hi everyone i am from pier 1 of chain
ups and i want to take this chance today
to present what we've been working on in
the last few years
who we are we are two teams of applied
cryptography researchers in Darmstadt
Germany and vassal Poland and we provide
cryptographic protocols and proofs but
our focus our goal is how we can use
smart contracts to scale blockchain in
particular I want to present to you
today three protocols that we've been
working on the first one you might have
heard about is called Piron and
extensions where we try to build a
framework for state channels the second
one is called fair swap where we tried
to build use smart contracts to build a
fair exchange protocol and the last one
is a very recent one called fast kitten
where we use trusted execution
environments to build secure private
smart contract execution so let's start
with the first one here on end
extensions and smart or state channels
is an extension of payment channels and
most of you will have heard about
payment channels and the idea is to get
rid of this very long duration and
costly single payments on the blockchain
and encapsulate them into a channel
which is secured by channel contract on
chain and this allows to make off chain
direct payments between two participants
really fast without additional costs and
our goal here is to take these existing
payment channels and make them more
powerful and we did this in three lines
of works and the main component that we
use to Staub servation that we can run
or we can put contracts that we can put
on chain also in state channels and not
just one we can put multiple contracts
into a state channel and this is a nice
observation because if we can do this
then we can also put a channel contract
into a channel and this is really nice
when we want to connect more than two
players in this case for example we have
Ellison English who have a channel and
Ingrid and Bob who also have a channel
and in both of these channels we now put
a channel contract which opens a new
virtual channel
between Alice and Bob this is really
nice because of opening this channel we
don't have to go unchain but this
completely happens off chain we can also
update this at closest of chain and use
it as much as we want again we can also
open contracts inside the virtual
channel as many as we want and the third
extension that we very recently
published is that we can also connect
more than two people we can connect end
parties by putting an end party contract
into channels and this these M party
channels also provide the same the same
properties as a direct or a virtual
Channel but enough about channels I have
two more proposals to talk about the
second one was fair swap and fair swap
tackles the problem of fair exchange
which is really hard to solve without a
blockchain classical examples when you
have a seller and a buyer and the seller
has a file X and the buyer is willing to
pay for this file but only if it's the
right one which is here measured over
his hash so very naive solution is we
just take a contract buyer submits a
coins seller submits the money and then
the contract verifies has correct or has
incorrect but this is actually really
expensive when we talk about large files
about bigger or megabytes so we propose
a new protocol called phase one where we
encrypt the file and not send it to the
contract but directly send it to the
buyer in the first message this is
happening directly between seller and
buyer so no on sharing communication the
buyer cannot see the file at this point
because it's encrypted and it's missing
the key so it locks the coins which will
make the seller submit the key and then
the buyer can decrypt the file to
actually look into it and verify if it's
correct or not correct and in case it's
not correct it sends a proof of
misbehavior to the smart contract which
the smart contract the the judge in this
case will verify so the goal here is to
keep this piece of information
as small as possible ideally independent
from the size of the overall file and
how we did this is by exploiting up the
file in many small chunks and the hash
that verifies its correctness actually a
local hash so the hash root of the local
tree is used to verify if the file is
correct or not correct so in this case
we have a very nice scenario because
Ellison bought if they disagree about
correctness of this can actually limits
the disagreement to a single element of
this tree so in that the last element is
wrong or a single evaluation of this
hash tree is wrong and in this case they
only have to send a single element a
single chunk of the file which the judge
has done to verify this can be done
really cheaply we measured it around
half a year ago where it was like two
dollars independent from the file size
so you could send an arbitrary large
file and this complaint was taking a
constant amount of fees and we also
evaluate the security this is something
that we take a lot of effort in formally
modeling and verifying security of our
protocols in this case we ensure that
it's fair so atomic exchange of payment
and file we also want to make sure that
it's sound so the buyer has to guarantee
that if he gets a wrong file you can
always generate a proof of misbehavior
and it will always be accepted and the
unfortunate EE property is really
important such that the buyer cannot
come up with a wrong proof of
misbehavior claiming the buyer
misbehaved even though he didn't and we
prove all of these properties formally
in the paper we also worked on some
extensions of this the most important
one is that I was basically only
explaining one example with the file and
the hash this also works for generic
witnesses and circuits so it's very
powerful can use
arbitrary programs or can verify
arbitrary programs and we also have
interactive and a non interactive
version of this dispute of the proof of
misbehavior and the non interactive is
nice because we have as soon as we have
five interactions with the contract and
that's it and the interactive dispute
has many more interactions with the
contract but we have three fairness so
we have the guarantee that all of these
transaction fees that have to be paid
for the dispute will only be carried by
the teacher by the cheating party so an
honest party doesn't really care how
long it takes or how expensive it is it
will always get reimbursed now to the
last of three things that I wanted to
present today which is called fast get
in fast kitten we use a building block
which is called a trusted execution
environment te or trusted Hardware where
this piece of hardware is trusted to run
the code we give it and no one can
influence this this execution but of
course why this piece of hardware has
trusted the person that runs it is not
trusted so we have this operator who is
in charge of giving feeding information
to the TE and forwarding its output so
it can stop the te you can stop
forwarding its messages but it can never
lie about the computation inside the te
and it cannot influence the computation
so we use this building block which is
quite common now in in cryptography and
try to run smart contracts inside this
piece of hardware and we get from this
is actually a really powerful protocol
because we can run a contract
independent of size of chain we have
very high guarantees we can protect
against malicious mock parties and
malicious operator we can uniquely
actually be at fault in case someone
misbehaves and also this protocol is so
simple
we can actually build it on Bitcoin okay
so how does it work
we have this T here in the operator and
all of the parties so they want to play
a poker game now which means we load the
poker game into this piece of card where
the parties attest this te so they know
that this is actually trusted hardware
and this is actually running the right
code and then the operator deposits a
security penalty deposit and all of the
parties lock the coins for the game then
we start and at this point we don't need
the blockchain we just run everything
off chain so the parties send their
inputs to the TE but I actually do it in
an encrypted way so the operator cannot
see the inputs and the TE also sends an
encrypted output back to the parties so
the operator has no idea of what's
actually happening and also the parties
don't see each other's inputs this is
also a nice feature with a theorem
doesn't have right now and it's really
hard to build its my contracts but it's
given for free in this setup so now the
parties can actually see who won and get
their money back from the TE which means
that he outputs a transaction saying
okay here Alessio Charlie get other
coins of course we still have to protect
against all this power that the operator
has so in case it misbehaves we actually
have to wait for a certain time out and
then the parties get refunded their
money but the operator lost his security
deposit which is well really painful for
him so to summarise over all of these
three works is a very interesting
observation that smart contracts are
really powerful tools that we can use to
ensure security and that can also use to
build more scalable protocols and our
goal here is to really provide
cryptographic models and proofs with all
of these protocols and really show that
they satisfied cryptographic security so
if you want to learn more about this
feel free to talk to me here at DEFCON
thank you
[Applause]
you