Multi-Party Fully Homomorphic Encryption (MP-FHE) in Practice | Devcon SEA

and without further Ado if you guys could uh give a warm Round of Applause for gub sheep as we bring him to the stage all right welcome everybody to the uh welcome everyone to the afternoon sessions in this first 90minut session we're going to be talking about multi-party fully homomorphic encryption uh which is a new technology that a handful of our Vel opers researchers and partners have been working on and prototyping with so I'm going to start off by um just kind of going a capella on a on a quick introduction to multiparty fhe or I'll refer to it as mp fhe uh and after that we're going to dig into frog Zone which is the demo game that some of you have seen downstairs on the uh if you've seen like the tables around the Frog Hub there's two tables each of them has four machines and you you know you might have seen people going on there trying to either debug stuff or play stuff uh I'll be talking about that game which is our first endtoend demonstration of using this technology and then we will hear several lightning talks um from folks who are involved in building either this game or some of the technology Stacks that this is built on top of and uh yeah so let's let's dig right into it so um we can also make this because this is a uh more casual session it's not as much of a like prepared like delivered talk where I'm just going to be talking at everybody um feel free to ask questions at any time maybe if uh the staff is available to help hand microphones to people when people have questions uh you're very welcome to just raise your hand at any point another thing is uh I'm I know that we have had a couple of different FHA related sessions throughout Devcon so to start off with I just want to get a bit of context on approximately where the audience is at um can you raise your hand if you know what fully homomorphic encryption is okay so that that's most of the audience I'm probably going to go ahead and assume that can you raise your hand if you came to the previous how to hallucinate a server talk yesterday that was about frog zone so show hands there okay cool so what I'm going to actually start off with then is I'll start off with a quick multi-party fhe introduction that assumes that folks know what fhe is and then uh I'm going to dig into this set of slides as kind of an introduction to uh the Frog Zone project and then at some point we can either move depending on what people are interested in we can either move into some code or we can move over to the Whiteboard to kind of conceptually break down the system so there's a bunch of different levels of the stack here that are at play and uh our goal for the end of this first 55 minute session is to get an understanding of what are all the different pieces involved in this in building a system that is built as an MP fhe application okay so um just to get started folks here it seems like most folks know what fhe is the idea uh in short is that I can take some piece of data and I can encrypt it and send it to a server that's something we've been able to do for many decades one of the problems is once I encrypt data uh a problem that I might run into is it's impossible for a server that's holding my encrypted data to actually run any kind of computation on that data so you might imagine something like let's say that I have some um you know I'm using an encrypted chat app right or an encrypted document store so I'm writing all these documents locally I save them to the cloud the cloud stores them in encryption and now maybe I want to issue a query to the cloud that says you know give me back all of the documents that have this keyword in the title now because all of my documents information is encrypted um the server has no way to figure out which of the documents have the contain the keyword that I'm looking for enter fully homomorphic encryption if we have fully homomorphic encryption the server can run an arbitrary program on top of that encrypted data so for example here it would be a keyword search to check which of these documents contain the substring you know frog or something like that right and the server would be running this program over data that it has it has no idea what this underlying data is it's going to get as output some in this case set of documents that are also encrypted and then it's going to send that back to me and I can decrypt the result and get my operations so in some sense what I'm doing is I'm kind of delegating computation to the server but the server is able to perform that computation in a privacy preserving way okay so this is how people have thought about FHA for a very long time people have thought about like well maybe we can do some sort of like private neural network training with this kind of thing um maybe we can have like you know hospitals that are able to share data with each other and compute aggregate statistics on encrypted records what we have been most interested in lately though is kind of a different way of thinking about FHA so in the normal model you know you've got your client in your server the client sends up some sort of encrypted data to the server the server computes on it sends it back the client decrypts it's like a delegated computation with privacy strategy is what FHA is being used for now we're interested in multiparty FHA uh what multiparty FHA is is it's essentially a way for multiple people to get together and perform a computation or execute a program over mutually private state so how many people here have heard of multi-party computation NPC okay so again most of the room so this is basically using FHA as a way to achieve this sort of general purpose multi-party computation right so FH we usually think about as client and server and delegating some privacy preserving computation to the server MPC we often think of as multiple parties jointly Computing something together we're saying here FHA is almost a cryptographic backend to achieve what we want out of multi MTI party computation which for various reasons we think could be could be a more interesting direction for um some reasons we'll get to in this first set of slides actually okay so let's dig into this um the particular thing that I'm going to be first introducing is this concept of a hallucinated server which is the sort of thing that we want to be able to run inside of um mpf or using mpf so as mentioned uh we've built a game to demonstrate and to end what using mpf in this way could look like that game is called frog Zone you might have seen it downstairs uh you can feel free to come up at some point to try playing the game up here there's a table that has the setup all these computers are networked together and they are running frog Zone on them um the game is very very simple I'm going to describe the game um and I have a demo that's booted up right here so the first thing is if you saw the game downstairs oh oops look like I'm getting a little lag um you you might have seen that in its steady state the game has a QR code up that basically is going to allow you to log in with your zoo pass so that way you know once you're in the Frog zone now the Frog Zone knows that you have this EDSA public key or sem4 ID okay so I've just logged in I can start and you can see there's a very simple interface here so the idea is it's a four player game there are four frogs uh each of us playing the game will control control one of the frogs and you can see over here in the upper left hand corner my frog has like five health and it has one attack and I can move my frog around up down left or right so you know now I'm moving around um I'm like only able to make a move every couple of seconds that's because fhe is just extremely slow we'll talk about that in a bit and um yeah I can the other the other kind of key thing going on here is I can only see in this 5x5 area around me so there's a 32x32 map all over the map there's things like various monsters you can see this guy is an imp a cute little guy just having a bad day he also has five hit points and one attack um this is a prickly prickly Bush I can attack the prickly Bush so there's monsters that are just sort of hanging out throughout this 32x32 map right so I attacked the prickly Bush I destroyed it so I got one attack I lost one HP let's go over to the Imp now can attack the Imp oops well the game is very brittle so you can see I I just took the imp's health down um I can do that again so now it has three Health attack it now it has one Health and then if I attack it one more time the Imp is the Imp has been slain and I have one more attack okay so so um this is essentially the core gameplay we have this map there's a bunch of Monsters the monsters are actually moving around on the map so while they're in the fog of War they're kind of doing their own thing um and then you've got their four players and then you've also got items so I can go and I can like here's a wooden sword um and once I move onto the sword I get an upgrade so I get one more attack Point um at the top of the map if I went up to the top I would see there's there's actually like uh an ice biome and in the ice biome there's a dragon and that's the boss monster of the game so if you slay the dragon you get a bunch of you get a bunch of score and you you win the game so that's that's the goal um very simple game uh and you know the total size of the game State actually is also very small there's about 150 bytes that represents just the total state of the board and all of the monsters and all of the items um the front end is just a react and phaser front end and the source code for the back end uh is about the equivalent of you know 500 lines of C++ and yet this game took about a month for a team of devs from gaus labs and zerox park and psse to put together which is kind of crazy right because this game looks almost like what a kid's first programming project might be you know if I'm if I'm like learning to code in grade school or something and I want it to put together I'm like maybe a particularly enterprising student I could put something like this together um and yeah this took multiple devs a very long time to build so what's going on here why is this hard well the reason that this is hard is because all of this game state is actually executing inside of fully homomorphic encryption and to our knowledge this is the first time that someone has built an application in this fashion where you have an application that involves multiple users and the back end is essentially being hallucinated it's being run inside of FHA so that means all of that 150 bytes of state is encrypted and all of the player actions such as a a request to move up or a request to pick up this item or a request to attack this monster that's happening inside of encryption cool so any questions so far Yeah question in the front and again for those coming in feel free to this is a interactive session feel free to raise your hand at any point ask questions so it says that the server is hallucinated but it also mentioned that you're running like a thousand CPUs yeah so how does that work we'll get to that we'll get to that in a bit when we break down kind of the the architecture of this but great question um um okay so like we mentioned we want to use mpf to simulate this idea of a hallucinated server and to motivate this you know we can think about how applications are run today today the way an application will work is um let's say at Devcon someone wants to start a social media site right for a social network for attendees of Devcon to be able to post and add friends to each other and send messages and stuff like that well the traditional web 2 way of doing things is someone would go and they would rent an AWS box and then they would write some backend code and they would deploy that code onto the box and then each of us via some you know website or client we would talk to that AWS machine and we would be able to engage in in The Social Network that way now one of the promises of programmable cryptography is that we'll be able to do this but just with the users collectively simulating the execution of this virtual server so we could imagine a billion people coming together and being able to hallucinate the back end of a service like Facebook or Twitter or whatever else and in this world what might be going on is everybody could be storing some sort of cryptographic Shard of the total server State and programmable cryptography you know Technologies like obfuscation or fhe or ZK would be used so that everybody can in lock step Advance the state of the computation one step at a time while preserving you know its correctness while preserving its privacy ensuring that everybody is only able to know or make you know get requests to the things that they're supposed to be able to know and so we'd be able to hallucinate Zuck out of the equation for this particular example um and yeah we we can have this idea of like almost a perfect computer it's a server made of math rather than having a physical footprint specifically somewhere it's perfectly secure privacy preserving verifiable it's interoperable with every other server that's hallucinated um but of course we're very early in our journey right now so what's going on is the Frog Zone backend is basically being collectively hallucinated by N9 machines Each of which is playing sort of a different role right so there's the four MacBooks over there and there's also five 192 core AWS machines these are six c6a 48x larges and it costs about you know $200 an hour to keep this up so what's going on under the hood is that these nine machines are collectively running the FHA computations together necessary to perform the action of the server um one sort of to put some numbers to this you can think about this as like every binary gate that is involved in the computation takes about 10 milliseconds to evaluate that's about a billion times slower than regular computation so you know I believe that on on Modern chips a binary gate might take something like about 10 to the1 like 10 Pico seconds to evaluate so we're nine orders of magnitude off and then the other thing is that for every bit of PL Tech State we're we're storing we have a blowup factor of about several several thousand so every PL text bit of state is going to correspond to about three ,000 bits of Cipher text I kind of think about this as um it's almost like we've built a cryptographic equivalent of like the uh a particle accelerator where we have this like enormous amount of resources that is existing in order to suspend in the middle of all of these computers a very small number of bits that we can operate on consistently um just like you know with a particle accelerator we have this like enormous like magnetic fields and crazy stuff just so that way for a brief instant in time we can uh you know get some evidence of the GS bozone or something so yeah in short we've built the slowest and worst performing game in the history of human Computing and we're going to talk about how we did that so like I mentioned um the ideal here would for would for uh would be for these four machines to be able to just collectively hallucinate the game through multi-party fhe but in reality because of some of the constraints performance wise that we have today there's nine machines involved now the same kinds of or very similar kinds of guarantees are still preserved but we're doing this so that the game can actually be accessible um and we can get sort of the performance we need to perform the so let's look at what's happening um so there's essentially this Fleet of AWS web servers that is storing the encrypted state so these web servers they don't see any of the actual underlying computation uh and in theory in the future they could be substituted out for just a local computation running on everybody's machines but we do that so that the moves can take under you know about 1 second or so otherwise it would be maybe like 10 seconds so whenever uh a machine wants to send an operation up to the server let's say I want to move my frog up right uh oh so the game lasts only five minutes so let me go ahead and log back in here and for those who are interested in how the zoo pass login Works without any kind of zoo pass popup going on uh there's a session about that it following this mpf session so you can see what's going on exactly with this page um so let's say that yeah I want to move my frog up I'm going to press this up button and what I'm going to do is I'm essentially going to send I'm going to encrypt this enum up right which I'm going to serialize as two bits and I'm going to send those two bits of Cipher text up to one of these five fleets of servers so now that that server is receiving two encrypted bits doesn't know what those bits are um what it's going to do is it's going to you know forward that request on to all of the other servers so basically all of these servers have are just replicating all the requests that are being sent from the clients and then what those servers are going to do is they're going to you know run that move in FHA on top of the state so essentially there's some function that takes in two inputs the first is you can think of as a 150 byte string that represents the state of the game and the second input is this encrypted you know two bits and uh I guess a player ID as well so it' be like four bits right and there's a transition there's a state transition function much like a blockchain has a state transition function that applies that move onto this 150 by state to get a new 150 byte state right and now I flush my you know store my memory and you know that's the new state of the game is this 150 bytes worth of encrypted um game State okay so finally whenever players want to retrieve some State how does that work well what I can do is I can send up a query to one of these five AWS servers that says get me the 5x5 area around my frog that's the only thing that I am allowed to see right I'm not allowed to see the positions of other frogs the way that this game should work is that none of the frogs should be able to see each other or see what each other is doing unless you know you're in the 5x5 area around where something's happening right okay so what I'm going to do is that's equivalent to basically some sort of view function execution on the state so uh I'm going to send up you know this request to execute a certain view function on the state and return it back to me one of those servers is going to take that request it will execute that view function over that 150 bytes it's going to get out some representation essentially of a 5x5 grid that has a cipher text corresponding to what's inside that tile whether it's a monster or player item or uh you know whether it's an impassible terrain or not and it's going to return it back to me right now the problem is it's executing this view function over some encrypted data and what I'm going to get out of that is also encrypted data so I'm the client I Reed some encrypted data back I cannot decrypt that data alone you know the guarantee of fhe is that you put some encrypted data in you run a program over it you get some encrypted data out um if we had something like you know program alisation I'd be able to get plain text Data out but this is the guarantee of FHA so in order to decrypt this data what I have to do is the way that this mpf protocol works is all four of the machines that our client machines here are storing essentially one you can think of it as a Shard or like a secret share of the protocol decryption key so all four of us need to put our shards together to perform any single decryption so that's exactly what we're going to do um again if you were downstairs you might have seen that you know in between all of the four machines there is this kind of uh this switcher in the middle that the all the computers were connected to that was helping to coordinate a multi-party decryption ceremony that would essentially take the encrypted output that's been returned by The View function pass it around to all four of the machines and then all four of the machines would uh collectively send some decryption shares back to me and I can use that to decrypt the output so for those who are familiar with you know trusted setup in zero knowledge protocols that's something kind of analogous to what's going on here to decrypt the result okay so um let's talk a little bit then about now now that we know that this is what's going on um and this is what the the function of each of these nine machines is uh let's kind of talk about the trust model here so earlier we had a question which was we talked about this idea that theoretically we want these four machines to be hallucinating a server together but there's some AWS machines in the mix here what is the trust assumption on those machines what are they doing what are we relying on them for what are we what are we not relying on them for does anyone want to take a shot yep over there um oh yeah if you just store in the whole state of the game in like a little 150 by um uh plane text or whatever You' just be using AWS to um process the next state right yeah exactly so each of those AWS machines is storing the cipher text encrypted version of that 150 plain text bytes um in fact it's replicated across all of the AWS machines and if we wanted to we could also replicate that state on each of the the local machines as well so all that we're doing with the servers is we're simply delegating computation to them right so each of those servers can run that state transition function where it takes in as input the cipher text and the encrypted move the encrypted State update and then output the new state any server could do that I could replace this server with that server I could have a marketplace where different people are providing servers to to perform this computation or even if FHA was about 30 times faster then we wouldn't need the servers at all we could actually just have all of those calculations replicated and running locally on all four of those machines and those machines would simply at every step run the FH process and then cross check with each other that the ending you know resulting Cipher texts of the 150 bytes are all equivalent so um right now we're doing this because we want the mo it was a designed goal to make it so that each of the moves takes under one second to process um but this is one of the things that we can do if FHA gets better okay any questions about this yes over there um what about onboarding and offboarding parties like how easy it is to join the service that compute and store the uh State and do we have to regenerate the key and like re reinitialize the whole setup every time yeah yeah so that's exactly right another limitation of this system right now with the protocols that we have is that you need to sort of set up the group in advance so you need to designate which are the parties to the comp ation then they run this almost kind of not quite trusted setup like process but something like a ZK trusted setup process to instantiate all the protocol parameters and those protocol parameters are for that specific group however it's it's for that specific group it's not for the specific program you can actually be then take that group and have a bunch of different programs running as well does that answer the question yeah so if we were to talk about like an ongoing setup let's say um M mm more RPG game that is like ongoing then and and it would be like permissionless to join and like be a part of the verifiers who compute the state uh that would me make sense to organize it into EPO or something right like and to re regenerate the setup uh for every Epoch yeah yeah I I think that um you could imagine doing something like that I I believe that it's also it doesn't seem too Out Of Reach to also upgrade what we have you know literally running right here uh to be able to accept you know adding participants and deleting participants and setting thresholds on like what is the number of key shares you need online um one kind of world I could imagine is I don't know if folks here have seen you know torrenting websites like The Pirate Bay but uh at any given time for any given torrent you might have some subnet of some number of Cedars and leechers and as long as you have enough Cedars you're able to access that data well we could imagine a world where you have you know that sort of setup but as long as enough people are online for the particular program subnet you have access to that particular program um so but in order to do that you would need a protocol that admits participants joining and leaving at arbitrary times now again you know hint hint nudge nudge wink wink this is the sort of thing that becomes very easy Once you have functional encryption and obfuscation and that's why projects you know this project and the precursor to this which was called the chicken game not instead of the frog game um sort of that that sorted to point us in the direction of actually wait of these problems would be solved if we had this even more advanced technology does that answer the question yes thank you awesome any others okay so let's keep rolling uh oops so the servers are I guess they're being trusted here not to go down hypothetically that we could be replicating the computation on local machines um they're only performing a fully deterministic operation with no secrets um and uh that's basically how this whole setup works okay so uh I want to get now into some of the tricks that we use to actually make this game you know this is a very simple game but it is a playable game that does have some minimum number of of consistent mechanics um so we use a number of Tricks basically uh to make this work even in the context of a highly constrain Computing environment and for me this is a little bit reminiscent of you know stuff that I've read about the early histories of video game or computer game development you know back in like the 90s or even earlier when you had these arcade machines um or the very first personal computers you would have these game developers who had very very limited amount of memory very very limited amount of compute and they would have to try to simulate some kind of self-consistent virtual world with a bunch of different rule sets and back then that's that's how we got a bunch of advancements in things like Graphics uh or I think things like you know efficiently Computing square roots or a lot of that kind of stuff came out so you know perhaps we might see something similar come out of FHA over the next few years um oh and as one other note um for those who have been uh looking into or following along with blockchain gaming in the last couple of years for me this has felt very reminiscent also of developing uh some of the first like onchain ZK games as well where you're working in an environment where ZK snarks are super slow five years ago there's like no l2s you have like a tiny amount of gas budget for your game how do you build something that has a self consistent Universe we might be about two orders of magnitude more constrained than the 2019 era of let's say like blockchain onchain gaming um or autonomous worlds as a lot of you know these these games are now like starting to be directed towards um but similar style of thinking so what are our constraints our constraints are we can't really go above 200 bytes of State due to the fact that um you know once you need a lot of bandwidth requirements and interactivity requirements because there's this you know 3000x Cipher text blow up you're simply transmitting too much over the network and again for those who have who have actually tried the game you might have noticed that downstairs um especially when the Wi-Fi was uh you know kind of dodgy the game would stop working or moves would stop getting processed or or all of these things you know that's the result basically of the fact that all of these these constraints need to combine together the biggest constraint though is that we have this one billionex computation overhead and as actually more than just a 1 billion x computation overhead I would secretly think about it as like a 10 to 100 billion computation overhead because there's certain things that you can't do in FHA that you would naturally do in a normal programming model so I'll explain that in a bit as well so um and then our goal was given all of these constraints we still want to be able to build a game where each of these moves takes under one second right so we got four players each of the players uh moves takes about a second to process an FHA when it's distributed across the five machines that means that I can move you know my frog once every 4 seconds or so and that's you know going to be rate limited by the client here um and 4 seconds is about the limit for like this to feel like a playable game so we're we're right in there um okay so um one thing that I want to talk about here first is the idea of the circuit model versus the memory model of programming and actually is it is it possible to switch over to the Whiteboard now is that something I can do okay all right so um how many folks in this audience have seen or programmed ZK circuits can you raise your hands okay so so folks who have tried working with ZK circuits have some sense that when you're writing a ZK circuit you're sort of fundamentally doing a different thing than when you're writing a program right a lot of stuff is basically like more annoying in some vague way well guess what you're in luck stuff is still more annoying in exactly those ways or at least very similar ways with FH as well um so let's talk about what it means to be programming in terms of circuits well with circuits what I have is I basically have a bunch of gates on the left side I take in a bunch of inputs you know in this case it might be bits and then you know I can run these through some other Gates and then like some of these Gates might come together in like certain ways and then I might like get some sort of you know some sort of outputs right now you know in in some sense this also looks maybe a little bit sort of like you know something like a neural network I start at the left and then I like go through all of these operations these operations depending on what kind of execution environment I'm working in they could be stuff like you know an arithmetic circuit has Gates that look like times and plus right so I would take these two bits um oh actually let's do this I would take these two bits and I might multiply them to get the output of this bit or I might take these two bits um and I might like add them to get the output of this bit other kinds of gates that we can imagine are Gates like um you know logical operators so or and you know not stuff like that this is approximately what a circuit is so I can go from from left to right and evaluate all the bits um now this is pretty different from how I think about a program right in a program let's say I'm writing in in you know some highle language I might write something like uh you know um in B 4 equals 0 one 1 0 and then like later down in the program I might be able to do something like you know check like if you know C equals equals B of I then like do something right and then like maybe like uh or maybe this is like some variable I'll call it like uh like X and then X is some variable here that like X is f of blah blah blah like some computation okay so um for those who have coded using something like circom uh you might start to see where the where the difficulty comes in where the problem comes in um when I'm trying to write something like this in the C model in this model what we implicitly have access to is this idea of memory right so I have you can imagine I have this big like memory tape with a bunch of addresses addresses like 67 68 69 70 71 Etc um and like I might put this array into memory and then if I want to read out the the number at location X then I can simply pull that out of of memory over here now now let's talk about why that doesn't work in FHA so let's say that I try to do kind of a naive construction where I oops where I implement this 32x32 grid by keeping a 32x 32 uh grid of Cipher texts so you see how like each of these tiles there's like some stuff in the tile right you see these tile details this tile has coordinates 224 it contains the monster that monster is a prickly bush has one HP one attack imagine I take all that and I try to basically encrypt that with my fhe scheme and then I store it at the position 2 comma 24 in my array now let's say I want to perform some action that causes me to modify the state of that 224 tile in encryption so I'm going to move my frog over here yep and I'm going to attack the prickly Bush and that like destroys the prickly Bush right what's the problem if I store this map as a 32x32 grid of Cipher texts does that is am I keeping private what I'm wanting to keep private from the server and the other players when I perform this action yeah over there sorry can you say that again see the whole um yes so so if we got together and we decrypted the whole map we would be able to decrypt it which is why there is at least sort of a one event trust assumption on the four players but I guess what I'm saying is that more than that so sorry to interrupt but H you might they might not know what you're trying to do but they will know exactly where you're doing it yeah that's exactly right so the issue here is let's say that the whole kind of the whole mechanic of the game is you can't see where other people are right like other people's coordinates are not being revealed to you they're not being revealed to any party that's inspecting the traffic of the network um so let's say I say okay well I'm going to take my frog and I want my frog to do something to tile 6 comma 3 but I'm not going to tell you what I'm doing to 6 comma 3 or like I'm like I take my frog and I say I want to take my frog and I want to make it do something to the tiles you know uh like 3 comma 24 and 3 comma 23 and I won't tell you what I'm doing that's a secret that's encrypted well this is going to leak a lot of information right this is effectively revealing to all the other participants on the network anyone looking at the traffic if we're Del getting you know tra if we're delegating computation to any server this is a pretty obvious tell that you are moving from 3 comma 23 to three uh sorry 3 comma 24 to 3 comma 23 does this make sense to everybody yeah so somehow memory doesn't quite work the same way inside of fhe that it does inside of regular programs and again for those who have seen ZK circuits this is is this is a similar issue here we don't really have access to memory in the same ways so instead what we have to do is we end up having to do this sort of check for every single tile right like I have to say uh well if I am moving on to tile three comma 23 um do this thing if I am moving on to tile 3 comma 24 do that thing you know get the outputs of all of those results and then add them together um M like and take like a DOT product with the with a vector that basically selects which one of those options is true so let me let me write that down actually on the board here um so let's say I have some function and we can literally go and look at this function in the code right after this actually that says um is Collision right and what that function is going to take in is it might take in um two values it's like some chords this is uh two integers right and then the other thing that it takes in is it might take in um you know let's say uh not allowed tiles and maybe there's like a 100 not allowed tiles each of them has like two coordinates right so what I essentially have to do here is I might have some other circuit the like is equal circuit that takes in chords one and chords two and it returns you know one if equal and zero otherwise what I'm going to have to do is I'm going to have to return this value okay so cords to so I'll say is equal of cords 2 comma not allowed tiles zero oh sorry have chords not allowed tille zero plus is equal chords not allowed tiles one and then etc etc and I go all the way down to plus is equal chords comma not allowed tile index 99 okay and now if you can imagine like I might and then you know this is going to Output basically like a one or a zero depending on whether or not the coordinates uh were contained inside of this array so that's basically a linear time operation I'm doing a linear scan of course what I would like to do in a normal program is I might store this thing as a bit map and then I would simply just look up X and Y of the coordinates and determine whether the bitmap contains um a a tile I can't collide with here I have to do this linear scan now this blowup is basically what happens for every single operation so let's say that I have some rule or some logic in my game that when I attack a monster I have to subtract that Monster's Health by my attack well the way that I'm going to do that is I'm basically going to Loop through every single Monster in the game and then I'm going to check does my coordinates equal that Monster's coordinates and if so apply this attack does my coordinates equal that Monster's attack if so apply that attack and then I'm also going to have to do that for every single item so anytime I interact with any coordinate tile I basically have to simultaneously run all possible branches of the program inside of FHA so that's why the overhead of FHA over regular programs is not just 1 billion x in the sense that a binary gate takes a billion x more time to run than a or sorry a binary gate in encryption takes a billion x more time to run it's also got this overhead of the fact that we're working in the circuit model and not the memory model does this make sense are there any questions so far cool oh yes question over there the question might not have uh legs but if we go back to the actual frog zone game I'm seeing on the right all of the encryption decryption happening and it's almost as if the program is basically checking for every single tile and encrypting it decrypting it and I'm wondering if that's necessary or if it's there is any optimization and you chose not to do the optimization or whether this is actually necessary yeah yeah so yeah the ideal world would be that I can make some moves to the server and then I can request for the state that I want from the server and the server just returns to me somehow the plain text you know Court the plain text like information of the tile um instead what we have to do here is I'm getting back an encrypted version of the tile and then I have to do the four-party like multiplayer decryption to actually get what is in the tile so there is an optimization that allows me to just get the tile back in the clear that optimization is called indistinguishability obfuscation so if we can crack that then this become this problem becomes a lot easier and that's what's actually one of the reasons that's motivated us to start looking so much at obfuscation is because we're trying to do these things and we realize oh wait this is really going to suck if we try to scale this up Beyond four people thank you cool um so it's it's actually that line of questioning that also drives a good amount of what we think of as the the research agenda in programmable cryptography so a practical question we can ask is like well what would it take to not have to do this four player networking or for example to not have so much difficulty instantiate it with instantiating a new group every time you want to do a new computation that leads us down the direction of functional encryption this sort of thing where like the circuit model is just way harder to work with and adds an additional 10 or 100x overhead on top of the programming model that is going to actually motivate another Direction which is the direction of oblivious random access memory which we'll also hear about later today in these afternoon sessions if we can crack fhe or obfuscation friendly oam then we can basically do fhe but we the indices of the memory that I'm trying to access are in some sense homomorphically encrypted in the same way so yeah a little demonstration of how even just building a simple little game you run into all these problems that you don't anticipate and that that just opens up and tells you about what to do next in programmable cryptography okay so um we can actually look at the move function that's implemented as a circuit and this is also going to be a good segue to talking about like the development stack of this whole thing so um yeah yeah I want to talk about the stack here so frog zone is built on top of an fhe Library an mpf Library called Phantom Zone um I believe Phantom Zone is one of the the two libraries that exists for multiparty fhe I recently found out I think open fhe also has something here um yeah the the wonderful Folks at GA Labs um mostly Jay as uh leading this has have been working on this mpf library and what it essentially does is it's a rust library that exposes is all these functions that look like stuff like you know fhe uncore or and the rust function fhore or takes in two encrypted bits two FHA encrypted bits and it outputs another FHA encrypted bit okay so you can start to build these programs that basically look like uh well I'll show you here so this is sort of analogous to like looking at like an R1 CS um you know if you're if you're deserializing what's coming out of like a circom compilation or something so um this stuff basically is going to these are arrays of all these fhe operations that we want to do and these are going to all get compiled down into basically a bunch of um you know FHA ores and FHA knots and FHA ands now it's you know as you can see like this is what the binary circuit for moving a monster around would would look like and I really don't want to write this by hand right like this looks very painful it's also automatically doing some optimization and parallelization what we would like to do is write in some kind of higher level language in the same way I don't want to write R1 CS when I'm writing in circom so what we have is um some of the wonderful wonderful Folks at psse essentially built a compiler tool chain that allows me to start by specifying my uh the the circuit that I want to execute in C code and then it uses a combination of compilers to basically take this C code and compile it down into a binary circuit and then it uses Phantom Zone to execute that binary circuit inside of fhe so if we look over one of these functions we can see some of the things that we were just talking about over there with like the pain of running in the circuit model so in fact right here I have that something very similar to that very function I was talking about apply move check Collision so the first thing that I'm going to do is I'm going to take in some of my old cordinates which is two 8 bit numbers um and I'm going to take in a direction and I'm going to run you know the uh coordinate incrementing procedure on this and then what I'm going to do is I'm going to have to take in all of these obstacles that are up here so this is essentially right now the map is hardcoded we'll get to later how you can make it so that the map is not hardcoded but it takes all of the coordinates of the water tiles and you can't run into the water tiles and it just checks to see does your coordinate equal to one of the water tiles and then it does the same thing with all the players and if you did not collide with anything it will return the new coordinat if you did collide with something it will return your your current old coordinates but randomized an encryption so that you can't tell that you didn't move um so this is C code that's written and then it's going to be compiled down into a binary circuit and then that binary circuit is going to be you know turned into this uh piece of rust code that uses uh Phantom Zone and then we're going to call that rust code inside of our um inside of our sort of backend and rust code that's actually running the game in encryption right so you can see over here I'm calling into this apply move function that was autogenerated by my FHA compiler tool chain so um yeah I think like edu and Han spent probably on the order of several weeks working on just getting this thing working um and there's a lot of basically like optimization work that happens at that step where for example we saw over here if we go to the apply move function that I have this like hard-coded list of obstacles what that enables the compiler to do is it enables the compiler to compile an optimized binary circuit that assumes that all of these coordinates are hardcoded in so you can start the compiler can start automatically you know intelligently um making it so that maybe I can do a batch check of a bunch of these because a bunch of these all start with the y-coordinate three so rather than checking each of them individually one by one maybe I do like a range check so this is the sort of way that we we op we um take advantage of existing like Hardware synthesis and and compiler type tools here so that's basically what's going on at the bottom level of the stack that is how we end up running stuff inside of fhe um any questions so far here cool let's keep rolling okay so using this kind of Stack we can write all of the Transformations that we want to do in the game which is basically like you know making a move for a player another one is like the monsters move around on their own inside of encryption so basically we can like write the function that determines you know given some random input for how the monster should move uh figure out if the monster is able to move to that location and then move it um and uh yeah you can essentially model this this C code as like running or C++ code AS running inside of FHA um so a level above that uh we get to the actual back end of the game and the back end is basically just this big harness around those FHA functions that sort of handles the input output from the different players and does a bunch of the various tricks that we need to do um to you know Factor different kinds of State Etc so one thing that we found out very early on in development is that it is a real pain to try to build and iterate on top of this kind of game and debug things when you're actually running the whole thing inside of FHA so you know if I want to test something each of the moves takes about 10 to 15 seconds on my laptop so if I'm trying to do local development this is this is really tough um so what we quickly sort of landed on was we also built out a mock plain text version of the back end that just simulates the exact same functionality that the um you know fhe back end is running but here it's in plain text and we sort of just artific ially take the benchmarks from that Fleet of five servers we see how long it's supposed to take to do a move and then we just sort of artificially introduce these rate limits or these these time delays in the mock version of the game so that makes it much easier to program but that was that was one small thing that we noticed and it's it's the accumulation of a bunch of small things like this that accumulates into a fullscale developer tool chain which is what we're sort of thinking about as a result of having gone through this first exercise once Okay so so um let's talk about a couple of the things that the server is doing a few of the tricks that it's doing so one thing that's going on is like I mentioned the blow up of plain text to Cipher text is huge it's like at least three orders of magnitude for every bit I want to transmit of equivalent plane text state I'm transmitting like kilobytes of uh encrypted Cipher texts so I really would like to minimize the amount of bits that I have to pass back and forth and you can imagine if I was sort of writing this application in the natural way with tools that we have today um the way that I might return the 5x5 area around my player is I could have some sort of data structure you know imagine some sort of Json that for each tile just contains does this tile have a monster or an item if it's an item what are the items like properties if it's a monster one of the monsters Properties or maybe it has a big checklist of all the monsters and all the items and you know I go down the list and I check off if there is one of those entities inside of this tile now that's going to lead to lead to a lot of this sort of communication blowup so we basically have to be very very um sort of Thrifty with our data structures here it's kind of similar actually to writing some stuff in solidity when you have to minimize the amount of call data or minimize the amount of stuff that's stored onto the chain um so approximately and this is not exactly right but approximately what is returned for any given cell is about 32 Bits And depending on what is in that cell whether it's a player or an item or a monster or nothing these 32 bits are interpreted differently so for example the fourth bite of the state if this if the first bite had uh basically the entity type player in it so that's an enum that takes two bits to serialize or three bits to serialize um then I know to interpret the fourth bite as the players score on the other hand if the entity type of the thing was item then I know to interpret this bite as the number of points that a player ought to get for picking this thing up right so um we using this kind of thing we're basically able to design the game around this idea that we should just have this 32-bit structure and that's our budget and we just have to fit whatever mechanics we can into this 32-bit structure a last thing that I want to talk about is the idea of Randomness in this game this is sort of the last backend component so like we've talked about there's these four players that are living inside of the Frog Zone and they can each see the 5x5 area around themselves but of course the map is 32x32 which means that there's a bunch of this fog of war that none of the players can see right all of these dark areas in between all of the respective players viewports stuff is still happening inside of those areas there's monsters that are moving around of their own accord so how do we make that happen when the game is being hallucinated by these four players right like how can we make it such that we can essentially have like an autonomous flying bat that's going around despite the fact that none of the players actually knows where the bat is because here at least with the frogs it's a little bit of an easier problem right you could kind of imagine that well in terms of where the frog is at least I'm going to know where the where my frog is and you're going to know where your frog is so each of us collectively we're going to know where the frogs are but somehow we have to simulate the execution of this bat flying around that none of us knows so the trick for that is to basically introduce some notion of Randomness you know and this is some of the idea that goes behind things like procedural generation as well so every time I send okay so actually let me back up a bit uh what we're going to do in order to set the foundations for these NPCs to be able to move around on their own is that the server is going to keep some encrypted bite as essentially a random seed at all times now whenever I a player wants to make a move what I'm going to do is I'm also going to client side generate some random bite and I'm going to encrypt that and I'm going to send that up with my move what the server is then going to do is it is going to in encryption exor the random bite that I'm sending up with the current bite that is representing its random seed state so in this way I'm sort of doing something kind of like a a Rand Dow sort of thing where I'm mixing this uh encrypted random State again very blockchain esque sort of construction here so now at regular intervals what the server can do is it can take that encrypted random State mod it by four to pick a direction up down left or right mod it by the number of monsters to pick a monster to move and then EX cute moving that monster in that direction all without having any idea of what the monster is or what the direction is did I hear any a question cool um so yeah this is very a lot of this actually turns out to be very reminiscent of blockchain development but rather than having to execute inside of this smart contract execution environment we're executing inside of FHA where we only have access to circuits certain kinds of determinism Etc okay so that move for example Not only was I encrypting the enum representing right I'm also encrypting this random bite the final thing that we weren't able to get to in this version because uh we didn't have the necessary compute to do it but if instead of having five of these massive aw machine AWS machines if we had 50 we would be able to do this is right now the map for this game is hardcoded right so if I log back in again here you can see so I'm starting a new game you can see that it's going to be the same map and my frog is going to start spawning in the same place now theoretically with this kind of Randomness strategy that I've just described we could embed a procedural generation algorithm that takes in a random seed into the fhe circuits to generate the map only when the players have joined now this is theoretically possible it would take about 10x more computations so it's not completely out of range um but the point is we we couldn't do it here given basically the amount of compute that is accessible right now for reserving off of AWS um this is also very reminiscent to a trick that we use sometimes in ZK games where we essentially procedurally generate the game by implementing a procedurally generation procedural generation algorithm inside of a ZK snark so you see there's all these different parallels between the different kinds of programmable cryptography and the different kinds of guarantees that they give so the eventual version of this game that you could imagine once we have obfuscation memory this sort of Randomness this sort of performance is we could imagine a billion people getting together to be able to hallucinate and procedurally generate an entire world and this world would have all sorts of NPCs and those NPCs would be able to move around autonomously like of their own accord and I think that's really really interesting I think that there's some like interesting implications um for uh for what it even means to be an agent in this game so for folks who were here for the morning sessions we touched very briefly on the end about like is there a different kind of digital agent that becomes unlocked by uh something like the Frog Zone you know I I had a little bit of a moment the first time that we got a bat moving around on its own in encryption which is like no one knows where this bat is or what its properties are and yet this bat is somehow still part of objective reality like what is what is the subjective experience of this bat what is it like to be a bat like flying around an encryption it's like a genuinely like very interesting question and I think it presents another alternative view on things like uh you know digital agency where we we often times we think about AI agents and llms and the fact that intelligence is one way of conferring agency but another way could be you know if I were to obfuscate or encrypt my entire brain and put it inside of a cryptographic program somehow I have a self-consistency to that program that is not that is an orthogonal Dimension to the to the AI sort of thing going on um yeah so that's about it for the back end I'll say one more quick thing about the decryption and then I will hand it over to edu to talk about some of the circuits um so one thing that's going on is if you look at this this is this is just bad window management this is not actually like strictly necessary um but the reason that to run this game right now I have so many terminals open is because what's going on is that each of these clients needs to basically be running a FHA decryption client locally and we have fhe decryption clients running locally in Rust so what's going on is essentially there is a decryption program that's running on all four machines those decryption programs are talking with the AWS machines that are carrying out the fully homomorphic encryption operations and then those four uh uh the four decryption programs and the four machines are linked together on a tail scale Network and they're sort of doing this peer-to-peer Communication in order to get um all of the respective decryption shares every single time I need to retrieve you know new cells in my viewport or refresh the cells in my viewport so um this whole thing basically has involved you know spinning up something like somewhere between 12 and 16 total programs that are collectively running all of these different parts of the operations necessary to hallucinate a server and all of this just to get four players playing a four four player frog game in a 32x32 grid um so yeah that's about it for uh the overview of frog Zone and with that I will stop here all right um let's get uh another round of applause for gub Che oh and um maybe one more thing that I'll say is I just want to shout out a bunch of the contributors who made this project possible was a real team effort across the stack we had uh John maayah from GA Labs we had Han and edu and CC from psse uh we had help from small brain games um we had help from Marian over there it was a a bunch of things coming together to put this demo for you guys at at Devcon so thanks again to everybody who was involved all right we're going to do a quick little 30 second change over um one of the fun things about uh interactive Workshop we got to have a fresh machine every single time so thank you for our lovely AV staff who's actually been doing an incredible job actually I'll take this moment can I get a round of applause for the AV staff for this whole uh this whole conference the volunteer staff all the people behind the scenes let's give them a little clap because they've been doing an amazing job we came to them this morning and we asked if we could have a whiteboard on stage can we swap out different machines and they've just made it all happen so you guys have been amazing and now I've killed enough time for us to have our machine set up so uh can I get another round of applause uh for excuse me sorry messed up my sheet here uh Edward Sono I think I pronounced that wrong but Here We Go Round of Applause for Edward and he's going to talk to us about Boolean and ZK circuits Round of Applause please [Applause] hello so um I've spent the last three years mostly working on writing ZK circuits some of these was circom and some most of that was Halo to and in the past months I've been playing with multiparty FH and writing cits for those and I will give a talk about some differences and similarities between writing FH circuits um which also applies to um MPC in many cases and ZK circuits so one of the first differences is that in most ZK proof systems you don't actually write circuits you write a system of constraints so the process is that you have a problem you compute the solution to the problem and then you write some constraints that verify the solution to this problem um so in this case uh actually I would say not all proof systems are like this for instance gkr is not like this but the ones that most people will be familiar with R1 CS ccs blanish and arithmetization are like this and an example of this behavior is that if you want to prove a division you don't write a division constraint you write a multiplying constraint on the other hand with MPC and FH we actually have Boolean or IC circuits and in this case we need to create a circuit that encodes the behavior of the program and the circuit will be fully evaluated from the inputs to the intermediate wires and to the final output so we cannot skip any computation there we cannot inject some witness and use it one similarity that Brian already discussed is that doing branching is hard in like technically we don't have branching so if we have a loop we have to unroll it if we have a condition we need to explore both paths and then converge um in constraints we'll probably assign uh the constraints that assign the possible results of every Branch to a signal and then constraint that signal to be the result with Boolean circuits or arithmetic circuits it's going to be similar as a circuit that takes both pass and and then converges uh another difference is the uh the ownership of the data in ZK there's a single owner of the data so you only have to think to think about private data and public data but in NPC or multiparty FH the data that is used as input can come from different parties so it's not just private but it's private from whom or for whom um and this applies to the inputs but also the outputs you may want to write some Logics that uh where the output is only revealed to some parties to a subset of parties another big difference is that in uh ZK usually we get parallelism in the proof system level but in NPC and FH we can do paral paralyzation in the circuit level so for instance if we can organize our Circuit by layers where there's no dependency between nodes in the same layer we can evaluate all the gates in one layer in parallel which is a great way to accelerate the performance another Point most of the ZK proof systems use field arithmetic uh in FH or NPC there are some solutions that use bull that use arithmetic circuits but others use Boolean and when we work with booleans we are in a world that is more familiar to regular programming because we can simply emulate the 8bit integer 16bit integer and then we don't have these um maybe harder to reason wrapping behaviors uh another difference is the state of circuit compilers I think in ZK the current Solutions are quite mature there's many options they have very good Integrations I think part of this is because um a lot of people have built applications using ZK so this has uh driven a lot of investment in developing this tooling on the other hand FH and NPC has been less used in practice so there's a lot of tooling that I would say has received less user feedback and hasn't had the opportunity to mature and get easier but there there some tooling but probably we can get better and this is the end of my presentation thank [Applause] you all right great closing slide another round of applause uh I'm going to quickly plug as we set up our next computer I'm going to quickly plug the programmable cryptography textbooks you've probably all been able to snag one if you haven't been able to grab a programmable cryptography textbook they're in the back corner there that's the last of our stock uh so when it's gone it is gone and um trying to think if there's anything else left to plug if you've been collecting the frogs our frog shop will be open uh probably for just a little bit after the CLS so please stop by there and um yeah we uh we're just going to get the session started in about 30 seconds after this machine is set up we will have a little break so at the uh end of this particular block we will have a not this talk but this block of talks we will have a little break so there will be a time for grabbing a quick coffee and bathroom break before we get into the next session after this led by Richard from the zup pass team and are we good to go all right our next session is going to be from Han Jen and he's going to talk to us about rewriting f pH Zone let's let's give it up for [Applause] H hello I'm H from PC and today I would like to share uh some experience during The Rite of fantome and I will try to explain the cast breakdown of it to show you more idea why it is though and as as you can see the frog game like the Frog moves slow because each one bit binary operation takes rly 30 millisecond on a laptop with the FI uh fhw scheme we are using and here's the reference uh parameter for for reference and 30 millisecond is roughly a billion uh times overhead compared to a commod laptop so uh that's why the Frog zone game looks a bit slow and among this 30 millisecond uh Le almost 80% of time is consumed by a repeated uh routine that uh I will show you uh quickly so this routine looks like this uh we take a a a polinomial from a cyer Tex which is a vector of a u64 integer and we decompose it into uh multiple polinomial with small lims in order to do some multiplication with the Boost trapping key we need to do fft it uh and send it to evalation domain and multiply with the Boost driving key and finally get back to coefficient form and this looks like a simple and quick to compute actually in a single boost chopping we have to repeat this uh routin for around 1770 time and that's why uh and and that takes roughly 80% of the 30 millisecond and if we braak it even uh smaller and you can see that the point wise M and sum takes roughly 40% of the whole boost driving time so if we can try to improve uh each of these compon component with signif significant uh amount then we can improve the the Boost driving time and and for the the the fren so here's the uh tricks that uh we in F currently we have already applied so for example we use uh complex fft instead of a number Zing transform to try to reduce the number of uh uh modular reduction to do to speed up the the overall REM multiplication and also we try to reuse the pre-allocated memory for for the routine I just show but uh we haven't done there there are more still there there are still more stuff to do for example on engineering side uh as we can see the most like there are roughly 40% of time we are doing the pointwise multiplication and sum so maybe the auto vectorization is not so good yet so we can try to man manually make everything seem or we can even try to code the H evaluator into GPU and application wise uh maybe we can try to make custom Lookout table generate by the compiler if they are many repeated uh gate so we can merge multipurpose trapping into a single one and on scheme side uh recently there are many cool paper that can try to uh boost dropping multiple cyber Texs at a single boost dropping so we can get faster am mtip trapping so yeah there are still many stuff to do to improve The Phantom Zone performance so if you are currently looking for project to ha count and the the the problem is interested uh is interesting to you maybe you Phantom Zone is a good place to go so here is the links to The Phantom Zone repository and some paper that uh we are using and that's it thank you thank you H uh you've got three minutes do you want to take any questions or do you want to yeah yeah yeah do we have any questions don't be shy not a okay we've got a question back uh here all right this guy's faster than me he's practiced thank you Han it was really cool what is the final more or less speed difference that you got uh of versus complex fft in your experiments I'm sorry could you repeat that yeah no worries uh after running the benchmarks between NTI and complex fft which is the Improvement that you got approximately and do you think you can do better than that or like this like ends there yes so on on computer like not on CPU I think uh fft already give a huge Improvement on entity and I guess that's already very good because I believe people already optimize fft for a long while so I think it's it's I mean my imagination is it's roughly there so I guess the next step will be GPU or like other mathematically Improvement yeah that's how I feel thank you all right thank you H another round of applause thank you thank you all right before I uh introduce our next speaker just a little bit of hostek keeping so this is our last uh speaker for this block and as I mentioned before we're going to have a little break in between where you can hit the washroom grab a coffee and then afterwards we're going to have a whole second half of programming the theme for that one is building consumer apps with programmable cryptography and uh Richard louu who's one of the members of the zup pass team has curated a whole afternoon of kind of like more uh Hands-On and explanations around building consumer apps with programmable crypto Cree cryptography obviously through the zup pass lens so that's going to happen here uh after Riley's talk we're going to take a break and then we're going to come back for that and uh I'm going to keep talking for a little bit because we're still figuring out the machine swap keep talking yeah keep going okay um oh man I should have prepared some jokes or something like that this is a great little LED thing you've got going on your frog Beret right right now um another fun little fact now that I'm seeing the Frog bra and I know we ran out of frog hats which a lot of people were after fun fact in the second section we're going to be using mircat for the Q&A and also the folks at mircat have been given some swag and we're going to be giving that swag out to the people who are number one on the mircat leader board so you know get asking questions in the second session if you didn't get a hat and you want a hat and I think at this point we're good um all right uh we're going to bring up Riley she's going to talk to us about mpf as a privacy preserving framework so let's uh give a round of applause for Riley and welcome her to the stage and thank you to all of you guys for sticking around for the whole session so let's uh let's put our hands together for [Applause] Riley uh hi everyone my name is Riley Wong my pronouns are they them um I'm going to give a heads up this is going to be really fast and there is a section about reporting abuse if you need to like emotionally prepare for that um so for an introduction about me my background I'm an independent researcher I'm the principal of emergent research which is a research lab and consultancy for privacy and governance and I'm also currently a research fellow ZX Park so I investigate applications of emerging privacy and cryptography tools with an emphasis on co-designing for vulnerable communities as well as building infrastructure for Collective agency and consent so I think a lot about about how emerging cryptographic tools such as ZK MPC and fhe can be built in tandem with cultural and Community work especially around topics of consent digital intimacy and Community safety so I think we can kind of speed through this a little bit um yeah MPC uh good for multiple parties um contributing private data towards a joint computation it's relevant for collectives involving multiple people and it also creates opportunities for Collective consent mechanisms that are mathematically guaranteed um FHA makes it possible to run computations on encrypted data so the data stays encrypted throughout the entire process including while in transit and M FH is the best of both worlds and that you can compute on encrypted data for multiple parties um yeah so as demonstrated um we do have working demos and libraries for this it is still in development and not quite production ready that being said I think now is a great time to steer the direction of how these tools are being developed by prioritizing real world applications that benefit existing communities most in need of privacy protections so uh we can cover some potential applications of this for vulnerable communities um so mpf is really great for coordination problems where if you're one person there's a penalty to taking some kind of staner action at the same time when you have multip multiple people with the same staner action you now have Collective power written numbers so uh one example would be for labor organizing so if you want to unionize your workplace if you're the only person publicly taking a stance about being pro Union you probably will get fired even though it is illegal um using something like MP fhe we can make it possible to privately commit to being pro Union so you can say I'm Pro Union and I only want this information revealed if at least 20 other people in my workplace or at least 50% of my workplace also makes this commitment and that information is only revealed if that threshold is reached and otherwise stays private and privacy is important here because if your employer finds out that they're unionizing efforts they might fire you hire a union busting firm they can you know put you on leave Etc but if you have enough people and only uh unionize when that threshold is reached you have now built Collective power at your workplace you can collectively Bon for better working conditions better wages Etc um MP fhd is also really great for coordinating win-win outcomes for any kind of prisoners dilemma style situation um which is like a sit situation where Collective cooperation is the best case scenario and we want that um but only on the condition that the other party cooperates and so you can reduce the risk um of penalty by saying I'm willing if you're willing and having that be uh privacy preserving and one advantage that mpf has over something like trusted executive environments for example is that you can build uh governance mechanisms based on Collective consent so because the information can only be decrypted with enough decryption shares um whether you grant or revoke consent you your consent becomes backed by this cryptographic guarantee um other applications for mpf um coining protest is a good example also if not enough people show up that can come with a lot of risks of you know arrest doxing police brutality physical harm so you want to keep your identity private um uh and only have that be revealed When You Reach some kind of threshold um so for example at least six of the community organizers in Ferguson mysteriously died um similarly with whistleblowing two of the bo whistleblowers mysteriously di um also useful for this idea of data striking so um it's a way of coordinating um uh in response to Major platforms or authoritarian institutions so you can coordinate mass deletions of like deleting your account deleting your data Mass unfollowing certain figures Mass up algorithm at the same time um another really useful application would be an mpf statistics Library um where you want to collect uh information about your community um at the same time if that database of uh community members is leaked you've basically created a list of people to Target um at the same time you want to be able to make informed decisions about your community like how old are we where do we live uh what are our finances like what's the race ethnicity gender disability status these are all things that benefit community building and organizing um in a way that involves uh very sensitive information around identity um and I really want to emphasize that these communities listed here um are very much directly impacted by not having privacy Protections in a very real material and physical way um particularly at this point in history um privacy protections have always been important for these communities and I also think that these needs are about to be heavily exacerbated on a pretty WID scale very soon so if there's one takeway from this talk I really hope it's uh this um from my personal experience being in privacy and cryptography there's a huge gap between people building the Privacy tools and the people who need them the most so I really urge you to work directly alongside communities that are most directly impacted by not having privacy protections um and one way to do this is through participatory codesign and so instead of Designing for communities you're uh designing by and with communities so it's about communicating and interfacing with community members directly listening deeply and building a holistic understanding of the full context of how and why these privacy needs exist what the specifics are in terms of challenges risks and priorities so given that background um we can take a look at a specific use case so reporting abuse is a situation where as an individual there's a real risk of danger and consequence at the same time when multiple people submit a report you can build Collective power written numbers so this problem is relevant to many communities uh truthfully and unfortunately including this one and the current state of affairs is that people who experience abuse by a vast majority do not report um for reasons including risk of retaliation escalation of harm risk to physical and emotional safety there is some prior work to this called project Kalisto that also uses cryptographic techniques such as Shamir um and this paper came out in 2018 so a lot of these tools and technologies have not been made yet and we've made a lot of progress in the past six years so a sample system design for something like this uh May involve identity ver identity verification uh using ZK email which is a privacy preserving way uh to verify identity um submitters uh can privately submit a uni identifier naming the perpetrator through some kind of community directory um and having a unique identifier um is really helpful for simplifying the matching process on the like mpf side becomes a simple integer equivalence check um and when there are matches uh submitters can choose a steps in terms of wanting to share contact information um setting thresholds for how many matches they want before they uh share information and being able to make a collective decision about what to do next um so here are some additional Technical Resources uh I think ZK email Phantom Zone haunted psse uh all these people are here this week um thank you yeah I'm really interested in building out this kind of infrastructure so please come talk to me I'll be in that back corner after this talk um thank thanks