EthCC 2: Sajida Zouarhi

[Laughter] hi everybody thanks for joining today so what we're going to see together are opportunities and challenges of blind and often computation so we're going to discuss about privacy and we're going to discuss about your online doppelganger so what we're going to see is what is your online doppelganger what is privacy by design and why we need it how does the web architecture today looks like and what it could look like tomorrow and also obviously I'm going to focus on blank computation and efficient computation so first thing Who am I I'm a some from Paris I'm an engineer researcher and an entrepreneur I currently work in at consensus as a blockchain architects I used to work in the past in several industries very interesting stuff that I learned and I shifted towards a more I would say social impact oriented project and basically how to help make the world better so that's kind of why I dropped from military sector I co-founded haha which is a project about cryptography and what chain Kidner which is about healthcare I'm going to talk about it after and also community initiative like the block fest and the chain Tech Association so since we have very little time for this presentation I'm going to ask you to ask your question on slide oh you have the link of slider here and you just use the code and you just drop me some question I'm going to answer to you later okay so first your relationship with 2.0 actors today looks like that the thing is when the internet started everybody was so happy we had access to information services games Wikipedia very very interesting stuff but something that we sort of noticed is that the first generation of developers they didn't put too much effort into security and your privacy and that's alright because their main focus was to was to make things work but after that this sort of vulnerability of weakness of the web was leveraged by actors because they started noticing that they will gain more value by collecting your data and having very little privacy around the data so that they can leverage them that's when they discovered that data was the new oil as you all know and that's why now that I mean even in the past aside creating services which goal was to make you share more and more every day and in 2012 I sing the sentence I to be said which is when it's free you're the product and I think that's when people started to realize what web 2.0 really was so your online doppelganger is basically yourself it's like a persona that lives on the web it's not something you need unique it's something that is distributed across platforms that you use every day and it's used to be its it is currently being used to targets ads for you to predict your behavior to manipulate you you all know I believe about the red and blue feed that happens during the elections so they change the way you see reality and also to monetize your data obviously without your consent and always without giving you money so I'm going to take two example that's one is very famous its Cambridge analytic ah what I've got what happens with Facebook the scandal and everything the other one is 23andme so just raise your hand if you know about 23andme okay now raise your hand if you used it sorry so the thing is it's very interesting for a lot of people to know more about the heritage the problem is you just want that service you don't really want them to know everything about you the issue with your doppelganger is that there are information about your location interests pictures where you've been your friends that's fine let's say tomorrow you want to change that you can just rebuild in your network change friends stop hanging out in the same location but you cannot change your DNA so 23 means kind of scary for me because it's the biggest private database for DNA that I know in the world and it's not regulated so something happened last year maybe you've heard of it scientists here in me got 300 millions dollars from GSK they're sharing information analyzed of you and they're putting that in the hand of pharmaceutical companies obviously they're getting a lot of money and obviously you're not being notified or paid so when we say love that we understand why privacy is important to our individual rights and why even as people building the next generation of application and the centralized application we should be concerned by that the question is can we reset the web weekends but I truly believe that blockchain is giving us the opportunity to reshape it at least so since we are basically taking this new approach at three building the web we should not make the same mistakes that were made before what the web was created we should take into account privacy by design from scratch so I don't know if you know about gdpr I mean obviously you know because there is so many so much communication around that but I found a website that is explaining it's in plain English and it's actually pretty fun so I put the link here it's like that could be online and I'm just gonna let you read one of the stuff and basically it's just common sense maybe some people when they read that you'll be like oh that wasn't the case before so gdpr is not only something for Europe it's something for the world is something that is going to be I believe a global shift maybe it started in Europe but Fermi is going to be a trend world wild and I really believe that it's better to get ahead of this right now than to wait for regulation if it's not just moral and ethics to make you make the change in your application and start focusing on privacy right now so let's talk about is it bothering you the telegram stuff no okay so so let's talk about web architecture how is this today how it will be tomorrow so this is a very simplified view as you can see you have a user wants to use a service it's maybe your app are good app sending you an encrypted data and then this application is going to store it and I'm calling it orphaned data because basically even though it's encrypted by the application it was not encrypted by the rightful owner which means basically that it was not encrypted client-side so it really is not data that you have governance over so the application is then going to use that data to compute and provide the service to you maybe it's free maybe you pay for it what we are envisioning for the future is something more like that this time the application is using assert services for example hellhound which is the project I'm working on and it's basically a platform to perfrom blind computation leveraging option network of hahahha notes and those nodes they know nothing about the data and they have no business in whatever the DEP is doing but they're going to be able to compute over encrypted data that is since then they're going to be able to give back this result to the application then the application is going to be able to do its job and give back the information to the user so as you can see here everybody is still in the picture nobody was disrupted it's not about you know changing everything or making people stop their business or like destroying 23andme or other services those are very valuable things we just want to have separation of concerns if you're here to provide DNA analysis or hosting you're not here to access my data and be able to monetize it and do whatever you want with it but it's just the way it is today it doesn't mean it has to be like that tomorrow so here we have a solution to leverage encrypted data efficiently and safely ok so now let's see the solution how does it work what is bind computation compute a line computation is more of a set of methods you can find in its homomorphic encryption secure multi-party computation and for example zero knowledge proof that are quite famous I put together a drawing here very simplified for homomorphic encryption so you have Alice on one side has some private data wants to delegate the computation to a third party Bob Bob is going to be paid for that that I this doesn't really want Bob to have the actual data why should he have that so Alice is going to use her pair of private and public key and is going to encrypt the inputs with her public key send the ciphers to Bob and the circuit which is here simple addition for the example which was also generated with the keys is going to be able to add cipher a and B and get ciphers C and when you decrypt cipher C using the secret key of Alice you get 7 which is pretty good 5 plus 2 equals 7 so if you now take a look at secure multi-party computation is quite different because you're not encrypting the data the inputs you're splitting them so you have n actors in a system that are going to work together to do a computation and so the issue of multi-party computation I would say the trade-off is that you need to be online is in interactive circuits so if you're asking for the computation you need to be connected and you need to participate to the computation that is not the case for homomorphic encryption but one of the issues with honorific encryption is the noise so the more complex your program is every step that you add your adding mathematical noise and so you have you know methods like bootstrapping that you can use but it's you know it's always a trade-off when you enter this field an example I put together like I put two pictures here of trampin butene you know they want to know who is the richest maybe you have your opinion on that but they don't want to say to each other their fortune so how are they going to be able to know which one has more money without disclosing this information secure multi-party computation solves that problem called Leo's millionaire and I think it's a very nice introduction to the topic and of course they zero knowledge proof you can check the Alibaba cave metaphor pretty straightforward now why are we talking about blind computation what is the the importance what is the impacts well if you are able to remove the privacy barriers you can create new ways for people to collaborate you can create new services you can unlocked an attendant a pool of use cases put some example here one is the kidnap project that I've been working on in 2015 I think it's a great example because it's also a project that aims at leveraging blockchain and here blind computation to save lives so it has a real impact and it's basically about matching healthcare information you find compatible donor for kidney paired donation so for example Alice and Bob are not compatible and Bob needs a key Alice needs a kidney so what do they do is it the end for them no they can join a pool and maybe we can find out another pair which is in the same situation is going to be to have a compatibility for example here with Alice and Bob maybe can give to Carol so this is a simplified example you can have change up to I don't know like 60 person involved so it's something that needs to scale to be efficient and so it means that hospitals needs to work together but we saw earlier that data was very sensitive so you're not going to convince hospitals to share patient data together like with each other that's never gonna happen but if you say you're not sharing the actual patient data you're only sharing encrypted data then now you can create a framework of collaboration for them and blockchain here is also helping us in this use case just for governance purposes because no hospitals wants to be you know no hospitals for example in France wants to have the hospitals maintaining the system being in the US so that's also a way to solve that if you want to take a look at a real demonstration using harm or fake encryption check the hellhound demo that we presented at DEFCON so basically people were able to come at the stand and at the boosts and ask for some computation choosing numbers that they would not tell us encrypted them on their phone sending it to our platform and we're able to recover the results of series of operation so option computation is the second aspect of that I'm not going to go into details you can take a look at layer two solution and choose pretty interesting stuff my message here if you know about the impossible triangle is that you have to do trade-offs you cannot have the centralization scalability and security at the same time on blockchain and it's so funny because many people are struggling for philosophical reasons and they're not taking an engineering approach to that just want the best solution for your system that's why I'm using half chained computation because I know that if I'm using cypher text which are bigger than plain text I don't even want to consider doing those things I'm Shane doesn't work so it's not because you're taking an option approach that you are sacrificing the centralization and this is a metaphor that I use which is the one of the human body bones in our body only represents 50% of the body mass but if you remove them what happens nothing good so even though even though it's not the majority of the body mass is still a very important component that's how I see blockchain in our project architecture you need it for critical steps you might need it for handling rewards stakes decentralized reputation we use it for a hellhound to do all that but everything that has to do with computation we just don't do on Shane we use proof we use miracle ization we use other techniques so I'm going to conclude so bang computation perform off Shane even on interested hardware so I added that just to tell you that we're not going to talk about as jigs until in clave but that would have been interesting and that will allow you to control your online doppelganger and now you're in control it's not as scary as it was before because it's your web 3 double ganger you have self sovereignty on its you can manage your data you can manage who access seats you can mind how basically can create your own terms and conditions for a change you can use services from actors that don't necessarily but you don't necessarily trust around your data like 23andme but still you like their service and you can use it to collaborate with other actors that might be competitors like in the kidney example and then you can share information that are going to be used for better service without sacrificing for example a competitive advantage that you have thank you and if you have any question feel free to use the slide oh you can also send me an email find me at the conference take a look at the capture the flag challenge that we are doing with some sybers pretty an auditing project of the ecosystem and if you want to go deeper into what we've talked about you can basically check this reading material in reference thank you [Applause]