Easily add encryption and private data with Lit Protocol - Chris Cassano

foreign [Applause] [Music] thanks for joining us today um we have Chris here from lip protocol who's going to be doing a workshop on easilyad encryption and private data with lip protocol questions go into the zoom chat and Chris will take them as they come in so feel free to ask questions whenever and with that being said I'll hand the mic off to Chris hey how's it going everybody um I am so excited to teach you all a little bit about lit protocol it's uh it's very near and dear to my heart as you can imagine so uh very excited to to get to share some of it with you especially in the context of this hackathon where I think there's some really cool stuff that you can build with it so let's get started what is lit protocol lit protocol uh utilizes threshold cryptography to decentralize public key cryptography so what does that actually mean uh we all are familiar hopefully with public key cryptography and how it works and what you can do with it right you can um sign things with a private key that's like the basis of all cryptocurrency and you can also um encrypt things to the public key and decrypt them with the private key and uh what we do at lit protocol is we use threshold encryption to decentralize that process and so what that means is that there's a number of nodes in the network say you have 30 nodes and you can set a threshold um you could say 20 of 30. and what those nodes do is a process called distributed key generation where they generate a public-private key pair that uh Nobody Knows the private key to the nodes each only have a share of that private key and they can do everything that you can do with regular public key cryptography with that private key share so they can sign with that share and they can decrypt with that share um the uh the user then can collect say 20 out of 30 decryption shares or 20 out of 30 signature shares um and then can create the signature or decrypt the content um and so that's that's how atlet protocol we decentralize access control is because there's a network of nodes that are running that are actually they check conditions and then they use their private key share to do an operation for you um okay so we uh I've talked a little bit a little bit about on-chain credentials that's generally what lit protocol uses to check if you should be allowed to decrypt something or receive a signature for something and what are on-chain credentials well you know it's data that lives on chain generally as some State inside a smart contract so it could be like does a user hold an nft are they in a Dow do they hold some amount of Eep um you know it could also be like do they own a specific wallet address and uh it could even be any smart contract call so you could you could write a smart contract that you know does all kinds of crazy logic or pulls in all kinds of things from all over the chain and and then uh you know spits out a true or false and you can use that to as a condition for whether or not someone should be able to access something so how does this actually work um the user is over here on the right and on the left of this graph is a blockchain and basically on the right the user requests either a decryption which is this key icon here a key or a signature which is a signed a JavaScript web token also known as a JWT and what the user does is they uh they talk to every single node and they ask for a decryption share or a signature share and with that request they also send a signed wallet message from signed by their their private key so what what that does is it lets the nodes actually check um does this specific user meet this condition and by checking the user's wallet signature the nodes can also confirm that the person making the request is who they say they are and that they actually own that ethereum address and so each node independently and in parallel will check the condition on chain with an RPC call so if you know if the condition is like does the user hold an nft then each node will check like with an RPC call does this ethereum address you know is the the balance of this ethereum address of this nft is it Greater Than Zero um and if the condition is met then each node creates a decryption or signature share using its private key share the user collects all of these above the threshold and is then able to encrypt or sorry been able to decrypt or um receive that JavaScript web token that they can send onto a server so what can you do with it there's basically two uh two main things you can do with it two like main Paths of usage um one is for locking static content via encryption and another one is authentic authentication for dynamic content via the JWT and so what what that means just to be clear is that when you use the SDK the lit protocol SDK which by the way is a JavaScript SDK it should work in the browser it should work with react it should work on node.js on the back end um it should work everywhere so uh that that's how you'll actually interface with the network is with the JavaScript SDK and it can basically give you two things as output it can give you an encryption key to decrypt something or it can give you a JWT that's signed by the actual uh the network of nodes itself so um on the encryption side on the encryption key side uh there there's a lot of cool stuff you can do you can do things like um encrypting and locking media files um you could do self-contained lockable HTML nfts um you can do any kind of d-web document encryption so we we have a ceramic integration that I'll go over in a little bit um and generally like any private data that is not custody by a third party is um is something that that the encryption is a good uh candidate for um and then you know the the final thing is what I like to call the Ready Player one uh like idea which is um if any of you guys have seen that movie it's like a guy like locks up a bunch of money um and then he dies and then if anybody solves the puzzle they can get all the money um and so that's like one thing you could totally design with this you could have a smart contract that maybe somebody has to check in like it's a dead man switch smart contract somebody has to check in um and if they don't then you know the puzzle is unlocked and people can start trying to solve it um and so that's like that's one of the cool things you can do with it you um you know with respect to lens protocol I think there's a lot of cool stuff you could do with the encryption um you could like have like private Publications where the actual content and the publication is is private um and only people who like meet a certain on-chain condition like maybe only everybody in like you have to be in a mutual Dow with me in order to see my my Publications for example is one one thing you could build with that um just a second I'm going to pause here because I see some chat questions I want to make sure that I'm getting them oh yeah can we you encrypt Dynamic content like streaming videos um so yes um for dynamic content I think you would probably want to use the JWT uh which is the other um the other thing you can get from the protocol right so generally in our docs we refer to uh the encryption use cases as static content and the uh the authentication and JWT cases as Dynamic content and so with respect to streaming videos we do have a um a cloudflare integration you can use where you can upload your video to cloudflare uh cloudflare stream is the name of their product and it will auto like cloudflare stream will automatically transcode it into a bunch of different formats for you um and then automatically serve those formats up and you can use our integration that we've built with it to put any lit protocol Access Control condition on it so you know the user has to own an mft or whatever um and anyway so let's uh we'll go over Dynamic content real quick and I'll come back to questions um for dynamic content this is basically any content that's like loaded from a server um or content where you like have a third-party custody in the data um so like web 2 experiences um like we we have a couple Integrations with like Google Drive zoom and Shopify that we built um that you could play with um or you know build you could you should build something on your own that's like similar um if you wanted to charge for a web 2 API right like you know you have to hold this nft or you have to um you know be actively paying me on um uh one of the web or one of the the payment streaming services whatever the on-chain condition is um that you could absolutely use it for that it's also great for Content that receives frequent updates so like if you if you had like um a price analysis dashboard and you were like oh like people who are members of my club that hold my club nft can can see my real-time price analysis and it's like changing all the time that's a really good um a really good use case of the JWT um okay and one question we have is how large can the static content be um and can you set the unlock to be a time stamp or a block number so uh the static content can be as large as you want um it is up to you to decide where to store it right so we only provide the encryption and decryption you still need to like decide do you want to store it on ceramic or ipfs or are we or you know wherever so that that part is up to you um and with respect to the unlock being a time stamp or a block number um so that's not something that we support natively but remember I said that you can use any smart contract function as your condition so you could very easily write a smart contract that you know the function says if timestamp is greater than this you know return true else return false and just use that smart contract um function as your condition um and and by the way we support um all the evm chains pretty much and we support most of the test Nets as well so uh if you wanted to like use a contract like this but you didn't want to have to pay to deploy it on mainnet you can totally you know use it on any test net that that you want and so it could be free um the differences between lit and new Cipher I'll come back to that one at the end I think but thanks for asking that question that's a good one okay so here's uh some of the things that we've built with lit just to give you a bit of an example um so like Shopify Zoom Google Drive cloudflare stream gather town and WordPress those are all examples that use the JWT right because they're all pretty much like web 2 services that use the JWT for authentication to these services um and then down here you see ipf is encrypt sorry ipfs encrypted files and the unlockable nft Mentor both of those are use cases that use the the static content um the the encryption key use case um and let me actually show you some of these uh real quick here um just to give you a bit of a demo of how things actually work um it's like this is the ipfs encrypted files uh and uh I met a mask um and what this does is it lets you uh encrypt a file and basically specify um the on-chain conditions for who should be allowed to decrypt it um and then the encrypted file gets uploaded to ipfs um so I'll just pick a random document here um and this is this is what I what I really wanted to show you guys is um this modal here so this is a component that we provide um I'll post a link to that um in the presentation and it's also linked in our docs which I'll go over in a minute um but this is a component that we provide um you can use this within react or within any JavaScript environment um even just like a vanilla JavaScript environment and this is a component that you can use to let your users decide who should be able to access something so you could use this with lens for example like the example I gave earlier of protected Publications you could use this for user a user could say like you know only let the people in my Dow um decrypt my Publications or you know only let like the users that hold you know so many various weird tokens um whatever this token is only let users that you know hold more than one of these on polygon uh be able to read and decrypt my my content and um just to sort of complete this demo for you uh we'll say maybe somebody who holds more than .01 each can decrypt this um and like in in an example of this application like the user gets uh a URL here and so you could share this with people that you want to share the content with um and then when a user you know clicks download if they meet all the conditions it'll download perfectly and if they don't this one doesn't have any ethernet I think so this one should should fail when I click download um and by the way right here you can see uh one One requirement of using lit protocol is that the user has a wallet and is able to sign messages with those wallets or with with that wallet um so here's an example of that that signing process and so yeah you can see right here it says unable to download um because I don't meet either of these conditions right um because I switched to a wallet that doesn't have this amount of Eve um Okay so one other thing that we built that's was kind of fun was um being able to control uh Tesla with an nft and so um that that code is all open source if that's interesting um the way that it works just just see so you know to give you an idea of like the kind of things you can build in the architectures is that um a user like a Tesla owner mints and nft and then they off with Tesla and get like a token for for uh use to talk to Tesla they encrypt that token once um with a symmetric key and then they encrypt it again with lit and then the the symmetric key lives on like a serverless function we use a cloudflare worker for this and so when a user shows up and wants to like drive the car and they have the nft they first decrypt that oauth token with lit um but it's not fully decrypted it's still encrypted with a symmetric key that lives on the server they send that up to the server the server um validates you know again that they meet the conditions and then um the server decrypts the credentials then talks to the Tesla API on on behalf of the user and so like what's cool about that is that like the credentials only exist in their decrypted form like when they're being used for something they're not just like laying around where somebody could just show up and steal the credentials um okay features um yeah so let's talk about some of the different things you can do with with lid in terms of like some of the more advanced features obviously we talked a lot about provisioning an encryption key or JWT um we also support Boolean logic which is like and in ore conditions um so you can combine multiple things like the user has to be in a dow and own this nft and have like more than two each or whatever and you can use those across evm chains so you could say like you know this user has to own a crypto Punk on eth and be in a Dao on polygon and that's the only way that they can can access this content um we also support updatable or permanent conditions um by default when you use the SDK conditions are marked as permanent but there's a flag you can set permanent false and then that will let you update them in the future which will let you do things like for example if you want to revoke permissions um from from someone you could use an updatable condition to do that um we have multi-chain support as I mentioned we support almost all the evm chains um and we also support Solana and the Solana test Nets it's free right now and also uh you know full disclosure like we are building on a decentralized architecture but right now we are running all of the nodes as we progressively decentralize so uh I know this is like a hackathon so people hopefully won't store anything valuable anyway but um like right now I would avoid like you know storing anything high value in in lit until we can decentralize the infrastructure some more which is uh we're in the process of doing that right now and um we think it'll we'll have a more decentralized Network up within the next few months um and we you know like I said earlier we don't store anything for you um it's up to you to bring your own storage solution um then you can encrypt your stuff with lit store wherever you want um and then nobody can read it without uh meeting the conditions even though you sorted in a public place like ipfs and and ceramic and tableland are are all public um so this is the access control modal that I showed you guys earlier um and we have some some docs on this here uh with some different ways to to utilize it uh we have some example code where you can see where it was used um definitely check out the the docs those are available at developer.litprotocol.

com um and this is where you can find like basically everything you need about about how to use lit um oh right okay the ceramic integration yeah so that's a good one um some of you guys will definitely want to use this um if you're using ceramic and you would like to have private data on on your uh on your hackathon project you can use lit plus ceramic to do that um which basically means you're using lit or sorry you're using ceramic for controlling right access um and you're using lit for controlling read access uh because the data is encrypted with lid and only the people that are able to decrypt it are able to actually read that that data um and so we yeah we have a npm package that basically just like glues lit and ceramic together that might save you a little bit of time if you're planning to use these two things together um and we also have an example implementation that utilizes that package as well so if you're if you're going to use ceramic and you you want to have some private data um this is probably like a good good package for you um and yeah we have a ton of example code um so that's hopefully that'll help you get get started and get going a little quicker uh uh all everything from like just examples of how to use the SDK up here to some things like um here's how to use like a cloud flare to protect um any URL on the web um so if you if you like want to protect the URL that you don't have access to or a way to gate um because you can't control that server you could you could use put this in front of it the downside to using something like this is that like once the user like an authorized user has visited the page then they like have the URL and they can just give it to other people so this is like not an ideal way to protect content like what's better if if you're gonna protect something on a server um is to to use um like this example right here yeah this is a example to gate Dynamic content on a server and this uh what's better about this is that if you like meet the conditions and you go to the server and you get the page right you can always take a screenshot of course or like print a PDF or whatever but if you take that URL and send it to somebody else it won't work for them because every request requires that the user present JWT from lit which proves that they meet the conditions and the user that you share that with won't have that we like I mentioned I mentioned earlier we have um a cloud flare um integration for for streaming token gated videos from cloudflare um the ceramic integration that I discussed here we have the um the the modal uh the share model that I just discussed um and I think that's pretty much everything that I wanted to get through with respect to the documentation and things like that um and I'd love to talk a little bit about the differences between lit and new Cipher and then if anybody has any other questions or like if you had a question that you didn't want to write in the chat and you wanted to ask verbally because that was like really long or something um then you can pipe up and ask that in just a sec and so the differences between lit and new Cipher so new Cipher uses proxy re-encryption and lit lit doesn't lit uses um threshold cryptography and the the main difference is like with proxy re-encryption um like another person generally has to show up uh or not another person the sorry the original person that owns the content has to show up to Grant access to every new person right and so the example that we gave earlier of like ready player one and building that with lit protocol um you you can't build that with new Cipher right because like you're dead you can't show back up and Grant proxy re-encryption access to like the person who solved the puzzle um and that's like one of the the like use cases where lit protocol really shines is in um locking content up behind an nft right because you can put that nft up for sale and you can like go about your Merry way your life when somebody buys that nft from you you don't have to show back up and give them access to that data by re-encrypting it to their public key instead like you just like live your life you never have to show back up that person is just able to decrypt it by default um and when they sell it to another person that person is able to decrypt it in perpetuity um it's the same thing for like when you think about um is a user a member of a Dao right it's like the the set of users that's in a Dao is constantly changing it's like people are coming and going they're they're joining and leaving um and so if you had to Grant access like manually to every new user that joined a Dao and then revoke access from every user that left it would just be like a huge pain and so instead what we do is we just like check the blockchain when you want to access it to see if you meet the condition and then selectively you know do the operation of decrypting or signing only if you meet that condition okay somebody asked how is lit compared to unlock protocol and mintgate um lit is like a developer tool basically like we provide an SDK um unlock and mintgate are primarily like consumer tools so like they give you like a dashboard they give you um you know everything you like it's all like point and click basically um we we're like really focused on building out the SDK also like lit is actually decentralized I mean like it's not because we're running all the nodes but it will be um versus like unlock protocol and mint gate um are aren't decentralized they they hold on to the content um centrally and selectively release it what that means is that like if you're uh like an engineer at mintgate or unlock protocol or something like that you could just like go in the database and like steal all the locked content because there's nothing like stopping you right um versus like with lit it's like it's encrypted right it's mathematically secured so it doesn't matter like what privileges you have at lit protocol like we here at the company can't see your content and and never will um and then yeah we we've built a bunch of um a bunch of consumer apps like you can see some of them here um and so that's like one area of overlap I would say between unlocked protocol and mint gate but this definitely isn't our main focus versus I think it is theirs um cool I have about a minute and 30 seconds left I think does anybody have any other questions um comments anything uh hey Chris um you actually got a question in the Discord chat um Fernando asked can you elaborate on cloudflare related topic just mentioned um sure yeah yeah we have a couple different things for cloudflare um we have cloudflare stream integration which like this essentially lets you embed videos and live streams that are um token gated um in order to to use this you'll have to have a cloudflare account and a GitHub account and this little widget thingy here will let you deploy everything to your cloudflare account to um to make this like super easy to use and then it you end up with like a UI where you can like you know upload your videos set your conditions like it's all it's all very smooth the other thing we have for cloudflare is an example of um protecting any URL with a cloudflare worker um and this like you don't have to use cloud for this you can use any serverless worker for this but cloudflare is just like a pretty easy one to use so if you wanted to like verify a lit JWT inside of a cloudflare worker this would be the example project that you would want to take a look at awesome so it looks like that's all the questions that we have for now um if you have any more questions feel free to drop them into the sponsor lip protocol Discord chat where I'm sure the team will be more than happy to answer and with that being said Chris thank you so much for taking the time to do this awesome Workshop I can't wait to see what everyone makes and uh yeah I hope everyone has a great rest of your day or evening morning Wherever You Are yeah thanks so much for having me appreciate it of course all right bye everyone