The journey from academic research to industry deployment of cryptography with Yehuda Lindell

Transcript

so it's my pleasure to introduce Yuda lindle today uh Yuda is a head of cryptography at coinbase and previously CEO at Unbound he's also a professor on Leaf at barand University uh Yehuda has been working on MPC for a long long while he is um for example an inventor of one of the fastest uh uh protocols for threshold the cdsa signing for two parties I think it's kind of uh was record breaking at the time I don't know if that still holds its record potentially it's a super fast and efficient uh yood is also an co-author with Jonathan cuts of a book introduction to Modern cryptography which some of you might uh might have read it's an amazing starter for those

who want to do cryptography want to learn about it it's super um simple and clear but at the same time very rigorous and formal and uh uh I think they keep updating the book and now uh Third Edition uh from 2020 so you can also find new stuff in there I think it covers cryptography from 1980s up to the modern day uh and we are very fortunate to have Yehuda he will give two talks here and the first one is more high level about his experience bringing um academic research into deployment and production at base thank you very much uh good morning thank you for having me so I'm going to my talk is going to be

in two parts the first I'm going to talk about my experiences uh with commercialization of MPC at Unbound security and the second part I'll talk about deployment of cryptography at coinbase and the theme together is bringing Advanced cryptography or recent results into uh deployment into actual commercialization and the challenges and that arise with uh I like interaction so please feel free to stop to ask to challenge uh that makes it much more interesting for everyone okay so the first uh part is going to be uh my startup Journey uh it's my experience in I'm and security

the thing about startups is that every startup is completely different and all experiences are very very different so there are things that we can learn but um there are no hard and fast rules if they were then uh doing startups would be easy I could just give you a rule book and re and hor would give you a rulebook and we' all be done uh but the whole point of startups is that they disrupt they do something different and therefore they all need to be uh uh dealt with differently one of the interesting questions is is a um second time startup CEO better than a first time startup so the second time you've already learned a lot right so you have experience that's true but they're also dangers do you fall in the Trap of interpreting everything for your

second startup to work work the same way as your first startup and if you do then you're probably going to fail because again each startup is completely different okay so uh the start of the story is uh the maturity the maturing of technology or or science starting as pure Theory over decades maturing to something can actually be used in practice sometimes it's fast sometimes it's slow but when that happens uh how do you deal with that how do you actually now take that science that you've built that you've worked on and uh get it into industry when industry isn't really aware of it so sometimes something already is being used zero knowledge now in the blockchain space is

very well understood and known you have some breakthrough in zero knowledge that uh uh has PR real measurable practical benefits that's not such a challenge today it's still a challenge everything's a challenge but it's even a bigger challenge if you're doing something brand new that nobody knows about and now you want to uh commercialize that what's technology by the by the dictionary definition at least the study and knowledge of the Practical especially industrial use of scientific discovery so we research for many many years we start with Theory maybe it starts becoming a little bit more efficient but completely impractical then more efficient then more efficient and at some point we say yes this is now technology it can used

for practical use I believe that the world can can benefit from this technology uh but how do I how do I get it out there as I mentioned if it's already recognized that's that's much easier if I've come up with a new and better medicine for Alzheimer's we don't have to convince anybody of the importance of that uh it's very easy for industry to recognize that that's also by the way uh while you'll see in uh in universities the um Tech transfer from biology and chemistry is typically quite easy the the research in the lab has been done has been brought to a certain point an external company will come and say yes I'm interested in that and it's done you don't have to do necessarily

the work to push it out yourself but computer science it's often very very different this science is sort of locked in Academia we know about it we've been doing it and nobody knows about it we'd like to say uh world look we have this great shiny new thing come and take it but it it doesn't happen and doesn't happen for a few reasons firstly that I know about it and raising your hand in University and saying I have this great result it was in acmcs and got the best paper award and it's going to solve world hunger that is not going to uh be very successful more importantly uh in Academia we often don't know how to choose really understand the use cases where it's actually beneficial we have an idea that it can be very beneficial that it can

solve certain problems but we don't actually really understand industry's problems that they're trying to solve if they understood our technology they could come up with really good use cases of where it's useful but they don't know about about our technology so we don't know how to go and them you know that problem you have we can solve that for you uh because we're not in that world and in fact you'll often see that very successful entrepreneurs coming out doing for example a startup in the uh that disrupt something in the braing to to to fintech these are people who have often worked in Banks and seeing that something doesn't work they understand the problem before they even start and now have a better solution but when you're in a different world and you're not aware of that it's very hard to convince someone about why it's

important a second problem is that at this point of the journey from science to technology the uh um the solution or although it might be efficient enough to use in practice it's not something which is an off-the-shelf technology which you can just say take and use as a blackbox it typically requires Great expertise to deploy to uh customize to the use case that you're dealing with and this is I think well familiar with NPC and zero knowledge today these are not things that if you don't know anything about uh uh cryptog graphy here there's a new zology system just take it and run it as a black box and everything is fine it typically just doesn't work that way uh another thing to notice is okay so

you've done this science and you think you've come up with something which is really beneficial some academics are looking are looking to go and commercialize they want to open a startup they actually really want to do that this is what they're looking to do and some others are not people ask me for many many years uh thought you do all the Privacy things don't you want to open a startup I said no I'm happy academic um but things change I've been out for quite a few years now okay so challenges of the early days when we started in 2015 B question is what is NPC nobody has ever heard of it there are thousands of papers since the late 80s about this uh topic both the theory and the practice of it but nobody knows what it is and in fact it sounds like

snake Hall and we actually had people telling us we don't believe you like it's not possible it cannot be possible to compute on data without actually seeing it h how can you even do that uh and and that's one of the biggest challenges in the early days how do you overcome that problem the first actually interesting is that academic reputation actually does help a lot so in some sense we feel like we're talking in a vacuum but uh when when you have an academic reputation and it's significant then it gives you at least the benefit of the doubt another thing is uh I wrote The Textbook with and cast that they mention because when we started uh teaching we didn't have any book that we

felt we could teach from but it turns out that this was actually really helpful in uh unbound's Journey because there are multiple times when we went into a meeting and in the meeting there are technologist there are engineers and there are maybe Business Development people or other people and someone there had taken a course in University in cryptography which had used my textbook so automatically it was like okay we're not going to believe everything you say uh but but we you you you have credibility and that's very very helpful and the reason why that's very helpful and very important and I'll talk about it a little bit more in this slide is that there is so much noise there's so there are so many different competing products there are so many vendors

claiming so many different things that uh organizations need some way to differentiate between the what's real and what's not real what's what's uh uh vague promises and some which is real technology and this can help them the second thing you need to do is educate the market today actually if you go out people know about NPC not just in the blockchain world it's not like they know about it like TLs but people know about NPC they've heard of NPC they they they know what it can do and uh that's very important when you want to start the the process of selling to organization one of the very important things in startups is okay I've been given an investment I now have to hit certain Milestones

between before the next investment but if I have to educate the market in order to hit those Milestones because otherwise I'm not going to able to sell that's going to take much longer and you have to factor that in so what is MPC is it real is it based on is it like a new fangle technology which we don't really understand or is it really based on something that we have a good understanding of can we trust it can we trust you in deploying this technology all of these questions are very very important you have to educate the market before you can really do very much there are are always uh outlier early adopters there are some organizations who that's part of their culture they like to adopt brand new technology but you need to

sell to the masses you need to sell a lot and you can't rely on them for hitting all your Milestones certification like fips or common criteria at Unbound we were uh selling software that protects Keys uh via NPC rather than in Hardware that was the the basic idea fips is is a certification which is for uh cryptography modules cryptographic modules so doing the standard cryptographic operations AES RSA uh ecdsa and so on and so forth and you can certify this module very often cryptographers or scientists look at these certifications sort of with a bit of uh uh scorn because we know that they don't really guarantee

high security it just basically says that you uh you do what you claim you do you're actually Computing ecdsa maybe at higher levels it does has some basic side channel of protections it tells you that you're authenticating and or administering these things managing them in an appropriate way but for industry they're very very important it's a sanity check and again we need to differentiate between the noise between what's fake between what's real there're also different levels of fips fips one is very basic fips level two adds additional control and level three and four are only for Hardware so we did fips level two and just to illustrate why this was important we had one customer very very uh significant

customer who's doing code signing for a very large software company who's using us for their code signing globally and it was an contract of over a million dollars a year and they uh withheld payment until we got level two certification because we told them we're getting level two certification and it always takes a long time uh in in these standards bodies and until we got it even though uh uh the the uh they were already using the software they they had withheld part of the payment it was very very important to them that's a sign that the the these this is worth doing and there are things like analysts like Gartner I don't know if everybody has heard of them but Gartner analysts they look at the market they describe what's happening in the market they describe Trends technological Trends but also

what different companies are doing and sometimes this feels outrageous like I mean we have literally thousands of papers in academic journals and conferences of over 30 to 40 years and what you care about is some analyst who doesn't really understand the technology doesn't know anything close to what we know in Academia and that's who you're relying on to say this is legitimate and answer is yes because once again uh in Industry I want to buy a product I certainly do not have the time or even this is probably not the capability of going and looking at all of this science understanding what happens I need someone to tell me in a very quick way does this make sense is this beneficial yes so you mentioned probably your early

customers were these places that uh you know adopted new technology and do you think those people cared about what Gartner was saying the very early adopters if you have someone very technologically aligned inside possibly less but it is important for them because you might be working at a at a company which is very Innovative and you'll come along and say yes we should buy this but you also have to convince the others in your organization you have to convince your manager or your manager's manager if it's if it's and you have to have procurement on board and they want to understand whether you know we should be buying from this uh this company it's very interesting if you think about it that in the startup World a company of 30 to 40 people can

sell s critical infrastructure software to massive Banks and companies you you typically would think maybe maybe we should be buying from such a small organization so they need to get very high confidence that that this is legit that we can trust them that they're going to be around it's not it's not so simple and having analysts validation will also help them so I mean essentially you have to pay for that analyst right like you buy some subscription and it's one of those quid pro pay to play is called yeah okay yeah that that's why for us it feels outrageous like I mean why are you trusting or believing analysts when it's it's all a game so the analyst will claim of course that even if you pay and even if you're involved it doesn't mean

that we're going to just sign off on anything you don't pay they definitely won't sign right like they won't talk about you probably I don't know too much about the exact details uh so if anyone from Gart are watching this talk should not come and sue me but uh yes it's sort of it's not it's not this objective market research yeah there is a pay to-play element but it's important and and Gardner for example has this thing called a hype cycle which you can see over here and it has different uh parts of the cycle scene inov ation trigger and a peak of inflated expectations a trough of disillusionment and then it goes up in the slope of Enlightenment and and real utility and this is from 2020 you can see that secure multiparty Computing is at like the the the height

of the inflated expectations on the on the on the hype cycle whether it what whether that makes sense or not it doesn't really matter but for us we could go in this was a really important slide to our customers because we're in in a pit we're Shing them this is real here you can see that this is multi secure multi party Computing they wrote is uh is a legitimate well-known technology uh we're part of the uh the process of of getting out into industry and so on and so forth doesn't this graph make you upset I I mean why is there a shape like this why are you know where where are they what process are they using to like put the dots on the x-axis yes you're a scientist I can tell

uh I have a slide later on about scientists doing startups and it's this this is one of the challenges which is how do you deal with these things which are completely non-scientific or don't yeah I mean this is what they put all Technologies they claim go through this through this type of hype cycle I don't really care I care that it's there and therefore that I can use this as a tool that's the way that I look at it does it is it perfect does it make sense is it right I care that I'm there I care that there's another G report talking about data protection and it mentioned secure multiparty Computing and Unbound security as one of the part as one of the major vendors who supplying Solutions like that that's

what I care about there's I mean what there are many things which are interesting right so I had a uh a few years maybe five years after Unbound was already running I had someone tell me in a meeting NPC is a buzzword and I wasn't sure whether to be happy or insulted I mean on the one hand it's great people know about NPC 5 years ago nobody knew what this thing was right um but it's a buzzword it's sort of like I don't know anyway um okay so we need to overcome this challenge of bringing this technology out and there are numerous steps the steps that I want to talk about firstly understanding the problem that you solve and who you sell to the

second finding your what they call the value proposition third determining the compelling event I'll discuss each of these there also issues things around product Market fit and focus which I won't talk about because they're very generic uh for I think all startups um so I don't think I have too much that's specific to say about it but I have slides at the end in case there's time and interest we can talk about them as well okay so let's start with what problem do you solve and building a scalable product first important thing is the distinction between a product and a project so in the early days of I'm bringing this technology out and and I have a customer who's interested in doing something with this

technology is this is that interest going to improve my existing product or is this going to be a very specific project to them and here are some here's an example so I'm an a company who uses NPC technology in order to protect cryptographic keys and now one of the car manufacturers reaches out and says we want to use MPC as part of uh uh uh for doing authentication for um getting into the car so I want to just come and the car will see my face and we'll just open the door but there are privacy issues I want to use NPC do I say yes or do I know it's a massive car manufacturer um this could be

significant money it's very good to show to investors maybe but it's not really in my line of business so I can lie to myself mainly and say why it's authentication authentication is cryptography so that's fine we're protecting cryptographic Keys here the cryptographic key is your face it's your biometric okay this is in line with our business but that's a lie this is not a repeatable product that we're going to be selling unless we say we're moving to solve a completely different problem but then each customer that comes and is interested in something different it's pushing us it's like a boat on on on the rough Seas going going in all directions because each time it's being pushed in a different way so you need to uh all all products need customization in the

beginning because you're building a product and now you have customers say okay but in order to use that okay so I see you you have this thing that protects keys and you manage the keys but in order to for me to deploy that I have a policy that administrators have to log in using their organization credentials so you need to support that via for example open ID connect okay that that's some sort of customization it's not really customization this is something that makes sense that many organizations want and therefore yes we'll do that but there are requests when when you hear them that you say no actually this is something that I think is specific maybe specific to you and it's very hard to know which it is and in fact there are

startups that fail because their first very big customer that they thought was typical was actually the outlier so here I want to do this thing it sounds like it makes a lot of sense I'm a very big bank I'm sure other Banks want it but no other banks are interested and then you spent the first two years or year and a half building very much towards this one very big customer but you can't sell it to anyone else and you run out of money so that's a danger I guess maybe I'll take a step back and say what's the difference between a startup and any other company what's the difference between a startup and opening a uh um a pharmacy or opening a um a furniture store the difference is scale startups are supposed to grow very very quickly you

know and and get to a point where you can return uh your investment money either via IPO or via an acquisition in order to do that and that's so that's one difference and the second difference so you need very fast growth but the question is also why do you need such fast growth because in the software world if you do something very interesting but you grow slowly and you don't capture the market then somebody else a large company will see that you're doing something very interesting and we just do it faster than you so what you need to actually do is get to a point where we've already captured Market enough of the market that you're a leader before anyone else realizes that they should be copying you and in order to get to fast growth you need to have a you need to be able to build a

product and sell it to many many organizations the same product if you need a large percentage of uh your work is customizing your product for each different customer it's going to make it very very hard for you to scale and if you're building a different product for each customer then you're a project company which is nice you can make very good money with a project company but this is not going to be a startup which will scale and get exponential growth and I am enough of a scientist that when I say exponential growth I mean it doubling every every year um you're not going to get there if you have to do too much customization you need a scalable product so as I said our focus on security was key protection and management this is an existing problem with an existing budget and that's important because it's much easier to

sell to an organization when they recognize the problem and they already have a budget to solve that problem now you're just asking them to spend that budget on a different product because you're supposedly much better than the existing products for example in the privacy world it's much much harder and there are startups using MPC order to obain obtain privacy whether it be different organizations collaborate collaborating there is no existing budget organizations maybe have a problem but those problems are different across different organizations and the challenges are much much harder but unless you do the work to try and get there you won't solve that either so repeatable use case what is a use case repeatability is something that I can

sell to many people what what do I mean by a use case and here we often think that okay protection of cryptographic keys that's a use case it's a very it's very well defined right there are cryptographic keys I use for all different things I want to protect them here that's a use case no that's not a use case that's a very generic category better machine learning for image analysis is not a use case it's a technological statement a use case is replacing smart cards that are used for authentication with MPC on your mobile phone whether it's a good use case or not I'm not commenting but that's a very specific use case it talks about authentication it talks about authentication from a mobile and using a smart card for and

and and replacing a smart card not for example not using a ubq UB HSN but using uh MPC instead on your robot it's very well defined better machine learning to detect flaws in a production plant actually after this slide I think it's not true that's not a use case because a production plant for the car industry and for silicon in uh uh uh building computer chips or um for for medicine these are very very very different a use case would be better ml to detect flaws in chip chip manufact for chip manufacturers for example that's very specific that's a use case that you can use why is it important to have a repeatable specific use case

because you need to sell and Market your product and you need to have a very uh good understanding of who's buying that product in order to know who to Market to if I'm trying to sell to everybody that I'm selling to no one I not a global organization with thousands of salese and marketing uh uh professionals I need to I I have very limited uh resources I have to know exactly who I'm speaking to and also to educate my salespeople and if I'm doing everything then it's very very hard for them to learn they don't like for us our code signing it's obvious right very very simple or database encryption it's very simple but if I'm doing code signing and database encryption and 15

other things then it's very hard for our sales people to even understand what we're doing one note which is important here is the double- H sort of deep technology it's uh for investors is actually good to see deep Tech they they see there's an there's an advantage here and that's something which can be very beneficial but we can often make the mistake that better technology is what makes the company win and I'm convinced that better technology with or say the other way around poor technology With Better Business execution will almost always win so I have a company using NPC to protect keys somebody else comes along and does the same thing but they're only using semi-honest adversaries they not doing malicious adversaries and their

Protocols are very naive they're not they're they're slower than ours and I'm not even sure they're very secure but will customers know the difference not necessarily if they have better businesses ution better marketing better sales better processes then likely that it's likely they're going to win so it doesn't mean that you shouldn't have good technology I'm convinced that having good technology is an advantage but it's an advantage when you have very very good business execution and not when you don't the other problem with technology is we tend to focus on it so we come and say here we do NPC we have this novel great way uh with new science on on how to protect your keys but the truth is that the technology underneath the hood isn't

really what people care about they care about how does it help them in their business what benefit does it give them what Roi or return on investment does it give them to buy your product and on the one hand it might sound obvious obviously the technology is there just to make a better product but it's a technology that's a differentiator so how can I not talk about the technology what am I doing if I'm not talking about the technology that's actually what what gives me the advantage over the others but that and that's a trap that we often fall into and especially when you when with something in the security and cryptography world the big question is can you demonstrate the benefit that you're providing or the ROI which that is return on investment so if I just say

yeah this is more secure than what you have now okay what does that mean how much more secure can you give me measurable something measurable to understand that I'm going to actually benefit I'm going to save money from this what what is it that you're doing that is better for me and this is why it's often easy to do a startup that for example does anomaly detection because for anomal detection what I can do is I come in I connect to your network and I show look look at all these things that are happening you can actually see you're using anomal detection right but you didn't detect these different things but I'm doing something which is cryptographic like how can I demonstrate anything can you say that can you show can you show me that attack you know

that and it gets even worse when when c c so companies try to deal with this they say things like if you would have used our solution then this breach wouldn't have happened it's a really really bad thing to say it pisses everybody off don't don't do that uh you don't know you can't say whether it would have prevented or not right the spe you can you can argue that it can help but it's very hard to demonstrate Roi for something which is just preventing a breach and not for example detecting afterwards which can which can be easy to do so this is a this is one of the biggest challenges that we had as well so I want to give you an example about um this idea of how we describe the benefit that we're giving or or what we're actually solving through for

example with zero knowledge not not not MPC so I've come up with a better zero knowledge Pro System I haven't okay but let's say I have so it's a better zero Pro and the question that we're all going to ask is in what way is it better so there are multiple things multiple way it could be more secure so it has better assumptions and a security model first is will anyone even understand that and secondly do they care do organizations have a problem with the security model the assumptions used in existing zero knowledge systems that or proof systems that that they can choose of the uh that already out there probably not I can also say it's more secure because there's no trusted setup needed and that can be helpful because now maybe I needed to do some ceremony

to set something up and now I don't that actually could be something attractive but you have to understanding who you're selling to let's say I'm using this zero knowledge scheme internally in my bank for something well if it's internally in my bank then I can do a trusted setup myself on a laptop which is brand new and is only used for that has never been connected to the internet and and nobody has to trust me because I I do trust myself so it's not so that means that this tells me what type of organization I should be targeting okay now the more obviously I have a fast appr or a faster verify and now have to understand who's paying for this product and who's going to gain from it so fast the approver Maybe means uh I'm going to save you on GPU costs or Cloud costs for computing

the proof or faster verifier means that I'm going to save you gas fees for verifying in the blockchain space the nice thing about the blockchain space is actually actually give a very very clear number for the ROI on a faster verifier I can say okay for these types of transactions I can look back over the past year on the blockchain see how many transactions of this type were carried out how much they cost in guas fees and this is how much it will cost using my proof system so if you're expecting to do this much this is how much your Roi is so I'm going to charge you whatever I'm going to charge you most products don't are not that clean it's much harder to justify okay so I'm going to sell you something that protects Keys uh

you're using Hardware now um this will save you money in the long run because you won't have to buy new hardware but I already have Hardware now or it's going to be if I go for the more secure C then I'm going to say okay but how much money have I lost in my organization because of this attack before am I really expecting to lose money in the future from this it becomes very very vague and very very difficult so now we understand our product we understand our use case we we know who we're selling to now we need to understand okay that that will automatically lead us to who our target market is and I want to give a couple of examples so one example is smart card replacement so we have a ubhs UB key for Authentication and I was say no you can

use a mobile and this is great because people forget the UB ke at home people lose them they're very expensive and this is much much easier for use and I want to sell to the US because most startups it's a best to start in the US market anybody know why why is the bests to start in the US market why do isra startups start in the US market capital gains tax laws nah the availability Capital gam tax laws are much better isra than the US actually the availability of capital no I'm not talking I'm talking who to sell to I'm not talking where I'm building my company I'm talking who do I sell to I'm going to sell to the US market it's one market with one language uh in pretty much one location

you go to Europe there's UK and France and Germany and Denmark and Belgium there are all different languages often many different cultures uh different regulations uh it's much much harder to to much much harder to penetrate CH is the best market then in some ways yes um so I want to sell my I want to sell my solution for Smart Car replacement in the US is it a good idea what do you think sounds good or not sounds good okay how many smart cards do you have in your bag one no no real smart cards like uh UB HSM UB key I have two you have two okay you're unusual how many how many

how many how many keys or smart cards do most people in the US have zero because the US market doesn't use them you they they're used in Enterprise settings so for Enterprise employees this can certainly be something but that's a pretty small market and it's a very hard Market to get into because it's already been captured but if you go to Brazil or you go to Asia then people in some people in some countries in Asia people walk around with multiple one-time password devices for logging in because their Bank requires them to because there's much more fraud in the banks and and there's less of a focus on usability so people actually have much more so this is not a very good thing if my if my aim is to

sell B2B Toc so I want to sell to Banks for their customers to secure their login the US market is probably not a very good idea so I have to understand once I understand my use case what I'm trying to do then I have to ask is that good for my target market or where should my target market be another question is sophisticated versus unsis sophisticated so Unbound was protecting keys in software using NPC okay um shall we sell that to um hospitals or Healthcare or education what about education schools and universities can protect our data using Al system probably not because a lot of

those organizations are very very immature in their uh um security posture they may not even be encrypting if you're not even encrypting yet then let then you know turn on TDE transparent database encryption just turn it on it's very very easy just do that a lot of them aren't even doing that our solution is one which requires more sophistication you need to deploy multiple nodes like two two servers for NPC you need to be able to transition your existing Solutions so you need a sophisticated customer we chose the financial sector and very large technology companies cuz they're sophisticated and they truly care about security if you as a company and if you're on Healthcare you care about Hippa but what do you what you care

about in Hippa do you really care that your customer data is safe or do you care that you fulfilled the regulation if you care that you fulfill the regulation only and the regulation doesn't require you to use this more complicated solution then you're not going to buy a more complicated solution but if you're a bank then you truly care typic Banks truly care that that money is not stolen that customer customer data being re being stolen from a bank is uh a very very hit very big hit in reputation because customers expect their Banks to keep their data safe so the type of solution you have leads you to the type of uh customer that you need to take as well okay what about the value

proposition what value am I bringing to was organization it's very much not what we thought we thought okay we're replacing Hardware with softare where we're going to be cheaper more agile faster to deploy that's all true but it didn't bring us to the compelling event which I'll talk about in in in a minute about why someone should buy right now because I already have this infrastructure I already have this Hardware what's going to make me move over and just being software wasn't enough and also because the ROI the return on investment was unclear I it's is it is it really going to be better when when is it going to save me money if it's only going to save me money in

10 years time I'm not going to invest in that today so in the end our major V position was completely different we talked about usability not usability of an end user but of the for the organization for the for the employees who need to manage this system uh orchestration defragmentation I'll show you that in a moment MPC turned out to be an important part but very but much smaller than uh than we thought in the beginning because yes everybody wanted to get rid of their HSM HSM what hsms are Hardware security modules there were these um physical boxes that provide physical protection of keys bit like James Bond stuff if you open them up then they there's this they get detected

and it can uh completely self-destruct some of them or or they're protected against side Channel attacks that they're what their industry standard for protecting keys not sure it makes that much sense today because physical security when you're when you're using a secure data center then it's completely different but this is what people use and everybody hates hsms I mean literally everybody everybody hates HSM we only had one meeting where the where the person said they didn't hate hsms or was that a very big Bank in the US and this uh uh very high manager said he hasn't heard of any problems with his HSM infrastructure he doesn't think think it's a problem at all the next meeting was the person who reports to

that manager who actually runs the hsms and he's spent the entire half hour swearing about how horrible hsms are and they don't work and they don't they don't interoperate so just his man he just he was very very good at his job and he didn't reflect to his manager how horrible hsms are so everybody hates them and they wanted a vision of how they could get off them eventually but it wasn't necessarily the highest priority to do right now they had other priorities another thing that was a big value proposition in some cases what we called key misuse resistance so let's say example of code signing everyone what code signing is used for every time you download an app it's signed cryptographically to make sure that um it's the update is indeed by the legitimate vendor if you have a banking

app and you and and I can deploy a malicious update then I can steal your money likewise if I can uh download a uh uh a fraudulent or malicious um operating system to your iPhone I can completely destroy it or or take control of it and and you can't even update so this is something which is very very important and very critical but I don't need to steal your key your Cod signing key in order to uh uh win win or or succeeding my attack all I need is to be able to sign on one transaction that you that that it's fraudulent same thing with cryptocurrencies if you have a million dollars protected by your key I don't need to steal your key I just need to sign one transaction which transfers

that million dollars to me and so I need to prevent misuse so if the keys in an HSM might be very detected and let's assume I can't steal it but if I can access the machine that's enabl to ask the HSM to sign then I'm done because I access that machine I tell the HSM to sign on the fraudulent code and and I'm finished so we actually did for one of our uh was we it was in the process when we got acquired so we didn't completely finish it but one thing we had was before you uh sign on COD or before you finish the you finalize your code you run static analysis you run vulnerability uh uh scans on your code and we were doing that at each MPC participant we we had two participants

and this would make it harder to bypass because if somebody change the code uh or wanted to change it on one of the machines that you'd have to actually breach two different machines and if they're in different environments maybe in different clouds that would be much much harder to do so that was also a value proposition that we had and a very important thing that someone said Bob leley was an advisor um he was an actually investor of V at City Bank and um he's uh father is the Blakeley secret sharing by the way so he's a cryptographer as well at City Bank he was then and he always said that it's much easier to sell a product that improves usability without sacrificing security than a product that improves security without sacrificing usability because improving security is not

measurable improving usability is now this may be disappointing because I'm a cryptographer I want to yeah I want to make money with my company of course but I actually want to do good to the world and so doing good for the world is cryptographer means improving security so I'm improving usability only it's like a bit of a maybe if I'm really like I can improve both but it it feels like a compromise but anybody in the security world knows that that one of the key uh elements to deploying better security is to have it to be very usable when a when a when a product is not very usable or when a security solution is not very usable it's not deployed broadly so improving usability withing security can do a lot to improve security of the

world but this is something which is much much measure much more easily measurable and therefore has more chance of succeeding okay what about the compelling event the compelling event is what will I buy now and the best way to explain these academics is the following question who here has a whole pile of papers that they want to read they have a long list what makes you read that paper today right I mean yeah there's I really I see your technology it's great it's very cool technology this is much better than the hsms that I have now it's much much easier to use I'm convinced of its security I'm convinced of its usability it's great but this is a massive infrastructure project we now have to uh uh we have to buy we have to add another

vendor to our list of vendors we have to do the work of deploying this we have to understand how it works we have to start integration we have to move existing products from that work things that work and I've been working for many years we have to move into something new and there's risk there yeah okay I I I love your technology it's great this is on our list of uh of uh you know our bucket list of stuff that we want to try and do before we retire and and you don't en close the deal so why will I buy now why do people buy Regulatory Compliance so very often people don't like reg regulation like it's like it's a pain it's but it's very very beneficial in the security world because it's what

makes people um actually do things so I want to go to the cloud uh oh no going I need gdpr says I have to encrypt in a c I have to encrypt everything I have to have certain controls in place and if I haven't done that I now need to buy something to enable me to do that here okay that's a compelling event I'll buy your product you need to know to Market to that this changes the target market as well another thing is business enablement we want to move to the cloud there's already a business decision to do that because it saves money but there are security concerns that arise around that and so now I'm not selling you more security I'm not selling you more security I'm selling you the ability to go to the cloud it's a completely different sale

completely different pitch yes you want to go to the cloud but you have this problem for when you go to the cloud how do you encrypt your data yes you can use a AWS KMS but then you're you're you're uh you're logged into AWS I can give you something which is cloud agnostic and you can move to another Cloud uh at no cost and therefore you can be more cost effective that's my pitch has nothing to do with security well it does because the the enablers is the security but the reason you're buying is not security the reason you're buying enables you to to to solve a business problem that you want to solve immediate cost saving but the immediate is often very very hard and Company initiative so we had I mentioned beforehand a very very large Global software company was using us for

code signing across the organization that company had uh code signing Keys stolen like code signing certificates stolen in in the industry World a certificate is often what they call the private key don't ask but they had code signing private key stolen and the Chief Information security officer said there's a company initiative to clean up the code signing we're not willing to have any more code signing Keys sitting on developers laptops across the company where we have no insight into what they're signing on how they're managed uh who has access uh uh there there is an initiative a company initiative to to have one Central code signing solution that organization

therefore set up a team whose job was to do that was to look around for a solution like ours uh we were running a webinar on using Unbound security for code signing they signed up for the webinar sent us sent our our uh marketing person in the middle of the webinar a message saying this is exactly what we're looking for and that was an over a million dollar uh a year deal again there was a compelling event there was a reason why they had to buy right now so now I want to show you what we started with when we started Unbound and what we ended up with uh after learning all of these lesson so this is what we started with these are slides that we actually had for customers and I want to stress that there's a difference between slides for customers and for investors

right investors are interested in the technology uh customers are interested in the problem that you're solving for them the investors also want to know that you know how to sell so that's also important but this is for this this is where we sold to customers okay so we have technology for securing applications and data we have strong scientific Roots deep research in computer science cutting Ed research from secure multi complication okay but but what what are you doing okay this this this is the first slide here's the problem in the world it's the data security Center challenge you have all of these this data you need to protect and there all these different attackers coming everywhere and this is not being made here are all these breaches so this is a really really strange thing to do

because we're trying to convince the customer that they have a security problem now that may make sense but for which type of customer do you need to convince they have a security problem the sophisticated or the unsophisticated unsophisticated because the sophisticated the one of two two cases are know they a security problem or they don't know but then you're not going to convince them anyway because they think they understand or they often do understand so this but who is our solution suited for the sophisticated or the unsophisticated sophisticated so is a complete waste of time if I'm in a meeting I told myself if you have to tell a customer that I have a problem they're not our customer just forget it it's not worth it we're only for Unbound they our customers are only those who

are aware they have a problem they need to solve it so these these two slides are completely relevant and then our fourth slide here how's we do it we decryption takes place without bringing the key together it's never in any place to be S okay but what benefit are you bringing me this this is the way we started okay and now I get to the way we ended um oh before what didn't we talk about we didn't talk about the problem we're trying to solve or if we did we said better security but that's we already discussed as a bad big mistake what benefits there are why you should buy now none of those things were in part of our pitch and that that's a massive mistake this is what we ended up with today's and we're talking about again our taret Market is Big

Enterprises large Banks typically or financials and very large technology company so very uh uh think large think diverse okay so there are many different environments you have different clouds you have different data centers you need to migrate things between those different environments there are many different key stores using you have physical hsms from different vendors that don't live nicely together uh you may have Cloud hsms you may have cloud kmss and vaults unprotected keys there are different interfaces different applications will use different libraries when talking to those different key stores to in order to use cryptography and by the way pkss 11 which is one of

the all this libraries for doing cryptography will not actually be implemented exactly the same even on different hsms and you have different cryptographic problems you're solving on top of all those different things so it's a massive mess it's completely fragmented different problems being sols with different libraries on top of different key stores in all in different environments this raises management problem problems and how you use it and existing infrastructure is rigid too slow I won't go through it all but these are all the problems that you actually have by the way side note in the last year we had a number of meetings where someone came to the meeting and said listen before you give us your pitch we want to show you what we're looking for let's not waste time and they had two

slides the first slide showing their mess of infrastructure of everything all over the place and the second slide with a unified solution for for all of these different things and then we said okay okay let's show you our slides right and then we showed them what we do and this was like what you call product Market fit right that you're actually solving a problem that people are already looking for you're not trying to convince the world that this is what they should need Steve Jobs can do that with an iPhone I'm not Steve Jobs I also don't have an iPhone to sell so I need customers who already know what they're looking for and I'm solving their problem that they're already trying to solve so what do we provide we provide unified orchestration a single pane of glass for managing all keys management can mean for example setting

companywide policies on key rotation and how long Keys have to be and who has access you should be able to do that from one place for everywhere if you have to go log into to 15 different management consoles to change a policy that's going to be timec consuming and error prone yes um this kind of circles back to the beginning of what you talked about basically the scientific perspective to kind of like the Enterprise perspective right um that people kind of like already understand their problem if they work in a domain for like 10 years how did you go from like what do you suggest for someone um that has the scientific Minds to directly go to kind of like the company perspective of kind of like trying to identify the problem to solve in the

first place right so I guess you made kind of like the transition through experience um how do you get the experience in the first place right so the um there there are a couple of solutions to that one is you just have to go through the process but not ahead of time that you need to go through that process will help you rather than learning from experience only the second thing is to partner with someone with the right business expertise I think it's critical that uh if you're a scientific co-founder you should have someone with the appropriate business experience say appropriate because in the beginning we took people who had completely wrong experience because we didn't know what's the

difference right you're you're a business person and you're a business person that's what I like saying what do you do you have a PhD I so you must be like that uh I have a friend who's a biologist or even worse I have a friend who's a historian so it's a same thing as you right you do the same thing no I mean it's completely different world they have nothing to do with each other right nothing bad against historians man it's different work I wasn't saying it's less it's different completely different so you need someone from that field who has the experience and who understands and then you work together where you provide your insights on what the technology can solve and then they provide the insights on what the world needs and you go and explore based on that because the chances are they won't have a good

enough understanding of the technology to know what you can really solve things which are very obvious to us yeah yeah we can do that oh no that's going to be impossible for them it's it's very difficult and in the same way we don't understand what the world needs and and they may not understand they need to do the research but this is together it's it's a much better solution so we had this unified uh uh unified way of doing everything and this was the Unbound core platform you had a virtual HSM just like a virtual machine provide a solution running on any hardware the virtual HSM was the way to consume cryptography wherever the key set so you would be using the same API it could be any of the common libraries but it would be one entry point wherever the key in there and the system would route the key route

route the operation to be to a cloud HSM or physical HSM or to a KMS or to our key store which was run in NPC we also talk secure encl we never got there so you so we wh you want to put your keys is fine but we're going to give you the benefit of now being able to have a un unified access and likewise Key Management unified Key Management One console where you log in using your organization credentials at the time if you wanted to log into AWS to manage your keys you need to use a a username password you weren't able to use open ID connect I don't know what it is today but at the time that was the case so we're providing an immediate solution to organizations to the fragmentation of the cryptographic space and also with

the vision going forward they'll be able to get rid eventually of their Hardware in a gradual way because once everything is from a unified API now when my HSM is needs to be deprecated I can just move that key across to the new system and on top of that different applications that we had Integrations to so that you could run all of that over this uh uh platform a very very different perspective from what we started with but one that actually resonated with the market and was very successful um until coinbase came along and acquired Us and got rid of everything except for the uh cryptocurrency stuff but fine it's uh nevertheless a very good story soorry we did have a slide about the technology but it came at the end so after talked

about all the benefits and everything there here's the technology you can split Keys it's never combined but what are the benefits the benefits are as follows support Cloud migration and adoption same key store for every environment cryptography at the edge where applications are it's not Hardware so I can put the software right at the edge where the applications are and get better time builtin high availability and Disaster Recovery it's software you don't need to buy multiple Hardware boxes fully virtualized particularly suited for zero trust environments these are benefits that that resonate with them not generic security uh better security uh statements okay so I'm going to finish this part of the talk with one more slide talking about the challenges of being a scientist co-founder which

starts with what what we with your question one question you have to first ask is do you want to is what you want to do are you going to try and continue in academi or research or you're going to be a full-time co-founder uh doing both is an absolute nightmare from experience um but it's a very important decision and it's very very hard to truly do both by the way I was sure that okay so we do this company there's a finite number of cryptographic parenes we need to support I to do RSA I to ecdsa U maybe ecis I need to do a with different modes of encryption once I've done that I'm done right this is the

full API so I was pretty sure I'd work for six months or so writing these protocols write a document and then yeah okay every now and then it's small it never ends it's the same thing in in coinbase by the way right so okay so yeah what's the problem multiparty EA EDSA backup you're done but it but the world moves very very quickly and actually there was always too much work to do the second question is what's my role as a scientist in a business environment and this is a very very important lesson that I learned and I was burned very badly for not knowing this lesson for the beginning um scientists have much too much respect for experience and

expertise CU that's what we in science right if you're in this room you shouldn't be asking me a question about zero knowledge because there are people people in this room who know much more about zero knowledge than me you'll ask the person with the most expertise if it's MPC the stuff that at least have research you'll ask me because we'll go to the person who's the biggest expert and if you're not an expert if you do come and ask me about zero knowledge what would they tell you go ask someone else why you coming to me that's not my that's not what I do right you're asking the wrong person so you're a scientist and you're in a business meeting and you're asked what do you think should we should we uh who should be who should our target market be who should who who who should we be

uh targeting to sell to and what are you going to answer I don't know what are you asking me that for I have no idea I've never done this before like I don't know anything about that leave me alone and that's what I did for a number of years and it's a huge mistake because as a co-found a you need to give input and B you actually can give input you just need to take the effort to learn about it and you can't it's not legitimate to take the excuse of this is not my area of expertise because it's the it's the joint thinking of the different people in the room with the different perspectives that will give the best benefit another problem is science is not used to making decision based on partial data so you ah should we target Banks or should we target uh

um large technology companies the answer is very simple right go do a survey and come back with concrete data and I'll tell you but no we don't have data so how how you as to make a decision based on no data I mean I understand when I get married I don't have enough data I have to make the decision but but this is a business decision just go and do the work no there isn't enough there is there's you're making continually making uh decisions based on very very partial information you have to get used to doing that and it's very painful in the beginning because it's not a muscle that we have you also have to learn to manage people and manage tasks that's a whole other talk but I think academics are terrible at managing task project management task management they're typically terrible at that nobody

teaches them to do that and it's very unfortunate it's something you have to learn how to do to prioritize properly to also know how to learn how to manage people which is something that is we're not used to doing because we never manage people before him so they they're part of the challenges but it all can be learned it's a painful process uh I had a uh an executive coach for a number of years when I became CEO because then I had to learn all of these things like straight away uh it was still a very painful process but in the end it all worked out so I was happy okay before I go to the next part any questions so the executive coach has helped you with the managing part or other things too the executive coach helps you to uh gives you someone who you can voice your your

uh what you're feeling your challenges what's painful to you uh who's independent so you have often advisors on your board but sometimes you have to be careful exactly what you say to them you want to be transparent but they're you know when you're feeling really crap and actually would just rather quit and walk away because you you've had enough as it's not something you really want to say to your board member okay you do want to tell them what problems you're having in the company but you don't want to tell them that for example external advisors can also do that for you um but also that they can also give you concrete information like okay but I want to I need to I'm not happy with management meetings I'm not happy with how they're how they're uh how they're

run so you know it's someone you can uh talk uh talk through with another thing that I did was reading but they're all these management books right you have this person who succeeded with a startup and writes a management book most of those I didn't really like it's a 150 page book you could three pages you probably get the idea um and it's anecdotal experience so I didn't really identify with it very much some of them helped a little bit most didn't but hbr Harvard Business Review has these booklets of of papers of all different things so we'll talk about management styles to do will give you four different management styles and how they work and the

different management styles that different people have and the advantages and disadvantages for that for me th those sort of things worked because I could I could uh look and understand and sort of more formalize the way I was operating so I would read a lot I actually read a lot of those different things I would discuss my exective coach and I would try this and then try that some things are are continual battle making making management meetings relevant and um useful was a continual battle but sometimes was better and sometimes it was worse yeah so it sounds like with your value proposition for the most part it sounds defensive in the sense that ideally a customer comes to you with a problem already and you say you can save them money right I was just wondering if

you have any insight on how to sell to like a customer who's looking to maybe like make money or how to change not saving not saving money business enablement is a very very big one most of the time we didn't try to save money because we were targeting sophistic ated organizations our price point was not low in fact we in the beginning if you're just buying a little bit of us we're probably more expensive than buying another hm because if you're selling to sophisticated high-end customers and you have a very very low price right it's like someone's selling you a Gucci t-shirt for $7 you're not sure right it doesn't sound right but business enablement or it depends exactly what the benefit is like here's a a new regulation that you

need to solve or you need to go to the cloud or or many other things or you have a very just you have a lot of pain in managing this infrastructure which is what we ended up with and here we can solve that for you but each startup will will find or each solution will have to find what it is that the benefit is and it's certainly not always saving money sometimes it is but but not always we we didn't save anyone money okay so how did you know where to price your your services or pricing is extremely hard extremely hard and extremely painful uh you don't want to leave money on the table so you start with outrageously high and then you go down and you but at some point you have to get to like I was

it always bothered me a lot like uh customers say okay how much does it cost and then the uh the uh sales people would started saying well it depends what you want to do explain to us your use case what you're using for they won't come back with the price and I don't understand tell me how much it costs uh but it really doesn't work that way um in the end we got we we got to a model which was very in the beginning we tried to copy the HSM model uh but we're software and they're Hardware doesn't make sense we come with a different model we're continually changing and adjusting if you're a better anomaly detection you can look around at the existing prices but list prices are very very far from what people actually pay anyway this is one of the biggest one of

the biggest challenges if you're selling to customers not to businesses then it's easier because you can see what people are buying paying for similar things things and you can also play around with it you can take it up and dig it down and see what effects you have but in the beginning with Enterprise sales the number of customers aren't that huge so it's a bit more challenging have you seen the effect of um popularizing the technology via blog posts or I know social networks having an effect on sales or so there's something called content-based marketing which I very much believe in we use it a lot uh I about social networks but generating real content that people can consume and it was beneficial to them I think is is

important so if you're um selling a code signing solution and there's an attack like uh that that affected that then explaining the attack not coming and saying buy Unbound and we solve your problem right that's a bad thing to say but but here this is what happened this is an analysis of what happened these are the sort of solutions that are out there uh and one of those Solutions is yours so yeah it's not you know it's not unbiased science but it's a bit like writing your introduction you do a bit of overselling then as well um so but providing content that's actually beneficial is something that we found is helpful and raises your name uh in the field as well so can be blog posts white papers that are not necessarily always

specific about your product also about your product but also in general about the field that you're in uh that that content based marketing I I I uh it resonated with me for sure so the second part of the talk I want to talk about what we do at coinbase and it's a it's a very different issues that are arising and this is more about how do we deploy new technology in a way that's actually safe and secure and how we not screw everything up because cryptography is hard okay so just a little bit about the applied cryptography group or ACG at at coinbase what what is our mission you can say it's to deploy or ensure state-of-the-art best inclass cryptographic deployment at coinbase uh we want to provide best usability and service to customers while maintaining

that security uh we also want to establish coinbase as a leader in the field and we want to pull the field pull the field ahead so that the field in general is better a breach for any organization is bad for coinbase coinbase is not happy when some other exchange is breached it's not like ah yeah so now come and use coinbase this is bad in general for the field and therefore coinbase would prefer for everybody to be secure the applied cryptography team which is the team that I run is a product d research team which means that we're not looking around for what research we can do which we think may be relevant to the organization rather we're always getting incoming requests uh for um for Solutions and we have to

provide them an offer right now at least and has been this way for the last two and a half years we have more requests than we can fulfill uh and that's a healthy thing and we also actually really enjoy it it's nice like you're not uh you're given real well constraints and a real problem that needs to be solved and you have to go ahead and solve that problem sometimes it's easy sometimes it's hard how do we do that well we work very closely with product to define the requirements engineering and the security team actually now part of the security team but I mean Security in general which will audit our solution the security of our solution as well as look at the General Security posture of the organization uh every deployment that we have will include the following things a

cryptog graphic design which is really a high level description of the problem we're solving because you'll see with a product person they'll explain the problem we want to make sure we're aligned and we don't spend a lot of time designing some uh uh complex protocol which actually isn't what they needed in the first place then we need to build the theoretical solution if it already exists then great um and then we'll validate it and if not then we'll have to research it I'm going to go through through each one in more detail separately then we write an implementation spe specification which will bridge between the um theoretical paper and the actual code so a very uh explicit clear specification and there'll be a review that they match

so that the theory matches the specification will then uh work with the security as a security audit team in coinbase that will audit and verify everything we've done then they'll be implemented and we'll check the implementation mat specification there'll be external reviews let's go through each one separately so cryptographic design will have a problem statement a solution outline and also a security or threat model were relevant the threat model here Security will often do very big threat models like looking at all different potential attacks and what can happen here it's more the security model of okay so if it's NPC and has these parties then he would you have to corrupt and if you corrupted this then what would happen to get an clear

understanding of what the goals are the next is theoretical research so we want to find the best solution for the task and there are three possibilities one is you find existing research that completely solves the problem this is almost never the case why is it almost never the case because even if you have a protocol let's say so we need to do multipart e say so we have a protocol for that but it integrates that is going to be used for example in custody in a certain way how did it integrate with that how are Keys generated and how are they deployed and how are they backed up and how do we get to a point where we're actually running the these systems are much much more complex and therefore just the protocol itself is only a part of the solution

but it's an important part of the solution but it's not everything and so when that happens then uh if you don't have a full solution then you you find an extion which is close and you adapt it adapt it and you you you write whatever you research whatever is needed in order to make it suit this specific product problem you have and the last possibility you need to develop a brand new cryptographic solution and this uh uh can sometimes be quick CU sometimes it's actually easy and sometimes it can be very complicated and actually take many many months so that means we do do some gets work in in our team where we think about things that we think we we will want to solve in the future um we discuss it with products whether make sense to them and then we'll kick off a

long-term research project so what I'll talk about tomorrow is for example one of those projects everything and what I'll talk about tomorrow is actually based on real product needs that we may need uh or or would be nice to have not not critical right now necessarily uh and therefore that's a long-term research project to get there once we have done that then we do the validation and we don't trust any research paper and I mean any research paper including our own so what that means is that we'll have a full validation and we'll do independently within our team and also there's an internal security audit team in coinbase who engages there a cryptograph in that team already but they also engage with external academic

cryptographers who will do reviews uh like you've never seen in any Journal that you've ever published in uh and it's it's fantastic and one just one example we were onboarding someone new um about a year ago uh and this person uh uh asked me okay but when I read your paper like or or your research like what level of and how much do I need to check what you've done and what I told them was uh you should think of me when you're doing the audit as this very old scile researcher who who who all of his good work was done over 20 years ago and really doesn't know what he's talking about anymore and but what I told her was don't trust me for anything you need to check every single step we're very

very uh paranoid about this and for the very simple reason is we're not protecting passwords for log to your University email right we're protecting billions and and billions of dollars so making a mistake is not something which is an option doesn't mean nothing is perfect right but the level of mistake has to be something we we can't afford to have a major a major floor in the protocols we deploy our research philosophy because of that is a very very very conservative one so we prefer mature results so I'll be I'll talk to you about your new your three round DCd say we want to start thinking about that when you first published it it wasn't relevant and we want to wait we want to

do full validation but we want something to have some time want to have time to analyze and look at it we're not running to do to to adopt everything brand new Off The Shelf full rigorous proofs always and if the proof is not rigorous enough that's fine or if we don't feel we understand it well enough we'll just rewrite the entire proof from scratch we prefer Simplicity wherever possible so if you're improving by 10% but it's much more complex either in the protocol or in the proof we probably won't do it if it's much much faster and there's a product need for it then yes we uh May well adopt it but we will prefer Simplicity uh where where we can both in the proof and in the design assumptions we prefer like the most extreme

assumptions that we use are paer and ddh doesn't mean that you can't use anything else right for example if you're doing a protocol for BLS and obviously you can use pairings because BLS uses pairings but I would rather not use pairings for for example to solve schnor or something like that we we wouldn't do that um we prove security and the most stringent definition UC security so security and concurrent composition and even if that means we have to pay a penalty for that like using the fish and transform for uc0 knowledge we have a paper which he published about that recently uh we will certainly do that and we will accept the random Oracle we can argue about whether that's reasonable or not but we yes we

accept the random arle we do not accept the group model and the distinction we make is very simple when sha 256 designed it's designed to look random looking or is the L curve points have a very very specific structure uh so no we don't rely on the jic proof model anywhere in any of our protocols doesn't mean we won't ever in the future if there's something which we absolutely have to it's the only way we can solve the problem but we don't we certainly don't want to implementation specification is a massive gap between a paper and and an implementation paper can be written very in a very modular way and very abstract so layers upon layers and maybe referred to other things and this is very very hard to come along and Implement without a good

understanding of it obvious checks are often omitted so do you always write in your paper check that this is what you got is is a is a valid elliptic curve Point probably not should you or not I don't know but often you Adit out you will admit that many things are not explained yeah we have a random AR called ontic Curve okay so maybe I can do h of M * G no that's not a random Oracle ontic curve because you know that the great log that's would be a complete disaster for protocols that use a random Oracle tic curve you have to fully specify all of these things what needs to go to the fat Shir hash everything has to be fully specified the majority of this is clear to a cryptographer certainly clear to a cryptographer who's fully read in full detail the entire

paper and not just the protocol by the way uh I've certainly screwed up in the past by reading only the protocol and a bit beforehand and afterwards and trusting and then realizing that oh they meant an unknown Order Group and not a prime Order Group messed up completely so yeah when you're an expert cryptographer you can read everything you can understand and then for write the specification but somebody else just coming and reading that will be a complete disaster so this is a central step in the process again we write them this verified by someone else in our team who didn't write it it's then verified Again by the security team who compare the theory to the specification and make sure that everything matches we

also have system specifications which tie the different protocols together and they're also verified in the same way so here just an example on leftand side you have a protocol in a paper for felon vsss this is what it looks like I don't if you can see it but this on the right hand side is the PVSS verify function which sort of is a little part of this which shows how you verify exactly that that everything is correct in that publicly verifiable secret sharing okay and so this is uh it calls you can see things like uh um yeah verify the ucz K BDL uh we have calls to random arle calls to all different things these are all very well specified in all of our documentation it's then implemented by a

team with uh team called security platform engineering they there are Engineers there with 25 years experience implementing cryptography and 9 years experience implementing NPC there aren't many people out there with that level of experience then there's a Code review independently Again by people in our team two of our cryptographers actually know how to read code uh not me and uh they they do one level of code review and then again it's additionally reviewed by the security team that that review now ignores a theory and just checks that the code matches the specification so you have an independent check that the specification matches the the the theoretical paper and then independent review that the code matches the specification and then after you've done all of that there's

also an external code in cryptograph cryptographic review for example you know by like NCC group or something like that as well preferably with people who actually understand NPC and cryptography which is true true of them just as an example so this is the way the result looks I don't think you can really see this but this is like a a page we have in Confluence which shows each of the uh specifications uh basic Primitives constant time mod multiplication zero knowledge proofs Vera secret sharing TDH through threshold encryption Quorum backup uh cble circuits uh NPC friendly key derivation or all different stuff and then for each one you'll have a theoretical paper a specification and a design document we relevant and then this is really really

complicated there are so many different moving pieces and upd update the spec how do we know that everything is updated correctly so this has to be track we're building an automatic tool but you can see a very very rigorous process where we have an Excel which is the latest spe Theory uh version which has been updated the latest specification which has been uh updated what has been reviewed what has been implemented what version was implemented and we track and make sure that all of these things are always up to date before anything is rolled out for actual production it's not a formal spec it is uh if I go back to here yeah it's but it's not a like words like choose random or or you know check that everything is valid it's much more exact it's pseudo

it's it's pseudo code and you often the text but know is like these is like clarifications they do include session IDs for example in the spec yes that level of detail of course additional activities that we do uh we provide cryptographic support across the company uh we do some offensive research internally and externally our offensive re research externally is more like if we find a bug somewhere else and want to understand that and make sure that so we can for ourselves and also to improve the security posture for the field we're not very interested in making very noisy black hat presentations and one last thing I want to say is that coinbase is very much about defense in depth and and I think we have a very good cryptography team at coinbase but there's an amazing security team so NPC tells you as long

as you don't corrupt uh you know a full Quorum of parties then you can't learn anything but that doesn't mean that we then say okay so as long we have reasonable security around those parties we okay uh each machine is incredibly locked down if there's a machine that's only used for delivering messages and in according to the theory they don't need to be trusted at all they'll be completely locked down and nobody can access that machine if anybody access that machines it will tell the whole world uh very very strong security posture an amazing security team and that gives us defense in depth so that we can you know nothing is perfect we're certainly not perfect and even though we have I I think we have the most rigorous process in Industry I I don't think

anybody comes close to at least not I've heard of and I still don't think that it's perfect so having defense in depth and knowing that security has our back is very very important to us as well and uh therefore they're they're a crucial part and of the overall security and and very important partner in in our development process the specification process that you mentioned did you kind of like P that over from the startup experience or was that kind of like less rigorous we ported it over but we've improved by an order of magnitude so yes we in the startup we had specification the specification s were not as exact as they are today we didn't have all of the the as much independent review we did reviews as well but not as much

independent review um so I would say yes it's the same idea we started with those types of processes but we're now orders of magnitude more rigorous about it and we didn't have of course at at Unbound we didn't have the security team that would do all of the both the defense in Dev but well there was different cuz you were selling software to companies and they did their defense in depth but um we also didn't have this external uh internal external um organization that was auditing us and working with us the whole way through we did do external reviews so examp Victor shup did a review on on on all of our protocols so we certainly had that as well but it

wasn't to the same level that we have now do go all the way down to implementing elliptic GF arithmetic and finance field arithmetic or so we don't um but sometimes as software Engineers do so in general my belief is don't Implement low-level low-level cryptography um but we have a software engineer who who's extremely strong and for ex some have a reason to for example he's openl um and it turned out that the Ed 25519 operations are not constant time and openl so he rewrote that as an example and also turned came out 30% faster than openl and constant time so so sometimes it's done but we typically do it only when we need to with your experience what's the future of MPC

General NPC um like there is so much work on FHA and every time I hear about all these people working on FH I question the the wisdom of that versus because even with FH you're you're going to end up to use some NPC on the back to to to to store the keys right so and I understand that it's for the decryption but so I think there are two different questions you're asking here one when I'll start with the second one about FHA uh come on we did NPC 25 years ago and was completely irrelevant we didn't we were it was unclear that a anybody would care and the things we thought about like auctions or stuff like I

don't know who would even care like it was unclear anybody would care it was unclear there would ever be ever be efficient enough for using practice but that process that we went through of slowly making it more efficient so I think on a research side it's very valid no no I'm not questioning the research side I'm saying but that there was no other option with def there is another option right yeah but there are use cases where non- interactiveness is helpful so in a use case where non interactiveness is helpful then FH uh is that's that's the way I explain the way I explain FH versus NPC when you when you when you can't have interaction just use NPC it'll always be faster when you when interaction is a problem and you want something to be done without interaction that's when you use f so what are the use cases for NPC in

general or FH the this is a very hard question there are startups out there that are working on this Duality uh PES uh there are some others that are looking to deploy NPC for privacy type applications not necessarily personal privacy type applications but more interaction between organizations the work has to be done like making that uh something which for the industry to be aware that this solution exists and to deploy that someone has to go and actually do that work in Unbound when we started no one knew about NPC at all and certainly not for key protection now there are organizations out there for now on then when someone reached out to me and say you know are there these types of

solutions out there we're looking for one so that work has to be done and where will end up it's unclear I can give you the same list of pretended applications we were talking about Academia for many years and I'm 9% sure that we're wrong about all of those where the actual benefit will come from if if it's still an if right that's something that it's only someone doing the market research trying to sell getting the feedback going to different organizations time and time and time again with investors that have the the patience to allow that market exploration that's where success will happen with that I don't see it happening at all how do you ensure that your implementation adheres to the specification is that something that

that's again a separate step we have a step where we can compare the specification to the theory and a second step where we compare the specification to the code there are different people that do that so all of those reviews are done internally by our team and in addition by this the coinbase security team in addition after was an external review but that's probably more just looking for a tax than doing a thorough review and and if the specifications are written well then they can do that so for example on the code riew there's someone actually whose familiarity with cryptography is not great and they do excellent reviews so sometimes the comments will be ones that we don't care about like they'll say things like the specification says that the order of the elements in the hash function for Fiat

Shamir is Q followed by R and they wrote R followed by Q so then we'll tell them you know we don't care about that that's fine but they're able to do very very good pattern matching and and and that gives us very good confidence thank you very much [Applause]