I'm going to talk about the new breakthroughs that are happening in cryptography, the opening
doors to unexplored spaces.
I will try to speak louder.
The free software movement and Linux at one time had power, it had vitality but then somewhere
along the way we started to play catch up, we started to try and follow the competition.
This on the desktop never happened.
The once great browser Firefox, its market share dwindled to zero.
Even this conference which has the best minds in free software community is funded by surveillance
capitalism, Google, Microsoft.
In this talk I want to talk about how we can escape the death trap and create the new paradigm
of computing.
This
talk is dedicated to Peter Hintzians.
Peter Hintzians was from Brussels and he was a programmer who, he wasn't born in Brussels
but he lived and he died in Brussels and he really embodied the ideas of what elegant
abstraction means.
Abstraction is something which Don Pauli creates complexity, Don Well empowers the software
developer but he was not just a good developer who made, for example, zero MQ which is really
interesting conceptualization about how we could build distributed systems but he was
also a theorist on creating free software, the social layer and creating free software
communities.
He taught us that free software is more than just having the code being accessible but
it's an entire philosophy and when we create the good, elegant abstractions, it enables
us to create software that's composable while not contributing complexity.
This is like the basis of how the Linux architecture is created, there's components and rather
than like in a Windows system where there's a system 32 filled with hundreds of DLLs,
there is a component which people can modify and in our projects we try to embody his ideals,
we try to carry his philosophy.
So everything that we use today, the concept of the sockets, the processes, the file system
was invented in the 70s with Unix.
Since then, nothing has fundamentally changed about computing and when they created Unix,
their vision was something that would enable deep collaboration between communities and
the infrastructure that they created, the software, ended up becoming the basis of the
web but they, at the time, they couldn't take their vision to its full conclusion.
They didn't have the algorithms that we have now like around peer to peer and consensus
and cryptography and so on.
There wasn't huge network bandwidths, the resources in the hardware weren't as big.
And since its invention, not much has changed.
What is a zero knowledge proof?
If I have a simple function and I call the function on a set of parameters or arguments
and I produce a result, the return value of the function, if I want to show to you that
this value that I've computed from the function is computed from some parameters that went
into the function, then normally the way that you do that, like logically, is I would have
to give you those input parameters and you have the function and you would compute the
function yourself and get that result at the end and then be able to verify that the result
is what it claims it is.
For example, in a Bitcoin blockchain, you're doing transactions and everybody verifies
the transactions that the computation is to advance the state machine to the next state
is correctly done.
Then there are two very interesting properties of ZK proof.
So first, the ZK proof is succinct.
What that means is the actual proof object that proves the computation that has been
run on the values is very small.
It's smaller than the input parameters that go into the function.
You would expect that it would be some big proof, but actually, we save computation.
When you want to verify that, you save computation compared to if you would compute the evaluation
of the input values, what we call the witnesses yourself.
The proof size is small and the time to verify the proof is very small compared to actually
computing it and it can be anonymous.
So there are some values that you put into a function to get a result.
You don't know what S, X, and Y are.
You know Z, you know Foo, but you don't know S, X, and Y and that enable us, they give
us a very powerful technique in our arsenal, in our toolkit of anonymous engineering.
So this is the general schema of ZK proofing.
So you have a proof function.
So that means that's how we generate a ZK proof.
So you have some private values, the input values to your function Foo, and you have
the output of the function, which are your public values, and you create a proof.
And then I give to you the proof, and you want to verify the proof, and you have the
public values from the evaluation of that function, and you get true or false back.
So how does it work?
This is obviously greatly simplified, but just observe this property.
If I have polynomials, and I add two polynomials, and then I evaluate the polynomial, that is
the same as evaluating the polynomials and adding them together.
This is due to what is called mathematically the homomorphic property of the function that
maps from the ring of the polynomials to the ring of the closure.
And it works as well for multiplication.
So just remember that homomorphic property, and then what we do is that function Foo,
we do this step called erythmetization.
So any code that you write, we turn that code into a set of polynomials.
So how do we do that?
Well, here imagine A and B are Boolean values, either 1 or 0.
So how can we turn those into arithmetic expressions?
So if you notice with those formulas in the top left, and these tables on the right, if
you do the calculation, you will get the same thing as long as A and B are 0 or 1.
When you perform those formulas, they are the equivalent to those Boolean expressions.
And if you want to enforce, just as a side note, that a value s is in a certain range
of values, for example, 0 or 1, well, it's just the same as saying s minus 0 multiplied
by s minus 1 is equal to 0, which is the roots of the polynomial where it would evaluate
to 0.
That will be a degree to polynomial, and there will be no other roots of 0 there.
And so we have that function foo, which, if you remember, where was it?
It was here, this one.
If s return x times y, else return x plus y.
And how do we arithmeticize that?
Well, you can see below that we have z is equal to sxy plus open bracket 1 minus s x
plus y.
Both of those are equivalent.
So we've taken piece of code, we've arithmeticized it as a mathematical expression.
So then we can use this Schwartz-Zippel lemma, which is rather than having to give you all
of these huge degree polynomials, depending on the number of equations that you're checking.
There is something that we can do where we can just evaluate a polynomial at one point.
That relies on the Schwartz-Zippel lemma.
So let's pretend that we have two polynomials that we're trying to check a multiplication
of.
If you remember in the first slide, we had fg evaluated alpha is equal to f of alpha
multiplied by g of alpha.
So these polynomials, if you notice, they're constructed so that they intersect through
a certain number of points here.
So the red one goes through 1, x equals 0, the red one goes through 1, x equals 1, the
red one goes through 2, x equals 2, goes through minus 1, x equals 3, goes through 1, etc.,
2, 3, 2.
So that's a Lagrange interpolation of those points.
And the yellow one, likewise, does the same, but for 0, 2, 2, 0, 2, 1, 3.
So you can imagine those are the lines of our kind of proof or program that we're trying
to enforce.
So the first one might be that we want to check that 0 times 1 is equal to 0, and 2 times
2 is equal to 4, and 2 times minus 1 is equal to minus 2.
So how do we construct that proof?
Well, if we multiply the points together, like so, we get a new set of points.
And then, because these polynomials are degree 6, to create the polynomial that comes from
multiplying these two polynomials, we need 12 points, which are multiplied from both
of these, but I've only done six here.
So then we have these points, and we interpolate, we draw a polynomial interpolating those.
So this is the new polynomial we get, the pink one.
And if you remember this relation from earlier, we now have this polynomial FG, and therefore,
if there is a protocol where a random point or a random X value is selected, then it's
sufficient to prove that there is this evaluation at this combined polynomial FG of alpha is
equal to evaluations of the other two polynomials multiplied together.
And therefore, you can be sure that that pink one is the multiplication of all the individual
points, because the random point and the probability of you being able to preempt that is basically
nearly zero.
And so we can actually see here, if we look at any two points, the top two is the red
and the yellow one, and the white one is actually the multiplication of the two points, and
the purple one is the purple one.
So we've actually created the polynomial which have this property at all points along it.
And because it has this property, it's sufficient just to pick a random point and check that
that's true.
And there is another puzzle piece which is the polynomial commitment proof.
So essentially, you can create a commitment of a polynomial which is like hashing a polynomial,
and you don't know what the polynomial is, so this is where the zero knowledge property
come from, and then there's an object representing a polynomial in your system, and any time
you can create a proof using the polynomial which has this statement on the right, which
says that the f is a commitment or hash of this polynomial f, and z is equal to an evaluation
of f at s.
And so that's what that open does is it creates this proof on the right, and then I can give
you this proof, and I can give you the commitment to the polynomial, which is just a hash of
the polynomial essentially, and you can verify that whatever polynomial is inside of f is
equal, is the z is equal to f, or evaluator s, and the same principle is true for addition.
So we have multiplication and we have addition, which means we can construct any NP-complete
program inside of zk proof.
Also, another technique is multi-party computation.
So in NPC, so with a zero knowledge proof, I can compute a value, I can prove a statement
about some values that I hold, but maybe sometimes we need to compute, or other people need to
be able to know certain facts about other actors in the system, and maybe they don't
have the incentive to create a zk proof or to prove statements about values that they
hold.
So that's where we use another technique that's called MPC, and I will show you how we can
do addition of values with MPC.
So Alice has some number, some secret number, 110, and Alice and Bob has some other number,
1177, and Alice now splits her number randomly, such that those numbers add up to 110.
So if you add them up, it would be 110, and then sends them to each other's servers.
So none of the servers know what Alice's number is, but they know parts of it.
They can reconstruct it if they collude, but we're assuming they don't collude, and then
Bob does the same thing, he sends his numbers, and now when we want to compute an addition
of the values, each of the server will add the values together, and now they get these
new values.
And if you look, those values added together when they reconstruct it is the answer of adding
the two private values together, and multiplication is similar, but slightly more involved, but
also it's possible.
So MPC is another powerful technique.
Also we have homomorphic encryption, so very simple partial homomorphic encryption is simply
this function, which is elliptic curve multiplication.
So if I have two values, and I add them together, and I multiply them by the generator of an
elliptic curve, or just some point on the elliptic curve, that is the same as taking
the value multiplying it by g, and then adding it to the other value multiplied by g.
So homomorphic encryption, the original idea in the 80s was there's a cloud, and anybody
can put values into this cloud, but they're encrypted, and then other people can compute
answers encrypted for a certain public key.
So you can use this to make computations on secret values.
From an abstract level, there is this new emerging field of anonymous engineering, so
we can compare it to other forms of engineering, so for example when we have software, we write
these instructions that run on a CPU and execute, and when we do cryptography we try to use
deep mathematical laws to try and create primitives or schemas, but the anonymous engineering is
actually using those different techniques like the ones I just showed, or other ones
like VDF or hash function, public key, asymmetric crypto, et cetera, to try and come up with
schemas that enable certain forms of applications with invariance to hold.
So let's give the first practical example, which is I have a set, I have a set of values,
and this set is just represented by a single hash, and I want to prove that my value is
in this set of objects, so to do that we have to construct something called a Merkel tree,
so let's say we have eight values, and what we do is we take two values at a time, so
we take the first two values and we hash them together, so we get hash of them, and let's
represent that by A, and now let's hash the next two values, we get another node B, and
then we hash them together and we get another node, so we get this kind of tree which the
root R represents the entire set of values, and this is a simplified diagram, normally
these might be 32 layers, so two to the power of 32 values will be in the tree, so for example
we had V1 and V2, and we hash them together and we get A, and likewise we have V1, V3
and V4, we hash them together and we get B, and then we hash those together and we get
AB, and then we do the same, we do the same on the right hand side and eventually we get
to R, now if I have some value, any value, let's say, I don't know, V5, and let's say
we also have R, how can I prove to you that I have, that V5 is in R, well what I need
is a pathway to be able to get to R, so what does that pathway mean, so for example if
I give you V6, then we can hash those together and we get C, and then if I give you D and
we hash those together, then we get CD, and then if I give you AB and we hash that with
CD, then we get R, and then I've proved to you that V5 is in R, using, instead of needing
to give you all of the items, I just give you a logarithmic number of items, I give
you a smaller number of items, so it's faster, it's used as a technique, but it can also
be used to create an anonymous inclusion proof, so we can anonymously prove that there is
some value in R, and we can even encrypt that value, or we can prove other statements on
that value, so I'll show you some code, how that looks like, maybe I can put this mic
somehow, like this, yeah that would be great, I need to speed up, but here is the proof,
you see the Merkel route at the top, we're saying, and there's a pathway, we're proving
some values in the route, and then we're re-encrypting the value, and we're exporting it, and, yeah
hold it, yeah, and to compile it, and then I compile the proof, like this, so it's compiled,
and then I have, sorry it's here, I have the code which actually computes the Merkel tree
with the value, but then also you see, includes the ZK proof code, and then creates the witnesses,
and where is it, and then loads the circuit, and then creates, constructs the proof here,
so now we get a proof, and then for the verifier we do here, we verify the proof, so we can
just run that, like so, ah, okay, no internet, but anyway, let's not worry about that, okay,
so then we can use that to create anonymous voting, so how do we do that, well, we say
on the, we create, when we create, constructs the people who are going to vote, we create
something like a coin, and there's like a, you generate a random serial number, that's
private, and you just create this commitment to it, and then when you want to use up your
vote, then you burn the coin, and you make that public, that secret value S, which means
you can't ever generate the same thing again, because that value is deterministic, and then
you just, you prove that there is a C, that's the hash of S, and that C is in the tree, using
the previous inclusion proof, and so how do we change that to do anonymous payments, well,
it's very similar, except now this coin, not just being a hash of S, is also a hash of
value for the coin, so it's two and four, which are owned by Alice, and then when we
want to spend that coin that Alice has, then we reveal those serial numbers, and we can
compute the partial homomorphic encryption of the two and the four, and we create this
transaction with two outputs, and we create the two new coins, like we showed before in
the previous slide, but we also want to prove that the value that goes into a transaction
is the same as the value that goes out, and we do that using homomorphic encryption, like
we showed earlier, and you see here, we've got the two plus the four is equal to the
three plus the three, so there we go, then we can do atomic swaps with different types
of assets, so Alice constructs her input and one output sending to Bob, Bob takes the transaction,
adds his input and one output sending to Alice, Bob also signs the transaction, Bob signs
and sends the finalised transaction, we can also do something where you have a network
with anonymous spam protection, so you have a sharing scheme, and normally, so basically
with this, you have this evaluation, I'm going to go fast now, and when you want to send
a message you compute the message M, you compute this X and Y, and if in one epoch, you again
create another message, so you're spamming the network, then you get these values, which
using the equation on the first line, you can compute what A0 is, and A0 is actually
your secret key, and so then that means that whenever you try to send another message to
the network in any other epoch, now you've lost your account, you can never send, but
it also means that messages are unlinkable, so you have unlinkability, we can do anonymous
auctions using MPC, so Alice has bids $4, Bob bids $6, they do a computation, they compute
who's the winner, we can do anonymous WikiLeaks, so I have this thing.jpeg, and then there's
a protocol where, you know, I've said that this is, I've made some claim about what this
file is, and it selects a random chunk from the file, and then we verify, yep, that file
is what it claims it is, and then there's an auction on the remaining chunks, and the
winners of those auctions decrypt the remaining parts, and then the file is decrypted, so
if you go to doc.fi website, and you go to the docs section, we have, where is it?
So go to the website, and there's also a blog called Insights, we have our own peer-to-peer
anonymous chat, there's no concept of identities, so if you go to the doc, there's a section
called IRCD, and we have a weekly meeting every Monday, but also there's a crypto section,
ZCAS section, testnet guide, you know, we're looking for good devs as well, so, conclusion,
so, we missed the mobile and the desktop, will we also miss the crypto renaissance, this
is like our best chance to capture value for development, like, this is the biggest problem
with creative people, is they create value, they don't necessarily have a way to capture
some of that value back, we now have techniques to do that, we were promised this future of
computing in the 90s, you know, the interface is, whatever happened to that, never got it,
and now, our phones, they're filled with all these dog shit, electron apps, like, that's
a failed paradigm, we're literally trying to copy Silicon Valley, I'm optimistic that
now people are actually going, actually, no, Linux is different, we're distinct, we have
our own energy, but we need to rediscover that, we need to create something that's new, because
their model is about capturing users under surveillance capitalism, to extract value
from them, our model is we create infrastructure, we create economic value for our networks
to become strong, and as a movement grow powerful, it's a different way of thinking, open source
was a mistake, you know, like, we discarded the beating heart of what gave us energy,
so we need to conceptualize the computing paradigm, so, you know, let's build something
new, like, actually inventive, so if I have a couple of minutes, I'm actually just going
to show our website, so I can show where to find docs, okay, I guess there's no, no,
I'm not there, come on to it, go into it.
All right, let's give a tour of how docsos, so here, there's book, I talked about peer-to-peer
distributed IRCD, you see there, instructions.
There's also crypto section.
You see here.
And also implementations.
There's a ZK explainer and also implementations
of most of the major ZK algos.
And also, probably more interesting for you guys,
the ZCAS stuff, like how anonymous voting works
and also anonymous payments.
All right, I just showed the distributed chat.
You just run a daemon like that.
Open my WeChat, bam, here we are.
There's encrypted channels as well.
You just set in your config file an encrypted channel
and then we have a chat.
See I can chat with other people.
So, yep, that's it.
That's my talk.
Thanks very much.
Thank you.