# Scalable multi-party FHE with Phantom-zone by Janmajaya Mall | Devcon SEA

- Speakers: [Janmajaya Mall](https://streameth.org/speakers/janmajaya-mall)
- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 20:49
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-CyIjTbHmVwg
- YouTube: https://www.youtube.com/watch?v=CyIjTbHmVwg

## Description

The talk introduces "phantom-zone", a framework to write scalable consumer facing MPC apps using multi-party FHE. Starting with what's multi-party FHE, talk gives a demo of non-trivial MPC app. Followed by introduction to programming model of MPC apps using multi-party FHE inside phantom-zone. Then the talk dives deep into primitives to realise multi-party FHE and ends with advanced FHE gadgets that further enhance multi-party FHE.

Speaker(s): Janmajaya Mall
Skill level: Beginner
Track: Applied Cryptography
Keywords: MPC, mp-fhe

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] [Music] hello um welcome back um so today I I would be talking about Phantom Zone uh but before I sort of like dive deep into Phantom Zone and talk about the rest of the things I would uh sort of walk you through the motivation behind Phantom Zone so if you guys are familiar with globally mutually trusted third party I would want to introduce this you to this idea of globally mutually trusted third party what is this m globally mutually trusted third party well it provides you three guarantees the first thing that it says is that whatever information you send to this third party it will always keep that private it would not leak it to anyone the second guarantee that it provides is that all the information that it has collected over time from different people you know we have been suing this globally mutually trusted third party all the information let's say for a year all the information is collected for all these years it would always keep the private and would not allow anyone to poke inside its tight inside its memory and the third guarantee that it provides is Mak makes this particular party very magical is that it you can it can compute any arbitary function we want it to compute as long as we provided enough authorization to be able to compute that function and we only output the necessary outputs usually I sort of like refer to this this mutually Tred third party as a mutually shared computer and if you guys are familiar with something called the god protocol this is the god protocol this is a picture from xabo back in 1987 um so first observation to make is that if you really want these three guarantees uh to be if you really want this party to be globally mutually trusted we want this party to be party to be able to prove these three guarantees to any individual without requiring any additional interaction which is why we require cryptography we cannot just make it on certain legal agreements or something like that we require cryptography for building this the building this um globally mutually trusted shared computer and we started to build Phantom Zone to eventually build the god protocol but to stick within the Realms of practicality we could only build an Abridged version of it so for the rest of the talk I would be talking about a what is fundom zone why it is an a bridged version of this God protocol and the second important thing that we're talking about is how can we push the Frontiers to eventually build the god protocol okay so Phantom Zone The Abridged version the key idea in Phantom Zone is something called multiparty fph encryption and for you to describe for me to describe you multiart f encryption I'll have to eventually describe what is single party F encryption in single party F encryption you you have a single client you know this guy over here they hold a secret they keep the secret private to them they can encrypt their information which is a here with the secret and produce an F Cipher text and then they can send this F Cipher text to any server and the server can evaluate an any arbitrary function on their private input which is a and produce an output Cipher text and that the and the client can receive the output surface and decrypt it so this is single party FG coming to multiparty F Well the key idea in multiparty fig is that you split this secret which is held private by a single client in single party F among many clients so you have s0 S1 S2 as secret Shard split among these three people over here the first step in multiparty F is something called Collective p uh public generation so all these three parties come together and they generate the collective publicy and and then all these three parties using the collective public key encryp their private inputs and produce F Cipher text and then they then they send their F cotex to the server server executes a Mary function on the F cotex and produce an F uh produce an F output the key thing to notice here is that all these parties would have to produce a decryption share to eventually decrypt the output cext here so they produce the decryption share using the secret shards and then they send it to each other and then only they're able to uh decrypt the art with Cipher text because in this case the secret was split among all these parties so why is Phantom Zone an a bridged version well because Phantom Zone assuming that in the future we able to add publicly vable Effigy to a Phantom Zone can only guarantee the three guarantees that I talk about in the god protocol to only the holders of the secret shots it cannot guarantee these three guarantees to everyone around the globe which is why Phantom Zone is just an abised version of it okay so you might wonder how do we build towards the god protocol like how do we even do it well what I would like to say at the moment is you know I would have loved to say that you know after a lot of research and a lot of like five years of research we have figured of the solution to get build the god protocol but now like there no at lightening thoughts here and there's one obvious answer to building to eventually building the god protocol which is program officiation what's program officiation well to Simply describe your program officiation let's just assume that you have function f right what you can do with program ofation is you take this function f and perform some Transformations on this function f and produce an offs skated circuit you can give this off circuit to someone else and program Association guarantees that the only thing that you can learn from that offset circuit is the input to Output map and nothing else now you might be wondering why is this useful because if the function is Trivial then you can e easily learn it from the input to Output map program OBS cation becomes easy become becomes very interesting when you sort of like OBS secate a program that is a cryptographic function for example let's just say that I take uh I take a function I take a function that is that decrypts any Cipher text that is encrypted to my public key right so I take a function and this function has my secret key and it decrypts any cyhex that was encrypted to me using my public key and I perform certain Transformations using prog tication to this function and produce an obic circuit I give this obic circuit to someone else what they can do is that they can decrypt any Cipher text that was encrypted to me using this obus circuit but they can never ever learn what the secret is inside that circuit they can never learn my secret key and um and this is these are the class of functions where program autic becomes useful and I'll tie it to to building the god protocol later in the slides uh okay so now assume that we can only build program officiation for some limited class of functions you know not for General class of functions but like limited class of functions I'll tell you one way of building the pro um building the god protocol using program appication step one modify the F scheme that we using before to become publicly verifiable what do I mean by that well a publicly verifiable F schemes does those things it evaluates the F function which you know a normal F scheme does in addition to evaluating the function it also produces a proof of correct evaluation so that anyone can verify this proof with the output CeX and be assured that the server that sort of executed this F function EXA executed did it correctly and which I usually referred to as proof Pi of correct evaluation step two replace the collective key generation operation that we did in the multiparty F with a trusted setup in The Trusted setup you have arbitary number of people here they perform some MPC protocol to produce FH Keys the two types of FG Keys which are very important public key and the bootstrapping key bootstrapping key is usually used for some sort of like F operations that you can completely blackbox the key thing here is that no one knows the ideal secret key because we're generating a we're doing a trusted setup in NPC to generate these two keys the third step is modify the trusted setup to also output an officiated conditional decryption Oracle okay that's a mouthful I sort of like go into it one deep one level deeper what is an obsc conditional decryptor this particular conditional decryptor is an obsc program of the following functionality what it does is that takes an output Cipher text and a proof of correct evaluation of FG circuit it verifies whether the proof is valid and decrypts the output cyhex if and only if the proof is valid and this sort of like tells you why did we assume in the first place that program autic may be feasible only for like limited class of functions because to build the god protocol like to to build the got protocol using the F route we only need program ofation to be practical for this officiated conditional decryptor so we modify the TR setup to also output this offc conditional decryptor and that's it and another thing to noce that this conditional decryptor also has the secret key the ideal secret key that no one knows embedded inside it okay so the end to end flow is you do MPC to generate three things public key bootstrapping key and the um and the offc conditional decryptor which I now realize is somewhat of mouthful uh I should have chosen some other term anyways the second flow is now anyone can encrypt their private inputs using the public key that is the output of the MPC protocol so you multiple Cipher Texs here and then they can send it to the F server F server evaluates the F function outputs the encrypted output in addition it produces a proof because the F server is evaluating a publicly verifiable F scheme um and then we Pro we we plugged in the proof as well as the output to the to the offc conditional decryptor and the conditional decryptor would only output the uh would only decrypt the encrypted output if and only if the proof is wallid so this is one way of building the god protocol using publicly verifiable F and program ofation for officed conditional decryptor so there's one way which I've just shown you but we need new ideas to push the Frontiers and to finally build the uh to to finally build program officiation or indistinguishability officiation if you're familiar with that here I've showed you just one way but if you're able to come up with new ideas then probably we can make program officiation more practical for General circuits not just for like limited class of functions that we use before and probably we can directly build the Cod protocols from program officiation okay so while I was exploring this field of program officiation and iio one key observation that I made um this uh one key observation that I made was that it's really hard to get efficient program officiation from standard assumptions and we would inevitably require exotic assumptions and I'll tell you what are standard assumptions what are exotic assumptions well a standard assumption is assumption that has been there for a while for example dlog the street log problem there's also there also exists additional incentive for people to break these stand uh standard assumptions and exotic assumptions are somewhat newer assumptions like they have been only there for like five years or not even five years like two to three years uh what we can do as a community to you know realizing that we might inevitably need need newer assumptions to build practical program modification is we can start examining these newer assumptions start breaking them start testing them or we can build applications using this assumption so that we can incentivize people to break them and tell us whether they're broken or not and then eventually in like few years we would have candidate assumptions that are newer assumptions but they have become then standard using which we can build practical program vestigation okay uh and taking a first step towards this we launching a py program for program to break one of the candidate assumptions which is called program appication via local mixing the way I think about this particular assumption is that you they're taking take they're taking more computational complexity approach than taking like the traditional approach of using algebraic structures to build program officiation the goal of the Bounty is that we've provided you an offc circuit with roughly like 240,000 Gates which was offcut from an original circuits with roughly thousand Gates and you have to find the original circuit you can learn more about the Bounty atopia too if you know what off estopia is off estopia means that we living in a world where officiation is practical uh and the Bounty is 10K and this bounty is launched in collaboration with um etherum foundation and ZX Park um okay so before I break um and I think that I have a bunch of time okay before I break I would want to make one conjecture and the conjecture goes as follows I think the god protocol is the convergence of cryptography probably building the god protocol would require certain sort of like f that is just one route but like publicly F and other things like MPC for it setup and so on and so forth but once we have built the god protocol I think it compasses everything it gives us everything that we have we have been like wanting for for a while it gives us witness encryption it gives us Z knowledge proves bya signatures it gives us MPC multiparty computation it gives us Fe fun functional encryption all all of these things that we've been demanding for a while and this is also one of the major reasons that we should start investigating much more seriously how to get practical program officiation and finally build the god protocol and that's it thank you all right thank you for the talk we do have some questions rolling in uh yeah uh let's go through some of the questions uh let's start with the first one can we Implement threshold ecdsa with Phantom Zone at the moment yes because you can express every like practical like theoretically yes but it would be very impractical to implement ecds with Phantom Zone at the moment because ecds is like you're doing eptic operations which is a lot of operations um as far as I understand threshold ecds is possible it takes two days to generate one single signature all right so next question can you tell us a little bit more about the definition of obfuscation as a virtual black box that's the first question over here isn't definition ofation as a virtual blackbox impossible I I am not posing officiation as a virtual blackbox um I I did not mean to say officiation is a virtual blackbox uh by the way the impossibility resolve for virtual blackbox is only for like certain very restricted class of programs it's not for like General class of programs eventually you can aim for virtual blackbox with certain caveats um but against saying that my my definition of officiation is not virtual blackbox um all right and what can be done today with Phantom Zone at the moment as I said Phantom Zone is an Abridged version of this God protocol it does not even have a publicly byi ref scheme so it does not give you all the three guarantees the only guarantee that it gives you is that it will execute the function that you ask it to execute while input while private information can be coming from multiple people you'll keep the information private but you'll have to trust it for it so you have to trust this particular server to always keep the information private and not send it to anyone else perfect and we do have one last question oh cool more questions rolling in can obus skating programs undermine open- Source transparency and make it harder to verify the absence of malicious code uh I see make it harder to verify absence of malicious code well that is assuming that the entire program is officiated um when I say officiation we require officiation for certain parts of the program which can interact with a public program and a private program which is obic I understand that obic can be used for many malicious purposes as well like for example you know like there there's several reasons why people might be interested in OBS cation but we can as a community make sure that there's an interaction between the public interfaces and the private interfaces which are obsc all right and why do you call the publicly verifiable FH circuit obfuscated doesn't the require solidity verifier or something which is public uh no uh I think once I give you off secar circuit there certain guarantees that you can learn from the obate circuit itself that it does not reveal anything as long as youve done the OBS cation correctly all right and do you have evidence that the conditional decryption functionality is imposs uh is possible using IO yes uh there is there theoretical results and we're trying to make it practical as well all right uh can you give one example each on how IO can replace ZK MPC fhe okay so for ZK what you can do is like you can embed a secret key inside this secr circuit the god protocol and uh a Zer knowledge proof is just a signature from this God protocol they whatever the secr whatever secret exists inside this particular server or this God protocol or this F Circuit of SEC circuit a signature by that thing becomes the zero knowledge proofs so you do not require zero knowledge on the client side uh anymore for NPC again it's a globally mutually trusted third party all of us encrypt our private inputs with the public key corresponding to the secret key that lives inside this off gate circuit and we send a private inputs to this it decrypts that performs some function and produces the output so that's one way of replacing MPC and the same for FG cool uh we can stay here for maybe another 10 seconds if there are any new questions rolling in all right cool um let's give