[Music]
okay great so the uh far future of uh
cryptography um
sorry next slide okay great so I think
first know we'll talk we'll talk about
the uh very recent past and I think
still ongoing present of cryptography
right I think the biggest change that
we've seen over the last few years is
basically the way that sarks have really
taken over everything right and one of
the analogies that I've used is I've
thought of SARS as being similar to a
Transformer right so this is know the
GPT architecture that's now famous from
AI land and
the analogy here is basically that if
you think about what GPT did right it
basically took a whole bunch of
different use cases for which thousands
of people have been putting in years of
hard work years of application specific
algorithms application specific data
Gathering application specific expertise
and it just like swept all of that away
with just a really dumb system where you
just like put like take half the
internet like throw it into a funnel and
then like run the G run a bunch of gpus
for a while and it just manages to
magically outperform all of them as a
general purpose architecture right and
snarks you have done basically exactly
that same thing for cryptography right
so we've
seen ring signatures we've seen range
proofs um you know we've seen all kinds
of different use cases just basically
swept away and subsumed under this
umbrella of I am just making a proof
about a computation about private data
that is is expressed as some kind of
standard um arithmetic circuit in a
standardized language and that you can
you can make a fair a fairly short proof
that just proves whatever claim you want
to prove about private information that
you have in zero knowledge and oh at the
same time it also solves scalability
right so it's this extremely powerful
general purpose technology and the
ethereum road map has already changed
completely as a result right so if you
look at the plans that ethereum has for
the next few years all of the far future
stuff really uh depends on sonars
existing the uh road map for replacing
veral trees with something Quantum safe
depends on Starks the uh road map for
long-term full light clients depends on
Starks the uh and rollups started off
being optimistic rollups and now there's
ZK rollups and they demand on Starks or
depend on Starks they're um also plasma
before sonar it was a a very limited
architecture that that could only do a
little bit after snarks it just be it
actually has become something quite a
bit more powerful so snarks have really
overturned everything and in a lot of
ways they've also simplified a lot of
things right like if you remember trying
to design protocols in the prear era
like you really need specialized
cryptographers putting in a lot of
specialized cryptographic work to make
specific applications work whether it's
proofs or it's ring signatures or it's
linkable ring signatures or it's chami
and blinding every one of these
Primitives would require a cryptographic
professional to do a whole bunch of work
and even still you'd only make something
that works for a few particular sets of
applications snarks indiv non-
cryptographers can just go in and they
can do their thing put in their code and
it just works next slide so let's talk
about what happens what happens Beyond
snarks so in one of my recent posts
talking about the future of the ethereum
protocol and made this analogy to these
Egyptian god cards from yui right these
like extremely powerful monsters that
just have these incredible Powers right
and uh you know in Yu-Gi-Oh Legend these
cards are so powerful that it's
physically dangerous to actually attempt
to create one of them and you're not
actually allowed to use them in duels
right and uh like these three protocols
I think are exactly that powerful in the
same way right so we talked about sarcs
but let's talk about the other two items
in the series right so the one in the
middle is uh fully homomorphic
encryption fully homomorphic encryption
lets you do any computation on encrypted
data without being able to learn
anything about that data this is
extremely powerful this basically lets
you take a very wide class of
applications and just Express them very
easily as an FHA problem I have private
data and I want you to do an algor run
some algorithm on the private data and
give me the results without um actually
learning my private data that's an FHA
problem um I want to be able to train on
people's data without learning the data
that's also an FH problem you do need a
little bit of cleverness to make sure
that like the thing that the model
actually learns about you doesn't uh
actually itself reveal your data and
like that's a differential privacy thing
right but the bulk of the hardness like
actually is just captured by the FH
piece if uh you want many kinds of uh
like privacy pres uh preserving
architectures privacy preserving Dows as
long as you're willing to accept a
certain certain trust assumptions it
becomes an FH problem f is like actually
an incredibly powerful technology
another thing that it gives you actually
is uh uh it gives you private
information retrieval so the ability to
make queries against a database without
the database learning what you're asking
for and one use case of this is privacy
preserving light clients right so you
can have an ethereum light clients and
your light clients can go and like ask
for like some piece of data about
history without the server actually
learning what you're asking for so very
powerful stuff but you know we also have
to get to the third Egyptian god
protocol which is alisation right you
can encrypt a program in such a way that
the encrypt program has the exact same
functionality but if you have a copy of
the encrypted program you can learn
nothing about the internals of it like
basically yeah except for what the
inputs and outputs are now technically
like that exact definition is uh like
not exactly achievable but like in real
like for any realistic use case it's
like basically close enough to that
right and so alisation lets you uh be
actually do everything that FHA does but
it lets you kick out like even more of
the of the trust assumptions almost all
of them you can do Dows that have
secrets you can you can actually use
offis cation to implement basically any
other cryptographic protocol you can use
offis cation to implement encrypted mols
you can use offis cation to implement a
ZK SAR scheme where verifying the SAR
only requires verifying a signature um
it's it can uh let you Implement like
any kind of uh FH MPC two party uh two-
party computation it uh like basically
is a superet of like almost everything
else cryptographic so in order to try to
make this a little bit more concrete
let's look at voting as an example right
so I think of voting as an example
because I mean obviously voting is
important in itself but also voting um
to me is like a stand in for basically
any kind of onchain mechanism that that
is not purely financialized right so
yeah I wrote this is like one of my own
fra uh Frameworks right so I wrote an
article about this um I think this was
uh the one on Nathan Schneider's
cryptoeconomics or coordination good and
bad but the B what I call financialized
is basically mechanisms where you don't
mind people arbitrarily colluding and
one example of this is like if you
compare money to let's say like like
likes on Reddit right if you think of
money I give you a dollar in exchange
for you giving me a dollar is not a
problem it's working as intended on
Reddit or on Twitter I upload your post
and in exchange for you uploading my
post especially if it got optimized to
Infinity would just completely break the
system right and so if you want to
support any kind of mechanism that is
not financialized then like that means
that you have to be able to prevent uh
collusion in some way at least make it
difficults to trust and that requires as
it turns out exactly the same type of
properties that voting requires so let's
look at voting as an example so base
case put it on the blockchain so what
does putting it on the blockchain give
you right it gives you public
verifiability so anyone can check that
the result was computed correctly and it
gives you censorship resistance if
you're an eligible voter no one can stop
you from voting so it's a good starting
point Dows have been doing this for a
very long time very basic now of course
voting on The blockchain has a lot of
problems so let's talk about adding
cryptography on top let's add ZK ARS
keep the previous properties but you
also add and you keep public
verifiability but you and uh you also
have censorship or resistance okay sorry
I wrote this incorrectly um the thing
that you add is privacy right basically
if you vote then no one will uh be able
to tell who like which person made a
particular vote you'll still be able to
see the contest of the votes but you
will not be able to see like who
actually made a particular vote right
and this already is a very significant
privacy gain it already makes uh many
types of collusion much uh much much
harder and like it's already a really
significant Improvement right but it's
still not enough right and the reason
it's still not enough is basically that
if you really wanted to sell your vote
then if you made a CK snark you could
still prove to someone else that you
voted for some particular particular
candidate very easily so let's add the
Macy mechanism the Macy mechanism does
not rely on any new cryptography it
keeps the previous properties but it
also adds coercion resistance right and
assuming that the server is honest so
assuming that the server is honest you
add this new property which is that you
cannot prove who you voted for even if
you wanted to make that kind of proof
and this adds like a very large friction
against actually trying to implement any
of this kind of bribing because
basically
either they have to do some kind of like
side Channel attack against you directly
as a voter or they actually have to like
attack the server now let's add FH right
so with FH you keep the previous
properties but you if you add FHA
together with threshold decryption you
can make the coercion resistance
guarantee only depend on an mfn
assumption so instead of relying on one
operator you can rely on potentially
like say seven operators out of which
like four need to be honest right now
there are voting protocols that have
existed since like 2002 that have given
all of these uh properties depending on
an mfn assumption with simpler
technology but those protocols they gave
all of the prop all of these properties
under that assumption this kind of
design actually gives uh um every
property except for corrsion resistance
an even stronger guarantee and if you do
it with general purpose cryptography it
generalizes much more naturally to any
voting system you're not if you H have a
system that's designed for doing Simple
vote counting you can switch it over to
doing quadratic voting quadratic funding
with like a few lines of code you can
switch it over to doing pairwise bounded
quadratic voting a few lines of code you
can switch it over to doing cluster
matching a few lines of code you can
switch it over to doing the community
notes bridging Matrix factorization
algorithm with only the lines of code
that you need to actually Implement that
Matrix factorization algorithm and if
you want to do it efficiently it's a bit
hard but the algorithm itself like
basically about 20 lines of code right
so FHA basically together with SARS you
actually create this like very general
purpose uh design and you keep all of
your all of these properties that you
want out of a voting system except cion
resistance depends on an MN assumption
which is like not ideal right because M
out of n can still collude silently and
they can collude silently they can like
pass all of the information over to the
NSA and like no one would be able to
actually tell that any collusion is
happening so now let's add aisc so with
aisc you can keep the previous
properties but you can make you can make
it so that extracting or proving any
information at all about individual
votes requires blockchain consensus and
you can even make it require some amount
of proof of work per bit of entropy that
you extract
so how do you do this
basically when a user votes instead of
sending their vote to a a threshold key
um
or like FHA encrypting it to a threshold
key they FH encrypted to a key that is
inside of an offis gated program and uh
the so this is a trusted setup but but
there are ways to make the trust setup
be one of one of N and you can make the
N be like extremely large right so FHA
encrypted into this key that's held
inside of a program and then that
program only gives the total output of
all of the votes and in order to give
the the total output at all and even
there it's not going to give the full
number it's just going to give like the
one bit basically who won right and or
potentially a few more bits if it's like
quadratic funding right and the way that
this program works is it Tellies the
votes and it also checks that there is a
proof that the block consent has
finalized it and on top of that it also
can check for like some little amount of
proof of work right so you could do it
like say like $500 worth of proof of
work or you could imagine like ethereum
eventually adding like maybe like
$10,000 proof of work on every finalized
blocker like some simple uh simple
amounts right and so then even if the
blockchain
consensus colluded um even if like
everyone colluded they would only be
able to extract a very small number of
bit of bits of entropy from the system
right and so actually deter and then you
can also make the program add a little
bit of gy and no noise and so extracting
any information about how an individual
voter voted will basically just become
extremely hard so this is like very
close to Ideal right so but there's more
so we'll talk about onot signatures onot
signatures are A Primitive where you can
make you can have a key where that key
can only be used in to make one
signature one signatures require users
to have quantum computers so this is a
milestone that will come at quite a bit
after the bad guys have quantum
computers right when quantum computers
come they're going to be like hundred
million dollar things you know the the
bad guys or at least the people that we
consider threats will have them first
right and so you'll have to wait quite a
bit of time after that until regular
users can also have quantum computers
right but you do is what what this ISS
is basically yeah you know you can have
a public key and it's a mechanism by
which it's a public key such that the
you for any given uh Nots you're only
allow it's only possible for the owner
of the private key to sign exactly one
message with that Nots and this all
depends on the quantum no cloning
theorem right if you have a Quantum
State then you cannot actually copy the
quantum State there's mathematical
proofs that this is impossible and the
signature scheme depends on solving a
problem which is um infeasible with
classical computers but doable with
quantum computers and so you're
basically like proving that you have and
that you're spending one of these
unclonable Quantum States so this could
actually be used to make Quantum money
without a blockchain now it doesn't
remove the need for blockchains
completely it still doesn't solve
sensorship resistance on its own but
this is the thing that like I'm not I
don't want to call an Egyptian god
protocol because like this is not just
the land of computer science this is
like in the land of physics right and so
it's like it's some kind of tier that's
like even more powerful than these
things so when will we get all of this
technology right so zekus SARS we're
seeing an increasingly high level of
maturity I mean I personally look would
declare Victory once we're able to
actually have ZK EVMS that are proving
blocks within one swad currently we're
probably still like a couple of orders
of magnitude away from this but there's
a huge amount of progress there's a huge
amount of work in binary field proving
systems like basically the race is on um
FHA we're starting to see viable
applications so if anyone here was at at
H City you probably got one of those
like Square wristband things and there
was an application called cursive where
basically you could provide a list of
what your interests are someone else
could provide a list of what their
interests are and actually used FHA to
compute the intersection so we're
starting to like see toy applications
that like right consumers can use on
local devices the FHA has roughly a
million Factor overhead and so you can
run business logic inside of it but you
can realistically you cannot run
cryptography inside of it right so it's
like at that interesting level where
it's like you good for some things not
it's still not good for a lot of things
it's uh you know in that middle Zone
alisation the big news over the last few
years is that we're starting to see
viable protocols in 2020 there was the
first protocol that was dependent on
only standard assumptions and this
protocol someone actually tried to
implement it and they discovered that it
would take 10 to the power of 27 years
to run a year later someone created a
slightly improved protocol and someone
else started to implement it and they're
estimating that it's going to take one
year to run now there's also a separate
line of work that's trying to make off
escas protocols based on slightly more
exotic assumptions and it's like
actually more debatable in the long run
whether this is more or less secure
right because it's like on the one hand
you have more exotic lattice based
assumptions that are like based on
multi-linear map constructions and like
zero testing and like that whole line of
stuff but on the other side you have
like Normie assumptions about luses I
mean you know go go out and like ask
anori what they what they assume in belt
lce is right that kind of stuff um and
but at the same time you have to like
assume and that and elliptic Cur
pairings and like one or two other
things right and so but that stuff you
know if you want to in office get a
program it takes like a couple of weeks
right and then one shot signature is
obviously no idea definitely a long time
and we'll see quantum computers break
half of existing cryptography including
anything lip to curve based long before
this actually becomes possible so
basically I think the takeaway is that
all this stuff that was like extreme
science fiction a decade ago is like
slowly coming into view right every
single piece is like with every single
passing year is becoming slightly more
and more clear and I think we can
actually really start getting excited
about these things right and we get
excited about a world where cryptography
actually can get to the point of in a
general purpose way actually being able
to replicate the or replace the
functionality of any trusted third party
and uh I think that future will be
amazing thank
you thank you vitalic um so we will do
three of Q&A uh we have the QR code here
you can scan to both add questions and
up vote questions um there are only two
questions so far and one with I I'll
start with the fun one which is vitalic
if you played the frog game and if yes
how many frogs have you collected
unfortunately not this time I've had
like zero time to do anything other than
jumping around Devon stuff but but but
here it's been fun um okay what
advantages will the snark ification of
uh the beacon chain um have I mean I
think uh the big the big one is
basically that you will have light
clients that will be able to fully
verify the ethereum protocol right so
like on your phone on your watch
anywhere anywhere that you wants to do
things with ethereum you'll be able to
like actually fully verify the rules of
the chain and uh like you'll be part of
the mechanism that ensures that the the
chain and like even 51% of the of the
sakers are not changing the rules on you
and uh that's uh so and this will all
just like happen passively and
automatically um to invite me to a
conference to speak out how does one go
I'm not not answering um One Shot
signature on the book possible not
answering can we call beam chain
ethereum 3.0 I think no and I think this
is like an important misconception right
because I think like a lot of people
like got this weird Twitter impression
that like oh you know in the be the beam
chain it will only happen in 2029 and it
only happen gives you these nice Ivory
Tower Properties about the consent layer
and so it doesn't even mean anything for
users and like this is ethereum 3.0
right and the reality is like very
different from that right the beam chain
is only covering the ethereum consensus
layer which is only like maybe one third
or one quarter of the ethereum stack
right the execution layer that so the
evm has its own road map and then layer
twos and Layer Two interoperability has
its own road map and uh even on the
consensus side all of the key things
that are actually meaningful for users
so ESP especially getting dank charting
um up I think can happen a lot sooner
than uh
2029 thank you um okay more questions
what do I think about tees I mean I
think they're definitely interesting for
some uses though I think it's always
important to remember that like they
depend on a lot of trust in specific
manufacturers and they get frequently
broken right and so you want to use them
for like applications where they're
either just additive in terms of
security or where the cost of them
breaking is like not too high but you
don't actually want to use them to like
literally replace cryptography so you
know use them responsibly um what can on
shot signatures plus sisc plus
blockchain not do it cannot give you
true love thank
you thank you
vtic so what our next speaker um is
going to prepare the connection with
their top um I've been sent to entertain
you guys
so uh one thing I found interesting with
vitalic presentation is when you start
listing down these cryptographic
protocols one by one um you don't need
to like scre your eyes that hard to kind
of like see some form of mathematical
computer emerge right like each of these
Primitives are synergistic with each
other um as an example one primitive V
did not talk about is Oram oblivious RAM
and one thing that's interesting with
that is the same way in traditional
computers we could put all of our state
in CPU registers but we don't because
they're hella expensive and we have like
you know multiple layers of storage we
have CPU registers Ram uh blog storage
network storage Etc it's probably going
to be the case that with cryptography we
will have to do the same so while some
of these protocols can technically do
everything we'll probably compose them
with each other in order to like reap
the best performance possible and so who
knows maybe in a decade we will have
cryptography computer Engineers whose
entire job is to build computers out of
polinomial and not out of silicon uh
which and they will I one thing I was
thinking about yesterday night when I
couldn't sleep is who's going to be the
tsmc of cryptography you know kind of
like a polinomial Constructor For Hire
that put together the biggest
cryptography computers um I will also
check with a if we're ready we're ready
okay cool so I will introduce our next
speaker to the stage um so Albert KN has
been many things to many people at both
eorum foundation in zerx park but above
all he's someone who pushes us all to
think in more Direction and I think he's
going to do that yet once again with
this talk titled the future of
cryptography the real surreal and super
real thank you
[Music]
Albert like I said we have to do this
there we
go all right hi everyone thank you
Justin for a very fitting intro today
above all I want to share some
interesting ways I think about the
future of
cryptography some many perhaps are ways
people have not considered um this is
going to go to some interesting places
as the title hints at but before I dive
in I want to emphasize that while I want
folks to consider more directions the
point is not to replace how you
currently think about things this is not
new thinking in a totalizing sense it's
not declaring it's not even predicting
at least not in the sense that people
usually interpret the concept of talking
about the future this is just thinking
creating awareness for what may be
possible and may be true because
sometimes that awareness is what makes
something unexpectedly possible we don't
have much time so I'm going to talk as
fast as possible uh just kidding but
seriously buckle up
so part one the
real let's start with some easy stuff
things many of you know if you've been
exploring modern cryptography here are
some uh slogans if you will come for the
encryption stay for the signatures or
come for the security stay for the
interoperability like today https is a
statement of security but maybe zps or
pctp programmable cryptography transfer
protocol will be a statement of
possibility how about this come for the
nuk proof paint stay for the
superconductor we've known for a long
time that cryptography is digital nuke
proof paint but it's the superconductor
aspect that we are only beginning to
realize and
understand now I want to go in a bit of
a different direction here's a quote
from Steve Jobs recorded in the book
Valley of Genius an oral history of
Silicon Valley that I'd highly
recommend one of many things that stands
out from this quote is this phrase
medium of
expression today what is the thing that
this thing we call computer technology
what is it a medium of expression for
consider all that's been built around
computer technology especially the
companies the organizations the products
the institutions what are they
expressing or this is a bit more of a
leading question what have they become
everyone senses something has gone a bit
ay with our relationship with the
digital a relationship that's largely
mediated by what we broadly call
computer
technology and so I want to take this
immune system lens when we think of the
word immune system we naturally think of
our physical immune systems this
predates literally Humanity itself but
for much of human history there's also
been this implicit notion of an
intellectual immune system you could
also consider calling this a
philosophical immune system think about
how you respond intellectually to
various things how that's changed
developed over time sometimes it
strengthens sometimes it's probably
weakened kind of like your physical
immune
system what about the digital right now
we think of digital stuff in terms of
security and protection but as our
digitally anchored and oriented
experiences become increasingly
intertwined with our lives perhaps the
notion of an almost organic digital
immune system is a way to think about it
notably a digital immune system
conceptually wouldn't even have been
cogent 100 years ago probably less it's
simply much newer almost primordial so
we need to remember it's going through
things that are more associated with the
very early stages of a system or
ecosystem
developing for instance one might say
that the interaction between the
physical and the digital currently leans
parasitic this is partly because we
haven't realized the full potential of
digital Technologies and and I guess the
digital realm to be more symbiotic with
our overall existence but I think this
can and inevitably inevitably will
happen especially as our intellect ual
immune systems co-develop or co-evolve
with our digital immune systems remember
one of the most underrated things about
evolution is that symbiotic coexistence
is literally a more effective
equilibrium than Total Takeover this is
true even when the specific organisms
fundamentally remain in competition such
as predator and prey if the Predators
start doing too well they crowd each
other out same goes for the prey now you
might think okay cool digital immune
system cryptography that makes sense the
connection is relevant but that's not
exactly where I'm
going what I want to consider next is
literacy consider this word and why it
even exists it used to be notable when
someone was literate as in could read or
write for most of History it was rare or
definitely not universally expected for
people to be literate that's why the
word exists to point out an unexpected
thing of course today it's notable when
someone is illiterate it's not just
notable it kind of feels wrong like
Society has failed that person keep this
in mind going from default illiterate to
default literate happens all the time
often slowly then
quickly one of the most well-known
company slogans of my childhood was from
Bill Gates and Microsoft as you can see
the slogan was a computer on every desk
and in every home 30 plus years ago this
sounded incredibly ambitious it was
almost awe inspiring as it turned out
this was nowhere near ambitious enough
should have been a computer pocket
computer with you at all times a
computer the first thing when you wake
up the last before you sleep a computer
while you're on the toilet when you're
in a meeting or attending a talk a
computer every we at all
times computer literacy as in being able
to make use of a computer for your needs
was rare until very recently when I was
a kid aptitude with computers was
actually low viewed as low status
phrases like computers are for
secretaries were common today everyone
below a certain age is computer literate
but not in the way that you might have
naively expected 25 years ago and it's
definitely not that everyone now knows
how computers work it's that every
computers became a thing everyone knew
how to use thanks in large part to the
iPhone and the subsequent smartphone
Revolution again default illiterate
becomes default literate but how it
happens is often hard to predict even
when the iPhone came out many thought it
was going to be a total
flop consider also how the concept of
photographic evidence has only existed
for like a hundred years imagine telling
someone in 1850 that there's a
photograph or video or audio recording
to prove or disprove their version of
events today that idea is entirely
second nature most of us have never
known a world without it of course
there's a storm brewing brewing with
progress on what we call AI because we
don't know what else to call it the
current concept of photographic evidence
definitely won't last another 100 years
might not even last 10 if you naively
extrapolate you might think we're going
to revert to the world of trust me bro
just like all of history before the
photographic evidence
era but naive extrapolation almost never
actually plays out a couple Generations
from now cryptographically grounded
evidence will be second nature to people
the same way iPhones made computers
second nature to kids today the same way
photographic evidence has been second
nature for
decades but it's not even really the
cryptographic evidence era we kind of
have that already to some some extent
it's the cryptographic literacy era
remember literacy doesn't mean Mastery
and widespread cryptographic literacy
doesn't mean widespread understanding of
how cryptography Works similar to how I
noted earlier that widespread computer L
literacy doesn't mean everyone knows how
a computer
works still what's really going to
happen is not actually going to be
thought of as cryptographic literacy
what will it be thought of
as I consider this one of italic most
underrated blog posts should be pretty
easy to look it up given the title
within the post balic defined legitimacy
as a pattern of higher order acceptance
Loosely speaking people expecting other
people to expect the same things and
therefore we can all expect
something recall that smartphones are
what unlocked computer literacy they are
the form and mechanism through which
computer literacy became near Universal
for cryptographic literacy or legitimacy
literacy the form and mechanism is
something we don't know yet what is it
that makes things more high order
accepted in this broader sense product
and Technology Innovations will unlock
this future and I bet some of them will
feel just as surprising as the iPhone
would have felt just 30 years ago to
someone still being AED by Bill Gates's
computer on every desk
Vision also remember the value of the
wheel it was unlocked by the invention
of the axle people weren't idiots they
long noticed that round things can move
more easily but that's not what it takes
to make use of the wheel we don't know
what the axles are to Crypt phography
Wheels
yet one consequence of all this is that
something that feels like cryptographic
writing will exist I'm sure it won't
feel literally like writing combined
with cryptographic signatures in fact we
already have that but what's important
is it'll have the property of being
inherently higher legitimacy than
conventional digital writing we will not
think of all things written digitally as
being more or less the same this is
already true to a limited extent
depending on the context but the
distinction will be much more
substantial and there will be a
reflexive feedback loop that causes even
more widespread legitimacy literacy
through throughout Society all of this
will contribute to another shift in how
people feel about cryptography even if
they don't know that's the thing that
they are feeling something
about so everything so far I've put
under the real now I want to start to
segue towards the super real to do that
first I want to revisit some miracles of
science here I'll Loosely Define Miracle
as something where if you didn't know
something existed or was possible it
would be very surprising that such a
thing exists just as it would be
surprising if magic exists
my first example is fire the existence
isn't a surprise since it spontaneously
occurs in nature but the ability to
control fire was a significant
development to say the least next is
electricity this one is a bit surprising
I guess people had seen lightning but
what reason was there to believe that
this thing could be harness that it
would turn out to be magic juice that
moves infinitely fast and basically
gives us permanent light communication
across vast distances or to be able to
construct things like
computers then there's nuclear power
which was I think truly a surprise like
wait a second effectively infinite power
is everywhere mass is literally
energy but there's one more source of
quote unquote power that gets overlooked
because it's a fundamentally different
type of power each of the first three
Miracle power sources can be viewed as
asymmetric offense it's a lot easier to
burn something to make than to make it
fireproof and we know how powerful a
nuclear weapon can be but as I noted
earlier cryptography is digital nuke
proof paint cryptography is an almost
infinitely powerful defensive or
protective technology and the fact that
it's the digital superconductor is like
the icing on the cake so I do think it's
reasonable to consider cryptography a
miracle of Science and one reason is
because cryptography is a physical
realization of the potential of
mathematics now let's consider the four
fundamental forces of the physical
Universe we've got gravity a force that
was definitely apparent to humans since
well before we were humans then there's
the electromagnetic force which was the
fact that was a force was not actually
really clear until about 200 years ago
then we've got these two crazy forces
that operate at Atomic scales the weak
force and the strong force we actually
didn't even realize they existed until
the 20th century and we didn't confirm
how the weak Force functions until like
1960 so are we sure that we've got them
all there's even like a digital strong
force strong nuclear force parallel here
you know cryptography holds things
together at a level that overcomes the
inherent collapse of Digital Data
kind of like the strong force overcomes
the repulsion that positively charge
protons otherwise would experience when
packed together in an atomic nucleus so
that's why I wonder if it might be apt
to think of cryptography as like a fifth
fundamental force of the universe
especially a universe that is
increasingly becoming a combination of
the physical and the
digital and so that takes us to part two
the super real and I I like this
particular definition of the word marked
by extraordinary
vividness so if cryptography is a force
of nature
then actually utilize that Force
requires implementation our day-to-day
us usage of electricity isn't just some
like General usage of the
electromagnetic force you know there's
voltage there's how what decisions
around batteries alternating versus
direct current and so much more there
are a lot of specific things so when I
say Cryptor here what I'm gesturing at
is the specific form that of things that
actually harnesses the cryptographic
force this is one reason I kind of like
to think of cryptography as a digal duel
to physical reality electricity the
transition we're undergoing can be
likened to the transition from a world
that only knew fire to a world where
electricity is everywhere back when
people only knew fire if someone told
you about electricity that we could
somehow harness lightning you might
imagine better lights better heat
perhaps better cooking ironically
because I fire is actually better than
cooking for cooking in a lot of
situations you can imagine lighting up a
city and heating a city but you wouldn't
really imagine powering a city you
wouldn't imagine computers the Internet
or that electricity actually kind of
runs even through our brains you
wouldn't you definitely would not
imagine artificial intelligence and you
definitely wouldn't imagine
cryptography so in the future digital
stuff such as data computation
information transmission that makes use
of programmable and other future
cryptography will feel like electrically
powered objects in comparison to what we
have across the web today Computing that
is cryptographically charged or maybe
Enchanted is far from what we currently
think of as Computing same with data
that is cryptographically Enchanted and
Beyond now why is this even more
important than it might seem at first
blush because the tech industry as of
now has philosophically flattened in
fact we can see remnants of the higher
dimensional space it it fell from if you
look at any Tech startups pitch they
pretty much all still contain a mission
and the mission is never build the most
valuable company now if you've ever seen
a hedge fund like a new hedge funds
pitch deck they never have a mission
it's all business it's how they're going
to make the most money the whole tech
company Mission thing at this point is
kind of a Remnant from a philosophically
higher dimensional era of Silicon
Valley and at the same time and not
coincidentally while computer technology
has improved dramatically it is
regressed from the standpoint of how it
feels counterintuitive
counterintuitively using computers going
back to like Doom or civilization 1 or
the well or IRC or aim or text-based
multi-user dungeons in many ways felt
more expansive enriching not that things
were anywhere near perfect back then
don't get me wrong but there was a hard
to quantify feeling of moeness that
feels so different than how the web
feels now it's fascinating how
differently and in so many in some ways
better I felt using a dialup modem with
terrible bandwidth and latency than I do
now on my 5G pocket superc computer now
a common response to this is technology
is bad and we need less of it I'm open
to that perspective but I don't think it
should be a totalizing one we've got to
also explore how the digital can return
to being an expansive and enriching
experience we've gone from it being
symbiotic to parasitic how do we go back
to being symbiotic that's the real game
and the future of cryptography plays a
vital necessary though certainly not
sufficient role in this and it's why
looking at cryptography strictly through
the lens of what it can technically do
is
incomplete instead or in addition I
think we need lenses such as this no one
today thinks of cryptography in terms of
nourishment um it might sound crazy but
I think we not only can but perhaps must
think of it in these terms because only
then can we potentially discover or
realize that it's actually a valid way
to think about it we might even find out
eventually it's the only natural way to
think about it and as for enrichment
this is a cryptocurrency conference so I
want to emphasize I'm saying enrich you
know kind of like the soil got enriched
and we were able to support much more
people on Earth not the uh the other one
um one last lens from the super real is
how can cryptography help us reenchant
the digital it's not just now we can do
do programming on cryptography even if
that is very cool it's that cryptography
itself is fundamentally a bridge between
math and physics between the digital and
the physical and perhaps between
computation and lived
experience so finally I want to spend a
quick few minutes on what I'm going to
call The Surreal I've got a quote here
from Italo calino um that closes with if
a new world were discovered now would we
be able to see it and the definition of
surreal a definition at least is Beyond
reality so I want to start somewhere
again probably a bit unexpected what's
the greatest invention in the history of
mathematics in my opinion it's the polom
the ancient Greeks Romans Chinese they
were all excellent in math but they were
held back by not having something like
polinomial
representation but here's the
interesting thing about pols even though
they were invented close to a thousand
years ago and even though they were
instrumental to things even like the
invention of calculus we didn't really
understand how awesome were until around
200 years ago what happened then we got
the first rigorous proofs of a theorem
about pols that's so important we call
it the fundamental theorem of
algebra the thing about the fundamental
theorem of algebra is it doesn't even
work if you only have real numbers it
only works when you have complex numbers
and it turns out pols are just one of
many things that make way way way more
sense with complex numbers that's why I
say the most unbelievable realization in
the history of mathematics and arguably
the world is that reality itself
consists of more than just real numbers
that the real numbers were nowhere near
all that was required to Simply describe
and reason about reality accurately
complex numbers show up everywhere from
Electronics to fluid dynamics to quantum
mechanics and more what's more the reals
themselves became more spectacular once
we completed or algebraically closed for
those are who are familiar with that
notation once we completed the reals to
form the complex numbers e goes from
being the number that's defined as like
the derivative of e to the x is still e
to the X to being a fundamental basis of
rotation in the complex plane Pi goes
from circles being cool to being far
more significant in part because the set
of points equidistant from the origin
becomes far more interesting in a
two-dimensional complex plane than on a
one-dimensional number line where you
just have X and negative X and that's
barely scratching the surface of
examples so consider this if the real
numbers aren't the full picture of
reality should we expect anything else
to be does the digital the internet the
web and perhaps more not really make
sense until we complete it with a unit
of cryptography as the reals were to
form the
complex if physical reality is built on
physics can we enrich a complex super
Reality by bringing elements of the
physical into the digital realm just as
we've clearly brought elements of the
digital into our physical existence and
can this be a symbiotic relationship it
almost can't not be to actually feel
like super reality is there a complex
big BL bang will it look like a Genesis
block or something else is cryptography
where silicon based life really comes
from and what's more real places in the
physical Universe we can literally never
reach like we get light from places that
are so far that if we traveled at the
speed of light towards them because the
universe is expanding we will literally
never get there what's more real those
places are places in this perhaps more
vast complex reality that we actually
can visit and so the last thing I'll say
is in science fiction you know we see
this phrase outer World sometimes will
we one think of outer realities and I
wonder when we hear a voice from an
outer reality what we will look like by
then and who will be
listening and so I'll leave you with
this final note as we uh take a few for
Q&A thanks a lot for
coming thank you
Albert so to start the Q&A session the
first question is how does cryptography
as a fifth Force interface with the
firmy Paradox are all the aliens
encrypted yeah I love this question
actually because I've always thought the
firming Paradox was a little bit simpler
than people make it out to be because
the key is why aren't we observing
things and given that for example we can
observe an ant farm without it having
any sense that we're observing them
there's a pretty big assumption that it
should be like that easy to observe
stuff out there so that's not exactly
what this question is saying but I just
kind of wanted to point that out like
what if you could
cryptographically be like encrypt your
mind onto like neutrinos and then flow
through everything maybe that's
happening right now and maybe that's
where things will go so even just at
that level like cryptography has helped
me with my thinking around the fmy
Paradox not saying that's the answer but
I think it's people kind of skip over
the whole like oh of course we'd be able
to see it even though it's actually it's
like literally trivial for us to observe
life that is probably closer to what we
are than you know maybe more powerful
intelligences are to us thank you Albert
um reminder that you can scan the Cure
code to ask questions we still have two
minutes of questions so many things you
can ask Albert um there's one question
one vot which is what's your suggestion
for individual to contribute to this um
so this can mean a lot of things right
it can mean you know a lot of the stuff
that people are showing here or it can
mean the thing that I just talked about
but I will actually focus on what I just
talked about I I think as simplistic as
it sounds my goal here is for people to
recognize that sometimes just taking a
moment to think about things can be
surprisingly valuable that sounds really
obvious and yet like how much time is
spent trying to just take a moment and
think and the talk here the goal of
nothing else was to give an example of
how many directions that can go in and
and not in a way where I'm like I'm
trying to convince you of something or
or sell something or anything else like
that so I think you may be able to
contribute more than you expect by just
taking a moment to think about what you
know and what and your perspective and
see how that might intermingle with
stuff as for other ways I think there's
a lot of great opportunities to ask
folks about that overall so we'll go to
the next one thank you um anyone you
care more more about what you want to
answer um sure I'll go with how do you
see cryptography contributing to an
Internet that is joyful symbiotic and
expansive to use um I don't have much
time but the quick answer here is uh the
physical world has a lot of properties
we take for granted and if nothing else
we're evolved to like Orient around that
even the fact that like non-f
fungibility is like default on in the
physical world and we need like
sophisticated constructions to make
things like essentially fungible like
words are fungible in a sense to apples
are more or less fungible that's only
because we've gotten good at putting
them all in a market and so on the
digital world has like these inversion
of a lot of properties so if nothing
else I think cryptography uh is
underrated its potential to enrich
because it's a way for us to imbue the
digital world with physical world
properties and that's a lens that I
think we haven't really explored much
yet yeah there's the fungibility
scarcity stuff but I think there's a lot
more to go in that direction thank you
Albert thank you another round of
applause for Albert please thank you
all right so we have a special treat
next our next speaker is Barry White Hat
a self-proclaimed Street cryptographer a
longtime collaborator with the EF and
zerox Spark Barry will wideboard out his
thoughts on how to build with IO and
more um I always a treat to hear what
he's cooking up please welcome to the
stage Barry White hat thank
[Applause]
you okay folks uh can you hear
me okay okay we're going to do some
whiteboarding stuff um so like basically
the plan for today is to like architect
some simple things using
IO um can I turn this around so like do
people have things that they would want
to architect so like a couple of things
I was thinking about doing is like how
to do is how to how to oh p goes the
other way how to use uh zero knowledge
how to use IO to uh to make zero
knowledge group that are just like a
single signature to verify so you have
this iio box it it does some stuff and
it's bits out of signature and like once
you check the signatures it's enough
it's enough to say to to to know that
that computation was done correctly so
that's one thing that we could do other
things we could do is like uh uh trusted
setup uh other things we could do is we
could do like a Bitcoin Bridge which is
kind
of more blockchain
e uh anything else people want do this
is supposed to be like interactive so
feel free to like shout stuff out and
interrupt me like I I want to have more
of like a conversation here than like a
a presentation your thoughts and send
them as nutr across the Galaxy oh no
that's too much can I encrypt my
thoughts and send them as neutrinos
across the Galaxy uh not
today anything else okay well if there's
nothing like just shout at me later I'll
ask you again in a while so let let me
turn this
around oh yeah it's
okay okay so basically the toolbox of IO
is that we have like some program that
we express as like
Gates and we have some ins and some outs
and then we do like the io
thing we do this IO kind of like almost
like encryption step and on the other
side we get like a whole bunch of a
whole bunch more Gates or more more
information and it still has ins and
outs but the like what's happening in
the middle is impossible for us to
figure out so this you can think of this
as like an encryption step that takes a
program it encrypts the program such
that the
output is like unknowable it's like all
you can all you can do is like put stuff
in and get the
outs and you can like see stuff that's
going in and coming out but you can't
figure out like what the original
program is
uh so one example of this okay so let's
take like a really simple example and
let's say that our gate here is just
like
a uh and
gate yeah so we have a really simple
program as an and gate and we put it
into our IO encryption
box IO and then we get out this like
more complicated
representation right so this is this is
also just like a list of like operations
like M maybe it's Matrix multiplications
that's what uh schemes
ADP uh and Matrix branching programs you
tend to use but maybe it's just like
other binary Gates that's the local
mixing schemes tend to use those so we
get this encrypted format of our program
but we have like blackbox access to it
right so we can put inputs and we can
get outputs so like this one this one
takes just two inputs but there's like a
whole bunch more gates here
the gates are really
complicated so we don't know what's
happening inside our circuit but we are
able to do like blackbox access so I can
just put like I can just because there's
only two inputs I can just go just
calculate the whole truth table right
because I have the encrypted program I
can just put in 0 and I get out uh I
don't know what I don't know what the
truth table of andate is well let me try
and guess so 0
0 1 1 0 0 uh 0 1 0 one one one okay
that's it source of Truth this is and
gate okay so we can just like these are
ins out okay so we can we can just put
that in and and like that's XR oh
huh we good yeah
okay okay so we can we can just go
through and like do the whole uh State
space enumeration and we can find out
the truth table but we don't know if
this is actually an anate or if it's a
more complicated circuit but like what
I'm getting at here is that like you're
able to you have blackbox access to the
thing right like the goal here is to try
and build up this model so you're able
to sit down and be like I can I can
imagine how to make things with IO okay
cool okay so let's do our first example
then of our Z
KP right because like I don't know if
you've seen the kind of like tree of uh
different the teag tree of different
cryptographic Primitives but IO is kind
of the the one at the very top because
you can use it to implement all of the
others so like as a way to just
introduce the concept let's do zkps okay
so let's say that like oh yeah let's
introduce this other model of how to
think about it
so so we have our setup which is what we
just talk aled about and now let's talk
about like how we think about the io box
so we have this IO
box okay iio box does some things right
so the first thing that it will do that
it does is it it does some like we can
Define some computation we want it to
do and then given that the computation
succeeds we get the io box to produce a
signature
so this is kind of like an if if
computation I have to move over to the
other side then produce the signature so
if the computation succeeds then produce
a signature so like this iio box has
been encrypted and I have given it to
you right so you have this box on your
computer you're able to give it any
inputs and the output you get is a
signature of something okay maybe the
signature is maybe we just signed the
computation right so basically if we
want to make a zero knowledge proof what
we need to do is we need to have other
colors we need to take this computation
we just set that to be whatever the
whatever the the the thing we want to
prove is right for example if you want
to prove that you have like 10
signatures from a certain public key
what you do is you take your IO box you
set the computation to be the
verification of 10 signatures and then
you have this Clause that like well if
10 signatures are here produce this
other signature and pass it out so one
important thing to remember is that we
have a secret inside the io box yeah so
let's do
secrets we have secrets inside our IO
box and inside our IO box what are our
secret our secret is the uh the the
secret key of this signature right and
we have this uh it's not secret we have
the public key so at the at the setup
phase what I do is I create this IO box
and I do the encryption step that we
talked about on the previous slide and
and now what I
do is I I publish the public key and I
say hey look if you ever get something
that's signed by this public key you
know that it has passed this this check
right cuz the only way that you can
produce this signature is if you execute
the io
box okay so this is how you do Zer
knowledge poost do we have any questions
so
far yes there we
go so the question is how do you trust
the output of the iio box if you don't
know the computation so like I'm using
the computation as like a placeholder
here but like when you do the setup you
would Define the computation and you
would sort of show people that like oh
this is the thing that I set up so like
IO inherently has this kind of like
setup phase which you can think of as
like similar to the zero knowledge proof
uh trusted setup where you set up the
circuit and you set up the com the
program that you want to prove but you
also need to set up the kind of like
private key right you set up the private
key and you you publish the public key
and this is like part of the of the
setup that you need to go go
through good anything
else okay oh Jordie oh no okay all right
later Jordie um Okay cool so this is how
you do Zer proofs uh so like a quick
aside is there any other things that
people are interested in architecting we
have 10 minutes so I I have enough stuff
to go through but if there's something
people are specifically interested in we
can think about
them okay well feel free to interrupt me
if something comes to
oh that was signing things okay let's do
that then at the end um so you want to
have oh so you want to have like a dow
that that has a private key and it wants
to sign things but like what's the point
of doing that is it like a you want to
have an
EA EA is externally owned account like a
private key for a dow but like I don't
it like the the reason I'm I I don't I'm
concerned about doing this is that like
well you can just have the dowo be a
smart contract and you can just verify
the smart contract did something as
opposed to like verify the signature of
something but like maybe Jordy means
that he wants to be able to have stuff
encrypted for the Dow that the D
can yeah
uh so Jord saying that he has he has an
external file he wants it to be
encrypted uh but he only wants you to be
able to decrypt the file if you send
funds to the Dow right yeah and and this
and nobody knows I mean this file was
encrypted and nobody knows the key
except that though yeah yeah yeah okay
okay okay this is kind of like is this
witness encryption I'm not sure but yeah
okay we can do that let's uh let me what
was the other things I had written down
here okay trust the setup okay so let's
do the trust setup and then we'll then
we'll talk about J St
okay
so okay so historically like we've done
trusted setups for a whole bunch of
different ZK applications and this
basically means that we like gather
Randomness from a whole bunch of
different people and then we compute
this kind of like uh special key that
has certain properties and basically
what I want to talk about now is how we
can use IO to do that uh in a way that
we don't need
to in a way that's that's like more
programmable that we can have this like
Universal setup that we can gather
Randomness and anyone is able to use
that Randomness to do whatever they want
with so here's how we do it uh so again
we have have our iio
box okay and our IO box does some
compute and if the compute succeeds it
produces a
signature of the
compute okay but in this case it will
also uh encrypt
something encrypt the output of the
compute yeah
and it's also able to do like a
decrypt so this is kind of like similar
to what Jordi was was getting at so it
takes the input it decrypts
it uh it it uh oh hold on I want to put
this the compute at the end I want to
put the signature at the end so it gets
an input it decrypts it it does some
compute on the
thing and then it uh encrypts it
and it signs
it and that's that's all that it does
this is our whole compute so it takes
input it does this and it outputs the
signature and it also outputs the uh
this
out also up puts
out okay so like it's important to
remember that like the io box is created
with the with the process that we
described at the very start where we
have some some like binary circuit you
like encrypt the binary circuit and you
have this like encrypted circuit that
you're able to execute but you're not
able to like understand or comprehend
you're able to do like blackbox stuff to
it but you're not able to see you're not
a able to see what's going on inside so
this is like the the the core API of IO
and this is the thing that you like once
we combine this with the ability to take
to make signatures we have this like
authenticity that we're able to use the
bootstrap basically
the
whole almost everything that a trusted
party can do so like one way to think
about this is that like you you have
like trusted party like IO can be like a
really trusted trusted third party right
where you can just say to the io people
the iio Box hey do this thing and sign
this thing and then just give me the
signature and because no one is able to
see inside or affect what's happening
inside this becomes a really powerful
tool that we can use to build like all
the systems that we ever wanted like
imagine that if you could really trust
Facebook or if you could really trust
like these internet services that's kind
of what we're getting at with iio okay
so how do we do the how do we do the
random number how do we do our random
number generation so basically what we
do is we we we we have this box and then
we say to people that like okay you take
a random number and encrypt it and put
it into the box and then Inside the Box
the Box will you encrypt it uh I have to
put the secrets here so we have a public
key and a secret key these are secrets
so no one knows the oh well no one knows
the secret key but everybody knows the
public key so basically the user
encrypts for the public key they put it
into the iio box the iio Box does the
compute where it decrypts it it it it
combines it with the with with the
previous Randomness that that was oh we
need to have two inputs right one is not
enough so this is input from the user
and this is input from the current state
so you have two inputs so it takes the
input from the user it decrypts it it
takes the input from the state it
decrypts it it joins the two Randomness
together and then it encrypts the output
and it it returns that and assigns that
so this is the so then what we do is we
make it like a chain where like we have
like this iio box kind of pass the value
to the next one which pass the value to
the next one and like what we're doing
is that we're just stacking Randomness
up on top of it of itself right and this
is kind of like phase one of our trusta
setup where we're generating this random
number that no one knows and like the
assumption is that like if any single
parody uh
includes uh honestly passes a random
number then there's no way for anyone to
to to know like to to to to calculate
the random number right because in order
to calculate the final random number you
need to have all of the intermediate
random numbers okay so this is how you
generate the random number then like we
have to make another box to actually use
a random number cuz like with the with
the trust setups that we've historically
done they need to have a special
property
uh it's not enough for them to just be
like random or whatever they need to be
able
to they need to have this like for the
trust for the powers of to it needs to
be like the G to the x equals g to or gt
to the to the x or something like that I
can't remember but like it needs to have
a special property so we just we just
make another IO box that does
that so the io box has the same kind of
like uh uh public key and secret key
so we have the same
secrets so it's kind of like these two
these are two different trusted parties
and they're able to talk to each other
so this one encrypts some values for
this one and this one takes those values
and does some stuff with them and then
we can have like our arbitrary compute
here and we do our compute and we and it
and it outputs the actual Tres
up okay okay how is this any questions
yes I think secret key is included in
iob box but is it make able that no
one's know that secret key yeah that's
an important property here that we have
to make sure that no one is able to know
the secret key and that's one of the
properties that we get from the like the
encryption Step At the very start yeah
so this is like a programmable
encryption ah thank you
M
yep hello so if you are uh off skating
the program does the programmer have any
advantage by knowing the actual program
and if so like how can other people
agree that the program is corrective
it's sophiscated yeah okay so this is I
saw this in in one of the this is a
question earlier uh that vitalic didn't
answer but yeah I I think this is a good
question so basically like in general
what we would do is we would publish
most of the program that the only thing
that we really care about about about
hiding is is is what this person was
getting at that all we care about hiding
is that is a private key like we're okay
with someone like the property of IO
that we care about is not that the
program is like indistinguishable it's
that the private key is
indistinguishable like in most cases we
want to tell you everything about the
program we want to explain everything
except the private key
cool uh so questions like some intuition
for the the blowup so if you let's say
you implement CPS with this iio box uh
and then if you have a more complex CP
how does it relate to sort of the
exponential blow up like what is a good
intuition for how how much SI efficient
it become as of the logic inside this
box
changes oh so it seems like you're
asking two questions here like one of
them is like what's the overhead of IO
and the other is that like like is could
IO potentially be competitive with dkps
in terms of like Pro time are you asking
both or are you asking one of
them on the logic inside I
box huh it's basically both questions
that you you okay okay let me answer
both questions then uh so the first
question is that it depends upon the
Assumption like different IO different
IO schemes have different overhead like
some of the more like extreme
assumptions are actually pretty pretty
efficient in terms of execution the
setup is the main
cost um but it remains to be seen it's
still very early so I can't really give
specific numbers or whatever um I'm not
sure if like I suppose that like the
thing that you're gaining from the io
zkp is the succinct verifier the
verifier is really easy it's just
verifying a signature so it's much less
overhead than traditional Zer knowledge
proofs uh which tend to be like a couple
of pairings uh the best gr 16 or F long
is like a pairing and like some other
scal mes and stuff so it's better uh
it's faster ver fire but the appr time
is likely going to be like really a lot
worse at least in the short term uh but
it depends on the the assumptions that
we end up using or the basis that we're
end up building things on so not really
clear yet I don't think that Zer
knowledge proofs need to worry about
anything anytime soon I think that they
are going to remain like this is more an
example like this is more an example of
what you can do I'm not saying that like
oh this is what we should do yeah okay
Barry it's Q&A time ah okay sorry Jord
no it's great that was the first
question
um I'll read them from the ones with the
most votes but feel free to not answer
or skip to the next one okay um the top
one is can you explain IO as explain me
like I'm five and why do we need to use
IO instead of other zkps ah ah like oh
you know what like I feel like we got
into so much trouble because we abused
the zero knowledge proof not or name for
such a long time than that like this
question just it's hard for me to
understand what this means by like other
zerge proofs cuz I suppose that this
person is thinking that like oh they
just this blanket term for all like
privacy technology and that's zerge
proes so ah so I think that the key
thing that iio gives is a non-
interactivity I think that like that's
the missing piece of the puzzle but zkps
are that people use are non- interactive
I think I think the person doesn't
understand that yet that zkps cannot do
everything far from it yeah yeah zero
zero knowledge proofs are a single
player technology iio is a multiplayer
technology this is what we're this is
what seems interesting about this
we can take the other one which is how
do we get from weeks to seconds for Io
uh I suppose we just have to like try
more we haven't really tried at
all um I think I don't know like I mean
well come on I know like we just need to
work on
it you heard that just go work on
it the next one is what are exotic
cryptographic assumptions
oh I think they're like more like like
do they want examples or they want like
the vibe I I just think they want to
know what you mean by that ah so there's
like standard assumptions which are
assumptions that people have made for a
long time all like all cryptography is
based upon assumptions because like
there's this open problem in math that P
is not equal to NP and that basically
means that like some things are hard and
some things are easy so because we're
not able to prove that some stuff is
hard and some stuff is easy we're not
able to prove that any particular thing
is hard and because we're not able to
prove that any particular thing is hard
we have to base everything we're doing
on assumptions we assume that things are
hard so there's different things that
people assume there's things that been
people being assuming for a long time
and people are much more open to these
assumptions because we've been making
them for a long time but then there's
newer assumptions that are more radical
uh that that that and those are what I
mean by exotic assumptions and if you're
interested in that uh Brian Lawrence
will give a talk about that in one of
the workshop the iio workshop so there
will be a talk about cryptographic
assumptions um so that's it we're
running out of time thanks everybody
thanks folks
and with that I will introduce our next
speaker to the stage goep um goip is one
of the co-founder of zor spark and the
creator of Dark Forest please welcome
him to the stage thank
[Music]
you hey everybody thank you for joining
us this morning for the programable
cryptography CLS uh the title of my talk
today is contact and I'm going to be
explaining a little bit about what that
means short
as a quick introduction I'm gub sheep
I'm one of the co-founders of Dark
Forest uh I coined the term programmable
cryptography about two years ago and
ever since then we've been exploring a
lot of its
consequences so this talk is going to be
a little bit more of a mental models and
Frameworks talk it's not going to be a a
whiteboarding session or a session where
we go deep into the cryptography um we
are going to hear more about the
technology in this afternoon's workshops
uh and what we're going to do in this
talk is you know we're going to look at
some history and some worked examples of
how we've come to build up even the ways
that we think about programmable
cryptography um at the end we'll also
tag on some highly uncertain speculation
of what we might do with those
Frameworks in the
future okay so the title of this talk is
inspired by a Sci-Fi series this is the
culture series by Ian Banks raise your
hand if you've read or heard of these
books oh actually it's pretty Prett
pretty decent number so the premise of
the culture series is that explorers
adventures in the this universe where
this transhumanist post scarcity Society
exists and you know it's sort of there's
a uh G galaxy-wide culture of all of
these humans or transhumans that are
involved in this Society um and one of
the most interesting sort of agencies
that exists in the culture civilization
is the contact Division and what the
contact division does is they're the
ones who are essentially at the
Frontiers or the fringes of the
civilization uh handling all kind of
interactions with any other
extraterrestrial life or intelligences
or things that they're finding at the
fringes and one thing that I kind of
want to prompt is what does it look like
for ethereum or applied cryptography or
programmable cryptography to have a
contact division what does that look
like okay so let's first take a step
back and ask what are we trying to do
here with programmable cryptography um
the the various organizations the
various individual contributors the
various people thinking about
programmable cryptography you know what
is what is sort of the goal here with
progammable cryptography we've seen a
couple of instances of goals maybe it's
realizing the the real or the super real
or the sural um one framing that I
really liked actually from Albert's talk
and that you know I've been thinking
about a bit myself as well is this idea
of programmable cryptography as a fifth
fundamental force and as we saw in
Albert's talk um cryptography represents
a set of extraordinary new capabilities
that would a priori seem impossible much
like how something like nuclear
technology or the ability to harness
electricity might have seemed impossible
as well and my question in terms of what
do we actually what are we doing here is
we're trying to figure out how to even
grapple or come to terms with this how
do we even think about this what does
this enable what are the right mental
models for this technology what will the
different path dependencies be to
realizing this what are the right
abstractions for the technology and how
do you design the interfaces between
each level of the stack here um in short
you know we have to we have to Grapple
with the same problem that nuclear
technologists had to Grapple with you
know in the last 100 years are we first
going to make a bomb or are we going to
make infinite energy and what are the
sort of cross- dependencies both
technologically and socially that are
involved in figuring that question out
or something like Computing you know
it's it's very non-obvious in the days
of something like the eniac one of these
giant room scale computers that the
descendant of this 60 70 80 years out is
going to be something like you know
virtual worlds like EV on line where
hundreds of thousands of people are
battling in a virtual space reality for
control of virtual space planets right
how do you even begin to start thinking
about what might take you from the leth
hand side to the right hand
side okay so there's a lot of stuff that
we could do that that wouldn't make
sense um in particular it's easy to
Rabbit Hole down one particular kind of
programmable cryptography technology uh
or to Rabbit Hole down like one
particular sort of use case or or
product or something like that but
ultimately it's really important to to
keep a solid head on your shoulders when
you're approaching this question because
this is a decades long civilization
scale technology and we need to approach
it and and take it seriously as such we
need to build some foundations mental
models in a way that takes seriously
that a mental model needs to be useful
on the time scale of potentially decades
that doesn't mean we need to get those
mental models exactly correct today but
how we think about this should be
credibly progressing us towards the goal
of understanding how to think about this
from a from a multi-decade civilization
scale kind of
scope now the other thing you have to
avoid while doing that is you have to
avoid getting sucked into the perfect
system trap especially in a way that's
not grounded in reality so the other
thing that we could do is we could be
like all right programmable cryptography
allows us to do this crazy stuff this
crazy stuff with tur machines with these
crazy guarantees let's sort of sit down
and and theorize for that theorize about
that for a really long time and build
some sort of like crazy like category
Theory type Theory like you know correct
by construction sort of thing um and
then you know that that's real mouse
trap too we don't want to go down that
rabbit hole but somehow we still want to
be making progress knowing that this
thing has as Grand of a scope as it does
okay so I want to talk about some of our
thinking on how we've approached this
problem over the last five years so
beginning about five years ago we
started to get the sense that there was
something interesting happening in
cryptography we didn't have the words to
describe it we didn't have the the
Frameworks you know nowadays people talk
about the idea of oh you know ZK enables
data interoperability that was not how
we were thinking about ZK at all when I
started building a game called Dark
Forest in 2019 the way that I was
thinking about this was I had just
learned about ZK snarks from Jordy
actually and I had this idea wow you
could use zero knowledge proofs and
blockchain to build this really specific
and very strange game so dark forest was
a game built on zero knowledge proofs on
blockchain um it was one of if not the
first non- cryptocurrency application of
zero knowledge proofs and it just seemed
like a total one-off hack at the time so
um we spent this time we spent some time
building uh Dark Forest and what we came
to realize was actually there was a
general principle going on which is that
zero knowledge proofs were not just
enabling this one specific game
construction they were enabling this
idea of incomplete information games or
games where players have some private
State on a blockchain or on a
decentralized system where the whole
state is public so that enabled us to
you know that that came through building
a bunch of other prototypes of of some
other games this is a screenshot from a
game we built called boat fight um and
unlocking that realization allowed us to
suddenly see what was going on with dark
forest and this category of games and
suddenly it became actually a lot easier
to build the different kinds of features
and even figure out what kinds of
features we could add into Dark Forest
so for example you know early on the
into the game we introduced this idea of
procedural generation that was enabled
by this mental model unlock of what ZK
was fundamentally doing
here okay so then we get into uh so dark
force was out 2020 this idea of
incomplete information was about 2021 in
2022 we started experimenting with wait
a second can we apply this principle
across a bunch of other kinds of domains
not just games so you know we built a
bunch of these circuits we built um
thing we had folks in the Xerox park
community ecosystem building things like
private message boards um ZK reppel over
here is a developer tool for working
with zero knowledge proofs there's
stealth drop which was like private
airdrops and we got the sense that what
was going on was you know the Common
Thread between all of these things and
between the game thread was this idea of
programmable privacy right and I I use
privacy in quotes here because I I sort
of am referring to a specific
connotation of privacy which is oh I
want to hide something I want to have
anonymity or pseudonymity or something
like that and we kind of distilled this
down into this idea that ZK snarks turn
cryptography problems into programming
tasks it was much like what vitalic was
sort of saying in the morning where uh
we don't you know need a cryptographer
to invent for us a new protocol for
every feature you can have someone WR
code and compile that into
cryptography okay so from there once we
had this notion of programmable cryptog
programmable privacy we were like well
let's step on the gas pedal here the
point is now a bunch of people can make
privacy preserving applications and
those people specifically don't have to
be cryptographers so we got a bunch of
people together started bringing folks
into this ZK ecosystem and we produced
things like the first zero knowledge
machine learning demonstrations stuff
like handon with pseudonymous or
Anonymous speech ethos which was the
first demonst ation of recursive zkps in
a consumer social graph kind of use case
um things which would allow you to Port
RSA identities into zero knowledge
proofs and so we did probably like you
know five 10 15 of these projects and
that's what got us to arrive at this
other concept called proof carrying data
the idea that actually the thing going
on here with zero knowledge proofs is
not something about privacy or
scalability like yes those things are
very relevant particularly in the
blockchain context but after building 10
or 15 of these apps we realized that
what the zero knowledge proofs were
fundamentally doing that was a Common
Thread in each of these apps was they
were enabling permissionless data
porting from Source a to destination B
so now you can move things like a GitHub
Identity or an email or anything like
that from this Destin um from this
origin Source o over to this destination
without needing to call apis or things
like that okay so that gets us to proof
carrying data um we built this framework
called the proof carrying data software
framework so this is a mental model that
then got actually translated into a
library and the beginnings of a software
abstraction and then we started building
a bunch of stuff on proof carrying data
so this is kind of the the the Blind Men
and the elevant sort of thing we were
realizing that all of these eight things
were instances of this common
category um so a lot of our proof caring
data experiments led us to Zulu which
was a community that wanted to adopt
decentralized identities cryptographic
identities work with cryptographic data
and we built this thing called zup pass
which everyone here has used to
basically uh claim their ticket generate
a zero knowledge friendly identity um
and store zero knowledge friendly data
and we built a bunch of apps on top of
this concept of proof carrying data with
zup pass as one of our levers so we have
things like you know the frog game you
can make zero knowledge proofs about
your frogs we had zo pole which was a
polling app for the Zulu community that
also expanded to a couple of other
communities zuo cast or zookat which
were these social sort of private social
Message Board apps for these communities
um just these various different
things and we built a bunch of pcds
proof caring data uh instances and we
tried to build a bunch of stuff with
them and then we ran into more limits
and then we started to factor out well
what are the common threads where those
limitations are holding us back and this
is what really led us to programmable
cryptography so for example with proof
carrying data and with ZK snarks we
could only enable individual people to
make proofs about operation on their own
data but there are a bunch of places
where we would want say two people or
multiple people to be able to jointly
compute across data that I have in my
zup pass and you have in your zup pass
and that led us to realize oh there's a
very natural connection with these other
kinds of general purpose programmable
cryptography Primitives like multiparty
computation and more another realization
that we had was that even though we had
this abstract concept of proof carrying
data PCD um it was actually in practice
really hard to use pcds what we'd have
to do is we'd have to write one more
bespoke circuit for every kind of
cryptographic operation or every kind of
you know proof carrying transformation
we wanted to do and so we ended up with
this whole repository of all these
different circuits and PCD types um and
we were back to kind of square one on
well you do need a cryptography aware
developer uh in order to even be able to
engage in this
ecosystem so that led us to programmable
cryptography um which is the subject of
this community-led session here today um
and concretely what it means to say it
led us to the mental model of
programmable cryptography or this this
way of thinking about programmable
cryptography is it allowed us to figure
out what the problem was and what the
capabilities would be un what
capabilities would be unlocked if we
solved those problems so you know me and
Andrew we took a look at all the stuff
going on with pcds and we were like well
this needs to become generalizable and
this needs to become much more flexible
so now we have pod and pod 2 as a result
which we'll learn about more today in
the afternoon sessions um we have uh if
you can go to you can go to p.org to see
sort of the latest on that um and then
we started carrying out other
experiments to see well now that we've
been led to this next line of
Investigation what what what might we do
if we take fhe or obfuscation or these
other Technologies to their logical
conclusion so uh this Devcon if you've
gone down to the Frog Hub you've might
you might have seen this game called
frog Zone which is as far as we're aware
the first game where the back end is
running entirely in fully homomorphic
encryption like Justin mentioned we've
basically built this four player game
where you've got four uh four frogs on a
32 by 32 grid the frogs can move up down
left or right they can collect items
slay monsters Etc and all of that is
happening inside a fully homomorphic
encryption with 1 billion x overhead on
top of what it would take to run this
kind of a game normally on a you know
plain text ordinary computer and that's
unlocked some really interesting
thoughts and it's sort of that is one of
the thing the things that's actually led
us to obfuscation because one of the
huge pain points of building something
like frog Zone if you've actually tried
the game downstairs is that there is a
ton of interactivity there's a ton of
multi-party computation decryption that
needs to happen the Wi-Fi keeps going
down going out downstairs our Hardware
switcher thing keeps failing and so
there's no way that you can take this
technology and scale it to something
like a billion people unless you bring
in a non- interactivity technology like
obfuscation so each of these things has
been essentially some sequence of
figuring out what's really going on here
trying to generalize what we currently
know and looking for what is the general
category of thing that this is and how
do we solve that
problem um each of these steps in the
understanding tree for programmable
cryptography has taken about a year and
uh each of them has been a concrete step
towards a grounded conceptual framework
for how to think about programmable
cryptography and what you can do with it
so again like I said in the beginning
none of these are complete Frameworks
none of them are you the end all be all
of how to think about programmable
cryptography but each of them does build
on each other and and we're starting to
get hints that this might be a generally
pretty good way to think about what you
can do with this technology you know
first starting with zkps let us build
incomplete information games and
decentralized systems then generalizing
that to saying ZK snarks turn privacy
math problems into coding problems then
generalizing that into ZK snarks are
about data interoperability and as vid
Alik said actually earlier on a pan
panel earlier this week rather than
calling them ZK snarks we might just
call all of these things proofs and then
finally we we've you know come to this
sort of model of programmable
cryptography as this general purpose way
to think about computation between a
network of
people okay so in essence what we've
been trying to do over the past several
years is build a machine to produce this
kind of thinking and what is the
mechanism by which this machine operates
that mechanism is what I sometimes think
about as contact with reality right so
rather than sitting in a room and and
theorizing a bunch about what might be
an interesting system or what might be
an interesting thing to put it put
inside of a snark you know we'll sit
down and we'll try to we we'll build a
lot of stuff we'll take as much of that
stuff as we can we'll deploy it whenever
possible in as real of a setting as
possible even if that's just to a few
hundred or a few thousand users and then
we'll constantly go through this process
of looking back auditing pruning and
synthesizing and trying to figure out
what is the general principle what's the
line that you can draw between all of
these
points here are some forms of what
contact with reality might actually look
like one is building a first endtoend
prototype of some technology that we've
never tried before so something like
frog Zone again let's let's just try to
put a server inside a fully homomorphic
encryption even if it's a billion times
slower and we'll figure something out
another one is trying to build something
that folks for whatever reasons will use
or need or ideally love even if it's a
small group of just a couple of hundred
people um another one is teaching
developers and providing them with
different tools or sdks or abstractions
and if that actually enables them to do
something that they couldn't do before
or understand something that they
couldn't do before maybe maybe even
build something that we could not even
have anticipated if we can do that then
we have some sense that oh this
abstraction is actually something that
makes sense that is is maybe worth
refining and building on top
of um by the way as uh sort of you know
in reference to that that last
particular point I think that Folks at
Devcon should think very hard about the
fact that every Devcon attendee now has
access to a ZK friendly EDSA and
semaphor key you know there's there's
essentially you can think of what will
you do with the Merkel route of all
Devcon attendees in addition thanks to
the Frog QR code scanning thing that's
been going on there are hundreds of
thousands of self-issued attestations
now between attendees that form a dense
social graph each of those frog requests
is essentially your P your key pair
signing someone else's public
key okay so yeah it's important to make
a lot of stuff equally important is not
to get distracted so if something that
we're building doesn't fundamentally
make sense but has the potential to you
know make a lot of money or score really
highly on some notion of model as of
metrics like users um knowing when that
is not the right track to keep going
down um another thing that we think
about is if we're really here with the
goal of testing out a new mental model
not compromising on the mental model and
getting that goal mixed up with
something like adoption it's better to
have a test with a thousand people that
test the right kind of framework or
mental or mental model than to scale to
you know 10,000 or 100,000 in a way that
is testing a different thing now the
ideal thing would be to you know test
with a 100,00 people with the right
mental model but that's what we're
working towards trying to scale up um
and yeah the last one is being willing
to constantly reassess resynthesize and
move on from things that don't make
sense or aren't working so we've had
plenty of false starts in terms of how
to think about what you can do with
programmable
cryptography okay so with that um I want
to talk about a couple of new mental
models or Frameworks that have uh come
up even just through discussions over
the last week with Folks at Devcon um so
one is again this idea that
interactivity really kills this is
another one of those motivations for
obfuscation like I mentioned we've been
running this frog zone game in the
basement of Devcon four players can get
around and you know it's just a real
difficult problem to get all four of the
clients doing the decryption multiparty
computation with every single operation
in the game now when we think about
something like interact activity versus
non- interactivity that's something that
doesn't sound as sexy as like now I can
do arbitrary programs on encrypted state
but it just turns out that for scaling
these systems to millions or potentially
even billions of people um you need some
strategy for actually dealing with the
fact that only the people involved in a
computation should need to be involved
in the actual process of running the
computation and an interesting
connection that actually someone made at
at a mpf panel yesterday was wait maybe
this is actually one of the reasons why
ZK have been such a powerful technology
that's been so accelerated compared to
FHA over the last years especially with
respect to blockchains we've actually
had general purpose zero knowledge
proofs for a long time now ZK snarks one
of the additional things is that they're
non-interactive you can make a one-hot
publicly verifiable proof and this is a
thing that's actually unlocked a ton of
use cases and a ton of actual you know
in the real world developer
activity um another one that I think
about um and I know I'm running out of
time I just have I have two more of
these um what is this idea of global
private state so we've noticed that with
things like fhe or MPC you can build
these decentralized applications that
have state you know imagine like a
variable or a location of a monster or
something where none of the participants
in the application actually know that
state but the state is being computed on
correctly so in frog Zone there's
monsters around the map that move around
but nobody knows where they're moving to
or from the servers and the maches are
just sort of executing in fully
homomorphic encryption advancing the
state of the game one step at a time and
the bat is just sort of its own like
autonomous agent that's that's just
moving around you know so one question
is like you know I I had a moment when
we got the bat moving around on its own
working where I was like wait a second
like what is the subjective experience
of this bat like is this a new kind of
agent it's somehow moving around in
encryption there's literally no single
computer or person or program in the
world
that knows where the bat is or knows
anything about what it's doing and yet
it somehow has this like independent
objective experience where it's doing
its own thing um it raises a bunch of
interesting questions about cryptography
and agency right like one thing that I
think about also here is you know a
cryptographic agent has a different
flavor or affordance to it than an AI
agent um a thought that then was
prompted from that from some other folks
who looked at frog Zone was like well
what's actually going on with encryption
we think of encryption as a technology
for hiding messages but maybe that's not
what's actually going on in the same way
that zero knowledge in many context is
not really about zero knowledge or
hiding it's about proving and it's about
data
interoperability so maybe the thing
going on with encryption here is you
know if I mind uploaded my brain in
encryption to you know some server
somewhere in plain or sorry not in
encryption in PL text to some server
somewhere the operator of that server
would be able to do surgery on my
neurons to really really like with
my subjective experience but if I
uploaded my brain in encryption or in
obfuscation somewhere the only way for
the person operating that program to
mess with me specifically would be for
them to essentially take down the whole
system because now all of the gates
describing my brain are intimately
connected with the rest of the off
fiscated program you can either turn the
crank on the entire program at once or
you can just like destroy it completely
that internal logic of the world is
somehow preserved because of the fact
that it's OB fiscated and the hiding
thing comes out as an accidental
property so you know going back actually
to to one of the things Albert was
referencing as well there's this idea of
we call something X because we don't yet
know what to call it it's it's pointing
at the idea that the words that we're
using to describe these systems are
placeholders and they represent the fact
that we just don't have a better
understanding yet so we called it zero
knowledge because we didn't know what to
call it um now we're moving to a world
of some maybe something like proofs
maybe we call it encryption because we
don't know what to call it and maybe
it's actually about creating worlds with
somehow mathematically unwind
codependencies between
everything maybe we call it cryptography
or programmable cryptography because we
don't know what to call
it so that's it basically for contact um
you can find out more about what's next
uh this
afternoon uh we will be talking about a
bunch of these different systems that
we've put into varying stages of
production um hopefully over the next
couple years years we essentially take
these mental models and we can start
building out a lot more mature systems
uh and thank you everybody if you want a
little froggy gift feel free to scan
this QR code as
well any froggy
gift it's not any froggy gift this is
most