# From Auctions to ZK: An Educational Tour of MPC Tools by Aisling Connolly | Devcon SEA

- Speakers: [Aisling Connolly](https://streameth.org/speakers/aisling-connolly)
- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 25:33
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-fC44nTlYz4w
- YouTube: https://www.youtube.com/watch?v=fC44nTlYz4w

## Description

Ethereum made a significant contribution to the Cypherpunk agenda by removing central points of trust, allowing us to gain accountability, yet losing us any semblance of privacy that we had. There is hope at hand for privacy, but hope, in this case, is rather technical.
This talk aims to bring you up to scratch on privacy preserving tools while discussing S{N,T}ARKS, TEEs, FHE, how MPC elevates them in a decentralized setting, and highlighting their use from Auctions to ZK, from the 90s til now.

Speaker(s): Aisling Connolly
Skill level: Intermediate
Track: Cypherpunk & Privacy
Keywords: Zero-Knowledge, MPC, Homomorphic Encryption, confidentiality, computation

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] thank you for the introduction um that was quite I think it's uh I should have wrote to someone earlier to ask if I don't go after Amir because like it's really hard to follow somebody who's so full of energy and so full of like good ideas and yeah principles that we should follow more and more um so yeah I will talk to you about MPC basically um some some of the tools that can provide some of the Privacy expectations that the cipher Punk values might actually benefit from um I'll give you an educational tour of MPC so from auctions to ZK my a toz uh I don't know if it works is there a way sorry is there some um special trick this yeah okay hello so I go back to the start so yeah I want to give you a bit of an overview of uh NPC from A to Z which uh if you know about NPC use cases it's from auctions to zero knowledge and so one thing I wanted start by and maybe uh this room kind of appreciates this is that cryptographers are not Cipher punks and I think I come from a background of cryptography and there is a tendency in the cryptography Community to think that because we build the tools that can you know help us exercise the freedoms and the cipher Punk values that we want um we do feel like we are some sort of rebels but after quite some time now I kind of realize that's not actually the case mostly what people like what the cryptographers actually like to do is push symbols around to try and make some proofs of security and feel uh smart and so this is uh this is great and it's really cool that we have a secure protocols but it does not make them Cipher punks and it does not result in the sort of Freedom tools that the cipher Punk values maybe need and the T types of things that Amir was talking about just now um so yeah cryptographers are not Cipher punks and this is why I kind of put it in this in this um in this session in the cipher Punk session rather than the uh applied crypto truck and so I think in building uh kind of Freedom tools or you know privacy preserving tools it's important to kind of understand some of the cryptography and so yeah this is why I want to give you some view of MPC so what has MPC been used for and first of all does everybody know what I mean when I say MPC okay one two three people so NPC stands for multi-party computation um is there anybody like who has absolutely no clue at all what multiparty computation is okay one person at the very back you're too far back to uh no but anyway MPC is used for computing on encrypted data so it started in the 80s with coin flipping mental poker comparing integers small things and essentially what it is is that you know a user Alice has some data in her local device or in her machine and whatever machine she can Secret share it to a network and this network communicates nodes in this network communicate to do computation on her encrypted shares and they produce a result this is it essentially and so the first large scale kind of practical example of this was the sugar beat auction which was run in 2008 and this was a double auction to determine the market price of sugar beads um it was an NPC you run between farmers and a sugar processor and researchers in Denmark um it was super nice because everybody agreed that this was kind of needed and useful um the farmers didn't have to reveal how much they were willing to pay the sugar Pro processors couldn't you know take advantage of farmers and everybody kind of won so this was a super nice um example of an auction that was run in NPC something that um could have benefited from something like this is let's say the Constitution da who lost an auction because they revealed how much they were willing to pay and you know uh uh their competitors could see how much there was in a public wallet before and um another one was the Boston wage study so identifying salary gaps across gender and um ethnicity so this was done in Boston they did uh NPC saw like a private computation across uh census data to try and analyze whether there was a disparity between gender uh wages across genders naturally they found that there was um and they found I think it was 30% maybe it's too small here oh yeah it was 30% I think in 2016 when they first did this study um and they did it again last year no 2023 yeah last year and it had decreased to 21% so by doing this kind of study um at least you become aware of some problems and then maybe you can actually start try and solve them um which is quite nice for society um there was also an Estonian student graduation so I don't know if you notice we are also doing a bit of a tour uh of different countries here and these countries are where a lot of the main NPC researchers are actually from and so it's kind of interesting also geographical tour of MPC but this uh study was uh to try and determine if um the Dropout rates in it studies were due to people working at the weekends uh if their part-time jobs were interfering with their studies and causing them to drop out and this was particularly important in Estonia because they became um much more technologically relevant country and they needed a highly skilled it Force but they had high Dropout rates so they were really trying to increase like uh the education of it Workforce they actually found that there was no correlation between these two things but the which was a bit sad for the study but like at least um we got a nice example of MPC out of this so it was run between the Ministry of Finance and the uh University so uh another one was then then things start to turn a bit weird and all of these things kind of had like nice societal uh implications um but then you know uh the tooling and the MPC protocols became a bit more efficient and they started being picked up by big Tech and the Google so Google had this experiment with MasterCard I can't remember what year 2017 is 18 maybe where they wanted to achieve the Holy Grail of advertising so this was the headline at the time and so Google as you know has like a very predatory ad model where they try to um mine things from your information and the Holy Grail of this ad model is essentially linking um your online activity with your payments Google doesn't have all the payment information but MasterCard does they can't compute together like MasterCard would never be willing to share uh people's information with Google just in the clear um because it's first of all illegal due to whatever privacy regulations and consumer protection reg regulations but Google also would not be willing to share um their information with MasterCard so they had some sort of blocker where they wanted to get around and they were like okay we want to compute on each other's data but how can we do this in a legal way um so they did um an NPC between some Google and MasterCard to do some aggregate statistics so saying I show you an advertisement for um some privacy bracelets on your uh browser um did you actually go to the store and buy privacy bracelets or how many people went to the store to buy privacy bracelets after they saw this ad so this was the kind of thing and then another one um worldcoin Iris scanning so this is maybe something that you've actually now it's called world I should have updated this but um this is where an orb scans your eye and tries to do some uniqueness checks so that people cannot register more than once um they got a knock on the door from some regulator saying you know how are you processing this data where is it all stored and so then they decided to um do some multiparty to split this data and do some multiparty computation over it and so these last two cases kind of start moving moving towards the dystopian maybe I shouldn't say this but like Realm where you know people are kind of doing MPC to sort of sidestep uh regulation and so I think the cryptographer point of view is a bit like you know okay there are problems in society and we have privacy issues like just throw NPC at it like just throw some crypto tools at it and that's all fine like your problem is solved um but I don't think this is necessarily the case because like with the Google MasterCard uh example there was really kind of a lot of not uproar but like discussion at the time about whether this is actually good or not like um is it good that now Google and MasterCard can collaborate on our data okay sure I can't be singled out it's not my data necessarily but like um as a group we all kind of suffer because Google has more power and so this is a bit questionable um so it's not really like just throwing MPC or just throwing cryptographic tools at a problem doesn't necessarily solve the Privacy issue that kind of underlies the whole thing and so the question then I mean like I think is it possible to solve these you know like how do you start to think about solving privacy issues or like you know um adhering to these Cipher Punk values with cryptographic tools and there are some super nice examples which maybe you have actually seen at this venue so one of them is from cursive who are um a small team team who are building privacy preserving applications and they are doing uh private proof delegation so this means that um actually you have these badges or some stickers or some uh uh coar bracelets or whatever they're downstairs in uh in the main hall just after the registration you can go and essentially it's a a a chip that you can tap with your phone you can enter your socials and then when you tap other people's chips you can do a private intersection of your uh common connections so the common people that you've met and tapped and then you generate approve on this uh private intersection to prove how many connections you have in common and then you can write up the leader board rise up the leaderboard and get some merch um crypto conference style and but the reason that this is interesting uh is because you know as uh Things become a bit more complicated the proofs get big and actually your phone gets slow and um you know these things need some libraries for verification and proof generation and all sorts of stuff so sometimes it becomes a bit restrictive to actually do proof generation on your phone so then an answer might be well why don't we actually start delegating proofs and you see this a lot lot with I think um the development of proof markets so like all these proof Markets started popping up over the last years to say like ah hey we can you know have some pure beefy machines that will generate your proofs really fast for you which is great but like if you have any sort of sense of privacy at all this is terrible now because now you're just Outsourcing all your private data to This Server who will generate proofs for you very quickly but um yeah you don't get any privacy here uh you Outsource your proof generation but you do it in a secret uh shared way like in this MPC way um and you generate the proof over those secret shairs and so um this is being done now downstairs not downstairs but like in the internet you can see it downstairs um so yeah this just happened yest today and when I say actually you can Outsource this to a network this network is not this uh mystical being in the sky as it has been for the past 20 years now it is actually live um so there's one Network that has run between us T the cursive guys who built this nice uh cryptographic connections app and the psse group so each of us are running um a bunch of notes that are generating these uh proofs on these uh secret chairs so yeah go down and see them if you want to actually feel ly in your hands there's also actually an MPC exhibition that you can learn more um of the history so yeah actually what they're doing is collaborative snarks generating collaborative snarks which is just generating zero knowledge proofs in an MPC Network currently they are using our tooling actually to do this which is um available for circom so if you're used to building circom circuits or noira circuits which is up and coming and getting lots of hype this week in particular and now you can use our tooling to do the same thing but in an MPC environment um so yeah that's snarks and so yeah all the stuff that you will generate here are clabber of snarks and so uh how is all of this stuff actually leading to these kind of new nice things that are not just getting us around regulation but like this actually cool solving privacy problems kind of tech and I think the most interesting thing that MPC is kind of enabling now in this blockchain world is this private shared state so you have these um private blockchains or l1s or l like Alo and Aztec who now have zero knowledge smart contracts and they have like private State and sometimes public State and you generate proofs on your private State and you can do stuff with the public State and interact and this is nice but in a sense it's a little bit limited because the zero knowledge proof is just a statement about a fact and like it's very difficult to actually do computation with that and so um if you can instead have a sort of MPC Network where you can maintain your privacy you can actually do more Leo you can actually do computation on all of your private State instead of just um having zero knowledge proofs in public State and so um you remember this picture from before we had like one party secret sharing their data to nodes in a network now I think the interesting part with private shared state is when you sort of introduce other uh players or other entities so now you can take um secret like multiple people can uh share their data to a network in a privacy preserving way and the network can do uh computation over that and I think this is super nice because we don't have to start revealing things to anybody we don't have to we have like all full general purpose computation and not just kind of workarounds with Z knowledge proofs so for me this is like the most exciting thing that is happening in the crypto world at the moment so I think with that like the Privacy conversations becoming super nicely nuanced it's not like full like privacy is not secrecy necessarily it's like you're not like completely black boxed and tied off from everything and nobody can see my data and no one can touch it and I can't even use it and like you shouldn't learn anything about me and it's not like fully open like everything on ethereum if I interact with the chain like everything is public and everything is recorded forever um now we're kind of finding this like somewhere in between this All or Nothing approach and for me this is super nice because in my life in my day-to-day life I come here I stand in front of you I want to be seen at times but I also at times don't want to be seen and I want to choose like I want to have the option to come and like um see people and I want to share myself and my thoughts sometimes but I also want the option to not so having this sort of um and I also want to sometimes avoid some people and talk to some other people and whatever like so having this um nuanced view is super nice and so if you are sort of MPC inclined but not necessarily A cryptographer how can you start thinking about these and I think one of the things that we're seeing is like okay you know I get excited and I'm like oh look it's like it's live you can actually use it now it's great um everybody should do this like and some people are like wait no though like because I mean like Amir like he's talking about super serious things where people are like dying and whatever and it's like okay yeah maybe like my little MPC Protocols are not for that case and like the question then is like okay who are your adversaries and how much power do they have and so like I said to you before that we are running these coars on the network which is established between oo um PSD and T and uh cursive so in a sense you're Outsourcing your work to us and you're Outsourcing your data to us so in a sense you trust us you trust us not to collude because if we all come together we can reconstruct your secrets and so one question that you might ask if you're starting to think about these things is like how many people need to actually collude is it like all of them is it just one of them as long as one of them is honest is it okay and so there are different models and different tradeoffs that you can make and different levels of efficiency and things like that so another one is then yeah like different Notions of security so like okay if if somebody can tamper with your system how much can they do and so I think the most common model of things that are running now is this semi honest security so like parties can become corrupt but they will follow the protocol as normal so maybe there's some information leakage maybe you like learn some stuff by uh observing the network but they still follow the protocol and then there's kind of the worst case situation where you kind of try to protect against militia security and protecting against this means that or like adversaries that can break Security in this sense means that they can control and manipulate and arbitrarily inject messages like they can just completely destroy your system so like if you are running an election let's say in an NPC and you have a malicious uh like if you um have a malicious adversary they could you know just change the results of your election like you know you have nothing so if you want to protect in this kind of situation it's super hard and you're not going to have much efficiency that's for sure um so yeah what about efficiency I think um I mentioned a few things the worldcoin example the cursive example I think these are two nice examples of things that are running in production which I think are the kind of things I would hope the sort of Cipher punk people would care about more than the theoretical people who care about the math um and so in saying that the difference between specialized protocols and like general purpose computation um is quite different so like you can do like highly highly optimized stuff um as in the case of worldcoin and they are doing un uniqueness checks you do about 40 billion checks per second and okay that translates to okay you have two eyes and you know you have many readings and your iris is pretty like uh data Rich um yeah it's data Rich so it's a lot um and this translates to I think about 15 people uniqueness checks per second and so these curse of coars that we're generating downstairs not downstairs but in the network um are about 12 seconds each but 11.9 like like the vast majority of that is the witness extension so this is like the actual NPC part rather than just the proof generation part so proof generation is very fast but witness extension is not too bad so this is where it's at now and so uh that's it for me if you have any questions I will be glad to take them thanks very much thanks so much for your presentation Ash um we've got a couple of questions uh here on the docket um but before we ask those questions I meant to actually mention one fun fact about Ash here is that uh she actually was an MC just yesterday so she knows how it feels I know I know how you're feeling right now after like 5 hours I was like I don't remember anyone's name I don't know what even this topic where are we this was a great one though even though it was technical um but the first question here is when kir kir is now there like now now you can use it so um yeah if you go to the TSO GitHub you can go and find uh kir and play with that awesome and then what's the difference between ZK with MPC versus FHA computation well um I did I I resisted saying things about FH so is great and like is a super ultimate goal for privacy because even if like there is collusion in the network stuff is still encrypted and you cannot like uh it's like a better level of privacy but it's hyper inefficient well like it's uh it's super inefficient so I think um we saw at CK Summit recently if you wanted to generate Zer knowledge proofs in an environment it was like like order of minutes rather than you know tens per second so it's uh just low and I think FHA is often considered a specific example of MPC MPC is super General so everything can be cast essentially as MPC but uh yeah FG is just slower thanks and uh the next question is about NPC wallets is it the future and what are your thoughts on NPC wallets generally I also didn't mention NPC wallets and I was going to make a comment about that so for me I mean when I mean MPC I mean like general purpose MPC like general purpose computation for me MPC wallets are kind of threshold signatures and things like this so it's a little bit of a special case and like a kind of a sub um sub computation it's just one type it's just generating signatures essentially so it's kind of a small part of NPC um super efficient I quite like them personally we don't work on any of that stuff but um I I like it yeah they're cool cool um and there are a couple of questions that are more about the yeah your opinion on things but first one is how do co- snarks work how to co very briefly in like 20 seconds if you know how ZK works you take the ZK and you split it over uh three people like essentially like what is needed to compute is zero knowledge proof is essentially linear so you just do it three times and you communicate and you get one proof in in a nutshell okay and what do you think of te or T and what is tea did this question come from someone who knows me or someone who doesn't know me that that makes all the difference so te is a trusted execution environment and it's like a super Hot Topic at the moment um I think they're wonderful and um no so the thing is with tees they're great and it's a it's a Super Hot Topic at the moment they're quite easily breakable so I have sometimes been critical of them in the past which is why sometime I'm wondering if this is someone who knows me but uh I think it's good like so with the coars we talked about um the collusion problem and you know I said that in this network let's say that we are running now you trust the three of us not to uh collude and so tees are one defense against this if you sort of run the MPC in a te across you know the nodes and the network um it's one nice defense and also like I as I said te can sometimes be a bit weak um if you use three of them from different uh providers then like spread them around the world it's also a lot better so ultimately I think um yeah we're going to see that happening very soon cool thank you and um I think we have time for one last question how does the MPC Network receive private data is it in the encrypted format for snark generation yes simple um I mean it's encrypted like across the internet but overall like before that even from your phone it's sent it's split into secret shares which is seen as can be cast as a form of encryption so essentially you encrypt it on your phone or your local device and then you send it to the servers cool okay I think we got one time for one more can we remove initial trust set of MPC what's the initial trust set I wonder um so like if you talk about like the collusion issue um I think that's what they're implying is the collusion can you remove it I mean everybody's not everybody's working on it but like this is the big problem in NPC at the moment um can you remove it never fully I'd say um but uh yeah we try I mean one there are different options like running things in tees you can start thinking about economic incentives for people not to collude um but yeah this is a is a problem cool well thank you so much Ash and uh thank you you're a better MC than me you did a very good job thank you but you can find out