FHE L2 and Coprocessor in Action

Transcript

okay thank you very much and welcome C to the stage okay hey uh thanks for having me uh I'm just going to go over uh kind of like the basics of FH sort of how the pros and cons of different uh privacy technology Etc uh so yeah just jump right in and how to build using uh just native solidity so um from high level uh fully homomorphic encryption I don't know if you guys have heard this before like fully homomorphic kind of like uh homo is in like you know like a homosexual like when a man likes a man um so it's kind of like you think about

it like one to one sort of like same same I guess in some aspects so basically what you do a p text should happen to the cipher text um so fully homomorphic encryption is basically the ability to run operations on data without having to decrypt it uh generally speaking usually when people talk about uh like some sort of security usually you're kind of just cryp might encrypted locally client side whatever and then Transit it might be encrypted except when you want to run these operations when you want to do lookups Etc queries uh can be difficult uh to do these type of like drilling into these whatever if you don't actually know the contents of what you're drilling into um so if you can see here basically you're running an encrypted function uh what's an encrypted function but let's get into that a little bit so uh really high

level overview if you just think about like a simple example of uh basic encryption scheme where you have a generation of a private key and a public key uh secret key whatever no clature you prefer um so basically you will encrypt this message M towards a specific Pub Key and then that specific Pub key will be able to uh decrypt it so this is pretty straightforward won't spend too much time on this but fully homomorphic encryption is basically adding one extra step here where you have the generation the encryption the decryption but you also have an evaluation step so if you look at it in terms of like you have the um like normally when you encrypt uh encrypt this message with a pub key and then you run a function on top of it the evaluation um is going to be done homor L and then you can decrypt as you

normally would this should be basically the same thing as like running a function on this message M so that was just a convoluted way of saying like uh if you want to encrypt the number five and then you want to run a function that will like double the number five or like take another number and then uh run some arithmetic expression on top of that you can do that without decrypting so you could do like five Time 5 uh without necessarily revealing uh what the values are what the product is in this case um and so it's it's relatively straightforward too if you think about like where's this comy a happening it like when you're running a function you can run a function on this encrypted um value and it's still going to evaluate to what it should evaluate to um and so you the communication is client side

only you know you can use some sort of like zero knowledge proof of PL text knowledge for example to verify that you know the construction of the cipher text and that it's formatted correctly Etc um and the computation in this case is slow just fat operations FH operations um but in the blockchain space you can think of this is like the server side is going to be the blockchain the machine that's the virtual machine or whatever that's running the logic uh so when we think of this FH uh nonsense basically you think homomorphic encryption has existed but the concept of fully homomorphic encryption means that you can run arbitrary operations on top of it which theoretically makes it uh something that you could build out your state with and um use for a lot of different things and yeah so buzzwordy in some aspects I kind

of think of FHA as sort of like U sort of what we thought like ZK was going to be for privacy in some aspects in terms of like being able to run things on some sort of State uh I mean I'm with a really broad brush here but mostly I'm just kind of talking in the aspect of like where where privacy is kind of going to go and we're going to go into the details about this a little bit more in the next slide um but if you think about like the history of this it's not like FHA is Like A New Concept I mean it is kind of but like it's ex the idea of privacy homomorphisms have existed you know since some Works released in the 70s Etc and a lot of work was done in the partial homomorphic encryption uh which kind of earlier when I was talking

about the difference between fully homomorphic encryption is that it kind of has this concept of like U keeping this Tech like uh FH us is noisy encryption right it's just kind of like when you Opus skate the truth with some like [ __ ] um kind of like when you're playing like poker or something you got a bluff sometimes so that people don't know like if if you're just playing it straight up every time you go in someone's going to know you got the nuts they're going to fold it's not EV right it's not good EV so sometimes you got to Bluff you got a [ __ ] um so there's a bunch of different schemes here that diverge I I won't go into too much detail if there's any questions like I can talk more but um yeah basically the main two branches here if

you look at it's a fat boosta fast boost tra branch which uses like Boolean circuits which is kind of good for like the deterministic state for things when it comes to like verification Etc um but there's also level schemes which are kind of approximate use float um and some people speculate that this is like I guess ideal for things like machine learning Etc but um yeah anyways uh so yeah here's just kind of like a high overview of like some different schemes and how they diverge um again I I would love to talk more about this but uh for the sake of time let's just move on um okay so from a high level when you think of like I'm sure a lot of us are familiar with conceptually with using zero knowledge truths for privacy in the space um which which is very like the

way I see it is like um zero knowledge boost are very good especially in a situation where like the inputs of them can't be encrypted uh like if it's a plane text like if you're pulling it from your email if you're trying to like verify your passport or something or do some sort of check uh could be very useful um the issue here is that some if you want to have like uh shared composable state it it starts to get difficult because if you have adversarial inputs they're going to lead to the prover um and so there're if that makes sense so it's kind of good for it's very good for like single use uh privacy cases like I said earlier we we we we use that for like the uh Cipher text formation U but the issue here is again the composable state so with FHA

basically you can have these like um these different like inputs for things and allow people to keep them private and Advance the state that way um so you guys also might be familiar with like multiparty compute multiparty computation um and in some ways I think this is probably the most similar thing to FHA in terms of like U the data is secret shared so you can actually run these operations without having to decrypt um the issue here is that if you look at the kind of the formatting it's it's going to have it's going to be communication bound which is always going to um have you know I guess some sort of like overhead in the case for like what do you do if one no goes down are we just [ __ ] so I mean it's it really depends how you set up your

scheme but basically the main thing to keep here is like when it comes to using fhe or MPC for shared composable state it kind of comes down to the communication and the interactive nature of it um and also you can use you know NPC for threshold encryption but again we'll get to that step a little bit later um and so here's kind of an example when you also compare to something like a te for example like sgx which is you know I guess these secure enclaves are going to have some sort of like known attack vectors and they're not necessarily cryptographically secure but the main thing I just want to highlight here again is just the interactive nature between homomorphic encryption and multi party compute um just in the case that like in some aspects e it's easier to paralize um which can be good for scaling um but

like I said you can use it for threshold encryption so you turn this interactive feature into I guess like a feature not a bug if that makes sense so you use the nature of it that it requires this round for actually some sort of like Key Construction or secret construction um and yeah just to summarize kind of like te fast programmable they're kind of sexy right now um you know there are known attack vectors Etc uh maybe I'm just like Doom LARPing it I don't really know but like you know it is what it is uh NPC also kind of similar again but has the communication bound and uh ZK we kind of went over this um you know unless it's kind of like paired with another cryptographic primitive uh might be a little bit difficult uh to use this um you know you could theoretically use

fhe or like NPC different type of scheme um kind of nested inside of it it's always an option um and yeah and FHA right now you know is a a little bit slow but the hardware I think is accelerating um to some aspects I mean everyone says that we're going to see order magnitude increase or whatever I is it true I I don't know but like that's what they say and uh apparently that's uh you know there's a lot of stuff we been working on even at Phoenix right like one of the things we um trying to integrate to is like the GPU integration Etc then I guess the fga is as6 ETC you know this Shel um yeah so like an FH rollup is kind of useful in the aspect where um you know who doesn't like rollups I guess or maybe there's too many l2s who knows but you know it

is what it is um so it's classic stuff you know sequencer sequencers or stuff there there's a slight different cue depending on like the thres the nuances of the threshold Network and like if you're calling a decr and like how the how the operations are executed symbolically um but from a high level you can kind of think that this is you know the base version of this I guess is some sort of like optimistic verification um like the post execution validators can submit a challenge we currently use a fork of like the Nitro approver um you know I I kind of look at this as like yeah the computational overhead of the proof generation for like the actual FH operations to verif price State like you know instantly for instance settlement is like difficult to do but um you know I think it's kind of

things like verifiable ml or even like rollups when they first came out right like the first ones are optimistic and you sort of move towards them and eventually maybe you get to some sort of like midium Etc or ZK depending on who you ask I don't know um yeah so from a high level you know if you think about how the virtual machine works like I if you guys are familiar with the concept of like stylus it sort of has like this intermediary uh interface between the evm and like some like for the the operations for the F the FHA operations that we're currently using are written in R right and like you can't really run that just normal solidity it's like there's overhead and it's expensive and like d but like so basically you can kind of think of this as these interface sort of actives these like stateful pre-

compiles that like when they're called upon they will like execute the operations and then they will be verified in a format that the L1 in this case can ver ethereum can invalidate um and so from this uh you know we can move on to an example of more like symbolic execution but I'll get to that a little bit more in a second so the threshold decryption so generally like from a high when people are talking about FHA usually uh each of these Cipher texts kind of need to be encrypted with a similar key or like a similar key set um so you can kind of think of like taking a single key splitting it up amongst a few validators and then requiring like I don't know I want three or four for this thing or like whatever you want um and so this is this applies to decryptions

re encryptions and we'll get into like what a re-encryption is in a little bit um like a sealed output but from a high level this is you know using some sort of like NPC protocol to uh kind of reconstruct the shares if this makes sense I again I won't dive into too much here but basically it's like um you you go through and you're like okay hey we all want to be able to reconstruct this um like secret so like how are we going to do it without well Distributing the key um but this is something that is going to be developed in the you know in the in the very soon in terms of the uh next text net I guess like I think in like a week uh should be out for uh testing and then the next one will probably be U like a different version

of it but anyway so yeah just to wrap this up this section of the kind of overview architecture the fraud proofs are um you know nothing too crazy um it's kind of like like I was saying using that W interpreter that's if you think about it conceptually sort of like the interface and like uh stylist um and so yeah when it comes to these arbitration it's standard optimistic verification in the sense where it's not the most efficient if someone actually ends up like attesting but like how often does that really happen I don't know um maybe not really have an opinion on that but like the FHA co-processor is basically the concept of like the symbolic execution I was talking about because realistically who wants another [ __ ] L2 right there's too many l2s liquidity fragmenting whatever so I think the idea here is to like try to go

towards the users right like hey like this guy I don't know his uncle works for base or some [ __ ] just really wants to work there like just put it on there so it's kind of like um in this aspect you can think of about that you have the UN 256s that basically are evm native and these kind of act as like pointers to the cipher text and then if you in theory if you're adding like Cipher text a and Cipher Tex B you're going to know which uh the the handles these hash values that represent where the where the cipher text are actually stored and then when you run this operation the operation itself is verified um how you do this verification process you know is I don't have say it's arbitrary but there's options right so you can even use something like an IG layer ABS which

is like something we're doing uh you know building at Phoenix um but anyways uh so yeah just kind of going over if anybody is interested in building uh just I want to emphasize that like it's relatively straightforward to build a Phoenix I mean I I I hesitate to use that a little bit but in the sense where it's just if you know solidity It's relatively easy to pick up as you can see you kind of just import it as like a library here you don't have to necessarily learn a new language or worry about like different like I guess client side storage Etc um or communication Etc in this case so it is kind of nice in that aspect um there's a local setup if you guys want to use hard hat there's also a remix plugin for those of you that I don't prefer remix I

I don't say that pejoratively like I kind I kind of [ __ ] with remix um and then there's Foundry I think a lot of you know more more developers are kind of using Foundry now I guess as cool as hip it's like I know it's the Gen Alpha um to inputs so you know I like to think about when you're working with FHA it's sort of like um try to not change too many things from how you're normally developing with solidity so usually if you use like a a un8 for example right like an unside iner 8 bit length representing a number from like 0 to 255 so you can use this for arbitrary bit length 1632 Etc um but basically it's going to work in the state of your contract similarly to if you're going to add these numbers you're going to subtract these numbers you're going to

um uh let's say you want to use it as like a value in a key mapping pair Etc things like that to represent an ID or a balance you know if a really simple example if you wanted to use like some sort of encrypted token private token right it's basically just having address the maps to a cipher text value that Cipher text value represents uh your balance Etc so basically we have this new data data that's called an inent arbitrary bit length but like basically it's it's kind of how you're putting in this number so like if you were to look at like I guess like the call data or whatever of the input prams of your function however it's verified right it's you're just going to see a cipher text blob so people are going to see what number you put in U but you can

also just raw dog it with like B arbitrary with general b code too if you prefer that I guess if it just makes more sense with your logic or you just prefer it uh yeah so the trick what I would say the one tricky thing with like working with FHA here is that kind of works at constant time code maybe some of you that have worked with like similar things like certain type of circuit dsls or whatever like might be familiar with this but basically you're using a selector function here so I'm sure we're all familiar with like the left side pad syntax you know it's like basic stuff uh if else well that doesn't really work because you can't have like these branches because they're both going to execute Etc so I like to think about it in the FH there's conditional assignment but there's not conditional

right basically both branches are going to execute but what it gets assigned to that's what's indeterministic or like deterministic um B based on your ebol so like if you look at this you're basically checking if a is less than b uh and then you are assigning that to an EO and E is exactly what it sounds like it's E1 and basically from there kind of branches diverges into either A or B so if you can sign it that way so I made it's a little bit annoying and like uh to have to work with but it's just sort of one of the uh I guess design constraints of our time required statements are pretty straightforward it's basically just like if you use the evm required statement except this way you're actually checking to see if like the uh the FH value is like the encrypted value is like you don't want

some someone sending like 100 tokens if they don't have 100 tokens it's going to [ __ ] every up so one of the things to check you have to be CAU in the fact that this is going to leak I mean it's going to be a conditional like Boolean leak like basically did they did they not you can remve force in some aspect so it's just a design constraint that has to you have to be aware of um in terms of avoiding leaking information talking about leaking information conversion leakage is one of those things that like generally speaking you want to avoid leaking plane text to memory once you have plane text to memory that's where a lot of attacks happen right man in the middle attacks Etc database C whatever um so especially when we working with something like an evm which is kind of like this uh like

the whole stack Trace is going to be available right it's public it's I State change is is reported and something Etc validated Etc so you have to be very careful here's an example where you're basically putting in like an unencrypted integer and then you're basically trying to encrypt it in this case but you're going to see what the encrypted interior was right because it's in plain text so you have to think about this is this is going to leak somewhere and it could [ __ ] everything up because like you know you build state from this and then some sometimes you just get rugged like ah no I see what you did I see what you did um and so Phoenix JS is like kind of the what like the JavaScript library I I guess we all probably kind of hate JavaScript but it's just one of those

things where you kind of got to work with it in some aspects I guess when you're building out your client right so but it's it's not too different I like to think especially when um you think about you know for those of you maybe worked with the like ether JS for example it's not too different so you're basically just integrating your ABI you have like this one extra step here where you're basically encrypted the number five is an EU and eight um so and then that like data type that blob whatever you want to call it the bytes if you want to just raw dog it you can just put that Ino um but yeah so that's basically what you're going to put into the input as your function um so in that aspect it's not too different from what you're normally used to do

uh for I guess full stack web 3 developers um permissions are basically like um you can kind of think of these as like the view functions in FHA like restricting like who's allowed to see what like um you know like if I have like a I don't know like a like an only fans or something and I don't want people getting a free look in my body um you can basically makes the only people that like pay for it are able to you know get the sealed output of it so uh you can kind of think of this is like U you're basically doing a stess Deion and you're wrapping it towards a user's Pub Key and then you send it to them that is what return to the client once it's hit once the client gets that uh locally you can sign you can basically unwrap it

using your secret key um and so in this aspect it's sort of like the view function in that aspect and it can be permission conditional uh speaking about adding extra conditions this how you can do in your contract like I said basically it's like only the premum subscribers get to see like this week's like new leaks or news or whatever so you could basically making conditional I don't know why I used only fans but like I guess you could use it for like professional stuff like you pay for uh subscription to some sort of auditing service and then you get the results ET um yeah so I'm just kind of wrapping this up with this smart contract example just trying to emphasize how it's relatively straightforward in the aspect of it's like yeah you just have to use native solidity the data types might take a little bit to wrap your head

around but like generally speaking it's not anything too too different General runtime tips if you're like okay hey fh's expensive it's kind of slow why the [ __ ] isn't this [ __ ] running why why am I getting an overflow well could break up your transaction also you have to be cant into the fact that the operation that you're doing is going to make a difference and the bit length that you're operating on is also going to make a difference relatively straightforward intuitive like adding two numbers should be cheaper than dividing two numbers and like adding two 8 bit numbers should be cheaper than adding like two 16 bit numbers so nothing crazy um yeah the other thing too is like you know uh you know if you guys are interested in working on these contracts like chat gbt is actually like kind of based like uh you might think

like go hey is it train on this is it going to give me some dog [ __ ] that's not going to compile it's okay I don't know give it a shot maybe um yeah and so for those of you that are interested this is a good way of getting started um with our current test n although we are moving over to a new test net I I I'm going to miss chain ID boobies so it'll be a thing or 80 wait I don't know why I said that but uh yeah and that's on my telegram if anyone wants to uh message me or do whatever um yeah so thanks for thank you very much Kyle uh Co from Phoenix well thank you very much for being with us very um efficient as well in terms of your speech and thank you so much for sheding light on the F and is

application yeah so um any last final message to the audience uh I don't know are there any questions okay okay I'm not answering yeah thanks okay very short and concise thank you very much Carl