# The Future of Privacy Preserving Smart Contracts by Ravital Solomon, John Pacific

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 22:43
- Topics: blockchain, smart contracts, distributed ledger, ethereum
- Watch: https://streameth.org/watch/yt-djrYx8w0zbg
- YouTube: https://www.youtube.com/watch?v=djrYx8w0zbg

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/5/the-future-of-privacy-preserving-smart-contracts

Ethereum is unable to support the development of privacy-preserving smart contracts in its current state. What do we need from Ethereum 2.0 to build arbitrary privacy-preserving smart contracts? What cryptographic building blocks are required? 
We’ll begin by diving into recent efforts both in academia and industry towards building PPSCs and some of the fundamental flaws with these approaches. We’ll also cover the trade-offs that need to be considered and the lessons learned from previous attempts in this space. Furthermore, we will discuss the limitations on use cases for each approach.Attendees of the presentation will leave with a better understanding of the state of the art for PPSCs in Ethereum and the wider blockchain space.

Speaker(s): John Pacific, Ravital Solomon
Skill level: Intermediate
Track: Privacy
Keywords: technical

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Applause] so if you put disclaimers if you come to see this talk we really hope you have familiarity with your knowledge pretty smart encryption and really hoping to provide as unbiased that the discussion as possible here you feel like we're not doing a good job of that who eats people feel free and call us out so what does a private citizen smart phone chimes there's a few different like components of properties and present Pacific's markup caps that are going to go over it with exactly what defines them another case privacy is defined by two properties confidentiality and anonymity and what we define privacy is in this case that confidentiality is when we can hide the inlet and the outputs of that at that state machines program so for example like in a slowly smart contract we all know that the inputs are not private everybody can see them as well as they are also no no buts there the inputs are not confidential and also they don't find the users involved in that confrontation so we have two properties that we've been finding but is confidentiality so that's like the bare minimum which is like just and puts it in and then and there would be like a more complete solution where it applies confidentiality you're probably familiar with some of the use cases for smart contracts in case you didn't know so our contracts are also a form of private transaction so like a Bitcoin transaction is a smart contract to some extent so in the case of private transactions there are viewing with these Z cash banana and two major ones private Bodi is known as case where people actually need to have their some privacy some degree of maybe even anonymity when they vote to cast ballots as well as auctions there's a really big market for wanted options and keeping that who is paying for what how much they're paying right so there are some considerations for preserving smart cat an honor talk were mainly going to focus on transaction privacy the reason why is because transaction privacy is a small subset problem of private transit of privacy you preserving smart contracts and the cool thing about transactions is that when you make them private you can actually sometimes generalize these into more broad definitions of smart contracts so they can actually make them into more intelligent Asians now don't that weren't just transactions there may be involved like whole state machine you can pull an execution we'll be getting more into that later so we believe there are four main considerations that go into actually developing a privacy preserving smart contract so we've separating things out in queue the privacy security and functionality within each of us there's a lot of complexities so in efficiency you can ask yourself how long does it take to actually generate the transaction what about verifying a transaction what is the actual communication complexity setup string size set-up time that's entering size what are the hardware resources required government zero knowledge systems do you have a lot of hardware resources required and they tend to gloss over that aspect and how does it actually scale with privacy as we mentioned before can we provide confidentiality or anonymity and is the privacy based on cryptographic techniques so do we have some truthful form of privacy or are we using other techniques such as tumblers for anonymity or stealth addresses security has similar considerations is the security based on cryptography do we have provable security or is security based on non cryptographic techniques we can look at trusted setup we also have to consider LAN standard cryptographic assumptions such as using the algebraic remodel knowledge of exponent which are slightly on standard and we have to consider what kind of adversary is our scheme actually secure against a post one-to-one a semi malicious one and then finally and arguably to us the most important consideration is functionalities when they're talking about developing PTSD can you actually adapt your scheme to new settings is it possible to really express any arbitrary computation with your scheme and more importantly is there support for stateful computations like area so that leads us into what we believe are the four definitions for these qualities for efficiency in the ideal world it should be quick to generate and verify transactions that it should be fast there should be a small communication cost it should be efficient when scaling and minimal hardware resources are required with privacy we should be able to get anonymity not just confidentiality it should be based solely on cryptography security is similar it should be based solely on cryptography we do not want to use a trusted set up both for security and functionality reasons and it should be secure against strong adversaries we've left this deliberately ambiguous because it depends what you can achieve a nurse eat and buy these are functionality we should be able to check off all three boxes that we just saw we want it to be easily to easy adapt to new settings you should be able to express any kind of program with our scheme and finally it should support stateful contributions so how do we actually achieve these four characteristics we're going to focus exclusively on the cryptographic techniques because we believe in through the whole security and privacy the first one we're going to look at is of course zero knowledge proof and there are three main schemes that everyone's familiar with snarks starts and Moltres so four starts they have trusted set up however that allows us to get the smallest reach sizes out of the three and the fastest verification possible but they also use a slightly non-standard cryptographic assumption which is knowledge of exponent Starks are arguably in a true on Starks and that they have no trusted setup and they use a much better understood and partners assumption of hash functions but that comes at the cost of incredibly large group sizes compared to the other two and some expensive partners needed and the form of extra RAM to actually get the efficiency they talk about 5min fulla troops they fall somewhere in between the two there is no trusted setup which is fantastic they have moderate proof sizes but they have some of the worst verification times however they can be improved when batching them together and they're based on well understood hardness assumptions using discrete locks so if we look at the three and see how they compare in terms of the four qualities we've ignored privacy because arguably all share of knowledge proof systems better compute provide confidentiality in terms of efficiency starts come out ahead with the smallest reach sizes and the founders verification however you know their trusted set up functionalities impacted a lot it's very difficult to port receive in settings starts have very poor efficiency as you see because they need additional hardware resources and they have absolutely giant true sizes but they do very well in security and functionality as do both groups and both of ears fall somewhere in between mature so that leads us into the next building block that touches going to bail them out so the next one is that is called multi-party computation something I probably shared a lot of you are already familiar with in the form of secret sharing scheme such a severe situation so multi-party computation is a type of privacy preserving computation technique which allows us to secure the inputs to some predetermined program and we have multiple artists who collaborate together and work together to execute this program and then the outlet they should have been tried that outlet that only the person who requested that competition should know like I said one of these examples should be super charity which you're all probably familiar with in like the cases like wallets how does put up your wallets and so so maybe this is the most predominant issue that everybody should understand what we're talking about multi-party computation is how interactive it is it is incredibly interactive depending on the number of parties you have so anything more than usually two or three participants we start seeing some really massive problems and for many other protocols that requires something like zero knowledge proves to keep the protocol actually fair so what that means essentially is we have like complexity layers and our NPC protocols like the very first layer we can imagine the network so all of our participants have to communicate with each other but we start having similar problems like traffic you know when you get in a traffic jam the first person in the front of the traffic gym steps on the brakes which causes everybody else's 7212 so we started seeing network latency to filter through the entire property through the entire network like that and it causes massive problems especially when a lot of communication is required for more complex things like we can imagine for a privacy-preserving smartphone track another thing is that as game theoretic and security sometimes where we may require novice majority and to keep things fair we require another layer of complexity like that produce when we start having to integrate proofs to ensure that everybody is acting appropriately and if we start doing this now we're talking about very complex and long protocol so in our next slide we'll be talking about some implementations of privacy-preserving select projects so if you have the most recent approaches that are based on etherion are Aztec and Caesar both of the collapsed perform confidential transaction on Imperium as head it uses a cute EXO model whereas these are uses an account based model both of them in theory are able to achieve in on Amity and however Aztec uses stealth addresses which doesn't really satisfy the cryptographic definition of privacy we want Caesar does do ring signatures however it's too expensive to implement on Imperium passes Seifer is a lot more mathematically sophisticated it comes from the same authors of bulletproof and utilizes commitment schemes held long frictions and it actually combines bold approach than Sigma protocols into something called bonus aspect is significantly simpler but they use a trusted setup there are a lot more efficient than Zener and they just rely exclusively on commitment themes and similar protocols to achieve this so what to z13 Gnostic have in common we're talking about the ability to eligible encryption what they're actually easily utilizing there's a property called how to become a morphic by encryption or given commitment schemes so what does it mean to be adamantly not amorphic but we have to all talk about different types of how morphisms but the case is hotter than thought morphism we can imagine that we have the encryption of something of value a and an encryption of a value B and if we take these two Sacre texts to perform it and a addition operation of the two cipher texts we actually get the encryption of what would be the output if you just added the two plaintext together except they're now imprinted so how this is built around to print it up build actual confidential transactions is we have an encryption of the balance say the number 3 and then we have the encryption of the transfer amount say I'm number like negative 2 you're sending 2 coins to somebody so when you take during 50 pounds of 3 and you're a gifted balance of things there you're good to transfer at negative 2 you add them together you get 1 so that would be the encryption of the balance after that transaction in general so it essentially lets you and now the pub organism is simply a way to map between these two domains and the plaintext of a team where we all familiar with just doing simple addition on things and the done in the encrypted cipher text domain where we don't normally see what the values under info some value that out of all organism is simply an operation and addition operation that lets us calculate what that would that would be able plaintext space so you can simply add ciphertext the other to get there played exhale fully homomorphic encryption much scan that's all thought about as we just saw some schemes do you utilize homework in addition to perform confidential transactions if you actually extend that and consider homomorphic multiplication which means that the encryption of a times the encryption of B is the same as first multiplying a and B together and then encrypting so what might happen if we were to create a PPS scheme that doesn't only just do homework but also does homework multiplication that would actually give us something that performs fully homomorphic encryption there hasn't been any epsp scheme that does fully homomorphic encryption so far but it might be interesting to consider how much more how we would get from including this at such speed we're going to quickly look at you non-aryan approaches one is that C which uses the context overlay model they use DK starts for performing on financial transactions and they actually have an even stronger notion of privacy than the one you define in addition to hiding the inputs and outputs of a function they also discussed hiding the function itself so what we can call function privacy however to achieve the efficiency that they're talking about if also an expensive scheme and the sense that can mean hundreds of gigabytes of RAM to get the proving types of compound and there's a second one from Oasis class you don't actually know if they're announced today are just gonna refer to it as the project from Oasis labs they use trusted hardware which does not satisfy our notions of security and privacy with cryptography and we're just going to gloss over their work but they're also in this space so briefly we'll talk about some comparisons between the type so it's really difficult to actually compare these technologies because they all accomplish similar things with different techniques it's they're just not really that easy to compare together directly but they do satisfy some properties you can discuss such as performance privacy the interactivity involved in the cryptographic security use so fully homomorphic encryption and it's complied entirely compute bound so the performance route is basically built on as a zombie just depends on how long a computer can actually perform these really intense operations such as an fft the privacy is also based on the encryption scheme which if you're familiar with any cryptographic security assumptions any standards we can say that you know usually just the SteriPEN its ie D CPA security it is not interactive meaning that you don't have to interact with a bunch of people for this computation you'll need to go to the computing party scripts today they give them a cake and they can usually perform the computation on it and it also satisfies some cryptographic security as well so we know that when we do plan on working encryption we know that it's going to satisfy math and I think our problem that's not you can solve it like I said QVC is network bout and then becomes an issue when you have more participants in it it's based on an encryption scheme and not a collision of that people privacy so a first major secret sharing your the same thing that your friends won't get together and try to screw you over it is interactive so it doesn't sound like that and the cryptographic security is somewhat similar that requires usually ask some fairness assumptions that requires you to listen zero knowledge groups - - good trusting hardware is kind of you know in my opinion it's just based on hardware security which you've been paying attention to the space recently you know we have spec the spectre meltdown speculative execution italics that like we've been trying for years to make secure processors and they're not working out that well so it's time the advancements that's going to take to make secure processors and real secure thing it's much longer than it will be to take these theoretical advancements to improve these rfh here at PC so let's just move on and do actual provable security and not just deal with the stuff that kind of but doesn't work so I have a contract approaches so far we've already seen Caesar and it really optimizes for security and the principal sense the frequency not attack but arguably they're not as VP sec they're just trying for confidential they really optimized for its efficiency Saxena is a fantastic job optimizing drives the and clock which we haven't really mentioned but is a lesser-known project that Z cache doesn't really do a good job of any of them however it's the most important thing to focus on is that none of the approaches so far has actually tried to optimize her functionality so it might be interesting to consider what happens if we pick a ppsv scheme what happens if we think of PBS DC Steve that optimizes for security privacy and functionality and gives a little for efficiency and compromises a little bear instance and for everyone else in the room that might not care so much about that when you're developing your own PBS fees you should really look back at the chart and consider which of the four properties you've seen do you really want to optimize for so that's it thank you so much thirty seconds yeah one question yes yes they might consider bulletproof more secure than starts and starts more secure so I do think Starks and more secure than starts I don't really a very trusted set up security can be compromised if the cronies pollute together and I think knowledge of exponent is a non-standard assumption that's not well understood so if I personally as a photographer but if feel comfortable using it other people might feel differently but according to my definition I think sharks are a little less secure than Starks the little critters and why bulletproof bulletproof sir based on discrete log and the discrete log problem and that's a very well understood cryptography assumption that's been around for a long time yeah yeah but the bullet proofs are based on discrete log only if you make them interactive right make them non interactive to require random or the same yes series one of you a free mother no thanks I don't know if that's true I agree random Oracle is a slightly non-standard cryptographic assumption and a lot of things you said you want to add return a frequent interactive you almost always need the option where you're going to get a random particle out so it depends first in a person what you feel most comfortable with I think this is just an opinion and I understand that other people maybe not know feel so comfortable of random articles and don't want to use from any cryptographic use cases it would be better for us to utilize things it's great that people want to utilize knowledge of exponent you know honestly help us find you know understanding bar has people implemented but for many years cases where we want to build for the long-term future we want to do stuff that we know and understand very very well now just thread and work alone which is the discrete log problem as well so yeah I'm also agree that knowledge of exponent is not very well and as well there's either discrete logic or rather part of the model but between their own the same kind the argue it's not been it's like well study and used quite as much time it's better than understanding but I'm happy to talk with talk to you about this like after it's a crystal incident and even setting aside the hardness metric obviously the trusted set up one of the dots that's also part of security at least times that's partisan yeah yeah but I think we can argue that the ZTR locality years River into the already returning from girlfriends thank you you literally need a girl interactions in technology but it's actually these people they just absorb it [Music] cool thanks [Applause]