Lightweight Attestation of Web2 Data via Interactive Zero-Knowledge Proofs and More

Transcript

hi everyone this is Rafel uh today's L share is uh lightweight authentication of web data via G then proof we have Shang from baps who is going to present it this is a very interesting work uh which follows up a bit uh on Deco and tari using two malicious 2pc to prove TLS uh uh connection um very excited about this talk and I hope you are so thanks a lot sh for being here and we are all ears yeah yeah thank you for the introduction and uh yeah let me share the screen one moment yeah yeah cool so yeah yeah he very happy to be here to uh

give you a pres a presentation about our work and um yeah I think uh it's kind of free for anyone to interrupt me for any questions during my presentation and and happy to uh answer that question so yeah the the the the the work of this presentation is about how to authenticating web data uh with uh interactive proofs and there is a Jo work with uh K shell and U so yeah let's let's let let's start so uh uh first let's introduce the the motivation on the background so the problem is as follows so uh there is a

approver or client who has some information from start in the server and there is a way for the pro to query and get their server so for example you have a password you have a password password and you have a API key and then you can access to a server and get your private private information um the problem here is that how can the appr or the client to prove to a party which we call a fire that the information is actually from the server and it's not just some random data or just you know make made by the appr by himself um and the key Point

here is that uh we cannot modify uh the server side because it's kind of impossible in in in real life that you need to change the server and then for this very special applications and importantly what we want to do is that we want to prove any kind of uh this data for any kind of serice so yeah it's kind of impossible for anyone to to to change the Ser side and this is also the most difficult part in the in the product design and a very concrete example is that uh I want to prove to a set party that I have enough uh e in combase how can I do that without any Chang of combase server so that's a

problem here and so to make the uh uh the problem the AL solution more gener General so we are considering the TS protocol so which means that the approver using TLS to access the server and this is kind of very you know very common and the TLs is a have two standard and is widely deployed in in a lot of applications for when you you're using browsers you're using atps and then you're using TS so yeah we are focusing on TS so there is TS 1.2 and TS 1.3 and in the in this presentation we are now focused on 1.2 but the the technique here is kind of

very uh straightforward to extend to you know T 1.3 so yes so I think so far so good so let's let's uh go into a little bit details of the TLs produ itself so there is two phases of DS so uh one is called a handshake phase and the other one is a Rec cord so handshake means that the client and a server uh to uh run a a key exchange protocol and to get a shared secret key and for the uh for the record phase so they are using very standard or classic uh uh uh giy

hammer key exchange so the protocol is very simple uh in general and the client send kind some kind of random values the server and the server send back to random value uh x times G which is uh you know litic curve point and the certificate and the signature and then the client send back to a y YG to a server and the the shared secret is is xyg which you know is where stand on the IFH exchange and using this uh share the key material the two parties can derive to derive you know a session casys with call KC or KS for the for the

record phase so in the record phase the client server using uh you know uh uh uh these two keys symmetry keys to uh send and receive messages from each side so here all the encryption is like is is is using uh symmetric is like as DM or cha or something like that so it's it's quite efficient in the uh in the uh in this phas so that's basically the framework of TLS and uh the framework is kind of simple but I have to say the details are quite complicated and that's why we spend a lot of time to implement

all the details so yes uh uh having this uh background of Ls so I think there is a first trial that how to solve the problem I mentioned before so uh there is kind of very simple way sorry kind of very simple way so in in this way the after all the Tails partol after handshake after you know uh the the red card in the red card phrase the approver send the request with a secret to the and then get back to you know uh the the message and everything uh after this

kind of TLS session the approver can get all the transcripts during the internet and the very simple way to do that is that the approver can just use SNS to prove that okay I know all the run all the secret the message that generated these transcripts and send the proof and all the transcripts to the verifier of course the the verifier can check the proof If the proof pass then the verifier say okay yes I I believe you so this is a very uh simple and a very natural way to to to think about the problem so uh yeah it's kind of very kind of very simple in general but unfortunately this solution is uh does

not work so there is a very simple attack so yeah the prover uh use r uh do the TS protocol uh normally everything is is correct and is valid but when the pro generate the the the proof so he uh replace the value M the value s text M with another s text of M Prime and the appr can do that because the appr get everything of all the symmetric in in all the record Parts because get all the secret key to encrypt everything so after replacing uh the S text of M Prime with M then the Prov can generate

a valid proof and send back to the verifier and the verifier just to check everything and every sing pass but this is uh this is absolutely not what we want because the Prov can encrypt everything of M Prime to the S Tex and the key Point here is that the approver uh knows the secret key of this knows the secret key of the encryption and he can generate any valid s text of any uh data and then go to the uh SNS and then generator proof so this is a key point and this is the the main problem that the uh the the natural uh solution be I mentioned before does not

work uh any question here maybe yeah if if I'm not sure I'm un clear M so if there's no any questions I I will go for the next side I don't see any questions in the chats no so it seems cool okay so how to solve this problem so okay now that's The Deco protocol so Deco protocol give a very nice uh solution of the of the previous uh problem so the the key part is is is as follows so uh instead of the approver as a client to run the a t session with the server so the verifier and approver

has to run a twpc two-party computation protocol to uh to to uh uh uh connected with the server in the handshake part at the end of the two-piece protocol the approver and the verifier we have the share of the session key which is KP or and KV and the server yes there's nothing Chang of the server server has the session KK and U and KP and KV are shares of okay so yes this means that the Prov himself cannot control the the TS session or the TS Channel by himself because it only knows partial of the key or only knows the share of the key and

uh in the in the query part so the verifier and theover has to uh uh uh uh get help from the verifier to run a two-piece protocol to generate the S text with the secr key and then send to a server so yeah here C1 is it looks like a very a normal s Tex instead of that the S Tex is generated by the two-piece protocol and then the server we are send back to the the the send back the uh response in the CeX C2 so the key part here is that now sorry the approver now forward the S text to the verifier uh as

a commitment of s text which means that after this step the approver cannot change the S text anyway so as as I mentioned before in the previous solution the Prov can change satic because he know the secret key and there's no commitment of the S test so he can change anything he wants so in this step since the approver canot control the the the incb and de of s text and the pro send forward the S text C2 to the verifier as a commitment then the approver has no way to change the C2 so uh this can kind of avoid the the the the attack before and after that the

verifier will send back the share KV to the approver and the approver get everything so now everything's okay because the prover can decrypt all the transcripts so he can see uh all the information he want and this time uh theover even the prover has the key he cannot change C2 anymore becausei already get that there's no way to to to to modify it and at the end of this procedure the Prov then run a knock to prove that okay I know KP secret message that generat C2 so it means that okay the C2 is not kind of random s text is actually

generated by or generated in the in the T session okay and uh uh in generally I think the de paror here now uh give a very nice Solution by using 2 PC and a little bit kind of trick key to commitment to commit the S text and uh yeah this this kind of protocol uh will work for the whole uh solution for the whole problem but but there is kind of drawbacks of Deco the drawbacks of Deco is kind of you know is about efficiency performance so in The Deco Paper they're using malicious secure 2pc paroc it's kind of very generic 2pc protocol so they're

using AIC G circuit which is kind of uh complicated and it involves very large communication Comm ation cost and the memory is very large and if if you are familiar with G kuit then AGC oated G is kind of like 10 times slower than semi counter Barts and another part is that uh if you're using SN you have to prove some Z unfriendly ciphers and operations for example uh they are working on CBC Mac cyer suit so so we have to prove sh or you have to prove as or even you have

to prove multiplications over this binary field which is kind of uh not that efficient and the memory cost is very large so that's kind of the performance is used in The Deco Paper so what uh the the the contribution of our paper is that we are using a new uh Paradigm what we call Gall then proof to uh replace all these heavy part these lightweight uh building blocks so generally speaking we can replace HC with semi honest cover circuit and then we can replace S SS with interactive

poops um all these uh building blocks is very lightweight but I have to say it's not a very it's not a simple replacement the details quite complicated I just want to uh give you a a brief framework of what we are doing and to make it very fast so uh especially uh the the the key point that uh when we are using ik K or interactive Lun proof uh uh the con state of theart I protocol is quite efficient is even efficient than the semi G circuit so in our whole protocol the main bottom EG of the performance is actually the semon C circuit there is no

kind of you know the ISAC part is very cheap you can just ignore ignore it in the in ternal performance so yes so let's go to a little bit details of all the all the other ideas while how we serve it so the idea here or we the key observation here is that when we are considering two PC partol uh the case in this problem is not a is not a general top protocol so the the key point that at the end of the at the end of the protocol the verifier we are send back the key shares to the to the to the to the to the approver so

we abstract the problem a little bit so for example uh if a approver and verifier who wants to run a two-piece poweron on function f and the input of prover is XP and input of the where f is SV then they run the two-piece protocol and get the output y or yv and YP and then uh at the end of the protocol the verifier will send back XV to XP so at the end of the the prodoc call Prov we get everything of the security part so that's exactly what uh what say talking about in in the previous uh Deco Paper

right so in this case we kind of uh use more general or use more efficient building blocks to to design this uh uh two two PC protocol so there's the key Point here is that when we compute when we compute this uh uh two- party computation by using Garber circuit so G circuit is very uh you know suitable for this buing circuit and there is a very nice property which is that the Govern security is actually secure against the malicious evaluator which means that we only need to consider the malicious Pro a case and uh in our protocol so before the

verifier revealing XV we want the prover to commit XP and YP so before I reveal everything so the prover cannot change his input and output and at and of end of the prover or end of the two PC particle so the pro has to additionally prove that the output and the input are consistent with regard to the commitment value so in this case even the pro the the malicious Prov can introduce some kind of you know malicious behavior in the two-piece protocol at the end of the protocol the verifier will detect that the appr cheat or not this is what we

want we do not avoid the malicious approver we just want to detect the malicious behavior of the approver so uh in these cases we are using the special case of garit and we are using a very special OV system to prove the consistency with regard to the committed value so this will make uh uh this will enable us to use just semi honest C circuit we don't need to use augmenting car circuit to to to to to prevent malicious behaviors so we just need semi circuit which is like 10 times faster and then we use ISAC to prove which is like maybe 100, times 100

times faster than like like than than than SNS or even other Pro system so this is I think this is the main idea that we can make them uh much more efficient so in the next slid I going to uh uh describe a little bit about uh each step of the of of the protocol and to and give a brief introduction of Gaba circuit and the V based is K yeah um so in the handshake is actually a two-party handshake so as I said before the approver and the verifier we around

two piece protocol to like to share the uh to to share the uh session key so in this case yeah I think the Deco Paper called the three PC handshake protocol which is is is is kind of in this way so uh after the server sent back to XG to the prover the prover will forward everything to the verifier and the verifier will check everything and the verifier will generate y g or Y VG and the who Pro generator ypg and the verify can set the the the EC Point elliptic curve point to the prover and the approver add these two point and send back to the server so which means that

uh the DH top is not generated by the appr itself it's generated by the verifier and the appr so this case he can do this two a three PC handshake protocal and um the the point here is that the verifier and approver each get a each part get like a secret value and the task is that they want to compute uh uh uh this uh you know session key the the the ddh tople and uh all these stuffs are are you know uh represented in in in in uh elliptic curves

so the key point that uh the verifier get a point J one and the appr get a point J2 and they want to compute the X Co rate of D1 plus A2 in the uh elliptic curve so so if you do some maass so it's just to compute this day equals Theta Square minus X1 - X2 and it means that is this equation and there is a very standard way to do this kind of a two-piece particle but uh it involves a a few building blocks so in The Deco Paper that using uh fully secure m2a m2a means that uh

multiplicative to additive a protocol which means um in the m2a protocol so each one has a input and has output and after the protocol the addition of the protocol equals to the multiplication of the of of the input which can transfer a multiplicative share into additive share and this is all what we need in in in this two piece protocol so in the also it's always called o protocol these two things are the same so in the in the in The Deco Paper they using Pay Your hom and gen proofs to to to construct this m2a protocal and we found that in our

case so we can just use a very weak o version what we call is O with errors so o with errors means that in the protocol we can guarantee the privacy of all input but we cannot guarantee the correctness of the output uh the building block alone is kind of very lightweight and we found that using this weak uh building block still is sufficient for our protocol which means uh the the the the reason is that um recall that in in the at the end of the protocol the prover has to prove that everything is done correctly so even if in the o with errors protocols

the appr introduce some errors to the output he can be detected by the verifier in the ID proof so the ID proof can make sure that that the Prov cannot introduce any errors in this kind of situation so we then can use L these arrows uh in with this kind of lightweight building blocks and it's kind of yeah maybe I think it's like three times faster or even more than using very general m2a protocol so that's that's why how we to to to to improve the you know the the the the the two PC handshake parts and uh yes the other part is that when we get a secret share get a shared

scheme material we has to use a KD F key derivation function to derive different key materials KS K KS yeah the K function is kind of very complicated it involves a lot of hmac sh functions and we actually impl or optimize all the circuits so our optimization is that we found that some of the uh part yeah here f means the compression function of the Sha function of the Sha uh 256 as function so in in in in the in the circuit there is a lot of reused values and we found that we can open some intermediate values to comput it uh

in plan to reduce the end Gates of all the circuits so we also prove that this way uh is also secure uh when we see FH as a random modle and in this case we can reduce uh the anate by like three times so which in turns improve the whole communication sit by three times so yeah that's that's that's the main idea that to be how we uh optimize all the circuits yeah it's very it's very complicated task but we we found a very nice way to optimize it and make it very uh make it the make the the number of end Gates much more smaller so this is why uh this is one part of what we do in

the in the K function and the other part is that when we focus on the record function record phas we're now focusing on a this m and yeah here is a very simple uh description of the ascm so uh given a message M1 to MN so you are using as and the key to encrypt all the counter and then X XO the the the the message you get a s text in addition you have to Compu a tag which is uh what we call gash function so um um I think uh we do not need to uh go into details of how how the details uh in the tag functions

what we want to say is that in this case the important thing is how we compute the Hedge part or the power of the Hedge part because it's very natural to use G to compute as for as only has uh like uh 6,000 end Gates and um it's very gen is a very general way to compute the the as function and the key Point part is that we how to how to compute the the polinomial function uh of of H and H is also as s text and uh there is a very general way to do that is that you are using also in Gaba circuit to to to compete everything but uh the but is quite heavy because

the multiplication of in the binary field is kind of very heavy because one multiplication involves like 8,000 endgate so it's even heavier than as gate so in order to reduce the the head here we now uh propos a new idea to uh compute the power of edge so the problem now is given share of hge which means each party hold H1 and H H2 respectively and uh we want to compute the additive shares of the power of H so the idea is is very simple so we losing a to M which means to additive to a multiplicative

particle with Arrows with arrow means that we can guarantee the privacy but we do not guarantee the correctness so this way we can compute uh H bar one and H bar2 and such that H1 x o H2 equals the multiplication of H1 bar H bar one and H bar two so in this case the two parties can locally comput the power of H H bar and it's also the multiplicative shares of the power of H and then we use o or use M2 a with arrows to compute the additive share of of of of the power of edge so in this way we can make about 1,000

times faster than directly GC and all these a2m with arrows and O with arrows are very light justing those like a few OTS and OT is quite is quite is quite lightweight uh in terms of performance so that's basically the the the whole protocol of the the the the main framework of our protocol and the the G the the G and proof Paradigm and other um uh optimizations of handshake red card and um the result is that we can improve The Deco Paper a lot so for example in the key kdf function we can

improve like three times faster and the computation uh as yeah we in in terms of computation time we are like about 10 times faster than dayod part the dayod and uh uh one thing we want to mention that we actually did not implement the SN part of Deco we only compared the NPC part even in this case we are like 10 times faster than Deco and and we think that if if you add the snug part in Deco you know the the Improvement will be much much much more larger and also we improve the communication size by 14 times especially when uh the memory size is kind of uh 25 times smaller because

do not need to use stocks and the carer circuit and ik K are memory efficient so all these improvements allows our partol to be deployed using browser extensions so it's quite lightweight and even the browser extension can run our protocol and actually integrate our integrate this protocol into our product so yes so far that's the main uh ideas and the main Improvement of a prodoc and uh yeah maybe any questions and in and in the next slid I'm going go into the details maybe descriptions of G CET and Isa

Cas um I do not see any questions in the chat uh I do have a question however when you talk about three times 10 times uh improvements in uh in speed um you say that you were only looking at the MPC Parts uh sorry the communication parts withco if I understand well uh so yeah uh actually we Implement all the all the all the all the details of our protocol yeah and we implemented the NPC part of the call yeah but we do not Implement The Snug part of Deco because it's kind of very complicated and then we compare our whole protocol with NPC part of Deco and then we still have like 10 times faster yeah so uh I just wanted to

confirm that uh these numbers taken into account the proving time of your protocol but not the one of Deco thanks a lot yes yes great thanks a lot okay so yeah I think I'm G I'm gonna talk about a little bit about a gar circuit maybe someone is not familiar with that so yeah just a very a a brief introduction of of cabar circuit which is kind of very popular in the MPC you know area so G circuit means that yeah the scenario is that there is a goer and the variator they know a function and they want to compute a function f and get the input

fxy so okay so g c is very familiar is very suitable for the you know boing circuits so uh we're not buing circuits means that there all the inputs all the all the wires are are a bits okay so the function is public so then the gra get the function and he get everything of the uh get the you know the layout of the other circuits so he choose random uh labels two land labels for each wires of the circuits so like A2 G so uh to reprint zero and one for you know use use use a label use a random label so then for each gate uh the GBL generate a

cble Gates so for example for the first anate so using a double key encryption symmetric encryption yes to uh uh use the input uh uh label as two keys to encrypt output label and the way he uh encrypt is according to the gate for example if you anate so the the the order is like 0000 Z 0 one 0o one z z and one one one so it the the encryption is like you have four S text then you have four S Tex for each for each gate and um then that the G can can generate all the G gates for all the all all Gates and then

sorry and then the G can send all the g go Gates which is is is G circuit to the to the evalate in addition the gab will send the the the input label according to his input for example here is like a z and a C1 and this kind of this is very secure because a z and a C1 one it's just random random labels does not the evate does not does not know any connections with the input and also the G we send the output lab output label of the circuit G1 and it tells the evaluate that G1 g0 means represent zero and G1 represent uh uh one so in this

case uh the evaluat and the g also run oper transfer means that the Val uh uh uh take his input uh to the to the oper transfer and the g also send the the labels to the ob trans and the EV we get the the the we choose the label according to his input B1 D1 and the Govern does not know anything about the result and the does not know anything about the other part so in this case the evaluate can get all these input and he can do the decryption means that he can actually he can test all these four C text and

decrypt uh the uh using use the encrypt label to decrypt the output label and then he can actually uh compute to the G1 compute to G1 or G2 for for number in this case he will get G1 so the output is is is a one so it's basically the the the main idea that proposed by y like back to 86 8 86 and I think there's like a lot of work in this area like 40 years after DC is is is quite efficient so one thing I have I want to mention that uh the security guarantee of KC of

GC is highly asymmetric means that as I said before in this case this GC protocol is secure against the malicious evaluator and this is a very nice property especially in protocol and the yes but is uh only secure against the semi gers because the goer can you know go a different function f Prime to get information of the variator so um in if you want to design a manous c SEC for example like a c SEC AGC so all you have to all you have to do is to avoid or find a way for the Malicia uh to to to avoid the malicious C to you

know go a different function f Prime what we call Selective attack so yeah this kind of uh the security property of GC and after 40 years GC is quite efficient so for example like half case of three halves so it's state of the that this protocal so in our protocol they're using half Gates and if you want to use three halves you can cut the communication size by like 25% but the computation uh computation overhead is a little bit higher by half gate so in our protocol we are now using half Gates and the current implementation of of GC like emp2 Kate can now govering

like uh 20 million anat per second and XR G for free so yeah uh in our C version we are using emp2 kit to implement you know uh the the G kit and is is is quite efficient because we can use ASN instructions to make it extremely fast so in the G circuit the the bottom neck of GC is not the computation size is the communication size so in our for example in havat if you want to uh gobble one endgate you have to send like 256 B bats so the the overhead so all the communication all the bottom of the

communication comes to comes from the G circuit yeah so far is the G circuits so yeah I'm GNA uh tell you a little bit about the ik K part so why ik K is very efficient and why I is is is is much more efficient than SN but it also have some yeah I think it I think also has some drawbacks for example it's only private coins not a public coin so we cannot make it non interactive but in our case this is sufficient because we already use two PC is already interactive so uh is is very is it's like it's it's perfect in other case and then we can make it very fast to to uh

to prove buing circuits especially in our case all the all other the stuff they want to prove is the buing circuits so a one I uh want to introduce is this what we call V Bas Vector op previous uh linear uh uh linear evaluator uh based is stuffs so um before I introduce the V ebased ik uh I just suppose assume that there is Oracle can generate this what we kind what we called V topers or it's just the C tops so in this case the verifier we have a global secret data and the vle

procedure will generate massive types of for random what we call atmac information sertic Mac is about the verifier has a key Ki and the approver we have a a Mac Mi for a random bit bii and all these uh uh uh numbers satisfy this linear equation so it's Ki equals Mi times bi uh plus b times Delta here uh K and M are are stream bits so like it's 128 bits and bi uh is is a random bits so in V are based ASA case we have to

implement a v can generate as as many top as we want and U the uh we find that there is a very efficient way to generate this kind of top uh is kind of is kind of phrase in some sense so given this kind of uh V topos we can construct I IDK protocol very efficiently and um one thing I want to mention that this ATAC is actually a you can see it as a commitment of the bi so yeah when when when each party open the the Vue there's no way that you can you can you can say

something different so it's actually interactive interactive commitment skins and this is also very important in our go them go them proof uh Paradigm because we don't need to uh press uh to to design or Implement a harh based harh based commitment for all the input and output we just use IG and just use you know V help us to make it a commitment and make it for free this is why we we can make it very efficient so in this case so the prover uh once we get this kind of tople the pro when the pro has some uh weakness which is called The W or W1 to WM which

are all bits so we have a very efficient way to commit or to make itac of the spe of this specific input uh wi the pro just like uh using minus bi and send the the result to the verifier this is safe because bi Is Random so the verifier can get any cannot get any information with that I and then and at the end of the protocol verify and approver can you know get itac of of of wi which is yeah is a commitment of wi and also this kind of linear uh uh relation is homomorphic is additive homomorphic so if it's X Gates

you can just uh locally X or all these all these numbers so the the the the the the difficult part is that you have to prove multiplicate so here the multiplication is is yeah is is Nate so when we are considering buing circuit so in this case the pro and the verifier has three you know uh ITX so the verifier then compute like K1 minus K1 * K1 K2 minus K3 times Delta so in this case you can do a kind of a MTH then you find that uh there is is uh there is a still

a linear equation as long as B3 equals B1 * B2 because if this is the case the last turn the quadratic ter will vanish and this will make it a a linear relation again which is very nice in our protocol so if this if if if uh uh is anate and is true then the verifying approver can get another linear equation of the of all this blue part and the yellow part and at the end the approver can first mask the uh the the previous part because there is some kind of information may

may some some information of of the equation so just invoked V part to get a random fresh tole and mask the previous p and open it then the verifier can check with this very linear very very very simple linear equation and when you considering you know multiple uh mod gate so you just use a Rand L combination to make it very simple so in this way we can prove uh endgate very efficient especially we can prove the gate uh Pro and and the circuit get by gate which means that the uh the whole protocol is is a memory efficient so you don't need to load all the circuit into

memory you can you just you know uh to prove the gate by put the second gate by gate so is it's memory efficient and some number here is that uh is is is is Bing fast for example the quick sale paper they we can just using like less than $2 to prove one trillion end Gates and uh about 2.5 USD to prove one trillion multiply Gates over over your mer Prime field which is you know much larger than it's not it's not just end gate it's a modifcation gate of a large field and the configuration of the machine is very is very is very

normal also uh we have other you know applications of IDK for example if the circuit is is replicate is repeated for example in asgm there is a lot of as circuits which are the same with different input so in this case we can even uh uh reduce the the the communication size of the of the of the of the protocol uh uh but the uh computation overhead is kind of little bit heavier so in our protocol we do not we do not use an uh right now because uh when we uh integrate to a browsers um the computation part uh the computation

power is very limited so we cannot afford this enement enement protocol in that case and also we also design you know ZM zml protocols using ik so um we can prove rate 101 inferences uh inference I think is the the complicated model uh so far we can prove as far as I know uh yeah but one one one important thing that the whole protocol is interactive it's not it's not publicly verifiable but yeah we we can we can we can show that I is powerful enough to to prove very complicated applications yeah so that's ik k

and yeah put everything together so you in our case so we first to use sem GC and to your handshake and then we use sim GC to encrypt you know the the query part and after the verifi G sent back to the prover they're using I here to prove okay the K the kdf is competed correctly and the the and the pro no KP and secret M that generate C1 C2 that's that's that's the whole framework and uh also we do some performance uh to compare with uh Deo so with different uh uh network with different payload sites

so yeah you can see the number is is like 10 times faster than Deco and also uh we conduct a global scale experiment so let me explain explain a bit so here the P the purple nodes is the verifier and these yellow nodes are approvers uh uh in different uh countries and areas so the Yellow Part the number of the Yellow Part means that the time that um when the server is hosted by the combase we are like to query the the balance of BTC or something like that and the green part it means that the server is hosted by

Twitter we like to create the number of followers so also we uh separate the the whole protocol into online and off Time online and offline off uh so which the uh uh the reason that we want to do this is that uh we can do a lot of stuffs lot of things before the approver establish the TRS session and we want to finish the whole three piec handshake uh before for the server time out so it's very important that we reduce the time of online so in this case in our experiment we show that even in the in the in the in the in the worst case we only need

like 10 second to complete the the whole uh three piece handshake and uh usually the time out time I think is about 15 seconds so yes we also can like to move the verifier to close to the approver to make sure that to make the time Much More Much much smaller so yes this number show that our protocol is kind of very scale and we also like integrate to our product and which mean and which shows that is kind of it works very well yeah so basically I we we put our paper on ePrint and actually it's got

accepted by uh US security this here and uh yeah I'm very happy if you have any questions to uh discuss with me online or offline yeah that's basically all the presentation thank you thanks for the talk really interesting you have really good results it's impressive uh I don't see any questions unfortunately on the chat uh and on my side I need to read a bit more about o to be able to ask you questions so I'm sure I will send you a few offline yeah sure sure yeah yeah here to hear any questions offline

yeah thanks a lot again for the talk and uh have a good day everyone yeah thank you thank you am