Meet Stoffel

Transcript

[Music] Now, please welcome our next presenter, Miss Michaela Quintine Collins. Miss Maine Coins, the floor is yours. Hello. Hello. So today I'll be talking about Stafle.

Um Stafle is a framework that we're building to enable um multi-party computation. So if you think about blockchains today, um everything is public by default um and although this gives us a lot of really cool applications, um this also limits what you can build. Um the biggest thing is that you have no choice but to be public by default. Um, and there's a lot of use cases as as we're seeing that rely on uh private information. Um, and as a result, this is hindering what we can build on top of blockchains.

Uh, why does this matter? Um, well, clearly as you can see from the the grid there, um, means that we can't really build all sorts of applications that we want. We are pretty close, um, depending on like what tools you use. Um so as you see it does cow swap. It doesn't really use like advanced cryptography but it does use um some clever architectural decisions to be able to give um decent amounts of privacy. Um most centralized exchanges indexes that most people use um have very high adoption but no privacy at all. Um there's high like onchain games that at one point were popular but are

no longer popular. um and that have also uh have low privacy, low adoption. And then there's like that other aspect where there's relatively high adoption um sorry relatively low adoption um but high private uh privacy like turn to cash and a lot of like shielded payment protocols um and so yeah this affects you know what we ship how we can adopt blockchains um and what you can add to apps and despite solving scalability for for most use cases on the previous slide um either through the use of new L1's um or through L2s um we still don't have privacy so even though you can have high

throughput bit zero it's still zero as as it says in the slide um so really like the next area of um adoption is through being able to target the upper uh right uh quadrant there um as I've pointed doesn't show up nicely. Sorry. Um so as a result, adoption kind of stalls. Um and you're you're sort of forced to um make trade-offs in your application design that are more centralized. Um for example, centralized exchanges um sort of act as like a de facto privacy tool

for many people. Um and as a result, you get less people actually on chain. They're still just using crypto through Coinbase, for example. Right now, we do have a lot of uh privacy tooling that can help developers. Um ZK is the most advanced, has the most mind share, um has the most tooling available, but you're limiting you're limited in terms of what what you can do with private data. Um specifically, you can't really do computation over private data. um by by design of ZK um the data is meant to only be held by the user and then you should provide proofs about that data.

Um so you can't really share it unless you know you sort of make assumptions about who is on the other like receiving end of that data. Um TE's are seeing a renewed interest in popularity recently. Um and there's been many gains in uh making them secure in practice and in the tooling as well. Um but the hardware guarantees are still uh making a few folks sort of worry about actually deploying them. Um F is also getting renewed interest and it's being like uh funded quite a bit. Um however even for relatively simple operations like multiplication uh it's

still very slow um requires like hardware speed ups and as as a result many companies building sort of f uh hardware um NPCs provide the same functionality as FP but um trades off this computational excellence for latency instead. Um but then your trade-off there is um if you want relatively fast uh computation then your nodes need to be relatively close geographically. So there's no tool that does everything at once.

So as a developer if you want to add privacy to your onchain applications um and you want to be able to do expressive compute as well then what are your options? Um so today we'll be talking about Stopple. Uh he's a honey badger. He's a real honey badger in South Africa and so we named the company after him. Uh there's a saying called uh the honey badgers are like the most resilient mammals um beyond humans they have very few natural predators and so we named our NPC framework. So what is um so it's a full stack um that we've built um specifically for NPC. Um I added E in here for because we

use them for integrity but um most of it is is NPC um so we we'll just be saying NPC for the rest of the talk basically it abstracts away the underlying cryptography um the dev flows are very familiar um and it works regardless of the setting web two web three um I should note that our web three stuff is still like uh work in progress heavily um but I'll be able to sort of go through examples on how how it should work. So yeah, you don't really have to like buy a token to use it. You don't need to like fund a wallet to use it or anything like that. It's just like any other dev tool that you're familiar with.

So quickly, what's MPC? It's a way to compute a function uh without a trusted third party. Um and typically use it when everybody that is computing with each other sort of distrust each other in some way. Um but there's information that is beneficial to everybody. Um and so this gives us confidential compute um while also distributing trust. A little bit of like a lower level detail here that I think is interesting. Um is that in order to do MPC uh the fundamental unit is called a share. Um and each of the stoples in this image would have like pieces of a and that's what that's what a share is. And so by the nature of MPC compute um this is

sort of why we had to uh come up with a stack from scratch. Um and so these are like inherently distributed objects um pretty different from what you're used to as a developer. Um and there's some like nice or weird features um about these shares. Um addition is free but multiplication occurs at latency and these can happen over fields or rings. So more concretely, what is the stoppple stack? So we have um a DSL uh called stoppling. Um it's still a work in progress, but right now it's very Pythonic. Um it looks very familiar. You don't really need to like completely rethink your syntax. We've simplified it

quite a bit. Um so write the exact computation you want um to distribute to have running in NPC network. Um we have secret and public types. Uh the secret types represent the shares that I mentioned on the slide uh and you have explicit control over when you want to reveal a share. So on the previous slide, this would have been reveal A um or if you want to keep brackets A and the underlying cryptography is completely abstracted away. So you don't need to know what a share is to even use it. Um the main caveat though is that um by the nature of MPC, there are some things that you can't do as you would with any like general purpose programming language. Um and control flow is one of them. uh you can't do

conditionals is like the biggest one. Um basically if you do conditional you would have to reveal the value. Um so you can't really do like if statements very easily. Next we have the stople compiler. Um so once you bring your program and stop it compiles and basically not only does it provide bite code but it provides like the most like efficient way to execute the MPC program. Um and so this is what like the output looks like. Um we're making this cleaner so that it makes more sense for uh developers. Um then this is the actual meter of everything. Uh we have a stople VM. It's

a separate execution environment optimized for u multi-party computation. Um so once you you've compiled your stop link program you're left with the result of a bike code. Um and this by code is loaded by all the parties and then executed on um so it handles all of the networking the NPC protocol choice um the parameters um and then spits out like the result of an MPC computation um and we also have reasonable defaults for this but if you're like a bit more advanced then u you also have the ability to change your parameters accordingly but now that you're you've like ran your MPC computation you want going to be able to use that result in your end

application. Um that end application can be a web app, it can be a blockchain, it can be any anything really. Um but in order to do that you need SDKs. Um so right now we have um a Python SDK and then our REST code is like all creates so you can use it as an SDK but it's not like packaged nicely in an SDK quite yet but it's all open source and available. And then right now we're working on a TypeScript and Solidity SDKs that um if you're building a TypeScript app, you can just um integrate the stuff in the previous step into it.

And then if you're building like an EVM enabled app, then you can also um get the result uh of an offchain MPC computation onchain. Um, so this is basically a way to uh, you know, get the actual MPC computation into your app and you don't need to rewrite your entire app. You can just have parts of your app be executed in MPC and the rest of your app stays exactly the same. And so it gives you a lot of options uh, for configurable privacy. So this is what the Python SDK kind of looks like. It has changed since I made these slides. Um, so yeah, there's a discrepancy between what's on the slide and what's actually like in our in our PRs.

So how would this look like for a blockchain app? Um, so basically on your right hand side, um, those are clients. Uh, and these clients can be users. Um, and they want some NPC compute done over their inputs. So before they even start they need to sort of get information about the application and request certain public inputs um from the chain. Um once that's done then locally they're able to do um this secret sharing uh procedure that I described previously.

Um they send the shares to the NPC network which is like stafle in a in a armor. uh these staff and armor uh nodes interact with the blockchain. They also get computation instructions um and public input output and some public output um and they receive the public inputs from the clients. Once they've managed to get uh all the inputs and inputs for their uh computation, then they're able to um do the computation. Once it's completed, they post the results on chain and and directly send uh the final shares to um the clients and then the clients can

reconstruct their information um locally. So how what have we actually unlocked? So the first thing is you can take like any function um that's useful to you and now you can split it um across uh multiple different parties. Um the next one is for any encrypted input you get encrypted output um as a result of having these three parties that compute the function without knowing it the inputs and during the actual execution of it you don't uh need to decrypt your input

which is like also pretty powerful and it's kind of the point of using NPC. So as a result uh you can take any functionality that you're familiar with um and you automatically get these uh nice properties um so it does open up a wide range of um functionality that is done within a confidential comput environment. So uh this is more of like how can you actually use this? The previous slide might have seemed kind of abstract. Um so we'll go quickly over an example um of how this is used.

So a case study that we uh wrote a while ago is called honey swap. Um it's basically unis swap but executed in PPC environment. So if you know unis swap you know that it does a constant um market maker. Um so basically x * y is equal to k. X and Y represent the sizes of pools of different assets in K some constant. Um, and it's initialized when whoever creates that pool for this pair decides to set the price for these. Um, so in order to swap it, um, it's by that formula up there. So basically if you wanted to implement this in MPC you're basically

implementing this b= y - k over x plus a um function. So roughly the flow is that um the client who's trying to do trades um in our honey budget swap system uh first they need to sort of request info from the smart contracts and initialize some constants. Um, in the demo that we wrote a few years ago, basically um the the clients had to um initialize into a new kind of account. Um, and this was kind of like a private account where the amount was hidden. Um, but then they still had to do some offchain processes.

Um, which they still they still need to do. Um, and so yeah, that's the first step. The next step is the amounts that they actually want to trade. Um they would encrypt it um and then also indicate like what what direction they want to trade it in. Um whether they want to trade um like sell asset A for asset B or vice versa. Um then once all this is sent to the MPC nodes and some metadata is sent over to the smart contract. um the MPC nodes wait until enough inputs um get added to the smart contract and they receive enough inputs and then that's when they execute the computation. Um this was

typically done in batches um because uh unis swap requires shared state and so once this is done then the result of the computation is posted on chain um but then the actual like um amounts that the the clients requested gets sent to them and then they're able to withdraw um the exact amount on chain uh sorry yeah from the chain um and like mentioned previously they would decrypt So basically this gives you a form of um darkpool um for unis swap where um you you leak very little information

about um what you've traded and how much you've traded um so what's the status of this now? Um so as I've mentioned earlier, we're still pretty early, but a lot of the components are kind of ready to play with right now. They're not production ready quite yet. Um, we just shipped our doc site today. It's still kind of um rough, but you can still sort of try it out. Give me some feedback. Um, I'll be here all week. Um, and uh, right now we are working on some utilities to make it easier. Oh, I should also mention you can't run this uh yet soon. This pier is waiting. Um, so yeah. Um, we've made NPC practical

today. I mean, it was always practical, but we've made it like more developer friendly. Um, you also don't need an uh, you know, PhD to to be able to use this stuff. We've uh, put a lot of effort into making it really accessible. Um, and now you don't have to completely shut off privacy utility in your apps because you have a way to replicate the functionality that um, you want to implement. by in an MPC environment to set up just a regular CL text environment. Uh so yeah, thank you for listening. That's the end of my talk. Um if you want to learn more about what we've been up to, uh you can scan the cur code up there. Um that's me on Twitter, black cryptobitch, and that's me on Telegram.

Just my first name, Mira. And yeah, that's it. [Applause] Thank you very much.