SBTB 2023: Ryan Orendorff, Building private and secure applications easily.

SBTB 2023: Ryan Orendorff, Building private and secure applications easily.

Recording: SBTB 2023: Ryan Orendorff, Building private and secure applications easily.

[Music] um as mentioned I'll be talking about um building private applications which are applications that allow users to take control of their data and make sure that their data is private using the sunscreen compiler which is the compiler that I've been working on along with some co-workers and friends for the last few years so when we're transacting online and we're doing any sort of basic anything online when you're interacting with a server we end up implicitly trusting third parties to keep our data safe so what happens when we're actually interacting with the server the most modern thing which is quite nice over maybe what we had before which was just everything was in the clear was that we have some data from the user we send it over to a server for some data processing now that process when we send over the data is encrypted so we use https and certificates and these types of things in order to try to keep the data safe while it's in transit um but while it's on rest on either side it could be unencrypted um the server will then process the data for us do something useful for us I mean that's why we're sending them some data um and then likely they will send us a response back over another encrypted Channel TCP with htps and that type of thing um but what's clear what's important to note in this diagram is that the data once it's gotten to the server is in the clear um there are certain cases where it might be encrypted at rest but at some point when the server actually needs to process it it needs to be just regular data not encrypted data so how do we use these types of things or why do we need to know this type of data um so say for example you're doing online shopping going through Amazon or something like that the website's not exactly going to know what you intended to purchase if everything is encrypted so it needs to be able to process your data in some form and also needs to be able to process your payment information additionally there are some other services um especially that I've propped up more recently such as like DNA services that need to know Health Data to determine um relatives or genetic markers for certain diseases or other types of things a lot of our Healthcare has gone online as well so you can log into online portals to access any of your patient data all that of course is stuff that you want to keep protected as as much as possible so the question is can we really trust third parties with our data and so under I think the kind of nicest assumption is that we assume that all parties are acting as best as possible um but there are still a few cases where our data isn't necessarily as safe as we would like so one case is data misuse and basically handing off data to people who it shouldn't have been given to or analyzing data in ways that it shouldn't have kind of common example of this one is the Cambridge analytical Scandal um so essentially data there was like it was um meant to be hold or it was held in this case by meta or Facebook and provided to a third party without necessarily the necessary checks that a user might want to ensure that their data wasn't used in ways that they didn't actually consent to there's also malicious actors there was a case for for the uh Equifax had a large hack in 2017 that involved the breach of a lot of people's data they actually set up another website to have people check whether or not their data was um exposed during that breach and then during that process they actually set up a shared they used a shared certificate with some other websites meaning that it was somewhat easy to impersonate the Equifax website and potentially steal people's data so that's the case of not necessarily like misusing data but someone coming in into the middle of the process and trying to take data for their own use and of course we have the kind of standard data breaches that we might all be too familiar with unfortunately so an example of this one would be 23 and me 23 and me had exposed some data related to DNA relatives This is highly personal information um and yeah so essentially people had this they had trusted 23 me to hold their data and for a long time they did hold that data properly um but at some point they unfortunately had a data breach it's as much as we try in security to provide as many uh safeguards against exposing data and stuff like that we unfortunately can't handle every case it just takes one faulty brick and a wall for the whole wall to come crumbling down so um the kind of takeway from all this is that even if we do trust a third party with our data to do the right thing our data isn't still necessarily safe in the case of some companies like 23 and me and ideally Equifax uh they're trying to hold your data in confidence and unfortunately succumb to hackers so the question is can users keep their data private while still using all their favorite online applications and my answer to this is yes we can do so using a technology called fully homomorphic encryption so what is fully homomorphic encryption so the it's kind of broken up into two pieces we're going to focus on just the homomorphic encryption part first so homomorphic encryption allows data to be processed while remaining encrypted it actually never gets decrypted like in our prior examples so maybe for a basic example if you want to add two integers uh there's kind of two ways you can do it the standard way is on the right side of this equation which says that you could take a and b and you can add them together and then you can encrypt the result so the plus d stands for the fact that you're doing it on decrypted data or just plain Text data or there's happens to be another way where you can basically encrypt a encrypt B and then add them together and get the same result as if you had encrypted as if you had performed the computation on just a plus b and encrypted the result so maybe this is helpful to see as a diagram so essentially there's kind of two paths you can take in this diagram either you can take the top path you can go a plus b calculate that and get a plus b and then encrypt it to get the encrypted answer to send to someone or you can encrypt a you can encrypt B and then you can add those and get the result you won't get precisely the same Cipher text you'll get the same data but each Cipher text or each piece of encrypted data will have its own randomness and we'll encode the same information so the fully part of the fully homomorphic encryption means that any computation uh can be performed on encrypted data so this is this does come with some caveats so essentially it means that in some senses it's something similar to turn complete you can calculate anything that you'd want to however some things are very difficult to calculate in such a system um and so there might be things where it's like well potentially I want to calculate something maybe I want to do a physics simulation in data that's going to there's a slow down related to processing encrypted data and there's also a blow up in data size probably not the right application um you could do it but it's probably should focus on things that are a little bit more reasonable to the system so let's review again kind of like what we're talking about here in the traditional application we send data to a server encrypted and then the server will then process that data unencrypted and produce some sort of result and then it will encrypt that data in send it back to us in this new paradigm what we do is the user will encrypt their data locally with their own key producing an encrypted result they will then send that data to a server who will then process it without ever decrypting that data so at no point does the server actually know what was contained inside that encrypted data to all they know they were literally given random bite strings they will produce some sort of result that result will be sent back to the user and then the user can decrypt that data as they see fit well they probably want to probably just don't want to hold on to it um and get the result of that computation so what's the challenge with current FHA setups why are they difficult to use well currently when you're using an FHA setup the developer or the user really needs to know C Coby quite well in order to choose the right system and parameters the system we happen to use primarily at the moment is called bfv there's another one that we're working on called tfhe which is based on tus elements um and there's other kinds of things where you have to know polom polinomial arithmetic and other types of things like that so it gets quite complicated making a uh computation performant is quite difficult even for experts there's a lot of parameters involved in trying to tune these systems such that you kind of have a trade-off of security and speed and data size and these types of things finding the optimal tuning parameters inside there can take quite a bit of time um you can get incorrect results if while performing a computation if it's not quite performed properly so essentially any encrypted data one of the kind of tenants of encryption is that there's always some sort of Randomness in the case of schemes that we're using there's a bit of noise that's added added to the message to Opus skate it so that noise that's added uh grows as you perform more operations on the encrypted data and there might be a certain point where you perform too many operations on encrypted data to be able to correctly decrypt it you will be able to decrypt it but it will just give you some random number instead the result that you want and then it's also hard to translate uh some problems into FH primitive so the main Primitives for the BFD scheme that we use is addition and multiplication turns out you can express any computation using those Primitives uh some more difficult than others but it's hard to necessarily take your program that you just write in Rust and then turn it into an FHA program by trying to figure out exactly how those maps to map to arithmetic circuits so that's where we come in with the sunscreen FHA compiler so the sunc sunscreen F compiler makes it easy to convert standard rust into encrypted form that work on encrypted data so here we have our ad example that we were talking about before just in the working on Plain Text data on clear Text data so you just take an a that's a signed value a b that's a sign value and you return another sign value and then it's just the addition of them now the only changes that you need to make in order to turn this into encrypted version uh is essentially a macro on top and some types so essentially you add this uh attribute on top you say FH program currently this scheme that's supported is BFB we're adding support for other schemes as well and then you'll notice here that the type changes so the type before was just I64 signed is the equivalent of I64 and then the wrapper Cipher essentially means that it's encrypted so how do we run this program it's not quite as simple as running just a regular rust program where you just call ad with whatever values you need to encrypt the data first that's since we're working with encrypted data so the way this works is that you uh call the comp you make a new instance of it and then you add in the program that you want to compile this will generate a application um that has some parameters so it basically runs your program to try to figure out what are the optimal parameters in order to make your computation fast and perform it yet still secure you then pass these parameters to a runtime and then get out the FHA program that you want to run you can then with that runtime generate the uh keys in order to generate encrypted data so this is kind of like SSH or any sort of asymmetric Key System where the public key is used for encrypting and the private key is used for decrypting in this case we'll be encrypting just the numbers 15 and five and then finally we'll run the program using our runtime so here we just pass it the program that we want to run add and then we pass in the values so add with A and B also passing in the public key this will produce an encrypted result so that Rec crypted that result has type of essentially Cipher of signed and then we can decrypt that result um using our private key so at this point you could consider all of this was done on a local machine but one thing that's kind of nice about all this is that most of these types are serializable so you can take the cipher text the plain text Data sorry the encrypted data or the plain text Data uh you can take the programs themselves and also the parameters and send them over to a server to be run so what type typ of data do we support with sunscreen so we have a few basic types one of them is a equivalent to a unsigned u64 we also have different bitwidth of that one so we have unsigned 256 and those types of things these ones support under the BFB scheme essentially plus minus and multiply um and then you can also operate on both plain text and encrypted inputs we also have a signed variant that essentially um is the equivalent of an I64 and has the same properties as this unsigned but also has the ability to do negation so if you had five you could have now negative five but encrypted we also have fractional values you can somewhat think of these is floating point they're more akin to fixed Point essentially the fractional that n value there is how many bits you want for the integer part and the rest of the um decimal part is actually related to the parameters chosen by the scheme often times you have many more decimal parameters than you would in a standard floating point so if you have Dimension 1024 if you're using only 64 bits for the integer part all of the rest of them are for the the decimal part so the advantage of this is that you can do kind of more like arithmetic on closer to real numbers um and you can also divide in this case by a a constant value not by an encrypted value but by a constant floating point value and then we also have a rational type so the rational you can somewhat think of as a signed over signed type and this one actually has all the properties that you could think of before except for as signed except for you can decrypt by an encrypted divide by encrypted value One Thing to note is that the first three are more performant than the last one um so the last one because you essentially are doubling the amount of Cipher text you're dealing with you have now two assign value over a sign value you're now dealing with something where um it takes more or takes more time to compute things the noise grows faster so you'll have to put in more refresh operations um the other part that you've seen here so far with relation to types is that Cipher wrapper so if you see Cipher of T that denotes that you have an encrypted value and either an argument or a return type uh the absence of this wrapper just says that you have the unencrypted type so that one's something somewhat easier you can just say like s. into to get like a unsigned or signed variant of that one Cipher is unique in the sense that uh it's not possible to just do a if you're familiar with Russ there's no like from trait or into trait you can't just generate one you have to use the encrypt and decrypt functions in order to generate a cipher value so uh talk a little bit about like how you can basically test in different types of cases so here you can test a function that's both generic and the encrypted variant so here we have ad but we've made it generic over a type T where we've said that the type T essentially has to implement the ad function and then if we want to use it in encrypted form what we do is that we just now call that function with the parameters that we were interested in with the types we were interested in so what's the value of this we're able to uh test functions in both an unencrypted sense and an encrypted text context and this enables F programs over many more types so one thing that needs to be known by the FHA compiler is that it needs to know exactly what types you're dealing with when it tries to compile the program you might not want to write this encrypted ad for absolutely every single uh types you might have as an input like you could have Cipher signed and then signed as b or you could have signed and uh Cipher signed you don't want to write all those variants what you can do is write the generic type or generic function up top and then and call it with the types that you care about we can also accept mixed inputs so for example what you could do is uh and these performance these operations are cheaper than the encrypted encrypted variants but essentially both sides of an equation don't necessarily have to be encrypted so here we're taking a and b but in this case b is not encrypted it's just a plain text value so we're taking encrypted value and then adding in a plain text value we also support operations of over arrays so here is an example of an array using the generics that we had talked about prior where we uh have a array of sub size n and then one thing to note here is that when we're dealing with this one is that we actually don't we don't have a definition of zero so we actually pull out the first element and call that and iterate over that use it as our place to uh store all of our data so we first pull out the zero element and then we take add to that each successive data element in the array then if we want call this in the encrypted form we just call our generic function that we have with the types that we care about now note that for this to work because the compilers essentially needs to know how many operations you're performing in order to generate the correct parameters what it will do is you need to have that 10 some sort of const generic or constant number there that it knows about so it can actually compile your program correctly so what's important to know here is you can operate on arrays but you cannot operate on dynamically sized objects such as vectors now now what you can do is you can write a program that expects a certain size collect data with a vector outside of the FH program and then try something like try into in order to try to convert it into a array and then use that array inside your FHA program then the failure will happen before you do the FH computation itself um there are some restrictions so there's no comparisons in the BF scheme we are working on a scheme that does allow for comparisons but essentially you can't say here is a was somewhat equivalent to a MX circuit if you're familiar with uh Hardware so essentially you would take a select bit and you want to say if it's one then you select a if it's zero then you select B uh this will not work because you need to basically uh you cannot do that comparison there that if select equals one component however comparisons are okay if you do it on uh constant data that is not actually pass into the function so here we have data that says we have the for Loop that generates an index and then we have if on the index of that for Loop that is okay because none of that data is actually coming in from the input arguments themselves um we also can't similarly operate on uh something where we don't know the size of it before runtime so here we have a for Loop and the problem is is that we're essentially going from zero to B whatever the size of B is um or whatever that value is but since we don't know what that value is when we try to compile the program we can't actually run this one um so the sunscreen compiler will tell us this and make it impossible to actually run what you can do similar to the other one is that if you have constant Expressions here you happen to know that you're doing five iterations then you can run a for Loop um there's some other operations that probably are a little bit uh the suncreen compiler will detect for you um and you generally want to avoid them anyway so it's good that we find them so essentially there's cases where you can do operations on encrypted data that probably will uh break the security of your system so one of them is if you take a Cypher Tex if you take some encrypted data and subtract it from itself they'll necessarily always be zero um so we generally don't want to do that that leasts information about kind of what's going on in the system what you can do is that if you had instead that subtraction where you took in a b type as well or a B value uh of Cipher signed you could subtract those if they were encrypted independently so encrypted under the same key two pieces of encrypted data they both look completely random those you can subtract the data inside will be zero the underlying message but the um that will be an allowed operation similarly if you multiply by a just plain text zero that's also a bad case that will just lead to encrypted data that's all zero all of the message and Randomness is gone and similarly to the prior case if you supply an encrypted zero then it is okay um because then you're taking an encrypted data which again looks kind of like random numbers and you multiply random numbers by random numers numbers and get out what looks random um there's also bounds on the computation so essentially uh i' mentioned that the cyer Tex has a bit of noise in it along with your message every every time you process that data the noise grows within it so there's a limit to how much you can do before you can no longer decrypt the data here in this case um the sunscreen compiler will also tell you that it was unable to any parameters that will basically satisfy this I've done too many operations in order to uh corly perform this uh repeated multiply so let's look at some examples of f programs we're going to go through three basic examples one we're going to calculate the statistics uh on top of encrypted values for the next set of examples I'll show you through some websites that we have some private ml inference on a few different cases and the final case will be uh how to perform private auctions so for the statistics on encrypted data so say a service wants to provide some statistics for a client um in this case we're going to focus on mean and variance but they don't necessarily want to share the user doesn't want to share their data with the server and potentially the server doesn't want to provide the information required to process the data so maybe they have a proprietary model for how they understand the data that they have or the data that they are receiving so in this case um we'll go through the code a little bit it should look pretty familiar to the sum case so this is the Sim equivalent to the sum case where we have a generic function where we're taking out the first value and then we're adding into that value as a like temporary storage um the difference here is that now we also have an additional constraint by this divide by f64 so now we're saying not only do we need types that it support add we also need types that support division by floating points um and then you can see here that we actually do perform that so when you're doing the mean it's the sum of all the values divided by the number of values um so we are able to do this if we use either a fractional or a rational type now for the variance the Varian is uh calculation of the variance is essentially you take the mean of the of the data you subtract each data element from that mean Square it and then divide by the number of elements here you can see that we're doing that so the um we have a few more constraints related to the fact that we're now going to do some subtraction and multiplication um and later on we'll use the mean so we'll need the division part so essentially we calculate the mean we clone the variance in order to get each data value again and then the for Loop essentially just does that mean subtraction and then does the squaring without using the PO function it just does it by the temporary value times itself and then we run that mean function on the variance that we pass in now note what's kind of cool here is that we can reuse the FHA functions that we had before so this allows us to compose FHA programs and kind of build up a Library without having to manually or Silo each of our programs away from each other and then to run the data is kind of as you would expect um the server can run the encrypted data by essentially specializing this generic types or generic functions we have for the types that we care about um and so this allows for a few different things as mentioned before the user gets to keep their data private the server also gets to keep its statistics model private so if it has any private weights it might have some plain text Data related to I have some sort of model and I have plain text Data related to uh the weight I've assigned to certain variables this will allow the server to keep those private uh we also have private machine learning as an example so uh we can do FHA based ml inference that allows users to keep their data private and to keep the ml model also staying on the server so the user doesn't necessarily need to download that ml model um so see for this example um we have a few different cases here uh we're having a this is a demo that runs on a server in AWS and essentially what it does is asks whether or not a transaction is fraudulent based on some information so here I'm going to uh start predicting this but essentially the framers that go in are a distance from home purchase price the distance from the last transaction and the median price along with some information as to whether or not the chip was used or the card was used itself so this data is encrypted and then sent up to a server processed and then returned this particular case is a uh three- layer neural network so essentially the user is able to send up their data get information such as this transaction looks legitimate and then um receive the result and only private to them so the server actually never learns anything about whether or not that transaction they don't know anything actually about the transaction they don't know what the purchase price was they don't know what the distance from home was they don't know anything they just know that they received some sort of data related to transaction that they threw it through their model and that they gave it back to the user to then decrypt the result so here uh we're running a another example where the distance from home is significantly higher and it's an online purchase so here the model that was detected uh detects fraud um then as a kind of another example uh here this is a different um case where we're trying to detect whether or not you have a high risk of a heart attack so in this case we're not using a neural network but logistic regression so here if we fill out the form with kind of the information that would predict a high case of heart attack we can send that to the server um and then you can see here that it says you have a high risk of a heart attack so this information could be sent um say to some sort of maybe a user wants to know about this without necessarily providing their um Health provider or someone else with information about their current health status they want to know some information um but they don't want to reveal it and then similarly the server doesn't have to reveal how it actually calculate this component um and then finally the last example we go through are blind auctions so blind auctions are where all bids are private you don't actually know unlike a normal auction maybe where you're sitting there and you're trying to figure out hey like uh someone else bid $5 now I'm going to bid $6 and I've know the history of this particular person always bids in this particular behavior and trying to come up with a strategy here uh you can't actually do that all bids are private um and what happens is that only the winner is determined um and reveals their bid and is able to purchase whatever the item is so there's some benefits to this model uh sometimes you also hear it as called it's similar to something called a Dutch auction um so you don't reveal the strategy that you're using in order to bid on something uh should you lose so if you win you do reveal something about a small amount of information related to the maximum price you're willing to pay for something or what you believe is at a reasonable price but if you lose you don't necessarily reveal any of your bidding history um additionally it often leads to more genuine bidding because people because they don't know the context of others bidding on the item they'll bid what they think is the fair market price for it um so the question is can we do this without necessarily trusting a third party if we were to buy provide all these bids to a third party one of the challenges might be is that they could potentially put in their own bid that supersedes any of ours or maybe we just don't trust them in general to run the the computation so here is an example of doing that so here we have um and this is online that on our blog so you can basically see that there's 92 other people who are bidding virtually in this case from a server um or they simulated and then we can put in a bid ourselves so the bids in this case must between must be between 5 million and 7 million so we can participate in the auction by sending up our bid it'll all be executed uh and then we'll find out who the whether or not we won uh in this case we didn't and for specifically just the fact that this is a demo um we can see what they actually bid as a value so this case it was 6,997 th000 um however if we provide a if we provide the maximum we're highly likely to win this auction and then you can see here that it says that you are the winning bid so in this case this is using uh what I've talked about before we have the BF scheme this is based on work on the tfhe so this does allow for comparisons but here you can see other applications where we providing people with an ability to participate in auctions privately and keeping their data secure um so with that uh that's the introduction I have to the sunscreen FHA compiler the sun sunscreen FH compiler makes it easy to make privacy preserving applications it reduces the risk of malicious data use because the data is encrypted and even the server doesn't know what's inside of it uh it reduces the effects of data leaks and also it gives users control of their data privacy now they are in control of the keys and they pass off the data to the server and they know that the server can't do anything with it they don't know any information about it and only they can decrypt the results so with that uh I you can ask me some questions there's also these QR codes that will provide you some information on we have a rust playground which is similar to The Standard rust playground but has our specific sunscreen compiler and the documentation we have for the compiler [Applause] itself would you like questions sure just um currently we don't support strings uh you could try to essentially encode strings using a like say for example you could use unside integers and use an asking encoding the question is what is like the our compiler mostly supports addition and multiplication so what does it mean to add two strings that once's a little bit more difficult um so we don't currently have support for string based values yeah so we are working on comp so as I had mentioned that we have the um TF which is the Taurus FH based scheme so we are working on implementing that we don't have a ton of details at the moment but they'll be coming out soon as you can see the blind auction was an example of using tfhe so we are well on our way to actually like providing support with that within the sunscreen compiler that case will be also like kind of like everything else in cryptography there's a little bit of a trade-off so if you want fast comparisons TF will probably be the thing you want to try if you want fast arithmetic and doing like data processing and ml stuff bfv will probably be the scheme that you choose yes like data sent in an array where indidual separately or the ARR all at I guess kind like is there a problem where the typical data that gets sent tends to be small numbers that people can just Pro for it because only number vales yeah so uh as your first question so the way our compiler works is that when you encrypt an array you can send over the whole thing at once um as for whether or not small values are a problem so one thing that's kind of nice about these schemes is that when you they're encoded so the plain Text data is like quite a small modulus so you might have like data between say two and a TH or something or zero and a thousand um however the actual space of Cipher text Data of encrypted data is is very large often times like the product of four primes four unsigned large primes so at that point you're dealing with data that's like randomly distributed over a much larger Cipher teex space so even if you collected a bunch of uh data it wouldn't necessarily give you an option to reverse that so there's if you're interested in kind of some more details on these things there's two topics called uh chosen plain text and chosen Cipher text attacks and then those will give you more information on kind of like what FHA is uh more like where f in those security parameters yes enen yeah uh so you can certainly do it in any language the mathematics of course is agnostic to the programming language in question the reason why we chose Russ is because um performance is a key challenge for fhe and specifically also data management because the cyper text can be so say encrypt one bit it could be a thousand times larger just encrypt that one bit than the one bit itself so you don't necessarily want to you want to use the move semantics of rust to like move values around and not copy them as much as possible um which is a little bit harder in some other languages having said that one thing that we also have supported in the past is that we have cases where we provided wrappers for uh Python and in solidity in one case for the ethereum blockchain so you're able to perform encrypted operations in those Languages by calling rust on the back end yes I guess at this point if you have more questions I invite you to go up to the Q&A Island up on the fourth floor figure yeah but thank you very much everybody joining thanks yeah thank you for attending thank [Applause] you