Remi Gai I Augmenting EVMs with FHE to Enable New Use Cases I Inco I Pragma San Francisco 2025

[Music] our second last Talk of the day is going to be super super interesting we're going to talk about how fully homomorphic encryption is actually becoming more and more practical we're going to talk about how you can actually think about what that is and get a better intuition and how inco in this case is specifically applying the to the evm with custom op codes to do fhe so please welcome REM on St you talk about F on the evm give him a big round of applause hi everyone so I'm Remy the founder of inco what we're building is what we call the universal confidential Computing Network so today all the L1 l2s have one thing common is that there are transparent databases so what does it really mean we actually believe that there needs to be a minimum of confidentiality necessary for Mass adoption so I'll give you a couple examples if we were to actually on board billions of people to Bing systems today it would actually be social chaos because everyone's bank account would be completely revealed and you wouldn't be able to do payroll in a confidential manner institutions and Enterprises are still having a hard time entering this space they have Trade Secrets they have compliance reasons uh and private blockchains are not quite the same because they don't have the same level user base and so overall you know the lack of confidentiality is still very problematic and lastly there are just a lot of use cases that wouldn't make sense without confidential computes so think of like maybe the the car games like poker for example uh private voting or blind auction so what we're building is we what we believe to be the missing layer of the Bing stack the confidential computer layer so this is is very similar to you know back in the early internet when nothing was encrypted you could only do academic research it was really until SSL came to B to you know now you can start encrypting credit cards uh payments you know so this is where we see you know confidentiality being a missing layer and missing stack that's quite crucial for practical adoption so who has heard of FH here by show hands okay great so for folks who have never heard of this it's a very different cryptography than ZK uh so what it does is one thing only and very well which is encryption but also comput on top of encrypted data so what does this mean so for folks who are not uh technical imagine having the ability to encrypt a picture like this Q picture you can still modify the pixels using math you can add divide multiply and by the time you decrypt now you have a filter right it almost sounds like magic but so this is what really what F enables is computation on top of of some kind of encrypted data without seeing what it is and so f is not new it's been around you know this concept has been around for 40 years now it first came in the 70s uh with privac privacy horom morphism back then it was just Pure Fantasy it was more of an idea what if we could you know enable something like this it was really 20 years later the first proof that this was somewhat possible uh with the p crypto system where you could do you know some additions and you know the challenge with FH is that you know when you encrypt data you have this thing called cyberx so essentially you have some data some data padding some noise and some noise padding as you compute on on top of these cyber Texs there is this noise accumul accumulation that basically builds up until this Cy Tex is no longer valid so in 2009 there was another breakthrough basically uh came up with with um qu Gentry uh with this concept of boost wrapping so what boost wrapping enables really is the process of den noising and so you can basically keep the noise in check and keep on performing operations but that process was still very slow until 2021 with this concept about program with bootstrapping which makes this boostrapping process a lot faster and efficient and the way you scale FHA is actually using hardare acceleration so you know uh FH is actually compute bound there's no networking time you don't have to communicate across different nodes so the way to scal is using specialized Hardware that are specialized to you know support like uh operations that are that are more specific to F here and a lot of these Hardware are actually coming out next year so you know the path to scaling is pretty straightforward and also happening pretty soon so why you know FH is interesting in terms of a confidentiality solution so there has been you know a lot of Legacy Solutions uh using ZK uh so here you know we can call them commitment based uh approaches uh versus you know FH which is encryption based approaches so there are a couple differences here so first first of all the way you approach commit based solution is the user would basically generate a proof on the on the client side so you know it's actually the compute overhead is actually offloaded offchain uh with encryption based systems typically you need the blockchain to basically do all the stage transitions uh for every single user so there's a difference here in terms of scaling in terms of privacy uh commitment Bas solution you can argue is more private because each user has their own encryption key and their secret actually never leaves the clients right they every time they generate Z proof they also attach it to a viewing key for let's say the recipients and so in a way it is more private encryption based system essentially you end up sharing some kind of decryption key so you know it could be a single private key that a system uh utilizes or it could be NPC based right so but the idea here is that you have to delegate decryption to a third party Authority so you can argue it's less private because there is this risk of collusion but there are benefits to this right so when you delegate the decryption key to a third party you actually make making decryption rules a lot more flexible so what do I mean by this in a commitment based system essentially every time you have to delegate this viewing key you have to specify viewing key to a recipient right but what if this recipient loses um his or her key or what if you want to delegate this viewing key to let's say your accountant right so this system is becomes a lot more rigid when it's commitment based uh versus a encryption based system you can actually program the decryption logic let's say on chain and so it becomes very easy for you to you know uh spend specify who can view this uh included Seer taex the fourth point is really around this idea of composability so when you have a commit commitment based system you have this you know prover and verifiers setup where you know all all the circuits the logic happens offchain the private data happens offchain it becomes very difficult to compose across multiple applications because these states by default don't talk to each other you need a centralized Pro to coordinate these states so it's a lot more rigid uh but within encrypt like we said earlier FH allows for confidential compute on top of these private state so it's actually a lot more straightforward so you can have this idea of share private State and everyone can interact with this and then lastly key rotation uh so I mentioned earlier revoking a key uh in a commitment based system is actually very difficult right uh it's basically not possible you speci them ahead of time and so it's problematic if you lose your key uh but encryption BAS system you could actually rotate the key so you can do this over re-encryption or transferring directly using F here so what does this mean when you apply FH to the evm what you're really doing is you're augmenting the evm with new types and new operations so a couple examples here so you have encrypted integers e went you also have encrypted booleans encrypted addresses the bytes and then you can compute on top of them so you can add let's say two integers hidden integers together using tf. add you can multiply them uh you also have on Randomness that can be derived from FH here so the idea is re augmenting the existing evm with additional types uh that wouldn't exist otherwise and so there are many existing FH schemes around uh the reason why we chose the TF scheme which stands for f or the tourus uh is because it has a couple properties here that are quite useful so for one it supports a pretty wide array of operations from divisions to multiplications to additions it also supports exact computation so what do I mean that this um there are other schemes that are limited by you know first of all specific operations such as additions and multiplications if you want to support more complex operations they become approximations so you can imagine in a scenario of a smart contract what if your balance is never accurate right so that that wouldn't quite make sense so you want this property of exact computation over Cipher Tex and lastly it's non-level so some schemes are bound has to be you know are bound by levels so what I mean is you have to know ahead of time how many steps how many computes you have to do and then there's a big bootstrap the challenge with smart contracts is you know you want a system that can you know compute any arbitrary logic and so you don't necessarily know ahead of time how many steps there's going to be right so this is where a non-level structure is actually uh very very um makes a lot more sense for the smart contract um use case here and so here from a high level you know what we're building is This Confidential compute layer for existing blockchains such as ethereum uh the major l2s and I know I just mentioned FHA this entire time but really this is a coordination across FH ZK and NPC so I'll just quickly go over you know how these uh systems interact with each other so on the far left let's talk about decryption so decryption is done by a NPC Network so what this really means is that the private key that everyone encrypts uh to for composability is never held by a single party so in order to decrypt something you need a threshold of these parties to do partial decryptions and then combine enough of a threshold to recate the pl Tex so this actually guarantees that you know no single party can start decrypting it runs balances you need some kind of threshold for computes we using you know FH so here you have compute nodes who you know based on the set of instructions whether it's addition multiplication divisions will perform these computations and FH has this property that's deterministic so if I add two sepex together the result will always be the same so this is where you know when you use something like consensus based blockchain you can actually verify the work that the work has been done correctly so if you think about you know this property is actually very interesting for the case of blockchains because block transparent blockchains the reason why they're transparent is because you need the ability to verify that every single transaction has happened correctly right but now with f because everything is deterministic you actually get the same property and because it's all cryptography based it's actually very aligned with the you know original Cypher Punk idea also using cryptography to self for privacy so overall you know applying F to blockchain uh is actually quite suitable in terms of form factor and then lastly the ZK piece so every time you encrypt something on the client side you want the user to prove that the cipher taex is not malformed because as you can imagine if the cyer tax is malformed there's going to be computation issues right later on and the second is the user needs to prove that they know what the PL Tex is the reason why is you know what if someone copy pasted your saex you know by looking on chain and then deploy it somewhere else right uh to decrypt it then there's there going to be information leakage so this is where ZK is applied it's really just a proof of knowledge and also proof that you know the seex is not malformed so when we launch mayet we enable folks to directly write F code on top of etherum and also existing L1 l2s and with that what you really get is the ability to you know tap into the exting user base and tvl so you don't have to move to a new new chain you can just let's say deploy a poker game on Arbitron or build let's say a payroll system on ethereum so how does this work right how do we get ethereum for example to run FH so from a high level you know so on the right side what you see is an example of a cyer tech so this is the encrypted data and on the left side is a handle so you can think of a handle almost like a the key to the value so it's like a key value pair relationship and you can think of the handle as like for example the hash of the CeX so what you're storing on ethereum is really just the handle or the representation of the seex so when you do something like a FH ad on ethereum what you're adding within the parameters so here it's Alice balance also the HL these are two handles right these are two Cypher Texs what you're really doing is a symbolic execution meaning that you're actually not running FH on ethereum what you're doing is you're creating the third handle and the third handle is just a hash of the two previous handles so what this really means is everything that happens on ethereum is actually just a mocked operation or it's a symbolic execution and this will later on happen on Ino essentially we will do the actual computation so Ino will be abstracted away from the end user perspective and you will be able to write FH logic directly on top of existing EVMS and so let's talk about use cases now why is this interesting it's interesting because if you think about this concept of private state it actually exists everywhere it's literally how we build things in web 2 if you want to build something like eBay in web 2 you need to be able to Shield everyone's bids right and this concept of private States just doesn't make sense in current blockchains because everything is transparent everyone everyone has perfect information and so this is where you know we can grow the pile what's possible across different verticals you know gaming def Asset Management infra gaming is probably one of the most interesting one because if you think about all the fun games that in web 2 they all have some kind of hidden mechanics right whether it's hiding your stats your resources uh your your cards right um and these are all the missing basic Primitives that makes the game fun that that they don't just don't simply don't exist in in uh in web 3 today in terms of you know simple payment systems such as payroll uh cap tables real assets everything is transparent today so there needs to be something a bit more practical some minimum confidentiality else like I said earlier on boarding billions of people today in web 3 is actually would be social chaos it wouldn't make sense for my neighbor to know how much money I have right it can actually put myself at risk it doesn't make sense for everyone to see what I voted right let's say a presidential election right I know families who don't talk to each other because they have different views on politics so there are a lot of practical reasons why confidential computer is necessary and you know privacy really is the Spectrum you have confidentiality and anonymity right but what people a lot of people don't realize in crypto is you know it's not about necessarily hiding your tra it's there just so many so much more that you could do so let's go over a couple use cases here so in the most basic case it's just a confidential erc20 uh for folks who you know understand solity the way this is implemented is just the mapping of address to eent so encrypted integer when you do a ec20 transfer you're adding a hidden amount to you know someone's hidden balance pretty straightforward for something like a car game you know we are able to generate hidden cards using FH here and uh as you know poker is a bluffing game it wouldn't Mak make sense if all the cards are public and so this is quite convenient because you know vrf has existed for quite some time in crypto but they are transparent uh by default and so a hidden vrf I say is probably a one one of the newer primitive uh are quite useful here for for games uh we actually built this a year ago uh during East Global and uh so who has played game Mafia before or werewolf I show hands yeah so this is a bluffing game so you know you generate different roles you could be a secret killer doctor or detective this game would not make sense if all the information is public right and more importantly I mentioned this concept of private state or share private State earlier and composability the reason why this game is so easy to build and was actually built over 24 hours is because the blockchain itself is the share private State layer so the players can directly interact with the smart contract in a permissionless manner any state transitions coordinations all happens at the Smart contract layer you don't need a you know op improver or any other option systems to basically coordinate some other benefits you know if you think about something like a private amm uh where you get to trade tokens there's this natural me protection as well because your intents are sort of mess right if the the bot don't know how much you're trying to to swap and the PS are encrypted there's no way for them to know front run you and then send send attack you right and then another example is pride voting so you know the idea here is that you can directly cast your votes uh the way you do this in practice is you can encrypt your your choice and then using essentially um I can go over this real quick uh because we have a little bit more time here uh essentially when you write confidential compute code you cannot use IFL statements because eel statements actually leaks information about the underlying encrypted data right so there's a clever way to do this over FH here called CMO or select it's essentially a Turner so in the first line of code for folks who can see here so um if the encrypted choice is equal to one you know you will return a encrypted Boolean that will actually be true but it's actually encrypted right what you do is you pass in this encrypted Boolean into this turn function called caox that Returns the actual V count if it's true and then zero if it's false but it's both are actually encrypted so you cannot tell if it's true or false right you you do the exact opposite for against which returns zero if it's true and then the VC count if it's false so now you know one of them is going to be the actual VC count and you add both of these to their respective Tes so you can see how you know building confidential computes uh smart contracts actually does require a little bit different design thinking but it's actually very feasible to you know run conditionals without leaking the underlying information so we are compatible with existing ethereum to tooling so this is where get you can get started very quickly uh if you know solidity you know how to use hardhead U mamass remix then it should take you less than 20 minutes to get started and in terms of FH we are able to support quite a big range of operations today and comparisons so it's really up to you to you know think through what novel use cases can be built um using these tools right if you want to build an amm there there there is division if you want to build a simple governance platform there are additions and comparisons so it's really up to you to you know um just figure out you know what else what's new and then you know we're always happy to provide you feedback uh if you have some interesting ideas so you can find our documentation here uh we we have some demos with this arcade page and uh yeah definitely join our Discord and telegram our team members are always online to you know answer questions and also help you provide feedback on your ideas thank you [Applause] [Music]