[Music]
hi guys I'm a researcher at UCL and for
the past year I've been building this
cryptography library and there's gonna
be a disclaimer for this talk I'm not
going to go deep into the math the Z cos
foundation how Privett is some useful
workshops that I'll do that later on and
I only have 20 minutes and the teach
cryptography you need more than 20
minutes so instead what I want to do is
they want to leave you with an
impression that cryptography can be
really useful for smart contracts if
nearly essential as well but first what
is cryptography well when I talk to non
experts they tend to say that
cryptography is about designing ciphers
ie encryption and decryption but
hopefully has some people in this room
know over the past 30 years and if the
rise of the internet cryptography is so
much more it's a bit of santak hitting
people on the Internet
ie you're a theorem account or endorsed
an information ie a digital signature
you know that's authorized your
transaction span some coins and even
more it's about building publicly
verifiable protocols where of a group of
people run a protocol and I'm not
involved they can send me the transcript
and I can have fifth or actually I can
be certain that that protocol was run
correctly so as I kept tog refer when
you look at aetherium you wonder what
does aetherium offer
well another goal of cryptography is to
minimize Trust we want to remove as much
trust from this system as we can but in
every system there's always a little bit
of trust so when we design a system
sometimes there's a trusted third party
but what's really cool about a theorem
is that a smart contract can be your
trusted third party with publix did so
because our public's did and it's a
little robot over there it gossips it
reveals all our secrets but it never
modifies the protocol and it will always
faithfully execute our protocol in our
behalf Ana's atomic either it runs the
function or it won't
I'm using smart contracts we can build
really cool things but first let's
consider a really simple example
rock-paper-scissors
unless considered where we don't use any
cryptography so our contract is a
matchmaking service if I want to start a
game for rock-paper-scissors I can start
a game
somebody can feign my game on the smart
contract and then they can play against
me so Alice with the little Mexican hut
she starts a game I'm because we're not
using any cryptography she's going to
leak rock so she'll reveal rock and say
I want a bad 5 pound or $5 in my
rock-paper-scissors game Bob can look at
the contract and say well Alice has
played rock so you know I'm just gonna
play paper I'm when the and win five
dollars you know the contractor Valley
we had static cuts back to say oh well
you you've won the ten dollars you won
the prize so really we can't actually
play rock paper scissors and a public
setting like a smart contract without
using any cryptography so what do we
need to actually build this we need a we
need a function where are we need some
photography where I can hide my choice
but then I can leader reveal my choice
and I cannot change my mind and we can
do this using trivial crypto and as most
people in this room are probably aware
of there's cryptographic hash functions
so if I want to choose rock I put it
through the house function I'll get 32
bytes of random theater I'll store that
in the contract and later on when I
reveal Rock the contract will hash it
again and compare the result with the
output of what it hashed so that's
really cool I'm what I also wanna yard
are two really cool features of smart
contracts deposits and refunds so the
idea is that when you start a game you
send a deposit and then when you finish
the game you get your deposit back and
this will provide a financial incentive
for people to finish the game so let's
go back to our little simple example of
rock-paper-scissors Alice will make a
choice so run it through the Hoss
function and then she'll send the house
of her choice five dollars and that
small little deposit now Bob comes along
and Bob can look at the contract you can
see that Alice wants to play but now he
can't see her choice
so there's a bit of risk it could be
rock paper or scissors so he'll make a
choice he'll send the harsh of his
choice five dollars on a deposit and
it'll tell the contract that he wants to
play rock paper scissors with vollis now
in the second round of this protocol
everyone must reveal their choice before
time T if you don't reveal your choice
you forfeit your deposit unlikelihood
the Condor party party will probably
automatically win
so next Alice will reveal scissors the
contract will evaluate to say that well
scissors was her commitment it matches
the hashas she give me next bob can see
that alice's choice for scissors so now
he has two decisions a he aboard the
protocol because he's lost or two he
plays the protocol evie wins or loses
now because he's never the deposit he's
gonna reveal pepper and he's lost the
game but he does this because he wants
to get his deposit back the contract
will evaluate this and say okay but I'm
sorry you know scissors beats paper Bob
gets his deposit back on Alice wins and
gets $10 now to the security experts in
the room that's my little disclaimer you
should normally use an ounce when you do
this but I want to avoid these details
because I'm not here to you know present
exact secure protocols so it's the
intuition of why cryptography is useful
so what's really cool about the previous
example is that the deposit of refund
scheme pervaded this financial incentive
for people to participate um or the
house phone pervades that ability to
hide my choice but also commit me to my
choice in a public setting
what's not really good is that when
Alice sends her hash
there's no way to verify that was either
rock paper or scissors all askew dissent
Spock and then later revealed Spock but
in this setting that doesn't really
matter because if I was dead true Spock
the contract will say well Spock was a
Nevada chase so Bob automatically wins
but what have we said when we have a
protocol or an application where a user
can't reveal their choice so all the
contract houses in
that information and the classic example
is e-voting
where we want a maximized voter privacy
so the idea is that you should be able
to see the patrick has cast his vote but
it's encrypted so you should never be
able to see what I vote it allows the
Mazda may have for encrypted votes and
these are in these are stored on the
smart contract and now we want to
compute the tally we should be able to
simply add these votes together and once
all the encrypted votes are added
together there'll be some crypto magic
and it will automatically perform the
decryption so then we get the tally
that's one yes vote and three new votes
now in this setting voters cannot reveal
their vote so we can't do that really
nice commit and reveal trick that we did
with Haas functions we also need to be
confident that every encrypted vote is
either yes or no if we don't know about
guarantee then an attacker could create
an encrypted vote in such a way where
they change somebody else's vote they
cancel somebody else's vote or they just
vote multiple times because remember
these are encrypted votes and under the
hood is all mathematics they're doing
addition subtraction multiplication etc
etc so one way they get around this is
the users here in all these proof and
when I can prove to you is that my
encrypted vote is either yes or zero on
it with this proof all and that's the
only thing I reveal about this encrypted
vote
I don't reveal the vote itself I just
revealed that it's well-formed honest
satisfy some type of criteria so now we
can build a contract where each voter
they'll do an L Kamal encrypted vote and
they'll stand up to the contract
alongside a 1 out of 2 0 Knollys proof
that there's voters either yes or no the
contract will accept it and store the
encrypted vote and every single voter
will do this then at the end of the
election we can add the votes together
and it will leak the tally now and
people want to know more about this type
of e voting smart contract I'll be given
a full talk about it a tent on Friday
morning so that's just a little
advertisement for my talk later this
week but let's consider another
application and also say we want to
source some type of competing
so Alice houses large computations he
can't to yourself and now he finds two
different cloud providers but he doesn't
necessarily trust them
so she makes each cloud do the same
exact computation and then if she's
given the same result from both clouds
then she has some confidence that the
competition was done correctly so what
she wants to do is set up a bounty so
now they're just smart contract out
there and if the contract and if the two
clouds can prove that they did the same
computation and they got the same result
the contract will reward the clouds for
their work so what we can do now is use
a Peterson commitment so this is so this
is different than a hoss funk emit Minh
Thuy can do some type of computation on
it wizard known as echo amorphic
encryption and the idea is that is
computationally binding on his infirmity
pronounce it and from Mission
theoretically hiding but we don't have
to worry about those two properties the
idea is that we can do some type of
commitment on the fan of result of the
competition so now each cloud will send
their commitment to the contract and
that'll be stored and later on they will
reveal an open our commitment to Alice
via some private channel Alice can then
compare proof of the open commitments
and she can see so you can see that they
have both done the CM competition and
got the same result and they've both
committed to this end result in the
contract
now what Alice needs to do is that Alice
needs to convince the contract that both
of the clouds did the computation
correctly and that they did both indeed
commit to the CM result and we can do
this using an equality zero knowledge
proof so the ideas are given to Peterson
commitments I can prove to you that they
both commit to the same message
we're very revealing about the message
that is about so essentially what Alice
can do is that so you can say okay yes
before the clouds did the work she sends
the robot or smart contract as equality
proof and then the contract will get the
two commitments it received from the
cloud it'll run it then
we'll use that as input to the proof and
then the contract will be convinced that
both of the clouds that the CM work and
then it will reward the cloud for the
hard work so that's really cool that we
can actually do this now of course in
this application you could argue well
both of the clouds can collude and
always and not do the competition but
they can get the money from Alice we're
going to ignore that for the security
experts but we have done some work in
this area so if you're interested
afterwards I can talk about it and
offline but essentially what I now want
to talk about is local crypto Sol so
these cryptographic primitives are
implemented in solidity and they're
available for experiments so the first
three were used for my voting system the
second two were used in that antique
illusion smart contracts I just spoke
about and that's another one that's
under review but I won't go into that
too much at the moment but what would be
really cool is that ideally what I
wanted to do now and this is my
disclaimer I wanted to have gas costs
off before and after the hard fork
because now a theorem supports elliptic
curve mathematics natively
unfortunately I've not money to get the
new op codes to work so someone in the
room is very familiar with that you can
talk to me afterwards and hopefully for
Fredi I can have updated gas costs and
how expensive this is I'll give you an
example so the one out of two zero
knowledge proof before the hard fork
would cost two point five million gas
which is really expensive considering a
block only contain seven million gas I
think that's roughly like three or four
dollars or something where now that the
hard forks happened the gas cost should
hopefully be in the region of 200-300
thousand gas but I still need a you know
get experimental results to say yes that
is actually the real cost cost now I
like the finish talking about other
pieces of work so I'm not the only
researcher who's been looking at
applications of cryptography on the
blockchain and I'm going to highlight
some papers that I thought were really
interesting so one was by Andre Miller
called decentralized poker and the idea
is that a group of people can play poker
as a smart contract and everything is
done using cryptography so we can ensure
that the cards are shuffled correctly
and that I have two private cars and
we're actually playing this
in a way where everybody can verify that
is correct the second one is by Sarah
Michael John he works with me at UCL and
the other scheme was a bit similar the
coin joint so everyone can deposit coins
and the essential smart contract and
then using ring signatures they can have
draw their coins back from the contract
in such a way where they're hiding in a
group so that's the achieve some type of
financial privacy and it's actually
really cool so I highly recommend
reading that one the second ones are the
third ones done by Arthur's group at ETH
Zurich and the idea is that lots of
Saveur contract is a padding contract
and I am Betty the Newcastle United is
finally going to win the Premier League
we still never do but let's say I go on
the BBC website and then the BBC
confirms that while Newcastle United
actually did win the Premier League I
can they improve to the contract that
the BBC said that to me and that's
really useful for any Oracle tape
service the third or the fourth one is
publicly verifiable seeker sharing so
this is the scrape protocol and the idea
is that they design this scheme the work
towards building a publicly verifiable
random beacon and this means that you
could have some tape a random number on
aetherium every so often and that's
really useful for gambling games and
everything else
we built that in as well I built that in
its solidity but it's only towards that
goal and doesn't achieve it yet of
course there's my anonymous voting
protocol on the country collusion
contracts that I spoke about just before
so thank you very much for listening to
this talk before I finish I have one
takeaway message key photography is only
one two and our toolboxes engineers to
solve problems and if you think
cryptography can solve your problem
alone then there's a really good quote
by Roger Needham he was a professor at
Cambridge in the eighties 90s and
eventually in the early 2000s and he
said if you think of tog R we can solve
your problem you either don't understand
cryptography or you don't understand
your problem thank you for listening
[Music]