Introduction to MPC and circom-mpz | Nam Ngo, PSE | ETHTaipei 2024

um so good afternoon everybody uh thanks for coming to my talk um today I will uh do an introduction to circum mpz so that is about two-party computation so I promise you that this talk is only about simple things right so we we actually need to take a break after J's talk at all um so uh first I would like to start with uh el5 to MPC so imagine you have this problem between uh like you 5 years old and also your friend 5 years old right so uh you are Alice and your friend is Bob um so after the the New Year both you have received some uh red envelopes right with some amount of money and then uh because like you are 5 years old you have this uh childish competition between you and your friend and you you started to wonder that between you and your friend who has more money from the red envelope right um but the problem is you don't want the other to uh to know your mouth because like you know it may be the case that uh you know it's uh like money is some sensitive thing even for five years old uh so um a solution could be you go to ask a trusted anti right so you have this honest aunti that is available to you in the house and then uh you get Okay so my auntie is honest she's an adult she's going to keep the promise right and then you reveal your amount to this honest auntie and also your friend also trust your auntie and also tell this amount and then because the honest Auntie has already like not both your mouth right so she can actually do the comparison herself in her head uh and then uh say that okay I'm sorry but your friend has more money than you and she's going to keep the promise right because she's honest and uh you know like no your friend doesn't know your amount and also you don't know your friend's amount it's fair but you know like life is not that ideal imagine you you don't have shut trusted anti what do you do uh so I can tell you that uh you can replace this uh Dred anti with the MPC anti that is made available to you through some uh cryptographic Primitives so it's called MPC right so uh this actually give the uh very much the same results so you can tell this MPC aunti your amount your friend does the same and then this MPC ATI behave exactly as the um trusted anti so she will this uh MPC anti will only output the comparison result uh without telling the other your private amount so um so this is what MPC is is about right but uh maybe we can uh you know like grow up a little bit and then actually understand more about this MPC so what is MPC actually uh you can think of MPC as uh this box right here so NPC stand for SEC multi party computation so it is like the appre abbreviation of this m p and C so multi party and computation uh but but the actual name is a security party computation so we may all wonder why uh you know like there is no secure in the appre abbreviation right you might think of like why not SMC why not smpc but just MPC because like what is the point of doing NPC if is not secure so secure should be implied when you do MPC right so that is the first property that we want uh so you have this box of MPC that there some function f that Alice and Bob can use to input their private input XA and XB and this box we output the Y that is the function f computed on XA and XP the three properties that we want out of this box is that first of all privacy so uh we want to make sure that only Alice will knows X8 and Bob will knows XB the second property is called independence of inputs so because like we may have this a synchrony in inputting the the the private inputs right so XA and XB they may be uh put in the box at different point of time so what if XA is input first and then XB can be dependent in some way so you can imagine the scenario where you have like salary negotiation or I mean this Infamous best friend or love uh you know like computation so you want this independence of inputs to assure some fairness to the computation right and then uh finally uh like also very very important you want correctness that this output is indeed the commutation of the function f on the uh private input XA and XB so MPC is as simple as this you know just replace some some trusted thing with something that is cryptographic um so uh like so we have like ZK before right so what is MPC in the landscape of uh the Privacy tool like what is MPC uh versus zkp so you can think about zkp so zkp allows the prover to convince the verifier that an instant X is true provided that the proven knows a witness W that Testify the correctness of the instance so basically you're checking this relation R between the X and the W and you want to ensure that it is one now now thinking of the term of MPC you just like have this check put in this box right so zkp you can think of it as an application specific NPC but only the pr has some secret that is W here right the the the verifier has no secret so MPC uh that Implement zkp is a box that allows the prover to input some secret some secret witness w that Testify the uh instance that is like X or X Prime and then the output is just a binary bit and but because like zkp is an NPC that does only one purpose it can be like very efficient because you you you can optimize as like the computation based on the the function right so zkp is an effici application specific MC that just does this thing okay so so um like now thinking about application uh you have application you have ZK then it BEC ZK app that allows you to do some like verifiable application right like ZK rollup ZK evm ZK VM um now if an application you at ZK ZK so that is like uh you have ZK ZK app that is like private app uh that is also very viable but you can can see that it allows you to have like only the uh the Privacy for the approval the verifier has no privacy uh like uh example application uh ZK ID like SEMA 4 or some some other ZK ID uh protocol so you can have private ID from the approver uh ZK ml ZK ml unfortunately you can only have either the model or the sample that is Secret you cannot have both so what if you combine up with MPC so application uh when you try to implement it with MPC you can actually have like private parties inputs from more than one this is by definition uh so you can imagine ppml that is an upgrade of dkml so you have both model and and Sample be be private and there are also other like applications has been considered before like uh by photographers or or some some other uh company uh private auction private voting or dark po okay so something that is like a little bit further ahead is f uh and what is MPC versus F so f stand for fully homomorphic encryption uh it allows you to do computation on ciper text so you encrypt some values and then you can actually do addition and multiplication on these values right just by doing uh some operations on the cyberx it is a very very powerful tool it can be used to uh build MPC but right now is sort of like expensive so it's really up to you um okay so uh I'm going to do a little bit of introduction to uh this gabo circuit so gabo circuit is a technique that you can use to uh Implement uh MPC a g circuit is particularly suitable for 2pc like two- party computation just you and your friend um so when you think about like MPC right it's going to be like this uh but what we really care about is MPC that is programmable so this is called generic MPC uh this part where you have Alice and Bob they have like some secret values and this output y is the same as before but MPC allows you to input like this public circuit for example what I'm describing here in the slide is the computation of an inner product between uh like two arrays of three elements from Alis and B so we want to compute the um the inner product of these uh two vectors without uh Alice knowing Bob's vector or Bob knowing uh Alice Vector right so so we we have got to uh describe this public circuit in some way so uh well there the name gabo circuit coming from uh you know uh circuit so you can imagine like uh here you do some uh multiplication for each of the array element and then here you do an addition here you do another addition and then you can get the result right uh so here is like 32 bits multiplication here is like 32 BS after circuit so uh like we can describe roughly how gabble circuit work so in gabble circuit you have two parties right there is the one that is called the gobler there is the one that that is called the evaluator uh it can this can be Alis it can be b or well uh they can switch roll we don't need to care about that is just that the the algorithm data runs are different so uh the goer is the one who will uh read the circuit description try to encrypt it and send along its private input in some encrypted way to the evaluator right so because this circuit is encrypted the elator has to be able to decrypt it in some way using some decryption case right so uh it can use like some some some some uh some mathematic here that uh try to obtain the decryption case Bas based on it private input here and then uh it can decrypt the circuit and and get the result so what is nice about this Sago circuit is that it has constant route of uh interaction so imagine if you here are doing some computation with someone that is in the America it is not a problem for gabo circuit because you just need to do this interaction once and then you don't have to do this roundout trip a lot of time uh but of course there is uh the tradeoff or high communication cost there are other techniques that allow you to do uh less communication but it requires higher route uh communication higher rout higher number of rout communication so well it depends on the the situation that you would what would want to use this technique or the other one but like it doesn't matter right because so I I believe me I have done some new deligance right I would like to really uh explain to you the uh technical details behind this gble circuit I've done this a couple of times but uh like at the end I realized that uh you don't really need it I mean if you really want to understand it you can go here uh so we have like some uh some write up for for gabble circuit but you know like the it is because I promised Simplicity in my talk today so let's skip all of these you don't really need to understand it to to start using MPC because you can use mpz so this is uh a library uh initiated by the TS notary team and uh at the MPC team we have done some more work to to make it uh you know have more features so uh let's forget forget about gabble circuit because all we need is actually focus on like how to write a circuit right how to describe this circuit here it is what important to us as the user of the technique so um you can use mpz there are several hardways uh so you can try to use uh this uh circuit trays so mpz circuits or some uh mpz circuits macros uh to describe the circuit is going to look like this right so you describe like bit by bits or even in the form of 32 bits uh computation but still like it takes you a lot of uh brand cells to be able to do this uh another way which will not take your brand cell because you will not able to do it at all uh this is like the legacy of uh the cryptographic uh development in the past right uh there is this thing called the preall phion circuit that is like uh highly optimized uh description of circuits like AES or sh but you don't have circuits Beyond those imagine you want something like uh well cck you may have it uh like some new uh some new Boolean AR uh some new Boolean circuit that that comes like today and you want to use it uh maybe there is no prone format for you to to use or it is not highly optimized as those that is before right so maybe just forget about this thing as well uh a little bit easier uh we uh make like uh the description of the circuit in the arithmetic form so you don't have to think about Boolean circuit so uh is called BMR 16 uh you can do direct uh for example here you can do multiplication between a and b and you can also do comparison so it's like these gays are gadgets that allows you to build circuit easier still you know I call this the Hardway what if I tell you there are more easier way that you can do so you can actually write circuit in circum and run it with MPC uh this is like some uh we we we have like this Soom ttic circuit is a interpreter from uh circum that is very very familiar with ZK death these day also aren and uh like some other PSC Forks before they talk about right that is like how easy is to use you have like T chain uh audits like ready for it so uh here this this is another part of the tun chain let's say uh you can write circum program and then you get uh some MPC ciruit out of it so uh how it works like you have some circum programs uh some part of the circum liap is also working right now with our interpreter you go through this interpreter and then it gives you a circuit Json that is like Artic circuit and then you can uh write a loader here in MPC uh and then you know just execute a circuit with some inputs from the G and evaluator and then you get the output so as simple as is you just need to write program in circum now uh like let's make an example right so uh privacy preserving machine learning uh with circum mpz so you can have some machine learning circuit in circum do the same as before here the ler you read the ways and the samples give you the inference result based on the circuit that you described before so like one question maybe uh how do we get this circum program for machine learning right turns out there are abundant of them you have this circum ml that is from the modulus lab they did some uh machine learning circum for fully connected layers and a simple Rel uh there is also s Li ml uh that is done by uh kti when she was with the PSC uh there's also caras to also done by uh kti uh and if you don't like caras you may use a tool to convert some Onyx model to caras and then you can use this and then the rest of the T chain is just the same okay and you can also if you don't like mpz you can use another loader here for example there are other libraries that allow you to do more than uh two parties like MP speed is um a library that allows you to do three four or as many as uh as many party as you want uh there is also motion so you see just replace this box here and then you you get it uh yeah like uh more MPC oh you can also uh try to use some f with it so basically because this uh Json Json Artic circuit is very very generic it just describe the circuit so uh if you have some idea using F you can also just write a loader in some f library and uh and do it as long as you support uh like enough guge for example if you have comparison gatee oh we have like uh some basic functionality as we described before uh we're working on like with more improvements uh for example we would like to enable scaling uh modular uh Prime Fu aromatic uh some more like Improvement on the um the description of the circuit like uh for example in the uh ppml you can imagine that uh it doesn't have to be uh a multiplication like between two Secrets if the goer is the uh is the one who is the one who has the ways right so it is like uh you you go from multiplication between two secrets to multiplication between one secret and one constant you can do that if uh the goer is the the one who has the way and right like it may be also convenient if you have arithmetic Tu Boolean conversion in in this Library oh sorry uh yeah we also have some wish list like those things uh we don't we don't think like we are working on them right now but it will be nice to have uh input sanitization some consistency check active security or some public auditability oh and so I think that is the end of my my talk uh you can scan this link uh it has like every link that I put before and now we have five minutes Q&A time does anybody have [Music] questions thanks for the talk Nam um I had a question around the tradeoffs that individual applications can make for themselves rather than just throwing a generic MPC tool at it so maybe for ML examples right wherein these are highly statistical and do not require like lot of precision can we maybe what kind of trade-offs can we make can we make like the field size smaller and maybe that way it makes it faster or what sort of trade-offs do you see that individual applications can make for themselves um yeah thanks so the question is about tradeoff yes uh try to make the MPC uh be more specific so we can um you know exploit some some something from it so it be less generic right yeah so uh yeah thanks for the question uh so I I put it here so the reason why like I try to make this tune chain this workflow so generic because uh like there is no Silver Bullet so maybe we want something this what I call the Rainbow bullet so you can change the back end um you can actually select what is best for you for example if if you have a lot of uh linear operation then it is best to use what we have here uh MP mpz BMR 16 that is like direct operation on arithmetic numbers uh if you have a lot of nonlinear like you have a lot lot of comparison or you have a lot of truncation like bit shifting left and right uh like you doing as is better if you use mpz that is in the Boolean format okay so it's all about trading off what what what you think about your circuit is um you can also uh look at the these uh new like not not so new uh they in the past they are not also not in Rust um so MP speed and motion uh they have some some some of the protocol supported have con uh let's say efficient conversion between arithmatic and Boolean so not as efficient in Artic not as efficient in Boolean but if you have a mixture of them this may be the the back end that you want do we have more questions okay thank you n thanks