Episode 295 - Return to MPC with Nigel Smart

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week guest Nigel smart and I revisit the topic of MPC that is multi-party computation and catch up on the progress that has been made in the field in the last few years he describes some of the components that go into an

MPC system such as garbled circuits secret sharing and FHA we discussed some of the use cases for MPC both on the system level like dkg and threshold signature schemes as well as real world use cases already deployed in the wild throughout the interview we also discussed the combination of MPC and ZK and how each can offer useful benefits to the other now before we kick off I just want to once again highlight the upcoming ZK hack Istanbul event happening next month November 10th through 12th just before Dev connect this is our second IRL hackathon and we invite you to come along and build with us meet the teams working on ZK learn new skills find collaborators and friends and imagine new ways to use ZK

in real world applications we hope to see you there the link to apply and more info can be found at ZK istanbul. comom I've added the link in the show notes now tan will share a little bit about this week's sponsors ever feel like developing zero knowledge proofs is a daunting task the team at risk zero is here to remind you that it doesn't have to be that way their out-of-the-box tooling allows developers to access the magic of ZK proofs from any chain without needing to learn custom languages or build custom ZK circuits Bonsai risk Zero's most anticipated product allows developers to prove huge programs offchain roll them into one succinct proof and verify anywhere with low amounts of gas visit rz.

lzk podcast to learn more and sign up for the Bonsai weight list today so thanks again risk zero join nosis Dow and be part of a revolution and decentralized infrastructure for the ethereum ecosystem the driving force behind a claimed products such as nosis safe cow Swap and the Zodiac Dow tooling Suite nosis chain a resilient incredibly neutral evm chain boasting over 160k validators a diverse range of clients and a trust minimized bridging to the ethereum main net through ZK light client Bridges and Hashi nosis have introduced the world's first decentralized payment Network nois pay and are building a web of trust-based income protocols cires Ubi they're on a mission to simplify self- custody with

an easyto use wallet that offers features like Pass key or email onboarding account recovery options transaction batching and gas abstraction do you want to help Drive the mission to create a blockchain platform that empowers developers businesses and users alike nosis are searching for a VP of Technology who will provide technical leadership Foster Innovation and ensure the success of their technology check out the full job description and apply on the ZK jobs board that's jobsboard Dozer knowledge. FM so thanks again no sow and now here's our episode today I'm here with Nigel smart an expert cryptographer and someone who has been on the show before we're going to be talking once again about the topic

of MPC welcome to the show Nigel hi it's great to be back it's been a long time been a long time so I did go back and listen to our previous episode before this one it was episode 90 recorded in August 2019 something people may not know is behind the scenes since then you've actually been sending me amazing guest ideas so we've been in touch um I know you sent me some great FHA guests a as well as some like cryptographers doing work I had I didn't know about but yeah what we were thinking about with this episode was like we had you on those years ago and at the time we did sort of a check-in on MPC that's multi-party

computation but we haven't as a like I don't think I've done any like proper episodes on MPC since then I think I don't think I don't know but we've done a bunch on trusted setups but not the general topic of NPC and so I just feel like it's a really good time to check back in with you to get a lay of the land to yeah and to also hear what you've been up to cool okay but you want to start let's start on you so last time we spoke I think you were 100% at liven yeah and you told me all about that that school actually I think I I've been keeping my eye out of like work coming out of there ever since but yeah maybe you can share a little bit about what you're doing now and yeah how it how you've evolved in the last four years on

the career side okay so um so in those days I was 100% 11 and um I had founded this company called Unbound security which was doing NPC for General um like threshold signatures threshold all sorts of other stuff and um that got sold to coinbase in 2020 something yeah 20202 end of the year 2020 beginning of the year 2021 so since then I've been kind of doing other things I've been helping a number of other startups in the space just not only the the blockchain space But The Wider cryptography space and I think we're going to kind of like touch on some of those things as as as we go through the

episode so some of those companies that you're interfacing with would you say they're primarily in the MPC side of things or are they kind of across the board cryptography cryptology I think they're across the board there's a lot of stuff um so cryptography is used everywhere yeah so it's used wherever it's in your bank or whether it's um in your mobile phone it's used on the blockchain you know everyone cryptographers have this kind of like St saying crypto means cryptography not cryptocurrency yeah so when so we really very uh yeah so it's it's it's everywhere so there's a kind of like there's lots of um stuff going on but obviously a lot of the kind of really exciting stuff is happening in the crypto equals cryptocurrency space so um

yeah whether that's zero knowledge whether that's threshold stuff whether that's H you know there's all sorts of stuff going on there but yeah I think what we wanted to do today was revisit MPC and we're going to be spending some time looking at you know what's out there you know how it's changed what state is MPC at let's start off with like a definition we've talked about it usually in the context of trusted setups but I actually I want us to like go back to basics Define what MPC is multi-party computation generally okay it's really so it the the definition is actually always been the same yeah in this in that MPC means what it says on the tin multi-art computation right so you have

multiple parties come together and they can compute an arbitrary function of their private data only revealing the outcome of the computation now what it turns out is that the word NPC then so that's actually what it does that's kind of like a functional description at a very very high level and the confusion arises is because people use MPC also for the technology which allows you to do that functional thing ah and and so that's one problem and then people focus on very very specific applications yes okay and actually it's really and and I think over the last few years I've kind

of tried to kind of like separate those things out in in people's minds when I'm talking to people so what we have is we have the functional description is it allows you to compute an arbitrary function on private input without revealing the private values okay so we can compute an election say is the classic example this everyone understands do an auction okay between many many people can bid seal bid auction you can work out who won the auction without having a trusted person okay now let's kind of then so that's that's the application now let's look at the Technologies so there's three kind of key technologies that allow you to build an NPC application so one is

called garbled circuits which is kind of very old and a kind of interesting application one is called secret sharing where we share a secret amongst a group of people and we proceed and the other technology which allows you to do NPC is fully homomorphic encryption so it's kind of like there's kind of there's the Technologies and then if we look at applications where sometimes people use the word MPC is distributed key generation dkg is an NPC application because we have a group of people the distributed people each put in some Randomness and out pops a key at the end and we don't learn what the randomness was to go into

the distributed key generation so we don't know what the overall key is so distributed key generation is an application of NPC so it's a use case like use case okay it's a use so the other one is threshold signatures so if you want to do if you want a threshold wallet like you would have from coinbase or from other threshold wallets that out there fire blocks defense all sorts um that is you have a secret shared secret and you use that to compute a signature where the secret doesn't come back together and the secret is kind of kept secret because secret going be kept secret so that is another application of NPC and we've already mentioned like auctions Etc now the kind of other thing

which is kind of confusing is that it's about privacy and so people confuse it with zero knowledge yeah okay now here is so this comes back to the you know like your Zer podcast is name podast so here's the kind of interesting thing zero knowledge doesn't really give you privacy because the prover has to know the secret and the pro proves that he knows something so he knows the secret someone knows something someone knows the thing okay right so for example so suppose you're doing a auction on the blockchain and what you have is you have everybody encrypts their things to the auctioneer

the auctioneer opens the encryptions works out who had won the auction and then posts a zero knowledge proof that the auction was done correctly now that not a private auction what's private to one person's it's private yeah one person learns stuff and that actually is a real problem because if you have that single person the The Trusted Auctioneer actually changes the game theory and the Dynamics of the auction because the auctioneer can now front run they can cheat totally yeah so there's there's so Zer knowledge is kind of like a funny thing one it kind of seems to say you've got privacy but you don't have privacy

for everything yeah and the other thing is that actually zero knowledge when you do rollups and stuff like that often you don't care about the Privacy anyway so no one really cares about privacy that's proving they they're they're trying to prove the validity of what's under the hood now what I want to because later on in this episode I want to talk about the sort of combination of these Technologies because I know that there's been work in that direction but I want to talk about another way that ZK and MPC kind of come together which is where MPC is used for The Trusted setup I kind of want to talk about this because it's just I'm just realizing that the way that the trusted setup is formed it's like the goal of it is to create like something random and

indecipherable but in that context I've always heard the following in MPC if one single participant is acting honestly then the you know the output will be correct but I don't think that actually is the case if you're like trying to combine a lot of data from different parties and it should be accurate right like this is this is the distinction I want to draw on like okay there's various um things you can say is the output correct is the output private is is it subject to an adversarial problem okay so there's kind of different things okay so let's look at the trusted setup so if we did a

trusted there's only two of us here alas okay if we just Tred to do a trusted setup between us we can execute a protocol where by if my private input is definitely private the output of the computation will be um I we can guarantee is kind of random so private random not you wouldn't be able to compute it from just your yeah yeah but the problem is is that you could um stop the protocol running because we've only got two of us if you decided not to play ball or decided to do something wrong we would

then Abol the protocol and we would fail so there's kind of so the thing is is that you have it's easier when you have more people right so imagine we've got four people doing thing you can build a protocol which tolerates one person being bad if two people are bad then they learn all the secrets okay but if one person is bad they don't learn anything and also if one person is bad it doesn't stop the pro the good people proceeding so you have this security what's called robustness that we can that the bad guy can't stop the good guys going on but you also have a number of bad guys that can get together to learn the secrets you have a threshold

for the bad guys and a threshold for the bad guys to break privacy also a threshold for the bad guys to stop the computation proceeding correctly I see so you have you have this balance that you have to bear in mind I want to talk a bit about that second part the Privacy part because when that statement like as long as one participant acts correctly the outcome is usable for a zkp often what you're trying to make sure is that there is uh like an output that is never going to be able to be discovered or or were tracked down right the toxic waste like you don't want that to be recognizable you don't want one person to be able to recreate it and use

it maliciously and so that argument of like if one person acts correctly then the MPC the output of the MPC the output of The Trusted setup is usable this is only to do with the Privacy part isn't it it's kind of different it's kind of so so so if if you think of um how how this kind of interesting because what you have is the trusty setup is kind of slightly uh strange and that what you want is you want everyone to be able to put some random stuff in yes you want a bad guy not to be able to stop the computation M and you want the output to be random as long as one

person is random exactly yeah as long as one person puts something random it will make the whole out the outcome is random okay so so the um so the in some sense the the NPC in this is the first two it's the creating the program that you run in NPC does this the the the the second one so for the last one so for example if I take some values uh this is a stupid example this is not a proper trusted setup right so I take if if we come up with if I come up with a value X and you come up with a value y if you come up with the value if you choose the value why to be zero or one because you're horrible you're the bad

person okay malicious actor yeah you're the malicious actor I pick if I pick a number between not and 2 to the 128 that's really random so if you just add n or one to it it doesn't make it less random my the fact that we when we just add our two numbers together the fact that I pick something really random Yes means that the is truly random so that's basically the program I'm actually executing z = x + y now if you could wait till if the protocol's de designed badly you could wait until you see my X and then you output minus X and you can force the output to be X Plus -

x equal Z which would be wrong so what we have to do is we have this is why it's called a ceremony we have to go in a specific order such that your input can't depend on my input usually the way you do that depends on the ceremony but actually the way you normally do that is actually you would actually impose do a zero knowledge proof that you know your input which would then prove that your input was not dependent on my input and then yeah so we would actually use zero knowledge proofs in the NPC protocol to build the CRS for Z proof or you do kind of these like the the sort of OG ones where it's orchestrated with people in different

Geographic locations where they could not possibly be sharing that information even there you would still have zeroid proofs to make sure that they aren't actually just duplicating results and stuff and they actually know their inputs oh cool yeah nice yeah so that I mean this is how I think I and a lot of folks in in the audience will have really come face to face with an NPC but the this is like I'm also realizing that that is such a unique use case the fact that all you want the output to be is this random number and you want it to be perfectly random so that like no one could guess it that is you know one way to use MPC but MPC multi-party computation obviously the use cases are

so much more broad than just that yeah and yeah and this is what I want to talk about in today's episode because I don't feel we've focused in on on how it's being used today yeah so I think the next well not the best the probably the biggest application of NPC by a long way is threshold wallets so okay where if you want if you want to sign something on a blockchain you basically split your key into different components these key goes to different people or you actually have a distributed key generation which is a bit like a NPC ceremony for Z knowledge and you then have uh an this one of these MPC wallets which allows you to digitally sign stuff on a blockchain you know you got so coinbase have NBC wallet which comes out the

company that um I founded co-founded and then there's um you know five blocks of stuff there's a company called defense in France dfns which has that there's um there's C some in um other countries that you know you there's lots and lots of NPC wallets out there and they're all based on what's called threshold signatures so what you see is that um MPC is also the same thing in in people's minds as what's called threshold cryptography so threshold cryptography is a very old thing goes back almost as long as NPC and that's now like really really big so we're recording this in the first week of October and in the last week of

September there was this is 2023 for those who are catching up listening to podcasts years in the past right so the um so last week there was the first of these nist workshops on threshold cryptography because NY the National Institute of Standards and technology for the US government is going to put a call out for um contributions and Technologies to do threshold cryptography how you do threshold ecdsa how you do threshold eddsa how you do threshold RSA how you do threshold this threshold that threshold the other they're also interested in Zer knowledge proof you know the whole gamut of crypto stuff was last week and um so there's

kind of like there's a really big impetus now to try and to standardize this and and push forward I want to ask you about that because in our episode back in 2019 you did mention that you're waiting for nist to do something like set is it this that you were waiting for this is what we're waiting for this is who four years later so so so this but it's it's not even the it's not the conclusion this is the call to start it it's the call to started so everybody's now on the starting block so it's a bit like the Olympics you know Paris Olympics the next year they were given the Olympics I don't know four or five years ago it takes a lot of preparation and then eventually the guns will fire and the 100 meters will

start so we are at the are people currently bidding to host the Olympics or are they in the Olympics naal okay so what what people are G they doing is they're going to be um they're going to be on the starting blocks okay um maybe it's more like a marathon 100 meters is probably the wrong that's a marathon Triathlon is it a triathlon could be maybe yeah is there like H is there the hash functions need to be or like yeah is there any like other types of Crypt already been done you see so we've already had hash functions so hash functions have been done um we'll come back to what's been done in a minute actually it's cool so we have um so there's going to be a process actually probably worth to

actually go back actually what what has been done and explain what's what's going on okay so what okay so what has been done is in the early 2000s well late 1990s there was something called the advanced encryption standard okay so this was the as algorithm which you use all the time everywhere we encrypt stuff with as everywhere on our phones on our browsers everything so this was actually created in luren which is where I'm sitting now so that's just kind of in Len two researchers came up with the as algorithm and then the US government standardized this via one of these processes that they're currently defining so this was the as process then they wanted to do hash functions so um the Sha one hash

function is considered rubbish so they wanted a new hash function so they called it sha three because sha two was also kind of considered a bit dodgy so sha three and so they had a sha three process and that finished maybe about 10 years ago I forget the right dat now what finished also this year was the postquantum process so if you using a uh blockchain or if you're using your zero knowledge proofs based on Starks no not based on Starks based on snarks yeah I get this right you're based on snarks um your cryptography is based on pairings pairings based on elliptic curves if

you're using ecdsa to do your signing or add DSA to your signing or using eliptic curves now if someone comes up with a qu computer you're toast because all of those things are broken okay yeah so your zero knowledge proofs go out the window your curve signatures go out the window so what the postquantum competition was doing the post postquantum process was coming up with what should be the signature algorithm once an quantum computer comes along so this has now been essentially decided okay so that's that's been finished and so the next thing this n doing is a kind of a process it's not a competition it's a process to solicit ideas and cryptographic Primitives for

more complex cryptographic Primitives and by more complex they basically mean threshold stuff okay look they're looking at old stuff like threshold pre-quantum stuff like threshold ecdsa but they're also looking at thresholding the postquantum stuff so for example the the other signature schemes or FH and other stuff plus plus the ancillary Tech that goes around that one of those pieces of ancillary Tech that goes around that is Zer LGE prints you're talking about this process to sort of get threshold cryptography something but like what are you are they looking for a number of people to suggest methods to

do it and one is chosen yeah one is chosen okay so this is very so in the past they've run a competition which was people would submit suggestions for for example for as there was loads of suggestions and then one was chosen as the winner for this this is just so complex yeah they're not even thinking there's going to be a winner they're basically saying people submit um ideas protocols exampled stuff and they will look at it and say this is a good thing this one we don't think is so good but they will create like it's almost like they I think they kind of wanted to create almost like an encyclopedia of complex cryptographic stuff H do they

want to try to break it too at the same time well I think that's well like it seems weird to just be like this looks nice yes you're get to be included instead of it being like battle tested or something it will be battle tested so but it'll be like but but crypto these days is not so much broken it's much more you have proofs of security you know you yeah you have like a why you know you have this kind of mathematical reasoning why this thing secure or or in this domain everything becomes so complex that um it's actually that in this specific use case you would use this technology and if you change the number of parties or if you change your assumption on the network or if you change your requirements then you would

use this thing over here soort of there's like I think someone last week they just they said here's all the things that nist have said are important we're just going to highlight all the options which which they thought they could come up with a um business case why someone would care about those options you multiply all those different options together and you had 3,000 different options damn before you've even got to the point of and that was just like considering okay we're going to do like threshold signatures if we do threshold signatures there's 3,000 different options for how you would want to do threshold signatures so clearly there's not what going to be one winner

there going to be a smallers ball of different approaches you could have and best practices on best practices too yeah yeah what's the duration of this competition or this uh it's not a competition it's a process okay it's going to take about four you know three or four years would be my expectation but you know it could go the as process was about four years the Sha 3 process was about the same length of time so it' be kind of similar where these things will be public people can comment on them people could try to break them people could try to make them more secure more fast or different just analyze them in different ways see what works what doesn't work what's more

applicable what isn't more applicable so that's kind of a yeah so you had sort of mentioned dkg and like the connection between dkg and um MPC I sort of want to break it down again I know you said it really briefly at the beginning of the episode but I want to actually understand like which falls into under which umbrella or is the dkg used to allow for an MPC yeah um it depends so for example so if you take the zero knowledge application of where I want the ceremony to set things up you can think of that as a distributed key generation where I throw the key away afterwards yes okay I'm kind of I create

a key I create G to the X say where someone is not meant to know X and and I throw it away okay so that's a dkg where you just throw away the secret key at the output at the end so that's an example of of an MPC protocol that I'm going to use in a zero knowledge protocol all right it is so dkg is MPC it's not that used that g yeah the dkg is in some sense an application that I'm running on top of NPC oh it's running on top of M this is the part where I'm confused about go we have NPC's this application layer is this definition of what what we mean to do it's I can compute something where everyone put something in and then I get an output

right that's that right so at the top of that I have an application which is dkg which is everyone puts some random in I produce something and then throw the away and I got the the CRS at the end zero knowledge okay and then that so that's kind of in some sense running on top of this idea of NPC interesting underneath that you have um the the technologies that make NPC but let's get on to that later right so we have this layer which is NPC allows you to compute something the thing I'm trying to compute in a dkg is the key generation I'm doing it in a distributed manner therefore I'm using NPC cool so the DK the kg bit is the application the dkg is because I'm running the application on top of NPC in some sense got it okay the threshold signatures you

also just mentioned that one threshold signatures it's funny because like the example you used was wallets the example I've always known is like the the proposal to use threshold I wonder if this is the same thing threshold encryption I hope it's the same thing for no it's not oh god really encryption is different okay we'll come to encryption in a minute okay the wallet oh true true signatures encryption you're right you're right yeah okay the thing that I was thinking about was this is being proposed for like uh proof of stake validation where to prevent me to prevent people front running or being able to like Place orders before they see an order coming through in the men pool there's this proposal for threshold decryption encryption yeah yeah um and

it sounds a little bit similar though where it's like creating a private space shared by many parties but you this is not MPC no it is it is right because but it's not threshold signatures it's not threshold signatures okay right so let's go so we think about so let's think of threshold signatures then we'll do threshold encryption got it in threshold signatures it's a signature where I've got many people hold the private key and together they're going to come together to sign the document okay okay they hold unique private keys or parts of the private key they hold parts of the private key and they're kept a par and it enable the NPC allows you to do the signature

without bringing those parts back together okay so you have to break into many parties to be able to do the signature so this is how an NPC wallet works okay I see so that's threshold signature I'm doing a signature in a threshold manner so to go back to my thing I have this NPC layer which is my computer anything on top of that I'm running a signature algorithm so my signature is running on top of NPC okay now we can look at threshold decryption threshold decryption is I've got a decryption key but I don't I've distributed this in a threshold Manner and I'm running a decryption algorithm on top of NPC which allows people to obtain the decryption of something by putting everything to by

putting their parts together without actually bringing them together by running the protocol and then that you could use to prevent me because you could basically everyone can encrypt stuff and then you they commit to it and then you decommit by running the threshold decryption and then so wow okay just to make it slightly more cool how do you get the threshold secret key in the signature scheme and the threshold secret key in the decryption scheme well that is exact running the distributed key gener key generation I was going to ask yeah unlike in the zero knowledge case you don't throw the key away at the end because you need it to be able to do the signing or the decryption later on when you say

distributed key generation I always picture sort of like there's a key and it's broken up into lots of keys and you get a piece of the key but I'm wrong right okay never ever ever exists so what happens never exist okay we just everyone comes up with some random and then from that random we manag to create a key plus shares of the key that we can then use an NPC prodal later on the signatures and this is why you say that like comparing it again to ZK where ZK there is a truth you make it secret through through proof through zkp whereas here there is like nothing and then you create a secret and then you do stuff with the secret and the secret is kind of is never actually exists so in

wallet there is a secret behind an NPC wallet because you can do signatures but that that secret never actually exists in one place together yeah okay so it can't be attacked yeah I get it that's cool so the threshold decryption story is it's an MPC itself and the way you create it is to use a dkg which is itself an NPC which is also an NPC where's the ZK in that okay but there is ZK potentially right there yeah okay right so here we so here what we go is so now we have two issues with let me do the me example or just arbitrary encrypted data on a blockchain okay

so what you have is that when you run an NPC protocol we remember what we have to do is we have to maintain privacy but we also have to make sure that the bad guy doesn't screw us over because the bad guy can screw us over by stopping us execute the protocol MH so we might be using inside the NPC protocol zero knowledge to enforce correct behavior and that was that example that you gave for The Trusted setup where zkp itself was in the MPC in order to guarantee or in the DK example you can use okay so then we okay so so one of the other companies I'm kind of working with at the moment is Zama which is um doing FH on the blockchain to do en so

you can encrypt data you can create encrypt smart contract so you can imagine this could be used for protecting against meev okay so now so what we can do is we can encrypt data put it on this blockchain encrypted under an FHA scheme we can do operations on the FHA and then we can do a threshold decryption to get the value back but when we post stuff to the blockchain how do we know that I've posted correct encryptions because all you see on the blockchain is a cipher text yeah this Cipher text could just be crap could just be a l of garbage right so how do we prove that we've encrypted the correct value CK great so I these these like this idea that you yeah you have many

many Technologies so we have this NPC application layer which allow which is this way of thinking we could compute any function on secret data without revealing any of the secret data people input okay that's NPC we have Technologies like fhe which allow us to do NPC calculations you can imagine that the meev stuff or executing a auction using fully hom encryption is an application of NPC but using FH as a way to do that and during that thing we have to prove that the you know suppose I'm doing an election right I can vote for I don't know what's your favorite candidates Trump and Biden yeah I'm not American thank

God I can't who you're Canadian here I can't remember who's in Canada yeah so there we Trudeau and someone else Trudeau and someone else okay so we're going to vote for Trudeau and whoever it is that we don't know there's actually usually like five though it's like anyway right there's Trudeau and Alis Bob Charlie and Eve right okay we got we got five and then when we do an encryption we're encrypting someone we voted for but someone could screw over the election by voting for someone who's not on the ballot ah so I have to Pro but how do we prove that the person who voted voted correctly for one of them yeah yeah they know you have a valid vote especially if

it could be like know one of these weird elections where you vote for a or b and something else and then like this exclusions thing so there might be some complex logic behind so you would then do a zero knowledge proof to prove that what you've encrypted is actually well formed and correct that's cool I me now we're getting into some crossover territory here which I'm very excited for I do want to come back to it but before we actually do that I want to move I want to go into what's actually happening under the hood I think we now have a sense for what the input is to the output who can participate what sort of other types of cryptography you might need to create something but actually in MPC you had mentioned garbled circuits

secret sharing and FHA yeah can we go through those a little bit like what is actually MP what's happening they're all magic okay okay they're all magic they're all it's kind of and actually the thing is they're kind of they're interesting that you can see they're separate but it turns out when when you get to really complex protocols they actually all interact as well so it gets really yeah so there's there's meta interactions later on but let's not worry about that okay let's just do simple stuff okay good okay garbled circuits garc are are they just like injecting Randomness into uh existing data no no a garbled circuit is is kind of really weird it's a really simple idea so you take a binary circuit so everyone does a binary circuit in electronics okay now what I'm going to

do is every wire on the circuit is gu going to have a zero or one on it okay so instead of putting a z one I choose a completely random string for the one and a completely random string for the zero for every single wire in the circuit so every one on a wire so if I have two wires so supposed I have a gate I have an and gate I have two inputs to the and gate and one output to the and gate the ones got there's three wires in that circuit there's going to be three different completely random values corresponding to one and three different completely random values corresponding to zero so that's the gar that's called the garbling the wires and now what I

have to do is garble the gate and the garbled gate is basically a lookup table which basically uses the wires as keys to an encryption scheme and the lookup table has four entries in it one corresponding to each possible entry of the an game and so I basically have this huge bunch of random values which are keys on the wires and a bunch of random um encrypted tables and now if I give you the random label corresponding to the one going into the first input of the and gate and a one on the thir second input landgate they're random Keys you don't know whether that corresponds to a zero one but you use that to evaluate the gate by do using

the lookup table which will give you the random value corresponding to zero or one as output and that allows you to evaluate the circuit but do I see the lookup table you see the lookup table but the lookup table is just a bunch of encryptions okay you don't actually see the lookup table you don't see like what is one to one you don't see what's one to one what you basically see is you see four encryptions and you and you when you evaluate the circuit that you only see two keys and those two keys only allow you to decrypt one of those encryptions and so to try to decrypt all four only one works and so that's the output and you still don't know what the output is it's still just a random piece

of and then yeah and that's that's that's what a garble circuit is and it really complicated but it's actually really fast B computers so they really really so originally these were introduced in the 80s I thought this was just Theory nonsense and then like I know we started doing this in like mid 2000s people started implementing this and we got faster and faster and now really really really super fast interesting is this this garbled circuit part is that like is that a part of MPC is that the first part but then you have to do other things afterwards basic technology so what happens in a gar circuit protocol it's usually a two-party protocol I create the function by doing all the garbling mhm I send the

encrypted circuit with over to you and now I also send over to you the these Keys corresponding to my inputs okay now you need to get the keys corresponding to your inputs so what you do is you then execute a little protocol with me so you get the keys corresponding to your inputs you can now evaluate the circuit like I said you just take these keys to go through the table then you get the output and then your output you just have to map back to the actual output where I've got I I know what that is anyway so I know I can tell you oh your random string corresponds to zero or your random string corresponds to one so it's a little protocol but the main

guts is this garble circuit and it was a two-party it's a two-party protocol there are generalizations but mostly speaking it's a two-party protocol so how do you take that then and turn it into the multi-party now that requires secret sharing perfect that was our next Point incredbly that's incredibly good question right so secret sharing is something that allows multiple parties and so what we have with secret sharing is that we take a secret and we split it up okay so there might be three parties there might be four parties in some sense secret sharing is essentially what is behind uh NPC wallets so we can there kind of very similar idea so you

have a threshold if you have a certain number of parties and if a certain number of them are honest then all works fine otherwise there's a problem okay and the thing is with secret sharing is it's it's linear it's like a lovely mathematical process which allows us to add stuff easily so we can we can execute additions really quickly the only problem is is when we want to do a multiply okay and multiplication now requires us to do interaction and that's when we need to send messages to each other and can secret sharing do that can secret sharing can do that because it's magic so you have this magic LEL protocol which allows you to execute a protocol which allows you to do the

multiplications very very efficiently cool so the problem with secret sharing is that I have to communicate every time I do a multiplication ah think about when I talked about my and gate every time I execute an and gate and and is like a multiplication and is is multiplication mod to yeah so every if I have to communicate every time I do an and multiplication that's a problem but in garbled circuit land I don't have to communicate so what there's these protocols which allow you to do some they allow you do the secret sharing to create a garbled circuit which allows you then to do the interaction without

actually having so many messages sent backwards and forwards I see so you have this tradeoff between amount of data sent versus the number number of interactions you have to do I just said interactive but then I realized as I said that maybe that's not the what you're saying when you're saying messages going back for you're not it's not interactive in the way we've known it is it yeah it's really interactive so it's like it is interactive so the thing is is that if I use garbled circuits I just at you and then you know what to do so it's non- interactive no it's interactive I I tell you once once one time interactive one time okay see secret sharing is multi-time interactive yeah so we've covered garble circuits

secret sharing we've talked a little bit about how they each have their own kind of properties and by combining them you get I guess whichever properties you want actually which properties you want in this case like I guess you don't want a lot of interaction right you want less interaction you want less back and forth yes um so that's the property that the garbled circuit gives you but garble circuits would only allow for two yeah participants secret sharing offers the m yeah exactly and also sometimes you actually the secret sharing is good enough for multiple parties because depends on what you're trying to do okay so then the other technology is FHA and actually wait right before you go into that garble circuits and secret sharing

like secret sharing I think is just the multi but is garbled circuits any sort of computation yeah actually you you basically got encryptions that little table is an is is is a table of encryptions so you but can can you compute over a garbled circuit yeah you basically evaluate the garble Circuit by evaluating this table by taking the inputs decrypting getting value and then repeating okay is that limited or can you do everything you do it for every you could everything you can do whatever you want whether it's sufficient or not is another question but you can theoretically do everything because now my question is why FHA okay so yeah FH so the point is with FHA is you can think of FHA as an NPC protocol

because different people can encrypt stuff and then you have they encrypt it to one person that person does all of the calculation and then you just need to do the decryption at the end to get the result so if you have many parties end parties wanting input in an NPC protocol imagine we're doing an election if we did an election with pure NPC in a really you know really complex election not like a simple first past the post but a really complex ction we'd actually have to have every voter engaging in the NPC protocol okay there's ways around that but generally speaking that would be the what the traditional way of doing it with

FH everybody can encrypt because it's a public key encryption scheme and then we only need a few number of servers doing the computation so there's very small amount of communication and then you have a heavy piece of heavy lift of in of computation and then at the end to get the result out you do an NPC which is like a threshold decryption okay and then the threshold decryption is using secret sharing oh my God so so the f is you have this FG computation which is doing the computation but then to actually get the output out you use a threshold secret sharing based

decryption operation and so you're actually combining all of these protocols you combine together I want to I want to go into this so when you first kind of defined this you kind of mentioned that under the hood there's garble circuit secret Shar in FHA but here it almost sounds like a single wait a single technology doesn't work you need all of them you do need all so but but from what you said it almost sounded like fhe could exist on its own in there it can without garbled circuits without secret share but so can l so so okay right so let's go through them again okay garble circuits can live on their own if it's just just a two-party thing okay okay you can have a two-party protocols just with Cal circuits you can have secret

sharing schemes just on their own and they can do stuff and you can have FH on its own but that would be you encrypt something to me I apply the computation send the result back to you you decrypt so it's almost like it's a two-party thing still okay it's a very special views case it's like you're Outsourcing data or getting the result back okay now what I'm G to now do is put them all together so so MPC I mean FHA in MPC just means you can do that kind of thing with multiple parties I guess okay so the point is you can do it with is you put FH can compute the MPC computation and then at the end you use a threshold

decryption which uses secret sharing to get the result out however you could put all three together because suppose you wanted a garbled circuit appli apption because it has less backwards and forwards but you wanted multiple parties so what you would build that on top of a secret sharing scheme application okay which allows you to do the garbling efficiently with very few numbers of rounds but then to start the secret sharing application you might start with a special protocol called speed that I helped developed about 10 years ago which uses fhe the initial process oh yeah build the secret to build the secret sharing NPC which then

allows you to do the you could have an NPC application which uses all of them interesting I remember so I remember in our last episode I think we did talk about that quite a lot and that combination of FHA and MPC like in that exact yeah case but I still want to understand if like would you say that all MPC protocols have FHA in them no or is it really optional it's optional and it's also all of them are optional garble circuits are optional secret sharing is optional f is optional so this helps me understand also then like MPC is almost like the umbrella term for the action of multi-party computation but it can be done there's so many like what multi means could be two or more yeah right and that will that will

determine what kind of underlying crypto cryptographic techniques you're using yeah I've for some reason yeah this this connection between MPC and FHA what I still am left questioning is almost like why do you need FHA like if you just think of MPC garble circuit secret sharing it can do any sort of computation maybe not that efficiently is what you sort of mentioned but like yeah why do you even need it I still don't understand what it adds or what it changes let's let's go back right so remember for secret sharing every time I have to do a multiplication I have to communicate so my amount the number of times I have to talk to you corresponds to What's called the depth of the

multiplications How Deep The the circuit is okay right with garbled circuits I don't have to it doesn't depend on the depth but it depends on the total size of the circuit so I can send you one piece of but it's a lot of for a while take a while for you to get there okay with FH the amount of communication only depends on the size of the input not the size of the function okay so for example suppose we're so if we're Computing a very wide function um like an auction say yeah actually an auction is a pretty shallow circuit it's just like which one's the

biggest right so but there could be a lot of input might not make sense maybe to use FH in application but if I had a very deep thing suppose I was encrypting data to you and you were applying a deep neural network to it yeah it's going to be much more efficient in the long run because I I'm only giving you the input encrypted and then you can evaluate the function without any communication whatsoever and in the real world we're limited on how much data we can send we might think we're not but there is a limit to the speed because there's apparently there's a speed of light maximum speed limit that you can't exceed and there the pipes are oh yeah who knew yeah and there's a pipes that

are of a certain size where there on the other hand when it comes to processing power there seems no limit on processing power M's laws stop working and we can still increase the amount of processing power yes processing power seems to be unlimited of in effect whereas bandwidth and and and and and ping times actually do have physical limits so that's why FHA kind of makes sense in application for some yeah does FHA and garbled circuits replace each other then usually no so you can well not garble circuits are very yeah in in terms of deployed applications there's less garbled circuit deployed applications I would say it's kind okay so like but I'm

just wondering if they're interchangeable like depending on the use case no well they can't yeah in some sense but no yes and no I'm sure I'm sure to implement it's way more complicated but I just mean like architecturally you have these three boxes would you no I I think I I would treat them as different architectural blockes that you can combine in different ways okay you would not different pieces imagine they're different Lego brick they're different sizes they're different shapes of Lego bricks okay I could take this stupid piece of Lego brick and use it as my basis of my car but this one might be better but I could if I was a 5-year-old kid get away with this other one and just use a bit of imagination cool you know what's so wild is so many of the use cases that have

been proposed for ZK I feel like either are also solved by MPC or sometimes like actually are only solved by NPC that like ZK had been proposed as as some way to make something private but when you look at like you know say I mean I think you said this on the last episode but it was like the hospital data example that's been brought up so often in the ZK context of like there's data in every place and we want snarks to like somehow prove that it has some characteristics and we then use that to to do better statistics shared over hospitals but in this case it's like the computation would actually be done in a private setting from all of these yeah exactly

uh individual sources yeah exactly so it's or actually fh2 fh2 so basically it's NPC as the application I'm bringing data together to compute something yeah but you use garbage circuit secret sharing or fhe to do that depending on the function situation yeah but actually even that example would FHA be the right one there as I think through it it's like you encrypt from all you're getting encrypted data and then you want to like do some computation could f for that that would you just straight up use f because like can f though take more than two inputs yes so the whole point is is alone just fhe just fhe except how do you get the output at the

end oh so the point is is you compute so every all the hospitals could encrypt their data to FH FH does the calculation and then to get the output out you need someone to have the decryption key but you don't want someone to have the decryption key so you use threshold decryption I see okay so it's like the second half of it like it's the although in some ways if you are just trying to get like a data like dat say you're just trying to find statistics the output of the computation could be visible like it's okay if someone sees that right yeah but the point is you have you have to get it out of the engine if if you're encrypting and Computing on encrypted data the encryption of the say your computer in

the average you take put in you encrypt the a average you've got an encrypted average you want to get that out so how do you get that out you don't want to give someone the secret key you do it in a threshold man I see I see and because if you gave them the key it would actually reveal everything in the encrypted space not just the computation not just in the FHA okay interesting so it sounds like FHA and MPC are very very closely tied yes I mean so this is my what I said is that kind of like maybe like in 2019 I was kind of making the bit of a distinction but now my kind of thing is NPC is this name of what you TR doing and then underneath you're using Goble

circuits Le secret sharing or FH and FH is the one which you have less communication it cost you ination but it's less communication yeah and it's funny because I think from your from your work like MPC as the umbrella term it's funny because like in my world ZK is the umbrella term because everything is ZK even MP even though I know it's not um but yeah I I actually want to ask you a quick this is a bit of an aside but I don't know if you saw Justin Thor's like 17 misconceptions about zero knowledge snarks I don't know if you saw thiser one of them one of the misconceptions was sort of using ZK or like I think in his particular thing it was ZK snarks and the ZK of ZK

snarks are is in in a lot of the cases doesn't actually exist so people are using snarks but no CK um I do Wonder though there's also been some debate about the umbrella term of zero knowledge to Define Advanced cryptography at least for VC purposes I wonder what you make of that do you think that's bad or good it's very lazy it's it's really lazy um and it's kind of silly really because actually it's using the snarkiness not the ZK snarkiness is is is a really really important thing because it has applications way outside of blockchain right so if I'm sending stuff just a

normal web2 application to Amazon and I want to know that Amazon has done the right thing that I've paid the money to do the right thing they could send me proof that they've done the right thing yeah so this snarky bit is yeah I think I think is actually that should be that's that's actually probably the most applicable bit of the whole Tech and the the zero knowledge is like it's like oh yeah well we could also do zeroids yeah yeah are there any concepts from the snark part of ZK that's been used in NPC like is it such different cryptography that it doesn't share anything or yeah has there been any overlap not really well apart from NPC has been used

to help snarks out but snarks don't really help NPC out because they're also I mean like they're still using eliptic curves they're so old fashioned yeah you know so in the what I was going to ask oh my God that's just just so old you know in terms it's not actually old using old crypto and and I think the NPC Community is we don't want to use old crypto we want to use stuff that is going to be secure when someone comes up with a quantum computer and I think that's the real the really killer application so not the killer application the killer issue but if you you know anyone listening to this podcast wants to have a startup that kind of is gonna conquer the world actually replace have a postquantum

version of snark yeah but also aren't there more and more like post Quantum parts of snarks in a weird way like there's been the I mean put using fry yeah there are yeah there are there are there are bits but actually having you know like so you have this kind of like there's different performance tradeoffs if using snarks versus Starks but you know actually if you could have the snarks and and everything that it's not just that the snarks the classic snarks aren't postquantum it's just that all of the components they use aren't postquantum and if you could get their components to be postquantum has also loads of applications elsewhere you it's all sorts of um so for example we can't do so we want to replace ecdsa as the

signing algorithm on bitcoin or whatever DSA on whatever change using a DSA we can't do that yet with one of the postquantum signing algorithms because we don't know how to do the postquantum signing algorithms in a threshold manner so we couldn't have NPC wallets with a postquantum NPC wallets well we could but they wouldn't be very efficient so that's something that this you know this n threshold thing that we talked about earlier is going to be looking at is can we have postquantum threshold signatures you know and that's like an open question so there's lots of this little little bits of tech here and there that's used in the blockchain world which is which is old is nist also looking like are there

components of ZK that they're also trying to check for standardized they do mention ZK in the in the thing but they're kind of using they want to they're interested in ZK specifically for the threshold application I see General ZK okay okay because that's a whole new kettle of fish that's like a huge amount that post Quantum question like actually this is a bit of an aside but like I know that there is some work towards lattice-based zero knowledge proofs would is lattice based cryptography postquantum Lattis based cryptography is postquantum so but there's some problem but there's the real the thing is with analysis it's about stuff being small so you have

stuff that is or is not small and the question is is how small is small so kind of like a really yeah so so so very very easy to explain the issue so what I do is I encrypt or I have some cryptographic blob that inside contains something hidden which is small so now what I want to do is I want to prove that that blob is correct so I want to prove that the small thing is actually small because that's what being correct means the small thing is small okay but I can't quite prove that it's really small I can prove it's kind of small but not really small and this is what causes the problems with zero knowledge in laes and that's why it's really difficult

because I can prove in zero knowledge it's kind of small but not as small as I really need and so there's there's this sort of call it this this this is the soundless gap is between the gap between what you want to prove and the Gap with with what you can prove is there's this little little bit there that you can't quite get and when you say small or very small are you talking about like probabilistically is this probabilities no I just mean really I mean imagine I got imagine I got like I don't know 128 bits of Stu inside this 128 bits of stuff is hidden 10 bits of stuff which is must be 10 bits of stuff but I might be only able to prove that it's 12 bits of stuff I see 12 is still small it's just not as

small as 10 and then and then so I kind of then I can't so that's why the problem is is that when I prove something the thing I'm I'm able to prove is slightly bigger than the thing that I'm really after and so I have this kind of mix that I really want to fix I want to make sure that we in today's interview cover a little bit of what state are we at in MPC and what companies and projects are you thinking about in terms of like doing this kind of work because yeah we really wanted to use this as a little bit of a check-in point on MPC but also potentially yeah you know giving us and the audience a

bit of direction on where we can look next and maybe you know other guest yes let's start with the state of the tech a lot of times when yeah a lot of times when we talk about these this cryptography we might be like this is what it can do but it doesn't mean that it's been implemented that it's been optimized it's sort of like theoretically this is what it can do or will do where are we at with MPC like does it live out in the world I mean I think I think it does but okay so there there are real applications in the real world okay so if we talk a general MPC which allows do the hospital application yeah so there are companies doing this um in in Switzerland there's a company called infer which does stuff with

hospitals there's a company um tune Insight also in in it it switzland does this there's a company called cybernetica in Estonia which has a really big application on this for Lots there's a few companies in Holland uh I've gone up remember at the end of the show I'll probably remember what their name are NC companies doing the kind of like the the big data type applications and there's a whole um alliance called the NPC Alliance which represents all these companies and if you go there there's like about 50 or 60 logos of different companies there what about I heard I heard that the big kind of AD Market places like Yahoo Google like is there some MPC in there so so um because of

third party cookies being banned ads really the ad infrastructure really relies on third party cookies okay this is like Legacy Tech from the '90s so to replace the Legacy Tech from the '90s Google and bet and others are creating NPC systems to do adtech so to get around uh third party cookies so you might have seen some people in their Chrome browsers have now got configuration for Google privacy stuff to do with ads this kind of enables some sort of NP CFI protocols there a meta are doing the same and others so that so big companies are doing this the the hospital examples so that's really deployed in the real world okay so that's traffic is traffic a real thing

or is that just theoretical oh using MPC for traffic because i' I've heard this a few times I think you even mentioned it traffic I think you had mentioned like satellite data like where satellites are but I've also heard a car example yeah there are car examples but I not sure sure if they're commercially deployed that's the kind of thing there lots of lab or PC level stuff but actual commercially deployed with real customers in the real world is I think that you've got there's a few with medicon and then there's um or big data which like cyber probably the biggest company doing that and then there's uh met and met and Google doing stuff on on the ad infrastructure in that ad example

is that auction is that like for the ad auctions kind like it's kind of like auctions or it's also uh your preferences so to making sure so you know there's really annoying ads you get when you look at Facebook yeah well I don't go there anymore but yeah apparently there's something to do with you know they might look random but apparently there's you know this is why I don't believe AI is going to take over the world if AI can't actually give me an ad I'm interested in it's not going to do anything is it right I mean it's useless I mean this is the biggest amount of money spent on AI is to give me ads that I care about and it doesn't so clearly it doesn't work right but they think it does so they kind of sell it so they kind of got to do this in a

way where the ad company doesn't learn Le the customers preferences beyond the fact that they're just they're interested in the ad well interested in quotes in the ad okay okay so there's a kind of and also um you don't want to influence the auction so that meta can't front run the auction or things like that got it that's that's NPC if we look at NPC NPC for privacy if we look at NPC for threshold there's loads of applications loads of people especially in the blockchain space so um NPC for threshold signing I was in a company in the 1990s that had this for its CA so when you had that you had you know had a distributed

RSA signature to do the certificate Authority signing in the '90s this is not modern this is really OD was there FHA in that in that type of MPC no no that was like Maes okay then we have then we have companies like coinbase which we mentioned their NPC wallet fire blocks are similar there's a really cool company I advise in France called defense dfns um which you might want to get them on um there's Jonathan CS works for them and Chelsea commo Chelsea is the one that's come up with this Frost protocol which is really popular community so that would so they're are really cool interesting there's loads of others and there I think there about 20 in that space they're they're also in the NPC Alliance doing stuff so that's kind of deployed and used by millions of people

all and loads of you know trillions of transactions today probably go through their um their networks um you have the ZK in in zero zerach that's deployed you know for all these ceremonies that people deploy so we have NPC for that and then if you kind of look at FH so FH there's a number of companies doing FH there's um enveil in the US duality in the US and I'm involved in a company called Zama which we've already mentioned and they they they've also been on the show that was one of they've been on the show there's no point having them in the future because they were on two months ago so so Z do a you had brand on the show Z do uh like an since since it was on the

show um zamo has launched this um encrypted version of the ethereum so you could do ethereum smart contracts on encrypted data it's kind of using the kind of tech we've been talking about for the last hour or so so this is on the FH front so I want to understand what are the open problems like what state are we is it all of these libraries are so perfect they're postquantum they work together perfectly or or is there still work to do what to do so for example let's just kind of and actually let's look at the interfaces because the interface is where there's really cool work to do so I send data encrypted to somewhere the cloud or a blockchain and they then compute on this

in an FH so I want to know that they've actually computed the right thing they've they might they don't know what they've computed on this is not a priv issue this is an issue of have they actually computed the right operations so that's a zero that's not zero that's a snark application because there is no secrets no Zer knowledge there is no Zer knowledge it's public stuff just can you verif can you prove to me quickly that you've done the right thing that's a really big open problem that's that's really really uh interesting and the reason the reason it doesn't work right now is this due to the type of cryptography underlying ZK still ZK so slow is because it's too slow snarks are slow snarks are super slow so snarks

snarks snarks are really slow if you've got a really small so what what do we use snarks for to prove that someone executed a smart contract correctly yeah how long's a smart contract it's not really that long it's not a big program at all really is it they're really tiny they're really really tiny programs and so actually snarks are mostly K technology is for very very small programs and we want to do it on mega mega mega programs oh you know so um so if you could solve that you could solve all sorts of other things you could solve um I could Outsource you know how do I know that Amazon has actually processed all the stuff in the cloud as I asked it to it could just give me a quick thing back going yes you did the right thing bam that'd be kind of cool

so that's one application two we just need stuff to go faster okay we need stuff to use less bandwidth so if you talk about the secret sharing applications or you talk about the gble circuit stuff everyone send less data because communication is expensive um I want to store store less data how do I store less data how do I yeah if if I store stuff in secret shared form or or encrypted form I want that to be smaller amount of data so how do I do that so there's loads of open questions there's loads of things especially on interfaces what about on the FHA side because I'm still hearing that like it's kind of not fully usable not fully there okay so for example

um so with it depends what you mean by fully there okay right yeah let's let's go into that though what what isn't there for FH but first let's say what's there find what is there right okay so if you if you think about the time it takes to do executions on a blockchain and a smart contract that's relatively slow anyway F can do that can work at the speed of a blockchain okay so the F can work at the speed of a blockchain so that's still that's fast right so we have that now we go we want to go faster or we want to have more throughput now today there are a large number of companies um around there Intel is kind of one of the bigger companies there's

ingonyama opis um others NE oium actually producing Hardware or in the process of producing Hardware now we already have can do a speed up of a h hundredfold speed up with fpga you can just buy an fpga implement the FH algorithm and you get a 100 volt speed up so if something plausible now we can go 100 times faster with no expense whatsoever today just having to deploy it if we then go to Asic and we put that in Asic we can go a thousand fold faster and those are meant to come online 2024 2025 so so the math is going to go faster but just the the

fact that you've got Hardware coming on board that's going to be coming on board in the marketplace in 2425 there's startups working in that space now there's a really really cool company is there actually A6 coming for or is it still A6 being produced could be coming on to this there's a really cool company called optalis in the UK which is going to be using optical Computing because the thing that you need to do and actually these are the same this is the same technology that you would use to accelerate Stars okay because basically what you need to do is you msms is MMS you want ffts ffts okay okay so we did we did an episode on Hardware a couple episodes msns and ffts

msn's are eliptic curves they're old Tech so we don't want those for ZK but ffts nfts they're the things that are postquantum they work and you can accelerate ffts and nfts you can apply it to zero knowledge and you can apply to FHA and the what's interesting about this company optalis because it's Optical and fft is an optical operation so it's for free okay yeah it's kind of weird I don't know it's weird what do you mean Optical I don't know if I follow that Optical Computing is like instead of working with um with binary signals Z1 you work with light and then FB is actually basically an operational

light which is for free so it's power it's powerless it's just it just do it and so so optalis is this kind of cool company that's got Optical computers and they're going to try to accelerate ffts using um Optical processing which should be which would be like even better because it would be less environmental cost less power and they should be super fast but again yeah so there's loads of stuff coming on there's fpj coming along in the next year as6 coming along in two years Optical Computing coming along and each one of those things should also benefit the zero knowledge space and quantum computers will not destroy it all quantum computers will destroy the blockchain because you're still using

elliptic curves and stars but everybody else would be fine okay got it Nigel thank you so much for coming back on and sharing with us sort of the state-of-the-art on the MPC front and also allowing me to kind of go deeper on what's underneath the Hood um I really appreciate that so yeah thanks for being on nice to be on thanks very much cool I want to say thank you to the podcast team Henrik Rachel and Tanya and to our listeners thanks for [Music] listening