Intro to MPC, Garbled Circuit and mpz -- ZK Jumpstart Series #1

Transcript

uh make sure that it's going to be available okay so uh I will start um talking about uh yeah the agenda for today so we're going to have this uh introduction to MPC all the techn technical topics are going to be given by Nam here then we're going to have a very quick far chat um with some I would say frequently ask questions of this topic um to anyone that's trying to explore um like how to build or what what's uh what is this

this stuff with uh MPC um and then we're going to have an open floor uh Q&A session for anyone that wants to ask something um yeah of course I I think during n's presentation you will be free to ask as well um yeah just type your question in chat I will I will be ready to bring that up um yeah so uh first of all we're all part of uh practicing skill and Explorations or PSC um so we're basically a team made of uh cryptographers uh Engineers researchers um and all people interested

in like building open source and free uh software tools um first of all to like um enable enable any privacy related uh application or help towards uh um bringing up more privacy related tools but at the same time trying to um help on the scaling of the infrastructure of ethereum um but at the same time uh I will the explorations part uh is mostly on um what what is the L latest on cryptography and and re research that so we can

um be up to date on on what what is the best that we can do for um this uh this PA so um yeah we were're we're all uh and I'm here we're all part of PC so happy to bring this up to you guys um The Talk today will be I'm just a presenter the talk will be made by uh Nam he's uh working on the MPC research team at uh MPC and um yeah I think uh we're good to go now um thanks I will take over from here so let me share my screen yeah sorry I

was still presenting okay so um are you seeing my slides right now that's right okay okay thanks so uh so welcome everyone to this FBC 101 uh so with this uh like very brief talk I I I will be trying to uh give you my pointers so that you can uh start

doing some uh research about this or uh if you want to try it out there we also a tool that uh I will also show today so um so the the structure of this uh brief talk is uh first of all about what is FPC and then and uh a very uh quick uh introduction uh to gabble circuit like a technique of uh like how you how do you do uh MPC right and then uh I will introduce the mpz library that is an in-house uh gabo circuit uh library for building MPC uh okay so so first of all uh what

is MPC so MPC stands for uh secure multi party computation so uh this is uh there is no s in the MPC uh so only mpnc because like if you're doing a multi party computation but that is not secure then what is the point right so this uh secure is kind of like implied by this NPC so uh you can think of NPC as uh this box that is right here so this box is an NPC of a function f that allows two parties Alice and Bob they can provide inputs XA and XB and then this box will compute y that is the function f on the input XI and XP

so the property that we want out of this box of uh npcf function f uh including like three important uh security properties the first one is what we call privacy right so this is the first thing about multi party computation uh we want to make sure that when and Bob join this computation only Alice will knows uh her input XA and Bob will know his uh input XB after this computation only the uh result Y is disclosed but not XA and XB uh we want the MPC to have independence of inputs so uh XA and XB are independent from each other when

they are used as input into this uh this MPC box you can think of like application of like when you're doing salary negotiation or like this uh famous uh application of best friend best friend or love uh like puzzle soling uh the third one you want is our correctness so you want to make sure that this Y is the output of f apply on XA and XP so all of these uh three properties compos of what is uh necessary for this NPC box to satisfy uh so here I will try to uh

contrast a little bit NPC with uh zkp so zkp is like what most people uh in this uh in this uh talk would be uh familiar with right so uh when you look at zkp so zkp allows approver to convince a verifier that an instant X something something with this x is true uh so it means that the Prov must know a witness W such that we want to test this relation of uh X and W and it has to return one so this relation R is like the function f before right X is uh the the the input of

uh of both party the approver and the verifier and W the witness is only are known by the appr so you can think of zkp as an application specific NPC so this NPC will uh we implement the function f that checks uh this relation and try to match uh the inputs uh X Prime and X by both approver and the verifier but uh like we soon realized that uh because x and x Prime they are public right so in this MPC only the approver has the has a secret here so by this like inherent nature of zkp uh even if we use NPC to implement

zkp we can only have uh the appr to to have the to have the sequency here so we can uh think of MPC as something that is more generic compared with zkp so zkp is just an application of MPC but because this uh the ckp is like optimized towards one functionality right so ckp can be uh more more efficient in doing this uh this function but what we're talking about here is uh to enable uh like broader uh class of application so in zkp you can only have one party provide the uh

private inputs and uh the other one is just like say this is what I want to check and the output is uh like whether the check is passed or not right so this is very very limited um in order to enable a broader class of application we need a modate tool uh that is MPC so uh I think that like everyone when they uh introduce to a new tool especially uh when the Tool has some mathematics behind you are probably like very eager to understand uh the basic things about uh the realization of this technique

right so uh next uh what we talk about is a technique called G circuit that we realize this MPC box that we just uh describe here right so let's see that how do we uh implement this function f using G SE so um with with NPC where talking about generic NPC so you can think of this box as like a functionality a function f that will uh check an additional input that is this uh public circuit right and then what you want is you want to execute this public circuit St here on the input of Alice and Bob xaxb so both

XA and XB they are private and uh when you apply this uh this circuit on these two two two primate inputs you get the uh the the output Y and uh what this uh NPC box uh has to be able to process is uh like you can break down the circuit into uh some some gaze right and then what we what what we care about is uh this end gate or and and this XR gate uh so if you want to think about like this is buan and then the automatic form of this and would be

multiplication uh and uh X all would be add when you think try to compare this with uh what what is familiar with you in uh in the zkp right so you want multiplication and add in zkp uh for the Boolean form of uh MPC uh you want to implement and and Export so with n and XR we can Implement pretty much everything so how the gabo circuit Works roughly is that um in the gabble circuit uh so first of all the gabble circuit is uh a protocol that has only two parties so uh you can only do uh two party computation with G circuit but that

should be like sufficient a lot of applications out there so in uh the gabo circuit protocol you you have uh two parties the first one is called graer and the second one is called the evaluator so what the goer does is that the goer will try to increase this Target and uh the private input XG and then send the the inced form of these inputs to the evaluator and the ulator in some way can obtain the decription KE based on theator input XD and then because now theator has the encrypted

circuit and then uh she also has the decryption key base on her private inputs then she can decrypt this uh this encrypted circuit and then get the uh output Y and then if the output Y is important for the gra then can just send this uh send this output to the gra and what is uh good about G circuit uh protocol is that um it has very low latency because as we can see here right so uh there like one rout two routs three routs and then uh if this is not necessary then in three routs we can

conclude the the protocol so there are also other techniques out there but it has higher routs or it has uh higher computational complexity but here uh what we we want to focus on is um we we we try to minimize those other criteria but we uh trade trade trade trade off with uh communication cost so you can imagine if you have high bandwidth then uh this is a very suitable protocol for you so hey yes uh yeah sorry um your I I think uh your voice is uh cutting a bit so if you want to turn off

your camera to oh yeah yeah yeah okay yeah and uh we have a question actually but uh arpit so um yeah while let see if you can play again I'm guessing it's in the in the garal circuit uh yes because uh no matter what uh no no matter what what circuit you want to process you only do these many rounds right so there there is one round where uh there is uh the sanding of this encrypted circuit and then there is another route of trying to obtain the decryption case based on the input of the

evaluator output uh in the case that the goer also wants to have the output then then then uh theor can also spend an an additional round sending this output to the GBL so uh it has like constant rounds and can you can imagine if you execute this over the internet then uh you like don't have to care too much about the uh latency of the of the network uh we also I think finny you want to ask your good okay and uh yeah RP uh got it uh got it now so fre to continue

okay okay thank you yeah so uh now uh like we we we we understand that uh in the gble circuit technique uh you process the circuit right and this circuit can be broken down into a gate and uh we can try to handle uh the Boolean Gates here uh and gate and XR gate right but uh um like the genetic technique of gabble circuit is like applicable to almost any uh any any kind of Gaines because uh the the the the um because the the E of the gble circuit

technique is to encor the truth table so as long as you have this truth table in mind you can uh you can you can you can dble the the gates and then have it evaluated so uh the protocol include uh the Gess algorithm and evors algorithm so let's first look at this Gess algorithm first so uh we are trying to encode the Boolean and gate here uh so the first thing here is that let's look at this gate we have the input A and B and the output C uh the first thing we have to do is we have to pick random labels for each uh possible value input and outputs of this gate so you can imagine you have

a z that represent the Bit Zero of gate a uh of y a uh A1 being the uh B one of the uh y a and then you have uh b0 B1 c0 C1 the same so all these random labels okay and then uh we want to encode this uh and truth table so the UN table has four entries uh you want to say that uh with a z and b0 you have to obtain c0 with a z B1 you have to obtain C1 uh c0 with A1 and B 0 you have to obtain C 0 and only with A1 B1 you can obtain C1 so this is the ining of the uh of the UT

table right so we're trying to try to do this for this end game so uh first of all we can uh do this encryption so you encryp the c0 with a z b 0 and then you get this uh label T1 okay and then you do the same for uh T2 T3 and T4 notice that only the encryption of uh A1 and B1 sorry using the key A1 and B1 should uh has the uh PL x uh C1 right so uh T4 in grip C C1 and T1 T3 in t t T1 T2 and T3 here all encryp C zos but under different keys

and then we can permute this uh this table that has for Cy Tex T1 to T4 and then send it to evaluator so because like these uh table entries already permuted uh the aor cannot know which cyberx encode which one right and we also want to send a z to the evaluator uh suppose that the input of party uh that has the input a is a zero right so it's zero here uh we also want say the mapping of c0 being zero and C C1 uh being one if C is the final output let's assume that we only want to evaluate this A and A and B and try to obtain C right so the circuit

is as simple as this so you you want the uh evor be able to distinguish between c0 and C1 if uh she gets C c0 then she she knows that uh the output is zero if she gets C1 then the output is is one uh so so so far what we have done is that we have encrypted the circuit right and then send it to the evaluator now theator has to obtain the decryption key in some way notice that here the goler has already sent one decryption key to the to the evaluator right so suppose uh there is a z right Suppose there is a z

here so uh the possible outputs are like T1 and uh T2 either this uh we have to deliver b0 and B1 to the evaluator in order to be able to to to De grip T1 and T2 right so uh for the evaluator be able to obtain either B b0 and B1 we use oblivious transfer so this is a protocol that allows uh Bob to communicate a bit uh to Alice and then obtain uh either m0 M1 based on uh the bit uh being B uh being zero or one but at Le does not know this uh this

bit that b is sending so basically after protocol Alice send Bob a bit a message based on the bit right but Alice does not learn learn this uh learn this bit at all uh the the technique behind this uh I will not explain because uh probably uh we we don't have time for for for that in in this brief talk you can uh you can ask if uh if you really want to understand in in the open floor so uh so now here uh suppose that uh the bit from from B is one then after the app previous transfer uh Bob has obtained B1

right and now with a z and B1 Bob can uh try to decrypt all the tables and then uh he realized that uh he can only decry T2 because he he only has uh the key a z and B1 right and then obtain c0 and because the uh Alice has s uh the the mapping that c0 is is zero then uh Bob learns that uh the output the final output C in this evolation is zero and then uh Bob can send this to to to AR okay so uh so that's the uh gabble circuit technique uh we can do the same

for almost uh every every gate right so not just and as long as you you can encode this G as a truth table you can use the same technique uh to to do that uh okay so uh that is the yes uh yeah sorry just want to pause for a second for maybe um we have question from the crowd I think you know the earlier the the algorism is kind of difficult to understand it so yeah I I want to pae for a second to see if we get question from the

crowd maybe not but um like how many any of you are familiar with this um like a ZK things would it be too difficult for you to understand it okay no one is Shing something nor worry uh we can do you know like a more question uh later so um thank you for sharing okay yeah great okay cool you don't know yeah so uh so so thank you so you know like uh what I'm going to introduce is this uh Library called mpz uh is developed by the the not team at psse uh so when you are

using this it it doesn't matter if you don't to understand any of of this right because you are using the library as long as you understand this box that is okay so you have an NPC uh that will Compu some function right and then you can allow a party to Pro to to to input a private input that is another uh party that provide another private input and then uh together using this box you can compute this this way so the the so you know like this this part that is like uh what you do right this part is oh sorry no these are what uh the users will do right so the developer part is actually this part and then uh you will wonder

like okay so how do I uh do this thing right how do I describe the function f uh so I just have it for you you can use this uh MPC Library uh so MPC is uh basically an experimental collection of MPC libraries written in Rust yeah this Rust part is important um so uh and we are also having some effort of uh doing uh some resar experiment uh and implementation on on on top of this mpz code base so mpz is pretty stable but on top of that we also have some uh highly experimental new things that we

use npz as a Spas so you can do a lot things uh with uh mpz uh in the TS notary team they use it for uh distributed key generation they use it for the encryption and incription and here's the link to the uh to the mpz so you go to the B uh giop and then you can find the mpz rep it is not so hard to find uh so mpz does a lot of things uh but to describe the circuit you only have to care about this uh these two these two Gres uh these two Gres mpz circuits and mpz circuits macro so this allows you to describe the uh

oan circuit and there are also some some micros for for for fast uh description of the of the circuit uh yeah so here it is pretty simple right you can also find some example there for example uh you can use this circuit buer and then uh you try to do some input and then you can use this macro bit X or and Trace to do something if that is what you want but there is also bit XR bit n bit XR n yeah you can find all of these things here uh so basically uh you can write like some par the circuit and then you

can compose that uh like reuse that as as much as you want uh another way in the MP in the mpz library is that you can fit it with some uh PR phc and circuit so this is the uh traditional way of uh describe some uh some some complicated circuit right so for example this is uh the as uh the as circuit so you can just uh fit this text file that describe uh how the how the uh wires are connected each other and what gate XR or and gate you want to

uh to do with it then fpz can pass this uh input uh yeah and then uh translate into this form and then you can have a circuit in the mpz as well uh you can also think of writing your circuit in other higher level language like Circ right uh and I think that this is a a more familiar way for ZK Dev to pick up mpz uh here I have an example of writing uh in the product uh argument uh there are some uh there some something that you can see about this so we have some effort trying to uh turn this into the the MPC circuit uh he is the repo so

come to it see okay so uh I guess uh that's it uh so we can do the F chat and and question yeah so there is a question in the chat but uh pamich seems to have taken it already um I will just mention it um so uh KY was asking uh if um like if both Al and when they send the values uh to the gate uh if you can know which value was sent first um yeah

can just let me know that was the correct question yeah um yeah so I am going over the question right now so uh yeah there is a question on uh right so when can Shen uh say something about no basic about ZK not so much about G circuit so you know like uh you don't actually need to know about ZK to pick this out because gavo circuit is like an ancient technique right it has even before what we have what you know about ZK these day

so it has we have G circuit before cross 16 before PL and everything uh and you only need to know is like you know how to describe computation as a circuit so that is the first point the second point if you want to go deeper then uh maybe something about uh hash function and symmetric encryption and that is enough so very very basic yes so is a ging reusable okay so uh that is

a very good question uh is the ging reusable for the same circuit but inputs no you have to uh redo the G circuit PR every time because you can think of this right uh so I generate a g circuit right I send it to you so uh this time you are using uh some input for example uh uh for example you you are using in input zero right and the next time I'm I'm trying to do use the same circuit right and then this time you input one so basically you just exhaust the the circuit possibility of me and then you it uh like eventually you learn what is

my input so we cannot reuse the uh we cannot reuse the circuit the circuit after generation is a one time thing yes so uh so about witness um so there is no witness in in the NPC uh like witness is the concept of uh the secret Z proof right in the zkp but uh in APC let's say that everyone has witness because everyone has some secrety here so for example in the uh in the goo circuit uh in in the end example here right so Alice has some some secret

bit here Bob has some secret bit here and they want to compute this game right it is very different from the case of uh of not proof where there is only the pro has the witness but the verifier doesn't have any any secret oh yes so I think I answer uh all uh yes yes okay so uh a high level overview of how a works okay so

yesly uh I have a hidden slide for that which one I can help you on that uh yeah I I I just located okay yes okay okay so uh this is right so Alice has to message m0 and M1 Bob has a bit B that is either zero or one and then Alice is supposed to deliver either m0 M1 but she's not supposed to learn about this B bit B okay so here is how we do it technically uh so this the same thing so Alice uh has to message m0 M1

and then uh po speed is uh either zero or one let's say the pop speed is uh zero so now what Bob has to do is that Bob is going to sample a public key pair okay that is called P pk0 sk0 right so uh I suppose if you are familiar with uh this uh like RSA uh you know that if you have the public see you can encrypt but you can only decrypt with the secret key right so Bob will sample this uh key pair pk0 sk0 and a random R okay and then Bob is going to send pk0 and R to Alice and

then Alice will encryp m0 with pk0 and M1 with r but Alice when looking at pk0 and R she cannot distinguish where the PK Z is the public key or r r is the public key okay right so Alice is going to send c0 and C1 to to Bob and then Bob because he has only sk0 but not the secret key of this random r b can only decrypt c0 to get m0 but not C1 so this is the technique behind a previous transfer use some uh public cryptography but very very basic

all right we had a bunch of uh questions related to public transfer uh yes so you know like uh yeah there are strong uh oblivious uh transfer protocol that prevent uh Bu from sampling to to public case right for example uh here if if we if we look at this right so here we say that uh B sample two key pair pk0 sk0 and the random R but if for example we ask Bob the way that he's going to dra this random R is to uh is to has some some

some something right and then uh Bob can also Pro your knowledge that this R is the output of some has function but on on input then uh in some way uh Alice can by verifying this uh zon proof that this R is the output of the hash she can uh be confident that R is random uh okay yes so MPC uh is not better than zkp uh it is more generic uh

zkp is more efficient in the sense that it is a fixed functionality right so you can have a lot of uh let's say leverage to to to to do optimization but uh because MPC is more generic so if you want to develop an NPC protocol then uh you don't really have a lot of leverages uh like bring encryption so I I'm not sure

uh this is the is is the same uh yes yes you mean oh right so I I mean uh not not stocks not stocks uh you can use some uh SN proof like based on thep lock that is the Tradition Way yeah I mean before snap and stocks you

can use SN proof but SN SN proof is uh is not as searching as snack and stock um we have someone to ask um about 2pc uh if you have time can you cover a little bit of that oh yes uh yeah so so okay so here's the view right uh to to PC is no is no mystery so I looking look at this uh so

MPC is SEC multi party computation so 2pc is two- party computation so basically what is described here right so you can only have two parties in two PC but in the case of MPC you can actually have more more than uh more than two uh yeah so the reason why uh like we distinguish 2 PC and uh MPC is uh I say that there are a lot of things that happen between two parties and uh that are of of interest for example uh you can use to PC for

authentication or doing for example machine learning inance right uh yeah and NPC you can you can use it for example uh statistic yeah more more more General applications let's say 2pc is a specific case where you can uh do some of imization because you limit the number of parties okay so there are a lot of

questions okay not only uh yes so right now we have codebase circuit for mpz we have also uh preall fion circuit passer in uh to to to to to Circuit in mpz and the circum circuit is uh let's say something that we are we are developing so we have some result already you can try to use it but probably it will have some uh okay so compare with f okay so uh yeah so this is a very interesting question uh

so so fhe you know like I describe gble circuit gble circuit is a technique to realize NPC or 2 PC fhe is actually another technique that we can use to realize MPC so it has this uh it has this relationship between F and MPC so f f so MPC is a collective of uh techn of techniques to do SEC computation f is one of the technique in this collection of Technology uh and uh so the difference between gabble circuit and fully homic encryption is

that uh G circuit has very low uh computational complexity because it only based on uh some some hash or symmet encryption of very simple uh like non latis uh public cryptography right but fhe is based on L this uh cryptography so it is like not as uh efficient in terms of computational uh complexity but C circuit has higher communication cost and fhe has like a lot less so I think it depends on your use case if you have a

then you may want to use f if you want to do this on uh some some phone and you happen to have strong internet then maybe you can C Apple circuit uh okay okay so uh multi party interactive o and parti G circuit uh okay so I I I'm not really familiar with these these terms maybe like if if you know something you can share with us uh can you hear me yes yes okay okay thank you no I was just uh going through a paper they have proposed a ZK fabric component uh it is in uh

telecommunication uh in 6G where the scenario is to uh verify a statement of Alis anonymously without revealing secret and over there they have introduced terms like partition guard partition Gable circuits for multiple verifiers and multi-party non- interactive OT for uh the multiple verifiers to verify the statements publicly so I just wanted to get uh a knowledge a clear knowledge about uh these terms to understand the concept yeah so yeah sorry about that because like you know uh probably these are like Advanced

Primitives that that you do within thiso circuit field so there is a huge gap between the basic version and this uh Advanced version I get if you want to understand this maybe you want to do some backtracking okay okay okay okay I will just follow along with the basics for now and we'll reach out again if I can have something around it thank you got it so I think we can um follow to the our chat lck of questions um yeah uh okay I will um present my

screen so um yeah so I think our current Focus uh in our team is to enable the creation of MPC uh applications uh but so now if you can like uh talk about what use cases doesc unlock um I will say like by itself and what could it unlock uh with um combined with some ck uh applications that exist today or yeah um yes thank you so uh what use

case uh let's say that FPC is uh closely related to fres cryptography so you already see a lot of MPC applications out there so what you call M C wallet uh threshold signatures they all uh they are all application of MPC right uh so recently there is the uh let's say the emergence of uh ZK ml which allows you to do uh verifiable inference on a model using a sample right uh we can upgrade ZK ml to uh MPC ml which allows uh both the model and the sample to be private

so with dkml you can only have either the the model or the or the sample being private because you know like this dkp model you only have uh the approver to have the witness so either this the model owner or the sample or the sample owner has to be the proval there is there is no other case but if we upate ckp to be MPC then we can have uh like the true privacy preserving machine learning inference uh uh there are also other interesting uh applications of MPC uh that are like consider uh in the past so you can

think of private order matching uh private voting private aution or privacy preserving plock proposal for for uh for the for the for the for the blockchain uh so any application that you want to remove the intermediary but you don't want uh everything to be transparent that can be an application of of MPC you can think of maybe MPC ebm so uh if I and you we engage in some uh like uh some some some computation together and then the output will be

sign by both of us and publish on the on the blockchain right we can have a smart contract for that so I think that is going to be uh like an interesting application there are also other applications that uh maybe uh for example uh we go to some events and then we can try to match our past events based on this for example p po p AP and uh that done so it like some surprise oh I I uh we we attended the the same event sometime before I think that is like some interesting real application yeah and also

um let's not forget that we have uh TLS notary which are the Builders of this um MPC actual uh library to use uh if you're a guy just uh feel free to explore it and like this uh the topics that them uh was talking about today they're implemented there so take a look um yeah well I guess this was already asked um not sure if you want to talk uh about this like why MPC and not fhd um we also had the question of like is NPC better than Z knowledge uh you know um I think there's uh there's quite

some confusion um I really like this um uh slide that you may like uh yeah being like um CK is actually an application specific type of multi-party computation um so I think uh with with a lot of people that mostly the the ones that are interested in these topics are come from from the Ser knowledge field uh so yeah I guess uh yeah why MPC and not FG but why MPC and not CK and I don't know I think it's a good topic to to run

about uh yes so uh I think this is among one of the uh questions uh but uh maybe let me make a summary here so uh fhe is among the NPC techniques that we can use okay alongside with a G circuit that are introduced in this talk so uh so that is like uh we cannot really say like why NPC and not F but like why not using fhe for FPC so that that is going to be the the precise uh the precise question uh so yeah so like when you want to realize some uh some applicate some some privacy preserving application right for example

uh among the question uh KY uh there is a question about like healthare data Privacy Act Right uh yeah so now okay let's consider this as an example uh so should I use uh F or should I use cble circuit right uh now suppose uh this Healthcare data privacy is that okay I uh have some uh say I go to some some test center to do some test and I got a sample right and then there is this application that uh we send my sample to some server and then using this model uh it can predict some of my health issues so let's consider this this application

and we want to do some uh privacy uh preservation for this application so should we use gabo circuit or should we use FG uh actually in this case it I think that both F and gble circuit is uh is applicable but um okay let's say that let's look at the uh the institution side right so the one that actually has the model now suppose uh we use fhe right we can do something like so the client is going to incre the sample with uh the client's key and then uh the

client will send this key together with encrypted sample to the to the institution and the institutions can encrypt the botle with uh with this this very same key uh and then uh do some inference on the Cyber taex and return encrypted result to the client right in this in this uh in this way of using uh the F we can see clearly that because the the institution doesn't have the decryption key because the key is coming from the client side right so only the client canc the encrypted result so uh this has a very uh heavy burden of computation on the on the instit in institution Ser we can see

very very clear uh but like from the client side it just does some maybe uh 100 encryptions and that's it uh and send the CeX uh to the to the uh to to the to the institution so there is also like not very much burden in computation uh not very much burden in the in the B right so you don't want to spend your data there now gble circuit gble circuit okay yeah so uh let me continue with this G circuit approach so with

gabble circuit you can imagine something like okay the uh the the institution is going to GLE the the inference uh the inference circuit right and then have this very big circuit send to the client so the client is going to receive maybe one year by data and then I think the client is not happy about it because now I'm spending my expensive data on on checking this so in this uh in this uh in this case maybe you want something like okay let let institution to take over the if that is a case but in some uh model we may have like

uh the the both party has the same capability then uh you you may want like okay the Gap may have like slighter uh Stronger slightly stronger Hardware than uh the the in this say the g has to has to do more but not so much more than the uh evaluator but still uh it is acceptable for both side uh okay so there is a question F is for security no both F and carbo circuit is for security but they have different

uh trof in in terms of cost right F very high cost of computation on the server side uh G circuit no no no no no G circuit does not RW anything G circuit and F give the same result in terms of security they just cost differently in terms of computation communication yeah so uh there is uh another method that is called sequ sharing

base uh but we're not covering that in this uh in this in this in this talk yes cool so um moving up yeah so we're trying to bring more applications applications um more NPC applications uh what do you think is the main challenge to to making them uh yeah so uh I think that there are several uh challenges uh when we want to engage with NPC to build some application right so the first one is

how you're going to to write your circuit or to write your program we have already seen three approaches like uh in uh like like in using API uh using some Crystal fashion uh circuit like is a text file or we can use uh C now like there are I I don't think it is very easy to to use API or to have uh to compose uh the pr fion uh circuit because in the end you you also uh doing something with the API it is like a mix mixed approach right

but uh I think that having uh more NPC DSL or trying to uh using trying to use uh an existing DSL such as ccom for writing NPC application uh that is uh a good thing to do but there are certain challenge with respect to uh usability and composability and reusability of is uh is these D dsls so there are some some challenge to to overcome there uh the second I think what is uh one of the important challenge in uh doing MPC application is the is the deployment uh MPC is not uh a well understood topic among uh let's say most

of the the developers uh and uh what is written in the paper is also has certain subties that only cryptographers after like really picking their brand they can understand what is what is going on there so uh trying to have a deployment uh environment that actually match what is happening in the paper so we can securely use the uh the MPC protocol is not very trivial uh yeah and then and uh you consider you can you can also consider

uh different cost uh model as uh what we have done with this uh privacy preserving health health uh Heth data app right so what is the computation that you're going to do what is the communication that you can afford uh do you want to do it with a lot of latency or not so that all depends uh which uh protocol that you choose that that is more suitable for your application yeah and finally uh so MPC uh does not really constitute of only uh gabo circuit SEC sharing base or FHP you also have to compose it with

ckp and maybe some authentication some encryption and yeah that is uh going to to be uh a mess for security so you have to do it very very carefully yeah I guess uh those are the points yeah yeah I mean uh there are a lot of challenges uh so I think we're early into this um sure KY do you want to ask something okay um so yeah um I guess uh we can uh receive questions but we have

been receiving a lot um so just type your final questions uh and yeah I would like to invite you guys to the PSD Discord uh you can hop on there and ask your questions anytime we'll be happy to help you in whatever you're trying to uh know or ask about NPC or if you want to contribute to any of the repositories that we're currently working on um we also have this uh MPC research uh compilation I'm not sure I have the link uh right now I would like to share it in chat let let me do it okay

yes we have uh open open channels in in in PSC um so just um ask your questions there and we'll be happy to to help um I don't think we have a tag as uh NPC team so um yeah we will just uh we just read the chat I guess um yeah thank you n for sharing this uh compilation of uh yeah a lot of the things that n has been talking about today and yeah some some other stuff um so yeah I think we can uh wrap

this up fny well all right uh thanks everyone for joining um we're going to do a second session of this uh jum series is coming up in March uh all right more details coming soon I guess um yeah so thanks everyone um thanks for joining and uh have a good day have a good night thanks guys thank you thank you thank you byebye um teams can we stay for a little to debrief

sure uh yeah about the recording I think uh pie you're the one who will handle