zkSummit - ZK0x02 - On-chain verification of the NuCypher protocol with ZK proofs - David Núñez

Transcript

so thank you all of us for coming my name is David I'm working in with new cipher I don't know if you have people you have heard of us I hope that after this talk we can you can have a better understanding of what we do and not only from the scientific perspective since we're going to get into a little bit really detail about the Cyrano stuff we're doing you know protocol but also we also like to want you to know what's or actually our goals of our platform and in thirst time you can show you a little a little demo of it okay so the oh yeah David knew yet I was a bit tougher from the center and we

come up with this super cool way to prove that our encryption protocol encryption protocol works correctly and it's a very novel way for the proxy encryption each other so first what's the cipher why why why we need do we need those hyper so basically our deployment that we want to solve is we're kind of data sharing a scenario where you if there's certain information that you want to prepare it and or confidential and you want to distribute it to several people perhaps do you know it you don't know them beforehand you

don't know them when you include the information so in a typical scenario you will basically use some kind of centralized server service where you upload your data and then hopefully this data can be encrypted with a different key for each different consumer so that would be like the ideal situation right we won end-to-end privacy or at mental anxiety we will try to have information encrypted from the from the moment when it is produced to the moment that it is consumed this is of course and you get a situation but it's fanatical it's very

difficult to do it with typical cryptographic primitives like symmetric encryption or traditional public key encryption because there are several requirements that are kind of conflicting so for example you may don't know who are the consumers we hope beforehand you may don't know who are going to be the entities producing encrypted data from the beginning you may not be available to be online to share or to grant access to other people so there a lot of profits that come when you only use traditional to turn so because of the reason up-to-date for any

kind of private data sharing service or protocol usually you have certain centralized service like ah I don't know cloud storage server or whatever and basically you will have to share the keys with them so you have either share the keys with them or have a shared key with everyone or with every potential consumer so none of these approaches are ideal and when you have to share your keys with the server which is basically what is usually done of course that you can you can have certain point a certain degree of confidentiality for something

between the point-to-point communication of course you can increase the files and putting on our Dropbox or whatever but then you want to share them with another people and you don't want to share your encryption keys there it means you have to sharing a few tickets with the server so let's have a con they create the data and decrypt them afterwards to you know to any any any consumer that they work so this is course is a point of failure where many potential threats may arise and basically I mean our goal is to solve this through advanced or emergent cryptographic solutions so assuming

there is a solution for this then there are very cool application that can be constructed by so for example if there was a you know a primitive that allows you to to share encrypted information with many potential consumers then you could construct for example encrypted end-to-end chat applications where they tie secreted from the source are encrypted by some chat service or whatever and then any potential consumer is going to be able to decrypt locally another interesting application would be to distribute content with it so for

example you could have accountant distributing Network this within multimedia material or whatever and only if the consumers have paid for the subscription or or something similar then they can decrypt the service of course this is also an application of of this kind of ideal cryptographic solution and we think that we have come up with this idea to traffic tool which is proxy encryption so personal feature has been known for yeah this year there's going to be 20 years but hasn't

gained a lot of traction up to now and [Music] we think that it's a really cool and useful primitive and I'm going to briefly explain to you how optional future so I don't know if you are familiar with traditional public key encryption I hope I hope you are so just busy to recall that Impala key encryption there are two type of case you have your private key and your public key and anyone can increase for you for a message that only you can connect with anyone can use your public key to encrypt but only you can use your parrot key to decrypt that's cool that it's useful for sending just

you know if I know if I know my recipient beforehand then I can use public key encryption what proximal kitchen does it's going a little bit further because it's a holly key encryption or skin but it also introduces a really cool feature which is a proxy encryption allows to transform ciphertext that has been encrypted with some public key so in this case we can assume there's a picture using with using Alice's public key and proxy encryption allows you to transform the ciphertext into a different ciphertext that can be opened

with a different record key so it's kind of if you have a sealed envelope and there is some way of changing the recipient of the envelope without without you know then he doing this operation being able to actually learn anything about the interval methods this is everything is done automatically so what do you need to make this process work so basically what person between two dishes is a new kind of key called their encryption key so their efficiency is something that the original owner of this data you know they're the one that has the private key can create a certain especially called

aperture key which basically allows gain access to her computer information so if alice is Alice creates this key and gives the skill to some proxy now this proxy can take any size of text that was intended for her re-encrypted and produce a new circuit that is going to be open about by Bob so what this is basically doing is giving us a tool to delegate access to encrypted information so in a way it's basically doing some kind of access control mechanism some kind of critter graphically enforce

access control area so yeah so as what are the main features of personal encryption is first the proxy during this service doing during this process the proxy doesn't learn anything they take a ciphertext operate the ciphertext with the right option key and the outputs and other side effects so they don't know anything about what's the underlying message also a really interesting feature and it's something that it's usually not stressed enough is that all Alice or the original owner identity data doesn't have to interact anymore after delegating access the

negating access is basically just the act of creating this transcription key and giving this key to a proxy okay so she can do this give this special opportunity to a proxy and she can disappear now there can be data producers that basically are any entity that can that knows Alice's public key and a crypt information that was in principle intended for her but that the proxy can transform into any of the authorized consumers that were authorized by it my Alice by the way if you have any kind question of our play

don't hesitate to interrupt me yeah [Music] yeah exactly so basically yeah so basically what she will do is since you want to do have we are assuming that it's consumer it's final recipient has as separate keeper separate privately so that means that Alice has to create one around return key for each for each of the recipient so the proxy has to you

know have four so in this is three consumers so Alice will create three encryption keys because in case imagine that she says now I don't want the green the green one to read my content anymore so she only has to say to tell the proxy that please remove that key and and that's it or a new one maybe there is now a pink consumer she can create a new encryption key and data data producers doesn't have to know anything about how her encryption keys have produced or or revoke or whatever so yeah yeah yeah it's for each delegation for

each access delegation operation of course has to be online in the center she's granted access so she has to authorize so but she's only intended to do interact only in this only at this moment exactly everyone everyone creates their own keepers independently they doesn't have to know each other's public keys but Alice Alice has to know the public key of the consumers when she wants to delegate access so if Alice or

the cotton producer is not Alice actual content producer is the entity encrypting data but imagine this Alice who is the entity in control of them that keeper so if she wants to give access to a new to a new consumer she has to know his public key yeah is the easy way to give access [Music] I already understand okay okay yeah I mean that could be done

but in principle for all prescription schemes that I know that basically the only way to do that is to her sharing his private her private key with the proxy because the for for yeah even I didn't explain this when else creates the reflection key she uses her private key so her present key is the key material and allows her to actually perform an acceleration so she wants if she wants to hunt to delegate the access delegation functionality she has to donate her private key and in general we don't want that to happen so yeah in general it's for us it's like a

requirement or a goal that Alice has to be online to delegate access because that's the way of a for enforcing that alice is actually you know agreeing with the success allegation right yeah [Music] [Music] [Music] [Music] yeah they only have to know us

public-key yeah it's basically we in decipher we cannot wait we usually prefer to named entities so usually call her Alice but she actually Fran are more the more specific role she's the data owner so produces no have to know the key the public key of the data [Music] yeah yeah yeah actually well I didn't

want to come into a lot of details about it but and we actually don't have like a single public key for Alice we have many of them where they can actually be labeled so Alice can create many label public keys including public keys and data producers can is you know depending on on the application yeah if we have time I hope we have time to show you the demo because yeah I'm going to talk about the seal on the stuff but that if we have time I think we will really you should you will really benefit from seeing the demo okay I know proximal encryption is can be confusing so please ask me wherever we want

I really prefer that protocol encryption and how the cipher works is clear rather than discern all this stuff because you know it's it's more advanced and I think it's probably in the best internet for you okay so now that you know what works for encryption is then what we're building is the new cipher Network we usually call it there's no safer but just to don't get confused between the company and the project sometimes we will say also new social network so what is the new cipher Network it's basically now that you already know what this concept is then cypher network is a service that is performing this

production encryption functionality but as a service and on top of that in a decentralized way so this is the very first application of the centralization and proxy encryption yeah we actually are very proud of it so basically the data owners or who we call us can create access policies and send these policies to the network these policies basically contain what we call encryption keys okay and the idea is that the nodes on the network in a decentralized way will perform a

encryption as a service whenever they are requested by independent data consumers right so you can see that there are encryption processes a way to enforce access policy because if the nodes perform our encryption and you have the private key that was authorized by Alice in the first place then you will get the content so it's basically in a way doing some enforcement of an access delegation decision yeah just to show you that we have many use cases I'm ready for no cipher so we have all of

them are basically trying to solve some data sharing name but in different scenarios you have medical platforms we have key management we have individual things we have decentralize databases but the common denominator of everything is that they need some kind of data sharing of confidential data and they want it to be decentralized and no cipher is the depth platform the the best person to do that yeah okay so getting a little bit more into the details of how where what what we do is our proxy or encryption escape

so we have come up with a special props original scheme which is first approximately encryption scheme what does this mean basically it is that it works in a distributed way so it's perfect for for this kind of decentralized solution so basically instead of having four I told you about encryption keys and I just told you about one proxy that gets one person key for a little ball but imagine that instead of having one proxy you have twenty proxies and you split the key between the 20 of them and then for the for the consumer to to get the content

they have to you know get their encryption from several of these proxies like kind of a I don't know if you're familiar with Shamu secrets reading this kind of it's similar because it specifically uses every secretary so it's a way to defeat any kind of central or single points of failure so we have a centralized platform who is performing your encryption and if at least certain number of nodes are benign and are collaborating the content the consumers will get their content yeah so there are some properties from the proxy

encryption perspective our C is unidirectional which means that access policies only work one way so when Alice delegates to Bob it that doesn't mean that Bob is also targeting to Alice I commit that because some flexible kitchen schemes are bi-directional so ours is not which is good and single ha which means that once approach it transform a ciphertext to Bob that's a fact that cannot be transformed again basically so this is also interesting because this is this disallows you know any kind of potential access delegation change that maybe alice is completely

unaware so that's what's wrong good also interesting properties this is non interactive from the proscription perspective not interactive means that alice does doesn't have to interact with consumers at least only have to know the public of the consumers that the public can be I don't know it can being in the blockchain that can be in any how you called it a bulletin board or whatever it doesn't matter it's a public key they are at least doesn't all in it with the public key of the consumers and one of the cool feature our scheme that I didn't mention that it's called in broad umbrella Spanish word for racial so one of the cool feature of umbrella is that

it uses your knowledge groups to grantee that they knows that the proxies are actually doing their job in a correct way so yeah so we have ready implemented this everything is fully implemented you can our reference implementation is written in Python so it's called PI humble and it actually under the hood it uses Twitter Afiya which in turn is just open itself because we lipid curve cryptography and you can play with it we are more than happy for if you don't wanna play with it its own pipe I

already you can also check out the source code and everything please have a look at it we will be very happy if you if you do and okay so diving in a little bit into the Syrian oldest probe stuff so I don't know what because I also want to demo okay so they how do how do we perform these proofs or encryption so we use this is the the first application of Cyrano is proof that we that I am aware of proxy rain of suitors proof to proxy encryption to actually demonstrate

correctness of the process in under the hood we use kind of a simple method which is usually proof of descriptive inequality which have been known for 25 years so and since we have we want a non-interactive protocol we are using the TSA militaristic to make it to make it non interactive and it's secured in the as long as the random Oracle model is secure which is I think this a fine assumption and what we can achieve is that any rain creep that ciphertext can have a proof

attached to it so and this proof is publicly verifiable so basically the central nodes cannot chip they can maybe they don't maybe they can go offline but if their life and if they are producing encryptions they can just produce garbage because one concern we could have with you know dealing with the centralized platform that operation encrypted data is what if the notes are just outputting garbage how are you going to check if they are operating just garbage just random garbage instead of doing actual you know correct work so since we have this that concern is gone so yeah this is really

simple not simple real a brief overview how we produce the proof this is a standard snore like proof of proof of knowledge basically what we do is we we take the ciphertext and I will explain it but we take that the original ciphertext we take the the share of the rent option key and and the node performs a $0 group using this which can be verified publicly in a hurry C way so basically this proof can be very

with with three very simple equations which actually only used a little simple and it to come I'll admit it so actually the proof takes information from the ciphertext of the proof not the verification process of this information to understand context information from the group's information from their raindrip the ciphertext perform some solid multiplication on top of it and it's done so from the protocol not not the protocol from the clarification protected we do this in Python all the time it's very fast for a CPU to do it so it's not a concern the cool thing is that we thought what about if we do this

in a smart contract so if we have a smart contract that can actually take encrypted cipher text and prove and you know check if they are correct or not then we have a very cool feature a very good method to publicly guarantee coordination for protocol but the problems that solidity has doesn't have a really support for elliptic curve cryptography admitted so we will library this is McLaren solidity with you know some optimized formulas and stuff and it's online you can check it it actually it's very fast for doing the kind of

operation that we want which is verifying for public public groups so the questions that form that with other ECC libraries for solidity may make millions of gas units they say okay 500k which is not that which is not that bad yeah perhaps I'm not going to go into the details about the ECC arithmetic library just mentioning that of course she's since this is going to be executed by a smart contract in a public platform don't use this library with any private data is just for checking for example signals

proof that can be publicly verifiable this is very detailed yeah so in Indian our crews are all in the in the form that I mentioned before and overall our protocol can verify a smartphone I can verify new site reports with less than one to three minute of gas unit which is really interesting and although it's kind of heavy it can be done and it can be used as part of our protocol for maintaining the network honest and correct so yeah you you can have a lot of information about what we're doing we

all we have all our development in the public we have a github you can find several repos we have for related to the stock would have mainly three of them new cipher which is our main application byamba which is the proxy encryption library and numerology which is the little arithmetic library for salinity so it would be great if you can check it out and tell us what you think about it we are all the time in this Court and I don't know you have questions but if there's time and you still want to know a little bit about what we're doing and we can show you a little demo if you if

you're interested is that okay to you yeah [Music] [Music] [Applause]