Modern Cryptography: Hype vs Hope | LISA16

[00:00:10]All right. So, um, yeah, I sort of get frustrated with kind of misinformation out there. So, this is intended to kind of de demystify a lot of things that you read about. Um, so with only 45 minutes, I have to go extremely quickly and certainly skip details of the math and certainly no security proofs. Um, but there's all these things that if you try to learn from the literature, the papers are incomprehensible. So they're so full of notation and uh security proofs and so forth. So I'm going to explain what problem is being solved, an intuition into how to solve it and whether it's actually practical enough to care about it. So um um I gave a much longer version of this to colleagues and let them choose the topics. So um you can blame them um if you don't like which topics are here. So I'm going to cover the ones in red and the ones in black were less popular with my test audience.

[00:01:09]So um oh and this also right okay so had um well you'll see sharing a secret. So I like to talk about this. It's not like a brand new thing, but it is just so incredibly cool. And when people understand how it works, and it's like not hard to understand, then their eyes light up. So, I'm um including that for that reason. So, the problem is you want to make end backups of a secret S. Um, and you want to be able to retrieve S in case you forgot it, but you're afraid that some of the backups might get stolen and then people will find out what S is. So what you're going to do is break a secret into shares. Uh you're going to store it in n places such that retrieval of at least k is required to um figure out what s is and if you get fewer than k then um you know so if um only three of them get broken into and k is five then um s is not revealed. So the first um simplest thing is if you have n locations where the quorum is one, it only requires one to do it.

[00:02:14]That's very simple. You just store the secret in each of n locations.

[00:02:20]If you want to make the quorum be n such that you have to be able to retrieve it from all n locations, then it's very easy. Again, you put random numbers in n minus one of them and then you take the secret exclusive word with all of those random numbers in the last one. But what about if k is between 1 and n? So what you do is you choose a line and if you have a line um where um the secret is where it crosses the uh y ais then um um any two points will reveal the line and any one point gives you no information at all. So uh you do this by choosing a random number b and the equation of the line is y = b * x + um s. So s is the value of the line at x=0.

[00:03:13]So um here you have a line you can give as many points on the line as you want and um um once you know two of the points you know where it crosses the y-axis and so uh the shares you give to people are the x value and the y-value at various places on the line. So um what you store is I comma Y subi in the first location, J comma um Y subj in the second location and so forth. And so um what if 2 is less than K is less than N.

[00:03:48]And so what you need to do is create an equation of order K minus one. So um given any K points, the equation can be solved and Sbound. And so the math is you choose k minus one random numbers b1 through b uh k minus one. The graph is going to be y equals s the secret plus the first random number time x the second random number* x^2 and so forth.

[00:04:13]Um now real numbers are kind of annoying um with computers and all that um and even integers are kind of annoying because they can get kind of an unbounded size. So in general in these sorts of things you do arithmetic mod sum prime p uh which will be greater than the secret and a share is an xy pair where x and y are integers mod p and um you don't even have to give people an x share because you could say you're my friend number seven. So um I'll give you the value of um um of y at x= 7. So, um, this is not only mathematically cool, but it's very useful and practical. Okay, the next one I'm including just because it's just so cute. Um, it's called Bit Commitment.

[00:05:04]So, the problem to be solved is that Alice and Bob are getting a divorce. Um, this won't solve that, but uh the the problem is they can only talk over the phone. uh maybe because there's restraining orders or something and they have to decide who gets to keep the house. So, they're going to flip a coin and whoever uh wins the coin uh toss will um get the house. So, there's sort of two obvious protocols. The first protocol is Alice flips the coin. Bob over the phone says, "I want heads or I want tails." And then Alice says, "You won the house or you lost the house.

[00:05:47]The second obvious protocol is Alice flips the coin. Um Bob is supposed to choose um heads or tails but not tell her and then she says whether it was heads or tails and he says whether or not he got the house. So obviously neither of these works because one or the other can uh cheat. So um we're going to use cryptographic hashes. Just to review it, it should be infeasible to find two numbers that hash to the same value. Um, and it should be infeasible to given a hash to find a number that hashes to that value. So the solution of our problem is that Bob chooses a random number R such that the bottom bit is a zero if he wants uh tails and one if he wants heads. He sends that hash across.

[00:06:36]Alice flips the coin, reveals whether it's heads or tails, and Bob now is stuck with he he's committed to heads or tails based on sending the hash because now he has to send the number that hash to that. Um, okay. So now I'm going to get into kind of the hairy um um uh crypto stuff that's impossible to understand, but hopefully I will give you the intuition into it. So there's this thing called a cir the circuit model which um is necessary for understanding the next two things I'll talk about which is secure multi-party computation and homamorphic encryption.

[00:07:14]So the circuit model says that any function of a s fixed size input and output can be built uh with a circuit with just two operations exclusive or and and or addition and multiplication.

[00:07:29]So um both of these um uh homorphic encryption and secure multi-party computation involve computation on data and what you the way you sort of come up with one of these schemes is you assume that whatever program you wanted to do on the data has been turned into a circuit and then all you have to do is figure out how to do these two operations and voila you've proven it works. Um so if you turn your program into a circuit it's a lot of overhead. Um um you have to expand the circuit for every single branch. Um so for instance, oh and you can't do infinite loops. So if you're looking for an item in a database, you can't do like binary search or something. You can't select one thing because you're working, as you'll see, on encrypted data. You have no idea which item it is. So your program has to actually go through every single item.

[00:08:30]Um so um um you know think about how inefficient this is. It's about a million times slower to do a circuit than a normal program. Not even talking about expanding all the loops and stuff.

[00:08:43]Plus whenever you might have done a branch you have to execute all possible branches. So um yeah anyway keeping that in mind um secure multi-party computation there's so many papers about this the problem they're solving is n participants each have an input and they want to uh compute a function of all of those inputs but each participant wants their own input to stay secret even though it's used in the computation and an example of this is an auction which is everyone has a bid but you don't want anyone else to see your bid and the function you want to compute is what is the winning bid. So um the obvious solution is have a trusted third party who receives all the inputs uh computes the answer and promises not to reveal any of the inputs. So um you know the highest bid was X and Joe you're committed to paying X. Um but cryptographers want to not depend on a trusted third party. So there's several proposed solutions all that are very expensive um and one is actually deployed in the yearly Danish sugarbeat auction.

[00:09:56]So um the outline of um you know one of the solutions is that each participant does secret sharing of its own input into n kshares where um um a kshare is you did a um um an um a degree k equation. So the quorum will be k + one.

[00:10:19]So um the shares of participant J's input um his input is I subJ and the shares are J1 J2 J3 and he gives one of these shares to each of the other participants. Um so each participant now knows N things which is a K share of each of the n inputs. So participant three will know I sub 1 3 I sub 23 and so forth. So um if k plus1 participants conspired they could calculate all of the inputs. So this isn't really encryption and in the sense that you would think. Um so the assumption is yeah that won't happen. Um so now you have to turn your program into a circuit with operations addition and multiplication.

[00:11:05]Um each participant operates on their own share of the inputs and at the end of the computation each participant will have a kshare of the answer. So the way you add two inputs, let's say that um if the program says to compute I5 plus I7, each participant adds its share of I5 to its share of I7, which results in sort of an equation where the answer is going to be the sum. So I mean this is incredibly cool and it just works um that you can just add the two things and your answer uh what that you get will be a share of the um other one. So if it were just this it would be like really cool. The problem is multiplying when you have two things um I5 uh times I7.

[00:11:54]Yes, you can multiply them together but now the equation the order isn't K, it's 2K. And if you ever sort of do enough multiplication so that it's greater than n, no one will be able to recover the answer. So um suppose there were a trusted third party. Um once you had these uh 2k shares and you want to reduce it down to kshares, everyone could give their 2k shares of i5* i7 and he could compute the um the answer redistributed as kshares and everything would be great.

[00:12:30]But if you had a trusted third party, why would be be fooling with any of this stuff? So um the if you notice kind of the computation that it has to do the third party um in order to create K shares out of two K shares is linear operations basically just additions. Um so these can be done in a distributed way on K shares of the 2K shares. So um but it's very very expensive both in terms of computation and network bandwidth because every time there's a uh multiplication that happens everyone has to kind of distribute things around do an expensive amount of computation and whatever. So my summary of secure multi-party computation of which there's like so many um uh papers written um is it's not a very important problem um and it's sufficiently expensive that it's impractical even though there's this use case that it's actually being used. Um given that there's not that many sugar beet farmers and um you know it only happens once a year they kind of don't mind that it takes hours and hours uh to do kind of a simple thing. Okay. So homorphic encryption.

[00:13:47]So the idea is you encrypt your data and you do operations on the encrypted data and the answer is the encrypted answer.

[00:13:56]Um so um this way it it sounds great. Um you can store your encrypted data in a public cloud that you don't really trust. Um and instead of downloading all of your data into a more trusted environment to do the computation, you can actually do the computation in the cloud. Um but um um and fully homorphic encryption says that any um program can be done on this encrypted data and the result will be the encrypted answer. You could download just this encrypted answer which is small and decrypt it locally and the cloud never sees your key. It sounds really great, but don't get too excited. It is completely impractical. So, um the encrypted data and the computations are about five or six decimal orders of magnitude less efficient than doing computation on the plain text. So, every bit of plain text turns into like a million um bits of cipher text. Um and they say, well, you know, we're making it more efficient, but more efficient is not enough more efficient that we should worry about it.

[00:15:02]Um, and then not only is the data much bigger, but converting your algorithm into a circuit is also mind-boggling as I talked about before. So what about partially homamorphic where there's only certain operations you can do and sure there are examples of that. So for instance, suppose you wanted to just be able to test for equality um of your encrypted things. So the way you do that is ordinarily when you're encrypting um you want to use um um an initialization vector to kind of throw randomness in so that the same plain text will have different cipher text. Uh but if you want to be able to test for equality just skip that step and so that the same plain text will always have the same cipher text. So sure you can do that but um um you know that will leak information obviously. Another cute thing you could do is order preserving encryption where you can actually test two things to see um which one's greater even though they're encrypted. And um that's kind of really cool. So the way to do that um is encrypt n items sorted from the smallest to the largest. So um you know just encrypt them with any old thing like AES or whatever and then you create let's say a uh 128 bit result but then you add to the high order part what number it was um in the in the sorting thing. So for instance 79 got encrypted to whatever is in the black there but you append a one because it was the smallest thing and then you append a two to the next one and so forth. Um, but this means that ahead of time you had to know which one was 1, two, three, four, and five. If you want to be able to insert things later on, then what you do is you um um just pick a number for the first thing that you encrypt. Hopefully kind of a medium number. And if the next thing is smaller than that, you you pick a different number. So here, you know, the upper thing was 373 5762 and so forth. So um now if you want to minimize information leakage um and let's say you only want authorized people to test for equality and you want other people to just not be able to test for equality.

[00:17:26]So what you do is you add an extra key and you encrypt everything after it's been encrypted for order preserving um and then um give the key to people authorized to test for that. So here you had this order preserving um encryption uh like I had on the previous slide and then you encrypt it with a key that people who are allowed to look at the order preserving can see and um but everyone else will just see completely encrypted stuff. So now back to fully homamorphic encryption. So remember the circuit model. So we have to be able to do multiplication and addition. Um and so we have to figure out a homamorphic scheme that can do both operations. So one homamorphic operation um is RSA. If you do RSA without padding and you take uh if the public key is an exponent e and a modulus n and the private key is the inverse exponent d modulus n then encryption of x is x to the e mod n. And if you want X Y, you take the encrypted version, which is X to the E * Y to the E, and it's actually X * Y to the E mod N, which is really cool, but that's only one operation. So for fully homorphic, all of the known schemes involve noisy numbers where um the encrypted number is kind of near to a legal value. Um but if you made the encrypted um version exactly a legal value, it wouldn't be secure. So you have to kind of add noise to it. But then the problem is every time you add two things with noise, the noise doubles when you multiply the noise. So if it gets noisy enough, it won't be clear which value which legal value it's closest to and it won't decrypt properly. So um there were schemes that allowed doing a few operations but then the noise would get too big. So the breakthrough was uh Craig Gentry said that actually what you could do is you can take your data that is the noise is getting to be a little bit too much. You could encrypt it and then homorphically decrypt it which is like mind-bogglingly expensive but it's proof that tada it is possible.

[00:19:48]Um, so there's lots of papers and it's absolutely impractical in terms of computation and data expansion I claim.

[00:19:56]So now I'm going to talk about blockchain which is so incredibly misunderstood. Um um so what is blockchain? It's a word when when it's actually two words, but yeah, there's this quote, when I use a word, it means just what I choose it to mean.

[00:20:19]And unfortunately, it is used for so many different things that it's very, very difficult to know what someone is talking about. So there's extreme confusion because people are using the term blockchain for lots of things just because there's so much hype around it.

[00:20:36]So if you um you know say that your thing is building on blockchain or it's a more efficient blockchain then you know you get venture capital and everyone's excited about it. So there's all sorts of hype um how articles about it whatever it is is being considered for all sorts of problems. Internet of Things um alternative to PKI for managing identities, real estate transactions and my favorite was um even the US military is looking at blockchain technology to secure our nuclear arsenal. So you know it's this is if once you understand the technology which hopefully you will in another 15 minutes it is so completely inappropriate for any of these problems. Um but anyway um so um um the the way that this blockchain as originally conceived it can only work because there's monetary um uh compensation to a community of things called miners. Otherwise why would anyone do this? So, Bitcoin uh started as a paper by presumably some pseudonym and released as open- source software and the community, the open source community agrees on modifications. So, the details might change. There's really no spec. It's just the code. Um and if there was a spec and anyone could make their own implementations of it, it would be a disaster as as I'll show. So, um it sort of requires all of the miners having identical code. Um so the design goal was they didn't want to trust any known institutions. So instead trust is given to a very large community of anonymous miners. Anyone can be a minor.

[00:22:24]You can download the software and start mining on your own machine or you can actually buy a hardware rig which is you know much much faster. Um and miners are rewarded based on doing a lot of computation. And so the assumption is that no the set of honest miners will be so huge and they'll have such an awesome amount of compute power that no set of dishonest miners will have more compute power than them. That's the entire trust assumption. But you know if you think about nation states and things like that there's no reason to believe that they couldn't swamp the compute power. So there's this public ledger where every transaction is recorded and world readable. So the payer and payee and a transaction are public keys. You're allowed to change your public key basically for every transaction just because you know that gives you maybe a bit of privacy. Um so public key X uh pays public key Y some amount. So, the format of the ledger is as a chain of blocks where a block has the hash of the previous block, um the miner's public key because if you're the one that gets that block, you want to get the Bitcoin.

[00:23:41]So, you um your public key, a bunch of transactions, and a nun, which is a random number. And um I'll explain what you need that for. So, the ledger says that from transaction, let's do the blue one. From transaction um um X15, A pays C a certain amount of um uh bitcoin. And so x-15 refers to the transaction that had the hash called x15.

[00:24:10]So um um the difference between the received quantity and the paid quantity because in the transaction with hash x15 um um a received 74.92 bitcoins but in trans in the uh transaction two down um a is paying only 74.21 and so the remainder is kind of transaction fee which is kind of a tip to the minor that uh gets this block. So they get the remaining uh bitcoins. Um and you can have multiple outputs. So um and a transaction you're required to spend the entire amount. Um and if you don't want to pay somebody the entire amount that you got, you can have multiple outputs. So you um from transaction X18 D pays E 25.11 bitcoins and F 830 bitcoins. And that is a way of paying yourself change um if you um you know if you don't want to spend the entire thing in one place. So it's not really anonymous. The entire world knows the sequence of public keys who paid who. Um the merchant is likely to know who they shipped the merchandise to. Um and there's other instances where who owns a public key might be own uh known. And if you mine the data of A pays B pays C, it can give you a lot of information. So a valid transaction suppose A pays B the output of a transaction with hash X. How do you know if that's valid? Cuz anyone could make up such a thing. So you have to the transaction has to be validly signed by the public key that is paying. Um, you also need to find the transaction that had the hash x um in which a was paid that amount. You know, are they allowed to spend this? And then you have to search all the transactions in between to make sure that they haven't paid somebody else before they paid you. And um yeah, um there's no central authority. If there were a central authority, having a ledger that everyone agrees on would be kind of trivial. Um but Bitcoin wants to be completely distributed with no pre-ordained trusted things. So where do bitcoins come from and how is the ledger agreed upon?

[00:26:32]So um um a block is um is a set of new valid transactions um that um such that the block has a cryptographic hash that's very very very hard to compute. So, um, Bitcoin tries to make sure that a new block will be found about every 10 minutes. If, um, it's found kind of too, uh, soon, more than every 10 minutes, they make the hash harder to compute. And if it's too hard, the hash is less hard to compute.

[00:27:11]So, um, the hash difficulty is adjusted so that there'll be a block about every 10 minutes. So remember a good hash is like a random number. So if you give it input there's a 50% probability if the top bit will be a zero or a one. Um the probability that the top 10 bits will be zero for random input is 1 over 2 to the 10th. So currently the hash has to have 70 leading zeros. So that's like you have to try um if you want to create a block you have to try with like 2 to the 70 different random numbers until you get one that just happens to have a hash with all those leading zeros. So um you insert a bunch of valid uh pending transactions. You choose a random number for the nons. You compute the hash. If the hash doesn't have 70 leading zeros, which with probability one over two to the 70 it won't, then you have to choose a different random number. Um, so if you're the lucky enough to be the first to find a block with a small enough um hash value, you get rewarded with some number of bitcoins. So um um um currently the amount of bitcoins you get is 12 and a half for that block plus whatever transaction fees there are. So what's the purpose of all these hashing?

[00:28:32]Um you know anyone can be a minor. So the entire trust model is saying well you know the probability that any set of bad guys can get together and have enough compute power um you know we'll just have enough honest miners and um and we don't have to worry about that.

[00:28:50]So um um suppose the set of miners did have most of the compute u power. They could undo transactions and create an alternate history. they can double spend what you know the things they had. Uh they basically this could bring down this would bring down the entire Bitcoin concept. Um it's also expensive in terms of network bandwidth because when you pay for your cup of coffee with Bitcoin that transaction has to sort of be flooded throughout the internet. Um, also when a minor finds a block um finds the next block that has to be flooded to all of the miners um and um if your transaction was not included in the winning block, hopefully it will be in some later block. And so it's a gossip protocol. Your node knows some others and those nodes tell others and so forth. So here you have some sort of network of just who's configured with who and um so whenever you receive something you just send it to all the neighbors except the one you got it from. So there'll be you know depending on how much connectivity here is there'll be lots of you know um going around in loops and all this kind of stuff. Um, plus it could be fragile like if that node happened to go down, it's now partitioned um, you know, into some set that can't talk to some other set. Um, so blockchain forks, it's possible for multiple miners to semi- simultaneously find a hash. So that means that there'll be two different blockchains, two different valid blockchains. And if a minor sees multiple of them, it takes the one with that's longest the the number of blocks. Um so hopefully the network will converge on a single chain.

[00:30:45]Um but this can take several uh blocks.

[00:30:48]So the advice is not to consider your transaction complete, not to consider yourself as definitely paid unless you not only see that the transaction where you were paid is in block N, but there's six blocks after that. So that would be like an hour. So um um yeah, until the transaction where A paid you is validly is safely recorded, A can double spend with somebody else. Um so if the internet were partitioned um or the gossip protocol itself were partitioned, then miners on each side would happily be adding blocks to the blockchain. um when the partitions rejoined, whichever side had the longest blockchain would win and everything beyond where they forked would no longer be in the ledger.

[00:31:38]Um and any bitcoins that were mined are no longer um there. So there was a example of a really bad fork where some people made new versions of the software that had harmless tweaks in it. But unfortunately that meant that there was some sort of block that looked valid to the new code and didn't look valid to the old code. So um the ones running the old code just completely ignored the blockchain that had the invalid looking block in it no matter how long it got given there was an invalid thing. And this would have lasted forever except uh you know luckily whoever is managing this noticed it with within just a few hours that's um then somehow magically they were able to kind of contact all the miners and get them to switch back to the older version. Um you know again if this technology really took off you know how would you let people know you know who they whatever. Um, so if there were lots of different implementations with subtle differences, there'd be forks like this all the time. Um, there's also finite total bitcoin. So initially the reward for finding the winning hash was 50 by uh blocks bitcoins and then it was h haved to 25 and now it's 12. So every four years the reward is h haveved um and eventually the reward will be zero.

[00:33:05]Um but it will be negligible long before then. So um they wanted to do this for I don't know the economic reasons that the the there'll be a finite amount of these things. Um, now transaction fees. The Bitcoin enthusiasts say the greedy banks take like 3% on every credit card transaction, but with Bitcoin it can be like much cheaper. Um, and today it's true most transactions don't include a transaction fee and still get uh swept into the blockchain. But if there's too many transactions per unit time to fit into the finite size block that happens every 10 minutes, um, um, then the miners are only going to choose the ones with the highest transaction fee. Um, every transaction is work for the minor because you have to um do all of this hashing and hashing over a smaller amount will be less work.

[00:34:04]Um, especially you have to do it two to the 70th times every bite u matters. Um and as the reward depends on fees rather than this um you know block reward, the transaction fees are going to have to rise to compensate for the lack of um reward in there. So currently it's about $5.85 85 cents reward per transaction in the block that the um miners get if you count both the transaction fees and the which is only like 3% currently um plus the other thing. So um interesting statistics um there are various websites that you can go to that says like how many minors there are and so forth. Um now full versus lightweight nodes. So the um um um the ledger currently the blockchain is like I don't know 75 gig or I have it on a um next slide. So um imagine if your smartphone in order to um accept Bitcoin and in order to see whether it's a valid thing you have to be able to look through the whole um history imagine if you had to store it.

[00:35:15]So instead it kind of changed into there's lightweight nodes and there's um full nodes. A full node keeps the entire ledger and if you get paid a bitcoin, you go and ask a full node, hey, should I believe this? Is this a valid thing?

[00:35:30]And they'll check against the um so you're configured with some number of full nodes, which is kind of ironic because supposedly nothing needs to be trusted, but you really do have to trust the full node that you're uh configured to trust. Um so how much energy? Well, the assumption is um in order to compute how much energy, it's very hard to compute this sort of thing. Um um so this is based on capitalism that if mining was very lucrative, more miners would join and if the cost of electricity is more than the reward, miners will drop out. So the amount spent on electricity will be a little bit less than the reward. Um, and it's hard to know exactly um how much it is, but uh the minor reward over the last year has been about a million dollars a day. And um there are reports that the minor reward barely covers the cost of electricity. And so at 10 cents per kilowatt hour, this is about enough electricity for 200,000 American homes or about half a nuclear power plant for this technology, which is just kind of a little researchy thing right now.

[00:36:39]Um uh but I actually claim that number is too low because if you actually go on Amazon and buy a mining rig for $800, you want to use it even if you're actually eating up more electricity than you're you're getting. You also may not really be conscious of how much your electric bill has gone up. And there's countries where electricity is highly subsidized. So mining is way cheaper and you may be stealing the electricity, so you may not care. um you know like if it's um done with bots or invalid uh cloud accounts and um um those cases it's software and it's harder to win against specialized mining machines but you know if the electricity is free why not so how much storage it's about 85 gigs um it grew 40 gigs in the last year um and there's 5,000 full nodes that are all storing this and hey I work for a storage company this is Right.

[00:37:39]Um, but they're talking about increasing the block size which will mean that the ledger will grow like even bigger and this is stored at every full node and also whenever a full node comes up it has to download the entire thing. Um, it's also hard to protect your bitcoins.

[00:37:56]So I do not keep my money in a mattress in my house because I assume that a bank is kind of more capable of um uh you know storing it safely than I am. But if you have bitcoins it will be stored on your computer. So there's two possible problems. If somebody breaks into your computer and when has that ever happened? They can steal all of your bitcoins. um um or if your um computer dies and you haven't made enough uh backups, the money is just gone. So um anyway, the reason I'm not a fan of this technology is it's enormously wasteful of energy bandwidth and storage. Um and imagine if it really caught on and people really did start using it for internet of things and all these other things. um transaction fees will eventually need to be really large. It's fragile, especially if there's any diversity in implementations.

[00:38:56]This trust model is just weird to me that um it's based on having enough compute. Um and it's difficult for a user to protect their money. It's likely that they'll just lose the information or that somebody will steal it from them. Um um when you pay a coffee shop for a a coffee, do you really do they have to keep you there for an hour to make sure that it's really validly recorded in the ledger? Um um there's a permanent record of every transaction and there's a limited number of transactions per unit time um in order to fit um into this. So what do people think are the good things about this?

[00:39:36]Because there are enthusiasts and they say, "Well, it's a distributed ledger.

[00:39:40]It's not just in one place. I claim that people know how to store things in more than one place. Um, you know, there's no central authority.

[00:39:50]And I claim if you wanted to do something sensible is have several trusted um authorities. So instead of one bank, have 20 banks with maybe some from different countries. Um, and a transaction is valid only after a majority of those have signed off on it.

[00:40:08]um you know that's perfectly reasonable um technology. Uh no greedy banks taking 3% transaction fees and I claim Bitcoin transaction fees will soon be much worse. There's an immutable permanent record and you can do that with digital signatures and storing things in multiple places and proof that event X occurred at some time. Again, there's straightforward ways of doing that. I would claim there should be like timestamping services that you send them a hash, they timestamp it and sign it.

[00:40:41]And if you're afraid that that timestamping service will die or something or get corrupted, make sure that if you really want to prove something, you have to get it signed off by 20 timestamping services. So, um, people are calling all sorts of things blockchain, some of which are totally reasonable technology, but they aren't revolutionary new technology, and they have nothing really to do with um, Bitcoin's blockchain. So, thank you.

[00:41:11][Music] So there's probably a bit of time for questions, but um I'll be around for the whole conference. So feel free to talk to me about this stuff. I'm very passionate about it. Yes. Hi Rody. So um there were two things that you uh talked about in a theoretical way that I'd like to clarify uh applications in the way that Lisa attendees probably would think of them. The first is uh in your discussion of uh splitting uh data and and secure u um retrieval um whether that has anything to to tell us about whether uh uh government back doors can be made to work or not and secondly uh about auctions and circuits. Does that have anything to tell us about whether uh blackbox cloud computing where the cloud provider does the computation without knowing either the algorithm or the input and output involved is possible or not? Oh, okay. I don't remember the first because I my head is very small, but the second one, great. Um, the second one, um, yes, there is technology to do what you want to do with homamorphic encryption and secure multi-party computation. Um, uh, that can be done very very practically and it's something else that I'm really passionate about. And it's this thing that Intel will have in their chips.

[00:42:45]It's currently in um uh clientships called SGX. Um uh but at any rate that that would enable you to do all this stuff in a straightforward practical way. Uh the the first part was if you have a government back government back doors. Yeah. Yeah. Government backdoors are sort of orthogonal to the other stuff you know secret sharing and and whatever can be done with a backdoor without it. Um yeah. So anyway, I better go. I'll be around. So keep in touch.