[Applause]
so if you put disclaimers if you come to
see this talk we really hope you have
familiarity with your knowledge pretty
smart encryption and really hoping to
provide as unbiased that the discussion
as possible here you feel like we're not
doing a good job of that
who eats people feel free and call us
out so what does a private citizen smart
phone chimes there's a few different
like components of properties and
present Pacific's markup caps that are
going to go over it with exactly what
defines them another case privacy is
defined by two properties
confidentiality and anonymity and what
we define privacy is in this case that
confidentiality is when we can hide the
inlet and the outputs of that at that
state machines program so for example
like in a slowly smart contract we all
know that the inputs are not private
everybody can see them as well as they
are also no no buts there the inputs are
not confidential and also they don't
find the users involved in that
confrontation so we have two properties
that we've been finding but is
confidentiality so that's like the bare
minimum which is like just and puts it
in and then and there would be like a
more complete solution where it applies
confidentiality you're probably familiar
with some of the use cases for smart
contracts in case you didn't know so our
contracts are also a form of private
transaction so like a Bitcoin
transaction is a smart contract to some
extent so in the case of private
transactions there are viewing with
these Z cash banana and two major ones
private Bodi is known as case where
people actually need to have their some
privacy some degree of maybe even
anonymity when they vote to cast ballots
as well as auctions there's a really big
market for wanted options and keeping
that who is paying for what how much
they're paying right so there are some
considerations for preserving smart cat
an honor talk were mainly going to focus
on transaction privacy the reason why is
because transaction privacy is a small
subset problem of private transit of
privacy you preserving smart contracts
and the cool thing about transactions is
that when you make them private you can
actually sometimes generalize these into
more broad definitions of smart
contracts so they can actually make them
into more intelligent Asians
now don't that weren't just transactions
there may be involved like whole state
machine you can pull an execution we'll
be getting more into that later so we
believe there are four main
considerations that go into actually
developing a privacy preserving smart
contract
so we've separating things out in queue
the privacy security and functionality
within each of us there's a lot of
complexities so in efficiency you can
ask yourself how long does it take to
actually generate the transaction
what about verifying a transaction what
is the actual communication complexity
setup string size set-up time that's
entering size what are the hardware
resources required government zero
knowledge systems do you have a lot of
hardware resources required and they
tend to gloss over that aspect and how
does it actually scale with privacy as
we mentioned before can we provide
confidentiality or anonymity and is the
privacy based on cryptographic
techniques so do we have some truthful
form of privacy or are we using other
techniques such as tumblers for
anonymity or stealth addresses security
has similar considerations is the
security based on cryptography
do we have provable security or is
security based on non cryptographic
techniques we can look at trusted setup
we also have to consider LAN standard
cryptographic assumptions such as using
the algebraic remodel knowledge of
exponent which are slightly on standard
and we have to consider what kind of
adversary is our scheme actually secure
against a post one-to-one a semi
malicious one and then finally and
arguably to us the most important
consideration is functionalities when
they're talking about developing PTSD
can you actually adapt your scheme to
new settings is it possible to really
express any arbitrary computation with
your scheme and more importantly is
there support for stateful computations
like area
so that leads us into what we believe
are the four definitions for these
qualities for efficiency in the ideal
world it should be quick to generate and
verify transactions that it should be
fast there should be a small
communication cost it should be
efficient when scaling and minimal
hardware resources are required with
privacy we should be able to get
anonymity not just confidentiality it
should be based solely on cryptography
security is similar it should be based
solely on cryptography we do not want to
use a trusted set up both for security
and functionality reasons and it should
be secure against strong adversaries
we've left this deliberately ambiguous
because it depends what you can achieve
a nurse eat and buy these are
functionality we should be able to check
off all three boxes that we just saw we
want it to be easily to easy adapt to
new settings you should be able to
express any kind of program with our
scheme and finally it should support
stateful contributions so how do we
actually achieve these four
characteristics we're going to focus
exclusively on the cryptographic
techniques because we believe in through
the whole security and privacy the first
one we're going to look at is of course
zero knowledge proof and there are three
main schemes that everyone's familiar
with snarks starts and Moltres so four
starts they have trusted set up however
that allows us to get the smallest reach
sizes out of the three and the fastest
verification possible but they also use
a slightly non-standard cryptographic
assumption which is knowledge of
exponent Starks are arguably in a true
on Starks and that they have no trusted
setup and they use a much better
understood and partners assumption of
hash functions but that comes at the
cost of incredibly large group sizes
compared to the other two and some
expensive partners needed and the form
of extra RAM to actually get the
efficiency they talk about 5min fulla
troops they fall somewhere in between
the two there is no trusted setup which
is fantastic
they have moderate proof sizes but they
have some of the worst verification
times however they can be improved when
batching them together and they're based
on well understood hardness assumptions
using discrete locks so if we look at
the three and see how they compare in
terms of the four qualities we've
ignored privacy because arguably all
share of knowledge proof systems better
compute provide confidentiality in terms
of efficiency starts come out ahead with
the smallest reach sizes and the
founders verification however you know
their trusted set up functionalities
impacted a lot it's very difficult to
port receive in settings starts have
very poor efficiency as you see because
they need additional hardware resources
and they have absolutely giant true
sizes but they do very well in security
and functionality as do both groups and
both of ears fall somewhere in between
mature so that leads us into the next
building block that touches going to
bail them out so the next one is that is
called multi-party computation something
I probably shared a lot of you are
already familiar with in the form of
secret sharing scheme such a severe
situation so
multi-party computation is a type of
privacy preserving computation technique
which allows us to secure the inputs to
some predetermined program and we have
multiple
artists who collaborate together and
work together to execute this program
and then the outlet they should have
been tried that outlet that only the
person who requested that competition
should know like I said one of these
examples should be super charity which
you're all probably familiar with in
like the cases like wallets
how does put up your wallets and so
so maybe this is the most predominant
issue that everybody should understand
what we're talking about multi-party
computation is how interactive it is it
is incredibly interactive depending on
the number of parties you have so
anything more than usually two or three
participants we start seeing some really
massive problems and for many other
protocols that requires something like
zero knowledge proves to keep the
protocol actually fair so what that
means essentially is we have like
complexity layers and our NPC protocols
like the very first layer we can imagine
the network so all of our participants
have to communicate with each other but
we start having similar problems like
traffic you know when you get in a
traffic jam the first person in the
front of the traffic gym steps on the
brakes which causes everybody else's
7212
so we started seeing network latency to
filter through the entire property
through the entire network like that and
it causes massive problems especially
when a lot of communication is required
for more complex things like we can
imagine for a privacy-preserving
smartphone track another thing is that
as game theoretic and security sometimes
where we may require novice majority and
to keep things fair we require another
layer of complexity like that
produce when we start having to
integrate proofs to ensure that
everybody is acting appropriately and if
we start doing this now we're talking
about very complex and long protocol so
in our next slide we'll be talking about
some implementations of
privacy-preserving select projects so if
you have the most recent approaches that
are based on etherion are Aztec and
Caesar both of the collapsed perform
confidential transaction on Imperium as
head it uses a cute EXO model whereas
these are uses an account based model
both of them in theory are able to
achieve in on Amity and however Aztec
uses stealth addresses which doesn't
really satisfy the cryptographic
definition of privacy we want Caesar
does do ring signatures however it's too
expensive to implement on Imperium
passes Seifer is a lot more
mathematically sophisticated it comes
from the same authors of bulletproof and
utilizes commitment schemes held long
frictions and it actually combines bold
approach than Sigma protocols into
something called
bonus aspect is significantly simpler
but they use a trusted setup there are a
lot more efficient than Zener and they
just rely exclusively on commitment
themes and similar protocols to achieve
this so what to z13 Gnostic have in
common
we're talking about the ability to
eligible encryption what they're
actually easily utilizing there's a
property called how to become a morphic
by encryption or given commitment
schemes so what does it mean to be
adamantly not amorphic but we have to
all talk about different types of how
morphisms but the case is hotter than
thought morphism we can imagine that we
have the encryption of something of
value a and an encryption of a value B
and if we take these two Sacre texts to
perform it and a addition operation of
the two cipher texts we actually get the
encryption of what would be the output
if you just added the two plaintext
together except they're now imprinted so
how this is built around to print it up
build actual confidential transactions
is we have an encryption of the balance
say the number 3 and then we have the
encryption of the transfer amount say
I'm number like negative 2 you're
sending 2 coins to somebody so when you
take during 50 pounds of 3 and you're a
gifted balance of things there you're
good to transfer at negative 2 you add
them together you get 1 so that would be
the encryption of the balance after that
transaction in general so it essentially
lets you and now the pub organism is
simply a way to map between these two
domains and the plaintext of a team
where we all familiar with just doing
simple addition on things and the done
in the encrypted cipher text domain
where we don't normally see what the
values under info
some value that out of all organism is
simply an operation and addition
operation that lets us calculate what
that would that would be able plaintext
space so you can simply add ciphertext
the other to get there played exhale
fully homomorphic encryption much scan
that's all thought about as we just saw
some schemes do you utilize homework in
addition to perform confidential
transactions if you actually extend that
and consider homomorphic multiplication
which means that the encryption of a
times the encryption of B is the same as
first multiplying a and B together and
then encrypting so what might happen if
we were to create a PPS scheme that
doesn't only just do homework
but also does homework multiplication
that would actually give us something
that performs fully homomorphic
encryption
there hasn't been any epsp scheme that
does fully homomorphic encryption so far
but it might be interesting to consider
how much more how we would get from
including this at such speed we're going
to quickly look at you non-aryan
approaches one is that C which uses the
context overlay model they use DK starts
for performing on financial transactions
and they actually have an even stronger
notion of privacy than the one you
define in addition to hiding the inputs
and outputs of a function they also
discussed hiding the function itself so
what we can call function privacy
however to achieve the efficiency that
they're talking about if also an
expensive scheme and the sense that can
mean hundreds of gigabytes of RAM to get
the proving types of compound and
there's a second one from Oasis class
you don't actually know if they're
announced today are just gonna refer to
it as the project from Oasis labs they
use trusted hardware which does not
satisfy our notions of security and
privacy with cryptography and we're just
going to gloss over their work but
they're also in this space so briefly
we'll talk about some comparisons
between the type
so it's really difficult to actually
compare these technologies because they
all accomplish similar things with
different techniques it's they're just
not really that easy to compare together
directly but they do satisfy some
properties you can discuss such as
performance privacy the interactivity
involved in the cryptographic security
use so fully homomorphic encryption and
it's complied entirely compute bound so
the performance route is basically built
on as a zombie just depends on how long
a computer can actually perform these
really intense operations such as an fft
the privacy is also based on the
encryption scheme which if you're
familiar with any cryptographic security
assumptions any standards we can say
that you know usually just the SteriPEN
its ie D CPA security
it is not interactive meaning that you
don't have to interact with a bunch of
people for this computation you'll need
to go to the computing party scripts
today they give them a cake and they can
usually perform the computation on it
and it also satisfies some cryptographic
security as well so we know that when we
do plan on working encryption we know
that it's going to satisfy math and I
think our problem that's not you can
solve it like I said QVC is network bout
and then becomes an issue when you have
more participants in it it's based on an
encryption scheme and not a collision of
that people privacy so a first major
secret sharing your
the same thing that your friends won't
get together and try to screw you over
it is interactive so it doesn't sound
like that and the cryptographic security
is somewhat similar that requires
usually ask some fairness assumptions
that requires you to listen zero
knowledge groups - - good
trusting hardware is kind of you know
in my opinion it's just based
on hardware security which you've been
paying attention to the space recently
you know we have spec the spectre
meltdown speculative execution italics
that like we've been trying for years to
make secure processors and they're not
working out that well so it's time the
advancements that's going to take to
make secure processors and real secure
thing it's much longer than it will be
to take these theoretical advancements
to improve these rfh here at PC so let's
just move on and do actual provable
security and not just deal with the
stuff that kind of but doesn't work so I
have a contract approaches so far we've
already seen Caesar and it really
optimizes for security and the principal
sense the frequency not attack but
arguably they're not as VP sec they're
just trying for confidential
they really optimized for its efficiency
Saxena is a fantastic job optimizing
drives the and clock which we haven't
really mentioned but is a lesser-known
project that Z cache doesn't really do a
good job of any of them however it's the
most important thing to focus on is that
none of the approaches so far has
actually tried to optimize her
functionality so it might be interesting
to consider what happens if we pick a
ppsv scheme what happens if we think of
PBS DC Steve that optimizes for security
privacy and functionality and gives a
little for efficiency and compromises a
little bear instance and for everyone
else in the room that might not care so
much about that when you're developing
your own PBS fees you should really look
back at the chart and consider which of
the four properties you've seen do you
really want to optimize for so that's it
thank you so much
thirty seconds yeah one question yes yes
they might consider bulletproof more
secure than starts and starts more
secure so I do think Starks and more
secure than starts I don't really a very
trusted set up security can be
compromised if the cronies pollute
together and I think knowledge of
exponent is a non-standard assumption
that's not well understood so if I
personally as a photographer but if feel
comfortable using it other people might
feel differently but according to my
definition
I think sharks are a little less secure
than Starks the little critters
and why bulletproof bulletproof sir
based on discrete log and the discrete
log problem and that's a very well
understood cryptography assumption
that's been around for a long time yeah
yeah but the bullet proofs are based on
discrete log only if you make them
interactive right make them non
interactive to require random or the
same yes series one of you a free mother
no thanks I don't know if that's true I
agree random Oracle is a slightly
non-standard cryptographic assumption
and a lot of things you said you want to
add return a frequent interactive you
almost always need the option where
you're going to get a random particle
out so it depends first in a person what
you feel most comfortable with I think
this is just an opinion and I understand
that other people maybe not know feel so
comfortable of random articles and don't
want to use
from any cryptographic use cases it
would be better for us to utilize things
it's great that people want to utilize
knowledge of exponent
you know honestly help us find you know
understanding bar has people implemented
but for many years cases where we want
to build for the long-term future we
want to do stuff that we know and
understand very very well now just
thread and work alone which is the
discrete log problem as well so yeah I'm
also agree that knowledge of exponent is
not very well and as well there's either
discrete logic or rather part of the
model but between their own the same
kind the argue it's not been it's like
well study and used quite as much time
it's better than understanding but I'm
happy to talk with talk to you about
this like after it's a crystal incident
and even setting aside the hardness
metric obviously the trusted set up
one of the dots that's also part of
security at least times that's partisan
yeah yeah but I think we can argue that
the ZTR locality years
River into the
already returning from girlfriends thank
you
you literally need a girl
interactions in technology
but it's actually these people they just
absorb it
[Music]
cool thanks
[Applause]