Privacy- Preserving Smart Contracts

Transcription

1 Privacy- Preserving Smart Contracts Ranjit Kumaresan Microso8 Research Joint work with Iddo Bentov, Tal Moran, Vinod Vaikuntanathan, Prashant Vasudevan, Melissa Chase

2 Smart Contracts [Szabo 94] Automate Contract Management Self- enforcing Key unlocks car iff monthly installment is paid

3 DifficulQes in Self- Enforcement InformaQon Exchange Want: Either both get each other s informaqon or none get Counter- party risks

4 MiQgaQng Counter- Party Risks Escrow Services Performs exchange iff both condiqons are saqsfied CondiQons that the other person s informaqon must saqsfy Are escrows really necessary? Impossible to enforce without trusted party [Cleve86]

5 Bypass Cleve s Impossibility? InformaQon has value Safety deposit = value of informaqon Money Escrow If exchange is unsuccessful honest party is compensated

6 Why Is This Any Be[er? Possible to implement in a model where we have self- enforcing informaqon money exchange [BK 14a] Claim- or- Refund TransacQons Bob claims Alice s deposit and Alice gets Bob s informaqon φ OR Bob does not claim Alice s deposit and Alice gets her deposit refunded φ

7 Bitcoin Implements InformaQon Money φ = = Knowledge of secret key Blockchain: Public list of transacqons TX1: Alice - > Bob TX2: Carol - > Dave TX3: Bob - > Carol Bitcoin transacqons are explicitly condiqonal To spend TX1: Bob produces a signature under his public key Miners validate condiqons and maintain the blockchain

8 Bitcoin- Inspired but Bitcoin- Independent φ InformaQon Money Escrow Blockchain ImplementaQon Privacy Scalability Single Point of Failure Data breaches leak Fee per transacqon Depends on complexity of φ Made public on- chain for verificaqon anyway Need Privacy- Preserving Mechanisms Miners need to see Large φ breaks consensus Miner dis- incenqvized Network delays Need to Minimize On- Chain Complexity

9 InformaQon InformaQon via Claim- or- Refund [BK 14] Want to Implement Main Idea: Double lock φ and φ φ ParQes end with up each other s informaqon and coins

10 InformaQon InformaQon via Claim- or- Refund [BK 14] Want to Implement What if Bob does not make a deposit φ and φ φ Bob does not have both informaqon Alice does not lose money

11 InformaQon InformaQon via Claim- or- Refund [BK 14] Want to Implement What if Bob does not claim? φ Exchange φ φ and φ No Privacy φ are public on the blockchain Bob loses his deposit

12 How to Get Privacy? [Need Privacy- Preserving ComputaQons] x x z Want to compute f(x,y) without revealing any extra informaqon about their inputs z y z = f(x,y) y Best Possible Privacy Cleve s result: Not possible even for f(x,y) = (y,x)

13 Privacy Tool: Secure ComputaQon Best Possible x x z Want to compute f(x,y) without revealing any extra informaqon about their inputs z y z = f(x,y) Secure ComputaQon Protocol πf y z = f(x,y) Privacy No fairness SECURE COMPUTATION implements the angel via cryptography [Yao 86,GMW 87,BGW 88,CCD 88,RB 89]

14 Private Exchange via Secure ComputaQon Earlier: New: [BK 14, KVV 16] Secure ComputaQon Generate encrypqon keys φ Exchange φ φ φ Check if informaqon is valid, then encrypt it Privacy Problem CondiQons φ and φ check informaqon publicly φk Exchange φk Only the one- Qme keys go public Encrypted informaqon kept local AuthenQcate keys φk φk Privacy Scalability

15 MulQple- Move Exchanges [KMB 15, KVV 16] Deposits made one- by- one φ4 M 1 M 2 M 3 M 4 M i depends on M 1,, M i- 1 M 1,..., M i should saqsfy condiqons φ i M 3 M 1 φ3 φ2 φ1 Claims in Reverse order M 4 M 2

16 MulQple- Move Exchanges [KMB 15, KVV 16] Player in debt unql move is made φ4 M 1 M 2 φ3 M 3 M 4 M 3 M i depends on M 1,, M i- 1 M 1,..., M i should saqsfy condiqons φ i φ2 φ1 M 2 Aborts a8er every move must be penalized M 1 Bob gets compensated

17 MulQ- Party Exchanges A set of par/es wish to perform an n- way exchange All might collude against one If someone aborts everybody must get compensated MulQ- party exchange from Can we implement this just claim- or- refund using claim- or- refund? [BK14,KMB15,KVV16]

18 Ladder Protocol [BK14a] Order of deposits/claims Roof deposits made simultaneously Ladder deposits made one a8er the other Ladder claims in reverse Roof claims at the end High- level intuiqon At the end of ladder claims, all parqes except have evened out If doesn t make roof claims then honest parqes get compensaqon via roof refunds Else evens out Ladder Roof P 1 T 1^ ^T n q, n P 2 T 1^ ^T n q, n 2 T 1^ ^T n q, n 1 T 1^ ^T n q, n. T 1^ ^T n 1 (n 1)q, n T 1^ ^T n 2 (n 2)q, n 2 2. P 3 T 1^T 2 2q, 2 P 2 P 2 T 1 q, 1 P 1

19 Planted Ladder ReacQve Case [KVV15] Roof P 1 D 1^ ^D n ^T 1^ ^T n q, 2n D 1^ ^D n ^T 1^ ^T n P 2 q, 2n.. 2 D 1^ ^D n ^T 1^ ^T n q, 2n 1 D 1^ ^D n ^T 1^ ^T n q, 2n Ladder D 1^ ^D n ^T 1^ ^T n 1 (2n 1)q, 2n D 1^ ^D n ^T 1^ ^T n 2 (2n 2)q, 2n 2 2. P 3 D 1^ ^D n ^T 1^T 2 (n+2)q, n+2 P 2 P 2 D 1^ ^D n ^T 1 (n+1)q, n+1 P 1 High- level Idea Use dummy tokens to bootstrap A8er plant claims: P 1 has paid all parqes A8er i- th ladder claim: P i+1 paid all parqes; forces P i+1 to conqnue ReacQve; force any protocol Plant P 1 D 1^ ^D n n q, n D 1^ ^D n 1 (n 1)q, n D 1^ ^D n 2 (n 2)q, n 2 2. P 3 D 1^D 2 2q, 2 P 2 P 2 D 1 q, 1 P 1

20 MulQple Exchanges A set of parqes wish to perform mul/ple exchanges On- chain transacqons for every exchange CondiQons depend on informaqon exchanged Unbounded number of exchanges from Can we use just one set single of transac/ons set of claim- or- refund for all exchanges? [KB 16]

21 Infrastructures for Contracts All pairs of parqes from a larger universe wish to perform exchanges UNTRUSTED Server Client- Server Architecture linear number of on- chain transacqons [KB 16,CK]

22 Summary Claim- or- refund transacqons are a powerful abstracqon Decompose complex mulqparty contracts into mul/ple simple stateless contracts (i.e., CR txns) without losing funcqonality Enables blockchain interoperability (not all parqes need to be on the same cryptocurrency) Secure mulqparty computaqon can provide privacy & scalability Other Related Work: [BBSU 12,BB 14,ADMM 14a,14b,KZZ15,KMSWP 16]

23 Thank You