Building cryptographic apps for human connection - Vivek Bhupatiraju & Andrew Lu

Transcript

[Music] okay hello everyone my name is Andrew this is Vivic and today we're going to talk about building cryptographic apps for human connection so first off why combine cryptography and human connection why are they such a good fit well it really comes down to two things human connection is centered around discoverability and depth discoverability means finding more quantity of connections more opportunities to connect with people and depth is about making each one of those connections more meaningful first off is discoverability so many social apps today are using a push-based model so

big algorithms or advertising feeds tell you what you're going to look at uh you don't really have control over what you see and in addition these feeds are based on maximizing how much time and money you spend on the apps on the other hand cryptography offers a few advantages here you own your own data so you get to choose how you interact with these apps you get to choose who gets to see your data and also what types of connections you're able to find now depth is another facet where a lot of social apps today are lacking if you look at popular apps like Tinder or Instagram these are all Center around

you making a public profile that's based on who you want other people to see you as rather than who you actually are they're not centered around connection they're centered around your public Persona in addition to that none of this data is verifiable you can basically put whatever you want on your Tinder you can put whatever you want on your Instagram and you're crafting an image for other people to see and as a result this leads to a lot of fake data a lot of fake profiles and a lack of genuine connection crypto phography helps this in a few ways first off it makes sure data is verifiable that it has a source of Providence to it in addition to that because now you have access to private data you can include a lot more

meaningful sources of information within your profiles you can include data that is more personal to you and reflects who you actually are in addition to that compute Primitives like MPC or fhe ensure that you can still create meaningful Primitives on top of this data okay so why do we care right now why is it so important to build apps with cryptography at this moment well there's really two reasons one of them is technological and the other one is social first off is the technology side as many of you uh might have experienced last year at ZK Summit we actually did a similar experiment with these NFC cards that you all have um but actually a lot

of the tooling we have access to today it simply wasn't there a few months ago things like non-interactive uh multiparty fhe and Trinity both of which Vivic are going to is going to talk about later on uh in this presentation they simply weren't production ready at the time so a lot of The Primitives that we really depend on are now here and they're ready to go in addition to that Primitives like ZK Emil and ZK TLS ensure that we can actually use this data today we can take data from web 2 silos make it portable and include it in our applications finally consumer devices are getting a lot better client side proving is becoming more important tools like nor tools like mpz Phantom Zone all these are designed for computational

loads on commodity hardware and they ensure that we can actually do more meaningful computation in the devices that are in your pockets okay uh now the other side of this is social uh it's about how social media apps have developed and evolved up until today uh this is a really interesting Twitter post and it's about how in a recent marketing campaign Facebook didn't mention the word friend a single time they just didn't say it and instead they were talking about feeds they're talking about content and all this other stuff uh but the original values of friends and connection that Facebook started with simply aren't there anymore social media today is about attention and not connection but

at the same time people are searching more and more for connection uh maybe these are a little small and you can't read it but to summarize people have fewer friends today than they've ever had uh and they're spending more time alone today than they ever had before so people are looking for more types of connections but social media isn't giving it to them so what can we do about this what tools do we have access to uh specifically how can we use cryptography to help enable human connection the first tool that we can use is cryptographic NFC cards all of you are experiencing this right now you all have these NFC badges uh as you entered the event and NFC is really great uh for one useful primitive which

is verifiably digitizing physical interactions I can prove to you that I actually met you in person by collecting a tap from your NFC card they're roughly two different types of cards that we experiment that have cryptography on them the first one is an ecdsa based card and the second one is a message authentication code or Mac based card so we're using the second kind which I'll explain more about later um but roughly speaking these both use cryptography to secure physical interactions at a high level the ecdsa cards are signing cards that actually have an internal nons which increments upon every tap and in addition to that they actually custody signing Keys within the chip so whenever you sign

whenever you get a signature whenever you tap one of these ECA DSA cards it increments a nons and it signs that non and gives you back the tap on the other hand the Mac based cards use a shared secret so basically the server has a secret that's uh shared with the card and when the card generates this incrementing nons tap it just generates a Mac for it and the server verifies this tap to ensure that the tap is valid so why do we use one card versus another well at a high level these ecdsa cards have two really important properties they're fully decentralized because the card actually custodies the keys so interestingly enough these cards actually just act as full wallets they

custody signing keys they can sign arbitrary data they can sign arbitrary transactions and so they act as full wallets but on the other hand these cars are somewhat difficult to use namely they're expensive they cost a lot more than the Mac based cards and they're also much slower and this is the main reason why we use these Mac based cards the N tag 42s for ZK Summit it's because the tap experience is way better takes less than a second versus these signing cards would take uh multiple seconds to generate a signature and that's actually because these signing cards are generating the signature on the chip it's a low power environment um and hopefully that technology can improve in the future okay so to summarize NFC is a really great educational tool it's

really tactile and physical uh when someone is introduced to NFC for the first time something we hear a lot is oh wow this actually feels real it feels like you're actually getting something when you tap an NFC chip and that's how cryptography should feel uh it's really engaging and it automatically elicits human connection when I tap you I have to be in the same physical vicinity as you I have to be right next to you uh and so we're engaging in a physical ritual when I actually get this tap but at the same time NFC is not super expressive it kind of can only express one thing which is that we have this physical relationship so we were looking for more ways to have programmable computation on top of this NFC data layer and that's where we got

to ZK proofs and specifically we use ZK for verifiable data and being able to prove things about your social graphs and about your own personal private data so our Tex stack is roughly this we use baby jujub signatures for NFC Taps that's what the chips give uh they ZK friendly signatures uh we use ZK email and TLS notary to be able to export web2 data and be able to use it within our applications in a verifiable manner Gro 16 proofs for efficient client side proving and we use Nova and other folding schemes for folding multiple signatures together to be able to generate summary proofs of an entire event experience so at a high level these are some of the uh experimentations we've

done in the past at devc connect we did events gated upon Taps so you meet the event organizers get Taps from them to actually join their event uh at e dember we had prizes based on generating ZK proofs of Engagement meeting certain people or going to certain uh events ZK Summit last year we did a Spotify rap like experience where you could fold all your signatures that you generated throughout the event into one single folding proof that represented your whole event experience and finally at a re recent residency we experimented with uh ZK email um and basically allowed you to import your calendar social graphs from your email uh as well as verifiable events uh that you were going to attend in the future and this

allowed you to ask other people within your calendar social graph to see hey I'm am I going to any events with you in common am I going to see you anywhere in the future okay some quick Reflections on ZK it's useful for importing personal data you can do it in a verifiable manner um but largely speaking ZK is still limited within this social app use case uh it doesn't allow full expressivity and it's largely a single player thing I'm proving things about myself about my own data to other people and it's great for these low trust environments where I want to like limit what I send to other people and this is really interesting because comparing ZK versus other tools

that we'll uh experience later on ZK is centered around minimizing the amount of data that you share versus something like MPC and FHA as we'll see really allows you to maximize the amount of data you share and look for more connection and share everything because it can be done in a safe and privacy preserving way so that leads us to our first multiplay CL tool which is private set intersection all of you can experience this on the app if you uh go meet someone you can see what you have in common and what this enables is for someone like Alice and Bob who've never met to actually see what similarities they might have how this works is that Alice and Bob's interests are both encoded as interest vectors and this PSI

primitive allows us to find the indices where both of them share something in common so in this case Alice and Bob meet each other they filled out their vectors PSI allows them to discover that they both are Lana fans and also are going to Coachella to see her this expands naturally to the multiplayer setting where Alice Bob and Charlie want to discover times to meet they want to find out when they can all interact with each other and hang out uh and so they all share their calendars but they do so in a privacy preserving way here PSI is used to find similar times where all three of them are all available and this leads to more effective social coordination in general in the multiplayer setting now some

general thoughts on PSI it allows you to use privacy in an offensive manner so often times we think about cryptography as defensive tools used to secure your data keep something private prevent you from getting hacked in this case it's offensive it actually allows you to share more because you can do so in a safe way and therefore discover more meaningful social Connection in addition it's pretty easy to understand and explain PSI is largely centered around hey like let's just find out what we have in common it's a very simple thing that people do anyways um but ultimately at the end of the day PSI is still largely a limited primitive it is just one interaction that you can do uh it's only hey like let's see what we have in

common and what we realized when we were building it is we wanted to look for more expressive forms of computation more things that allowed you to do uh comparisons or averages and Vivic is going to talk to you more about Primitives like that yes so this naturally brings us to more General multiparty computation and the specific scheme that we've spent a lot of time and resources in is multiparty FH and the reason for this is that we're mostly building in consumer settings where liveness and compute are both kind of like bottlenecks liveness here uh represents a number of back and forth rounds between two parties uh because people put their phones away um that basically stops a computation from

happening if it takes multiple rounds so multiparty F has really favorable kind of rounds compared to stuff like secret sharing and garble circuits and the other nice thing is that it kind of offloads computation to a server there's two main modes that we've worked with uh multiparty FHA in the first is interactive and so basically there's uh initial MPC to set up a collective public key amongst a group of folks so this Collective public key is generated such that no individual party knows its corresponding private key and so everyone can basically feel safe to encrypt their data to this Collective key at that point you can send all of your data to a server and the server can do different operations in this case it's just a multiply and get some output all you know encrypted to this

Collective public key and then finally there's a second NPC process to decrypt this data and so again this is really nice because you basically can offload all this compy to the server but there are a lot of rounds initially and in the second phase so as Andrew mentioned PSI is available in this app and actually it is built using multi party uh fhe because it happens to be you know very efficient and one thing you might notice when trying it is that like you we actually require both of you to opt in at the same time so it's kind of a synchronous process and the reason for this is that there's probably like seven back and forth rounds and it's really difficult to build a good ux unless you require both parties to just kind of sit

there and let the whole compute finish and we've tried in the past where sort of it's more asynchronous but then yeah if someone puts their phone away then basically the whole computation is blocked and it can just take long time for any sort of like results to populate one thing we'll highlight actually with the PSI is um you can also in the app put in cryptographic hot takes you can get overlap on that and you can sort of safely share those things uh update from these zk1 mocks the second mode we've started to work with is something called non interactive multiparty FHA uh which I think is not quite a thing in the literature it's something that was uh pioneered by this group called G Labs uh that we work closely with and it basically gets rid of this initial MPC where instead the server generates a

shared key and key switches different parties data to the shared key itself and so this is nice because it skips this initial NPC but also each party only needs to encrypt their data once they just encrypt it with their own public key and then the server can handle basically this key switching operation to bring it to the shared key the rest of the process continues as normal the server doesn't compute there's a collective decryption process but you do save a bunch of rounds here so we actually built this at a recent conference uh called Frontiers in San Francisco and the setup there was essentially private job matching so a candidate and a recruiter uh could post basically a job profile and a job description privately and every time you

sort of met someone we basically run this computation in the background to see if there was overlap in your kind of uh sort of encrypted data you uploaded and we found this interesting because as a candidate often you know you want to be looking for better opportunities or at least search what's out there while you're still employed at a specific place and it's really difficult to do this in like a public fashion because you don't want to you know mess up any relationships with existing employers and so this setup basically enabled this sort of stuff to happen only if there actually was an overlap you don't need to reveal that hey I'm looking for a new thing it'll only surface if like the candidates you know interests and salary requirements actually fit what the recruiter has in mind so you can imagine the candidate putting like some super

high salary requirement just to see what's out there and this actually reduced the number of rounds significantly but there's still four rounds of communication which means there's still kind of this weird back and forth where if Alice puts her phone away then Bob is kind of like blocked from receiving any results but overall um this is a significant Improvement upon a lot of other NPC schemes especially in a consumer setting and again it's really nice because the server can handle all this compute as well and so like the user on their you know you know compute limited device only has to handle generating a public key and doing encryption and decryption one huge downside of fhg schemes in general is especially in the multiparty setting it seems like is the uploaded public keys are huge um so to get like

you know SEC like 128 bits of security uh you usually require like keys in like the tens to hundreds of megabytes and you know if you're kind of trying to set this up in like an app experience this is a huge load for someone to upload even on good Wi-Fi but especially on like you know something like a conference Wi-Fi or like on data and there's also a huge uh blow up in the you're encrypting as well because you're adding all this noise and other stuff to make it fully homomorphic so uh that brings us to um Trinity which is a scheme that we've researched inhouse that we think answers a lot of these different requirements in particular um there's kind of one round necessary of computation with one kind of initial pre-processing phase that can be used for many different NPCs and it also comes with verifiability out of the

box the inputs that are going into this multiparty computation um can you can basically verify that they you know correspond to other data it's called Trinity because it's a combination of three different powerful cryptographic schemes the first is Garo circuits basically the same one from you know Yao and the 80s um kg witness encryption which is a relatively new result from 2024 and good old plunk uh actually any sort of ZK snark that uses kzg works but uh We've chosen to use plunk because it has great tooling and great performance I'm going to go through each of these quickly I'll keep it pretty high level um but for garal circuits this is essentially a general purpose uh two-party computation tool you can make it multi-party but it's really shines in the two-party setting and the problem or

the reason we haven't used it before is like this oblivious transfer section here classically requires like usually three rounds there's ways of like kind of lowering that to two rounds with some other techniques but in general there's basically a bunch of back and forth that needs to happen and so again it makes it really difficult to use vanilla Garbo circuits in consumer settings kg witness encryption comes to the rescue here um the high level API of kg witness encryption is basically you have a normal Vector commitment you have different indices from 1 to n or like roots of unity and you're committing to some dictionary and what you can do is you can essentially encrypt to this kg commitment at a specific opening so if this kg commitment at you know Point like index I opens to D ofi then uh the

sort of like committer can decrypt a specific encryption you make but if that opening proof doesn't exist then you can't decrypt so it's basically like you can sort of yeah basically do these sort of like um committing to a vector and it's all very efficient just inquires like a few pairings and some EC moles and the main application that uh the authors of this paper built it for is something called lonic oblivious transfer and so this is also kind of um very detailed but the rough idea here is that you can essentially batch a number of OTS into one round of pre-processing which only shares a like constant sized kg commitment and then you can use that constantz kg commitment across many

different oblivious transfers and so if you kind of include this oblivious transfer data alongside your garbling you just have one round total of computation which is really really nice for Consumer settings finally plon comes in because this kg commitments you can essentially attach a succinct proof of validity in the settings we're operating in this kg commitment corresponds to the various parties like inputs into a garbled circuit and by default there's no verifiability on this it's kind of like you're trusting the parties to put in the right data but you can essentially for very cheap attach a proof uh like a plun proof where you know your kg commitment at a high level can just be this First Column and you can attach a bunch of other data like ZK email ZK TLS data to prove that your

commitment is valid and this is all very efficient and very succinct and so altogether U basically Trinity enables this sort of like one round of data transfer to do a 2pc uh which again in consumer settings is like super useful cuz people put their phones away basically and in addition you also get um validity proofs of your data uh for very cheap and also very small proofs like small enough where you can you know feasibly put them on a blockchain the upshots of this are that Trinity actually we're still working on implementing Trinity uh should be up in a few weeks at Edge City and Devcon so these are more kind of what we're looking forward to uh versus Reflections but we think Trinity will enable really simple developer experience and user experience for for building and using uh

consumer GPC um because yeah when you don't have to think about all these rounds of computation that's actually a huge load taken off of both the developer side and also on the user um basically interacting with this app next um the cool thing is because we're building off plunk and in general any kzg based um ZK snark you can actually build off other ZK proven data that users have posted whether it be in blockchains or other settings Trinity can plug into this very naturally uh which is really really neat especially in a world where you know hopefully people are generating more and more proofs about themselves and maybe the overall sort of like mental model to think about with uh Trinity is that you essentially for Alice and Bob Alice can send Bob this encrypted email with basically a set of criteria and some

sort of hidden information and Bob will only ever get to see the hidden information if he actually matches this criteria and so it's kind of this combination of like witness encryption and multi-party computation and it just enables we think a bunch of new kind of of affordances that we will go through now because we think we finally sort of through these Explorations got to some really exciting views of what future coordination communication could look like with between different humans the first one is this idea of unbreakable consent and this actually is kind of flipping what's often thought of as a flaw of NPC which is that parties can exit a protocol early which basically means that for everyone else

involved they might not get the result of the computation they might not get to decrypt in the case of like FH based multiparty stuff but at least when you consider the 2pc query response setting this actually is like a real feature in that for Alice to learn anything about Bob um it like Bob needs to sort of participate or consent to participating in this kind of decryption process for any information to be revealed and so it's kind of like mathematically required that you know both parties or all the parties involved consent to what is going on before anything is revealed and this is a very very different model from existing situations where we just kind of Hope servers do write by our data um which often times you know they're training their own models they're selling it to whoever they're

selling it to other people to train models so this is an exciting new sort of way of existing digitally the next is idea of digital pheromones so for anyone who's unfamiliar a pheromone is a chemical substance produced by an animal to signal to other individuals to engage in some kind of behavior other individuals in the same species and one way we've been thinking about these sort of uh Trinity kcg commitments which again are sort of commitments of different people's like input data is that there's these very lightweight you know they're like constant size and also like undetectable and that there's you know computationally hiding signals that we can start putting out into the world and then using this sort of like encrypted email kind of like querying we can just sort of freely discover Synergy in a way that is like safe uh consent is like

deeply baked into and potentially just like discover a lot more sort of serendipitous Synergy between people in a way that the sort of current model of social media with like public Billboards really just does not facilitate very well finally uh this's idea of narrowcasting so narrowcast is the opposite of broadcasting and this kind of really builds off this sort of like encrypted email idea where instead of just being dependent on like public feeds or group chats you can sort of just narrow cast information to the people that it would be most relevant to where you can be sure that you know only if they match the criteria that you've set for this data could they actually see it and interact with it and we also think this will enable lots of

interesting ways of connecting and coordinating with people that aren't easily available right now so where can you experience this technology um all of you can experience it right now um the app that all of you have built off the NFC cards in your badge have a bunch of these experiments and we want to reiterate there's some fun prizes for people on the leaderboard and right now the first five people who get to I think 33 was the number we decided um get to take home some NFC rings as well um which will be sort of Early Access to different experiences we're building so at Z Summit we've basically kind of just like thrown a bunch of fun cryptography apps into one experience but for Edge City Devcon and onwards we're building a more cohesive single app called cursive connections where you can sort of take your social graph from

many different events import data from many different places and essentially discover new connections you know learn more about different people in your community get recommended events and sort of a kind of holistic platform for a lot of these different ideas where exploring if you're at either of these events please come see us or come find us we would love to get you a chip get you started on this and yeah happy for any and all feedback finally uh we're very lucky to be hosting a really large booth at Devcon uh right near the entrance of the venue and it's going to be modeled as a museum exhibition focused on cryptographic connections so this is both like past uses of cryptography for connection like ciphers encryption even like ethereum uh demos from some of the sort of Cutting Edge projects in the

space as well as a bunch of different art exhibitions on just you know for different artist friends of ours like how they interpret cryptography connection and this sort of thing and we are actively trying to find collaborators to do demos to to make art pieces so please reach out to us if this is something that interests you or your company uh we would love to collaborate and make this school a little about cursive uh we're research and Design Lab focused kind of exclusively on these directions and yeah this is a place that's very near and dear to our hearts and everything we've described here has been the result of many many collaborations and we want to continue that going forward so yeah if this is a research or product area that is of interest to you or to your group uh we would love to try to figure out

ways to work together uh get this Tech into hands of more people and finally we owe a big thank you to privacy and scale expirations uh cursive is Grant funded uh from PSC which is a sub team of the ethereum foundation um the grant support is amazing it's allowed us to do very for exploration but the network of collabor and sort of positive sum public goods work we've been able to put out while being supported by PC has been nothing short of miraculous so huge shout out to them and yeah these are places to follow our work going forward thank you thank you very much do we have any questions otherwise I guess we're at

time oh here we go let's give you one second thank you um really interesting talk um I'm just curious what is a um like a ZK consumer um product that you would like to see in the world that maybe you in particular don't want to make but think should exist that's a great question um do you have a good answer what's up do you have a good answer to this ZK consumer product I prefer MPC consumer products I think well this is more of a

shout out like I think some of the stuff that the folks at ZK P2P are doing is really interesting um I think that's really focusing on the verifiability aspect of ZK which I think is a lot of sort of room to or like a lot of value to get from that um yeah basically enabling sort of more verifiability on data exchange and that sort of thing um also especially around High sensitivity data like financial data passport data that sort of thing I would love to see more ZK on and yeah I think in many ways we have chosen not to focus on ZK because a lot of the stuff we're working with is more social and personal in nature and we think doesn't benefit as much from um zkps as some of this other stuff but uh yeah we think there's a lot

of cool stuff to explore I think last question and then L great um was wondering if you if Trinity can in any way counter like the raidering attacks that you have with PSI like you just create a lot of uh sham accounts um and try and see how you intersect with someone like with triangulation yeah that's that's a great use case of this sort of verifiability and it's a it's a big sort of bug of the current PSI actually one thing I'd like to shout out is um a project called Greco uh built by Tima is now working on new iteration of it off of work from enrio and J maaya um that's one that is

basically doing a similar thing where it's proving that data has been encrypted correctly as inputs into a PSI into an NPC so yeah ZK is a super important tool uh in all sorts in like all these crypto systems in basically ensuring that the Integrity of this stuff is is is strong because you can basically just do more meaningful computations that way but yeah that's that's a great use case number two thanks let's thank our speakers once again thank you very much [Applause]