DAPPCON 2019: Private Computation for Smart Contracts - Ainsley Sutherland (Enigma)

Transcript

hi everyone my name is Ainsley I work on the product team at enigma um and what enigma does as we just mentioned is we try to enable private computation for smart contracts as you know data on block chains is public by default that includes your transaction data it also includes any data that you put as input to smart contracts and so that is something that really limits a limitation on the types of applications we can build and what we can do with applications that already exist this is the problem that we're trying to solve so the Enigma network which has a network of nodes that are enabled with trusted execution environments handles the private computation aspect of an

application and we rely on the indictment chain for the verification there this is we currently have a discovery u developer release out and this network will be permissionless it's economically incentivizing a proof of stake model and most importantly for this talk it's compatible with etherium so you're able to outsource the parts of your contract that need to compute over private data to our network and then call aetherium functions from the secret contract so when you're ready to return that data back to the in from aetherium network so the best way to kind of explain how that works is through the perspective of the stakeholders in the network and that includes developers who deploy

applications users who create tasks which basically a unit of work for the nygma network and the workers who then execute those tasks developers deploy contracts to the Enigma network they write these secret contracts which are written in rust and then compile them to bytecode and deploy them on the Enigma network they're registered on an enigma contract that lives on aetherium and that manages those contracts users are able to interact with these applications by submitting encrypted data to the secret contracts on enigma and a hash of that data will be submitted to the enigma contract on aetherium so that it can be managed from there and then once the yes and so then

finally we have the worker who has this data now workers receive tasks based on a stake lottery whatever worker is selected is able to then execute that task and propagate the results across the peer-to-peer an enigma network the worker also submits the results back to the task sender and optionally calls a function of an aetherium contract with the result after the task has been verified by the ending the contract on aetherium the payment is released back to the worker so just to review this users are able to submit encrypted inputs the worker executes the computation updates the encrypted state and then returns an encrypted output

back to the user it can also make Anitha nerium call back and that allows you to run some business logic privately on enigma and then return the non-sensitive result back to the theorem for further processing so I'll talk a little bit more about the process by which this encrypted data gets sent to the network and just to review this what needs to happen is it the encryption of inputs has to happen on the were on the user side so we have a client library for that called enigma Jas the worker needs to be able to decrypt that input in a secure environment the worker needs be able to perform the computation and then Rhian crypt that data for transmission back to the user who then needs to be

able to decrypt it and read it and so this is how that process works first the client requests a worker ID from the enigma contract on aetherium once that user has the correct worker ID they perform a duty Hellman key exchange protocol every computation uses new keys and a new encryption process following the key exchange those users are able to exchange encrypted data so that's kind of an overview of the data flow in our network and I'm happy to go into more detail with questions afterwards but I also find this stuff to be more clear through an example and happily we have one of those and we just finished it earlier this week so this is a coin

mixing demo that we made and so just to just to recap enigma provides data privacy so that means that any type of data that you're inputting to the contract is encrypted but we are using that affordance you know to create transactional privacy so as you may know coin mixing is one way to achieve transactional privacy it obfuscates the history of whatever transactions have happened on that account does it's by kind of pooling funds together and then sending them to fresh new recipient addresses afterwards we're excited about our implementation because the architecture that we have enables us to have certain advantages on both usability and on costs and I'll get into that in a little bit so just to

recap what this project is it's an enigma based mixing service the protocol is based on coin join it's non-custodial that means it's not a centralized service and it's not interactive which means that users don't have to don't have to interact twice with the application once they say like this is what I want to submit and here's my recipient address they're done once the application finishes running they will receive their tokens in their recipient address without any further action on their part we also have implemented this with a quorum which is a minimum number of participants in the mix the reason that you want to have that number be above a certain amount is student sure that it's not kind of a let's say useless process where it's just me and

one other person mixing our coins and that's not a very good way to achieve anonymity we also will implement a timer threshold and the reason for that is because even if you have a quorum that's somewhat large if people know what that quorum is it's possible to spam the mix by sort of like submitting if the quorum is 20 people I submit 19 transactions so I'm trying to track my counterparty it that way so a time threshold in addition to a quorum can introduce some amount of randomness there that makes that more difficult but we haven't implemented the time threshold yet and as you can see there are some members of the community that think that this service is very important and we agree um so we have a quick demo video here I will play it for

you okay so this is actually running right now on our discovery developer network which is a locally deployed version of the Neyman network it runs in a doctor environment and we just released a few weeks ago a command-line interface for it which is an NPM package so it should be pretty easy for you to get up and running with this developer lease if you want so it starts off um this is gonna be just a little slow because it's how long it takes right now but you can see it's kind of setting up the task information on the left here we have a very simple UI that kind of walks a user through what a coin joint is and what kind of information they're going to need you can see at the bottom there that

progress zero out of two for this application we've just selected a quorum of two users which is pretty low like I suggested that that would be a bad idea but just so this demo doesn't take forever we'll just use two people you send your sender address there and the recipient address which should be like a fresh address that you've never used before you've user one has submitted it and something I should note right now we are only handling fixed deposit amounts like one that's so that you can't be identified by having like a very specific number that you're mixing very specific amount of coins for example now we're on the next user user - who has a lot of eath very rich guy very concerned about his privacy now they're mixing

ready to make salad by the way we picked the name salad because we think coin mixing should not be seen as like an illegal bad activity it's healthy to achieve you know some privacy where your transactions are concerned especially if you're opening these wild CDP's and so forth maybe you don't need everybody to know about that okay now it's waiting and oh did it already submit do you guys see an alert down there no but not yet well it the the the relayer which I'll talk about in a second has now received all of the messages and has batch them has submitted the New Deal and we're just waiting for that deal to be approved which can take a little bit of time but hopefully not that much time

any questions yeah yeah so enigma is like a network of nodes that have these trusted execution environments and we are kind of like a layer 2 to a cerium so we work with mysterium by this callback functionality and we also kind of propagate the tasks amongst the Enigma network that's the purpose of the enigma contract on aetherium I can get into more detail on that but that's the reason the tasks the user send is hashed and committed to the in England contract and sent encrypted to the network so that when the result is processed it checks to make sure

those inputs were the same were received by the worker were the same as the user said they were sending the computation is public and that's kind of what the how the execute environments work is that you have some trust in them that they execute the code that they receive we can talk more about the the heart of that stuff later but let's yeah those are good questions if you want to play around with this yourself or try out our docker environment you can check out the demo at this address and I encourage you to do that but I'll also go into a little bit more detail this should be pretty quick because we already talked

about it but basically this is the client and in this model we're actually using a relay or in says something I should mention is it the secret contracts you can actually have they can have they have encryption libraries as well so what we've done here is kind of double encrypted the recipient address so the users communicated with the secret contract to encrypt the recipient address and then they've submitted that encrypted recipient address as well as other deal metadata to the operator and the operator then waits for a quorum to be reached to people in this case and when the Opera when this quorum is met the operator creates a new deal and the operator is also responsible for watching the deposit contract to make sure that the users aren't lying about

having actually made this deposit that can be reverted at the end of the deal if for some reason that doesn't work but this is a better user experience if the operator is playing nice so when the a quorum is reached in the time limit at some point in the future is reached the operator uses an image a us to submit all the deal information to the secret contract and the secret contract heat logic here is actually really simple all it does is it decrypts the recipient addresses it reorders them and we have access to a randomness service via the te environment so the addresses are then reordered and then it returns those addresses to an aetherium function and

the the etherium function has an only enigma modifier which means that only this secret contract can actually call that disbursement function which is responsible for then sending the coins to these happy wealthy anonymous users who have a lot of tussin at ease great so some of the reasons that we're excited about this and this is a very early prototype for us just trying to explore one of the use cases that our protocol affords and explore how architecture enables different solutions to other types of other alternative ways that you could achieve something like this one of the things that we're excited about is cost we don't have hard numbers on this yet but we will soon but we do know that ZK transactions are very do K proofs are very expensive right now

we know they're getting cheaper and we hope they continue to do so but that's something that we're very curious to see if we can improve on and also the usability aspect like users once they submit their tie their deal parameters they're not required to have a proof if they have to come back to or keep the tab open for 24 hours or anything like that it's kind of a once and done sort of a situation this is something that we can also do is stuff like voting where instead of a commit reveal process to achieve a secret vote you're just submitting your encrypted vote computations being running and the results return and you're never responsible for like revealing your hash or anything like that so some open questions for us on this project what's a good anonymity set that's the quorum

number we don't really know it kind of depends on what your threshold for risk is and what kind of what for what purpose you're mixing your points what's a good time threshold is that actually a good thing to pursue and we'd like to enable arbitrary size deposits in the future I think we can do that but we have to do some further work on it I mean we're grateful to the semaphore society for inspiring this project and also for their research on mixing in general cool so we're also excited about other applications and we're currently working on building blocks and primitive sort of demos and all these verticals I mentioned private voting that's relevant for governance we're doing secret auctions we're really interested in things like multi player gaming with state working on demos around that

things like poker rock-paper-scissors as well as the you know elephant in the room of personally identifiable information and things that our sensitive data about yourself that taps required a function but would be too sensitive to include on chain yeah so I was hoping that we would have time for questions and because I spoke really fast I'm sure there will be questions it's kind of a trade-off there um so go ahead I just wanted to point out um we have a forum you can ask questions there too if mine don't satisfy you and I'm also gonna flag our engineers who are here with me as I said I'm on the product team I like things to work and for users to be happy but if you have hard questions go ahead

can you name a worker see his private data no that's not possible why not because of how Hardware enclaves work they have a private key pair generated inside of them and that private key the private key for that keeper has never seen outside of the Enclave the one we're using particularly is called Intel SGX so yep that's what we call proof of Intel and it's a good question a lot of people have it but if Intel does have access to that private key we're in many other more serious ways it's not a it's not a bad question it's a good question but yeah that's my answer for that one yes so there are some things like core shadow and side-channel attacks like that um we

think those have been primarily mitigated by Intel patches and micro code updates but we also will have some like local worker consensus which can help make sure that the Enclave is returning the correct result and as well as having nodes be randomly selected so if you're going through all the effort to get access to the node and launch some type of like attack on it that requires that type access you're gonna not always be guaranteed to even get the get that task which is why I kind of having this decentralized network of nodes that do share encrypted state is actually much more robust than saying just relying on the same Enclave to do all that processing yes in the back but you have to shout really loud can someone repeat his question that's

closer to me Oh are we supporting AMD not right now I think like we're very interested in alternative thing was like he's sown and other types of open-source enclaves but right now this is like hard enough so we're focused on this for now yes yes so so I'm gonna try to answer a question but I think there might be two questions in there so the quorum is specifically for this application coin mixing and it's basically the idea is that if you and I are mixing our coins and you're like malicious actor or it's you and your bad friend and you're trying to clean your

coins and I'm the cops and I send like 30 transactions so that I'm trying to make sure that I know what the output is and you guys don't know that you've actually been traced to that mixer so quorum is to try to like create enough people that participate in the mix to guarantee some yep oh yeah sorry it can be I guess you could you could have a threshold if that's if there were other factors like time that passed so you could create something that's more complicated but yeah for right now it's just an let me set that's that's correct so any more questions yeah [Music] do I know what the picture is like what's going on I there's a project

called Keystone that I know about I think people are working on it but we're also we have like our hands pretty full just trying to get this ready and on to maintenance so I don't know too much about what the current state of affairs is with that I do know that Intel is also very interested in releasing a second version of this chip that will have a more decentralized attestation process so that's also perhaps a step that you would be interested yeah yeah um so I think civil attacks on

mixers is something that a lot of people are interested in figuring out a solution to one thing that I've seen discussed is this idea of somehow incentivizing people who are holding large amounts of funds to just keep their funds in the mixer so that it's actually like really expensive to do something like that because in order to get just like some type of super majority of the people participating in the mixer you'd have to commit quite a lot of money like so for example imagine that n instead of two is like twenty thousand or more but yeah I think that's something that's an active research question this is like I said we just finished this demo on Monday so we're discovering all the problems now but that's something that will affect most I think most appointments is it that rely on an anonymity set any more questions

it's so great we have so much time for questions okay well if you don't have any more questions I'm Ainsley Maria Elena Avishai we're all gonna be here and we're happy to talk more about this if you are interested in building something with us or have questions about what we're doing we love to chat thank you [Applause]