"Faster,Better,Stronger,Safer" BLS + ZKPs = Better Web3 for all

Transcript

[Music] thank you [Music] so hello everyone thank you so much for joining me here for my talk so today I'm gonna talk about two very important topics when you actually work in the blockchain system and also in cryptography which are BLS signatures and zero knowledge proofs so the topic is how to use zero knowledge proofs with BLS signatures or at least threshold PLS

signatures so I'm gonna give a small introduction about myself and then an introduction to the topic for those who don't necessarily know it and then we're gonna go through the topic so there will be some maths but don't get scared I'm gonna try to explain as much as I can so okay so a small introduction about myself I actually started working in the blockchain ecosystem since 2017. here we are in 2023 and I'm still stuck here and I don't want to live

um so um I studied actually mathematics and cryptography and cyber security and then eventually I just started working in the blockchain ecosystem trying to bring what I've learned and what I've what I've been doing in school to blockchain so I worked mostly uh so different companies I worked at consensus cardano and worked I'm also a teacher guest teacher at University and I worked also on different startups currently I'm working at intu so at Intel we try to bring security for your private key so we're creating a protocol that would allow people to collectively uh own a private key and not basically each

person will have their own private key so basically that's a way of providing more security to the private key and not having a single point of failure where your private key is stored somewhere and can be stolen of course there are different solutions like a hardware wallet software wallet but this is what we do which is more like MPC solution um so let's get started okay so I'm gonna introduce what our threshold BLS signatures if you're not familiar with then what are zero knowledge proofs so okay so what is BLS signatures so uh you must hear about different types of signatures schemes that are used in the

blockchain ecosystem such as ecdsa Schnur signatures or BLS I'm going to focus here on BLS signatures so BLS signatures are actually schemes that are built based on bilinear elliptic curves so bilinear ecliptic curves are elliptic curve curves that have the bilinear property which is basically so I know I think I cannot really draw something here I'm sorry I haven't prepared something to explain very quickly but I'm going to try to explain to you and you'll understand so basically the bilinearities is a mapping let's call it e that will allow an element of group number one and so you take an element of

group number one you take another element of group number two and then you get an element in the third glue in the third group and the property is that these elements for example are points on elliptic curves so you multiply scalar of the first element so let's say a multiplied by the point p and then the second element is B multiplied by the point q and the third element that you get in the third group would be uh another point on that third group let's call it g for example power or at least like sorry multiplied by uh a multiplied by B so um this is the bilinear property that it

is provided on these curves and BLS signatures are actually the verification process uses uh this uh these parents so the BLS signature is um as uh shown above so you take a hash of a message and then you take that hash of the message power the private key that you have because you have a pair of public and private key so you take the power of the private key and that's your signature so you don't be confused because sometimes in Academia it is represented as this or is it or it's represented as uh basically the multiplication of that private uh private key with the hash uh with the

hash of the message M so it depends on how you explain it but for example like in elliptic curves it's it's a scalar multiplied by by it uh so yes so this is the signature in order to verify whether a signature is uh correct or not so you take that pairing e and you have to compare these two parents first one and the second one if they're if they match it means that your signature is valid so what it means it means that the pairing of the signature and GG um basically is an element of the of the group from on the elliptic curve which is the generator as we call so the

signature is as I explained in it's the hash of the message power s and then basically the pairing it means that so it's e of hash of M Power S and G and then the second one is e of hash of M G power s so because of the bilinear property this means that the first one is actually equal to e of the hash of m g all of them power s and also the second one it's dissimilar because this is what because I know I didn't draw it but yeah this is basically the bilinear property that will allow this and that basically means that the signature will match okay now I'm going to explain what our

trust what is trust hold cryptography because afterwards I'm going to explain BLS a threshold BLS signatures so threshold cryptography is basically allowing a group of people to collectively own a key uh home and use it either for encryption or for signatures uh so basically a single individual will not be able to recover that secret secret alone and we only need we all we all basically need a threshold uh number of that group to recover the secret together so imagine if you have a group of five people then uh only three of those five will be able to collectively recover the key and that

basically provides more security to that so this is what we mean by the threshold cryptography so um you must have heard by multisig wallets and multi multi signatures and the difference between threshold signatures or as we call them TSS just hold signature schemes and multi-sig is that multi-signatures basically each individual they have their own private key and then each individual will sign a transaction on chain whereas the in the threshold every signature happens of chain with only an element of the

private key so let's let's call them let's say we have S as a private key and we have S1 S2 these are our shares of the private key until SN for example so each individual will sign off chain with their only share and then the only thing that you see on chain is actually the aggregated signature that the from all of all of these people or at least the threshold group and so what are the advantage messages of threshold over multi-sig is that well basically you're you can have the group of people that sign together their identity can be hidden whereas in the multi-sig every identity is being revealed because each individual signed on chain also the cost of these transactions will be less

because we only have one on-chain signature whereas in the multi-sig every individual will sign their signature which means it costs something and then yeah collectively they will have they will own a wallet for example and also in terms of security because in the multisig each individual will still have to secure their own private key whereas in the threshold it's the private key actually it's never created at any single point of time so each individual will sign with their share and then we only need to aggregate their signatures but we don't need to construct the master private key at any single point of time we which is another point of

advantage to threshold cryptography um and I'm not trying to say that multi-siga are not good I'm just because I'm working on threshold I'm just showing you the advantages of this uh of this scheme so now the let's talk about BLS threshold signatures so for example uh like I said in the in the signature scheme you take the hash of the message to the power of the secret key so for example like in the threshold where every individual that own only a share of the key they will basically sign with their shares so s i for example so instead of like the aggregate basically the master private

key and then the aggregation basically is so the multiplication of all the basically shared signature so partial partial signatures basically so again it could be also the the sum it depends because I'm showing you as a power so if I do if I did the the signature multiplied by the half sorry the private key multiplied by the has the message it will be the sum uh signature will be the sum of partial finishers um so yeah so basically this is uh the threshold uh BLS signature so there is um you must hear also about the

aggregated BLS signature so there is a difference between aggregated BLS signature and a truss hold BLS signature so the aggregated BLS signature it means that every individual will sign with their own key and then we aggregate all of these signatures into one so this something is useful and especially in terms of like when you work on for example like on scalability so instead of like taking every signature and using it you actually aggregate all of them into one and then use that aggregated signature whereas in the threshold BLS signature you actually every signature is signed using only a share of the key and not like individual individual key of that participant

so when I was explaining before what threshold means so this is like just an explanation for example like if we have a group of six people and then the trust hole like will only need for example like four out of six to um to sign together something and then create like an aggregated signature so this is just like to represent it and then why actually that's useful because well sometimes if you have a group of people and you need every individual to come together and sign something at a certain point of time when you need it or like when a certain uh time frame and then sometimes these people are not online sometimes they're for example

like they're like they're not connected sometimes they're malicious and they don't want to for example like sign or or give you like malicious signatures so in that case you have to create a system where even if you don't have all of these partial signatures correct partial signatures you're still gonna be able to aggregate the final signature and Achieve and achieve it so okay now let's talk about LaGrange aggregation so when I was explaining actually the threshold BLS signature so when how do we create every uh share of the secrets so there is a process which I'm not going to talk about called the

dkg distributed key generation scheme so in order to generate every share of the secret of the master secret which again we're not actually creating it at any single point of time but basically in order to create all of these shares that together will represent like the same uh pair of public and private key we have to use uh LaGrange interpolation which basically Shamir secret sharing secret sharing it means that you have to create a polynomial that's basically a polynomial of degree T minus one t is the threshold value that we talked about so we create that polynomial and actually the secret itself is a of zero and then every element so every share of

the secret is one element of that polynomial so in order to create all of that in the dkg process you have to use LaGrange uh polynomial which again not gonna explain but it's basically you have to use that formula in order to create every share of the secret and then when you do that you go back to the process where I explained that every uh every uh shareholder will sign using only their share and then we aggregate these signatures together to get the final aggregated BLS signatures um again when I'm talking about basically uh threshold schemes it doesn't only apply to BLS it only applies to different schemes such as

ecdsa but the difference is that on BLS it's it happens naturally and it's it's aggregatable like easily than in cdsa so something that I forgot to mention that some of the advantages of BLS over other schemes such as ecdsa is that especially in the size for example like BLS has 48 bytes whereas ecdsa basically has a double 64 64 bytes and also it's aggregatable more easily which means that always the aggregation will create an element in that in that curve in that group whereas like in ecdsa it's more

difficult and also the BLS signatures they're deterministic which is not the case for ecdsa ecdsa it uses random number generator in the signature process the problem with that is that when you use random number generators you have to make sure that you actually use an real random number generator otherwise you might retrieve some an attacker at least my uh might retrieve some information about the private key or or for example like what happened with I think it was like Sony PlayStation 4 attack when they basically use the same random number K

in the signature process and that basically revealed what was the private key and they were able to generate signatures using that again ecdsa can be made also deterministic but in in the beginning it's not something that is deterministic it's the it's um randomized basically what does BLS is so these are like some of the advantages of BLS so in the aggregation process you go to more using the BLS than to use ecdsa and actually a lot of blockchain projects use BLS signatures like ethereum use it on proof of stake with validators uh algorand usage Divinity usage I think Shia protocol and many

projects that actually use BLS because they see the value of it over ecdsa okay moving okay now I'm gonna give just like small introduction about proof systems because the idea of this presentation is to actually see how we use uh proof systems or zkp at least with uh threshold BLS signatures so actually proof system is you have approver and a verifier and then approver will try to convince the verifier certain information so proof systems usually they have three properties I mean at least two of the three so they would have at least two of these properties so the completeness the soundness and zero knowledge so every

proof system has at least two of these three it can be the completeness with the zero knowledge it can be the soundness with the zero knowledge it could be the completeness and the soundness and not the zero knowledge so it depends the completeness it means that the honest prover always convinced the provider what that means imagine it means that if Google is basically telling the truth it will go eventually Google will be able to convince me with like a very big probability and the soundness it means that always if Google telling the truth will convince me and there is a very very negligible probability that a dishonest proverb will be able to convince the verifier the zero knowledge property means that the verifier will only need a small

amount like or of basically information to know that this that the approver is telling the truth and actually not that information does not include the secrets at all um so I can give you like an example the Alibaba example is like very it's like if you go on Wikipedia and look for zero knowledge they give you like this example as the first so basically the Alibaba example it means that we have Alice and Bob Alice wants to prove to Bob that she knows to see the secret password to a door which is inside of a cave so the door in the middle of the cave and Alice wants to prove to Bob that she knows that password to the to the door so instead of giving the password to Bob to to for Bob to know

that okay Alice knows that password so Alice what she will do she will enter from one side of the cave with the door closed and then she will exit from the other side so it's impossible for Alice to open that door and exit from a different side if she actually didn't know the secret password so that's an example of zero knowledge so she didn't give any information about the secret but she still proved to Bob that she knew that secret now there are two types of um zero knowledge proofs okay well this is not important there are two types of zero knowledge proofs interactive ones and non-interactive ones so the interactive ones it means that the prover and the

verifier will have to communicate in order for the prover to be able to convince the verifier and that means like it could be one round of community communication could be several rounds of communication where the verifier will send some challenges and the approver will have to respond to these challenges and then each time the response has to be true so if we imagine let's say k number of uh rounds so if Alice is telling the truth then basically Bob will accept it with um like will will accept it and then there will be like a really really small probability that bubble accept something something that is false and the higher the K value the the smaller this negligible

probability is which means that we have to have many many rounds of interactions in order for this protocol to be secure so that doesn't it's not really practical especially if we if we have a system where the prover and the verifier don't really communicate a lot so we need to create a system where the approver can still convince the verifier but we don't need to have all these rounds of communication so how to make this proof non-interactive so in 1986 Shamir and Fiats basically created the Shamir fiata aristic system that made uh zero knowledge proofs non-interactive by actually replacing the randomness from

the verifier and when I say the randomness I mean is the basically the interaction at least like from the verifier by a hash function So Random Oracle replacing it by a hash function so I have this here the example so instead of the prover generating request and then the verifier chooses a challenge and then the proofer will have to reply with the response so we replace all of that by the prover generating request Computing the challenge as the hash of that commitment and that request and then basically and then send in the response and send in all of that in one time as the proof to the verifier and then the verifier will eventually verify that proof so that makes it non

non-interactive okay so now that we went through introduction let's go to the topic I'm going to talk about publicly verifiable secret sharing schemes which actually use zero knowledge proofs to publicly verify some sort of information and how these are used with the threshold BLS so in a in a verifiable secret sharing scheme we have a dealer so when I say a dealer here is actually in the dkg process in the distributed key generation process every participant is um is we call them a dealer but like every participant like sends secret

shares to other participants that they have that they will receive so basically this dealer will send will create secret shares send them among a set of end parties and then uh t plus one uh honest and parties will be able to recover their secrets and then the idea behind this verifiable secret sharing schemes is that they have to broadcast a polynomial commitment and then that polynomial commitment will help the receiver of the share to verify whether they actually have received a correct share or not so there is uh we have actually verifiable secret sharing and then publicly verifiable secret sharing and the difference between the two is that in the first one the receiver will be able to to verify their share but

will not be able to verify whether the other participants received a correct share or not whereas in the publicly one every participant will know that other participants have received a correct share now why that that is important in some cases like in this dkg process some participants will say hey I actually didn't receive the correct share and that dealer sent me a malicious one now whether the other participants will believe or not they can't check the validity of what the this receiver is saying unless the receiver will have to send them their share so they will verify and that's not that's not a choice like the receiver should not send their share so they should be able to

verify to know whether that dealer that's sending shares is malicious or not to be included in this key generation process and also in the signature aggregation process so that's why it's really important to have this as a public verifiable information and one when I'm talking about this this is where it comes the usage of zero knowledge proofs because they allow to non-non interactive zero knowledge proof because they allow this information to be publicly verifiable okay so this is to explain the dkg process that I talked about earlier so let's imagine three participants P1 P2

P3 will engage in the distributed key generation each participant will have their own share as one as two as three and then these shares the sum of these shares basically will represent the secret uh key itself which again we don't compute it at all and then this key will have a public key Associated to it so uh the process of the PVSS publicly verifiable SQL sharing it goes how it goes such way so the dealer will have to compute a polynomial when I oh okay I have to go very fast okay sorry so the dealer will compute a polynomial this will allow the pub to for a participants to verify whether the

emphasis information was valid or not then we'll encrypt every participants share with their um public key so this is something I haven't mentioned so each participant will have their pair of uh basically encryption and decryption keys because they will have a Channel of communication and only that receiver of that information will have to uh the basically decrypt and see their share and not the other participant so they will send it to them using their public key and then them using their own private key they will be able to decrypt it and then they will send the deal in which is the cipher text to every participant plus the commitment over a secure broadcast channel and then

basically each participant will have to decrypt and retrieve their share so the now the zkp comes in to hand into this so we have two proofs so here I'm actually explaining something that the definity research team worked on but there are a lot of uh pdss protocols that exist um whether with BLS or with ecdsa or different protocols but yeah this is the the things that I'm explaining here are like the done by the definitive research team so there is a proof of correct secret sharing which means that it shows that each share is encrypted correctly so basically every participant will be able to retrieve a correct secret share and the second proof is the proof of

correct chunking which proves that uh it was decrypted uh honestly so I'm only going to explain one and apparently very quickly because we don't have time so I'm going to focus on the correct chunking so actually each share will be divided into multiple chunks why is that the case because basically when the encryption is being sent to the receiver it will have to be divided into multiple pieces because then it is the power we have to solve the discrete logarithm problem to retrieve these shares and if there be if the the if the value is Big then it's it's impossible to retrieve it or at least like it's hard because we're going

to do Brute Force to that to retrieve it and we actually don't need the whole ciphertext to be able to achieve these values we only need a part of the ciphertext which is M of the whole side like only s i one so as I am not to all of them to be able to retrieve the every share of the secret so uh this is uh basically if the dealer is honest then the this share will belong to a certain subset so B is actually representing that sub like the final value of that subset sorry sorry they're telling me to stop okay um sorry I guess um anyway I mean it's math stuff don't don't care uh but actually just one last

thing so it's actually uh a proof that will be sent by the approver and the verify and then it will be added like some blinding factors so to make it like this information not retrievable and we have to compute the discrete logarithm to be able to ver to retrieve these uh shares and because we added blind impactures it make it uh zero knowledge sorry I didn't explain it that much but thank you I guess questions afterwards not here [Applause] [Music] foreign

[Music]