MPC vs. FHE vs. TEE

Transcript

three off Jen [Music] hello oh we have the co-founder of AA Network tra hello and hitting the stage again enrio okay hi everyone again uh if you recall I'm enrio researcher at PSC and uh today I'm glad to moderate this panel with guy Zen and Zen the topic is uh discussion on te

MPC and FH and uh without further Ado I will let uh the speakers introduce thems introduce what is their company and uh I will Al also ask them to speak about their company without focusing too much on the technology but just trying to get what's the value that your company is offering maybe guy you want to start sure um thanks for moderating another session and you know we're very excited to be here I'm gaki I'm the CEO of Phoenix Phoenix is an L2 and co-processor that utilizes F morphic encryption to solve one of the problems that we believe is the key problems to

be solved in the next couple of years which is the lack of data confidentiality uh on different blockchains um so I'm not going to talk yet about FH I will in a minute um but I want to state that uh previous to my role uh as as as as Phoenix I used to work at Intel and I led F morphic encryption initiatives at Intel um as a side story I also worked a little bit on the Olympic Games and I was at the same stadium exactly three years ago uh during the Tokyo 2021 game so it's kind of a closure of a loop for me um but from my standpoint um we're at a position in time which is quite unique

we we think about the ethereum ecosystem the uh key challenges that were we're facing so far which were uh scalability and high cost are mostly solved yes there is a lot to be done there but they're not a burning problem anymore and the fact that we have everything which is public is literally like a blocking factor that should be solved and we're going to talk through this panel about how we are planning to do that using fully horor encryption cool um hey guys I'm Zen I'm one of the co-founders of web 3 off and uh what we do is you know those login boxes that you see on certain web 3 applications the ones with like email

password or Google login or so on so forth um we power the bulk of applications in web 3 that have that login box where behind the scenes the key management and authentication provider for over um 800 live applications in web 3 um some specifically in Japan include I think um include double jump Tokyo uh Square Enix built the nft platform and web thof um let's see my crypto Heroes a couple of others here and there and uh we have about 20 million users across a month across all of these different

applications we've been around for a while so we we're the largest player in the space as well and yeah I mean that's more or less what we do nice uh hi everyone my name is trong I'm uh one of the co-founders for utata Network so what do we do we kind of like we want to extend machine trust onto into the entire web tree ecosystem so uh you can think of it as like each of us we are carrying like uh a mobile device with us like be your iPhone or your Android phone and even your DSL cameras and stuff like that and in each of these machine what if we can actually give a

kind of like Identity or we can tell if this device that you are using is trustworthy or it's a genuine device it's an authentic device device and from there we can have things like uh profence of of data or like uh Integrity of computation and stuff like that so uh and we want to achieve it through this process called attestation I'm pretty sure during the course of the panel there will be some interesting discussions and yeah okay so the next question is about like the technology that you are advocating for so maybe this time we can start with Zen that is going to advocate

for MPC during this panel uh yeah so I mean uh just to be clear web off doesn't just use MPC we use MPC Plus account obstruction and a couple of other things in our stack um but MCC is definitely one of the more prominent ones NPC stands for multi-party computation uh and it was it it was it's been a field of research that's been going on for decades at this point in time before crypto kind of popularized it in a certain way uh it was more used for privacy use cases as well as um like you know analytics and data hiding uh use cases but crypto really popularized MPC in its use for Key Management in

particular uh everybody in order to interact with the blockchain we all need a public private keypad and this public private keypad is very similar to a username password set um what PC essentially does when it applied to this specific use case is it allows you to split up the password into multiple different parts uh and store it on different locations that you might want to use so it's kind of like tofa but for crypto okay so I guess I'll be advocating for tees uh similar to what uh Jen say like uh at automat we don't

just use te is we we actually use it in conjunction with things like ZK proofs and uh MPC so I mean why use te then right if if you using all these other cryptographic Primitives uh the thing about tees is you you can imagine te as like a kind of uh special spell that you can cast like each of your machine there's this magical uh SE that is embedded in in your machine and then with the right incantation you can create this shield and within the shield no one can see what you're doing and whatever that you want to do within this

like magical Shield it will be done and you can get guarantees cryptographic guarantees for it and through this process we can actually make use of te to help augment some of the other cryptographic uh processes like MPC uh uh in terms of ensuring collusion resistance or uh say ZK proof as an alternate proof system for uh for the suxin proofs that's generated uh by ZK systems so uh and one of the additional kind of like properties that te has that a lot of um other cryptographic Primitives don't is actually the ability to

delegate trust to a particular third party or external device uh yeah so perfect um so it's my turn uh before I start talking about FH if it's okay I just want to ask like for show of hands how many people here heard of FH or familiar with f okay it's I I do see quite a lot of hands being shown up and and the reason I've asked this question is that F has been discussed I would say for many many years but it was always considered as like this kind of magic because what FHA does and it it it allows us to run computation on data while the data is

encrypted I'll say it again you can run computation on data while the data is encrypted which sounds a bit of magic because we were always taught that when you encrypt something it's meaningless and if you want to operate over that data you have to decrypt it you can then compute it with uh potentially trusted execution environment but you have to decrypt the data the magic of FHA is that you don't necessarily need to encrypt the data you encrypt you don't necessarily need to decrypt the data in order to compute on it what you do is that when you encrypt the data you encrypt it in a way that maintains the mathematical structure of that data which then gives you the ability to actually compute over that encrypted data which is quite transformational

because now we can take data put it on chain and compute over that data so users can now do confidential transactions where the actual amount of the transaction is encrypted you can do private voting and private governance where the voting itself is is is protected because like I hope people at the audience know it today everything on the blockchain is public so anything that's not encrypted is visible uh to to basically whoever wants to to see it and fha's goal is is really to to change that now the reason we picked over fug and I think this is why this is where

things may become a bit more interesting is because I've been working with tees for many many years um and I love tees I think tees are great but I think tees have a certain limitation which is that you need to trust somebody in that case it can be the hardware manufacturer or the the cloud service provider and if there is an attack on a te the mitigation of that attack becomes very complex and I would love to hear like the opinion in a minute um FHA actually does the same thing but it does it through cryptography so it's latis based cryptography it's Quantum safe and it's

actually operating far better than what it was in the past couple of years there's been significant progression and it is ready for prime time and I'll pause here because I'm pretty sure that my te and MPC colleagues here have a different opinion well um you know tees have this reputation of of being like broken because uh there seem to be like so many different attacks on te like uh key extraction attacks uh side Channel attack uh even like uh physical attacks like through through manipulating the voltage that is going into the CPU you can

actually make the CPU behave in a in a kind of like weird manner well uh I actually wrote a paper on how we can break Intel SX to actually extract the secret keys but the thing is a lot of these attacks are well they are theoretically possible but in reality in order for you to actually perform such an attack you you need either a very long period of time because side channels typically have a very low kind of like information band wve that means you can only obtain a little bit of information about the key uh every time you you kind of like probe the the hardware so you you need to have a lot of access like unfed access to the to

the actual uh CPU or the actual trusted execution environment and it it might take like 2 hours or 3 hours or 4 hours so you can think of this as Yep this might be some some cons of using a te but at the same time if you actually have a use case for example I have some ephemeral data that is uh secret for a short period of time and then it's going to be made public what kind of use case can that be encrypted might uh Ms like when the transaction is in the mol it's supposed to be private but once the transaction has been kind of like accepted then it is we can kind of like

publish it publicly if if what we want is like a public blockchain so in this case a te uh kind of like the flaws of the te won't manifest that that much so that's that that's kind of like number one how do you uh work around uh some of the cons of a te the other is on the actual vulnerabilities itself like everything is code including cryptographic libraries so the the the reason why these attacks happen for tees is that there's some implementation mistake in the micro code or in the libraries uh of the te similarly such kind of like bus or vulnerabilities can exist in other

cryptographic Primitives too for example like in z proof the circuits might be under constraint so you you might accept uh malicious or malformed uh proof or the verifier itself might be buggy and then you might verif you might actually accept a a proof from a uh from a proof that you shouldn't actually accept so yeah so you talked a lot about um the you spoke a lot about the uh the technical and theoretical and also practical implementation vulnerabilities of tees right uh but just to add on to I think what guy was trying to uh hone in on was that tees

even in the perfect implementation theoretical as well as actual implementation tees are dependent on individual operators or trusted parties to run and then produce outputs on so just let let me let me give one example right um let's say you have a te that uh that you're using it for I don't know to manage perhaps your wallet or something like that and it handles encryption and decryption from your wallet so that you can use it um if this te goes down it's not if it's broken into if the person operating this te decides just

for whatsoever reason to not operate the te anymore you won't be able to get back your wallet yes but similarly so so uh this is actually the problem of availability like let's say if I if I put my key into one single operator without any backup or like I I have a hardware wallet like a ledger for example and I didn't actually copy down my my recovery the the 24w recovery code and I dropped my ledger into the pool then sadly that's probably the last time you're going to see your account and

whatever assets that is within but the thing is you don't have to like uh stall a single copy of the encryption keys in in the te for example we can actually combine tees and NPCs the te can just hold a shattered copy uh of of the secrets and what you have is actually a kind of like a more robust system compared to just using MPC alone because I mean MPC gives you the guarantee that uh each individual operators actually can't see the the the the encryption keys so is what you're saying you know that NPC is necessary and tees are optional

no okay uh I I would actually say that it depends on on your use case and like if your your kind of like use case is the absolute security I would say use everything if for example uh your use case is like Fast gaming like like gaming uh l2s or or use cases where you need low latency but in terms of security you just need to have a certain level of guarantees the tees are really suitable for it it's cheap cool cool cool cool so I think we spent a lot of time attacking tees right um but we should spend some time talking about FHA

um and I think just for you know like FH is actually FH and NPC are actually very similar in terms of cryptographic fields like one is really built on the other and you could say it's just one generic umbrella um but for the sake of specificness and this conversation I think we could Define MPC more specifically to its use cases which are more popularized at this point in time in crypto so the specific use cases of MP PC and you know key cryptography and and FH being a more generalized uh approach uh to uh to to potentially the utilization of NPC so I think um one of my core uh you know uh there's so much research being done

in ZK fields which have with with with there's a lot of effort being put into ZK uh and into ZK Research into it different circuit systems into proving the scalability of things and all um FHA will always have threshold assumptions relative to ZK so why do FHA okay um I love the question I'll start by maybe giving a little bit of an FH versus MPC for a minute um when you think about MPC um it's it's actually quite valuable it's a computer a uh uh mechanism but the key challenge I have

with MPC is that it's communication bound so you can use and most of what use cases that you see with MPC are use cases of wallets of of of of of the ability to take a key and share it among the user and and and the custody but MPC in general is is a very hard problem to solve when you start thinking about taking it into a distant ized a completely decentralized space because it's communication bound and the communication it grows exponentially as you get more and more nodes out there um so I would say MPC is perfect for wallets and what what web3 Au are doing I think is really like the best scenario

of utilizing MPC but it's not the right vehicle when you actually want to do computation in a decentralized way uh on on on chain data FH on the other hand is what we call computation bound it's slower than regular computation but it's com computation bound which means that better Hardware produces better results and what we've learned in the past is when when things are dependent on Hardware they typically get solved like you can look at even the the AI transformation that happened once Nvidia started like releasing the right gpus and things started to become very quickly we we see the same thing with FG so I would say FG um is is is definitely slower than than others but it's

actually ready for many of the use cases that we see today it's probably not the right fit for me protection I agree with you there and T is may be the better solution today but if you think about like two three years into the future um this will no longer be a problem I will agree that the end game for any type of solution will never be just one cryptography it will be a mix of FH MPC ZK and te is uh in a way where FH will be the one that would be utilized to run the computation over the encrypted data MPC will be used to split the network key and protect that so we have a

threshold Network and potentially even run that inside a te and we'll also have ZK for verifiability um and that's where I would say the end game is right so we spoke about the attacks on the te actually I wanted to touch on u a type of attack that can happen in uh in FH networks so I will ask uh this question to to guy and I'm referring about like collusion attacks so what do I mean by collusion attack is in a FH Network when there are like multiple participants you know we need to encrypt something under a common like a kind of a master public key and there must be

someone owning the the cryption key for this master public key and uh in many scenarios this key is kind of shared across a set of nodes and this they're like I think two type of risk the first risk of course is that these parties can just collude with each other and go ahead and start decrypting all the state but uh I think the even uh a bigger risk is the fact that you as a user you as a consumer of this application you cannot really tell that this happened so I'm wondering how you defend from this type of collusion attack so I think the problem that you're describing is not just an FHA

problem it's also an NPC problem and and I'm sure that that my friend here would comment on that and that is literally I would say maybe it's even more of an MPC problem than an FH problem but we will be facing that and the the problem that can happen with uh several participant either colluding with one another uh is is as a problem which is realistic the way we can do to solve it is a by making sure that we run the part of computation inside a te to prevent that from actually happening in a malicious way where somebody you know has access to multiple uh uh um multiple nodes and

then can actually generate that the other path is that we are making sure that the participants um you require a large amount of participants and you only need a subset of them but still in a meaningful way which would make collusion I would say maybe realistic maybe theoretical and not really realistic is is literally like where we're aiming to solve that so Zen how do you reply to that um yeah you're absolutely right in that both FH as well as MPC inherit threshold assumptions which basically for the Z that means that you rely on a n Out of a t out of n

um parties uh and on that trust assumption that t number of parties don't collude so as to either reconstruct your key decrypt your information blah blah blah what so on so forth I think the way which we um approach and try to solve this problem is really on making sure that the participants on the MPC protocol aren't the network and aren't people or individuals which aren't you right um the way web throw off works is actually we split a users P private keypad and we St store all of these different things on things that users already own themselves so this could be their devices it could be social accounts that

they already own it could be encrypted under pass keys or um or or or or other forms of biometric information in which a user has and owns themselves right so um I think at the end of the day it's not about it's not about so much as like making sure or changing or the the tral assumptions itself are wrong it's just a tool that we use and making sure that the participants and where these cryptographic pieces of shards are held are good places to keep them okay so I would just add a little bit and then maybe kind of like end off with with something about te so the the thing about this collusion attacks on FH is it depends on how the FH is actually being

used so you can have a situation where I'm the owner of the data I encrypt the data and I want to Outsource it for some third party computation in that case there won't be any collusion any possibility of a collusion because I own the key uh the the kind of like the third party server would just operate on totally encrypted data so uh it this this issue kind of like arise because of the utilization of MPC to hold uh master key for FH networks tees are a great solution for this but actually other than te there have been research that is being done and it's being done now on how can we

actually find out if there is a collusion or not the the main issue here is that tea parties can collude and we don't know which of the tea parties or if they actually collude or not there are some papers uh that describe a solution where you can you can identify uh if the particular decrypted value actually comes from some of the participating parties or not so so this is kind of like an alternate way on on how this uh problem can be addressed and finally kind of like back to tees right uh just now Jen actually uh mentioned that in order for us to use tees we need to trust a particular manufactur like be

it AMD Intel or say arm well this is the case now but in the web tree ecosystem and Industry right there there hasn't been a lack of like Hardware companies like there's FH accelerators there are ZK accelerators why can't we have a distributed uh te manufacturer the secrets of the te can be kind of like embeded as physically unclonable functions so so you can think of it as the secret key of your CPU is actually the Silicon itself and and these kinds of like uh if it's being implemented properly uh this alleviate

the issue on whether the secret key can be extracted from the CPU or not and in terms of like whether this manufact uring process is trustworthy or not we can kind of like have a uh they call it a kind of like choose and cut uh destructive testing method where a bunch of us or n manufacturers would manufacture the chips we come together and then we Rand randomly sample a subset of the chips and then we destructively analyze if this is indeed what we think it is so this way we can actually have a kind of like decentralized te e Hardware that is built for web

tree right so we are getting close to the end of the panel I just wanted to give you the opportunity to tell the audience and any builders that might be in the audience that might be interested in start using this technology what is your advice to let them go home and start uh building something well I I I'll make this one short but um what what I want people to get out of this is that data confidentiality user privacy is important we need to have that State of Mind as we start building applications into the next couple of years the this is a fundamental infrastructure that's needed if we want to really scale blockchains and make

them widely adopted and that's uh that's something that whatever cryptography you're going to use you will get uh in a much better State than what we have today so you know go research f go research MPC go research ZK but I have to say it's far easier than where it was in the past and it is very very practical from a developer standpoint yeah absolutely and I think um absolutely agree with everything gu said you know this panel was set out that it was like versus versus versus but really all have great use cases great applications and great um and and and uh and and and and and and and great practical uh benefits to the to the

world um I think if you're looking to get started do reach out you can talk to us that would be a great start but also um a lot of there are a lot of different open- Source libraries uh out there uh which do very simple NPC tooling be it from just simple oblivious transfers or uh a little higher level you know gg20 open source libraries or otherwise um they're quite fun to play with they're quite practical play around with them I think they're a lot of fun I totally agree so so basically it's not really a matter of FH versus MPC versus ZK versus tees but rather you

think of all of this as like tools in your tool box and then depending on the problem that you're trying to solve apply the appropriate tools uh to the problem and yeah things are a lot better now there are a lot of like small little toy examples that you can play with to uh experiment using MPC fhe or like even te now with like confidential VMS using tees can be easier because you can just write your normal program and run it inside a confidential VM so really excited to to kind of like uh be in this Junction in time where that there's so much

development cool so thanks for listening and Applause for the panelists and uh thanks andrio for the thanks enrio