Cryptography on the Blockchain

[Music] hi guys I'm a researcher at UCL and for the past year I've been building this cryptography library and there's gonna be a disclaimer for this talk I'm not going to go deep into the math the Z cos foundation how Privett is some useful workshops that I'll do that later on and I only have 20 minutes and the teach cryptography you need more than 20 minutes so instead what I want to do is they want to leave you with an impression that cryptography can be really useful for smart contracts if nearly essential as well but first what is cryptography well when I talk to non experts they tend to say that cryptography is about designing ciphers ie encryption and decryption but hopefully has some people in this room know over the past 30 years and if the rise of the internet cryptography is so much more it's a bit of santak hitting people on the Internet ie you're a theorem account or endorsed an information ie a digital signature you know that's authorized your transaction span some coins and even more it's about building publicly verifiable protocols where of a group of people run a protocol and I'm not involved they can send me the transcript and I can have fifth or actually I can be certain that that protocol was run correctly so as I kept tog refer when you look at aetherium you wonder what does aetherium offer well another goal of cryptography is to minimize Trust we want to remove as much trust from this system as we can but in every system there's always a little bit of trust so when we design a system sometimes there's a trusted third party but what's really cool about a theorem is that a smart contract can be your trusted third party with publix did so because our public's did and it's a little robot over there it gossips it reveals all our secrets but it never modifies the protocol and it will always faithfully execute our protocol in our behalf Ana's atomic either it runs the function or it won't I'm using smart contracts we can build really cool things but first let's consider a really simple example rock-paper-scissors unless considered where we don't use any cryptography so our contract is a matchmaking service if I want to start a game for rock-paper-scissors I can start a game somebody can feign my game on the smart contract and then they can play against me so Alice with the little Mexican hut she starts a game I'm because we're not using any cryptography she's going to leak rock so she'll reveal rock and say I want a bad 5 pound or $5 in my rock-paper-scissors game Bob can look at the contract and say well Alice has played rock so you know I'm just gonna play paper I'm when the and win five dollars you know the contractor Valley we had static cuts back to say oh well you you've won the ten dollars you won the prize so really we can't actually play rock paper scissors and a public setting like a smart contract without using any cryptography so what do we need to actually build this we need a we need a function where are we need some photography where I can hide my choice but then I can leader reveal my choice and I cannot change my mind and we can do this using trivial crypto and as most people in this room are probably aware of there's cryptographic hash functions so if I want to choose rock I put it through the house function I'll get 32 bytes of random theater I'll store that in the contract and later on when I reveal Rock the contract will hash it again and compare the result with the output of what it hashed so that's really cool I'm what I also wanna yard are two really cool features of smart contracts deposits and refunds so the idea is that when you start a game you send a deposit and then when you finish the game you get your deposit back and this will provide a financial incentive for people to finish the game so let's go back to our little simple example of rock-paper-scissors Alice will make a choice so run it through the Hoss function and then she'll send the house of her choice five dollars and that small little deposit now Bob comes along and Bob can look at the contract you can see that Alice wants to play but now he can't see her choice so there's a bit of risk it could be rock paper or scissors so he'll make a choice he'll send the harsh of his choice five dollars on a deposit and it'll tell the contract that he wants to play rock paper scissors with vollis now in the second round of this protocol everyone must reveal their choice before time T if you don't reveal your choice you forfeit your deposit unlikelihood the Condor party party will probably automatically win so next Alice will reveal scissors the contract will evaluate to say that well scissors was her commitment it matches the hashas she give me next bob can see that alice's choice for scissors so now he has two decisions a he aboard the protocol because he's lost or two he plays the protocol evie wins or loses now because he's never the deposit he's gonna reveal pepper and he's lost the game but he does this because he wants to get his deposit back the contract will evaluate this and say okay but I'm sorry you know scissors beats paper Bob gets his deposit back on Alice wins and gets $10 now to the security experts in the room that's my little disclaimer you should normally use an ounce when you do this but I want to avoid these details because I'm not here to you know present exact secure protocols so it's the intuition of why cryptography is useful so what's really cool about the previous example is that the deposit of refund scheme pervaded this financial incentive for people to participate um or the house phone pervades that ability to hide my choice but also commit me to my choice in a public setting what's not really good is that when Alice sends her hash there's no way to verify that was either rock paper or scissors all askew dissent Spock and then later revealed Spock but in this setting that doesn't really matter because if I was dead true Spock the contract will say well Spock was a Nevada chase so Bob automatically wins but what have we said when we have a protocol or an application where a user can't reveal their choice so all the contract houses in that information and the classic example is e-voting where we want a maximized voter privacy so the idea is that you should be able to see the patrick has cast his vote but it's encrypted so you should never be able to see what I vote it allows the Mazda may have for encrypted votes and these are in these are stored on the smart contract and now we want to compute the tally we should be able to simply add these votes together and once all the encrypted votes are added together there'll be some crypto magic and it will automatically perform the decryption so then we get the tally that's one yes vote and three new votes now in this setting voters cannot reveal their vote so we can't do that really nice commit and reveal trick that we did with Haas functions we also need to be confident that every encrypted vote is either yes or no if we don't know about guarantee then an attacker could create an encrypted vote in such a way where they change somebody else's vote they cancel somebody else's vote or they just vote multiple times because remember these are encrypted votes and under the hood is all mathematics they're doing addition subtraction multiplication etc etc so one way they get around this is the users here in all these proof and when I can prove to you is that my encrypted vote is either yes or zero on it with this proof all and that's the only thing I reveal about this encrypted vote I don't reveal the vote itself I just revealed that it's well-formed honest satisfy some type of criteria so now we can build a contract where each voter they'll do an L Kamal encrypted vote and they'll stand up to the contract alongside a 1 out of 2 0 Knollys proof that there's voters either yes or no the contract will accept it and store the encrypted vote and every single voter will do this then at the end of the election we can add the votes together and it will leak the tally now and people want to know more about this type of e voting smart contract I'll be given a full talk about it a tent on Friday morning so that's just a little advertisement for my talk later this week but let's consider another application and also say we want to source some type of competing so Alice houses large computations he can't to yourself and now he finds two different cloud providers but he doesn't necessarily trust them so she makes each cloud do the same exact computation and then if she's given the same result from both clouds then she has some confidence that the competition was done correctly so what she wants to do is set up a bounty so now they're just smart contract out there and if the contract and if the two clouds can prove that they did the same computation and they got the same result the contract will reward the clouds for their work so what we can do now is use a Peterson commitment so this is so this is different than a hoss funk emit Minh Thuy can do some type of computation on it wizard known as echo amorphic encryption and the idea is that is computationally binding on his infirmity pronounce it and from Mission theoretically hiding but we don't have to worry about those two properties the idea is that we can do some type of commitment on the fan of result of the competition so now each cloud will send their commitment to the contract and that'll be stored and later on they will reveal an open our commitment to Alice via some private channel Alice can then compare proof of the open commitments and she can see so you can see that they have both done the CM competition and got the same result and they've both committed to this end result in the contract now what Alice needs to do is that Alice needs to convince the contract that both of the clouds did the computation correctly and that they did both indeed commit to the CM result and we can do this using an equality zero knowledge proof so the ideas are given to Peterson commitments I can prove to you that they both commit to the same message we're very revealing about the message that is about so essentially what Alice can do is that so you can say okay yes before the clouds did the work she sends the robot or smart contract as equality proof and then the contract will get the two commitments it received from the cloud it'll run it then we'll use that as input to the proof and then the contract will be convinced that both of the clouds that the CM work and then it will reward the cloud for the hard work so that's really cool that we can actually do this now of course in this application you could argue well both of the clouds can collude and always and not do the competition but they can get the money from Alice we're going to ignore that for the security experts but we have done some work in this area so if you're interested afterwards I can talk about it and offline but essentially what I now want to talk about is local crypto Sol so these cryptographic primitives are implemented in solidity and they're available for experiments so the first three were used for my voting system the second two were used in that antique illusion smart contracts I just spoke about and that's another one that's under review but I won't go into that too much at the moment but what would be really cool is that ideally what I wanted to do now and this is my disclaimer I wanted to have gas costs off before and after the hard fork because now a theorem supports elliptic curve mathematics natively unfortunately I've not money to get the new op codes to work so someone in the room is very familiar with that you can talk to me afterwards and hopefully for Fredi I can have updated gas costs and how expensive this is I'll give you an example so the one out of two zero knowledge proof before the hard fork would cost two point five million gas which is really expensive considering a block only contain seven million gas I think that's roughly like three or four dollars or something where now that the hard forks happened the gas cost should hopefully be in the region of 200-300 thousand gas but I still need a you know get experimental results to say yes that is actually the real cost cost now I like the finish talking about other pieces of work so I'm not the only researcher who's been looking at applications of cryptography on the blockchain and I'm going to highlight some papers that I thought were really interesting so one was by Andre Miller called decentralized poker and the idea is that a group of people can play poker as a smart contract and everything is done using cryptography so we can ensure that the cards are shuffled correctly and that I have two private cars and we're actually playing this in a way where everybody can verify that is correct the second one is by Sarah Michael John he works with me at UCL and the other scheme was a bit similar the coin joint so everyone can deposit coins and the essential smart contract and then using ring signatures they can have draw their coins back from the contract in such a way where they're hiding in a group so that's the achieve some type of financial privacy and it's actually really cool so I highly recommend reading that one the second ones are the third ones done by Arthur's group at ETH Zurich and the idea is that lots of Saveur contract is a padding contract and I am Betty the Newcastle United is finally going to win the Premier League we still never do but let's say I go on the BBC website and then the BBC confirms that while Newcastle United actually did win the Premier League I can they improve to the contract that the BBC said that to me and that's really useful for any Oracle tape service the third or the fourth one is publicly verifiable seeker sharing so this is the scrape protocol and the idea is that they design this scheme the work towards building a publicly verifiable random beacon and this means that you could have some tape a random number on aetherium every so often and that's really useful for gambling games and everything else we built that in as well I built that in its solidity but it's only towards that goal and doesn't achieve it yet of course there's my anonymous voting protocol on the country collusion contracts that I spoke about just before so thank you very much for listening to this talk before I finish I have one takeaway message key photography is only one two and our toolboxes engineers to solve problems and if you think cryptography can solve your problem alone then there's a really good quote by Roger Needham he was a professor at Cambridge in the eighties 90s and eventually in the early 2000s and he said if you think of tog R we can solve your problem you either don't understand cryptography or you don't understand your problem thank you for listening [Music]