, and then took the stairs down back to Liming.

We had hot pot again for dinner, supplemented with some beer, because it’s a rest day :) then we hung around the campfire at the youth hostel chatting with some of the climbers who are here for the “climbing community event”, and shared our impressions of Liming with the group (Julie and Cathie even did this in Chinese! Mostly.) Now we are cozy in bed, ready for an early start tomorrow!

❤ Cathie obo Julie and Marty

Day 6: last full day in Liming!

Today was our last full day together in Liming! Julie and Marty are leaving tomorrow at 1pm to meet Julie’s parents in Lijiang, and I’m leaving the morning of the following day to meet my family in Shanghai. We spent our day climbing some classics in the Lisu area (up the huge staircase), and only climbed 5 star routes all day!

I don’t have that many photos from today, I think I took fewer photos because it was really cold (it didn’t help that we were climbing in the shade) and I was all bundled up. So I’ll just list / describe our routes:

• the great owl: 5.9 beautiful continuous hand crack! You know you’re in for a good time when the rack calls for 3 #1s and #2s! Marty lead this, which was no trivial task (there was a tricky start with a slightly flared thin hands crack).
• boy with a coin: a 5.10+ offwidth, with an absolutely glorious overhanging offwidth roof finish where you could stem while doing butterfly stacks, and you can look through the crack all the way to the sky on the other side! This was my favorite pitch of the day.
• gore: 5.10+ layback, which Julie led like a beast. The layback was overhanging and very powerful, this route was short and sweet.
• the reckoning: 5.12 route with a little bit of everything: chimney, offwidth, hand jams, finger crack, and layback. With some optional stemming, too. Julie led this and Marty and I toproped it, it was really neat movement! Julie and Marty somehow utilized a helmet jam at the chimney section.
• the lost world: 5.11, we climbed the first two pitches. The first pitch was really good for the first half (more offwidth!) but got dirtier the higher I went. Julie led the second pitch which was somehow even dirtier. After the second pitch, we decided it was too dirty to climb, and that we should rappel. (And we decided that this was definitely NOT an ultra classic five star route, despite what the guide book claimed.) But at the top of the second pitch (60m off the ground), we found some holes that were chiseled into the rock by the native Lisu people ~80 years ago! It’s wild to imagine them climbing that route without modern climbing equipment or ropes or anything!

Here’s Julie being sad we decided to rappel… If you look carefully on the right wall, you can see some holes in the rock! A historical relic!

Here’s one of the holes, up close!

I also saw this absolutely beautiful crack from the trail, and used my 5x zoom to get this photo to look more closely. After some homework, I figured out that it’s the third pitch of “the black hole”, and goes at 5.13 :o

We puttered around town, grabbed dinner, and are turning in now. It’s nice that we have found a good rhythm to our climbing days, but I feel like just as we are getting into the swing of things, our trip is ending already! So soon!

❤ Cathie obo Julie and Marty

Julie/Marty postscript

Marty housing some eggs and mantou

Marty having SO MUCH FUN on CLEAN SPLITTER ROCK

The adorable Faraway Inn where we’re staying at night!

Day 7: Goodbye Liming!

This trip has gone by too fast, but at the same time my body is pretty rekt and ready to lie down (and just eat good Chinese food) for a few days. Today was our last day in Liming! Julie and Marty and I went for a hike in the morning, and Julie and Marty headed out to Lijiang at 1pm while I stayed around the rest of the day — I’ll leave for Lijiang tomorrow morning.

We hiked to the diamond, the huge cliff face in the background! The guidebook called the approach a “gentle stroll” but I respectfully disagree, it was closer to a steep goat-path-following bushwhack where we all got covered in multiple different kinds of burrs.

We made it up eventually though, and had lunch on this amazing outcrop with a majestic view of the whole valley — there are so many cliffs here, and it was also cool seeing the terraced farms from above.

This is what the diamond looks like up close — very sheer and blank! There are some cool huecos at the bottom though. We didn’t climb today because of time constraints (Julie and Marty had to catch their ride at 1pm) so we just gazed at the rock.

Julie and Marty headed out with our driver homie, 和丽珍 (more on her later!) and we said our goodbyes. I then met up with the folks who were part of the climbing volunteer event, today was their rest day so they were making rugs out of old climbing rope. I helped the girl in the foreground with the blue rope rug, it turned out really well! (It was my first time making a woven rope rug).

I also donated some glue in bolts to the volunteer organization, to help with development efforts — for replacing existing sketchy bolts, adding bolts to run-out sections, and developing new routes. They’ll go to good use!

和丽珍 (Julie and Marty’s driver to Lijiang) invited me to dinner at her house with some other climbers, and I accepted. It was really good farm to table food. She grew all the vegetables herself! And the chicken for the chicken soup was theirs, it was killed and processed on the porch right before dinner. It was all super delicious!

They even had one dish that was all locally foraged mushrooms (the one the guy in the blue jacket is reaching for). The other climbers all ate it and said it was delicious (and that it was their favorite dish) but I exercised caution and didn’t have any. I thought Marty would appreciate this tidbit though!

I rounded out the night with some campfire songs with the volunteer group, we sang some Chinese songs and some English classics. I got the group to sing “country roads” and 童话 (which was actually the biggest hit of the night, since everyone knew it!) It was such a cute, happy, and wholesome evening.

I’m sad to be leaving Liming tomorrow morning, but we had such a good time here and I’m so grateful to have been able to go on this grand adventure with Julie and Marty! And thanks James and Emily so much for recommending that we check out Liming, we wouldn’t have seriously considered coming here otherwise!

Thanks for following along!
❤ Cathie obo Julie and Marty

Planning a trip to Liming

If you were inspired by our trip, you can (and should) make your own trip happen! Here are some tips:

• Getting there: fly into the Lijiang airport (flights usually go through Kunming), and hire a car to take drive you to Liming (3 hours).
• Climbing gear: most routes are bolted for a 60m rope. We were happy to have triples in #0.5 to #2, with doubles in the smaller and larger sizes, and one #5 and #6 for offwidth sections.
• Guide book: Mike Dobie’s guidebook on Rakkup is the definitive guide, though the Rakkup interface is a bit hard to use. I added some routes to the Liming area on Mountain Project as well, but that is a more sparse collection and only has the classics.
• Local community: this is the Liming Facebook page, where you can find climbing partners and guides. There are also posts with the latest in climbing access in the area, which is an ever-shifting topic.
• Timing: fall and spring have the best weather, but try to avoid the big Chinese holidays (the Mid-Autumn Festival in the fall, and Chinese New Year in the early spring) since there are more non-climbing tourists who come to Liming then.
• Lodging: we loved the Faraway Inn, and this is where most climbers stay! There is also a youth hostel down the road, if you want to save money.
• Food: there are tons of food options on the main street of Liming, we highlighted some of our favorites in the trip reports! But be aware that if you’re vegetarian, you have to be very clear you don’t eat any meat, otherwise you might still get a meat garnish.
• Rest days: check out the via ferrata, and definitely go to the market if you overlap with a market day!
• Language: it definitely helps to know Chinese, but these days you can always use a language translation app to communicate! The locals mostly don’t speak English, but are very friendly and willing to help.
• Payment: almost everyone, including corner stores and street vendors, takes WeChat Pay, which you can set up with a foreign bank account or credit card.

And lastly, I’ve gotten some questions about how the climbing in Liming compares to Indian Creek — and I think the climbing in Liming is better! The lines are more varied, the edges are crisper, and the cruxes are more thoughtful. Not to mention that it’s way less crowded, and has better access to plush accommodations and tasty food. You just have to go a bit off the beaten path, but I think it was well worth it and I can’t wait to go back!

A little while later, I settled down in San Francisco and rekindled the love affair with silks that I had started in the desert. I joined Aerial Artique, an aerials and acroyoga studio, where I took classes after work. I occasionally made it out to Circus Center, with their intimidatingly tall ceilings and ruthless instructors. And most critically, I made friends with a group of circus and aerial performers who lived in a warehouse-turned-group-house and-performance-space in SoMa, called Dovetail. The folks at Dovetail hosted weekly circus jams, where they invited friends to use their aerial rigs and train together. I’d come practice the sequences I learned from class, learn new tricks from others, and get inspired.

Since many of the Dovetail friends performed circus and aerial acts, they would organize showcase events where people could perform their works-in-progress, and get feedback and support from the audience. These were magical nights, full of beautiful showmanship and a really lovely sense of community. After attending a few showcases, I was inspired to put together a silks act of my own to perform. But before I was able to choreograph and polish an act I was happy with, the pandemic hit and open-invite aerial jams became a thing of the past.

Unsurprisingly, the pandemic greatly changed the San Francisco circus and aerial scene. My favorite studio, Aerial Artique, shut down over the pandemic, and Dovetail also disbanded. During this time, I refocused my efforts on climbing, and was lucky enough to have a great quarantine crew to train and adventure with. We built a bouldering wall in Mel/Alan/Julie/Marty’s backyard, and had fun decorating and setting weird routes on it. On weekends we drove out to Yosemite, and got better at crack climbing and long multipitch routes until we eventually felt ready for big projects such as The Nose on El Capitan, and other Yosemite testpieces such as the Rostrum and Astroman.

However, I missed the musicality and performance aspects of aerial silks. This year, I decided to pick silks back up, and revisit my pandemic-interrupted project of putting together an aerial silks performance. I joined Inspiration Studios, and began regularly taking classes after work and training at their open gym on the weekends. Before long, I had acquired a large enough corpus of tricks and transitions that I was losing track of what tricks I had learned, and their relationships to each other. So as the nerd I am, I made an “aerial skillbook” with photos and GIFs of each trick, notes for how to enter and exit from it, and its relations to other tricks. I soon learned that one of my classmates, Eden, had done a similar exercise, and we compared notes.

After one of my silks classes, I saw a poster in the lobby of Inspiration Studios calling for applications to their summer showcase. I saw that there was an option to apply for a group performance, but upon closer inspection the group rehearsals didn’t fit my schedule, so a solo performance was my only option. I submitted a performance application to the organizers, with a “portfolio” of videos from Aerial Artique sequences and Dovetail jams.

Renee (the owner of Inspiration Studios) emailed me a few days later and said I had been accepted, and that she was looking forward to seeing what I put together! So I started preparing, by picking my favorite tricks and trying to string them together with graceful and interesting transitions. I was particularly inspired by the flowing and effortless transitions of Zoë Isadora — I watched a lot of her videos and lessons as I was preparing my routine.

A really fun part of the choreography process was picking out the music! I was looking for something simple, smooth, and low-tempo, but with a driving and bass-forward chorus. I liked “Not Enough” by Elvis Drew and Avivian, and felt particularly drawn to the moody guitar line. “I Feel Like I’m Drowning” by Two Feet had many of the same elements as well. Ultimately, I felt more excited to listen to “Not Enough” a million times while choreographing, so I chose that as my showcase song. It wasn’t quite long enough (2:40), so Harry and I used some elbow grease and song editing software to add one more repeat of the chorus, bringing it up to 4 minutes.

Inspiration Studio added additional “open studio” slots for performers, so I came in on weeknights and weekends to practice my set. I would listen to the song on headphones (to not disturb other aerialists), record myself doing the sequence, then come down and watch the video while drinking water and catching my breath. I would then change up the sequence or timing based on how the video looked… and rinse and repeat. In the beginning of the choreography process, I would make large changes such as which tricks to include and in what order. By the last few weeks, I was focusing on the finer details of showmanship, such as where I was looking during each trick, hand flourishes, dramatic pauses, and the timing of each trick to match the music.

The day of the performance finally arrived! I invited some friends who were a part of my aerial journey: Rilka, who was my first silks mentor; Julie, Aurora, and Ember, who took silks and hammock classes with me; and of course my husband, Harry, who helped me edit the song and was so supportive through the whole process! As I was called to the stage, I was “scroked”, which is my term for “scared and stoked”. I walked to the silks, and waited for the music to start…

My first trick off the ground was a split-silk invert into splits. I spent a LOT of time stretching my splits in preparation for the performance!

I put on a footlock, inverted, and took a moment to strike a dramatic pose. This also gave me a moment of rest before going into a fancy split-silk double footlock sequence.

From double footlocks, I was able to hit this fun split pose! Careful observers might notice that all the splits in my performance were on my right side, because that side was more flexible. (Do what I say, not what I do… always stretch both sides equally!)

I went hands free, and balanced precariously for a few seconds in this position (with some wobbling). In the video Harry recorded, you can hear him laugh and shout “wiggle wiggle!” at this point (not helpful, Harry!)

An interesting and directionally-challenging transition brought me to the crossback straddle, where I was able to go hands-free again and rest for a second before launching into an inversion sequence.

I inverted, hooked my leg for stability, and dramatically untangled the silks to make sure they were separated before going into the tick-tock drop.

I originally wasn’t planning to put the “music box” trick into my performance because it was too simple and easy, but Harry said that was his favorite trick, so I included it for him (and as a chance to take a breather!) It ended up looking really pretty though — which goes to show, not every trick has to be a difficult one!

As I was setting up for my big double-star drop, I tossed the silk over my free leg and the photographer captured this beautiful moment. This is one of the reasons I enjoy silks (as opposed to hard aerial apparatuses) — they really have a mind of their own, and move so fluidly and dynamically!

I took a deep breath, and let go into the double-star drop. The photographer caught me mid-drop! I love how the tail of the silk curves around so elegantly. I have never seen myself mid-drop before, and am pleased to see that I kept good form (arms and legs out like a star, strong core with no twisting). This was the scariest part of my performance, but I drilled the drop so many times that I felt confident I had it dialed.

The “cartwheel” is one of my favorite tricks, because you can do it over and over and over again (the end position is the same as the start position). Here, I’m coming up at the end of my second consecutive cartwheel with some anti-gravity hair, for my grand finale.

And that was a wrap! I was the last performer before Renee (who was a very cute cat, performing aerial hoop). We finished with performer bows, and some photos with my friends. Of course my friends picked me up!

Many thanks to Ken (@poleninjaphotography) for the gorgeous photos! Here are some more photos and videos from the performance. My favorite video is the video Harry took, because of his cheering and narration — this was his first time watching my entire performance, and I love his surprised exclamations!

After the performance, we headed to Wursthall for some celebratory bratwurst and beers, where we discussed the highlights of the showcase. For me, the highlight was finally seeing my pre- and post-pandemic silks journey come together into a performance I was really happy with, and to be able to share that with friends who were an important part of that journey!

The Rostrum

Falcon Party [Cathie + Julie + Milde]

Julie and I kicked off our fall climbing season by getting on the Rostrum with Milde! We were originally planning to climb Positive Vibrations and some other routes on The Hulk, but the forecast for the area shaped up to be a quad-fecta of 30mph winds, below-freezing daytime temps, snow, and wildfire smoke. We figured that maybe mother nature didn’t want us to climb The Hulk that weekend, and decided to bail to Yosemite instead.

We’d been tossing around the idea of climbing the Rostrum — but I was intimidated by the finger cracks, while Julie was intimidated by the offwidths. We decided to combine our strengths to get on this legendary route. Since Julie and I wanted to swing leads, but Milde also wanted to join in the fun, we tagged a line for Milde to toprope solo behind us — an unusual but efficient setup! (The party ahead of us was confused about our setup, and asked Julie “did you just pick him up in the parking lot?”)

Packing beta: I was a huge fan of going light and ditching the follower
pack on this route! We each brought a fanny pack (with snacks, the topo,
and a headlamp), a water bottle, and light shoes (eg Xeros, Toms - since
the approach and descent are so chill).

Julie battled the finger cracks on pitches 2 and 4 with strength, bravery, and some goat noises. It was then my turn to dust off my offwidth skills on pitch 6, which turned out to be quite fun because I could get secure knee-jams for most of the way!

While climbing through the pile of bloody bird shit on pitch 7, we joked that we’d turned into falcons, and made falcon noises for the rest of the route. (There were very excited falcon screeches when Milde brought out his bag of sour gummy worms — a falcon’s favorite snack!) We topped out a bit before sunset, made falcon calls which reverberated off the canyon walls, and took an elated summit selfie.

Pitch 8 beta: Mountain Project says to remove your big cam (#5) so it
doesn't get dragged into the crack, and "gun for the top - do not fall".
However, we're team "safety first" and didn't love this suggestion. 

You can actually leave the #5 cam in the crack, and then get some small
pieces in a small horizontal crack on the face (.1, .2, .1/.2 offset, or
all of the above for a nest of power), which will keep the rope out of
the crack and also provide some protection. Alternately, you can also
extend the belay from the tree (making a long rope-tree anchor) to keep
the rope out of the crack as you're belaying.

The next morning, we had a leisurely breakfast of champions at camp with Maia and Jean — blueberry and banana pancakes, courtesy of Milde! Once we were stuffed, we all headed to New Diversions for some chill cragging. From New Diversions, we had an amazing view of the Rostrum so we had to take a Rostrum selfie!

We got rained out in the afternoon, so Julie and I drove back to San Francisco. On the way back, she mentioned that she had tickets to an Acid Pauli set… so of course, we did a wardrobe change and went out to party! We’re never too tired to dance!

Going for the send [Cathie + Ben]

Ben had been engaged in a multi-year battle to get the ground-up send of the Rostrum. He had climbed and sent every pitch separately, but had been deterred from a bottom-to-top ascent multiple times by weather, smoke, or running out of daylight. A few weeks after I climbed the Rostrum with Julie and Milde, Ben was traveling to San Francisco for a conference, so we decided that we’d get him out to Yosemite and finally find him the closure he needed.

We drove out from the Bay Area on Saturday morning (which in retrospect was a mistake), finally arriving at the base of the route around noon. A guy in the party ahead of us was an ecologist in Yosemite, and taught us many fun falcon and bear facts (he said the best place to spot bears in the fall is in the oak grove by the Yosemite elementary school, since they love fattening up for the winter on acorns!).

I usually don’t climb routes multiple times in succession, but I really enjoyed getting on the Rostrum again because every pitch felt way more secure and fluid the second time around — I felt like I got the movements dialed! I also appreciated Ben’s precise beta for the finger crack sections, which helped a lot. He’s a great teacher, and actually taught me a lot of my offwidth and finger crack techniques when climbed the cracks at PGSF together four years ago — it’s very fitting that he’s a professor now!

Ben led the crux (pitch 4), which he had projected and sent in the past. This time, his foot blew unexpectedly — he had placed his .75 cam in a spot that blocked a better foot placement! He lowered back to the start of the crack and got the send the second time around, placing the .75 a bit higher so the good foot placement was free. I also fell at the crux, but lowered back to the start of the crack and got the “toprope send” on my second try. So maybe we didn’t get a ground-up send, but we’ll count this as “good enough” to give Ben the closure with the Rostrum that he needed!

Due to our late start and a slower party ahead of us, we ended up climbing the last two pitches in the dark. I led pitch 8 by headlamp, and semi-joked that it didn’t really matter if I had light because you don’t need to see anything to climb offwidth anyway. We summited, celebrated our successful outing, and stumbled back to camp.

Astroman

Astroboy [Cathie + Ben]

To round out our weekend, the next day Ben and I decided to climb Astroboy, which is the name for the first few pitches of Astroman. Ben wanted to take a crack at the Boulder Problem (pitch 2), and I was really excited for the Enduro Corner (pitch 3).

On pitch 2, we made a poor route-reading error, which was obvious in retrospect. We thought the Boulder Problem was the top half of the left crack, so Ben climbed the 5.10b stem start and traversed left to the piton, following the chalked holds. (Little did he know that the chalked holds are usually from people traversing right…) He climbed up the thin left crack and flailed desperately, to the dawning realization that it was way harder than 5.11c and he was off route. I gave him a crash course in aid climbing, and he aided his way to the anchor. Whoops!

I led the Enduro Corner, and it was epic!!! The climbing off the deck was great hand jams for me, and felt amazing — I wished it would never end. Unfortunately, it soon thinned down to .75s, and also got steeper. I tried to make the thin hand jams work for a bit, but tired myself out and had to rest. Once I resigned myself to full-commit laybacking, though, I was able to power through some burly but secure moves. I pulled over the bulge desperately, and found a thank-god stem rest. One more section of laybacking led to the most glorious chimney ever — easy climbing, with multiple hand cracks to choose from! I belayed Ben up, and we decided to call it a day and rappel from there. All in all, we had a pretty epic Yosemite weekend, and quite an adventure packed “work trip” to California for Ben!

Full commit [Cathie + Jon]

A few weeks later, my buddy Jon visited me from Salt Lake City. We’d climbed together a bunch in his neck of the woods (Moab, Indian Creek, Little Cottonwood Canyon, City of Rocks) but he’d never been to Yosemite, so we had to make the pilgrimage! And since he doesn’t believe in warming up or doing things in moderation, he decided that he wanted his first ever climb in Yosemite to be Astroman. I was game :)

Pack beta: we brought a small haul bag, since it was going to be a long
day with a non-trivial descent. The leader trailed a tag line, and set up
the haul with a microtrax. They hauled the bag up while belaying the
follower (with the bag a little ahead of the follower, so the follower
could un-stick the bag if it got caught). The pack had our approach shoes,
food, water, jackets, and headlamps. Bring grippy shoes for the descent,
there are some slab sections!

We got an early start, and were hiking to Washington Column when I heard Jon say “Cathie… is that a bear?” I had been so focused on finding the climber’s trail, that I had completely missed the bear behind a boulder, maybe 15 feet away from me. The bear munched on acorns and watched curiously, as I made a hasty retreat.

Approach beta - Gaia track:
https://www.gaiagps.com/public/Qinj6MT4umn19iThe8wOjcyq
The spot where I backtrack is the correct approach trail - follow that!
We backtracked and took a long way around, because the bear was blocking
the trail...

After that fun wake-up, we made it to the base of Astroman without any more mishaps. I led pitch 2 this time, and went the correct way instead of going off-route above the Boulder Problem. Jon led the Enduro Corner, though the #1 hand crack was a bit more of a struggle for him on account of his giant meat-paws. He took a whip at the bulge, rested, then powered through to the chains.

After two chill pitches, we arrived at the Harding Slot, and I was on the sharp end. I had read up on other people’s beta on how to climb the Harding Slot, and had ended up more confused than before. People talk about the Harding Slot like they talk about a psychedelic trip — their description mostly sounds like gibberish (“dyno chicken wing”???) and ends with “I don’t know man, I can’t really describe it, it’s a whole experience… you just gotta do it yourself to understand, yaknow?”. Armed with a bunch of useless beta, I headed up into the unknown.

Before imparting my own useless, unhinged-sounding ramblings on beta for the Harding Slot, I’ll just say — that was the wildest and weirdest thing I’ve ever climbed, and it was so cool!!! Getting into the slot was the hardest part for me, since everything was so slick. I got a great hand jam with my left hand, while palming down with my right hand and trying to make the most of some very slippery feet. I could then bump my left hand to the jugs in the back of the slot — no dyno chicken wing required.

Once I was in the slot, I pulled out my chimney and offwidth bag of tricks: frog scooting while pushing down with my palms, and some heel-toe cams. I really appreciated being small, as I fit pretty comfortably but never felt like I was going to get stuck. If I wanted a rest, I simply put my arms in front of my chest and inhaled, and I was securely and cozily lodged. I got good gear in the back of the slot the whole way up (.75–2"), which made me happy, although I couldn’t fall out of the slot even if I tried.

However, Jon, being more than 50% larger than me, had a very different experience. He pulled into the slot without too much difficulty, but shortly ceased to make upward progress. It turned out that he was simply stuck.

Jon wanted to swing to the outside of the slot to climb the 5.11X layback. However, I had not been a very considerate leader, and the gear I’d placed in the back of the slot made that difficult. He laybacked a short section to get around the narrowest part of the slot, and then swung back into the crack to retrieve the gear.

Harding Slot gear beta: If you have doubts of your follower's ability to
fit in the Harding Slot, be a considerate leader and don't place gear once
you're in the slot, so they can toprope the 5.11X layback variation. The
smaller human should lead this pitch ;)

Jon emerging from the Harding Slot

There were rappel rings on top of the Harding Slot, so we checked in to see if we wanted to keep going up or rappel. Jon was pretty exhausted from his battle with the slot, but since it was “only four more pitches” to the top, we decided to keep on going.

I was on the sharp end for the “Changing Corners” pitch. However, my tank was running low — especially since I’d stupidly forgotten our sandwiches at home, so we had been subsisting off of bars all day (and any of my climbing partners can tell you, that you don’t want a hungry Cathie!) I quested upward, but got pretty rattled by the high-commitment mantle move and the face climbing. By the time I arrived at the corner with “thin tiny nuts”, I was running on fumes and hung on some marginal gear. Through sheer willpower, I powered through the wider crack section while battling killer rope drag, toward what looked like a thank-god belay ledge. When I arrived at the plush ledge, before building my anchor, I checked the topo. I realized I had gone off-route and had to downclimb and traverse right to the actual anchors, and I almost broke down and cried from sheer exhaustion and frustration. I held it together (barely) and did the wild traverse to the actual anchor out right.

Jon bravely led the last pitch, the “scary face pitch” which goes at 5.10d R, as the sun was setting. This pitch has not one, but two R sections, because the gear is so marginal! The rock quality is pretty questionable here, and the rock sometimes crumbles into skrittle underfoot. At the 5.10d R section, Jon’s foot slipped unexpectedly as he was placing gear. A fixed nut caught him, but he landed on the “menacing spike” before the rope came taut. He collected himself, called down that he was fine, and soldiered upward again. He belayed me up, as I marveled at how sparse and questionable the gear on the pitch was. It doesn’t go at “R” for nothing! (Jon ended up with a pretty dramatic butt bruise, but no serious damage).

We topped out in the dark, and wolfed down half a burrito from Taqueria Cancún and some snacks which had been buried at the bottom of the bag. I was so grateful to get some calories — we needed it for the long descent!

We made friends with a party that had climbed the South Face of Washington Column, and did the descent with them. They had amazing gear beta — instead of heavy and bulky approach shoes, they had packed Chacos and hiking socks! It seemed to work great for them. It took us 1.5 hours to get from the summit to the base of Astroman, and another 30 minutes to get from the base back to the car.

Descent beta - Gaia track:
https://www.gaiagps.com/public/Ch3lwf3dSqUX9reOJsGTJofb
Once you finish the 4th class ledgy downclimbing and enter the forest,
you could follow the descent trail downhill which leads you back to the
main hiking/biking/horse trail. However, we had left a backpack at the
base of Astroman, so instead we bushwhacked west to get back to the base
without losing as much elevation.

We both had work the next day, so we slogged to the car and drove back to San Francisco, stopping by In-N-Out for a late dinner. We arrived home around 2am and collapsed into an exhausted slumber.

A gear side note — partway up Astroman, Jon told me that the trigger wires on my #4 had broken. This was really annoying, since we still needed the #4 for several wide sections! I MacGyver’ed some trigger wires out of extra hairbands, and vowed to more closely inspect my trigger wires for signs of wear in the future. Once I got home, Harry replaced the trigger wires for me, using a trigger wire repair kit we ordered from Black Diamond.

In non-climbing-related adventures, Jon had never been to the SF bay area before so I showed him my favorite outdoor spots — the tide pools at Pillar Point, and the redwood forest. He made little friends in both places!

Fifi Buttress

When I climbed the Rostrum with Ben, completely by coincidence, Miles was actually higher on the route and recognized my helmet when he looked down! We hung out around his campfire when we got back to camp, and he and I discussed roping up the following weekend. He suggested Fifi Buttress — he had already climbed Voyager and Center of the Universe, but was down to climb them again so I could experience them!

Approach beta - Gaia track:
https://www.gaiagps.com/public/PPeMf4WkKqmJNWqU4Kd3ZvW0
This track takes you to the base of Voyager! To get to the base of Center
of the Universe, see my descent track.

Voyager [Cathie + Miles]

Voyager was such a fun romp! I loved the variety of climbing it offered, and how safe it felt (there are bolts whenever the protection is even mildly questionable). We basically giggled our way all the way up the route. The cruxes both felt very feasible — the Incinerator is exhausting but well protected, while the Boulder Problem is just one big move (with slippery feet) with a bolt at your waist!

Center of the Universe [Cathie + Miles]

We had so much fun on Voyager, that we wanted to keep going. We ate lunch at the base of Voyager, then walked on the ledge over to the top of pitch 4 of Center of the Universe. We climbed pitches 5, 6, and 7 on Center of the Universe, which Miles said are the best pitches on the route.

I made the silly mistake of linking pitches 6 and 7 together, which resulted in terrible rope drag by the time I got to the crux of pitch 7. I pulled through the crux, got a hand jam, plugged a #2, and was pulling up rope and trying to clip my piece when my hand jam slipped out and I took a huge whip! Miles said I fell about 15 feet, but it felt like an eternity falling through free space — at least the fall was clean! I collected myself, and then battled the rope drag to the anchors. Despite being rattled by the fall, I still really enjoyed the climbing on Center of the Universe — another high-quality route by Dan McDevitt!

Descent beta - Gaia track:
https://www.gaiagps.com/public/xRw1DihRRPgyKFULbKNjMtrO
This is the descent from the base of Center of the Universe.

Mr. Natural [Cathie + Julie + Cheryl + Foster]

Dan and Shannon got married in Yosemite Valley (with the most gorgeous wedding ceremony ever), and a bunch of our climbing friends were in attendance! The ceremony was at sunrise and the reception was in the afternoon, so we had a few hours to sneak away and climb. We decided to get on Mr. Natural since it was walking distance from our campsite at Upper Pines — perfect for a quick getaway!

Approach beta: If you climb Apron Jam as an approach pitch, bring some
big gear! I was happy to have a #5 and #4 for the wide crack at the start.
There’s a slightly heady traverse right from the top of Apron Jam, to the
start ledge for Mr. Natural.

Julie was an MC for the wedding reception, so she climbed Mr. Natural first in order to have time to change and do preparations for the reception. She headed up and marveled at how good the finger locks were, confidently placing gear and moving smoothly. She made a few goat noises at the crux, but pulled through the hard moves by entering the witness position and giving herself words of affirmation.

Next, Foster toproped the route clean — all aboard the send train! He also brought his fancy camera and ascending setup, so he could fix a line and play photographer for Cheryl. Cheryl took the sharp end, all smiles and nervous excitement.

I headed up last, and squeaked by with a send — though it wasn’t an onsight, since Foster gave me helpful and much appreciated gear beta from his photographer’s position on the fixed line. I’ve never gotten the professional photography treatment while climbing before, and it was pretty neat!

We rappelled and walked back to camp, to clean up and get dressed for the wedding reception that afternoon — which Julie and Marty did an amazing job MC’ing, of course!

I considered the fall climbing season in Yosemite to be officially over when it started snowing in early November. I had a ton of fun getting on some harder and higher-commitment routes this season, but was also ready to take a break after running my body into the ground weekend after weekend. I celebrated the end of the season by spending time with friends and family in the bay area, carrying on our yearly tradition of going chestnut harvesting at Skyline Chestnuts. The plan is to hibernate until the start of ski season… which is actually pretty soon!

Cocktails / Mixed Drinks

Heartbleed             | Bloody Mary
Rum-time Error         | Strawberry Daiquiri
Co(lada)-factor Attack | Piña Colada
Use after Fruit        | Grapefruit Juice + Vodka + Club Soda
Open Source Software   | Make your own cocktail
Zero Knowledge         | Surprise cocktail

Other Alcoholic Drinks

Log4Claw               | White Claw
WannaCry               | Smirnoff Ice
Buffer Overflow        | Guinness

Virgin Drinks

Stack Canary           | Grenadine + 7UP
Rogue Key Attack       | Remove the alcohol from any cocktail
Ristretto              | Red Bull
Air Gap                | Water
FEDRAMP Compliance     | Cold Pressed Vegetable Juice

Snacks

Remote Chip Execution  | Chips & Salsa
Meltdown               | Freeze Pops

This drink menu was originally made for a DEFCON30 kickoff party. There was also a Cards against Cryptography game, and the scavenger hunt team “what’s with the nails?” was born. Feel free to suggest other security/cryptography themed drinks, the wittier the better!

Getting stoked

Julie and I have both always dreamed of climbing El Capitan, but we thought of it as something only “real climbers” do — it seemed like too big and intimidating of a project to seriously consider. However, sometime in late 2021, we started discussing climbing The Nose together, in earnest, and we got really stoked as the idea became more concrete. We read up on how to big wall climb, put together a training plan, studied the details of the route, and blocked off weekends for practice runs and skills training leading up to the Big Push.

The plan

Our friends Mel, Dan, and Alex climbed The Nose together last year as a party of 3, in 3.5 days. We thought the way they broke up the days made a lot of sense, so we planned to follow their itinerary up the route:

Normally, Julie and I mostly free climb — meaning, we use our hands and feet to get up climbs, with protection from gear and a rope. However, in order to efficiently climb The Nose, we used a mix of french free and aid climbing. French freeing is when you free climb, but occasionally place gear and pull on it (it’s basically free climbing with some cheating); aid climbing is when you place gear and put ladders on the gear, and step up on the ladders. No matter what form of climbing we did, though, we were always protected by our gear and ropes — we are team “safety first”! (For more details on the logistics of big wall climbing, VDiff has a great explanation.)

Day 0: Fixing to Sickle Ledge, 7am — 4pm

Update from the valley: today (day 0) we fixed to sickle and hauled our bag up, as planned. We’re sleeping in a campsite tonight, and will jug the lines up tomorrow morning.

We got a permit for sleeping on the wall, and the ranger said we’re the only party on the nose with a permit! There is another party who did the same thing as us today though (fixed to sickle, hauled bags) — so we are going to get a really really early start tomorrow to try to beat them! (They have two EXTREMELY heavy haul bags and a separate portaledge bag and a huuuuuuge poop bucket — they are climbing siege style and can’t be very fast, so we don’t want to get stuck behind them…)

We had a small fiasco with fixing ropes, because it turns out that the second rap (from sickle) requires a 70m rope (though the guidebook says 60m… Lies!). But the rope we saved for that rap was 60m. And our haul line was 65m! Thankfully Harry brought in my 70m rope, as well as some ice cream ;) (and poor Julie hauled the bag on a dynamic rope). Also squirrels got to our sandwiches, so we didn’t have lunch but had a really early dinner on the pizza deck, yum! Julie would like to add that she successfully tricked Cathie with egg/no egg 3 times today! Harry was not fooled, he was 2 for 2.

Sending love!

Egg/no egg is a game where you take a hard boiled egg (or a tea egg in our case — my mom made us a bunch of tea eggs for wall snacks) and put the entire egg in your mouth (or don’t), then turn to your partner. Your partner has to guess whether you have an egg in your mouth or not. It’s an ideal game to play while snacking at belays. And really, it’s harder than it sounds!

Because we fixed lines to Sickle Ledge, we could sleep on the ground for the night— which was nice because we got to enjoy some nice “ground” amenities before spending the next few days on the wall!

In the evening, Chongo paid a surprise visit to our campsite (Harry had spent the afternoon discussing quantum mechanics with him, and had invited him over). He gave us some tips on hauling systems and wished us good luck on our climb!

Day 1: Ground to El Cap Tower, 5am — 5pm

Hello dearest friends and lovers!

We just wrapped up a very successful and eventful day 1 (please note the zero indexing of the days). We got a 4am wakeup, and harry was gracious enough to get up before the asscrack of dawn with us! We jugged up the ropes we fixed yesterday, and dropped our extra rope which Harry picked up. Despite our early wakeup, we weren’t the first one the wall — some whoops and cheers were exchanged with a NIAD (nose in a day) crew who were past sickle before 5am (wow)!!! We beat mega haulbag party though, phew.

At the top of the first pitch, Cathie decided to pull a tommy caldwell and yeet her fanny pack (containing her phone and headlamp) off the wall, whoops. Luckily we have an oh shit kit containing an extra headlamp. Unfortunately her phone may be a goner though, all future updates will come from Julie (who will hopefully not yeet her phone).

Julie got to lead the stovelegs, declaring them the best pitches ever (so far). Cathie got redemption on the wide fists / offwidth pitches, and got her first correct egg / no egg of the trip. We forgot the haul line once, but otherwise the hauls went pretty smoothly. Hauly the haul bag has been serving us very well.

We made it to El Cap tower around 3pm and fixed the next two pitches (Texas flake and the boot flake). Julie sort of freed the calf of the boot. We wrapped up around 5 and are now enjoying the view from the v v plush bivvy on el cap tower, while warming up with hot Pad Thai.

Fingers crossed for a big smooth day tomorrow. After jugging our fixed lines, we’ll kick it off with the king swing! The weather today was a little cloudy and chilly, but altogether quite nice (sending temps!) Hoping it stays more or less the same through the next few days!

Like and subscribe, and thanks for following along!
Cathie + Julie

That night, we slept on top of El Cap tower which is a very spacious ledge, with enough space to sleep 6 people — and we had it all to ourselves! The view of the valley was gorgeous, especially at sunset and sunrise. While eating our hot Pad Thai dinners, we video called our partners (there is great reception once you’re high up on the wall) to say hello.

We stayed anchored into the wall at all times while cooking, setting up camp, and sleeping (safety first!) Since the ledge was so large, we could just sleep on our sleeping pads — no portaledge needed.

Side note: where’s the bathroom?

Since we were spending multiple days on the wall, of course we had to use the bathroom at some point. We’d go #1 off ledges (preferably away from the climbing route), while keeping our harnesses on. Going #2 is a bit more involved — you have to poop in a bag, and bring it with you! We bought really nice “wag bags” from my friend James Huang, who runs niceclimbs.com:

Next, we put the used El Crap bags in an air-tight “poop tube”, which my husband made for us out of plumbing pipe. We named ours The Poopmaster:

I will admit, though, that my body had a difficult time relaxing enough to make #2 happen… which Julie mentions in our next email update.

Day 2: El Cap Tower to Camp V, 6am-7pm

Day 2: questing into the unknown

We got up at 5am, Cathie tried to poop and sadly no luck. We saw beautiful stars last night and enjoyed the sunset views. We had a leisurely and delicious breakfast watching the light slowly filter into the meadow.

We jugged up to the boot flake, then Julie set up for the king swing. She snagged it first go, so fast that Cathie wasn’t even set up yet to give her a boost. Woops and delight ensued. We had some rope shenanigans with the lower out off of the boot, but with ingenuity, safety, and good ole fashioned struggling we made it.

King Swing

Harry was in El Cap Meadow with a telescope and watching / taking photos of us, and he captured the rope shenanigans as I lowered out from boot flake:

Julie led the Lynn hill traverse and it was AMAZING! LYNN HILL IS OUR HERO AND INSPIRATION!!!! after the traverse Julie led a pitch with a crazy step out that required full faith that good things were happening around the blank corner (there were good things). Cathie followed and got to experience the terror/joy as well. We swapped, then Cathie brought us to the bottom of the great roof!

Cathie CRUSHED the great roof, she credits the danfi hook and DMM offset nuts. at this point we caught up with a party above us, and were caught up with by a niad party below. Slight chaos ensued. We tried to let the niad folk pass, but they got their rope stuck and had to fix it for a while. Julie cleaned the roof and continued.

Harry got this great timelapse of me leading the great roof:

Cathie led the pancake flake and describes it as “fucking insane, it’s like 110ft of continuous liebacking”. Side note we have been french freeing most pitches and have been really enjoying the actual climbing on the nose (shocker).

At this point the niad party caught us again and we let them pass, they were pretty cool and had heard of us!! They were both climbing stewards and had heard from the other steward who issued us our permit that we had climbed all the planet granite cracks in a day. We exchanged weird asian nuts for gummies from Berkeley bowl west and all rejoiced.

Cathie took us to camp 5 via an “awkward pitch” which she thinks is just a misunderstood pitch. Someone dropped a black totem on Julie’s head, booty??? Julie fixed the next pitch, catching up with the party ahead once more. We came down and were done around 7pm. It was a 12.5 hour day!! Woohoo! We’re now fed, watered, peed, and portaledge is set up.

Shout-out to Carson for letting us borrow his inflatable portaledges which are crazy nice.

Tomorrow our goal is to stay on our A game, be safe, smooth, and have fun!! We plan on waking up around 6, moving by 7/730, and we’ll go from there!!!

Love you all, we’re hoping we get to see you all at the top!
Julie+ Cathie

Because Camp V was a smaller ledge than El Cap Tower, and slightly sloping, we decided to use the G7 inflatable portaledges so we would have a larger and flatter surface to sleep on. They were really easy to set up, though it took a little bit of getting used to sleeping on them (you have to keep your weight centered, or you will slide around). Here are some exhausted smiles after a long, fun day of climbing:

Day 3: Camp V to the top! 7am-4pm

WE MADE IT!!!!!!

Hello from the top of El cap! Today was a good day. In continuation of our trend of waking up one hour later each day we woke up at six, broke down the G7 pods which worked ok. Julie slid a little bit at night and Cathie was bunked under Julie and was quite cozy. Cathie had her first ever successful wall poop in her life!! The camp 5 ledge has a nice little private pooping area that we used for our WC.

Once we broke down camp we jugged up our fixed pitch from the day before. Cathie kicked off the leads with a tricky aid section that turned into the most beautiful hand crack known to man kind. She felt so guilty aiding the hand crack that she felt morally obliged to put on her crack gloves and free the rest. Then the changing corners pitch came up. First off, Lynn Hill is a boss and we cannot imagine anyone thinking that that pitch could go free. Cathie quested hard, and a piece blew on her resulting in a lost brassy and squeals (there was a bolt and a good nut under her and she took a 2 ft fall). Cathie crushed it but her brain was mush at the end so Julie took over the next leads.

First pitch was a beautiful hand crack that Julie kind of aided at the beginning then freed. Next was the sort of tricky roof, Julie sang to herself “just keep climbing” and extensively used our four black totems. The stance at the end of this pitch was wild!! Cathie was too nervous to look down but Julie loved the exposure and the stance. The final two pitches were the bolt ladder, the roof was unexpected! It was a good thing we had gotten practice on the kor roof three weekends ago so we felt really good on it. (We really crammed for this exam).

The final belay was the most insane hanging belay over a roof with no feet. All of El cap extends below you and the wind was going crazy. We felt so nervous, excited, tired, relieved, drained, optimistic, and felt something adjacent to proud, more like the feeling you feel when you’ve worked really hard for something and are kind of sad it’s coming to an end (note: Julie felt this way but Cathie was shitting her pants).

Julie topped out, saw friends then the rope got stuck, and she had to go back down to the anchor and haul and fix from there. Julie and Cathie had a beautiful little moment together before joining the others at the top ❤. Cathie took us to the top, we got an assist on the belay and the haul from Marty and Harry. Cathie watched and commanded from her high horse.

We feel so lucky that Adam, Kenny, George, Wen, Harry, and Marty came to meet us at the top. Kenny and Adam brought a two burner stove and cooked a deluxe mushroom pepper and onion stir fry. The boys brought us fresh pineapple and watermelon and everyone brought tons of water. We feasted, we hugged, and we were so so happy, feeling all the feelings.

We set up camp at the top of El cap to sleep and watch the sunset, which was stunning both to the west and to the east over half dome and Tuolumne. We popped champagne (thank you George, Adam, and Filippo)!

We have el capped, el crapped, and now we el nap!!!!!!!
Lots of love,
Cathie+Julie

We ran into Connor and Jim Herson on the top of El Cap, they had just finished climbing the Salathe — and Connor had freed the whole route (it goes at 5.13c!!!). Jim took one look at Hauly and told us, “that haul bag is way way way too big.” We don’t fat shame our haul bag, but their haul bag was about a quarter the size of ours and I will admit, it looked way more pleasant to haul!

Day 4: Back to civilization

Hello friends!

Now that we have successfully completed our adventure and are safely home, it’s time to thank our sponsors (aka the friends and family who made this all possible) -

Our summit support crew — Harry, Marty, George, Wen, Adam, Kenny — who hiked the grueling upper Yosemite falls trail to the top of El Capitan with 9 gallons of water, a full cooking setup, fresh food (watermelons, pineapples, beer, champagne), and hugs! Also Harry set up a telescope in El Capitan meadow to watch us and take photos of us on the wall, which did a great job of documenting our second day on the route.

Carson, who lent us his G7 pods — they were such a pleasure to sleep on at camp 5, and were so light and easy to set up!

Alex Lenail for gifting us a haul bag! We affectionately named her Hauly, and she was our constant buddy on the wall.

hauly the haul bag

Dan, for lending us his proprietary DanFi hook — that made aiding a much more pleasant experience (we got away with using only one ladder instead of two, reducing tangles).

Mel, for all the beta and aid knowledge transfer. And for our amazing practice run up Washington Column together!

Milde, also for aid beta and inspiration. We collectively called Dan, Mel, and Milde “the elders” (e.g. “the elders set up a Tyrolean here when they climbed it”). Thanks for showering us with your knowledge!

Our super supportive families — Julie’s mom said she was proud of us for dreaming so big! And my mom’s way to show support was to made us a ton of tea eggs for snacking on the wall, which were so tasty (and perfect for playing egg / no egg ;) )

We love you all so much, thank you for coming along with us on this journey!

Julie + Cathie

Side note (optional reading): Preparation

Julie and I have been climbing for 8 and 10 years respectively, so we were already fairly comfortable with multi-pitch trad climbing (including skills like gear placement, rope management, and endurance for long days on the wall). Things we actively worked on to prepare for the Nose:

• We wanted to be comfortable enough to on-sight 5.10c in the valley, so we could free or french free most pitches on the Nose. So, we trained in the gym and in the valley until we felt comfortable at that grade. This training included “heavy bottom girls” gym sessions, where we would climb with a double rack on our harnesses and/or several liters of water, to simulate the weight we’d be carrying while climbing on the Nose. We also did a “tour de craque”, where we spent a day climbing every single crack in every single Planet Granite gym in the bay area, totaling about 52 pitches.

• We learned big wall skills — how to aid climb, haul and dock bags, fix and jug lines. This was the biggest step for us, since neither of us were very experienced big wall climbers (I had climbed Moonlight Buttress many years ago, but my skills were rusty). We practiced aiding bolts in the gym, at least until we got in trouble for it. I set up a fixed line on a tree in my backyard, where I practiced jugging and hauling/docking Hauly with weights in it — I timed each lap, and was able to get about a 2x speedup! Chris McNamara’s books and videos helped a lot with learning aid skills, and Bryan Bornholdt gave us some great advice for dialing efficiency.

• We also practiced our big wall skills in Yosemite itself. We practiced jugging by ascending the fixed lines to Heart Ledges, and hauling Hauly (with 4 gallons of water) the whole way. This is how we decided we really wanted to stick to a 1:1 (instead of 2:1) haul! We climbed Washington Column with Mel 4 weekends before, did a Nose practice run to Sickle 3 weekends before, and did another Nose practice run all the way to the Boot Flake (sleeping on Dolt Tower) 2 weekends before our final push. The Nose practice run to the Boot Flake felt smooth and efficient, so we were confident enough with our skills to go for the full route!

• We studied the Nose topo extensively, including reading others’ pitch-by-pitch breakdowns and tips. We annotated the topo with our most critical notes, and split up pitches (red = Cathie, blue = Julie, purple = ?).

• We got all our gear together and packed! We ended up bringing: a triple rack, 2 ropes (lead rope and haul line), personal climbing gear (harness, ascenders, etc), 2 G7 pods, 2 sleeping pads with ground sheets, 2 sleeping bags, headlamps (including a backup), 4 gallons of water, backpacking dinners and a jetboil, sandwiches and a LOT of fun snacks, the Poopmaster and several El Craps, clothes, toiletries, a first aid kit, and of course Hauly. We had a follower pack which contained warm layers, the first aid kit, and food for the day. We each carried a fanny pack with a phone, printed topo, tape, headlamp, and snacks — at least, I did until I yeeted mine off El Cap.

• We picked the Juneteenth weekend for our big push, since it looked like a surprisingly cool weather window. We blocked off vacation days at work, got unreasonably excited, and then had the experience of a lifetime!!!

Thanks for reading, and happy adventuring!
❤ Cathie + Julie

Background on Blind Signing

Blind signing is exactly what it sounds like: a protocol where someone signs something without knowing (being blind to) what they are signing. This concept was first described by Chaum in 1982 in his paper, Blind Signatures for Untraceable Payments. Basically, blind signing allows you to decouple the signing step (since the signer is blind) from the redemption step, giving nice privacy guarantees. The concept might seem a bit contrived, but is actually useful in a few situations, including digital cash schemes and voting protocols. For a really good explanation of how this works using the voting analogy, see the Cloudflare blog post on Privacy Pass; if you like talks more, I explained the concept in my talk at 0x0G.

The VPN by Google One, Cloudflare, and Google Chrome are all interested in blind signing protocols as well. This is because they all have something in common: they want to make sure that users are actually valid users (as opposed to bots, scrapers, etc) before serving them content, but they also want to preserve the privacy of those users as they browse. Blind signing allows them to do both. The users prove that they are valid users by authenticating to a service, and giving the service a blinded value to sign (so the service doesn’t actually know what token it’s signing). Then, when the user wants to retrieve content, they unblind and redeem this signed value (token). The redeemed unblinded value that the redemption endpoint sees is unlinkable to the blinded value the authentication service saw and signed! Therefore with blind signing, a VPN by Google One user can have peace of mind that the VPN operator is not able to link their identity with their browsing activity using session IDs, which gives a stronger anonymity guarantee.

RSA blind signatures

The simplest blind signing scheme is based on RSA signing. I will not cover RSA signing here, other than to link to the RSA paper and to mention that it is extremely easy to implement insecurely, leading to a long and storied history of attacks on RSA and a general recommendation not to use RSA by cryptographers. I will discuss later why RSA based blind signatures were still the right choice for VPN by Google One.

RSA parameters, oversimplified (assume that these are chosen correctly):

e = public exponent
d = private exponent (known by signing server)
x^e^d == x (mod N) for all x in [0, N)

Protocol:

Notes: r must be relatively prime to N. The Client and Redemption Point must know the correct public key e.

“Non-attack” #1: token malleability

Suppose you are a malicious client, and want to run a bot farm. You'd like to legitimately get one signed token, and then use it to create many new illegitimate but valid signed tokens, for your bots to use, by taking advantage of token malleability.

First, you authenticate to the Signing Server and get a signed blinded token back: T = sig(BM). Next, you create a bunch of new tokens from this signed token without having to authenticate again, by multiplying your token by a constant. For example, you can make T’ = T/2:

T' = sig(BM) / 2
= (m*r^e)^d / 2
= m^d * r / 2

Now you can unblind your new, evilly procured token T':
sig(m') = T' / r
= m^d / 2

Send your evil unblinded token to the Redemption Point, which does the validity check without suspecting a thing:
given signed token: sig(m') = m^d / 2
given message: m' = m / 2^e
check: m' == sig(m')^e
which gives: m / 2^e == (m^d / 2)^e
expanded: m / 2^e == m / 2^e

So the Redemption Point sees this check as passing, meaning they have unwittingly accepted the evil token! Using this approach, you could produce near-infinite evil tokens using just one honest token: just multiply the honest token by different constants, and tweak m' accordingly.

Now why doesn’t this work? Moti pointed out to me graciously: it actually would work fine if you were only operating over plain messages m… the attack works because of the ability to tweak m freely, since the receiver doesn’t actually know ahead of time what the message should be. In fact, this is the way that RSA blind signatures are initially written up on the Wikipedia page (though hashing is mentioned at the end of that section). However, the correct way to implement RSA blind signatures is to operate on the hash of the message, instead of the message itself. If you replace all instances above of m and m' with h(m)and h(m'), you will see that in order to successfully create a malicious h(m') to fool the Redemption Point, you would have to find a preimage to the hash function. We assume that this is a computationally infeasible task, if the hash function is well chosen.

This is yet another example of low-level asymmetric crypto pitfalls… and also why it’s important to reference the correct writeup when analyzing cryptographic protocols! Of course, Google One’s VPN implements this correctly, and I was just chasing a false lead.

“Non-attack” #2: nonce reconstruction

Here’s a more subtle non-attack. RSA blind signing is constructed so that even if the Signing Server and Redemption Point collude, they should not be able to link a token signing from redemption. Let’s poke around to see what they could learn by colluding. Say the Signing Server saw a blinded token BM, and the Redemption Point saw a redeemed token with message m. They think that these two are linked, meaning that BM was a blinded token made from m. Working together, they will try to reconstruct r from these pieces.

Signer knows: BM, d (privkey)
Redemption point knows: m, sig(h(m)), h(m)
Everyone knows: e (pubkey)
Solve for r: BM = h(m) * r^e mod N
Divide by shared h(m): BM / h(m) = r^e mod N
Raise by privkey d: (BM / h(m))^d = r^e^d mod N = r'

So, the evil Signing Server and Redemption Point have reconstructed the secret nonce r (their guess is denoted as r'). They can now check if this r' actually corresponds to the original BM and m that were received:

BM == h(m) * r' ^ e mod N
== h(m) * ((BM / h(m))^d)^e mod N
== h(m) * BM / h(m) mod N
== BM mod N

So, the original BM and m received do correspond with r', meaning that the Signing Server and Redemption Point have successfully linked a token signing with a token redemption! This breaks the anonymity and privacy guarantees of RSA Blind Signing, and means that a malicious browser / CDN / VPN can track your behavior across the internet…

Or does it? Before reading on, maybe try to figure out why this attack actually doesn’t work? It’s a fun exercise! Credit to Thai for pointing this out first.

Okay, here’s why this doesn’t work… because any reconstructed r', from any BM and m values even if they are not correlated, will pass this check! Let’s work through it with example BM_1 that corresponds to m_1, and sig(h(m_2)), m_2 where m_1 != m_2:

Signer knows: BM_1, d (privkey)
Redemption point knows: m_2, sig(h(m_2))
Everyone knows: e (pubkey)
Solve for r: BM_1 = h(m_1) * r_1^e mod N
Divide by h(m_2): BM_1 / h(m_2) = h(m_1) * r_1^e / h(m_2) mod N
Raise by privkey d: (BM_1 / h(m_2))^d = (h(m_1)/h(m_2))^d * r_1 mod N = r'

Notice how in the original attack, when we divided by h(m) it cancelled out on the right, since we assumed that the signer and redemption point were looking at the same message. In this example, it doesn’t cancel out nicely because we are assuming that m_1 != m_2. Since the Signing Server and Redemption Point don’t know whether the messages are correlated, they set their guess r' to this messy value (BM_1 / h(m_2))^d. Let’s see how the equivalence check plays out:

BM_1 == h(m_2) * r' ^ e mod N
== h(m_2) * (h(m_1)/h(m_2))^d * r_1)^e mod N
== h(m_2) * h(m_1)/h(m_2) * r_1^e mod N
== h(m_1) * r_1^e mod N

And this check actually still succeeds, as we end up with the original definition of BM_1 = h(m_1) * r_1^e! So what this means is that whether you are reconstructing r' from two related or unrelated values doesn’t matter, as no matter what, your reconstructed r' will pass the faulty check of relatedness. So you don’t actually learn any information, either way.

Alternatives

There are many other protocols to blindly create tokens, which can be broadly grouped under blind signatures and anonymous tokens. Blind signatures include RSA, Schnorr/DSA, BLS, and Abe; this post is a great introduction to the field. Some well-known examples of anonymous token protocols are Privacy Pass, used by Cloudflare, and Trust Tokens, used by Google Chrome. (I was also lucky enough to review Trust Tokens before it launched; I gave a talk at 0x0G about my findings).

The drawback for anonymous token schemes such as VOPRF-based Privacy Pass and Trust Tokens is that they are not publicly verifiable — that is, any redemption point would have to know the secret key d in order to check that a signature is valid. RSA, Schnorr, Abe, and other blind signatures are publicly verifiable: you only need the pubkey e to perform a signature validity check. In the case of VPN by Google One, it was highly desirable for the signatures to be publicly verifiable so that the private key wouldn’t have to be distributed to all exit nodes. Therefore, it made sense to choose a publicly verifiable signature scheme in this setting. Schnorr blind signatures are shown to be broken, BLS blind signatures are computationally expensive, and Abe blind signatures have large signatures; given design requirements, RSA blind signatures were the best fit for VPN by Google One.

For both anonymous tokens and blind signature schemes, one critical component is for all clients to see the same public key (or in the case of Trust Tokens, the same set of public keys) — this is the only way the unlinkability property can hold. If different users see different public keys, then the signer and redemption endpoints will be able to differentiate between groups of users based on which public key they are working with — therefore grouping the users into different anonymity sets.

Conclusion

My main takeaway from all this is that RSA is weird! As a result, RSA blind signing has strange properties, and its security relies on subtle things such as hashing and correct RSA parameter selection. But the core protocol is not broken; in fact, this paper proves it to be secure under the random oracle model. So our attempts to break RSA blind signatures were doomed to fail all along, but hopefully it was a fun adventure! If you want to learn more or be involved in discussions on this topic, here is a recent draft for the Crypto Forum Research Group (CFRG) on RSA blind signatures.

Thanks

With contributions from Thai Duong, Moti Yung, Tancrède Lepoint, and Scott Hendrickson — thanks for working with me on this review! Thanks also to Andres Erbsen, Jeremy Rubin, and Geoff Bradway for giving feedback on this blog post and making it more readable.

Adventures with RSA Blind Signing was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

In this post, I will explain how the Bulletproofs zero knowledge proof protocol works, as well as talk about the confidential asset protocol and confidential smart contract language we are building using Bulletproofs.

This post is a condensed version of previous talks and blog posts and our Bulletproofs library documentation. It has also been featured in the MIT Digital Currency Review.

Background

Zero-knowledge range proofs are a key building block for confidential transaction systems, such as Confidential Transactions for Bitcoin, Chain’s Confidential Assets, and many other protocols. Range proofs allow a verifier to ensure that secret values, such as asset amounts, are nonnegative. This prevents a user from forging value by secretly using a negative amount. Since every transaction involves one or more range proofs, their efficiency, both in terms of proof size and verification time, is key to transaction performance.

In 2017, Bünz, Bootle, Boneh, Poelstra, Wuille, and Maxwell published Bulletproofs, which dramatically improves proof performance both in terms of proof size and verification time. In addition, it allows for proving a much wider class of statements than just range proofs.

Definitions

Commitment — a commitment Com(m) to message m is hiding, which means it does not reveal m. It is also binding, which means that if you make a commitment to m, you cannot open it to a different message m’. In the context of Bulletproofs, commitment refers to a Pedersen commitment, which has the additional property of being additively homomorphic, which means that Com(a) + Com(b) = Com(c) only if a + b = c.

Zero-knowledge proof — a proof that a certain statement is true, without revealing the secret that the statement is about. This is usually done by making a commitment to the secret that the statement is about, and sharing the commitment along with the proof.

Zero-knowledge range proof — a proof that a secret value is in a certain range (from 0 to 2^n — 1). The proof is usually shared with a commitment to the secret value so that it can be verified.

Inner product — the sum of an entry-wise multiplication of two vectors.

Notation: vectors are written in bold, such as a, 2^n (which is an n length vector 2^0, 2^1, ... , 2^{n-1}), and 0^n (which is an n length vector of 0s). Inner products are written as c = <a, b>, where a and b are vectors of the same length, and c is a scalar.

Range Proof

We’d like to make a proof of the following statement: 0 ≤ v < 2^n

We know that if this is true, then v must be a binary number of length n. For example, if n=4 and v=3 (we’re checking if 3 is in range of 0 to 2^4 — 1), then this means that v must be able to be broken up into a bit representation that is 4 bits long, if it is actually in range:

We would like to represent this claim in the form of an inner product because of the extremely efficient inner product proof that Bulletproof introduces, which we will talk about in the next section.

First, let’s name the bit representation of v: v_bits.

v should be equal to the inner product of v_bits and the vector 2^n (which is an n length vector 2^0, 2^1, ... , 2^{n-1}) if v_bits is actually the bit representation of v. We can do that by adding check 1 in the figure below.

Also, we need to make sure that v_bits is actually composed only of bits (no other pesky numbers, like 5 or -1000… that would be bad!) We can do that by adding check 2 in the figure below.

Next, we combine these two statements using challenge scalars, and add blinding factors to them. The math behind this is not difficult — just tedious — and ends up giving us an inner product statement in the form of c = <a, b>. That is, we arrive at a statement where if the statement is true, then we know that v is in range of 0 and 2^n. You can follow along with the step-by-step math for how that statement is created in our range proof notes.

Inner Product Proof

In the range proof section, I mentioned that our goal was to create a statement in the form of an inner product, for efficiency reasons. Let’s go into more detail on what an inner product is, and how we can prove an inner product efficiently!

An inner product proof is a proof that c is the inner product of vectors a and b. That is, c = <a, b>.

This may be a helpful visual for what an inner product is:

Naively, a prover could prove this to the verifier by sending over a and b and c, and then the verifier could verify that c = <a, b> by computing it themself. However, this would take O(n) space to send, and O(n) time to verify, where n is the length of a and b. The great thing about the bulletproofs inner product proof is that it allows us to do this proof in O(log(n)) time and space instead!

The intuition for how the inner product proof is achieves this efficiency, is that in each step it halves the size of the a and b vectors it is working with. Therefore, it requires log(n) steps since after that many steps, the lengths of a and b are 1 (the base case).

So if we started with the original a and b vectors, and their product c, then we can divide each of the vectors into a hi and lo half:

And then, we get a random challenge scalar x that we use to combine the hi and lo halves of a and b to create a’ and b’, which also gives us a new c’ = <a’, b’>.

When doing the math to expand c’, notice that the first two terms of c’ are the same as c! Therefore, we can simplify the expression for c’ to be written in relation to c, and what we can call terms L and R:

In each round, the prover sends L and R to the verifier, and repeats the next round using the a’, b’, c’ as a, b, c. Notice how at each step, this halves the lengths of the vectors a and b!

After log(n) steps, we arrive at the base case, where a’ and b’ are both of length 1. Then, there is no more compression to be done, and the prover can simply send a’, b’, c’ to the verifier.

The verifier now has scalars a’, b’, c’ from the base case, and scalars L and R from each of the log(n) steps. The verifier can then reverse the process, starting at the base case. They can trivially verify the base case by checking that c’ = a’ * b’. They can check that the computation is done correctly at each higher step by verifying the calculation of c by using the c’, L, R from that step, until they have completed all checks.

To see the full math behind the inner product proof, read our inner product proof notes. To see the prover and verifier’s algorithms, read our inner product proof protocol notes.

Aggregated Range Proof

Aggregated range proofs are great for performance, because they allow m parties to produce an aggregated proof of their individual statements (m range proofs), such that the aggregated proof is smaller and faster to verify than m individual range proofs. The protocol for creating aggregated proofs is slightly more complex than creating individual range proofs, and requires a multi-party computation involving the parties. In our implementation, we used a centralized dealer to coordinate the communication between the m participating parties.

To see the math behind the aggregated proof, see our aggregated range proof notes. To see the prover and verifier’s algorithms, read our range proof protocol notes. Also of potential interest is our notes on the aggregation multi-party computation protocol and corresponding blog post.

Constraint System Proof

A constraint system is a collection of two kinds of constraints:

Constraint systems are very powerful because they can represent any efficiently verifiable program. A zero knowledge constraint system proof is a proof that all of the constraints in a constraint system are satisfied by certain secret inputs, without revealing what those secret inputs are.

For example, we can make a set of constraints (a “gadget”) that enforces that some outputs are a valid permutation of some inputs. Let’s call this a shuffle gadgets. In a simple shuffle gadget with only two inputs and two outputs, we could represent the possible states as the following:

If we get a random scalar x, then we can actually express this requirement in the form of an equation: (A — x) * (B — x) = (C — x) * (D — x). Because of the equality of polynomials when roots are permuted, we know that if the equation holds for a random x, then {A, B} must equal {C, D} in any order.

When we implement this 2-shuffle gadget in our constraint system, it looks like this:

In line 6, we get our challenge scalar x.

In line 8 and 10, we make two multiplication constraints: (A — x) * (B — x) = input_mul and (C — x) * (D — x) = output_mul.

In line 12, we make one linear constraint: input_mul — output_mul = 0, which constrains input_mul = output_mul.

For the full sample code of the 2-shuffle gadget, including tests, see our GitHub repo. For an overview of how and why we implemented constraint system proofs, read our blog post here. To see the math behind constraint system proofs, read our R1CS proof notes.

Cloak

The goal of a Confidential Assets scheme is to make transactions in which the asset value and asset type are kept hidden, thereby allowing for multi-asset transactions in which external observers cannot deduce what is being transacted but can verify that the transactions are correct. Cloak is a Confidential Assets scheme built using Bulletproofs.

Cloak is focused on one thing: proving that some number of values with different asset types is correctly transferred from inputs to outputs. Cloak ensures that values are balanced per asset type (so that one type is not transmuted to any other), that quantities do not overflow the group order (in other words, negative quantities are forbidden) and that both quantities and asset types are kept secret. Cloak does not specify how the transfers are authenticated or what kind of ledger represents those transfers: these are left to be defined in a protocol built around Cloak.

Cloak builds a constraint system using a collection of gadgets like “shuffle”, “merge”, “split” and “range proof” all combined together under a single gadget called a “cloaked transaction”. The layout of all the gadgets is determined only by the number of inputs and outputs and not affected by actual values of the assets. This way, all transactions of the same size are indistinguishable. For example, this is what a 3 input 3 output cloak transaction looks like to a verifier or a viewer of the blockchain:

This is what a 3 input 3 output cloak transaction would look like to a prover trying to make a proof of validity for a transaction with an input of $5, ¥3, $4 and an output of ¥3, $6, $3. Notice how the assets of the same type ($) are grouped, merged together, and then split and rearranged into the target amounts:

Cloak turns out to be surprisingly efficient: compared to a single-asset transaction (such as the Confidential Transactions proposal for Bitcoin) where only range proofs are necessary, the additional constraints and gadgets needed to support the issued assets add less than 20% of the multipliers. And thanks to the inner product proof, the impact on the proof size is close to zero. This is an illustration of the number of multipliers required by each gadget in the Cloak protocol:

To learn more about Cloak, check out its specification. To see the implementation, check out the open-source Cloak GitHub repo.

ZkVM

The goal of ZkVM is to make a smart contract language that allows for confidentiality. It builds upon previous smart contract language work, aiming for an expressive language that runs in a safe environment and outputs a deterministic log. It uses Cloak to validate that encrypted asset flows are correct, and uses Bulletproofs constraint system proofs to add constraints that values are being operated on and contracts are being executed correctly.

ZkVM is still being developed, and you can follow along with progress in the open-source ZkVM GitHub repo.

Summary

Hopefully this post has helped you understand how the Bulletproofs zero knowledge proof protocol works, as well as what we’ve been building over that protocol. This just scratches the surface; I encourage you to read more in our notes and dive into our repo if you have more interest!

Acknowledgements

I worked with Henry de Valence and Oleg Andreev to understand and implement the Bulletproofs paper, as well as design and implement the Cloak protocol. The protocol research team at Interstellar is currently designing and implementing ZkVM.

Thanks to Benedikt Bünz for answering all our questions about the Bulletproofs paper! Also, thanks to Andrew Poelstra for his feedback on this writeup.

In our previous article, we announced a pre-release of Bulletproofs 1.0, the Rust implementation of range proofs. We (Cathie Yun, Henry de Valence and Oleg Andreev) have been working on extending it to support proving arbitrary statements in zero knowledge using a constraint system, which we would like to share with you today. We are also excited to publish our work on the next generation of Chain’s Confidential Assets protocol called Cloak, which builds directly on top of these Bulletproofs constraint system proofs.

Constraint System

Bulletproofs are an optimization to an earlier paper by Bootle, Cerulli, Chaidos, Groth, and Petit, which showed that it was possible to prove arithmetic circuit satisfiability in the discrete log setting. Their paper introduced the logarithmic-sized inner-product argument, as well as a technique to convert an arithmetic circuit into a rank-1 constraint system (R1CS). The Bulletproofs paper optimizes the inner-product argument by a constant factor, and shows how to use Pedersen commitments as inputs to the constraint system.

R1CS expresses linear combinations of various variables and their multiplications. The Bulletproofs paper uses the following format for the constraint system: an array of n multiplications that gives 3*n low-level variables: left, right and output “wires” of each multiplication “gate”, and an array of q linear constraints between these variables and additional m high-level variables that represent external facts.

We realized that it is more efficient to bypass arithmetic circuits altogether and provide the API for building a constraint system directly. This way we do not have to construct the graph or arithmetic expressions and then transform them into constraints: higher-level protocols can often keep that graph represented statically by their source code and build constraints on the fly.

Moreover, since the matrices representing the constraints are usually very sparse, we only store the non-zero terms. The only operation that needs to be done on the constraints is flattening with a challenge variable, and the result is defined solely by the non-zero terms.

Variables

The constraint system has three kinds of variables: high-level witness variables, low-level witness variables, and instance variables.

Instance variables are public parameters, known to both the prover and the verifier. In other proving systems that require a setup for each constraint system, this allows public inputs to the circuit. In Bulletproofs, no setup is required, so there’s no difference between a constraint system with public inputs and a family of constraint systems parameterized by those inputs. This means we can internally fold all instance variables into a single constant parameter.

High-level witness variables are known only to the prover, and represent external inputs to the constraint system. In Bulletproofs, these are represented as individual Pedersen commitments to the external variables, for which we construct and prove some relation. For instance, in the Cloak protocol (described below), the transacted amounts are represented as commitments to high-level variables.

Low-level witness variables are known only to the prover, and are internal to the constraint system, representing the inputs and outputs of the multiplication gates. For instance, in Cloak these represent bits inside a range proof or intermediate amounts as they are passed through shuffle, merge and split stages. Low-level variables are computed per-proof and committed using a single vector Pedersen commitment.

Challenges

As noted above, instance variables can select the constraint system out of a family for each proof. This enables a novel approach: by generating some of them as a challenge from a verifier to a prover, the constraint system itself can be thought of as a challenge from a verifier to a prover, where some constraints are generated randomly in response to the prover’s commitments.

The use of challenges to parametrize constraint systems can enable significantly fewer multipliers, which makes the resulting proof smaller. For instance, a verifiable shuffle may require O(n²) multiplications in a static constraint system, but by using challenges we reduce the overhead to O(n) multiplications — inputs and outputs can be used as permuted roots of the polynomials that are randomly sampled at a challenge point and constrained to be equal:

{a,b} = {c,d} ⟺ (a−x)⋅(b−x)=(c−x)⋅(d−x)

Our implementation performs the Fiat-Shamir transform using Merlin transcripts to generate such challenges. The challenges are bound to the high-level variable commitments which are added to the transcript before any of the constraints are created. Then, the prover and verifier can compute weights for some constraints with the use of the challenges.

The use of challenges comes with an important caveat: the challenges are bound only to the high-level witness variables (the external inputs to the constraint system), not the low-level ones, so it requires careful analysis to ensure that the construction is safe. That said, we are working on an improvement to the protocol that would allow challenges to be bound to a subset of the low-level witness variables, and have a safer API using features of Rust’s type system.

Gadgets

The resulting API is largely inspired by the Bellman API used in Zcash: there is a single code path used by both the prover and verifier to allocate variables and define constraints, organized into a hierarchy of task-specific “gadgets”. This way the allocation, assignment and constraints on the variables all happen in one place, providing assurance that variables are not accidentally left unconstrained. In other words, each gadget can be verified independently, without having to analyze correctness of the entire constraint system as a whole (see also the caveat about challenges in the previous section).

Each gadget is a function that interacts with a mutable “constraint system” object represented by a trait. The prover and verifier use their specific implementations of this trait respectively. The gadget receives secret variables and public parameters, allocates and assigns variables, generates challenges and adds constraints to the constraint system object.

Gadgets can be composed. For instance, in the Cloak protocol, a “merge” gadget takes M inputs and M outputs and calls a sequence of M-1 “mix” gadgets that operate on pairs of values. Then, the whole collection of gadgets in Cloak is abstracted away with a single “transaction” gadget that takes all input and output values, which could be used either directly or as a part of a higher-level protocol.

The Bulletproofs library does not provide any standard gadgets, but only an API for the constraint system. It is the job of each protocol on top of it to create a collection of gadgets for its use and build a complete constraint system out of them. For an example of a protocol built using a collection of gadgets, see our Cloak implementation (described below).

Cloak

Cloak is the redesign of the Chain’s Confidential Assets scheme using Bulletproofs. We are making its implementation open source and calling it Spacesuit as in interstellar cloak.

Cloak is focused on one thing: proving that some number of values with different asset types is correctly transferred from inputs to outputs. Cloak ensures that values are balanced per asset type (so that one type is not transmuted to any other), that quantities do not overflow the group order (in other words, negative quantities are forbidden) and that both quantities and asset types are kept secret. Cloak does not specify how the transfers are authenticated or what kind of ledger represents those transfers: these are left to be defined in a protocol built around Cloak.

Cloak builds a constraint system using a collection of gadgets like “shuffle”, “merge”, “split” and “range proof” all combined together under a single gadget called a “cloaked transaction”. The layout of all the gadgets is determined only by the number of inputs and outputs and not affected by actual values of the assets. This way, all transactions of the same size are indistinguishable.

Bulletproofs constraint system turns out surprisingly efficient: compared to a single-asset transaction (such as the Confidential Transactions proposal for Bitcoin) where only range proofs are necessary, the additional constraints and gadgets needed to support the issued assets add less than 20% of the multipliers. And thanks to the inner product proof, the impact on the proof size is close to zero.

The work on Cloak and Spacesuit is far from complete, and now will continue in the open in our repository. To learn more about Cloak check out its specification.

Next steps

The work on constraint systems and Cloak is still ongoing. For the R1CS implementation, there are two major improvements that we will focus on:

First, we would like to extend the Bulletproofs protocol slightly, to enable committing to a portion of low-level variables using a single vector Pedersen commitment without an overhead of additional individual high-level Pedersen commitments. This will also come with a change in the API that would ensure that challenge-based variables cannot be inspected, preventing the user from accidentally breaking soundness of their gadgets.

Second, we want to enable multi-party proving of a single constraint system. This is different from the existing aggregation MPC that we’ve done for the range proofs: instead of aggregating proofs of distinct statements purely to make proofs smaller, we want to enable building a joint proof of a single constraint system by multiple parties, without sharing their secret inputs with each other. This not only makes the proofs smaller, but could also improve privacy in Cloak by enabling a zero-knowledge version of a CoinJoin protocol.

Further reading on constraint system proofs

• How to build a constraint system proof
• Prover and verifier algorithms for a constraint system proof
• Example: a proof-of-shuffle constraint system
• Example: Cloak constraint system specs

Thanks

We’d like to thank Sean Bowe, Daira Hopwood, and Jack Grigg from the Zcash team, as well as Mary Maller from University College of London, for their helpful suggestions and discussion.

Programmable Constraint Systems for Bulletproofs was originally published in Interstellar on Medium, where people are continuing the conversation by highlighting and responding to this story.

At Chain, we’ve been working on a pure-Rust library for Bulletproofs, which we described in a previous post. Our initial release only proved single ranges, but Bulletproofs allow aggregated range proofs. These harness the logarithmic size of the inner-product protocol to create a proof for m values that is smaller and faster to verify than m individual proofs.

The aggregation is performed by a multi-party computation protocol involving multiple parties and one dealer. Each party has a secret value and wishes to create a range proof aggregated with the others, revealing only a commitment to the secret value and not the secret itself. The dealer is a coordinating party that facilitates this process.

In our implementation, the parties share their commitments with the dealer, and the dealer generates and returns challenge variables. Each party sends its share of the proof to the dealer, and the dealer combines their shares using the inner-product proof to create an aggregated proof.

There are multiple ways to model these party and dealer interactions. One way would be to implement the parties and dealers as mutable objects, with a function that mutates the party or dealer state for each step of the protocol. But it’s possible to use this API incorrectly: to call the functions out of order, or forget to call a function, or to call a function more than once. Ensuring that the API is used correctly is made more difficult when running it asynchronously over a network.

A deviation from the protocol could result in invalid proofs, and opens up the user to potential vulnerabilities that might result in the dealer learning a party’s secret value. For instance, each party constructs a vector polynomial and reveals the result of its evaluation at a single challenge point to construct its proof share. However, if the party could be tricked into revealing multiple evaluation results (a multiple-evaluation attack), it would be possible to cancel out the party’s blinding factors to reveal the party’s secrets.

We wanted a foolproof model that would prevent users from performing any step other than the correct next step of the protocol. With this in mind, we modeled each party and dealer state as a distinct type, and used move semantics to enforce state transitions.

In Rust, objects are either owned or borrowed. While there can be multiple borrows of the same object, each object has a unique owner. When objects are passed by value, ownership is transferred to the new scope, and the old scope can no longer access it. This makes it possible to implement “consuming” methods which take self by value, and therefore can only be called once. In the party and dealer types, such methods consume the previous state and return the next state in the protocol.

Due to the Rust type system, we have a guarantee that a step of the protocol can’t be performed twice. Since the first evaluation consumes the object, rustc guarantees that it can’t be referenced to perform another evaluation. This ensures that the implementation is invulnerable to multiple-evaluation attacks. We also have a guarantee that the user can’t perform steps out of order or skip steps, since it is impossible to call a function on an object that is not of the correct type.

This is an example of an implementation of session types, a type theory formalism that was proposed to structure interactions over communicating processes. An overview of session types can be found here, and details on a more general implementation of a session type library for Rust can be found here.

Our implementation of aggregated range proofs is still at an early stage and will continue in a public GitHub repository. For more details about our implementation, see our aggregation protocol notes; for an explanation of how the range proof algorithm works, see our range proof notes.

Thanks to David Tolnay for pointing us to the Session Types in Rust paper, and to Henry de Valence and Oleg Andreev for all their work on the Bulletproofs implementation. This post was originally published on the Chain blog.