[Music]
thank you for the introduction um that
was quite I think it's uh I should have
wrote to someone earlier to ask if I
don't go after Amir because like it's
really hard to follow somebody who's so
full of energy and so full of like good
ideas and yeah principles that we should
follow more and
more um so yeah I will talk to you about
MPC basically um some some of the tools
that can provide some of the Privacy
expectations that the cipher Punk values
might actually benefit from um I'll give
you an educational tour of MPC so from
auctions to ZK my a
toz
uh I don't know if it
works is there a way
sorry is there some
um special
trick
this
yeah okay
hello so I go back to the start so yeah
I want to give you a bit of an overview
of uh NPC from A to Z which uh if you
know about NPC use cases it's from
auctions to zero knowledge and so one
thing I wanted start by and maybe uh
this room kind of appreciates this is
that cryptographers are not Cipher punks
and I think I come from a background of
cryptography and there is a tendency in
the cryptography Community to think that
because we build the tools that can you
know help us exercise the freedoms and
the cipher Punk values that we want um
we do feel like we are some sort of
rebels but after quite some time now I
kind of realize that's not actually the
case mostly what people like what the
cryptographers actually like to do is
push symbols around to try and make some
proofs of security and feel uh smart and
so this is uh this is great and it's
really cool that we have a secure
protocols but it does not make them
Cipher punks and it does not result in
the sort of Freedom tools that the
cipher Punk values maybe need and the T
types of things that Amir was talking
about just
now um so yeah cryptographers are not
Cipher punks and this is why I kind of
put it in this in this um in this
session in the cipher Punk session
rather than the uh applied crypto truck
and so I think in building uh kind of
Freedom tools or you know privacy
preserving tools it's important to kind
of understand some of the cryptography
and so yeah this is why I want to give
you some view of MPC so what has MPC
been used for and first of all does
everybody know what I mean when I say
MPC okay one two three people so NPC
stands for multi-party computation um is
there anybody like who has absolutely no
clue at all what multiparty computation
is okay one person at the very back
you're too far back to uh no but anyway
MPC is used for computing on encrypted
data so it started in the 80s with coin
flipping mental poker comparing integers
small things and essentially what it is
is that you know a user Alice has some
data in her local device or in her
machine and whatever machine she can
Secret share it to a network and this
network communicates nodes in this
network communicate to do computation on
her encrypted shares and they produce a
result this is it
essentially and so the first large scale
kind of practical example of this was
the sugar beat auction which was run in
2008 and this was a double auction to
determine the market price of sugar
beads um it was an NPC you run between
farmers and a sugar processor and
researchers in Denmark um it was super
nice because everybody agreed that this
was kind of needed and useful um the
farmers didn't have to reveal how much
they were willing to pay the sugar Pro
processors couldn't you know take
advantage of farmers and everybody kind
of won so this was a super nice um
example of an auction that was run in
NPC something that um could have
benefited from something like this is
let's say the Constitution da who lost
an auction because they revealed how
much they were willing to pay and you
know uh uh their competitors could see
how much there was in a public wallet
before and um another one was the Boston
wage study so identifying salary gaps
across gender and um ethnicity so this
was done in Boston they did uh NPC saw
like a private computation across uh
census data to try and analyze whether
there was a disparity between gender uh
wages across genders naturally they
found that there was um and they found I
think it was 30% maybe it's too small
here oh yeah it was 30% I think in 2016
when they first did this study um and
they did it again last year no 2023 yeah
last year and it had decreased to 21% so
by doing this kind of study um at least
you become aware of some problems and
then maybe you can actually start try
and solve them um which is quite nice
for
society um there was also an Estonian
student graduation so I don't know if
you notice we are also doing a bit of a
tour uh of different countries here and
these countries are where a lot of the
main NPC researchers are actually from
and so it's kind of interesting also
geographical tour of MPC but this uh
study was uh to try and determine if um
the Dropout rates in it studies were due
to people working at the weekends uh if
their part-time jobs were interfering
with their studies and causing them to
drop out and this was particularly
important in Estonia because they became
um much more technologically relevant
country and they needed a highly skilled
it Force but they had high Dropout rates
so they were really trying to increase
like uh the education of it Workforce
they actually found that there was no
correlation between these two things but
the which was a bit sad for the study
but like at least um we got a nice
example of MPC out of this so it was run
between the Ministry of Finance and the
uh
University so uh another one was then
then things start to turn a bit weird
and all of these things kind of had like
nice societal uh implications um but
then you know uh the tooling and the MPC
protocols became a bit more efficient
and they started being picked up by big
Tech and the Google so Google had this
experiment with MasterCard I can't
remember what year 2017 is 18 maybe
where they wanted to achieve the Holy
Grail of advertising so this was the
headline at the time and so Google as
you know has like a very predatory ad
model where they try to um mine things
from your information and the Holy Grail
of this ad model is essentially linking
um your online activity with your
payments Google doesn't have all the
payment information but MasterCard does
they can't compute together like
MasterCard would never be willing to
share uh people's information with
Google just in the clear um because it's
first of all illegal due to whatever
privacy regulations and consumer
protection reg regulations but Google
also would not be willing to share um
their information with MasterCard so
they had some sort of blocker where they
wanted to get around and they were like
okay we want to compute on each other's
data but how can we do this in a legal
way um so they did um an NPC between
some Google and MasterCard to do some
aggregate statistics so saying I show
you an advertisement for um some privacy
bracelets on your uh
browser um did you actually go to the
store and buy privacy bracelets or how
many people went to the store to buy
privacy bracelets after they saw this ad
so this was the kind of thing and then
another one um worldcoin Iris scanning
so this is maybe something that you've
actually now it's called world I should
have updated this but um this is where
an orb scans your eye and tries to do
some uniqueness checks so that people
cannot register more than once um they
got a knock on the door from some
regulator saying you know how are you
processing this data where is it all
stored and so then they decided to um do
some multiparty to split this data and
do some multiparty computation over it
and so these last two cases kind of
start moving moving towards the
dystopian maybe I shouldn't say this but
like Realm where you know people are
kind of doing MPC to sort of sidestep uh
regulation and so I think the
cryptographer point of view is a bit
like you know okay there are problems in
society and we have privacy issues like
just throw NPC at it like just throw
some crypto tools at it and that's all
fine like your problem is solved um but
I don't think this is necessarily the
case because like with the Google
MasterCard uh example there was really
kind of a lot of not uproar but like
discussion at the time about whether
this is actually good or not like um is
it good that now Google and MasterCard
can collaborate on our data okay sure I
can't be singled out it's not my data
necessarily but like um as a group we
all kind of suffer because Google has
more power and so this is a bit
questionable um so it's not really like
just throwing MPC or just throwing
cryptographic tools at a problem doesn't
necessarily solve the Privacy issue that
kind of underlies the whole thing and so
the question then I mean like I
think is it possible to solve these you
know like how do you start to think
about solving privacy issues or like you
know um adhering to these Cipher Punk
values with cryptographic tools and
there are some super nice examples which
maybe you have actually seen at this
venue so one of them is from cursive who
are um a small team team who are
building privacy preserving
applications and they are doing uh
private proof delegation so this means
that um actually you have these badges
or some stickers or some uh uh coar
bracelets or whatever they're downstairs
in uh in the main hall just after the
registration you can go and essentially
it's a a a chip that you can tap with
your phone you can enter your socials
and then when you tap other people's
chips you can do a private intersection
of your
uh common connections so the common
people that you've met and tapped and
then you generate approve on this uh
private intersection to prove how many
connections you have in common and then
you can write up the leader board rise
up the leaderboard and get some merch um
crypto conference style and but the
reason that this is interesting uh is
because you know as uh Things become a
bit more complicated the proofs get big
and actually your phone gets slow and um
you know these things need some
libraries for verification and proof
generation and all sorts of stuff so
sometimes it becomes a bit restrictive
to actually do proof generation on your
phone so then an answer might be well
why don't we actually start delegating
proofs and you see this a lot lot with I
think um the development of proof
markets so like all these proof Markets
started popping up over the last years
to say like ah hey we can you know have
some pure beefy machines that will
generate your proofs really fast for you
which is great but like if you have any
sort of sense of privacy at all this is
terrible now because now you're just
Outsourcing all your private data to
This Server who will generate proofs for
you very quickly but um yeah you don't
get any privacy here uh you Outsource
your proof generation but you do it in a
secret uh shared way like in this MPC
way um and you generate the proof over
those secret shairs and so um this is
being done now downstairs not downstairs
but like in the internet you can see it
downstairs um so yeah this just happened
yest today and when I say actually you
can Outsource this to a network this
network is not this uh mystical being in
the sky as it has been for the past 20
years now it is actually live um so
there's one Network that has run between
us T the cursive guys who built this
nice uh cryptographic connections app
and the psse group so each of us are
running um a bunch of notes that are
generating these uh proofs on these uh
secret chairs so yeah go down and see
them if you want to actually feel ly in
your hands there's also actually an MPC
exhibition that you can learn more um of
the
history so yeah actually what they're
doing is collaborative snarks generating
collaborative snarks which is just
generating zero knowledge proofs in an
MPC Network currently they are using our
tooling actually to do this which is um
available for circom so if you're used
to building circom circuits or noira
circuits which is up and coming and
getting lots of hype this week in
particular and now you can use our
tooling to do the same thing but in an
MPC environment
um so yeah that's snarks and so yeah all
the stuff that you will generate here
are clabber of snarks and so uh how is
all of this stuff actually leading to
these kind of new nice things that are
not just getting us around regulation
but like this actually cool solving
privacy problems kind of tech and I
think the most interesting thing that
MPC is kind of enabling now in this
blockchain world is this private shared
state so you have these um private
blockchains or l1s or l like Alo and
Aztec who now have zero knowledge smart
contracts and they have like private
State and sometimes public State and you
generate proofs on your private State
and you can do stuff with the public
State and interact and this is nice but
in a sense it's a little bit limited
because the zero knowledge proof is just
a statement about a fact and like it's
very difficult to actually do
computation with that and so um if you
can instead have a sort of MPC Network
where you can maintain your privacy you
can actually do more Leo you can
actually do computation on all of your
private State instead of just um having
zero knowledge proofs in public State
and so um you remember this picture from
before we had like one party secret
sharing their data to nodes in a network
now I think the interesting part with
private shared state is when you sort of
introduce other uh players or other
entities so now you can take um secret
like multiple people can uh share their
data to a network in a privacy
preserving way and the network can do uh
computation over that and I think this
is super nice because we don't have to
start revealing things to anybody we
don't have to we have like all full
general purpose computation and not just
kind of workarounds with Z knowledge
proofs so for me this is like the most
exciting thing that is happening in the
crypto world at the
moment so I think with that like the
Privacy conversations becoming super
nicely nuanced it's not like full like
privacy is not secrecy necessarily it's
like you're not like completely black
boxed and tied off from everything and
nobody can see my data and no one can
touch it and I can't even use it and
like you shouldn't learn anything about
me and it's not like fully open like
everything on ethereum if I interact
with the chain like everything is public
and everything is recorded forever um
now we're kind of finding this like
somewhere in between this All or Nothing
approach and for me this is super nice
because in my life in my day-to-day life
I come here I stand in front of you I
want to be seen at times but I also at
times don't want to be seen and I want
to choose like I want to have the option
to come and like um see people and I
want to share myself and my thoughts
sometimes but I also want the option to
not so having this sort of um and I also
want to sometimes avoid some people and
talk to some other people and whatever
like so having this um nuanced view is
super nice and so if you are sort of MPC
inclined but not necessarily A
cryptographer how can you start thinking
about these and I think one of the
things that we're seeing is like okay
you know I get excited and I'm like oh
look it's like it's live you can
actually use it now it's great um
everybody should do this like and some
people are like wait no though like
because I mean like Amir like he's
talking about super serious things where
people are like dying and whatever and
it's
like okay yeah maybe like my little MPC
Protocols are not for that case and like
the question then is like okay who are
your adversaries and how much power do
they have and so like I said to you
before that we are running these coars
on the network which is established
between oo um PSD and T and uh cursive
so in a sense you're Outsourcing your
work to us and you're Outsourcing your
data to us so in a sense you trust us
you trust us not to collude because if
we all come together we can reconstruct
your secrets and so one question that
you might ask if you're starting to
think about these things is like how
many people need to actually collude is
it like all of them is it just one of
them as long as one of them is honest is
it okay and so there are different
models and different tradeoffs that you
can make and different levels of
efficiency and things like that so
another one is then yeah like different
Notions of security so like okay if if
somebody can tamper with your system how
much can they do and so I think the most
common model of things that are running
now is this semi honest security so like
parties can become corrupt
but they will follow the protocol as
normal so maybe there's some information
leakage maybe you like learn some stuff
by uh observing the network but they
still follow the protocol and then
there's kind of the worst case situation
where you kind of try to protect against
militia security and protecting against
this means that or like adversaries that
can break Security in this sense means
that they can control and manipulate and
arbitrarily inject messages like they
can just completely destroy your system
so like if you are running an election
let's say in an NPC and you have a
malicious uh like if you um have a
malicious adversary they could you know
just change the results of your election
like you know you have nothing so if you
want to protect in this kind of
situation it's super hard and you're not
going to have much efficiency that's for
sure um so yeah what about efficiency I
think um I mentioned a few things the
worldcoin example the cursive example I
think these are two nice examples of
things that are running in production
which I think are the kind of things I
would hope the sort of Cipher punk
people would care about more than the
theoretical people who care about the
math um and so in saying that the
difference between specialized protocols
and like general purpose
computation um is quite different so
like you can do like highly highly
optimized stuff um as in the case of
worldcoin and they are doing un
uniqueness checks you do about 40
billion checks per second and okay that
translates to okay you have two eyes and
you know you have many readings and your
iris is pretty like uh data Rich um yeah
it's data Rich so it's a lot um and this
translates to I think about
15 people uniqueness checks per second
and so these curse of coars that we're
generating downstairs not downstairs but
in the network um are about 12 seconds
each but 11.9 like like the vast
majority of that is the witness
extension so this is like the actual NPC
part rather than just the proof
generation part so proof generation is
very fast but witness extension is not
too bad so this is where it's at now and
so uh that's it for me if you have any
questions I will be glad to take them
thanks very
much thanks so much for your
presentation Ash um we've got a couple
of questions uh here on the docket um
but before we ask those questions I
meant to actually mention one fun fact
about Ash here is that uh she actually
was an MC just yesterday so she knows
how it feels I know I know how you're
feeling right now after like 5 hours I
was like I don't remember anyone's name
I don't know what even this topic where
are we this was a great one though even
though it was technical um but the first
question here is when kir kir is now
there like now now you can use it so um
yeah if you go to the TSO GitHub you can
go and find uh kir and play with that
awesome and then what's the difference
between ZK with MPC versus FHA
computation
well um I did I I resisted saying things
about FH so is great and like is a
super ultimate goal for privacy because
even if like there is collusion in the
network stuff is still encrypted and you
cannot like uh it's like a better level
of privacy but it's hyper inefficient
well like it's uh it's super inefficient
so I think
um we saw at CK Summit recently if you
wanted to generate Zer knowledge proofs
in an environment it
was like like order of minutes rather
than you know tens per second so it's uh
just low and I think FHA is often
considered a specific example of MPC MPC
is super General so everything can be
cast essentially as MPC but uh yeah FG
is just slower thanks and uh the next
question is about NPC wallets is it the
future and what are your thoughts on NPC
wallets generally I also didn't mention
NPC wallets and I was going to make a
comment about that so for me I mean when
I mean MPC I mean like general purpose
MPC like general purpose computation for
me MPC wallets are kind of threshold
signatures and things like this so it's
a little bit of a special case and like
a kind of a sub um sub computation it's
just one type it's just generating
signatures essentially so it's kind of a
small part of NPC um super efficient I
quite like them personally we don't work
on any of that stuff but um I I like it
yeah they're cool cool um and there are
a couple of questions that are more
about the yeah your opinion on things
but first one is how do co- snarks work
how to co very briefly in like 20
seconds if you know how ZK works you
take the ZK and you split it over uh
three people like essentially like what
is needed to compute is zero knowledge
proof is essentially linear so you just
do it three times and you communicate
and you get one proof in in a
nutshell okay and what do you think of
te or
T and what is tea did this question come
from someone who knows me or someone who
doesn't know me that that makes all the
difference so te is a trusted execution
environment and it's like a super Hot
Topic at the moment um I think they're
wonderful and um no so the thing is with
tees they're great and it's a it's a
Super Hot Topic at the moment they're
quite easily breakable so I have
sometimes been critical of them in the
past which is why sometime I'm wondering
if this is someone who knows me but uh I
think it's good like so with the coars
we talked about um the collusion problem
and you know I said that in this network
let's say that we are running now you
trust the three of us not to uh collude
and so tees are one defense against this
if you sort of run the MPC in a te
across you know the nodes and the
network um it's one nice defense and
also like
I as I said te can sometimes be a bit
weak um if you use three of them from
different uh providers then like spread
them around the world it's also a lot
better so ultimately I think um yeah
we're going to see that happening very
soon cool thank you and um I think we
have time for one last question how does
the MPC Network receive private data is
it in the encrypted format for snark
generation
yes simple um I mean it's encrypted like
across the internet but overall like
before that even from your phone it's
sent it's split into secret shares which
is seen as can be cast as a form of
encryption so essentially you encrypt it
on your phone or your local device and
then you send it to the servers cool
okay I think we got one time for one
more can we remove initial trust set of
MPC what's the initial trust set I
wonder um so like if you talk about like
the collusion issue um I think that's
what they're implying is the collusion
can you remove it I mean everybody's not
everybody's working on it but like this
is the big problem in NPC at the moment
um can you remove
it never fully I'd say um but uh yeah we
try I mean one there are different
options like running things in tees you
can start thinking about economic
incentives for people not to collude um
but yeah this is a is a problem cool
well thank you so much Ash and uh thank
you you're a better MC than me you did a
very good job thank you but you can find
out