ZK7: StoffelMPC Private Computation on Public Blockchains - Thomas Steeger - Hashcloak

Transcript

[Music] hello my name is thomas thanks for letting me present here this is my first time at ck summit but i won't be talking about uh yeah zero knowledge topics i will be talking about multi-party computation in fact uh yeah i'll talk about stuff mpc which is a framework for multi-party computation it brings some form of yeah privacy to public blockchains okay so this is the structure of my talk so in the beginning i'll be talking a little bit about multi-party computation in general we have a look at some

introductory examples and also add some protocols and afterwards we we have a short look at current solutions of privacy on public blockchains and then we'll see why we probably need some other form of privacy like mpc and what are the benefits and why is it cool and after that yeah we'll have a look at our frameworks duffle mpc which basically allows developers here to to bring some form of privacy to the blockchain leveraging mpc um and so yeah and then we will have a look at some uh general purpose mpc which is needed for this and we'll have a look at compilers

and virtual machines and in the end uh yeah we'll have a look at open problems and give some outlook okay yeah so the first mpc so what is mpc i mean mpc stands for multi-party computation and it's basically when you have several people who have a secret and they don't want to re reveal that secret but they would yeah benefit from some computation over their secrets so i mean what you often read is in the papers is this sentence multi-party computation allows parties to jointly compute a function over the inputs while keeping them private yeah and uh i mean what a funny example is for example if you're working at some

company and you're an employee there and you would benefit from knowing maybe the average salary the company pays so what you can do is the first employee it takes his or her salary and then masks it with some random number so he adds the random number to the salary and then he writes it down on a piece of paper and then he passes it on to the next person again right adding his salary to it and then it goes round and round and round and in the end you get back it gets back to the first person and you can then subtract the secret number and divide it by the people and then you have your average salary which is then broadcasted by some by one party but this is yeah somehow

or at least this example is very tied to this pro specific problem instance so yeah we want to do some more general mpc so what can we do so yeah you probably all know shamir secret sharing from from basically threshold wallets or something like that so how does it work i mean you have a secret and you encode that secret as a point on the polynomial so uh basically it's here for x you have the 15 it's the evaluation of the polynomial at x equals zero yeah and then you give our shares to other people which are points on the polynomial right so you have here player one two and three and if you agree that

the x coordinate is always the player number and then you can hand out these shares without uh yeah specifying the x coordinate so player one would get what is it 8 here player 2 would get 3 and player 3 0. yeah and then i mean basically the secret is split up and encoded into these points and then you can reconstruct the secret by using these points with the lagrange interpolation uh yeah the nice thing about this is here that it depends on the degree of the polynomial of what kind of reconstruction scheme you have because yeah for example if you have a parabola you need three points and for the general case you always need n plus one points yeah

so i you could so you could even add here p4 and p5 and then any three out of five of these shares could reconstruct the secret okay but this was only an example now for yeah the case where you have one secret and you divide it into several shares so now we have several secrets in fact we have two here and uh let's say we have now three players who each have a share of these two secrets and now when it get what gets really interesting is when you uh yeah when you want to compute with it right so how can you compute in this case so think of it as points on the polynomial and if you then

consider addition i mean you can just if you add these points on the polynomial then basically you add the these polynomials together and yeah which is basically adding these secrets then together so addition is pretty yeah simple because it doesn't require any so any form of interaction but it gets a little bit more difficult with multiplication i mean you have the case where you have some public publicly known constant then you can do it similar to addition but it doesn't work if you have uh yeah basically uh yeah two shares you can't multiply that because when you're multiplying a parabola with another parabola you get another degree of the polynomial and yeah then your reconstruction scheme

doesn't work so then you have basically to do a new sharing of this yeah of this combined secret so this is not nice it requires a lot of interaction uh so what can we do here there have been some further i should mention this is the bgw protocol in the literature so it's fairly old and there have been a lot of improvements to this protocol uh yeah so the most uh or the yeah mainly all protocols that use this uh mpc in the pre-processing world where you basically have an offline and an online phase and in the offline phase you prepare something for the online

phase which in this case are these bible triples and these beaver triples are then consumed for every multiplication right so you have these values abc which you share in inside this mpc and it obeys this relation c is equal to a b uh and then when you want to carry out a multiplication you you use one of these beaver triples and use the following relations so each player takes this share x and y and then he subtracts the secret shirt a and b and he then opens it as the d and e so and after that you can multiply it locally with this so this is pretty nice uh yeah and then

there have been several other improvements of this protocol it's called bidosa speeds overdrive high gear there are a lot of protocols like this but what they do is they optimize how these pivot triplets are constructed you can use i think some protocols use somewhat homomorphic encryption for that others use oblivious transfer and sometimes they add these message authentication codes so that yeah this npc works in a malicious security model yeah so here this is this is an excerpt which i have taken from the mp speeds repo i

will tell what mp speeds is later but i just want to yeah show you this slide so that you know that there are different security models under which npc works so basically we have this malicious covered and semi-honest uh yeah security security models where malicious just means that the players don't stick to the protocol and covert is combat security is that they stick to the protocol if they knew or that no they don't stick to the protocol uh no it's uh yeah when they know that they will be discovered cheating they don't cheat that's what it is yeah and semi honest is that they just follow the protocol and then you have these different majority settings honest and dishonest

where is it yeah there and of and the field over which you are operating can be different and then there are some mpc protocols which are entirely different like goblin for example where you encrypt the circuit and send it around okay yeah let's now come to blockchain privacy i mean everything you do on a blockchain is basically public so what can we do to avoid this or what is done to avoid it yeah i mean we have this zk proofs we've heard a lot about them basically zcash you can send around money without connecting a sender and recipient this has then been ported to ethereum

with tornado cache then you have the aztec protocol which is a zkzk roll-up so it combines the yeah the roll-up roll-up guarantees you get from zero knowledge proofs together with this uh with this shielding and then there's new cypher which does this proxy re-encryption and so what from my understanding this is basically some excess mechanism yeah that you can uh so if alice has some data she can encrypt it and then she can allow some other party to get access and then other parties can re-encrypt it on her behalf for this other party without having some intermediate decryption of it and they are also do

some fhe research i think but i'm not true so yeah but this is basically research here because it's some sort of holy grail of computing over secret data another category are these trusted execution environments there is secret network and uh yeah and they use these trusted hardware devices uh yeah basically they're in the cpu like intel sgx um yeah and then there's mpc so currently mpc is in most situations use they are for wallet management so there isn't really any computation over these secrets they are just split apart and then reconstructed yeah but we want to change this right so

that's why i have put software mpc there as a outlook for the future uh yeah okay yeah so why do we need multi-party computation so i mean multi-party computation offers some advantages so the problem with zero knowledge proof is that you can't do them on shared data right so i mean if you think of somehow for example an order book or something like that uh you don't have really anybody who can do this zero knowledge proof for the data so it doesn't work in this case uh yeah the problem with and you don't have that for mpc which is quite nice so why there is uh some endeavor to yeah builds these on on chain exchanges

using mpc yeah then you don't have these trust assumptions like in the trusted execution environments because you don't have to trust any hardware you don't have to trust any manufacturer and to some degree npc is already used in practice so it's not that far away like fully homomorphic encryption i mean there have been some instances instances where it is used for medical data and yeah stuff like that so the problem with npc is a little bit that yes you always have this communication overhead and if the parties are far apart you always have this latency between them so this is not nice and

yeah the other thing is that general purpose npc is quite hard so because the other you get this overhead called virtual machines and compilers and yeah okay so there let's now have a look at stuffel mpc so yeah stuff mpc again is the framework for a developer to build this privacy preserving applications with mpc and for that we need general purpose mc npc so what does it mean i mean it's it's similar to the zero knowledge case where yeah the developer writes his code or yeah what he wants the mps mpc to be done in some domain specific language we'll see

later why we need that and then a compiler takes care of it and compiles it to an arithmetic circuit it's also possible to use a boolean circuit and after that it gets further compiled into bytecode for some vm so what the the the things we need for general purpose multi-party computation is the domain specific language compiler and virtual machine but this is only the mpc world right i mean we want to somehow connect this mpc to the blockchain yeah and how does or how could this look like yeah i mean you basically you have three parties here which is the mpc the user and the ethereum or any blockchain and the interaction between user and

blockchain stays basically the same you have yeah i mean you can query data from ethereum you can write to it using transactions but then you would also have this private data interaction with the mpc and here the mpc uh yeah it operates in this mpc as a service model which means that the secret data is input by the user to the mpc so the npc nodes don't make up their secrets themselves they they basically work for the user and yeah they can also query the output from the mpc for private data and then you have this interaction between the mpc and the blockchain in a sense that when yeah public data is required or when you

when you want to open these yeah these uh the shares the secret then the mpc writes it to the blockchain and in that sense the blockchain is some sort of coordinator for the mpc because yeah the mpc is constantly querying or looking at the blockchain if anything is needed um okay yeah so how does it look like or what are we doing at hash clock so we are building this duffel mpc framework it's inspired by mp speeds mp speeds is basically some form of testing framework for different mpc protocols yeah so it offers this general purpose mpc and uh yeah you can uh the developer

can i mean it already implements this general purpose npc and then the developer can specify with which mpc protocol he wants his code to be executed yeah we use some modular crate architecture in rust i i put here the list of the sub crates which we are currently using or what we are thinking of how it will look like and yeah it would be nice if the developer had the choice to use this framework in two different ways so on the one hand he would use it like i've shown you before but at the on the other end he would also be able to use sub crates of this so for example the here the mpc in the mpc crates there would then be implementations of

different mpc protocols and then they could include it in their application how they like um okay yeah so coming back to this uh to these three things you have this language the the compiler and also the uh the virtual machine so why do we need a domain specific language um yeah basically we want the developer that he's able to write his applications without knowing anything about mpc so yeah but if you have a look at it how how this works i mean some code of it has to be run in the mpc and the other part of the code has to be run in the blockchain

so the compiler should have to figure out how this is separated and then the developer does only have to put yeah to put secret types there or clear types and the compiler figures out how this is separated and compiles it for yeah it's a remainder or for the mpc vm we got about five more minutes five minutes okay yeah so here i put some yeah compiler specific problems from mpc uh what's interesting about mpc is that you want to avoid these in interactions because they are quite costly and yeah in order to do that the compiler tries to penalize the a lot

of these communications and they are they want to batch that into a single round of communication another thing which is a problem is yeah if you have this execution path dependence so in this example i mean if x is secret shared and you have some comparison like in an if statement yeah then it's pretty hard to yeah to figure out if it's true or false so what do you do is that you somehow defer the the evaluation of it and this is this technique is some sometimes known as the branchless programming but it's a problem right because this then scales linearly with the circuit size and you have that in your communication

and if you have something like this for example where you have an array and you want to set uh some slot of the array to one but this is the secret shared value uh you run into a problem because your array might be pretty large right it could be thousand or ten thous ten thousand slots uh yeah and then you have to resort to other techniques like oblivious data and yeah it's sometimes called oblivious rum where you somehow want to hide the read and write access [Music] yeah and this is our yeah or what we think what our virtual machine will look like so it's uh inspired by mp speeds and

scale members game number is basically some sort of sister project to yeah mp speeds and yeah we have these uh it is it uses a risk design so we have these uh op codes for here on the one hand you have opcodes for arithmetic circuits on the other hand for uh for binary circuits and then you have some op codes for both some general up codes and we have these type registers which are for every type so i mean you have the clear type registers you have the secret type registers and you have the call stack and these cores then communicate by using the memory so if core this core

needs to communicate with that core it would go over the memory and if it this the core communicates with a another core at on some different npc node then you would have some network channel between them um yeah okay yeah so here i have put some open problems which we think are quite interesting so we want to add some zero knowledge functionality so that we get some fbc with public verifiability which means that yeah and basically anyone can check that the mpc is doing correct then there's this the next one is much more of an implementation question because basically you want yeah i mean

you want to use several cpu cores for the vm and then it's a question of how to do it because i mean yeah pro you probably want to use some work uh some works the stealing schedule so and this then leads to the using this tokyo in rust uh and we want to support other robust npc protocols so there is currently this or what we are implementing is this honey badger mpc protocol but there are other interesting npc protocols this question is much about uh yeah about this oblivion oblivious write and read excess so how do you handle these data types uh

and this question is that yeah i mean and this what i've shown is currently much more in this mpc as a side chain framework so you don't inherit the layer one security uh yeah and it would be nice if you could somehow execute this as a rollup yeah and the last one is about these beaver triples if you remember it was this uh in the offline phase where you pros constantly process these beaver triples and you need this interaction between the nodes yeah and in there you would just have some yeah solid or random function basically which you see it but they are correlated with each other so you would it would

only require an interaction at the beginning yeah okay so we want to say special thanks to the people at uiuc and ic3 because what we are doing wouldn't not be possible without their work so thanks a lot yeah and thanks to you for listening to my talk uh if you want to stay in touch here is the repository for stuff for npc we just open sourced it and this is yeah cloak you can follow it on twitter and we are currently hiring for mpc engineers

[Applause] so raise your hand so another question i understand but the mpc model here is that you just have some sort of servers like what's what's the what's the point like what are you trying to achieve like okay so you have this like at least from your diagram of having if blockchain have some public statement you're supposed to have some private states shared between two parties right yeah inside the mpc right yeah so you want the npc to be like what

like a network that sort of jointly holds the secret yeah exactly so you have this private data and the private data is uh shared inside this mpc as yeah as these uh shares right so each node holds a share of the secrets and but it's supposed to be like a cluster with like i don't know like n of n sort of sequence so yeah i mean what you what it depends on the mpc protocol that you are using right so in what we are currently looking at you have this threshold guarantee for where you are where you think that uh one third can be one third of the parties inside the portable protocol can be malicious and

it still works right and you and the protocol also offers some form of guaranteed output delivery that you always get an output if you stay in that safety margin and the idea is that the client just sort of like like deals secret shares to the whole sort of decentralized network of npc and then they will perform computations later just sort of like a cloud distributed yes exactly yeah yeah and why is the blockchain involved yeah i mean you want that you get this form of privacy on to the blockchain right so how do you i mean how do you get privacy to the blockchain this could be some way to do it they would have like

like a white list of like public keys of the nodes and the descent like you need somehow like like anchor the identities of the decentralized sort of entities in the mbc cloud thing into the blockchain right by the way if that's the kind of goal of somebody we have some query inside of the blockchain like in the smart contract i want to get some of the data from something or get some computation of it like a mean of a bunch of uh numbers that are secret share and then the mbc sort of cluster needs to look at the blockchain see that request yeah in that way so assign that output and put it like send it back to the box exactly you would have this interaction between mpc and blockchain yeah

thanks perfect okay i think we're out of time so uh once again thanks thomas