[Music]
okay hello everyone uh today I we' like
to talk about ZK MPC U bringing public
audity into multiparty computation yeah
or MPC uh today I'm excited to share our
latest advant
advancement in this field for
you okay this is the today's outline but
yeah let's start from introduction and
please give me a little bit time to yeah
for the team introduction also yoi Inc
is a Japanese fintech company to helps
and entrepreneurs and businesses to grow
uh interesting uh uh increasing asset
liquidity with Innovative Financial
Solutions and we are doing R&D for uh
zkp and MPC to focus on secure and
efficient computation so today I would
like to talk about the project which
have received two ESP grants from the is
foundation and this is our team member
uh This Is Us Nakai a researcher and
developer and I'm task and last he is
not here but we have Masa Masa uh
co-founder
CEO so uh let's go into the topic uh let
let me first introduce about the
importance of the secure computation uh
and MPC so secure computation in data
driven world is uh is really essential
it allows us to protect the sensitive uh
information such as healthare and
financial and it enables useful analysis
without exposing information and
multiparty computation uh or MPC is a
key technology for this purpose uh so
yeah uh it enables multiple parties to
jointly comput functions while keeping
their inputs private and they only have
to share the final results so this will
ensure the secure
collaboration so uh let's think why uh
the third party verification for MPC is
essential uh especially the case we are
using dishonest majority protocols like
speeds uh when we are using uh dishonest
majority protocols uh participants like
Alice and Bob can verify them within
themselves that calculation results are
computed correctly
however they cannot directly prove uh
the correctness to the third party such
as Charlie so in this case Charlie will
think can I trust this
result uh yeah that's why uh adding C
party verification to MPC is a very uh
essential uh uh especially for use cases
like application to blockchain uh
finance and medical data
analytics so uh this will is the
overview for the rest of the uh
presentation uh firstly uh we will uh
show how
to uh introduce the public ail into spe
NPC protocol by introducing the
collaborative DK snarks uh next we will
secure consistency of the secret input
which enable third party to verify the
input conat using par and
commitment and next we will uh show our
enhanc of the bitwise support for public
auditable auditable speeds so speeds is
well suited for arithmetic operations
but not effective for uh bitwise
operation so we support uh functions
kind of such kind of uh comparisons
conditional branching and de bit
composition and so on and this will
expand the range of possible
applications and as a application uh we
implemented the game master free
werewolf or sometimes called Mafia game
uh using MPC to Showcase how our
enhancement will make the MPC more
versatile to uh collaborative use
cases okay I I'll pass to
yusuke on next uh to achieve what we
introduced we need to understand the
backgrounds and issues uh in more depths
and we which we will
explain firstly let us begin with the uh
MPC protocol Basics uh MPC uses the
techniques called secret sharing uh
which is uh data is splitted to some
shares and each party has uh it shares
one by one and there are some kind of
secret sharing like additive secret
sharing and Shia SEC Shing and so on
let's consider the example of addition X
X and Y is shared and the addition of X
Plus Y is uh can be obtained by simply
addition of the their shares and however
multiplication and other more
complicated operation needs uh needs
Communication in intermediate steps yeah
and space space is one of the well known
NPC protocol proposed in 2011
and this is uh use this uses additive
suet sharing so it is suitable for uh
arithmetic operation like addition and
multiplication and so
on and there are two phases uh one is
preprocessing and the other is online
phase and the next we talk about the P
MPC uh publicly auditable MPC is the
most important concept in our session in
order NPC uh the correctness of MPC
calculation can be verified by uh
participants however pmpc uh impos MPC
on uh of third party
verification it was proposed in 2014
however the efficient implementation
does not exist at the
time however uh in 20 21 the coopertive
Z snacks which is the one of efficient
uh implementation of public auditable
MPC uh was proposed by oir and
Bon the idea of ctive snack is to prove
uh to prove by m m
provs and the call KZ commitment uh KZ
commitment is a kind of polinomial
commit M uh which is used in DK s and
pro and verifier uh communicate with uh
each other and
commitment uh Pro compute commitment and
send to proof to verifier and verifier
uh last check that the pairing of uh
specific
calculation and uh probative ZK SNS uses
the
uh poal commitment uh in dkp uh like
Marin and pron and so
on and we focus on the mathematically
aspects of collaborative snacks uh it's
it uh idea is very simple uh the pi I is
a proof
uh proof generated by Shadow input and
Pi is the total
proof this techniques uses the linearity
of polinomial commitment and uh if we
generate uh
the proof uh each party then this is a
share of total
proof however if we want to uh use
collaborative ZK or pmpc on blockchain
uh there are some issues to be
solved the figure shows that DK snacks
and NPC additive oriented and bitwise
oriented
NPC uh roughly speaking we want to
develop techniques in this Vision uh
which satisfice all three uh Legions
the first issue is the consistency of
secret inputs space uh in space uh there
are pre preprocessing phase and online
phase so we have to ensure that the
consistency of secret
inputs and this figure shows that
conventional NPC and the public
auditable
NPC and the second issue is requirement
for the general purpose
computations speace based NPC is
suitable for arithmetic operations
however uh not suitable for bitwise
operations
so we have to uh you have to implement
such uh bitwise operations uh which is
efficient for Speed yeah and this uh
effects on constraint generation in zkp
because of restriction of finite felds
which can be used in
zkp and next uh we focus on the first
challenges the secure consistency of
secret
inputs in MPC uh in especially in space
uh the data input data uh is generated
by using auxilary data uh created in PR
processing phase so we have to
uh we have to be more cautious than
usual the committed data uh sorry we
solve these problems by using
commitment
uh we we commit uh input data uh before
the input shares generated
so and
at add at constraint to dkp so we can
verify that the
uh data in preprocessing and online
phase and the proving phase is uh must
be
same and we choose p and commitment uh
to
implement
and there are some constraints
uh we implemented for example uh L
constraint and and so
on and we focus on second changes
bitwise operation
support Recall why uh bitwise operation
difficult in space uh space uses
additive secret sharing so bit de compos
and comparison uh such operation U will
be more more costly than uh addition and
multiplication so if we using uh larger
finite Fields then more constraint needs
so we can't uh it is difficult to
implement bitwise
operations uh implementation uh we added
especially uh equality zero test and
comparison test and uh bit
decomposition uh on speace based
MPC and if we also implemented share
conversion protocol because Pedas and
commitment needs uh two different finite
fears and let's look the uh algorithm
detail this shows the equality zero test
let's imagine that you have the data X
of share of data X and we want to uh
calculate X is zero or
not firstly we generate the landom share
r with uh Associated bit with bwise
share and uh calculate X+ R and publishe
them uh this denote as C if x is zero
then R and C must be same so we use this
fact and calculate uh AI uh this is
bitwise and output the
uh total an of all AI uh this means uh
one if xal is zero and otherwise this
means zero
and
surprisingly uh
bitwise operation uh doesn't uh need for
additional
constraint uh for each
party even if
uh this can be considered as separation
of dkp programs and the uh NPC
programs so we focus on each
Legions and next we want to show
applications and demo
video we developed a we game Sorry game
master free well of game uh this flow
chart shows that uh well of game flow
chart wh of game for well game is a a
game uh the players are divided into two
teams one is Bard team and the other is
we team and prayer uh whose Ro is hidden
and uh by
using specific Ro action and voting and
uh player aim
to victory for their
teams usually we of game is is necessary
for
necessary sorry game master is necessary
for we of game however we developed uh
game master free wealth game by our CK
MPC here is the list of we implemented
the protocol in the DK
where Ro assignment Anonymous voting
where of f for ter check and victory
condition such computation is done by
MPC and uh we can check the con check
the correctness of such
actions let's pick up the ler assignment
in
dkw uh players inputs the shuffle Matrix
uh by secret shares
and then compute uh the lws by grouping
protocol and they generate uh
collaborative proof of L assignment
protocol then uh if the verification is
correct uh then they they are informed
uh their
RS this is a demo video of our
bpc uh this is four people
case
uh the Alice and Bob and charie and Dave
they legister name and then set up began
uh right the
way and the L assignment protocol is
long is running and proof here is proof
generation
by
MPC after the proof
generation uh the proof is
verified
and they are uh Alice is
fortun uh both Is wealth and Charis and
Dave are
villagers and the night pH uh they they
do uh special
action AR Fortune teror uh Divine B and
B attacked to
char and the discussion phase and boting
phase is
here ice and Bob and Dave are both
then again the proof generation is
started after the verification of the
proof uh Dae was
executed
here and finally the vory condition
check program uh is running
here also generating uh collaborative
proof
after creating and verification game is
over weides win
here at trust uh we looking to the
Future Prospect of our zkm
PC if it is it becomes available on
blockchain
uh it it can be used as a more it can be
used as a sty NPC module on blockchain
with smart
contract and uh it can be also applied
to some regions like machine learnings
and medical and financial data
uh such case uh
where multiple party needs to share
data and that's DK MPC can reduce the
security risks and ensure that the
correctness of
calculation thank you for
listening thank you once again uh very
nice talk you covered many things uh we
got an overview of all of MPC uh
background on different protocols all
that you've implemented U demo
everything and future I think it was
really nice talk thank you very much H
we have some questions um maybe I will
start at the bottom so maybe I missed it
but which snark did you implement growth
16 or something else uh ah sorry uh I I
don't write gross 16 however uh gross 16
is also implemented for our zkm PC like
Marlin and pron yeah so plon Marlin and
gr6
yes very nice cool uh did you implement
everything from scratch or did you use
some existing libraries uh in the part
of our program is
uh existing libraries uh for example the
crypto cryptographic uh Primitives uh we
use this aqu workx
library and uh the
collaborate with s part uh we refer to
the original work however uh in
pre-processing phase of spe and the
bitwise
operations uh bitwise operation region
we we light uh from scratch nice
impressive cool and maybe one last
question for me is um where would you be
most excited to see this used what sort
of developer or application would you
really love to see building this I think
your examples that you did with the
games and the demo is super nice but
outside of your team uh who would you
love to see using
it ah okay I'm really interested if this
is used in kind of uh medical case or to
make the machine learning model uh
together with a different organization
so if each organization has a different
secret data and they don't want to
reveal the data to each other but still
they can make learn the model to create
uh to create the model or to also do the
yeah um estimation from the model so I'm
really excited to combine this uh
technology with machine learning yeah
and you think it's efficient enough to
do um some machine learning in
MPC yes yes so if if we use MPC in
machine learning we the model itself can
be private or don't have to be rebuilded
to anyone yeah very nice cool well
that's all the questions we have um we'd
like to thank the speakers again for a
very nice talk
um thank you thank you so we have a few
minutes six minutes before the LA next
and last session