►
Description
Panel: Cryptography: from Theory to Practice in Hyperledger - Hart Montgomery, Fujitsu Laboratories of America; Angelo de Caro, IBM; Mike Lodder, Independent; Brent Zundel, Evernym; Marta Piekarska-Geater, Balancer Labs
What's going on in the world of cryptography in Hyperledger? What tools do we have? How do we use them? What problems are we trying to solve? We have gathered 5 panelists across all different areas of cryptography--from theoreticians to practical implementers--to help try to answer these questions in an interactive discussion. We will summarize the state of cryptography in Hyperledger and then break out into smaller groups to discuss various different topics, including (but not limited to) zero knowledge proofs, Fabric cryptography tools, cryptographic interfaces and tips for using them, post-quantum cryptography, and using cryptography for verifiable credentials. Participants will be free to jump around different groups in order to ensure that all of their questions, comments, and requests for Hyperledger cryptography are answered.
To learn more about Hyperledger, the open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments. Which serves as a neutral home for various distributed ledger frameworks including Hyperledger Fabric, Sawtooth, Indy, as well as tools like Hyperledger Caliper and libraries like Hyperledger Ursa click here: https://www.hyperledger.org/
Sessions Details & Slides (if available)- https://sched.co/j3ao
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2021 #Blockchain
A
A
The
goal
of
today
is
to
be
fairly
interactive.
To
allow
you
to
ask
questions.
We've
put
together
a
broad
range
of
people
from
cryptographers
to
cryptographic,
engineers,
basically
lots
of
people
who
use
and
build
cryptography
in
a
wide
variety
of
ways.
Today.
So
we'd
like
you
to
we'd
like
to
give
you
the
opportunity
to
ask
questions,
see
what
people
are
up
to
and
really
just
interact
with
some
of
the
core
cryptographers
in
hyperledger.
A
So
I
will
start
by
introducing
people
and
letting
them
speak
briefly
about
what
sort
of
cryptographic
work
they
do
in
hyperledger.
So
I'll
start
with
angelo
de
caro.
So
angelo,
as
many
of
you
may
know,
is
one
of
the
original
architects
of
fabric
and
is
an
integral
contributor
to
its
cryptographic
systems.
A
B
Yes,
thanks
thanks
heart
for
the
introduction.
Definitely
today
I
will
focus
mostly
on
on
zero
knowledge
and
in
particular
I
would
like
to
to
discuss
to
talk
about
this
new
project
in
the
fabric
space,
to
bring
tokens
with
zero
knowledge
on
top
of
fabric.
So
very,
very
exciting
news
coming
and
I'm
looking
forward
to
talk
about
these
things.
A
Wonderful
thanks
a
lot
so
next,
I'd
like
to
introduce
marta
pikarska
marta
is
another
accomplished
academic.
She
has
a
phd
from
the
technical
university
of
berlin
she's,
a
very
accomplished
security
researcher
with
a
lot
of
publications
in
the
area.
Marta
has
a
long
and
very
interesting
history
working
in
blockchain,
which
I'm
sure
she
can
tell
you
about
from
blackstream
to
a
long
time
in
hyperledger
and
now
working
in
d5
at
balancer
labs.
C
Sure
so
I
guess,
given
my
background
and
the
stuff
that
I'm
doing
now
and
kind
of
combining
the
two
I'm
really
interested
in
how
we
can
make
d5
more
usable
and
secure
and
what
are
the
differences
between
the
usability
of
especially
usability
of
permission,
blockchain
systems
and
permission
less.
So
how
does
that
impact
usage?
A
A
A
A
Well
then,
I
guess
it
will
we'll
skip
to
you
then
brent.
So
finally,
I'd
like
to
introduce
brent
dundell
brent
is
the
principal
crypto
engineer
at
evernum
he's
been
a
long
time,
prolific,
hyper,
ledger,
contributor
he's
worked
on
and
been
a
maintainer
on
ursa,
indy
and
aries,
and
perhaps
most
famously
he
has
a
best
real
world
crypto
talk
award,
which
is
something
many
famous
people
in
academia
covet
heavily
so
brent.
Would
you
like
to
say
a
few
words
about
what
you're
interested
in
crypto
and
what
you're
working
on.
D
A
Fantastic
and
finally,
I'm
heart,
I'm
also
a
cryptographer,
and
one
of
my
big
interests
is
post
quantum
crypto.
So
I
know
there
have
historically
been
a
lot
of
questions
on
post
quantum,
cryptography
and
I'll
be
happy
to
answer
any
of
those
today
if
people
are
interested,
so
our
goal
for
the
panel
is
to
have
is
to
give
all
of
the
audience.
So
all
of
you
guys
the
opportunity
to
ask
all
of
these.
These
expert
cryptographers
like
angelo
mike
brent
and
marta,
all
the
questions
you
want.
A
A
E
A
A
B
B
The
beauty
of
this
this
this
sdk
is
essentially,
you
can
at
any
time,
decide
to
use
zero
knowledge
or
not
use
zero
knowledge
in
a
absolutely
transparent,
transparent
way.
So
not
the
developer,
not
even
the
the
end
user
had
to
feel
any
birth
feel
any
burden
in
using
this.
This
zero
knowledge,
the
zero
energy
technology
in
practice.
What
does
it
mean
that
this
framework
takes
care
of
the
key
handling,
generating
the
proof
make
sure
that
the
the
metadata
are
distributed
to
all
the
parties?
B
There
are
things
I
I
think
one
of
the
most
complex
part
was
exactly
distributing
the
private
informations
to
all
the
parties.
That
needs
to
be
aware
of
the
the
information.
Why
is
this?
When
we
talk
about
zero
knowledge?
We
are
essentially
talking
about
publishing
commitments
to
the
blockchain,
because
we
don't
want
to
reveal
the
content
of
the
tokens
right.
So
we
just
use
this
the
digital
commitment,
which
is
an
equivalent
of
the
a
sealed
envelope
right.
It's
a
digital
version
of
the
syllabus
and
zero
knowledge.
B
Just
allow
us
to
prove
statements
on
top
of
this
on
on
the
content
of
this
of
this
commitment.
But
if,
if
any
symbols
are
swapping,
for
example
assets,
they
must
have
a
way
to
communicate,
to
communicate
to
each
other
the
secrets
that
they
are
using
to
perform
the
to
perform
the
operations
so
orchestrating.
B
This
was
actually
more
complex
that
implemented
the
zero
knowledge
proof
system
proof
system
itself.
So
I
can
maybe
give
you
the
link
in
in
chat,
so
you
can
start
to
explore
this
project
and
if
you
have
any
question,
I'm
very
very
glad
to
to
answer
them.
In
particular,
we
want
this
project,
so
we
start
we
open
sources.
We
we
started
open
sources.
The
first
batch
of
the
code,
which
is
just
give
a
a
very
sim,
simple
experience
with
with
zero
knowledge
and
then
with
the
in
the
coming
days.
A
A
D
A
A
D
D
And
so
one
thing
that
we're
looking
at
is
in
is
first
adjusting
the
canonicalization
algorithm
to
not
use
rdf
canonicalization,
so
that
we
can,
it
can
be
more
cleanly
specified
exactly
how
the
inputs
are
being
formatted,
and
the
second
is
to
the
first
way
we're
looking
at
doing.
It
is
actually
incorporating
some
of
the
ideas
from
microsoft's
spartan
proposal
and
work
on
that
is
kind
of
just
taking
off.
I'm
happy
to
drop
links
to
the
sorts
of
things
we're
doing
there.
A
C
So
definitely
there
is
a
lot
of
scope
for
research
in
terms
of
understanding.
How
can
we
prevent
yeah
around
smart
contracts?
How
do
we
prevent
smart
contracts
that
are
broken
from
executing?
How
do
we
analyze-
something
that
is
very
interesting,
actually
is
discussion
around?
Ultimately,
all
of
those
d5
protocols
want
to
become
taos
decentralized,
autonomous
organizations.
C
A
A
A
C
A
A
There
are
a
number
of
issues
and
the
biggest
issue
I
see
is
what's
called
forward
secrecy.
So
basically,
what
this
means
right
is
in
today's
world
right.
We,
we
encrypt
data
with
key
exchange
right.
You
know
we
send
data
over
the
internet
and
there
are
lots
of
people
recording
all
of
this
data
right.
A
A
So
if
you
think-
and
I
I
think
this
is
probably
you
know
way
too
optimistic,
but
if
you
think
that
a
quantum
computer
will
be
able
to
break
crypto
in
five
years,
you
know
any
data
you
have
now
that
might
still
be
sensitive
in
five
years.
You
need
to
start
thinking
about
using
a
post
quantum
encryption
scheme
or
a
key
exchange
protocol,
so
sort
of
the
ford
secrecy
threat
is
the
biggest
one
and
certainly
for
government
and
military
applications.
A
A
So
we'll
probably
end
up
using,
what's
called
lattice-based
cryptography
for
new
digital
signature,
algorithms,
fundamentally,
there's
not
much
change
in
terms
of
what
an
end
user
would
see.
Although
the
key
sizes
are
substantially
larger,
so
you'd
see
some
performance
degradation,
so
I
hope
that
answered
the
questions.
A
B
B
So
they
the
systems
are
especially
if
you're
talking
about
central
banks
you
will
have
by
by
law
by
the
load
parties
that
are
entitled
to
be
to
be
able
to
look
at
the
these
transactions,
so
some
special
parties
in
the
system.
So,
just
if
you,
if
we
just
deployed
zero
knowledge
as
it
is,
this
will
for
greet
this
kind
of
with
the
auditabilities
disability
settings.
So
that
is
probably
the
the
most
crucial
point
because
it
becomes
also
the
weakest
point
in
the
chain
right.
B
Definitely,
every
time
that
you
won't
start
a
tokenization
of
any
assets,
digital
assets
or
a
real-world
asset
that
you
want
to
move
to
the
digital
space,
and
you
want
to
have
multiple
parties
playing
with
these
assets.
You
immediately.
You
immediately
face
the
need
to
some
some
level
of
privacy
and
then
with
it.
You
will
come
immediately
also
some
level
of
reconstruction,
so
you
want
to.
You
might
want
to
see
the
history
of
certain
assets
that
you
have
to
organize
it
or
you
might
want
to
do
auditability.
A
D
It's
it's
a
natural
question
to
ask,
because
the
original
reasons
bbs
and
cl
signatures-
were-
I
mean
they
are
group
signature
schemes,
so
why
don't
we
use
them
as
group
signature
schemes
for
credentials
is,
is
a
really
good
question?
The
the
only
answer
I
really
have
we've
talked
about
it.
Some
talked
about
that
it
is
a
capability
that
we
could
introduce,
but
what
has
kind
of
failed
to
emerge
in
the
conversations
is
is
a
really
key
use
case
to
drive
it.
D
A
A
B
Yeah
yeah,
so
definitely
what
I
can
say
that
I
can
point.
I.
I
posted
a
link
in
reply
to
to
a
paper
written
by
accepted
the
conference
or
peer-reviewed
paper
written
by
colleagues
of
mine
from
haifa,
and
they
they
they
go
in
lots
of
details
about
this
right
to
be
forgotten,
which
is
in
a
sense.
Gdpr
is
also
is
giving
to
to
to
any
person
or.
B
As
a
right
for
to
any
person,
so
I
would
I
just
refer
to
that
paper
there
it's
a
lot.
There
are
a
lot
many
leaders
written
there.
There
was
also
a
proposal
to
bring
this
to
fabric
actually
to
simplify
the
life
of
developer.
If,
if
I,
if
I
understand
the
question,
it's
it's
more
from
a
technical,
so
how
do
we
write
this
in
practice?
B
Unfortunately,
that
that's
another
topic
where
we
really
would
like
to
have
the
community
helping
us
in
delivering
this,
this
gdpr
support
for
fabric
it
would
be
really
fantastic.
Otherwise,
you
know
it's
like
saying
that
we
are
implementing
the
same
solution
again
and
again
and
again
and
again,
which
is
essentially
based
on
at
the
current
stage,
with
the
private
data
collection.
So
you
are
posting
only
hashes
on
the
ledger
that
are
not
brute
forcible.
B
B
In
this
sense,
this
is
the
alone
is
not
enough,
because
even
now
now
the
private
information
are
stored
somewhere
and
even
in
this
somewhere,
you
have
to
give
a
possibility
to
erase
this
information,
keep
in
mind
that
there
is
no
way
or
definitely
not
a
cryptographic
way,
and
I
don't.
I
think
this
would
be
a
physical
problem.
How
can
I
prove
that?
I
really
deleted
something,
and
indeed
I
think
gdpr
is
it's
only
saying
that
certain
pieces
of
system
piece
of
information
are
not
accessible
anymore.
So
that's
the
one
one
of
the
other
goals.
D
D
You
know,
that's
like
number
one
rule:
if
it's
not
there,
there's
no
need
to
have
anybody
asked
to
get
rid
of
it
and
then
the
second,
the
the
mechanism
that
they
were
looking
at
introducing
should
it
become
necessary
to
do
so
was
actually
because
the
in
indy
is
a
is
a
permissioned
network,
it's
possible
for
the
nodes
if
the
node
validators
it's
possible
for
the
node
validators
to
to
be
able
to
say?
Oh,
I
have
I.
C
I
it's.
It
is
quite
interesting,
this
this
whole
right
to
revoke
a
right
to
delete
data.
I've
always
been
of
the
opinion
that
at
least
the
fact
that
you
can
record
and
prove
that
you
requested
in
a
reliable
way
is
better
than
the
system
without
blockchain,
where
you
can
just
claim
it.
But
it's
claim
against
claim.
I'm
wondering
do
you
know,
because
I
actually
don't.
How
does
the
forward
secrecy
that
hart
was
talking
about?
How
does
that
impact
gdpr?
C
B
I
would
say
that
it's
a
killer,
if
you,
if
you
start
posting
cipher
text
on
the
ledger,
that
will
kill
you.
That's
that's
for
sure,
because
the
cipher
text,
no
matter
what,
even
even
if
you
get
forwards
forward
security
I
mean
the
past
will
be
lost.
So
that's
that's
a
problem,
so
you
should.
You
should
not
put
cipher
text
on
the
ledger.
If
you
want
this
kind
of
right.
Indeed,
there
is
also
another
problem.
B
I
think
this
I
heard
this
in
the
first
time
I
was
dealing
with
the
banking
world,
they
a
bank.
So
there
are
certain
legal
parties
that
if
they
are
storing
cypher
text
they
are,
they
are
responsible
to
be
able
to
decrypt
them.
So
they
must
know
the
secret
key
to
the
crypto
cipher
text.
But
if
now
anyone
is
starting
pushing
ciphertext
on
the
ledger,
I
mean:
how
can
I,
how
can
I
have?
I
don't
have
all
these
keys
to
the
secret
keys
to
the
to
the
crypto.
B
So
that's
a
no
no
ciphertext
on
the
ledger.
It's
just
a
no
for
money
for
many
reasons,
once
the
ciphertexts
are
out,
then
of
course
this
is
a
different.
It's
a
different
story
and
usually
the
pi.
So
if
a
hacker
is
able
to
penetrate
your
system,
then
of
course
the
the
past
is
lost,
what
you
could
do?
Actually
it's,
instead
of
storing
the
cipher
text
in
a
single
place,
you
might
start
secret
sharing
the
decipher
text.
So
you
know
you
put
pieces
just
it's
like
breaking
the
cipher
text
in
multiple
pieces
and
yeah.
B
A
Yeah,
to
go
technical
basically
to
to
adhere
to
sort
of
all
these
privacy
rules,
you
can
view
sort
of
hashes
and
other
things
as
to
as
commitments
to
things
right.
It's
like
if
I
put
a
hash
on
a
blockchain,
it's
sort
of
a
commitment
to
the
blockchain
and
commitments
well
in
the
ideal
world
they're,
either
computationally,
hiding
in
statistically
binding
or
statistically
hiding
and
computationally
binding.
Now,
I'm
not
sure
how
that
how
much
sense
that
makes
to
non-cryptographers,
but
basically
what
that
means
is.
A
But
if
someone
breaks
the
hash
function,
then
they
you
know
they
can't
come
up
with
my
message
because
it
they're
just
too
many
possible
messages.
It's
information,
theoretically
hiding
so
so
there
are.
I
think
there
are
ways
around
this,
but,
as
angelo
points
out,
you
can't
store
ciphertex
on
the
blockchain.
A
If
you're
worried
about
forward
secrecy
and
privacy
loss
so
speaking
of
angelo,
there
are
some
zero
knowledge
questions
for
you.
Is
there
any
advantage
to
use
interactive
zkp's
over
nizix
and
consortium
blockchains,
and
what
about
setting
up
the
trust
infrastructure
between
parties
right?
You
can
also
jump
in
here.
If
you
want.
B
Yeah
yeah
very
interesting,
I
would
say
it
very
depends
on
the
blockchain
system.
So,
as
I
replied
in
general,
it's
a
no
in
the
sense
that
the
verification,
if
you
take
ethereum
the
verification,
cannot
happen
interactively
because
that's
it's
like
saying
that
the
entire
network
should
connect
to
the
prover
and
interact
to
do
in
order
to
verify
if
a
zero
knowledge
proof
is
correct,
or
not
so
in
blockchains
like
ethereum,
that
use
the
paradigm
order
and
then
execute
you
can
only
use
nizix
so
non-interactive
generally,
but
in
fabric.
B
Actually,
we
we
use
a
complete
different
paradigm.
We
instead
say
you
first
execute,
then
you
you
order
and
then
you
validate.
So
during
the
execution
phase,
you
can
say:
okay
now
there
are
a
bunch
of
servers
that
what
we
call
endorsers
that
will
verify
the
zero
knowledge
proof,
possibly
even
in
an
interactive
way,
and
then
the
rest
of
the
network
will
trust
this.
These
these
endorsers
via
the
endorsement
policy,
in
having
done
this.
B
This
thing
so
in
in
fabric,
even
even
interactive,
zero
knowledge
proofs
are
possible
if
this
brings
some
advantage,
but
it
remains
to
be
seen
no
interact
with
zero
knowledge
proof,
especially
when
it's,
if
it's
a
it's
a
snark,
it's
a
succinct,
it's
very
efficient
to
verify,
so
the
burden
of
interaction.
Why
we
should
take
setup
setup
is
also
another
very
dramatic
thing.
Luckily,
there
are
now
non-interactive
zero
knowledge
proof
systems
that
do
not
require
a
trusted
setup.
B
You
just
have
to
pick
a
hash
function
and
then
you
go
and
then
you
go
with
it.
So
these
are
very
good
and
even
some
that
are
updatable.
So
once
you
publish
the
public
parameters,
this
can
be
updated
continuously.
So
a
lot
of
progress
on
this.
I
wouldn't
I
wouldn't
I
wouldn't
say
that
this
is
an
issue,
as
it
was
a
few
years
ago,.
D
I
could
repeat
your
answer
shortly:
yes,
we're
working
on
this,
or
by
we
I
mean
mike
water,
is
working
on
this.
It's
definitely
something
that
we
see
as
being
valuable.
You
know
there
are,
there
are
use
cases
that
are
asking
for
it
and
requiring
you
know
require
that
require
threshold
signatures.
So
what
we
are
looking
to
build
in
ursa
is
the
capability
to
essentially
threshold
eyes
any
of
the
signature
schemes
that
we
already
have
so
yeah
short
answer.
A
B
That
that
one,
the
sample
the
symbol
was
published
there.
It
was
just
really
a
specific,
a
specific
example
how
you
could
implement
tokens
there.
The
token
sdk
that
we
are
now
proposing
is
diagnostic
is
actually
as
this
beautiful
two-layer
api
that
gives
to
the
developer
an
abstraction
that
is
agnostic
to
the
in
the
actual
implementation
of
the
token
on
top
of
fabric.
B
What
does
it
mean
is
in
practice
that
you
can
switch
the
technology
that
you
use
behind
so
either
zero
knowledge
or
actually,
when
I
said,
zero
knowledge,
there
are
many
many
zero
export
systems
that
can
be
used,
so
you
can
change
the
xenonsh
proof
system
that
that
you
use,
or
you
can
even
just
use
a
plain
version
of
the
tokens.
If
you
don't
need
the
you
don't
need
any
privacy
or
in
certain
settings
you
might
need
to
have
auditing
in
others,
you
don't
need
to
have
auditing.
B
So
the
token
sdk
brings
all
this
knowledge
in
a
single
place
in
a
systematic,
systemized,
systematic
way
for
the
developers
to
quickly
develop,
develop
token
applications
for
for
fabric,
so
that
that
would
be.
I
would
say
that
is
the,
and
also
the
interesting
thing
is
that
the
the
technology
that
we
are
deploying
we
are
open
sourcing
for
the
zero
knowledge
part
is
also
it's
in
a
paper
that
is
reviewed.
Anyone
can
look.
I
posted
also
the
link
here,
just
as
I
saw
that's
the
technology
that
we
are
going
to
open
source.
A
D
D
For
the
most
part,
I
believe
you
can
just
apply
the
anonymous
credential
models
for
those
signatures
that
are
applicable
to
those
models.
One
of
the
things
about
a
verifiable
credential
is
some
of
them
use,
vbs,
plus
some
of
them
use
cl
signatures,
some
of
them
use,
e-25519
signatures
and
and
aren't
selectively,
disposable
or
zero-knowledge
proof
capable
signatures
at
all,
and
so
the
yeah
for
the
most
part.
There's
there
are.
You
know
the
anonymous
credential
models,
I
believe
apply.
D
A
I
think
that
the
uc
model
is
a
great
model
to
look
at
blockchain
in,
if
you're
familiar
with
what
it
is
just
because
well,
we
need
you
know.
Blockchains
are
never
used
in
a
vacuum.
We
need
to
compose
constantly
different
cryptographic
protocols,
so
it's
very
useful.
The
only
issue
is
that
uc
proofs
are
like
catastrophically
long
and
complicated.
A
A
B
B
So
how
do
we
run
the
initial
public
offering
from
with
full
security
with
full
privacy
privacy,
with
respect
to
the
orders
of
the
bidders
of
the
investors
that,
for
example,
they
they
might
not
want
to
trust
an
investment
bank
to
collect
the
orders
and
then
to
decide
the
price
of
the
new
or
the
the
price
of
the
new
stocks?
So
definitely,
yes
and
there's
no
need
for
for
a
fabric,
private
private
data.
B
Actually,
what
is
interesting
is
that
at
that
time
we
didn't
have
yet
another
piece
of
software
that
were
open,
so
we
already
have
source
a
few
days
ago.
We
just
opened
so
that
we
called
fabric
smart
client
that
will
give
you
the
ability
to
implement
this
kind
of
things
very
easily
on
top
of
fabric.
A
A
B
A
B
Complication
that
you,
you
just
don't
need,
we
don't
need
to
go
into
this.
This
kind
of
details
it
just
you
know
it's
just
enough
to
know
that
there
are
general
purpose,
general
systems
that
can
prove
that
generates
zeros
proof
for
essentially
any
statement,
then
the
the
how
they
do
that
it's
very
technical
it
does.
It
doesn't
really
matter
what
matters.
Actually,
maybe
that's
also,
I
guess
it's
important
also
for
the
the
the
different
industries
and
might
want
to
use
zero
technology
and,
in
particular,
the
finance.
B
The
finance
space
is
to
come
up
with
the
standardization
of
zero
knowledge
group,
so
the
guys
in
dk
proof
the
the
best
from
the
dk
proof
standard.
They
are
definitely
doing
a
great
work
to
push
in
having
a
standardization
of
the
the
primitives
of
the
assam,
the
cryptographic
assumptions
how
these
are
out
zero.
The
truths
are
encoded,
which,
how
do
we
encode
the
statements
that
we
are
that
you
are
proving?
That's
definitely
something
that
is
very
interesting
and
also.
B
There
is
also
another
aspect
that
I
think
it's
not
a
minor,
but
we
must
have
a
way
you
know
in
most.
For
example,
if
you
talk
about
the
utxo
token
and
let's
suppose
that
alice
wants
to
spend
a
token
most
of
the
time
in
an
enterprise
space,
the
secret
key
that
alice
might
use
to
spend
this
token
will
be
in
an
hsm.
B
So
we
must
have
also
zeros
proofs
or
statements
that
are
friendly
with
the
with
the
hsm.
Therefore,
you
know
again,
hsm
is
hardware.
They
are
not
it's
very
difficult
to
deploy
new
cryptographic.
Signature
schemes
on
on
hsm,
so
we
better
be
compatible
with
existing
signature
scheme.
Like
adds
a
that.
That's
really
actually
a
very
good
scheme,
very
secure,
very,
very,
very
powerful,
very
compatible
also
with
hsm
and
with
the
the
most
advanced
generation
system
that
we
are
aware
of.
B
B
Oh,
maybe
my
colleagues,
my
colleagues
in
jury
are
better
expert
than
the
mural,
the
possible
scenarios.
I
don't
really
know.
What's
what's
the
security?
What's
the
threat
model
there,
I
think
they
have
sys.
I
think
they
there
is
a
threat
model
where
essentially,
even
someone
who
has
root
access
to
the
machine
cannot
access
the
the
hsm,
so
they
are
kind
in
an
isolated
environment.
B
So
now
it's
all
about
trust
right,
so
you
you
buy.
You
are
buying
this
service
from
a
cloud
provider.
You
are
trusting
that
they
are
not
cheating
or
they
are
really
delivering
on.
What
on
on
on
this
on
on
this
premises
anyway,
no
matter
what
you
know,
if
you
don't
trust
a
single
provider,
you
can
always
spread
your
secret
keys.
There
are,
I
think
there
are
in
the
hsm
space
protocols
to
have
keys
in
multiple
hsms,
and
then
they
come
together.
They
they
speak
to
each
other,
and
then
they
generate
a
signature.
B
A
F
Yeah,
so
I'm
working
on
implementing,
like
all
the
threshold,
the
major
signature
types
like
for
the
bitcoin
curve,
ed2519
and
bls.
So
with
you
know
both
a
distributed
key
gen
and
distributed
signing,
and
that's
mostly
for
the
clients.
I
work
for
that's
what
they're
interested
in,
and
I
know
that
this
is
a
major
interest
of
blockchains
right
and
so
we've
looked
at
different
hsms.
F
F
Was
it
secret
computing
or
I
can't
remember
the
exact
name,
but
you
get
the
point.
There's
all
these
cloud
hsms
and
take
your
pick
right.
So
azures
is
based
on
intel.
Sjx
amazon's
is
their
own
proprietary
thing,
but
it's
pretty
simple
to
use
and
then
they've
also
got
cloud
hsms
and
then
google's
got
their
secure
compute.
So
I
mean
it's
all
over
the
place.
A
A
A
A
C
I
can
start
I'll
start
on
the
soft
side.
I
think
that
we
are
still
lagging
and
thinking
around
a
blockchain
when
you
build
out
a
blockchain
consortium
or
consortium
in
blockchain.
How
do
you
figure
out
the
interactions
between
participants
and
how
do
you
ensure
that
people
feel
comfortable
and
understand
what
it
means
to
using
a
blockchain?
C
Also
in
permission
space?
There
is
not
much
thinking
about
the
entry
in
governance
versus
off-chain
governance
that
usually
falls
like.
Usually
everyone
falls
under
the
often
governance,
and
then
it's
not
really
a
blockchain.
So
I
think
these
are
the
things
in
permission:
space
that
need
kind
of
analyzing
and
looking
into
in
general.
I
think
that
we
are
really
still
very
much
behind
usability.
C
There
is
too
much
that
people
need
to
understand
in
order
to
build
those
systems
and
to
even
to
use
them
and
I'm
seeing
that
actually
there's
more,
even
in
d5
than
than
in
permission
space.
Unfortunately,
people
are
losing
a
lot
of
money
because
they
don't
really
understand.
I
like
to
say
that
we
try
to
say
that
we
democratized
finance
space
by,
but
it's
like
giving
people
knives
and
not
telling
them
to
point
them
outwards,
so
they
are
just
mostly
end
up
stacking
themselves.
B
But
look
from
my
point
of
view,
I
like
a
lot
of
competition.
I
think
we
have
to
to
foster
competition
in
the
in
this
space.
Blockchain
first
of
all
is
giving
us
a
huge
opportunity
to
deploy
this
some
crypto
technology.
That
was
considered
very
fancy
very
fancy,
even
though,
let
me
say
even
the
threshold
crypto,
I
think
it
has
more
than
40
years,
so
it's
a
very
well
established,
at
least
in
the
the
academia
and
the
academia.
It's
very
well
established
technique,
though
there
is
a
point
and
I
totally
agree
with
martin.
B
This
even
threshold
is
not
so
usable
in
in
practice.
It's
not
so
obvious
to
deploy
and
the
same
thing
is
for
for
zero
knowledge,
well
understood
primitive.
From
a
theoretical
point
of
view,
you
always
forget
that
there
are
the
small
details
that
actually,
when
you
go
and
deploy,
you
start
asking
yourself.
But
what
is
this?
Where
is
this?
How
do
they?
How
do
I
deploy
this?
But
this
becomes
now
the
weakest
point
in
my
chain
of
security.
What
do
I
do
here?
B
So
you
see
there
are
very
problems,
so
we
have
to
foster
this
competition.
I
hope
that
hyper
ledger
will
push
stronger
and
stronger
on
on
on
these
two
to
set
the
bar
very
high
on
the
projects
that
are
coming
in
to
ask
the
projects
hey
come
with
real
solution
that
people
can
really
use
and
can
make
a
difference.
F
E
C
A
But
that
that's
pretty
far
from
the
truth,
you
know.
One
of
the
things
I
am
excited
about
is
the
the
potential
for
sort
of
one-off
multi-party
computations
to
be
used
in
a
lot
of
blockchain
applications.
There
are
a
lot
of
things
you
only
need
to
do
once,
and
maybe
you
don't
care
if
they're
super
efficient,
so
so
that's
sort
of
something
I
think
will
become
popular
in
the
future.
D
If
that
hasn't
been
done,
and
I
I
don't
know
if
we're
having
a
meeting
this
week,
but
in
two
weeks
from
today
at
least
there
will
be
an
ursa
meeting
that
folks
should
feel
free
to
come
to
take
your
bring
your
questions
there.
We
we
love
sitting
around
and
talking
about
crypto
stuff,
that's
pretty
much
why
we
keep
going
to
the
ursa
meetings
so
so
you're
welcome
to
join
us
there
and
yeah,
I'm
not
sure
anybody.
What
else
should
we
say.