#246 Guy Zyskind: Enigma – Providing Scalable Privacy-Preservation to Smart Contacts

Transcript

[Music] hi welcome to epicenter church talks about the technologies projects starving desensitization and the global blockchain revolution my name is specia Joe and my name is Sonny and today we have on with us DICE's him who is a CEO of the enigma project and we'll be learning about that today guy could you please introduce yourself sure so yes my name is a guy I am co-founder CEO of enigma enigma' started

as a project back in 2015 when I was a graduate student at MIT started as a research around privacy-preserving computation its relation to the blockchain and particularly how can we use these kind of privacy-preserving technologies to add privacy to block chains as a whole cool so how did you like you know originally get interested in MPC I could like you know you wrote this paper back in 2015 while you were at MIT what originally intrigued you with that problem so actually first of all I got really interested in blockchain technology I first of all I got

interested in Bitcoin I was fascinated by the idea that you know you could basically decentralized ledger even though you have untrusted peers I thought this was fascinating there must be a lot more that you can do with it and then a group of guys we we basically started the project around trying to use blockchain for like other kind of applications especially identity data privacy but very quickly realized that there's very strong limitations for blockchain there's a lot of limitations because boxing is inherently fully public and there's so much you can do and that's even without discussing the scalability issues I was really fascinated about how can we make people

users better tools for them to control their own data in their own privacy and I was also interested in how can companies you know reduce liabilities that they have with storing sensitive data and that really got me interested into this field of secure multi-party computation and how it relates to the blockchain I see and so what inspired you to like take this like research this was more like an academic work your master's thesis was on like the efficient secure computation what inspired you take this academic research and then turn it into a company and like a public blockchain project or was it always sort of the intention from the get-go so the intention from the

get-go was to do something that I'm passionate about and that actually can you know really change our day to day lives for the better I know this is a cliche but the goal was really to do something big luckily MIT is really a great place to do those kind of things and when I you know wrote the first paper and then circulated the Enigma white paper and I was also heavily involved in the MIT DCI and MIT Bitcoin kind of ecosystem like I guess all of these things kind of fed each other and it very quickly became apparent that the best way to do this you know beyond the initial research was to actually move outside of academia and

actually try to do it whatever it's a company it's a foundational organization it doesn't matter the goal the goal was and is to create something that a lot of people can use and that would influence a lot of people's lives okay well let's hop right into it then I mean starting with one of the core aspects of enigma which is privacy preservation and so you know if we look back at the history of blockchain specifically starting with Bitcoin so transparency there's always been the sort of delicate balance between transparency and privacy you know Bitcoin blockchain is of course open public and so inherently the information is available for everyone but there's

this sort of pseudo anonymity where really aware technically in theory isn't aware of who's behind the transactions so as time has evolved the peoples of agreed with that others saw it as potentially a vulnerability and we've seen companies grow into this space that are now analyzing the Bitcoin blockchain and other block chains to extract certain types of information from it and of course you know we have Z cash and we have these privacy-preserving block chains so in this context can you me perhaps describe what are the different types of privacy problems that one can run into if but while using public block

chains to run smart contracts execute transactions financial transactions and this type of thing I think there are two types of privacy that people care about today and that's very much like how block chains have evolved in the last years so there are like transactional block chains right Bitcoin all of the so many Forks that exist anything that relates to transfer of money and transfer value and for this we have a lot of privacy solutions like Manero like Zee cash like so many others that are just popping every day but there is a another dimension to what blockchain in consensus technology

permissionless considers technology can bring us and that's what we've seen with smart contracts in with etherium but I believe the problem with smart contracts is actually much much bigger and much harder to solve because you know when you're talking about Bitcoin all you need to hide which is again as we're seen really not easy is you know the amounts and the sender and recipient when you're talking about smart contracts there's a whole state there's arbitrary state arbitrary data arbitrary computations and all the nodes in the network see all of that so to me focusing on solving that privacy issue is kind of like the other big thing that

we we should divert our efforts to what are some existing technologies that exist in order to do privacy preserving state or is there a sort of a body of research that exists before the introduction of the introduction of Bitcoin and aetherium o'clock chains or is this field of computer science you know new and very much tied to like this industry so I'd say this body of research started around the same time that the body of research around consent to started maybe even a bit earlier so both of these are like 30 40 years old body of researches

there's a lot of literature this whole sub field is called secure computation just like we have consensus disability consensus and Byzantine fault tolerance in distributed systems both of these have been here for a long while I think what a change in the last decade is that there's a lot of efficiency gains that have been made to both many are related to blockchain at least in the in the consensus aspect in a secure computation I'm not sure it's as much related to blockchain as he just is that more researchers are interested in it and the effects of big data is kind of made this a requirement of how to protect data

privacy while computing interesting so at the core and perhaps correct me if I'm wrong here but there's three different types of approaches to preserving privacy in a blockchain so one is doing secure multi-party computation and I'll let you explain what that means specifically but I think just in that term you know one can imagine what that entails then zero knowledge proof which most of our listeners will be familiar with at least at some level and the third is trust execution environments which was also talked about on the show and so people may be familiar with technologies like Intel SGX and its ability to perform computation in you know in a secure environment this

is the sort of exhaustive types of approaches to enabling privacy on a blockchain are there other methods and could you perhaps describe more in detail how each of them preserves privacy what are the advantages and disadvantages of each solution of course so these solutions they're not you know unique to blockchains but they are very efficient for blockchains there's a few others like fully homomorphic encryption which is amazingly theoretical but we don't really know how to do it well enough in practice and there are other solutions that are more targeted and pinpointed so it's probably not worth discussing but of the three that you mentioned there is as you said the secure multi-party

computation secure multi-party computation is basically the idea that you know you can't trust one computer or like one entity with your data but if you can have a network of computer maybe five maybe ten maybe hundred as long as you can know that you know some fraction of them would not collude with the others then your data will basically remain encrypted at all times and they can still run computations over it as a network so that's in MPC I'm happy to go into more detail with that first of the execution environments are a similar idea that say there is you know an include there is a trusted region in the

in the processor or you can kind of push all data and all codeine every computation that happens inside that region cannot be accessed from the outside so that is how you can basically achieve privacy-preserving computation using that and the third one is zero knowledge proof so zero knowledge proof many don't know this but it's actually being developed very closely together several decades ago with multi-party computations zero knowledge curves are the idea that if I have some data and I want to run some computation over that data then I can prove to you without revealing the data but the result of that computation was indeed correctly computed and I

don't have to reveal anything else I'd say that you know in this context secure multi-party computation transit execution environments are similar they have very different threat models and deployment models but they both enable computers and people to run computations over data that they cannot see if I'm a computer in the trusted execution environment where it's part of an MPC Network I am not seeing the data that I am actually computing over where it comes to zero knowledge proves by definition I have to have the access if I'm the prover that is proving some computation I need to have access to the data but I don't have to reveal that

data to anyone else so this to make sure I get this right the difference here is like enger' knowledge proof it's I want to prove I want to do the computation and keep the data private so I can have a private input run the company to myself and give you the private output and I never have to give you the input but if I'm trying to outsource the computation then you know zero knowledge proof don't really help in this situation because whoever's running the computation needs to know about the inputs and that's where the secure multi-party computation comes in is that it's not about right that is very much right and that is also true if you want to combine different data from different

users right like if you're doing if you're trying to do it like if you're trying to do you know a secure auction for example then all the users will need to send someone their beads that that entity that person can then prove that they computed the winner correctly and only reveal that but that person with the zero knowledge proof but that person would still need to see all the beats so this is kind of like you know one of the drawbacks of using some when you use something like Z cache is it's very computationally expensive for the users of Z cache because if they want any privacy they sort of have to do these currently very expensive smart computations themselves and is really no way to outsource that computation

without basically leaking their privacy and so is this something that like the realm of werlla the secure multi-party computation it will like be able to solve that problem right so obviously secure multi-party computation does has its overhead as well but in many computations and in many cases being you know doing a multi-party computation is faster than being approver in a big enough circuit so and you can definitely outsource it to some other parties and the users don't have to participate in the computation there are benefits for users to still participate in the computation but they don't they don't they don't have to so yes ok so now it looks like you know

delve in a little bit into the enigma project and so we have these like different ways of doing things of privacy-preserving technologies and you know your goal was to create a privacy preserving public blocks a network and so how are you kind of deciding which of these avenues to focus on and go down that's it that's actually a very good question because there's a lot to do right and we and I still believe very much that despite the kind of adversarial aspect a lot of people take in the space and Finkley you know it's like there can only be one I very much believe that like we're still

building all did building blocks and we are here to collaborate and kind of feed off each other so it's great to kind of work together and see like how we can help other projects so with that said the way that we started is basically by focusing on what we call the compute layer so the way we conceptualize you know the full enigma protocol is that there are two big pieces of it one piece is the verifier and that's the blockchain the blockchain should only really get proofs of computations right and results and basically store them over time and deal with payments but it should not do heavy lifting computations that is also similar to other philosophies from other projects like

troubied but to be honest this has already appeared in the twenty fifteen enigma white paper so we we share that belief even before it became so well known the other layer is the computer that's basically where nodes can run privacy-preserving computations at higher scale because not every node in the network has to run all computations and they can do that either using trusted execution environments which is what we have right now the first release or they can do that is secure multi-party computation protocol which is what we're going to release later on probably next year maybe we should start with then the current

implementation that you have now and then go talk into the secure multi-party one later so you know you guys released your first version like version 1.0 recently and have a public test net using the trusted execution environment system could you tell us a little bit about what you have in this like version one and what it really does it's actually pretty cool because version one the way we built it is that it's very easy for developers for example in etherium to to get going the way that it's done today and that's what I mean about like we know we're choosing our ballasts and which isn't what to focus

on so the way that it works right now is that you write just a regular smart contract in solidity and you deploy that to aetherium we have some api that you know under the hood registered start is an enigma secret contract that's what we call smart contracts that you know can deal with private private data and the way that it works is that you can designate specific computations specific functions is function that you want to run in a privacy-preserving way the way you do that is that users can basically encrypt all of their inputs and there's some elliptic curve diffie-hellman happening between a user and one of the Enigma nodes that you know and one of

the in claves in the enigma nodes to basically generate an encryption key that the user can use the user then encrypts inputs to a later computation and that is a transaction to aetherium to that smart contract state then users can actually call a function execution of the smart contract to happen in enigma what then happens is that the bytecode is being loaded into an one of the Enigma nodes we call these a worker node these worker nodes pushes that bytecode incident clave and pushes the encrypted arguments from definian blockchain inside in clave and then the in clave

and only the in clave can decrypt that information because only then clave has the right information to derive the the key the crimson information runs the computation in an EVM inside of the in trace and then pushes out the output and commits that bacterium so you can really do interesting things like you can have a smart contract in etherium today but if you have like you know very sensitive functionalities like voting you know you don't you don't want devotes to be public or like auctions or like random number generation or many many other ideas you can basically upload them to enigma and then push the result back to

your smart contracting material so that's what we have today so I just wanna look at this from an application developers perspective so let's say for example that I'm building some sort of a voting app which is a great example - you want your votes to remain private I build my DAP just as I would you know if I was building it in a non privacy-preserving way then where I got lost is how does the enigma blockchain our network retrieve data from the smart contract is the Enigma network parsing the earth Emer blockchain or is the smart contract sending data to enigma so all the enigma workers they're basically they have a connection to the ethereum

blockchain right the way that this works is imagine you have a voting application smart contract you have to write a smart contract in a way that you know it can store a blob like just an array of encrypted votes what then happens is that ever you users that want to cast their vote can basically send a transaction like you know add vote or like store vote and that vote itself is encrypted with a key that only then clav in the Nigam okay no if there's a some more details but I'm you know I'm removing them for simplicity all those votes encrypted votes are just stored in the smart contract state in Ephesian if hiriam

doesn't understand these encrypted votes this is just like random random junk to atheneum but basically the user can then submit a request to the same blockchain to run a computation that should run on enigma that actually spins out and it spits out an event write the note all all enigma worker nodes are basically listening to those events coming in it picks up the computation it takes the computation for material only phenol nothing really happens it only happens on nygma and nygma takes that computation runs the logic of that function what I didn't mention is that the user needs to point to the encrypted

arguments that are already stored in the contract the enigma the enigma node knows how to parse it so what it does is it sends the encrypted arguments from the etherium smart contract inside in trave it sends it pushes the byte code from aetherium for that function let's say the function is you know tally votes pushes that into the end clave then clave then decrypts or the votes emitted from all users and just you know sums them up she's like who's been voted and then pushes the decrypted result back to you female so on the etherium side it's kind of like you know you explain that they're writing all their stuff in solidity and they just they're smart

cartridges has to know how to accept this encrypted data and like sort of ask the date out and bring it back in what are they writing on the SGX side so like what I know that she X the bindings currently are mostly in C++ or the developer is having to write like C++ code that runs in the SPX or what if yeah what are they writing there so that's really the cool part they don't need to do any of that they just write solidity code they have like a library it kind of feels it's kind of like based on web three like an extension that allows you to like handle off from the user side from the dev side like all the encryption and that kind of stuff and extending transactions that

has encrypted data and all that but other than that the developer doesn't need to understand anything about HDX anything about xe+ class code or anything like that so the near name meant network just understands this the facility smart contract sort of interprets the code there in a way that it will know how to interpret this data given the function that is meant to execute on the data exactly yes so essentially what you're doing is you're running an EVM inside of the the Enclave and so anyone can submit any traditional smart contract there one question I have

that is you know we talk about like the data of being able to be encrypted like for example you know the votes are encrypted and we send it and they get decrypted in the Enclave is it possible to decrypt the to encrypt the contract itself like could I encrypt EVM bytecode and have that be only decrypt able in the S yet so you know maybe there's a case where two companies want to have like a private contract together or something is that something that's possible so it's actually there's been an interesting discussion you know falling about that it's a very small technical change we don't support it right now but it's like something that can be done very very quickly I'm not sure we we would want the first use

cases to be that because if you do that but yes it's technically possible it's very easy to recruit the bytecode and decrypt it inside in trade but at the same time there's a lot of trust in the person that is basically producing that code which you cannot validate the code you cannot like test it for like bug security bugs and stuff like that so what it is possible it might not be the first applications we want to encourage maybe we can talk a little bit about the security model of the SG axes you know that often one of the most concerning things for a lot of people and quite honestly for me it's often a little bit concerning as well so you know oftentimes people kind of laugh about SG acts where it's like oh why do you need

decentralization when you can just you know trust Intel what do you think about like you know how does this SGX trust hardware security model how does what do you think it's a relationship with like the decentralization is and I actually I think this is a very valid point and we are we are having a lot of conversation about that on where it makes sense where it doesn't and it is also still a work in progress the way that I view this is that like the entire technology stack SGX is another very strong part of the toolkit of the tool chain which we should not discount I think there's a lot more work to be done there and a lot more research so when I started researching privacy-preserving

technologies three years ago there was very little in the way of STX actually one of my advisers is actually the the first professor the first person to write an extensive paper about SGX about how it works and it was around I think 2014-2015 but since then we've seen a lot more research in that space and I and I think that's where it is it's a very much ongoing research on how to hard energetics on how to improve SGX not just across to the execution environments is a whole and over time we need to figure out what makes sense and what doesn't maybe as Jiggs is okay for integrity but not for but not for full

privacy maybe some aspects are okay but not all of it so that's very much an open research question to still look at I think most concerns that we've been getting around is GX is around the ability of like site analytics and data leakage I think there's less concern right now about integrity issues as far as I've been able to gather so I think that's again something to figure out is SGX okay for correctness like proving stuff but less okay for privacy another aspect to keep in mind is availability right sjx does not give you a veil ability in any way if I know it goes offline you still need the blockchain to penalize them so that's

something that should be in any case in SGX security model there's like for me at least what I see it as is I would prefer to use an SG x4 when I'm running my own computation so you know yes I know there's like all the Intel of stuff with expector meltdown you know I don't know if we can trust the hardware or 100% but let's assume for a moment I'd say I'm running an Intel CPU so therefore you know sure I'll just check I'll trust my this if they are saying that this is some more secure then you know I might as well trust that as well but that's like you know let's say I'm running some very some program that I need to be extremely secure on my own machine the problem with what the SGX is trying to propose to the world is it

says oh not only do you have to trust your SGX in your personal machine you have to trust the SGX in someone else's machine and the problem to me really comes down to the fact is how do you know what's an SGX or not and currently the way intel does it is they have this like singular server basically that's like a remote at the station service which is like intel gets to say what is a valid SGX and the problem is if that one service gets hacked right anyone can create a add a fake public key to that list of valid SD axes and pretend to have an SG X when in reality they don't

and do you think this is like a legitimate threat to the entire security of this like of the SGX side of enigma where like it is essentially a singular central point of failure I'm actually much less concerned about that because I know for a fact that Intel has in their roadmap they actually want to move away from that so I think this is very much a temporary thing I also think trusted execution environments are not limited to HDX although it is the most widely spread solution right now so again I very much think that this is a work in progress to improve these kind of things also there are ways to mitigate right now there's an interesting disease about how to

reduce the trust in in the Intel attestation service I I can't remember the name right now but there is a thesis about it and it proposes different models we've actually employed one similar model where it's basically you you got a very you do have to still go through Intel for like you know the first attestation of an in clave but then after you do that you generate the key in southern clave and that key is used to sign like messages and like you know operations which is you know some improvement there's still a lot more to do but I think we're on the right direction I think it's gonna evolve to a place where that's not that much of a big issue so coming back to the enigma Network can you just sort of describe a

network topology here if the way I understand this Jax is that you don't necessarily need like enormous amount of nodes you just need sort of one trusted execution environment that can do the computations how many nodes exist in the network how do they interact together are there multi-party computations over SGX is the sort of thing also possible it is but let me that's that's like jumping a lot ahead so the the way that it works is there's the blockchain and you can think of the blockchain is you know having its own network and its own nodes these nodes can be the same as an enigma worker nodes but you know for simplicity let's separate them so in a mega mode there is a peer-to-peer

network of what we call worker nodes these nodes right now register on chain right on the freemium blockchain in the future is going to be in our own chain and basically register and prove that they have T capable a trusted execution environment enable and you know they put stakes so that they can be penalized if they misbehave and then they can join the network for computation and the way that it works is that basically for every computation right now we simple one worker several workers to do to execute that computation that's kind of the way in a nutshell there's other optimizations working on but any not you

that's kind of the way that it's being done right now a lot of these like concerns around the security model that I was discussing around the SGX that's sort of why it is the first version but really your long-term goal is to delve into the old secure multi-party confrontations right so maybe it's a good time to jump into that could you explain to us because but I don't think many of our viewers or listeners are very familiar what is secure multi-party computation sure so before I touch it I do want to mention that I think what we taneema care about the most is to solve the

problem of privacy preserving computations at scale right and there are different techniques to do it and we're taking a pragmatic approach so yes trusted execution environments are one direction to do that which works right now and allows people to develop right now anything is going to be a constant research and constant track to improve to improve that at the same time there are other technologies right now my personal favorite and what I think is the most promising and also because I research that for several years in secure multi-party computation so secure multi-party computation actually says this and it's a good way to move from Transat execution environment to that it says the following it says

in an ideal world we would have like one supercomputer that we can fully trust that supercomputer we'll all we can outsource computations to write and that supercomputer will never leak the data to anyone it can never be hacked and it will always compute the correct result and we can trust it to do that that is an ideal world and trusted execution environments try to emulate that in the best way possible we'd secure hard work but in practice we may not want to trust these because you know there are weaknesses there always and it's a constant improvement but can we come up with a better scheme that is based on just cryptographic assumptions

multi-party computation says the following let's say you don't have one computer but instead you have several untrusted computers it's very similar to the consensus in blockchain world you don't know you can't trust one computer but you have several untrusted computers you know let's move you simply if you can say that only that at most half of those computers would be bad would be like you know malicious would be adversarial then you're fine you can you can consider that network even though you cannot trust them individually as the whole that network would be able to achieve those two properties it could run any computation with full privacy which means the data would never leak

not even to the nodes running the computation and never to the outside and that all computations would complete successfully so if you get a result you know it's the right result that's basically the theory of MPC could you maybe like touch into a little bit about like the technical of how it works like you know for my understanding there's usually some sort of like you know secret sharing that you do and you split the data over multiple sharp like shards the data and you perform computations that are perfectly like you probably the best person to describe it you give us a Brit the viewers a brief summary sure so there are two main techniques to do MPC

one of them is uh yeah galbart circuits it's a bit different now going to touch it the other is using secret sharing secret sharing is basically this idea that let's say you have a piece of data you can split it into n pieces such that any T and u so basically any subset of some size and that's a parameter that you can define and if any such subset can basically be used to reconstruct the data but if you have less than that subset then no one can reconstruct the data it's completely random it's completely useless so that's the main building block of MPC and now let's think of an example like that so

let's use the example of a salary okay that's usually the example that's given so let's say you have Alice and Bob Ally says her salary Bob has his salary they want to compute the they want to compute the average but they don't want anyone to know they don't want each other to know how much it should each of them is making and they don't want anyone else to know that either so what do they do they do an MPC protocol and let's say there is now a network of 10 nodes ok they can actually do it between themselves but let's take the example that there's a network of 10 nodes that they all chose these two what Alice does Alice basically secret shares her salary between all of those 10 nodes that means that every one of those 10

nodes gets one share of the data but again that share cannot be is completely users on its own and let's say that the way if this has been designed is that unless you have all the shares you cannot see the data then Bob does the same thing secret Jersey salary to all the nodes and now each node basically has a share of Alice's age and a share of Bob's age no node can actually see these salaries but it turns out that they can go through a multi-party computation protocol to compute the average salary because this is very simple use case really all all that they need to do is that each node needs to take both salaries add them together

their own share of the salaries add them together / - and basically run the same computation as if they had the old data and then what they get is each node gets the share of the result now if you want to see the Crypt or reconstruct the result what they have to do they have to send both let's say Alice and Bob all of the 10 shares of the dart competition that they did and now Alice and Bob having all of the shares can decrypt that information can reconstruct the result and see what the average salary is and what do you get no one learned each other's salary the network itself is even more interesting

the network that you outsourced did not learn anything it ran a computation but it's not very anything about it the only way to do it is if all of them would be malicious and collude and that is why you need to put some constraint on the network in this case the constraint was that at least one node is honest in the average scenario you talk about you know you add the two together then you divide by two and that's the result the classic example that's always used in the you know NPC world is the whole classical millionaires problem right very similarly design problem except that it's like Alice and Bob or just trying to figure out who has more money right the question I have is so you know what

I would do is okay secret share both of them subtract one from the other and so if it's positive one has more the other has more but how do I return this result to Alice involved without telling them the difference I just want to tell them whether it's positive or negative so is this something where now like oh now I have to come is there some other thing I have to use it may be a snark or something to prove maybe like the NPC computers they don't want to give that and result they want to show just that I have a snark to show you that the end result was negative or how does this work exactly so it's you don't really need snow or anything for that let's take the simple so the place where you need like zero knowledge proof is if and

there are different ways to do it is if you want the nodes to make sure that they run the computation correctly right because if I'm no official of the data I need to how do I know that one of the nodes didn't like switch its own share of the data with some random garbage you like with all zeros right that's where like proofs come into play but let's take the simple case we call it a semi honest case where we assume the nodes we don't want them to learn more they more information then they have which is their own share but they won't go and do like those kind of Byzantine behavior type of things so in that case the computation is just more complicated so there is a very known

theorem and it's very well known by now that any computation any any function any computation that you have you can basically translate that into a circuit of additions and multiplications and you can basically compute any functionality so in this case and you can compute that without revealing any data that you don't want to so in this case what you will do yes you would subtract one from the other the protocol is higher it goes like that you some salt one from the other then we need to make sure is the result greater than zero or not that's like the next type that the notes do together which is more complicated and then they get like one bit as a result it is a 1 or 0 to a false so they don't

have to leave more information that result is also encrypted in the sense that each node has a share of that beat it never leaked nothing more than that victor to any of the nodes that's very important it gets a bit more complicated because the way that we work for security reasons is in what's known as finite fields so we don't really work under the integers so the whole thing of like you know negative non negative it doesn't there's no order in finite field on the field so there's another check that you need to see if like the like the result wrapped around the field or not which again gets a bit more complicated but the point is you can do it and the nodes can do it and they can get to the point where the end result is

just one secret shared beat was was a was you know was Alice's is Alice richer than Bob and then they can return that so no snarks know anything just pure old npc actually does this a process of running an MPC computation right is it sort of you know I take the data they get split everyone runs this like thing in parallel and then there's one last final merge step or is there like a lot of communication needed between the computing nodes so there's a lot of communication in the dots that's where basically MPC becomes less efficient of course that is the main

trade-off of using MPC compared to something like transit execution environment sure where we've been making a lot of improvements like the academic literature in the last decade has made a lot of improvements on my thesis may have made also some improvements and that's a a continued process and it enigma we're focusing a lot on how to improve it further but that is the main cost so in MPC the whether it works is that linear operations which are basically addition multiplying by scalar that is like public that kind of stuff can be done locally can be done without communication and it's very cheap it's basically free we call it free but whenever you want to do a multiplication

by the way other protocol works they all nodes in the MPC protocol have to communicate with each other and kind of sync sync with each other to be able to reach reach the read end result and every time you have a multiplication you got to do that so that is basically where MPC becomes you know less efficient and there are a lot of ways to improve that but it is an effect of the protocol so you know you you secret share this thing you everyone has like a share of a polynomial with a certain degree it's the issue is when you multiply to share multiply two polynomials of the same degree now you have a higher degree and now you have to like somehow figure out to communicate to each other like okay how do we reduce

the degree of this polynomial again is that essentially what the reason for this communication is yes that is that is very very much correct there's actually a more efficient approach that that's becoming heavily used called speeds which we also employ that approach basically the use another mechanism instead of the degree reduction so what it basically does is it you pre process a lot of what's known as multiplication triplets so you create random values of you know C equals B times a these a and B's are completely random and the C result in this random

as well and you can batch these like offline very efficiently because it doesn't have to because it's not related to any commit data in the computation and then anytime you do a multiplication you consume one such what we call a triplet random triplet and then you don't have to do a degree reduction you can actually have a much more efficient protocol and that's what we use but yes what you're saying is correct that is the original reason why I need to do that so to get like a intuitive understanding what is the communication complexity like are we talking about like N squared with a very high constant are we talking about like n cubed but how does the you know as I want more nodes participating in the multi-party

computation how does my overhead increase so usually we like to talk about how many the in like one round how many values is a you know is a factor of the nodes in the network how many values are being communicated and worked on so in the original protocol which is called bgw which is a degree reduction one what you need to do is that every nodes basically needs to take its share and use that we share that right and then send one every other node in the network one unique value so you get N squared because like each node needs to send n unique values

so that's n times n expert in the Triplett's protocol what's interesting is that you only need to have n values the reason is that ever no justice to broadcast another one value for all the nodes all the pews in the protocol so you only get em unique values so that's an amazing improvement obviously there's you know there's a question here is broadcast free or not right if you assume the broadcast it's free then it's just one value and it's completely linear so it depends really depends how you count it but all of these are dependent on the right of the size so in my teases and in the original ending a whitepaper and and we've seen more and more protocols actually take

this approach today but back in 2015 this was super unique and it is still unique in the context of MPC we said let the net will grow what we need we need a first sampler right that can basically sample a group of MPC nodes for each computation and then that group is constant size the constant there is still high because for security that that group might be you know you might want a great big enough group but at least the scalability does not depend on how many nodes are in the network all of this that we've been talking about now is in the security bottle that you you mentioned briefly the semi honest model where I'm kind of assuming that at least

some percentage of the nodes whatever my K percentages I guess would improve erm I'm getting the data from our non Byzantine they are a chronic the computation correctly what are the questions that I have especially you know it kind of put Italy due to my work at cosmos and something that we're very particularly interested in is is there a way to do MVC computation with attribute ability so I can say that like oh if there's a Byzantine knows that trying to give me part of my computation can we've realized that they're like griefing by like you know changing everything to zero or and is there can we actually

figure out which of the nodes was the one who tried to grief everyone else yes you definitely you definitely can and actually it's possible to have all nodes attributable there are different techniques to do it and I believe that in the system that we're building we really need that so like 1/3 or 1/2 of my pcs actually focus on you know kind of firmly proving that if you really want to create a system with like properly evenness and that you know continues to to make progress you gotta be able to identify and each and every node that you know misbehaves because you want to be able to penalize them

because if that's not the case you get freeloaders and that's definitely not not something that we can live with so there are stories yes and there are but there are caveats right and this is where we're putting a lot of attention the covers are usually around efficiency so there are two main systems right that I can propose at least for the sake of this of this conversation there's what is known as detectable NPC detectable NPC basically says that even if one node misbehaves you can detect that right you won't know which node but you can detect that for this is great because at least you know we will never get the wrong

results which is very important so no one can really move in a Byzantine way but it's hard to create incentives around it because it's not an attributable foe fault it's not what it's not the next level of what's called identifiable NPC which is like attributable NPC it's the ability to uniquely say who cheated and anyway so it turns out that we can do detectable MPC very efficiently the nodes basically share some some Mac key and they kind of as they as they go through the computation they also on the side compute over a computation that is multiplied by that mckee and at the end of the computation you basically try to

save the result that you got in the real computation multiplied by that shared key evaluates to the the the Mac and I mean there's really nowhere - the probability of that happening randomly is like you know in potentially small so that is a great way to detect but you won't know who cheated the other way is where other mechanisms like zero knowledge proof and this is why I always say is your knowledge proofs is complimentary it's not like you know it does a different thing zero knowledge proof and especially is a kind your knowledge proofs could be very efficient in the sense that let's say we're in a multi-party computation protocol we

detected that there's been a fault but we don't know how to attribute that one fault okay now we can actually as the knows okay produce a proof that you're in the computation correctly and in zero knowledge and probably in a second way proof their blockchain that you did it correctly if you didn't the blockchain can then go verify these efficiently and penalize you the problem why you probably don't want to do it every time is because you knowledge process are super expensive so I am I'm a big believer in taking what's known as an optimistic execution route so do something fast just make sure that you can detect if something bad really bad happen and if that has happened you can file a dispute and you know maybe you

can do something like troubied maybe you can do something like as your knowledge proof that's where I believe these can come in but you can 100% do these that's great that's good news to hear so there's also you know one last question on the MPC side of things there's this concept called fully homomorphic encryption and i've always like you know i don't really know too much about it I've always just heard jokes about how it's like a unicorn of computer science can you just quickly explain very briefly on what this fully homomorphic encryption is is it at all related to MP secure multi-party computation is it a subset or is it just something completely different so fully or more freaking ssin is another

technique to basically compute over encrypted data it is actually a the cryptographic equivalent or trusted execution environments you don't so in MPC you do that by not trusting one node by by taking a lot of untrusted nodes and as a whole you can trust them by you know secret chairman and all that with fully homomorphic encryption it's basically a type of encryption that you can still run computations over data while it's encrypted so this would be perfect right like hey I'm a user I can encrypt my data I can outsource it to one computer we don't even need to say what we need is centralization for availability but we don't need the centralization for

anything for the data privacy just send it to one computer that one computer would compute over the encrypted data would really not know what it is computing about so you can see how this is very similar to cross at execution environments but the guarantee is fully cryptographic it's not by a secure hardware this is what fully homo freak encryption is it allows you to fully compute in one node over encrypted data and then return an encrypted result the problem is that it's very inefficient it's very inefficient unless you're doing like maybe like a lot of additions but again when multiplications come into play it turns out that this becomes like really inefficient so for

general-purpose computation it's just really theoretical however there has been places that you know somewhat homomorphic encryption is are like small small circuits of homo freak encryptions are being used today and is useful and one example is in some MPC protocols so for example when I gave you the idea of how do you generate these random triplets for MPC these C equals a times B it turns out that this is just one multiplication and a lot of additions so you can actually do that with folio morphic encryptions so long story short it's a different idea it's inefficient its Kalin's general purpose but we're

using that in small things it's actually even using ZK Snorks in some small extent so a bit earlier we talked about the incentive models and I'd like to come back to this specifically to talk about the token economics in enigma so there there is a token for the for the moment it is an ER C 20 token living on etherium you mentioned earlier that the token would at some point live on the Enigma blockchain so one can assume that in an enigma so if network and then a proprietary evening my blockchain will exist in the future talk about the role of the token here we've all we've already talked about your distance

advising bad behavior but you know broadly what is real the token they're all of the token is really to maintain the security of the network this is not unique to enigma it's very much like most box chains it's the idea that tokens incentivize nodes for computations so if I'm a user you know I'm I'm executing a function in a secret contract then I have to obviously send some payment some fee for whatever workers are running that computation and the workers are getting incentivize you know with with enigma tokens so very similar to other block chains but at the same time if nodes misbehave in the

computation then we need the ability to penalize them which is why nodes need to also deposit the stake okay and so can you give us an idea of like how that stake is calculated is it based on the complexity of the calculation or how does that work so we're still determining the numbers but the stake is most likely going to be bigger than or even much bigger than whatever what the biggest computation could realistically be like so the way we do this is we define Network iterations like pretty large epochs we don't have to get into that so we can imagine how many computations or how many steps can you

know leave inside one epoch and the stake has got to be larger than that and what about for users do we have an idea of how the computation price would be calculated and how much can you know if we if we come back to this voting mechanism example sort of a somewhat simple simple function like tallying up votes what is you know an accurate representation of what that would cost a user using the tap so right now it's calculated based on just the same gas model as Atheneum we are working on adjusting that one thing we didn't discuss is that we're

basically rewriting all of the back end to be based on web assembly we feel that's where the industry is going and so the you know the cost mother is gonna have to change based on that so we're working on it right now it's also important for us because we're basically gonna have two interpreters we're gonna have an interpreter for was in inside the trusted execution environment which is just a normal one but we're gonna have an interpreter that simulates multi-party computation as it was an interpreter so it was an interpreter that does multi-party computation and Daddy that it has a different calculation the reason the reasoning that is that you know let's say you have

we said comparing two numbers right comparing two numbers in a trusted execution environment in aetherium it's you know one opcode one operation in MPC is gonna be multiple operations in some Network communication so we got a factor that in still work in progress but that's that's the general idea and it's certain incentive model to acidifies nodes to stay online basically an availability incentive there is a penalty for that so the way that it works is that we sample different nodes right for different computations per epoch basically there's like one epoch

an epoch could let's say last a day in that epoch a group of nodes can are going to be in charge of computations for this much contract for this secret contract and we kind of shuffle them around now inside that epoch we have smaller time windows that are known as timeouts if if a node does not respond to a computation request within that timeout then it can be penalized okay interesting so before we wrap up here can you just give us a brief overview of what are some significant milestones that you've reached recently where is the project currently at and what are some of the

plans for the roadmap in the coming months we release a test net the first one a few weeks ago so that's actually very exciting we have a lot of projects and partners that were working with and that are trying to code and continuously giving us feedback what we're seeing from that feedback is that a lot of ours a lot of the assumptions that we made were like in terms of features are wrong and should need to evolve and that is great that is exactly what we wanted so there are a lot of new features that were working on right now though we didn't originally expect it to do but they're like crucial for developers for example having an encrypted state so the way that the networks are right now is

that users can encrypt in arguments right then you can call a stateless essentially stateless function in enigma and the result of that says that function is then being committed to aetherium but people want to be able to actually carry state and keep it state over and over that comes up in in many applications you know for example a machine learning model right like you wanna you want to be able to get some small chunk of data in an encrypted form taking a currently encrypted model and train that together and then you wanna you you want to maintain the new encrypted model as it is at time 10 then

the time you live anyone are you know evolve it a bit and save at the time 11 and you want to continuously keep that encrypted a lot of use cases require that kind of encrypted state another thing that we've seen is that you know evm is somewhat weak to a lot of the use cases that we want so we are working very hard on moving to webassembly and many many other aspects like that we have a full list so that's one thing the other thing that we're basically the other two things that we're focusing on in 2018 are moving the state from ethereal to move in the state to our own network and basically encoding the state in a way that fits enigma treats this

idea of encrypted computations and makes it very efficient to that that turns out to be a very non-trivial and difficult problem because no other blockchain project has had to keep the idea of encrypting in state and Krypton arguments in mind and the third thing is actually continuing work on the MPC interpreter and MPC functionality the goal is in 2019 to enable what we call secret contracts 2.0 which is the ability to write privacy preserving smart contracts with the general-purpose multi-party computation this move from the etherion blockchain to your own network is this something that would also allow users to use it nygma with

other smart contract platforms if you're in classic or danau or whichever one server to emerge in the future so that's what we want the way we see it we want an England to be a fully contained solution and that is something that we evolved into we realized that the only way to create really make the right design choices that is if we create a full solution inquiry don't want blockchain but at the same time we want other blocks we want to create bridges to other block chains as well that's something that we see is really important but the way we think we should be doing that is basically through partnerships I don't think we would have the core capacity to do that the way is

to talk to other projects we have a partnership with ion for example we've created the bridge to aetherium because it you know made sense because a lot of people develop on ethereum but going forward we want that to happen but that would require collaboration with other projects great well guys thanks so much for coming on it was great to talk to you and learn more about enigma and how you guys are leveraging trusted execution environments and doing multi-party computation so these are topics that we've covered quite a few times on the show I mean we've had Ari Jules on a long long time ago to talk about like the town crier model that uses T's and then we also had people from Microsoft Coco and we've had true bits so like all these different

technologies and everything that we've been able to learn so far sort of coalescing in this in this one project so it's very very encouraging to see that thank you very much it was great to be on the show and thank you to our listeners for once again tuning in you can find new episodes of epicenter every week we released to YouTube but also to iTunes SoundCloud and whatever podcast platform you having to listen to your podcast on you can also they just you reach us on twitter at epicenter BBC and if you're looking to you know i support the show and encourage us um what we're doing you can always leave us an iTunes review it

helps you find the show and we're always happy to see you reviews so thank you very much and we look forward to the back [Music] [Music]