Ari Juels: Using Hardware Enclaves to Provide Trusted Data to Smart Contracts (Episode 164)

Transcript

[Music] this episode of epicenter is brought to you by Jax Jax is a userfriendly wallet that works across all your devices and handles both Bitcoin and ether go to jx. and embrace the future of cryptocurrency wallets hi welcome to present show which talks about the Technologies projects and startups driving decentralization and the global blockchain Revolution my name is Seb and my name is Brian faan crane we're here today with Ari jwes he is a professor uh in at the Jacobs Institute

at kelltech and before he became an academic he was also a longtime researcher at RSA the famous cryptography company and and of course Corell we've had on a bunch of times uh people from Corell because they have some very interesting activities there around blockchain and around cryptocurrencies so we're going to speak a little bit about that as well and we're going to speak especially about uh two papers that Ari has published with his team uh one of them about authenticated data feeds which is uh may sound Bland at first but it's actually a very very crucial topic and the other topic of course sounds about as alluring and exciting as any uh any paper

probably I ever published in the blockchain cryptocurrency space about a criminal smart contracts so thanks so much for coming on Ari oh my pleasure thanks for having me I remember when we uh talked before you mentioned that so so you you at RSA uh which is sort of one of the key companies right around the public key cryptography um and and you mentioned that when you joined them which I think was in the '90s if I remember correct L that you were even involved in cryptocurrency related projects uh back then can you share a little bit about what you were doing then yeah it was well it was actually cryptocurrency it

first turned me on to cryptography I read a paper in uh 93 I think by Stefan brands on Anonymous digital currency so that was my uh introduction to cryptography and uh computer security the first projects I worked on at RSA were cryptocurrency related in fact and the first uh crypto conference I attended was Financial cryptography uh in 1997 I believe it was took place in anguila so why was there an interest back then um on the side of the RSA in this topic well people often forget that

um before the the year uh one uh AB after Bitcoin uh there was a lot of interest in cryptocurrency but uh centralized forms of cryptocurrency in which privacy was provided through various cryptographic techniques such as blind signatures and so the idea in general was that a bank a central Authority would issue currency but wouldn't know to whom it had issued it this form of cryptocurrency if I can call it that or digital currency uh arose as a result of a paper published in the very early 80s uh by David shom so this was already an active

area of research and it was natural for RSA which of course was a uh cryptography focused company at that time to take an interest in this as a potential application of cryptography yeah I mean we just recently did an episode with Ian G where we talked quite a lot about this early history um and some of the projects that were going on back then and I think this is a topic at least I would be very interested in revisiting a few times and doing like historical episodes right when one talks about some of these um some of these projects uh remember Ian talked about there being a whole community of companies around primarily around digicash in Amsterdam in the 90s

who all working on this right I'm curious what are your thoughts on why those early cryptocurrency projects never took off in the way that Bitcoin has right well it's rather hard to say I mean the the um there were a number of companies focused on various approaches to digitizing currency uh mondex was one of them a company that relied on temp resistant Hardware smart cards to store money um it was a fairly alluring scheme actually so I don't know why it failed digit of course is the most notable success and then failure in this realm and it's not clear that its failure was due to technical problems so much as it

was due [Music] to business problems and managerial problems so one can easily imagine an alternate universe in which digicash flourished and it's possible that uh in such a universe we would today be using digital currency on a regular basis but it would look very different from Bitcoin that's fascinating because uh I think one of the one of the most interesting segments of that uh Ian Grigg interview uh I thought was uh him making this very point that a lot of these Technologies had very good Engineers around it but and the technology was um for the most part uh

Rock Solid but that business there was no business models or uh the business model wasn't sustainable or there were these man managerial problems and uh and to hear you say that once again sort of reinforces this idea that uh in order to to build something sustainable you need to have a you know the the technology side but also the business side sort of come together and uh in in in a in a unique marriage yeah well cryptocurrency then and cryptocurrency now both attract uh some really outstanding technical talent and David shom is known not just for developing blind digital signatures which were what essentially uh fueled

the growth of uh pre- Bitcoin cryptocurrency but also for devising what are called uh mix Nets and those are essentially the basis for tour so he was one of the progenitors of tour as well as one of the progenitors of digital currency digicash was um a company he was involved in founding and I believe at some point he may even have served as the CEO so it's an example of the the type of uh Excellence that uh has marked this area of inquiry for quite a long time now so you recently left I think about two years ago you left Rosa to join uh or become an academic what made you leave and how did you end up focusing so

much on cryptocurrency related topics well I was I guess paradoxically uh interested in Academia because I felt there was more opportunity for influence and Technology transfer than in an industry lab that's it may seem a curious claim but when you're working in Industry lab I I was running RSA Labs my last years at RSA you have essentially only one customer right namely the company in which the lab is is located as an academic you have as many customers as you as you like as it were when you develop a new technology and I have indeed found as an academic that

it's been easier for me to influence new technologies than it it was as uh Chief scientist at at RSA so that was the reason for my leaving and it seems to have panned out in the way that I'd hoped and and did you anticipate that you were going to spend um some of your research interest around blockchain and cryptocurrency when you left or is that something that just sort of happened afterwards yeah you were you were asking uh how how I became involved uh that was due to uh my colleague elae shei actually who turned me on to Smart contracts I I wasn't particularly

interested in Bitcoin before I entered Academia although I had done research on uh cryptocurrency in the past as I mentioned but Elaine um introduced me to Smart contracts and in smart contracts I I saw just a fascinating range of possibilities right of course a cryptocurrency uh that supports smart contracts is a lot more flexible than cryptocurrency without uh touring complete if you allow me these use the term scripts uh and offers uh many more possibilities some of them good uh some of them as I guess we'll discuss later

not so good but uh I saw here in topic that was both interesting from a research perspective and potentially quite impactful uh commercially and in the community at large So speaking about your moving on to your first topic which is this paper called Town career authenticated data feeds maybe first where does the name Town career come from well a town crier historically was somebody who went around with a bell ringing the bell uh announcing the news of the day and this was our goal in constructing what is often referred to as an oracle which we prefer to refer to as an authenticated data feed to serve

as an authoritative source of news and facts uh State about the real world for smart contracts that's that's the motivation and why is it such a problem today for blockchain systems well I would almost say that it is one of the major impediments to to Smart contracts really achieving fruition that as we were discussing earlier uh I would for instance suggest that the reason that the Dow attracted um something on the order of $200 million dollar worth of investment was because um investors in ethereum had no place else to put their money and the

reason for that is that it's very hard to write an interesting smart contract when you don't have access to Reliable data that real world State one of the very few things you can do as you were remarking is crowdfunding and that's essentially what uh what the Dow is doing so I think it was a uh lack of richness in the ecosystem that resulted in the Dow and I think that lack of richness stems fundamentally from the inability of smart contracts to Source um a wide array of trustworthy data feeds I I I tend to think this is a a really fascinating new area of Exploration with regards to blockchain

Technologies uh having access to trusted sources of data it seems like uh there are you know this is not the the first of its kind like Microsoft is also doing something similar with uh with this Bletchley architecture and and the criet system where essentially a blockchain architecture decentralized blockchain architecture can rely on uh trusted sources of of data that themselves are not centralized but that inhibit the sort of same type of properties as a blockchain where um whereas the the the the the source of the data itself um can be trusted and and you you put trust in this case in um some Hardware so could you explain perhaps elaborate on some of

the technical uh architectural um properties of uh this Tom Cryer model on the hardware and the software side right so Town Cryer's uh main objective is to serve as a bridge between existing trusted sources of data in particular websites and for technical reasons they have to be https enabled but serve as a bridge between websites and smart contracts so it's meant to be essentially a a trustworthy pipe now there are already pipes in existence that provide essentially the same functionality as Town C or kiz it would would be an example but the

problem with these systems is that they require that you trust the system operator or you re you trust a couple of uh entities TLS notary in addition in the case of oral it and typically these are small operations there's no particular reason to believe that they have um implemented their systems correctly or that they themselves are trustworthy people although I'm sure they are now of course one can should can and should have the same concerns about town CER right why should some academics and their students stand up a service any more reliable than any other the key technology behind Town CER

is something known as software guard extensions this is a new instruction set architecture extension introduced by Intel into its in uh into its recent model CPUs sgx is um an extremely powerful security technology what enables you to do is run an application in a protected and isolated environment known as an enclave in such a way that even the operating system can't interfere with the control flow of the application and can't see the state of the application so this um and The Enclave is as far as the operating system is concerned essentially a black box another thing that sgx enables is the

production of what's called an attestation by the hardware to the software the application running in an enclave it's possible for the hardware to generate a proof that a particular program is running in The Enclave when you combine all of this uh in an oracle like Town CER you get the ability to prove to people that data is being authentically scraped from a Target website by a program running in an enclave that everyone can trust this program can be published scrutinized by the community and so on and so forth so in principle you only need to trust the hardware and Intel of course whom we all whether or not we like it need to need

to trust for the most part anyway in order to have the assurance that town Cryer is delivering data Faithfully from a source to a Smart contract okay so if I can just uh rephrase that uh and so the town CER is essentially a set of instructions running on secured hardware and by secured Hardware we're talking about an enclave that exists within a computer system that will run instructions uh at the service of the operating system and the instructions that it's running uh have been I presume that the provisioning has been signed

and also the instructions themselves and the the results have been signed by The Enclave now it's getting data the instructions are um calling external websites or calling apis to receive data so uh for instance The Enclave could call say the Bloomberg API and get Market data uh and then providing that data through uh the town C to a Smart contract and so what you have is you have a system where you have multiple roots of trust uh you're trusting Intel and you're trusting their root key to to to properly uh that well they attest essentially that you provision this this

uh this Enclave with a set of instructions and it's also signing the results and you're trusting Bloomberg's key um because they have a certificate and you know one could argue uh on the validity of the certificate model but you know let's assume that we trust Bloomberg's key uh and then that information is then delivered to a Smart contract uh and those keys and sign the TR would presumably sign a transaction uh on the smart contract executing some action on a decentralized network is that an accurate uh representation that's essentially right uh so there is as you say a program running in The Enclave um a finger print of which um is included in an

attestation digitally signed by the platform and so a measurement is taken of the program and its memory at the time that it's um stood up and this measurement this fingerprint a hash is embedded in an attestation signed by the platform so anyone who gets this attestation knows that it came from a platform that is running Town CER code in an enclave assuming that the fingerprint included in the attestation matches one published for the town CER code uh you can additionally bind to a particular instance of the Town CER code a public key whose private key is held by the application

itself once you've consumed the attestation then and determined that a legitimate piece of town CER code is running you know that anything signed with the private key corresponding to the public key in the attestation anything appropriately signed was signed by the application right so you have the assurance that anything signed in this way was produced by a trustworthy piece of code what does this piece of code do it goes out and scrapes data from Target websites the way that ensures that it's connecting to a valid website is exactly as you suggested by checking its certificate right B uh implicitly by doing an uh by establishing an https connection

this is a little more involved than the description I'm giving because of problems like uh the lack of a network stack in The Enclave The Enclave has to use the operating system to communicate with the network but in essence that that's the way it works so in in in this in this sort of stack of technologies that we've described do you have to trust the operator of The Enclave what's the level of trust that you have to have in the operator as long as you believe that the hardware can't be successfully tampered with and there are some concerns about the security vgx and it's known to have uh side channels for instance but assuming

that you uh embrace the abstraction that Intel is put forward this kind blackbox model you don't need to trust the operator at all um you as you suggested you do need to trust the website from which the data is being sourced but you need to do that anyway if you're getting data from a website um but the operator you don't need to trust are there any fail safes that you can that one can imagine where uh perhaps The Enclave would be retrieving data from multiple sources and making some sort of an average to figure out what you know an accurate uh value should be or you know let's say one of

the websites is hacked or attacked or even just simply is down um making sure that that Enclave can that software can can get the data from another source is is that something that can be programm within the Enclave yeah absolutely there are few forms of replication that can be helpful in creating greater trustworthiness one is replication of the Oracle the town chir code itself partly for reliability but also in case an sjx host actually does get compromised and somebody who's willing to invest enough money in breaking a CPU is almost certainly going to be able to

do so and so that's one form of replication that can be valuable another as you suggest is replication across data sources and there are a number of ways to achieve such replication you can forward data from multiple sources to a Smart contract and let it sort out how it wants to uh handle replicated data whether for instance wants to take a majority vote over sources or an average in the case of say a stock quote or something else uh or you can do this within Town CER which has the benefit of um less uh data being sent to a Smart contract and therefore um uh lower cost in ethereum for instance if we're

deploying this in ethereum where the amount of data transmitted um determines the the cost of a message so uh there are these two forms of of replication possible additionally uh a very important feature of town CER something that it can achieve thanks to sgx that traditional oracles can't is its ability to handle confidential data uh and I I can give you a couple of applications um in which uh you can see the value of confidential data and why uh confident potentiality of the type that town CER provides or that can be accomplished by some other me means is so important for smart contracts in

general sure perhaps can you give us one example of an application that would require confidentiality yeah so so let me give you an example our uh students for instance have put together a very nice little application which enables a smart contract to sell flight insurance now the idea is very simple you're about to embark on a flight you request a policy from the smart contract and uh you can request in the applications as we've designed it although you may want to change this in practice you can request a policy of whatever amount you want uh there's some associate premium that you need to send to the smart contract and then if your flight is canceled or

delayed the smart contract will automatically uh compensate you right it will pay the amount specified in the policy how does it determine whether your flight's being delayed or canceled it uses Town Cryer for this purpose right so there a very simple application uh and um one in which you can see why it's so important for smart contracts to have access to external sources of data State about the real world it also illustrates why confidentiality is so important you need to specify of course in your policy what flight it is you want to ensure and if the flight you're insuring is as would typically be the case a

flight you're actually on you're broadcasting to the world because this thing's on the blockchain you're broadcasting the world your flight itinerary and this is obviously undesirable what you can do with Town Cryer is send the specifics of your flight the flight number day and so on so forth directly into the Enclave through an encrypted Channel so that the code in The Enclave can determine whether your flight was delayed or cancelled let the smart contract know whether a cancellation has taken place and therefore the um policy should be activated uh without the smart

contract without the blockchain seeing flight details exposed in the clear now this as I said is something you can do with a traditional Oracle thanks to sgx which provides this type of confidentiality is a of the program and its state with respect to the operating system this is something you can do yeah that's a fantastic example and also just to run through a few other examples here when in in the etherum right paper right one of the things they talk about is this idea of financial derivatives now Financial derivatives at the moment in ethereum you can't really do right but if you have you know currency data feeds or let's say also um stock prices you know you could create synthetic versions of Apple stock Google

stock at you know put options call options all kinds of stuff uh quite easily and and you know again if you think of one of the potentially exciting applications for theorem could be that in a country like China where they don't have access to uh stock market or you know they they don't really have a tool to invest in let's say something like apple then they could potentially do that if you um have those data feeds in in something like ethereum and then another example that's also mentioned right was they said they have crop insurance again you know how do you do that if you don't get data in but if you do have of course water you know you know fall levels and and um and and

those kind of things all of a sudden becomes actually very trivial or maybe to give one last example uh We've often done episodes on prediction markets and if you look at one of the most prominent projects in the space is augur and they have the develop this in my view convoluted system to try to essentially create a data feed right where they have all these people with reputation they're supposed to like look up these events and then lock them and then somehow this gets averaged you know weighted by how much reputation they have and and then the idea is this gets accurate outside information into the blockchain but of course this is very expensive and and

maybe still prone to some attacks and then with something like sgx and those things it just becomes totally trivial um so I think this is yeah it's super exciting um what you guys are working on yeah so some of the I mean augur and prediction markets in general are an interesting way to uh deliver trustworthy data they are as you suggested prone to manipulation particularly if somebody has a financial stake in manipulating the outcome of the of the market uh an additional problem they have of course is that they can't provide confidentiality and then of course they don't scale precisely because they're so expensive as you as you said and they have to resolve the events in the end right so

somehow how do they resolve the events right either they have to rely on some sort of Oracle to uh which in the example of gnosis right one would uh rely on the gnosis company I'm sure they also will try to decentralize this in some ways but in Aur they try to fully decentralize that but then there has a lot of other downsides and I think think with with this approach you really just get rid of all of those problems that that's certainly the hope now one of the things that uh all gear does that a um very basic Oracle one that really just acts as a kind of raw pipeline doesn't do is process data but there's no reason that you can't run um natural language processing algorithm in an enclave and

uh as long as people trust that the NLP algorithm is uh accurate they can rely on NLP instead of um uh human beings to process data in a marketplace with all of the complexity surrounding something like AIT or or nooses so are when can we expect to see those data feeds on etherum when is this you know how far is this technology uh when will companies maybe prediction markets and and others incorporate some of these uh tools well we're hoping to stand up an alpha version of town CER quite soon uh probably in the next month

that version will not be a production version and that it doesn't make um it doesn't make full use of sgx quite yet Intel requires that users of sgx be appropriately licensed and um a critical service for um the use of sgx is not yet live in production form there's a test version uh currently available but um sgx isn't uh as far as I know uh available uh in production um in complete form yet but I expect that will happen soon and our hope is that the town CH Alpha will very quickly evolve into a beta and I would

hope sometime this year that we'll have a robust Town CER service available in ethereum uh serving many different forms of data and providing different varieties of confidentiality for its users let's take a short break to talk about Jax Jax is a multicoin wallet created by the people at the central now in the past if he had a whole bunch of cryptocurrencies it was a pain to handle them you either had to leave them on an exchange which was insecure or you had to have all these different wallets which was a hassle fortunately now with Jacks those medieval days of darkness misery and suffering are over Jack

supports multiple cryptocurrencies and new ones are being added but it's not just storing cryptocurrencies you can do with ja but you can also exchange them directly from with inside the wallet thanks to their shape shift integration and since there's only one seat Jax makes it super easy to back up and sync to other devices Jax works with Windows Mac OS Linux Android iOS and has browser extensions for Firefox and chrome so go to ja.io that's jx. to download the wallet and get started today we'd like to thank Jax for their support of epicenter so at this point uh these these Enclave Technologies I believe are

still sort of in their infancy we have yet to see like them be mass-produced and uh massively available uh it will be interesting to see what happens then when you can just like initiate an Amazon uh sorry an enclave uh device on an Amazon instance or uh you know any type of cloud service and that these things become rly available uh one could imagine at that point that that we have sort of this commoditization of data feeds uh where um data Fades become you know these Commodities that you can just plug into and and tie into any type of smart contract uh another thing that

also is I think interesting to to consider is this commoditization of functions so on one hand we can have data feeds that are just pulling you know pushing data to a contract but on the other hand we can also have Smart contracts that go call out this uh this Enclave to execute a specific sort of Industry specific function or something that perhaps is computationally very complex that you want to Outsource to another um to another system uh could you perhaps give us your thoughts on where this is going in the next you know 10 15 years once these things have become uh readily available yeah so the the larger Vision as to how sgx might be used for blockchains is much broader

than the one I've described for Town c one can imagine executing smart contracts off chain in entirely in enclaves and having enclaves attest to their correct execution this would have a number of benefits including um uh efficiency ability to achieve much stronger confidentiality and so on and so forth right so one can certainly imagine such a world and given the way that um the industry uh certainly the financial industry is already watering down blockchain Technologies and planning to execute smart contracts offchain uh ja seems like an essential ingredient do do you see then these Technologies if they become I mean those

reason to think that they won't uh if they become massively available and robust you know scalable and you know we have industry support uh do you see these as competitors to Smart contracts well you know decentralized ethereum style smart contracts uh I I'm not sure I would view them as competitors because I think they're achieving essentially the same functionality as smart contracts executing on a blockchain there are many different blockchain models of course permission permissionless and so on and so forth I think one can mix and match onchain execution with offchain execution and different blockchain models uh so I don't see it as a competing so much as a complimentary technology well let's move on to our next topic and and actually it's going

to be related a little bit as well I think it's all edges to to the authenticated data feed uh model which is the topic of criminal smart contracts now of course Bitcoin has had a reputation for quite a long time and uh in you know enabling listd trade and the silk Ro of course is one of the best known Bitcoin projects uh was and and so you seem also you have now done research on what are some of the additional problems or different problems that come up when smart contracts are possible supposed to just you know cryptocurrency so can you run us through is this a you know is this a real threat how big of a

threat it is and um what are some of the scenarios that you could see Happening Here in the short term I don't see it as a real threat and part of the reason for that actually is the lack of good oracles at the moment it's hard to uh construct a criminal smart contract without not access to real world state so in some sense uh to CER is going to be an enabler of the bad things achievable with smart contracts uh as much as it is of the of the good things in the medium to long term I definitely think it's a concern we've already seen all kinds of Mischief perpetrated as a result of the introduction of Bitcoin Bitcoin has been very beneficial in many

ways but one can't deny uh it's um having fueled the rise of ransomware for instance right which has become a real Scourge and leading to things things like the the Silk Road so uh I think it's a real concern smart contracts create or provide much more flexibility than Bitcoin per se and that flexibility will be used for good things and bad it will almost certainly be abused and it can be abused in some somewhat scary ways one of the things you're talking about there I think the key Concept in in your paper is is that you've

commission fairness can you talk about what that is yeah so commission fairness is essentially an embellished form of what's called Fair exchange a fair exchange is um the is a problem that smart contracts solve very nicely this is the problem of ensuring that when two parties transact with one another that each gets what she is entitled to so if uh Alice has a to sell 10 shares of a stock to Bob and Bob has agreed to pay $1,000 then Alice should get the ,000 and Bob should get the 10 shares so ideally we would like this transaction

to be an atomic operation if you use a Smart contract it it can be fair exchange is important in Commerce of any type and crime of course is just a form of Commerce right it's it's a business so it's important to criminals just as it is for uh real honest players in a in a cryptocurrency but commission fairness acknowledges that fair exchange is actually not quite enough in a transaction a legitimate commercial transaction or a criminal transaction right uh and I I'll give you an example right so one of the criminal smart contracts that we explore in our paper is one that solicits the theft of a

private key like the mining key for a certificate Authority so say Alice creates this smart contract she offers $10,000 for anyone who can deliver the key and Bob steals the key and delivers it to Alice well Fair exchange would mean that Alice gets the key and Bob gets the money all seems good but suppose that as soon as Bob steals the key he reports the certificate Authority that he stolen it and then the certificate Authority immediately revokes it well Alice has gotten the key then but it's worthless right so fair exchange hasn't guaranteed the implicit contract that Alice and Bob engaged in even if it fulfilled the

literal contract commission fairness means that both parties get the value that they intended to get out of a contract right so it's a broader notion than fair exchange and we we formalize it in our paper for a few different smart contracts so this example with the the theft of a private key can you explain how is it possible that you know if if I'm the thief I'm stealing this private key how could I you know prove that I hand this key to Alice uh to collect my payment without having to you know for example post that key you know in clear text in an ethereum contract because presumably I don't want to give it to

everybody I just want to give it to Alice right so here we can appeal to the magic of cryptography if Alice embeds the public key of the certificate Authority in her smart contract Bob can provide her with the private key uh encrypted under Alice's public key and also provide a proof that the cipher text here actually contains legitimate private key this proof references the certificate Authority's public key as represented in the smart contract as I said using the magic of crypto one can construct such proofs one can do it using uh ZK snarks for instance but they're actually less costly techniques for this particular application today's magic word is crime

c r i m e head over to Let's bitcoin.com to sign in enter the magic word and claim your part of the listener [Music] reward so you mentioned CK snarks here I mean right now ethereum doesn't support those right so is does that mean this smart contract wouldn't be possible at the moment on ethereum but there would have to be support for C snarks first or or is there a way that one could do it to today well as I said one can do it without ZK snarks uh ethereum still doesn't quite have the crypto support you would need to construct Z knowledge proofs of the type needed here so uh

some embellishment of the crypto capabilities of ethereum would be required but not a lot actually and um I think there there are many good uses for uh ZK snarks and other forms of crypto such that ethereum will almost certainly want to support them in the near future and presumably also you could have a ZK narx r on an sgx um and then have that evaluated in their potentially so that they kind of attest that okay this is the right key or this is the right um proof yeah that gets a little trickier uh Intel uses a group signature scheme called epid which is also not supported in ethereum at the

moment so the uh so validation would have to happen offchain it is possible just makes things a little more complicated but yeah so so if you just look at the kind of larger implication right this is a pretty a pretty revolutionary idea right so because I as a as a thief I could say or as a attacker or government or somebody I could say Okay I want to I want to put out a bounty for uh yeah let's say a private key of a certificate of authority so that I can afterwards um fake the https certificates and you know I put out $50,000 or some amount uh on any etherum smart contracts and then anybody at that

company could steal that key um deliver it to me collect the money and and I don't even have to know who is that person uh they don't have to reveal their identity so that's that's a pretty um a pretty powerful thing and a pretty threatening thing as well and I think given the state of the if you look at the current political landscape geopolitical landscape and everything that we've been seeing with you know these these alleged hacks of us uh political parties by Russia with Anonymous and and Wikileaks and all this kind of thing um you know this could be a very very uh powerful tool um to the AR Aral of any one of the players within

this uh geopolitical this new Cyber geopolitical War where basically anybody can issue a bounty say you know I want to I want to get the key for you know this particular server in in the Russian intelligence service and and once it's been once that smart contract's been deployed there's no stopping it and essentially uh it's it's up to you know who has the technical or or even uh knowledge you know it could be even internal uh knowledge to uh to release those keys yeah and this is this is one of the frightening things about criminal smart contracts a criminal can create a smart contract and essentially just walk

away the contract will execute autonomously and no further interaction is required by the Sol soliciting Criminal Who created the smart comp and there's an interesting question there is is is the criminal the one the one who you deployed the smart contract or is the criminal the one who actually delivered the key and I think probably lawyer talk about that right and you know additionally uh to uh hearken back here to our discussion of oracles the combination of criminal smart contracts and oracles is an especially potent one because it enables crimal uh criminals to solicit crimes in the real world

right not just in the digital world um you know farfetched example we give in the paper is an assassination smart contract there are lots of others that are a little less far-fetched and I think will be quite realistic so these are the reason for our publishing the paper is that we regard these as real threats and we think the community has to reflect seriously on how to counteract them what mitigation should be built into blockchains before they do become a serious problem so yeah now that we at this lure topic let's let's spend a little bit of time on that so would this work in a similar way I I would say let's say I want to somebody assassinated um and putting out the bounty on ethereum and

then how would they uh you know how would they collect that that money you know if they really end up killing that person right so the the general idea here is that uh you know somebody stands up a smart contract and requests that the CEO of company X be assassinated and offers a bounty uh then the smart contract can ingest an appropriately processed news feed to determine whether or not the assassination has taken place and pay out the Bounty now of course the challenge here is H how do you know even if you know that the assassination took place how how do you know who is responsible for it and for this purpose it's necessary to use something we refer to in the

paper as a calling card this is a so in the real world a calling card is a an object traditionally left by a criminal at the scene of a crime as a kind of Act of bravado to call attention to to himself or herself like the Beltway Sniper in DC in some years ago used to leave a death tarot card near the bodies of his victims so that's an example of a calling card in this context a calling card is a piece of information about the crime that can only be known in advance by the criminal who perpetrates it so an example would be the day time and place

at which the assassination takes place now the way the contract would work is that the uh wouldbe assassin commits to a Smart contract put a cryptographic commitment on the blockchain sends it to the to the smart contract before the crime is perpetrated and then after the crime occurs can open this commitment to prove knowledge of details relating to the crime that demonstrate that uh he or she was actually responsible for it and you can also require that the criminal leave a deposit so that you don't get um you know frivolous commitments or attempts to guess details about a crime that's that's perpetrated you know thankfully these activities are visible on the blockchain so there's uh some

hope of um addressing them before they truly become problematic right if somebody actually does stand up an assassination contract one would hope that the community would act to neutralize it in some way and of course it would certainly also be you know warning sign to to the person potentially right that's like Hey listen there is a bounty out on you uh on this you know on ethereum or some some other system you know you better get some bodyguards you better get right well thankfully as I said assassination is a little far-fetched uh but in the case of some crimes and key theft is a

good example you don't actually have to specify a single Target to get benefit from the contract for example if you're interested in forging a certificate uh you would be happy with um the root key for any any appropriate CA and and there are um hundreds of root CA associated with a typical browser so the private key of any of those Casa would be sufficient for you to forge a certificate you could therefore specify bounty on any one of the you know in uh Internet Explorer it's I believe over 750 Casa any one of those 750 Casa uh and uh that would be sufficient

as I said to forge a certificate so you would not actually be warning a single potential victim that a crime is about to occur right you're warning a group of hundreds of potential victims and this then it then becomes more difficult to defend against the attack and in in this case would it also not be obvious well you know one would see somebody collected that Bounty but it wouldn't be possible to see which one of those keys was compromised yes it's also possible to uh provide a zero knowledge proof of the correctness of a private key that doesn't specify which private key it is just specifies that the private key corresponds to the public key of some legitimate certificate Authority H it

yeah it's it's fascinating if you one can think of like this weird dystopian type movie scenario where you have you know these decentralized autonomous assassination markets uh where anybody can anybody with with the right amount of money can uh um plan or or put out a bounty for an assassination uh and then it would be interesting to see how that would play out you know would that be sort of a leveling of powers or would there be some sort of mutually assorted destruction uh uh thing happening where you know nobody uses it because it could potentially be you know catastrophic for for for everyone right yeah you know I think I think the greater risk is that people experiment with criminal smart

contracts in in a way such that the reputation of a cryptocurrency like ethereum is sullied and cryp criminal smart contracts then would really be to the to the detriment of legitimate users of of a system of that kind or these criminal smart contracts are not so nefarious they're not assassination contracts that the system in which they're being used is likely to be shut down but they are bad enough so that they pollute the water right that they drive away potential legitimate users of the system because the reputation of the system is so badly

damaged yeah and I think that's a very very scary scenar especially if you see in Bitcoin right so what was it used for okay so some people bought some drugs online right and paid for it with Bitcoin right that's that's basically that and the ransomware ones are sort of the two uh the two Criminal use cases I think in Bitcoin that have really gotten some traction and and and you know if one looks at uh some data analysis that has been done in Bitcoin I think estimates are still that this is a a very small percentage of Bitcoin transactions you know maybe uh 2 3% or something like that that concerns such listed

activities and even then it has gotten uh it has really tainted the oration of Bitcoin very strongly but I think if you look at these criminal smart contracts especially like something like an assassination contract or things like that it will make for an incredible new story right it will make and and so it doesn't it just takes one to completely uh dominate the the image of such a system right that that's absolutely right and that as I said is is a real risk you know whether or not a an assassination contract actually leads to an assassination is questionable but whether an assassination contract might lead to some lurid news story that

causes people to turn away from ethereum is quite possible well let's let's do one one last question on this one what are some of the measures that exist to protect from Criminal smart contracts it's a really challenging problem and it's not clear what the remedies are one can delegate to some Authority the ability to preemptively neutralize smart contracts but that's challenging and who's the authority right we're talking about decentralized cryptocurrencies here so suddenly you're creating centralization who's the authority how does the authority determine whether or not a smart contract is actually criminal that's a difficult question the

same format of smart contract I described with the calling card can actually be used for somewhat legitimate purposes as uh as well as uh truly ones for example you could use such a smart contract to solicit the return of a stolen piece of artwork then you're engaging with criminals there's a risk of moral hazard that you're actually causing people to steal artworks but the intention is good should such smart contracts be neutralized or not it's really not clear so this is the these are the problems that bedevil any solution we've been able to come up with but I think almost certainly there will have to be some mechanism in place if we're to see um very nice systems like ethereum

thrive in the long run so in closing here just before we we wrap up uh I'd like to talk about ic3 so you're part of ic3 which is uh the initiative for cryptocurrencies and contracts uh can you tell us a bit about what what is the ic3 and what the objectives are yeah I'm happy to so ic3 is a research initiative spanning at this point five universities mainly Cornell and Cornell Tech but also uh uiu University of Illinois Urbana champagne um uh UC Berkeley and the techon and includes a dozen faculty most of them in technical areas mainly computer science but uh also uh

including a faculty member at the business school at Cornell and one at the law school because of course the study of cryptocurrency isn't a purely technical one they're very interesting financial and legal questions that form part of the research agenda of ic3 we have about um uh well we have several dozen students at this point exploring a whole range of topics ic3 was created to uh fill a what we see as a really problematic gap between the research that's going on in Academia and the needs of industry in the community at large so ic3 is trying to do research

that is relevant to the problems confronted by users today we have a few industry Partners uh Intel is one of them uh incidentally speaking of sgx uh with whom we work closely to distill out research problems that we believe are of significance and we work with others in the community we have a close connection with the ethereum foundation as well so as as I said ic3 was created to bridge the gap between Theory or academic research and practice and that's what all of the Dozen faculty members and the many students are committed to yeah and of course we've had uh we have had em G here in it Aon several times am G here several times who's also

at the ic3 so what are the research questions that are you driving your agenda and IC 3's agenda well we conceptualize our research agenda in terms of uh five big problems that we refer to as Grand challenges one of those is the problem of scaling blockchains right this is a problem in any type of blockchain permission permissionless with smart contracts without um we're looking to develop new techniques that allow uh cryptocurrencies to scale up to throughputs of potentially hundreds of thousands of transactions a second so that that's one of these Grand

challenges another is ensuring the correctness of smart contracts the th amply illustrates the pitfalls of smart contract programming these are pitfalls that we're trying to address in our research another is the problem of confidentiality where to be more precise the tension between utility and confidentiality and blockchains blockchains are marvelous things in that they provide perfect transparency everything that happens on the blockchain is visible to the whole world this is great for accountability but it's disastrous for confidentiality we believe that using techniques from cryptography and using

things like trusted Hardware that's possible to eat your cake and have it too to run smart contracts that provide accountability but also provide strong privacy uh the fourth Grand Challenge is the delivery of strongly authenticated data smart contracts one of the problems we talked about today and the fifth is RIT large uh dealing with the unknown when smart contracts in particular are executed but this is true more generally at blockchains there's always the possibility that something unexpected will happen again the Dow illustrates this this problem quite nicely so we believe that smart contracts should be designed in ways that are robust to

error and unforeseen circumstances that they should contain for instance what we refer to as Escape hatches ways of modifying the terms of the smart contract modifying the execution of the smart contract so these five grand challenges um are a a broad umbrella in which the vast majority of our research is conducted and we believe that these are the most important challenges facing blockchain users today well all right thanks so much for coming on today and and thanks so much for the work you're do I think it's super interesting and and I think you're absolutely right that these are such critical issues for this industry to resolve and and once they are resolved

it will be extremely interesting the Innovations those will unleash both on the good side and on the bad side and we'll certainly be watching very attentively also uh when this town CH is going to launch and you know when we can to see some people doing the first experiments with that uh so thanks so much for taking the time thank you it was a real pleasure and thanks for inviting me on to the show and of course we'll be linking as well to AR's website and the papers we discuss today as well as the ic3 website and and other resources if people want to go a little bit more deeply into this topic so they'll know where to go uh so yeah thanks so much for joining epicenter is part of the letor pron Network you can find this show and other shows on letor

pron.com and uh and of course you can subscribe to the show and any of the podcast applications and if you like the show and you want to support us then please uh leave us an iTunes review it helps people find the show so thanks so much and we look forward to being back next week [Music]