WEBVTT Kind: captions Language: en 00:00:04.569 --> 00:00:07.919 align:start position:0% hi<00:00:05.350> everyone<00:00:05.769> i<00:00:05.979> am<00:00:06.069> from<00:00:06.269> pier<00:00:07.269> 1<00:00:07.299> of<00:00:07.629> chain 00:00:07.919 --> 00:00:07.929 align:start position:0% hi everyone i am from pier 1 of chain 00:00:07.929 --> 00:00:10.589 align:start position:0% hi everyone i am from pier 1 of chain ups<00:00:08.139> and<00:00:08.500> i<00:00:09.010> want<00:00:09.459> to<00:00:09.639> take<00:00:09.849> this<00:00:10.030> chance<00:00:10.299> today 00:00:10.589 --> 00:00:10.599 align:start position:0% ups and i want to take this chance today 00:00:10.599 --> 00:00:13.980 align:start position:0% ups and i want to take this chance today to<00:00:10.750> present<00:00:11.440> what<00:00:11.799> we've<00:00:12.129> been<00:00:12.369> working<00:00:12.580> on<00:00:12.990> in 00:00:13.980 --> 00:00:13.990 align:start position:0% to present what we've been working on in 00:00:13.990 --> 00:00:16.880 align:start position:0% to present what we've been working on in the<00:00:14.260> last<00:00:14.439> few<00:00:14.889> years 00:00:16.880 --> 00:00:16.890 align:start position:0% the last few years 00:00:16.890 --> 00:00:19.670 align:start position:0% the last few years who<00:00:17.400> we<00:00:17.580> are<00:00:17.610> we<00:00:18.090> are<00:00:18.120> two<00:00:18.540> teams<00:00:18.960> of<00:00:19.290> applied 00:00:19.670 --> 00:00:19.680 align:start position:0% who we are we are two teams of applied 00:00:19.680 --> 00:00:23.030 align:start position:0% who we are we are two teams of applied cryptography<00:00:20.330> researchers<00:00:21.330> in<00:00:22.040> Darmstadt 00:00:23.030 --> 00:00:23.040 align:start position:0% cryptography researchers in Darmstadt 00:00:23.040 --> 00:00:26.960 align:start position:0% cryptography researchers in Darmstadt Germany<00:00:23.070> and<00:00:23.820> vassal<00:00:24.300> Poland<00:00:24.720> and<00:00:25.460> we<00:00:26.460> provide 00:00:26.960 --> 00:00:26.970 align:start position:0% Germany and vassal Poland and we provide 00:00:26.970 --> 00:00:29.390 align:start position:0% Germany and vassal Poland and we provide cryptographic<00:00:27.390> protocols<00:00:28.260> and<00:00:28.500> proofs<00:00:28.800> but 00:00:29.390 --> 00:00:29.400 align:start position:0% cryptographic protocols and proofs but 00:00:29.400 --> 00:00:32.570 align:start position:0% cryptographic protocols and proofs but our<00:00:29.760> focus<00:00:30.150> our<00:00:30.480> goal<00:00:30.840> is<00:00:31.200> how<00:00:31.860> we<00:00:31.920> can<00:00:32.310> use 00:00:32.570 --> 00:00:32.580 align:start position:0% our focus our goal is how we can use 00:00:32.580 --> 00:00:37.460 align:start position:0% our focus our goal is how we can use smart<00:00:32.880> contracts<00:00:33.660> to<00:00:34.320> scale<00:00:35.090> blockchain<00:00:36.470> in 00:00:37.460 --> 00:00:37.470 align:start position:0% smart contracts to scale blockchain in 00:00:37.470 --> 00:00:39.200 align:start position:0% smart contracts to scale blockchain in particular<00:00:37.860> I<00:00:38.070> want<00:00:38.340> to<00:00:38.460> present<00:00:38.790> to<00:00:39.090> you 00:00:39.200 --> 00:00:39.210 align:start position:0% particular I want to present to you 00:00:39.210 --> 00:00:41.330 align:start position:0% particular I want to present to you today<00:00:39.239> three<00:00:39.900> protocols<00:00:40.770> that<00:00:41.010> we've<00:00:41.190> been 00:00:41.330 --> 00:00:41.340 align:start position:0% today three protocols that we've been 00:00:41.340 --> 00:00:43.700 align:start position:0% today three protocols that we've been working<00:00:41.520> on<00:00:41.820> the<00:00:42.450> first<00:00:42.690> one<00:00:42.870> you<00:00:43.410> might<00:00:43.559> have 00:00:43.700 --> 00:00:43.710 align:start position:0% working on the first one you might have 00:00:43.710 --> 00:00:45.490 align:start position:0% working on the first one you might have heard<00:00:43.860> about<00:00:43.980> is<00:00:44.400> called<00:00:44.640> Piron<00:00:45.239> and 00:00:45.490 --> 00:00:45.500 align:start position:0% heard about is called Piron and 00:00:45.500 --> 00:00:47.900 align:start position:0% heard about is called Piron and extensions<00:00:46.500> where<00:00:46.920> we<00:00:47.040> try<00:00:47.309> to<00:00:47.370> build<00:00:47.640> a 00:00:47.900 --> 00:00:47.910 align:start position:0% extensions where we try to build a 00:00:47.910 --> 00:00:50.540 align:start position:0% extensions where we try to build a framework<00:00:48.420> for<00:00:48.629> state<00:00:49.140> channels<00:00:49.530> the<00:00:50.220> second 00:00:50.540 --> 00:00:50.550 align:start position:0% framework for state channels the second 00:00:50.550 --> 00:00:52.790 align:start position:0% framework for state channels the second one<00:00:50.700> is<00:00:50.940> called<00:00:51.030> fair<00:00:51.480> swap<00:00:51.600> where<00:00:52.380> we<00:00:52.500> tried 00:00:52.790 --> 00:00:52.800 align:start position:0% one is called fair swap where we tried 00:00:52.800 --> 00:00:55.580 align:start position:0% one is called fair swap where we tried to<00:00:52.829> build<00:00:53.280> use<00:00:54.210> smart<00:00:54.570> contracts<00:00:55.110> to<00:00:55.260> build<00:00:55.380> a 00:00:55.580 --> 00:00:55.590 align:start position:0% to build use smart contracts to build a 00:00:55.590 --> 00:00:58.490 align:start position:0% to build use smart contracts to build a fair<00:00:55.860> exchange<00:00:56.100> protocol<00:00:56.940> and<00:00:57.780> the<00:00:57.989> last<00:00:58.200> one 00:00:58.490 --> 00:00:58.500 align:start position:0% fair exchange protocol and the last one 00:00:58.500 --> 00:01:01.310 align:start position:0% fair exchange protocol and the last one is<00:00:58.710> a<00:00:59.040> very<00:00:59.340> recent<00:00:59.670> one<00:00:59.910> called<00:01:00.360> fast<00:01:00.900> kitten 00:01:01.310 --> 00:01:01.320 align:start position:0% is a very recent one called fast kitten 00:01:01.320 --> 00:01:03.020 align:start position:0% is a very recent one called fast kitten where<00:01:01.890> we<00:01:02.010> use<00:01:02.250> trusted<00:01:02.760> execution 00:01:03.020 --> 00:01:03.030 align:start position:0% where we use trusted execution 00:01:03.030 --> 00:01:06.440 align:start position:0% where we use trusted execution environments<00:01:03.989> to<00:01:04.589> build<00:01:05.369> secure<00:01:06.030> private 00:01:06.440 --> 00:01:06.450 align:start position:0% environments to build secure private 00:01:06.450 --> 00:01:10.609 align:start position:0% environments to build secure private smart<00:01:07.440> contract<00:01:07.890> execution<00:01:09.170> so<00:01:10.170> let's<00:01:10.380> start 00:01:10.609 --> 00:01:10.619 align:start position:0% smart contract execution so let's start 00:01:10.619 --> 00:01:12.050 align:start position:0% smart contract execution so let's start with<00:01:10.770> the<00:01:10.860> first<00:01:11.130> one<00:01:11.310> here<00:01:11.700> on<00:01:11.850> end 00:01:12.050 --> 00:01:12.060 align:start position:0% with the first one here on end 00:01:12.060 --> 00:01:16.400 align:start position:0% with the first one here on end extensions<00:01:12.720> and<00:01:13.850> smart<00:01:14.850> or<00:01:15.450> state<00:01:15.990> channels 00:01:16.400 --> 00:01:16.410 align:start position:0% extensions and smart or state channels 00:01:16.410 --> 00:01:18.380 align:start position:0% extensions and smart or state channels is<00:01:16.619> an<00:01:16.830> extension<00:01:17.190> of<00:01:17.369> payment<00:01:17.820> channels<00:01:18.119> and 00:01:18.380 --> 00:01:18.390 align:start position:0% is an extension of payment channels and 00:01:18.390 --> 00:01:20.090 align:start position:0% is an extension of payment channels and most<00:01:18.869> of<00:01:19.020> you<00:01:19.170> will<00:01:19.200> have<00:01:19.710> heard<00:01:19.920> about 00:01:20.090 --> 00:01:20.100 align:start position:0% most of you will have heard about 00:01:20.100 --> 00:01:22.430 align:start position:0% most of you will have heard about payment<00:01:20.640> channels<00:01:20.909> and<00:01:21.150> the<00:01:21.540> idea<00:01:21.870> is<00:01:21.960> to<00:01:22.290> get 00:01:22.430 --> 00:01:22.440 align:start position:0% payment channels and the idea is to get 00:01:22.440 --> 00:01:25.280 align:start position:0% payment channels and the idea is to get rid<00:01:22.650> of<00:01:22.680> this<00:01:22.979> very<00:01:23.280> long<00:01:24.090> duration<00:01:24.479> and 00:01:25.280 --> 00:01:25.290 align:start position:0% rid of this very long duration and 00:01:25.290 --> 00:01:27.710 align:start position:0% rid of this very long duration and costly<00:01:25.820> single<00:01:26.820> payments<00:01:27.270> on<00:01:27.420> the<00:01:27.510> blockchain 00:01:27.710 --> 00:01:27.720 align:start position:0% costly single payments on the blockchain 00:01:27.720 --> 00:01:30.980 align:start position:0% costly single payments on the blockchain and<00:01:28.190> encapsulate<00:01:29.190> them<00:01:29.400> into<00:01:30.210> a<00:01:30.240> channel 00:01:30.980 --> 00:01:30.990 align:start position:0% and encapsulate them into a channel 00:01:30.990 --> 00:01:33.469 align:start position:0% and encapsulate them into a channel which<00:01:31.320> is<00:01:31.500> secured<00:01:32.100> by<00:01:32.130> channel<00:01:32.790> contract<00:01:33.270> on 00:01:33.469 --> 00:01:33.479 align:start position:0% which is secured by channel contract on 00:01:33.479 --> 00:01:36.289 align:start position:0% which is secured by channel contract on chain<00:01:33.750> and<00:01:34.020> this<00:01:34.710> allows<00:01:35.040> to<00:01:35.460> make<00:01:35.580> off<00:01:35.880> chain 00:01:36.289 --> 00:01:36.299 align:start position:0% chain and this allows to make off chain 00:01:36.299 --> 00:01:38.300 align:start position:0% chain and this allows to make off chain direct<00:01:36.930> payments<00:01:37.409> between<00:01:37.590> two<00:01:37.979> participants 00:01:38.300 --> 00:01:38.310 align:start position:0% direct payments between two participants 00:01:38.310 --> 00:01:43.090 align:start position:0% direct payments between two participants really<00:01:39.299> fast<00:01:39.659> without<00:01:40.260> additional<00:01:40.530> costs<00:01:41.190> and 00:01:43.090 --> 00:01:43.100 align:start position:0% really fast without additional costs and 00:01:43.100 --> 00:01:46.969 align:start position:0% really fast without additional costs and our<00:01:44.100> goal<00:01:44.520> here<00:01:44.549> is<00:01:45.150> to<00:01:45.180> take<00:01:46.170> these<00:01:46.470> existing 00:01:46.969 --> 00:01:46.979 align:start position:0% our goal here is to take these existing 00:01:46.979 --> 00:01:48.560 align:start position:0% our goal here is to take these existing payment<00:01:47.369> channels<00:01:47.700> and<00:01:47.909> make<00:01:48.210> them<00:01:48.390> more 00:01:48.560 --> 00:01:48.570 align:start position:0% payment channels and make them more 00:01:48.570 --> 00:01:50.840 align:start position:0% payment channels and make them more powerful<00:01:48.960> and<00:01:49.650> we<00:01:49.920> did<00:01:50.070> this<00:01:50.220> in<00:01:50.400> three<00:01:50.430> lines 00:01:50.840 --> 00:01:50.850 align:start position:0% powerful and we did this in three lines 00:01:50.850 --> 00:01:55.100 align:start position:0% powerful and we did this in three lines of<00:01:50.970> works<00:01:51.299> and<00:01:53.090> the<00:01:54.090> main<00:01:54.299> component<00:01:54.869> that<00:01:54.900> we 00:01:55.100 --> 00:01:55.110 align:start position:0% of works and the main component that we 00:01:55.110 --> 00:01:57.170 align:start position:0% of works and the main component that we use<00:01:55.320> to<00:01:55.560> Staub<00:01:55.799> servation<00:01:56.130> that<00:01:56.460> we<00:01:56.820> can<00:01:57.000> run 00:01:57.170 --> 00:01:57.180 align:start position:0% use to Staub servation that we can run 00:01:57.180 --> 00:01:59.990 align:start position:0% use to Staub servation that we can run or<00:01:57.689> we<00:01:57.930> can<00:01:58.080> put<00:01:58.290> contracts<00:01:59.130> that<00:01:59.549> we<00:01:59.640> can<00:01:59.820> put 00:01:59.990 --> 00:02:00.000 align:start position:0% or we can put contracts that we can put 00:02:00.000 --> 00:02:02.870 align:start position:0% or we can put contracts that we can put on<00:02:00.210> chain<00:02:00.479> also<00:02:00.840> in<00:02:01.470> state<00:02:01.710> channels<00:02:02.100> and<00:02:02.369> not 00:02:02.870 --> 00:02:02.880 align:start position:0% on chain also in state channels and not 00:02:02.880 --> 00:02:04.969 align:start position:0% on chain also in state channels and not just<00:02:03.150> one<00:02:03.360> we<00:02:03.509> can<00:02:03.689> put<00:02:03.869> multiple<00:02:04.110> contracts 00:02:04.969 --> 00:02:04.979 align:start position:0% just one we can put multiple contracts 00:02:04.979 --> 00:02:08.780 align:start position:0% just one we can put multiple contracts into<00:02:05.280> a<00:02:05.460> state<00:02:06.150> channel<00:02:06.479> and<00:02:07.399> this<00:02:08.399> is<00:02:08.549> a<00:02:08.580> nice 00:02:08.780 --> 00:02:08.790 align:start position:0% into a state channel and this is a nice 00:02:08.790 --> 00:02:10.490 align:start position:0% into a state channel and this is a nice observation<00:02:09.450> because<00:02:09.690> if<00:02:09.929> we<00:02:10.080> can<00:02:10.229> do<00:02:10.350> this 00:02:10.490 --> 00:02:10.500 align:start position:0% observation because if we can do this 00:02:10.500 --> 00:02:13.009 align:start position:0% observation because if we can do this then<00:02:10.979> we<00:02:11.100> can<00:02:11.250> also<00:02:11.370> put<00:02:11.640> a<00:02:11.880> channel<00:02:12.570> contract 00:02:13.009 --> 00:02:13.019 align:start position:0% then we can also put a channel contract 00:02:13.019 --> 00:02:15.740 align:start position:0% then we can also put a channel contract into<00:02:13.620> a<00:02:13.650> channel<00:02:13.980> and<00:02:14.340> this<00:02:15.060> is<00:02:15.209> really<00:02:15.540> nice 00:02:15.740 --> 00:02:15.750 align:start position:0% into a channel and this is really nice 00:02:15.750 --> 00:02:17.870 align:start position:0% into a channel and this is really nice when<00:02:16.140> we<00:02:16.290> want<00:02:16.470> to<00:02:16.560> connect<00:02:17.040> more<00:02:17.489> than<00:02:17.549> two 00:02:17.870 --> 00:02:17.880 align:start position:0% when we want to connect more than two 00:02:17.880 --> 00:02:20.840 align:start position:0% when we want to connect more than two players<00:02:18.170> in<00:02:19.170> this<00:02:19.440> case<00:02:19.680> for<00:02:19.920> example<00:02:19.980> we<00:02:20.549> have 00:02:20.840 --> 00:02:20.850 align:start position:0% players in this case for example we have 00:02:20.850 --> 00:02:22.670 align:start position:0% players in this case for example we have Ellison<00:02:21.420> English<00:02:21.750> who<00:02:21.930> have<00:02:22.079> a<00:02:22.110> channel<00:02:22.530> and 00:02:22.670 --> 00:02:22.680 align:start position:0% Ellison English who have a channel and 00:02:22.680 --> 00:02:24.560 align:start position:0% Ellison English who have a channel and Ingrid<00:02:23.370> and<00:02:23.489> Bob<00:02:23.640> who<00:02:23.850> also<00:02:24.000> have<00:02:24.269> a<00:02:24.299> channel 00:02:24.560 --> 00:02:24.570 align:start position:0% Ingrid and Bob who also have a channel 00:02:24.570 --> 00:02:26.809 align:start position:0% Ingrid and Bob who also have a channel and<00:02:24.840> in<00:02:25.380> both<00:02:25.590> of<00:02:25.620> these<00:02:25.890> channels<00:02:26.280> we<00:02:26.489> now<00:02:26.610> put 00:02:26.809 --> 00:02:26.819 align:start position:0% and in both of these channels we now put 00:02:26.819 --> 00:02:28.940 align:start position:0% and in both of these channels we now put a<00:02:26.880> channel<00:02:27.239> contract<00:02:27.720> which<00:02:28.230> opens<00:02:28.620> a<00:02:28.739> new 00:02:28.940 --> 00:02:28.950 align:start position:0% a channel contract which opens a new 00:02:28.950 --> 00:02:30.070 align:start position:0% a channel contract which opens a new virtual<00:02:29.310> channel 00:02:30.070 --> 00:02:30.080 align:start position:0% virtual channel 00:02:30.080 --> 00:02:32.470 align:start position:0% virtual channel between<00:02:30.680> Alice<00:02:31.010> and<00:02:31.040> Bob<00:02:31.220> this<00:02:32.090> is<00:02:32.210> really 00:02:32.470 --> 00:02:32.480 align:start position:0% between Alice and Bob this is really 00:02:32.480 --> 00:02:34.720 align:start position:0% between Alice and Bob this is really nice<00:02:32.600> because<00:02:32.900> of<00:02:33.200> opening<00:02:33.650> this<00:02:33.800> channel<00:02:34.220> we 00:02:34.720 --> 00:02:34.730 align:start position:0% nice because of opening this channel we 00:02:34.730 --> 00:02:36.310 align:start position:0% nice because of opening this channel we don't<00:02:34.910> have<00:02:35.120> to<00:02:35.300> go<00:02:35.420> unchain<00:02:35.960> but<00:02:36.170> this 00:02:36.310 --> 00:02:36.320 align:start position:0% don't have to go unchain but this 00:02:36.320 --> 00:02:38.800 align:start position:0% don't have to go unchain but this completely<00:02:36.680> happens<00:02:37.460> off<00:02:37.610> chain<00:02:37.910> we<00:02:38.510> can<00:02:38.660> also 00:02:38.800 --> 00:02:38.810 align:start position:0% completely happens off chain we can also 00:02:38.810 --> 00:02:41.980 align:start position:0% completely happens off chain we can also update<00:02:39.110> this<00:02:39.530> at<00:02:39.800> closest<00:02:40.220> of<00:02:40.430> chain<00:02:40.760> and<00:02:41.150> use 00:02:41.980 --> 00:02:41.990 align:start position:0% update this at closest of chain and use 00:02:41.990 --> 00:02:45.760 align:start position:0% update this at closest of chain and use it<00:02:42.140> as<00:02:42.880> much<00:02:43.880> as<00:02:44.090> we<00:02:44.180> want<00:02:44.450> again<00:02:45.260> we<00:02:45.470> can<00:02:45.620> also 00:02:45.760 --> 00:02:45.770 align:start position:0% it as much as we want again we can also 00:02:45.770 --> 00:02:47.890 align:start position:0% it as much as we want again we can also open<00:02:45.920> contracts<00:02:46.730> inside<00:02:47.480> the<00:02:47.750> virtual 00:02:47.890 --> 00:02:47.900 align:start position:0% open contracts inside the virtual 00:02:47.900 --> 00:02:51.760 align:start position:0% open contracts inside the virtual channel<00:02:48.470> as<00:02:49.030> many<00:02:50.030> as<00:02:50.240> we<00:02:50.390> want<00:02:50.600> and<00:02:51.020> the<00:02:51.560> third 00:02:51.760 --> 00:02:51.770 align:start position:0% channel as many as we want and the third 00:02:51.770 --> 00:02:54.550 align:start position:0% channel as many as we want and the third extension<00:02:52.570> that<00:02:53.570> we<00:02:53.780> very<00:02:54.050> recently 00:02:54.550 --> 00:02:54.560 align:start position:0% extension that we very recently 00:02:54.560 --> 00:02:56.290 align:start position:0% extension that we very recently published<00:02:55.070> is<00:02:55.340> that<00:02:55.520> we<00:02:55.640> can<00:02:55.760> also<00:02:55.880> connect 00:02:56.290 --> 00:02:56.300 align:start position:0% published is that we can also connect 00:02:56.300 --> 00:02:58.480 align:start position:0% published is that we can also connect more<00:02:56.480> than<00:02:56.540> two<00:02:56.870> people<00:02:57.350> we<00:02:57.680> can<00:02:57.830> connect<00:02:58.250> end 00:02:58.480 --> 00:02:58.490 align:start position:0% more than two people we can connect end 00:02:58.490 --> 00:03:01.330 align:start position:0% more than two people we can connect end parties<00:02:59.000> by<00:02:59.660> putting<00:03:00.080> an<00:03:00.230> end<00:03:00.470> party<00:03:00.890> contract 00:03:01.330 --> 00:03:01.340 align:start position:0% parties by putting an end party contract 00:03:01.340 --> 00:03:05.260 align:start position:0% parties by putting an end party contract into<00:03:01.640> channels<00:03:02.030> and<00:03:02.680> this<00:03:03.680> these<00:03:04.190> M<00:03:04.760> party 00:03:05.260 --> 00:03:05.270 align:start position:0% into channels and this these M party 00:03:05.270 --> 00:03:09.100 align:start position:0% into channels and this these M party channels<00:03:05.720> also<00:03:06.140> provide<00:03:06.440> the<00:03:06.650> same<00:03:07.900> the<00:03:08.900> same 00:03:09.100 --> 00:03:09.110 align:start position:0% channels also provide the same the same 00:03:09.110 --> 00:03:11.290 align:start position:0% channels also provide the same the same properties<00:03:09.680> as<00:03:09.950> a<00:03:10.010> direct<00:03:10.580> or<00:03:10.820> a<00:03:10.850> virtual 00:03:11.290 --> 00:03:11.300 align:start position:0% properties as a direct or a virtual 00:03:11.300 --> 00:03:14.560 align:start position:0% properties as a direct or a virtual Channel<00:03:12.220> but<00:03:13.220> enough<00:03:13.459> about<00:03:13.580> channels<00:03:14.120> I<00:03:14.330> have 00:03:14.560 --> 00:03:14.570 align:start position:0% Channel but enough about channels I have 00:03:14.570 --> 00:03:16.780 align:start position:0% Channel but enough about channels I have two<00:03:14.780> more<00:03:14.959> proposals<00:03:15.560> to<00:03:15.709> talk<00:03:15.890> about<00:03:16.040> the 00:03:16.780 --> 00:03:16.790 align:start position:0% two more proposals to talk about the 00:03:16.790 --> 00:03:19.900 align:start position:0% two more proposals to talk about the second<00:03:17.150> one<00:03:17.300> was<00:03:17.750> fair<00:03:18.110> swap<00:03:18.230> and<00:03:18.790> fair<00:03:19.790> swap 00:03:19.900 --> 00:03:19.910 align:start position:0% second one was fair swap and fair swap 00:03:19.910 --> 00:03:21.850 align:start position:0% second one was fair swap and fair swap tackles<00:03:20.480> the<00:03:20.810> problem<00:03:20.840> of<00:03:21.410> fair<00:03:21.740> exchange 00:03:21.850 --> 00:03:21.860 align:start position:0% tackles the problem of fair exchange 00:03:21.860 --> 00:03:25.870 align:start position:0% tackles the problem of fair exchange which<00:03:22.520> is<00:03:22.550> really<00:03:23.090> hard<00:03:23.330> to<00:03:24.280> solve<00:03:25.280> without<00:03:25.760> a 00:03:25.870 --> 00:03:25.880 align:start position:0% which is really hard to solve without a 00:03:25.880 --> 00:03:29.560 align:start position:0% which is really hard to solve without a blockchain<00:03:27.730> classical<00:03:28.730> examples<00:03:29.300> when<00:03:29.480> you 00:03:29.560 --> 00:03:29.570 align:start position:0% blockchain classical examples when you 00:03:29.570 --> 00:03:31.090 align:start position:0% blockchain classical examples when you have<00:03:29.660> a<00:03:29.690> seller<00:03:29.959> and<00:03:30.170> a<00:03:30.230> buyer<00:03:30.260> and<00:03:30.980> the<00:03:31.070> seller 00:03:31.090 --> 00:03:31.100 align:start position:0% have a seller and a buyer and the seller 00:03:31.100 --> 00:03:33.490 align:start position:0% have a seller and a buyer and the seller has<00:03:31.490> a<00:03:31.520> file<00:03:31.790> X<00:03:32.090> and<00:03:32.450> the<00:03:32.690> buyer<00:03:32.840> is<00:03:33.050> willing<00:03:33.110> to 00:03:33.490 --> 00:03:33.500 align:start position:0% has a file X and the buyer is willing to 00:03:33.500 --> 00:03:35.949 align:start position:0% has a file X and the buyer is willing to pay<00:03:33.709> for<00:03:33.950> this<00:03:34.070> file<00:03:34.340> but<00:03:34.850> only<00:03:35.090> if<00:03:35.570> it's<00:03:35.750> the 00:03:35.949 --> 00:03:35.959 align:start position:0% pay for this file but only if it's the 00:03:35.959 --> 00:03:38.380 align:start position:0% pay for this file but only if it's the right<00:03:36.140> one<00:03:36.200> which<00:03:36.980> is<00:03:37.250> here<00:03:37.640> measured<00:03:38.030> over 00:03:38.380 --> 00:03:38.390 align:start position:0% right one which is here measured over 00:03:38.390 --> 00:03:42.009 align:start position:0% right one which is here measured over his<00:03:38.540> hash<00:03:39.610> so<00:03:40.610> very<00:03:40.940> naive<00:03:41.269> solution<00:03:41.450> is<00:03:41.840> we 00:03:42.009 --> 00:03:42.019 align:start position:0% his hash so very naive solution is we 00:03:42.019 --> 00:03:44.380 align:start position:0% his hash so very naive solution is we just<00:03:42.170> take<00:03:42.380> a<00:03:42.440> contract<00:03:43.190> buyer<00:03:43.760> submits<00:03:44.269> a 00:03:44.380 --> 00:03:44.390 align:start position:0% just take a contract buyer submits a 00:03:44.390 --> 00:03:47.050 align:start position:0% just take a contract buyer submits a coins<00:03:44.660> seller<00:03:45.380> submits<00:03:45.860> the<00:03:46.100> money<00:03:46.310> and<00:03:46.580> then 00:03:47.050 --> 00:03:47.060 align:start position:0% coins seller submits the money and then 00:03:47.060 --> 00:03:49.150 align:start position:0% coins seller submits the money and then the<00:03:47.150> contract<00:03:47.540> verifies<00:03:47.959> has<00:03:48.290> correct<00:03:48.680> or<00:03:48.950> has 00:03:49.150 --> 00:03:49.160 align:start position:0% the contract verifies has correct or has 00:03:49.160 --> 00:03:51.340 align:start position:0% the contract verifies has correct or has incorrect<00:03:49.670> but<00:03:50.510> this<00:03:50.630> is<00:03:50.750> actually<00:03:50.900> really 00:03:51.340 --> 00:03:51.350 align:start position:0% incorrect but this is actually really 00:03:51.350 --> 00:03:53.470 align:start position:0% incorrect but this is actually really expensive<00:03:51.890> when<00:03:52.340> we<00:03:52.459> talk<00:03:52.610> about<00:03:52.730> large<00:03:53.060> files 00:03:53.470 --> 00:03:53.480 align:start position:0% expensive when we talk about large files 00:03:53.480 --> 00:03:58.060 align:start position:0% expensive when we talk about large files about<00:03:53.750> bigger<00:03:54.470> or<00:03:54.590> megabytes<00:03:54.860> so<00:03:56.709> we<00:03:57.709> propose 00:03:58.060 --> 00:03:58.070 align:start position:0% about bigger or megabytes so we propose 00:03:58.070 --> 00:04:00.670 align:start position:0% about bigger or megabytes so we propose a<00:03:58.100> new<00:03:58.370> protocol<00:03:58.820> called<00:03:59.480> phase<00:03:59.690> one<00:03:59.959> where<00:04:00.590> we 00:04:00.670 --> 00:04:00.680 align:start position:0% a new protocol called phase one where we 00:04:00.680 --> 00:04:02.770 align:start position:0% a new protocol called phase one where we encrypt<00:04:01.070> the<00:04:01.280> file<00:04:01.489> and<00:04:01.790> not<00:04:02.180> send<00:04:02.450> it<00:04:02.570> to<00:04:02.690> the 00:04:02.770 --> 00:04:02.780 align:start position:0% encrypt the file and not send it to the 00:04:02.780 --> 00:04:04.690 align:start position:0% encrypt the file and not send it to the contract<00:04:03.230> but<00:04:03.680> directly<00:04:04.160> send<00:04:04.370> it<00:04:04.489> to<00:04:04.610> the 00:04:04.690 --> 00:04:04.700 align:start position:0% contract but directly send it to the 00:04:04.700 --> 00:04:07.600 align:start position:0% contract but directly send it to the buyer<00:04:04.880> in<00:04:05.450> the<00:04:05.930> first<00:04:06.170> message<00:04:06.550> this<00:04:07.550> is 00:04:07.600 --> 00:04:07.610 align:start position:0% buyer in the first message this is 00:04:07.610 --> 00:04:09.520 align:start position:0% buyer in the first message this is happening<00:04:08.120> directly<00:04:08.600> between<00:04:08.750> seller<00:04:09.320> and 00:04:09.520 --> 00:04:09.530 align:start position:0% happening directly between seller and 00:04:09.530 --> 00:04:12.820 align:start position:0% happening directly between seller and buyer<00:04:09.590> so<00:04:10.040> no<00:04:10.220> on<00:04:10.459> sharing<00:04:10.790> communication<00:04:11.830> the 00:04:12.820 --> 00:04:12.830 align:start position:0% buyer so no on sharing communication the 00:04:12.830 --> 00:04:14.740 align:start position:0% buyer so no on sharing communication the buyer<00:04:13.070> cannot<00:04:13.519> see<00:04:13.790> the<00:04:13.970> file<00:04:14.180> at<00:04:14.330> this<00:04:14.450> point 00:04:14.740 --> 00:04:14.750 align:start position:0% buyer cannot see the file at this point 00:04:14.750 --> 00:04:16.210 align:start position:0% buyer cannot see the file at this point because<00:04:14.900> it's<00:04:15.140> encrypted<00:04:15.410> and<00:04:15.769> it's<00:04:15.890> missing 00:04:16.210 --> 00:04:16.220 align:start position:0% because it's encrypted and it's missing 00:04:16.220 --> 00:04:18.849 align:start position:0% because it's encrypted and it's missing the<00:04:16.340> key<00:04:16.549> so<00:04:17.209> it<00:04:17.330> locks<00:04:17.450> the<00:04:17.720> coins<00:04:17.989> which<00:04:18.590> will 00:04:18.849 --> 00:04:18.859 align:start position:0% the key so it locks the coins which will 00:04:18.859 --> 00:04:21.759 align:start position:0% the key so it locks the coins which will make<00:04:19.310> the<00:04:19.489> seller<00:04:19.729> submit<00:04:20.690> the<00:04:20.810> key<00:04:21.049> and<00:04:21.320> then 00:04:21.759 --> 00:04:21.769 align:start position:0% make the seller submit the key and then 00:04:21.769 --> 00:04:24.040 align:start position:0% make the seller submit the key and then the<00:04:21.950> buyer<00:04:22.100> can<00:04:22.400> decrypt<00:04:23.090> the<00:04:23.300> file<00:04:23.510> to 00:04:24.040 --> 00:04:24.050 align:start position:0% the buyer can decrypt the file to 00:04:24.050 --> 00:04:26.170 align:start position:0% the buyer can decrypt the file to actually<00:04:24.380> look<00:04:24.560> into<00:04:24.740> it<00:04:25.070> and<00:04:25.340> verify<00:04:25.729> if<00:04:26.000> it's 00:04:26.170 --> 00:04:26.180 align:start position:0% actually look into it and verify if it's 00:04:26.180 --> 00:04:28.990 align:start position:0% actually look into it and verify if it's correct<00:04:26.450> or<00:04:26.690> not<00:04:26.750> correct<00:04:26.900> and<00:04:27.620> in<00:04:28.520> case<00:04:28.790> it's 00:04:28.990 --> 00:04:29.000 align:start position:0% correct or not correct and in case it's 00:04:29.000 --> 00:04:30.670 align:start position:0% correct or not correct and in case it's not<00:04:29.180> correct<00:04:29.570> it<00:04:29.810> sends<00:04:30.200> a<00:04:30.290> proof<00:04:30.530> of 00:04:30.670 --> 00:04:30.680 align:start position:0% not correct it sends a proof of 00:04:30.680 --> 00:04:33.730 align:start position:0% not correct it sends a proof of misbehavior<00:04:31.190> to<00:04:32.150> the<00:04:32.540> smart<00:04:32.780> contract<00:04:33.290> which 00:04:33.730 --> 00:04:33.740 align:start position:0% misbehavior to the smart contract which 00:04:33.740 --> 00:04:35.770 align:start position:0% misbehavior to the smart contract which the<00:04:34.010> smart<00:04:34.250> contract<00:04:34.430> the<00:04:34.880> the<00:04:34.910> judge<00:04:35.419> in<00:04:35.630> this 00:04:35.770 --> 00:04:35.780 align:start position:0% the smart contract the the judge in this 00:04:35.780 --> 00:04:39.040 align:start position:0% the smart contract the the judge in this case<00:04:35.840> will<00:04:36.620> verify<00:04:37.300> so<00:04:38.300> the<00:04:38.419> goal<00:04:38.630> here<00:04:38.930> is<00:04:39.020> to 00:04:39.040 --> 00:04:39.050 align:start position:0% case will verify so the goal here is to 00:04:39.050 --> 00:04:40.730 align:start position:0% case will verify so the goal here is to keep<00:04:39.410> this<00:04:39.650> piece<00:04:39.950> of<00:04:40.100> information 00:04:40.730 --> 00:04:40.740 align:start position:0% keep this piece of information 00:04:40.740 --> 00:04:43.700 align:start position:0% keep this piece of information as<00:04:41.010> small<00:04:41.520> as<00:04:41.670> possible<00:04:42.180> ideally<00:04:42.780> independent 00:04:43.700 --> 00:04:43.710 align:start position:0% as small as possible ideally independent 00:04:43.710 --> 00:04:45.830 align:start position:0% as small as possible ideally independent from<00:04:43.950> the<00:04:44.100> size<00:04:44.340> of<00:04:44.580> the<00:04:44.640> overall<00:04:45.150> file<00:04:45.450> and 00:04:45.830 --> 00:04:45.840 align:start position:0% from the size of the overall file and 00:04:45.840 --> 00:04:49.070 align:start position:0% from the size of the overall file and how<00:04:46.680> we<00:04:46.740> did<00:04:47.040> this<00:04:47.220> is<00:04:47.460> by<00:04:48.060> exploiting<00:04:48.630> up<00:04:48.930> the 00:04:49.070 --> 00:04:49.080 align:start position:0% how we did this is by exploiting up the 00:04:49.080 --> 00:04:51.710 align:start position:0% how we did this is by exploiting up the file<00:04:49.290> in<00:04:49.560> many<00:04:49.770> small<00:04:50.100> chunks<00:04:50.580> and<00:04:50.760> the<00:04:51.480> hash 00:04:51.710 --> 00:04:51.720 align:start position:0% file in many small chunks and the hash 00:04:51.720 --> 00:04:53.780 align:start position:0% file in many small chunks and the hash that<00:04:52.020> verifies<00:04:52.470> its<00:04:52.680> correctness<00:04:53.070> actually<00:04:53.640> a 00:04:53.780 --> 00:04:53.790 align:start position:0% that verifies its correctness actually a 00:04:53.790 --> 00:04:57.440 align:start position:0% that verifies its correctness actually a local<00:04:54.060> hash<00:04:54.690> so<00:04:55.500> the<00:04:55.890> hash<00:04:56.070> root<00:04:56.400> of<00:04:56.640> the<00:04:57.180> local 00:04:57.440 --> 00:04:57.450 align:start position:0% local hash so the hash root of the local 00:04:57.450 --> 00:05:00.290 align:start position:0% local hash so the hash root of the local tree<00:04:57.630> is<00:04:58.040> used<00:04:59.040> to<00:04:59.250> verify<00:04:59.430> if<00:04:59.790> the<00:05:00.090> file<00:05:00.270> is 00:05:00.290 --> 00:05:00.300 align:start position:0% tree is used to verify if the file is 00:05:00.300 --> 00:05:03.800 align:start position:0% tree is used to verify if the file is correct<00:05:00.690> or<00:05:01.080> not<00:05:01.170> correct<00:05:01.670> so<00:05:02.670> in<00:05:03.210> this<00:05:03.480> case 00:05:03.800 --> 00:05:03.810 align:start position:0% correct or not correct so in this case 00:05:03.810 --> 00:05:06.380 align:start position:0% correct or not correct so in this case we<00:05:04.260> have<00:05:04.410> a<00:05:04.440> very<00:05:04.680> nice<00:05:04.890> scenario<00:05:05.880> because 00:05:06.380 --> 00:05:06.390 align:start position:0% we have a very nice scenario because 00:05:06.390 --> 00:05:08.480 align:start position:0% we have a very nice scenario because Ellison<00:05:07.170> bought<00:05:07.380> if<00:05:07.620> they<00:05:07.860> disagree<00:05:08.370> about 00:05:08.480 --> 00:05:08.490 align:start position:0% Ellison bought if they disagree about 00:05:08.490 --> 00:05:11.540 align:start position:0% Ellison bought if they disagree about correctness<00:05:09.060> of<00:05:09.270> this<00:05:09.480> can<00:05:10.110> actually<00:05:10.550> limits 00:05:11.540 --> 00:05:11.550 align:start position:0% correctness of this can actually limits 00:05:11.550 --> 00:05:13.970 align:start position:0% correctness of this can actually limits the<00:05:11.820> disagreement<00:05:12.480> to<00:05:12.750> a<00:05:12.780> single<00:05:13.290> element<00:05:13.620> of 00:05:13.970 --> 00:05:13.980 align:start position:0% the disagreement to a single element of 00:05:13.980 --> 00:05:16.790 align:start position:0% the disagreement to a single element of this<00:05:14.280> tree<00:05:14.550> so<00:05:15.420> in<00:05:15.690> that<00:05:15.810> the<00:05:15.870> last<00:05:16.170> element<00:05:16.680> is 00:05:16.790 --> 00:05:16.800 align:start position:0% this tree so in that the last element is 00:05:16.800 --> 00:05:19.940 align:start position:0% this tree so in that the last element is wrong<00:05:17.010> or<00:05:17.640> a<00:05:18.030> single<00:05:18.750> evaluation<00:05:19.050> of<00:05:19.740> this 00:05:19.940 --> 00:05:19.950 align:start position:0% wrong or a single evaluation of this 00:05:19.950 --> 00:05:23.150 align:start position:0% wrong or a single evaluation of this hash<00:05:20.190> tree<00:05:20.490> is<00:05:20.820> wrong<00:05:21.150> and<00:05:21.450> in<00:05:22.050> this<00:05:22.200> case<00:05:22.530> they 00:05:23.150 --> 00:05:23.160 align:start position:0% hash tree is wrong and in this case they 00:05:23.160 --> 00:05:25.220 align:start position:0% hash tree is wrong and in this case they only<00:05:23.340> have<00:05:23.580> to<00:05:23.760> send<00:05:24.000> a<00:05:24.180> single<00:05:24.480> element<00:05:25.110> a 00:05:25.220 --> 00:05:25.230 align:start position:0% only have to send a single element a 00:05:25.230 --> 00:05:27.950 align:start position:0% only have to send a single element a single<00:05:25.650> chunk<00:05:25.920> of<00:05:26.190> the<00:05:26.610> file<00:05:26.820> which<00:05:27.510> the<00:05:27.750> judge 00:05:27.950 --> 00:05:27.960 align:start position:0% single chunk of the file which the judge 00:05:27.960 --> 00:05:30.230 align:start position:0% single chunk of the file which the judge has<00:05:28.200> done<00:05:28.410> to<00:05:28.650> verify<00:05:28.760> this<00:05:29.760> can<00:05:29.970> be<00:05:30.090> done 00:05:30.230 --> 00:05:30.240 align:start position:0% has done to verify this can be done 00:05:30.240 --> 00:05:33.440 align:start position:0% has done to verify this can be done really<00:05:30.780> cheaply<00:05:31.200> we<00:05:31.980> measured<00:05:32.310> it<00:05:32.450> around 00:05:33.440 --> 00:05:33.450 align:start position:0% really cheaply we measured it around 00:05:33.450 --> 00:05:35.840 align:start position:0% really cheaply we measured it around half<00:05:33.720> a<00:05:33.840> year<00:05:34.050> ago<00:05:34.140> where<00:05:34.530> it<00:05:34.560> was<00:05:34.680> like<00:05:35.010> two 00:05:35.840 --> 00:05:35.850 align:start position:0% half a year ago where it was like two 00:05:35.850 --> 00:05:38.420 align:start position:0% half a year ago where it was like two dollars<00:05:36.710> independent<00:05:37.710> from<00:05:37.860> the<00:05:37.980> file<00:05:38.160> size 00:05:38.420 --> 00:05:38.430 align:start position:0% dollars independent from the file size 00:05:38.430 --> 00:05:40.310 align:start position:0% dollars independent from the file size so<00:05:38.730> you<00:05:38.790> could<00:05:38.970> send<00:05:39.210> an<00:05:39.540> arbitrary<00:05:40.080> large 00:05:40.310 --> 00:05:40.320 align:start position:0% so you could send an arbitrary large 00:05:40.320 --> 00:05:43.100 align:start position:0% so you could send an arbitrary large file<00:05:40.620> and<00:05:40.920> this<00:05:41.490> complaint<00:05:42.030> was<00:05:42.240> taking<00:05:42.900> a 00:05:43.100 --> 00:05:43.110 align:start position:0% file and this complaint was taking a 00:05:43.110 --> 00:05:47.500 align:start position:0% file and this complaint was taking a constant<00:05:43.770> amount<00:05:43.860> of<00:05:44.160> fees<00:05:44.930> and<00:05:46.340> we<00:05:47.340> also 00:05:47.500 --> 00:05:47.510 align:start position:0% constant amount of fees and we also 00:05:47.510 --> 00:05:50.000 align:start position:0% constant amount of fees and we also evaluate<00:05:48.510> the<00:05:48.690> security<00:05:48.990> this<00:05:49.470> is<00:05:49.620> something 00:05:50.000 --> 00:05:50.010 align:start position:0% evaluate the security this is something 00:05:50.010 --> 00:05:52.220 align:start position:0% evaluate the security this is something that<00:05:50.190> we<00:05:50.310> take<00:05:50.460> a<00:05:50.520> lot<00:05:50.790> of<00:05:50.820> effort<00:05:51.240> in<00:05:51.420> formally 00:05:52.220 --> 00:05:52.230 align:start position:0% that we take a lot of effort in formally 00:05:52.230 --> 00:05:54.440 align:start position:0% that we take a lot of effort in formally modeling<00:05:52.680> and<00:05:52.950> verifying<00:05:53.550> security<00:05:54.180> of<00:05:54.300> our 00:05:54.440 --> 00:05:54.450 align:start position:0% modeling and verifying security of our 00:05:54.450 --> 00:05:56.690 align:start position:0% modeling and verifying security of our protocols<00:05:55.020> in<00:05:55.320> this<00:05:55.800> case<00:05:56.070> we<00:05:56.340> ensure<00:05:56.670> that 00:05:56.690 --> 00:05:56.700 align:start position:0% protocols in this case we ensure that 00:05:56.700 --> 00:05:59.840 align:start position:0% protocols in this case we ensure that it's<00:05:57.060> fair<00:05:57.330> so<00:05:57.600> atomic<00:05:58.410> exchange<00:05:58.710> of<00:05:59.220> payment 00:05:59.840 --> 00:05:59.850 align:start position:0% it's fair so atomic exchange of payment 00:05:59.850 --> 00:06:02.570 align:start position:0% it's fair so atomic exchange of payment and<00:05:59.970> file<00:06:00.440> we<00:06:01.440> also<00:06:01.620> want<00:06:02.010> to<00:06:02.070> make<00:06:02.250> sure<00:06:02.400> that 00:06:02.570 --> 00:06:02.580 align:start position:0% and file we also want to make sure that 00:06:02.580 --> 00:06:07.100 align:start position:0% and file we also want to make sure that it's<00:06:02.760> sound<00:06:03.140> so<00:06:04.880> the<00:06:05.880> buyer<00:06:06.090> has<00:06:06.510> to<00:06:06.690> guarantee 00:06:07.100 --> 00:06:07.110 align:start position:0% it's sound so the buyer has to guarantee 00:06:07.110 --> 00:06:09.290 align:start position:0% it's sound so the buyer has to guarantee that<00:06:07.140> if<00:06:07.620> he<00:06:07.830> gets<00:06:08.010> a<00:06:08.130> wrong<00:06:08.310> file<00:06:08.670> you<00:06:09.120> can 00:06:09.290 --> 00:06:09.300 align:start position:0% that if he gets a wrong file you can 00:06:09.300 --> 00:06:11.180 align:start position:0% that if he gets a wrong file you can always<00:06:09.750> generate<00:06:09.990> a<00:06:10.290> proof<00:06:10.530> of<00:06:10.680> misbehavior 00:06:11.180 --> 00:06:11.190 align:start position:0% always generate a proof of misbehavior 00:06:11.190 --> 00:06:14.150 align:start position:0% always generate a proof of misbehavior and<00:06:11.520> it<00:06:11.910> will<00:06:12.060> always<00:06:12.240> be<00:06:12.420> accepted<00:06:13.080> and<00:06:13.350> the 00:06:14.150 --> 00:06:14.160 align:start position:0% and it will always be accepted and the 00:06:14.160 --> 00:06:16.160 align:start position:0% and it will always be accepted and the unfortunate<00:06:14.520> EE<00:06:15.030> property<00:06:15.750> is<00:06:15.810> really 00:06:16.160 --> 00:06:16.170 align:start position:0% unfortunate EE property is really 00:06:16.170 --> 00:06:18.020 align:start position:0% unfortunate EE property is really important<00:06:16.620> such<00:06:17.130> that<00:06:17.340> the<00:06:17.430> buyer<00:06:17.610> cannot 00:06:18.020 --> 00:06:18.030 align:start position:0% important such that the buyer cannot 00:06:18.030 --> 00:06:19.580 align:start position:0% important such that the buyer cannot come<00:06:18.330> up<00:06:18.450> with<00:06:18.660> a<00:06:18.690> wrong<00:06:19.080> proof<00:06:19.440> of 00:06:19.580 --> 00:06:19.590 align:start position:0% come up with a wrong proof of 00:06:19.590 --> 00:06:21.500 align:start position:0% come up with a wrong proof of misbehavior<00:06:20.100> claiming<00:06:20.970> the<00:06:21.090> buyer 00:06:21.500 --> 00:06:21.510 align:start position:0% misbehavior claiming the buyer 00:06:21.510 --> 00:06:24.650 align:start position:0% misbehavior claiming the buyer misbehaved<00:06:22.380> even<00:06:22.770> though<00:06:22.890> he<00:06:23.040> didn't<00:06:23.420> and<00:06:24.420> we 00:06:24.650 --> 00:06:24.660 align:start position:0% misbehaved even though he didn't and we 00:06:24.660 --> 00:06:26.840 align:start position:0% misbehaved even though he didn't and we prove<00:06:24.900> all<00:06:25.110> of<00:06:25.170> these<00:06:25.440> properties<00:06:26.160> formally 00:06:26.840 --> 00:06:26.850 align:start position:0% prove all of these properties formally 00:06:26.850 --> 00:06:29.270 align:start position:0% prove all of these properties formally in<00:06:27.090> the<00:06:27.210> paper<00:06:27.560> we<00:06:28.560> also<00:06:28.710> worked<00:06:29.070> on<00:06:29.220> some 00:06:29.270 --> 00:06:29.280 align:start position:0% in the paper we also worked on some 00:06:29.280 --> 00:06:32.930 align:start position:0% in the paper we also worked on some extensions<00:06:30.060> of<00:06:30.240> this<00:06:30.920> the<00:06:31.920> most<00:06:32.160> important 00:06:32.930 --> 00:06:32.940 align:start position:0% extensions of this the most important 00:06:32.940 --> 00:06:34.760 align:start position:0% extensions of this the most important one<00:06:33.120> is<00:06:33.240> that<00:06:33.450> I<00:06:33.660> was<00:06:33.810> basically<00:06:34.650> only 00:06:34.760 --> 00:06:34.770 align:start position:0% one is that I was basically only 00:06:34.770 --> 00:06:36.950 align:start position:0% one is that I was basically only explaining<00:06:35.190> one<00:06:35.430> example<00:06:35.820> with<00:06:36.150> the<00:06:36.300> file<00:06:36.600> and 00:06:36.950 --> 00:06:36.960 align:start position:0% explaining one example with the file and 00:06:36.960 --> 00:06:39.320 align:start position:0% explaining one example with the file and the<00:06:37.140> hash<00:06:37.350> this<00:06:38.100> also<00:06:38.310> works<00:06:38.640> for<00:06:38.880> generic 00:06:39.320 --> 00:06:39.330 align:start position:0% the hash this also works for generic 00:06:39.330 --> 00:06:42.200 align:start position:0% the hash this also works for generic witnesses<00:06:39.930> and<00:06:40.200> circuits<00:06:40.850> so<00:06:41.850> it's<00:06:42.030> very 00:06:42.200 --> 00:06:42.210 align:start position:0% witnesses and circuits so it's very 00:06:42.210 --> 00:06:43.700 align:start position:0% witnesses and circuits so it's very powerful<00:06:42.480> can<00:06:43.170> use 00:06:43.700 --> 00:06:43.710 align:start position:0% powerful can use 00:06:43.710 --> 00:06:46.310 align:start position:0% powerful can use arbitrary<00:06:44.690> programs<00:06:45.690> or<00:06:45.960> can<00:06:46.139> verify 00:06:46.310 --> 00:06:46.320 align:start position:0% arbitrary programs or can verify 00:06:46.320 --> 00:06:50.350 align:start position:0% arbitrary programs or can verify arbitrary<00:06:47.009> programs<00:06:47.520> and<00:06:48.710> we<00:06:49.710> also<00:06:49.860> have 00:06:50.350 --> 00:06:50.360 align:start position:0% arbitrary programs and we also have 00:06:50.360 --> 00:06:52.969 align:start position:0% arbitrary programs and we also have interactive<00:06:51.360> and<00:06:51.990> a<00:06:52.080> non<00:06:52.289> interactive 00:06:52.969 --> 00:06:52.979 align:start position:0% interactive and a non interactive 00:06:52.979 --> 00:06:55.249 align:start position:0% interactive and a non interactive version<00:06:53.280> of<00:06:53.490> this<00:06:54.090> dispute<00:06:54.570> of<00:06:54.810> the<00:06:54.990> proof<00:06:55.139> of 00:06:55.249 --> 00:06:55.259 align:start position:0% version of this dispute of the proof of 00:06:55.259 --> 00:06:57.740 align:start position:0% version of this dispute of the proof of misbehavior<00:06:55.830> and<00:06:56.190> the<00:06:56.820> non<00:06:57.000> interactive<00:06:57.600> is 00:06:57.740 --> 00:06:57.750 align:start position:0% misbehavior and the non interactive is 00:06:57.750 --> 00:07:00.170 align:start position:0% misbehavior and the non interactive is nice<00:06:57.960> because<00:06:58.350> we<00:06:59.039> have<00:06:59.220> as<00:06:59.460> soon<00:06:59.669> as<00:06:59.880> we<00:07:00.030> have 00:07:00.170 --> 00:07:00.180 align:start position:0% nice because we have as soon as we have 00:07:00.180 --> 00:07:02.629 align:start position:0% nice because we have as soon as we have five<00:07:00.720> interactions<00:07:01.710> with<00:07:01.889> the<00:07:02.009> contract<00:07:02.430> and 00:07:02.629 --> 00:07:02.639 align:start position:0% five interactions with the contract and 00:07:02.639 --> 00:07:05.570 align:start position:0% five interactions with the contract and that's<00:07:02.789> it<00:07:03.030> and<00:07:03.330> the<00:07:04.229> interactive<00:07:04.949> dispute 00:07:05.570 --> 00:07:05.580 align:start position:0% that's it and the interactive dispute 00:07:05.580 --> 00:07:07.580 align:start position:0% that's it and the interactive dispute has<00:07:05.789> many<00:07:06.120> more<00:07:06.389> interactions<00:07:07.169> with<00:07:07.410> the 00:07:07.580 --> 00:07:07.590 align:start position:0% has many more interactions with the 00:07:07.590 --> 00:07:10.189 align:start position:0% has many more interactions with the contract<00:07:08.039> but<00:07:08.610> we<00:07:08.759> have<00:07:08.910> three<00:07:09.180> fairness<00:07:09.690> so 00:07:10.189 --> 00:07:10.199 align:start position:0% contract but we have three fairness so 00:07:10.199 --> 00:07:11.900 align:start position:0% contract but we have three fairness so we<00:07:10.350> have<00:07:10.470> the<00:07:10.620> guarantee<00:07:10.770> that<00:07:11.070> all<00:07:11.580> of<00:07:11.759> these 00:07:11.900 --> 00:07:11.910 align:start position:0% we have the guarantee that all of these 00:07:11.910 --> 00:07:13.640 align:start position:0% we have the guarantee that all of these transaction<00:07:12.600> fees<00:07:12.810> that<00:07:12.990> have<00:07:13.050> to<00:07:13.320> be<00:07:13.350> paid 00:07:13.640 --> 00:07:13.650 align:start position:0% transaction fees that have to be paid 00:07:13.650 --> 00:07:16.070 align:start position:0% transaction fees that have to be paid for<00:07:13.919> the<00:07:14.039> dispute<00:07:14.520> will<00:07:15.000> only<00:07:15.270> be<00:07:15.539> carried<00:07:15.900> by 00:07:16.070 --> 00:07:16.080 align:start position:0% for the dispute will only be carried by 00:07:16.080 --> 00:07:18.439 align:start position:0% for the dispute will only be carried by the<00:07:16.139> teacher<00:07:16.470> by<00:07:16.949> the<00:07:17.010> cheating<00:07:17.430> party<00:07:17.789> so<00:07:18.330> an 00:07:18.439 --> 00:07:18.449 align:start position:0% the teacher by the cheating party so an 00:07:18.449 --> 00:07:20.210 align:start position:0% the teacher by the cheating party so an honest<00:07:18.720> party<00:07:19.050> doesn't<00:07:19.320> really<00:07:19.500> care<00:07:19.770> how 00:07:20.210 --> 00:07:20.220 align:start position:0% honest party doesn't really care how 00:07:20.220 --> 00:07:22.250 align:start position:0% honest party doesn't really care how long<00:07:20.400> it<00:07:20.550> takes<00:07:20.760> or<00:07:21.000> how<00:07:21.060> expensive<00:07:21.419> it<00:07:21.720> is<00:07:21.840> it 00:07:22.250 --> 00:07:22.260 align:start position:0% long it takes or how expensive it is it 00:07:22.260 --> 00:07:26.600 align:start position:0% long it takes or how expensive it is it will<00:07:22.500> always<00:07:22.800> get<00:07:22.949> reimbursed<00:07:25.280> now<00:07:26.280> to<00:07:26.340> the 00:07:26.600 --> 00:07:26.610 align:start position:0% will always get reimbursed now to the 00:07:26.610 --> 00:07:28.879 align:start position:0% will always get reimbursed now to the last<00:07:26.820> of<00:07:27.180> three<00:07:27.600> things<00:07:28.199> that<00:07:28.440> I<00:07:28.500> wanted<00:07:28.830> to 00:07:28.879 --> 00:07:28.889 align:start position:0% last of three things that I wanted to 00:07:28.889 --> 00:07:31.159 align:start position:0% last of three things that I wanted to present<00:07:29.250> today<00:07:29.669> which<00:07:30.300> is<00:07:30.330> called<00:07:30.600> fast<00:07:30.900> get 00:07:31.159 --> 00:07:31.169 align:start position:0% present today which is called fast get 00:07:31.169 --> 00:07:33.950 align:start position:0% present today which is called fast get in<00:07:31.650> fast<00:07:31.949> kitten<00:07:32.340> we<00:07:32.850> use<00:07:33.060> a<00:07:33.330> building<00:07:33.750> block 00:07:33.950 --> 00:07:33.960 align:start position:0% in fast kitten we use a building block 00:07:33.960 --> 00:07:35.689 align:start position:0% in fast kitten we use a building block which<00:07:34.139> is<00:07:34.169> called<00:07:34.560> a<00:07:34.680> trusted<00:07:35.099> execution 00:07:35.689 --> 00:07:35.699 align:start position:0% which is called a trusted execution 00:07:35.699 --> 00:07:40.450 align:start position:0% which is called a trusted execution environment<00:07:36.470> te<00:07:37.470> or<00:07:38.070> trusted<00:07:38.490> Hardware<00:07:39.169> where 00:07:40.450 --> 00:07:40.460 align:start position:0% environment te or trusted Hardware where 00:07:40.460 --> 00:07:44.330 align:start position:0% environment te or trusted Hardware where this<00:07:41.460> piece<00:07:42.090> of<00:07:42.270> hardware<00:07:42.720> is<00:07:43.009> trusted<00:07:44.009> to<00:07:44.310> run 00:07:44.330 --> 00:07:44.340 align:start position:0% this piece of hardware is trusted to run 00:07:44.340 --> 00:07:46.580 align:start position:0% this piece of hardware is trusted to run the<00:07:44.729> code<00:07:44.970> we<00:07:45.479> give<00:07:45.660> it<00:07:45.780> and<00:07:46.050> no<00:07:46.259> one<00:07:46.440> can 00:07:46.580 --> 00:07:46.590 align:start position:0% the code we give it and no one can 00:07:46.590 --> 00:07:50.420 align:start position:0% the code we give it and no one can influence<00:07:47.009> this<00:07:47.960> this<00:07:48.960> execution<00:07:49.530> but<00:07:50.280> of 00:07:50.420 --> 00:07:50.430 align:start position:0% influence this this execution but of 00:07:50.430 --> 00:07:52.610 align:start position:0% influence this this execution but of course<00:07:50.699> why<00:07:51.240> this<00:07:51.300> piece<00:07:51.990> of<00:07:52.139> hardware<00:07:52.500> has 00:07:52.610 --> 00:07:52.620 align:start position:0% course why this piece of hardware has 00:07:52.620 --> 00:07:55.040 align:start position:0% course why this piece of hardware has trusted<00:07:53.160> the<00:07:53.610> person<00:07:53.820> that<00:07:54.120> runs<00:07:54.330> it<00:07:54.539> is<00:07:54.750> not 00:07:55.040 --> 00:07:55.050 align:start position:0% trusted the person that runs it is not 00:07:55.050 --> 00:07:58.969 align:start position:0% trusted the person that runs it is not trusted<00:07:55.710> so<00:07:56.370> we<00:07:56.669> have<00:07:56.849> this<00:07:57.030> operator<00:07:57.740> who<00:07:58.740> is 00:07:58.969 --> 00:07:58.979 align:start position:0% trusted so we have this operator who is 00:07:58.979 --> 00:08:01.939 align:start position:0% trusted so we have this operator who is in<00:07:59.909> charge<00:07:59.970> of<00:08:00.419> giving<00:08:00.780> feeding<00:08:01.470> information 00:08:01.939 --> 00:08:01.949 align:start position:0% in charge of giving feeding information 00:08:01.949 --> 00:08:05.779 align:start position:0% in charge of giving feeding information to<00:08:02.490> the<00:08:02.639> TE<00:08:02.820> and<00:08:03.409> forwarding<00:08:04.409> its<00:08:04.620> output<00:08:05.159> so 00:08:05.779 --> 00:08:05.789 align:start position:0% to the TE and forwarding its output so 00:08:05.789 --> 00:08:07.430 align:start position:0% to the TE and forwarding its output so it<00:08:05.880> can<00:08:06.090> stop<00:08:06.360> the<00:08:06.389> te<00:08:06.720> you<00:08:07.020> can<00:08:07.199> stop 00:08:07.430 --> 00:08:07.440 align:start position:0% it can stop the te you can stop 00:08:07.440 --> 00:08:09.589 align:start position:0% it can stop the te you can stop forwarding<00:08:07.979> its<00:08:08.099> messages<00:08:08.669> but<00:08:09.150> it<00:08:09.240> can<00:08:09.449> never 00:08:09.589 --> 00:08:09.599 align:start position:0% forwarding its messages but it can never 00:08:09.599 --> 00:08:12.080 align:start position:0% forwarding its messages but it can never lie<00:08:09.960> about<00:08:10.289> the<00:08:10.680> computation<00:08:11.310> inside<00:08:11.729> the<00:08:11.880> te 00:08:12.080 --> 00:08:12.090 align:start position:0% lie about the computation inside the te 00:08:12.090 --> 00:08:15.560 align:start position:0% lie about the computation inside the te and<00:08:12.539> it<00:08:13.050> cannot<00:08:13.460> influence<00:08:14.460> the<00:08:14.820> computation 00:08:15.560 --> 00:08:15.570 align:start position:0% and it cannot influence the computation 00:08:15.570 --> 00:08:18.620 align:start position:0% and it cannot influence the computation so<00:08:15.919> we<00:08:16.919> use<00:08:17.099> this<00:08:17.370> building<00:08:17.729> block<00:08:17.940> which<00:08:18.300> is 00:08:18.620 --> 00:08:18.630 align:start position:0% so we use this building block which is 00:08:18.630 --> 00:08:21.490 align:start position:0% so we use this building block which is quite<00:08:18.960> common<00:08:19.229> now<00:08:19.440> in<00:08:19.740> in<00:08:20.010> cryptography<00:08:20.370> and 00:08:21.490 --> 00:08:21.500 align:start position:0% quite common now in in cryptography and 00:08:21.500 --> 00:08:25.760 align:start position:0% quite common now in in cryptography and try<00:08:22.500> to<00:08:22.560> run<00:08:23.099> smart<00:08:23.400> contracts<00:08:23.940> inside<00:08:24.770> this 00:08:25.760 --> 00:08:25.770 align:start position:0% try to run smart contracts inside this 00:08:25.770 --> 00:08:28.790 align:start position:0% try to run smart contracts inside this piece<00:08:26.760> of<00:08:26.880> hardware<00:08:27.240> and<00:08:28.020> we<00:08:28.260> get<00:08:28.409> from<00:08:28.650> this 00:08:28.790 --> 00:08:28.800 align:start position:0% piece of hardware and we get from this 00:08:28.800 --> 00:08:30.770 align:start position:0% piece of hardware and we get from this is<00:08:29.010> actually<00:08:29.340> a<00:08:29.370> really<00:08:29.580> powerful<00:08:29.880> protocol 00:08:30.770 --> 00:08:30.780 align:start position:0% is actually a really powerful protocol 00:08:30.780 --> 00:08:33.310 align:start position:0% is actually a really powerful protocol because<00:08:31.409> we<00:08:31.710> can<00:08:31.919> run<00:08:32.669> a<00:08:32.700> contract 00:08:33.310 --> 00:08:33.320 align:start position:0% because we can run a contract 00:08:33.320 --> 00:08:36.560 align:start position:0% because we can run a contract independent<00:08:34.320> of<00:08:34.409> size<00:08:34.620> of<00:08:35.070> chain<00:08:35.580> we<00:08:36.360> have 00:08:36.560 --> 00:08:36.570 align:start position:0% independent of size of chain we have 00:08:36.570 --> 00:08:38.690 align:start position:0% independent of size of chain we have very<00:08:36.990> high<00:08:37.080> guarantees<00:08:37.890> we<00:08:38.159> can<00:08:38.339> protect 00:08:38.690 --> 00:08:38.700 align:start position:0% very high guarantees we can protect 00:08:38.700 --> 00:08:40.459 align:start position:0% very high guarantees we can protect against<00:08:39.089> malicious<00:08:39.390> mock<00:08:39.719> parties<00:08:40.200> and 00:08:40.459 --> 00:08:40.469 align:start position:0% against malicious mock parties and 00:08:40.469 --> 00:08:43.040 align:start position:0% against malicious mock parties and malicious<00:08:41.070> operator<00:08:41.510> we<00:08:42.510> can<00:08:42.539> uniquely 00:08:43.040 --> 00:08:43.050 align:start position:0% malicious operator we can uniquely 00:08:43.050 --> 00:08:44.840 align:start position:0% malicious operator we can uniquely actually<00:08:43.529> be<00:08:43.620> at<00:08:43.680> fault<00:08:43.950> in<00:08:44.310> case<00:08:44.520> someone 00:08:44.840 --> 00:08:44.850 align:start position:0% actually be at fault in case someone 00:08:44.850 --> 00:08:47.420 align:start position:0% actually be at fault in case someone misbehaves<00:08:45.390> and<00:08:45.630> also<00:08:46.440> this<00:08:46.589> protocol<00:08:47.010> is<00:08:47.160> so 00:08:47.420 --> 00:08:47.430 align:start position:0% misbehaves and also this protocol is so 00:08:47.430 --> 00:08:48.550 align:start position:0% misbehaves and also this protocol is so simple 00:08:48.550 --> 00:08:48.560 align:start position:0% simple 00:08:48.560 --> 00:08:52.090 align:start position:0% simple we<00:08:48.620> can<00:08:48.770> actually<00:08:49.040> build<00:08:49.220> it<00:08:49.310> on<00:08:49.430> Bitcoin<00:08:51.100> okay 00:08:52.090 --> 00:08:52.100 align:start position:0% we can actually build it on Bitcoin okay 00:08:52.100 --> 00:08:53.290 align:start position:0% we can actually build it on Bitcoin okay so<00:08:52.160> how<00:08:52.520> does<00:08:52.580> it<00:08:52.730> work 00:08:53.290 --> 00:08:53.300 align:start position:0% so how does it work 00:08:53.300 --> 00:08:56.230 align:start position:0% so how does it work we<00:08:53.750> have<00:08:53.930> this<00:08:54.140> T<00:08:54.500> here<00:08:54.740> in<00:08:55.220> the<00:08:55.340> operator<00:08:55.730> and 00:08:56.230 --> 00:08:56.240 align:start position:0% we have this T here in the operator and 00:08:56.240 --> 00:08:58.510 align:start position:0% we have this T here in the operator and all<00:08:56.990> of<00:08:57.110> the<00:08:57.230> parties<00:08:57.620> so<00:08:57.860> they<00:08:58.010> want<00:08:58.250> to<00:08:58.370> play 00:08:58.510 --> 00:08:58.520 align:start position:0% all of the parties so they want to play 00:08:58.520 --> 00:09:00.790 align:start position:0% all of the parties so they want to play a<00:08:58.550> poker<00:08:58.880> game<00:08:58.970> now<00:08:59.300> which<00:08:59.810> means<00:08:59.990> we<00:09:00.290> load<00:09:00.650> the 00:09:00.790 --> 00:09:00.800 align:start position:0% a poker game now which means we load the 00:09:00.800 --> 00:09:03.430 align:start position:0% a poker game now which means we load the poker<00:09:01.010> game<00:09:01.279> into<00:09:01.880> this<00:09:02.029> piece<00:09:02.930> of<00:09:03.050> card<00:09:03.260> where 00:09:03.430 --> 00:09:03.440 align:start position:0% poker game into this piece of card where 00:09:03.440 --> 00:09:07.810 align:start position:0% poker game into this piece of card where the<00:09:04.340> parties<00:09:04.730> attest<00:09:05.600> this<00:09:06.290> te<00:09:06.950> so<00:09:07.490> they<00:09:07.640> know 00:09:07.810 --> 00:09:07.820 align:start position:0% the parties attest this te so they know 00:09:07.820 --> 00:09:10.090 align:start position:0% the parties attest this te so they know that<00:09:07.850> this<00:09:08.210> is<00:09:08.390> actually<00:09:08.680> trusted<00:09:09.680> hardware 00:09:10.090 --> 00:09:10.100 align:start position:0% that this is actually trusted hardware 00:09:10.100 --> 00:09:11.860 align:start position:0% that this is actually trusted hardware and<00:09:10.250> this<00:09:10.339> is<00:09:10.520> actually<00:09:11.270> running<00:09:11.480> the<00:09:11.690> right 00:09:11.860 --> 00:09:11.870 align:start position:0% and this is actually running the right 00:09:11.870 --> 00:09:15.010 align:start position:0% and this is actually running the right code<00:09:12.140> and<00:09:12.670> then<00:09:13.670> the<00:09:13.790> operator<00:09:14.240> deposits<00:09:14.870> a 00:09:15.010 --> 00:09:15.020 align:start position:0% code and then the operator deposits a 00:09:15.020 --> 00:09:17.800 align:start position:0% code and then the operator deposits a security<00:09:15.560> penalty<00:09:15.950> deposit<00:09:16.580> and<00:09:16.820> all<00:09:17.570> of<00:09:17.690> the 00:09:17.800 --> 00:09:17.810 align:start position:0% security penalty deposit and all of the 00:09:17.810 --> 00:09:21.250 align:start position:0% security penalty deposit and all of the parties<00:09:18.170> lock<00:09:18.410> the<00:09:18.560> coins<00:09:18.800> for<00:09:19.310> the<00:09:19.370> game<00:09:20.260> then 00:09:21.250 --> 00:09:21.260 align:start position:0% parties lock the coins for the game then 00:09:21.260 --> 00:09:23.410 align:start position:0% parties lock the coins for the game then we<00:09:21.410> start<00:09:21.710> and<00:09:22.010> at<00:09:22.279> this<00:09:22.400> point<00:09:22.700> we<00:09:23.120> don't<00:09:23.240> need 00:09:23.410 --> 00:09:23.420 align:start position:0% we start and at this point we don't need 00:09:23.420 --> 00:09:25.000 align:start position:0% we start and at this point we don't need the<00:09:23.570> blockchain<00:09:23.779> we<00:09:24.410> just<00:09:24.650> run<00:09:24.830> everything 00:09:25.000 --> 00:09:25.010 align:start position:0% the blockchain we just run everything 00:09:25.010 --> 00:09:27.550 align:start position:0% the blockchain we just run everything off<00:09:25.430> chain<00:09:25.700> so<00:09:26.420> the<00:09:26.540> parties<00:09:26.900> send<00:09:27.380> their 00:09:27.550 --> 00:09:27.560 align:start position:0% off chain so the parties send their 00:09:27.560 --> 00:09:30.370 align:start position:0% off chain so the parties send their inputs<00:09:28.040> to<00:09:28.279> the<00:09:28.400> TE<00:09:28.630> but<00:09:29.630> I<00:09:29.660> actually<00:09:29.870> do<00:09:30.110> it<00:09:30.260> in 00:09:30.370 --> 00:09:30.380 align:start position:0% inputs to the TE but I actually do it in 00:09:30.380 --> 00:09:32.260 align:start position:0% inputs to the TE but I actually do it in an<00:09:30.470> encrypted<00:09:30.740> way<00:09:31.070> so<00:09:31.400> the<00:09:31.490> operator<00:09:31.850> cannot 00:09:32.260 --> 00:09:32.270 align:start position:0% an encrypted way so the operator cannot 00:09:32.270 --> 00:09:35.890 align:start position:0% an encrypted way so the operator cannot see<00:09:32.870> the<00:09:33.110> inputs<00:09:33.440> and<00:09:33.650> the<00:09:34.550> TE<00:09:34.760> also<00:09:35.450> sends<00:09:35.779> an 00:09:35.890 --> 00:09:35.900 align:start position:0% see the inputs and the TE also sends an 00:09:35.900 --> 00:09:39.280 align:start position:0% see the inputs and the TE also sends an encrypted<00:09:36.230> output<00:09:36.800> back<00:09:37.310> to<00:09:37.339> the<00:09:37.610> parties<00:09:38.290> so 00:09:39.280 --> 00:09:39.290 align:start position:0% encrypted output back to the parties so 00:09:39.290 --> 00:09:41.260 align:start position:0% encrypted output back to the parties so the<00:09:39.380> operator<00:09:39.740> has<00:09:40.400> no<00:09:40.580> idea<00:09:40.910> of<00:09:41.000> what's 00:09:41.260 --> 00:09:41.270 align:start position:0% the operator has no idea of what's 00:09:41.270 --> 00:09:43.570 align:start position:0% the operator has no idea of what's actually<00:09:41.480> happening<00:09:41.720> and<00:09:42.320> also<00:09:43.100> the<00:09:43.190> parties 00:09:43.570 --> 00:09:43.580 align:start position:0% actually happening and also the parties 00:09:43.580 --> 00:09:45.880 align:start position:0% actually happening and also the parties don't<00:09:44.089> see<00:09:44.300> each<00:09:44.420> other's<00:09:44.779> inputs<00:09:45.230> this<00:09:45.770> is 00:09:45.880 --> 00:09:45.890 align:start position:0% don't see each other's inputs this is 00:09:45.890 --> 00:09:47.710 align:start position:0% don't see each other's inputs this is also<00:09:46.220> a<00:09:46.250> nice<00:09:46.400> feature<00:09:46.700> with<00:09:47.150> a<00:09:47.330> theorem 00:09:47.710 --> 00:09:47.720 align:start position:0% also a nice feature with a theorem 00:09:47.720 --> 00:09:50.170 align:start position:0% also a nice feature with a theorem doesn't<00:09:48.320> have<00:09:48.680> right<00:09:49.370> now<00:09:49.400> and<00:09:49.790> it's<00:09:49.910> really 00:09:50.170 --> 00:09:50.180 align:start position:0% doesn't have right now and it's really 00:09:50.180 --> 00:09:52.390 align:start position:0% doesn't have right now and it's really hard<00:09:50.510> to<00:09:50.660> build<00:09:50.810> its<00:09:51.050> my<00:09:51.200> contracts<00:09:51.770> but<00:09:52.220> it's 00:09:52.390 --> 00:09:52.400 align:start position:0% hard to build its my contracts but it's 00:09:52.400 --> 00:09:56.890 align:start position:0% hard to build its my contracts but it's given<00:09:52.640> for<00:09:52.820> free<00:09:52.940> in<00:09:53.120> this<00:09:53.270> setup<00:09:54.910> so<00:09:55.910> now<00:09:56.210> the 00:09:56.890 --> 00:09:56.900 align:start position:0% given for free in this setup so now the 00:09:56.900 --> 00:09:59.740 align:start position:0% given for free in this setup so now the parties<00:09:57.200> can<00:09:57.350> actually<00:09:57.680> see<00:09:57.890> who<00:09:58.130> won<00:09:58.370> and<00:09:58.940> get 00:09:59.740 --> 00:09:59.750 align:start position:0% parties can actually see who won and get 00:09:59.750 --> 00:10:02.620 align:start position:0% parties can actually see who won and get their<00:09:59.930> money<00:10:00.140> back<00:10:00.350> from<00:10:00.680> the<00:10:01.100> TE<00:10:01.390> which<00:10:02.390> means 00:10:02.620 --> 00:10:02.630 align:start position:0% their money back from the TE which means 00:10:02.630 --> 00:10:04.540 align:start position:0% their money back from the TE which means that<00:10:02.810> he<00:10:02.930> outputs<00:10:03.470> a<00:10:03.589> transaction<00:10:04.190> saying 00:10:04.540 --> 00:10:04.550 align:start position:0% that he outputs a transaction saying 00:10:04.550 --> 00:10:06.850 align:start position:0% that he outputs a transaction saying okay<00:10:04.820> here<00:10:05.270> Alessio<00:10:05.720> Charlie<00:10:06.080> get<00:10:06.620> other 00:10:06.850 --> 00:10:06.860 align:start position:0% okay here Alessio Charlie get other 00:10:06.860 --> 00:10:09.850 align:start position:0% okay here Alessio Charlie get other coins<00:10:07.270> of<00:10:08.270> course<00:10:08.570> we<00:10:09.080> still<00:10:09.260> have<00:10:09.320> to<00:10:09.560> protect 00:10:09.850 --> 00:10:09.860 align:start position:0% coins of course we still have to protect 00:10:09.860 --> 00:10:12.010 align:start position:0% coins of course we still have to protect against<00:10:10.370> all<00:10:10.580> this<00:10:11.000> power<00:10:11.300> that<00:10:11.570> the<00:10:11.690> operator 00:10:12.010 --> 00:10:12.020 align:start position:0% against all this power that the operator 00:10:12.020 --> 00:10:15.430 align:start position:0% against all this power that the operator has<00:10:12.140> so<00:10:13.070> in<00:10:13.190> case<00:10:13.460> it<00:10:13.670> misbehaves<00:10:14.210> we<00:10:15.080> actually 00:10:15.430 --> 00:10:15.440 align:start position:0% has so in case it misbehaves we actually 00:10:15.440 --> 00:10:17.350 align:start position:0% has so in case it misbehaves we actually have<00:10:15.650> to<00:10:15.800> wait<00:10:15.950> for<00:10:16.250> a<00:10:16.280> certain<00:10:16.490> time<00:10:16.880> out<00:10:17.089> and 00:10:17.350 --> 00:10:17.360 align:start position:0% have to wait for a certain time out and 00:10:17.360 --> 00:10:19.510 align:start position:0% have to wait for a certain time out and then<00:10:17.810> the<00:10:17.960> parties<00:10:18.320> get<00:10:18.560> refunded<00:10:19.040> their 00:10:19.510 --> 00:10:19.520 align:start position:0% then the parties get refunded their 00:10:19.520 --> 00:10:21.280 align:start position:0% then the parties get refunded their money<00:10:19.700> but<00:10:20.060> the<00:10:20.180> operator<00:10:20.570> lost<00:10:20.870> his<00:10:21.140> security 00:10:21.280 --> 00:10:21.290 align:start position:0% money but the operator lost his security 00:10:21.290 --> 00:10:24.520 align:start position:0% money but the operator lost his security deposit<00:10:21.740> which<00:10:22.550> is<00:10:22.730> well<00:10:23.180> really<00:10:23.930> painful<00:10:24.200> for 00:10:24.520 --> 00:10:24.530 align:start position:0% deposit which is well really painful for 00:10:24.530 --> 00:10:28.030 align:start position:0% deposit which is well really painful for him<00:10:25.390> so<00:10:26.390> to<00:10:26.450> summarise<00:10:27.050> over<00:10:27.500> all<00:10:27.710> of<00:10:27.860> these 00:10:28.030 --> 00:10:28.040 align:start position:0% him so to summarise over all of these 00:10:28.040 --> 00:10:30.760 align:start position:0% him so to summarise over all of these three<00:10:28.280> works<00:10:28.520> is<00:10:28.990> a<00:10:29.990> very<00:10:30.470> interesting 00:10:30.760 --> 00:10:30.770 align:start position:0% three works is a very interesting 00:10:30.770 --> 00:10:33.100 align:start position:0% three works is a very interesting observation<00:10:31.280> that<00:10:32.030> smart<00:10:32.450> contracts<00:10:32.930> are 00:10:33.100 --> 00:10:33.110 align:start position:0% observation that smart contracts are 00:10:33.110 --> 00:10:35.020 align:start position:0% observation that smart contracts are really<00:10:33.410> powerful<00:10:33.890> tools<00:10:34.130> that<00:10:34.490> we<00:10:34.610> can<00:10:34.820> use<00:10:34.850> to 00:10:35.020 --> 00:10:35.030 align:start position:0% really powerful tools that we can use to 00:10:35.030 --> 00:10:37.900 align:start position:0% really powerful tools that we can use to ensure<00:10:35.540> security<00:10:36.020> and<00:10:36.440> that<00:10:36.980> can<00:10:37.190> also<00:10:37.400> use<00:10:37.730> to 00:10:37.900 --> 00:10:37.910 align:start position:0% ensure security and that can also use to 00:10:37.910 --> 00:10:41.260 align:start position:0% ensure security and that can also use to build<00:10:38.060> more<00:10:38.390> scalable<00:10:38.660> protocols<00:10:39.410> and<00:10:40.270> our 00:10:41.260 --> 00:10:41.270 align:start position:0% build more scalable protocols and our 00:10:41.270 --> 00:10:43.660 align:start position:0% build more scalable protocols and our goal<00:10:42.200> here<00:10:42.230> is<00:10:42.800> to<00:10:42.830> really<00:10:43.459> provide 00:10:43.660 --> 00:10:43.670 align:start position:0% goal here is to really provide 00:10:43.670 --> 00:10:46.000 align:start position:0% goal here is to really provide cryptographic<00:10:44.390> models<00:10:45.050> and<00:10:45.260> proofs<00:10:45.529> with<00:10:45.830> all 00:10:46.000 --> 00:10:46.010 align:start position:0% cryptographic models and proofs with all 00:10:46.010 --> 00:10:48.250 align:start position:0% cryptographic models and proofs with all of<00:10:46.160> these<00:10:46.310> protocols<00:10:46.700> and<00:10:47.089> really<00:10:47.390> show<00:10:47.660> that 00:10:48.250 --> 00:10:48.260 align:start position:0% of these protocols and really show that 00:10:48.260 --> 00:10:51.400 align:start position:0% of these protocols and really show that they<00:10:48.440> satisfied<00:10:48.980> cryptographic<00:10:49.430> security<00:10:50.410> so 00:10:51.400 --> 00:10:51.410 align:start position:0% they satisfied cryptographic security so 00:10:51.410 --> 00:10:52.720 align:start position:0% they satisfied cryptographic security so if<00:10:51.560> you<00:10:51.680> want<00:10:51.860> to<00:10:51.890> learn<00:10:52.070> more<00:10:52.250> about<00:10:52.310> this 00:10:52.720 --> 00:10:52.730 align:start position:0% if you want to learn more about this 00:10:52.730 --> 00:10:55.650 align:start position:0% if you want to learn more about this feel<00:10:53.300> free<00:10:53.480> to<00:10:53.510> talk<00:10:53.810> to<00:10:53.839> me<00:10:53.990> here<00:10:54.770> at<00:10:54.860> DEFCON 00:10:55.650 --> 00:10:55.660 align:start position:0% feel free to talk to me here at DEFCON 00:10:55.660 --> 00:10:57.070 align:start position:0% feel free to talk to me here at DEFCON thank<00:10:55.840> you 00:10:57.070 --> 00:10:57.080 align:start position:0% thank you 00:10:57.080 --> 00:11:07.769 align:start position:0% thank you [Applause] 00:11:07.769 --> 00:11:07.779 align:start position:0% 00:11:07.779 --> 00:11:09.839 align:start position:0% you