Anonymity in MACI

Transcript

foreign [Music] it is nice to be here today's topic is anonymity in Macy my name is Maria mikich I'm GK researcher in the team 3327 3227 is a real r d Department in the Attic 42 company which is Venture builder company and my team 3227

obtained a grant from ethereum Foundation to add anonymity in Macy so before we start a little bit more about me I'm also assistant professor and faculty of mathematics in Belgrade Serbia and I'm head of Department of differential equation at the same same faculty and I'm also co-founder of mathematical Academy mathematical Academy is some kind of private school where we're working with talents in the field of mathematics and physics and our participants attending primary and secondary school and for example this year they won 24 medals on stained competition so we are very proud of them

and today's topic is anonymity in Macy and is connecting to a voting system it is very important to note here that is very difficult to create a voting system that is completely resistant to collusion to Blackmail of any kind to censor votes or to add some extra votes so what we want to achieve is to have complete privacy and unlimity in voting at the same time so the question arise is it even possible to create such a voting system and we have Macy what is Macy Macy is minimal anti-collusion infrastructure we

can see it as an application that allows users to have voting on chain may see reduced bribery and disable sensor voting this means that no one can vote on behalf of someone else and it knows it is not possible to falsify the results of voting the initial idea related to this Macy project came from vitalik and we can also see Mason as a collection of ZK circuits smart contract and typescript packages that we can use to build our programs on top so what how Macy really works what is done

so far in Macy before we had anonymity in Macy can voters cancel the vote if for example they were blood blackmailed and who can see how voters voted we want to answer on these questions well in Macy we have uh users or voters and we have voting coordinator first voters need to be registered in to reproduced they need to send their public key and their public key plays a role of their identity so in order to vote user needs to create a vote and all votes are encrypted before it sent to

Macy's Mark contract so everything on chain is hidden and this is really good and two only peoples who can decrypt these votes are coordinator and the user in Macy we use elliptic curve diffie-hellman encryption so how precisely this goes well in order to create the message user needs to create a comment the command contents of user public key vote option won't amount and some other variables that is not important for us today so then user create a comment a user needs to sign this command with his public key and after that

he needs to encrypt the comment and the signature in order to obtain the message okay so in this message user can have two actions the first one is to change his public key and the second one is to change the vote option so if we have a user who is blackmailed to vote for option two but this user really wants to vote for option one and that user registed with his public E1 he can send two messages the first one will be to change his public key he is public key he wants that his public be publicito okay and the second is to vote to vote for option one he really wants to vote for

option one okay after uh create comment he will sign this comment with public E1 encrypt it encrypted and sent to the Macy's smart content then coordinator decrypts the message he will change the public if user user will have public key tool okay and he will add vote for option one after this yeah my user can send one more message in the second message a user can vote for option two blackmailer wants that this user vote for option two okay he will uh wrote here in the field that his public key is public event and he will sign this

comment with public E1 encrypts it and send to the Macy's Mark contract then coordinator decrypts this message he will show that uh the public key that user used for signing the message is not the same as user publicly okay so this message will be invalid message but user can decrypt this message a user can prove to the blackmailer that he really vote for option two but this message is in invalid message but the blackmailer could not know that this message is invalid message okay so as we already said before we use elliptic curve difficult encryption in

AC in order to obtain the share key coordinator needs to multiply his private key with the public key of voter okay so private key of coordinator is a field number it's a number and the public key of user is point on elliptic curve the results of multiplication will be the point on elliptic curve and this point on an elliptic curve is a share key but when water wants to decrypt the message he will multiply his private key with coordinator Public's public key and he will get the same point on elliptic curve because here we use very elegant

property of elliptic curve when voting is over the coordinator entered the scene and the coordinator needs to make zero knowledge proof that he was decrypted all messages and that he update stately correctly after verification he needs to create one more zero knowledge proof he collects all the votes and make zero knowledge proof with results of voting and the coordinator cannot add some extra Vote or tensor someone's Vault or change vote because he will get the false proof

and this is very nice feature and we want to save it but we saw that the burning problem in Macy was that coordinator can decrypt all the votes so if we have a malicious coordinator he can pass on the information and we don't want to have it so we want to add anonymity in Macy projects how to do that well we need to use album encryption we need to use randomization and of course we need to use zero knowledge proofs so let's start how our gamma encryption works when we have a voter and coordinator in order to obtain their

public keys they need to multiply it there's private keys with generator point on elliptic curve so private keys are field elements numbers and the public keys are points on elliptical when users want to encrypt the message using Algoma encryption he needs to have inputs and that is some random variable X public key of person who will decrypt the data and of course the secret message in our circuit we will calculate the big X the big X is the result of multiplication a little x with generator

point on elliptic curve so if someone wants to know little X he cannot do that because we have discrete log problem in order to assign our message to point an elliptic curve we have map to curve problem and this is very hard problem but in our case it was very simple because we only need to encrypt two states zero and one so we can easy uh have map bijective map that assigned message to the curve point for example we use base point and Infinity Point for this and after that in circuit we need to calculate me which is a result of

adding Point M which represents our message two results of multiplication of little x with public key of A person who will decrypt the data and the output of the circuit will be m e and big X uh when person wants to decrypt this uh secret message he needs to calculate Little X multiplied by public key public key of person who will decrypt the data but this person cannot know little X because we had discrete log problem so he will calculate the result of multiplication

of his private key with a big X he can he obtained big X so he can calculate this but here we will get the same result as the result of multiplication of little x with his public key because we use uh we because we use a very elegant property of elliptical so this person can decrypt the data it is very important to note here that here person who decrypt the data don't need to know publicly of person who encrypt the data and we don't have it in elliptical difficult encryption we also use randomization we use red

randomization when we want to convey the same two Cipher text but we don't want to see the link between them okay so the function that re-randomized uh this Cipher exists in ciphertext to some another cyber text is create in such a way that these two side protects can be decryptable using the same public key and of course when we decrypt this message we will get the same message okay how we use all of this stuff then we we want to save two nice features that we already had in Macy project for example we want to save that person can

change his public key and can change his vote because then he can prove to the blackmail that he really vote for option that blackmeyer wants to vote but this message of course will be invalid message and of course we want to hold the messages or all votes be encrypted and stored on chain but we also want to add we want to add anonymity we want to add that coordinator cannot see how voters voted so in order to obtain that that we need to disable coordinator to see the link between the old and the new public key of water

so we need to have two more messages the first message will be to deactivate their public key not to change to deactivate after that coordinator coordinator will will add this public key to the set of the activated Keys okay and yeah encrypted State using algoml encryption in order to generate a public key person needs to make zero knowledge proof that that his old publicy belongs to the set of the activated Keys okay and the output of the circle will be the real randomized message and nullifiers it is

very important here to note that the nullifiers are important because we need to make sure that user can can generate exactly one public key so in this way coordinator cannot know uh the the the link between the old and the new public key and we add anonymity in Macy thank you [Applause] thank you thank you for this insightful

presentation very interesting could you elaborate a little bit more on the Practical use cases of this um I mean which types of votings would you like to process and what is the practical application I think that we can use it for some kind of voting in web 3 but to be honest I don't think that we can use it for not State voting or something like this so do you think this is gonna be like a smart contract or does it require some other infrastructure yes we use a Smart contractor for

verification of the proof I not only thank you you can always get in touch with the speaker of the of the floor [Music] [Music]