ZEXE: Enabling Decentralized Private Computation · 1 ZEXE: Enabling Decentralized Private Computation Sean Bowe Alessandro Chiesa Matthew Green Ian Miers Pratyush Mishra Howard Wu

1

ZEXE: EnablingDecentralized Private Computation

Sean Bowe Alessandro Chiesa

Matthew Green Ian Miers

Pratyush Mishra Howard Wu

Zcash UC Berkeley JHU Cornell Tech UC Berkeley UC Berkeley

ia.cr/2018/962 libzexe.org

PENCIL Workshop, 2019

https://eprint.iacr.org/2018/962

http://libzexe.org

Computing on distributed ledgers


• Today we have a number of systems for running general computations on distributed ledgers: Ethereum, Tezos, EOS…



• These usually work by re-execution: every node re-executes every transaction.



• These usually work by re-execution: every node re-executes every transaction.

3

Scalability and privacy issuesScalability Privacy

3


3


3


3


3


•Bottlenecked by weakest node

3


•Bottlenecked by weakest node•Independent of consensus-layer

improvements

3



improvements

Anyone can see:

3



improvements

executed program

Anyone can see:

3



improvements

executed program input

data

Anyone can see:

3



improvements


datacaller

Anyone can see:

3



improvements


datacaller

Anyone can see:

•Permanently stored on the ledger

This work: ZEXE

4

This work: ZEXE

4

A ledger-based system that enables users to conduct offline computations and then publish transactions about these.

This work: ZEXE

4


Privacy: tx reveals no info about offline computation

This work: ZEXE

4


Privacy: tx reveals no info about offline computationSuccinctness: tx can be validated in poly(k) time

|tx|<1KB Verify(tx) in <50ms

This work: ZEXE

4



|tx|<1KB Verify(tx) in <50msFunctionality:

This work: ZEXE

4




• extensibility (user-defined functions)

This work: ZEXE

4




• extensibility (user-defined functions)• isolation (malicious functions do not affect honest ones)

This work: ZEXE

4




• extensibility (user-defined functions)• isolation (malicious functions do not affect honest ones)• inter-process communication (functions can interact)

This work: ZEXE

4





Example applications:

This work: ZEXE

4





Example applications:• private user-defined assets

This work: ZEXE

4





Example applications:• private user-defined assets• private stablecoins

This work: ZEXE

4





Example applications:• private user-defined assets• private stablecoins• private decentralized exchanges

This talk: ZEXE

5

This talk: ZEXE

5

Will use ideas from ZEXE to construct

This talk: ZEXE

5


private user-defined assets

This talk: ZEXE

5


private user-defined assetsprivate decentralized exchanges

This talk: ZEXE

5


private user-defined assetsprivate decentralized exchangesprivate stablecoins

Trading digital assets

Trading digital assets• Custom, user-defined assets are most successful

application of smart contract systems.



• Many different kinds of assets such as ERC-20, ERC-721 tokens and stablecoins. Different properties and controlling authorities.




• How to trade such assets?




• How to trade such assets?Centralized exchanges





- Users give up custody of assets.






- Can lead to loss of funds due to fraud/breach/error







+ Efficient: infrequent on-chain activity








+ (Somewhat) private: only exchange learns trade details









Decentralized exchanges










+ Users retain custody of assets











- Inefficient: on-chain activity for all trades











- Inefficient: on-chain activity for all trades

- Non-private: any observer can see trade details

Limitations of DEXs

Limitations of DEXs

Privacy:

Limitations of DEXs

Privacy:• Every trade goes on the ledger.

Limitations of DEXs

Privacy:• Every trade goes on the ledger.• Transactions reveal participating parties, assets and

values.

Limitations of DEXs


values.

Limitations of DEXs


values.

User financial privacy

Limitations of DEXs


values.


Trading history of users is public on the ledger, which reduces fungibility and can reveal secrets like trading patterns and techniques.

Limitations of DEXs


values.

Frontrunning

Miners’ privileged network position enables them to see big orders before others, allowing them to place their own orders before prices change.



Limitations of DEXs


values.

Frontrunning

Miners’ privileged network position enables them to see big orders before others, allowing them to place their own orders before prices change.



[BDJT17, BBDJLZ17, DGKLZBBJ19]

http://hackingdistributed.com/2017/08/28/submarine-sends/

http://hackingdistributed.com/2017/08/13/cost-of-decent/

https://arxiv.org/abs/1904.05234

8

8

Private user-defined assets

8

Private DEX


8

Private DEX


Private stablecoins

8

Private DEX


Private stablecoins

The Zerocash Paradigm

9

Each transaction consumes old coins and creates new coins. The senders, receivers, and values are provably hidden.

[BCGGMTV14]


9


[BCGGMTV14]

sn1 cma

sn2 cmb

∗


9


sn3 cmc

sn4 cmd

∗

[BCGGMTV14]

sn1 cma

sn2 cmb

∗


9


sn3 cmc

sn4 cmd

∗

[BCGGMTV14]

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

HIDDEN

[BCGGMTV14]

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]

all created coins (commitments)

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]


cmb

cme cmc...

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]


consumed coins (serial numbers)

cmb

cme cmc...

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]



cmb sn5

cme cmc...

...

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗


9


sn3 cmc

sn4 cmd

∗

v5+v6=ve+vfHIDDEN

[BCGGMTV14]



cmb sn5

cme cmc...

...

sn1 cma

sn2 cmb

∗sn5 cme

sn6 cmf

∗

Sketch of Zerocash

10

tx

old coin serial numbers

new coin commitments

[BCGGMTV14]

𝗌𝗇𝗈𝗅𝖽i 𝖼𝗆𝗇𝖾𝗐

j

Simplify: just say that proof proves four things: Existence of coins, unique spends, construction of new coins, and correct values.

Reason: don’t use it in the rest of the talk anyway.

Sketch of Zerocash

10

𝛑tx


new coin commitments ZKP

[BCGGMTV14]


j



Sketch of Zerocash

10

𝛑tx



COMM

[BCGGMTV14]


j

𝗉𝗄𝗈𝗅𝖽i v𝗈𝗅𝖽

i ρ𝗈𝗅𝖽ic𝗈𝗅𝖽

i



Sketch of Zerocash

10

rt 𝛑tx

set of all coin commitments



COMM

∈

[BCGGMTV14]


j



i

𝖼𝗆𝗈𝗅𝖽i



Sketch of Zerocash

10

rt 𝛑tx




PRF

COMM

∈

[BCGGMTV14]


j



i


𝗌𝗄𝗈𝗅𝖽i



Sketch of Zerocash

10

rt 𝛑tx




PRF

COMMCOMM

∈

[BCGGMTV14]


j


i ρ𝗈𝗅𝖽i 𝗉𝗄𝗇𝖾𝗐

j v𝗇𝖾𝗐j ρ𝗇𝖾𝗐

jc𝗈𝗅𝖽i c𝗇𝖾𝗐

j





Sketch of Zerocash

10

rt 𝛑tx




PRF

COMMCOMM

∈

[BCGGMTV14]


j



j v𝗇𝖾𝗐j ρ𝗇𝖾𝗐


j


∑i

v𝗈𝗅𝖽i = ∑

j

v𝗇𝖾𝗐j




11

Zerocash achieves ideal anonymity for a single asset

(on a single blockchain).

11

Zerocash achieves ideal anonymity for a single asset

(on a single blockchain).

How to achieve ideal privacy for multiple user-defined assets (on the same blockchain)?


12

rt 𝛑tx




PRF

COMMCOMM

∈


j

𝗉𝗄𝗈𝗅𝖽i ρ𝗈𝗅𝖽

i 𝗉𝗄𝗇𝖾𝗐j ρ𝗇𝖾𝗐


j



* For now we ignore how to mint an initial supply and generate a unique id.

*


12

rt 𝛑tx




PRF

COMMCOMM

∈


j

𝗉𝗄𝗈𝗅𝖽i (𝗂𝖽𝗈𝗅𝖽

i , v𝗈𝗅𝖽i ) ρ𝗈𝗅𝖽

i 𝗉𝗄𝗇𝖾𝗐j (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j ) ρ𝗇𝖾𝗐


j




*


12

rt 𝛑tx




PRF

COMMCOMM

∈


j

𝗉𝗄𝗈𝗅𝖽i (𝗂𝖽𝗈𝗅𝖽

i , v𝗈𝗅𝖽i ) ρ𝗈𝗅𝖽

i 𝗉𝗄𝗇𝖾𝗐j (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j ) ρ𝗇𝖾𝗐


j




For every id in tx, id-value is conserved

*

13

13

So far: multiple, private, user-defined assets in the same transaction, with the same anonymity pool.

13


But: assets are still isolated.

13


But: assets are still isolated.

How to enable applications that interact with multiple assets?

Custom access to user-defined assets

14

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i


∙ ∀𝗂𝖽, 𝗂𝖽-value is conserved


c𝗇𝖾𝗐j𝗉𝗄𝗈𝗅𝖽


j ρ𝗇𝖾𝗐j(𝗂𝖽𝗈𝗅𝖽

i , v𝗈𝗅𝖽i , 𝖺𝗎𝗑𝗈𝗅𝖽

i ) (𝗂𝖽𝗇𝖾𝗐j , v𝗇𝖾𝗐

j , 𝖺𝗎𝗑𝗇𝖾𝗐j )


14

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i





i ρ𝗈𝗅𝖽iϕ𝗈𝗅𝖽


jϕ𝗇𝖾𝗐j

∙ ∀i, ϕ𝗈𝗅𝖽i (all coins) = 1

(𝗂𝖽𝗈𝗅𝖽i , v𝗈𝗅𝖽

i , 𝖺𝗎𝗑𝗈𝗅𝖽i ) (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j , 𝖺𝗎𝗑𝗇𝖾𝗐

j )


14

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i







jϕ𝗇𝖾𝗐j

∙ ∀i, ϕ𝗈𝗅𝖽i (all coins) = 1


i , 𝖺𝗎𝗑𝗈𝗅𝖽i ) (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j , 𝖺𝗎𝗑𝗇𝖾𝗐

j )

Transaction reveals no information about asset

identifier, value, or predicate

15

Private atomic swaps

15

Private atomic swaps Key primitive for constructing DEXs

(𝗂𝖽𝗈𝗅𝖽1 , v𝗈𝗅𝖽

1 , 𝖺𝗎𝗑𝗈𝗅𝖽1 )

ϕ𝗈𝗅𝖽1 = ϕ𝖾𝗑𝖼𝗁

𝗉𝗄𝗈𝗅𝖽1

c𝗈𝗅𝖽1

15

Private atomic swaps Key primitive for constructing DEXs





c𝗈𝗅𝖽1

15




ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2

(𝗂𝖽𝗇𝖾𝗐1 , v𝗇𝖾𝗐

1 , ⊥ )

ϕ𝗇𝖾𝗐1

𝗉𝗄𝗇𝖾𝗐1

c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2

Key primitive for constructing DEXs





c𝗈𝗅𝖽1

15


ϕ𝖾𝗑𝖼𝗁(c𝗈𝗅𝖽1 , c𝗈𝗅𝖽

2 , c𝗇𝖾𝗐1 , c𝗇𝖾𝗐

2 ) :



ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2


1 , ⊥ )

ϕ𝗇𝖾𝗐1


c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2






c𝗈𝗅𝖽1

15




2 ) :

Parse 𝖺𝗎𝗑𝗈𝗅𝖽1 as (𝗂𝖽⋆, v⋆, 𝗉𝗄⋆)



ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2


1 , ⊥ )

ϕ𝗇𝖾𝗐1


c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2

(𝗂𝖽⋆, v⋆, 𝗉𝗄⋆)






c𝗈𝗅𝖽1

15




2 ) :


Check that 𝗂𝖽𝗈𝗅𝖽2 = 𝗂𝖽⋆ and v𝗈𝗅𝖽

2 = v⋆



ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2


1 , ⊥ )

ϕ𝗇𝖾𝗐1


c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2

(𝗂𝖽⋆, v⋆, 𝗉𝗄⋆)






c𝗈𝗅𝖽1

15




2 ) :



2 = v⋆

Perform swap: 𝗂𝖽𝗇𝖾𝗐

1 = 𝗂𝖽𝗈𝗅𝖽2 ; v𝗇𝖾𝗐

1 = v𝗈𝗅𝖽2

𝗂𝖽𝗇𝖾𝗐2 = 𝗂𝖽𝗈𝗅𝖽

1 ; v𝗇𝖾𝗐2 = v𝗈𝗅𝖽

1



ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2


1 , ⊥ )

ϕ𝗇𝖾𝗐1


c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2

(𝗂𝖽⋆, v⋆, 𝗉𝗄⋆)






c𝗈𝗅𝖽1

15




2 ) :



2 = v⋆

Perform swap: 𝗂𝖽𝗇𝖾𝗐

1 = 𝗂𝖽𝗈𝗅𝖽2 ; v𝗇𝖾𝗐

1 = v𝗈𝗅𝖽2

𝗂𝖽𝗇𝖾𝗐2 = 𝗂𝖽𝗈𝗅𝖽

1 ; v𝗇𝖾𝗐2 = v𝗈𝗅𝖽

1

Check addresses: 𝗉𝗄𝗇𝖾𝗐

1 = 𝗉𝗄⋆

𝗉𝗄𝗇𝖾𝗐2 = 𝗉𝗄𝗈𝗅𝖽

2



ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2


1 , ⊥ )

ϕ𝗇𝖾𝗐1


c𝗇𝖾𝗐1


2 , ⊥ )

ϕ𝗇𝖾𝗐2


c𝗇𝖾𝗐2

(𝗂𝖽⋆, v⋆, 𝗉𝗄⋆)

= 𝗉𝗄⋆


16

DEX

16

DEX

Atomic swap

16

DEX

Atomic swap

Order creation

Trade finalizationOrder discovery

17

DEX Architectures

17

DEX Architectures

Order-based:

17

• Order book maintains list of orders published by makers

DEX Architectures

Order-based:

17

• Order book maintains list of orders published by makers

DEX Architectures

Order-based: (A, B, vA, vB, …)

17

• Order book maintains list of orders published by makers• Takers can scan for open orders and fill them

DEX Architectures


17

• Order book maintains list of orders published by makers• Takers can scan for open orders and fill them• Eg: Radar Relay, IDEX.

DEX Architectures


17


DEX Architectures

Order-based:

Index-based:

(A, B, vA, vB, …)

17


DEX Architectures

Order-based:

• Index maintains list of “intents-to-trade” published by makersIndex-based:

(A, B, vA, vB, …)

17


DEX Architectures

Order-based:

• Index maintains list of “intents-to-trade” published by makersIndex-based:

(A, B, vA, vB, …)

(A, B, …)

17


DEX Architectures

Order-based:

• Index maintains list of “intents-to-trade” published by makers• Takers can scan for intentions and interact with makers to fill

orders

Index-based:

(A, B, vA, vB, …)

(A, B, …)

17


DEX Architectures

Order-based:


orders• Eg: AirSwap

Index-based:

(A, B, vA, vB, …)

(A, B, …)

17


DEX Architectures

Order-based:


orders• Eg: AirSwap

Index-based:

(A, B, vA, vB, …)

(A, B, …)

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Intent-based DEX

18

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Intent-based DEX

18

Maker

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Intent-based DEX

18

Maker

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Intent-based DEX

18

Maker Taker

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Intent-based DEX

18

Maker Taker

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Intent-based DEX

18

Maker Taker

tx

Index

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Intent-based DEX

18

Maker Taker

tx Ledger

Index

19

Privacy Leakage

Ledger

tx

M T

19

Privacy Leakage

Ledger

tx“The addresses

addrM and addrT are exchanging

vA units of A for

vB units of B”

M T

19

Privacy Leakage

Ledger

tx“The addresses


vA units of A for

vB units of B”

identities of transacting parties

M T

19

Privacy Leakage

Ledger

tx“The addresses


vA units of A for

vB units of B”


assets and values in the trade

M T

19

Privacy Leakage

Ledger

tx“The addresses


vA units of A for

vB units of B”



Trade anonymityNo information about participants in the trade is revealed.

M T

19

Privacy Leakage

Ledger

tx“The addresses


vA units of A for

vB units of B”



Trade anonymityNo information about participants in the trade is revealed.

Trade confidentialityNo information about the assets and values used in the trade is revealed.

M T

Private Intent-based DEX

20

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Index


20

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Maker

Index


20

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Maker

Index


20

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Maker Taker

Index


20

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Maker Taker

Index


20

(A, vA) (B, vB)

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

Sell Buy Public key

BAT MKR pk1

ZRX OMG pk2

A B pkM

Maker Taker

Index

(A, vA) (B, vB)


21

Maker


21

(A, vA, 𝖺𝗎𝗑𝗈𝗅𝖽1 )

ϕ𝖾𝗑𝖼𝗁


c𝗈𝗅𝖽1(B, vB, 𝗉𝗄𝖬)

Maker


21


ϕ𝖾𝗑𝖼𝗁



(c𝗈𝗅𝖽1 , 𝗌𝗄𝗈𝗅𝖽

1 )

Maker Taker


21


ϕ𝖾𝗑𝖼𝗁




1 ) (B, vB, 𝖺𝗎𝗑𝗈𝗅𝖽2 )

ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2

Maker Taker


21

tx


ϕ𝖾𝗑𝖼𝗁





ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2

Maker Taker


21

tx

Ledger


ϕ𝖾𝗑𝖼𝗁





ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2

Maker Taker


21

tx

Ledger


ϕ𝖾𝗑𝖼𝗁





ϕ𝗈𝗅𝖽2


c𝗈𝗅𝖽2

Maker Taker

Trade anonymity:tx hides all information about Maker and Taker.

Trade confidentiality: tx hides all information about A, B, vA, and vB.

22

22


22


Custom access to private user-defined

assets

22

Private DEX


Custom access to private user-defined

assets

23

23

But what if you want a user-defined asset with a different (custom) policy?

23

But what if you want a user-defined asset with a different (custom) policy?

For example, simple ERC-20 tokens require only value-conservation. other tokens, like stablecoins, need to also implement blacklists and whitelists.

Birth predicates

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i





j ρ𝗇𝖾𝗐j(𝗂𝖽𝗈𝗅𝖽

i , v𝗈𝗅𝖽i , c𝗈𝗅𝖽

i ) (𝗂𝖽𝗇𝖾𝗐j , v𝗇𝖾𝗐

j , c𝗇𝖾𝗐j )

24

Birth predicates

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i





𝖽,i 𝗉𝗄𝗇𝖾𝗐j ρ𝗇𝖾𝗐

jϕ𝗇𝖾𝗐𝖽, j

ϕ𝗈𝗅𝖽𝖽,i ( ⋅ ) = 1

ϕ𝗇𝖾𝗐𝖻, j ( ⋅ ) = 1


i , c𝗈𝗅𝖽i ) (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j , c𝗇𝖾𝗐

j )

24

ϕ𝗇𝖾𝗐𝖻, jϕ𝗈𝗅𝖽

𝖻,i

Birth predicates

rt 𝛑tx




PRF

COMMCOMM

∈


j

c𝗈𝗅𝖽i







ϕ𝗈𝗅𝖽𝖽,i ( ⋅ ) = 1

ϕ𝗇𝖾𝗐𝖻, j ( ⋅ ) = 1


i , c𝗈𝗅𝖽i ) (𝗂𝖽𝗇𝖾𝗐

j , v𝗇𝖾𝗐j , c𝗇𝖾𝗐

j )

24


𝖻,i

∙ ∀𝗂𝖽, 𝗂𝖽-value is conserved∙ Policy p is enforced

Supporting arbitrary data and computation

rt 𝛑tx




PRF

COMMCOMM

∈


j

r𝗈𝗅𝖽i



r𝗇𝖾𝗐j𝗉𝗄𝗈𝗅𝖽




ϕ𝗈𝗅𝖽𝖽,i ( ⋅ ) = 1

ϕ𝗇𝖾𝗐𝖻, j ( ⋅ ) = 1

𝗉𝖺𝗒𝗅𝗈𝖺𝖽 𝗉𝖺𝗒𝗅𝗈𝖺𝖽

25


𝖻,i

Supporting arbitrary data and computation

rt 𝛑tx




PRF

COMMCOMM

∈


j

r𝗈𝗅𝖽i



r𝗇𝖾𝗐j𝗉𝗄𝗈𝗅𝖽




ϕ𝗈𝗅𝖽𝖽,i ( ⋅ ) = 1

ϕ𝗇𝖾𝗐𝖻, j ( ⋅ ) = 1

𝗉𝖺𝗒𝗅𝗈𝖺𝖽 𝗉𝖺𝗒𝗅𝗈𝖺𝖽

25


𝖻,i

Store arbitrary data

Store arbitrary data

ZEXE

26

ZEXE

26

Modeling: Records Nano-Kernelminimalist shared execution environment that defines rules for computing on records (units of data)

ZEXE

26


ZEXE

26


Theoretical crypto: Decentralized Private Computation

crypto primitive that realizes a ledger-based RNK where txs reveal NO information about computations

ZEXE

26




ZEXE

26




Applied crypto: ZEXE

leverage techniques from zkSNARKs, recursive composition, and efficient circuit design

ZEXE

26




Applied crypto: ZEXE

leverage techniques from zkSNARKs, recursive composition, and efficient circuit design

libzexe.org

http://libzexe.org

27

Thanks!

ia.cr/2018/962

libzexe.org

https://eprint.iacr.org/2018/962

http://libzexe.org

Documents

ZEXE: Enabling Decentralized Private Computation · 1 ZEXE: Enabling Decentralized Private Computation Sean Bowe Alessandro Chiesa Matthew Green Ian Miers Pratyush Mishra Howard Wu