Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 18 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Why We Need Threshold FHE for Blockchains by Wei Dai | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/why-we-need-threshold-fhe-for-blockchains/

There is a fundamental limit to building privacy-preserving applications in ZK. For example, we do not know how to replicate applications such as Uniswap and Aave in zero knowledge where complete privacy for users is achieved. This talk introduces how threshold FHE can help fill the gap ZK tech leave us desiring--privacy for shared-state applications.

Speaker(s): Wei Dai
Skill level: Advanced
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: Threshold Cryptography,Fully Homomorphic Encryption,Privacy

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Crypto we're a VC funds, um crypto native uh anyways um Okay. So what I've been talking about today is uh not about your dollar proofs and let me open by a question. Raise your hand if you think it's your knowledge solve all the Privacy problems in the blockchain space.

A

I see one hand, let's see two three all right. Well, if you didn't raise your hands, maybe um well, maybe you know better than I do but I don't think zero dollars off all the Privacy problems. So let me explain why so, um let's think about blockchains. So what are blockchains and computation right, uh blockchains applications. uh Everything is a computation on the blockchain right. So ethereum is a public State machine. That's replicated uh if you have some consensus mechanism, and so what is it? What is the same machine?

A

It's the same machine is something that uh keeps a state and has a transition function and transition stays through transition, function right and more computers, same machines, blockchains and smart contracts right. So everything on ethereum all the smart contracts are State machines.

A

Okay, what if we want to do the same machine transitions uh with privacy? Well, let's try to use your knowledge. How are you going to as you go to sleep machines, your knowledge, well we're going to execute the off chain and only prove the execution that is correct on chain right, so I'm not going to show you the details here, but more or less is going to look like this picture where every single States, you know it's a different color and your do knowledge update, is going to uh essentially link one color to another.

A

Color right, so here on chain will have three different states, as opposed to the user, want to interact with the state machine and uh they each independently enjoy a different proof right thinking, state two to some state three. Now, if one proof is processed on chain, let's say the the live one, the blue one here, what happens is that the second transaction of this of the second user is now invalid right, because it's the proof um is going from the same like state two, but now you need to link to stage three right.

A

So so that's the problem with executing General State machines in general knowledge blockchain. You range of race conditions, okay, so this problem is actually been observed over the years in many different ways. But basically um you know the the store is at either you do a transparent engine computation which you know that we do on ethereum.

A

So you have no privacy, but you have the you know, benefit of a share state that everybody can have access to or on the other hand you have a zero knowledge of chain execution uh and you kind of have the flipped. uh You know uh benefits and and kind of downsides, which is that you have private inputs, but to State, that's not shared between anyone. Okay, so uh we're.

A

Basically someone like us with you know these two properties, so we can't really get both and my talk is about how to get both properties and I call that um a confidential share state. So how do we get confidential share states on the blockchain? And the answer is fully homomorphic encryption or fhe for short, okay. So what is home of encryption?

A

um This is, you know brief intro to cryptography. So um so this thing is here is kind of commutative diagram. Okay, so suppose, there's a message and fix a circuit see here we can compute the circuit on a message to get C of M. So that's this error over here, okay, um at which this scheme allows you to kind of do this thing, but with three different steps: okay, uh and so first, let's take our message: instead of computing, the function I'm going to encrypt it. Okay, so everything that's done here is encrypted.

A

You can now see what's inside right, so uh you know this is what kind of go through in your TLS channels and stuff like that right, you first encrypt it, and then you kind of run. This evaluation function, which takes in the circuit right and this uh stepper text to get another set for text. Okay, um we'll have you down here.

A

Well, I haven't really done anything useful right, but let's actually try to decrypt this thing again right uh if a fishy skin allows you to essentially um so if you decrypt this- and you know and there's things that it's uh you know it actually works, it means that you actually get back to the resultant computation okay. So what have we done here? Instead of doing computation in the clear we can first encrypt, do the computation and then decrypt Okay.

A

So so this thing is like really really sick right because um it allows you to do computational encrypted data. It's like you, know the Holy Grail of you know Computing uh and privacy right.

A

um So you know this thing has been discussed ever since, like the 80s, um but, like you know recently, we like only within the past about 15 years, do we know constructions of this thing? Okay, so there's still a single point of failure here, which is the decryption key right so that anyone holds a decryption key can get the data. So the idea is we're going to like move everything Unchained to be encrypted and stuff right so, but we don't want a single person to be able to decrypt. So what do we do?

A

We're going to add um thresholds, cryptography, we're going to SQL share the decryption key to every single validator? Okay, so now, I'm gonna have to guarantee that you can only reconstruct what's inside if, um if k out of the N validators say so, okay, all right, so all right! So what can we do with that? uh You know with such a virtual Effigy scheme. uh It turns out. We can basically, uh you know, do confidential same machine replication on chain and to release any information. uh You know that we want to the public.

A

So let me kind of wrap up by telling you about the work of Pesca uh so Pesca. It's uh well short for privacy, enhancing smart contract architecture, which is kind of a blueprint to unify the three types of computation right. So we have transparent, unchain, computation, zero knowledge option computation and this on chain replicated computation computation is a framework that I try to unite the three things you know putting the three together um so very briefly on what kind of what the challenge is here.

A

So the challenge is that if you want to make this in Practical, uh you have to really really think about efficiency as it, so it turns out. Fh is really really slow and uh is way slower than ZK. Even so, you want to push computation to zero knowledge as much as possible.

A

While doing you know the bare minimum amount of like shared computation in fhg, okay and uh I'm, going to kind of connect the two components using virtual decryption, so it's going to look at look like this, where, on the left hand, side we'll have some type of like DK shooter tool, which is really standards, we're going to also use zero dollars to kind of encode inputs into this apigee computation module on chain and then we're going to decrypt stuff and then put it back into the you know through the pool.

A

um So this is actually inspired by the penumbra State model. I encourage you to kind of look it up. It's it's actually, one of the cooler projects, that's you know, being implemented right now that have that's a private X, okay, anyways um and in the work we also extend this to uh to some Publications, uh one of which is uh essentially a dark pool. A privacy, preserving custom function, Market maker and the other one is uh first, first price privacy preserve auction. Okay. So let me in by a short conclusion, which is uh you know?

A

What are the three points I talk about today? Privacy? Is you know, privacy, it's really important in blockchain space and zero knowledge is not a full solution and to get confidential share States. We need something. That's fancier and in this talk, I presented one option using apigee and encourage you to go check out the work of best gun and the link to the paper is in this QR code. Anyone that they didn't raise their hands. Everybody understood that already, when stuck with way after the talk. Thank you so much wait once again.