Enigma: Privacy-preserving Smart Contracts for Ethereum by Guy Zyskind & Isan Rivkin (Devcon4)

all right hi everyone my name is guy Siskind I'm the CEO and co-founder of enigma and I want to tell you today how you can build scalable privacy-preserving smart contracts on aetherium so the problem with blockchain is that it's completely public everything you put on the blockchain is there for everyone to see and also forever that means that you cannot use sensitive data on the blockchain today and that's a big issue I'm sure you would all agree that any application today whether centralized or decentralized is going to need to use sensitive data in some form or another and obviously this greatly limits the potential applications that we can use with the technology so if you want to be a bit more technical smart contracts which is the unit of execution that we have in blockchains gives us correctness but it does not give us privacy correctness means that if you're running a computation then you can be then you can be guaranteed that you're gonna get the right result and no one can temporarily and that's great that's why we're really excited about blockchain technology but we need something stronger and a stronger definition is what we call secret contracts that provide both both correctness of the execution but also privacy of the data so in Ligue 1 is the first available platform for you to build secret contracts and execute them it is the first time that you can actually add and use sensitive information on the blockchain without compromising central is a decentralization enigma works by using privacy enhancing technologies that allow you to basically compute over encrypted data that's the main secret sauce the second part for scalability we take the position that execution should be separated from consensus block shares are really good at reaching consensus on small amounts of public data but they're not good at keeping privacy and they're not good its scalable execution so we have a long history of of actually doing this a few years ago we came up with these two ideas and we published these in two papers decentralizing privacy and the original white paper for enigma and these papers currently stand on more than 500 citations combined so they really become a cornerstone in the space and really they are they were the first to crystallize the ideas that if you want to have privacy in the blockchain you're gonna use some additional cryptography you're gonna use something that allows you to cut two computer encrypted data and on top of that if you really want to have scale you got a separate execution from consensus and you know I was here this week and it was really inspiring to see that so many other projects are actually taking that approach right now so maybe it's taken a few years but it seems that the industry is finally coalescing into the idea that execution and consent should be separated and that privacy for smart contracts is really important and we should not settle just for transactional privacy so I'm mostly going to talk today about the Enigma discovery Network this is the first network that we're pushing out right now the network has all the great features I told you it allows you to execute these secret contracts and it's scale but it also has other important properties its permissionless completely it's economically incentivized which means that we use some form of proof of stake model and I think what's mostly important for developers here and for this talk is that it's compatible with the fabien we don't want to make you choose between aetherium and enigma there's enough of you know copycat blockchains in the space what we want to do is make sure you can build the best decentralized applications that you can so we build a very seamless bridge and I will talk about it later on about how you can actually combine public execution on aetherium with private execution or enigma so the best way to the best way to explain the protocol is fer to discuss the stakeholders so as usual we have developers that write code we have users that then interact with these secret contracts with that code and we wear things kind of change is that we have workers workers are basically the nodes in our network that are running and executing secret contracts we use these definition to kind of separate them and not to confuse them with the theory of nodes and miners that reach consensus the basic architecture is as follows as I said developers deploy secret contracts to the network there's users can then submit tasks that's the equivalent of human transactions and that basically then gets executed on the Enigma network and final consensus is reached on ethereum for developers we support two modes of execution two modes of sorry of writing contracts you can use solidity which many of you know or you can use a web assembly enabled language primarily rust we're keeping solidity for backwards compatibility but actually Ross and webassembly have a lot more benefits we're seeing dangerously go in that direction and so if you really want to enjoy all of the benefits and scale that the system can provide you should probably use the web assembly route from a user perspective once a secret contract is deployed the user can interact with that secret contract by submitting tasks which are again they're the equivalent of ephemeral transactions the main difference is that a task can include encrypted inputs that the user supplies under the hood what really happens is that the user commits a proof of the transaction of the task on the freemium blockchain that actually helps us reach consensus on the ordering of the task so that the Enigma network does not need to do this and we reuse the trick all over all over the place whenever there's something small that we need agreement on and it's not a heavy computation we do dot on ethereum but the actual execution then happens on enigma which is a separate network the way that works is we start with it the user starts with a task right he sends the task to the Enigma network but which nodes is a task propagated to we're not using the naive approach that current blockchain use where everyone computes everything that is counterproductive to scalability instead we have a proof of state model where we sample a group a group of workers the constant sized group of workers to actually execute that task and those and and those group of workers are always weighted by stake which means that if you stake more tokens you are more likely to get selected to two more computations and that really increases scale that gives us a form of sharding that is fairly simple to implement and that we're gonna have up and running in about two months and then that quorum these Committees of workers they actually run these computations and at the end of an epoch so for performance reasons it's not just one computation that is each group is assigned to it's actually a group of computations that are bounded by time in an epoch and at the end of the epoch the workers submit the results back to Ephesian a theorem only does very small verification making sure all the state changes are correct and if that's the case the workers get incentivized if not they get penalized and slashed so I'm gonna I'm gonna go a bit deeper about the what a secret contract execution looks like internally what's important to understand here is that each secret contract has an encrypted state that's like a that's like an ethereal State for contracts but the difference is that this is enter and enter an encrypted when a computation comes in then the the current encrypted States goes in basically lives in the network and the workers that are running the execution they can update the state however they see feed based on the computation of course and then they can spit out a new modified updated encrypted state in addition users can supply encrypted inputs users can supply encrypted inputs and then get encrypted outputs that are only selectively revealed to them now what's really important in this slide is how we preach to a theorem we have a third type of output which is the etherium callback basically if you're a secret developer if you're if you're a secret contract developer you can enter it a special return statement that returns statement can can take the output of the secret contract that just executed an enigma call another smart contract on etherium with the with the output from enigma as an input to that to that smart contract that completes the full cycle so if to give you a concrete example if you have a voting smart contract we do know how private voting how hard it is to achieve that in a good way on the theorem so what you can do you can have the private voting happen on enigma an enigma users can supply their encrypted votes the actual tally function runs on enigma workers and then at the end of that you can commit that result back to smart as input to another smart contract in aetherium that can do whatever business logic with those results that it wants all right let's switch gears a bit so far I told you a lot about how enigma architecture works and that we have encrypted computation but I was kind of hand-wavy right let me explain to you how we actually protect privacy in the network so for discovery right now we're user entrusted execution environments or T's to actually achieve these privacy guarantees these are basically a secure region in the processor that can hide any data and anything that goes inside of a computation from even the host so a malicious Souls cannot see what they're computing over it gives us great scalability guarantees it gives us strong privacy guarantees but we're actually thinking about how we can do better there are other privacy preserving technologies that are available today that are purely cryptographic this is actually a good time to say that when enigma started and I was a student at MIT my teasease was on how we can achieve privacy preserving smart contracts using secure multi-party computation or MPC which is one of these techniques MPC is a distant cousin to a fully homomorphic encryption they both try to achieve the the goal of computer over encrypted data but because NPCs steal orders of magnitudes more scalable we are focusing on developing that one one final note on zk snarks and Starks there's there's a a big misconception about these technologies they're an amazing technology but at the same time ZK star snarks and Starks don't actually allow us to compute over encrypted data what they allow us is that if we trust someone with the data that someone can then prove a computation over that data without actually revealing the data to anyone else but you still gotta trust someone with the data and in the context of smart contract this doesn't work because in when you execute smart contract on the blockchain the nodes are untrusted you can't trust them to actually see the data so ZK snarks and Starks are with the exception of very specific use cases like transactional privacy that are usually explored for scalability and not for privacy long story short we need something like MPC and I'm going to give you a quick background about how that works I'll try to go I can't go into too many details but I try to get to give you the main idea so MPC works in this paradigm let's assume first that we have an ad ideal world in this ideal scenario we have one trusted machine a godlike machine that we can send any computation to and any sensitive data and we can trust that machine to always produce the right results and ever to leak the data to anyone this is obviously not possible in the real world these process execution environments really get us to the limit of what's possible with that but it's still not perfect if we want the perfect solution will need cryptography so NPC comes and says you know maybe you can trust one machine but if you can trust a network of computers where all of the net all of the nodes in the network's don't have to be trusted but as long as there is at least one honest node in that network then you can actually run secure computation you can actually run any computation and achieve both privacy of the data everything remains encrypted and you can get the right result it's an amazing it seems almost impossible and counterintuitive but we actually know that from the 80s so let me walk you through a simple example of how that works let's imagine we have a very small network of three computers and they're gonna do MPC to solve the problem of computing over encrypted data so first of all we need to find out how can we store data in this network storing works by a process called secret sharing it's actually not that complicated but I'm not gonna explain it here but the main idea is that you take a piece of data let's say that data is called X and then you split it into different encrypted shares and only send one encrypted share to each computer so the first node gets x1 the second X to the third X 3 all of these are independently encrypted you can do the same with any any amount of data that you want let's say Y and now let's run a simple computation so let's say we wanna run addition when it turns out that addition comes for free because of the properties of secret sharing all you have to do to compute the addition of X plus y is as each one of these computers to just combine the numbers together locally and that's it and then when you want to decrypt the result what you have to do you have to send all of the shares of the data back to someone that someone having all of the shares in one place can decrypt the information but an amazing thing you happen here these computers have ran a computation they don't know the excess they don't know the whys and they don't know disease all they saw if you probe into if you zoom into one of these computers all you see is encrypted data and yet this guy got the decrypted result so that's the basic of MPC when it comes to addition multiplication is more complicated but I do want to go at this on a high level of how it works so for multiplication it turns out that we need something else when it's something called multiplication triplets multiplication triple triplets that's the ABC they are correlated randomness so a and B are just random numbers that are randomly generated independently but C is correlated because it's the product of a times B ok and now every node has has these triplets these triplets are independent of the data so they can actually be computed a priori like you can put a supercomputer these computers can work overnight and just generate many many many many of these a B and C's the reason is that these a B and C's are then used as a one-time pad and they cannot be reused so you really need many of these pre-process for a computation so now let's do the actual computation we want to compute x times y what happens here is that each node takes a one-time pad of their share of x and y the reason they do this is because then they need to share these with each other which is what happens here and then when they share it with each other they can because they have each one of them has all the shares they can decrypt a number called D and a number called e Deenie are basically a one-time pair of x and y why is this important because if we not Dundee step then all the nodes would have shared their X and Y's together and by the property of secret chairman if you get all the x and y's in one place you can decrypt the actual information so this is a master we cannot avoid this but because c equals a times b and if you then plug that into this equation just by very simple algebra you're gonna have to trust maybe you're getting is gonna cancel out and you're gonna end up with Z equals X x times y or actually each of these Z's is an encrypted share of x times y and so at this point you can just send those these back as with the addition and hold and behold we computed multiplication over encrypted data now that might not sound that exciting I mean addition multiplication fine how do we get general purpose computing well it's a very known result that will addition multiplication you can actually compute any function and that's what we use and that's technically what I believe other other other techniques like fhe and Starks years that's really all you need so how does that tie back to enigma and what are we working right now to develop next beyond trusted execution environments so the idea is the idea is and there's only a small amount of difference we need to make the idea is that when the user now submits a task instead of encrypting those with you know a yes or something and just sending these to the enclave's what they can do they can do the secret chairmen they can split these into shares and share one and and send one share of the input to each node in the group in the worker group that is randomly assigned and everything else kind of happens is the same way the worker groups having secret shared version of the data of the inputs they can get they can take the webassembly code and then just go one by line line by line in the web assembly code and interpret that as an MPC protocol so for example if you have an instructor if you if you have an instruction that says if you have any service that says that's multiply two numbers when it's actually being interpreted as what I showed you two minutes ago now I'm running out of time a bit so I what I do want to focus on is first of all that this is life today we have very serious projects building on us and there's a whole host of applications what this is relevant we talking governance auction secret icos and privacy-preserving Dex's and many many other use case and at this point I want to invite Stan from our team to actually show you a live demo for privacy-preserving voting thank you hi I'm a software developer at enigma and part of the protocol team today I will demonstrate a demo that is built on top of our application but before I want to make a claim and kind of walk you through this so unchain governance what is this so it's kind of at risk if you think about it we're trying to build this decentralized world this decentralized applications but the more we grow the more decisions we need to make in a decentralized environment and this means voting so if we look today the common use case is for voting RTC ours which is token curated registries and dowse by the way raise your hand if you know what the TCR is all right this ye are are basically a list a list of some vendors and reviews you can think of a decentralized al put tokens so we have TCR and we have dows that maybe we want to vote on a change of leadership or maybe we want to fork the network so all of those require voting now usually the scheme is done with something that is called commit and reveal it has two steps the first step would be you hash some vote you commit this on chain and then you have this period of time where you have to reveal the real value on chain and validate this now there's two well it's kind of sucks from a user perspective because it requires you to remember to reveal your vote in limited period of time so if you know civil project for example they sent Google calendar reminders to tell you hey don't forget to vote otherwise it's lost and also it doesn't prevent vote bribing because you can always see who voted for what so with the demo I'm demonstrating now it's kind of solved right so basically the the schemes today are launching voting is subject to automated bribery attacks you can have different attacks and this is a problem so now I'll show you have a demo and if you want to build something like this all you need to know is solidity and JavaScript to interact with our network so this is a voting application based on top of the enigma protocol and this is just in the browser so maybe the internet would work okay so basically we have here accounts et really counts at our disposal and they're connected to a test net and we'll access them programmatically we have tokens we're using for vote and you buy those tokens and you use them to vote at some exchange rate then we have stake tokens I know it's blurred those take tokens is for for you to do weighted voting so you kind of you can stake five tokens and wait with and vote with the weight of five after we do this we need to buy tokens so we will buy ten tokens and we will take five of them into the contract and now we need to create a poll so we need to insert some bits of information first of all we have quorum so we will choose a quorum of yes votes divided by the number of total votes should be bigger than 50% and it's a simple majority so if we have more than 50 the poll has passed then we need to ask a question so is privacy important and voting and very topical and then we need to add some period we'll say 60 seconds so we have 60 seconds to vote go ahead create the poll and then users can start voting so the first user will go in and say stake 5 and say yes privacy is important the timer keeps growing and most importantly is the result you can see in the console it's saved encrypted in aetherium so just to reiterate no one no third-party sees this information and who wanted for what so this is an important aspect and then we need to vote again right so after this happens we'll switch an account this is all Testament of course but this is why it kind of happens behind the scene so we'll take three tokens and we say nope privacy is not important again you can see the result is completely encrypted and this is how we start on chain um so again at the end of this timer a very important function will happen on our side this will trigger a computation the nodes on our network will fetch the state fro material compute over the encrypted data tightly the results commit them back on chain and modify the contract state on etherium yeah we can see that success for those of you who keep account we had five vote saying yes really won't saying no so privacy is important and then on the front end we have this event listener just simply listens to an event on the tearoom account on the aterial network and you know once the poll is ended it can update the UI that's alright so I know we run out of time but I just want to just want to finalize and tell you some exciting things secret voting the demo just saw is not just a demo it's actually being produced by very reputable companies in the space we have Aragon and ocean protocols actually building privacy preserving voting on ethereal right now you can actually look at the code if you want it's live another amazing example is machine learning over encrypted data so eggs in chain was working with us has implemented a scheme where they can classify our credit worthiness that's what the plain he represents in the diagram and they can keep the actual weights of the model completely encrypted so they can hide the model from the network and still continue to train it and get better predictions on whether people credits is worthless or not enigma is live today you can work on it you can build on it just go to enigma dot KO / protocol and start building we have documentation we're open to feedback the code is open source everything you need is there but what's even more exciting that I want to announce today is eggs enigma growth grants enigma growth grants is really the best way for you to become involved is the new emerging ecosystem we're going to work together with the people who apply to grounds we're going to fund these we're going to help this evolve and this includes a lot of the core things that we need to make the enigma platform an independent thriving ecosystem now enigma is exploding right now it's growing very fast and there are many ways for you to get involved beyond eggs whether you're a developer or a user or you want to just run node and stake and earn rewards all of the information that you need is packed on this slide thank you very much