[Music]
hello everyone so in the next 20 minutes
we're going to be talking about the role
of programmable cryptography in DC
programmable cryptography has been
talked about in this conference um you
know in relation to ethereum consistent
protocols and trust mization and um I I
just want to perhaps add the stage um to
say that cryptography is fundamentally
about trust minimization and there is a
new category a new wave of cryptographic
schemes that can help us better minimize
trust in different settings and uh maybe
perhaps the the first thing that we'll
do here is to introduce our our panelist
muu and muu has worked for over a decade
in cryptography and maybe can you tell
us briefly about your background and you
know your experiences in in these
cryptographic Primitives yeah uh thanks
V uh my name is Mutu uh I'm a professor
at Josh toown University and founder of
a zero knowledge company Le hero um I
did my PhD back in 2004 uh under Rafael
Pas who is a student of Sylvio mikali uh
I've been doing research in zero
knowledge and multiparty computation for
I think two decades uh now and
um I think uh one of the things for me
just blockchain ecosystem and the
ethereum ecosystem is that these these
Primitives that we have studied that was
discovered in the 80s are really coming
uh to life uh but today I I guess uh we
are going to talk about more advanced
Primitives um which I would also include
like from FHA to Fe witness encryption
and indistinguishability of fation yeah
so perhaps let's dive straight into it
so I think um most of of us here
probably have heard CK zero knowledge
and MPC multi party
computation and uh to probably to a
certain extent FH right fully homeor
encryption can you explain um the
landscape there and and also uh
functional encryption winess encryption
and inity officiation what do these
things actually
do so when you think of encryption it is
one way to look at it is that uh with a
secret key you get sort of an All or
Nothing functionality if you have the
secret key you can retrieve the entire
message if you don't you don't you get
nothing these Primitives functional
encryption and witness encryption you
know push these encryption schemes to
what we like to call now programmable
cryptography so let's start with W
witness encryption so what does witness
encryption allow you to do is to encrypt
a message with say a puzzle and the idea
is that you'd be able to decrypt this
encryption only if you know the solution
to the puzzle and this is really
beautiful because you don't need to give
a secret key to anybody the secret key
is the solution to the puzzle now what
could this puzzle be in the in the
context of let's say uh Bitcoins Etc you
could imagine that you know I want to
lock some amount of money for anyone who
can solve uh say the reman hypothesis so
now you can imagine that anyone who can
solve it gets the solution and can
decrypt and get a message which is a
transaction paying you some amount so
witness encryption pushes the boundary
of encryption to the point where I can
now not give a secret key but just be
able to decrypt if I know the solution
to a puzzle functional encryption and
indistinguishability of vcation I'd say
is like a little bit of mother of all
Primitives like they you can construct
one from another and also do a lot of
things so functional encryption allows
you to generate like a programmable
secret key this is how I think about it
so what happens is that in a functional
encryption I can encrypt a message and
then I can generate a secret key for a
Target functionality and this secret key
will allow me to decrypt any encrypted
message to reveal just the function
applied on the message so if I say some
function f i can generate a secret key
secret key F that if I hold this for any
Cipher text or any message that's been
encrypted in the scheme I can learn F of
F now when this was discovered or when
this was defined Etc one of the classic
examples is uh spam filtering so I can
have the cloud just have a targeted sort
of secret key to see whether when an
encrypted message or uh comes to my
inbox to do spam uh filtering but as you
as we will talk today you will also see
that this functional encryption also has
other uh powerful uh uh applications now
industry inability of fation I would I
would say probably is higher than
witness encryption and functional
encryption it actually has this promise
that I can take any program and
obfuscate meaning that I can give it to
you in a way that you cannot reverse
engineer the original code now you
should take it with a grain of salt pure
obfuscation is impossible so if someone
comes and says hey can I use
indistinguishability obfuscation to
replace tees this is not true so yeah I
think there's a lot to unpack unpack
there continue
um so indistinguishability ofation I
want to say is that it's something that
um it tries to find the right definition
of obfuscation that is both realizable
and um actually does have meaningful
consequences I'll just stop with the
definition of indistinguishability
obfuscation it says that I can obfuscate
programs in a way that I will not be
able to distinguish the obfuscation of
two programs that have identical
functionality and it seems pretty weak
but this this form of obfuscation
already can give you witness encryption
functional encryption and uh a lot of
other things so just to recap at the
high level if we have
officiation then that implies winess
encryption and functional encryption um
what about the other way can can you
some of the landscape so actually a
strong again uh with just like with aisc
even functional encryption there are
different definitions are different
levels of security if you go for like
sometimes the strongest form of security
it becomes impossible but for a certain
kind of functional encryption actually
you can construct in distinguishability
of vcation so in that sense I would put
both of them in the same category and
both of them imply witness encryption
and going back from witness encryption
to these things are harder got it so
witness encryption is kind of the
easiest to get and then functional
encryption iio alisation could be
equivalent depending on that definition
so perhaps let's zoom in on wi
encryption uh for now and I think one
use case that really spark my interest
uh in actually looking at wi encryption
is um uh and actually being able to
extend the existing protocols without
actually running MPC so one example of
this is uh in ethereum we have B
signatures we have already a lot of
Auditors with existing infrastructure
and and uh and and the question is can
we actually encrypt to uh a side of
these valuators
and and there the condition right the
puzzle that that you described before
would be has enough notes signed a
message um so that you would then be
able to to decrypt um and so I think
that's one application where people have
proposed where we could use wi
encryption so just looking at this
particular use case can you describe to
us is this is is this uh feasible right
now do we need custom scheme or do we
need generalized wi encryption um so I
mean just uh probably before the tldr is
that actually this is one of the recent
advancements where witness encryption
for a specific language can enable
exactly this functionality which is that
let's say that I have n signers for
something and I want to be able to
decrypt something as long as I have say
t out of n signatures I can encrypt a
message and the puzzle really is that I
need to have t out of end signatures and
there has been a recent construction
even implemented to show that this
functionality is uh is feasible but let
me just say that general purpose witness
encryption would be to ask can I do this
for an arbitrary puzzle and the answer
is today we only know how to construct
that from obfuscation itself so G
purpose witness encryption is still far
from being practical but for this
specific application it is possible to
do it and I want to say that if you also
Trace history witness encryption it goes
back to even like when you think of cca2
encryption it was a limited form of
witness encryption and since then there
have been some progress but I want to
say general purpose witness encryption
is still uh far way out well definitely
zooming on that um in a later question
but so let's go to functional encryption
and appication I think one of the more
recent uh proposals that applies
functional encryption is to actually
adds features to bitcoin to for it to
become more like ethereum right so there
this thing called Bitcoin Covenant which
is not uh feasible on bitcoin today and
people have been proposing to use
functional encryption to to get
confidence for Bitcoin and the use case
there is to say that ecd signing key
must be used in a certain way uh only if
a condition on the signing messages is
true so this requires computation on the
message to be signed a condition to be
checked and uh a signature to be
generated as as the the function to be
computed um can you comment briefly on
this particular use case and whether
that is feasible currently using
uh using alisation or functional
encryption okay um it's going to be hard
to comment but I will say that um if you
look at the construction I want someone
to implement it to really see the
overhead although just looking at how I
have to implement the circuit I need to
embed arithmetization of One Prime to
another Prime for elliptic curve
operations I think the overhead the
margins are going to be a lot but that
should not deter people from trying to
uh uh implement this but just to maybe
give a rough idea of not the
construction but um where it comes from
functional encryption is that so
functional encryption again just like
witness encryption if you want for
general purpose polinomial size
computation you the only way we know is
to do it from indistinguishability
ofation but uh a very restricted form of
functionality is an inner product okay I
take two vectors I want to compute the
inner product can I do this under uh can
this be the function and can I do this
under uh functional encryption and there
are constructions actually there are I
want to say feasible constructions to do
this now this recent work that has shown
that we can implement this functionality
that we said where if um a certain
condition and this condition really you
can think of it as verifying a zero
knowledge proof then I
will sign a particular message and this
can be again translated into whatever
functionality you want in the under
uh blockchain layer and just using this
inner product functional encryption you
can construct uh one that can do this
functionality which is verify a certain
kind of proof and then sign say under
the Snore signatures which are needed
for uh the Bitcoin protocol again I want
to say that um the fact that these
Primitives can be useful for these is
not surprising these are like really um
uh very strong Primitives that have you
know really a vast range of applications
but discovering where it is practical
and feasible uh is still really an
ongoing uh
research got it so perhaps let's zoom
out um a little bit more to more diac
the con of DC more broadly I think one
way to look at where we can apply
programmable cryptography is wherever a
te has been used right so there's two
angle to this um if a te is currently
needed can we remove that uh Reliance on
the te and you know we're else can we
insert this trust execution environment
um where it's actually could actually
use cryptography right and so can you
actually comment
on the difference between trust
execution environments trust Hardware
versus programmable cryptography using
officiation so as I mentioned before
right te can give you what is called uh
close to what's called a blackbox of
fisc and that's a technical term but
what it really means that it can give
you access to a just the input output uh
behavior of a functionality now in
general if you want to realize it
without any hardware assumptions it's
impossible so uh indistinguishability of
fation cannot serve as a replacement for
uh for tees but uh I think maybe I want
to make a Spiel here of a larger point
in general in this area and also
probably because of my sort of
background here is that uh when we all
studyed like zero knowledge and MPC
actually MPC in my mind can solve most
of the things that we want now witness
encryption functional encryption IO all
of these help to address
certain adversary or certain um uh
certain kinds of attacks on the protocol
actually it can minimize interaction it
can help you interact with smart
contracts better Etc but I think if you
look at MPC on its own can solve a lot
of these so when we think about these
Primitives we also need to understand is
it that this attack Vector is why these
Primitives are crucial again I mean I I
don't want to comment on that but this
is something that people have to
understand and even when you have to
implement things like witness encryption
and functional encryption there is going
to be a dkg component the dkg assumption
is no different than what you will have
to make for MPC from a security
standpoint you're going to say hey up to
n minus one of the parties are going to
be corrupted or up to like half of them
are going to be corrupted so from at
least from a number of collusions Etc
these like when you compare MPC and
witness encryption and functional
encryption for these things you can't
put them on the same place and I'll also
say that MPC today is far more efficient
than it was I want to say like when I
started studying uh MPC so when when we
are thinking about these applications
and these great Primitives uh I would
post this question that hey can we
device first an MPC solution can we
deploy it can we see is this enough like
is this are already going to give you
certain meaningful privacy guarantees
yes at the cost of maybe some denial of
service attacks but uh I do think that
in terms of even realizing the potential
that we are seeing of these things to
look at uh MPC so is it correct to say
that there a spectrum uh from trust
trust it something that requires a lot
of trust to something that's very trust
minimized where uh you know we we
actually rely on math in the middle is
NPC right NPC still realiz on
mathematical assumptions but we actually
ask certain notes to be honest right and
there's ways to hold them to be
accountable if if they behave
dishonestly which is actually quite open
research area the notion of accountable
MPC which I think is is actually you
know within the the the same category of
program graphy um we should do
applications first using you know more
trusted uh w Battle tested Primitives
and then move to things like
obilation um so maybe in the in the last
couple minutes um let's explore the
actual feasibility of these more
advanced Primitives um I think the first
result that's peer reviewed and accepted
by The Wider cryptographic community
that says IO tication is possible came
from 21 right and can you comment on
what has happened since then uh has
people implemented this this primitive
and and what is the performers like uh
yeah actually um my when I was doing my
PhD my PhD classmate uh hu Lynn she is
one of the authors of this 2021 uh paper
that solved indistinguishability ofation
but one needs to actually understand
what did they solve right when you say
that can I realize in distinguishability
ofation it was like you know at least a
decade back they showed the first
candidate construction based on
multilinear maps but then after that
there was this huge cycle of people you
know trying to Define what is the
security of multilinear maps it you know
there were constructions they were
broken there were constructions they
were broken the officiation construction
itself wasn't broken but the Assumption
was broken so really in the theoretical
Community it was about trying to find
the falsifiable Assumption based on
which you can construct OB fation and
the JIS paper in 21 came up with the
first set of falsifiable assumptions and
I just want to say as a cryptographer
for us our bread and butter is about
getting things using falsifiable
assumptions and that was the huge
breakthrough in JLS 21 that you could
construct aisc based on falsifiable
assumptions but if you look at this
construction it requires four different
things LPN LW bilinear Maps like several
cryptographic assumptions went into
constructing this and now since then
what people are trying to do which again
is one of the other sort of really
motivating questions in cryptography is
to minimize the cryptographic
assumptions you don't want to assume
four different things and a more recent
line of work is trying to get another
flavor of a single assumption which is a
latus based assumption to construct
officiation there are again candidates
but it's kind of going a little bit in
the cycle of multi-linear maps where
they Define something it gets broken
they Define something but you know this
is a cycle that you know Theory people
are used to uh in terms of these uh
constructions but just to uh you know
wrap up with the Practical feasibility
of this we are far from alisation being
practical I want to say that there was a
paper I forget now maybe six to seven
years back in crypto where they showed
they did construct an offis that could
do five operations and I mean like
really five gates uh of uh of
computation and that took like hours uh
hours to run using uh multilinear maps
and that being said you know definitely
research should still go into uh you
know making these things both reducing
the assumptions but also trying to find
out in a limited form can the these
things still be practically
constructed so you know a counter part
of that is if you look at 10 years ago
you know maybe 15 years ago people said
the same thing about a and nck and you
know the land has really changed do you
think the same thing will happen for
ofation and and are there enough
cryptographers actually working on
this um that's a great question I will I
will first say that I will not bet
against cryptography I know all the
researchers in this field they're making
tremendous progress uh in doing this but
will it accelerate as much as zero
knowledge and MPC uh I think that's a
little bit of a different question it
really comes from is the community
invested in solving that problem let's
take the the bit bit coin signing
example you don't have this particular
op code that you want that will allow
you to verify zero knowledge proofs uh
in my opinion well if the Bitcoin
Community are willing to bring opcat you
can now verify uh zero knowledge proofs
that is uh to me an easier path towards
that particular goal than trying to make
a functional encryption problem uh
solve well I think