ETHTaipei 2024 Workshop：PSE_Part 1

to notion page or the Wi-Fi password uh yeah Wi-Fi password if you need it who is not in the telegram group evam group yeah I can let me show you the code Ty March 21st one or you can just uh scan the QR code do anybody need QR code the yeah here we go no okay okay I think this is mostly our crowd today and I think we don't need the microphone so let me just talk so first of all like where happy to have you guys here uh uh to join us at the round table discussion and uh today have we have many awesome talks right from either from Jay or n and in this round table we're mainly focus on the application side so the two technical detail is not the uh the the point of the day yeah so uh today's agenda we'll focus on uh discuss with each other so if you have any thoughts just speak out yeah share with everyone yeah so the agenda will start from a quick brief uh talk from J and then to introduce F and MPC and after that we'll discuss some open issue and uh after the discussion the final part we might want to uh split into like two to three groups over there in the in the in in the table at that area and get a deeper view about how uh you can do uh with NPC and F to solve some real world problem and maybe incorporate with your own project okay so without further do um oh yeah there's another thing that uh the telegram group there's a link that you can take a note note inside it's a notion page so if you have any questions or feedbacks you can just put it on the notion page yeah and we all can see that okay so without further Ado um maybe you can have men to share the um talk about hello everyone I'm so can can you hear me well okay yes so uh so before I start I want to have like a question how many of you here is a cryptography like actually studying math cryptography and then you know like composing protocol and improve them studying or just implementing like Define draw so that is next question so actually write paper on it like moving things okay so I'm one so like the only one here uh so how many of you like familiar with DK like doing implementation and can actually like transfer that knowledge oh yeah several of you here this definitely no s well no like I I I shouldn't count them because like you know the like semi horse of this uh this this round type of discussion but you know like uh so my point to me here is that not many people are like in formal cryptography and also in like very technical cryptography um so like the majority of us is application Builders and uh unfortunately there are very few resource uh that is made available about this aspect of cryptography right so so we have like many W MK tutorial uh tutorial on Halo 2 on on circum like how how do you uh for some with DK but like about how do you compose an app using those we have very very few right I think like I've seen it before uh one uh one slide by do ship about like privacy preserving application and that's it and I'm not sure how how accessible is that maybe he he gave the top in one uh conference and then that's it so uh I think like we can do more about that so that is the the goal of of today um so uh I want to do some introduction about NBC and uh we'll relay a little bit with ZK so uh we can understand how an application Transit from ZK to NPC what we can upgrade from DK to NPC um so MPC stand for multi party computation right it's a secure PR for us to build privacy preserving application any application combined with NPC will allow you to preserve some private input to yourself still we have the correct computation and have the outputs that we want and it doesn't really limit to just two party I mean two- party is the most common case if you think common case if you if you think about about like human interaction uh some companies they may try to have like more uh more more parties joining in you can think of like hospitals doing uh statistic together um and there are also giants like Google Microsoft Facebook uh Amazon try to do some inference uh do some uh yeah commutation statistic on the customer data right so uh like privacy is like a most in in those cases so um now uh in web Tre we have like transparent data in web3 we have transparent data we try to introduce DK for scalability right using this verifiable computation we the goal is to to save cost on chain we can also do something like ZK ZK so uh but that allows only like uh privacy to the pro so if we think about ZK ml uh in the defon C give this like four dimension right you can either so zkl has very good application in automation so nothing is private you can also have either the model from the the company that is private or the sample in the from from the client is uh is is private but you cannot have both using just ZK so MPC allows you to upgrade a feature that is you can have both the private model and input the sample at the same time right so uh what I think about like using NPC uh in building application is that uh if you are from like non ZK world right you can think of so I'm having some computation I want to put it on chain but I don't want anybody to look at my data MPC is the right tool because it allows you to do like private computation for two Pary is or even more right uh if you are from the ZK world you are used to verifiable computation uh but you really need the capability of having more than one party to have the uh private input right for example um I mean so most of the most of the examples are actually from the financial world like if you're doing order book matching you don't want uh your order to be known by the other party just they can play games Financial games on you right so NPC is the right to so I think of that as like upgrade uh of of ZK to to NPC as so mean it's just as simple as that as application Builder we can focus on on that aspect we take an application we think about it what is the private feature that we want what is the Sensi data sensitive data that we want to expose to the other and we try to protect [Applause] yeah um I think it would be better if I stand over there because people are turning heads and probably make my my M bra so am I visible over here okay I'm not problematic at all walk in the middle no no I just don't want to be walking in the middle you a microphone no no no no am I audible at the back sounds good cool uh so um I I'm so my focus here is more than g f morph ention and probably more useful for actually this particular setting is an interactive way of doing this thing so I would just like I would just like take 10 minutes and I would ask like just just ask you guys raise your hand if any question in the middle and I'll happily answer those questions but and then stop me any way that you want me to stop at don't throw bottles at me won't be stopping but like days let's stop um cool so first I'll try to introduce and give you intution about F and then I'll try to introduce like a few applications you know the the things that we when we write FG stuff we sort of Imagine then developers will be developing these things so and then I I'll try to you know briefly introduce those applications as well so the way I think of fig is a simple blackbox think of like a f server right it's a blackbox and whatever happens inside that server cannot be viewed by anyone else so if I hand over my data to that particular server the server can perform computation on top of the data but we would never learn neither the server would ever learn what the data is right so you encrypt everything give it to the server it performs some computation and produces an output and that output is the function evaluated on your data that is that's a now F Works in a single key setting where you have a particular user that is me I encrypt my data give it to the server and the server let's say has a patented model you know like let's say they are afos and they train a very precious model um and they did not want me to download it but I want my data to stay private all the time right so I encrypt my input using my secret key give it to the server server EV valuates the model on my input and produces an output and I get the output so me and SE both are happy they keep the data they keep the model private and I have my data private now viewing F from this view is somewhat limited because there's only one secret key owner F also works in threshold setting where you have multiple users let's just say you have multiple friends and they want to participate together to figure out a very simple thing let's just say uh they want to figure out who is um let just say they want to participate in an auction right someone is trying to auction something off and they want to participate in an auction and need to figure out which one BS the highest right so I can have a Provident all these folks would participate in a distributed key generation operation and then they will encrypt their bits and will simply hand over these bits to the server and the server would perform on these F Cipher Texs and calculate the maximum of these and then output the maximum value and the friend who bid the highest would have sort of would have the identity corresponding to that and you can just decrypt it and find out the mins um so this is the threshold setting of now one view I would like to have like the way I imagine this thing the way I find Equity useful to be in is when you are building applications for the user because if I'm working on a phone all I can do is that I can set few Ms of data to the server in F it is very computer expensive for sure but the entire compute is handled by the server the client does not need to do anything the client only needs to encrypt certain things things and just send it up the server so the in scenarios where you know you're building user facing applications F sort of shines in this way because you can just offload everything to the server and like we have seen in ZK space as well you just offload everything to server I believe that that's the great cost for all when you sort of like build user pH applications because now the user now the user is not bottom like the only thing that is bottom like is the server and you can build any application like any compated application and just speed up Ser does it make sense any questions yeah uh I I'm new to like both uh fhpc world and my uh so um not for my understanding is that like B FH and and PC you have like multiple parties and they have uh private inputs but uh FH is kind of like they incred the inputs and handle all the computation to the the server and what NPC is kind of they have to one party perform some computation and then send some result to second party and second party come some result and uh so uh that yeah yeah and like uh and and how how do we like you know like what what's the tradeoff between these two approaches and like when when should we like choose one over the other I yeah please go the tradeoff is pretty clear in this case because in NBC world the two clients would have to stay online other the time or three clients four clients whatever that is and they will have to send data to each other and the data could be very high like it could be it could be it could range from GBS like from MBS to GBS in F World they just come online for the first time they perform distrib distributed key generation operation generate the keys upload the keys to the server and that is it they can sleep after and they equp their stuff hand it to the computes ands the box and that's it so there is first stateof I would say is the likess thing all the parties need to stay online in MPC World in F World they just come online once they sleep after that the second thing is in F the only bandwidth cost that you have is to approach the cyer text and probably the gun operations in MPC you will have a constant communication um but now I'm being biased towards F in this case because I am more from F side prob now be able to be more uh EX in this case I'm sorry uh would I me to pick it up yeah yeah because because I like the way I'm thinking it's bias towards f for some reason yeah so like thanks uh I've been talking about MPC right so FBC is actually uh the term for Collective of Technology including F oh so uh like the techniques that we can use to realize uh MPC uh we we can generally divide them into three categories the first one is called gble circuit the second one is called secret chain base the third one is called eny um so these three approaches they have different trups so for Cle circuit very low computational complexity I mean they just you do a little some a bunch of as even using the same key that is called fix key fix key as and fix key fix key a you can run it like using uh a native instruction in the CPU so like there is no instruction loading just fit the data and then it gives you the output so very very fast and also standardize standardized right uh the problem with that is you have to do a lot of communication but only in terms of B width you have constant round so you just send the data and then uh and that's it right if you don't care about the out outut right um so that is like low computation High communication low round so that is for G for secet chain base um you have also low computation low communication but High R High R complexity because you have to do this back and for right um yeah and then for f you have high computation but you have this freedom of like not everybody has to uh stay online and then uh you know like you can do uh like there is no R because you just send aide effect not it if you don't care about the the output of course uh yes question uh so in secret sharing based teams for MPC you say constant communication I I I I was rather expecting the communication RS to be linear with the comp uh the the complexity of the circuit that you evaluating uh it's quadratic it's quadratic yeah it's Quadra and it is quadratic with the number of part as well quadratic with a yeah okay so it is like if you have nend parties increasing the complexity then it is n² no no it's n n n Square n Square uh and then linear with the circuit complexity okay so yeah so what I'm trying to get into is that if you have n parties it scales quadratically the communication in in in in MPC am I correct yes yes it scales quadratically and it scales linear with the complexity of the function that you're trying to evalate um I would say the communication stay Conant because you you just need to upload it to the server the complexity on the comp of the computation on the server is L it is like as complex as as it gets but like it grows linear I would also like to confirm one thing in caral circuits uh for for for this for generating the BPL um no wait a minute that's for secret sharing right yes okay um for Goble circuits what's the size of the Goble circuit like is it linear with the lexity of the linear with the circuit size linear with the circuit size so and the combination cost is no combination cost like there are two party yeah it is also two- party right yeah so like saying you you have only one pair that's it but in the case of uh SEC training base you have more pair but you can also do secing base for two parties yeah um please sorry I just wanted to confirm with you that there are specialized NPC settings where the delegator doesn't even have to be online right you can send some pre-processed material to the notes and then it can go offline and just take the results back at the end in that case the delegator is handing over the secret data to all these notes not secret data exactly um some press material which help with the we that the user is expected to and so here the user doesn't really have to so from the user experience standpoint it's really better because you can go offline in yeah but what happens to the user private data does it still stay private no you don't send the Raw Fitness data sorry you don't send the Raw Fitness data from the delator standpoint you Mas that and send somee material so that was like a specialized uh MPC protocol buil for ZK delegation which like try to do something similar the user can go offline just send the private witness to to NBC and then just get back the proof generat okay I I'm not familiar with the work but I would like to yeah it's called ZK s but I'm I'm I'm still I'm still confused about like you Mas the data does that mean that like like how does the server like in order to generate the group collaboratively I I believe you're in collaborative setting right you are in a collaborative setting but the delegator doesn't really participate in that collaborative setting yeah but like in order to generate like you said Z proofs in order to generate a z proof we need access of the witness yes so so how how do how do these servers get access to the vs so at the beginning the delegator secret sh that among the nodes and and then they use those secet CH themselves and then yeah okay so when the servers come together they can take get the witness yes so they could collude against the that that's what I meant like the user is leaking their privacy to these that's what that's what I meant yeah it's like a semi honest setting yeah expect at least 50% of to be honest it is 50% yeah it's not it's not at you can make that malicious security that paper was how does the complexity increases with the this it it should be work I I I have a problem I so things like using FH like the only thing on the user side they have to do is to encrypt the the private input right and send it to the server whatever it is the blackbox will do the computation and send back the result so like if if my private input is a image let's say 4 MB Is it feasible in the state of our FH yeah it just the the larger the image sizes the more the communication you have to do that's it like the L let's just say that um right now I cannot give you exact numbers because I don't remember everything the top of my head but let's just say the every bit expands up to probably 50x so you just have to upload 4 4 MB * 50 oh that 200 M yeah that's it like you just you just you just so there's a there's a measurement called Cypher like PL Tex to CER cyhex ratio yeah in most cases is 8 so you can just probably well it depends on how optimized your circuit is but like yes so so if I like my private input is a like a photo I want to I want to like uh tell the government that somebody Park their park their car wrongly on the on the sideway and you plock the the way people want and I want to have this as private in so if it's at 4 M I have to if if I use an F I have to like have like 200 uh MB data encrypted data and send it to 2,000 2,000 because that's 50 oh I oh your initial dat was 2 mp uh oh 4 MP okay sorry my bad my bad I'm so is that feasible in like the mobile device so far maybe our our phones I don't know like is it is it okay to upload 200 MB but just just take my word for 50 it could be 100x as well I'm just keeping a number I see usually it is 52 something but like you will have to device a circuit that is optimized for this St um but in usual cases it's not like even for let's say in most cases when you work in L setting you sort of like crop the image Small Things the image is very small like for rest the IM are like 128 pixels some that so it's not like really b um so maybe do some preprocessing before the private data because because if if you using model that already exists like if you're cting a model from P do then and and you sort of like finding for your purposes then the images input images for those models are very small and the reason for that is like training a m model of big images is very expensive so a lot of people that have already retrained models they have very small they use very small training images and and that is very simp forg because the moment it is small we okay with it but like even if it sort of increases in size the the increase is lar it's not well it seems like we we are into the open discussion right now yeah I have a question so since we're dealing with multiple parties um is there anything uh architectural that is uh related to like the order of the participants engaging into that computation like can it be asynchronous or should be all synchronous like everyone submits their inputs and then the computation happens or is any kind of as synchronicity possible in either FH orc