Satoshi Has No Clothes, What About Szabo? by Ian Miers (Devcon5)

thank you all for braving the tsunami for one of the best last talks at the conference this is the talk on Satoshi she has no clothes what about Szabo so do we need privacy for smart contracts I sort of started about thinking about this because everyone sort of understands that you want privacy for money for some reasons that's the problem for cryptocurrencies is that they are basically Twitter for your bank account they expose all of your spending details to everybody your creepy ex girlfriend or boyfriend do your business competitor is literally everybody so this is the thing that we're starting to understand these days but it's not clear what the analogy we should draw for smart contracts is it's not exactly clear what we mean by privacy and it's not clear how we could possibly get it right so if you know cryptocurrencies Twitter for your bank account you know what is a smart contract well it could be Twitter for you easy to account but easy to already has that that's Amazon s3 that everyone fails to secure and like leaks all the credit card databases and such so it's not that squared over your Tamagotchi clone is a nice description of crypto kitties but doesn't tell you why you care about privacy and similarly twitter for your ponzi scheme well that doesn't work either so we don't have that kind of analogy but there is an interesting one that I think is worth mentioning because it's linked to privacy which is a you know small contracts are like privacy in a different way right we have this fail whale problem right so for those of you who you know use Twitter back in the day Twitter broadcasts all your data to everyone and they had the scaling problem or they couldn't handle the massive amount of data that was public and so it turns out that if you could solve whatever it is about privacy and some worry for payments and you do refer small contacts as well you'd actually end up helping scaling in the same way because you'd have less data right so something vaguely before figuring out what privacy is these two things are linked right if you reduce the amount of information that's out there for everyone to see about you you also reduce the amount of information the network has to deal with so okay well what's a smart contract well okay I'm a computer scientist I'm about to be a professor at the University of Maryland next year found excited Z cash you know I tend to try to define things so you can look at a small contract as a function f on some state AK s and it takes inputs you know X and it does an update to get you a new state the blockchain checks that all this stuff is enforced this is really just formalism so you start thinking through this and you start thinking about well what can we hide right we can hide the inputs that you're calling the smart contract on that's one thing we could hide the actual state of the smart contract that's another thing and then importantly we could hide what the actual smart contract even is so that nobody knows that like crypto Katie's Observer ran but when we start thinking about it in this way in this sort of dry academic approach we just go whoa what are we even trying to do here again like this formalism doesn't sort of reflect real life it's not clear what to think about this is not the way you should go about this right so the first questions like why does privacy matter for contracts at all right and it's hard to give just one reason because unlike you know peanuts right well we all know what payments are on a day to day life we know what bitcoin was trying to do smart contracts are everything to everybody right there is no one use case there is no one privacy story I can tell you right for things like actual legal contracts going back to like the nick szabo ideas of these things right you have some kind of settlement mechanism for it an actual like agreement you made between parties it's kind of obvious that you need some form of confidentiality because when businesses sign contractual relationships between each other they don't publish them too happy about the world right and so if you really use smart context as part of business relationships then all of a company's business relationships would be public and no business will do that because we won't use these tools that prefer to pay lawyers $400 an hour to do actual contracts that are confidential all right so that's one use case right another one if you're trying to do defy right well you don't want trading strategies to be public you don't want all the information about how you're trading what you're doing to be visible to everybody and I think this is probably one of the more compelling use cases for privacy on the blockchain because we know that finance firms try to get any edge they possibly can right so if you've used Google Maps you know that there's a satellite photo button that you can get satellite photos of the entire Earth right Google is not the one financing all the satellites those companies that do commercial satellite photography one of the principal clients is hedge funds because they buy overhead and he'll of photos to be able to figure out how much forming someone's doing how much business our factory is making how many employees someone has based on who's in the parking lot right so these are guys who are willing to build spy satellites to get information about what they're doing on a market so compared to that downloading your blockchain and doing a bunch of analysis it's a really easy thing right so you need privacy in that setting if you want to do some kind of crazy global computer it's not clear what you're going to do with this what your access policy is all but we already know that you don't want your actual computational stuff to be public right this is again back to s3 right Amazon leaking everything mistakes happening things getting breached you just you don't want your computer harddrive to be public to the Internet right anybody here want to put up their entire hard drive on like like a share link to Twitter anybody can read it right nobody wants to do that all right so that's the use case there the bottom line is that no business is gonna use any of this stuff that leaks all this data so you need to have stories about how to mitigate what's going on and to provide privacy options so now we're back to this well what is a smart contract and again it turns out definition is useful but the real thing you need to think about is you know what do you what are you actually trying to do right so though for questions right who needs to verify your data right where when do they need to do it where is the secrets where are the secrets in this system right and then finally what are you trying to hide so in terms of verifying it yeah it could be just you but if you're just trying to verify your own data well that's kind of sad and you really don't need a blockchain right if it's the current participants that's actually a thing we know how to do and that's really nice if you want anybody in the future to possibly be able to verify what's going on things get interesting and actually we'll get to some research on that that solves it at the end of this talk right the other important question is when do you need to verify right if there was a smart contract or you know you're doing some computation with people do you just need to know it's correct right now do you need to know it's correct as the computation goes on after you laughter they're no longer participating do you need to low no it's correct before you even get started like you walk into a room people have been dealing cards and playing a game do you need to know that the deck wasn't loaded even though you never saw that part of the of the game happen it depends right the next question is where - secrets live and this is actually probably their will got chair with smart contracts because if you want your secrets to live with random people off chain the people are participating it's fine but two people can share it can keep a secret if one of them is not a blockchain right block chains don't keep secrets and so the usual problem we run into when people start thinking about private smart contracts is they go oh I want the blockchain to hold an encryption key to hold my password to hold some data and that turns out to be incredibly hard to do and quite problematic so you you prefer to avoid it and then finally and this is sort of the mundane more low-level putting my professor hat on like what are you trying to hide right are you trying to tie the state of the contract which the state metadata like which contracts being run that one turns out to be important the inputs or even the actual function right so well okay what are these things how do they break down well let's look at a couple of examples I'm going to go over three of them right which is sort of common things that come to mind right one of them is a simple game poker right the next one is let's consider something like payments this could also be like custom tokens custom assets any of these crazy defy projects right they all have these like custom tokens and underlie them right it's like a video game arcade at Chucky Cheese right you built this whole complicated machine but you also have these custom tokens you have to put into it to power it and you might need privacy there and then finally a typical thing that comes up I'm not really sure why but it's what everyone thinks of it's like auctions right you want to do a sealed bid auction to price an asset right and these all it turns out have some privacy goal they want but they're different right so in terms of poker right who needs to verify what's going on well it's only the people playing the game right if you all show up to a poker table you decide to do hand the only people who care what's going on in the poker game really all the people there right and they only care about it for as long as they're playing the game and they get the money out after that nobody cares alright so veil needs verify it then and finally right the secrets who has what card what hand that's just shared between them the blockchain never needs to know about it right you don't need to get them to keep something permanently so this is somewhat easy right the state you want to keep private is you know what people's hands are the inputs actually the bats the actions that like raise call flip the river card those actually can be public so this is one setting in contrast payments get a lot harder because in the payment system everybody needs to be able to verify what's going on because anybody you might pay needs to know that your money is actually good so this process is a bit of a problem right and they need to verified anytime in the future the people who keep the secrets well that is simple in this case is anyone who's holding the bag right anybody who has money he has crypto tokens those bag holders they need to keep the secrets but nobody else and for that you're keeping all the data secret the balance from the to everything else right and then finally for like a sealed bid auction again we're back to the participants needing to just know what's going on only during the auction so this is similar to a poker game but the difference is that the secrets are kept with an auctioneer those are the bids and the bids are what you need to keep secret so what do we do about this well there are a couple of different techniques you can use that can work for various things there were basically three on the first one is a thing that's called refereed the computation this came out of academic work in 2009 him that nobody ever heard of and nobody ever cites but then got sort of reinvented I think completely by happenstance by things like true--but and arbiter manof chain labs and no doubt other things I haven't thought of this is sort of like state channels in a certain sense and these provide a certain kind of privacy the next thing is trusted execution in the form of either SGX or MPC and this is really sort of the Holy Grail but it turns out to be problematic and then the final thing which is sort of what my research is on and in fact I have a paper appearing this year on is sort of zero knowledge-based execution protocols and so this starts with Z cash which does privacy just for a fixed function which is payments it got generalized on some things that say oh you can have multiple different functions that standalone it's basically different block chains then called hock and then the latest piece of research which is by me and my co-authors actually so you can have general computation instead of a composable way right so I'll give you a brief overview of these threes that's techniques so refereed computation is you know sort of like a state channel and it actually is the closest thing to a wheel-like contract in the sense of what we have under the law right you have some parties they agree to do some stuff they do whatever it is off chain as long as everybody's honest right they don't disagree nothing happens on chain you have no privacy problems if there's ever a dispute though you take it to the blockchain and the blockchain is supposed to mediate the dispute right and so this works quite effectively quite efficiently it doesn't have privacy inherently when you resolve it usually when you resolve it on chain everything's public similarly to a court case but if you do have some other a privacy solution for doing private computation on chain turns out you can make this private right and you can use this for something like a poker game quite well it works nicely right and so in this case right this works for systems where you know only the participants care about the correctness only insures correctness well participating because you actually have to be moderating with these people and it hides pretty much everything if you get the dispute process right so that's one option but it's limited right it basically works for these things where you only care as long as you are in the room right it doesn't work for money and the reason it doesn't work for money or anything like it is because a year ago when you weren't part of the cryptocurrency scene or whatever twenty guys could have gotten together and decided they were going to invent a bunch of extra money and since you weren't in the room you didn't see them do this so you couldn't dispute it on chain and now you have no idea what happened right so the only this only works when you've seen all the state transitions the next thing you can do is SGX right or multi-party computation and these are actually very similar from a conceptual point of view they basically both conjure a trusted third party out of thin air right either do it by assuming you have hardware that's secure or by assuming that you have some number of servers one or five of them are honest and then you do some crazy cryptography and ideally this provides exactly what you would want like a perfectly private smart contract that can keep secrets and do everything in practice it's a little bit of a challenge trusted hardware is frequently broken right like Intel has had problems we don't really think you can do this securely if you're dealing with a serious attacker and the MPC stuff is actually expensive and in particularly dealing with parties who go offline both for SGX and for MPC is hard because if you have encrypted data on your blockchain and the guy holding the key even if you trust him disappears your data's gone so you have to figure out some way to you know share secret share key and have a bunch of people then you know we've refreshed shares and someone goes offline you have to hope people don't get corrupted if you screw this up and someone pretends to go offline and it comes back they can end up holding all the keys and either in PC or SGX and then they have all your data so it's risky right but it does give you the ideal right so in SGX NBC what happens everyone can verify because they are supposed to trust this mechanism they can verify forever but before after assuming they trust the nodes that are running it the MPC or the SGI can actually keep secrets it can keep encrypted data on a blockchain and everything's hidden but at a very high cost which is dis conceptually this stuff is incredibly brother so that brings us to the zero knowledge approach right in any idea is instead of posting your input to the smart contract and the existing state on chain you just replace all that with a zero knowledge proof that hey we did this update and it's totally correct naively if you do this you'd reveal the actual state so okay you encrypt that you hide that same thing you do and like say Z cache but they're two problems with this naively if you do this this way it reveals the metadata of like what program is being run what payments are being made and if you and it reveals what function you're running so what do I mean by this well consider a basic ERC 20 token write your state is a table of who has what money the function you know allows payments decrement one row increment the other and if you naively did this just let's prove this is correct you'd run into one of two problems either everybody would be able to view this table who is part of the the RSC 20 dokkan so you'd have no privacy or you do something weird will you leak which things being updated all right so what do you do instead why you take this table and you split it up into little mini tables which are kind of like UTX those where each person has their own separate state right and now nobody can see all this thing necessarily when they're doing an update and so you have this but you still haven't solved your privacy problem because if you want to make a payment from like Bob to Charlie you have to say I'm gonna update this entry this blob and this blob and people are going to know you're updating those thankfully we know how to solve this right we just do the same thing that Z cash does right we put everything in a miracle tree we prove the new entries on the tree and we show that the records are correct and we break this linkage right this is fairly simple it was straightforward to do once you have decency case snarks the question is and the thing we actually really didn't sexy is you know how do you get this to work what's the computational model and so in this the computational model is you have a commitment to data on chain and the commitment contains the code that created it and the code that's going to run when you try to hit like update it and then every time you do a transaction all you do is prove and zero knowledge that the code the Creator that was valid and actually ran that your transaction is well-formed and that the code that was supposed to run when you updated it actually ran correctly right you actually do this via a layer of indirection where you have multiple different ZK snarks and the cool thing about this is that unlike previous work which did this is a standalone thing in this system you can have multiple different assets multiple different custom contracts and they can all communicate with each other privately and nobody will know which ones which write versus in the previous models you had basically a version which was D cash a version that was some custom asset another custom asset and everyone could tell which one was moving back and forth so in this model you can verify everyone can verify what's going on because the zero knowledge of proofs are correct you can do it at any time the secrets however do have to remain off chain and so that's a little bit about a little bit worse but this is I think quite effective and so we have you know these kind of options to do all this stuff and I think the zero knowledge one is actually something you'd seriously consider it so with that I'll take questions also on the off chance that any of you want to study this stuff I'm starting at fall 2020 as a professor when I'm looking for grad students thank you [Applause]