Nigel Smart谈MPC系统

欢迎收听《零知识》播客，我们将带您探索区块链技术和去中心化网络的最新动态。

Welcome to Zero Knowledge, a podcast where we explore the latest in blockchain technology and the decentralized web.

本节目由我安娜主持。

The show is hosted by me, Anna.

还有我弗雷德里克。

And me, Frederic.

在本期节目中，我们邀请到了密码学教授奈杰尔·斯马特，一起探讨多方计算技术。

In this episode, we sit down with Nigel Smart, professor in cryptology, to talk about multi party computation.

在开始之前，我们要感谢本周的赞助商StarkWare。

Before we start, we want to say thank you to this week's sponsor, StarkWare.

StarkWare将于9月16日在特拉维夫举办StarkWare技术交流会。

StarkWare will be putting together the StarkWare sessions in Tel Aviv on September 16.

此次活动将汇聚零知识证明领域最杰出的学者和应用实践者。

The event will be bringing together brightest minds in the field of zero knowledge proofs from both the academic and application arenas.

讨论主题包括自主托管交易、一层网络的Stark技术、Stark友好型哈希函数，以及Stark证明的其他创新应用。

Topics that will be discussed are self custodial trading, Starks for layer one, Stark friendly hash functions and other cool things you can do with Stark proofs.

另外，我将主持其中一个分会场。

Also, I will be hosting one of the stages.

所以如果你对这项激动人心的尖端技术感兴趣，请务必参加Stark研讨会，或者提前一天参加Stark入门工作坊，在那里你可以从零开始构建一个Stark证明器。

So if you're interested in this exciting cutting edge tech, do join the Stark recessions, or come a day early for the Stark one zero one workshop where you could build a Stark prover from scratch.

使用优惠码zkpodcast可享受任何门票8折优惠。

Use the code z k podcast to get 20% off any ticket.

我们大约有50个这样的优惠名额，所以赶快行动吧。

We have about 50 of these available, so get it fast.

再次感谢Starkware对本播客的支持。

So, again, thank you Starkware for supporting this podcast.

现在请收听我们对Nigel Smart的采访。

And now here's our interview with Nigel Smart.

今天我们想坐下来聊聊MPC系统，我们请到了可能是最适合的嘉宾——Nigel Smart教授，他是鲁汶大学密码学教授，也是Unbound Tech的联合创始人。

So we wanna sit down today and talk about MPC systems, and we have one of the possibly best guests to do so, Nigel Smart, professor at Cryptology at KU Loven and the co founder of Unbound Tech.

欢迎来到节目，Nigel。

Welcome to the show, Nigel.

哦，欢迎。

Oh, welcome.

很高兴来到这里。

Nice to be here.

和往常一样，安娜也在我们这里。

And we have Anna with us as usual.

你好？

Hello?

你好。

Hello.

那么作为开场，奈杰尔，如果你能回想一下最初进入这个领域的时候，密码学中真正让你感到兴奋并想要投身于此的是什么？

So to kick it off, Nigel, if you can think back to when you first started in this space, what is it about cryptography that really got you excited and wanted to to work in this space?

好的。

Okay.

最初我是学数学出身的，后来我发现那真的赚不到什么钱。

So originally, I trained as a mathematician and and then I realized there really wasn't much money in that.

所以情况大致是，如果你像我当初那样研究这类数学，你会想着要赚钱或不想受穷，那么你就会选择密码学。在九十年代中期，这门学科刚开始被广泛应用，因为互联网那时刚刚兴起等等。

And so it was much if you're doing this kind of maths I was doing and you go, I wanna make money or I don't wanna be poor, then what you do is you do cryptography, which in those days in the, like mid nineties was just beginning to be deployed, you know, everywhere because the internet had just started, etcetera.

我知道很多人是通过军方接触到密码学的。

I know a lot of people who got into cryptography through like the military.

比如在瑞典，我们有那种为期一年半左右的服役制度。

So either through in Sweden we have like this thing you go through for a year and a half or something.

他们就是通过那种途径进入这个领域的。

They get into it through that.

你有接触过军方背景的密码学应用吗？

Did you ever have that exposure to like the military side of it?

并没有。

Not really.

当然，当你参加国际会议时，总会遇到来自各国政府机构的人，有的机构名称是三个字母缩写，有的是四个，还有五个的，视国家而定。

Of course, when you turn up at all the international conferences, there are various people from various government agencies there, some with three letter and acronyms and some with four, some with five, depending on the country.

他们总是试图假装自己不在场，但其实都在。

And they always try and pretend they're not there, but they are.

所以你多少会见到这些人。

So you kind of you kind of get to see these people.

是啊。

Yeah.

我有个问题想问，关于你目前的研究方向，因为你是密码学教授，而不是密码技术教授。

So I have a question about, what you're working on right now because you're a professor of cryptology, not cryptography.

对。

Yeah.

这两者有什么区别？

What is the difference between those two things?

好的。

Okay.

密码学是设计和破解密码的科学。

So cryptology is the science of making and breaking ciphers.

密码技术是设计密码的科学，而密码分析则是破解密码的科学。

So cryptography is the science of making ciphers, and cryptanalysis is the science of breaking them.

如果你两者都做，那你就是在做密码学。

And if you do both, you do cryptology.

国际密码学协会，代表全球所有密码学家，尽管其成员都是密码学家，却被称为国际密码学协会。

So the, International Association, which represents all the cryptographers in the world, is called the International Association of Cryptologic Research, even though everyone in it is a cryptographer.

所以我想你可能是我们节目中的首批嘉宾之一，虽然不是第一个，但你是少数几位非区块链领域直接出身的嘉宾。

So I think you're one of the first maybe not the first guest, but you're one of the few guests that we've had on, that aren't necessarily coming straight out of the blockchain space.

但我的问题是，你与区块链领域有什么互动？

But my question is, have you I mean, what is your interaction with the blockchain space?

因为我了解到你曾与一些团体合作过。

Because I understand you have done some work with groups.

好的，首先，

So okay.

你必须明白区块链不等于加密货币。

So first, you've got to understand that blockchain isn't cryptocurrencies.

密码学中有两个信条：加密指的是密码学，不是加密货币；另一个是区块链不等于加密货币。

So there's two mantras in cryptography is crypto means cryptology, or crypto means cryptography, not cryptocurrency, and the other one is blockchain does not mean cryptocurrency.

好的。

Okay.

区块链在加密货币领域之外有很多应用。

So blockchains have a lot of applications outside of the cryptocurrency space.

而且在企业领域，许多区块链并不一定需要工作量证明。

And also in terms of corporate land, a lot of blockchains do not necessarily need proofs of work.

工作量证明在比特币这类系统中起到的作用是解决共识问题。

So you could do, so what proof of work gives you in something like Bitcoin is, it solves the consensus problem.

但如果你有所谓的许可区块链，还有其他方法可以解决共识问题。

But there are other ways to solve consensus problems if you have so called a provision blockchains.

因此有很多应用使用区块链作为基础，但配合许可服务，这时区块链被用作一种仅追加的数据库。

So there's a lot of applications around that use a blockchain as, but with provision services, and there what you're doing is you're using a blockchain as a, what's called a, like an append only database.

这使得数据库应用比使用标准分布式数据库更简单些，后者存在锁定和解锁等问题。

So it allows you to do database applications which are slightly simpler than using standard distributed databases where you have issues of locking and unlocking etcetera.

是的，我曾为这个领域的多家公司提供咨询，主要是金融行业的公司。

Yes, I've been advised to a number of companies in this space, mainly in the financial sector.

这很有趣。

That's interesting.

所以你接触过很多所谓的私有区块链，但你有接触过公共领域的项目吗？

So you've touched a lot of these quote unquote private blockchains, but have you touched anything in the public space?

我是说像Zcash这类更新潮的技术。

I mean there's like Zcash and a lot of these newer fancier things.

是的。

Yeah.

好的。

Okay.

我没有

I haven't

接触过复杂的加密技术。

touched complicated crypto.

我确实没有直接参与过像Zcash这样的公共区块链应用开发，但我认识背后的团队，我们经常交流，所以是的。

So I haven't explicitly worked on on any of the the public blockchain applications like Zcash, but I know the people behind them and we all talk to each other and so yeah.

所以这是一个非常、非常小的圈子，是的。

So it's a very, very small community Yeah.

他们清楚正在发生什么。

Who know what know what's going on.

特别是Zcash，我想，我们今天要讨论MPC，他们确实有。

Particularly Zcash, I think, I mean, we're going to be talking today about MPC and they have Yeah.

一个非常、非常著名的MPC应用案例。

A very, very famous case of using MPC.

我认为，在区块链社区里，第一个让人们真正理解MPC作用的就是Zcash的创始仪式，那是个很有意思的一次性应用。

I think, yeah, I think in the in in the blockchain community, the first, you know, thing that made people in the blockchain community understand that what MPC was doing was the Zcash opening ceremony, which was kind of an interesting one off application.

但你现在实际看到的，特别是在加密货币领域，是加密资产托管，现在有很多应用场景使用MPC进行授权和签名操作，这些操作比以往更高效，也更适合实际应用。

But what you're actually seeing, especially in return to when you go to cryptocurrencies, is crypto custodianship, is a lot of applications now there for MPC to do authorization and signing operations, which are more efficient and match the application much better than than previously.

加密货币的好处在于它催生了许多有趣的应用，不像传统金融机构或普通公司，它们绝对是高科技的早期采用者。

So there's cryptocurrency is good in that it generates lots of interesting unlike normal financial institutions or normal companies, they're they are definitely early adopters of high-tech.

我们的听众可能注意到的一点是我们发音MPC的方式。

One thing our listeners may be noticing is the way that we're pronouncing MPC.

是的。

Yeah.

而不是说MPCs。

And not saying MPCs.

因为我最近从奈杰尔那里了解到，用MPC的复数形式实际上是非常不正确的。

Because as I learned recently from Nigel, that's actually very incorrect to use MPC in plural.

MPCs这种说法没有意义。

MPCs doesn't make sense.

所以告诉我们为什么

So tell us why that

是这样。

is.

好的。

Okay.

当你谈论零知识证明时，它指的是一个特定的事物。

So when you talk about the zero knowledge proof, it's a thing.

所以你可以讨论复数形式的事物。

So you can talk about plural things.

所以你可以讨论零知识证明（复数形式）。

So you can talk about zero knowledge proofs.

所以你可以讨论ZKPs（零知识证明的复数形式）。

So you can talk you can talk about ZKPs.

这样才说得通。

So that makes sense.

而MPC代表多方计算。

Whereas MPC stands for multi party computation.

因此它是一种技术，如果你用复数形式，就是在讨论多方计算过程，而非这项技术本身。

Therefore it's a technology and if you pluralized it, you'll be talking about multi party computations and therefore you're talking about something that's a processes that's going on rather than a technology.

如果你想讨论这项技术的复数形式，就像可能有一个软件实现某个版本的MPC，另一个软件实现另一个MPC版本，这些就是两个MPC系统。

So it so if you if you want to talk about the technology and pluralize it, it's like you might have a piece of software that does one version of MPC and another version of software that does MPC, they would these would be two MPC systems.

确实如此。

So yeah.

明白了。

Got it.

感谢你与我们分享并澄清这一点。

Thank you for sharing that with us and for clarifying.

我知道我们和业内其他人经常犯这个错误，所以了解这一点很好。

I know that I think we and others in the space have made this mistake a lot, and so this is good to know.

是的。

Yeah.

当你遇到缩写词时，最好先弄清楚它实际代表什么，再决定能否使用复数形式。

It's whenever you have initials, it's always good to understand what go back to what they actually stand for to decide whether you can pluralize it or not.

你能说'FHEs'吗？

Can you say FHEs?

如果你指的是密文，那就可以谈论'FHEs'，因为它们属于加密范畴。

Well, you can talk about FHEs if you're talking about the ciphertext because they're encryption.

如果你对x和y分别进行加密，那么它们就是多个加密实例。

So if you take an encryption of x and an encryption of y, then they are encryptions.

但实际上你指的是x和y的具体加密实例。

But they are you're actually talking about the specific encryptions of x and y.

而如果你想讨论FHE作为一种技术或不同类型的技术，你会说FHE技术。

Whereas if you want to talk about FHE as a technology or different types of technology, you talk about FHE technologies.

就像你说NPCs时，指的是实际正在进行的有效计算。

Like, if you're saying NPCs, you're talking about the actual computations that are good taking place.

对。

Yeah.

没错。

Exactly.

是的。

Yeah.

对。

Yeah.

嗯。

Yeah.

我之前在这个播客里做过一期关于MPC的内容，说实话，可能算不上是最好的开场。

Did an episode on MPC on this podcast before, and, you know, if I'm honest with myself, it's probably not the best intro ever.

但那只是你我之间的对话。

But It was just it was just you and me.

当时只有我和弗雷德里克在场，所以我们并没有让任何嘉宾难堪。

It was me it was just myself and Frederic, so this wasn't like we're putting any guest under the bus here.

是啊。

Yeah.

不过我很好奇想听听你的看法，奈杰尔，如果要简单介绍一下什么是MPC，你会怎么说？

But I'm curious to hear from you, Nigel, what would your, like, short introduction to just explaining what MPC is be?

好的。

Okay.

想象你有两组、三组或四组数据，你想在不暴露原始数据的情况下对这些联合数据执行函数计算。

So imagine you've got two sets of data, or three sets of data, four sets of data, and you want to compute a function on the joint data without revealing what the data is.

并且希望通过协议执行这种计算来完成。

And want to do this via a protocol by doing a computation.

所以这是多方参与、多组数据，在它们的联合输入上进行计算，而你唯一能获取的就是输出结果。

So it's multiple parties, multiple pieces of data, doing a computation on their joint input with and the only thing you learn is the output.

一个很好的实际应用案例就是医院场景。

So a really good example, a practical example that's used is hospitals.

医院掌握着患者的医疗数据，而你可能需要进行某些医学统计研究。

Hospitals have information on patients, and you might want to do some medical, statistical experiment.

这样你就能在不公开各医院患者信息的前提下，对多家医院的联合数据进行医学统计分析。

So you could do a medical statistical experiment on the joint data of the hospitals without each hospital having to reveal the information about their patients.

这在技术实现层面会是什么样子的？

What would that look like on on the sort of technical front?

具体是说每家医院都需要在计算机上运行什么程序吗？

Like, would that actually be each hospital, like running something on a computer?

整个流程会怎么运作呢？

Like, what would that look like?

具体表现为：每家医院都有独立的数据库，连接数据库的计算机从自家库中提取数据，然后与其他医院的计算机执行协议流程。最终协议结束时，你就能得到想要的统计结果——而任何医院都无法获取其他医院的原始数据。

So it looked like, each hospital would have their own separate database and they would have computers that attach to the database, and the computers would pull data from their own database and then engage in a protocol with the other hospitals, and at the end of the protocol, out pops the statistical answer you want, and what doesn't pop out to either hospital is the other hospital's data.

这在数学上保证了这些信息不会被泄露。

And this is mathematically guaranteed this doesn't pop out.

所以无论你进行多少黑客尝试，都能确保不会有额外信息泄露。

So it's you don't you know, no matter how much, you know, hackery you do, you're guaranteed that there's no extra information that jumps out.

我猜它还能保证共享的信息或那个指标是正确的。

Does it also I guess it also guarantees that the information that is shared or that, like, that metric is correct.

对。

Yeah.

对。

Yeah.

对。

Yeah.

所以你还能确保结果的正确性。

So you also get correctness of the results.

不过，你无法防止人们撒谎。

So, you can't protect against people lying.

所以如果一家医院谎报数据，你也无能为力。

So if one hospital lies about its data, that's all you can do.

但你可以防止某家医院计算出错。

But you can prevent a hospital, one of the hospitals doing the wrong calculation.

因此他们必须达成正确的计算共识，执行相同的计算。

So they all agree on the right calculation, they have to both do the same calculation.

在我们的介绍集中，我们从求解多项式的角度讲解了多方计算。

So in our introduction episode we covered MPC from the perspective of solving polynomials.

这是我们深入探讨的基础理论。

That's our fundamentals that we go into.

你认为现代多方计算系统本质上还是在构建和求解多项式方程吗？还是说已经远远超越了这一范畴？

Would you say that modern MPC systems are still like fundamentally, you know, constructing and and solving polynomial equations or has it moved way beyond that?

噢，这个嘛...

Oh, it's, yeah.

它不只是解多项式方程，你可以进行任何计算。

It's not just solving polynomial equations, so you could do any computation.

从八十年代起，我们就知道任何明文中可计算的内容，我们都能安全地计算。

So from the eighties, we knew that any any anything you can compute in the clear, we can compute securely.

是的。

Yeah.

所以理论上，任何你想进行的计算我们都能实现。

So if you have any computation you wanna do, in theory, we can do that computation.

实际上这取决于技术和具体需求，但理论上我们可以计算任何内容。

In practice, that depends on the technology and what you want to do, but in theory we can compute anything.

一个很好的例子是美国政府几年前实施的卫星项目。

A really good example that was done in a US government program a few years ago is satellite.

有两颗卫星环绕地球运行，有时卫星会相撞，代价极其昂贵。

There are two satellites going around around the earth, and sometimes satellites hit each other and it's really expensive.

明白吗？

Okay?

所以关键是要确保半数卫星不会相互碰撞。

So but what you wanna do is you wanna avoid make sure that half satellites don't hit each other.

另一方面，各国并不太愿意透露他们卫星的实际位置。

On the other hand, countries aren't really very keen on revealing where their satellite actually is.

是的。

Yeah.

所以你可以想象，卫星正飞越某个国家的事实，你可能并不想知道。

So you can imagine though the fact that the satellite is going over a country, you might not want to know that.

因此实际上，在那个我曾参与的美国政府项目中，一些人做了多方安全计算：一个国家知道自己的卫星位置和飞行方向，另一个国家也知道自己的，然后在不透露卫星位置的情况下，计算出卫星是否会相撞以及是否需要改变轨道。

So you could actually so what we what some people did in that US government program I was involved in is that they actually did an MPC calculation where you had one country knew where its satellite was and what direction it was going in, and another one was, and you would work out whether the satellites were going to hit each other and whether they should change course without revealing the positions of the satellites.

所以你可以进行类似牛顿力学的计算。

So you could do computations which are like Newtonian mechanics.

其他例子可能是，我们在这里参与的...听众可能不知道，但我们实际上身处三个不同的国家。

Other examples could be, we're engaged in here, we, I don't know, your listeners may not know this, but we're actually in three different countries here.

也就是说，我们分布在三个不同的国家，实际上在进行音频合并时就会遇到问题。

So this is this is we're in three different countries, and actually, when you do a merging audio, you actually have a problem.

所以如果你们使用加密通讯，为了进行群组对话的音频合并，实际上必须先解密这些通讯。

So so if you if you have encrypted communications, you actually have to decrypt them to merge the audios for group conversations.

这实际上还是同一个美国政府项目，我们当时有三个不同站点的语音通信。

So this is actually, and it's the same US government programme, we actually had voice communications from three different sites.

语音通信是加密的，但随后会被合并——即合并音频文件后，在对话过程中实时回传。

The voice communications were encrypted, but then merged, where you merge the audio files and then send them in back real time during the conversation.

这有点像Skype现在的功能：你连接Skype后，它会通过解密并在群组对话时动态合并三方音频。

So that's kind of like being able what Skype currently does is you connect to Skype and it will do it will merge the three together by decrypting and having to do the merging on the fly when you do a group conversation.

因为这其实相当困难，但我们成功在一个安全域内实现了这一点。

Because that's actually quite hard, but we managed to do this in a in a secure domain.

这两个例子真的非常惊人。

Those are two really, those are amazing examples.

是的，非常酷。

Yeah, really cool.

由此可见这项技术的应用场景——我们讨论过医疗保健、军事应用（比如卫星）、语音应用。

So you can really see that this has applicants, so we talked about healthcare, we talked about military applications, you know, with satellites, we can talk about voice applications.

在加密货币领域，你可以通过MPC计算来保护签名密钥：把加密签名密钥分割存储在不同服务器上，进行分布式数字签名。

In the cryptocurrency space, you can secure your cryptographic keys to signing by, you can take your cryptographic signing key, you can split that up and put those in different servers and then use those, then do an MPC calculation to actually do the digital signature.

因此密钥永远不会集中在一处，安全性大大提高。

So the key is never in one place, it's much more secure.

你可以将一部分签名密钥放在柏林，一部分放在美国，还有一部分放在日本，它们永远不会合并。

You could have just one signing key in Berlin, one signing key in America, or one part of it in in Japan, and they never come together.

这就解决了冷热钱包密钥存储的难题。

So this has solves the problem of where do you keep your cold and hot wallet keys.

哇。

Wow.

这超级有——这个真的存在吗？

That's super inter is that is that actually does that exist?

这不像是

That's not like

确实存在。

That exists.

听起来像是多重签名，但我觉得有所不同

Sounds sounds like a multisig, but I feel like it's different

比任何方式都好。

than anything.

这不是多重签名。

It's not a multisig.

它比多重签名更好，因为多重签名要求接收方知道它是多重签名。

It's better than a multisig because a multisig requires the recipient to know it's a multisig.

所以它看起来不一样。

So it looks different.

对吧？

Yeah?

而且多重签名假设你有一个多重签名，需要三个签名组合起来，这实际上告诉验证者你的授权策略需要三个人同意，而你可能并不希望这样。

And it also multisig, suppose you have a multi sig which says we're going to take three signatures and combine them, then what that actually tells the verifier is that your authorisation policy was three people had to agree and you might not actually want that to happen.

所以我们用MPC技术可以生成一个对验证者来说看起来像真实签名的东西，看起来就是一个普通的签名，但从签名者的角度来看，它是由具有不同授权的不同密钥组成的。

So what what we can do with MPC is produce what looks to the verifier like a genuine signature, looks like a normal, normal, normal signature, and then but from the signer's point of view, it is the it has been composed of different secret keys with different authorizations.

所以可以设置成允许我单独签署交易，但安娜和弗雷德里克必须一起才能签署，因为我们不太信任他们。

So it could be that you allow me on my own to sign a transaction, but Anna and Frederic have to get together to sign it because we don't trust them too much.

所以他们必须一起行动。

So they have to come together.

因此我们可以建立所谓的访问结构，要求两人签名或一人签名即可。

So we have there, we could have what is called an access structure where you have two people have to sign or one person.

类似的技术已被应用——虽然不是MPC领域——但这类访问结构被用于核武器指挥控制系统。

And similar things have been used, not in terms of MPC, but that kind of access structure is used for nuclear command and control.

发射核导弹需要总统和潜艇指挥官，或副总统、潜艇指挥官和一名将军等组合授权。

Launching nuclear missiles, require the president and the submarine commander, or the vice president, the submarine commander and a general, or something like that, you need a combination.

这些不同的访问结构可以通过区块链签名实现，验证者无从知晓背后的授权策略，这可能是企业机密。

So you have these different access structures, and you can do that within the signature on the blockchain in a way that the verified doesn't know what your authorization policy was behind, which could be company confidential.

那么，这个技术已经部署了吗？

And then to, is this deployed?

是的。

Yes.

Unbound Tech公司开发了相关技术，目前已在相当数量的大型加密货币交易所实际部署，用于保护他们的冷热钱包密钥。

Unbound Tech produced tech in this space and it's actually deployed in a reasonable number of the very large cryptocurrency exchanges to, secure their cold and hot wallet keys.

这也意味着他们能够处理更大规模的交易周转，为消费者带来越来越少的延迟。

And it also means that they have they could do, greater volumes of turnaround and and less and less, delay for consumers.

我确实认为这有一些应用场景。

I actually think there's some application.

我们过去讨论过比特币桥接问题，比特币的一个限制是你不能拥有超过特定参与方数量的多重签名。

We've talked about Bitcoin bridges in the past and like a constraint in Bitcoin is that you can't have multisigs above a certain number of parties.

但在桥接方案中，实际上可能需要一个由上千参与方组成的多重签名。

But in a bridge, might actually want a multisig of, like, a thousand parties.

是的。

Yeah.

这在比特币原生协议上是无法实现的。

And you can't you can't do that natively on Bitcoin.

所以你必须采用类似这样的方案。

So you would have to do something like this.

没错。

Yeah.

确实如此。

So yeah.

没错。

Exactly.

这正好解决了那个问题。

That exactly solves that problem.

你是说，MPC系统是你研究的重点吗？它们一直是你的研究重点，还是在此之前你还在研究其他内容？

Would you say I mean, is are MPC systems the focus of your research, and have they been the focus of your research, or was there something else that you were working on before this?

哦，在此之前，我做过各种各样的研究。

Oh, before this, was doing all sorts of stuff I've done.

最初我研究的是——哦，你应该知道这个。

So originally, I worked on what's called oh, you would know this.

我研究过椭圆曲线密码学。

I worked on things called elliptic curve cryptography.

那是在90年代末到21世纪初，我们研究如何破解椭圆曲线密码学之类的技术，然后在2000年代初出现了基于配对密码学的大热潮，这种技术现在被用在一些区块链应用中。

This was back in, like, the late nineties, early two thousands where we looked at ways of breaking elliptic curve cryptography and stuff, and then there was this big boom in the early 2000s on what's called pairing based cryptography, which is used in some blockchain applications.

举个例子，想想看，我认为Definiti是其某些应用中配对密码学的大用户。

So for example, think big, Definiti I think as a big user of pairing based crypto in some of its applications.

然后还研究过密钥协商等各种其他技术，涉猎很广。

And then worked on key agreement, all sorts of other things, so various things.

到了两千年代中期，主要聚焦在两个方向。

And then kind of in the mid two thousands, there were kind of two things.

所以我总会参加MPC相关的讲座。

So so I would always turn up to MPC talks.

要是复数形式，就该说talks（讲座）。

If you let plural, it's talks.

就是这样。

There we go.

因为这些是关于MPC的讲座。

Because they're talks about MPC.

总之，我经常参加MPC讲座时睡着，因为实在太无聊了。

Anyway, so I talked so I would always turn up to MPC talks and fall asleep because this was just so boring.

这就像它永远不可能实用一样。

This was just like this was never gonna be practical.

MPC自二十世纪八十年代就已存在。

MPC had been around since the nineteen eighties.

它非常、非常理论化，没人认为它会有实际用途。

It was very, very theoretical, and no one would ever think you could ever use it.

然后在两千年代中期，大概是2004年，我参加了欧洲密码学会议Eurocrypt，这是欧洲主要的密码学会议，在瑞士因特拉肯举行。

And then in the mid two thousands, I think it was like 2004, I think it was, I went to a Eurocrypt, which is the main cryptography conference for Europe in Interlaken in Switzerland.

在密码学会议上，我们有一种叫做'余兴会议'的环节。

And it at cryptography conferences, we have something called a rump session.

'余兴会议'是一种嗯...

Now a rump session is a Mhmm.

某个晚上举行的活动，人们会喝很多啤酒和葡萄酒，然后进行两分钟的短演讲。

An event in one of the evenings where people drink a lot of beer and a lot of wine, and people give two minute talks.

这些两分钟的演讲要么很有趣，要么是广告，要么是在演示某些东西。

And they're just giving two minute talks, which are either funny, an advertisement, or they're demonstrating something.

有个家伙上台了，他居然在两分钟内现场演示了MPC在他笔记本电脑上的运行。

And one guy got up and he actually, in two minutes, alive, gave a demonstration of MPC working on his laptop.

在一个两分钟的演示里，你需要把演示内容搬上舞台并让它实际运行起来，这时候你就会意识到：哦，这不再是理论了。

Now in a two minute presentation where you have to get the presentation onto the stage and actually do actually get it running and working, you go and you go like, oh, oh, this isn't theoretical anymore.

这是真实的。

This is real.

第二年，Eurocrypt在丹麦的奥胡斯举办。

And then the next year, there was a Eurocrypt this time in Aarhus in Denmark.

同样是在非正式会议上，有人站起来说，我们实际上已经用MPC为真实世界的人们完成了一项真实计算——这就是后来在MPC社区闻名遐迩的'丹麦甜菜拍卖'案例。

And at the same thing at the rump session, someone got up and said, actually, we've used MPC to do a real calculation in the real world for real people, which is what's called which was the calculation which is now famous in the MPC community as the Danish Sugar Bee Auction.

所以提到MPC就不得不提丹麦甜菜拍卖。

So you can't mention MPC without mentioning Danish Sugar Beet Auction.

那一刻我恍然大悟：这确实是真的。

And at that point, I went, uh-huh, it really is real.

之后我转变了方向，开始与Unbound Tech另一位联合创始人Yehuda Lindel合作，同时也与在因特拉肯做过非正式会议演讲的Benny Pinkus共事，我们真正开始构建MPC系统，尝试将理论转化为实践。

And then I kinda like shifted, and then we started doing I started working with Yehuda Lindel, who's the other, co founder of Unbound Tech, and also working with Benny Pinkus, who is the guy who had given the rump session talk at Interlaken, and we started actually then sort of building MPC and seeing whether we could turn the theory into practice.

为了让你们有个概念，我们在2007、2008年完成了首个超大规模的'主动安全'计算——这是安全计算领域的黄金标准，我们计算了一个特定函数。

And to give you an idea, we did the first very large scale, what's called Actively Secure, which is like the gold standard of security computation in 2007, 2008, and we calculated a specific function.

具体是什么函数不重要，重要的是我们计算了一个特定函数。

It doesn't matter what it is, we calculated a specific function.

那是人类历史上首次实现这种计算，当时耗费了数小时。

At that point was the first time anyone had ever done it, it took hours.

哇。

Wow.

小时。

Hours.

而现在同样的计算可以在毫秒内完成。

And now that same calculation can now be done in milliseconds.

十年间，性能提升幅度急剧下降，这就是它变得如此热门的原因。

In ten years, the the performance improvement has just dramatically dropped, and that's why it's become so hot.

我想回到最初，你早期从事的那些MPC工作。

I sort of wanna go back to that beginning, that early MPC work that you were doing.

那实际上是什么样子的？

What was that actually what did that look like?

嗯，好吧。

Well, okay.

对我来说是这样的。

So for me okay.

我可以谈谈整个领域或者我个人的经历。

So it well, I I could talk about the community or for me.

这两者有点不同。

So it's kind of, like, different.

在八十年代，这个领域的人们还在用纸笔工作。

So in in the community, in the eighties, people were just doing pen and paper.

你知道，他们当时在做思想实验。

You know, they were doing thought experiments.

明白吗？

You know?

会发生什么？

What would happen?

所以第一个例子在某种意义上就是心理扑克。

So the first example is mental poker in some sense.

你怎么能通过电话玩扑克呢？

How could you play poker by telephone?

所以我有一堆牌，我有一堆牌。

So I've got a bunch I've got a bunch of of cards.

你有一堆牌。

You've got a bunch of cards.

我们已经发好了牌。

We've dealt the cards.

我不知道你手里有什么牌。

I don't know what your cards are.

你不知道我手里有什么牌，但我们想通过电话玩扑克，并且仅通过交换加密消息来防止作弊。

You don't know what my cards are, but we want to play poker and not cheat over the telephone by just exchanging cryptographic messages.

于是人们就这样玩着心理游戏，并由此提出了MPC（多方计算）的概念。

So people were just playing mental games like that, and they came out with this idea of MPC.

然后在八十年代和九十年代初，人们只是在理论上探讨它能做些什么？

And then in the eighties and early nineties, people were just playing with the idea of what could it theoretically do?

你能计算任何东西吗？

Could you compute anything?

事实证明，确实可以。

And it turns out, you can.

从理论上讲，你可以安全地计算任何想要的东西，这挺酷的。

You could theoretically compute anything you want securely, which is kind of cool.

大约从九十年代中期到两千年代中期，人们不断探索各种计算方法，但这些方法当时并不实用，网络条件不佳，计算机速度也不够快，诸如此类。

And then maybe from the mid nineties to the mid two thousands, people were kind of coming up with ways of doing the computations, but they weren't really very practical and the networks weren't very good at the time and computers weren't so fast, etcetera etcetera.

到了两千年代中期，计算机的速度终于快到能处理一些非常基础的操作了。

And then like in the mid two thousands, computers were just about fast enough that you could do something really basic.

所以我认为，八十年代提出的那个著名案例——百万富翁问题——很好地体现了这个理念。

So I think the idea there's this famous example which came up in the eighties, which is called the millionaire's problem.

假设你有两位百万富翁，他们想知道谁更富有。

So imagine you've got two millionaires and they want to work out who's the richest.

他们各自有一个输入值，一位富翁有数值x，另一位有数值y，他们想计算x是否大于y，或者y是否大于x。

So they want to compute they've both got their inputs, one input, one millionaire's got the value x, one millionaire's got the value y, and you want to work out is x bigger than y or is y bigger than x.

这就是你想要计算的，同时不透露x或y的具体数值。

And that's all you wanna compute without revealing x or y.

所以只有这些信息：两位百万富翁，爱丽丝和鲍勃。

So the only information so you've got two millionaires, Alice and Bob.

爱丽丝可能会知道她更富有，而鲍勃会知道他是较穷的那个，但我们不知道具体相差多少。

Alice will learn maybe she's the richest, and Bob will learn he's the poorest, but we won't know by how much.

这就是所谓的'百万富翁问题'。

So that's what's called the millionaire's problem.

而这个人在因特拉肯的临时会议上所做的，就是在16位整数上运行了百万富翁问题。

And what this guy had done in this rump session in Interlaken is run the millionaire's problem on 16 bit integers.

这只是一个甚至不到百万的数字。

So it's just a number which isn't even a million.

这个数字还不到65536。

That's like less than six five five three six.

对吧？

Yeah?

所以这是在比较两个小于16位的数字，耗时两分钟。

So this is comparing two numbers less than 16 bits, and it took two minutes.

这就是他比较整数所用的演讲时长。

That was the length of his talk to compare the integers.

差不多就是这样，当时我们就是处于这个阶段。

That was kind of that that was kind of that's where we were.

但一旦你能实现某个功能并实际操作，你就会立即实施并思考：我能让这个跑得更快，我能优化那个，这部分可以省略，那个可以改进。

But as soon as you could do something, as soon as you could actually implement something and play with it, you would then implement it and you go, I can make this go faster, I can make that go faster, I don't need to do this, I can change that.

我可以利用基础设施的这一部分。

I can use this part of the infrastructure.

我可以这样使用操作系统。

I can use the operating system in this way.

我可以这样利用网络。

I can use the network in this way.

突然间改进就接踵而至，一个接一个地快速涌现。

And suddenly the improvements come rapidly, you know, one on top of each other.

所以你刚才谈到的就像是研究与工程之间的桥梁或鸿沟。

So what you just talked about is sort of this bridge or this gap between research and engineering.

我们之前在这个节目中也与其他人讨论过这个问题，这总是让我感到着迷。

And we've talked to people on this show before about this and it's always fascinating to me.

正如你所说，我看到的是一旦有了可以实际操作的东西，就能开始吸引工程师们。

What I see is exactly what you said that once there's something out there to play with, that's when you start attracting the engineers.

一旦工程师们加入进来，他们就会说，其实我可以稍微加快速度，我可以在这里做些改进，于是黑客们开始真正提升技术，然后你们开始更紧密地合作，这才是真正取得突破的时候。

And once you have the engineers on board, they can go, well, actually I can speed this up a little bit, I can do this over here, and you start having the hackers actually improve the technology and then you start working more hand in hand and that's when you get the real improvements.

你如何看待工程师和程序员与理论家们合作的角色？

How do you see the role of engineering and the programmers coming in and working with the theorists?

嗯，我认为关键在于，至少在这个领域，实际上每个人都是紧密合作的。

Well, I think the thing is, certainly in this area, actually everyone's hand in hand.

世界上仍有一些理论家在研究理论MPC，但几乎所有人现在都在理论与实践相结合，这是因为你无法仅凭新想法来改进某个协议。

There's still some theorists doing theoretical MPC in the world, but almost everyone's now doing a combination of theory and practice, is that because you can't so you have a new idea to to improve some protocol.

你有了些新奇古怪的想法。

So you have some new weird and wacky idea.

实际上，在纸上测试行不通，因为现实世界中所有东西都受网络延迟、内存问题和带宽影响。

Actually, testing it on paper, you can't test it on paper because in the real world, everything works on what's the network latency, memory issues, bandwidth.

这些系统现在如此复杂，有太多活动部件，不实际实施就无法真正测试某件事是否真实，或是否能带来改进。

And these systems are now so complicated, they have so many moving parts that you can't really test whether something is real or not, or whether it gives you an improvement without actually implementing it.

所以现在很多理论研究都与工程研究紧密结合。

So a lot of the theoretical research now is hand in hand with engineering research.

同时工程研究也需要理论家来解决问题——当你完成某个工程项目时，会突然发现'天啊，这是我们从未意识到的东西'。

And also the engineering research requires the theoreticians to solve problems or you do a piece of engineering and you go, oh my god, that's something we never realised.

然后你把问题抛回给理论家，他们会说'确实，我们之前测量的指标有问题'，这时你突然意识到理论界应该测量的某个指标在实际世界中根本没有意义。

And then you pass it back to the theoreticians and they go, oh yeah, they kind of measure the wrong things and then you suddenly realize that you've got some one thing you're meant to be measuring in the theory world doesn't actually make sense in the practical world.

这就是理论与实践的永无止境的循环：理论指导实践，实践反哺理论，如此往复。

This is a never ending combination of theory to practice, practice to theory and so on.

所以大约十年前在密码学社区（crypto指的是密码学，必须强调这一点，必须强调，crypto就是密码学的意思）

So maybe ten years ago in the crypto community, that's crypto means cryptography, always got to get that in, always got to get that in, crypto means cryptography.

好的，在密码学社区里，理论家和实践者之间曾经存在某种分界线。

Okay, in the crypto community, there was a of like, there was a bit of a bifurcation between the theoreticians and the practitioners.

但我认为过去七八年发生的许多事情实际上让他们走到了一起，其中一个原因就是MPC应用和实用性的爆炸式增长，这让理论家们突然意识到：哇，这些东西真的有用。

But I think a lot of things over the last seven or eight years have actually brought them together, one of which has been this huge explosion in MPC applications and practicality, which suddenly the theoreticians are going, woo hoo, that stuff's useful.

而实践派的人则欢呼：哇，我们又有新玩具了。

And the practical people go, woo hoo, we've got something else to play with.

接着全同态加密也迎来了巨大爆发，同时我们还创建了一些让社区成员聚集的交流平台。

And then there was the huge explosion in fully homomorphed encryption and then also we've kind of created community places for people to come together.

比如我和Kenny Patterson共同创办的'真实世界密码学'会议，每年一月举办，从七年前只有100人参加的小型活动开始发展。

So I founded along with someone else, Kenny Patterson, this thing called Real World Crypto, which we run every year in January and it turned from being like seven years ago, it was like a tiny event with 100 people.

现在它已成为全球规模最大的密码学会议。

It's now the biggest cryptography conference in the world.

我们约有700人参会，包括加密货币领域从业者、学术界人士、政府人员，以及苹果、Facebook、谷歌和微软等公司的密码学团队都会出席。

We have about 700 people turn up and we have people from the cryptocurrency space, we have people from academia, we have people from government, we have the crypto teams of Apple and Facebook and Google and Microsoft turn up.

我们有对公共政策感兴趣的人士参与。

We have people who are interested in public policy.

去年，我们有人在波士顿进行了一项非常有趣的调查——波士顿议程调查，他们让200家公司参与了一项关于不同公司中男女薪酬差异的统计调查，并让所有公司将数据输入这个MPC系统进行统计分析。

Last year, we had people doing NPC, doing a really interesting survey in Boston, which is the Boston Agenda Survey, where they got 200 companies to do a statistical survey of whether there was a difference in pay between male and female in the different companies, and so they got all the companies to put their data into this MPC system to do the statistical analysis.

所以看到各种公共政策议题正在真正地将人们凝聚在一起。

So seeing all sorts of public policy stuff coming out that's really bringing people together.

你刚才提到了FHE（全同态加密）的概念。

You just mentioned sort of the FHE idea.

是的。

Yeah.

我不是

I'm not

在这里说FHE。

gonna say FHEs here.

FHE。

FHE.

实际上，你对MPC的定义听起来与FHE非常非常相似，都是这种能够组合几乎任何东西的理念。

Actually, the way you've defined the MPC, it sounds very, very similar to the FHE, this idea of this ability to combine things and almost anything.

是的。

Yeah.

在你目前的工作中，你认为MPC研究是一个独立领域，还是看到它与许多其他概念正在融合？

In the work that you're doing, I mean, do you see the the work on MPC as a as a silo or do you actually see that blending in with a lot of these other concepts?

它们非常非常相似。

They're very, very similar.

事实上它们确实密切相关。

In fact, they actually are really related.

好的。

Okay.

所以这个好的。

So the Okay.

好的。

Okay.

关于全同态加密（FHE）的典型应用场景，人们常说的模式是：你加密一些数据，发送到服务器，服务器在不知内容的情况下进行计算，然后将结果返回给你。

So the thing with the usual use case of FHE is, well, that's pretended that people say, is you encrypt some stuff, you send it to the server, the server computes on it without knowing what it is and sends it back to you.

想象一个加密的谷歌搜索——你加密搜索词发送给谷歌，谷歌返回搜索结果但不知道你搜了什么或结果内容，你收到后再解密。

So you think about an encrypted Google search, you encrypt your search term, you send it to Google, Google gives you your search results, but doesn't know what you've searched for or what your results are, sends them back and you decrypt.

好的。

Okay.

这虽然不实用，但能让你理解其核心概念。

That doesn't isn't practical, but that gives you an idea of what the idea is.

其实这和多方计算（MPC）很像，区别在于这里只有服务器单方参与计算。

Now that really is like MPC, except there's only one person doing the computation, the server.

所以这是...好的。

So it's it's Okay.

MPFHE本质上就是缺少多方参与的MPC

M p f h e is MPC without the

嗯。

m.