all right hi everyone my name is guy
Siskind I'm the CEO and co-founder of
enigma and I want to tell you today how
you can build scalable
privacy-preserving
smart contracts on aetherium so the
problem with blockchain is that it's
completely public everything you put on
the blockchain is there for everyone to
see and also forever that means that you
cannot use sensitive data on the
blockchain today and that's a big issue
I'm sure you would all agree that any
application today whether centralized or
decentralized is going to need to use
sensitive data in some form or another
and obviously this greatly limits the
potential applications that we can use
with the technology so if you want to be
a bit more technical smart contracts
which is the unit of execution that we
have in blockchains
gives us correctness but it does not
give us privacy correctness means that
if you're running a computation then you
can be then you can be guaranteed that
you're gonna get the right result and no
one can temporarily and that's great
that's why we're really excited about
blockchain technology but we need
something stronger and a stronger
definition is what we call secret
contracts that provide both both
correctness of the execution but also
privacy of the data so in Ligue 1 is the
first available platform for you to
build secret contracts and execute them
it is the first time that you can
actually add and use sensitive
information on the blockchain without
compromising central is a
decentralization enigma works by using
privacy enhancing technologies that
allow you to basically compute over
encrypted data that's the main secret
sauce the second part for scalability we
take the position that execution should
be separated from consensus block shares
are really good at reaching consensus on
small amounts of public data but they're
not good at keeping privacy and they're
not
good its scalable execution so we have a
long history of of actually doing this a
few years ago we came up with these two
ideas and we published these in two
papers decentralizing privacy and the
original white paper for enigma and
these papers currently stand on more
than 500 citations combined so they
really become a cornerstone in the space
and really they are they were the first
to crystallize the ideas that if you
want to have privacy in the blockchain
you're gonna use some additional
cryptography you're gonna use something
that allows you to cut two computer
encrypted data and on top of that if you
really want to have scale you got a
separate execution from consensus and
you know I was here this week and it was
really inspiring to see that so many
other projects are actually taking that
approach right now so maybe it's taken a
few years but it seems that the industry
is finally coalescing into the idea that
execution and consent should be
separated and that privacy for smart
contracts is really important and we
should not settle just for transactional
privacy so I'm mostly going to talk
today about the Enigma discovery Network
this is the first network that we're
pushing out right now the network has
all the great features I told you it
allows you to execute these secret
contracts and it's scale but it also has
other important properties its
permissionless completely it's
economically incentivized which means
that we use some form of proof of stake
model and I think what's mostly
important for developers here and for
this talk is that it's compatible with
the fabien we don't want to make you
choose between aetherium and enigma
there's enough of you know copycat
blockchains in the space what we want to
do is make sure you can build the best
decentralized applications that you can
so we build a very seamless bridge and I
will talk about it later on about how
you can actually combine public
execution on aetherium with private
execution or enigma
so the best way to the best way to
explain the protocol is fer to discuss
the stakeholders so as usual we have
developers that write code we have users
that then interact with these secret
contracts with that code and we wear
things kind of change is that we have
workers workers are basically the nodes
in our network that are running and
executing secret contracts we use these
definition to kind of separate them and
not to confuse them with the theory of
nodes and miners that reach consensus
the basic architecture is as follows as
I said developers deploy secret
contracts to the network
there's users can then submit tasks
that's the equivalent of human
transactions and that basically then
gets executed on the Enigma network and
final consensus is reached on ethereum
for developers we support two modes of
execution two modes of sorry of writing
contracts you can use solidity which
many of you know or you can use a web
assembly enabled language primarily rust
we're keeping solidity for backwards
compatibility but actually Ross and
webassembly have a lot more benefits
we're seeing dangerously go in that
direction and so if you really want to
enjoy all of the benefits and scale that
the system can provide you should
probably use the web assembly route from
a user perspective once a secret
contract is deployed the user can
interact with that secret contract by
submitting tasks which are again they're
the equivalent of ephemeral transactions
the main difference is that a task can
include encrypted inputs that the user
supplies under the hood what really
happens is that the user commits a proof
of the transaction of the task on the
freemium blockchain that actually helps
us reach consensus on the ordering of
the task so that the Enigma network does
not need to do this and we reuse the
trick all over all
over the place whenever there's
something small that we need agreement
on and it's not a heavy computation we
do dot on ethereum but the actual
execution then happens on enigma which
is a separate network the way that works
is we start with it the user starts with
a task right
he sends the task to the Enigma network
but which nodes is a task propagated to
we're not using the naive approach that
current blockchain use where everyone
computes everything that is
counterproductive to scalability instead
we have a proof of state model where we
sample a group a group of workers the
constant sized group of workers to
actually execute that task and those and
and those group of workers are always
weighted by stake which means that if
you stake more tokens you are more
likely to get selected to two more
computations and that really increases
scale that gives us a form of sharding
that is fairly simple to implement and
that we're gonna have up and running in
about two months
and then that quorum these Committees of
workers they actually run these
computations and at the end of an epoch
so for performance reasons it's not just
one computation that is each group is
assigned to it's actually a group of
computations that are bounded by time in
an epoch and at the end of the epoch the
workers submit the results back to
Ephesian a theorem only does very small
verification making sure all the state
changes are correct and if that's the
case the workers get incentivized if not
they get penalized and slashed so I'm
gonna I'm gonna go a bit deeper about
the what a secret contract execution
looks like internally what's important
to understand here is that each secret
contract has an encrypted state that's
like a that's like an ethereal State for
contracts but the difference is that
this is enter and enter an encrypted
when a computation comes in then the the
current encrypted States goes in
basically lives in the network and the
workers that are running the execution
they can update the state however they
see feed based on the
computation of course and then they can
spit out a new modified updated
encrypted state in addition users can
supply encrypted inputs users can supply
encrypted inputs and then get encrypted
outputs that are only selectively
revealed to them now what's really
important in this slide is how we preach
to a theorem we have a third type of
output which is the etherium callback
basically if you're a secret developer
if you're if you're a secret contract
developer you can enter it a special
return statement that returns statement
can can take the output of the secret
contract that just executed an enigma
call another smart contract on etherium
with the with the output from enigma as
an input to that to that smart contract
that completes the full cycle so if to
give you a concrete example if you have
a voting smart contract we do know how
private voting how hard it is to achieve
that in a good way on the theorem so
what you can do you can have the private
voting happen on enigma an enigma users
can supply their encrypted votes the
actual tally function runs on enigma
workers and then at the end of that you
can commit that result back to smart as
input to another smart contract in
aetherium that can do whatever business
logic with those results that it wants
all right let's switch gears a bit so
far I told you a lot about how enigma
architecture works and that we have
encrypted computation but I was kind of
hand-wavy
right let me explain to you how we
actually protect privacy in the network
so for discovery right now we're user
entrusted execution environments or T's
to actually achieve these privacy
guarantees these are basically a secure
region in the processor that can hide
any data and anything that goes inside
of a computation from even the host so a
malicious Souls cannot see what they're
computing over it gives us great
scalability guarantees it gives us
strong privacy guarantees but we're
actually thinking about how we can do
better there are other privacy
preserving technologies that are
available today that are purely
cryptographic this is actually a good
time to say that when enigma started and
I was a student at MIT my teasease was
on how we can achieve privacy preserving
smart contracts using secure multi-party
computation or MPC which is one of these
techniques MPC is a distant cousin to a
fully homomorphic encryption they both
try to achieve the the goal of computer
over encrypted data but because NPCs
steal orders of magnitudes more scalable
we are focusing on developing that one
one final note on zk snarks and Starks
there's there's a a big misconception
about these technologies they're an
amazing technology but at the same time
ZK star snarks and Starks don't actually
allow us to compute over encrypted data
what they allow us is that if we trust
someone with the data that someone can
then prove a computation over that data
without actually revealing the data to
anyone else but you still gotta trust
someone with the data and in the context
of smart contract this doesn't work
because in when you execute smart
contract on the blockchain the nodes are
untrusted you can't trust them to
actually see the data so ZK snarks and
Starks are with the exception of very
specific use cases like transactional
privacy that are usually explored for
scalability and not for privacy long
story short we need something like MPC
and I'm going to give you a quick
background about how that works
I'll try to go I can't go into too many
details but I try to get to give you the
main idea
so MPC works in this paradigm let's
assume first that we have an ad ideal
world in this ideal scenario we have one
trusted machine a godlike machine that
we can send any computation to and any
sensitive data and we can trust that
machine to always produce the right
results and
ever to leak the data to anyone this is
obviously not possible in the real world
these process execution environments
really get us to the limit of what's
possible with that but it's still not
perfect if we want the perfect solution
will need cryptography so NPC comes and
says you know maybe you can trust one
machine but if you can trust a network
of computers where all of the net all of
the nodes in the network's don't have to
be trusted but as long as there is at
least one honest node in that network
then you can actually run secure
computation you can actually run any
computation and achieve both privacy of
the data everything remains encrypted
and you can get the right result it's an
amazing it seems almost impossible and
counterintuitive but we actually know
that from the 80s so let me walk you
through a simple example of how that
works let's imagine we have a very small
network of three computers and they're
gonna do MPC to solve the problem of
computing over encrypted data so first
of all we need to find out how can we
store data in this network storing works
by a process called secret sharing it's
actually not that complicated but I'm
not gonna explain it here but the main
idea is that you take a piece of data
let's say that data is called X and then
you split it into different encrypted
shares and only send one encrypted share
to each computer so the first node gets
x1 the second X to the third X 3 all of
these are independently encrypted you
can do the same with any any amount of
data that you want let's say Y and now
let's run a simple computation so let's
say we wanna run addition when it turns
out that addition comes for free because
of the properties of secret sharing all
you have to do to compute the addition
of X plus y is as each one of these
computers to just combine the numbers
together locally and that's it and then
when you want to decrypt the result what
you have to do you
have to send all of the shares of the
data back to someone that someone having
all of the shares in one place can
decrypt the information but an amazing
thing you happen here these computers
have ran a computation they don't know
the excess they don't know the whys and
they don't know disease all they saw if
you probe into if you zoom into one of
these computers all you see is encrypted
data and yet this guy got the decrypted
result so that's the basic of MPC when
it comes to addition multiplication is
more complicated but I do want to go at
this on a high level of how it works
so for multiplication it turns out that
we need something else when it's
something called multiplication triplets
multiplication triple triplets
that's the ABC they are correlated
randomness so a and B are just random
numbers that are randomly generated
independently but C is correlated
because it's the product of a times B ok
and now every node has has these
triplets these triplets are independent
of the data so they can actually be
computed a priori like you can put a
supercomputer these computers can work
overnight and just generate many many
many many of these a B and C's the
reason is that these a B and C's are
then used as a one-time pad and they
cannot be reused so you really need many
of these pre-process for a computation
so now let's do the actual computation
we want to compute x times y what
happens here is that each node takes a
one-time pad of their share of x and y
the reason they do this is because then
they need to share these with each other
which is what happens here and then when
they share it with each other they can
because they have each one of them has
all the shares they can decrypt a number
called D and a number called e Deenie
are basically a one-time pair of x and y
why is this important because if we
not Dundee step then all the nodes would
have shared their X and Y's together and
by the property of secret chairman if
you get all the x and y's in one place
you can decrypt the actual information
so this is a master we cannot avoid this
but because c equals a times b and if
you then plug that into this equation
just by very simple algebra you're gonna
have to trust maybe you're getting is
gonna cancel out and you're gonna end up
with Z equals X x times y or actually
each of these Z's is an encrypted share
of x times y and so at this point you
can just send those these back as with
the addition and hold and behold we
computed multiplication over encrypted
data now that might not sound that
exciting I mean addition multiplication
fine how do we get general purpose
computing well it's a very known result
that will addition multiplication you
can actually compute any function and
that's what we use and that's
technically what I believe other other
other techniques like fhe and Starks
years that's really all you need so how
does that tie back to enigma and what
are we working right now to develop next
beyond trusted execution environments so
the idea is the idea is and there's only
a small amount of difference we need to
make the idea is that when the user now
submits a task instead of encrypting
those with you know a yes or something
and just sending these to the enclave's
what they can do they can do the secret
chairmen they can split these into
shares and share one and and send one
share of the input to each node in the
group in the worker group that is
randomly assigned and everything else
kind of happens is the same way the
worker groups having secret shared
version of the data of the inputs they
can get they can take the webassembly
code and then just go one by line line
by line in the web assembly code and
interpret that as an MPC protocol so for
example if you have an instructor
if you if you have an instruction that
says if you have any service that says
that's multiply two numbers when it's
actually being interpreted as what I
showed you two minutes ago
now I'm running out of time a bit so I
what I do want to focus on is first of
all that this is life today we have very
serious projects building on us and
there's a whole host of applications
what this is relevant we talking
governance auction secret icos
and privacy-preserving Dex's and many
many other use case and at this point I
want to invite Stan from our team to
actually show you a live demo for
privacy-preserving voting thank you hi
I'm a software developer at enigma and
part of the protocol team today I will
demonstrate a demo that is built on top
of our application but before I want to
make a claim and kind of walk you
through this so unchain governance what
is this so it's kind of at risk if you
think about it we're trying to build
this decentralized world this
decentralized applications but the more
we grow the more decisions we need to
make in a decentralized environment and
this means voting so if we look today
the common use case is for voting RTC
ours which is token curated registries
and dowse by the way raise your hand if
you know what the TCR is all right this
ye are are basically a list a list of
some vendors and reviews you can think
of a decentralized al put tokens so we
have TCR and we have dows that maybe we
want to vote on a change of leadership
or maybe we want to fork the network so
all of those require voting now usually
the scheme is done with something that
is called commit and reveal it has two
steps the first step would be you hash
some vote you commit this on chain and
then you have this period of time where
you have to reveal the real value on
chain and validate this
now there's two well it's kind of sucks
from a user perspective because it
requires you to remember to reveal your
vote in
limited period of time so if you know
civil project for example they sent
Google calendar reminders to tell you
hey don't forget to vote otherwise it's
lost and also it doesn't prevent vote
bribing because you can always see who
voted for what so with the demo I'm
demonstrating now it's kind of solved
right so basically the the schemes today
are launching voting is subject to
automated bribery attacks you can have
different attacks and this is a problem
so now I'll show you have a demo and if
you want to build something like this
all you need to know is solidity and
JavaScript to interact with our network
so this is a voting application based on
top of the enigma protocol and this is
just in the browser so maybe the
internet would work okay so basically we
have here accounts et really counts at
our disposal and they're connected to a
test net and we'll access them
programmatically we have tokens we're
using for vote and you buy those tokens
and you use them to vote at some
exchange rate then we have stake tokens
I know it's blurred those take tokens is
for for you to do weighted voting so you
kind of you can stake five tokens and
wait with and vote with the weight of
five after we do this we need to buy
tokens so we will buy ten tokens and we
will take five of them into the contract
and now we need to create a poll so we
need to insert some bits of information
first of all we have quorum so we will
choose a quorum of yes votes divided by
the number of total votes should be
bigger than 50% and it's a simple
majority so if we have more than 50 the
poll has passed then we need to ask a
question so is privacy important and
voting and very topical and then we need
to add some period we'll say 60 seconds
so we have 60 seconds to vote go ahead
create the poll and then users can start
voting so the first user will go in and
say stake 5 and say yes privacy is
important the timer keeps growing and
most importantly is the result
you can see in the console it's saved
encrypted in aetherium so just to
reiterate no one no third-party sees
this information and who wanted for what
so this is an important aspect and then
we need to vote again right
so after this happens we'll switch an
account this is all Testament of course
but this is why it kind of happens
behind the scene so we'll take three
tokens and we say nope privacy is not
important again you can see the result
is completely encrypted and this is how
we start on chain um so again at the end
of this timer a very important function
will happen on our side this will
trigger a computation the nodes on our
network will fetch the state fro
material compute over the encrypted data
tightly the results commit them back on
chain and modify the contract state on
etherium yeah we can see that success
for those of you who keep account we had
five vote saying yes really won't saying
no so privacy is important and then on
the front end we have this event
listener just simply listens to an event
on the tearoom account on the aterial
network and you know once the poll is
ended it can update the UI that's
alright so I know we run out of time but
I just want to just want to finalize and
tell you some exciting things secret
voting the demo just saw is not just a
demo it's actually being produced by
very reputable companies in the space we
have Aragon and ocean protocols actually
building privacy preserving voting on
ethereal right now you can actually look
at the code if you want it's live
another amazing example is machine
learning over encrypted data so eggs in
chain was working with us has
implemented a scheme where they can
classify our credit worthiness that's
what the plain he represents in the
diagram and they can keep the actual
weights of the model completely
encrypted so they can hide the model
from the network and still continue to
train it
and get better predictions on whether
people credits is worthless or not
enigma is live today you can work on it
you can build on it just go to enigma
dot KO / protocol and start building we
have documentation we're open to
feedback the code is open source
everything you need is there but what's
even more exciting that I want to
announce today is eggs enigma growth
grants enigma growth grants is really
the best way for you to become involved
is the new emerging ecosystem we're
going to work together with the people
who apply to grounds we're going to fund
these
we're going to help this evolve and this
includes a lot of the core things that
we need to make the enigma platform an
independent thriving ecosystem now
enigma is exploding right now it's
growing very fast and there are many
ways for you to get involved beyond eggs
whether you're a developer or a user or
you want to just run node and stake and
earn rewards all of the information that
you need is packed on this slide thank
you very much
you