DAPPCON 2018: 10 Privacy by Design Platform - Amira Bouguera (Amazig)

Transcript

Emira bugera so I'm a cryptographer at consensus I've been at consensus for for about almost a year right now and I'm working on privacy related issues on the blockchain in general and mostly etherium and today I'm gonna talk about the platform that I'm building which called hellhound to implement privacy by design tools which are cryptography tools for developers to use them so let me just give you an overview about what I'll be speaking about so I'll just go an overview about privacy what is the cryptography role in privacy in general and what are the cryptography primitives that that are needed to be implemented then I'll have I'll talk a bit about the state state of the

ecosystem in general and some of the weaknesses in in the cryptographic softwares and the Hat and then some of the famous cryptography hacks that happened in the past and then last but last but not least I will talk about hellhound platform and what we offer with our platform what are the features we offer and also some of the decentralized computing cloud computing services that exist already and also by the end I will tell what are the next steps for for our projects so let's start so what is privacy so many people ask this question and they also say we

want to intruments privacy by design but do we really know what means what does it mean privacy so privacy it is a fundamental right that should be given to every single person to every one of us and we should be able to control whatever we want to share of information with those who trust and whatever we want to keep away from those who we don't and privacy what does it mean privacy means power and the more we have the more power we have over our lives in the last few decades some of the most powerful institutions and governments have tried to manipulate people and make make sure that use this data against

them in some of the social engineering methods in order to extract all sorts of data of people and then use it against them to create an online double gender of this person and manipulate it afterwards and make them do whatever they want so and and in fact they managed to do that and how do they do that so they collect data over our phones they collect data from from the website from Facebook from all over all from the Internet and they they will be using this data against us so how do we protect ourselves so what should we do so privacy program in fact is dependent

on a security program because security we use it in order to be able to encrypt data to make sure that this data will not be shared with anyone so in fact also a security program is very dependent on cryptography so what is the role of cryptography first in cryptography what does it mean it means that it's it's a method to be used to cipher some sort of messages which means between two people communicating between each other's and they want they don't want a third party to know what they're saying so they will add some mathematical functions to this information and then a third party will

not be able to read what's what's being sent in this information so now some of the most famous cryptography tools and primitives that are being used all over the place and mostly I'll be speaking of those we are talking all about in the blockchain space so let me just start by a question so whoever knows have ever heard about ZK snark or ZK start or what is the difference between them could raise their hands now who knows what exactly means and what is the math behind each of these protocols could raise their hands

not that many so maybe it's not important maybe it's not important maybe you don't need to know the math behind you just we could just use it so let me just give you an overview of what is ZK snark and ZK start so zk zero knowledge protocols in general our methods that we use in order to to prove to another part to another party in the system that we have some sort of information for example and we don't want to share with them this information but we only send them a proof that we have it so that is the general idea so they should be sure that we have information without us having to

share this information set the general idea of zero knowledge protocols what is ZK snark so ZK snart is a protocol that it's used to prove the identity of a person to another another person but and then the other person will be 100 percent sure that is that identity without us having to share any information about the identity we just share a proof of that so ZK Stark is something similar but there are two different protocols what is the difference so two of them are non interactive protocols what do we mean by that it means that in order for two parties approver and verifier to

community they need to communicate in order to send some sort of challenges to make sure who who said who the person says who he who he is then his his correct and he needs like to prove to prove it but non-interactive it means that we don't have to send go in and forth messages between these to prove ER and verifier so which is perfect for the blockchain system so we just publish a proof on the blockchain and then ne veut fire at any single point of the time will just come and verify this proof so both of them non interactive protocols now ZK start in fact and one of the biggest problematic since Iike it's not that it needs a trusted set up so what is the trusted syrup it means that some

of the third parties will work together to create some to generate some algorithm for for proving some algorithm for verification and also some secret value the secret value will be used afterwards to generate this proof now why it's problematic it's because in in ZK snark and especially for Z cache the cache protocol if you you may have heard of it that they use ZK snark is that they they say that we suppose that this set up trust a set up phase is secure which means if it's not secure then the whole protocol is gone and we could generate fake proofs so if we say that these third parties who can loot together to

generate some value maybe could pollute maybe like the government's could control them ne or and then we could have fake proofs for example voting system or something and also something not good about trusted setup that it takes so much time in computation which means big complexity now ZK stark doesn't need such doesn't need such such a set up phase also quantum safe what do we mean by quantum safe we mean that we have some sort of quantum computers that will be able to to break some of the some of the cryptography algorithms break the security that's behind them Zika is snark in fact they're not quantum safe which means these quantum

computers can break them and we could recover the secret value so how why they're not quantum secure because they're based on cryptography algorithms they're called pairings so pairings in fact the security assumption behind pairings is the computational diffie-hellman which means let's say I have a point on an elliptic curve for example P and then I compute this value P with some random value alpha and I also compute P with some random value beta the computation that if you have a problem it means that it's hard to compute alpha multiplied by beta multiplied by this value P which doesn't seem like very hard but in fact it is so

this is the security that's behind pairings and also this it is also it means that also it depends on discrete logarithm algorithm discrete logarithm problem which is breakable by quantum computers will be able to break the discrete logarithm which means in the future these could be breakable now ZK starts are not breakable because they only use hash functions and they are quantum safe so this is just an example now moving to the next primitives who here knows what is a morphic encryption or multi-party computation not much now who knows what one of them means or how what are the

use cases okay I'll give you some introduction about it so what is a morphic encryption in fact it's an encryption method that allows us to to apply some sort of functions over encrypted data so the encrypted data in fact will be random and in fact you cannot really apply just a function on some random values that you cannot even read but a morphic encryption allows you to do that so meaning have some ciphertext one ciphertext to computed with the same encryption algorithm that you will be able to apply some sort of function f may be like multiple multiplication addition or any sort of operation and then the value that you

will get at the end by applying this function over encrypted data if you decrypt it in fact it has the same value f as if you applied the function over the data in plaintext so why it's important now just it'll give me to give you the RSA example RSA it's an encryption protocol so as I say in fact the encryption method is we have a message m and then we do empower some explanation e which is a public value and then we do this and that's the encryption of M so if we do encryption of m1 encryption of M - if we multiply the first encryption with the second encryption in fact the value that we have it's m1 x m2 two of them power e which means as if we applied the

multiplication over the plaintext in fact so this is the multiplication property that some protocols has and other products have edition property that you could have like addition on ciphertext so why it's used let's say for example you'll be able at some point to send in encrypted data to Google say I want to search something but I don't want to Google to know what I'm searching for and boodles it can send me back the results and give me what I searched for without them knowing what I worried what is the thing that I was searching for it's perfect right not really well it's still in research phase these sorts of protocols but so anyway so I was just giving you some sort of example

now how to use these protocols how are we able to use them in fact if you don't understand the math now as I said before maybe it's not important maybe that we don't need to to understand what's behind it now I'll give you some examples of why we need to understand this math or we need some people to understand it I'll give you some example about the weaknesses in cryptography software that have been caused because of this ignorance the first miss some mistakes in the implementation of cryptography protocols caused by developers who don't understand what is the what exactly the protocol means and then I'll give you an example about flaws in protocol layers such as ccpe TLS and then side-channel

vulnerabilities that are on hardware let's start with the first one some map ok let's start with the first attack in fact that happened in the PlayStation 3 so what happened in PlayStation 3 that some attacker was able to have root access and was able to recover and to recover the private key of the signature and to have root access on the PlayStation 3 so what what happened in fact before let me just give you an overview about the ECDSA algorithm that was used for generating these signatures so we choose a random value K for each signature that we gonna go in to do for each new signature and then we compute some R value R which is

K multiple by GG is is a public value in our in the group that we choose to use and then we compute some are which is uh which is the point of our model or some cue and then we compute the signature which is the inverse of this random value multiplied by the hash of the message the hash of the message we it's public value because the message is public and then the hash we can compute it ourselves plus R which which also was generated from the big R multiplied by X which is the secret key in our algorithm and then we output the signature now the vulnerability was that Sony was using in fact the same random value K and they were not generating a

new value K each time they were computing a signature so they were using the same K so what happened because of that so if we take a first signature s1 so it's K minus 1 multiplied by the hash of first message plus rx the second signature is also K minus 1 just because we use the same random value multiplied by the hash of M 2 plus our X Y is the same are just because we use the same K and then it generated the same big R now if we do s1 my as my s2 we recover K minus 1 multiplied by the hash of M 1 minus the hash M 2 s 1 minus minus MC s 2 is a public value it's the signature the hash of the message the first

message the hash of the second message also is a public value so which means we could recover the inverse of this K which means we could recover the K and while we recover the K we just apply it to the to this algorithm and then we could recover the secret value X and then we could recover the private key so that was an implementation invitation bug that happened because developers just didn't understand that I needed to generate a new value each time now let me give you a second example about one of the most famous attacks that happened on the TLS transport layer which called the heartbleed so what is the heartbleed attack in fact it was it was applied on

the heartbeat heartbeat extension on the open SSL library in TLS so the heartbeat is a way of keeping communication alive between a server and clients so what the client sends he Center some sort of message let's say okay and okay has two bytes and then the server will just reply with the same message plus the same size now in fact the attack what was is that the attacker sent a message okay but the size he sent a different size this big big big size and which is not the size of okay of course so if he sends at the server the bug what it cost it cause that the server would reply with okay and then

replies with values from the memory of the memory of the of the server of all the messages are unencrypted messages that were stored just sick he just sent the correct value the correct size of what the client asked for what are these unencrypted messages that could be passwords they could be private keys all sorts of unencrypted unencrypted data so that was a certain bug that was an open SSL cryptography Kleiber ease also because of implementation problems a third example with side-channel attacks that happen for hardware let's say smart

cards some come compute computing hardware solutions so what happens I'll give you just an example of these sort of attacks the sub for example at power consumptions and this is this is a sort of attack that could be applied so we just like calculate the power they cancel the consumption for example at I mean of consumption of the of the functions that we calculate say say multiplications Aquarion that were the hardware will execute to kill to compute the private key so in fact in the eros a protocol in order to compute the private key we just

take them the the encrypted messages that I showed you before which is M multiple by E and then we just sorry explanation in and then we just do in a second explanation with D which is the private key so in order to compute this private speedy so what we do in RSA we use five squaring and one multiplication so when we measure in fact because squaring and multiplication have different measures so we will be able to find the multiplications that we're done and since the multipliers that have been used are only to read as we have 32 possibilities of multipliers then we will be able in fact to recompute the

private key from such from such a flaw now I gave some examples now I'll let you know what we proposed in our project in hellhound so now what can we how can we do how can we help developers sorry can do for example like a morphic encryption zero-knowledge protocols apply these secure multi-party computation which I haven't talked about but maybe in the next time in the in the easiest how can they use them in the easiest most secure and efficient way according to the current state of the art of of these protocols and without them having to have the all the knowledge of the math behind it because

I just give you some really simple examples of the math mathematic behind these protocols and it's more and more more complicated than just these so how can we do that well hellhound is your solution you just use hellhound now what we offer we offer a recommendation engine for cryptography libraries what do we mean by that is that for example a developer would say I want to do blind computation I want to I want to do I want to do computation I don't want to publish my data unencrypted and I also want to verify this computation and I it's ok I don't care about complexity I care more about privacy depends in what

you care about more and more so then there is an algorithm that will be running and will be choosing from a certain database what sort of libraries that will be better used for what you need and then it will give you back a result it will not send you back the result it will just tell you okay we found a perfect solution do you want to use it and then after that we have a network that will do blind computation using amorphic and multi-party computation protocols and then verify these these computation and also we have verified crypto libraries so what do we mean is that all the cryptographic

libraries that exist so far especially for these new protocols are not verified which means they could still have some of the security bugs that have just not people have just didn't find them and we propose to do verification for these libraries in order to mitigate against some of the side channel attacks some of the cryptography implementation of cryptography protocols and this is just an idea about the architecture we want to create so the clients would communicate and then there was the recommendation engine and will it care check with the state of the art and then we could do computation with multiple nodes with multiple hellhoundz knows and depending on their reputation depending

it's also depending on on a consensus protocol behind these nodes how do they compute and also stakin system in order to make sure that these nodes are honest in doing the computation and then we publish verification afterwards to the blockchain and then we get result and then verify it so that's just an overview of what we proposed now some of other ideas of all the already existing platform that do these type of computation such as Gollum who were presenting I guess in this conference I exact enigma enigma' in fact they were doing also of change computing but

they're using hardware solutions we propose something different we propose multi-party computation to include different nodes to be able to do to do this computation enigma will be mostly focusing on their private smart contract platform also I exact which is a distributed platform for doing computation so these all are different projects they propose different solutions for these similar problematics that we find right now in the blockchain that we have privacy issues and also scalability issues we try to solve all these problems and some of these projects proposed solutions and we are one of these projects so what are the

next steps for our project so we'll be launching our version one of the crypto map of what we will be using as primitives cryptographic primitives we'll be launching it and get up by September and then we'll be releasing our white paper by the end of the year and and then this is just the beginning and just stay tuned and these this is the team so we are just two people so we are two people a cryptographer and blockchain architect and we are based in Paris but we are part of a bigger team called its compute which is at consensus and we work on on distributed computation of change computing solutions on the blockchain

also privacy related issues so join us and let's build privacy by design now we are currently recruiting please check our offer and please if your full stack developer please check our offer and join us to work together thank you everyone [Applause]