Diamond iO: New Cryptanalysis and Efficiency Improvements

Transcript

[music] [music] Hi everyone, I'm SA from the Islim Foundation. Before diving into the arisk, I first want to let you know why I'm so excited about ariskation. So it's not just about making Islam more private. I believe obiscation will open up a completely new type of the Islam application that naturally needs Islam security.

With ariskation more people will be able to benefit from the Islam's crops property even outside of the finance context. Our final goal is to give smart contracts private keys no one knows. Please imagine that your smart contract can use the private key for decing its inputs or storage data or for signing the output. However, even the person who runs this contract on their own computer will not be able to learn the private key and any secret value like the decryption result.

And such confidential smart contracts will enable new design of ELM applications. So far smart contracts have coordinated multiple peoples with conflicting interest by designing incentives and we have called this crypto economics. Confidential smart contracts will be able to also design who can learn what under what condition and we call this crypto epicisks.

So in this way confidential smart contract can program not only manif but also information flow. So let's take an example of let's take an example of organ. Let's take example of organ transplants. So here we want to match we want to find matchings between hospitals between hospitals of patients and hospitals of the donors and today we relying on trusted or intermediate party like a registry to compute these matchings on private data. But this also means that if this party is just hacked then all of

the confidential data handled by that party will leak. And with AI these attacks are getting a faster and cheaper. So this is why I believe this kind of risk becomes a real problem today. A confidential smart contract can try to address this problem. The registry will be replaced by matching confidential matching contract and hospitals will send only the encryptions of the medical datas in this case.

And here all participants need to trust just two things for privacy. The security of the handling cryptography and the security of Iselion. Some of you might wonder why why the security of Iselion is necessary for privacy in this context. This is because in this example we have to rate limit number of the queries each participant can make. Otherwise a mercious participant can just make a bunch of the queries to to match most of the dattors and learn them.

So in this way if the application is stateful the security of Iselion against double spending attack can be leverage for protecting privacy by black privacy by by breaking it can like revage the security for attacks against or breaking the privacy by rewinding the states and I believe we can this confidential smart contract will be useful beyond this example especially when many people are inversion like matching and anyone can participate at any time but like they still keep

some shared private state and with AI it will be hard today to make a make a single or data custodian that such that any participant can commonly trust. So I believe it will be easier for many people to trust the Ethereum security and cryptography rather than believing that no cyber will be hacked. And there are several methods to implement or this confidential smart contract including NPC and TE but I think ouration is a scalable and secure P to that.

So for example, if we rely on external MPC committee or TE, we will need extra trust outside. And if predator performs MPC by themselves, this will lead a trade-off between scalability and centralization. This is because to achieve better throughput for better scalability predators need need to perform more computation and communication and this increase the operation cost of predator with demand.

Arbiscation can avoid this tradeoff because we can de we can delegate all of the heavy ariscation evolution into any permissionless server and the bars just needs to keep signing Israel is broken becomes much clear by compelling them with the lessons we learned when scaling public smart contracts. So I believe giving up on obiscript practical obiscation today is as bad idea as giving up practical snacks back then.

So yeah I expect or your next question is so can we then make obiscation secure and practical? Unfortunately, there are a few attempts to implement obiscation and all of these obiscation obiscation implementations rely on some non-standard cryptographic assumptions. One of them is a diamond IO a lot space IO we proposed last year and it had two problems. So what is security? So this lie on new assumption we proposed called all product alg but it still lacks a lot of it still lacks crypto enough cryp

analysis to make sure this assumption actually is actually secure and second problem is efficiency. So the cost to evalate obiscated circuit in diamond IO increases superinially in the input rank of the program being obscated. And in fact we could instantiate this diamond IO with practical parameters only for very small input size like up to 110 input bits which is very far from practical use. And for the first point in this year we have coraborated with professor Amit sahis labber to analyze all product elaborating

and we found several counter examples against this assumption when the latest dimension is too small and one of our conclusion is that diamond IO's approach can't scale to long inputs because to avoid these attacks the evolation cost must scale superenarally in the input ranks and the work of this and the paper of this work will be made available in a few weeks. So to solve these two problems we are building a new version of diamond IO called diamond IO2.

Although we are still writing the first security proof of this construction, this will no longer rely on our new assumption or product AW and also it improves the evalation cost to almost linear with in input ranks L of the program and the scale of the program itself. So we evalated and compares the complete efficiency with diamond IO1 for the same task.

And our first uh result is that we could instantiate diamond mode IO2 with with the parameters which is as as large as there are some FUG implementations which means parameters remains practical length and importantly these latis parameters are independent of the input strength and the program scale and this is the biggest difference and improvement from the diamond IO1. one and we estimated the complete performance for this task by landing a part of the whole aberation and scaling the obtained numbers.

Here is the result. So because the number of the because the numbers are too huge we compared we measured and compared we counted these numbers are based on the age of the universe and the data size of the internet archive. Yeah I can bet like nowhere has counted these performance in with such like a in such a way. So you can see that diamond IO2 improves the obiscation time by factor of 10 to six sorry 10 to 25 and abolition time by a factor of 10 to 16 and obiscation size becomes smaller by the factor of 10 10

to 24. Although this is still far from practical, this improvement gap gloss with the input ranks since diamond IO2 also improves the asymptoic efficiency of this obiscation and evaluation and then I'll explain or how we achieved this improvement concretely. One core primitive handling both diamond IO1 and two is a keyhomeic encoding in similar to FG.

Your inputs can be your inputs can be encrypted and encoded and some secret s and anyone can compute some socket over these encodings to get the encoding of the output. But unlike Fuch Arbus skater trusted party can prepare a special decoding key which is specific to some circuit C. So that evalator can decrypt and decode only the output encoding of the specific circuit output but they cannot use that for any other purpose and this will this enables evaluator to evalate some circuit without knowing the

inputs or circuit themselves and also without interaction with the offiscator. However, this idea still requires evolator to obtain encodings of their own inputs. But unlike FG, this the process to make this encoding requires a secret. And uh this is non-trivial to make these encodings without knowing this secret. Diamond IO1 are achieved this process by pipia special matrices such that a taken obtains the encodings of these inputs just by multiplying matrix for each input bit.

However, this is not free because this matrix multiplication amplifies the LW noise in the encoding. As a result, to support larger input sizes, we have to set the we have to use the larger module skew from the beginning. And this increases not only the number of the matrix multiplication, but also the cost of each matrix product or the matrix size or encoding size themselves. And this is why diamond IO1 requires superior evolation cost with input rank L.

We solved this problem by refreshing noises for each input bit so that the L reel remains an initial level regardless of the how much input you processed. So this makes the modus independent of the input rank L. So that the evolation cost grows all only almost linearly in the input ranks L and also program scale. And this n refreshing process which is very similar to which is very similar concept to FG bootstropping consists of these three steps.

And among them the first the first process which evalates key homorphic BLF over encodings is to evalate the surroundum functions over key horic encodings or is the biggest bottleneck. Then how far is diamond IO2 from practical diamond practical IO? Our current estimation is that it will still require 10 to 24 times or optimizations uh to improve the PLF throughput.

And we have several ideas to try to to achieve this optimizations. And as you can see many of these ideas are imports techniques and ideas from from the other cryptography earlier including FUG and snack. So I believe there are still a lot of room for cryptographers engineers are working on different a cryptography to contribute to latis based IO and another approach we are interested in is a out research for IO.

So we have built a radis library called MXX to build diamond IO and we we open sourced uh this library and here both humor and AI can write its own IO protocol or any lattice protocol in the MXX or domain specific language and then the back end of this MXX will automatically aate and estimate their performance on GPUs. And also it outputs the collectness statement in lean. So if AI proves that this collectness statements are host by making proofs, we can make sure that the protocol written

in this DSL by AI is actually correct. And um only missing piece here is a feature to output or security statement are in ling. And uh I believe if we can also support this we will be able to close the loop of this out research which means AI will make some new IO construction implement this in DSL and their handsets based on this MXX will feedback the performance and checks the correctness and security properties.

Okay, let's conclude uh our this talk. So I believe ariscription is a secure and scalable path to confidential smart contracts and this will enable this will enable you to plug them not only manif but also information knowledge flows and this will open new type of the applications and in these two years we have improved this diamond IO but factor of 10 to 16 but we still need to improve the performance of PLF's throughputs by the factor of 10 to 24 and optim very optimistically I think if

we can accelerate the speed of our IO research by more than like three times probably we can achieve or this improvement just in one year and uh to do that we will need more helps from the wider area of cryptographer clgraphic our researchers and also we need to use more AIs to accelerate our research and I believe these attempts will open our new application of Islam and will provide the crops properties of Islam to wider people.

Thank you for listening. >> Wow Sora that was an amazing talk that really made things much more clear. Um so and we have some really good questions here. So question for you. So just as zero knowledge proofs took years to reach maturity like how many more years do you think it's going to take for IO to become like practical? >> Yeah. So yeah, I often I'm also often asked this question and it's I I always feel like this is how to answer this question. But like uh as I said like if we can accelerate our like a research or like three or four times using like AIS and uh by like Gen knowledge from Bis

Alier cryptographers probably uh yeah we might be to get or some IO constructions which can be learned on real hards end to end or within one or two years and then We will yeah I think we will still need to spend more times on cryptoysis of the assumptions use used for those constructions before reing this on mainet. >> Another question that I think is super interesting here is like can diamond IO be accelerated using parallelization or GPUs? Uh yes exact. Yeah like and we already use GPUs and all of the

benchmarks we presented here are are like a measured on GPUs and uh especially uh is similar to many of the latis based FUG or the process of like lat space I the process of like diamond IO can be also paralyzed or as a like al algorithms features. >> Awesome. So, another question that I think is kind of cool is has the Ethereum Foundation considered running like an auto research competition to like get the community to try to like tackle this problem and like really optimize this. So we we don't have any offshore plan for that and uh but like

as I shared at the last slide or yeah I'm really interested in doing that and uh to do that yeah we have to solve a problem about how we automate the verification of the security property especially like how we analyze some new assumptions which is which are potentially are proposed by AI >> and this is another question I mean you sort already answered this at the beginning of your talk, but what applications of practical IO are the most interesting to you? >> Yeah. So I think so basically I think first I'm in general like I'm interested in like a type of the applications

um which will like solve the more real world problems which requires privacy and also like a privacy or among like multiple papers and uh yeah I think Um yeah probably one like a big picture I'm interesting is that uh like if we have some like u AI models running on offiscated program or like confidential program or then like I think we can like uh provide like some uh ideas and information prompts uh to the same model in encrypted way and uh uh we can uh compute or that output and

uh yeah like and I think this is interesting because uh I believe uh in the future uh our society will lie on like uh some like advanced algorithms including AI for uh and they will they will need to uh process like a multiple people uses private informations as a feature. of the application, specification of the application and uh our confidential smart contract might be able to provide our solution to balance their uh privacy protection, trust assumption and then our usability or feature of such

advanced algorithms. >> Another question. So um this is kind of an interesting question. So like once we achieve practical IO, what's next? Like this seems like the holy grail of cryptography like what's what's next after this? >> I see. Uh I think the next thing I'm interesting is uh uh quantum cryptography. This is not like a tr it's not like a postquantum cryptography. uh quantum cryptography means uh cryptography enabled by using quantum bits and uh uh I'm not so familiar with uh this area

yet but like uh for example this will enable uh oneshot signature such that even the harder of this signing key can make signature only worse and uh I think this might provide more trustable or to physical data for smart contracts also Awesome. Thank Thank you so much. [music]