Private markets on Ethereum - 0xPARC Pierre

Transcript

so hello everyone welcome to this learner and share session today uh today we have a peer who will be talking about private markets on ethereum and for this session you can ask questions in the chat and also request to speak at the end of the presentation and and thank you Pierre for presenting and welcome and you can start whenever you want okay thank you thank you Vivian for organizing this I'm super happy to present this uh in front of PSC people

and outside of PSE also um that um some work that I did with the Xerox Park so I'm also taking this opportunity to thanks uh to give thanks to Xerox Park for that and of course now to give thanks to upsc to for um so I'm going to switch screens right now so that means that I'm not seeing the chat uh so when people are asking questions so I don't know what's the question policy but uh if you feel that there is like some urgent matter that I did not tackle or urgent question like don't hesitate to

interact me because I will not have my eyes on the on the chat Vision so I'm giving you the responsibility to interrupt me when uh yeah um you can answer all the questions at the end of the session and that's fine yeah that's definitely fair all right cool yeah perfect yeah nice cool um so today I'm going to present you a private market so the subtitle is saying uh that it's about like how you can leverage ZK for uh trustlessly trading arbitrary computations so it's kind of a bold subtitle because like we say arbitrary

compositions and in this presentation we will actually like go through only three examples but I see that those examples are like interesting because they tackle very different problems and yet they all use the same scheme for it and is what we call like the private Market scheme in a way uh and what's interesting is that this game is like basically generalizes to all of those three very different examples um so the session will go like in five parts the first one will be like a bit of background because uh I was basically uh on the sh on the shoulders of giants

like I did not invent this and so I want to give you guys a bit of background on where this work is coming from then we'll go over like the relevant Primitives so what I want in that is to give you like the tools so that you get you can after this session like start to think in kind of theoretical terms about those constructions and eventually come up um by yourself with like new things to build markets for so that would be like a bit of the uh kind of the theory behind it but it will be like uh pretty easy then we like um describe the setup so like when you

assemble those Primitives together you actually end up with like a setup so the private Market setup and we will go through it and then we will uh go over like some example markets so like like setting private Keys uh selling signatures setting even growth system proofs so which was like I think one of the most interesting uh result of network and uh finally I will go over like future directions for this work cool so let's go over the background a bit so actually this work um the the there was some early work that was done by Nick Urban and this

work was called eth Data Marketplace and it's a very interesting repo uh that advise you to go check out if you are interested into those things because it basically like lays out um in a very smart way all of The Primitives that basically uh private markets Leverage um so he lays out like three property proofs and he leveraged those property proofs for like different use cases like he says okay yeah we can basically sell the sell the pre-image of a hash and we can also like actually like sell the hash of dark first coordinates so that first is an Unchained gain

um we can also leverage this for like um uh like proving the image bearing process that was done on some particular jpeg for instance using some random bitmap and um he actually gave a talk last year at East Amsterdam where it was describing a setup for a cell selling SEC P 256 K1 key pairs so the kind of keypads that I use on bitcoin for instance and uh yeah so it's a it's a very interesting Ripple um and it was actually a very interesting talk so uh go check it out uh it's it's

um it's it's it was pretty early in in a sense so there is a certain background that is also interesting and in which I was a bit more involved uh here it was not again it was not my idea um it was also an idea by Nick so uh it was this idea of selling like the hash of some dark first coordinates but um someone called xeroxash Cameron and was like okay let's build actually a market for back Forest planets and so we built what we called a Night Market so dark Forest is like a launching game

where you can sell planets uh sorry conquer planets and uh what we did was some kind of trustive Market where you can sell the planets that you have conquered because the planets that we are actually conquering in that game have like specific abilities or characteristics so you can resell them because they can act as a strategic advantage to your allies or to your opponents so it was a way for people to like make a bit of profit on Dark Forest while not getting into some with ponzinomics basically

and so Night Market was a way to privately exchange Planet coordinates um by improving the properties some properties about them so for instance I would say so I have this planet who is like that specific characteristic that is super interesting I can Zeke prove it this characteristic but I can also ZK prove to you that those coordinates are encrypted in a way that make it possible for you to later on decrypt those coordinates and get to know what the special planet that I'm talking about and getting to you on that market and so the general idea that we started

to have was that what is provable is tradable and that's quite an important idea because anything that you can prove in uh by writing for instance a circuit about it so let's say for instance that I want to prove that I know the square root of a number or more generally that I know some kind of results regarding some computation if I can prove that I have correctly done that computation then that means I can actually Trade It because I can give the proof that I know um witness that satisfies that computation and you might be interested into that

witness and I can actually prove it that I know it so I can sell it to you so that's a pretty powerful idea so let's go over the relevant Primitives for that so first there is what we call the assertion proof so we renamed it from property proof which was a term used by Nick because sometimes people were confused because property could mean like some people would interpret it in a way that property meaning some property right when actually what this does is just verifying that the data verifies some

property that you are interested about so the thing here that we do is we run some function that takes as an input some piece of data some property that we want to verify about that piece of data and we basically add a constraint that checks that these functions returns and so when you do that assertion proof you are basically convincing a buyer that the private piece of data that you are selling verifies the property that is being sold then the second relevant primitive is the encryption proof so this proof is here to convince the

buyer that the private piece of data has been encrypted using a desired key and scheme so the little formula that you see on the right shows that if I am encrypting the data with some key and that I am decrypting in I am decrypted decrypting that encrypted data with some key I'm getting the data back so that's what the proof will do it will say hey I'm using this key and I'm using that encryption scheme and when I encrypt it and then decrypt it back and get into data back

so that's the encryption proof and we will need it because we will want to convince the buyer of the data that it will be able to decrypt the data that is buying because when we communicate that data on chain of course we don't want to extend that data completely decrypted we want to encrypt it so that this knowledge gets spread only between the seller and the buyer and not everyone can access what I'm selling so that's the encryption proof so assertion proof encryption proof and commitment proof that's the third important primitive and it's

it relates to the idea of commitment and here what we are proving to the buyer is that what is being sold and how it is sold verifies some earlier committed value so let's say for instance that I'm committing to selling to you the private key of a particular address then I am committing to that address I cannot tell you the private key of some other address so the commitment here would consist into proving that I'm selling to you the private key of the address that I have committed to earlier cool so let's say let's go over a very

simple setup so this setup consists into like setting an odd number so it's just an example setup and as you can presuppose it's not an interesting use case but a simple one that will maybe give you some intuition about how those Primitives fit together cool so let's say that Alice knows an odd number so she will commit to this number by posting it hash on a smart contract so she will hash this number in some way and commit to it on on chain

so here it's written in blue because it relates to the commitment proof then what should we do is poster public key with which anyone can compute a shared key using for instance ecdh so adapt you have the chairman and here it's written in red because it relates to the encryption proof where the seller will show that he has encrypted the data so here Alice with some sharete so Second Step Bob comes along and wants to know what is this odd number so we will compute these shared key with Alice using again ecdh for instance and

it will commit to that share key so here it's like a mix of the commitments and of the encryption but it's written in blue because Bob commits to a shared key um and highly Alice will have to prove that she has encrypted her odd number using that committed short key also it will escrow one if to pay a list for this odd number and Alice will come back in the picture now so she will be able to sell to Bob her own number what she will need to do is first to show that her number is not divisible by two so that's the accession proof where

she's proving some property related to the data that she's selling it's in green then red because she's doing some encryption proof and he shows that he correctly encrypted your number using some encryption algorithm and then the blue proof so the commitment proof she shows that she used the same shot key as Bob and that's the number that is being sold is the same as the one committed earlier so Bob is now sure that he's buying the odd number that Ali is committed to earlier so yeah that's how the three those three different Primitives the assertion proof the encryption proof and the

um commitment proof are all coming together to sell this odd number okay so a small detour you have two setups that you can think about um we'll not go into too much of details but you have the bid or the ask setup in the ask setup what it consists of is to say I know some piece of info and I'm asking x e is for it and so the flow will consist into saying hey I'm asking for X is and someone comes along order so like Pub

escrow some is and then I come back and I fill that order in the beat setup it's a bit different because here I come along and I say I want to know some piece of info and I'm bidding X is for it so in that case I'm and communicating uh to the outer world that I'm interested into some piece of info and if someone has this piece of info then it can come along and feel the beat that I'm doing so when you do a sale using a bit setup you have a reduced number of steps but yeah that's that's a small detail so let's go over some example markets

let's do some interesting uh markets that we can learn learn more things than selling in our own number okay so let's do first ethereum addresses so in the case where we want to sell an ethereum address on chain using that setup first we will have a Setter that will come and that will say that is asking for X is for the private key of the address 0x ABC so we are in the ask setup basically and the seller is like asking X is for that the buyer comes along and makes an order so firstly we'll

escrow the eth for the private key of this address it will commit to some shared key that he has computed using the seller's public key and you will also post this public key to carry out to let the seller also carry out ecdh on this side foreign consisting of a property proof so the assertion proved that we are talking about with consisting to proving that the private key reserves to some ethereum address the encryption proof and finally the commitment proof so the encryption proof proves that we encrypted the private key with the shift

key and the commitment proof proves that the shacky results to the address that he was talking about earlier and finally the buyer can decrease the secret key that has with the shared key that he has computed and which has been the encryption is posted on chain so it just puts the data back from the chain and decrypts it with the shared key that he computed early on foreign so now let's talk about edgsa signatures you can do it for private Keys you can do it so for signatures so setting signatures is actually quite similar again so the server comes and

here is just making a different he's just expressing something different he's just saying for instance I can send data with this particular private key to which a public key is associated and I actually commit to this application chain so if someone comes around and if she wants to I can thank some stuff with this private key and let's say that there is a buyer that is interesting it was maybe big message to be signed by this public key maybe to access subservice and so it comes and he he does the same thing again he is posting this public key he's posting some data related to the signature algorithm and he is also posting the hash of the chat key again checks that the hash results to some

committed public key and here is signing the hash of the public key in that setup and is just proving in that case that the signature he has done is correct and that this the data related to the signature is also encrypted correctly so that when the buyer comes back it can decrypt the signature and use it anywhere he wants so this is a way for instance to tell let's say some signature over some particular message and so let's say this message would be I want to access this service then I can ask to someone who has the key to generate a signature over that message to generate a message for me so then I

can also access that service on my end then you can also sell gross 16 proofs and I think that's where it was also like very interesting to do this work um it actually did not start with let's say Square 16 proofs it started with um some other idea so the idea that we wanted to realize in the beginning with private Market was to allow anyone to sell their ability to post messages into ZK gated group so I don't know if you have heard

about like hey Anon but hey Anon was some project that was uh proposing for people that were able to prove some property regarding their ethereum address so for instance I can prove that I own some kind of nft to start posting messages on some Twitter account so that makes this app uh what we call a ZK gated app because to access the functionality of the app you have to provide proof using ZK that your ethereum address has a particular ISD

um so in the case of anon the proof was consisting for instance of a marker path and a signature as private inputs and we are like Okay so let's tell the record path and the signature directly but of course if you do that you would detoxing yourself because you would if you wanted to sell you access to it you would basically give with it the marker path and the signature so you would be saying hey that's this publicity that access to you so we could not naively sell knuckle paths and signatures for that

and instead what we came up with was well let's use recursivity because recusivity would allow us to tell the proof itself without diverging the input to the proof and an app like Anon is not expecting to see the inputs of the proof of course it's just expecting to see a valid proof and recursivity would make it possible to sell lugural 16 proofs that make it possible to access those kind of services directly without diverging any data about the marker paths and the signature okay so let's go over how that works

so here the buyer comes and stays in the case of renon he says I can generate a proof or this particular group so a group here is some groups that is only that has some exclusive rights to personal messages on an and the Sarah comes and says I can generate the proof for this particular group and this particular verification key and so the verification key is this device in a way that is in charge of verifying the proofs and so he's saying that I can generate the proof of that particular verification key so that you are sure that you are buying the proof

that results that would be verified that as true from this particular verification key and not for some other verification key that you are not interested in on the market and it comes to his public key again some some signature data and some shaky that he wants to use for the encryption and then what the setup will do is prove that the cross 16 proof being sold is correct that it has been also correctly encrypted that the enclosure key is correct the verification verification key is correct

and that the message hash is correct um what is the message hash in that case well in that case actually the setup comes and asks for instance for posting a particular message in this group and the buyer will simply show that the message hash that you assigned and for which she has provided also some Merkel proof for the public key that is in the group is correct so that's why you are talking about the message hash here that's the big picture is that the setup comes and says I can access this group uh the buyer sorry comes and says sorry

to say oh okay I I think you have yeah I have interchanged by your answer on that picture so if you're confused that's that's normal but steroids on the left and by your eyes on the right uh but basically the picture is that the seller comes and says I can access this group the buyer says I'm interested please generate a proof for accessing the group and um I want to post that specific message and the seller says no problem it generates the proof he also signs the message that the buyer wants to post in that particular group and he encrypts the proof and then eventually the buyer

can come decrypt the proof and submit that proof to the DK gated app so that you can then post the message into group that he was not supposed to access so where does recursivity comes in well if we go from the left to the right we will see how the approved generation process works so firstly you see on the left there is two kind of inputs there is public inputs which is the roots of the group that we want to access to so often that group is represented as a tree and the root is a public signal to the proof that we are generating and

there is also a message that is public and then you have some private inputs so a marker path a signature and a pep key those things are are not supposed to be known to the buyer of the proof so first the seller will generate the Anon proof for that showing that is supposed to access the group and then the recursive step will come in the second in a second step but consisting to showing that you are selling a valid proof of a hay and unproof so that's the big red circle where the sacred will check that the proof that you are selling is correct

that the encryption of this proof is also correct and that it has been encrypted with a shared key that is also correct and so the outputs of that will be Roots a message and some encrypted proof that the buyer will then be able to decrypt and post into the zkgate tab but it's not a perfect world and the issue is that this was a very expensive circuit so I think it's above 20 million constraints so I clearly went above my AWS budget for that

um and it was uh pretty expensive both in terms of computation and in terms of money but it was still a very interesting experiment cool so let's check what all this means what does it mean that anything that is profitable is tradable and that includes private Keys signatures cross 16 proofs and whatever kind of provable computation that you can think of so first I think that's a cool perspective is that you can have a world of nice dabs that can come out of this so for instance selling private keys well you can actually think about ways

to leverage account abstraction and some kind of rotating key key pair that is working on your abstracted account that you are using and then you end up with a way to rent your wallet with that scheme also setting signatures well it's also a nice it's a nice way to um do you know web pure web Tree in that native way um of handling subscriptions so let's say for instance that I'm a digital newspaper and um I want to sell subscriptions and the way I can login into my website is using uh signatures well people can

actually buy those signatures on chain trustlessly and anonymously to access my service it's also a pretty cool way for instance to handle subscriptions also selling group 16 proofs is a nice way of for instance giving a voice to those that could not access an app for instance I know that um there is some really cool project going on in the nouns now with um some um some Reddit like zkk to the app for expressing And discussing governance proposals but the thing is that to announce uh costs like a lot and so if

you have something that you would want to say about nouns that you do not have uh enough is to buy a noun and someone deems your message interesting but wants to remain anonymous while sending you the access when you can do that using the market construction and in general it actually gives some pretty interesting utility to your nft because it means that you can now start to use your nft to generate proofs about it and sell back those proofs to people that are interested into accessing those litigated tab and of course there is a lot of other steps that can be I think created using that game and I would be like very excited to

see what they look like a second interesting idea I think is that these constructions makes liquid E-liquid things so private keys are actually not meant to be sold ZK gated groups are not meant to be opened and if you can now build markets around those well this means that those peer-to-peer markets are making liquid E-liquid digital assets and so that's very interesting because I'm not sure that um we have a fully explored what are the implications of this kind of idea because um I don't know how liquid

a whole liquid are supposed to be private keys or how liquid are supposed to be segregated groups because often those zkt groups for instance are built with the assumption that this is a good mechanism for civic protection but it also asks questions about well if I can sell the proofs that are the key to let people enter that group well that can pose Sometimes some questions and yet also propose very interesting design opportunities for the makers of those zgregated apps yes so thank you and I will now take your questions

thank you so much uh do we have questions um yes we have condition yes and so is it possible for ZTE groups yes so that's a very interesting question and um this is possible and I think this is a restriction and it's also like a design choice so um zkgate groups I think can like add some rules with respect to what kind of proofs can be provided to access the app and maybe for instance design some

mechanisms for um proofs value so for instance you could imagine a market where uh proofs of second order value are sold and those proofs are second total value for instance are used for accessing channels where only people that have both those proofs with of second data value can access to so it's an example of adding some restrictions for those CKD groups and yeah I think that's an interesting poll design poll to turn around and to explore because a lot of

things can be tweaked and thought about regarding which kind of restrictions you want to add on top of your CK git tab yeah thinks of this question thank you um I don't know if there is any other questions uh people can request this picture if that's why one minute to say someone

wants to last um more questions [Music] seems like it was very clear um yeah so thank you so much and thank you everyone for attending and thank you so much Pierre for the presentation and as someone is typing uh yeah thank you thank you thank you

thank you thank you vegan very nice from you for okay bye-bye see you bye I