Threshold Signature for Mass: Benchmarking & Usability Study

Transcript

[Music] hello good evening everyone so the last Talk of the day and thanks to the Lindell for uh great talk and he's one of the legend in MPC definitely I'll be just touching uh and building on the same topic so I'm Jay uh co-founder of science Laboratories it's a young cryptography focused company building MPC libraries and today we will be talking what we have learned while working with our partners and customers and mostly touching all these learnings through building digital assets

so first of all MPC is not a magic like Linda also told there's lots of miscommunication around particularly the hack which happened couple of days back with multi-chain it was not MPC it was bad and implementation and bad policy in the organization so there are a couple of Dimensions which you have to touch and therein we have to figure out what's exactly the role of MPC is today we will be touching user empowerment some trust assumptions speed and usability fasting empowerment and Trust so not every design is self-custody let's see how and this we have learned while we have been serving our customers

providing our libraries which are application agnostic until now the whole field has been binary whether it's custody or self-custody but certainly custody is a spectrum and we have to see how we can define that so we choose a framework which has three variables usability empowerment and security and we use the access of empowerment and Trust to Define custody's spectrum and there are a couple of parameters number one can transactions be blocked by an Enterprise is the service permissionless is the whole signing key generation process totally transparent and can I do permissionless

recovery whenever I want if these variables are met then probably that's the best self-costary state we have written a whole proper block which is right there on this QR code link which can be read we Define all the specs how do we find the custody all the variables and couple of examples right and based on that framework what we came up with was these four zones localized self-custody distributed self-custody shared custody and then delegated custody let's see one by one and this is the example which I personally like a lot because as you see in the picture Heron what we are doing is we are

splitting the keys into two parts not literally exactly same as coinbase was using two-party lineal protocol your keys are now between your browser wallet or a browser plugin and one one on your phone so there's no Enterprise holding any key share it's still with the user we have full control on it you can sign when you want you can recover whenever you want and experience is very much like two-fact Authentication I will show you a short video yeah when you initiate transaction it will send a push prompt on your phone except if you accept it it will trigger the MPC protocol in between and done

very much like Duo OCTA of the two FAS of the Web Two Worlds now second comes the shared class 3 model there are multiple wallets in this domain where your keys are split between your bro your phone wallet or the browser wallet and Enterprise server and therein there is a trust assumption which we have to take into account you are trusting Enterprise that they are properly managing your key share it can't be stolen they might be using secure Enclave or a proper service but they're in probably it might not be right to call it self-custody they are positioned some bit somewhere between call shared custody model it can have one server One servers or multiple servers

and then we try to position a couple of wallets in the domain in both self shared and designated and there are a couple of them whom you are working with as well now another interesting thing which we understood while talking to talking to the partners is Embassy is a very chatty protocol and therein there is assumption that all the communications are trusted somehow and there are a couple of avenues where that we can launch some malicious attack and therein we have been facing demand of can we make this whole communication trustless can you make the whole communication to a state where the companies goes down even then you have MPC wallet running into action and then we have been investigating couple of protocols we

have been trying to make the whole communication decentralized such that if your company goes down then also you can have your MPC signing happening between your different devices an interesting case which happened here is we have been working with a partner where we are building a social wallet where the key Shares are hybridized between your phone your friends and Family's phones and also the Enterprise cloud now the notion here is the user can choose or there might be an algorithm to choose whether to choose the Enterprise Cloud through MPC signing or through the phones but the main catch here is that when the company goes down let's say the company is a startup running our coordinator or Enterprise

and when they go down all walls can still be accessed by the user because they can go to their friends and family and still run the MPC protocol it's a total peer-to-peer uh signing wherein we are leveraging couple of protocols based on Gossip like waku wallet connect which will be releasing a couple of uh in some time very soon and then comes the most interesting Parts which we are very very excited about is efficiency signing matters the time you have spent to do a key generation or sign does affect the impact on the user base so before going to the numbers in general MPC or TSS has four stages pairing distributed key generation

there's a backup process like lindeltools and then there is a signature process and there are other elements like refresh and uh recovery process when you lose one of the nodes one key thing which you noted was that there's a particular element called secure multiplication subroutine in a protocol during kitchen which was very heavy and that took around 50 percent of the time when we measured the if the numbers across hundreds of phones if you see the number here you will see that this subroutine in itself is taking around few tens to few hundreds of milliseconds which might not be well taken into account by the user who is trying to perform signatures or even very fastly

and these all protocols use Parlier based designs and then we also launched the same benchmarking on trying to see how it performs on S devices like watch or phone and if you want to scale and go to the next billion user we believe that we have to be mobile fast and that's why we are championing the whole perception of running at least one MPC node on your phone and one can be anywhere else so benchmarking is super important so what is the other alternative when we can do something which is more real time more fast so oblivious transfer based algorithms which does secure multiplication was the other alternative which we chose and we ran a couple of benchmarks just to know there are a couple of protocols in the

domain dkla 1719 and there's a new one called 23 and there's a latest paper which was which came a couple of weeks back what happened here is that we noted that the keys in went very very fast if you see even for a two-party setup you can do equation on laptop in 250 milliseconds on phone in around 1.2 seconds and that's the general setup which we have observed in practice or in commercial state the most interesting thing is that you can sign also quite fastly if you compare the most uh widely used multi-party MPC protocol like zz80 90 or 20 or cmps they take around few hundreds of milliseconds to perform a signature

even for two party setup but the implementation of dkls which we have done lately both 23 and 19 you can perform signature in around 55 milliseconds on phones and this is not taking into account the bandwidth or the network time between communicating between the phone and the cloud but that will be the function of the network speed which you have but the key takeaway key takeaway here is that you we have reached up to a state where you can perform signature in very very real time just to give you some hint uh between Cloud running three three nodes on the cloud and one on the phone you can sign in around 1.2 second approximately which is pretty fast and that's one of the thing which we are

super proud of right now and probably this is the fastest MPC implementation right now totally in Rust very scalable it scales from two to multi party quite well and just to note that when we design MPC wallet or a protocol we have to be very very aware again what is our truss assumption what is our threat assumptions and then only we can design it's not a magic we have to be very very aware about what is the user base we are trying to Target on the same note what we are going to do in September in Singapore is we are having a conference called the compute which is probably unique MPC Focus conference on 12th of September if you are around definitely attend you

will have best cryptographers and best academicians in MPC who have written papers or who have designed protocols they will be talking and exchanging ideas it will be a super uh impactful event we believe and that's all thank you very much [Applause] yeah if you have questions I'll be happy to answer now or maybe later [Music]