J1 PAIN 04 Matthew Di Ferrante Cryptographic Approaches to Smart Contract Privacy & Scalability

thanks for coming to this talk this one it's cryptograph I think this was in the a privacy tract but I've also mixed in some scalability stuff as well it's it's a big crypto heavy I mean some somewhat mats heavy so I'll try to go slowly through those examples and if you don't if you started throwing out just really listen to the point where I say just listen to this point cuz there's only a few important bits that you have to lock on to to actually get the most out of this really yeah so that's the topic and basically I'll walk through a very simple example of doing a ring signature a contract on a theorem for voting and show why even though there's a lit of a trade-off between if you want it to be true 100 percent private it's quite hard to make it scalable if you wanted to make it a hundred percent scalable then you kind of lose some privacy so we a show a few different approaches and then come up with like kind of a hybrid model that where you can kind of get the best of both worlds anyway I so and if other way if you want to know the about me I was forget about this part it's so I Matthew the front I do some security and cryptography at the Assyrian foundation help on some of the vertical stuff and besides that I also run my own firm ZK labs which you can see the site in the domain the email domain there which is a smart contract auditing firm and also I do some encrypted development there as well cool so all right the so the overview we'll go through the motivation you know what what to sort of brought me to this talk what brings me to this kind of research in general I'll go a big part of this stuff is gonna be a little curved refresher and a slight overview of bilinear pairings because without that it doesn't make I mean the rest of the talk is mostly just statements so and then we go through an Avon change voting scheme you know say you know if we're ever gonna do a voting on the blockchain or we're not we're all those other block chains I'd like to do one chain governments or whatever you know like a project like Aragon who have company governance in the blockchain you know you ever they all kind of need the sunshine voting these on th voting schemes and so I'll go through like a an attempt to make those voting schemes somewhat private such that if I vote for a outcome you don't know that I voted for the outcome but you know that someone eligible to vote voted right and I'll surely you know I'll show the button once you run into that and then we'll all go into a very very high level overview well I mean it's high level and below at the same time but you know we'll go through it on how to make that a bit more scalable so some of the motivations for the for the talk and this recent general is a theorem is great for trustless applications but if you do things naively as seeing like if you just write a normal smart contract if you don't if you're not really aware of the cryptographic primitives our offer it's the privacy is not great I mean pretty much non-existent and the gas cost is is astronomical if you were thinking about like if you ever wanted to do a blockchain like a state Oh voting on the blockchain like for an election right dude those are usually millions of people can you if you can imagine that normal I love the curve signatures are 64 bytes for a signature you multiply that by the amount of at the very least right without you including the message if you multiply that by 64 million for just 1 million election with 1 million people that's 64 yeah the 64 megabytes on the blockchain for each electron and that doesn't really scale well especially because that's the absolute lowest point if you're not even telling people what you're signing for at the it's actually probably 10 times that so it's like gigabytes per election and it wouldn't really work out but so you know we the we can go through a scheme and leveraging some crypto primitives we can alleviate some of the problems of privacy in scalability and also yeah obviously mostly I guess most electron it's most sensitive voting protocols don't want don't want to reveal the voters preferences right so that is well we know you don't you don't want to do it absolutely naively because even though that might be easy to program it's definitely not desirable working works now so hope you can see that but it's cut off on the left there but so I'll go through the elliptic curve primer because it's some of the stuff is necessary to understand that stuff later on but the curves have some special properties that are useful for general education systems and if you're not aware of elliptic curves you know I guess most people are watching conference should be aware of them by now but if you're only know of them by name basically is if the curves are the modern version of RSA right they are a public key cryptosystem which has yeah you know has it's it's asymmetric where the key to encrypt is not the same as the key to decrypt and ends vice-versa so you know the when you make any theorem address and you sign a transaction that's that's done through elliptic curves you know bit corny theorem and most of the cryptocurrencies U is elliptic curves you know most of them use this one specific curve which is SEC P 256 K 1 we know bitcoins original curve and it's I it's also kind of one of the things that made block chains possible in the first place I mean besides the public key cryptosystem stuff if you wanted to use RSA for the blockchain for private public key signatures it would be ridiculous the the key sizes for RSA for the same level of security are something like 20 to 40 times larger right so we already have scaling problems with the quite efficient EC schemes that we have now RSA we probably may have made this unworkable other than much much slower so anyways the history aside the elliptic curves have these properties which mean we can perform additions and multiplications on the public key without its destroying its relation to the private key right so remember that public and private keys are really just two numbers I mean the private key is a number the public key is two numbers it's a curt it's a coordinate of point but you know you can create a morphism that maintains the group structure and that's kind of what you know guys ristar all these nice to your knowledge proofs the more the extensions I was well in your pairings it gives rise to zk snarks and you know there's so and so for that you can do some cool stuff so I'll just read us out the EC security crash course the security in RSA is based on hardness of factoring large numbers but the security and let the curves it's based on the discrete logarithm problem and so what is this read logarithm problem it means so given given Y that is the result of a computation G to the X right so if G is for example 2 and X is for that 2 to the 2 to the 4th power would be near 16 right and so you given 16 you say okay what what to the power of X base - sorry taken giving taking - what is the exponent that gives me 16 right and so on normal the under normal real number line that's quite easy because exponents have an inverse but on modular fields which is you know an hour saying lived occurs and and any fields discrete fields in general the definition of discrete fields you can't inverse this because there isn't there is just not an inversion that one-to-one inversion operation right so both in RSA and the curves we deal with integers on modular groups and meaning the operations wrap around like an o'clock right so clock are somatic is modular arithmetic if I if it's 2 p.m. and I say let's meet in 12 hours we're not going to meet at you know 226 p.m. at 26 whatever we're meeting at 2 a.

m. I guess yeah and then this this is basically what's being Illustrated there in that simple calculation but in in cryptography these numbers are obviously gigantic they usually deal with numbers on the order to to the 256 or larger which is you know you know much much bigger than what's your clock and keep track of but here's an example in terms of the like of real numbers it's much smaller though so probably keys are scalars integers from the underlying field and you know here's a I guess it's a it's not super like it's not a center point that you'll come across as a non cryptographer but it may so it'll make things a little easier to understand and litter slides the elliptic curves there are a group that is created from an underlying field right so you you it's kind of like the group the curve or the group that substantiates a curve is really an emergent property of the underlying finite field and so from one field you can actually make create many different elliptic curves depending on how you construct a curve right and you know as I said before you know I look the curves are crypto is much more efficient than RSA to vd6 bit the curve key gives you 36 3072 be bit RSA key security and you know here's a fun tidbit on the homomorphism are the commutative properties you know if you have a private key X and the public key to the X then the private key of the public heat times the a constant K to the power of X is X times K I mean I know that's a bit hard to follow just in spoken word but it's a this is this little trick is often used for vanity generation a vanaf your generation like if I want a he theorem address that starts with you know one two three four five six seven eight nine and I don't want to do the computation myself but at the same time if I let somebody else do that competition for me knave li again then don't know my product key right and I I definitely don't want that so what I can do is I can crew I can take a X right this is this is mine and remains always secret and I create the GDD X and then I switches pub right and I give the public key du/dx to an external party and I say you know compute and a dress that has GDX at its component and width you know one two three four five six Andrew nine at the beginning and so he'll find these this third party they will find a constant K that that you know I like this should be Y bit more let's say K cater to Y because if it's a third party to different one but they will find the constant K to the Y that you know hashes to address one two three four five whatever and they won't be able to use it because they don't have the primary component G to the X but if they give it to me then I can combine you know K to the X and U to the X together and create a you know my vanity dress so it's kind of gonna it's a nice way to source a specific type of computation so let's go through a concrete example of elliptic curves in the application which is the simple this is probably the simplest signature scheme with let the curves and it's not the one that's most used because this specific way to do it was patented the patent expired recently maybe I think now it's been maybe like a year or two but you know we almost always use ECDSA at theorem uses et ECDSA and so there's a Bitcoin and so on this one's much easier and now that it's not none of the patents expired you know you can actually use this so the Schnoor signature provides your knowledge proof of knowledge of the exponent so it's a mouthful but that's the sort of very precise definition the private key is that your expert right as we said I was went over before and the other curve primer and the section or signature is a zero knowledge proof that I know the exponent without giving you the exponent because obviously then you know I'm giving you away the secret and used to yeah that's this breaks the public heating so this means that a signature nor signature is really real nothing at all about the private key it does not provide any attacker any information but for brute force besides what they would be able to do with just a you know full state space search okay and here's sort of a protocol accomplices the interactive version or the non interactive version of snore just has like a hash in here somewhere but the interactive version is just a bit easier to follow in your head so I'm Bob the prover I want to prove to us you know a third party that I have the private key X and Alice is the verifier again some sorts from third party the public whatever and I create a witness value W and I take my the G and this sort of the gene this is standard notation over the kerbs G is basically just a the base the group generator it's a it's a number that's like hard quarter and all software so you know we all know G G is public by default so I take G and I and I take it to the power of W and I get a Big W so I send and that's the blind of value when I send Alice the larger W and Alice already has my public key right so G D DX is my public key and that's also public information so she this was general she got it from a mailing list or something um so Alex because it's interact this is the interactive version of snore Alex take pics are random number C is just a random integer and sends me that integer and then I so to prove that I really do have X and I'm not just generating fake proofs I take the the primer for the blinded value so the needed the generator for the witness and I subtract C the challenge times X I mean modulo the the field well the field modulus and I get the response are and then Alice the quickly verifies this is a proper signature scheme and it's you know secures a little bit curves anything else you were using it up the curse Alice can check that G to the power of r times G to the pub the public key to the power of C is the larger value W what is that why does that work this is a here's a algebraic proof with a bit of easier to follow perhaps line by line so you can say if you remember you're you remember one thing that to keep in mind when you're reading this stuff is as the curves are really can really just be abstracted away as algebraic fields or so algebraic groups which means you the laws of X for initiation and multiplication addition apply just as they applied in elementary mathematics right so if you expand this stuff you can say look G to the R times Pub public e to the power of C equals W if you if you like you know rips substitute to the the terms you get you know G to the W minus XC times 3 to the X C equals duty of the W right and if you you know in because of the logs if exponents these to the X see here and the X see here cancels out and you're basically just left with G to the W right and so that's where the signature works if only this specific one works only if you follow this protocol in order right because if you again if you if you're spend a bit thinking about this if you don't if I'm not forced to pick the small W before I get the challenge C then I can pick I can just pick any random w to make this work right like it because these two these two cancel out so you need if you really if you plug in and pretty much any any combination numbers here it'll work as if you're not forced to do could do could do the commit beforehand and you know again this is the non drug diversion which is more what people are used to interpret signatures when I create a signature I can just publish it to the world without having to be involved in every verification you just use the hash and to force WC causality a causality because you cannot yet see the result of the hash before knowing W right because that's that's kind of the security that we all assumed from hashes right so I mean that's so that's this is a simplest possible version right here so we can we can move on now so on bilinear pairings so the bilinear pairings is perhaps you've read about them or or you know seem to mention just by name but we we got on the cerium virtual machine we managed we put in support in op codes for bilinear pairing checks and operations late last year and they allow for some interesting extensions to literature's right and the extension being that normally the curve is you can really you can if you have two elliptic curve points you can only add the elliptic curve points together but you can't multiply them you can take a scalar an integer and raise it to an exponent we can take you can take a point and raise you an exponent that is a scalar but you can and you can bother while you obviously two scalars together or you can multiply a point by a scalar be kind of multiply a point by the point and this kind of extends that group to make it fully complete your multiplication as well so you know yeah as I said it allows the next operations the multiplication of like the curve points it's not normally possible on non-parent curves and the reason it's not possible is that if you if you did it on the same group then it breaks discrete logarithm problem where this breaks this discrete the Hellman problem which is this original if you have one problem which is kind of like why signatures work but if you do in a very specific way it allows you to do DK snarks without breaking normal signatures so here's an example of BLS signature so given a private key X message m a hash function H the signature is you know Sigma is the hash the message run through the hash function which is a number right I remember like always there's numbers oh actually sorry this is a chest roll at the performance so you hash to a number converts one that's well at the curve point and then you raise that to the X which is your private key and you get a signature right and the rotation of the signature is simply you take the this is kind of a way to encode bilinear pairings points because kind of maybe how you can tell from the word bilinear by linear to two lines they are a bilinear curve is kind of a a pairing of two curve right it's a grouping a combination of the curves so you take the bilinear point you have you know a point from the group 1 another point from the group - and you can do this special operation there are allows your shuffle exponents out sought from inside these little parenthesis to the outside so if we remember that the signature here is just H to the MX and I like I can see as I sort of show here I can take the H to the MX and and instead of instead of keeping the X inside I can take it outside the parentheses right I can't move the X from here to here but I can take it from so from the H of the M to the G but I can take it outside and again since since this is a basically the same but the X is just on the other term I can move it outside the parenthesis and check for equivalence and this is kind of the very very basic first step of why it's the case narcs work and a whole bunch of other stuff but the short without getting into the van so by this works pairings pairings curves allow you to shuffle around the exponents to check for equivalence is something that cannot be done or normal if the Kurds because if you could do this on our most of the curve then you could take the X out into a base that you know the like a factor of and you know take a you know get to get the power keyword so here's a I'll go through an example of normal ring signatures on normal if the curves and and then I'll show how they differ on by linear pairing well did the properties of this signature you know the some of the some nice benefits some not so nice and then I'll go through a version on that uses the properties of kind of battling your pairings but anyways so I looked the curve for example ring signatures the what are they exactly so the concept or first introduced in a paper titled how to leak a secret by some of the RSA authors it concerns use these keys in a group instead of using them individually to prove you have a private key from the group as opposed to proving ownership of a specific key right if I if I sign normally from an obscure Madras I'm saying you know he's here Majoris one two three blah blah blah it's mine or you know whoever signed it let that more and has has ownership of it and here's a proof to signature and you know this allows me turns transact or whatever this one is if I have a set of public keys or you know a larger group I can prove that I am from the group but not prove exactly which key Ike respond to so you know kind of like why they were introduced in the first place they're useful for whistleblowing if each public key for example belongs to a government official the official can leak some classified data proving that they are indeed a government official without outing themselves as individually as a whistleblower so you know if yeah if you're in a government party of 100 people and and we're in some advanced government that has learned how to use computers and you know they actually had the understan cryptography finally you know you can say it's some something dodgy is going on in you know someone some lobbying or corruption you can say hey look here's a signature from one of the part parties that would be privy to this but without you easily getting themselves assassinated right because they now we wouldn't now they know exactly who leaked it but it's just somebody from within politics right that would be a nice thing so again the ring signatures are just one type of your knowledge proof they prove X and only X 0 no truce allow you to prove knowledge of a secret that revealing I think about the secret so the the national analogy I have for this class of properties is say if I choose a card from a deck of cards and I want to be you prove to you that it's a red card if I just show you the card it reveals more than the color it reels the suit the number and so on basically you know everything and I don't want to reveal everything I just want a real that one bit of information which is the color and but if on the other hand I just take my card aside from the deck and we know you assume that this is a deck with 24 black cards and 24 red cards and I haven't messed with the deck and I fight if I take all the black cards of the other if I take all the black cards out of the deck and I flip them up and there's no more black cards and Zac I prove that this card I set aside in red writing perhaps you you unpacked the deck and so you know that I haven't thrown any random cards in so specifically the zero knowledge proof and recognize the signature is this called a zero knowledge proof of set membership so you know let's take the supreme tip and try to do something useful practical with it and so we can create project voiding rounds with linkable wrinkles ensures by requiring each user submit their probably key to the contract you know a public key that they want to be they so in this case you would probably have a setup step if anybody is aware of for example the Estonian government they give out I have one of the Estonian ie ID II residency things and the the so Dena residency card has a chip in it you know a smart chip and that smart chip can be clogged plugging into a smart card reader and if you mess with the pin I mean the the software you can create signatures from it and the signatures and derive a public key which then you can go check against the Embassy's website or you know some some server they run that says look yes i i certain i have a certificate where i sign for this public key right so at all public keys you know that all signatures from this public key are very likely from me Matt to the frontier because the only way to get that card with the key in it and you can't extract the key you know well assuming that the heart smart card is safe and the only way to get that card is to be me and go to the embassy and you know get the let's show my passport at the Embassy right I mean and if I lose the card you still can't sign as me because you need a pin and again you can't reset the pin unless you're me so you know for example the the public key submitted to the contract could be something from one of these key identities that Switzerland in Estonia now have a government issued or some one-time thing where you know that you're not gonna get Sibyl attacked and so say that you know where there's a group of a hundred people that need to sign and they you know being deployed its Marc contract saying you know wait until you get a 100 public keys and that committed signing and great and now once they have all joined each user into is entitled to one and only one private vote right in through the some extension to Rick's signatures we can make sure that even though you when I sign you don't know that I'm at have signed you know that if I sign two times you can detect that I try to double sign but you just don't know who so you can prune all double votes there's more contract into it automatically but you just you just you still don't know who signed but you know it was just it must have been one of the one of the people from the set of committed public keys so like here's a little visual representation of that so you can see if we were using this for for example anonymous the the ring finger can be used for anonymous payments or or voting or whatever the you can see that the like the green if we imagine identities here as the green key and the yellow key and the red key I mean this is these are still the same colors I think it's a but yeah the there are still the same on this side right except for the way that the signature is constructed and the signature contains a component from each key so if this person commits some funds and a key as person commits some font and a key and so on then only the person who has the pride kick and then withdraw from this right again for example a ring mixer and the signature it reveals no information besides the fact that it's a signature from this group right so you know that if I put money in no one can steal my money but at the same time when I withdraw the money no one can know that I you know like no one can know that the first word drawer was me or that the last words rossum is with me right so it makes sense I think that's not too difficult it's just some crypto magic but you know take it as truth so there's there's a problem here you know if you wanted to use this for just if you wanted use any Navy again for a larger scale stuff I the wrong though through normal ring signatures we have indistinguishability between participants you know I can't tell the first and the last sign your apart I don't know who they are but there's an obvious scaling problem so a vote from a thousand people work are a thousand individual signatures there are one thousand like six size bytes each and for this specific implementation at least the one that I did myself it's really a large it's quite large it's it's like a more than 100 bytes per signature per individual signature component so again this would be a thousand times a hundred times a thousand which is yeah ridiculous it's a ridiculous size and I think you if you even if you do it with the with the bestop codes right now the most optimized EVM assembly you hit a limit about at the ring of ten people ten to 15 people so if you want to do you know a mixed type network like you have in Manero or in Z cache or the cloud of a view of anonymous users is very large that's there's not possible I'm at least not if you program it this way but there is a there's some hope if you use instead by linear pairings and so let me get ready for the next slide because I didn't really have time to make the pictures pretty so there's just a bunch of math on there so consider that a simple setting in which several signers all wish to sign the same message m right so for example if somebody makes a proposal on the maintenance saying you know where we want to upgrade the smart contract you know it's a token contract and the token holders are eligible to to vote on whether it can be upgraded or not and you know if they sign then rate if they don't sign then you know it just it's just taken as implicit note and the message you know again would be just me to upgrade and so imagine that we have a threshold aggregate and event so this is a simple aggregate and an event meaning that it's not a yet so it's a yet so just an aggregate an event not a threshold M of n so saying you know say that there's I don't know a thousand users and and I want seven hundred just say yes right if we don't get that seven hundred number nothing happens so you know again yeah consider that the message is the same just a smart contract hash for example the signers the sign your I their secret key is X to the X I and the public key is you know while I so by whatever that's a G to the X sub I the and then the signature is created a bit differently than we were doing it in the nor example so and the the signature here for each signer is the one that we went over here right from BLS so we take our public key sorry we take our private key the exponent X and we raise that raise the hash curve point to the power of that right so our signature is the BLS signature so it's not the signature and remember remember these little these properties where I can shuffle the exponents out of the curve out of the parenthesis to check to do like you know simple and computation shortcuts and check equivalences right so now we know that each individual signers Sigma signature is created by HM to the over X this if if you don't have the mathematical background it's just this power its product sign meaning that the aggregate signature is simply all of the individual signatures from each participant multiplied together right remember we couldn't do this if I take a signature on the net for you know some easier transaction and another second from the main net I can't multiply those together that's it's you just can't do that on normal at the curves but because we're gonna bilinear pairing curve we can do that so the final signature you know the an event signature is simply the signature from each participant both well together um so yeah I know the rewards you know you have you have yeah each individual signature is just H of M summation the to the individuals a private key so the aggregated signature is just basically what we did over there and for verifying the smart contract we just we only need to we can accept if and only if Z the elliptic curve the bilinear check G over the aggregating signature is equal to the product of all individual signatures you know for each individual public key over the message right and it's and it's a bit of hard to visualize this without having you know a few pages more pages of math but basically this just says it's basically saying the same thing as this year right we take each individual signature I multiply it so we have say that we had at 1010 signers we'd say Sigma 0 times Sigma 1 times Sigma 2 times Sigma 3 and so on and that's a sigma complete right or Sigma whatever total which is the aggregate and so this one would be you know we take the elliptic curve point the pairings point y 0 which I mean remember it's just G to the X 0 because that's what the that's what this is right over hm and then we multiply that by you know e y 1 and so on any y 2 and that because of the properties of our linear bearings we can make sure that it is the same as that without anybody losing any of their underneath well without anybody losing the private keys right but there is a there is one thing if anybody managed to catch to follow the rambling is that you don't you lose a privacy here right because for each if you if you're sort of looking at the if you pay attention to the to the definition the each signature is I am self-sufficient so it's it's you can test each signature independently even if they don't if you don't have the n of n right and I can tell that yeah you know public key one voted for this message and I can tell public key to never wrote it so they didn't want to it top grade so what we can do instead is we can if we wanted to have the best 4th world's again for the nice in this league which ability from the normal at the curve and the scalability to be able to do the check on chain without you know spending a million dollars you can do this process you can do this process first off chain and get the result oh you know with you because you can do I get you you can say like that bilinear pairings are backwards compatible right so you can use bilinear pairing curves for normal if the curve stuff but you can't use a lip the curve groups for bilinear pairing nonviolent written groups for billionaire pairing stuff right so you can you can do is at one part of the key to do this process and get the true get the initial sort of vote distribution and then a third party can come in with the well a third party or a multi-party process or whatever can come in with the through this process and create an aggregate key I mean there's and then there's another there's a bit of another version of this one which is threshold signatures is a bit more efficient but we're cars Morris previous setups and then there's a you know well go on the side exercise I think so with all that assuming the public keys or have already been registered on train for other purposes we reduce the voting step data cost from a thousand times a thousand times the size of the signature to really just the size of the signature because again we as we can just we have to assume that that possible keys have to be on chain anyway because you know like otherwise you can you can the participant must register to vote at one point or another there are ways to limit the amount of stuff you put on chain but you kind of always limited by the national step but if you kind of if you assume that eventually we all have a IDs that can interact with the blockchain or or something of the sort then once you put your ID on the blockchain for one purpose then any smart contra can curve refer to way right so it's like at one time storage cost and just many time reads cost so and there's not there's other extensions here that have further setup steps where it's possible to reduce this even further such that M of any mo ven creates the same signature threshold signature so for example if you have like a seven of ten threshold signature any seven keys in the ten in the set of ten keys signing will create the exact same signature output right so whether it's the first seven or the last seven different keys different key sets they'll sill create the same signature and the Suzi again through cancellation and bilinear pairings which is only possible by other parents and the trestle signature is used by one of the other projects that I think is presenting here this week Definity a user in their concessive algorithm and for even more setup costs initial setup cost and a bit more exotic math you can create a constant size proof or based it really like uh you can kind of see it as a smart hash that can hold verifications for practically unlimited amount of events which is called a set accumulator set accumulator is again it's basically like just cut just kind of like a hash can hold a fingerprint for an arbitrarily large size file a set accumulator index can hold can be a verification for like on arbitrary large amount of events arbitrarily large amounts of events you know there's always limit which is like login to verification time but that's a more computation to everything and yeah so that's I was a bit of a foray into sort of the some of the trade-offs and how you would go about constructing the stuffin and we know even if you think that a theorem is not scalable now block chains are not scalable now a lot of people whine about this you know especially in the media you know the further away you get from the other standing the more alarming the articles get but you know it's not it's like it's just because we know where it's a pretty NASA and Industry cryptography itself is not liked by many people I mean sure it's fancy everybody like it likes to talk about the magic but nobody very few people like the right cryptography code and so you know this progress is slowly but it doesn't mean that it's impossible right again it's just the AG you know we've only been around for a few years cool so any questions yeah so just about the the threshold BLS thing yep about the the threshold signature just that if it's Lagrange interpolation based like aren't aren't most threshold signature schemes based around and Lagrangian terpil ation so you would get this property that the same sets or different sets of sig signature shares lead to the same underlying signature on the same value or is it just that like there's no random witness data in the random commitment data in the signature well I mean surely if you have random commitment data you probably come up with different outputs i I yeah you're right that most threshold signatures are based on Lagrange interpolation or similar things where they come up with the same I mean the one that I showed is the aggregate signature right which is not tresh hold and so obviously you have different well I mean there's only one output anyway right but it's just there's not an M event I I think that there may be ones that are based not on Lagrange interpolation but it's you know I wouldn't be able to name to you it's fuzzy stuff that I've just gone through in research but yeah I mean the majority are just based on based yeah what you said so just why is the the pairing necessary then for this uniqueness property I mean if the Lagrangian Tribulation is enough to give you the unique signature on the same value regardless of the key sets used I mean it's well listen work on I think yeah there's like a I guess it depends on it depends on what you're exactly trying to use it for and and you know the way that you are setting up the group I mean for for like key share setups I think you do need by linear pairings but you know for example yeah like you're right that you can do ECDSA in a quiche airway with Lagrange interpolation as well I think it just kind of depends on whether you use it you're using it as just like that one stand alone event where once it comes to get you know you have that you need to have that interaction process every time it comes together or you do whether you want that first dkg set up and then from then on you want the non interactive test right so yeah it depends on the use case Thanks yep give that stuff on to all over there in the back thank you I have few questions in fact so my first question is about the ring the ring signature when you were talking about the voting process well it's it solves a sort of problem that you don't really reveal the identity of the person but what about Sybil attacks how can we solve such a problem and make sure that people do not generate multiple public keys to have multiple identities to be able to vote yes I feel I went over that briefly before basically yeah again if you if it's like a governmental election for example right you can only use the you can only use the key to sign that the government has signed off of on right and like in the payments example right to make sure that you know somebody doesn't you know withdraw more than eight to put in as well I mean nothing prevents them from being more than more participant but every time they put in they try to be more than one it cost some more money right so there's economic incentives their permission incentives yeah the simple problem is a problem in environments where there's no economic penalty for trying to be multiple people but it's not I mean Sybil the simple problem is not really a cure Prager again it's a economic incentive problem so the solution there depends on the use case right so like using security check or some security deposits or something yeah yeah or again yeah or like having some sort of in-person verification step before you're allowed to you know sign okay and my second question is about scalability issues and when you use for example secret sharing protocols and you do any sort of multiplication or whatever you want off chain to solve scalability issues and then verification you do it on chain so for example like I was thinking of the other day of how to do for example Shamir's secret sharing verification on chain and then you have to do interpolation function would we use a smart contract for that or how we do that like on chain I mean it's it's a very broad question I it's it's very much depends on you guys you know some use cases are are okay with or more or more accepting or of like massive off chain computation and on change check points right if you can use something like that then you know true bit scheme type stuff works well you know or you know maybe we can you wear something like I plasma similarly right it's a lot of off chain side chain stuff and then eventual settlement if somebody tries to settle a wrong stake then somebody can read a conflicting proof I I mean it's yeah the the solutions they are varied massively depending on what you're trying to do it's a it's always a equation between how much overhead you want right because an off chain network takes overhead versus how much how much of it do you want to be not interactive and just you know immediately on chain thank you I think's really interesting Matt you as usual quick sort of pragmatic question when do you think we can see the first implementation of the signatures types in in ethereum or other blockchains and if so which one do you have a rough idea in terms of timelines so the the nave one sergeant well but the ring signature probity one if you look on my github I mean it's not on here but just google my name is like one of the first links I already have an implementation of that about it I guess I said it's it's quite it's ridiculous it's just way too inefficient I mean even with the bilinear pairings opcodes it's still not something that I mean if people actually started using that as a main service the the chain would go down again right well I'll go down but I mean it would be very gas price would go higher it would be very high so the the other one you know for the BLS compactification and probably the first version would not have privacy but again for our chain voting like Douw type stuff right soon perhaps I mean it's not that complex I'm I'm sort of in talks to me and Dean where it's worse when we educate labs we're gonna talk to Eragon about it and you know we have some yeah some stuff in the partnership but soon probably hopefully maybe like this month I don't know thank you very much any other questions right no more questions thanks [Applause]