ZKPodcast: MPC systems with Nigel Smart

Transcript

[Music] welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik [Music] in this episode we'll sit down with Nigel smart professor in cryptology to talk about multi-party computation [Music] before we start we want to say thank you

to this week's sponsor stark where star crow will be putting together the star core sessions in Tel Aviv on September 16th the event will be bringing together the brightest minds in the field of zero knowledge proof from both the academic and application arenas topics that will be discussed our self custodial trading starts earlier one stark friendly hash functions and other cool things you can do with stark proofs also I will be hosting one of the stages so if you're interested in this exciting cutting-edge tech do join the stark recessions or come a day earlier for the stark 101 workshop where you could build a stark prover from scratch use the code ZK podcast to get 20% off any ticket we have about 50 of these available so get it fast so again Thank You Stark we're for

supporting this podcast and now here's our interview with Nigel smart so we want to sit down today and talk about NPC systems and we have one of the possibly best guests to do so Nigel smart professor cryptology kay you Lovan and the co-founder of unbound tech welcome to the show Nigel how welcome nice to be here and we have Anna with us as usual hello hello so to kick it off Nigel if you can think back to when you first started in this space what is it about cryptography that really got you excited and wanted to to work in this

space okay so originally I trained as a mathematician and and then I realized there really wasn't much money in that and so it was much if you go if you're doing this kind of maths I was doing and you guys I want to make money or I don't want to be poor then what you do is you do you do cryptography which in those days in the mid-90s who is just beginning to be deployed you know everywhere cuz the internet had just started etc I know a lot of people who got into cryptography through like the military so either through in Sweden we had like this thing you go through for a year and a half or something and they get into through that did you ever have that exposure to like the military

side of it not really of course when you turn up all the international conferences there are various people from various government agencies there some with three-letter and acronyms and some with for some with five depending on the country and they always try and pretend they're not there but they are and so you kind of you kind of get to see these people so I have a question about what you're working on right now because you're a professor of cryptology not cryptography yeah what is the difference between those two things okay so cryptology is the science of making and breaking ciphers so cryptography is the science of making ciphers and cryptanalysis is the science

of breaking them and if you do both you do cryptology so the International Association which represents all the cryptographers in the world it is called the international social Association of Cryptologic research even though everyone in it is a cryptographer so I think you're one of the first maybe not the first guess but you're one of the few guests that we've had on that aren't necessarily coming straight out of the blockchain space but my question is have you I mean what is your interaction with the blockchain space because I understand you have done some work we got groups okay so first you've got to understand that blockchain is in crypto currencies

so so there's teeth these two there's two mantras in cryptography is crypto means cryptology crypto means cryptography not cryptocurrency and the other one is blockchain does not mean cryptocurrency [Laughter] okay so blockchains have a lot of applications outside of the cryptocurrency space and also in terms of corporate band a lot of so a lot of block chains that do not necessarily need that inclusive work so you could do so what proof of work gives you in something like Bitcoin is it solves the consensus problem but there are other ways of solving consensus problems if you have a so-called provision block

change so there's a lot of applications around that use a blockchain as but with provision provision services and basically there what you're doing is you're using a block trainers that a what's called a like an append-only database so allows you to do database applications which a slightly simpler than using standard this should be the databases we have issues of locking and unlocking etc yes I've been advised the number of companies in this space in mainly in the financial sector that's interesting have you so you've you've touched a lot of these quote-unquote private blockchains but have you have you touched anything in the public space I mean there's eggsy cash and a lot of these newer fancier things yeah okay so

I haven't touched a complicated crypto so have explicitly worked on on any of the the public blockchain applications like sea cash but I know the people behind them and we all talk to each other and so yes so it's a very very small community who know what was going on particularly easy cash I think I mean we're going to be talking today about MPC and they have a very very famous case of using MPC I think yeah I think in the same community the first you know thing that made people into butchering in a community understand at what MPC was doing was the sea cash opening ceremony which was you know kind of interesting one of application but what

you're actually seeing especially in return to when you go to cryptocurrencies is crypto custodianship is a lot of applications now they're for MPC to do authorization and signing operation which are more efficient and match the application much better than previously citizens a cryptocurrencies good in that it generates lots of interesting unlike normal financial institutions or mobile companies there they are definitely early adopters of high-tech one thing our listeners may be noticing is the way that we're pronouncing MPC yeah and not saying MPC's because as i learned

recently from Nigel that's actually very incorrect to use MPC in plural and pcs doesn't make sense so tell us why that's okay so when you have when you talk about the zero knowledge proof it's a same so you can talk about plural thing so you can talk about zero knowledge proof so you can sort spec you can talk about ZK Peas so that makes sense whereas MPC stands that multi-party computation therefore it's a technology and if you paralyzed it you'll be talking about multi-party computations and therefore you're talking about something that's a processes that's going on rather than a technology so it so if you if you want

to talk about the technology and kura lies it it's like you might have a piece of software that does one version of MPC and another version of software plus MPC they these would be two MPC systems so yeah got it thank you for sharing that with us and for clarifying I know that I think we and others in the space have made this mistake a lot and so this is good to know yeah this is whenever you have initials it's always good to understand what go back to what they actually stand for to decide whether you could PluralEyes it or not can you say fh is well you could talk about FA cheese if you're talking about the ciphertext because they're encryption so if you

take an encryption of X and an encryption of Y then they are encryptions but they are you're actually talking about the specific encryptions of X of Y whereas if you want to talk about fhe as a technology or different types of technology you talk about fhg and although geez like if you're saying NPCs you're talking about the actual computations that are gonna taking place yeah exactly yeah yeah yeah we did an episode on NPC on this podcast before and you know if I'm honest with myself is probably not the best intro ever but it was just it was just you and me it's just myself and Fredrik so this wasn't

like we're putting any guests under the bus here I'm curious to hear from you Nigel what would your like short introductions just explaining what MPC is be ok so imagine you've got two sets of data or three sets of data or four sets of data and you want to compute a function on the joint data without revealing what the data is and you want to do this via a protocol by doing a computation so it's multiple parties multiple pieces of data doing the computation on their joint input with and the only thing you learn is the output so a really good example a practical example that's used is

hospitals hospitals have information on patients and you might want to do some medical statistical experiment so you could do a medical statistical experiment on the joint data of the hospitals without each hospital having to reveal the information about their patients what would that look like on the on the sort of technical front like would that actually be each Hospital like running something on a computer like what would that look like so it looked like each Hospital would have their own separate database and they would have computers that attach the database and the computers would pull data from their own database and then engage in a protocol with the other hospitals and at the end of the protocol out pops the statistical answer you want

and what doesn't pop out to either hospital is the other hospitals data and this is mathematically guaranteed this doesn't pop out so it's you don't you know no matter how much you know the happier you do you're guaranteed that there's no extra information that jumps out does it also I guess it also guarantees that the information that is shared or that like that metric is correct yeah yeah yeah so you also get correct the results so you can't protect against people lying so if one Hospital lies about its data that's all you can do but you can prevent a hospital one of the hospitals doing the wrong calculation so they all agree on the right calculation they have to both do the same

cooperation so in in our introduction episode we covered MPC from the perspective of like solving polynomials like that's our that's our fundamentals that we go into would you say that modern MPC systems are still like fundamentally you know constructing and solving polynomial equations or has a moved way beyond that oh yeah it's not just solving polynomial equations you could do any computation so from the 80s we knew that any any anything you can compute in the clear we can compute securely yeah so if you have any computation you want to do in theory we can do that computation in practice that depends on the technology and what

you want to do but in theory we can compute anything so it's also a really good example that was done in the US government program a few years ago is supply the two soft lights going around the earth and sometimes satellites hit each other and it's really expensive okay so but what you want to do is you want to avoid make sure to have sufficed don't hit each other on the other hand countries aren't really very keen on revealing where their satellite actually is yeah so you can imagine though the fact that the satellites going over a country might not want to know that so you could actually so what we what some people did in that US government program I was involved in is that they actually did an npc calculation where you had one

country knew where a satellite was and what direction it was going in and another one was and you would work out whether the suffix were going to hit each other and whether they should change course without revealing the positions of the satellites so you could do computations which is like Newtonian mechanics other examples could be we were engaged in here we don't know you listeners may not know this but we're actually in three different countries here so this is this is where three to four countries and actually when you do a merging audio you actually have a problem so so if you if you have encrypted communications you actually have to decrypt them to merge the audios for group conversations so

this is actually and we're in it and it's the same US government program we actually had encrypted communications from three voice communications from for three different sites the voice communications were encrypted but then merged where you merge the audio files and then send them back out in real time during the conversation so that's kind of like being able what Skype currently does is you connect to Skype and it will do it will merge the three together by decrypting and having to do the merging on the flight when you do a group conversation because that's actually my card but we wanted to do this in a secure domain those are two really those are amazing examples yeah I've really pretty cool so you can really see that this has Africa so it talks about health care we've talked about military

applications you know we're satellites we can talk about voice applications in the cryptocurrency space you can secure your cryptographic keys to signing by you could take your cryptic rips graphic signing key you can split that up and put those with different servers and then use those need to an MPC calculation to actually do the digital signature so there's the the key is never in one place it's much more secure you could have just one signing key in Berlin ones finding clear in America once part of it in Japan and they never come together has it solves the problem of where do you keep your cold and hot wallet keys wow that's super interest is that is that actually does that exist

that's not like down sounds like a multi fig but I feel like it is because I'm only sick requires the recipient to know it's the mondesi so it looks different yeah and it also multi-sig suppose you have a multi suit which says we're going to take three signatures and combine them then what that actually tells the verifier is that your authorization policy was three people have to agree and you might not actually want that to happen so but what we deal with npc produce what looks to the verifier like a genuine signature looks like a normal normal normal signature and then but from the signers point of view is the it has been composed of

different secret keys with different authorizations so it could be that you allow me on my own to sign the transaction but Ana and Frederic have to get together to sign express them too much okay so they have to come together so we have there we could have what's called an access structure where you have two people have to sign or one person and the similar things have been used not intensive NPC but that kind of access structures use the nuclear command and control yeah launching the missiles you require the president and submarine commander or the vice president the submarine commander and a general or something like that you need a combination so you have these different access structures and you can do that within the signature on a

blockchain in a way that the verified doesn't know what your authorization policy was behind which could be company confidential and then - is this deployed yes unbowed tech producer tech in this space and it's actually deployed in a reasonable number of the very large crypto currency exchanges to secure their cold and hot water keys and it also means that they have they can do greater volumes of turn around and less and less delay for consumers I actually think there's some application we've talked about Bitcoin bridges in the past and like a constraint and Bitcoin is that you can't have multi SIG's above a certain number of parties yet in the

bridge you might actually want a multi sig of like a thousand parties yeah and you can't you can't do that natively on Bitcoin so you would have to do something like this yes exactly exactly so Stockholm would you say I mean our is our MPC systems the focus of your research and have there been the focus of your research or was there something else that you were working on before this oh because this was doing all sorts of stuff I've done so originally I worked on what's called about you would notice I've worked on things called elliptic curve cryptography this was back in like the late 90s early 2000s where we looked at breaking elliptic curve cryptography and stuff and then there was this big boom in the early two thousands of us called tearing based cryptography which has is

used in some blockchain applications so for example I think a big Definity I think as a big user of parent based crypto and some of this applications and then but some key agreement all sorts of other things so various things and then kind of in the mid-2000s there were kind of two things so I would always turn up to MPC talks you know turell's talks there we go because there talks about it anyway so I talked to armed so I was turn up to NPC talks and fall asleep because this was just so boring this was just like this was never going to be

practical MPC have been around since the 1980s it was very very theoretical and no one would ever think you could ever use it and then in the mid 2000s I think it's like 2004 I think it was I went to a Europe ripped which is the main cryptography conference through Europe in Interlaken in Switzerland and it cryptography conferences we have something called a rump recession now a rump session is a an event in one of the evenings where people drink a lot of beer and a lot of wine and people give two-minute talks and they're just give it two minute talks which are either funny and advertisement or they're demonstrating something and one guy got up and he actually in two minutes live

gave a demonstration of MPC working on his laptop now in a two minute presentation where you have to get the presentation on to the stage and actually do actually get it running and working you go then you go like oh oh this isn't theoretical anymore this is real and then the next year there was a year kripp this time in outage in Denmark and at the same thing at the rump session someone got up and said actually we've used MPC to do a real calculator in the real world for real people which is what's called which was the calculator which is now famous in the MPC community as the Danish sugar B auction so you can't mention MPC without

mentioning Danish sugar beet auction and at that point I went ah ha it really is real and then I kind of like shifted and then we started doing I started working with you who the lindelt who's the other co-founder of unbound tech and also working with many Pinker's who's the guy who had given the krump session talk at interlaken and we started actually then sort of building MPC and seeing whether we could turn the theory into practice and to give you an idea we did the first very large scale was called actively secured which is like the gold standard the security computation in 2007 2008 and we calculated a specific function it

doesn't matter what it is we calculate the specification at that point was the first time anyone would have done it it took hours hours and now that same calculation can now be done in milliseconds so in 10 years the performance improvement has just dramatically dropped and that's why it's become so called I sort of want to go back to that beginning an early MPC work that you were doing what was that actually what did that look like okay so for me okay so it will I could talk about the community or for me so it's kind of like different so in the community in the 80s people were just don't pen and paper you know they were doing sort experiments you know what would happen so the first

example is mental poker in some sense how could you play poker by telephone so I've got a bunch I've got a bunch of the cards you've got a bunch of cards with dealt the cards I don't know what your cards are you don't know why I can tell but we want to play poker and not cheat over the telephone by just exchanging cryptographic messages so people just playing mental games like that and they came up with this idea of MP silient and then in the 80s and early 90s people were just playing with the idea what could it see erratically do could you compute anything and it turns out you can you could theoretically compute anything you want securely which is kind of cool and then maybe from the mid 90s to the mid 2000s people were kind of coming up with ways

of doing the computations but they weren't really very practical and the networks weren't very good at the time and computers weren't societics etc and then like in the mid two thousands computers but just about fast enough that you could do something really basic so I think the idea um this is famous example which was came up in the 80s which called the millionaire's problem so imagine you've got two millionaires and they want to work out who's the richest so they want to compute they've both got their inputs the one input one millionaires got the value x1 millionaires got value Y and you want to work out is X bigger than Y or is y bigger than X and that's all you want to compute without revealing X or Y so the

only information so it's got to millionaires Alice and Bob Alice will learn maybe she's the richest a Bob will learn he's the poorest but we won't know by how much so that's what's called the millionaire's problem and what this guy had done in this rap session in Interlaken is run the millionaire's problem on 16-bit integers so it is a number which isn't even a million that's like 65536 yeah so this is comparing two numbers less than sixteen bits and it took two minutes that's what the length of his talk to compare the integers that was kind of that was kind of that's where we were but as soon as you could

do something as soon as you could actually implement something can play with it you would then implement it you go AHA I can make this go faster I can make that go fast as I don't need to do this I can change that I can use this part of the infrastructure I can use the operating system in this way I can used a network in this way as suddenly the improvements come rapidly you know one on top of each other so what you just talked about is sort of this bridge or this this gap between research and engineering and I we've talked to people on the show before about this and it's always fascinating to me what I see is what you said that once there's

something out there to play with that's when you start attracting the engineers and once you have the engineers on board they can go well actually I can speed this up hope that I can do this over here and you start having the hackers actually like improve the technology and then you start working more hand-in-hand and that's when you get the real improvements you know how do you see the role of like engineering and and the programmer is coming in and working with the theorists I think the thing is certainly in this area actually everyone's hand in hand there's still some serious doing theoretical MPC and lived in the world but almost everyone start doing a combination of theory and practice is that because you can't so

you have a new idea to improve some protocol so you have some new weird and wacky idea actually testing it on paper you can't test it on paper because in the real world everything works on you know what's the network latency memory issues bandwidth and these systems are now so complicated they have so many moving parts that you can't really test whether something's real or not or whether it gives you an improvement without actually implementing it so a lot of the theoretical research now is hand-in-hand with engineering research and also the engineering research requires the theoreticians to you know solve problems or you do a piece of engineering and you go oh my god that's

something we never realized and then you pass it back to the theoreticians and they go oh yeah we you know they kind of measure the wrong things and then you suddenly realize that you've got some one thing you're meant to be measuring in the theory world doesn't actually make sense in the practical world and in business and never-ending combination of you know theory to practice practice to theory and so on so maybe 10 years ago in the crypto community that's crypto means cryptography always going to get that it always got to get that French administratively okay in the crypto community we were desert kind of like there's a bit of a bifurcation between the fear attitudes and the practitioners but I think a lot of things over the last you know seven or eight years I've

actually gotten together one of which has been huge explosion in MVC applications and practicality which suddenly the theoreticians are going whoa ice that's useful and the practical people we've got something else to play with and then there was the huge explosion in 30 coming off encryption and and then also we've kind of created community places for people to come together so I founded along with someone else Kenny Paxton this thing called real-world crypto which we run every year in January and it turns from being like seven years ago it was like a tiny event with 100 people is now the biggest cryptography conference in the world you know and we have like 700 people turn up and we have

people from the cryptocurrency space we have people from academia our people from government we have you know the crypto teams of Apple and Facebook and Google and Microsoft turn up we have people from who were interested in public policy last year we had people doing MPC doing a really interesting survey in Boston which is the Boston agenda survey where they got 200 companies to do a statistical survey of of whether there was a difference in pay between male and female in the different companies and so they've got all the companies to put their data into this MPC system to do the statistical analysis so seeing all sorts of you know public policy stuff coming out that's

really bringing people together you just mentioned sort of the fhe idea not to say FHA's here fhe actually the way you've defined the MPC it sounds very very similar to the fhg this idea of this ability to combine things and almost anything yeah in the work that you're doing I mean do you see the work on MPC as as a silo or do you actually see that blending in with a lot of these other concepts they're very very similar it's like they actually are really related okay so okay okay so the thing with the usual use case of FHA is that what has pretended that people say is you encrypt some stuff you send it to the server the server computer on it

without knowing what it is and sends it back to you so you think about it encrypted you encrypt your search term you send it to Google Google gives you your search results but doesn't know what you've searched for or what your results are sends them back and you decrypt okay that doesn't isn't practical but that gives you the idea of what the idea is now but really is like MPC except there's only one person doing the computation the server so it's it's okay FAK is MPC without the end wow this is really which is the really easy way to think about it so it's very very similar however they're not not separate so one of the big breakthroughs we had is is we

have an MPC protocol called speeds which is spelt espied easy for the authors which is smart pedro vanguard of Zacarias so huge thing cryptography you put things in alphabetical order but someone realized it if you reordered our names written these speeds because it was a really fast protocol and that's those are awesome music and is it you know bulletproof it's not yeah your aiming is important diving is really really important we have actually whenever we do something we come up with a really cool name to make sure people remember it's a speeds everyone remembers and this came out in about 2012 and what speed does is actually it uses fhe

to do MPC so it uses F it uses a form of fhe which usually people go that's totally impractical but we use f HT to actually could make things go faster than if we didn't have fhe so we can actually reuse fhe within the MPC calculation as as an accelerant to make it go faster so to dig in a little bit more and get like I want a better practical understanding of how these MPC systems work so maybe we take speeds as an example and like explain how that protocol works ok so guys we got service we got myself we've got I don't got Fredrik and we we have some piece of data

so imagine don't worry about putting data into the system or out of the system just think at the moment of how you actually do come so if we have a variable in a program let's think of the variable called X so what we do with that variables we split it into three and we so we write X as X 1 plus X 2 plus X 3 so Anna gets X 3 Frederick gets X 2 and I get X 1 now if you could remember there untrustworthy if Anna and Frederick get together they're the least trusted right so if it were just X 2 and X 3 they can learn nothing about X it's only the three of us together know something about X ok so in my pieces back when I'm running the program I only hold X 1 Fredrick only

holds X 2 and Anna hauls X 3 now suppose we have another variable call it Y we have y 1 y 2 of Y 3 in the same way now if we want to add the variables together to get Z equals x plus y then all that I have to do is go Zed 1 equals x 1 plus y 1 Frederick goes Z 2 equals x2 plus y2 Ana goes Z 3 equals x 3 plus y 3 and then miraculously Z is actually said 1 plus n2 plus n3 by the magic of maths ok so that turns out well so what that means is what's called linear operations are for free is that you don't have to do anything clever to do linear operations of addition is the linear

operation multiplication by constants and linear operations so the only difficulty seems to be doing nonlinear operations now the simplest nonlinear operation you have is multiplication yes after you do addition at school you do multiplication so for multiplication there's all sorts of complicated ways of doing multiplication and it's very hard to do on the podcast because you need lots of thoughts and stuff but what speeds does is it uses homomorphic encryption to enable you to do the multiplication fast so we just saw instead of using the homomorphic encryption to do an arbitrary computation which is very expensive we'd use the home of encryption just do a very simple operation which is

multiplication and that means that we can make the multiplication go very fast to do the multiplication we have to communicate data so I send some data to Fredrik - Anna Anna Spence invented the Frederick and me and Fredriksson from David Allen me but so this data is transmitted around but this data reveals nothing about the actual underlying secrets but then we can put do some multiplication and it turns out that any computation that you can think of can be written as as as the sequence of pluses and multiplies okay so we just then need a compiler which takes our program turns it into a sequence of pluses and multiplies not quite this is simplifying a bit and then we just rub that and then we've got our secure computation so you

basically use as you described before FA cheese - you know operate on this very small domain where it's really fast and yeah therefore can can speed up the the complicated part of MPC yeah exactly so that's one way of doing MPC there's another way of doing MPC which is undo - Andy yeah which is called which people have heard of which is called Yao circuits or garbled circuits and here what you do is you represent the function as a binary circuit just like it would be able to on a microprocessor on the chip in electronics in silicon and so it turns out there you can represent everything as a bunch of ads and saws and ores and not gates yeah and here what you do is that you actually

produce the lookup table the truth table for the for the op binary operation you actually form an encrypted version of the truth table and they're what you use is use the standard cipher like AES to do the encryption of the truth table and then when you evaluate the computation you are basically decrypting parts of the truth tables and working through the circuit so there's kind of two different ways of doing it there's the secret sharing approach of like of speeds and then there's the encrypted truth table approach of of garbled circuits since you actually been working in the space for like a pretty good amount of time and you've seen this develop I would be really curious to hear what you think of some other may be comparable systems or

systems that have been compared you might not think of them in the same category but for example we actually not too long ago also did an episode on T E's okay teehee yeah can can we say two E's environment is the thing okay so I am very curious to hear what do you think of tees and do you see a relationship between tees and NPC because we we've often heard them lumped together or compared and I wonder what you think it's kind of interesting okay so two years a trusted execution environment so as we see it now it's something like armed trust zone or Intel SGX at if you go back to the very first paper on

floaty humble encryption which was in 1978 okay so this is a long time ago in 1938 the paper of fully homomorphic encryption by it Rivest etc he they had two ideas in this paper the first idea is wouldn't it be good if someone could invent fully homomorphic encryption because then we could compute on data without seeing it and then they said but that looks really hard so why don't we just encrypt the stuff going into the microprocessor and they said well what you could do is you could put a little encryption device as the data goes into the microprocessor so the registers in the microprocessor in the clear but as the data comes out is decrypted missile encrypt is has decrypted going in and encrypted going out and then he went and

they also said but that's also a do stupid idea because actually this is 1970s technology the best cipher they had was bears which was terribly slow he's then hardware and even microprocessors then were faster than the best so they couldn't get the data in quicken up and out so that was to consider the no go so what's kind of interesting is when fhe starts becoming interesting and like 2009 when Craig Gentry came up with the first fhe implementation first fhe idea at the same time people also revisited this idea of putting a little encryption device on the bus going into a microprocessor to encrypt stuff coming there now and of course now with

microprocessors actually it's the buses to slow thing so slowing it down a little bit by just aes encryption stuff doesn't really cost much okay because getting data in and out of the processor is the slow bit of the computation so now and that's then dead 2 T years by Pierre Thomas gxo they are their historic see they are absolutely come from the same source set very similar however Intel and the others made a very interesting decision when they decided to do build the tea so inside a microprocessor it has to make decisions and and as it makes decisions it leaks power or at leaks radiation or at least heat or sound or whatever and so they explicitly excluded from the tea

designed these what's called side-channel attacks and therefore teeth are only trusted if you trust no-one to actually monitor the device and break it so this what you just said there about the energy and reading like the kind of real heat coming off it what are you talking about that idea that like because you could track spikes in your heat and energy consumption you could potentially crack yeah you can see it what's in there you can see it okay so at the banking industry's notice notice rate is so maybe some of your us listeners are kind of like I've only just got a pig Chip and PIN cards they're doing transactions all those chip and signature in the u.s. in the rest of the world we've been using chip

and bit pin for about twenty years and the chip and pin cards the bank's have known that the chips could be broken by measuring power consumption and an electromagnetic radiation so years or so there's been a lot of work to actually secure trip and pin cards against these kind of tax this is big business it goes back back to even goes back to the 60s people would program these big computers in the 60s and they would know what was happening in the didn't have debuggers gdb did not exist and so what you would do is you position to the computer and he would go and go like there oh it's stuck in loop for because he knew the sound of the loop of what

the computer sound was making by actually sounds coming out so this side channel attacks were actually used as debuggers in the 1960s well and so T Eve as as we're talking about them those are not protected they are not protected against light rather nice as a deliberate design decision so if you put your trusty of execution environment in the as the bad guy then it's and they have the right tool and they had the right tools they can so yeah so this is this is one of the problems of tes have and it's a deliberate design decision I think the assumption is is dist is T's running in a cloud server you don't trust Amazon to you know you go you trust Amazon not to cut a lot of

electromagnetic radiation equipment to measure around the server because they're sorry but you probably don't want the data in the clear on on the Amazon server itself or Microsoft server or one of them so there are said they are they have advantages to use but they're not the panacea that everyone seems okay let's just face it no technology is a panacea right MPC has a problem that they she has a problem T's have a problem everything has a problem but T's problem is a channel attacks well that and the fact that they have this attestation thing so we actually need to trust in told yeah yeah adder we were doing yes how do you know it's actually dirty a real real te yeah it's

funny to hear you say like it's not the panacea that everyone seems to think it is because in in my bubble in the space that I move everyone hates them like no one wants to use them some people they hate it I'm English so we have this thing called ma bi which is something you like a love or another idea this is more and maybe in the zero knowledge proof camp but you know because they're snarks and snarks require a trusted set up and a trusted set up an npc can be quite laborious and requires some sort of

social organization and it can actually be potentially dangerous that you know this what did you call it this year at the random string yeah that the common reference string could actually be discovered some go so that poses a danger so we see new systems coming out where they've actually removed the need for an NPC like bulletproof and Starks and I'm wondering what you think about those okay so the reason you want to use these things you want to do zero spruces complex statements and you want to do that efficiently though the question is what do you mean by fishing so efficient could be fast for the prover it could be fast for the verifier it could be low communication costs the size of the

proof is small and each one of those three technologies optimizes one and so so the goal is is you know the perfect zero knowledge proof would be fast for the proof of false to verify and though space yeah you have these different competing things and currently the level of technology is is we don't know how to do all good things at once so you basically start there but it proves etc and it's not whatever they all optimize different things on the other hand there is another technology to do so most proofs called MPC in the head which is really really funky so is it actually called MPC in in

the head yeah what does that mean okay so the idea of so let's go back to our example where we said I want to prove some arbitrary statement to you so what I do is I run an MPC protocol myself between two parties say in my head so I both on both Alice and I'm Bob in my head and so but because I know everything I'm the prover so I've run both parties in my head and then the proof is that you the Challenger send me a challenge that says open Alice and if I know the statement is the only way I can open Alice correctly as if I actually know the value I'm trying to

prove correct and so there is a zero knowledge proof technique called NPC in the head which is doesn't require setup assumptions it's quite slow it's quite large but in a quiet bid but it can do anything really any statement really really efficiently if you could write down a circuit for it and and it's actually forms the basis of a certain logical prose quantum signature scheme so one of the big things happen in the crypto moment is post quantum and one of the post quantum signature schemes called picnic that's been submitted to the NIST competition is actually based on NPC in the head so there's all sorts of different

everybody's kind of trying to find different ways to do it that as their own knowledge but this basically speed of verify speed approver choice of proof and trusted startup assumptions are the things and you always have to give up one I think it's an interesting to look at an example like the millionaire's problem if we go back to that like you could have a zero knowledge proof in any system that says yes Alice has more money than Bob yeah yeah and like in a bullet proof system it would be expensive to produce that proof it might be pretty large so it'd make total sense if you want to prove to many people many times over time that Alice has more money than Bob but if you're just trying to prove it once to Bob then it doesn't make sense to go through all this

trouble and it might be better to have an NPC to do it or you're trying to prove bunt I'm like a bunch of pairs and lie in this system like setting up a new trusted set up for each year it's way too complicated and expensive so you need something else yeah yes different applications debates whether yeah so I think this leads us to our last questions which is about like the future of these systems so maybe you can tell me what other than the NPC in in the head or in my head what was it MPC ahead in the head what other kind of new kinds of NPC systems or NPC setups

or techniques are you seeing emerging okay so one of the big I think in terms of NPC it's kind of we kind of the basics are kind of done but we're just getting more optimization so I think people are interested in what happens is there's a quantum computer bill there's a lot of move to what happens law in the case of quantum computing making sure systems as this year against quantum computers and that brings on to a whole thing that really really touches the whole of the crypto but cryptography and cryptocurrency space which is call crypto agility is that you've seen in the last ten years you know problems with ciphers and algorithms having to be retired you know md5 was a big was a hash function was used everywhere in

Windows and of course real problems for Microsoft having to remove the thousands of places it was used and we kind of need to be able to have how do you change the system which is already deployed quickly so why don't you know we're currently TMS one point three has currently been standardized trying to deploy it is quite hard actually you know it took ages to get rid of everybody to get rid of SSL three despite everyone knowing it was rubbish deploying new systems when things are broken is hard imagine blockchain right so imagine the hash functions broken okay how do you could have to change all the hash functions instantly so then it's not built into the system because it's building consensus in the consent yeah

how are they going to agree on changing the hash function how they could agree on changing what digital signature to use and now if you if you go this elliptic curve based on this whatever it was the the the Coblentz curve I can't my which number in this yeah that's used in Bitcoin but I'm said someone breaks that curve you want to change everything overnight what happens to all the signatures that have already been made all of them are invalid instantly because you can afford steady signature yeah so you could have kept your you don't know so how do you do this trick agility on systems that are deployed and people haven't really thought about that very much so would that almost fall under the category of like upgradability yeah yes is that right oh you'd call

yeah operator so he's Paul agilities that you can move you could shift you can quickly shift your cypher from A to B if you find out it's broken and so I think when people's built the internet and the early systems in the nineties they went yeah it's not the heavy come on it's like is this not gonna last very long it's just gonna but you know this is we're gonna just deploy some stuff and we're going to replace it very quickly so you don't really think about how you could upgrade things and then this kind of habit got built in and engineers to go oh we're gonna use this piece of crypto it works but I really see millions and millions of devices with you know one device might have a thousand pieces of crypto calls within it and you've got isolate or of them if you if the Apple

is broken you have to isolate orders them and replace them it's a real real problem it's a it's a huge problem not only in like if Bitcoin had to change its hash function you know it would be like it just wouldn't happen now yeah I can't even imagine what would happen like they should be thinking about this now yeah yeah for sure yeah and yeah like I think if they're in like when it launched it was a lot more agile it was a lot more like yeah we know that things will change we were thinking about you know quantum computers and they're like trying to think about it but it's still like over time has stagnated and it's like almost to the same level as Bitcoin and like not wanting to change yeah so

it's like a lot of the next generation of loftiness now are thinking about upgradability and like how do you keep an agile protocol but it's super hard it's like a fundamentally difficult question yeah I guess it's not only difficult technically but also just socially like people there's so much resistance from community and also there you know people who are a little evangelical about their favorite algorithm you're gonna use our remix cuz it's the best thing ever you know and they won't yeah they won't shut up that's that's so true and it's so funny you have you I mean do you see this in academia oh yeah only time it's ready ready yeah it's really appointment so you kind of mentioned earlier on this

post quantum network when you mention this sort of bit the Bitcoin hash function could be broken like is it post quantum hash function the Bitcoin signature scheme is not post content the Bitcoin hash function is in some sense post quantum in the fact is the hash function except the Bitcoin hash function is based on what's called the MD family now MD should go up Bel's because that's md5 it comes from the same stable as md5 it's tweaked version of md5 is a more complex version of md5 so shut it called sharp 2 and shower 2 is based on sha-1 good

whose face Michele zero which is based on mp5 which is based on mp4 which is based on empty - and they have been broken in order empty - was broken then mp4 then md5 that shall 0 then shall 1 and now we're on char - indigo yeah it's own we gonna take a matter of time it might be 10 years it might be 1 year it might be a hundred years but it's the same family it's the same the same technique should apply it's just a more complex notion of something that's already been broken do you believe that actually everything that's being created today it will be broke everything will be broken good question yeah but so but in the restive well so the US government already reacted to this so there is a

shower 3 and shell 3 is from a completely different family so shell 3 shell three looks - char - like a s looks too dense they just look different you know so the attack techniques you'd use on shell to do not apply to shelter in shell threes a much more interesting algorithm you can use it for much more different things so that was so that was created by some Belgium's I now live in Belgium because Belgium is the home of cryptography so your listeners may remember that a s comes from Belgium so hopefully sharp and shell 3 comes from Belgium so our hope is that the winner of the NIST competition for the post quantum algorithms will also come from Belgium because we think that's

just should be the definition is that good crypto algorithms should come from Belgium but in the case of aetherium what are they what are they actually what's used there so I'd like to believe this using catch hack which is shall free so that's a different one and hopefully we'll get a microprocessor support for sha-3 in the next few years there's a funny like story or own like the oddity of the theorem protocol that theorem uses catch act 256 which is sha-3 before it won the nist competition so it's sha-3 an internist and and like had from cachexia 56 to sha-3 there was a small

tweak and some like hardcore etherium people when when the was going through was theorizing that maybe this tweak was applied by like a government agency to try to inject some knowledge so they stuck with a check to 53 there's a good story there about des so des was modified between the submission and the thing and everyone thought it was because the US government had modified to make it weaker actually what happened was the US government modified to make it stronger yeah so to wrap up what would you say that you're looking forward to the most over the the coming a little while like well new technologies new projects whatever it may be

okay so cool things that are coming up is the excitement of NIST postcards in crypto competition so who's gonna weigh in it is it going to be Belgian it's gonna be someone else and and of course they're not they cook they said it's not a competition so there's not going to be a winner and you're going like the air right everyone still treat it as a winner and so it's really important and there's so that's gonna be like what people settle on for encryption and signatures I think there's a lot of work on steering on his proofs of proven those we've really touched on I think a lot of people think you know NPC in the head I think might be pushed a lot further I think applications their PC in the real world who can really take off will see lots of you know we've already

touched on the number in the English clip in his podcast and I think it's going to be alike there I know this is like really weird and wacky stuff do you know like um that the cryptographers always come up with you know thinks this is there was just like there a few years ago called indistinguishable obfuscation which is a way of obfuscating code I could give you the code and you don't that what the kind of program does it's kind of but that's kind of died a bit in terms of research in the moment there are these things keep popping up one of the things we've noticed is that a lot of times something will be developed it'll be kind of exciting but maybe not yet useful it'll die down and then come back in some new form is there anything in like early research that you would

love to see come back well I don't know it'd be picked up I think the thing is if it was in yes kind of this is kind of weird in the the fact is is that you go back and you go oh yeah the eventually it there it was already there so for example we already talked about trust education environments we're already in the fhe paper you know and you go like everyone forgets it and so actually if I knew what was kind of cold in the past that's what I would now be doing should be on the lookout yeah yeah yeah yeah you got a lookout and but see if things come back and yeah it's kind of this kind of interesting you kind of you always see it using the world response and you get new things

coming the old tales come back and they look like new so what are you working on next all or now currently we're working on MPC and ahead ideas to do more efficient or analyze prints we're looking at improvements for MPC protocols we have stars beats protocol with embodied in a piece of software called scale SCAL ii which we've been with now maintaining and using that in a number of applications so people can download that and play with that as an MPC system we're looking to we're always looking to recruit new people I mean this the whole area is really hot there's not a single cryptographer on

the planet who hasn't got a large number of job openings so anyone listening to this would like to come and work in lurvin which is the biggest crypto group in on the planet we have the inventor of AES one of the inventors bas just worked down from the corridor from Mesa and whatever we have work on Bitcoin and symmetric ciphers privacy and everything is going on in Lovely's we've got about 70 people working on cryptography just didn't love it so if you're interested it please just drop us a line and come and work with us thank you very much for being on the podcast there was a pleasure no problem very interesting and to our listeners thanks for listening thanks for listening you [Music]