Andrew on "Advanced Cryptography for Communities" @ ZK Hack Meetup in Athens, 12 April 2024

Transcript

okay hello everyone uh my name is Andrew I'm going to be talking about Advanced cryptography for communities and once these slides load yeah so if you were at ZK Summit yesterday you may have noticed that inside your badge you had a little NFC card over here uh and these nf6 cards were issued by us they each come with their corresponding digital signature public key and so every single attendee gets a card with the public key and and every single talk also has its own card with the public key and whenever you go ahead and tap a card then you're going to get a signature from that public key and what we've done is on the side we've built Merkel trees for a lot of

interesting sets about people and talks at the event and so for example uh we would have a speaker of Merkel tree and this consists of all the speakers and their corresponding public keys and so you can make useful proofs about hey maybe I've met certain number of those speakers and I've tapped their cards now going ahead what is the point of this we have all these NFC cards you can go around the event tapping other people's cards like why do we care uh the first step is we need to understand like why we're talking about digital signatures in the first place because digital signatures are really the core of this experience digital signatures first off are portable uh an ecdsa signature is

roughly around 64 bytes depends on the encoding format you use but it's it allows you to verify that a certain interaction in this case in real life was actually authentic and it actually happened uh the second thing is that they're context free and so compared to something like nfts or something that uh maybe requires an API digital signatures give Universal verifiability I don't need access to any API I don't need any proprietary platform if my device is able to verify a digital signature which pretty much every single device is then I can work with signatures I can generate signatures and I can take any signature that you give me and I can verify that it's correct and the final

step here is that digital signatures are composable so I think of signatures as the base layer for everything else that can be built on top in terms of advanced cryptography so we want to start with signatures uh that's what this whole project is about these NFC cards are meant to have a sort of interesting set of signatures that were provided to every single person in this room and then other people can come and build applications on top of it so if there's anything I want you to remember it's this digital signatures are the ideal base layer for advanced cryptography now any of you in this room next year can decide hey at zikit Summit 12 we want to build our own application

we want to use event data we want to know who people talked to we want to know who people met uh we want to know what talks people attended to and we also wanted to know what they did at ZK Summit 11 well you can easily do it just from looking at the signatures that we've provided so anyone can go into this app they can export these signatures and some other developer can build a totally different app that has absolutely nothing to do with ZK Summit 11 app and nothing to do with cursive and you can use these signatures out of the box so there's nothing proprietary about this now what can we actually build with this so what does the app actually look like and what sorts of cool cryptography experiments were we able to run well first off I'll walk you through

the app so if you ever tap someone's card you'll see this screen this is your home screen and it kind of lists out every single thing that you've done at the event so right over here uh this means that I've tapped Andrew and so we allowed any tap to do contact sharing as well so when I go ahead and I let's say I walk up to aush and I want to tap aush well I'm going to be able to see any of the contact information that he has agreed to share with anyone who Taps him in addition I can go to any t uh talk room and I can tap in a card in front of the room and I can prove that i' I've attended this talk now with all these attestations what can we actually build first step is proofs you can prove

that you did certain things at ZK Summit 11 this is an example of what a proof looks like so on the left you can first collect the bunch of signatures in this case the proof that you generate is tapping into five talks you want to prove to someone that you actually attended five talks at ZK Summit what you would do is you would go to this room you would tap in the five cards you would collect these signatures and then you're able to generate this proof and after you generate this proof you get a public link online that anyone can look at and anyone can say oh this proof was actually valid this person actually did attend those talks and for right now these proofs are hosted on our website but you can easily copy the proof and you know host it anywhere you

want now here's where the fun stuff begins let's say that I walk up to iush and I want to see what we have in common I've just met I and I want to decide if I want to be his friend now one way I can base this interaction off of is what sorts of talks he's been to and what sorts of people he's met at ZK Summit and I can use that to determine if I like him or not but I don't want to just send him every single thing and ask him hey like what have you actually done uh what talks have you been to you might lie I might lie uh also I want to keep What I've Done private and so that motivates private set intersection and this interaction looks a little bit like this so I've collected a bunch of

signatures I us has collected a bunch of signatures we walk up to each other at ZK Summit and we both decide hey we want to discover what contacts and what talks we have in common so keep in mind this is an interactive protocol so this uses two-party computation and fully homomorphic encryption and because it's interactive we sort of have to do it at roughly the same time we don't have to press the button at the exact same time but Aisha is going to have that same button and we're both going to press the word discover we're both going to say we want to discover our shared interests afterwards it will run this computation and then finally we'll be able to see oh hey like we both know Sora we both know sain I like Sora I like sain so I probably like aish

now what's actually happening under the hood is I'm taking all my signatures that I have I'm encoding my signatures as a bit Vector of ones and zeros remember how I said that there were maybe 500 different public keys for attendees and talks at ZK Summit each one of those public Keys corresponds to an index and I'm encoding my signatures using those indices then I perform encryption alongside iush we perform a two-party computation to encrypt our corresponding bit vectors and then afterwards in this encrypted Land We perform the index wise product of these bit vectors so we'll multiply these bit vectors and then we'll get a resulting bit Vector that says oh hey at this

index we both have a one and so that's how I know that we've both met sorum now uh if you think about this a little more I'll save this for homework but you can think about this protocol you might come up with some ways that someone could exploit this or possible attacks but Hinton en R is is going to give a talk later on about how to nullify so these the Texs third thing also very exciting is folding schemes now uh to motivate this one thing we wanted to do was have every single attendee be able to generate a final big proof of everything they've done at the event so similar to how Spotify wrapped takes every song you've

listened to all your artists all your data throughout throughout a year and it turns it into one big wrapped UI that you can look at that people screenshot and just post on Instagram we wanted to make a ZK proof for that and for this we wanted to use folding schemes the advantage of folding schemes is that we can build this proof up incrementally we don't have to uh have all the signatures at once and generate one entire proof of everything you've done at the event but instead we wanted to be able to fold in every single signature as you get it uh and this allows us to experiment with the new technology folding schemes of Nova uh but also hopefully see if this is fun for the future this is what this looks like uh at the end of your event you get this

little folding like UI that says oh this is how many attendees you connected with how many talks you've uh been to how many speakers youve met and you get to see all this you get to review all of it but then you get to generate this final proof and this final proof basically takes in all the signatures uh that you haven't folded yet and it folds the remaining ones in and and it allows you to publish this little uh wrapped proof at the end of the day and this wrapped proof is something that you can post on Twitter you can post online and anyone can go visit this URL and say oh hey like this is Andrew he met six people at ZK Summit but he also didn't go to any speakers and you can verify this proof yourself uh again now uh in regards to

folding schemes uh folding schemes were implemented by uh Jack's team MCH 34 so he's going to give a little talk about it but I'll hint at this a little more uh he'll he'll talk about this a little more but folding actually takes a bit of time to run and so folding every signature in it would be difficult if we wanted to do it right when someone got it because it would be blocking their entire uh UI experience and so there's a ton of work done uh by Jack andan to actually make this work inside web workers and so actually what's happening when you collect a signature by tapping a card this is all happening in the background these signatures are all being being folded in uh whatever you're doing okay uh bonus shout out here is

email nfts now this wasn't done at this event but this was uh an activation we did with aush mzk email at e den and so the idea here is that okay you have all these signatures because they're so composable it's extremely easy to build any type of experience on top including any web 3 experience so if you care about web 3 if you care about nfts then email nfts is a great prototype type of how this might work so we had a similar setup where you would go around and tap cards around the venue at e den and when you tap a card you got a signature now uh iush helped us integrate I and Sora helped us integrate uh the setup where you could go present the signature or present a proof of this signature inside a

contract and when you sent this proof to a contract then you would automatically get an email nft so everyone who signed up for the app had an email associated with them and this contract would basically send them an email nft uh and you can ask a more about how this works under the now uh final thing I want to mention here is that a lot of this Advanced cryptography is actually quite practical it just requires a little bit of engineering work to make it happen uh so ZK proofs these proofs of signatures take around 1.5 seconds per signature uh what we're doing there is an ecdsa verification and a Merkel proof running the PSI takes around 5 Seconds uh it's

actually quite fast uh it's it's quite fast compared to a lot of ZK proofs we want to make H but it requires both participants to be online so it's interactive and that's a limitation finally folding takes around 3 to 5 Seconds depends on your device a lot uh Jack will talk more about this but we use web workers to make this happen automatically in the background and so that's not a big limitation and finally I think the cool part about having this all be under the framework of signatures is that none of these teams technically needed our permission to build this we just provided the signatures we provided the front end for a away uh a way for people to actually go around and collect signatures but enrio could have decided hey like uh

John giant enrio could have been like oh like I want to build some FHA experience right I want to use signatures and I want to say like uh oh like what's the private intersection for zk2 right and we could just have these NFC cards we could give them out we can give out signatures but then people could export their signatures could just take them from local storage or we could have some export functionality and they could build a separate app and anyone would be able to use it and so finally uh I work at cursive we are a cryptography and Design Lab building applications of sign data and just working on Advanced cryptography in general uh if any of you want to collaborate on any of these types of experiences build anything involving digital signatures uh we're always happy

to check finally shout out to PS for funding this work and here's our telegrams this is my telegram this cursive telegram if you're interested uh you can join and [Applause] chat when you were talking about the private set intersection are you talking about like using filters or is it more simple than that uh when you were talking about like the big vectors and stuff is it Blom filters well for for us the solution we actually implemented is each user just takes their list of signatures and encodes

that as a bid Vector oh okay okay it's just a list I got it yes yes and so you might be thinking about ways where that WR or why that isn't a great solution well enri is going to tell you why it's not a great Sol