nick

one of the holy grails of crypto would be to replicate CEX privacy and compliance but with blockchains’ decentralization everyday users don’t want to go fully onchain because their entire financial life becomes public, and institutions don’t know how to make blockchain platforms compliant because regulations aren't built for systems with no central authority. so you end up with horrible contracts with whitelists and multisigs as admins, i.e. the lack of privacy of web3 with the centralization of web2. it’s a really underrated benefit of multiparty computation that it can plausibly fix this. secret sharing data across a bounded set of parties gets you a lot more decentralization and privacy than a CEX, while still providing plausible compliance if the parties are located in the relevant jurisdiction for example the result is a trading platform that can’t see your tx history but can still check you are compliant, and lift bad actors’ privacy when required by the law this isn’t an either/or situation: private, decentralized systems like Monero and Zcash will always be around. but this creates practical middle grounds for both individuals leaving CEXes and institutions moving onchain — bringing us the privacy we need while taking into account the reality of compliance requirements MPC opens an entire new whitespace in crypto, and enables practical bridges between the world we’re living in and the one we’re building.

hey david, i’d love to hear where your claimed limit of 3 parties for cerberus comes from? BDOZ online phases are extremely fast and the main factor in computation time is latency rather than bandwidth until you reach a much higher number of nodes or parallel computations. adding nodes doesn’t add rounds of communication, and consequently runtime isn’t significantly affected between 3 and 6 parties for example. it’s also an advantage of having separate clusters that you can distribute that load instead of having it all weigh on a single committee. which brings us to interoperability: privacy fundamentally limits free interoperability, since program B shouldn’t be able to do whatever it wants with program A’s private state (including reveal it): there needs to be role-based access, which requires involvement of the committee. which is exactly what we have with symmetric-key encryption for data meant for specific users (or even other programs). interop then comes in two distinct flavors: permissionned (the one you mention where program A re-encrypts part of its state to program B’s key so B can use it), and permissionless, where a user provides their state plus a ZKP to show it corresponds to the onchain symmetric ciphertext (umbra actually uses this trick for certain ops already). sidenote: ZKPs are also something you leave out when talking about your privacy solution, is it the same as zama where the user’s expected to produce this big zkp client-side with every tx? as for silent decryption attacks, you know just as well as me that all threshold systems share those attacks, yours included. and yes it involves more parties, but you conveniently gloss over the 2/3 honest supermajority assumption and just talk about committee sizes as if they were comparable in any way to dishonest majority (they aren’t). not only do you eventually run into diminishing returns on security (you can’t expect 50-100 nodes to all run on different infrastructure and not reuse providers/locations at all, which makes them less independent in terms of hacks), but even with a small probability of hacking a given node, you require far larger committee sizes to match dishonest majority’s security. e.g. for a 5% chance of a node being compromised, your system would need 21 nodes to match the security of a 4-party MXE. in our case, the recovery set can be extremely large because its size has no impact on throughput, only on key recovery. also believe it or not key switching is a thing in MPC too! which means you can set up your MXE so that keys are rotated every epoch and the state is re-encrypted by the committee, which mitigates key leaks in the exact same way FHE-based systems can

Gutted to lose one of the best companies in the space. Really enjoyed the ZK Hack meetup you hosted last April, cryptography in Berlin and ZK won't be the same without you guys.