Indistinguishable obfuscation. The tech that will solve crypto! - Jordi Baylina

Transcript

[Music] Is it okay? Oh yeah, one moment because this is um the setup. Okay, there we go. Well, today um I mean well right now I'm I'm I'm working right now the the my main project right now is ZISK. ZISK is a uh

ZKVM. It's based on the uh I mean it's in the a project inside Polygon and it's a Polygon I mean it's a ZKVM is a technology that's trying to uh prove things in real time. I mean ZK is has been a technology that has been evolved a lot during the last years. Okay. But today in my presentation I want to talk to a new technology. I mean this it's it's a technology that's not even ready right now but it's a kind of what's coming next after ZK. Okay. And this is like the the holy grail of cryptography.

I mean it's a a technology that's called uh offuscation. Maybe many of you have been have heard some some point that cryptography by offuscation doesn't work. I mean this is a a thing that uh you may hear about. Okay. But actually um well there are some recent um papers that it's been proved that at least it's solvable. We don't have a solution for that. But I want to present and I I'm I'm explicitly I want to talk about the applications. I mean what can you do? So what's this technology and what can you do? I mean seen from the application perspective and why this technology can be important in the near future. Okay.

Um so what's really obuscation? I mean obuscation is is even I would say it's even much more simple than ZK. I mean when you the first time that you hear about ZK it's quite of magic and you don't really know understand what's going on butuscation is very simple. I mean what we are doing in offuscation is we are taking a program a deterministic program with an input and output. Okay. And we are like offuscating. I mean we are like like compiling. So the way that okay that this program I mean it's like imagine that you compile. I mean when you compile uh you cannot see what's inside but imagine that's a cryptographic compilation. I mean it's something that you cannot learn anything of what's inside the box. Of course you can execute it. You have an input. You

have an output. But if you are trying to see the code that is compiled code you cannot learn anything. You cannot see anything. So you put an input you just execute some commands and the output magically appears something that's a I mean it's the same that this program okay and the important part of this offuscation is that also this program can have a private key that nobody knows I mean in this procession this private key is generated and nobody knows this uh private key it's a private key that's in there you can execute programs against this private key but you cannot nobody can discover and can see this private key. So this is very much what's offuscation at at at high level.

You see that's very simple. I mean you're offiscating a program. I mean you're just hiding a program and with a private key which is really important. It's probably the most important part of this uh system. Okay. So let's see if you have I mean assume that this is working. Okay. So okay what can you do with this? Okay. Well you can do everything in cryptography. Okay. as an example. For example, you can do very easily a ZK, but the ZK how you would do it. Okay. Well, you have a program that whatever you want to prove that I mean the same program that you are using in in in in ZK, you offcare it, you put it here. You have a private key that nobody knows. But private key don't knows. But this this you may have a public key

that's already known. Okay, this private key can generate the public key. So the public key everybody knows but the private key doesn't know. So the idea is that okay you get any input you execute that and if this program happens I mean if it's okay you just take the public output or if it's the public output is that is valid then you just sign this uh uh this uh public input output uh uh with the private key that's inside the box. So verifying the zero knowledge is verifying a signature.

So you can have a full zero knowledge program and instead of using some elliptic curves thing you just do normal signature and verifying it with a zero cover you just get a signature you get a zero knowledge. Okay. So even for something that's as simple as that, you can you have a I mean you have a lot of advantages here. Okay. What else you can do? Well, you can do easily fullorphic encryption. I mean omorphic encryption means that you can mean you want to do a computation uh mean you are a computer mean a trustless computer. So I do my I get my data I encrypt the data I give to you. The computer just execute that in an encrypted form. It returns me the result and then I decrypt it. Okay.

Well, you can have this program embedded in one of these auscated box, okay, that's running in some computer way. And then what I do is just I encrypt the program with the private key of the box. The computer executes this box whatever uh of course the program encrypts that and it gives me the result to me. Okay, very so it's quite a straightforward doing full uh uh fullorphic encryption if you have this technology. Actually there is window wind encryption is even simple I mean because windows encryption is like fullomorphic encryption but the result I mean the result can be decrypt I mean it's already decrypted uh uh in the right way I mean this decryption is uh

uh on that way why uh when this encryption is important well let's let's just do for example some interesting applications something that we cannot do now okay but for example imagine that I get some content some image or some video that's encrypted with a uh with a with a mean with a with a with a key, okay, with a with a with a normal cryptographic key, okay? And I want to say I want to set up a system, a decentralized system that um whoever uh sends uh some money to some smart contract, they get automatically the decryption key of that file without having a centralized server. Well, you

would do it this way. I mean, in this box. So, you encrypt the the you encrypt the key with some uh with some private key or some derivation of this private key. You encrypt the file and then in this box actually you do a verification, you can execute or you can just verify as a verifier. So you prove that actually you prove that you send some money to sub smart contract and then if this happen I mean the code of this program says that if this happen then it it gets the private the the it reveals the key or the derivation of this private key. So you can do that. I mean you can set up that. I mean you can just set encryp a file uh put it in IPFS or somewhere else and set up a smart contract is whoever solved this puzzle

or whoever sent me some money here or whoever whatever then uh it it it it will get automatically the decryption key of that and forget about that. You can signatures of the Dow this is very much the same. So imagine that that Dow a smart contract. Okay. But smart contracts cannot really sign things. I mean they can I mean well a zero knowledge of that something that the transaction has been happen or that some event has emitted some event it can be understood as a signature but actually they cannot um maybe sign something for a bank or some some something in a a third party system.

Well with this system you can you could I mean and the schema is very much the same. You prove something you execute something you prove something. And if this is if this is correct, I mean if this smart contract goes to certain way then uh if you are proving that this is correct then um you will sign something maybe just sending some funds or doing some signature here. Okay. So this allows uh this technology allows easily to do these things. Another interesting thing is uh bitcoin bit bitcoin breaching or bitcoin if you want double pegging without forking bitcoin which is uh interesting. How would it work? Well, the idea is that I mean you send funds to some bitcoin address and uh it's a

bitcoin address is uh is uh is is I mean is managed by this private key that nobody knows this private key but has a I mean it has an address has a public key so it has a an address. So you send the funds there of course you go into Ethereum or to other chain u you generate the tokens that the wrapping tokens whatever but then when you are sending back how you recover the funds because these private keys don't know well in this case if you prove that in Ethereum you have been born you burn the the you burn the the keys then this box will sign a sending transaction that will send you back the transaction. So with this you can have a decentralized bridge with Bitcoin

without having to fork anything about B bit B bit B bit B bit B bit B bit B bit B bit B bit B bit Bitcoin this works from Bitcoin to Ethereum because Ethereum is proof of stake and then it's final okay if the other chain is not final then this system doesn't work but in this case from Bitcoin to Ethereum this system would definitively work and for any two systems that has this concept of finality this application uh would work what else well multi-arty uh FH E I mean that's very simple I mean you if you want to do any computation of I mean many of you have different data okay but you want to keep this data private okay and you want we want to do some computation of this data and the result of this computation be selectively shared with some individuals well this

is quite obvious I mean everybody gets his data it would encrypt this information with uh with it would encrypt this information with uh uh I with a public key of this box. Okay, they would send this box would will decrypt this information do whatever computation take the results and encrypt them uh these results encrypted with the different keys according to the rules that you can do but you can do that actually I mean the cool thing is that you can do that in in a in a single round I mean you can do just executing that which is I think it's uh really cool application for this I mean there is one one related application related to that for example is for medical data

Uh imagine a system that you can publish your medical data but your medical data is encrypted uh with something that nobody knows but you know that this medical data can be used for a given specific programs. Okay. So you get you keep the privacy but if if for sensor time programs that maybe they are data or they do some correlations or some limited computation on this data then this is uh workable. Okay. So you get it allows you to to work in I mean to see in that direction in this privacy for multi-party uh computations voting I mean voting at the end is a well it's it's a generic of a private estate thing but the idea of a

of of of uh I mean first you go for the private estate first I mean the private estate at the end is I mean private estate is for example what Aztec is doing or these things at the day is I mean right now the Ethereum has a public estate So everybody knows what's in the public state. But imagine that this state is private. Okay, so that nobody knows is it's encrypted somehow. Well, you can get the transactions. Maybe the transactions can be encrypted so that nobody knows what you are executing. And you have this box. And this box mainly what's doing is okay is decrypting the transaction decryting the state executing the transaction on this uh state that's already decrypted encrypting the state and maybe putting some output and that can be free that

can be open or or or not. Okay. So with this technology having private uh blockchains is um trivial. I mean it's natural uh uh uh to have voting is very much the same because in voting is I mean you get this you have a private estate which is the results of the voting and you want to keep them private. So you get your vote which are your transactions and this box would uh decrypt the boat actually do the summation addition or the checks verification whatever is done in this box and at the end uh uh encrypting the state for next pass or uh you get a receipt uh from the user that's also encrypting the state okay and you can

use that for doing uh normal voting okay um anonymous identity I mean this is a super interesting application is uh right now for example if you want to use your pass use your passport to vote to generate a nullifier actually I mean well with some passwords you can but in general you cannot because signatures are not uh deterministic in there okay so you cannot have a an identity uh so you want to have an identity that's usable only for one unique application with that um you can do that and the idea of this uh anonymous those identity is that okay you prove that you hold the p that you

hold the password and if you prove that you hold the passport this box will generate a deterministic key I mean a key that's based only on the on the private key the application and the ID is going to be hash derived from that and this going to be give you a nullifier a nullifier in general you want to sign this nullifier because you want to verify that this nullifier belongs to this identity but this will give you a specific number that's attached to one ID to one application ition ID. Okay. And you can generate I mean with just using normal U IDs you can uh use this to generate these unique uh numbers from identities.

Okay, this is just a small number. I mean this is a small example but this is there is a u a bunch of much other uh uh uh much more other applications that you can do uh with this uh technology actually I mean you can you you can solve uh uh things for example doing bitcoin rollups this is quite obvious uh uh on that you don't need and when I'm saying bitcoin rollups means bitcoin without having to fork bitcoin but it's because you are converting you can convert I mean you can use normal cryptography uh having this uh having this box. Okay.

Um in terms of setup there is uh uh games I mean games that you need to hide uh some state some common state but that nobody needs to know about that this technology applies very much as you can see I mean um all these applications do not think that you need uh offuscation for doing this application for doing you don't needation what I'm trying to say here is that if you if you solve for offuscation actually you have everything solved. I mean for a lot of these protocols there are probably more simple uh protocols that uh could may work so that they may work. Okay. But this is uh the nice thing of this technology is that it

allows you to I mean it if we solve this is like we solve like almost everything. This together with with blockchains I mean with consensus I think it's it solve a lot of the things. Okay. This is why sometimes this is called I mean is the god computer or if you want to be more politically correct I mean omnipresented trusted computer. Okay. Because it's it's like I mean it's it's not a service. I mean it's a computer that you everybody can run. I mean this this this thing okay so it's a computer that's everywhere and actually is god because it has a key that no nobody knows and but but it can execute things on on that okay so it's it's the the nice thing of this protocol okay and I mean what's the current

state-of-the-art well the current state-of-the-art is I would say it's a little bit depressing okay and that's why I I mean that's why my interest in um in in is to give this this this talk is because at this point there is less than 10 researchers that actually working on this. Okay, I think we need to improve that. So that's I think I mean uh I want to give awareness of the importance of this technology on the quantity of things that you can solve and how much we can we may need this and uh the effort currently the effort I mean if you compare the number of uh ZK researchers that we have right now compared to the numbers of people that's working in this problem uh is uh is is really really really is really low.

Okay. Um here there are some uh interesting ideas that coming some about local mixing. I think that there is uh uh I mean my colleague Jay is doing a presentation about local mixing in one hour or so some some in another room. I mean if you are interested you can go there but I mean but there are other interest and a lot of paths that has not been explored. Okay. And um what's clear is that can be uh sol you know how mathematicians work. Okay, I mean if you go for mathematicians they they say that a hash just this random oracle and just does not work but actually a hash works.

Okay. So and it has been proved that with these probabilistic things this u uh this is technically I mean it's mathematically possible that this will happen. So it's uh uh it's of course it's an open uh uh problem. there are a lot of new uh ideas that are coming and and a lot of uh fields that has not been explored. Okay. And here I would I mean if if any researchers in the room or people that has contact with researchers I think this is something that should be uh put more effort in trying in trying to achieve. Okay. just uh I mean this is just a want to give you a high overview of for example how uh I mean if we have

this technology how we would create a normal I we call it IOBM mean something that's a generic uh computer like that so and the idea is well if we have this box actually we don't have a box that's doing a specific things actually can have a box that's able to execute any ofuscation program on that and at the end it's just doing a clock I mean a processor block. Okay, so the idea is that you have a state uh mean the processor at the end is a state machine. So you have a state that's uh encrypted then you this block just decrypts executes one instruction and then encrypts the state. Okay, so you can with this you can have a what would be a IO VM. Okay, this is a little bit more complex because you need memory. So

maybe a memory can be like another box and is doing all these mean oblivious memory so that you don't know even what you are accessing and what you are not not accessing and uh yeah the last slide probably you will need some uh free input and free output so just to have but the idea here is that you can if you if we solve this even at relatively low level you can have a I mean let's say a universal BM box that can execute uh uh everything in in an offuscated in an offuscated way. Okay. And this um I mean the future maybe this u um IO box can be embedded in a in a in an ASIC or I mean

in micropro I mean in a in a hardware embedded so that can be executed maybe 1,000 times or 1 million times as lower that you would execute a normal processor. But actually mean for encrypting uh one transaction you don't need much. I mean with you combine that with ZK and things you don't need to huge programs to be running that for for for being useful. Okay. So that's that's the presentation. I think it's a cool tech. Um I wanted you to know that this is something that's happened. [Music] Yeah. Thank you Jordi for this. Actually I was working in this field like 15 years ago and uh from the paper from

Barak I'm sure you already know that paper he he proved that uh blackbox virtual offiscation is impossible theoretically and after that you know I just stopped working on the field it's this has been over overcome and actually has been proved that uh it's very much like the like the run like like the the like the random oracle dilemma. Okay. So, it's actually is possible assuming without having hardware component like TPM, right? Yeah. I'm not I mean I'm not uh uh Yeah, I mean maybe Jay he want to answer that. He's more it's somewhat it's only so the proof

only works for very contrived programs like self-heating programs. you can have general blackbox of um and it's just that uh like when you have cryptographic proofs it's just that proof is only for very very contrived programs not for like general programs so like that paper doesn't say is that you cannot have blackbox sophistication but but that I mean it's a hard problem I mean it's not so but I'm saying that there is only 10 persons yeah that's why 10 people it's probably maybe it's a too difficult problem to to solve problem here um the normal path of cryptography is I mean we started with CK maybe the next step is uh fullomorphic encryption and maybe next step is forcation so

maybe just that's let's say the natural highway to go to this tech but and here is a controversy and this is in but I have the intuition that they could be shortcuts to uh uh ofuscation that's my intuition I mean u most of the people in the research don't agree with me Okay, but that's that's just uh just telling. Hey, thanks for the talk. I excuse the new question. So, what are the main differences between a TE and uh this obiscation? Cuz it sounds like it achieves the same thing but uh at maybe different the the the the yeah the the the the encryption. Yeah. The the witness

encryption with a fusation. ZK. Yeah. Oh, no. ZK is you are proving I mean here is so in ZK you are proving a computation. Okay. So you have a computation and you prove that this computation is uh correct without having to execute the computation. Okay. In this what we are doing is we are hiding a program. I mean we are uh offuscating a program. Okay. I mean we are talking about programs. Okay. because when we are proving the execution of a program and the other is we are executing the program in an offuscated way. Okay. So that's why pro I mean this is much stronger. Okay. So this offuscation is

much if you get this you get ZK automatically because I mean if you can if you can execute fuscadian programs that mean that you can prove the programs. Okay. In ZK you are just proving. So the idea is that you are shortcutting. I mean proving that you execute a program the easiest way is you execute the program. I mean this is the trivial way and the only thing that ZK is doing is um reducing I mean is this succeed part I mean it's just reducing the reducing the the the effort that needs to do the verifier uh in order to verify a computation okay uh in this case what we are doing is we are of I mean we are anybody can execute a

program um but uh nobody knows what's inside the program actually The important part is not the fuscation of the program. The important part for most applications is the fuscation of the key that's holding the program. So actually what a lot of times the program is is is known and is is you know what's executed. You want this to be known. Okay. But uh the important part is that you cannot uh learn anything about the key that's using the program in there. Okay. which is I mean from the technical perspective is not exactly I mean this it's a less restrictive thing that if you want to do a real full offuscation okay but these are details on what you want to solve

but I mean if you solve that this offuscation of the key with this most of the application that I've been talking about it's already solved it's you you get it it's just as an um well I think that time time over but uh a lot of people has tried I mean a lot of engineer years have been trying to do offuscation. Okay, but all this is broken. Okay, so we are here. We're talking about uh lay off auscation. I mean it's a cryptographic offuscation. Okay, we have at least five more minutes. So uh let's go on the questions. Okay. Uh I'm sorry if this is a Hi. I don't know where you are. Oh, here. Okay. Uh sorry if this is like a silly question but so with ZK you

can have a program running publicly on the blockchain and you hide the inputs like like you can verify but here this is kind of the opposite right because you can't really like as is run like for example the the verify like the the decryption decrypt upon verifi verification that you example that you showed like I sell a book it's encrypted and when someone pays it's decrypted. This can't live onchain currently even if the tech existed, right? Because the book is encrypted. It's onchain. Someone pays and it's decrypted and it sent plain text pl to the person, right? So you need a central party. I mean, but

this the thing the thing is that this is without the central party. I mean without the server that's giving to you the key. Yeah. Yeah. So so I'm asking like where where do you imagine this running? Because I if if I run the obuscated code and I have access to the inputs and outputs then I can learn a lot just by running it locally with inputs and looking at the outputs right so you have a if you have a if if it's well auscated you cannot learn anything about the program actually you the important part is that you cannot learn the key that's so you have a program that inside is the key but even executing a lot of times with different inputs you cannot I mean doing anything messing around of what you are doing there it's impossible to learn anything

about the key and this is the difficulty of the pro I mean it's not an obvious program but there is ways I mean actually we know um I mean we know algorithms that it they work the problem is that they are not practical I mean maybe there are some algorithms that it takes like something like two to the 27 years uh to I mean it's it's a good start but I mean it's But it's not uh anything practical, but it's it's it's possible. And I'm convinced that there are ways to do that in a practical in a practical in a practical manner. I mean, I'm talking in something that I don't know, maybe it's a breakthrough, but I'm

not talking something that's available right now, but it's something that it it it I have I'm convinced that's going to be available uh at some point. Hello. Uh what are then the advances advances the recent advances that make you confident? Well there is um I mean uh there is um I would say I mentioned two one is the one the one that you mentioned that there are some mathematical proofs that that that the problem is solvable. I mean because there was actually there was a proof that it was not solvable. Okay. But actually this has been proved that you you you can solve it in a assuming different way. So that's one thing and the other is uh I mean and this is a

local offuscation or things like that there are um I mean there is one technique that's this local offuscation that's very much is just taking the um the quantum computing theory about how the circuits are generated that way and using those circuits and doing some DNA when you have a programming you convert with gates okay so machine with gates but in this case is reversible gates. Okay. So with that you can you have a way of let's say expanding I mean creating more random gates and mixing them okay and it's what we call local mixing and this

intuitively uh mean it's like uh mix by mixing the the the program you are hiding the program okay and if you do that in the right way uh there are ways to that this could be offuscated this has been proved already that I mean depending how you do it is not correct. Okay. So it's like but there is some research that's going in that direction that uh um makes me feel optimist optimistic because with this kind of algorithms thinking in a let's say a one to 1,000 uh a slower a slowing down of the computations just by going offcation it would be possible I mean

it's in the research but uh there are some papers especially coming from uh some let's say new research u um departments I mean all these papers for example come from people that comes from the physics and quantum computing things that are introducing new ideas uh that comes from different fields that uh well that the let's say the more cryptographic people is thinking in I mean it's a start looking at that in and and maybe thinking in a different with different perspective and this looks like there is something there Okay. But I mean it's just a smelling we need to to to see and this is a lot of hard work of many researchers but we need more. I mean

that's we need more researchers. Okay let's keep it here. Thank you very much. [Music]