Why We Need Threshold FHE for Blockchains by Wei Dai | Devcon Bogotá

foreign [Music] crypto we're a VC funds um crypto native uh anyways um Okay so what I've been talking about today is uh not about your dollar proofs and let me open by a question raise your hand if you think it's your knowledge solve all the Privacy problems in the blockchain space I see one hand let's see two three all right well if you didn't raise your hands maybe um well maybe you know better than I do but I don't think zero dollars off all the Privacy problems so let me explain why so um let's think about blockchains so what are blockchains and computation right uh blockchains applications uh everything is a computation on the blockchain right so ethereum is a public State machine that's replicated uh if you have some consensus mechanism and so what is it what is the same machine it's the same machine is something that uh keeps a state and has a transition function and transition stays through transition function right and more computers same machines blockchains and smart contracts right so everything on ethereum all the smart contracts are State machines okay what if we want to do the same machine transitions uh with privacy well let's try to use your knowledge how are you going to as you go to sleep machines your knowledge well we're going to execute the off chain and only prove the execution that is correct on chain right so I'm not going to show you the details here but more or less is going to look like this picture where every single States you know it's a different color and your do knowledge update is going to uh essentially link one color to another color right so here on chain will have three different states as opposed to the user want to interact with the state machine and uh they each independently enjoy a different proof right thinking state two to some state three now if one proof is processed on chain let's say the the live one the blue one here what happens is that the second transaction of this of the second user is now invalid right because it's the proof um is going from the same like state two but now you need to link to stage three right so so that's the problem with executing General State machines in general knowledge blockchain you range of race conditions okay so this problem is actually been observed over the years in many different ways but basically um you know the the store is at either you do a transparent engine computation which you know that we do on ethereum so you have no privacy but you have the you know benefit of a share state that everybody can have access to or on the other hand you have a zero knowledge of chain execution uh and you kind of have the flipped uh you know uh benefits and and kind of downsides which is that you have private inputs but to State that's not shared between anyone okay so uh we're basically someone like us with you know these two properties so we can't really get both and my talk is about how to get both properties and I call that um a confidential share state so how do we get confidential share states on the blockchain and the answer is fully homomorphic encryption or fhe for short okay so what is home of encryption um this is you know brief intro to cryptography so um so this thing is here is kind of commutative diagram okay so suppose there's a message and fix a circuit see here we can compute the circuit on a message to get C of M so that's this error over here okay um at which this scheme allows you to kind of do this thing but with three different steps okay uh and so first let's take our message instead of computing the function I'm going to encrypt it okay so everything that's done here is encrypted you can now see what's inside right so uh you know this is what kind of go through in your TLS channels and stuff like that right you first encrypt it and then you kind of run this evaluation function which takes in the circuit right and this uh stepper text to get another set for text okay um we'll have you down here well I haven't really done anything useful right but let's actually try to decrypt this thing again right uh if a fishy skin allows you to essentially um so if you decrypt this and you know and there's things that it's uh you know it actually works it means that you actually get back to the resultant computation okay so what have we done here instead of doing computation in the clear we can first encrypt do the computation and then decrypt Okay so so this thing is like really really sick right because um it allows you to do computational encrypted data it's like you know the Holy Grail of you know Computing uh and privacy right um so you know this thing has been discussed ever since like the 80s um but like you know recently we like only within the past about 15 years do we know constructions of this thing okay so there's still a single point of failure here which is the decryption key right so that anyone holds a decryption key can get the data so the idea is we're going to like move everything Unchained to be encrypted and stuff right so but we don't want a single person to be able to decrypt so what do we do we're going to add um thresholds cryptography we're going to SQL share the decryption key to every single validator okay so now I'm gonna have to guarantee that you can only reconstruct what's inside if um if k out of the N validators say so okay all right so all right so what can we do with that uh you know with such a virtual Effigy scheme uh it turns out we can basically uh you know do confidential same machine replication on chain and to release any information uh you know that we want to the public so let me kind of wrap up by telling you about the work of Pesca uh so Pesca it's uh well short for privacy enhancing smart contract architecture which is kind of a blueprint to unify the three types of computation right so we have transparent unchain computation zero knowledge option computation and this on chain replicated computation computation is a framework that I try to unite the three things you know putting the three together um so very briefly on what kind of what the challenge is here so the challenge is that if you want to make this in Practical uh you have to really really think about efficiency as it so it turns out FH is really really slow and uh is way slower than ZK even so you want to push computation to zero knowledge as much as possible while doing you know the bare minimum amount of like shared computation in fhg okay and uh I'm going to kind of connect the two components using virtual decryption so it's going to look at look like this where on the left hand side we'll have some type of like DK shooter tool which is really standards we're going to also use zero dollars to kind of encode inputs into this apigee computation module on chain and then we're going to decrypt stuff and then put it back into the you know through the pool um so this is actually inspired by the penumbra State model I encourage you to kind of look it up it's it's actually one of the cooler projects that's you know being implemented right now that have that's a private X okay anyways um and in the work we also extend this to uh to some Publications uh one of which is uh essentially a dark pool a privacy preserving custom function Market maker and the other one is uh first first price privacy preserve auction okay so let me in by a short conclusion which is uh you know what are the three points I talk about today privacy is you know privacy it's really important in blockchain space and zero knowledge is not a full solution and to get confidential share States we need something that's fancier and in this talk I presented one option using apigee and encourage you to go check out the work of best gun and the link to the paper is in this QR code anyone that they didn't raise their hands everybody understood that already when stuck with way after the talk thank you so much wait once again