[Music]
hello um welcome back um
so today I I would be talking about
Phantom Zone uh but before I sort of
like dive deep into Phantom Zone and
talk about the rest of the things I
would uh sort of walk you through the
motivation behind Phantom Zone so
if you guys are familiar with globally
mutually trusted third
party I would want to introduce this you
to this idea of globally mutually
trusted third
party what is this m globally mutually
trusted third party well it provides you
three
guarantees the first thing that it says
is that whatever information you send to
this third party it will always keep
that private it would not leak it to
anyone the second guarantee that it
provides is
that all the information that it has
collected over time from different
people you know we have been suing this
globally mutually trusted third party
all the information let's say for a year
all the information is collected for all
these years it would always keep the
private and would not allow anyone to
poke inside its tight inside its
memory and the third guarantee that it
provides is Mak makes this particular
party very magical is that it you can it
can compute any arbitary function we
want it to
compute as long as we provided enough
authorization to be able to compute that
function and we only output the
necessary
outputs usually I sort of like refer to
this this mutually Tred third party as a
mutually shared computer and if you guys
are familiar with something called the
god protocol this is the god protocol
this is a picture from xabo back in
1987
um so first observation to make is that
if you really want these three
guarantees uh to be if you really want
this party to be globally mutually
trusted we want this party to be party
to be able to prove these three
guarantees to any individual without
requiring any additional interaction
which is why we require cryptography we
cannot just make it on certain legal
agreements or something like that we
require cryptography for building this
the building this um globally mutually
trusted shared
computer and we started to build Phantom
Zone to eventually build the god
protocol but to stick within the Realms
of practicality we could only build an
Abridged version of
it so for the rest of the talk I would
be talking about a what is fundom zone
why it is an a bridged version of this
God
protocol and the second important thing
that we're talking about is how can we
push the Frontiers to eventually build
the god
protocol okay so Phantom Zone The
Abridged version the key idea in Phantom
Zone is something called multiparty fph
encryption and for you to describe for
me to describe you multiart f encryption
I'll have to eventually describe what is
single party F
encryption in single party F encryption
you you have a single client you know
this guy over here they hold a secret
they keep the secret private to them
they can encrypt their information which
is a here with the secret and produce an
F Cipher text and then they can send
this F Cipher text to any server and the
server can evaluate an any arbitrary
function on their private input which is
a and produce an output Cipher text and
that the and the client can receive the
output surface and decrypt it so this is
single party FG
coming to multiparty F Well the key idea
in multiparty fig is that you split this
secret which is held private by a single
client in single party F among many
clients so you have s0 S1 S2 as secret
Shard split among these three people
over
here the first step in multiparty F is
something called Collective p uh public
generation so all these three parties
come together and they generate the
collective
publicy and and then all these three
parties using the collective public key
encryp their private inputs and produce
F Cipher text and then they then they
send their F cotex to the server server
executes a Mary function on the F cotex
and produce an F uh produce an F
output the key thing to notice here is
that all these parties would have to
produce a decryption share to eventually
decrypt the output cext here so they
produce the decryption share using the
secret shards and then they send it to
each other and then only they're able to
uh decrypt the art with Cipher text
because in this case the secret was
split among all these
parties so why is Phantom Zone an a
bridged version well because Phantom
Zone assuming that in the future we able
to add publicly vable Effigy to a
Phantom Zone can only guarantee the
three guarantees that I talk about in
the god protocol to only the holders of
the secret shots it cannot guarantee
these three guarantees to everyone
around the
globe which is why Phantom Zone is just
an abised version of
it okay so you might wonder how do we
build towards the god protocol like how
do we even do
it
well what I would like to say at the
moment is you know I would have loved to
say that you know after a lot of
research and a lot of like five years of
research we have figured of the solution
to get build the god protocol but now
like there no at lightening thoughts
here and there's one obvious answer to
building to eventually building the god
protocol which is program
officiation what's program
officiation well to Simply describe your
program
officiation let's just assume that you
have function f right what you can do
with program ofation is you take this
function f and perform some
Transformations on this function f and
produce an offs skated
circuit you can give this off circuit to
someone else and program Association
guarantees that the only thing that you
can learn from that offset circuit is
the input to Output map and nothing
else now you might be wondering why is
this useful because if the function is
Trivial then you can e easily learn it
from the input to Output
map program OBS cation becomes easy
become becomes very interesting when you
sort of like OBS secate a program that
is a cryptographic function for example
let's just say that I take
uh I take a function I take a function
that is that decrypts any Cipher text
that is encrypted to my public key right
so I take a function and this function
has my secret key and it decrypts any
cyhex that was encrypted to me using my
public
key and I perform certain
Transformations using prog tication to
this function and produce an obic
circuit I give this obic circuit to
someone else what they can do is that
they can decrypt any Cipher text that
was encrypted to me using this obus
circuit but they can never ever learn
what the secret is inside that circuit
they can never learn my secret
key
and
um and this is these are the class of
functions where program autic becomes
useful and I'll tie it to to building
the god protocol later in the
slides uh okay so now assume that we can
only build program officiation for some
limited class of functions you know not
for General class of functions but like
limited class of
functions I'll tell you one way of
building the pro um building the god
protocol using program
appication step
one modify the F scheme that we using
before to become publicly verifiable
what do I mean by that
well a publicly verifiable F schemes
does those things it evaluates the F
function which you know a normal F
scheme does in addition to evaluating
the function it also produces a proof of
correct evaluation so that anyone can
verify this proof with the output CeX
and be assured that the server that sort
of executed this F function EXA executed
did it
correctly and which I usually referred
to as proof Pi of correct
evaluation step two replace the
collective key generation operation that
we did in the multiparty F with a
trusted setup in The Trusted setup you
have arbitary number of people here they
perform some MPC protocol to produce FH
Keys the two types of FG Keys which are
very important public key and the
bootstrapping key bootstrapping key is
usually used for some sort of like F
operations that you can completely
blackbox the key thing here is that no
one knows the ideal secret key because
we're generating a we're doing a trusted
setup in NPC to generate these two
keys the third step is modify the
trusted setup to also output an
officiated conditional decryption Oracle
okay that's a mouthful I sort of like go
into it one deep one level deeper what
is an obsc conditional decryptor this
particular conditional decryptor is an
obsc program of the following
functionality what it does is that takes
an output Cipher text and a proof of
correct evaluation of FG
circuit it verifies whether the proof is
valid and decrypts the output cyhex if
and only if the proof is
valid and this sort of like tells you
why did we assume in the first place
that program autic may be feasible only
for like limited class of functions
because to build the god protocol like
to to build the got protocol using the F
route we only need program ofation to be
practical for this officiated
conditional
decryptor so we modify the TR setup to
also output this offc conditional
decryptor and that's it and another
thing to noce that this conditional
decryptor also has the secret key the
ideal secret key that no one knows
embedded inside
it okay so the end to end flow is you do
MPC to generate three things public key
bootstrapping key and the um and the
offc conditional decryptor which I now
realize is somewhat of mouthful uh I
should have chosen some other term
anyways the second flow is now anyone
can encrypt their private inputs using
the public key that is the output of the
MPC protocol so you multiple Cipher Texs
here and then they can send it to the F
server F server evaluates the F function
outputs the encrypted output in addition
it produces a proof because the F server
is evaluating a publicly verifiable F
scheme
um and then we Pro we we plugged in the
proof as well as the output to the to
the offc conditional decryptor and the
conditional decryptor would only output
the uh would only decrypt the encrypted
output if and only if the proof is
wallid so this is one way of building
the god protocol using publicly
verifiable F and program ofation for
officed conditional
decryptor so there's one way which I've
just shown you but we need new ideas to
push the Frontiers and to finally build
the uh to to finally build program
officiation or indistinguishability
officiation if you're familiar with that
here I've showed you just one way but if
you're able to come up with new ideas
then probably we can make program
officiation more practical for General
circuits not just for like limited class
of functions that we use before and
probably we can directly build the Cod
protocols from program officiation
okay so while I was exploring this field
of program officiation and
iio one key observation that I made um
this uh one key observation that I made
was that it's really hard to get
efficient program officiation from
standard
assumptions and we would inevitably
require exotic assumptions and I'll tell
you what are standard assumptions what
are exotic assumptions well a standard
assumption is assumption that has been
there for a while for example dlog the
street log
problem there's also there also exists
additional incentive for people to break
these stand uh standard
assumptions and exotic assumptions are
somewhat newer assumptions like they
have been only there for like five years
or not even five years like two to three
years
uh what we can do as a community to you
know realizing that we might inevitably
need need newer assumptions to build
practical program modification
is we can start examining these newer
assumptions start breaking them start
testing them or we can build
applications using this assumption so
that we can incentivize people to break
them and tell us whether they're broken
or not and then eventually in like few
years we would have candidate
assumptions that are newer assumptions
but they have become then standard using
which we can build practical program
vestigation
okay
uh and taking a first step towards this
we launching a py program for program to
break one of the candidate assumptions
which is called program appication via
local mixing the way I think about this
particular assumption is that you
they're taking take they're taking more
computational complexity approach than
taking like the traditional approach of
using algebraic structures to build
program
officiation the goal of the Bounty is
that we've provided you an offc circuit
with roughly like 240,000
Gates which was offcut from an original
circuits with roughly thousand Gates and
you have to find the original circuit
you can learn more about the Bounty
atopia too if you know what off estopia
is off estopia means that we living in a
world where officiation is practical uh
and the Bounty is 10K and this bounty is
launched in collaboration with um
etherum foundation and ZX Park
um okay so before I break um and I think
that I have a bunch of time okay before
I break I would want to make one
conjecture and the conjecture goes as
follows I think the god protocol is the
convergence of
cryptography probably building the god
protocol would require certain sort of
like f that is just one route but like
publicly F and other things like MPC for
it setup and so on and so forth but once
we have built the god
protocol I think it compasses everything
it gives us everything that we have we
have been like wanting for for a while
it gives us witness encryption it gives
us Z knowledge proves bya signatures it
gives us MPC multiparty computation it
gives us Fe fun functional encryption
all all of these things that we've been
demanding for a
while and this is also one of the major
reasons that we should start
investigating much more seriously how to
get practical program officiation and
finally build the god protocol
and that's it thank
you all right thank you for the talk we
do have some questions rolling in
uh yeah uh let's go through some of the
questions uh let's start with the first
one can we Implement threshold ecdsa
with Phantom
Zone at the moment yes because you can
express every like practical like
theoretically yes but it would be very
impractical to implement ecds with
Phantom Zone at the moment because ecds
is like you're doing eptic operations
which is a lot of operations um as far
as I understand threshold ecds is
possible it takes two days to generate
one single
signature all right so next question can
you tell us a little bit more about the
definition of obfuscation as a virtual
black
box that's the first question over here
isn't definition ofation as a virtual
blackbox
impossible I I am not posing officiation
as a virtual blackbox um I I did not
mean to say officiation is a virtual
blackbox uh by the way the impossibility
resolve for virtual blackbox is only for
like certain very restricted class of
programs it's not for like General class
of programs eventually you can aim for
virtual blackbox with certain caveats um
but against saying that my my definition
of officiation is not virtual blackbox
um all right and what can be done today
with Phantom
Zone at the moment as I said Phantom
Zone is an Abridged version of this God
protocol it does not even have a
publicly byi ref scheme so it does not
give you all the three guarantees the
only guarantee that it gives you is that
it will execute the function that you
ask it to execute while input while
private information can be coming from
multiple people you'll keep the
information private but you'll have to
trust it for it so you have to trust
this particular server to always keep
the information private and not send it
to anyone else perfect and we do have
one last question oh cool more questions
rolling in can obus skating programs
undermine open- Source transparency and
make it harder to verify the absence of
malicious
code uh I see make it harder to verify
absence of malicious code well that is
assuming that the entire program is
officiated um when I say officiation we
require officiation for certain parts of
the program which can interact with a
public program and a private program
which is obic I understand that obic can
be used for many malicious purposes as
well like for example you know like
there there's several reasons why people
might be interested in OBS cation but we
can as a community make sure that
there's an interaction between the
public interfaces and the private
interfaces which are
obsc all right and why do you call the
publicly verifiable FH circuit
obfuscated doesn't the require solidity
verifier or something which is
public uh no uh I think once I give you
off secar circuit there certain
guarantees that you can learn from the
obate circuit itself that it does not
reveal anything as long as youve done
the OBS cation correctly all right and
do you have evidence that the
conditional decryption functionality is
imposs uh is possible using IO
yes uh there is there theoretical
results and we're trying to make it
practical as
well all right uh can you give one
example each on how IO can replace ZK
MPC fhe okay so for ZK what you can do
is like you can embed a secret key
inside this secr circuit the god
protocol and uh a Zer knowledge proof is
just a signature from this God protocol
they whatever the secr whatever secret
exists inside this particular server or
this God protocol or this F Circuit of
SEC
circuit a signature by that thing
becomes the zero knowledge proofs so you
do not require zero knowledge on the
client side uh anymore for NPC again
it's a globally mutually trusted third
party all of us encrypt our private
inputs with the public key corresponding
to the secret key that lives inside this
off gate circuit and we send a private
inputs to this it decrypts that performs
some function and produces the output so
that's one way of replacing MPC and the
same for FG cool uh we can stay here for
maybe another 10 seconds if there are
any new questions rolling
in all right cool um let's give