ZK Podcast: Threshold Cryptography with Omer Shlomovits from Zengo

Transcript

[Music] welcome to xero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me anna and me frederick this week frederick and i chat with omar shlomovitz from zengo wallet we talk about mpc threshold cryptography and how this work is being used in a blockchain context but before we start in i want to say a big thank you to this week's sponsor leased authority leased authority is a team of researchers cryptographers open

source developers and privacy advocates they are a security consulting company known for their dedication to pushing the limits on how to build privacy respecting solutions they specialize in security audits like the eth2 specification protocol labs gossip sub protocol atomics library wallet and smart contracts for the tesla's foundation block stacks investor wallet centrifuges tin leg 3.0 and more they wanted me to let you know that they are currently working on a step-by-step guide to building zk snarks called the moon math manual you can find and donate to this project on git coin grants matching round eight is starting this week speaking of the zero knowledge podcast also has a grant on git coin so when you head over to the site

do consider donating to both i've added the links in the show notes lastly lease authority is also hiring so if you're interested in working with leased authority on anything zero knowledge related head over to their career page to learn more about the security auditor position they have opened you can find that at leastauthority.com careers i've also added the link to this in the show notes so thank you again least authority now here is our interview with omer today we're sitting with omar shlomovitz from zengo wallet and we're going to be revisiting a little bit the topic of npcs and covering primarily the topic of threshold cryptography so welcome to the show omer hi great to be here thank you for having me

um i think we got to know each other a little bit through a research group that you've created called zengo x i think what would be interesting to kick off this interview is to hear a little bit about zengo and zengo x what's what are those two entities and how are you related to them yes so zengoto is um is a company building a wallet for consumers crypto wallet it's a company that i co-founded and as part of my role in the company i had research in in a research group which we named zengo x which was not the original name but this is the name we gave it now this group exists on github which if you think about it is kind of a

social network with uh the issue tracker tracker and the pr and where and you can start stuff and you can follow and so on and we felt the need to that something was missing right so we wrote a lot of cryptographic libraries that are very specific to uh required all sorts of use cases and we said that people that are coming uh to the github organization are sometimes lost and uh the conversion from taking them from being just a visitor to being a contributor is something that we want to improve so what we've done in the beginning is that we just added a link to a telegram group and instead of you know asking for

contributions and so on just tell them look we want to know you want to meet you want to discuss let's walk together and it was uh i guess it's a successful experiment because it organically kind of attracted very interesting people from the space and even a bit from outside the space which have common interest to uh very specific use of cryptography so that group just grew and obviously it's it's now also exists on telegram and what we do is that first of all this is like the main group is kind of at the front but there are many side rooms that are very vivid uh discussions around all sorts of topics that include research what happened is that when we started by

being focused on something called threshold photography we noticed that there is also room for other kind of research related topics around cryptography uh to be discussed that are related to the space and the space is pushing uh forward the entire field of cryptography so based on demand we kind of shared more and more of what we are doing which also evolved from just threshold cryptography to more cryptographic application or application that are heavily relying on cryptography that can be used in the blockchain space so so yeah that's kind of how uh research came to be which is i would say like 50 percent

more oriented to cryptographic uh code and implementation and 50 to research and and out of this 50 percent also some part of it is for general research in cryptography and from time to time we try to i mean it's one thing to bring people to come and talk and discuss the other thing is to keep them engaged and feel comfortable to talk about all sorts of questions that they have like engage with discussions so we start to do all sorts of activities around this group which includes uh at some point we had the webinars around cryptography uh from people from the let's call it community or ecosystem we also started some study groups one

about class groups which was highly successful uh i mean i think now we have one of the uh maybe the only one for specific use cases class groups in last uh libraries and it's it's there's like a course it's not cheap to get the knowledge about classroom so it really was helpful um yeah and that kind of activities yeah i can go on alone but but the end result is that now it's it's it's an ecosystem and then we we sit uh growing by the day and then gets a lot of engagement and eventually we're also getting a lot of contributions and this is the core of xango x it's contributors working together to solve interesting research problems and also to build cool libraries in cryptography uh it

feels pretty unique to have this sort of research group come out of a wallet essentially where like it's pretty commonplace that a sort of core team has a research group as well or something like the ethereum foundation has a research group but i've never really heard a wallet company have that so what is your goal to like contribute that back to the wallet or is it so like disconnected from that at this point that is really about fundamental research or even contributing research back to the to the protocols yes so uh it's a great question now we need to understand how xango started and when it started so my english uh i came from academia i met my co-founder well which was uh he's a seasoned entrepreneur and uh

he came up with this issue of the wallet which never bothered me but after sleeping on it i realized that this is a true pain now i came with some background in mpc and it took us some like basic research until we figured out that this is what we wanted to do like we need to build key management which is uh one of the cause of building a wallet in the space around multi-party computation or threshold cryptography or threshold signatures and from that point i spent pretty much 24 7 uh implementing npc which was in its infancy very surprising to see what it was at that time now as you said when you build a product at the early stage there was a lot of r d uh and the research was very much

related those this point to what we built in the wallet for example i think the first real research we've done was around recovery you need to build a recovery scheme that would be equivalent to your primary way of sort of handling the keys right because otherwise the attacker would just go to your secondary way of how you do recovery and would get the key out of this way so we try to solve recovery and because we are using npc we try to stay with the same assumptions and so on uh and eventually i think we presented it at uh the stanford blockchain conference and what happened is that i guess some some part of it is uh due to luck is that this area specifically threshold cryptography in relevant blockchain space attracted a lot of

folks from academia at the same time so there's been a huge surge of research that is focused on this area which meant that for us it was very easy to first since we're kind of one of the first to actually try to work with those uh primitives and protocols we encountered all sorts of problems that has some value to to academia people so it was easy to start collaborating with them so this was the focus of the early days but from that point while we started to establish the research community and like answering those questions it opened up to bother questions for example so how do you do a pc when you have a lot of parties right

not just two or three which was the common case what happened when you have 1 000 parties so it kind of led us to this fundamental question that eventually for example in this question we wanted to answer on how do you build the communication layer in the right way for mpc for example based on some state machine application bft um that we this was like our angle so yeah it diverged and diverged in that point now what we have now is that our research is probably ahead of the product uh and it's also by the way after you launch it it's harder to change cryptography but the research is still supporting most of what we do in the cryptographic level in the

product and in security stuff and he also supports other products uh for other companies that are using the code everything is open source so there is this ecosystem and there are questions around it and we also and allow us and we allow for all the time to seek for alternatives to try and improve you know after you solve something about security want to improve the efficiency so this is like another line of research so i would say that like there is a lot of connection between our origin and what we are doing now but there is yet another big chunk of research that is not directly expecting the product in the near future what you describe as this community building sounds a lot like the xero knowledge podcast telegram

group and then the zk study club and some of the projects that we've been building obviously a bit more focused on the zero knowledge specific space but there's so much overlap i find with your group and i know when i when i first joined it and got to see what was happening in there it just seemed like it would be inevitable that eventually we'd have a conversation and hopefully get to share some of that info now the study clubs are really successful i i think we probably what inspired me to do our study groups although they kind of picked up a different approach but but i think it was the inspiration yeah we get a lot of inspiration from the zero knowledge ecosystem oh cool so we've heard the story from the founding of the company onwards but

can you tell us a little bit about what happened before that led you here um the story is kind of simple i i found the launch of ethereum i think this is what i picked up i picked it up smart contracts kind of blew my mind so i read the yellow paper uh much before i read the bitcoin paper the white paper uh my my first attempt was to find an issue with the ethereum proof of work they eat ash it was actually an existing algorithm that vitalik kind of tweaked and my goal was like i knew that there was no security proof to the tweet that's vitally done and i saw them at the same time there was a lot of other research going on about all sorts of like it's called moderate heart functions uh in

relation to relation to space and also like memory consumption and in the uh computation so i i had a quite nice i think few observations i made presentation but nothing that i could actually make substantial contribution out of it and i guess that from that point i decided to not bet against italic and then i uh eventually i met where so this is what i what i mentioned before so we had nigel smart from unbound tech and some university living yeah can you love it supposed to be a cool place uh we had him on a different episode to talk about npcs and a bit of threshold cryptography but um i know you listened to that

episode as well amaran i think we can flesh out our knowledge of of threshold crypto a little bit more but i'm not sure that we have sort of the basics i think we have the basics of npc of how you know you can go from a polynomial to where where different parties have the different components and we explain those kinds of things but going into more like real world cryptography uh say and the like i don't think we really have the fundamentals there so maybe you can help us get up to speed a little bit on that and talk about some of your own work there as well sure starting with uh mpc stands for multi-party computation so basically what it means is what we know

today is that we can take any function uh and we can compute it with mpc techniques meaning that you have private inputs that you don't want to share but you want to learn some output so nigel mentioned the millionaires problem like you want to learn for example so the inputs would be some secret salaries and you want to learn who is the richest party now traditional cryptography you could say that this is kind of a branch inside npc that focuses on functions that are cryptographic right so all of the cryptographic functions we know like key generation and uh signing digital signatures and encryption they all have a threshold

equivalent and you call it threshold because you need to make this threshold assumption that uh is parameterized by uh there's two parameters let's call them t and n this is a common naming for them convention so what you want to say that you have n part is joining the computation and out of the n part is you assume that no more than t are malicious meaning that they try to sabotage the protocol and learn something about the other party's input okay so why is this interesting so for example uh signatures which is the biggest use case in the blockchain space this is something we do all the time when we propagate blockchain right when you sign a transaction you actually do

a digital signature over the transaction to uh sort of say that this is your identity the signature is equivalent to say that i have this hypographically proven identity that i'm touching to the transaction why is this interesting in terms of cryptography so let's take for example digital signatures so in blockchain this is what we do for every transaction we attach signature which is basically like saying i have a cryptographic proof that this transaction uh came for me like i'm saying this is my identity and no one can forge it right the basic security property of signature is that it can be unfoldable however it is some kind of a single point of failure for once so

one motivation for using a threshold cryptography or threshold signature would be to kind of distribute the trust among parties so this is actually very similar to multisim that is either existing natively in some blockchains or in others like it you need to write some smart contracts or some functionality to achieve it but this is what you try to to get so you can actually encode any access structure that you want both in multisig and also in threshold signatures however using threshold signatures you can add the access structure so the output one of the requirements of the threshold signature is that the verification would be the same right so when you verify multi c you basically need to verify

each signature separately so it has some implications around the size of the transaction and also about the fees that you need to pay for it because it takes more space but also there is this privacy issue that you can actually expose the access structure in mpc you require that the verification protocol would stay the same so for an outside observer looking at the blockchain a verifier a minor whatever the signature should look the same so normally the access structure it can be 500 signers that are somehow connected with some let's say end gates or gates and all sorts of like imagine still get eventually you get a single signature which is the same size as a single sign signature that's the

point of failure is that there is sort of a traceability aspect i i would say it depends on on the use case for some if you have a really big access structure so the fees might be something you cannot handle so you'd want to have fees of a single transaction but yes it it might also also the size might be a factor but then also the privacy so it really depends now i want to connect it a bit to to the research community and and what was going on in academia so a few people envisioned stephen goldstein they saw a way that threshold cryptography can be used in a wallet but the protocols of doing it since in bitcoin we use a protocol named ecbsa

which stands for elliptical digital signature algorithm so the way of doing threshold ecdsa was uh not very efficient so it was uh imagined but but never done in practice and what happened is that during the same time that i started my company there was a large body of researchers that try to push this point and because of the bitcoin use case found very clever ways and tricks on how to make this threshold dcdsa super efficient now it's still very far from the efficiency you get from a single sign first of all you have to you have to have communication like with with all threshold cryptography i mean there's some state of the art now

that try to minimize the communication but usually with mpc you need to exchange information so there's the communication aspect here and also the computation so you do need to involve some complex computation and also from security security wise there are some security assumptions that are not native in the blockchain which is just a regular public elliptical assumptions that you need to incorporate still those protocols kept improving over the past three years until we have now really really efficient ways of doing this natural dcpsa i want to go back for a moment because i just want to redefine you you sort of made the distinction between the multi-sig and the mpc and the threshold cryptographer being a

subset of mpc basically you were saying that they're like with threshold cryptography all inputs are the same size or are identical in a way can you just clarify what you mean by that i can clarify by explaining about if we just look at signatures so a signature is actually three different algorithms one is a key generation one is signing and one is verification so when you go to the threshold variant of it so you have to find a way to do a distributed key generation or dkg the signing is also distributed so you can call it distributed signing or threshold signing verification must be the same as in the

single signal case so what it requires you is that the output of the signing the signature algorithm should look the same as in the single signal case so it means that you take all the information from all of those this might be i don't know how what size access structure and you need to compress it into a single signature so you do all these kind of mechanics inside the digital signature but the output should look or should uh be of the same size as in a regular digital signature algorithm however in multi-thing you basically concatenate different signatures so it's go it goes linearly with the number of signs i see so you end up with a you do you actually add them is that kind of what you mean

by that you're kind of like putting one after another to make this like master signature yeah yeah got it cool that's been a helpful distinction actually yeah i've always been a little bit curious as to why multisigs weren't considered npcs or vice versa but it was cool with this new kind of threshold cryptography you know you've mentioned some of like the pros or the benefits of it but like has it also opened up any problems yes so behind what i mentioned that you do need to assume some security assumptions depends on the protocol so it might be that you need to introduce some new assumptions into your system which is not preferable you also introduce overhead in computation you

also require communication so on top of it the protocols themselves are extremely complex to write like i i can say now with 100 confidence that doesn't matter who tried to implement threshold bcdsa they failed including ourselves like you have to fail this is one of the reasons why we are so happy to have this kind of ecosystem around it because it got to be better this is the only way to gain trust you have to battle test it over and over you have to get new sets of right to look at it you have to improve it constantly otherwise you fail uh this is one of the reasons for example binance implemented threshold signature library and uh we found

several issues that are the algorithm itself in the way they implemented cryptography that can be severed now it's interesting because it opens all kinds of new attack vectors uh because i mean we can go into specific examples of what it looks like to actually maintain this kind of uh or to understand signatures but uh the end result is that for example now we are also maintaining violence liability because we we kind of see value in try to standardize it try to make it as simple as possible try to make it so deliberately is go library otherwise last library we want to make them uh interoperable we want to make them uh with similar api we see a lot of confusion around it so it's really hard

also just to interact with those libraries requires some level of experience or knowledge of cryptography just to to talk with us to use the api of those libraries so for example in our case in the xango libraries we built a stack on top of it so we have another library just to wrap the threshold signature library to make it more human friendly such that you'd avoid mistakes around this like you know round off communications and so on and then we have another library on top of it which is more application specifically if you want it for uh to have threshold uh validation scheme or come to a threshold wallet so you need to have another library even on top of it you had one more layer

just to wrap it so to make the api completely completely foolproof uh because like this is the the cost of it it's like extremely complex but that binance bug that you mentioned like you was the problem that they had implemented too early before something was battle tested binance did a fantastic job they created state-of-the-art library they used the right people to console them they audited the library they called the bugs that we found and it's it's in plural it's bugs and also again we found bugs in many other places including ourselves and by the way our library is also audited even you know the auditors are not familiar all the way with this new

technology so it's sometimes an issue but even doing all this great work you still can find all these cracks that are really hard to catch like it's really hard for example to explain uh maybe i mean one of the main reasons is that you need to find like someone that is fusion between a software engineer a network engineer and the cryptographer and usually those guys like do not meet so it's uh and they do it's rare i guess yes yes so it's how to to completely eliminate bugs the only way to do it is iteratively by like any other thing like any other software you have to keep battle testing it and like have experts look at it and contribute

it's the only way yeah i think it's worth highlighting that the only thing that that improves it is is time right i mean even an open ssl that had been around for 20 years there were severe bugs that were found and so it's sort of you can't ever expect anything to be perfect and i think that's why it's great to have a community and a group and like a number of eyes who are actually looking at it from different vantage points using it in production in different settings and that's the only way you actually find stuff yeah can you give a bit more detail about the actual bugs though maybe that helps us also to understand like what does a bug in threshold cryptography mean in the real world like why would that be bad okay sure so let me explain about

the simplest bug that we found so for this i need to introduce another threshold protocol which is secretly shelled so the goal of this protocol is it's extremely important it's mostly when you do threshold cryptography in production you it's almost a must-have so what you need to do is that an attacker let's say that you now you threshold this is the the name that i use you traditionalize your scheme your cryptography so now instead of one party you have n parties each one holds some secret and you want to avoid the situation when a tackle gets hold of t plus one such uh secrets but a clever attacker would go and attack one by one so let's say

you spread your secret shares to different sites the attacker will just go to one side by the other and and until you get enough enough signatures that they can construct the secret so to avoid it you need to add this notion of change with time so you need to take some time uh parameter uh and after this time you want to refresh the keys so you want to keep the same secret key uh that is never reconstructed but it should be the same but you do need to refresh the secret so that you overwrite your old secret this is also the mechanism if you want to introduce new parties into your to your group so uh if some parties uh stop responding you want to introduce new one so this is

uh part of this mechanism and it happens like for example in dirand uh where they produce this they do it it's it also exists in threshold signatures the name you're using here is secret share is that the term you're using yeah i say that for every for each party each party owns a secret shell i mean it doesn't necessarily it means that this is it but in the case of signatures usually this is the case so what happens in in the binance code is that so you need to do this protocol to uh reshare so again the goal is that you have the same secret this is like invariant in the system should be kept but the secret shares of the secret should be reshuffled now to do it you need each party to communicate with the other

parties so each party would take his own secret and would share it with the the rest of the en manuswan parties now what will happen is that it's enough for an attacker to attack let's say one party or i actually can even work for a network attacker but let's assume that an attacker attacks one party now this attacker would send the right shells to some of the other parties and an incorrect secretary to other parties now there is a mechanism for each party this is because we are need to protect against militias and so there are mechanisms for each party to check each message that it received and to verify that it received the right message so this is all good and fine but what

happens is that this attacker would send some good shares and some bad shares now the ones that receive the bachelors would detect it and they bought the protocol meaning that they would keep their old signature the ones that received the good shares would continue the protocol eventually overwriting their existing signatures so you end up with two groups of secretaries that are not compatible with one another because one done a deletion which is irreversible the other one has not done a deletion right so two uh observations here is that one it's really easy to fix so you need to add another round of communication which is obviously what the implementer wanted to

avoid and in this sound of communication you do need to kind of say so which pattern is to say so i got everything right i got everything on and based on it they had to consensus of what they should do another thing is that a smart attacker that goes undetected doing it once can keep doing it eventually getting to some kind of an extraordinary extortion situation if it involves money so it can get to a point where you don't have in your end parties group enough secret chance to reconstruct a full key only if you use one of the secrets or a secret that the attacker knows so it kind of deteriorates the attacks attack back to a single signer or something like this and then the attacker can say okay you want my secret chance only if you sign a transaction

that gives me half of the amount locked in this account or something like this so if you look broadly at you know when you as you put it threshold dies various schemes is there a class of problem or a class of attack that seems to pop up or is it you know bugs as in any crypto software or is it actually like no these things we need to be aware of these things are new new things that pop up that come as a result of that so i think that at some point it would be possible to classify those type of attacks right now all those systems are very new and the process is uh very manual so you know that i mean what happens when you threshold by the

scheme is that you take out all the big guns in cryptography so immediately it means that you need to again move to some kind of distributed system and and also you introduce commitments and zero knowledge and morphic encryption and whatever like you just saw it all in and out of this there is a lot of pitfalls that might happen so i mean there are known like issues that you can you can start look for so one of i mean the recent blog post i published was about an issue i i found in several libraries that are doing threshold signatures but but different than dsa or 25519 and then you you have some dependency in the elliptical so you need

to work in a specific suburb of the elliptical but what's interesting is that when you combine these two things one is communication and second is walking in the prime or the subgroup of the elliptical there's all sorts of issues like each message that you receive you now need to also check something about the elliptical point that you receive for example and these checks uh sometimes we notice those like they are missing and then there are sorts of implications on what you can do and apparently these checks are also should be part of when you do some basic sigma like zero knowledge protocol proofs as part of the npc and so on so i guess there are

ways that you can uh cluster those but uh right now i mean the process for my point of view is very manual another thing that i thought about as you put it here you pull out all the guns to sort of uh threshold dice something but i wanted to take us a step back even before that which is you talked earlier about bitcoin and having threshold signatures there which you know could lead to multi-cigs or or whatever that doesn't require bitcoin script and and all sorts of things and now we're moving into schnoor and we need better efficiency there etc but what drives all of these things what drives these changes what drives having threshold signatures at all so like what are the use cases or why why

do we want these things at some level i imagine there's there's many different answers for different fields but if we look at bitcoin for instance what's the the prime motivating factor you know you earlier you said for the wallets like having a social recovery scheme is obviously a big thing but it feels like there's a lot of research that goes into this it has to be more than a social recovery scheme uh yes yes so i it really depends on uh it's a great question and uh there are all sorts of applications for for threshold cryptography and if you want to do the course between threshold cryptography and blockchain you can think about several

like killer applications so one is indeed this new model which is on the one in non-custodial but still gives you this kind of ways to avoid single point of failure okay so this is for example one thing that we using in our wallet and this was like our uh design principle was avoid single point of failure and once you go into this realm of so you don't have a private key anymore so it means that the attacker must be at let's say two locations at the same time to get the full to reconstruct the full private key but once you go into this realm of having the key

distributed and never reconstructed so you can think of all sorts of stuff to build on top of it so you can basically do a lot of what you natively would have done in a blockchain either in a smart contract um or in some in script in bitcoin you can do it off-chain and then your your footprint on the blockchain would be minimal so one example is is the work we've done a couple of years ago about atomic swaps but instead of doing it using transactions on chain what i'm doing is that i'm switching signatures between different parties so if i can distribute one secret and i can distribute another secret now i can uh trade in my signatures and we we came up with this gradual release

method that allows you to let's say switch or replace trade bit by bit until you get to a point where one party learns the secret to open another party while the other party learns this party secret shell eventually you get to a point where one party con controls the full control of some key that the other party now lost control of let's say you also do only sharing so without going too much deals you can build all sorts of applications around this when we have this ecosystem of not single key but distributed single key there are other applications in in the field ones that are worth mentioning that are getting traction so one is the proof of stake validation so let's say that you have a blockchain and

like you want some consensus and you can run it with a 1000 validators but it's not much like an attacker would control most of them so the network will go down so what you can do you can distribute each validator into another 1000 signers or cosigners such that they need to cooperate together so you get this fact of increasing security when you do this uh there are all the existing libraries and actually um polychain for example labs are doing it already so it's it's also getting traction uh and and it goes on and on like for example one work that we are now doing is about taking the the watchtower concept of lightning network and

showing when you look at it from a key management perspective how you can extend it into uh and watch towers that are connected between them in certain way that gives you some security benefits yeah i hadn't heard about that the key trading thing that that's also fascinating i do generally like the non-custodial but giving custodial levels of a user experience to be an inching problem space that requires a lot of this is there any connection this is sort of a side thing but is is threshold cryptography and vdfs related uh no not really i mean there is one connection which is a project we worked

with uh with ethereum it started the beacon chain and beacon chain to make the randomness unbiased you need vdf and to make a vdf based on rsa groups you need to generate an lsa group that no one knows the secret key to so to do it you use a threshold cryptography so we kill you founded uh a very nice project that uh we reviewed i'm going to present this process in real-world crypto that is doing a massive mpc for rsa keys okay then you can get the public lsa key without the secret key and then you can use it in video and then you can use it uh in the bitcoin chain so it's a lower it's a at a different step

in this process it's not deep in our vdf it's rather before it's the prep for the vdf uh i mean there are ways to do uh probably threshold pdf but i don't think it was researched so far okay but this would be another cryptographic primitive that you can threshold interesting going back to frederick's earlier question of like why you need this or like how it actually is the perfect solution for certain things do you have any other examples of that so uh the public isn't such thing as a perfect solution everything is uh composed of trade-offs but i mean we know that

it's very popular with exchanges they are i mean the largest exchanges today crypto exchanges are using it so think about this kind of model where you have like the exchange generate a single key and this is like the master key but now the exchange um is using some kind of a two-party scheme where one party belongs to one group of signers from the exchange and the other signer is can be one of another group from the exchange right so let's say that in order to to enable to confirm a transaction from some cold wallet to hot wallet in the exchange

you need to have the agreement or the consent of two groups and you need to have one out of each so this is i think a common case that you see in exchanges like you said uh you need for from certain amount you need uh one exact form exactly from this group and one operator from this group something like this and then you can go on and on with the access structure so it's really convenient to define this type of ielts is an access structure that allows you to have more control over how you confirm cryptographically like it's not going to be just an api yes no you actually need to uh confirm tutorial which makes it much more secure way to enable this kind of confirmations i

know it's starting to pop up like on on the same similar venus exchanges starting to pop up with validators as you said as well where a validator doesn't want to run everything on one machine if that machine gets compromised and the the key is stolen they can get double signed or whatever you know there's various ways to exploit that or attack people so these are spreading it out on multiple machines or multiple people that need to to do stuff to or take action to break the system yeah some of the work that you basically shared with us in prep for this episode where it was about crypto wills can you tell us a little bit about that work and how that actually relates to threshold cryptography if that's the

right solution for it yes so i would first start with a higher level presentation without even like diving into the problem of of how to do a crypto wheel which basically means that like i mean the issue i think is is uh self-explanatory but in crypto you do need to have some relative or someone you want to have someone that would be able to take in a non-custodial way of course your funds after something happens to you so but before going into this just i i think it belongs to uh this is the connection to threshold photography to bother a range of questions around whether i should use what applications

or what problems should be answered with or should be solved with racial cryptography so there are a lot of protocols that we want to imagine are happening between two sides and those protocols can be mostly easily solved if you say so let's say okay i don't want to trust any one entity in the world but let's say that i can allow myself to trust that i'm adding this something in the middle let's say server but this server is distributed in the sense that everything is doing it's doing is is threshold crypto so it means that uh i can rely on the fact that out of this n servers at least p plus one would be able to uh to help me with any operation i want so this is

another like another example of a problem like this is the uh stealth others this is a problem that raised by metallic that we picked up uh and tried to solve uh with his help or now i mean let me give you the concrete example let's say edward snowden uh opens an account and film account and publishes his address and says look i'm looking for donations now you want to donate to adwords know then but you don't want it to get back to you that you know what uh a transaction change showing that you actually send money to snowden so you need to find a way to send the money without having this on chain footprint that shows that you sent to these others so this is still others issue and with crypto is i find some i find it a bit parallel that again

there's let's say a lot going into the terminology that we introduced in the paper but let's say you have a sender and a receiver and the sender should send something to the receiver conditioned on several conditions one of them is something should happen only in the future another thing is that the digital footprint should be non-existence or something or some conditions on it uh before the the funds can actually be collected by by the receiver now in both problems if you introduce this threshold assumption and and structure then you can solve them relatively easy one goal of these papers is to put the solution out there and say like this is let's say the the ground tools okay we know that we

can do it let's formalize it whatever it's possible for those that uh it works for them it's it's great however it gets much more interesting when you start to remove this men in the middle so in the crypto wheel paper what we i think one of the interesting solutions that we try to show is that let's say i'm removing this man in the middle uh or this threshold assumption with multiple servers by uh trusted execution uh environment like sgx or even specifically intel sgx so when you put sgx in the middle we didn't want to count on the fact that the sjx knows the time and we didn't want to to count on the fact that sgx is confidential so so it makes the the problem much more

interesting so there's a spectrum of solutions that you can try to uh forward the problem before you go into the full case of completely just two parties like it's a two-party protocol that now needs to be solved uh in a very expensive way i mean it's a fascinating question and topic the crypto wills what happens to people's i mean in the most maybe basic ways like say someone passes away or doesn't have you know they're or they're trying to bequeath their crypto to somebody else how do they ensure that that is done and that the certain kind of rules are followed so for example like maybe they don't want to reveal what's in there before they pass away or they don't want to reveal who else is being bequeathed or something like

that i mean it's it's it sounds like such a huge problem but what you're saying is you found kind of like a subset of tools that you could potentially use to solve for this yes i mean the research uh structured as follows so you have the trivial solution which is inefficient or requires you to trust someone you have the more complex solution that requires you to have this structure of servers but then you also need to have this kind of assumptions and then we go all the way uh up to the point where you can do it just with the two parties that are involved and yes like you said the conditions of the problem are dictated to you like you know that

it should have privacy like you cannot reveal that because before you actually die or you you need to reveal it only to the right person at the right time so you have this open all the conditions and then you just try to to find this toolset that can help you solve it under certain conditions and eventually what i hope is that people would take this paper and and would find the solution that fits them best and and would use this or build on top of it because there are a lot of future questions because like you said it's a huge topic yeah it's an interesting like philosophical uh and technical problem like combined where the easy solution is you just trust your lawyer and and you're done with it but then you can go further and further but i mean at

the the last point then as i think get through last point of needing real world data is how do you detect when someone dies and like trigger the scheme yeah it's it's uh so this is you first need to assume something about uh the liveness of the whatever entity it is so the way that we uh decide to define it is by having this kind of digital footprint so it can be defined in several ways but eventually you need to predefine like or to have some contract with yourself on what services are you planning to be active on and at what cadence so it can be a blockchain it can also be i

don't know login to facebook or to twitter whatever and if you are inactive in in those services for some time then uh your will supposed to be uh accessible so this is like a condition but we definitely keep this as an open question because there's probably it's it's uh oracle issues it's uh it's a big issue also it changes so much over time like you know once upon a time i had a myspace account that i actually visited a lot but i would hate to have my daily activity of that be in any way reference actually my facebook for that matter but that's that's such a it's sort of like trying to make your digital life be your life like if you're active

in some digital way then you're alive yeah it's probably the simplest way probably but uh yeah i mean the paper raises many questions this is one of the major ones how exactly and i know you started to explain it before but where exactly is the threshold cryptography in that construction that you kind of came up with or in one of the constructions like where does it live exactly it's it's you need to have it out of the blue and it raises others uh questions like how can you deploy threshold structure so how can you actually do it in a way like in real world in production in a way that would maintain this threshold assumption of separating completely the accordion end servers so i just assume that you have in the sky

for the sake of solving the problem and just assume that you have in the sky uh you are given from god uh and servers they are completely separated they they can act maliciously but but you assume that they cannot collude all of them like up to a certain pressure they can pollute and uh you have a protocol that you need to design improve secure uh that allows you to solve the problem using this structure but it's really a hard problem in real life like how can you actually you need to have separate softwares uh in different languages and uh it should be like you cannot have an admin that like goes from one machine to machine and put because this admin is a single point of failure so you invoke the assumption or you cannot have your ceo have access to everything so

you have to to find ways to actually do it and it's funny because i think most of the industry are not actually solving this like deployment issues so we're almost out of time and it's time to to start wrapping up but before we leave you i i would like to hear more about the mpc alliance because this is something that you're involved with together with a bunch of other companies and sounds like an interesting endeavor but what is it really uh okay so thank you for bringing this up npc alliance it's a non-profit organization based in delaware that puts as a goal to push forward mpc adoption

to market education so in the mpc alliance we have i think now around 40 members 40 companies that are different size and shape so it might might be competitors it might be large organizations alibaba for example might be smaller ones startups like like my own and we are all working together and we have our network try to come up with both technical contributions and marketing contributions to the success of of mpc technology so for example in the technical aspect i can say that we have in wikipedia so this is kind of a community project wikipedia for npc uh which is starting to gain traction

like people start to add articles and so on uh but but it's ongoing for quite some time this is something it was never done before we also put a lot of effort into standardization aspects of mpc and from the marketing aspect so we host webinars we participate in webinars in events by companies and we will start the podcast soon and our blog posts and and on and on and on and uh yeah that's that's it i co-founded it together with the other two companies unbound tech which nigel is the co-founder of and another co-founder is the linda which is my supervisor at the university and also with cpo which is a company

based in denmark california and uh three of us founded it and now we are together we've done on cybernetica we sit in the boards but it's yeah it just it started just a year ago so just a very earlier it's cool and it's great to hear that you're going to be creating more and more resources for people to engage with mpc work will there be sort of specific threshold cryptography within that or would you just lump that together like do you think you're going to have to create subgroups as it evolves within the pcls yeah yeah so the mpo okay so there are i would say two large use cases for a big use case for npc nowadays

one is around security which focuses on threshold cryptography and one is around privacy so privacy machine learning and so on this is like a huge use case run by many companies and there are uh it's divided i mean the alliance is like 50 50. so i know because i talked with all of the companies i have a good industry overview we have around 50 50 from also blockchain and non-blockchain companies since blockchain drives cryptography and the use cases in blockchain are usually around the key management and around security uh so we already have this kind of subcommittees that are focused on the different applications and pushes them in their own domains and industries cool so omar

thank you so much for coming on the show and sharing all of this work we're going to add a number of links in the show notes for anyone who wants to follow along and uh yeah where can where can people find you or engage with these groups uh it's free it's easy to find so xengo.com yeah it's uh everything you need to know about the wallet there's uh a page about xengoix that connects to both the github and the telegram group and from the telegram group you can hope to any other one of the smaller rooms on telegram and you can ping me on telegram as well on twitter well thanks a lot omer then thank you thank you very much yeah pleasure and to our listeners thanks for listening thanks for listening