"Crypto Means Cryptography" - Jan Camenisch, Head of Research at Dfinity

Transcript

hello and welcome to the blockchain and us we're pioneers and thought leaders talked about their journey in blockchain technology crypto assets and a token economy and I'm your host Manuel stutters this episode is supported by 21 lectures 21 lectures mission is to bring more developers to the Bitcoin ecosystem with in-person courses lectured by world renowned Bitcoin and lightning developers courses teach participants the fundamentals to work with blockchain technologies to learn more visit 21 lectures calm my guest today is Yann camenisch Yann is head of research at Definity and

director of the Definity suruc research lab and he also serves on sovereigns technical governance board before joining Definity Yann was a principal research staff member at IBM research in Zurich where he led the privacy and cryptography research team and was a member of the IBM Academy of Technology Yann is a leading scientist in the area of privacy and cryptography he has published over a hundred and twenty widely cited papers was granted over a hundred and forty patents worldwide and has received a number of awards for his work and now to the conversation with Yann Kamini Sh hyeyeon and many thanks for taking time

today well thank you it's a pleasure young you've been working as a researcher at IBM for almost 20 years and now you switched to Definity one of the few billion-dollar blockchain projects here in Switzerland why did you make this move well yes I was surprised myself to some extent yeah 20 years is a long time and a certain point drag when you're persecuted come up sort of jumped on it because it's exciting it's quite different and I thought okay after 20 years doing something you might be I

might be good refreshing and also of course since there's a lot of crypto and I like to do cryptography I should say I like to do cryptographic protocols and there's a lot of that in divinity so it was a very very nice opportunity and I enjoy it a lot what exactly are you working on currently at divinity so we're I mean there's lots of use cases of a cryptographic protocols at all layers here and so essentially we were looking at the whole system that the divinity is

going to build look what the crypto problems there are analyze the protocols that have already been implemented make sure they are secure improve further protocols or design new protocols and proof those secure and what are the current research questions you know that you that you work on here actually I mean we put a lot of the research questions on hold because we won't want to launch a platform and we'll make sure that that platform is really secure I mean it's this has like financial value attached to the whole platform and so therefore I mean you need you need to

see your dad so securities is important yeah and so from that point of view most of the questions are not so much traditional cryptographic research question but but really like analyzing the protocols making sure that the security is all fine maybe coming up with some new security models because yeah how can you analyze some of those protocols it's a bit different from maybe what you would traditionally very yourself as okay here's your normal well-established security models and now yeah you need to take some things but they have a different view on things it

may be someone here here is there too and to be sure that things are okay but that's that's quite different probably from what you've been doing it IPM I mean I guess there it was probably more of a research focus on fundamental research I mean that's my impression that I get but how is your work different here from what you've been used to at at IBM sometimes of course it's different because we were building up a company we were interviewing people a lot looking for the right people to to work with us helped us launch the platform so that of is of course different just because of the scale I mean at IBM I was Celso running research

projects hiring people but just maybe like two people a year if there was a new project here it's it's more like 10 people a year or even more I mean how big is your team well people but that's just a research side that will be more people here in Zurich office we were growing up to maybe 50 people by the end of this year but this will be engineers working building the platform together with researchers and so maybe one things that is really different here from from

at IBM we were sort of the researchers and engineers are all under one roof here and much closer collaboration on building that stuff so less of an ivory tower sort of setup wasn't that much of an ivory tower Hiram and it still was a commercial entity right and so we we did some well some of the research was fundamental research and some of them what was a long-term research with a lot of the research Gary's also geared towards Clark to that point of that focus it is the same and it was what I

did at IBM and was always concerned about practical protocol something really it's also real-world problem that can be used in products but it's like here of course it is much more direct right you know that if yourself a problem and then it will be in the product immediately because you're working with the engineers to make that real or if an engineer has come up with some solution to solve something then then you look at that directly analyze it and maybe improve it or maybe you say okay it's fine actually a great solution it's much more direct obviously it's also much much smaller company right I

think that's an interesting point that you brought up there use you spoke about the input the direct feedback that exists between engineers and the researcher and you already had that at IBM here maybe more but of course if somebody's researching at a university they don't have that at all so how important do you think that feedback loop is for the quality of the research go both ways right have to if you completely disconnected maybe you might solve some problems that are completely irrelevant and that don't have any applications that might be nice

academically because here you're satisfied because you saw something in the nicest possible way and you're handy if you're somewhere where you have a close relation and of course you're much more focused on just self in exactly that problem and maybe if there's some time pressure maybe not in the nicest possible way but I think after all so if you do more in industrial research you should always take enough time to solve it in the right way to make things whole I mean to really have like take a step back think about okay so what I am I doing here does this make sense if that's how it should be and then because only that

I'll make sure that and that what you build it will really be secure because if you're too much down into it you might miss a lot of things and so I think that's still the same so I think at the end of the day it's not a huge difference and the universities have to do profit as well they have to get some external funding increasingly as well so I don't think okay if I would say like the difference between IBM and the university research it's probably this very very close I mean right I mean if you're in a company you might be closer to getting stuff into products but on the other hand at university you can do like spin-off startups so fro late at

the end of the day as long as you're doing research and publishing papers it's probably the same in most places let's say you work on a new research project here at Definity what is the process that this project would take over the course of its life maybe not a typical way to go about it I mean there's of course a few things that I mean like a research methodology that you learn also a commitment to young PhD that sort of the apart from having research results is the most important thing that is a human maybe I have to learn how to look at things and how to solve things but then how how you come out with a research question might of

course differ quite a bit right you might like walk walk home or walk work and then start to think okay right actually there we have an issue there's a problem here then we need to solve and so somehow the first step is always I guess recognizing that there is a problem something that you want to address it could be something that is immediate because an engineer tells you look I don't really know how to solve it could be because there have a solution and then you think about well that solution actually doesn't really solve the problem so the first thing the most

important thing is really to recognize the problem to see what how does the problem look like what is the problem really what are we trying to solve and what what is to prove the most difficult is I mean what kind of security features do you want to have because ready I mean you have to get get in some sort of a paranoid mind as well right you have to think okay what could people do here if it was called people and what could go wrong so you not only have to you have to figure out what it should do but they also have to figure out what shouldn't be possible right so that's the most difficult part probably and all of people probably underestimate very often

right because I had that's the solution you think but the whole process really clearly phrase the problem is a big part of the research thing and then obviously you need to find a solution you need to solve that you need to find a way to cryptographic protocol or another protocol mechanism to solve your problem and then you have to show that this problem actually not only solves the problem for molecular function l fortune ality point of view it does what it should do because that you can just test but you also need to show that it is secure so that all the other things that you thought so it should not be possible can't happen and that again is a whole new challenge and

[Music] and sometimes you need to go back and realize okay I can't quite solve the problem that way and so I have to rephrase the problem certain it's a cycling back and forth I think that sort of the typical approach that you always have to do yeah I'll tell you if I have other things did he go back to it an engineer and say look here's how I think we could solve that actually it works out it's secure but then you might have overlooked some like realization issue seriously let's make sure it's not practical at all you couldn't implement that for this reason so that there's all that you need to cover them it's a very interesting but also very satisfying job

right I mean you can you can be very satisfied if you solve a hard problem that you came up with so a lot of recognition there I guess as well cool what's the recent heart problem that you that you solved one that's maybe particularly interesting well I can maybe tell a bit from for the time at IBM there and I mean I think that's easier to talk a lot of things that we solve the disability right now I mean we're still be rebuilding the system so we can't talk about all the things right now it will do eventually I mean of course it is important that you always publish your your your security your group the protocols that other people

can enter them as well but one of the one of the things that I liked a lot is my work on identity and privacy preserving identity which I guess I also hope to be useful to defeat it at some point and but it sort of shows what what exactly what exactly was that I mean right so the idea there is that if you use your identity online you know you quite often reveal more information than necessary so one of my favorite tracks up is for those who were old enough to remember when you rent attack

at a video rental store right Wendy could watch all the movies and he would go with the empty empty box to the clerk and the clerk would say well this movie have to be over 12 for this one we have to be over 18 of course you also have to be a member right and so you would have to show your membership card you would have to show your magic card it would verify those things but of course at the end of the day it wouldn't remember any of that maybe would know time which movie you rented we have to give it back but if it was same online of course if you do something digitally I mean all this information gets stored on a server somewhere and that server has to be like online 24/7 because they want to rent

out movies right so it has to be highly available and that's very hard to protect so you Lee and if you send your all your data there you leave it there and that makes you very vulnerable because now potentially everybody who works that server or if they don't care for his backups that information spreads and then digital information is very hard to to keep at a place because it's easily copied and then so and actually people want to make back off so they don't lose it because you can also easily lose it yeah so what I was working on it is and typical crypto problem in some sense well how can I convince online that the movie rental service that I have all these properties without actually revealing all the table

because that's all they needed to know right do we have the sufficient attributes over 12 subscription at right kind and they didn't know that the exact well it's just need to know that that's satisfied and so what we did what I did there was like my colleagues coming up some crypto protocol that they could just transmit that single bit of information yes I am allowed to rent that movie without reading an audio all that other data and it seems very paradoxical how could you do that I mean if if you if you want to learn whether somebody's solar energy you need to see their birthdate right but that's the cool thing the crypto allows you to do

it allows you to sort of Arana cryptographic protocol such at the end of the day you would be convinced that I'm older than 12 but you even see my birth date or anything it just would know that I got an identity card from the government issued that has a birth date on it that is further in the past and twelve years and so I can run a cryptographic proof protocol with you and that convinces you of 10 and if a little bit we're doing similar things in some sense its cryptographic protocols make sure that everything was of a stole okay without revealing and too much information so you need to protect things at the end of the day so I guess that's another buzzword today apart from

blockchain I think everything is zero knowledge and then people or happy about that but indeed so that's why I guess this whole blockchain world guess we wouldn't even say it if you need to block chain it's like an internet computer distributed computer so distribution is really a way to make things secure without without the cheaper cost right I mean you can make some a single server secure you can try to lock it in you can try to disconnect it from the network and all of this stuff but that's that's very costly so much easier ways is to distribute that computation such that unless like a

majority of these computers or or hacked then the overall system is still good in that that's really what what if you want to say blockchain in some sense is all about it's about distribution of trust so that you can protect the system in a cheap way at the end of the day now we're already talking about what Definity does what makes Definity special you know in comparison maybe to other blockchain projects around so what would I really like about the feelings and what was one of the reasons that I joined was that it's unique and in terms of tuition writers there's wish we're

gonna build an internet computer like an online computer that's highly available that's highly secure right much better than anything that you see so far so I like there's a vision that's what we want to achieve there's other projects that they're much more limited in scope which of course on one hand it's much harder to build this but I mean it's always good to be very ambitious because then I think that's the best way to do a chief nice excellent results the internet computer that's what Definity wants to be yes so build the sort of a secure computer by essentially by a distributed distributed

system that runs computation distributed ly and so therefore making it secure right so if you have your own computer at home and then of course there's issues likely to make break down and you might lose all your data right and then you're cooked so maybe all right there because I just do call to computers always make sure that there's a backup that's already good idea but still still at your home if there's a burglar coming and taking both computers you're still cooked yeah and so many quickly come up with okay babe it's better idea if I put that computer with like a friend of mine and suffer so then you're getting towards the distributed system right and

that's also what is nice from the cryptography a point of view distributed system this tribute cryptographic protocol and that's really what they feel it is about right we want to built a distributed computer that's very easy to use you don't have to worry about the computer crashing ever it won't crash you don't have to worry about backups because it won't lose data and you don't very how to about to upgrade it because it becomes too slow it's it's all building right so it's you don't have to do any maintenance it will be highly secure it won't lose data ever there's no no attacks be possible so from that part of its the best thing ever I think

everybody wants to have that and we gonna build let's take a quick break and we'll be right back this episode is supported by 21 lectures 21 lectures mission is to bring more developers to the Bitcoin ecosystem with in-person courses lectured by world renowned Bitcoin and lightning developers courses teach participants the fundamentals to work with blockchain technologies 21 lectures covers cryptography the structure of transactions and blocks and how they are chained smart contract language the lightning protocol as well as software and toolkits to develop on top of the blockchain and lightning to learn more with it 21 lectures dot-com so from the

best thing ever I think everybody wants to have that and we're gonna build that mm-hmm but I'm sure there's still several gaps you know between the dead vision and and actually building it and then that's probably what what you're working on good to have a vision it's like okay let's go and land on the moon and if the situation eventually you build it right and then so there's a lot of a lot of things that you need to figure out you don't need to do it right and you need to solve a lot of problems and so that's really what is nice here is we've ever and we're having this vision we're building towards that of course step by step right we just don't

take a plane and try to apply to know more but we will think about it ok so good the way we need to have a rocket we need to have a moon land or all these kind of things right that's our goal what do we need to build in order to go there and that's what we're doing currently renters are designing the overall system then building building it parts by part do you but do you publish do you plan to publish the research so doing now right we're sort of analyzing the disk protocols or bills and its best finding protocols it makes the security pros and tougher or novel protocols that obviously and we need to publish them because I mean a

good way to do to do security not only by doing the I mean you need to prove Santa models correctly all of that but also other people should be able to read that because at the end of the day we're all humans we do make mistakes and so like it needs to be peer-reviewed other people need to look at that maybe they have ideas to improve that so that's the normal research project or process that we're also heavily subscribing so definitely we will publish our results one wants their aerial so that right now we're focusing on building launching our platform and so like smoothing out making all the papers all the research

we do readable accessible that's still like quite a bit of a step and shouldn't be underestimated that the time it takes to write something nicely to explain it nicely to make it understandable it's very important too and so we're gonna do a rabbit it's just right now we were focusing on on the world and the content rather than the presentation okay cool so you know maybe maybe if we look beyond affinity at the whole block chain space at the whole crypto space what do you think are important questions there that need answers blockchain was another thing the blockchain now and purpose it

was very great for cryptography right so it's a it's a lot of like he's inspired a lot of new work a lot of new thinking and get started by the whatever by the Bitcoin protocol that people are talking about this is a new approach how to to design a distributed system because normally you would say okay here's the and partyís and they run a protocol together but of course then they always have to know who the Empire servers in bitcoins of that that problem was defined a way because whoever has a lot of computational power is one of the parties so that was totally a new approach and I think that that was really needed to

ignite it is distributed computing Welland distributed systems as well as cryptography gives a lot of new import and I opened up tons of new research questions some of them are ok so what are the exact security models here that we have to figure out how to how to go about proving things secure what are the assumptions some of the typical traditional models don't quite fit or they're too strong not allowing for good protocols so there's a lot of like new questions there there's a lot of other problems like how how do you build a

system a lot of like I mean you have to really dig down and once ok in the interworking so for all of these things in order to but the closer you look the more problems you're fine right well Security's one right and currently I think many people are looking quite closely at security but what's another one that you know doc chains need to become more you know useful and mainstream maybe like what is the killer application and that's fun but I'm really for our application if you think about less and sometimes any registry is

already an application how we could you know a property registered that right now or like very very decentralized but in other way right so it's it's like every community he runs their own system maybe they have it in a computer maybe not and if it's on a computer is it secure so that's like one application they could just roll around like a blockchain kind time protocol and just have it more secure and more available at the same time so I think there's really a ton of problems that ton of applications that you could just in sort of a much better solution to you use a secure distributed

system but of course they also look how do you build these things I mean it's not so easy either I mean of course for some of the things maybe blockchain wouldn't be the right solution for all things difficulties but it like many things that it's not like a big hammer that you can just hit everything you need to be a lot of more careful design what are the properties so you need also but what true the platform provide right I mean sir if you have something like Memphis and all of you have to look at something like the affinity platform like a computer by itself it's it's helpful but maybe it's not all that helpful it's more key if you look at the maybe Apple App Store it's in some sense

like the iPhone is not a computer but it has to say ecosystem around it right with can put apps there it has billing and all this that's something what you need you need a whole ecosystem for things to really lift off because with a better computer just by your computers and take it home hardly anything you can do with it and so you need to have like applications that are useful and only then you can really build something I think that's second order what is the right set of applications how to get those applications that's like we don't run out of work any time soon so there's a lot of stuff to be done yeah good point there is obviously a big blockchain and crypto community or that's quite global but is there also a

research community you know where you exchange ideas maybe with other researchers from other projects there's the cryptography community one of each I was lucky to be part last 25 years move if there's three conferences three big conferences every year one in Santa Barbara in the u.s. one some point at some place in Europe its various one one in Asia Pacific mostly and that varies that's where people meet and there's more specialized conference so more specialists or a block chain then distributed system conferences rich research lives on and those conference relevant that they meet

exchange results and of course the some of that has been hijacked if you want to say by the blockchain movement some people some people are already are a bit worrying about that it takes I mean some researchers I mean right I mean you see people teachers crypto means cryptography has been hijacked to mean like currencies rather than cryptography it's very good a lot of inspiration is lively even if people had asked me should I do a PhD in crypto ten years ago I would have said yes but I would have worked a look at it it's tough field sort of the big problems have been solved or maybe quantum computers is

another thing that the that helped to ignite that as well so it's there's a lot of new cryptic questions that around quantum computers and how to collect against that threat if it ever exists but I think this whole blockchain movement was a difficulty not a big game changer and that the cryptography community benefits a lot from that as well cool young did you always want to work in research I guess I don't know I grew up on a tiny little farm in the mountains right so and I record all summers we worked on making hay and all

that kind of stuff so was the but then yeah I liked math and I liked doing that big satisfaction I also like to do build other things that's what you do on the forum as well right I mean you fix your own things and there's always stuff around because we always had some boots and nails and hammers and saws lying around so you could build stuff so I was like building stuff but then but that's the time I did not have a clue what research was about any even even though that universities just would exist yeah but then I mean I thought I would like to dig more into mouth and so I

went to gymnasium did there and that I went to I went to study was a study math but then I decided the electrical engineering would be a more interesting because I had this maybe stupid pictures at math you would end up as a teacher like insurance mathematician which sounded really boring so I didn't want to do that right but maybe at an end of the day math would have been maybe the better choice for as a cryptographer anyway but but then I sort of written into electrical engineering but then I realized that I'm really more interested in in research discovering new things and just I shouldn't say just I mean it's engineering it's also a nice job

but I sort of figured it's more of the same so you applied skills that you know but you don't really learn new things at least that's what I thought at the time so I thought I will really want to go into research to discover new stuff to solve there and so yeah that I ended up doing research and somehow by coincidence more or less and to help to encrypt oh but I really love that that great field yourself is a paradoxical problems those things that you thought was not possible to start with and then actually yourself that so that that's a very satisfactory cool as a researcher what in your view

are the most important skills persistence you should not give up I think that that's something you have to have some yes I'm storming out there but also you need to be able to structure problems to analyze things right you need to be able to dissect things sort of question yourself all the time is this the right way to think about it I think it's it's a hard job in a sense you you just can't go home and switch your brain of it it always sort of follows your itis it's maybe more and more an attitude denature francis if you can know a way of living in some sense

you're always think about your problem is always somewhere in your mind right guess your family has the mind is thinking about yeah and you can you learn that skill or what do you think that's impossible to learn different approach to certain curiosity i think you have to have ram and of course there's a lot of things you can learn about how to do that I mean what's the procedure sometimes you can learn and because many things you have to have a talent and then you can learn things and if you have a big

talent but you don't learn the right things you're also not good if you learn all the things but you don't have a talent maybe maybe go quite far and there's different kinds of talents and doing things right instead of doing the right things yeah successful research you also have to do the right things because if you do something that nobody else is interested in you will be frustrated as well nobody cares about your results at the end of the day there's a bit of that as well yeah the end of two days already needs to pay your salary and if nobody's interested in what you're doing it's

probably also very hard all right and and for that it probably needs more than a curious mind to be a successful researcher I guess yeah I think that's something you can learn or also depends right I mean depends on vary or somebody coaching you depending greatest research but don't know how to sell your stuff then maybe you you need to go somewhere where there's somebody that you can sell your stuff I think it varies there's a whole spectrum there right I mean if you if you look at the research communities there's all kind of people and they're all successful for maybe for for different reasons and different yeah cool what are you you know in your work

or also in your life what are you currently learning the nice thing about research is always like new stuff to learn of course now now being at Definity it's a start-up it's a quite a new life I mean I mean also IBM was an American company or person us before prep analysis Silicon Valley group that is quite different it's also refreshing and of course you can tell also I can take it with the sense of humor like how things go there yeah I think everybody in some sense regardless of what you do

we also if you you see always learn new things and but now I'm very lucky that different environments and the things are changing all the time it has downsides value I mean any backups or things are not that they used to be or things change no but it's really exciting and there's so many things going on so many opportunities to learn today's are almost too short to deal with all of that mm-hmm unless you don't sleep unfortunately where do you think all of this is going I mean either at affinity or also in the blockchain

research space what's on the horizon there well I don't have like a crystal ball right but I mean at the end of the day they support computing as a solution to make things more secure Tripper that what won't go away that something will start and think of course we are somewhere on that typical hype curve I think I don't think that blockchain or distributed computing in that sense is different from anything else but it's really it's because the world has realized this is a promising technology there's a lot of benefits on doing that so that is there and we'll see

applications in many areas it's gonna be used we'll have the internet computer everybody's going to use the internet computer because it's so nice you said not to have to worry about very computers are of course when and what the timeline of that is we will see when we don't know yet divert it but things are looking very good so and we're very positive yawn this was great thanks a lot for taken thank you thanks so much for joining us today more info on our guests and our sponsors is in the show notes of this episode and on the podcast web site the blockchain and us comm to help people find this

podcast it's important that you download subscribe and give it a top rating and review on iTunes or on the podcast platform of your choice I'm Manuel staggers and I thank you very much for listening you [Music]