Source-linked AI summary
Enigma: Decentralized Computation Platform with Guaranteed Privacy
Guy Zyskind, Oz Nathan, Alex Pentland
TL;DR
Enigma addresses irreversible data sharing and fairness problems in secure multi-party computation by separating public and private contract execution and combining privacy-preserving sharing with economic penalties. The system supports controllable private computation, with correctness against up to n −1 active adversaries and privacy unless a dishonest majority colludes.
Problem
Data sharing is irreversible, while secure multi-party computation can permit malicious parties to learn outputs and abort before others, undermining control and fairness.
Method
Developers write private contracts whose private parts run off-chain, using additively homomorphic secret sharing, verifiable correctness mechanisms, and security deposits to penalize malicious behavior.
Results
Correctness is ensured against up to n −1 active adversaries, while evaluated code is guaranteed not to leak information unless a dishonest majority colludes.
Takeaways & Limitations
Enigma enables controllable private computation and applications including private biometric authentication, IoT data management, and blind voting.
Takeaways & Limitations
The re-sharing step requires O(n2) communications among all parties, making MPC impractical beyond a small constant number of parties.
Abstract
from arXiv · showhide
A peer-to-peer network, enabling different parties to jointly store and run computations on data while keeping the data completely private. Enigma's computational model is based on a highly optimized version of secure multi-party computation, guaranteed by a verifiable secret-sharing scheme. For storage, we use a modified distributed hashtable for holding secret-shared data. An external blockchain is utilized as the controller of the network, manages access control, identities and serves as a tamper-proof log of events. Security deposits and fees incentivize operation, correctness and fairness of the system. Similar to Bitcoin, Enigma removes the need for a trusted third party, enabling autonomous control of personal data. For the first time, users are able to share their data with cryptographic guarantees regarding their privacy.
1 Motivation
Blockchains provide decentralized transparency and incentives, but their public, replicated design cannot handle private data or heavy computation. This leaves sensitive processing in centralized systems, with associated privacy and security risks.
- Blockchain applications provide decentralized architecture, transparency, and tamper-proof activity records without granting absolute control to one party.
- Public blockchains cannot handle private data or extensive computation because data flows through full nodes and only fiduciary code can run on-chain.
- Sensitive data therefore remains stored and processed in centralized systems that are less transparent and less secure.
2 Enigma
Enigma enables decentralized applications to compute on private data without a trusted third party. It combines secret-sharing, distributed computation, and reduced redundancy so data remains private while more demanding computations become possible.
- Enigma uses secure multi-party computation to split data among nodes, which jointly compute functions without any node accessing the complete data.
- Enigma reduces storage and computation redundancy by assigning each computation to a small subset of nodes, enabling more demanding computations than blockchain replication.
- Enigma can run any program while keeping inputs secret, such as computing an average wage without revealing individual salaries.
- Secure computation makes data access reversible and controllable because only the original owners see the raw data.
3 Design overview
Enigma connects an existing blockchain to an off-chain network for private and intensive computation. Public execution, access control, storage references, and auditable proofs remain blockchain-mediated while computational work is distributed off-chain.
- The blockchain facilitates transactions and enforces access control through digital signatures and programmable permissions.
- Enigma executes public code on the blockchain and private or computationally intensive code off-chain, with proofs of correct execution stored on-chain for auditing.
- An interpreter distributes private-contract execution across the network, improving runtime while maintaining privacy and verifiability.
- Storage: Enigma’s off-chain DHT stores data references rather than the data itself, while client-side encryption and blockchain-programmed access protocols protect private data.
- The off-chain network also executes privacy-preserving code and heavy publicly verifiable computations that are broadcast through the blockchain.
4 Off-chain storage
Enigma’s off-chain storage uses distributed shares and encrypted data so each node sees only a distinct local view. A modified Kademlia DHT distributes these shares efficiently through persistent secure channels.
- Off-chain nodes form a distributed database in which each node has a distinct view of shares and encrypted data, supporting privacy and fault tolerance.
- The storage layer modifies Kademlia’s DHT with persistence and secure point-to-point channels to distribute shares efficiently.
5 Privacy-enforcing computation
Enigma combines publicly verifiable secure MPC with optimizations intended to make privacy-preserving computation practical on large networks. Its framework addresses privacy, correctness, and communication efficiency through secret sharing, auditing, and network reduction.
- 5.1.1 Privacy (passive adversaries): Secure MPC based on secret sharing lets parties evaluate computations without revealing complete data to any node.Secret sharing is additive-homomorphic, while multiplication requires degree reduction and interaction.
- 5.1.1 Privacy (passive adversaries): Multiplication creates degree-2t polynomials, requiring a reduction step that imposes an honest-majority constraint in the information-theoretic setting.With computationally bounded adversaries, privacy and correctness can hold for any number of corruptions, but fairness and output decisions still require an honest majority.
- 5.1.1 Privacy (passive adversaries): Naive degree reduction requires O(n^2) communication because every party must interact with every other party.This makes MPC impractical beyond a small constant number of parties.
- 5.1.1 Privacy (passive adversaries): Enigma proposes a generic solution that avoids functionality-restricting assumptions and makes secure MPC feasible for arbitrarily large networks.The computational model includes hierarchical secure MPC, network reduction, and adaptable circuits.
- 5.1.2 Correctness (malicious adversaries): The modified sharing scheme preserves additive homomorphism, retains O(n^2) multiplication communication, and ensures correctness against up to n − 1 active adversaries.Its expensive offline round can be amortized across many computations and run in parallel with other computations.
- 5.1.2 Correctness (malicious adversaries): Publicly verifiable sharing stores MACs and commitments on the blockchain, allowing auditors to detect invalid computation results.The nodes compute over shared values rather than commitments, which remain available for public validation.
5.2 Hierarchical secure MPC
Hierarchical secure MPC extends formula-based protocol simulation to reduce multiplication communication from quadratic to linear, trading communication cost for parallelized computation and scalability.
- Hierarchical secure MPC: O(n^2) communication in standard secure MPC requires every computing node to interact with all others, making large networks impractical.For LSSS, this communication cost applies to every multiplication, while additions can be computed in parallel.
- Hierarchical secure MPC: The hierarchical approach simulates an n-party protocol using a log-depth formula of constant-size MPC gates.The method extends prior formula simulation to linear secret-sharing schemes.
- Hierarchical secure MPC: Communication for multiplication falls from quadratic to linear, at the cost of increased computation complexity that is parallelized.The simulated comparison contrasts vanilla MPC with the optimized implementation as the number of parties grows.
- Hierarchical secure MPC: The implementation is designed to scale to arbitrarily large networks, whereas vanilla MPC is limited by the number of parties.Figure 4 presents the simulated performance comparison underlying this scalability claim.
5.3 Network reduction
Network reduction dynamically selects computing nodes and can shrink the active set during expensive computations, while privacy remains guaranteed unless a dishonest majority colludes.
- Network reduction: A random subset of the network performs each computation, with selection favoring load balancing and publicly validated reputation.The technique is intended to keep the network fully utilized.
- Network reduction: Code evaluation does not leak inputs or interim variables unless a dishonest majority colludes, under the stated threshold condition.The passage gives the condition as t ≥ n/2.
- Network reduction: Intermediate results generally become less descriptive and more aggregative as evaluation proceeds from inputs to outputs.This property motivates reducing the number of computing nodes during evaluation.
- Network reduction: For simple functions or very few inputs, the decreasing-node optimization may not apply, but these functions are fast to compute.No additional steps are needed in that case.
- Network reduction: For expensive functions with many inputs and lines of code, the system dynamically reduces computing nodes as evaluation progresses.A feed-forward network processes addition gates first, then multiplication gates, recursively secret-sharing interim results with N_c nodes.
5.5 Scripting
Enigma’s scripting model partitions private contracts across on-chain and off-chain execution, using private references, a public ledger, a DHT, and MPC-backed data access.
- Scripting: Private contracts are partitioned into on-chain and off-chain execution; off-chain code returns private results and sends correctness proofs to the blockchain.The scripting language is similar in syntax to well-known programming languages.
- Scripting: The private keyword marks objects whose computations remain secure, while code accesses references rather than locally available data.The underlying private data are not directly present at the computing party.
- Scripting: The system exposes three decentralized databases through a global singleton dictionary: the public ledger, DHT, and MPC.Each provides a distinct storage or computation function.
- Scripting: The public ledger is public and append-only, while the DHT stores off-chain data with encrypted transmission and predicate-controlled access.Ledger history is read-only accessible by key and time; DHT predicates can restrict access to specified public keys.
- Scripting: MPC secret-shares stored values across computing parties, allowing references for computation without revealing the underlying value.By default, only the original dealer can request raw data through declassification.
- Scripting: The ledger, DHT, and MPC dictionaries use one namespace for simplicity, although finer database and table hierarchies are available in practice.
6 Blockchain interoperability
Enigma links blockchain-based identity and access control to off-chain storage and MPC, allowing predicates on the ledger to govern private resources without trusted nodes.
- 6 Blockchain interoperability: The interoperability layer links blockchain identities and protocols to off-chain storage and computation requests.It describes identity formation, ledger storage, and predicate-conditional routing.
- 6.1 Identity management: Shared identities extend ordinary identities across multiple entities and encode their semantic meaning.The pseudo-anonymous portion is represented as a (2n + 1)-tuple, where n is the number of parties.
- 6.1 Identity management: Identity metadata includes public access-control predicates and other relevant public or private information.Public predicates moderate access control, while private metadata can be stored off-chain in the DHT.
- 6.1 Identity management: Alice can let Bob compute over her height through MPC without giving Bob direct access to the height value.The shared identity and predicate specify the permitted computational use.
- 6. Blockchain interoperability: Blockchain transactions validate public state, while shared identities and predicates on the ledger moderate access to off-chain resources.The off-chain network verifies private metadata without requiring trusted nodes.
- 6.2 Storage protocols: DHT storage checks write permissions and permits custom predicates to determine who may read stored data.The scripting-language DHT object abstracts this protocol.
- 6.3 Computation protocols: The MPC share-and-compute protocol secret-shares data, distributes shares to sampled peers, and returns a reference for authorized computation.A secure protocol generated from unsecure code evaluates f(x) without revealing x.
7 Incentives
Enigma combines fees and security deposits to compensate nodes and penalize malicious behavior. Its contracts verify correctness and fairness, while account balances and time-limited storage fees govern resource use.
- Security deposits: Security deposits make malicious behavior punishable, complementing fees that compensate nodes for computational resources.Full nodes must submit deposits, which can be forfeited when they lie or abort computations.
- Security deposits: MPC fairness attacks can let a malicious majority learn the output and abort before others do, so Enigma penalizes rather than prevents this case.The protocol cannot prevent this attack when carried out by a majority.
- Security deposits: Contracts verify computation correctness and fairness after completion; dishonest or prematurely aborting nodes lose deposits, which are redistributed to honest nodes.The computation continues without the malicious node by setting its data share to 0.
- Fees: Requests for storage, retrieval, and computation have fixed prices, and computational compensation reflects each node’s contribution measured in execution rounds.Enigma distributes different computation parts across nodes rather than having every node execute the entire computation.
- Fees: Because request costs may be unpredictable, finalized costs are deducted from node account balances, and requests require a minimum balance.This follows from Enigma’s Turing-complete platform.
- Fees: Storage fees are market-based and time-limited; insufficient balances restrict access and eventually trigger data deletion unless funds are added.Hosting contracts renew automatically while the owner’s balance remains sufficient.
8 Applications
Enigma applies private computation and decentralized control to data-sharing, organizational, identity, financial, voting, IoT, and key-management use cases. These applications let parties use or share data without exposing raw information or private controls.
- Data marketplaces: A privacy-preserving data marketplace could let consumers sell access to data while retaining autonomous control and reducing customer-acquisition friction.One example is pharmaceutical companies scanning genomic databases for clinical-trial candidates.
- Secure backends: Companies can use customer data for personalization and targeting without storing or processing it on their own servers, reducing security risks and protecting privacy.The text presents this as preserving existing uses while avoiding server-side handling of the data.
- Internal compartmentalization: Organizations can let employees analyze data while preventing them from stealing it, protecting trade secrets and potentially lowering security costs.The passage also associates broader internal data access with improved productivity.
- Authentication: Voice, face, and fingerprint data can be stored and computed on Enigma so only the user accesses it, with private contracts controlling additional-key requirements.Those policies remain unexposed to potential attackers.
- Authentication: Enigma can authenticate users by secret-sharing personal information and linking a real identity to a public pseudo-identity through a private contract.The process is described as trustless and privacy-preserving.
- IoT: IoT data can be stored, managed, and used in a decentralized, trustless cloud.The application specifically targets highly sensitive data collected by IoT devices.
- Controlled sharing: Users can share data with third parties under reversible, contract-defined policies while services run computations without accessing raw data.The user retains control and ownership of the data.
- Crypto banking: A private crypto bank could support loans, deposits, and investment products without publicly revealing users’ financial situations or internal details.The model combines autonomous blockchain control with private financial information.