[Music]
okay thank you everybody uh is this good
can you hear me okay so today I'm going
to talk about iio so this talk starts
with like an inciting incident so in
2013 or 2023 I took a trip to Marseilles
and I got really bad food poisoning I
was I was very sick and I had these kind
of like Hall inations that ordinarily
you need to pay like a lot of money to
get so it was either this or it was this
but I don't know which which one was the
culprit um but like so people think that
like your your stomach is actually like
a part of your brain that like the the
bacteria in your stomach uh it digests
food in a certain way and it
communicates with your brain which like
affects the way that you actually think
and after I had the food poisoning it
really kind of changed my life a lot uh
here are some of the changes that
happened so I started living alone I
live I moved to a new city to live with
friends I I stopped being a digital
Nomad and I had a a home for the first
time in like five or six years uh I
started to focus on health I found like
peace in my life that I didn't know was
possible to have I also quit my job um
and all of this was like precipitated by
me having food poisoning but I think
that it was more like another
contributing factor is that like I just
always want more from life like the
things that the things that I have or
the things that we have is is like never
satisfying for me you know so I I'm
always like searching for more um so
like so now I'm going to talk about like
some of the things that we currently
have that I think are not enough uh one
of them is the like the whole
programmable cryptography tool of like
proof of validity like this is a useful
tool but like we've been using it for
years and it seems that like we've we've
we're getting close to the limits of
applications like I'm very excited that
we have ZK EVMS and we have ZK rollups
and that we have this like whole proof
of validity uh uh ecosystem that's
that's growing but I don't think that
this has transformed the way the world
in the way that I was hoping that
programmable cryptography would change
the world another thing that I'm
concerned about is like zkid so I spent
a lot of time thinking about like well
why was the first blockchain thing a
currency rather than a reputation system
uh because I thought that like well a
reputation system is going to be much
more like free and open but the reason I
think is that like reputation systems
are inherently about like excluding
people and it seems that like this is a
difficult thing to like build as like uh
it it seems as less empowering than a
currency system which is like like free
for anyone to use basically um um so
like I'm less excited about doing like
private identity stuff and because it's
inherently about like excluding
people uh so like last year I spent a
lot of time thinking about like what
else could we have you know like what
was the future what was a better future
for us so this time last year I gave a
talk about it's called 2pc is for Lovers
and it talks about how we can use FHA
and NPC to have this like multiple party
hallucinated server where you have this
like encrypted computer that like you do
all of the operations inside the
computer and nobody knows what's going
on inside and like the talk is
interesting and it digs into this idea
and proposes some sample
applications uh but one of the big
problems with this whole direction of
work is that it required interaction so
like with MPC you needed to be online to
in order to execute the server and I was
I think like I'm currently most excited
about like having servers with many many
people uh Computing together and if you
wanted to have a server with like a
million people you just can't do that
right because a million people would
have to be online at the same time and
Computing together at the same time
which seems to me just to be completely
impractical because like someone is
going to lose their password or
someone's going to lose their phone and
you just won't be able to see the final
result or you won't be able to finish
the
computation but the thing that uh that
so so in order to overcome this the tool
that we need to use is IO which which is
stands for indistinguishable observation
which basically takes a away the
interactivity uh that we that we need to
have for hallucinated servers up until
now um so if you want to do something
new you have to do things differently so
the rest of my talk I'm going to talk
about like the the different things that
we're
doing uh so why don't we have it already
so it's hard uh like IND distinguish
alisation has been an open problem for a
long time recently in 2022 the first
practic or the first scheme from
standard assumptions was proposed and
this was a big deal in the IO world
because it was the first time that it
was like even theoretically possible to
do this but unfortunately the scheme is
Not Practical it would take millions of
years to like execute to to do a full uh
execution of IO an IO circuit um but
this is from standard assumptions so in
cryptography we're we we always try to
base what we're doing upon standard
assumptions uh but like actually in the
cryptocurrency world we won't really do
this so much uh in the cryptocurrency
world we we use a bunch of non-standard
assumptions that like the regular
cryptography Community would be very
concerned about and like two examples
are like the snack friendly hash
functions they use this very like crazy
kind of assumption that like we like the
rest of cryptography doesn't really
think about and also grinding is right
is another non-standard
assumption so like well the question is
like like another question to ask is
like why do we even need to assume
anything in the first place and the
reason for this is is that like when
like P equals NP question mark is like
this big open problem in computer
science it's like this kind of like
million Millennium prize if you're able
to prove like P is not equal to NP is
basically says that like some things are
easy and some things are hard and like
all of the easy things all of the hard
things are not actually just secret
secretly easy things uh so because we
can't prove that something is hard or
something is easy easy we're not able to
prove that like no sorry because we're
not able to prove that anything is
harded and or anything is easy we're not
able to prove that like specific things
are harded or easy and because of that
we're not able to to say that like well
this problem is hard it's hard to solve
this it's hard to decrypt this unless
you have the private key so what are
current assumptions we currently use
well we currently use a bunch of
assumptions that are based upon prime
numbers so elliptic elliptic curves is
like a prime number based assumption and
this assumption has been chosen because
it's been like an open problem for
hundreds of years for hundreds of years
number theory has been trying to figure
out to understand more about about prime
numbers and about like their
distribution or whatever and this is the
assumption that like most of our
cryptography is based upon because it's
just really high like it's been open for
a long time but like the problem is that
there's a lot of there's a lot of
complexity here there's a lot of
complexity I want to go back yeah
there's a lot of complexity here in
Prime not because it's just like this
kind of security by obscurity thing it's
this problem we've been trying to solve
for years and years and years and like
no one has made any progress on it so
therefore we think it's hard but like
I'm not like there's been like recently
more people have been trying to come up
with like simpler assumptions that are
Al that are also like we think hard and
like lisis is an example of this uh okay
now I want to go to the next slide
okay so like the lus assumption is that
much simpler than the prime prime number
based assumptions and they seem like
much more it it it intuitively it seems
to me like much harder but it's not like
but we can't prove it like we can't
prove that anything is hard so we just
have to base everything on these
assumptions um it seemed yeah so like
one exam so what does it take for like
an assumption to become like a standard
assumption so it took about 10 years for
the lce based assumptions to become like
standard although like many people in
the cryptography Community are still
very skeptical about luses for example
Daniel Bernstein is just like does not
is not confident
in in lce based uh
cryptography
um yeah so like this slide I don't know
if I have time to go deeply into it but
it's basically claiming that like AI is
more dangerous than quantum computers
because for cryptography because
like if AI seems to be a tool to like
teach people and that seems to me like
inherently more powerful than a tool
that's like able to do compute compute
so like I feel that like this like I
make a prediction here that like well in
the next 20 years AI is going to make
break more stuff than quantum computers
will um I think this is a good this is a
good bet um but like it means that like
the the assumptions that we that we
previously had uh we need to be more
careful about right because like we're
we're going into a world where where the
like old this has been hired for a very
long time might not CH might not be
remain being the case as Okay so
right so so like basically I've become
open to to using like non-standard
assumptions to build IO and the hope is
that like we will be able to here's a
list of papers uh and and and basically
the way it works is the top uh from top
to bottom is from like standard
assumptions to like more exotic
assumptions um yeah and here's our
implementations of the various schemes
but this is in no particular order I
should have ordered this better
uh yeah so like basically our goal is to
like Implement these schemes and to like
break them or or try to find and then to
build tools to build things on top of
the schemes so like we have a we have a
bunch so so we're announcing this bounty
where we've implemented the first paper
or the last paper on the list the most
like a uh extreme assumption on the list
before it's called local mixing and
basically you can take take a circuit
with 1,000 Gates and OBS fiscated it
which basically means that you add like
Randomness to the Circuit until the
circuit becomes 230,000 Gates and then
basically the challenge is to take the
230,000 gate circuit and reverse it to
the 1,4 gates circuit right so be able
to remove all of the noise while
maintaining the functionality of the
circuit and we claim that this is really
hard and if this is really hard it's
it's basically like indistinguishable
ofation we can build a bunch of cool
stuff so this is a a boundary that we're
just announcing today and so the the
price is $10,000 for someone who's able
to do this and this is a a collaboration
between these three groups phandom Zone
ZX and the eum
foundation uh yeah so well what would it
mean if we were able to do IO um we
would basically finish cryptography and
the reason like okay so here's how to
think about this so basically you can
model IO has like a trusted third party
that you can actually trust so Z you can
Al you can model zero knowledge proofs
like this but the party is more limited
so if you have a trusted typ party that
like does some compute and verifies the
compute for you then that's like that's
like what a zero knowledge proof is but
with with I with with like once you get
to IO you have a that's able to do
basically everything they're able to
verify computation they're able to
they're able to like do multiparty
computation stuff they're able to
maintain secrets and only use the secret
under certain
conditions
um so IO is basically very close to the
end of what we of what we would need uh
or is close to the end of programmable
cryptography uh and like I don't know
what I'm like I I feel like this is like
the last big Quest it's kind of like you
know that in history there was a time
when people thought that there was there
was just more land that people didn't
know like people were like exploring the
world and there was just more places to
go you could always like go further west
but then at one point you just got like
to the end of the world and then it was
like what do you do like what do those
people do like imagine that you're like
you're like yeah I want to live a life
of adventure and then you get to the
west coast of the US and you're just
like done like what
next I don't know but I feel like no
matter what I will not be happy because
no wants to finish programmable
quotography less than I
do okay so uh while you're in Thailand
there's all these opportunities to have
these like life-changing experiences so
go to the night market and and don't be
too
careful
uh so there's two more there's a couple
more talks about this um there's 2 p.m.
on stage 6 today at J is going to talk
more about the Bounty he's going to dig
into like how local mixing works and a
bunch of and and like a bunch of things
about like the the scheme itself like
the we don't have any tools yet that
people can like build applications on
top of um at the moment we're still like
we just made the simplest possible
circuit but it's reasonably practical
the the the thing the thing that takes
the most time is actually doing the
obfuscation to run the circuit it's just
like a 2,000 260,000 gate circuit that
you execute so like the performance is
pretty good but like that said it is a
very extreme assumption that we're
building on I think that like our plan
is to imp sorry let me go back and show
the show the other
papers so we already did local mixing
but our plan is to sort of work up from
like most extreme assumption and most
practical or least and most practical to
to less extreme and least practical and
hopefully somewhere along the way we'll
find we'll find something that's that
like is in The Sweet Spot uh I'm
confident that we'll be able to find
something that works uh from standard
assumptions but I think that like it's
important to start and like our goal is
to like have a bounty for a bunch of
these different schemes and always have
one that's not being broken or like
always have two that's not been broken
and just like continue this effort
because like the the lattice based
assumptions uh it took like 10 years to
go from being like kind of crazy
assumption to more useful or like more
more accepted so we're hoping that like
we'll be able to like navigate a similar
trajectory
here
okay okay yeah so there's more talks I
think on uh Tomorrow there's a bunch of
talks about IO that would be interesting
for people to check out
um yeah I have a little bit extra time I
can take some questions or I can talk
some more if I remember some other stuff
I wanted to
say thank you so much Barry thank
you this presentation was very complex
for my non technical brand but actually
the audience here have added very cool
questions and the first one here that I
wanted to ask was was you know like a
definition what is an what's IO and uh
pretty much an explanation if you could
do like an explain like M five that
would be helpful sure uh so iio stands
for indistinguishable OBS fisc and it
basically means like encrypting a
program such that you can execute the
program and you can get a an output that
you can that is not encrypted so like no
one is able to see what the program is
doing but what you get out is something
something that you can understand so
basically it's like FHA but in a non-
interactive
way like another way to think about it
is I can give like the formal definition
but maybe we should go to the other the
the next question let's just take the
next question another question here what
does IO replace
ZK ah so IO kind of includes ZK so
there's ways that you can use IO to to
well it like it depends what you mean by
ZK because people abuse the term to mean
a whole bunch of things and like I used
to do that too well I don't know if I
did used to do that too but yeah okay so
if you mean zero knowledge proofs as
just like a proof that a computation was
done correctly then then it's like yeah
you can do you can you can do that with
IO but IO is much more than ZK it's it's
more powerful because like another way
to think about this is ZK is like a
single player thing that I can prove
about things that I know I can show
people things that I know and other
people show me things that they know but
there's no way to do like a
collaborative proof there's no way to do
a multiplayer things right and like iio
basically lets you do like multiplayer
stuff so you can do like all these
interesting Co coordination
things well you got here some love from
your psse colleagues and I have another
question for you so Quantum machine
learning will break more things than AI
or qu to each alone sorry
Quantum machine learning will break more
things than AI or Quantum by
themsel will break more AI or Break It
on its own uh I think that like AI by
itself will break more than than than
quantum computers by
itself does IO not rely on any
assumptions yeah yeah yeah it does IO
relies on a bunch of of different
assumptions like all cryptography lies
on assumptions except for one time pad
which doesn't rely on any assumptions
is there any physical heart limit to how
fast cryptography ZK Etc can get uh yes
it can like ZK cannot get faster than
the than the thing you're trying to
prove you at least have to like
calculate the
witness um or you need to be able to
like do the
computation
um ZK has that limit and so does
everything I guess I suppose that like
you at least need to understand what
you're trying to do I need to think more
about like the io case to have like a
more coherent
answer when will IO happen one year five
years how would you define a prediction
market for this H yeah that sounds good
uh an IO prediction Market I think that
like we like it did like I think the key
thing to ask in that question is from
like what kind of assumptions that like
we historically we've had a whole bunch
of IO schemes
that have been from like standard from
non-standard assumptions but they've all
been broken um so I think it's just a
matter of time on like so so like that's
the important thing to include if you're
thinking about when you're asking this
question so from like nonstandard
assumptions I think pretty soon like
it's already the case that there's
practical IO schemes from non-standard
assumptions but we don't know if they'll
be broken or not so like that's another
interesting thing we could do prediction
markets of whether a particular
assumption will be broken that could be
really fun
um yeah do we need eteron if IO works
yeah yeah I think I think that there's
still these things kind of like add
together uh so there's a couple of
things that IO is not able to do one of
them is like data proof of publication
or data availability uh cryptography as
far as we know is not able to make sure
that you have published something
because that's like a it's it's like an
objective reality to be confident
something has been published is not
possible to do with just compute you
need to have some consensus so ethereum
is still useful for
this what are you personally excited to
work on almost the end of cryptography
research is reached I don't
know I don't know yeah I don't know I I
feel like I'm just secretly going to try
and sabotage our efforts
yeah there is a lot of questions here
but I do wanted to find one maybe like
one last
question if you can compare IO with food
what would
be
[Music]
um I don't know probably the hardest
question you've got in this I see it
seems to be some kind of like food that
consumes all of the food so like
atoms yeah okay yeah yeah okay carbon
yeah that's a good that's a good closing
for your present bar thank you so much
it's very cool to learn more about IO
everyone give it up for Barry