ZKPodcast: Dan Boneh on the past, present & future of cryptography

Transcript

before we start we want to say thank you to our listeners for coming along with us all the way to this special hundredth episode in general we really do like to hear from you so please get in touch with us and let us know what kind of topics you want us to cover for the next hundred EPS you can find us on telegram on Twitter on YouTube or you can email us if you want to support the podcast you can donate to the show either on patreon get coin or directly all of this info is in the show notes and if you're new to the zero-knowledge podcast then I want to say welcome please do subscribe where you get your podcasts we share new episodes every week and we would love to have you join us so thanks again for coming along with us on this journey for

the last two years we've been learning about blockchain tech the decentralized web and the awesome emerging field of zero knowledge proof systems it's been a wild ride and at the same time feels like it's just getting started so I would say stay tuned so now on to our interview with Dan Byrne a welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik all right so I'm here with Anna and Dan Bonet and this is a very special episode

because it's our hundredth episode and I can't imagine a better person to have our hundredth episode with because we're sitting with someone who has invented much of what we were talking about and much of what the entire blockchain space is built on so I think this is great too many of our listeners you're someone who doesn't really need an introduction but perhaps it's best to lay some background work here so Dan who are you how long have you been working in crypto and whatever related fields so first hi everyone it's great to be here and congratulations on 100 episodes really really happy to be here so let's see so so for background so I'm I've

been working in cryptography now for for a long time am almost embarrassed to say it's almost what is it 20 over 25 years or so it's a wonderful wonderful wonderful area I really really enjoyed it I've kind of I got hooked on cryptography already when I was in high school it was kind of clear to me this is what I want to do with my life it's a it's a beautiful combination of very deep mathematics and real-world problems and people really care so I'm a professor here at Stanford I that I've primarily focused on cryptography computer security and in the last five years or so on block chains again block chains are like such an exciting area for cryptographer that it's been a lot of fun and I guess that's what we'll

explore in the coming hour you say that like cryptography was always this exciting field but early on what was the exciting parts and was it what was it different parts do you feel like there's more and more industry involvement as time has passed I'm just sort of trying to picture like what it was like then and what it's like now oh absolutely it's changed a lot over the years so I guess when I started out the field was mostly well the field was all was gonna divide it into two parts there were the people who were trying to build secure systems and using cryptography cryptography for that and there was a lot of kind of ad-hoc experiments going on at the time and then there was the theoretical community who was kind of laying the groundwork

for what is a secure system it turns out even just defining what is secure encryption that actually turned out to be quite a difficult thing and surprisingly even for something as simple as symmetric encryption right so Alice and Bob have a shared key Alice wants to send a message to Bob how does she do that even for something as simple as symmetric encryption it's only in the year 2000 that we had our correct definition for what is the right the right thing to do that what is it that we're actually trying to achieve and for your listeners I hope everybody knows this is a course called authenticated encryption which is kind of the correct way to implement symmetric encryption today so that was kind of being developed by the by it more of the theory community and what happened over the years which I thought was really

exciting is this really SiC bridge emerged between theory and practice primarily because the ad-hoc experiments that were kind of developed over the years you know in many ways turned out to be let me just say kind of more exciting that we want them to be works you know so excitement is when things break it's very exciting and you know we have a version a crypto library now called boring TLS which the whole point there is to say cryptography is supposed to be boring you implement it it just works it never breaks and you never hear about it again and in the old days in some sense cryptography was exciting which is kind of experimental protocol fee I mean it was a little too had a little too many attacks on it and so there was a very thick bridge that was constructed between the theory community

and the applied community and now for example it's pretty much accepted that authenticated encryption is the only way you should be implementing symmetric symmetric encryption there are very robust models for key exchange and in fact the development of the very recent development of TLS 1.3 I'm sure all your audience has heard about this is a huge development in the world of security and cryptography that is an amazing success in that that whole protocol was designed using you know rigorous definitions and formal verifications of all the protocol steps and it's a major major advance so TLS 1.3 is a much better protocol than the TLS versions that came before it

specifically especially thanks to the stick bridge between the theory and the experimental community and you're given this long history you know at what point did you start seeing like blockchain as being a part of cryptography and what what was your entry point into blockchain say oh yeah that's it that's a great question so you know blockchain is not just about cryptography blockchain is kind of a combination of multiple areas one of the things that's so fascinating to me is that it really is such an interdisciplinary field of research or more research you know I guess interdisciplinary field so obviously it involves cryptography but

it's not just cryptography it's also distributed systems economics legal aspects and so on so to me I guess boy I don't remember the exact dates but I guess we we kind of well I guess we taught our first course on blockchains back in 2015 I believe so that was that was that was kind of wild a while ago and we have been teaching this course now annually so I think right now we're teaching it from the fourth time I have to say it's one of the hardest courses I teach and the reason is it's almost the exact opposite of teaching calculus right so when you teach calculus well I don't teach chuckles but if you if you teach calculus that's that the material

doesn't change right yeah that bought's material that was invented when a 200 years ago and that's basically what you eat and blockchains literally literally every year that we teach the course it's a brand-new course yeah it's remarkable that we have to kind of redo you know 75% of the course every year and I'd love to talk a little bit more once we dive into education I'd love to talk about the changes we made that we made this year but so the attendance attendance in the course is actually fairly robust it's like over a hundred students every time although it does fluctuate so it's kind of interesting that I'd say I'd say that you know enrollments kind of fluctuates with the price of Bitcoin if we see over the summer Bitcoin goes up but attendance goes up if we see over the

summer the big goes goes down the tennis goes down yeah I was just thinking it must have been very there must have been a huge waitlist in 2017 late 2000 oh my god yeah that then we had then we had over 150 students yeah that was actually that was actually quite a large course do you limited actually no no no no no of course there's none of our courses our limit of course is to don't we have very very large courses and then you also have Coursera you have on online course oh yeah so actually maybe it's worth maybe it's worth talking about as you can tell I'm very passionate about education particularly cryptography education so maybe I can talk a little bit about what what are resources that people can kind of use in a bit in addition to the blockchain course we also have courses

that focus specifically on cryptography and computer-security so cryptography core is basically just an introduction to cryptography so actually we have courses at many different levels that I teach so at the freshman level this is these are students who are just coming in starting user like nineteen year old students starting in and I try to get them excited about computer security and cryptography so we have like a course it's called ten ideas and computer security it's half about security half about cryptography we have an introductory course to cryptography and then we have our graduate course in in crypto although I gotta tell you there's I have to tell you this funny story that happened to me a while ago so I get this call from a reporter and she's telling me that she's writing a story about crypto education so I say great that's

what I do let's talk about it and then she says well so how long have you been teaching crypto so I say well I've been teaching crypto for over 22 years and then the reporter is a little eyes a little puzzled yeah so then so then she asks but wait a minute before 2009 there was nothing to teach what did you teach before 2009 yeah so then that was I was a little shocked yes so then I had to kind of stop and say wait a minute cryptography this is like that area that's like over 2000 years old you know the ancient Babylonians were already encrypting things yeah so it was not invented in 2009 there was a lot a lot to teach beforehand and so yeah so so goes back to the crypto is means cryptography not cryptocurrency ah

well yeah that's true that's true but actually the word crypto honestly it's kind of now become it has two different meanings right yeah I mean it does mean cryptography to some people and doesn't mean cryptocurrencies to some to some other people does that bother you there's other people we've interviewed are really bothered really bothered by that you know at the end of the day a lot of this is applications of cryptography so I don't I don't mean to be you know I what is it there are enough battles to fight out there I don't need to be fighting with Mill's yeah so if people want to use crypto for cryptography and cryptocurrencies fine I think it's better of course if crypto continues to mean cryptography because that's that's the original use of the term but if people are happy and

expanding what what it means fine do you also I mean do you consider what you're working on also cryptology I heard that there was a distinction there so cryptography meaning the ability to encrypt and cryptology encrypt and attack yeah so I don't I don't like those distinctions so there's a cryptography which is sort of encryption and crypt analysis which is the attack attacking crypto systems and then cryptology sort of the combination of cryptography and cryptanalysis you know those I think those distinctions are somewhat artificial in that the way we work is you know we try to construct a system and then we try to prove that it's secure if we fail to prove that

it's secure we try to attack it if we fail to attack it we go back to try to prove that it's secure and we bounce back and forth and sometimes modifying the system as we go along and so really to design you can't design a crypto system without also knowing how to attack it so the distinction between the two fields is is not that meaningful you know cryptographer needs to do it needs to do both so yeah I want to jump back into this point on education because I would want to make a part of this podcasts about education actually I think it's a fascinating topic but I would want to take a step back from where we were just talking and ask what do you think the current state of both cryptography and blockchain education is

today like cryptography education is obviously widespread and exists in all universities across the world blockchain education not at all like I think Stanford is in the forefront here oh yeah for sure right so like you said cryptography education is actually fairly fairly widespread maybe I should mention that in fact you know we have even this massive open online course this is what's called a MOOC on cryptography that in fact a lot of universities adapt adapted the material for the MOOC for their own local courses which is everybody before as its material is public everybody's welcome

to I learn from the course and also use it to design their own courses so that's on the on the cryptography side on the blockchain side there is still a lot of there aren't that many like you said there aren't that many universities that offer courses and I think that's kind of unfortunate yeah I think it's a such an exciting area to teach that I would really encourage many many more professors to actually offer those courses at the universities one thing I would say is education has kind of changed a little bit over over the past couple of years in that first of all all of our materials are available online so anyone who wants to design a

blockchain course they're very welcome to come to our to look at what we teach there they can steal all the materials they can steal all our projects our exams are our lecture notes and are very welcome to just use it to design local courses at their universities and I would say even everything that we do is recorded and made available so if anybody if a student wants to actually take Stanford course on blockchain zoran on cryptography go ahead you can sign up remotely and we have students from all over the world who take our courses on everything is is recorded and available for folks to to attend and so why do I find this why do I find blockchain is so

much fun to teach like I said it's a hard course to teach it's a hard course to teach because it changes from year to year but what did that let's let's talk a little bit about what goes into a blockchain course so I viewed a sort of a mix of a distributed systems class plus a cryptography cryptography class so I kind of liked to think of blockchains as a system that has four layers yeah so the bottom layer is what I call the consensus layer this is basically how do we take a sequence of transactions from the public or a set of transactions from the public and make it into an ordered sequence that all the participants in the system's agree on that's what the consensus layer done that's what that's what that's what layer one the second

layer unfortunately I have to call layer 1.5 which you'll see why in a second so that's the second layer it's layer 1.5 is what I call the compute layer sometimes this is called a blockchain computer so here in layer 1.5 we kind of we can kind of assume that transactions are have already been us ordered sequentially and now we can build a computing environment on top of these transactions so you know Bitcoin has Bitcoin script as the computing layer theory am has the EVM is the computing layer you know many other block chains have their own computing layer so that's kind of I kind of think this is kind of the equivalent of an operating system for we like I kind of like the name blockchain computer so that's that's that's what I tend to use layer two is basically the applications that are

built on top of the blockchain computer right so these are all the stable coins and lending platforms and and all the dphi that's been developed out there and then layer three is basically all the user facing applications so these would be like wallets and custody services and things like that right so I kind of think of these as these four layers and you notice that it has many it's it's it's it spans many areas of computer science and beyond so the consensus layer of course a distributed systems the application layer has of the compute and application layer has a lot of cryptography that's that that's built into it including by the way zero knowledge and snarks which is I guess where what we'll talk about in just a minute and then you know the obviously the the user facing layer that

has a lot of legal and business aspects associated with it so in fact every year obviously another lawyer so every year I ask a lawyer to come in and talk about the regulatory environment for blockchains so just a shout out I guess this year we have the chief counsel of Anchorage coming to speak at our at our class but the regulatory environment and of course the regulatory environment that's like a fascinating area in its own rights especially what's happening in the world today you know with Libra and now the feds saying that they're going to get into cryptocurrencies so that that's kind of a whole that's like a whole class on its own which by the way I should say Icona my classes designed for computer scientists so we focus on a how the different layers work but the students

actually go ahead and build decentralized applications all the way from writing solutely contract including the web 3 interface and so on so all the way to the user facing parts of its but it's designed for a computer scientist there are also parallel courses being taught in the last law school and in the business school they focus on completely different aspects of blockchain yeah so if your listeners happen to be faculty at other universities this is an amazing opportunity for like interdisciplinary collaboration right Khan creating a sequence of courses across the university is is really really rewarding and you know we all get exposed to a set of topics that we're not really that's kind of a little bit outside of our daily week is there

is there any other topic in cryptography where you've seen something similar where you've actually seen course like I realize that these are related courses and they don't need to be taken in tandem but they it helps to know something about law and it helps to know something maybe on the business side so or that or the token economic side when it comes to other cryptographic concepts have you seen anything like that well you know that's the beauty of computer security a lot of computer security is interdisciplinary right so computer security obviously has a huge legal aspects around it right so in fact we one of the courses we teaches is legal aspects of computer circuits computer security for lawyers yeah basically how the legal system how the US legal system interacts with the technical computer

security world so that's kind of so that you see that a lot in in general computer security but computer security you know so it has obviously legal ramifications there's a lot of psychology goes into computer security how do you get people to do things that harm their computing environment so know so a lot this look this is why I love this area a lot of it is really goes goes beyond computer science to other other parts of you know of academia that psychology economics and so on so it's not unique to blockchains but blockchain is really really really amplified what what are those categories so for blockchain we've sort of mentioned there's computer science there's legal the big school business economics and economics yeah okay yeah so right so those are kind of the major parts this psychology is not included

yet yeah yeah that's it that's a good question you know I'm sure that in time psychology will be will be included as well I guess there's there's a lot of you know in computer security there are the types of attacks that we call social engineering attacks where where I try to kind of an attacker would would try to make a user harm their computer by calling them up and that's called social engineering and convincing me to do things that they shouldn't like telling your password right you shouldn't but yeah I can people attackers can convince you to do it so I don't know that we're seeing as much of it in the blockchain so we see much of it much more of it in computer security but I'm sure I'm sure in the long run psychology psychology it rules everywhere right so I'm sure in

the long run we'll see more interactions when you're teaching these students like do you feel like there's some students who are just so good on the engineering side but maybe less talented on the theoretic side on the math side are you trying to find students who have this perfect balance like what are you kind of what are you looking for when you're when you're teaching these people oh what a great question yeah so even though you know our students are amazing I mean it's just I kind of always impressed with what they're what they're able to do obviously there are some students who are more interested in coding and engineering and there are some students who are more interested in in doing proofs and focusing on the math this is why cryptography is such a wonderful area it literally brings the

two things together right so well you know if you're gonna be using cryptography implementing cryptography doing research in cryptography there is nowhere around that you got to be able to do understand deep math yet you gotta be able to do proofs these days a crypto systems it does not have an Associated proof of security is not a crypto system that we pay attention to yeah and so you have to learn how to do proofs at the same time it's an a I've you gripped our introduction to encrypt or sets an applied course in that yes you have to do proofs but you also have to write code that implements everything that we learned so I think it's one of the I can't think of any other course where students literally you know they have to deal with you know group theory and and

and proving that that that certain things are are correct and at the same time they have to implement and show that what they did works I think this is unique I don't I don't know that that happens and a lot of difference in a lot of different courses and honestly this is why I try what this is what attracted me to the field I love both the system side of things and I love both the mathematics of it so this is what I do why I do it and this is why I view it as an applied course so how do we deal with this dichotomy right that it kind of takes you know to the two sides of your brain well it takes two parts of your brain to to kind of to kind of do this well the truth is that it's it's not

that hard right I mean if you I'm a believer that if students are excited by a topic they'll devote energy to understanding it and then they will understand how to do both math and implementation the same time yeah so the goal is just to make people you know excited about the topic and understand that this is something that they need in the real world right when they graduate these kids are going to be the ones building the computer systems that are we are going to be using in the future it is absolutely guaranteed that they're gonna rely on krypton they're gonna need cryptography no matter where they go even if they go into block change for sure but even if they go into building web systems and storage systems and such they're gonna have to use cryptography

to protect the information yeah so they're gonna have to understand how to use it correctly they have and they're gonna have to understand how to implement it correctly and so I think it's a it's kind of easy to motivate students to actually get excited about the area and also honestly it's something that they haven't really seen before and most of them haven't really seen a lot of this before the kind of the the types of proofs that are involved the types of attacks that are involved you know the amazing thing is you I can show them like you know here's how RSA signatures work looks perfectly reasonable to you seems like it makes sense and it should work and yet if you start thinking but you realize that if you implement it with one tiny bug the whole thing is just completely insecure which is trivial to forge signatures

yeah this is like this is a tag called ablation back our talk on RSA signatures which is a lot of fun to teach because you see this you literally see this thing works right you can sign you can verify everything works it looks like it should be secure and if there's just one check that you forget to implement the whole thing falls apart right it just shows you how how subtle and difficult it is to get it right yeah and you know students need to understand that this is something that sort of actually kind of kept me out of crypto when I was in college because there's like I had worked in engineering for a long time before college as well and like when you're talk to programmers and talking in engineering there's this mantra of don't roll your own crypto everyone says

don't roll your own crypto all the time everywhere and I think it's sound advice oh I'm gonna go I'm gonna take it a step further so don't roll your own crypto typically refers to don't invent your own crypto which is absolutely right you should use standards you should use the things that the community has vetted absolutely right there's another step to that which is typically don't even try to implement your own crypto because it's that's the that's what I take it to that's right that's right it's one of those things where you know if you're at a company and somebody comes to you and says whew I made our crypto library 20% faster this is great the tip of the answer should be no you probably made it vulnerable to a timing attack right there's a reason why these things are implemented the way they are and so even

when like implementing crypto correctly is counterintuitive and typically you should be using standard libraries that a lot of people have vetted looked at and tried to break and couldn't and that's what's that's what you get should actually get deployed but how do you then balance that with getting people into the field if you're always telling everyone to not do anything in the field well I mean that that's that's a that's a very fair question but the the the fact is that to know how to use a library correctly you have to understand what the primitives are and how they're supposed to be used there's a typical example is actually this is something that just came out in iOS 13 right so Apple has this what does it call the

crypto object that's supposed to be used by applications to encrypt and they're there before iOS 13 their interface was fairly complex yeah you have to specify the initialization vector the IV you have to specify the mode of operation for your for your encryption scheme and most developers just didn't know what to write there so they just ended up googling and went to Stack Overflow found some sample code and just pasted that into their into their application and it turned out that sample code was just incorrect yeah it told them to use ECB mode for encryption and said the I've eaten all and that that's just that's just incorrect so unless you understand what the parameters are it's very likely you're going to use the library incorrectly which by the way it's kind of interesting this also goes to API

design which is in crypto one of the that's also been my mantra in that we should keep our API is boring as well right it should be like literally encrypt key and message it shouldn't be the API should the basic API should not have all these bells and whistles where you can specify the mode and the IV and so on and so forth right so one of the things that happen in iOS 13 is Apple greatly simplified the the crypto API so now it's a lot harder to get yeah so we definitely should see more of this but my point is no matter what library you using you need to understand what the primitives do so that you can use the library correctly now moving on to zero knowledge stuff which we've already touched on a little bit you know

I think zero knowledge crypto has become a really hot topic over the past year two years maybe there's also been a ton of development happening recently also in your own work and what your group is doing how does zero knowledge fit into the field of cryptography and why are why does zero knowledge Tech seem so important especially to box chains Oh fantastic yeah so I'm really excited about all the developments that are happening in zero knowledge so by the way one thing that I promised you come back to earlier so let me do that now is one of the new things we're doing in our blockchain course this year is I just believe because snarks have become such a vital component of blockchains

that we're not developing developing like three three weeks of the course just explaining how snarks work and how to use them in blockchains yeah so we've made space we've had to kind of compress other things specifically to make much more room for snarks and by the way we're gonna make all that content available on the internet for free so if anybody wants to learn about snarks come back in in a few weeks and all this all this information will be available on the web well this well this snart's course be specifically for computer science yes yes okay because I've always understood you can teach snarks for computer science you can teach snarks for cryptography you can I I tend to teach computer scientists for sure for sure there's room to do a blockchain class for non computer scientists actually you're making me think that

this is maybe a good idea for me to do in the future so but that right now the course is designed for computer scientists so the plan is we're gonna dive exactly into how snarks work and by the way this has become such a fast-moving area there's so many new ideas coming up that we could actually teach our whole course just on snarks but this here we're just gonna focus on kind of the main the main techniques so why do I think that snarks are so so important for blockchains well there there are kind of two killer apps that make them really important so the first one is a blockchain all the data on the blockchain is public yeah if it's a public blockchain you know the whole world sees it but even if it's not a public blockchain you know the the

participants in the network see all the data on the blockchain often that means that businesses cannot use it right so you cannot you cannot have your private confidential business data stored in a public blockchain the typical example I like to give is if you know Ford wants to pay their tire suppliers using a cryptocurrency and how much they pay is written on the blockchain that is that just means that Ford can't use it because anyone who they pay could then see what else they've paid in general they're gonna be paying in the future to other suppliers or to other or in fact all of Ford's competitors will see exactly I'm just picking a Ford van we'll see exactly how much Ford is

paying for their tires right which is not something that people want to make public but at the same time this transparency this is a topic by the way that I find super fascinating this balance of transparency and privacy but transparency is a good thing as well like the fact that you can see this ledger is actually the benefit of a blockchain I'm so happy you said that I'm so happy you said that so the properties of a ledger is a you have public verifiability and transparency right public verifiably everybody can tell all the transactions are correct at the same time public variability and transparency make it so that businesses simply can't use it the other example is if a business wants to pay its employer employees in a in a cryptocurrency their salaries would all be of public to the world which is not workable and even

like what they do after with those exact ins there's somehow betrayed by the way I was always thinking there's a kind of an interesting sci-fi novel to write which is how would a society function if literally all transactions were public to the whole world what would happen and I guarantee you the first thing that society will do is it will create human mixed Nets right so if you want to buy potatoes and I want to buy Tomatoes will kind of I'll buy your tomatoes and you'll buy your now you'll buy my potatoes what kind of mix mix the coins are ourselves yeah because humans just fundamentally don't there's a there's kind of a need for for privacy in you know in our financial transaction I almost feel like with the advent of social media there was this moment where it was almost like an experiment or a

belief that actually we don't need privacy anymore all of a sudden people felt I can share everything with everyone and I feel that now we're seeing the repercussions of that and basically things that previous generations learned also firsthand this generation is now learning oh wait sharing everything there are problems with that there are on you know unforeseen consequences of having all of your information out there very interesting actually I think it's an interesting thought experiment I would really encourage your your listeners just think what would a society how would you function in a society where literally all transactions are public yeah it's it's an interesting thought experiment but anyhow so there's this so there's this conflict yeah right so

there's a confident need for transparency and verifiability in the one hand it is a need for privacy on the other hand this is this type of conflict is exactly the conflict the type of conflict that cryptography can help resolve yeah and the tool to do it is your knowledge and snarks yeah and this is why it's such an important tool so what it allows you to do is effectively people can post commitments to the blockchain rather than posting the data in the clear and then if they want to prove that transactions are valid they just attach as your knowledge proof to say yes this transaction is valid and anyone can check the zero knowledge proof convinced themselves that the committed data actually corresponds to a valid transaction without learning what the committed data is yeah in the same thing for transparency you know if you

want to prove that you know you followed certain rules you can just attach a zero knowledge proof to your not just to your all your transactions and by the way this is not just payment transactions this could apply to adaps as well you can just prove that you're following the protocol and do that all in zero knowledge so snarks I believe there are such an important tool because they help resolve this fundamental conflict and blockchains they help us move from a totally public blockchain to a private blockchain while preserving all the properties of transparency invariant public verifiability so definitely zero knowledge bruce can provide privacy for transactions but it goes much beyond that in that they can provide also privacy for adapts right so that whenever you post data to adapt you don't have to actually reveal what the

data is you can post commitments and just prove that the DAP you know processed that commit that data correctly so there's a there's a lot of potential it's not just about privacy it's about I would say it more generally it's about resolving the conflict between public verifiability and privacy that's what that's what they do so that's one thing that's so that's that's a huge huge deal on its own and that's why I think snark shots are important but snarks actually let you go those are by the way is DK snarks the ones that are zero-knowledge snarks by themselves don't have to be zero knowledge and the other so that's that's the other aspect that they that they provide which is scalability right so there are beautiful projects like roll-up and I guess you already covered coda in a previous session totally but I don't know if you

talk about roll-up in a previous session well just recently we had an episode with George's Tarun and James Prestwich and there we talked we touched on roll-ups but I'd actually like to do an episode just outlining the different kinds of roll-up yeah we've already we've also talked to the matter labs who's doing a version of rolling yeah right right yeah yeah we're working with them too yeah soso roll-up is maybe I could just summarize it quickly so roll-up is a way to scale up the blockchain where instead of sending transactions to directly to the blockchain you send transactions to the roll-up server the role observer aggregates thousands of transactions verifies that they're all correct and then posts that up to the blockchain and I guess you mentioned there are now multiple types of roll-up services so

there's optimistic roll-up where where security is enforced by staking and then there's a zero-knowledge role that's actually not to zero nazhde snark roll-up where security is maintained by crypto so I want to focus on the snort version of roll-up yeah so there the idea is that these thousands of transactions are submitted to the roll-up server the roll-up server will verify all the signatures will verify that the transactions are valid relative to current account balances and then just post a prove short proof that those transactions are all valid and all the contract on the blockchain needs to do is is verify there's one simple short proof and you verify thousands of transactions at once yeah so this is pretty cool this is really really cool

very beautiful application of of snarks it actually takes us into one something that we've been working on so right now they are limited to because of the time to produce these proofs they are somewhat limited in the number of transactions that you can handle per block so one of the things that that we're working on this is with two of my students riad Wahby and alex ausdom here they are we are working on basically improving the the proof generation time so that we can dramatically scale up the number of transactions per block yes and we can we can get and already the our system shows that you can go up an order of magnitude beyond what's available today yeah so same proof generation time just handling you know an order of

magnitude more transactions per block so yeah that's it again this is like an amazing application of snarks in that you can have outsourced the job of verifying transactions away from the expensive blockchain into an offline service and the service can then prove to the blockchain that things were done correctly a thing that really scares me about zero knowledge actually is going back to what you were talking about before with crypto is supposed to be boring it's not supposed to be exciting and we're talking about snarks which have been around for a while and you know kind of bad I'll test it on Z cash and other things but then like this year we've had Sonics and then we had halo and then now we have SuperSonics and

it's just like project after project and it's moving so quickly how do you actually ensure that that these things are correct that they're reviewed battle-tested that you know it's actually ready for adoption into a critical system you know so the state of snarks today is not exactly where we want to be yeah so there are like five or six different directions for building snarks maybe just to mention them there's like NPC in the head there's like g'kar like systems there's the GG PR methods starix bulletproof stairs like different I kind of think of them as like different trains for building for

building snarks yeah and each one follows a very different technique and the problem that we're having is II one is good in its own way yeah so just to give an example bulletproof for example gives the shortest proofs without trusted setup you know the GPR methods give the shortest proofs with trusted setup right so if you don't like trusted setup you have to use bulletproof so if you if you ok with process setup you can use the GPR methods or growth 16 methods and so like every and the same is true for for the other methods right some of them have better approver time some of them have better verifier time so like every

method kind of shines in its own dimension what we would love to have yeah and I hope we'll get there what we would love to have is like you know one snark to rule them all yeah just like in Lord of the Rings yeah we'd love to have one snark that's like better that's like best in all dimensions that's the one snark that we would teach that's the one snark think we would implement and that's the one snark that we would all use and make sure the implement implementation is robust we're not there yet yeah different snarks are good in different dimensions and so I hope you know this is an open problem I hope your listeners can help us solve this and so today basically it's a very very exciting area of research right so like every week there's like new ideas no

results as you mentioned I mean even my students put out supersonic just last week actually this week I think that's it they're posting the paper so very very very exciting area I think if we wait just a few years you know we I think we will get to this one snark to rule them all and then that's the one we will we will focus on right now the one that's being that's being most widely deployed are the gross gross 16 methods right so this is in the bellmen library in the circum and so on which by the way in our course we're also going to be doing like a hands-on bellman project so our students are gonna have to learn how to write our 1cs code so they can actually implement snarks themselves for bellman so if

people are looking for projects to do just go to our website and do the project yourself and you can learn how to write our 1cs code yourself and so right so right now those are the kind of the that implementation you know of grouse sixteen like methods that's kind of the the as he said battle-tested implementation that's what many of the projects actually use but in the long run you know things could be could be a little different right now it's an active area of research and by the way that happens like all the time I mean that happens in a in a fast-moving field you know there are new ideas coming up and it takes a while for the implementers and developers to actually go ahead and and write battle-tested implementations this it's just early you

know is this early in the development of this applied field even though I have to say one of the fascinating things is your knowledge is not a new concept did you learn all the dates back to the to the to the 80s right it's just for many years it was considered this theoretical application there hasn't been like it was a little bit of a struggle to kind of find a real-world application for zero knowledge and then blockchain is kind of burst on the scene and they're like the perfect application perfect right it's just a perfect match and because it's such a perfect match all of a sudden everybody's interested in kind of building the best one and making it work in practice in the minute you haven't have a real-world application that's where kind of the wreath at sky now where all these beautiful ideas and

people's focus comes up and that's why we're seeing so much development now but it's a lot of fun I mean that's kind of what makes this exciting right what would you what would you say though to a team because I've actually met a few like blockchain company teams who are looking to influence your knowledge proofs but they don't know where to start they're kind of like exactly what you're saying with this boom of new new concepts coming out they don't know which one to kind of latch on to so would you give them the advice to wait no no no no no you don't want to hold up progress just to wait for for you know the community to did you know define the define the best snark what let's see so first of all I should say come talk to us you know we're happy to help

we talk to a lot of projects and in fact a lot of our research is based on problems that projects posed to us that's one that's one option the other option is course hire people who can help assess which which zero knowledge method is best for you for your particular project and if it's you know if you're kind of a black box user of of snarks well there are already fairly good implementations that you know they do require trusted setup that do require you know prove ur time is not it's not ideal and so on but there are implementations like bellman and such that's that a lot of projects actually use so the implementations are

getting more robust but they're a little bit they're falling behind behind the latest developments in the theory of snarks yeah so there's gonna be a little bit of catch-up to do but you know the the other interesting thing is you could try to use whatever is available today as in your project and then if if a new snark gets developed later essentially you can swap it in if you know you're ok with a hard fork to swap it in but that's that's always another option is there any fear I mean in this in these new constructions that have come out is there ever a fear that like there isn't enough peer review that there isn't there's so few people that actually know

how to gauge this stuff that proper peer review isn't necessarily happening and some narratives or some ideas might be taking hold which are not completely correct you know the truth of the matter is these are complex systems to implement right and so whenever you're dealing with a complex system you know that there will be issues down the road yeah and so it's it's quite possible that your project might use a snark implementation today and later on and will turn out that that there were bugs in the implementation and the snark is not as sound as you would hope or maybe he's not as private as you would hope in fact we know that this has already happened a couple of times in the real

world and so the best thing to do is just design your project project to prepare for that right so write a snark has to to security properties right soundness and prep and zero knowledge right so resolves of the privacy property and your implementation could end up breaking either one and in fact we've seen examples in the real world where in okay soundness was broken in the other case zero knowledge was broken yeah and so the only thing the only advice I can give there is well you know these are complex systems and when you design your project you should just design in a process to handle those kind of bugs so if there's a soundness soundness but a soundness vulnerability is the is the

more dangerous one because soundness could actually lead to money being lost or money being created so that's actually quite quite a dangerous effect and so you need to prepare for a hard fork to recover from those kind of kind of soundness bugs as your knowledge bug is mostly affecting people's privacy which of course can be equally devastating and there what can I say I mean you just need to just your project needs to be prepared to handle those kind of those kind of issues but I can't it's not exactly the snarks are not the ones that should be taking the the brunt of the of the heat here in that you know consensus is also extremely complicated to implement correctly in the real world if they have consensus bugs you also

have issues with money being lost or created and many projects are prepared to deal with consensus bugs by hard forking and fixing them so I don't think it's it's fair to say that snarks are especially vulnerable I think this whole ecosystem of blockchains it's just a complicated complex system and whenever you have complex systems you have to be prepared for you know major vulnerabilities that you have to address going back to that question of but like specifically of peer review though is that I mean it throughout all of those systems how like how does it work right now is it just sort of the traditional academic peer review on some of the academic papers and the reason I'm asking is because there's so much work also coming out of Industry it's not necessarily vetted in the same way I

guess I wonder what you think of that yeah this is it's it's I know it's a it's a bit of a because it's a young area it's a it's a bit of a problematic topic to end question to answer in that in the traditional computer security world you know there are companies whose whole business model is just to help other companies assess the security of their software right so there are lots of companies we will do security reviews for you in the world of I'll change some of these computer security review companies have also morphed into doing blockchain reviews so they will review your soluti code and review your consensus protocol in the area of snarks it's much harder for them to find people to do reviews because

it's such a specialized area and there are not that many people who are versed in it it's interesting because here the way that that we're talking about peer review is like the audits basically it's it's the company is auditing rather than sort of that academic say I'm not in academia but like the way I've understood peer review where you'd actually send papers out to other academics who would basically say yes this follows you know what it needs to in order to be considered acceptable research without that we are more dependent I guess on these auditors and firms the security firms well I mean there are two types of audits right obviously when a new snark system is developed there is a peer review to make sure that the system itself is correct

and robust that the proofs are or hold otherwise the pub snark would not be published so that's like a peer review of the paper but there's a separate audit which is once the system gets implemented you want to audit the code that actually implemented that system that she implements that system and then that is something that is much harder to do I'll tell you the reason academics and PhD students don't like to do that as much is it's harder to write papers about that right so you know publish or perish I mean students have to write their PhD dissertations if they can't if what they do doesn't lead to a publication it's not there it's not worth their time to do and so I think it's and so security reviews of of

crypto code is not something that we should rely on PhD students to do because that's not what they're here for it really should be these professional auditors that do and they they honestly they just need to build up the expertise to do it so we've covered a lot throughout this episode on education now we've been talking a little bit about peer review and it's your knowledge space and where's your know-how is your knowledge fits into sort of the general cryptography space but I want like Dan you've been involved in so many blockchain projects and what I'd love to hear about are any kind of blocking projects zero-knowledge projects that you're excited about right now absolutely yeah I'd love to first I should say I'm full-time at Stanford so

what we do the way we work is projects come to us with interesting research questions and then you know we help solve those those questions so that's how I love to work and in fact many of our many of the papers that we writes are motivated and driven by fascinating questions that the project's come and ask us and I have to say this is why I love the blockchain space so much because there are the questions that it raises that the project's raise our questions and have never been asked before and so for us it's wonderful wonderful to work on them so since we've talked about zero knowledge maybe I can talk a little bit about projects that we're doing that are related to zero knowledge and then we can kind of veer off to other other directions sounds good yeah so one one project I wanted to

mention that we did recently is a system called prio this is a system for privately collecting telemetry data so it's it has applications and blockchains but the mean but it's about the main applications is a bit outside and so let me explain what that means actually yeah what is telemetry oh you can start there sorry I'll explain so you know in the past when when a factory made a product like a car or a cell phone or a toothbrush or something you know it would roll off the factory floor and then the manufacturer would never ever hear back from the product right so Ford makes a car they would normally never hear back from the car that has changed right today all products are connected and as a result

they constantly can send data back to the manufacturer so cars constantly now connect back to four to the manufacturer and send data back you know cell phones obviously connect back to the manufacturer when you run a browser it connects back to the browser vendor and sends telemetry data back telemetry means basically how is the product being used okay even your toothbrush right if you buy an IOT toothbrush that's gonna send data back to the manufacturer and the reason the manufacturer wants to collect all this data is so they can make the product better right so for them it's actually a treasure trove of data that they can use so you can see again there's this problem here that manufacturers want to collect data on how customers use their products so they can make it better but at the same time there's

obviously privacy problems here right if I if my car is sends data back all of a sudden the manufacturer knows where I am at any any given time and how I how exactly I'll use my car same thing with cell phones same thing with browsers I don't want my browser reporting which websites I go to the browser event vendor so that's called the telemetry telemetry data what so again there's this conflict right they would like to collect aggregate data of how customers use their product they don't care how you specifically use the product but they want to know how many people drive with their tires under inflated they don't care if you drive with your tires under inflated they just want to know what fraction of the population drives with tire under tires under inflated by the way I think this

is highly relevant in the blockchain space in in the sense that you know when we are building watching clients we want to know how people use those clients how many people run in aetherium node we have no way of finding that out because we have made the decision early on that we are not going to let the client phone home we don't want people's data and so we kind of don't know how people use our software how they run their clients what with what configurations etc so it's really hard to like design a good block chain client because we we don't know how people use them yep so you're you're you're making the case here so you're saying layer four layer four is basically the client facing layer and that actually there's a

there's a need for telemetry there there as well but my point is all they care about is aggregate data you don't care who who you don't care who's using who's running a full node you just can't want to know how many people run a full node and so on and so that's what the prio system does yes so the prio system is basically a way for companies to collect aggregate information without ever ever learning anything about the underlying data other than what's revealed by the aggregates collection does this go back to that point we were talking about before where there's like the transparency in the privacy so like a certain amount of information is delivered through but true privacy is still maintained the way I would say it is exactly like it's exactly right here right on target in that

is a conflict here between utility and privacy and crypto is one way to resolve that that conflict there are other ways by the way there is something called differential privacy there are other techniques but crypto is one way to help resolve that that conflict and so let me in in just a few sentences let me explain how the prio system works and then I should say that this is actually getting deployed yeah so there is like by now there are companies out there who are deploying was deploying prio and I think a lot of your listeners are already listening already using it it's pretty good company by the protocol prio is a protocol as a project that we did here and is available everything we do

by the way is available anyone can use it or take our code run with it so yeah all of this is stuff that's available cool there's an implementation available too okay so so how does it work well effectively what happens is whoever's create collecting the aggregate data needs to run it relies on two non cooperating servers yeah so two or more so effectively let's list a stick with two with an example of two yeah so you have to keep yeah so so the company would have to partner with someone who basically functions as an auditor and is not gonna share information with the company ah yeah so that's a that's a strong assumption to

make but that's what the system needs to scale to to millions of users and then what happens is every every customer like if you're talking about a browser the browser user basically will send encrypted data to the two servers and once you know the millions of customers send their data over to these servers then the aggregate encrypted edik instead of can somehow be combined together so that the aggregate results becomes available in the clear without revealing anything else about the underlying data it's not quite homomorphic encryption it's actually based on a coma morphic encryption would not scale to the to millions of users this has been - let's say the our goal

was to support hundreds of millions of users and as a result we use and theoretical mechanism it's actually based on secret sharing and it can tell you that the prot the difficult problem to solve was well if you're not seeing every individual's contribution how do you know that people are not saying sending you junk data and and ruining the aggregation process by doing it for example if you're trying to count how many people ours are driving with under inflated tires well one person who wants to mess with you can send you can send you instead of saying sending zero or one yes I'm I have under inflated tires or not they can send you like a million or - a million they can send you values that are way out of bounds yeah and so

the connection to zero knowledge is what we had to do here was effectively have people send secret shared data but then provide a zero knowledge proof that the data actually is is within the allowable range for example so if a company wants to collect a bunch of traits like this so that every customer sends encrypted vectors of zeros and ones and then there's an zero knowledge proof that proves yes all the values here you don't know what they are but you can convince yourself that they really are binary either 0 or 1 if they've acted correctly exactly so we had to develop a new zero knowledge mechanism that's specifically designed for proving facts about secret shared data yeah and this the mechanism

is actually something that's underlying many many of the snark instructions so this is something called a linear PCP and I don't know if you covered linear PCP in previous session or really really it's a really really important term now in the in the constants of snarks this is how to understand actually it helps you understand how snarks work and it helps you also understand how the previous system works it's kind of a very very powerful unifying concept so what's a linear PCP it's by the way do to you volley shy and and and his and his collaborators very very powerful concept so let's see if I can explain it in two sentences see that's a challenge for me

so what is it linear PCP a linear PCP is basically a funny type of proof yeah so so I can send you proof a proof is literally just a string of numbers yeah and the only thing you are allowed to do with that proof is you can specify a vector of the same length as the proof I send you and what you get to see then is the inner product of those two vectors the proof vector and the query vector yeah and so the prover submits this this this proof vector the verifier submits a number of clarity X and the verifier then gets to see the inner product of the proof vector and the query vector and then based on the responses the verifier says yes I believe this proof

or no I don't believe this proof and the amazing thing is that the proofs don't need to be very large they're linear and the size of the statement and the verifier doesn't have to issue many queries in fact a constant number of queries is sufficient to verify a proof what is the PCP stands for is the proof no no it's a probabilistically checkable proofs because the queries are probabilistic and this is one of the beautiful applications of probability of randomness that you can verify very complicated statements very efficiently using randomness and what is the linear part of that yeah the linear is the fact that the queries are linear queries so that the response to the query is an inner product of the query vector and the proof vector yeah so that's what that's

why it stands for that's what's a linear PCP what's the opposite of a linear PCP or not opposite but what's it what's the other type of a PCP is what what I would call a point PCP so a point PCP maybe is a more natural one where I can provide a proof to you and then you ask me your the verifier so you ask me opened position number 34 in the proof yeah point number 34 show me what's in position 34 show me what's in position 217 yeah and so those are traditional PCPs which now I would call point PC peas because you're opening points so for example Starks are based on point are based on point PC peas and that's actually my question because like in I know that there's a part of stark construction where you actually take a

sampling that's right yeah that's right so the whole that's right so the whole Fri method that's all based on on looking at particular points inside of the but if you step back it turns out a lot of these point pcps are themselves based on linear PCPs so yeah so linear PCP is actually really quite a powerful concept right so in a PCP the verifier is random is random it's very important that the verifier be random and let me give you a quick example of the power of randomness so the typical example would be if I give you a polynomial of degree ten in a black box and the only thing you're allowed to do is evaluate the polynomial at points of your choice your job is tell me if this polynomial is identically 0 or not yeah that's the

only thing you're trying to do it turns out you can query the polynomial at many points but if you do it deterministically it's actually not so easy to to determine if it's a zero polynomial or not you would need at least 10 queries with randomness it's quite easy all you do is you choose one random point and you ask whether the polynomial in the black box is is whether the result is 0 or not at the random point because you know that a poem of degree 10 has at most 10 zeros the probability that you hit one of those zeros is very small it's 10 over the size of your field and so if the answer is nonzero you're guaranteed the polynomial is not the zero point omiyo if you're zero you'll make a mistake

with relatively small probability but it's interesting there even in that example because like there is a chance you do hit one of the 10 for sure yeah yeah yeah so so absolutely this is why there's always a soundness error but if we can drive this is called the soundness error where you make you make the wrong determination but if the but effectively we can drive the soundness error to be as small as we want by making the field sufficiently big yeah and so you'll see in a lot of these constructions there's always a trade-off between soundness and the size of the field and actually on the topic of randomness we had Justin Drake from the theorem foundation on the podcast like six months ago or so and he actually talked about the importance of

randomness and how this could be used if any of our listeners are interested in this topic in particular I'm gonna put the link in the show notes great and I should say by the way that even though now we've made the argument for for randomness it turns out in many situations we can actually remove the randomness using a heuristic called the Fiat ramier here a stick which then lets you basically generates the randomness using a hash function which makes the protocol non interactive so even though randomness is crucial when you come to actually implement these things often we can we can simulate the randomness using at using a hash function nice do you have any other examples of projects kind of in the zero knowledge field that you're excited about right now or working on right now yeah we have a couple also in the

blockchain space but let me give you one that I'm that I'm kind of excited about that's that's relevant to block chains although as applicable more widely so this is a system called true to F so here we were quite worried about supply chain attacks so what happens you I'm sure you've heard of this board that ended up in Apple and Amazon that turned out to have an extra rice grain chip of rice grain processor on it that actually opened up a back door and so that's an example of a supply chain attack now whether so yeah so you buy a machine it comes to you from somewhere in the world and it turns out it's got extra hardware that opens up actually a back door on

your system I guess that the application here to block chains is you know if you buy any of these you know ledger or treasure any of these any of these wallet Hardware you know how do you know that the wallet hard were actually implements implements what it's supposed to implement maybe somebody put some other chip inside of the hardware device that opens it up to a back door this is like supply chain like a like a factory exact where it's not even the manufacturer themselves but that someone malicious had access to their supply chain yeah exactly so you buy a part from someone how do you know that that part doesn't have extra chips in it that opens you up to opens a back door on your system right so we were particularly worried about this for for

these second factor authentication tokens so you know what's what are called u2f tokens universal second factor and so traditionally I'm sure you're familiar with u2f tokens I'm sure a lot of you listeners you use u2f tokens right so these are like devices like the Google Titan ship and Yubikey and so on and so and so so forth everyone uses a UV key I'm not sure how many actually does but yeah I hope everybody it's a wonderful wonderful product yes by the way you Biko are right down the street here and I work with them too so it's a it's a really fun company so the the question is what happens if you know one of the second factor comes to you and it's got a back

it's got something that's gonna leak your credential to the outside world when you use it maybe I can step back a second and I can say that these u2f factors traditionally what they're designed to defend against is a situation where your laptop is infected with malware but you but the second factor device is secure right and then the malware can't get the credential because the credential is stored in a second factor now we're saying well fine this is a great security model now maybe we can enhance it a bit why don't you why don't we also consider the opposite situation where your second factor device actually is infected because of the supply chain attacks but your laptop is secure yeah so maybe the laptop can somehow verify that everything that the UTF device does

is according to the protocol yeah and so if you try if the u2f device tries to leak your credential somehow it'll get blocked because the the fact the laptop is going to prevent that from happening so we have these two security models right either your laptop is infected and the UTF token is legit or vice versa of course if both your UTF token is compromised and your laptop is compromised yes I'm good yeah we don't have trust so then there's nothing much we can do for you gotcha so true 2f is a system that kind of enhances the traditional u2f model and so how does this connect as your knowledge well so the interesting thing is your laptop doesn't contain any secrets what it does effectively is every time the u2f device produces a

signature say so you're trying to login there's an EC DAC signature that's been generated by the by the u2f token that's used for for logging you in every time it does that it's gonna provide a zero knowledge proof that actually it produced that signature correctly so in a test to the validity validity exactly so the concern is specifically and it's a signature in principle could leak your secret key if you were malicious and you won you had the secret key and you wanted to leak it to the outside world you can produce an ECDSA ECDSA signature that actually leaks the secret key right there is randomness in the ECDSA signature that randomness could be used to leak information about your secret key yeah so what the laptop will

do then is it will make sure that that the signature produced by the u2f token actually is not doing that and how you do it there's a whole protocol that goes into it so it's contributing to the randomness that the u2f token is using and then there's a zero knowledge proof to say yes I actually used the randomness you gave me and therefore the signature is properly random it does not it does not leak you secret heat yeah so I want to encourage people to just think about the supply chain attacks you know whether the event that we heard about last year happened or not and you can link maybe to that event on the on the website whether that event actually happened or not I think the message to remember is that events that can happen that type of supply chain attack is real

and even if it didn't happen next year it'll happen it's or if it even if it didn't happen last year it will happen next year so so I'd like to encourage your listeners to think about the supply chain attacks and and the point that I'd like to make is that using using zero knowledge like techniques at least in certain cases we can help to make sure that whatever hardware you're running it can prove that it's doing things correctly so even if the hardware itself isn't it has been compromised it cannot that compromise cannot be used to leak secrets from the hardware cool so that's some of the work that you've done I know there's like a whole host of other work both from you and from your group of

students and everyone so we can't really cover everything but what I'm curious about as well is what are some of the like you're talking about solved problems now what are the unsolved problems what are you looking forward to work on in the future oh my god there are many what a wonderful question ok so one of the problems that's been driving me crazy over the last couple of years that I would be so happy if somebody solves so please I hope one your listeners solve this is this long-standing problem of constructing what are called multi linear maps so let me explain I imagine your listeners have heard of bilinear maps by linear maps or the technology that's underlying BLS

signatures it's a technology that's underlying many of the recent snarks growth 1616 and so on so by linear maps are effectively maps that take two inputs and they're linear in each one of the inputs it turns out we can do a lot more if we had what's called a cryptographic multi linear map so a multi linear map is a map that takes multiple inputs and it's linear in each one of those one of those inputs so what are these things good for well one of the one of the exciting applications for them is they very easily solve the long-standing problem called non-interactive key exchange not interactive group key exchange so what's

the problem there so imagine we have a million users every user posts their public key to some public forum say they post on a Facebook or something and now a subgroup of a thousand of them want to create a group key so they can communicate securely with one another yeah so this is what's called the group key exchange question and we'd like to do that not interactively so every user all they have to do is they have to download the 999 public keys from the remain from the other users plus their own secret key and that lets them generate a group key and all that thousand members of the group do this and they all end up with the same group key an eavesdropper all he sees is just

a thousand public keys and as a result he can't figure out the group overall the the group key um yeah so this has been an open problem for a long time the deep the famous diffie-hellman protocol lets us solve it for two parties there's a famous protocol due to antoine jew that lets us solve it for three parties in beyond three basically we have theoretical solutions but no practical solutions yeah and so multivariate maps would give you a complete solution to this problem right away and I'll just say this is this is quite relevant today because there's now a whole working group called the messaging layer security working group MLS trying to standardize group key exchange and this is all relevant because of various chat

applications they all support group key exchange you know it's a signal and messenger and so on and so forth they all support group chats and so a group key exchange will let them very easily build group chats that are that are secure today they have to go through a much more complicated protocol to generate a group key so we can do it and they will do it and actually the MLS working group is standardizing systems for group key exchange based on to party key exchange so they can generalize from two party to end party these multi linear maps will give a very clean solution so this is actually a good time to solve this problem and by the way I have to say there are other killer applications from ultra linear Maps one of them is what's called code obfuscation and maybe we can talk about

quite office Kishin when we talk about future things that crypto can do for us but we already know that multi linear Maps imply code obfuscation and if we had good multi linear maps we could actually have decent code obfuscation schemes so that's that's a exciting area so hopefully one of your listeners is interested and can actually come up with a great solution that would be so happy maybe I can mention one more problem please yeah so so this is also a problem that's been on my mind for quite some time and I would like love to see a clean solution so this is actually a really basic problem that in some sense the crypto community has been failing the blockchain community yeah so the problem is what I would call short post

quantum signatures yes so we have pre quantum we have good signatures Shanor signatures BLS signatures and such that have a short public key 32 bytes and a short signature 48 or 64 bytes and so on what we'd like to have is a signature scheme that remains secure even if the adversary has a quantum computer a post quantum signature well today if you look at the submissions to the NIST competition these submissions basically either have much much longer signatures or much longer signatures plus public key links we'd like both the public key and to be short yeah and of course we'd like it all to be based on assumptions that

we all known trust and believe in we we have faith that there really are post quantum secure so this is a problem that I've been kind of bothered with for a long time can we actually have can we construct short these short post quantum signatures I was hoping we've been working quite hard on trying to get them from these schemes called AI sahjhan ii based crypto systems so i sadja knees are kind of a interesting way to build post quantum security but somehow everything we try we're also able to break so we're not quite there yet but you know it's again it's a wonderful wonderful question and hope some of your listeners would be interested in well we'll try to work on it if you have ideas you know

please send please send them we'd love to collaborate the whole area of isogen ease is something i want to do an episode on in the future because there's so much talk like VD FS have been a hot topic for a while as well and there's these new I saw Jeannine CDF's and yeah there's a bunch of interesting stuff there and it's a feel that I know very little about yeah the nice thing about AI sahjhan ease is that if you understand how de Hellman works you can actually at a high level you can understand how I saw G's work quite quite easily yeah so I would love to launch into my into my description of how I sergeant's work but I'm not sure in the time we'd have to do we'd be here until the evening usually if we do that maybe that will require a new episode I

want to ask you about this post quantum stuff so this has been brought up a number of times is this something that you think the cryptography community is very focused on right now are they focused enough on the post quantum idea yeah quantum computers are going to come along and potentially break a lot of the standard cryptography mm-hmm yeah you know the way I'd answer this question is the first question to ask is why would anyone develop quantum computers right so so the answer people give is oh yeah we can break RSA we can break the screen lock we can break diffie-hellman that's not a reason to develop quantum computers right the reason that's not the reason to develop quantum computers is we have good post quantum crypto today right we have lattice based crypto we have I saw any base crypto it's all getting standardized by NIST

so by the time somebody actually builds a large of quantum computer to break these schemes we will moved on we have a ways to recover and so that's not a reason to build a quantum computer if there's no business reason to build a quantum computer they will never be built that's just a fact of nature law of nature so the first question you have to ask is why is it that why would anyone build a quantum computer there have to be other applications outside of breaking crypto systems and the answer is that these quantum computers are actually well not surprisingly they're good at simulating physics and the place where we need to simulate physics is when we do computational chemistry so when you do drug design yeah when you do I guess people always give these these

fertilizers where you try to actually design molecules with certain properties today if I give you a complicated molecule and I ask you tell me what its ground states are analytically it's actually quite difficult to do and often people have to go and build a molecule and then do crystallography to actually figure out what what its structure is it'd be much nicer if we can do it all in a computer and you need quantum computers post quantum computers in order to do that you call them post quantum comic wanna confuse this post quantum interfere in this quantum computer so you would need quantum computers in order to do that so so many of the this is called the the term for this is called an misc this is what's called a noisy intermediate scale

quantum computer misc and the killer application for disks is basically computational chemistry right so that's the kind of the short-term application that we're working foot towards now these Mis Kaplan's they typically require only a couple of hundred hundreds of qubits or maybe thousands of qubits to break crypto we need tens of millions of qubits yeah so we're very very very far away from that and by the way it's not just the number of qubits that we need it's also the decoherence time yeah so today if you look at the quantum computers that are being built today you know by IBM by Google by Righetti those quantum computers today can only basically they can maintain coherence so that for a relatively short

amount of time so you can do very very shallow computations right so you can you kind of have to be your computation within a thousand steps and then the competition dies there's too much noise so you can do you can evaluate a wide circuit but it has to be very shallow so that it's fast to evaluate whereas breaking crypto well those algorithms are necessarily sequential so they take quite a while to run so it'll take the algorithm the computer actually a couple of hours to run to break the crypto so we're not there we're far from there a-and the number of qubits and being the decoherence time now the interesting thing is that there are improvements right so the number of qubits keeps in keeps growing the decoherence time keeps increasing and so let's just pretend

let's assume things will progress at the rate of Moore's law it's not that's a big assumption we don't know if that's true or not but let's assume things progress at the rate of Moore's law well you will need to get to around 100 million qubits to run these these factoring and discrete log algorithms so if he computes log of 100 million base on 1.8 month right Moore's law says doubling every 1.8 months you get about 30 years yeah so we're thirty years away if Moore's law applies we're about thirty years away from having a computer that's large enough to actually break a crypto system yeah so that's kind of the time horizon it sounds like it's worth keeping an eye on but it's still a ways off so a lot of this pre quantum cryptography is still very very

relevant yes so in fact a lot of pre quantum cryptography is gonna be very relevant for a long time to come we're probably gonna have good indication when it's when we need to move away from from the pre quantum crypto at the same time I have to say that crypto community is very hard at work on building post quantum systems so that we are ready this is what academia is supposed to be working on right we're not supposed to be working on things that are needed next year we need to be working on things that are also needed 50 to 100 years from now so there's a massive effort in building post quantum crypto systems we are pretty much we're very well prepared for it so yeah so block teams are safe no worries effectively for now it's okay to use pre quantum

crypto very cool in the same line I'm really curious to hear your vision of the future of crypto we already touched a little bit on various topics here but you know where do you see things going given your decades of experience you know these are things moving faster slower is it more exciting or less exciting or what's going on what will happen in the future yeah that's a great question I have to say there's never never a dull moment in crypto it's like over every couple of years it seems like all the important questions have been solved and then like a whole new area gets invented so there's never ever a dull moment maybe if I if I have to answer you if I

need to answer your question I would kind of answer it like like this I would say you know over the past decade we've kind of seen tools that were considered theoretical tools like zero knowledge and MPC we've seen them kind of move into practice and actually get deployed in real systems which is so much fun to see you know for a cryptographer this is amazing amazing to see this beautiful ideas that we've been developing for 30 years are now actually being put to you some thrilled that this is this is happening so you asked about the future well I'm hoping that the same thing will happen in the future yeah so there is this very theoretical concept in cryptography today which we touched upon called obfuscation so maybe for your

listeners who are not familiar with obfuscation I can say what application is it's a crypto mechanism that allows you to hide the secret keys in code yeah so I can put a secret key like a secret decryption key a secret signing key in code I can literally give you the software yeah you can run the code and do whatever you want with it yeah I can run the software do whatever you want with that software but you will not be able to get the key out other than the way that the software was intended to run yeah so that's what office Kishin lets you do so why is this relevant to blockchains well you can imagine adapt where I would actually build and build a program that signs a certain message

only if certain conditions exist yeah and then today if I upload that program to the cloud to the blockchain everybody can look at the program and say oh that's a signing key I'm just gonna extract a signing key and sign things when they're not supposed to be signed but if the program is obfuscated really the only thing you can do is run the program and it will only sign things for you if the appropriate preconditions are satisfied yeah today if we wanted to do that we effectively have to use secure hardware like SGX or other or other hardware enclaves but office keishon basically lets you do things that today requires secure enclaves just using crypto so what's the problem the problem is even though obfuscation software office keishon

solves almost all open problems in crypto it's like it's amazing yeah it's literally if we had practical obfuscation it's like almost everything you want can be done yeah it's it's remarkable yeah but it's not there yet it's far we know so that's right so today we have candidate obfuscation schemes they're polynomial time but this is a terrible plan it's a terrible polynomial so they're so inefficient that we can't really build real anything that's even resembling something that's that's that's real world yet so my hope is just like you know ten twenty years ago everybody was saying go zero-knowledge npc it's all theoretical and I'll get deployed too slow too inefficient one could hope that over the

next decade or two or three or four you know obfuscation will get better and better and better until the point where it can actually be deployed and again the amazing thing is everything that we can do or you know simple things that we need Hardware enclaves for today can then be done without relying on a hardware in clave but instead relying on crypto well right so we will remove single points of trust and you know instead of security it's always better to base it on math than to base it on other assumptions so yeah so that's kind of I'm hoping that's one area where you know things will will move in the future and then you know in the world of post quantum security there's still a lot to

do yeah they're like I said the short signatures is an issue you know better snarks for the post quantum world obviously Starks are our post quantum but you know like I said there are many different directions to building snarks and not all of them are post quantum and then even in the world of quantum there is actually a sequence of papers that we wrote a while ago and something we would call post post Kuan so so post post Kwanzaa bit of a funny name but what it is is is the settings where not only is the ad not only does the adversary have a quantum computer but actually the end users also have a quantum computer so imagine my laptop is a quantum machine we are very far away

from that right today quantum computers are huge right they have these fridges that have to cool things down to absolute zero long ways off until this is actually running on my laptop but you know maybe our great great great grandkids will have quantum computers on their laptops and then this opens up like a whole new directions for attacks because today if I want to attack a signature scheme for example the security for a signature scheme says I get to submit a message of my choice and you give me a signature on that message and we'd like to make sure that the signature is secure under those settings but if my laptop is quantum I get to submit like if you like like a bag of messages and you give me back a bag of signatures it gives the attacker more

power and as a result the question is how do we design crypto systems that are secure when the attacker can interact with the participants over a quantum Channel yeah so even that's our things that that we're considering and like I said there's a lot more to do to do in that space as well so the quantum world is like you know it's gonna keep us busy for many many years to come cool all right to wrap it up I won't want to ask a short question that's a little bit more on on your personal feeling because you invented or a part in inventing VLS signatures and they're now being widely adopted by like this let relatively large blockchain

community how does it feel to to like invent something and create something like be less signatures and see such wide adoption of it so honestly I'm happy whenever new crypto mechanisms get deployed so for me it's wonderful to see pairings and BLS signature is being used yeah I love it I'm actually quite happy that pairings are used in other places to snarks minion to snarks use use pairings but for sure I mean I'm thrilled that BLS is is is useful right so BLS signatures are basically based on by lineae maps so I'm thrilled to see more of more applications of about linear maps being used in the real world

I guess the primary reason why BLS signatures are kind of a good match for the world of blockchains is that it's very easy to aggregate BLS signatures once there once they're produced yeah so you can have a million people generates signatures on messages of their choice and then anyone can come in take those million signatures and push you can compress them into a single signature yeah that can then be verified so that one single signature then basically provides a proof that all million signatures were were valid and it's really simple to aggregate all you do is you just multiply all the signatures together that's all it is yeah and so if you have a bunch of signatures in a block all the signatures on a block can come be compressed into a

single signature in the proof of state systems you have to have a lot of the stickers sign and sign the fact that they allow a certain state transition you can take all those signatures and compress them into a single signature so the data that's actually stored in the blockchain is much much much smaller than it is than it was before and yet it still represents all of those signatures somehow exactly so that one aggregate signature convinces the verifier that all the messages that were there were that were signed were actually properly signed so you know I like everything in cryptography it's a it's kind of a tricky tricky situation yeah and that it's it's always more complicated than

it seems yeah if literally you implement if you read the kind of the basic schemes for how to do aggregation you you read that or you just take all the signatures and you multiply them together and that's it that's your that's your aggregate signature well it turns out it's not that simple yeah so that is actually what you do you just multiply them all together but it turns out if you just do it naively you open yourself up to what's called a rogue public he attack yeah so that's a fascinating attack in its own right where where what I can do is I can look at Europe Blackie and I can cook up a public he myself that I wouldn't know what the private key for that public he is yeah so I cook up a new public key and now all of a sudden what I can do is I can

create an aggregate signature on a message of my choice that would look like both you and I sign that message yeah that's the rogue public he attack we're in effect I can create create an aggregate that commits you to a message that you never signed yeah and so well so you have to be careful about rogue public keys and in fact most of the work on be the signature deals with how to defend against public ease and we have multiple methods to defend against that and all is actually is being worked into this standard that that's now emerging to provide secure signature aggregation so the only thing I'm saying the only reason I'm bringing that up is I want

your listeners to understand that aggregation is really simple it can be done securely however you know don't don't do this at home but you know if you're gonna do a signature aggregation follow the standards because if you just do it in the simple naive way it'll not be secure and it's it's ignoring all of those attack exactly cases exactly exactly you have thought of in the construction of things yes exactly exactly so so it's kind of it's a useful mechanism yeah that will compress the amount of stories you need to store large numbers of signatures but you should be using standards so that's one area where people sometimes can make mistakes another area is in the again kind of looking at recent work on BLS is

this question of if you want to sign a message in BLS the first thing you have to do is you have to map the message to a point an elliptic curve and the question is how do you map to a point in an elliptic curve it turns out there's kind of a naive method it's called basically guess and try see you know you hash to around in place and you hope that it's on the elliptic curve but it turns out we can do things more efficiently and so actually we have some recent recent work this is with Riyadh my student riad Wahby where we give a very efficient way to map on to these praying friendly elliptic curves so again this is all getting wrapped up in this in the standard so if you're going to use be other signatures it's

probably at this point a good idea to follow the the standard that's forming don't kind of implement your own library in your own rollout your own implementation follow the techniques in the standard follow the API that's the standard the standard provides and that's probably the best way best way to do it and I have to say the cool thing is that it's really getting quite a bit of traction so Definity chia East 2.0 2.0 all those projects are actually using BLS and so yeah I'm like you said Frederick I'm thrilled that this is actually seeing real use and I hope to see much more crypto get deployed in these projects when is that actually developed when is the PLA like when when was that first proposed oh it's quite old it's uh dates back to I believe 2001

yeah and so it took what was it like ten years twelve years before you got to see it implemented in blockchain or was it already well we implemented it fairly quickly just to experiment with a scheme but the the I guess when did when did blockchain projects kind of start using I think well that's a good question I'm actually not sure I'm just trying to picture like the first one I remember publicly writing or like maybe it's just the first one that was a large project writing about it was Tiffany yeah I think Dom was actually kind of needed it for their threshold relay so what he needed was a signature scheme that's easily supported threshold signatures

and easily supported threshold key generation yeah and so that that was a good match in that it easily supports both those operations cool listen this has been such a fantastic conversation wide-ranging I feel like there's so many pieces of this last two hours that we could go very deep on and do full episodes I want to thank you so much for being on the podcast and for being on our 100th episode it's my pleasure thank you so much for actually running this podcast it's a wonderful service to the community thank you very much I actually I had a piece in the education section that I wanted to ask on what role you think podcasts like these and others play but

I'll leave that for a future conversation as well so thank you thank you very much it's been a pleasure yep thank you guys and to our listeners thanks for listening thanks for listening