Fully Homomorphic Encryption to make Web3 safe(r)
Private Smart Contracts Using Homomorphic Encryption



× 
  ⚠️🚀 Zama released the alpha code and white paper for the fhEVM.
  See it on Github here, and please ⭐ star the repo to support our work.
FHE EVM demo - watch video
‍Homomorphic encryption (FHE) is a technology that enables processing data without decrypting it. This can be used to create private smart contracts on top of public, permissionless blockchains, where only specific users would be able to see the transaction data and contract states. While FHE used to be too slow to be practical, recent breakthroughs are now making this possible in the next couple of years.‍Note: this blog post is an updated version of Rand Hindi's presentation during EDCON 2023.‍‍Private smart contracts using homomorphic encryptionEverything on a blockchain is publicHow else would nodes agree on state?This makes web3 unsafe‍Theft‍Criminals can see what you own, so they can easily target you and steal your crypto.‍Surveillance‍Governments can surveil you, even if you use multiple addresses.‍‍MEV‍Bots can front-run you, creating a hidden tax on every transaction.‍Homomorphic Encryption (FHE) enables encrypted data processinge.g. $ Enc(a) + Enc(b) = Enc(a+b) $ or more generally $ f(Enc(x)) = Enc(f(x)) $.FHE enables privacy in smart contracts while keeping everything on-chainEncrypted transaction dataData included in transactions is encrypted and never visible to anyone.‍Encrypted state updatesStates are updated while remaining encrypted at all times. Not even block producers can see the data.‍Encrypted on-chain dataData stored on-chain remains encrypted end-to-end, even when used by smart contacts.‍Some cool use cases enabled by FHE‍Trustless bridgesUse an encrypted key to sign bridge transactions homomorphically.‍‍Blind auctionsGreat for NFT auctions, RWAs, DeFi darkpools, marketplaces, etc...‍‍Confidential votingKeep choices and token amounts encrypted when voting.‍ZK is for scalability, FHE is for privacy‍Homomorphic Encryption 101Ciphertext = encrypted data + noiseWe need to add random noise to the encrypted data to guarantee security.Problem: noise grows with every operationIf the noise grows too big, it will overwrite bits of data with random ones.On-chain states can be updated indefinitelyThis means noise will eventually grow too big and lead to incorrect states.‍Bootstrapping reduces noiseBootstrapping is a special operation that resets the noise to its nominal level.How can we compute exact comparisons?Using additions and multiplications alone can only approximate them.TFHE to the rescueTFHE is a scheme that enables fast bootstrapping and exact arbitrary computations.TFHE bootstrapping is programmableFHE is getting exponentially fasterFHE smart contracts are doable today, with a throughput of ~5 tps. FHE ASICs will enable 1,000+ tps at a fraction of the cost.Zama FHE performance (Million FHE gates/$)‍A private smart contract protocol using (T)FHEWhat we want‍Simple user experienceUsers should interact with a private contract the same way they interact with a public one.‍Simple developer experienceDevelopers should not have to learn a new language to write private smart contracts.‍Simple integrationChains should have as little to integrate as possible, and not disrupt their existing ecosystem.‍FHE token contract in SolidityThere are many technical challengesAccess controlHow do we selectively decrypt states without a centralized decryption key?‍‍ComposabilityHow can contracts be composable without breaking privacy?‍‍PerformanceHow do we increase throughput while keeping block sizes small?‍Secure the private key with Threshold FHESplit the secret key amongst validators such that at least 2/3 are needed for decryption.1. Secret sharingGenerate and distribute pieces of the secret key to each validator.2. Partial decryptionEach validator then does a partial decryption (or keyswitch).3. AggregationThe partial decryptions are aggregated to yield the full decrypted value.Note: Needs a fixed number of validators such as in DPoS, NPoS, etc..Zero-knowledge proof of input awarenessUsers need to submit a proof that they know the value of the encrypted inputs.1. Encrypt dataUsers encrypt the transaction inputs they want to keep secret.‍2. Generate proofThey then generate a zero-knowledge proof to show they know the inputs.‍3. Validate proofValidators then check the input proofs before executing transactions.‍Next: going from 5 tps to 1000+ tps‍TrancipheringTranciphering allows sending encrypted inputs with minimal size expansion vs plaintext.‍‍FHE-rollupsOptimistic FHE rollups are already possible, and ZK FHE rollups will be possible within ~3 years.‍HW accelerationFHE hardware accelerators are coming in 2025 and will speedup FHE by 1000x or more.‍‍‍Dr Rand Hindi is the CEO at Zama and an investor in 30+ companies across privacy, AI, blockchain, medtech and psychedelics.Follow Rand on Twitter.