Little Things We've learned About FHE by Chih-Cheng Liang | Devcon SEA

[Music] thank you Teresa um hi welcome here um so I'm C from PSC um we're talking about F FH today so here's my selected uh resume to fit my narrative uh first like uh in August and July this year I'm very honored to work with ZX Park ALS lab and PSC Fox on the uh FH project called Fantan Zone and before that uh in the past three years I've been um working on ZK ebm projects uh with kimy there and okay with bunch of many people and before that like I was working um different various applications uh in psse so uh I think in summary like what have what I haveen what I have seen is like a rise of the uh computational Primitives on cryptography so what does that means like we discovered a bunch of computation Lego uh these Legos starts with Gates like this you can uh add numbers together or you can multiply numbers together um and we call these cases uh arithmetic Gates and if you're are going uh coming for programming world uh you probably seeing this end Gates or gates exort gates and not Gates and you can fit bits inside it and do operation with it uh these are called bullan Gates uh so these are kind of abstract uh models uh once you get this you get the whole uh computation you need you can uh serve user with um different kind of application logic uh how does that go um so first you have Gates and then if you combine this skates together you get circuits and then if you build uh language and compilers on top of them and you feed uh developers some coffees and teas and they'll build amazing applications and to happy users um so I think that's what happened in the ZK past uh in the ZK we kind of have some uh arithmetic Gates uh that allows you to um perform computations and secret values and now uh FHA we are getting new sets of Legos and they unlocked new sets of capabilities and this is what we'll dive into uh today so before that let's do some recap on ZK calculation so when we talk about computations like um we we usually start with calculations and then we few more abstractions and then uh we can do computations on actual application logic so here is a circuit uh that looks like a Sudoku board they have some prefield values seven and three you can fill in some initial value five and then you multiply together you get 35 you plus three you get 38 you can witness some private value too and then you get the result 40 and then you can uh send the input and output to the verifier and without sending all the computation Trace in the middle and in this way uh you get privacy for your uh private value uh you also get the computation uh compression for uh people call this the sness and if we accept some more abstractions um so we rep uh developers are very good at uh turning your application needs into the computation of bits and bites so uh we can do some high level logic like this uh for example you have ID one two three that is uh reside in the ID registry um so uh this computation result tell us this is a valid ID uh has a this dog you can insert some uh secret value in the this secret field of ID this ID has some certain attributes and then uh the whole thing combined together this shows uh you knowledge secret uh so you are the owner this dog is the owner of id123 and then furthermore this id1 123 has a age field says 19 uh so that this dog is 19 years old but the dog want to tell people it's 19 years old the dog want to tell uh it's uh greater than 18 years old with just one additional computation step so uh that works well for if you're user is just one dog but now like uh if you you you want to build applications that interacts with multiple users uh like this uh dog and cat and they want to decide what to have for dinner either Cy or py um but like their opinions are very sensitive so secret that needs some cryptography that can pretend uh protect you from State actor attackers so um they kind of that's that's imagine we we don't uh have any cryptography and we Host this computation on The Trusted third party like the the the horse below and then the dog sends uh their vult one uh and the uh preference for PTI zero and the cat sends uh the their vot one and uh the vot for Pai then we perform some computations uh we want to add the vs together and to get the uh final preference for the for for the dinner but then like you see like this requires the interaction of the Dog secret and the cat's secret and then it's not achievable by the uh the the ZK gate so uh that's where FH comes to help so FH stands for uh it's a short for three words but uh I'm not going to torture you with that nerdy details um uh I going to uh redefine FH as just one word and it's a computation over encrypt data uh as people say like the ticker is f and so um what does mean like computation over uh inry encrypted data so you basically get this two new Legos and then you can have encrypted data from player one encrypted data from player two and then you add them together you get the computation result and so when I heard like the encrypted computation over encrypted data first time I didn't realize how powerful it is or like the significant it is but it uh if you see here it kind of builds a boundaries between two players and then you let their secret to interact with each other and you get a computation result um so now like with FH you can do the uh the dinner voting properly so the dog sends the encrypted uh preference cat sends their encrypted preference and then you use the uh new FH gate and to add add them together to get a encrypted computation result and then you have to decrypt it to get the actual result so I think balic has a saying like all the technology we have is kind of a simulated trusted third party and I think we uh like from this example we're kind of seeing this phenomena like this uh horse on the button is kind of like a TR thir party and when we're using uh FH and without it like the the applic the application logic looks similar but like it's kind of wrapping on another layer of security and uh for the user from the perspective of user they all they see is the same they input some value on their browser and then they got some values from their browser but like the uh they are differ behind the scene and there are different security and Trust assumption behind the scene so uh why are we not already using FHA now uh we kind of already like uh so in the basement you have frog Zone from uh Z Park uh I highly recommend you to play it um but there are three main problems of FH right now uh first is uh the computation is costly uh let's say you want to send one bit of PL text uh from this stock to the server you have to encryp it and in this encrypted message is a data itself so it has some size and how big is this data um so this data takes uh six bites it's kind of um it's amortized and it's kind of uh 100 times of the uh the pl Tex and it grows linearly it means if you have 100 bits you multiply uh 16 bytes by 100 uh this is this is already very good uh but the terrible part is the computation part you need a server of 192 vcpu it burns 10 USD uh per hour so I highly uh recommend you to play the Frog games on the basement to feel that like $10 per hour like feeling so this second problem is the verifiability um so uh you're getting this uh computation result but is this computation result coming from the correct computation step or the incorrect computation Set uh to be honest like you cannot really tell like it needs extra work you either wrap another DK proof on top of it you either do some like message check or something to to either guarantee kind of Integrity um it's it's a problem people are actively solving but it's still a problem so the problem number three is the decryption problem so after all the computations we're getting the uh encrypted computation output but how do you decrypt this how do you remove that elephant from the fridge um so you need someone to decrypt the the message but uh you can you know give the decryption key to a centralized uh party but this is this is like you're are not doing FH at all um but the concern is like uh if you like if someone have has the ability to decrypt the output can they also decorate other users input and this uh you know this makes the whole like FH a security theater um so the other way to solve this is you use some threshold decryption scheme um so every uh encrypted output you need all the party to derive a decrypted uh decryption key share and together uh they have to collect all the decryption key together to actually see the output so if the the dog did not give um its uh decryption key to their input the other people will not able to decrypt the dog's input but uh the problem here is the cat uh if the cat goost it then nobody nobody can actually decre this output and then this this secret will be secret forever so uh let's give a quick recap uh the message is simple um in ZK we kind of have uh computations on top of your own secret and for FH um we can engage with other Secrets uh so you can build uh applications for multiple uh multiple peoples and that opens a lot of doors to many new applications so I expect like you will heard like the world FHA in the like near years there will be more talks more in the next STC like uh this is a kind of trending topic and lastly uh I want to direct you to play the Frog crypto at a basement uh to feel like how early days of uh FH feel like um also if you're are coming for a developer background here's some reports you should check uh the first two are from G lab uh there it's a library for uh multi party FHA uh uh pay attention to the branch because like the latest call is living on some branch and if you want to uh you deploy your frog Zone yourself uh check the last link you can deploy frog Zone and you know it's early days things break so expect some hi up on the code and yeah that's all I have for you thank you so much all right thank you CeCe we actually have a lot of time for QA so feel free to submit questions uh let's go from the first one on the screen what are the best use cases you've seen for FHA so far uh that's a very good question so uh for me personally like definitely not for others like I'm more from like economic background and I'm very interested in like uh auctions and votings these are very you know like old FFG applications they are they're very ancient but I feel like uh if we can do proper voting and proper actions uh that would be cool but uh but people like I think what makes people exciting in the future is if you can build uh some uh private State uh you you can build a uh let's say P2P Network you have a private State and then you have some State transition function you can continuously upd States and then you have some uh you can build a like some kind of private blockchain and private uh application to many but like I uh I cannot say anything concrete at this moment because I don't know um and we have another one which optimiz do you see possible to solve performance issue oh uh so um so this is uh what I heard from uh our our uh colleagues uh P he said like the last um so the latest performance update was already in like 2016 and there hasn't been a new papers uh for that performance um Improvement so we might be looking for some like a new generation of uh bootstrapping technique uh to to improve their performance uh when should you use ZK FH or MPC um so I so my my you know over over simp simplest understanding of this is if your application involve just one party then you DK if you have two parties uh use M uh MPC if you're more than three parties uh try F all right cool uh yeah let's wait a few more seconds because we do have more time for QA uh what do you think think of tees as a solutions for shared State shared private State computation as a performance solution over FH good question I don't know yet I haven't di into this topic and so I haven't developed opinions on this all right perfect okay um all right let's give it another 10 15 seconds to see if have any more maybe a question for you like who here have heard FH before Oh okay almost everyone okay who here have heard in distinguishable office before okay oh nice all right cool uh thank you CeCe for your amazing talk our next talk will be in 10 minutes so