Loading...
Àpilẹ̀kọ yìí jẹ́ àgbéyọ láti inú ìwé ìròyìn BBC. Òpópónà Ẹ̀rí, iwe ti o ni ominira kan ti n ṣakiyesi iṣiro-itọju aṣiri: ZK, FHE, MPC, TEEs, ati idanimọ aifọwọyi. Ti a tẹjade akọkọ bi "Ìpamọ́ ní ìfiwéra: ohun tí àwọn ẹ̀ka-ìmọ̀láàyè ìdánimọ̀ mẹrin ṣèlérí" a ṣe àtúnṣe rẹ̀ pẹ̀lú ìyọ́ǹda ẹni gẹ́gẹ́ bí apá kan ìwé ìròyìn yìí. Ìpínlẹ̀ Àjọ Zcash #339. Látọwọ́ Stephen Webber.
Ní òpin oṣù July, Zama yí padà sí ilé ìtura kan tí ó ń jẹ́ "The Village". ibi ìfọwọ́sípò ìdánilójú (confidential swap venue) lórí ẹ̀rọ-ìmọ́ Ethereum, ní ìdánwò àdáni ṣáájú ìfilọlẹ̀ sí gbogbo ènìyàn ni oṣù Kẹsán, èyí tí ó jẹ́ kó ṣeé ṣe fún oníṣòwò láti fi èròǹgbà kan tó ti parọ́pò bo iye owó náà pamọ́, iyàfàyè gba dídawó àti itọsọna ìṣòwò.
It relies on a small piece of choreography for this. The trader deposits two confidential transfers, one carrying the actual assets and one for the opposite leg with a zero amount, so an observer sees a bidirectional movement of hidden size and cannot tell a buy from a sell. Whitelisted market makers decrypt the intent, see the size but not the direction, and quote both sides. A sealed-bid auction settles on chain, and only the winning maker learns which way the trade moved. The net result is a swap executed at size on a public chain, where no single party outside the trade ever assembles the whole picture.
Zama describes the product as confidential end-to-end, but what does that confidentiality really entail? Confidentiality here requires confidentiality along a whole chain of actions, so that the public sees one thing, the losing bidders see more, since they decrypted the trade's size in order to quote it, and the winning bidder sees more still. To put it simply, each stage of the sequence is that way because of a decision someone made about who needs to know what, and when. It would be nice to sum up confidentiality as "nobody sees anything," but nothing would work in practice. Confidentiality has to be structured, and it has to follow a sequence.
What's interesting is that nearly ten years before that launch, Zcash put the first confidential settlement layer on a public blockchain, using zero-knowledge proofs to hide the sender, receiver, and amount of a transaction while proving to everyone that the transaction was valid. In the decade since, "confidential" has become the adjective for at least four distinct families of technology: shielded transactions, fully homomorphic encryption, multi-party computation, and trusted execution environments. Products from all four families now run in production, several of them on the same chain. So, what's inside the tin?
Àwọn ìdílé mẹ́rin náà fúnni ní ìdáhùn tó yàtọ̀ síra, tí ó sì máa ń bojú pọ̀ nígbà míì sáwọn ìṣòro mẹ́rin òdìkejì. Níwọ̀n bí gbogbo ìdáhùn ti wá di ohun èlò báyìí, ojúṣe gidi ni láti mọ èyí tá a fi ṣe àríyànjiyàn wa gan-an.
Gbogbo àlàyé nípa ìpamọ́, nígbàtí a bá tú u sí abẹ̀rẹ́ rẹ̀ ní láti dáhùn ìbéèrè mẹrin. Ìsọfúnni wo ni ó wà láìsí? Láti ọ̀dọ̀ ta? Ní ìgbà wo nínú ìgbésí ayé àwọn ìsọfún náà? Kíni o sì gbọ́dò gbẹkẹlé fún ìdánilójú wípé yóò yè?
As an example, take the swap venue. It must hide amount, direction, and slippage. Why not the asset pair? Zama says a future version will conceal that too. From whom: the public and the front-running bots fully, the quoting market makers partially, the winning maker least of all. During which phase: through quoting and auction, with a designed disclosure at settlement. And whom you need to trust: the guarantee rests on the FHE itself, on the smart contracts, and on a threshold key-management system whose operators must not collude past a threshold. Per the ìwé alábala, kò sí ẹni kan ṣoṣo tó lè rí kókó ìdìbò náà gbà.
O jẹ apẹrẹ fun ṣiṣe iwọn laisi igbimọ igbohunsafefe. Awọn oluṣe ọja rii iwọn nitori wọn ko le ṣe idiyele agbasọ kan lai si rẹ. Oluṣowo kọ itọsọna nitori, daradara, idoko-owo nilo o.
Ohun tí àpèjúwe yìí fi hàn ni pé ẹ̀tọ́ tó dà bí ìdìkejì, bíi wípé nǹkan kan jẹ́ àṣírí tàbí kò ṣe é ní ti gidi ń wọ inú ètò àwọn ààlà. Ọ̀nà púpọ̀ ló wà láti dé orí ẹ̀tọ́ ọ̀kan náà.
A shielded Zcash transaction hides the sender, the receiver, and the amount. What remains public is the proof: a zero-knowledge argument, checkable by anyone running a node, that the hidden transaction follows the rules. Shielded funds exist as encrypted notes, each one a private record of an amount and its owner that appears on chain only as a cryptographic commitment. Spending a note publishes a nullifier, a value that prevents the same note from ever being spent twice without revealing which note it was. This means the network can reject double-spends without ever learning which funds moved, so spending leaves no trail linking one transaction to another. The proof's job is to establish that the spender owned the note, that the transaction's values balance, and that no ZEC was created or destroyed, all without disclosing any of the quantities involved.
The design's distinguishing property is most apparent when considering what must be trusted. There is no committee that can decrypt a shielded transaction, no operator set whose collusion threshold matters, no hardware vendor whose attestation must be believed. What remains in the trust base is the mathematics and the correctness of the circuits that encode the rules. For anyone whose threat model includes the infrastructure itself, operators who can be pressured, vendors who can be compromised, that short list is the product.
Bi ọrọ ti o daju, pe igbẹkẹle ipilẹ ni a ṣe idanwo nikan ninu iṣelọpọ. Ni Oṣu Karun ọjọ 29, Taylor Hornby, oluwadi aabo kan ṣayẹwo fun Shielded Labs, ri aiṣedeede odi ninu iyipo ẹri Orchard pool's proof circuit, bayi lati igba ifilole 2022 ti adagun naa, ọkan eyiti, gẹgẹbi ifihan awọn ile-iṣẹ Shielded labs ' , le gba laaye ZEC eke ailopin lati wa ni minted inu Orchard laisi eyikeyi ami on-chain .
Àtúnṣe pàjáwìrì náà dé ní ọjọ́ márùn-ún: Orchard dáwọ̀ dúró ni June 2, nígbà tí ó sì tún padà bọ̀ sípò lọ́jọ́ 3 pẹ̀lú àyíká kan tó ti yípadà. Ìròyìn ìmúbòjú ZODL ṣe àkóbá yìí láìsí àwọn ohun mìíràn ju èyí tí Shielded Labs ṣe, nípa sísọ ewu fífi owó ṣòfò lẹ́ẹ̀mejì nínú adágún dípò ìpèsè èké, àti wípé àṣírí oníṣẹ́ lòókun àti iye ìpín ìdánilẹnuwò kò kàn án rárá.
A ó fi àtúnṣe ìwádìí náà ránṣẹ́ nígbà tó bá yá. Ironwood, ti a mu ṣiṣẹ bi NU6.3 ni Oṣu Keje ọjọ 28, ṣe edidi adagun Orchard titilai, ṣii adagun tuntun lori ọna asopọ atunṣe, atilẹyin nipasẹ awọn iṣayẹwo ominira ati iṣẹ ijẹrisi osise. Ati tọ gbogbo owo n jade lọ kọja iyipo kan eyiti o fi opin si yiyọ kuro ni iye wo ni yoo jẹ fun ọ lati gba? wọlé lọ́nà tí a lè ṣètẹríba, restoring every user's ability to independently check the circulating supply without seeing anyone's transactions. The episode is the trust-base ledger in action. When circuit correctness failed, the remedy was mathematics and migration, not a committee's discretion, and the blast radius was bounded by auditability the architecture had built in at the pool boundary years earlier.
Ohun tí ìbòjú rà pẹ̀lú ìpìlẹ̀ ìgbàgbọ́ tó kéré jùlọ náà jẹ́ díẹ̀ ní pàtó. Ìgbésí ayé àfihàn ni owó, iye ti ń lọ láti ẹgbẹ kan sí òmíràn. Kò si ipò ìdánimọ̀ pínpín èyí tí ọpọ àwọn ẹgbẹ ṣe ìṣirò lé lórí, kò sí ìlànà àdéhùn àṣírí kankan àti ìwé àṣẹ ìdánilẹ́kọ̀ọ́ tí a fi kọǹpútà pamọ́.
FHE jẹ ki iṣiro ṣiṣe lori ciphertext. Ni ilana Zama, ẹya ti o wa ni bayi lori Ethereum, awọn iwontunwonsi ati gbigbe iye waye lori pq bi idaduro ti a fi pamọ labẹ apẹrẹ naa Ìlànà ERC-7984, awọn coprocessors ṣe iṣiro ti a fi pamọ kuro ni pq, ati decryption nilo quorum ti oludari alakoso-iṣakoso bọtini ominira, ẹgbẹ mẹtala ni ifilọlẹ mainnet, yan fun orukọ rere ati awọn ere ṣiṣe, nitorinaa ko si ẹni kọọkan le ka data naa. Eyi jẹ ohun ti o mu iwe aṣẹ encrypted tabi adagun awin igbẹkẹle ṣeeṣe rara: ipo aṣiri ọpọlọpọ awọn ẹgbẹ, kikọ inu ariyanjiyan adehun pinpin.
But what about the key-management committee? Someone has to be able to decrypt, or the data is not usable. The design's response is to make that someone a threshold of independent operators rather than a single custodian, and to govern who may decrypt which values through access control written into the contracts themselves, extendable to designated parties such as auditors, a delegation mechanism whose compliance implications belong to the next piece in this series. The question for someone evaluating solutions is whether the committee's composition, incentives, and threshold match the evaluator's threat model.
Iṣiro pupọ-ẹgbẹ pin data sinu awọn ipin ti a pín kaakiri kọja awọn akopọ ominira, eyiti o ṣe iṣiro lapapọ abajade laisi eyikeyi node tunto awọn ohun elo. Avishay Yanai, alabaṣepọ ati Alakoso Soda Labs, ẹniti ẹrọ oni-nọmba ti o ni iyika ṣiṣan, executes EVM-compatible contract logic over encrypted values in production on the COTI network, describes good MPC design in production as ensuring that no single party, whether an observer, a node running the computation, or the vendor, ever sees plaintext inputs or intermediate state, and everyone sees only what the disclosure policy grants them. The guarantee only depends on non-collusion, and that is an assumption you can engineer and contract around, such as with operators in separate jurisdictions, on separate clouds, and under independent audits, with legal exposure for collusion. Cryptography's job here is what he calls a tremendous trust reduction rather than trust elimination, to reach equivalence with the trust institutions place in clearinghouses. Collusion past the threshold breaks privacy, but not correctness, since in designs with public auditability, external validators can still check that reported results are right without joining the computation.
The caveat is merely that such an observer sees that a transaction happened, when, against which contract, who submitted it, plus batch sizes and fees. A participating node can learn which function ran and its throughput patterns. Timing correlation is another consideration, as activity levels can leak even when amounts don't. And whatever the application outputs in plaintext, repeated small disclosures could grow into potential patterns for a party that is on the lookout for them. "It's the boundary of the promise," he clarifies, so evaluators should demand vendors draw it explicitly. No computation model repairs the submission of plaintext by, for example, a compromised client. The protocol computes faithfully on whatever it is given. Who talks to whom is a transport problem, and compliance is policy rather than mechanism: "No cryptography makes that judgment for you."
Garbled-circuit designs run in constant rounds with the heavy cryptographic material precomputed before inputs exist, which is what makes transaction-rate workloads feasible where secret-sharing protocols pay network round trips per operation, and where, per Yanai, some MPC families protect the values but not the fact of computation, garbled-circuit designs can extend cover to counterparty addresses and asset types. The family's most consequential property for this comparison, though, is that MPC is an architecture in its own right, and it is also an ingredient inside the other families: the threshold key committee under an FHE deployment is itself a multi-party computation. The evaluator's question, in Yanai's framing, is "what does my committee do, and what do I pay on top of it?" If the committee exists either way, running the computation itself in MPC can remove an expensive outer layer.
It's worth clarifying that two very different products get discussed using the same acronym. Custody MPC splits a signing key across several parties so that no single one of them can sign alone; it protects one secret, and the joint computation involved is a single fixed operation, producing a signature. Compute MPC runs general program logic over data that stays hidden throughout, and involves many parties' inputs, arbitrary contract logic, and continuous operation. The mathematics is what the two have in common. Operationally, though, one is used for key management and the other is a confidential execution environment.
A TEE is a hardware-isolated region of a processor that keeps data encrypted in memory and shielded from the operating system, the hypervisor, and the machine's operator, with remote attestation letting an outside party verify what code is running inside. The design buys the two things the cryptographic families pay dearly for, generality and speed: an enclave runs ordinary programs at close to ordinary cost, which is why TEEs anchor most confidential-compute offerings from the major clouds and a growing set of chain infrastructure.
ìgbéga ni ìpìlẹ̀ ìgbàgbọ́, nítorí pé ìdánilójú náà lágbára bí ètò àti ẹrù tí àwọn oníṣòwò hardware ṣe fún wọn bá ti le tó. àlàfo èsì-ọkàn rẹ̀ sì fẹsẹ̀ múlẹ̀ sí i láti dènà lílo òpó ọ̀nà abẹ́lé (side channel extraction), èyí jẹ́ irú ìjàkadì kan tí wọ́n ń lò tipétipé. àwọn olùdásílẹ̀ TEE mọ ìwé àkọsílẹ̀ yìí ju àwọn alátakò lọ. yíyan ìlànà ìṣètò túmọ̀ sí gbígbéra ẹni rò dáadáa wípé ohun àmúṣọròdì dídágbàgbẹ́kẹ̀lé pẹ̀lú fífi ìdíwọ̀rí hàn ló dára jùlọ nínú ṣíṣe iṣẹ́ ní ojúlówó iyara, ó sì rí bẹ́ẹ̀ fún ọ̀pọ̀lọpọ̀ ìgbésèṣẹ́.
Could shielded Zcash serve the confidential trading venue use case? No, but that's not a shortfall. An RFQ venue is shared encrypted state under contract logic, many parties' hidden intents composing inside an auction that itself runs blind. That's more applicable for something like MPC, with shared private state under frequent interaction, an order book, a netting cycle. Shielding has no substrate for that; its hidden state is a payment between two parties. The venue itself is suited for FHE or MPC, and it is worth noticing that when Zama built it, the confidentiality it delivers is a schedule of disclosures to whitelisted, identified market makers, which is necessary for institutional trading. But that is a different product than what a shielded transaction offers, which is confidentiality with no whitelist and no party who eventually learns your direction.
What about corporate payments and payroll? This is a market every FHE and MPC vendor now courts, and it's exactly the problem shielding was built for: amounts hidden, counterparties hidden, validity public. In principle a shielded chain is the strongest-trust-base answer available, no committee, no vendor, no operator set. In practice the corporate-payments market is being won on rails, ERC-20 integration, existing custodians, existing compliance tooling, stablecoin denominations, and shielded Zcash offers a different asset on a different chain. But it's a solid fit at the level of problem shape and is simply awaiting integration. The cryptography can do it, so the practical concerns have to do with what the surrounding stack connects to.
It's also worth looking at what the other three families offer, and shielding does not: a party who can be compelled. A threshold committee can receive a court order, an enclave vendor can be subpoenaed for its signing keys, and an operator set has a jurisdiction. An institution that needs a compliance path may count the committee as the product. It is also, from another seat, the vulnerability.
If we look again at the cases surveyed above, we see a picture that overlaps. Most FHE deployments have threshold MPC underneath as the decryption layer. Zero-knowledge proofs certify encrypted inputs before FHE consumes them, and in garbled-circuit systems can certify them after the fact, giving users a forced exit that does not depend on the network's availability, a practice borrowed from rollup architectures. TEEs appear inside MPC nodes as defense in depth, Zama's key-management nodes run their share of the computation inside hardware enclaves, and TEEs increasingly host the provers and builders of systems whose end guarantees are cryptographic. A comparison written in five years may find the seams hard to locate. But composition runs one direction only.
èyí ló mú kí ọ̀rọ̀ tí olùṣirò ń béèrè kò jẹ́ nípa "ẹ̀rọ ìgbàlódé" rárá. ohun tó yẹ kó o wá ni bí àṣírí ṣe wà ní ìsínwọ̀n, àwọn nǹkan wo la yọ kúrò nínú rẹ̀ àti àwọn nǹkan tó lè fi àyè gba ìdásílẹ̀ náà, bóyá ìyẹn á jẹ́ ìṣirò tàbí wíwà bó ṣe tọ̀nà lójú ẹ̀ka-ìmọ̀ràn kan, àìṣe àjọṣepọ̀ ìgbìmọ̣ kan, iye ojúlówó òpópónà dídáńgájíá, tàbí sítíkónì oníṣòwòkan. ka gbogbo ìbéèrè fún àṣírí nípa gbíbéèrè pé kí lo pa mọ́, láti ọwọ́ ta, títí dìgbà wo, àti lórí àṣẹ ẹni, nígbà náà ìwọ yóò sì mọ̀.
Ìfihan: nkan yi ni a ṣe atilẹyin nipasẹ kan ti o jẹ onigbọwọ. Ìpínlẹ̀ Àjọ Zcash. ZCG did not review or approve this piece before publication. Proof Street's funding commitments are listed on the ojúewé ìfúnnilókun.
Àwọn ojúewé tó jápọ̀ mọ́: Àpótí ìdìbò (Using_Zcash) · Wíwo àwọn kókó-ìmọ̀ràn · "ẹni tí ó lè rí ohun" nínú Start_Here yípò ní ọ̀nà wiki pàtó