Privacy Preserving Smart Contracts by Julian Koh (Devcon4)

hi everyone today I'll be giving sort of the brief overview of this privacy-preserving smart contract industry it's sort of quite a hot thing now with like companies like Oasis raising a lot of money and sort of I'll be break down the different approaches to achieving this so sort of the easiest example to understand why this is useful at all is um let's think of like a private election smart contract we all want to vote and the smart contract with sort of count everyone's votes and give like a winner but as you can see in this example let's say vote wanted to come in at the same time and vote three comes in at like ten minutes later the third vote can actually see what that is people I vote at first they can sort of decide oh it's 5050 right now so now if I vote I can actually push it the result in whichever favor I want which is really bad so what we want is actually everything hidden all the inputs are hidden the state of the smart contract is hidden and we can only see the actual result so there are sort of four ways of doing this the first one is homomorphic encryption which is sort of like a pipe dream and it's really slow today so it's not really feasible right now and but the three ones are covered today are trusted in execution environments multi-party computation and your knowledge proofs Zucco be really happy so the first one tesr sort of this idea that on process on computer chips that can actually be like a separate environment which is sort of hidden from the OS so and this sort of special they call it Enclave imagine if this Enclave had like a private key and a public key and I encrypt the file with the enclaves public key only the Huntley can actually decrypt it no one else in the entire world can see what it actually is so that's how we can actually achieve this private computation sort of the most common thing the most common Enclave today is the Intel SGX chip which is actually available in most Intel computers today Intel chips today obviously there are some problems with like we having to trust Intel that they did not put like a back door or whatever but sort of you can think of how it would work is that we have a smart contract which actually coordinates users and off chain trusted execution environment computers and they don't see what you're actually computing but they'll help you do with the result that's like the easiest way and the most practical one today the second one is quite interesting it's a cryptographic method it's not Hardware at all it's called MPC some of you guys might have heard of it it sort of goes like this let's say there are three people XYZ who want to compute like the sum of their numbers or whatever but each of them don't want to reveal what the actual number is what person X can do is he can do like a linear secret sharing scheme he can break down his input like X into three pieces maybe X 1 X 2 and X 3 and he can send these to three different notes Y will do the same Z will do the same and in the end one of these nodes for example that note there he only gets x1 y1 z1 and he can input we can calculate someone so he doesn't actually see the full input of any of the XYZ but he only cares like a piece of it and in the end all three of them can come together and actually produce the actual sum without anyone seeing what the actual inputs were it's quite magical actually addition is really easy multiplication is super hard for this MPC method but there are a lot of cryptographic ways of doing it and most of like the cutting edge work today is sort of trying to optimize doing multiplication and actually if you can do multiplication and addition you can do any computation you want in the entire wall so that's how you can achieve sort of these turing-complete private smart contracts one of the big problems of that is like for example for the MPC thing what if one guy actually doesn't do the correct protocol he just does some random computation and the result is nonsense he would have reset everyone else's time so that's some sort of Sybil attack can thing so we also want to make sure that all these private computing notes do the right thing so how do you do that we sort of force them to prove that they did the correct thing they ran the correct computation there are sort of two ways of doing this one is the true bit muddled it's really easy to do today it doesn't use much cryptography is more like economically guaranteeing that people do correct computations but sort of I think the more interesting one is sort of using like zero knowledge proof stuff like that to make sure that notes can actually run the computation submit a proof to the smart contract that they actually ran the right one and this mathematical guarantee that they did so snart's us quite interesting in this regard but they need a trusted setup for each type of computation that you do so it might be good for like one time one contract which has you just use many many times like maybe like Z cache type thing but if you want like a new trust set up for each smart contract that's like super unscalable so there are a lot of cool new things that you guys have seen over the last few days I starts and that's this one new protocol calls XE I think which is by some Cornell guys which also does this in a very interesting way so sort of to put it all together we can think of the original problem of hiding all the inputs hiding the state of the smart contract and getting the output using the tree methods that I mentioned above so we can make sure that the smart the people who are computing the actual output the computing notes all have to run trusted execution environments and if that is compromised they also have to run an MPC protocol so if you're able to pretend that you have like Enclave but you actually don't you still only have a piece of the data it's really strong adversarial guarantees actually and lastly we can use some sort of zero knowledge proof that these the computing notes can show the whole world that the Aranda thing correctly and we can also sort of use a smart contract to economically incentivize this whole process and we can do private private voting stuff and a lot of other cool applications thank you