thank you all for braving the tsunami
for one of the best last talks at the
conference this is the talk on Satoshi
she has no clothes
what about Szabo so do we need privacy
for smart contracts I sort of started
about thinking about this because
everyone sort of understands that you
want privacy for money for some reasons
that's the problem for cryptocurrencies
is that they are basically Twitter for
your bank account they expose all of
your spending details to everybody
your creepy ex girlfriend or boyfriend
do your business competitor is literally
everybody so this is the thing that
we're starting to understand these days
but it's not clear what the analogy we
should draw for smart contracts is it's
not exactly clear what we mean by
privacy and it's not clear how we could
possibly get it right so if you know
cryptocurrencies Twitter for your bank
account you know what is a smart
contract well it could be Twitter for
you easy to account but easy to already
has that that's Amazon s3 that everyone
fails to secure and like leaks all the
credit card databases and such so it's
not that squared over your Tamagotchi
clone is a nice description of crypto
kitties but doesn't tell you why you
care about privacy and similarly twitter
for your ponzi scheme well that doesn't
work either so we don't have that kind
of analogy but there is an interesting
one that I think is worth mentioning
because it's linked to privacy which is
a you know small contracts are like
privacy in a different way right we have
this fail whale problem right so for
those of you who you know use Twitter
back in the day Twitter broadcasts all
your data to everyone and they had the
scaling problem or they couldn't handle
the massive amount of data that was
public and so it turns out that if you
could solve whatever it is about privacy
and some worry for payments and you do
refer small contacts as well you'd
actually end up helping scaling in the
same way because you'd have less data
right so something vaguely before
figuring out what privacy is these two
things are linked right if you reduce
the amount of information that's out
there for everyone to see about you you
also reduce the amount of information
the network has to deal with so okay
well what's a smart contract well okay
I'm a computer scientist I'm about to be
a professor at the University of
Maryland
next year found excited Z cash you know
I tend to try to define things so you
can look at a small contract as a
function f on some state AK s and it
takes inputs you know X and it does an
update to get you a new state the
blockchain checks that all this stuff is
enforced this is really just formalism
so you start thinking through this and
you start thinking about well what can
we hide right we can hide the inputs
that you're calling the smart contract
on that's one thing we could hide the
actual state of the smart contract
that's another thing and then
importantly we could hide what the
actual smart contract even is so that
nobody knows that like crypto Katie's
Observer ran but when we start thinking
about it in this way in this sort of dry
academic approach we just go whoa what
are we even trying to do here again like
this formalism doesn't sort of reflect
real life it's not clear what to think
about this is not the way you should go
about this right so the first questions
like why does privacy matter for
contracts at all right and it's hard to
give just one reason because unlike you
know peanuts right well we all know what
payments are on a day to day life we
know what bitcoin was trying to do smart
contracts are everything to everybody
right there is no one use case there is
no one privacy story I can tell you
right for things like actual legal
contracts going back to like the nick
szabo ideas of these things right you
have some kind of settlement mechanism
for it an actual like agreement you made
between parties it's kind of obvious
that you need some form of
confidentiality because when businesses
sign contractual relationships between
each other they don't publish them too
happy about the world right and so if
you really use smart context as part of
business relationships then all of a
company's business relationships would
be public and no business will do that
because we won't use these tools that
prefer to pay lawyers $400 an hour to do
actual contracts that are confidential
all right so that's one use case right
another one if you're trying to do defy
right well you don't want trading
strategies to be public you don't want
all the information about how you're
trading what you're doing to be visible
to everybody and I think this is
probably one of the more compelling use
cases for privacy on the blockchain
because we know that finance firms try
to get any edge they possibly can right
so if you've used Google Maps
you know that there's a satellite photo
button that you can get satellite photos
of the entire Earth right Google is not
the one financing all the satellites
those companies that do commercial
satellite photography one of the
principal clients is hedge funds because
they buy overhead and he'll of photos to
be able to figure out how much forming
someone's doing how much business our
factory is making how many employees
someone has based on who's in the
parking lot right so these are guys who
are willing to build spy satellites to
get information about what they're doing
on a market so compared to that
downloading your blockchain and doing a
bunch of analysis it's a really easy
thing right so you need privacy in that
setting if you want to do some kind of
crazy global computer it's not clear
what you're going to do with this what
your access policy is all but we already
know that you don't want your actual
computational stuff to be public right
this is again back to s3 right Amazon
leaking everything mistakes happening
things getting breached you just you
don't want your computer harddrive to be
public to the Internet right anybody
here want to put up their entire hard
drive on like like a share link to
Twitter anybody can read it right nobody
wants to do that all right so that's the
use case there the bottom line is that
no business is gonna use any of this
stuff that leaks all this data so you
need to have stories about how to
mitigate what's going on and to provide
privacy options so now we're back to
this well what is a smart contract and
again it turns out definition is useful
but the real thing you need to think
about is you know what do you what are
you actually trying to do right so
though for questions right who needs to
verify your data right where when do
they need to do it where is the secrets
where are the secrets in this system
right and then finally what are you
trying to hide so in terms of verifying
it yeah it could be just you but if
you're just trying to verify your own
data well that's kind of sad and you
really don't need a blockchain right if
it's the current participants that's
actually a thing we know how to do and
that's really nice if you want anybody
in the future to possibly be able to
verify what's going on things get
interesting
and actually we'll get to some research
on that that solves it at the end of
this talk right the other important
question is when do you need to verify
right if there was a smart contract or
you know you're doing some computation
with people do you just need to know
it's correct right now do you need to
know it's correct as the computation
goes on after you
laughter they're no longer participating
do you need to low no it's correct
before you even get started like you
walk into a room people have been
dealing cards and playing a game do you
need to know that the deck wasn't loaded
even though you never saw that part of
the of the game happen it depends right
the next question is where - secrets
live and this is actually probably their
will got chair with smart contracts
because if you want your secrets to live
with random people off chain the people
are participating it's fine but two
people can share it can keep a secret if
one of them is not a blockchain right
block chains don't keep secrets and so
the usual problem we run into when
people start thinking about private
smart contracts is they go oh I want the
blockchain to hold an encryption key to
hold my password to hold some data and
that turns out to be incredibly hard to
do and quite problematic so you you
prefer to avoid it and then finally and
this is sort of the mundane more
low-level putting my professor hat on
like what are you trying to hide right
are you trying to tie the state of the
contract which the state metadata like
which contracts being run that one turns
out to be important the inputs or even
the actual function right so well okay
what are these things how do they break
down well let's look at a couple of
examples I'm going to go over three of
them right which is sort of common
things that come to mind right one of
them is a simple game poker right the
next one is let's consider something
like payments this could also be like
custom tokens custom assets any of these
crazy defy projects right they all have
these like custom tokens and underlie
them right it's like a video game arcade
at Chucky Cheese right you built this
whole complicated machine but you also
have these custom tokens you have to put
into it to power it and you might need
privacy there and then finally a typical
thing that comes up I'm not really sure
why but it's what everyone thinks of
it's like auctions right you want to do
a sealed bid auction to price an asset
right and these all it turns out have
some privacy goal they want but they're
different right so in terms of poker
right who needs to verify what's going
on well it's only the people playing the
game right if you all show up to a poker
table you decide to do hand the only
people who care what's going on in the
poker game really all the people there
right and they only care about it for as
long as they're playing the game and
they get the money out after that nobody
cares
alright so veil needs verify it then and
finally right the secrets who has what
card what hand that's just shared
between them the blockchain never needs
to know about it right you don't need to
get them to keep something permanently
so this is somewhat easy right the state
you want to keep private is you know
what people's hands are the inputs
actually the bats the actions that like
raise call flip the river card those
actually can be public so this is one
setting in contrast payments get a lot
harder because in the payment system
everybody needs to be able to verify
what's going on because anybody you
might pay needs to know that your money
is actually good so this process is a
bit of a problem right and they need to
verified anytime in the future the
people who keep the secrets well that is
simple in this case is anyone who's
holding the bag right anybody who has
money he has crypto tokens those bag
holders they need to keep the secrets
but nobody else and for that you're
keeping all the data secret the balance
from the to everything else right and
then finally for like a sealed bid
auction again we're back to the
participants needing to just know what's
going on only during the auction so this
is similar to a poker game but the
difference is that the secrets are kept
with an auctioneer those are the bids
and the bids are what you need to keep
secret so what do we do about this well
there are a couple of different
techniques you can use that can work for
various things there were basically
three on the first one is a thing that's
called refereed the computation this
came out of academic work in 2009 him
that nobody ever heard of and nobody
ever cites but then got sort of
reinvented I think completely by
happenstance by things like true--but
and arbiter manof chain labs and no
doubt other things I haven't thought of
this is sort of like state channels in a
certain sense and these provide a
certain kind of privacy the next thing
is trusted execution in the form of
either SGX or MPC and this is really
sort of the Holy Grail but it turns out
to be problematic and then the final
thing which is sort of what my research
is on and in fact I have a paper
appearing this year on
is sort of zero knowledge-based
execution protocols and so this starts
with Z cash which does privacy just for
a fixed function which is payments
it got generalized on some things that
say oh you can have multiple different
functions that standalone it's basically
different block chains then called hock
and then the latest piece of research
which is by me and my co-authors
actually so you can have general
computation instead of a composable way
right so I'll give you a brief overview
of these threes that's techniques so
refereed computation is you know sort of
like a state channel and it actually is
the closest thing to a wheel-like
contract in the sense of what we have
under the law right you have some
parties they agree to do some stuff they
do whatever it is off chain as long as
everybody's honest right they don't
disagree nothing happens on chain you
have no privacy problems if there's ever
a dispute though you take it to the
blockchain and the blockchain is
supposed to mediate the dispute right
and so this works quite effectively
quite efficiently it doesn't have
privacy inherently when you resolve it
usually when you resolve it on chain
everything's public similarly to a court
case but if you do have some other a
privacy solution for doing private
computation on chain turns out you can
make this private right and you can use
this for something like a poker game
quite well it works nicely right and so
in this case right this works for
systems where you know only the
participants care about the correctness
only insures correctness well
participating because you actually have
to be moderating with these people and
it hides pretty much everything if you
get the dispute process right so that's
one option but it's limited right it
basically works for these things where
you only care as long as you are in the
room right it doesn't work for money and
the reason it doesn't work for money or
anything like it is because a year ago
when you weren't part of the
cryptocurrency scene or whatever twenty
guys could have gotten together and
decided they were going to invent a
bunch of extra money and since you
weren't in the room you didn't see them
do this so you couldn't dispute it on
chain and now you have no idea what
happened right so the only this only
works when you've seen all the state
transitions the next thing you can do is
SGX right or multi-party computation and
these are actually very similar from a
conceptual point of view they basically
both conjure a trusted third party out
of thin air
right either do it by assuming you have
hardware that's secure or by assuming
that you have some number of servers one
or five of them are honest and then you
do some crazy cryptography and ideally
this provides exactly what you would
want like a perfectly private smart
contract that can keep secrets and do
everything in practice it's a little bit
of a challenge trusted hardware is
frequently broken right like Intel has
had problems we don't really think you
can do this securely if you're dealing
with a serious attacker and the MPC
stuff is actually expensive and in
particularly dealing with parties who go
offline both for SGX and for MPC is hard
because if you have encrypted data on
your blockchain and the guy holding the
key even if you trust him disappears
your data's gone so you have to figure
out some way to you know share secret
share key and have a bunch of people
then you know we've refreshed shares and
someone goes offline you have to hope
people don't get corrupted if you screw
this up and someone pretends to go
offline and it comes back they can end
up holding all the keys and either in PC
or SGX and then they have all your data
so it's risky right but it does give you
the ideal right
so in SGX NBC what happens everyone can
verify because they are supposed to
trust this mechanism they can verify
forever but before after assuming they
trust the nodes that are running it the
MPC or the SGI can actually keep secrets
it can keep encrypted data on a
blockchain and everything's hidden but
at a very high cost which is dis
conceptually this stuff is incredibly
brother so that brings us to the zero
knowledge approach right in any idea is
instead of posting your input to the
smart contract and the existing state on
chain you just replace all that with a
zero knowledge proof that hey we did
this update and it's totally correct
naively if you do this you'd reveal the
actual state so okay you encrypt that
you hide that same thing you do and like
say Z cache but they're two problems
with this naively if you do this this
way it reveals the metadata of like what
program is being run
what payments are being made and if you
and it reveals what function you're
running so what do I mean by this well
consider a basic ERC 20 token write your
state is a table of who has what money
the function
you know allows payments decrement one
row increment the other and if you
naively did this just let's prove this
is correct you'd run into one of two
problems either everybody would be able
to view this table who is part of the
the RSC 20 dokkan so you'd have no
privacy or you do something weird will
you leak which things being updated all
right so what do you do instead why you
take this table and you split it up into
little mini tables which are kind of
like UTX those where each person has
their own separate state right and now
nobody can see all this thing
necessarily when they're doing an update
and so you have this but you still
haven't solved your privacy problem
because if you want to make a payment
from like Bob to Charlie you have to say
I'm gonna update this entry this blob
and this blob and people are going to
know you're updating those thankfully we
know how to solve this right we just do
the same thing that Z cash does right we
put everything in a miracle tree we
prove the new entries on the tree and we
show that the records are correct and we
break this linkage right this is fairly
simple it was straightforward to do once
you have decency case snarks the
question is and the thing we actually
really didn't sexy is you know how do
you get this to work what's the
computational model and so in this the
computational model is you have a
commitment to data on chain and the
commitment contains the code that
created it and the code that's going to
run when you try to hit like update it
and then every time you do a transaction
all you do is prove and zero knowledge
that the code the Creator that was valid
and actually ran that your transaction
is well-formed and that the code that
was supposed to run when you updated it
actually ran correctly right you
actually do this via a layer of
indirection where you have multiple
different ZK snarks and the cool thing
about this is that unlike previous work
which did this is a standalone thing in
this system you can have multiple
different assets multiple different
custom contracts and they can all
communicate with each other privately
and nobody will know which ones which
write versus in the previous models you
had basically a version which was D cash
a version that was some custom asset
another custom asset and everyone could
tell which one was moving back and forth
so in this model you can verify everyone
can verify what's going on because the
zero knowledge of proofs are correct you
can do it at any time
the secrets however do have to remain
off chain and so that's a little bit
about a little bit worse but this is I
think quite effective and so we have you
know these kind of options to do all
this stuff
and I think the zero knowledge one is
actually something you'd seriously
consider it so with that I'll take
questions also on the off chance that
any of you want to study this stuff I'm
starting at fall 2020 as a professor
when I'm looking for grad students thank
you
[Applause]
you