Guy Zyskind

Distributed point functions (DPF) are increasingly becoming a foundational tool with applications for application-specific and general secure computation. While two-party DPF constructions are readily available for those applications with satisfiable performance, the three-party ones are left behind in both security and efficiency. In this paper we close this gap and propose the first three-party DPF construction that matches the state-of-the-art two-party DPF on all metrics. Namely, it is secure against a malicious adversary corrupting both the dealer and one out of the three evaluators, its function's shares are of the same size and evaluation takes the same time as in the best two-party DPF. Compared to the state-of-the-art three-party DPF, our construction enjoys 40-120× smaller function's share size and shorter evaluation time, for function domains of 2¹⁶ -2⁴⁰, respectively. Apart from DPFs as a stand-alone tool, our construction finds immediate applications to private information retrieval (PIR), writing (PIW) and oblivious RAM (ORAM). To further showcase its applicability, we design and implement an ORAM with access policy, an extension to ORAMs where a policy is being checked before accessing the underlying database. The policy we plug-in is the one suitable for account-based digital currencies, and in particular to central bank digital currencies (CBDCs). Our protocol offers the first design and implementation of a large scale privacy-preserving account-based digital currency. While previous works supported anonymity sets of 64-256 clients and less than 10 transactions per second (tps), our protocol supports anonymity sets in the millions, performing {500,200,58} tps for anonymity sets of {2¹⁶, 2¹⁸, 2²⁰}, respectively. Toward that application, we introduce a new primitive called updatable DPF, which enables a direct computation of a dot product between a DPF and a vector; we believe that updatable DPF and the new dot-product protocol will find interest in other applications.

Blockchains ensure that all transactions, including those that execute deterministic programs known as smart contracts, are processed correctly and without interruption. However, blockchains inherently provide no confidentiality - all transaction data, including inputs sent to smart contracts, are public. This has led to a rise of confidential smart contract blockchains. These blockchains utilize privacy-preserving techniques to add privacy to smart contracts, but they usually rely on Trusted Execution Environments (TEEs) (e.g., [14, 24]) that are susceptible to side-channel attacks and other security concerns ([7, 13, 33] to name a few). More recently, several works have focused on achieving confidentiality using Fully Homomorphic Encryption (FHE) (e.g., [1, 30]). While this approach is promising, these works limit scalability as they require all nodes in the network to execute FHE computations and reach consensus over the encrypted state, which is prohibitive. Instead, in this work and inspired by the recent move towards layer-2 solutions, we present the first rollup-based FHE architecture. We argue that while for plaintext computation rollups are a needed solution, in the context of FHE, where the computational overhead is orders of magnitude higher, they are a necessity. In our design, we take an optimistic rollup approach, allowing us to avoid the orders of magnitude penalty incurred by state-of-the-art verifiable FHE techniques [34]. In fact, our framework can be seen as a cryptoeconomic solution to solve the same problem of verifiability in FHE. We implement a proof-of-concept of our solution, and in the process, we show how we can build FHE rollups without making any changes to existing layer-Is like Ethereum, even if they do not support FHE operations inherently. We further implement three smart-contracts that are only possible if data remains confidential, and show that their performance is practical.

The security and usability of cryptocurrencies and other blockchain-based applications depend on the secure management of cryptographic keys. However, current approaches for managing these keys often rely on third parties, trusted to be available at a minimum, and even serve as custodians in some solutions, creating single points of failure and limiting the ability of users to fully control their own assets. In this work we first revisit the problem of threshold ECDSA by considering the commonly admissible 'server-aided' model, namely, the presence of a semi-honest and non-colluding service provider. Then, we leverage that model and consider cases where that 'server' is distributed, introducing the novel concept of unstoppable wallets; hence eliminating any single point of failure. Unstoppable wallets are programmable threshold ECDSA wallets that allow users to co-sign transactions with a confidential smart contract, rather than a singular third-party. We construct highly efficient threshold ECDSA protocols that form the basis of unstoppable wallets and prove their security in the server-aided model, achieving the standard notion of fairness and robustness even in case of a dishonest majority among the signers. Our protocols minimize the write-complexity for threshold ECDSA key-generation and signing, while reducing communication and computation overhead. We provide a proof-of-concept implementation of these protocols, written in a smart contract language, deployed on the Secret Network - a blockchain that plays the role of the server. Using that deployment, we showcase the protocols' applicability for two interesting applications, policy checking and wallet exchange, as well as their efficiency by demonstrating low gas costs and fees.