ETHParis: Building privacy preserving DApps with NuCypher

all right everybody my name is McClain Wilkinson one of the cofounders of new cipher we are a data privacy layer and access control layer for 3mm applications are sort of reason for existing as a company is to build the developer tools the infrastructure that make it super easy for all of you all to build privacy-preserving applications protocols and tools and we really work on two core pieces of technology one is our new site for network which I'll talk mostly about today and that's just a way to provide decentralized access controls for your D app so a way to build and to end encrypted applications on top of etherium and other smart contract platforms and the other is longer-term R&D that we do are in laddus cryptography and specifically or mostly in fully homomorphic encryption well the new cipher network itself is a decentralized access control network that uses something called threshold proxy re encryption in the obvious you know question to ask before we even get started is why can't you just use traditional asymmetric cryptography or traditional public key cryptography to basically take care of all the you know confidentiality and privacy in your application you know obviously traditional vanilla asymmetric cryptography is very well understood we have this traditional Alice and Bob narrative where Alice has some secret message or secret data that she wants to share with Bob and no one else so all she has to do with public key cryptography is just encrypt that message with Bob's public key she can send that message across the network to Bob and he using his own private key is the only one who can actually decrypt that data and read it so this is you know very well understood very easy to reason about very secure where it gets a little bit murkier is if we start to extend this into the context of an application so if we take you know current web today almost all these popular web services we use from Google Dropbox Amazon and Facebook are really predicated on this idea of server-side decryption this is because most useful applications are multi user so if Alice uploads some encrypted data to Google there's not really any way for Google to share that data with Bob or charlie unless either alice gives that person her private key or unless the data gets all decrypted server-side with Google and maybe it's okay maybe we trust Google we trust Amazon we trust Facebook or a lot of us here at Global probably not but we certainly don't trust some of the people that are trying to break in to these servers whether they're nation-state hackers or just malicious cyber criminals or blackhat hackers and if we take it to sort of oops well you can't see them but they're supposed to be giant picture versions of these small little guys here Vegas lighting is not good enough but if we take to the next logical step of decentralized applications we can't have anything decrypt a server-side that's sensitive because this could be a server or a node that's under the control of one of the people were trying to protect that data against could be an IP FS node and Iran it could be an ethereal node in Russia for example basically how need to have some way to protect the data from the minute it leaves Alice's premises to the second it gets to the intended recipient and never exposed anywhere in the middle so if we were to try to build some sort of access control network using just traditional public key cryptography basically that would mean that all the nodes in the network are having to decrypt data from Alice encrypted again for the recipient and send it along so that means every node in the network has access to the plaintext data that means any node if it goes offline or just wants to deny somewhat access can do that some of you might be familiar with this idea of Shamir's secret so we could improve upon the situation a little bit by splitting the private key up into a bunch of shares and issuing those shares out to different nodes in a potential access control network and this is an improvement because no one node can access the data or no one note can deny access but we still have this problem that a sufficient number of the nodes conclude in order to decrypt the data or did I access so a new cipher we something called proxy Ari encryption just sort of close that loop so that everything is encrypted from Alice to Bob and not decrypted anywhere in the middle and what proxy encryption allows us to do is it allows Alice to use some untrusted proxy to re-encrypt a rekey the data it is originally encrypted under her key into being encrypted under Bob or Charlie or Dave or Evans key and for the magic about proxy rien Krypton is that this rien Krypton or this rekeying happens without ever decrypting the data in the middle so the proxy only ever sees encrypted data and never sees plaintext the storage layer only sees encrypted data it never sees plaintext and just to sort of maybe help you understand that a little bit more we have this little video example here let's say we have an alice that has a bunch of private data in this case let's say it's just financial data in Excel she wants to encrypt that data and upload it to some remote storage so she encrypted on her client she uploads it to s3 or ITF a store swarm at this point she's the only one who can access that data if Bob tries to use his private key to access it it's not gonna work he has no way to actually decrypt the data so that will fail but let's fast forward a couple days and let's say Alice decides after all she does want to share this data with Bob what she can do is she can create something called a re-encrypted key and a rien kripp Shing he has two inputs the first is her private key and the second is Bob the recipients public key but there's no way to actually get these two inputs back out once you've created the rien Krypton key it's a one-way function so she can give this rien kripp ssin key to a proxy or some node in the new site for network and that note can use this free encryption key to take the data it was originally encrypted for her andrey encrypt it so that it's now encrypted for Bob and in the new sign for network the nodes basically get paid for this work and once that re-encrypted has happened that bob can take that re-encrypted ciphertext use his own private key to decrypt it so the proxy never sees the data the storage layer never sees the data just Alice who obviously is the original data owner and Bob who is her intended recipient and the other nice thing is Alice and Bob their private keys always stay with them so they're not passing around private keys so this sort of vanilla proxy encryption that we just talked about gets us pretty far in building an access control network because now no node has access to the data but there is one problem in the sense that we have one area encryption key with one node which means that if that node goes offline either because for the no fault of its own it loses power it gets ddosed or it's maliciously denying people access if that node goes offline Bob the recipients gonna have no way to get the data so we want to build in some degree of redundancy some degree of greater collision resistance and what we do for that is we use a threshold proxy encryption scheme that is actually very similar to shimmy or secret sharing but instead of splitting up the private key into a bunch of shares we split up the re-encrypt in key into a bunch of shares so in this case we just split the cripton key up into five shares as long as we have three of those shares the reading krypton will be successful and Bob will be able to access the data so that effectively is what the new cypher network is it's a network of these proxy nodes that are accepting re-encrypt and key shares on the behalf of Alice they're enforcing potentially any conditions such as time or payment that she wants to impose on that sharing policy and then there Rhian crypting ciphertext for Bob so we kind of a couple new characters into this traditional Alice and Bob cryptography narrative the most obvious one is Ursula and Ursula is what we call the proxy node so if you're writing an application for a new cipher you're gonna be using these Alice and Bob characters if you're running a node in the new site for network you would be using the Ursula character and then we also have this this fourth Enrico character which is the data source in many applications Alice and Rico are going to be the same character you know I'm producing data on the Alice the data owner I'm the data source as well but in other application this use of what a kind of delineate between Alice and Enrico's because there could be many data sources let's say I am an Alice I have a lot of data sources I have my watch I have my smart phone my laptop my you know email account all of those are Enrico's in the new cipher narrative if you want to be one of the Earth's of the nodes in the new cipher Network basically we require nodes to stake the new cipher token is a kind of bond or collateral so this is basically a work token that we use to allocate work within the network and to coordinate the network so let's say you staked 5% of the new site for tokens you would get 5% of the re encryption work if you do that work correctly you would get 5% of the compensation and the payment for that work it is also a way to make sure that nodes behave correctly so if you're an Ursula node and you decide you know you're knocking into your job correctly you're just gonna give me random garbage gibberish instead of properly re-encrypted anyone can submit Lisa clear cryptographic proof that Rhian ssin is incorrect and you would get slashed and forfeit your stake so that's an economic incentive for nodes to behave so we have this heartbeat demo that I'll walk through in a second and I think it's it's very nice because it kind of clearly illustrates all of these different characters and what their roles and responsibilities within the network are so we have an alice who is the ultimate data owner or the policy owner we have this heart monitor which is we've considered and Enrico in the new sign for network it's producing data and case alice's you know heartbeats and encrypting them under Alice's public key in this demo we'll just save the data locally but in practice you know you could use any storage layer it doesn't matter and decipher is agnostic to whether he is swarm or IP FS or s3 and then we also have a doctor or Alice's doctor who was a Bob so this is the recipient that alice is going to grant or delegate access to her heart main monitor data to and then Alice will issue basically a sharing policy to the new site for network saying hey I want Bob to be able to access my data Bob will interact with the new cypher network to get this data here re encrypted for him well let's see if I can get my terminal to show you oh there we go this is gonna be tricky because I can't actually see it on my computer I'm gonna have to turn around so look at the screen here okay so first thing that we're going to do is I'm going to spin up a couple of these epoxy notes just locally so I have this bond let me demo Orsola steps here so we'll start with and that will basically the best our our first oxy good obviously each person or each node in the network will have their own pudding in here should put is oh so that's the first node so right now the network not especially for there will spin up couple borer and in that one will run this by the way I'm just running all this locally but we do have a a definite which all of you can have network up in the line here five five this script will create five or six more the proxy nodes and he will connect to that initial node spun up learn about it it will learn about them and we'll all learn about each other no please switch back first or slowly from the other so now we have a network of m47 Ursula's that are anything locally and they're ready to basically that policy very policy on behalf of you so we'll jump up to the palace valishia hi file here and this is just a script base that will you pay this pusher will skip this stuff this is your turn about back to you first so let's eight-hour Alice what we'll do first is will try to if there's an Alice already exists it stayed to disk there's not so this is to Alice we're creating batch here we're gonna tell her to that network of Ursula's and we have been healthy all right now for no discovery for network we'll create a label and now Alice you know have an alice has some data roster of labels and you can think of it kind of like a file path or directory Alice might have a bunch of data so she has email she has text messages yes snapchat social media she doesn't want to give Bob access to everything she just wants to give Bob access to this hard data so she'll make this hard data label she will create basically a policy public key for that label and this is the public key that all the hard data is going to be encrypted under so when the Enrico's data sources are creating data it's all going to get encrypted under the policy key here we're just gonna generate a bunch of pests or dummy data for the purposes of the demo and we're going to encrypt it under that policy key so now we have a bunch of encrypted data and now we could fast forward a little bit and we could say okay I want to share my data with dr. Bob so what she needs for that is if you remember from earlier in the presentation a rien ssin key consists of Alice's private key or the policies private key in this case which obviously Alice has and the recipients public key so we need some way to get you know the recipients public key and we'll just to see what happens through some song channel maybe she went into the doctor's office and he gave her his public key there so we've got the public key will initialize you know a Bob the same way did we did an alice and then we don't want to just give Bob access forever so we're gonna create some conditions and these can be any arbitrary condition that you want in this case we're just going to set an end time for the policy so after in this case five days Bob is no longer going to have access the axis is going to be revoked and we're also going to set these threshold M of n values and the M of n values are basically the number of shares that we're going to split the re-encrypted key up into so in this case we have M of two in and of three so there's gonna we're gonna take that reading shinky split it up into three different pieces send those three different pieces out to three different notes in the network and as long as two of them properly re-encrypt Bob should be able to access the data so we have that policy we'll call this Alice or Alicia out grants function method to actually issue it out into the network and if that works we should have this policy living out on these these these Ursula's that we previously created so you'll see a similar thing Alice has to learn about the nodes similar to how the nodes learned about each other as soon as she learned about three of the nodes she'll be able to send out her three three encryption key shares and it printed out done so it looks like everything worked she had the access policy created for dr. Bob and assuming that did work Bob should be able to then go and ask the network to re-encrypt for him so we have a similar kind of script for Bob here that will sort of show how to do that we'll skip some of this setup stuff similar to how we initiate initialize and Alice will initialize a Bob so this is the receiving character we need Bob to join the policy that alice is issued out to the network so basically use that label whoops we'll use that the label is basically the name of the policy that dr. Bob is going to join so he'll join that policy I'll check that it is actually well he'll use Alice's signing public key to verify that the policy is actually created by Alice and then he will go and fetch all of the encrypted data from whatever storage layers in whether it's Amazon s3 or IP a faster swarm or weave any we're a new site for Network agnostic to the data store so fetch that but obviously it's all encrypted under alice's policy key so at this point he has no way to access it he needs to basically send that encrypted data to the new cipher network and ask it to re-encrypt for him so this is what's happening here he will basically say hey you sorry for network please rien crypt this data for me if there's a valid policy on the new site for network all the conditions are satisfied the Ursula's will do that rien krypton they'll give him back Ari encrypted cipher text that he can then use his own private key to decrypt and if that works he'll have the plain text oops they'll have the plain text and we'll just print it out and see if we're able to read it or not looks like there was no policy oh yeah so it looks like it worked we can see all this heart rate data points coming in getting re-encrypted and then printed out in plain text for Bob so I don't have it as part of the demo and the scripts but we also have the ability to revoke Bob's access so let's say you know six months later Alice decides okay I'm going to switch health care providers I have a new doctor I don't want Bob access today anymore now it's Charlie so she can create she can basically tell the news hard for network hey revoke this access policy for her Bob issue a new went out for her new doctor or whoever she wants to share the data with okay so we have basically a couple different test sets that are available for you to use this is basically the federated staking test net so if you want to run one of the ursula nodes this is the one we recommend that you do it on all the instructions for doing that or on Doc's dot new cipher comm the name of that network is I think you pronounce it Oh MOA it's that weird celestial thing that flew past the earth a couple weeks ago this is the initial seed node that you would learn from but if you're just building an application or the app we actually recommend that you use the dev net which I don't have the information for here but it should be on the hackathon repo on our github which I have a link for later and that is just a more stable thing that new cipher or us as a company are running all the notes for that so not just random people out there in the wild so you have basically better guarantees that all the nodes will be up and available and it'll be a lot more stable so I'll just sort of wrap up by touching a little bit on the research of some of the research stuff that we're doing mostly around fully homomorphic encryption and for those of you who aren't familiar with fhe basically homomorphic encryption is this idea that in the same way that you can take some plaintext data apply a function to it get a result a amorphic encryption says that you can take some encrypted data apply a function to it and get an encrypted result so we're primarily interested in looking at this for obviously blockchain application so potentially applications for smart contracts so you could have private smart contracts where all the inputs are hidden in our private so you could imagine things like secret I SEOs or private auctions private voting potentially those sorts of things we've open sourced a little bit of our early research on this one is the most interesting thing is probably this new fhe library which is a GPU accelerated homomorphic encryption scheme it's about a hundred ex faster than non GPU accelerated schemes which we as far as we know make it makes it the fastest fhe library currently available you can run it it's open source that's all right under the new fhe repo you need obviously a GPU to run it that's what we used to make it fast and we actually use it at Berlin to run the first-ever fully homomorphic support contract is it kind of proof of proof of concept so be really cool and if you guys hear it sort of drove that even even further so this weekend you we'd be very happy to see you build something with new site for network or the new fhe library we have twenty five hundred dollars in prizes one is for the most novel split between two prizes one is the most novel use case for either to decide for network or new fhe the other is the most impressive technical implementation so we've very interested to see how impressive of technical achievement you can do over the weekend at Denver is kind of challenge someone actually implemented a decentralized 23andme with new fhe which was pretty impressive I'll just shortly mention this the day after eath paris ends we're doing a virtual online hackathon with coinless that runs for a month so if you like building with new site for over this weekend you want to keep doing it we'd love to have you join this as well more information obviously our websites Doc's new Cybercom we have to get start getting started guides we have sort of instructions for how to run that same demo that I showed you tonight on your own machine the main proxy encryption new cypher network is under the new cipher repo on our github our threshold proxy encryption scheme that we use is called umbral you can also take a look at that if you want to work with a sort of a lower level cryptography library and then we have the new fhe homomorphic encryption library I'll be around most of the weekends we have one other team member here you're happy to try to help you in person if you can't find us the fastest way to get help or ask technical questions or you know get stuff resolved is on our discordant so all of our engineers hang out there pretty much twenty seven so we're distributed team someone will probably be around no matter what time you ask your question and that's it thanks for hearing me out and excited to see what you guys do this weekend and I'm happy to take any questions or chat with people after