# Programmable Cryptography and d/acc | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 20:23
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-NrhmX3yHNdA
- YouTube: https://www.youtube.com/watch?v=NrhmX3yHNdA

## Description

This short panel will explore the role of advanced programmable cryptography, beyond ZK and MPC, in d/acc. Programmable cryptographic primitives like functional encryption (FE), witness encryption (WE), and indistinguishability obfuscation (iO) have become theoretically feasible and even moving towards real-world practicality. This panel will explore how these primitives can be used to improve trust-minimized infrastructure and applications.

Speaker(s): Wei Dai, Muthu Venkitasubramaniam
Skill level: Intermediate
Track: [CLS] d/acc Discovery Day: Building Towards a Resilient Utopia
Keywords: Cryptography, Use cases of cryptography

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] hello everyone so in the next 20 minutes we're going to be talking about the role of programmable cryptography in DC programmable cryptography has been talked about in this conference um you know in relation to ethereum consistent protocols and trust mization and um I I just want to perhaps add the stage um to say that cryptography is fundamentally about trust minimization and there is a new category a new wave of cryptographic schemes that can help us better minimize trust in different settings and uh maybe perhaps the the first thing that we'll do here is to introduce our our panelist muu and muu has worked for over a decade in cryptography and maybe can you tell us briefly about your background and you know your experiences in in these cryptographic Primitives yeah uh thanks V uh my name is Mutu uh I'm a professor at Josh toown University and founder of a zero knowledge company Le hero um I did my PhD back in 2004 uh under Rafael Pas who is a student of Sylvio mikali uh I've been doing research in zero knowledge and multiparty computation for I think two decades uh now and um I think uh one of the things for me just blockchain ecosystem and the ethereum ecosystem is that these these Primitives that we have studied that was discovered in the 80s are really coming uh to life uh but today I I guess uh we are going to talk about more advanced Primitives um which I would also include like from FHA to Fe witness encryption and indistinguishability of fation yeah so perhaps let's dive straight into it so I think um most of of us here probably have heard CK zero knowledge and MPC multi party computation and uh to probably to a certain extent FH right fully homeor encryption can you explain um the landscape there and and also uh functional encryption winess encryption and inity officiation what do these things actually do so when you think of encryption it is one way to look at it is that uh with a secret key you get sort of an All or Nothing functionality if you have the secret key you can retrieve the entire message if you don't you don't you get nothing these Primitives functional encryption and witness encryption you know push these encryption schemes to what we like to call now programmable cryptography so let's start with W witness encryption so what does witness encryption allow you to do is to encrypt a message with say a puzzle and the idea is that you'd be able to decrypt this encryption only if you know the solution to the puzzle and this is really beautiful because you don't need to give a secret key to anybody the secret key is the solution to the puzzle now what could this puzzle be in the in the context of let's say uh Bitcoins Etc you could imagine that you know I want to lock some amount of money for anyone who can solve uh say the reman hypothesis so now you can imagine that anyone who can solve it gets the solution and can decrypt and get a message which is a transaction paying you some amount so witness encryption pushes the boundary of encryption to the point where I can now not give a secret key but just be able to decrypt if I know the solution to a puzzle functional encryption and indistinguishability of vcation I'd say is like a little bit of mother of all Primitives like they you can construct one from another and also do a lot of things so functional encryption allows you to generate like a programmable secret key this is how I think about it so what happens is that in a functional encryption I can encrypt a message and then I can generate a secret key for a Target functionality and this secret key will allow me to decrypt any encrypted message to reveal just the function applied on the message so if I say some function f i can generate a secret key secret key F that if I hold this for any Cipher text or any message that's been encrypted in the scheme I can learn F of F now when this was discovered or when this was defined Etc one of the classic examples is uh spam filtering so I can have the cloud just have a targeted sort of secret key to see whether when an encrypted message or uh comes to my inbox to do spam uh filtering but as you as we will talk today you will also see that this functional encryption also has other uh powerful uh uh applications now industry inability of fation I would I would say probably is higher than witness encryption and functional encryption it actually has this promise that I can take any program and obfuscate meaning that I can give it to you in a way that you cannot reverse engineer the original code now you should take it with a grain of salt pure obfuscation is impossible so if someone comes and says hey can I use indistinguishability obfuscation to replace tees this is not true so yeah I think there's a lot to unpack unpack there continue um so indistinguishability ofation I want to say is that it's something that um it tries to find the right definition of obfuscation that is both realizable and um actually does have meaningful consequences I'll just stop with the definition of indistinguishability obfuscation it says that I can obfuscate programs in a way that I will not be able to distinguish the obfuscation of two programs that have identical functionality and it seems pretty weak but this this form of obfuscation already can give you witness encryption functional encryption and uh a lot of other things so just to recap at the high level if we have officiation then that implies winess encryption and functional encryption um what about the other way can can you some of the landscape so actually a strong again uh with just like with aisc even functional encryption there are different definitions are different levels of security if you go for like sometimes the strongest form of security it becomes impossible but for a certain kind of functional encryption actually you can construct in distinguishability of vcation so in that sense I would put both of them in the same category and both of them imply witness encryption and going back from witness encryption to these things are harder got it so witness encryption is kind of the easiest to get and then functional encryption iio alisation could be equivalent depending on that definition so perhaps let's zoom in on wi encryption uh for now and I think one use case that really spark my interest uh in actually looking at wi encryption is um uh and actually being able to extend the existing protocols without actually running MPC so one example of this is uh in ethereum we have B signatures we have already a lot of Auditors with existing infrastructure and and uh and and the question is can we actually encrypt to uh a side of these valuators and and there the condition right the puzzle that that you described before would be has enough notes signed a message um so that you would then be able to to decrypt um and so I think that's one application where people have proposed where we could use wi encryption so just looking at this particular use case can you describe to us is this is is this uh feasible right now do we need custom scheme or do we need generalized wi encryption um so I mean just uh probably before the tldr is that actually this is one of the recent advancements where witness encryption for a specific language can enable exactly this functionality which is that let's say that I have n signers for something and I want to be able to decrypt something as long as I have say t out of n signatures I can encrypt a message and the puzzle really is that I need to have t out of end signatures and there has been a recent construction even implemented to show that this functionality is uh is feasible but let me just say that general purpose witness encryption would be to ask can I do this for an arbitrary puzzle and the answer is today we only know how to construct that from obfuscation itself so G purpose witness encryption is still far from being practical but for this specific application it is possible to do it and I want to say that if you also Trace history witness encryption it goes back to even like when you think of cca2 encryption it was a limited form of witness encryption and since then there have been some progress but I want to say general purpose witness encryption is still uh far way out well definitely zooming on that um in a later question but so let's go to functional encryption and appication I think one of the more recent uh proposals that applies functional encryption is to actually adds features to bitcoin to for it to become more like ethereum right so there this thing called Bitcoin Covenant which is not uh feasible on bitcoin today and people have been proposing to use functional encryption to to get confidence for Bitcoin and the use case there is to say that ecd signing key must be used in a certain way uh only if a condition on the signing messages is true so this requires computation on the message to be signed a condition to be checked and uh a signature to be generated as as the the function to be computed um can you comment briefly on this particular use case and whether that is feasible currently using uh using alisation or functional encryption okay um it's going to be hard to comment but I will say that um if you look at the construction I want someone to implement it to really see the overhead although just looking at how I have to implement the circuit I need to embed arithmetization of One Prime to another Prime for elliptic curve operations I think the overhead the margins are going to be a lot but that should not deter people from trying to uh uh implement this but just to maybe give a rough idea of not the construction but um where it comes from functional encryption is that so functional encryption again just like witness encryption if you want for general purpose polinomial size computation you the only way we know is to do it from indistinguishability ofation but uh a very restricted form of functionality is an inner product okay I take two vectors I want to compute the inner product can I do this under uh can this be the function and can I do this under uh functional encryption and there are constructions actually there are I want to say feasible constructions to do this now this recent work that has shown that we can implement this functionality that we said where if um a certain condition and this condition really you can think of it as verifying a zero knowledge proof then I will sign a particular message and this can be again translated into whatever functionality you want in the under uh blockchain layer and just using this inner product functional encryption you can construct uh one that can do this functionality which is verify a certain kind of proof and then sign say under the Snore signatures which are needed for uh the Bitcoin protocol again I want to say that um the fact that these Primitives can be useful for these is not surprising these are like really um uh very strong Primitives that have you know really a vast range of applications but discovering where it is practical and feasible uh is still really an ongoing uh research got it so perhaps let's zoom out um a little bit more to more diac the con of DC more broadly I think one way to look at where we can apply programmable cryptography is wherever a te has been used right so there's two angle to this um if a te is currently needed can we remove that uh Reliance on the te and you know we're else can we insert this trust execution environment um where it's actually could actually use cryptography right and so can you actually comment on the difference between trust execution environments trust Hardware versus programmable cryptography using officiation so as I mentioned before right te can give you what is called uh close to what's called a blackbox of fisc and that's a technical term but what it really means that it can give you access to a just the input output uh behavior of a functionality now in general if you want to realize it without any hardware assumptions it's impossible so uh indistinguishability of fation cannot serve as a replacement for uh for tees but uh I think maybe I want to make a Spiel here of a larger point in general in this area and also probably because of my sort of background here is that uh when we all studyed like zero knowledge and MPC actually MPC in my mind can solve most of the things that we want now witness encryption functional encryption IO all of these help to address certain adversary or certain um uh certain kinds of attacks on the protocol actually it can minimize interaction it can help you interact with smart contracts better Etc but I think if you look at MPC on its own can solve a lot of these so when we think about these Primitives we also need to understand is it that this attack Vector is why these Primitives are crucial again I mean I I don't want to comment on that but this is something that people have to understand and even when you have to implement things like witness encryption and functional encryption there is going to be a dkg component the dkg assumption is no different than what you will have to make for MPC from a security standpoint you're going to say hey up to n minus one of the parties are going to be corrupted or up to like half of them are going to be corrupted so from at least from a number of collusions Etc these like when you compare MPC and witness encryption and functional encryption for these things you can't put them on the same place and I'll also say that MPC today is far more efficient than it was I want to say like when I started studying uh MPC so when when we are thinking about these applications and these great Primitives uh I would post this question that hey can we device first an MPC solution can we deploy it can we see is this enough like is this are already going to give you certain meaningful privacy guarantees yes at the cost of maybe some denial of service attacks but uh I do think that in terms of even realizing the potential that we are seeing of these things to look at uh MPC so is it correct to say that there a spectrum uh from trust trust it something that requires a lot of trust to something that's very trust minimized where uh you know we we actually rely on math in the middle is NPC right NPC still realiz on mathematical assumptions but we actually ask certain notes to be honest right and there's ways to hold them to be accountable if if they behave dishonestly which is actually quite open research area the notion of accountable MPC which I think is is actually you know within the the the same category of program graphy um we should do applications first using you know more trusted uh w Battle tested Primitives and then move to things like obilation um so maybe in the in the last couple minutes um let's explore the actual feasibility of these more advanced Primitives um I think the first result that's peer reviewed and accepted by The Wider cryptographic community that says IO tication is possible came from 21 right and can you comment on what has happened since then uh has people implemented this this primitive and and what is the performers like uh yeah actually um my when I was doing my PhD my PhD classmate uh hu Lynn she is one of the authors of this 2021 uh paper that solved indistinguishability ofation but one needs to actually understand what did they solve right when you say that can I realize in distinguishability ofation it was like you know at least a decade back they showed the first candidate construction based on multilinear maps but then after that there was this huge cycle of people you know trying to Define what is the security of multilinear maps it you know there were constructions they were broken there were constructions they were broken the officiation construction itself wasn't broken but the Assumption was broken so really in the theoretical Community it was about trying to find the falsifiable Assumption based on which you can construct OB fation and the JIS paper in 21 came up with the first set of falsifiable assumptions and I just want to say as a cryptographer for us our bread and butter is about getting things using falsifiable assumptions and that was the huge breakthrough in JLS 21 that you could construct aisc based on falsifiable assumptions but if you look at this construction it requires four different things LPN LW bilinear Maps like several cryptographic assumptions went into constructing this and now since then what people are trying to do which again is one of the other sort of really motivating questions in cryptography is to minimize the cryptographic assumptions you don't want to assume four different things and a more recent line of work is trying to get another flavor of a single assumption which is a latus based assumption to construct officiation there are again candidates but it's kind of going a little bit in the cycle of multi-linear maps where they Define something it gets broken they Define something but you know this is a cycle that you know Theory people are used to uh in terms of these uh constructions but just to uh you know wrap up with the Practical feasibility of this we are far from alisation being practical I want to say that there was a paper I forget now maybe six to seven years back in crypto where they showed they did construct an offis that could do five operations and I mean like really five gates uh of uh of computation and that took like hours uh hours to run using uh multilinear maps and that being said you know definitely research should still go into uh you know making these things both reducing the assumptions but also trying to find out in a limited form can the these things still be practically constructed so you know a counter part of that is if you look at 10 years ago you know maybe 15 years ago people said the same thing about a and nck and you know the land has really changed do you think the same thing will happen for ofation and and are there enough cryptographers actually working on this um that's a great question I will I will first say that I will not bet against cryptography I know all the researchers in this field they're making tremendous progress uh in doing this but will it accelerate as much as zero knowledge and MPC uh I think that's a little bit of a different question it really comes from is the community invested in solving that problem let's take the the bit bit coin signing example you don't have this particular op code that you want that will allow you to verify zero knowledge proofs uh in my opinion well if the Bitcoin Community are willing to bring opcat you can now verify uh zero knowledge proofs that is uh to me an easier path towards that particular goal than trying to make a functional encryption problem uh solve well I think