Varun Rajeev Madathil

[Chris Peikert @ChrisPeikert]

The bots and I made a little thing for my cryptography class: the one-way function transform lab.

Interactively write security proofs (reductions + analysis) and attacks, both correct and wrong, for a variety of natural function transforms.

https://t.co/mxsuC2LdqX

[Varun Rajeev Madathil @Varun_2703]

@luhelminger @GuyZys But this will still need additional machinery like multikey FHE, or key switching. This still requires extending the construction and the model. Definitely an interesting question!

[Varun Rajeev Madathil @Varun_2703]

@luhelminger @GuyZys Thanks!
And yes! You’re right PriFHEte focuses on payments only so it doesn’t provide a private shared state abstraction. One could maybe keep the AMM state under a contract-specific FHE key and evaluate the AMM transaction homomorphically.

[Varun Rajeev Madathil @Varun_2703]

@luhelminger @GuyZys Our recent Asiacrypt paper PriFHEte (https://t.co/26nLA3SsJD ) gives these anonymity guarantees for private transactions with FHE. Anonymity indeed is quite challenging - for private transactions you need O(N) computation if the state has N accounts.

[Varun Rajeev Madathil @Varun_2703]

@0xFanZhang Secure Aggregation for Federated Learning used by Google (Bonawitz et al. https://t.co/wu4ASeH7v9)

[Bas Westerbaan @bwesterb]

First Google found a much better quantum algorithm that'll run on any quantum computer to break elliptic curves. They're not releasing it: they only show they have it with a ZK proof. https://t.co/6OyEDcXq0w

[Varun Rajeev Madathil @Varun_2703]

@zkdragon @colludingnode @WatsonLadd @payy_link If you don’t want to FHE, Private Signaling (the exact same problem as OMR) allows for retrieval as well. We show two solutions - one with TEE and another with MPC.

https://t.co/gHjuX3j1p7

There also a couple of follow-up works to make retrieval more efficient!

[(Guy Zyskind*) @GuyZys]

Anonymity: the Achilles’ heel of privacy on Ethereum

Anonymity means unlinkability: observers shouldn’t be able to tell which user sent/received funds (and by extension - what assets they have in their possession).

In traditional finance, that’s trivial (banks know, the public doesn’t). On blockchains, it’s hard - every transaction is public, deterministic, and permanently linked.

In UTXO systems (Bitcoin, @Zcash), anonymity is relatively easy: you don't have account balances. Instead, each wallet controls a set of 'unspent coins', which are otherwise stateless. Sending a coin means creating a transaction that spends a previously unspent coin and creates one or more outputs of unspent coins linked to one or more other addresses. For example, if I have unspent 10 BTC, and I want to send 2 BTC, I'm going to link those coins to two new unspent outputs: one to the address I want to send funds to (2 BTC), and the rest (8 BTC) to an address I control. If you ever sent a Bitcoin transaction you probably know this.

To get anonymity (a-la $ZEC), we can very efficiently prove in zero-knowledge – i.e., without anyone knowing – that spent coins were correctly transferred between parties, without leaking who those parties are (anonymity) or the coin amount (confidentiality). This is thanks to the UTXO model, and because all coins are committed to and tracked via a Merkle Tree. Proving in zk that something belongs in the tree is very efficient. Yey.

But Ethereum (and other account-based systems like Solana) work differently. Each user maintains a single account balance. I'm a fan of the account model, as I'm guessing most users and especially devs are. It is so much simpler. It's basically your bank account - your address controls a single entry in the state marking your balance. Any transaction you send simply decreases your balance and increases someone else's. Just like a bank transfer.

But this is stateful, and it is not clear how to efficiently anonymize who the sender/receiver are in each transaction. Confidentiality on the other hard is solved - you can use FHE (even partial HE like in Solana) to encrypt balances/amounts.

Systems like Tornado Cash, Railgun, and Privacy Pools tackle this by carving out UTXO-like sublayers within Ethereum. You deposit ETH or tokens, then withdraw to a new address, effectively simulating “notes.” It works – but at a cost. You lose composability and programmability: private assets can’t interact natively with DeFi, contracts, or cross-chain logic without breaking anonymity. And we really lose any benefit of the nice and clean account model that is so easy to reason about.

What we really want is native anonymity for the account model – one that preserves privacy and keeps smart contracts composable. That’s a much harder problem, but an important one.

Two recent works explore this space.
🔹 High-Throughput Three-Party DPFs with Applications to ORAM and Digital Currencies (my work with @AvishaiY and @alex_pentland)

This work is blazing fast, but it suffers from MPC's difficulty to scale beyond a very small number of servers (3 in this case), so this won't work for public blockchains.

Link: https://t.co/cazTK6UvNt
🔹 PriFHEte: Achieving Full-Privacy in Account-based Cryptocurrencies is Possible:

FHE-based, but mostly a feasibility result and not a practical one
https://t.co/zEphUvOqYQ

Solving anonymity on Ethereum natively on the account based model, and combining it with FHE is a critical problem to solve. I've been exploring solutions to this, and @fhenix we're working on an idea that could hopefully put this to rest.

[Varun Rajeev Madathil @Varun_2703]

@KyleSamani We have a paper at Asiacrypt this year that also uses FHE to show full privacy for account-based cryptocurrencies is possible.

https://t.co/26nLA3SsJD

[Yale Applied Cryptography Laboratory @YaleACL]

Join us tomorrow for a talk by @rel_zeta_tech (@aztecnetwork)!
🪧Title: Revisiting the IPA-sumcheck connection
📅When: 1pm ET, Sep 10
📷Livestream: https://t.co/cfbjEvqM5E

[Varun Rajeev Madathil @Varun_2703]

@kostascrypto Secure Multiparty Computation ❌
Secure Mussel Computation ✅

[Yale Applied Cryptography Laboratory @YaleACL]

Join us tomorrow for a very interesting talk by Adam O'Neill (@UMassAmherst)!
🪧Title: Schnorr Signatures are Tightly Secure in the ROM under a Non-Interactive Assumption
📅When: 11am, Feb. 7th
📷Livestream: https://t.co/cfbjEvqeg6

[Yale Applied Cryptography Laboratory @YaleACL]

We're excited to kick off our seminar series this semester with a talk by @GGrivol (NYU Stern) on Optimal Block Times Under Decentralized Exchange Arbitrage!
📅 Join us for the talk at noon, January 31st.
📽️ For more details & a link to the livestream:
https://t.co/cfbjEvqM5E

[Aniket Kate @aniketpkate]

[New Paper Alert] A Homerun for oblivious message retrieval (OMR) (https://t.co/wWI5peT2YN) w/ Yanxue Xia (https://t.co/moiUcppkYv) n @Varun_2703

[Varun Rajeev Madathil @Varun_2703]

@zkproofs Write a Part 2 to https://t.co/pxYmPTZZ7a 😛

[Sri AravindaKrishnan @aravind16coiner]

Happy to announce that the paper https://t.co/cSxnzNYeiz will appear at NDSS 2023. My first paper at NDSS after many attempts :) Amazing cross continental collaboration with @Varun_2703 @pedrorechez @LLFOURN Dimitrios and Giulio.

[Varun Rajeev Madathil @Varun_2703]

@cronokirby @socrates1024 https://t.co/3d31jWgJ9N

[Triangle BitDevs @TriangleBitDevs]

Just scheduled Socratic Seminar 10. Sep 28th @ 6pm.

Please note the new location in the Durham Main library!

I'm very excited to announce we will have @Varun_2703 join us to discuss his work on new crypto to resolve DLC contracts.

Also, you can join remotely! We'll be on jitsi

[Abdullah Talayhan @talayhan_a]

(1/8) I am very happy to announce https://t.co/m0YHFEIZgW, a non-commercial platform to discuss and ask questions about Cryptology ePrint Archive papers. It aims to accumulate knowledge around papers in cryptography.

[Varun Rajeev Madathil @Varun_2703]

@vnprc I’m down let me know the details!