Sora on "Non-interactive Private Computation" @ ZK Hack Meetup in Athens, 12 April 2024

Transcript

hi everyone I'm s I'm really mainly working for z now but I'm also personally researching some crypto s cryptography and today I would like to introduce a new cryptography that maybe many of you have never seen uh so let's go so today's talk is about our private competition with some private State dat so we Define this uh protol like our trusted party are holding a private State data and the user are providing an input with the computer its output of a certain second on input private on the private State and input data however

this protocol should not riew more no nor more information more than the py outs in other words uh each party or the protocol should not the protocol should hide the information about the input and the private State private state for each other then how can we use or this kind of competition for the application like web to do web three uh so we can use this for uh for using for user for using the uh uniqueness of the web to Identity or information uh with keeping the anonymous property so for example uh we

can consider a Anonymous and unique human ID so we Define this ID as a hash some random sort and unique human attribution so for example it is a your passport number or your IR code and we can also Define your it's uh proof of Holdings attribution like uh proof of passport for your pass for your client passport number or a video of your eyes uh and you this proof says our eyes in this video has a claimed I scord and this ey is also living one and uh we want two requirements about this humor ID first one is the

uniqueness so it says where each human can obtain only one human ID at the same time for the same same attribution type and second one is anonymousness so it says even if or some other party knows the attribution of attribution your attribution like your passport number uh this no one can compute its human ID uh without the proof of holding the attribution so if the adversary does not know the proof of passwort you cannot compute the proof human ID of your passport number and uh we can and this will be used use for for some onch application

like uh distinguishing between hum and both birs in the contract or some on boting where one human has a one boat but it can maintain the anonymous property or this is my most favorite application is and this is a oan desan where first you die in again you cannot join the game again because this game requires your human ID and once your human ID is registered as the Dead one you cannot get the same human ID or unless you get two passport yes and we can achieve this kind of application or using private

competition with private state but setting the salt a random salt as a private State and or us provides the proof of holding attribution as the input and this one computes human ID or only if the given proof is bued and if you are familiar with LPC or FG uh you may think or we can achieve that using that so for example if you use our FG uh the user will compute the proof of holding the uh attribution and comput the homologically comput human ID or using the encryption of the salt and and uh and also we need a proof of the

proof of the FG evaluation using ELO's library and uh the first party will uh decl the uh DEC this enion of the human ID or if and only if the given proof is valid however here uh we have a less or strong liess assumption on the on the trusted py so this is significant because if trusted party goes offline before returning the Deion of this ened humor ID or user cannot get the human ID anymore so if the trusted party goes offline or the human ID application does

not work so here if we can construct a no interactive version of this private competition or we can solve this live livess problem because in this no no interactive setting or The Trusted party only needed to send one single message and this single message alls the user to compute this perform this private competion our results help from The Trusted party but it should not review the information about the private state so can we Achi such non interactive version of private competitions so our in short it's

impossible in your practical way now but theoretically it's possible using one of these cryptographic theories and today we focus on cryptographic oration sorry so I it does not depend on that's not denote the cryptographic overation but I is one of the cryptographic overation so uh okay so we go to the uh deep of deep of the deep part of the overation so so what is the oration so it's kind of process to compare the some original circuit to different form of overated circuits but since this is just a

circuit you can provide some input for the overated circuit and here it output should be equal to the output of the original circuit for the same input in other words it does not change the functionality of the original ciruit however adversary cannot get nonoral information or in this circuit uh by observing even if the adversary can observe this overated circuit and uh unlike the unlike the holistic overation scheme or like JavaScript overation uh this cryptographic work says are as long

as some cryptographic assumptions hold or or uh some hard some cryptographic problem is had for the for this adversary the adversary can cannot uh get the non trivial information from this OB tet so um with the enough security proof we can also embed such as uh bitcoin's private key we can Al have to C the Bitcoin private key inside the circuit so this strong security definition is the feature of cryptographic Investigation then uh which kind of uh so formally uh which kind of security uh we can

Define so uh actually uh the formal definition of oration is called our IND indistinguishability oration it's I and I says or if there are two circuits with a different implementation but with the same function in other words the these two cets return return the same output for the input that the adversly then the aration of these two cets are indistinguishable for the adversity so even if adversary knows are these two CS are with with uh a recation of Cil or cver

is provided to the for adversity it cannot determine whether the OB comes from C or SE uh but maybe you think or this security definition is not so useful or uh we want more stronger a clear security defion uh but unfortunately we cannot say uh we can construct some overation uh which only reveals the information about the T or about the or pyic output in your plan model however uh in the paper uh in uh last year uh so as this paper says uh if

we if we can uh believe some more stronger assumption about the hash function uh we can make we can model our ideal cryptographic oration uh which only reduce the psychic output so if you use such IDE ofation uh we can construct no interactive private competition with private States uh in this way so in the case of our human ID competition uh we consider a circuit or that's where the Sal is hard called this and it will it will first verify the given proof and if the proof is valid it computes the human

ID uh using the hard CED sort and the provided or human hum attribution and The Trusted body only needed to construct this ciruit without holding a random s and submit the aration of this C that's all and aor can compute this overated soet just by providing the proof of holding the attribution to the psych which that's human IDE and uh to check the live less we consider the case where uh this Transit party goes offline after releasing this

overation even in that case or theator can still comput the human ID because it only requires this overation but this overation should be published at the set up F so we can say we don't have to uh R your Lang of this body then uh so finally uh we are so finally you may think uh K really achieve such ration so uh so um so uh for many years many cryptographers think overation is actually impossible from well established standard assumptions however

a blackr happened in 2020 and as far as I know this is the current uh latest and simplest construction of ir so if you believe uh this or top of these three cryptographic assumptions uh which one first one is a Runing party with noise assumption uh it's similar to lwe but L distributions are slightly different and the second one is just says we have some slow generator with a constant or D and the thir is a kind of assumptions on Baria GPS or other words assumptions using ping and only from these three

constru assumptions we can construct in uh functional inion uh which is a more functional version of public key fun public key eclipsion and using that we can construct an IU and also if we have if we believe more strong or more stronger assumption about the hash function uh we can construct ideal oration from this functional eqution so the CL status of oration is uh we believe or we can construct a recation from standard assumption theoretically but it's complete construction are still

impractical so I believe our next 10 years will be like uh the be like a progress of zkp so it means uh we will make more practical and practical First Construction of aration and uh we will have a a practical solution for such non interactive private competition um so I want to contribute such progress thank you for listening [Applause] do you have any

questions okay so so what exactly is like the overhead of the latest like iio results so there are many overheads uh but one of them is I think the step so one step is one our bottle name is our form from functional eqution to because it complete idea is so weasly use our functional encryption so so so functional encryption is a like okay so functional in is similar to prop

or encryption but it decryption algorithms only outputs the pyic evaluation of the message in the cyhex and the idea of the transform from functional encryption to or uh to I is or it computer uh encryption algorithms of the functional encryption inside the circuit of this functional encryption so uh each repeat process should be at least uh linearly increased with the input size and uh actually I don't understand the complete complete flow of the uh uh complete uh our scheme to

construct functional ention forms our three assumptions but I think this three step this step will also have some bot nexts and okay so would it be possible with uh iio to for example create a smart contract that is like holding a private key and like uh signing stuff based on some condition yeah thank you for your question so I think it's possible uh because uh so for example uh we can uh embed hard algorithms which veries the finalized e blockchain and checks if or

some conditions are satisfied on so if we have some so if we combine such b fire Eire algorithms press or some algorithm to use the priv hardcoded private key and some specific condition uh we can say if there are some events or happened on each and you can provide them find proof of finalized is your blockchain or you can use this private key for this purpose [Music] all right let's give s a final round of applause [Applause]