# Multi-Party FHE for Multi-Player Privacy | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 54:54
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-Md1LKfuBGFo
- YouTube: https://www.youtube.com/watch?v=Md1LKfuBGFo

## Description

Privacy is an unsolved challenge for blockchains and decentralized systems. ZK cryptography gets us there partially, but not all the way. ZK enables “single-player private state,” and certain other kinds of privacy are impossible to realize with ZKPs alone. Panelists, the cryptography library devs, infrastructure builders, and application devs who have recently started to explore programmable encryption will discuss MP-FHE as one such tool for achieving more general privacy capabilities.

Speaker(s): Eduard Sanou, gubsheep, Janmajaya Mall, Veronica Zheng
Skill level: Beginner
Track: Applied Cryptography

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] all right let's go ahead and get started welcome everybody hope folks are not too sleepy from lunch thanks for making it out here for the multi-party FHA for multiplayer privacy panel to introduce things I'm gub sheep and I will be our host of the panel for today and I'm delighted to introduce our three panelists as well three incredible cryptography Engineers who have been working on various topics in programmable cryptography over the past several years we have with us today jamama jaaya who is the uh founder of gaus labs and the creator of The Phantom Zone fully homomorphic encryption Library we have edu a researcher and engineer at psse who was one of the first contributors and developers on the zkm project that's the original zkm project and we also have with us Veronica an open source developer who has worked on everything from consumer facing crypto products at coinbase to Frontier cryptography prototyping alongside organizations like the EF and zerox park so the title of this panel is nominally about multi-party fully homomorphic encryption but as with many things in this fast moving world of programmable cryptography and as you might have heard if you came to one of the other programmable cryptography panels earlier in this week this term is largely a placeholder name for a set of Concepts that we don't fully know yet how to describe or how to use or how to even think about yet necessarily in the in the clearest ways but I want to start off by introducing this term itself because it's sort of been one of the best anchors we've had emerge uh in the past year for describing um some of the things that have emerged from the recent world of research and development around these Concepts so maybe for starters I'll direct the first question to Jay here can you tell us about mpf so this isn't a term that as I understand this is not a term that actually is conventionally used in the academic world of fhe and what do we mean when we say multiparty fhe you know does that what distinguishes that from fully homomorphic encryption how do we sort of think about that prefix in this context h H well the way I would think about multi party FG is it's a way of doing multiparty computation using fully homic encryption and the advantage of this approach then taking the traditional ways of doing multiparty computation is in this case the computation is offloaded to the Ser if you take a traditional approach to multiparty competition let just say secr sh scheme or Y was gobling you would have to pay a bandwidth cost it is not the computer that is bot like in that case but you have to you know upload things and send to the other party um the difference between multi-party F and the normal way people think of FG uh which is fully homor encryption is that in in the single single party FG where it's a single player game a single person holds a secret key and then encrypts everything sends to the server server has some function that it usually wants to keep a private let's just say Neal Network and the server would evaluate the neuro Network and send the output to the client back and the client can decrypt it but in contrast to this in multiparty F the secret key which was just held by a single client in single party f is now split among multiple of them so that individually no one can decrypt the artw only when all of them come together uh they can decrypt the output and that's the difference between single party F and multi party F cool so multi-party FHA somehow exists in the intersection of the best of what we want out of multi-party computation as well as fully homomorphic encryption yes because it's sort of like trades of bandwidth cost that the client needs to pay in traditional MPC with compute so you have HED compute but we know how to solve higher compute instead of solving a higher bandwidth requirement problem um cool so maybe one thing that I also want to dig into a bit is this idea of so we have this contrast with MPC which is that we can take the bandwidth costs down um in terms of the contrast with FHA as I understand it a lot of what's going on with trying to introduce this term uh or when we think about related things like obfuscation is to also catalyze a mental model shift in how we think about what FHA is good for so I think FH is actually a pretty new topic for um all the panelists by new I mean on the on the time scale of kind of one to two years but a lot of us have heard about FHA as this technology that has been you know this wild DARPA project for a very long time how did you guys think about FHA before you started embarking on the most recent research journey and how has that mental model shifted now in the context of mpf uh yeah I think like a while I first heard of FH it's like about 10 years ago in college and then uh yeah and then like uh people say like okay I the first time I heard about it I think it's magical because for most people when you think about uh encryption uh you you think about hashing you think about okay you put your input there it's like you come out is like a a string and it's kind of garbage and now you kind of like have a piece of uh string garbage and then you add to another piece of string and garbage for some reason it preserves like the addition you can somehow decrypt it and then get the result so for me it's kind of like really magical uh but around that time people were telling me like you know it's like a million times to a billion times slower and then you know I just feel like it probably wouldn't be relevant for me as a software engineer I just moved on never thought about this until like you know we uh started experimenting on stuff this summer like build on top of J Library phom Zone and then I saw okay this is something actually possible and then you can use it for multi-party computation so yeah it's like a really magical experience for me yeah I think I also learned about FH first around eight or 10 years ago just like Veronica and it also felt quite magical but I found the technical side of things more interesting uh because if you think about having encrypted data and being able to do arbitrary operations on top of that while preserving the data sounds really awesome but then on terms of applications of traditional FH I think I got less excited about that because it's a lot of about of loading computation from like a weak device but in my opinion like these devices are no longer weak like we get more power every year on our phones so my first first question is why canot just run the same competition on my phone or maybe not today but in one year maybe I'll like I think people are trying to run llms on phones right now so to me there was a paradigm shift with the introduction of multiparty which is it's not something that you can uh it's not just offloading computation that you could already do it on your phone and then you do something to accelerate now it's Computing on private data from multiple people which is something that you could not do before so that was pretty awesome yeah so to summarize it kind of sounds like there's been two major updates in the thinking in the last couple years the first is more than just being this crazy theoretical technology someone can actually sit down and write an FHA Library write FHA circuits on top of that um it's no longer this Pine the sky thing and the second thing here sounds like our understanding of what FHA is even good for or useful for has shifted you know with the introduction of this intersection with MPC and the idea that it's not about delegating computation but actually about multiple people coming together to to produce some joint output so maybe you know I'm curious if someone could give an example of both maybe just to contrast what the world looked like when I remember sometimes I would see a popular science article about FHA 10 years ago and there'd be a certain flavor of application which I agree with you I you it just was not so exciting to me but now the things that we're starting to see people prototype and build very very early on on these systems is qualitatively different so I'm not sure if any of you have some examples here or can speak to that difference one really good example is like out there at the Frog Zone um where you have uh you have a global state in which each party has their own private state that no one knows um so you have a global state that sort of like composes of private States coming from multiple people which is kind of interesting which we did not like which we cannot have with normal well I wouldn't say normal but like things that we now consider normal like zero knowledge proofs uh um and so on and so forth um I suppose do you guys have any other interesting new case yeah it's not a particular use case but I think a lot of people have observed that smart contracts in ethereum work with public data and then I think many people learned about ZK and thought can we use ZK to have private smart cont contracts and the answer is most of the times no because we need private shared state so there are many applications where we want computation on private State like I don't know uh Unis swap um maybe there are particular solutions that can be built off ZK but they need to be tailor made for the particular use case but multiparty fhg gives you a general framework to build these kinds of applications with shared private State yes so for me um mpf it's like changed the for under users like I think it changed like my entire view about how I think about data so like with my mpf AG like my default is like going to be I want to share my data more uh so just to give an example so uh I normally when I meet like strangers I feel like very awkward and very anxious I don't know what to talk about I just don't know like what to say to those people people uh I know some of you may not think so but like a lot of us do uh so like uh so one thing like in the past few days like you know just going to those After parties I'm just keep on thinking like you know what if I can just like upload all my data my interests the books I read like all my thoughts my experiences like on on a server somewhere and then like you know like everyone else also upload their information and the when I meet a stranger like I meet Brian and then it just pops up to say like okay you guys both interested in this or like you guys are have different opinions on this so I'm like okay maybe I can talk about this so I don't need to think about what to talk anymore uh I think like in traditionally like before like uh mpf AG like if I want to do this I mean I have to write the code of course but I still have to convince people to upload all those information uh to my service like how do I trust people to do do that like I probably need to start a company and like trying to uh build a brand and uh like maybe make myself like Facebook or Google and then people start to upload their data uh and then like you know like when I have those data I might not want to have all those data because it's kind of like scary like what if I leak people's data uh and then I have to hire a bunch of Engineers to like secure the data and then you know I needed to have money so maybe how do I how do I make money like out of this I might have to show people ads so you know like a lot of things can go wrong like from there uh but with uh multiparty F I didn't need I don't need to do like any of those things I can simply like write my code okay and then like we can do this kind of uh matching or like suggesting recommendation thing like peer to peer uh without going through all of those things I think it's just going to like open a lot of like different use cases is yeah so it sounds like one of the underlying themes here with what you all are excited about with mpf is this idea of multiple people coming together to jointly compute something and without needing to rely on on some other strategies and you know there's this first strategy of we can have someone build a company build a business model build a trusted brand around collecting everybody's data and doing those joint computations and there's some problems with that and then edu you mentioned something interesting as well which was like well you know we have ethereum we have Smart contracts we have ZK maybe a thought could be can we can we combine these tools together to uh get what we want and as you mentioned this doesn't turn out to be enough and what I want to do actually is a lot of the folks in this room might be a little bit more familiar with ZK than FHA and I know for all of us we kind of came into this space as well through the ZK world as well um what is the right way to look at comparing ZK and FHA what what can they do what can each of them do that the other cannot and why is it the case that actually in the blockchain world we've talked so much more and seen so much more progress in ZK over the last five years than in these other programmable encryption Technologies I think one of the main interest from the blockchain industry in Z has been focus on scaling not on privacy and there's a lot of economic incentives to solve the scaling problem because you can have l2s uh that are pinned on ethereum and Within These l2s it's easy to extract uh to get to monetize them because you get fees but on the other hand um yeah well that's the answer I have why the blockchain space have focused mostly ZK and I think even in the ZK world we have seen more uh scaling development than just privacy applications on ZK that's my impression so probably um mpf gives you a different angle and we still need to explore and convince people why this is nice I would say the programming model for multi Part F is still kind of unexploded um we were trying to build this frog zone game with Brian as spark people and uh we came AC a lot of issues while doing that as well you know we set up five servers just for that game by the way uh oh we we just set up five serves for the game by the way so the programming model for multiart FG is still very unexplored it's not as clear as ZK at the moment the difference is that um I can point a few differences for example uh it's not all in multip party f I suppose the memory access model becomes problematic because the moment you sort of leak which part of the memory you're reading um it sort of like violates the law of you know privacy like you cannot do that so you have to pay you know linear amount of time to actually retrieve anything from the memory so that becomes a problem um what becomes better is that now you have um instead of just thinking in like single player term in ZK where you have just one person generating Witnesses on their devices and then just posting the proof somewhere what needs to be done in multiparty FG world is like you have to consider multiple people and they have a shared State and a private state within that shared State um and that is sort of a switch which took me some time to grasp over I would also quickly answer the second question I I somewhat agree with um edu that um there was there's a huge economic incentive to build um use Z for scaling but I also think that uh uh blockchain world people are not that comfortable with uh so so usually the people that are using multi-party F or like threshold F in certain scenarios at the moment from blockchain they have some they have something called God servers these are the servers that hold these secret shards that we usually put put on the clients uh blockchain people are not that much comfortable with it um and that is the tangible part of F that is like what is possible at the moment and uh what we need to do now is sort of like figure out a way around that problem which is more like not tangible at the moment like people are not able to see a way around it which inevitably leads to something called program officiation which we can talk about later as well so I think that it's not just about like there's a huge economic incentive it's also because um getting around this problem of God ex servers holding the secret shards is uh is is a is a challenge it's more like a theoretical question at the moment then you know within the reals of like us right out of college do being able to do all these things um so there's also a switch over there so maybe actually one thing I'll prompt here as well is it sounds like the reasons that you guys are mentioning are related to on the one hand there's the economic incentive for blockchains that drive ZK forwards or at least ZK for scalability forwards not clear yet how far it drives ZK for privacy and then on the other hand you know there is ultimately this technological problem of can we make uh the idea of secret shards that need to be held by a bunch of people more you know palpable to different communities that could adopt this technology but what that also kind of signals to me is there's a little bit of like almost like a social or a cultural aspect to that what I'm curious about also is from a technological perspect perspective or a theoretical perspective is there an inherent reason why ZK needed to happen 3 to 5 years earlier than FHA or is it actually the case that you know we think it's more of a social economic incentive that sort of thing that's pulling this forward in other words could FHA is there actually just a lot of lwh hanging fruit that's waiting to be discovered or is FHA inherently harder somehow I would say that we zik I I think you need to solve a single piece but with FH to be usable you need to solve FH but verifiability and figure out a way to spread among many users so there are more pieces and maybe it's harder to solve all these pieces together and while we don't solve these pieces we can have some examples or demos but maybe not quite get there to this final solution that we envision I I would say that uh uh in in the in the more uh Web Two World F has received more attention than ZK um than our world where we sort of like inhabit um I I I I'm I'm not in a position to say whether ZK is harder than fig or F is harder than ZK or something and so forth but I would say that um it's more like a social thing as well um like the cultural thing of us getting about this tool to make sure that we delivering libraries and building tools so that people can use it easily which is not often the case in the traditional world like not the traditional like web to World whatever that is did you have anything I saw that you were picking up your mic a bit ago oh yeah uh so so I think like I'm not too sure about the theoretical which is harder uh but from like application developers point of view I feel like ZK there's like less it's more like a non-interactive it's like okay you have like a approver approve a piece of something and then you can give it to the verifier and then for uh mpf AG there's just a lot of like those kind of participants and interaction happening and uh as of now like when we decrypt the in like you know like the decrypt the output there still like aliveness so that's like a lot harder to build like application around uh so yeah but one thing is quite interesting is like uh when I build uh like DK applications normally uh I would like you know make the data uh hiding the data by default I would actually like just by default hide data but with M uh mpf AG like I think like as an application developer you kind of want the user to share as much as possible so that's like another difference yeah U one more thing would be that I I sort of uh so there's only one way of doing F at the moment if you know about it like there's just like lates and ring L Ling with erors that you're familiar with and you can only use that for FG there's somewhat hints that probably theoretically f is much harder than ZK just a conjecture no no sort of like commitment to that um but I also think that it's more like a cultural issue where not we not so probably we are not coming with new ideas and probably if we sort of like enforce us a lot of people are paying attention to this thing and find it useful then probably we can come up with new ideas like the way we did for ezekia like for a long time we just had got 16 um and then you know up come plon U and so on and so forth uh there's a lot of really great insights there I guess one thing that actually I had I had not considered was the role of interactivity here so interactivity played a huge role in actually making ZK snarks practical as well you know the idea that the way a ZK snark or a general purpose zkp used to work was you would have these two parties and they would perform some interactive protocol between themselves we actually did have general purpose zero knowledge proofs that were interactive before ZK snarks came onto the scene it seems like the really important thing that actually made this practical for developers is you have this oneshot nature where I can generate a proof I can publish it publicly or I can send it to you and you can verify it and we can get on with our application so you know it makes sense actually that the nature of interactivity here just makes it so much harder to reason about you now need to do this coordination problem amongst all the different parties um I think that's a super good Insight um I'm curious to double click into J some of the directions you were just gesturing at from the theoretical perspective what can we carry over from what we know from I guess the first Branch or generation of programmable cryptography that we have really Advanced what carries over from ZK into fhu or are we in a totally different world how do we how do we think about development in this space uh is anything even relevant or is this like we need to go off and have some completely different kind of cryptographer think about some completely different kind of systems uh I would say that the programming models somewhat can be transported over uh um I when first starting with a I was having enough information about ZK did help me sort of understand a lot of things but The Primitives are entirely different um you're working with luses uh which are much simpler than electric curves so that's a that's a good point um there are less ways I do not know but like I think that the less way to shoot yourself in the leg with lisus because you know now we have standardized parameters and so and so forth there are more ways to shoot yourself in the leg with the altic curves um at least on the base primitive level uh ltis is sort of like uh give you they're much more they give you more API probably because of which they give you when I say API sort of like you know I think of hardness assumption as API giving me things to manipulate um I think uh plates give you more structure in terms of like the API which gives you f eventually um and U uh what else one thing about elter curves is that the the size of any CTIC that you encrypt using you know the normal cryptography that we know is like very small ltis is blow up everything like the data that you sent over the communication is is is way bigger than the way you would do it you know maybe if it's by some commitment or something like that H what else did I miss anything yeah one thing I'm curious about also is you know in when we sort of bottom out at the Z in terms of the ZK performance story We bottom out in things like uh ffts or you know fast 4A transforms or MSM multiscalar multiplications what do we bottom out at least in the current generation of f schemes are any of those similar does any of our acceleration work Hardware work think ways of thinking about parallel parallelization to any of those Carri over yeah they do um because um all we working with is polinomial um and have a TF polinomial and zqf polinomial and you have to multiply these polinomial which requires something called fast for transforms if you were to do them efficiently and I suppose that really applies like the all the work that is happening at least on the GPU side for ZK sort of ports over to I would I would rather go ahead and conjecture that it's directly ports over to the FG world because all of them are working over friendly primes like Goldilocks or all of them are probably not working with ffts but like probably merenia prime or Goldilocks and so and so for so I think that is completely relevant to the F world as well cool so that's a bit on the theoretical side we're now one of the big jumps in the last really half year is we've started to move from if you want to engage with this kind of Technology you purely have to engage with it at the theoretical or at most cryptography Library level one of the big transitions it seems is that developers can now at least begin to engage with this maybe developers who have a high awareness of cryptography and some math background but nonetheless at least you don't yourself have to be a cryptographer to start building on top of and using these things so Ed you and Veronica the both of you have been amongst the first developers I'm guessing in the world to really engage with mpf or fhe broadly and really take it seriously and think how do we build stuff with this um where are we at right now can you describe what the journey has been or what the experience has been what does the tool stack look like that both of you were also among the earliest developers in the applied ZK world as well how does that contrast where where are we in comparison is this like 2017 is this 20122 does that question even make sense tell us a little bit about the development experience today uh yeah I I I feel like it's it's similar to 2017 it's like uh in 2017 like I remember remember we have this njs and the circum which is like super awesome uh and uh now uh I think like we have this Phantom Zone built by Jay uh so I was able to experiment with it and build stuff uh during this summer so like we built this like a chickens game which is like a previous version of this frog game uh so we have this like 4x4 20 x 20 grade with like four chickens move around and then chickens col X which is like one and zero uh so I think like from that uh experience we uh like how we build the game is like we can write the code like maybe at that time we're writing C++ and then we have like a compiler compile it down to like binary circuits like binary Gates that's like what Phantom Zone is using uh and then once we have that uh we can use a Phantom Zone Library uh to to do that I think like um if you start writing the circuits like and first it's like uh yeah so so I remember like why I when I talk this IDE and like how to like how to think about this like uh you know uh EG in a Grade like a zero and one and then I realized okay like every time like you encrypt a zero and one you sample like different Randomness so like when you encrypt like zero and one I time it's like the uh s for text is actually like different so that is like a shift and we also realize okay you cannot just access like a cell in the braid because a CO coordinate is like encrypted so like in so like in traditional programming if you want to lay EG say sell like a two St you just exess two St flip the bit but here you have to go through like the entire grid uh so yeah it's it's it's pretty interesting but I think like on the high level it's actually the experience is pretty similar to like the ZK development experience like we just experiment like build a lot of demo code build a lot of use cases and then we realize okay here is the things we need like researchers to do more to help us like optimize and here are the things we needed to build like Library framework as like ZX Park built like this pod and GPC Library so you can help developers to build more useful application so I think like in general like the experience feels pretty similar yeah yeah I would add that as far as I know there's been FH libraries for single party for a few years but probably they there's not been a lot of developers interested in building applications on top maybe it's because of the performance maybe it's because just of loading computation was less exciting and on the other hand in the ZK space we've had so many developers wanting to build applications and deploy them on chain and build proof of Concepts and I think this has helped a lot on the maturity of the tooling and making it more usable so in that sense for FH tooling I think we're are not there yet and then we have all this FH previous tooling that was single party but now we want to use it on the multiparty setting so we can reuse the ideas of having circuits but maybe we need a layer on top to Define who is the owner of the data that is coming into the circuit and I think there's been some uh exploration on this from the MPC side so hopefully we can take all these ideas and build better tooling that is more usable and that makes the process of taking the library and building an application faster yeah I want to tell on a couple of things that the both of you raised um the first is this idea Veronica you mentioned that if I have some sort of you know you guys try to build a chicken game over the summer right which is basically there's a grid the chickens can move around the CH if you're a chicken you can lay an egg at a square then you can keep moving around and you can only see what's around your chicken and you said this thing that was the uh being able to actually flip a bit at a certain coordinate is not as simp simple as accessing what's the value at 2 comma 3 in this two-dimensional array and flip the bit you know somehow you need to scan over every single coordinate and do a maybe flip in encryption over every single coordinate so that you're preserving the location that your chicken is actually is um interacting at so um one of the things that this makes me think about is this idea of thinking of fhe more in terms of programs rather than functions where a program is something that might keep some person State whereas a function is something that you run once it has some inputs and it has some outputs a program might have some memory you execute some you know imagine like a smart contract call and then the memory changes and then you execute another call and then the memory changes and you can read from it so um when we talk about something like the uh this model of programming without thinking about things in terms of the the program and memory model I guess we're just limited to edu like you were saying these single application single party FHA applications where you're basically just running an extremely slow calculator right like I can I can perform delegated computations but a billion times more slow than I would be able to on my own machine is that kind of an accurate summary yes so we've gone then from I I was able to observe some of your guys' experiments over the summer um can you talk a bit about not just the development process but the mental model shift and going from the first application were these kinds of uh calculators where we can add numbers together running a onshot function or J I know you built a simple game Bomberman and then after that we moved on to this chicken game and now we've got the Frog demo going on in in the downstairs basement what was the process of figuring out the programming model here like for all of you how what did you go into feeling uncertain about and then what clarified as you started writing the circuits I would say that one of the challenges that if you imagine this server that is running FH functions and has a private State and then clients keep uh sending request to run stuff on this private State there is the question of how much does the server see for instance you can have a state and four methods and the server knows which method you are calling to update the state but you could also put these methods encrypted so the there's only a single endpoint and there's like a switch in the circuit that picks the method and then runs the computation and there's also like if you try to balance both you will find trade-offs between performance and privacy so trying to reason about that is pretty hard um for me it was um so in F turns out that you have to perform something called bootstrapping a lot like this is a Bo bootstrap this is a single operation that is the bottom like requires a lot of polom multiplications and and your entire function is like many of these bootstrapping operations I observed myself to search over from like I just started appreciating paralyzation a lot more after fig than before because what you can do is like you can take a program but you can write a program in a way so that it's very paralyzable and they can assume you have a server in the cloud that has you know thousands of CES and you just put it over there and executes in parel and the latency is like really low so that what that is one thing that I like to mention is like in F you just start to appreciate the power of pariz a lot more than otherwise yeah uh yeah as I said like you know access like me memory like is hard uh another thing is hard is like uh how do you think about how to represent States like that's like actually um you you know matters a l a lot like in terms of the performance of the algorithm so like thinks about what how how do you like Bond those States together and then uh so like yeah so basically that's like one part of the thing we have to think about uh another thing is like I I think it's just how do you uh think about your API and like because the thing is like uh you can do like a bunch of computation and anti and like if you want to actually see the result you have to have like every party to decrypt it and then so you can get the result uh so that is one thing to really think about and also like um you think about who get the result because the person who decrypted last like who get all the other people's decryption shares would see the result so that is also another thing to think about when you uh desire your program we're getting back to this interactivity topic that we touched on earlier in this panel it seems like this is a real thorn in our ability to build more scalable mpf applications I mean as far as I'm aware all the demos that each of you has tried to run are involving at most three or four parties um how do we scale past that how do we get to a world where the Twitter backend can be run as one huge multi-party computation or mpf or just general cryptographic computation is that mpf can bring us or uh well with with mpf or any any MPC protocol you stuck with this this issue of someone holding the secrets um and that is hard to get around unless you have something new um which sort of led to the investigation of program officiation and IND distinguish Le officiation in the first place well um and can we get there yes we can get there we have we have like a few things to present and and I think if you were there for Bar's talk he sort of introduced your bounty we implemented a program tication scheme and sort of we want people to break it because it's based on newer assumptions so I think there's a path there there's a path for building a Tut back in based on the hallucinated server model um that you've been mentioning um yeah can one of you describe maybe what program alisation gives us here what problem does it solve that we're running into with mpf maybe you can think of it as non-interactive mpf so you have the program you have the private State and anyone can uh call this program and get the outputs without interaction from the other parties so in short we don't have to do this multi-party decryption every single time I want to retrieve some result from my encrypted program think of it as the the offse circuit now has the ideal secret k f which was first split among these different parties embedded inside it and now you feed your inputs you feed your cyhex which is output of the F evaluation to this off security program which holds the ideal secret and it decrypts it for you it's just like a decryption Oracle and if you want to be more strict I would say that it's a conditional decryption Oracle because it just first needs to verify whether the F was evaluated correctly or not but that's a different question so yeah maybe my final line of questioning here with my final line of questioning here I want to look a bit towards the future so we've heard this topic obfuscation come up a couple of times at Devcon and we've also heard a lot of really strong claims about obfuscation obfuscation removes the need for ZK obfuscation generalizes mpf how much of the work on these Technologies you know mpf the schemes we we're using in particular the programming models around them um is actually going to be relevant in a world where we think obfuscation is actually the final boss of cryptography should we still be developing these particular mpf schemes like what what role do these still play or is this something where this is a bridge technology but what we really think is going to happen is at some point obfuscation is going to take over once it becomes practical enough and completely you know remove the need for any of of these tools uh I would say that to ask that like answering that question would take a while honestly um but there's one way of aing officiation that requires publicly verifiable proofs of f evaluation and F so you require certain proof generation they're not Z knowledge exactly but you require F over there you require some sort of MPC protocol as well but once you've buil officiation then it didn't compasses all these things um yeah I would say a different view point of view which is that for performance reasons we may want to stick with the fastest solution so we may have hybrid Solutions in the same sense that you can build a signature scheme with ZK but we still use like traditional signature schemes so maybe I all the part that you can do with FH you will do it with FH and only the part that it needs IO you will need you will be using I you uh there's also a question of whether you can build program officiation for generic circuits or can you only build program officiation for limited class of circuits uh and we do not know a full answer to that yet um all right um a final question I have is uh what would all of you be most excited to see built next on top of mpf or any of these technologies that are creating this model enabling this model of this trusted third party built inside cryptography hallucinated server maybe folks here have heard a couple of different terms what what should we build next uh I I I wouldn't want like researchers and also like uh uh you know cryptographers like someone like Jay to build like improve the library and uh actually try to make up fation a reality if that happens I think there's like so much much things uh we can actually build on uh for app developers I think this is the time you can actually try like mpf AG uh I would like to uh people to build more things like for uh multi parties like for people to connect to coordinate and to kind of negotiate things so that's type of the things I want to see yeah I think someone should finally build the IG trust um we have been trying this for like now almost four years now and I think someone should finally build the IG trust with multiparty FG at ofation if it's practical in near future and for those who don't know igen trust is basically proofs about social graphs if we have a decentralized social graph then we would like to be able to perform some operations on it yeah I totally agree with these uh two points I would like to add one which is less exciting but it would be nice to lower the resources requirements of mpf so that it can run on lower and Hardware so more people can use it awesome thanks folk so now we're going to go to audience questions I believe that in a moment you'll be able to see oh cool okay here we go so we've got this QR code on the screen you can scan and make a ZK proof with your zass ticket uh to post a question to this feed and we're going to start picking some of these questions to pose to our panelists here so maybe uh I'll I'll go approximately in order here what would be a good framework to start with for someone interested in building on top of mpf what is even the landscape Phantom Zone that would be a library that already implements mpf protocols and then you would need a compiler on top of that unless you want to be writing Boolean circuits by hand which is a fun option if you want to learn how it works but not very practic iCal and we there are some solutions for the compiler thing but they are not very robust and some someone in PSC will probably working on this are there other tool Stacks besides Phantom Zone that exist uh there exists Lao that is like a more lower level Library again gives you multiparty f for different schemes not just the schemes that phant Zone implements you can work with that uh there is something something called open F that also implements multi-party f um again very low level not as not as high level as Phantom Zone but like if you really want to you know go into this Wilderness and sort of explore F then I would recommend these to libraries for sh awesome so the next question here is about tees uh how have you considered the combination of tees and FHA to solve privacy issues you mentioned and about how much the server knows maybe to add on to this it sounds like what what mpf almost resembles is like a mathematical te that also happens to be 1 billion times slower so I'm curious for each of your takes on basically you know why is it worth exploring this Avenue why is it worth incurring such a high performance cost overhead is it because we believe that that cost is going to go down enormously or is it because we believe that there's some fundamental reason why the direction of things like fhe and obfuscation versus the direction of things like tees lead us to different capabilities I would say I find it harder to reason about the because I believe all the can be broken and then it's a matter of how hard it is to break them so you try to put a cost on breaking them but this estimation I don't know how good you can make it because if someone finds a new flaw that reduces the cost and you build a solution with that assumption then uh you have a bad solution so FH gives you an alternative where yeah it's the performance is worse but you have better guarantees on the security um I would say that what I what I really want is like a box that com that is like this mathematical te and this I can sort of like explore this box and confirm the guarantees that it provides and I don't think we can do that with te at the moment um the only feasible way of doing that at the moment is by relying on mathematical guarantees which comes from cryptography and one form of that is like fully morphing encryption yeah I I think what I think about it maybe mpf AG also make you to be able to do things like peerto peer fashion so you can have like a A cryptographic Shard of the of a program and then to run it that way rather than put everything inside a central box uh so that might be useful in some use cases yeah one thing maybe I'll contrast this with and I would love to get some takes on this is well with a lot of the FHA prototypes that we've seen built in the recent months the architecture for these things looks like you have multiple clients and you also have a server that computation is delegated to that's responsible per for actually performing The FHA over encrypted data you know there's some Spectrum here between everybody is running the FHA locally on their local machines two there's a delegated computation two actually we're going to delegate the trust model to the te as well how do you think about navigating that Spectrum like what is an appropriate place to land on and if and of course we might even take it further on the Spectrum in the other direction which says well maybe we don't even accept fhe because at the end of the day some set of parties needs to hold a bunch of decryption key shares so theoretically some K ofn people could collude to to decrypt the entire State we need program alisation instead where do you think about landing on the Spectrum and where do you essentially draw the line for what technology is actually useful for an application yeah I think there should be a world all those things exist and depending on the special like your use case and then you choose one versus the other you might think about like what of your uh security guarantee you want to achieve like and then also like the performance and like how is the uh when you have users like how is the user flow going to look like uh so yeah I yeah I think like depending on the stakes of your problem you may use the in certain parts you may also try to have hybrids like maybe you have a model where you have a collusion assumption but then you run this under te so now you need to break through security properties which is that they Collide and also sorry they collude and also they break the te so I guess on the Practical side of things if you want to build a product some people may find using is acceptable but I think we as a I don't know as a researcher as researchers we should try to push more and try to work towards having practical M pfh and practical NPC in general the problem with relying on just tees or even like this God Ser model of the multiple servers in the cloud probably you know T servers in the cloud holding the secret shards is that the moment you try to build a big application or the moment there's enough incentives people will break it like the moment there's a way to break it people would break it um which sort of like forc me to push on this other Direction Where We should really aim for program ofation to become practical for any of these things to scale in terms of going global um it would be really hard to even scale multiparty F if you're not able to get on this problem um one other thing that I want to ask about and this is inspired by one of the questions on the screen which is about ecdsa the signature scheme ethereum uses is where do these Technologies intersect with blockchain I mean after all we are at Devcon the annual or you know semiannual ethereum developer conference um and it also sounds like the way that we've been talking about mpf obfuscation hallucinated servers and all these Concepts is very similar to the idea of the world computer spiritually that ethereum is gesturing towards so are there any specific technical interfaces that any of you think about as this is the border between FHA and blockchain in the near future right now it might not be performant enough but where where are we going to see these things finally dock or converge or how should we think about docking them uh like at the okay if we if we just imagine that we have program OB secution practical in future then there's there's a huge chance that we can make we can completely change the smart contract framework of vium itself this might be a big claim but like you know uh just just take it for granted at the moment that we have program modification but uh we can completely replace that with IO um or ofation we cannot do that at the moment with multi party FG because us as the community are not comfortable with these God servers holding the secret shots um which is why I also think that we cannot Dock at the moment uh we would make future progresses to be able to be compatible with what blockchain people are comfortable with I mean this kind of gets me back to some of the discussion we had about interactivity right so ZK snarks became a very good fit for blockchains once they became non-interactive when we had general purpose interactive zkps the liveness assumptions needed to interoperate with smart contracts were just too high is that a fundamental barrier to to fhe and blockchains or is that something where we can actually do some sort of hacks in the near term to find some useful convergence I can imagine some solutions where a a like a small party um coordinates outside side of the blockchain and then they compute something with multiparty FH and send it to the blockchain for instance I don't know like FH multi6 something like that I guess that would be but when you want to go to the global state with no coordination I think the only solution is going to be program ofation awesome all right that is all the time that we have let's give a big round of applause to our panelists