# Domain control and periodic poling of epitaxial ScAlN

Fengyan Yang  Department of Electrical Engineering, Yale University, New
Haven, CT 06511, USA  Guangcanluan Yang  Department of Electrical Engineering,
Yale University, New Haven, CT 06511, USA  Ding Wang  Department of Electrical
Engineering and Computer Science, University of Michigan, Ann Arbor, MI 48109,
USA  Ping Wang  Department of Electrical Engineering and Computer Science,
University of Michigan, Ann Arbor, MI 48109, USA  Juanjuan Lu  Department of
Electrical Engineering, Yale University, New Haven, CT 06511, USA  Zetian Mi
Department of Electrical Engineering and Computer Science, University of
Michigan, Ann Arbor, MI 48109, USA  Hong X. Tang<EMAIL_ADDRESS>Department of Electrical Engineering, Yale University, New Haven, CT 06511,
USA

###### Abstract

ScAlN is an emerging ferroelectric material that possesses large band gap,
strong piezoelectricity, and holds great promises for enhanced $\chi^{(2)}$
nonliearity. In this study, we demonstrate high-fidelity ferroelectric domain
switching and periodic poling of Al-polar ScAlN thin film epitaxially grown on
on c-axis sapphire substrate using gallium nitride as a buffer layer. Uniform
poling of ScAlN with periods ranging from 2 $\upmu$m to 0.6 $\upmu$m is
realized. The ability to lithographically control the polarization of
epitaxial ScAlN presents a critical advance for its further exploitation in
ferroelectric storage and nonlinear optics applications.

Alloying scandium (Sc) with aluminum nitride (AlN) results in a new class of
ferroelectric nitride semiconductor, ScxAl1-xN, that holds great potential for
electronic and photonic applications. Single crystalline ScAlN can be grown on
c-axis sapphire substrate with gallium nitride (GaN) as a buffer layer by via
molecular beam epitaxy 1, 2. The Sc composition is tunable which can be
leveraged for varying bandgap and refractive index. ScAlN possesses unique
properties such as high dielectric strength, large piezoelectric constants,
and low coercive fields in comparison to AlN 3, 4. These properties make ScAlN
attractive for various applications in electronics, including heterostructrue
field effect transistors (HFETs), piezoelectric and ferroelectric devices, and
high-frequency acoustic resonators5, 6, 7, 8, 9.

Especially, ScAlN promises a high second-order nonlinear optical
susceptibility $\chi^{(2)}$, which was reported to be nearly two times as
large as that of LiNbO3 when Sc concentration reaches 20$\%$ 10. This
particular property leads to enhanced $\chi^{(2)}$ nonlinear interaction, for
example, in second harmonic generators11, 12, 13 and optical parametric
oscillators14, 15. Moreover, the Sc alloying in AlN significantly decrease the
coercive field to below the dielectric breakdown field, making it possible to
flip the polarization8. Therefore, if periodically flipping and maintaining
the polarization is achievable on a ScAlN platform, quasi-phase matching for
$\chi^{(2)}$ process can be realized, further enhancing the effective coupling
strength and facilitating numerous nanophotonic applications such as
$\chi^{(2)}$ frequency conversion12, 15, 13, Pockels combs16, and cascaded
$\chi^{(2)}$ and $\chi^{(3)}$ nonlinearities. 17, 18

This article first presents a study on the ferroelectric switching property of
epitaxial Al-polar ScAlN thin film grown GaN-buffered sapphire template, which
is highly compatible with standard III-nitrides semiconductor fabrication
process. The ferroelectric switching current was extracted using a custom
setup based on Positive-Up-Negative-Down (PUND) measurement19, 20, and the
coercive field was found to be 6 MV/cm. We further demonstrate high fidelity
and uniform ScAlN poling with periods ranging from 2 $\upmu$m to 0.6 $\upmu$m.
Reaching such short poling periods is a prerequisite for second harmonic
generation in the deep visible even ultra-violet wavelength range, which
remains to be challenging due to stringent requirement on poling periods 21,
22, 23. The submicron poling period demonstrated in this article provides an
opportunity for mirrorless OPO 24, 25, 26, a type of optical parametric
oscillator that does not require an optical cavity, which simplifies the
design and makes the device more robust against environmental disturbance.

The starting wafer consists of a 100 nm-thick Al-polar ScAlN film grown on a
c-axis sapphire substrate via Molecular Beam Epitaxy (MBE) using highly Si-
doped GaN as a buffer layer 1. Fig. 1(a) shows the wurtzite crystal structure
of Al-polar ScAlN alloyed with 25$\%$ Sc concentration, which was set to be
our targeted concentration in growth to allow better lattice match to GaN and
reduce dislocation density6. An atomic-force-microscopy (AFM) scan over a 5
µm$\times$5 µm area reveals a smooth surface with a root-mean-squared
roughness as low as 0.6 nm, as indicated in Fig. 1(b). The layer composition
of the wafer was characterized by a scanning electron microscope (SEM)
equipped with energy-dispersive X-ray spectroscopy (EDS). Fig. 1(c) shows the
cross-sectional SEM images of of Sc0.2Al0.8N/GaN heterostructure. The element
distribution was obtained by EDS mapping at 4.088 keV, 1.486 keV, and 1.098
keV, which correspond to emission lines of Sc K$\alpha$, Al K$\alpha$, and Ga
L$\alpha$, respectively, indicating well defined boundaries at all growth
interfaces.

The ferroelectric switching property of ScAlN was characterized by PUND
measurement, where a series of programmed voltage pulses was applied to the
film successively to extract ferroelectric switching current $I_{f}$.
Electrodes of varying sizes were patterned on ScAlN chip through nickel
evaporation, followed by a liftoff process. The underlying GaN layer, which
has low resistivity due to high Si doping concentration, serves as the counter
electrode. Silver paste was applied at the edge of the chip, connecting the
Si-doped GaN layer with an aluminum holder. Fig. 1(d) illustrates the PUND
measurement setup. An arbitrary waveform generator (AWG) was programmed to
generate PUND pulses, which were amplified by a linear voltage amplifier, and
then applied to nickel electrodes via an ultra-sharp probe tip. The current
induced by the electric field was converted to voltage signal through a low-
noise current amplifier, and an oscilloscope was used to measure the output
voltage.

Fig. 2(a) displays the applied voltage pulses and circuit current in PUND
measurement. The triangular-shaped voltage pulses have a peak voltage of
$\pm$62 V and a pulse length of 200µ s. A negative voltage pulse was applied
to initialize the polarization of the film, followed by positive (‘P’) and up
(‘U’) pulses. In addition to the polarization switching current $I_{f}$,
parasitic currents including displacement current $I_{c}$ = $C\,\frac{dV}{dt}$
and static leakage current $I_{l}$, contribute to the measured $I_{p}$. Since
polarization was supposed to be fully reversed during "P" pulse which was
chosen with a relatively long duration, the ferroelectric current should not
present in $I_{u}$. Therefore, the net forward switching current $I_{f}$ can
be obtained by subtracting $I_{u}$ from $I_{p}$. Similarly, the backward
switching current can be extracted from negative (‘N’) and down (‘D’) pulses,
where $I_{b}=I_{n}-I_{d}$.

The ferroelectric current density can be calculated by $J=I/A$, where $A$ is
the area of the nickel electrode. The electric field applied on ScAlN film can
be approximated as $E=V/d$, with $d=100$ nm. The time-dependent polarization
$P$ of the film can be found by numerically integrating $J$ over time. The
resulting $J-E$ and $P-E$ relationships are shown in Fig. 2(b), represented by
red and purple curves, respectively. The $J_{f}$ and $J_{b}$ values exhibit
large asymmetry, which is mainly attributed to the asymmetric electrode
configurations and the enhanced leakage current $I_{v}$ during forward
switching, as reported in previous work 27.

In order to obtain reliable measurements, we focused on the backward switched
polarization $P_{b}$ and swept the peak voltage with fixed pulse length. The
results are shown in Fig. 2(c). The ScAlN film under investigation exhibited a
coercive field of approximately 6 MV/cm and a maximum backward switched
polarization of 250 µC/cm2. Remnant polarization of this film is thus
estimated to be $P_{b,max}/2=125~{}$µC/cm2.

We employed trapezoid voltage pulses with a peak voltage of 62 V and pulse
width of 1 ms to perform poling process, which fully reverse the ferroelectric
polarization from Al-polar to N-polar. After poling, the top nickel electrodes
were removed by hydrochloric acid, then Piezo-Force-Microscopy (PFM) was
utilized to map out N-polar and Al-polar domains, as shown in Fig.2 (d). The
significant phase difference between domains confirms the successful poling of
ScAlN thin film.

To verify the polarization retention capability of ScAlN film, we applied a
poling voltage pulse to one device and recorded the current response. After a
waiting period of 24 hours ($\sim 1\times 10^{5}$s), we reapplied the same
pulse and recorded the current response once again. The results are plotted
plotted in Fig.3 (a). Unlike many other ferroelectric materials that exhibit
polarization loss with time28, here after 24 hours, negligible poling current
was observed, indicating a high stability of polarization retention after
poling.

High fidelity and flexibility of domain engineering are also required for
realizing quasi-phase matching in quadradic nonlinear optical devices. We
first designed and patterned a "YALE"-shape top electrode, consisting of the
four letters which are connected through a bus electrode. The bus is connected
to a 20µm$\times$20µm square electrode for convenient contact with the probe
tip. Multiple voltage pulses with 62 V peak voltage and 500 $\upmu$s length
were applied to the contact electrode at room temperature to ensure thorough
polarization switching. After poling, the N-polar domains were more
susceptible to HCl solution and can be further exposed via HCl etching for up
to 20 minutes. The significant contrast between the original and poled domains
can be revealed via scanning electron microscopy(SEM), as shown in Fig. 3(b).
The well-defined boundaries and uniformity of the reversed domains provide
strong evidence for high quality poling of ScAlN film via lithographically
defined patterns.

Finally, to demonstrate periodic poling of ScAlN, electrode arrays were
patterned with varying periods $\Lambda$ of challenging small values, which
are 2µm, 1µm, 0.8µm and 0.6µm, respectively. The same poling voltage pulses
used previously were applied to these electrodes, followed by the same post-
processing steps. The resulting exposed domains are presented in Fig. 3(c),
where the poling periods agrees well with our designed electrode patterns. The
electrode arrays’ duty cycle were designed and fabricated to be 25$\%$ for all
the periods, but here the achieved poling duty cycle increased as period
decreases, which we believe can be mediated by optimizing pulse length for
smaller periods accordingly. We hereby demonstrate our capability of realizing
periodic poling of thin film ScAlN with arbitrary periods, especially sub-
micron periods, which in principle can fullfill quasi-phase matching for
$\chi^{(2)}$ frequency conversion in any wavelength range within ScAlN’s
transparency window. Importantly, the submicron poling period will unlock
possibility for mirrorless optical parametric oscillation, which since its
first proposal in 1966 24, hasn’t been verified in any integrated photonic
platforms.

In conclusion, ScAlN is a promising material for photonic applications due to
its flexibility in domian engineering and high fidelity periodical poling
reported here. The decent coercive field 6MV/cm make it possible to pole
thicker ScAlN film which provides better optical confinement when patterned
into waveguides. Photonic waveguide based on 500nm sputtered ScAlN has been
reported before with propagation loss 9±2dB/cm at 1550nm 29, which still holds
room for fabrication optimization to achieve comparable loss as AlN photonic
circuits 30, 11, 31. With future development and growth optimization on
waveguide-compatible films, it is feasible to realize low-loss ScAlN photonic
circuits for a wide range of integrated $\chi^{(2)}$ nonlinear optics
applications, and bring significant advances to III-nitride photonics32.

Figure 1:  (a) Wurtzite crystal stucture of Al-polar Sc0.25Al0.75N. (b) AFM
image of as-grown Sc0.2Al0.8N surface across 5$\mathrm{\mu m}\times$
5$\mathrm{\mu m}$ area with RMS=0.6nm. (c) i, SEM image of Sc0.2Al0.2N/GaN
heterostructure. ii-iv, EDX mapping of Sc, Al, Ga distribution. (d)
Experimental setup for PUND measurement and poling. AWG: arbitrary waveform
generator, VA: linear voltage amplifier with fixed gain to be 100, CA: current
amplifier with variable gain, OSC:oscilloscope. Figure 2: (a) Applied voltage
pulses and corresponding circuit current in PUND measurement. (b) Forward and
backward switching current density (red curve) and P-E loop by integrating
$J_{f}$ with time (purple curve). (c) Backward switched polarization $P_{b}$
changes with peak electric field. (d) PFM phase image of a 10µm $\times$ 10µm
square which was poled by trapezoid voltage pulses with a peak voltage of 62 V
and pulse width of 1 ms. Figure 3: (a) Currents for the poling pulse and
probing pulse after waiting for 24 hours. (b) SEM image of a "YALE" pattern
after poling and HCl selective etching. (c) SEM images of periodical poling
pattern with periods equal to 2, 1, 0.8, and 0.6 $\upmu$m, respectively.

## Acknowledgment

This project is supported in part by Semiconductor Research Corporation (SRC),
Defense Advanced Research Projects Agency (DARPA) under the COmpact Front-end
Filters at the ElEment-level (COFFEE). FY and HXT acknowledge partial funding
from National Science Foundation (NSF) Center for Quantum network (CQN) under
grant number EEC-1941583. The facilities used for device fabrication were
supported by the Yale SEAS Cleanroom and the Yale Institute for Nanoscience
and Quantum Engineering (YINQE). The authors would like to express their
gratitude Dr. Yong Sun, Dr. Michael Rooks, Sean Rinehart, and Kelly Woods for
their invaluable assistance in device fabrication.

## Data availability

The data that support the findings of this study are available from the
corresponding authors upon reasonable request.

REFERENCES

## References

  * Wang  _et al._ 2021a P. Wang, D. Wang, N. M. Vu, T. Chiang, J. T. Heron, and Z. Mi, “Fully epitaxial ferroelectric ScAlN grown by molecular beam epitaxy,” Appl. Phys. Lett. 118, 223504 (2021a).
  * Wang  _et al._ 2020 P. Wang, D. A. Laleyan, A. Pandey, Y. Sun, and Z. Mi, “Molecular beam epitaxy and characterization of wurtzite scxal1-xn,” Applied Physics Letters 116 (2020), 10.1063/5.0002445.
  * Moram and Zhang 2014 M. A. Moram and S. Zhang, “Scgan and scaln: emerging nitride materials,” J. Mater. Chem. A 2, 6042–6050 (2014).
  * Rassay  _et al._ 2021 S. Rassay, D. Mo, C. Li, N. Choudhary, C. Forgey, and R. Tabrizian, “Intrinsically switchable ferroelectric scandium aluminum nitride Lamb-Mode resonators,” IEEE Electron Device Lett. 42, 1065–1068 (2021).
  * Caro  _et al._ 2015 M. A. Caro, S. Zhang, T. Riekkinen, M. Ylilammi, M. A. Moram, O. Lopez-Acevedo, J. Molarius, and T. Laurila, “Piezoelectric coefficients and spontaneous polarization of scaln,” J Phys Condens Matter 27, 245901 (2015), caro, Miguel A Zhang, Siyuan Riekkinen, Tommi Ylilammi, Markku Moram, Michelle A Lopez-Acevedo, Olga Molarius, Jyrki Laurila, Tomi eng England J Phys Condens Matter. 2015 Jun 24;27(24):245901. doi: 10.1088/0953-8984/27/24/245901. Epub 2015 May 22.
  * Wang  _et al._ 2021b P. Wang, D. Wang, B. Wang, S. Mohanty, S. Diez, Y. Wu, Y. Sun, E. Ahmadi, and Z. Mi, “N-polar scaln and hemts grown by molecular beam epitaxy,” Applied Physics Letters 119 (2021b), 10.1063/5.0055851.
  * Fichtner  _et al._ 2019 S. Fichtner, N. Wolff, F. Lofink, L. Kienle, and B. Wagner, “Alscn: A iii-v semiconductor based ferroelectric,” Journal of Applied Physics 125 (2019), 10.1063/1.5084945.
  * Wang  _et al._ 2022a D. Wang, P. Wang, S. Mondal, S. Mohanty, T. Ma, E. Ahmadi, and Z. Mi, “An epitaxial ferroelectric scaln/gan heterostructure memory,” Advanced Electronic Materials 8 (2022a), 10.1002/aelm.202200005.
  * Giribaldi 2020 G. Giribaldi,  _Sc-doped AlN: high performance piezoelectric MEMS resonators and high-polarization ferroelectric_ , Ph.D. thesis, Politecnico di Torino (2020).
  * Yoshioka  _et al._ 2021 V. Yoshioka, J. Lu, Z. Tang, J. Jin, R. H. Olsson, III, and others, “Strongly enhanced second-order optical nonlinearity in CMOS-compatible Al1-xScxN thin films,” APL Quote Quad (2021).
  * Bruch  _et al._ 2018 A. W. Bruch, X. Liu, X. Guo, J. B. Surya, Z. Gong, L. Zhang, J. Wang, J. Yan, and H. X. Tang, “17000%/w second-harmonic conversion efficiency in single-crystalline aluminum nitride microresonators,” Applied Physics Letters 113, 131102 (2018).
  * Lu  _et al._ 2019 J. Lu, J. B. Surya, X. Liu, A. W. Bruch, Z. Gong, Y. Xu, and H. X. Tang, “Periodically poled thin-film lithium niobate microring resonators with a second-harmonic generation efficiency of 250,000$\%$/w,” Optica 6, 1455 (2019).
  * Chen  _et al._ 2019 J.-Y. Chen, Z.-H. Ma, Y. M. Sua, Z. Li, C. Tang, and Y.-P. Huang, “Ultra-efficient frequency conversion in quasi-phase-matched lithium niobate microrings,” Optica 6, 1244–1245 (2019).
  * Bruch  _et al._ 2019 A. W. Bruch, X. Liu, J. B. Surya, C.-L. Zou, and H. X. Tang, “On-chip $\chi$ (2) microring optical parametric oscillator,” Optica 6, 1361–1366 (2019).
  * Lu  _et al._ 2021 J. Lu, A. Al Sayem, Z. Gong, J. B. Surya, C.-L. Zou, and H. X. Tang, “Ultralow-threshold thin-film lithium niobate optical parametric oscillator,” Optica 8 (2021), 10.1364/optica.418984.
  * Bruch  _et al._ 2021 A. W. Bruch, X. Liu, Z. Gong, J. B. Surya, M. Li, C.-L. Zou, and H. X. Tang, “Pockels soliton microcomb,” Nature Photonics 15, 21–27 (2021).
  * Cui, Zhang, and Fan 2022 C. Cui, L. Zhang, and L. Fan, “In situ control of effective kerr nonlinearity with pockels integrated photonics,” Nature Physics 18, 497–501 (2022).
  * Liu  _et al._ 2019 X. Liu, A. W. Bruch, J. Lu, Z. Gong, J. B. Surya, L. Zhang, J. Wang, J. Yan, and H. X. Tang, “Beyond 100 thz-spanning ultraviolet frequency combs in a non-centrosymmetric crystalline waveguide,” Nature communications 10, 2971 (2019).
  * Martin  _et al._ 2017 S. Martin, N. Baboux, D. Albertini, and B. Gautier, “A new technique based on current measurement for nanoscale ferroelectricity assessment: Nano-positive up negative down,” Rev. Sci. Instrum. 88, 023901 (2017).
  * Feng  _et al._ 2010 S. Feng, Y. Chai, J. Zhu, N. Manivannan, Y. S. Oh, L. Wang, Y. Yang, C. Jin, and K. H. Kim, “Determination of the intrinsic ferroelectric polarization in orthorhombic homno3,” New Journal of Physics 12, 073006 (2010).
  * Sayem  _et al._ 2021 A. A. Sayem, Y. Wang, J. Lu, X. Liu, A. W. Bruch, and H. X. Tang, “Efficient and tunable blue light generation using lithium niobate nonlinear photonics,” Applied Physics Letters 119, 231104 (2021).
  * Nagy and Reano 2020 J. T. Nagy and R. M. Reano, “Submicrometer periodic poling of lithium niobate thin films with bipolar preconditioning pulses,” Opt. Mater. Express, OME 10, 1911–1920 (2020).
  * Zhang  _et al._ 2020 H. Zhang, H. Zhu, Q. Li, and H. Hu, “Reversed domains in x-cut lithium niobate thin films,” Opt. Mater. 109, 110364 (2020).
  * Harris 1966 S. E. Harris, “Proposed backward wave oscillation in the infrared,” Applied Physics Letters 9, 114–116 (1966).
  * Ding and Khurgin 1996 Y. Ding and J. Khurgin, “Backward optical parametric oscillators and amplifiers,” IEEE Journal of Quantum Electronics 32, 1574–1582 (1996).
  * Canalias and Pasiskevicius 2007 C. Canalias and V. Pasiskevicius, “Mirrorless optical parametric oscillator,” Nature Photonics 1, 459–462 (2007).
  * Wang  _et al._ 2022b D. Wang, P. Wang, S. Mondal, Y. Xiao, M. Hu, and Z. Mi, “Impact of dislocation density on the ferroelectric properties of ScAlN grown by molecular beam epitaxy,” Applied Physics Letters 121 (2022b), 10.1063/5.0099913, 042108, https://pubs.aip.org/aip/apl/article-pdf/doi/10.1063/5.0099913/16480664/042108_1_online.pdf .
  * Lou 2009 X. J. Lou, “Polarization fatigue in ferroelectric thin films and related materials,” Journal of Applied Physics 105, 024101 (2009), https://doi.org/10.1063/1.3056603 .
  * Zhu  _et al._ 2020 S. Zhu, Q. Zhong, N. Li, T. Hu, Y. Dong, Z. Xu, Y. Zhou, Y. H. Fu, and N. Singh, “Integrated scaln photonic circuits on silicon substrate,” in  _Conference on Lasers and Electro-Optics_ (Optica Publishing Group, 2020) p. STu3P.5.
  * Airola  _et al._ 2022 K. Airola, S. Mertin, J. Likonen, E. Hartikainen, K. Mizohata, J. Dekker, A. Thanniyil Sebastian, and T. Pensala, “High-fidelity patterning of aln and scaln thin films with wet chemical etching,” Materialia 22 (2022), 10.1016/j.mtla.2022.101403.
  * Liu  _et al._ 2021 X. Liu, Z. Gong, A. W. Bruch, J. B. Surya, J. Lu, and H. X. Tang, “Aluminum nitride nanophotonics for beyond-octave soliton microcomb generation and self-referencing,” Nature communications 12, 5428 (2021).
  * Liu, Bruch, and Tang 2023 X. Liu, A. W. Bruch, and H. X. Tang, “Aluminum nitride photonic integrated circuits: from piezo-optomechanics to nonlinear optics,” Advances in Optics and Photonics 15, 236–317 (2023).


# zkHawk: Practical Private Smart Contracts from MPC-based Hawk ††thanks: This
publication has emanated from research conducted with the financial support of
Science Foundation Ireland grants 13/RC/2106 (ADAPT) and 17/SP/5447 (FinTech
Fusion). This work was also supported in part by Science Foundation Ireland
grant 13/RC/2094 (Lero).

Aritra Banerjee  ADAPT Centre
School of Comp Sci & Stats
Trinity College Dublin
Dublin, Ireland
<EMAIL_ADDRESS>Michael Clear  School of Comp Sci & Stats
Trinity College Dublin
Dublin, Ireland
<EMAIL_ADDRESS>Hitesh Tewari  School of Comp Sci & Stats
Trinity College Dublin
Dublin, Ireland
<EMAIL_ADDRESS>
###### Abstract

Cryptocurrencies have received a lot of research attention in recent years
following the release of the first cryptocurrency Bitcoin. With the rise in
cryptocurrency transactions, the need for smart contracts has also increased.
Smart contracts, in a nutshell, are digitally executed contracts wherein some
parties execute a common goal. The main problem with most of the current smart
contracts is that there is no privacy for a party’s input to the contract from
either the blockchain or the other parties. Our research builds on the Hawk
project that provides transaction privacy along with support for smart
contracts. However, Hawk relies on a special trusted party known as a manager,
which must be trusted not to leak each party’s input to the smart contract. In
this paper, we present a practical private smart contract protocol that
replaces the manager with an MPC protocol such that the function to be
executed by the MPC protocol is relatively lightweight, involving little
overhead added to the smart contract function, and uses practical sigma
protocols and homomorphic commitments to prove to the blockchain that the sum
of the incoming balances to the smart contract matches the sum of the outgoing
balances.

###### Index Terms:

Hawk, Private Smart Contracts, Multi-Party Computation

##  I Introduction

Cryptocurrencies are generally decentralized and based on a public distributed
ledger called a blockchain. Many cryptocurrencies that followed Bitcoin,
including Ethereum, do not offer transaction privacy. In a nutshell,
transaction privacy hides the origin of a transaction (the sending party),
along with the amounts transacted, such that a third party inspecting the
blockchain cannot track the flow of money between accounts. Zcash [1] and
Monero [2] are two popular cryptocurrencies that provide transaction privacy.
A major limitation of these cryptocurrencies is that they do not support smart
contracts. In short, a smart contract is a program that determines a set of
deposits and withdrawals to/from a set of (anonymous) accounts. A smart
contract is created by a set of parties to facilitate a common goal. We call
these set of parties the participants of the smart contract. The absence of
support for smart contracts in existing cryptocurrencies with transaction
privacy inspired the Hawk project [3]. Hawk obtains transaction privacy with
support for smart contracts, albeit with the trust assumption of a special
type of entity known as a manager. The manager sees the inputs of each
participant in the smart contract and must be explicitly trusted not to leak
them. There have been other recent developments in privacy where the smart
contract execution is done off-chain like in Arbitrum[4] which used the
concept of Virtual Machines (VMs) along with the trust assumption of a manager
as well. But Arbitrum provided only partial privacy, i.e, the input of the
parties are hidden from blockchain but not from each other. The goal of this
research is to build upon Hawk so that along with support for transaction
privacy and smart contracts, we additionally obtain privacy for the
participant’s inputs (i.e. they are hidden from the blockchain and each
other), without the trust assumption of the manager.
Our starting point is an observation made by the authors of the Hawk protocol
[3], namely that the manager can be replaced by running a multi-party
computation (MPC) protocol between the parties. However the authors of the
Hawk paper point out that this approach would be presently impractical. Indeed
it can be readily seen that by applying MPC to the design of Hawk as it is
incurs the prohibitively expensive overhead of executing a zk-SNARK proof [5,
6, 7] within an MPC program (a circuit in practice). We therefore propose to
remove the zk-SNARK proof from the MPC program. However this leaves us with a
considerable challenge - How do we prove to the blockchain that the sum of the
in-going account balances in a smart contract is equal to the sum of the
outgoing balances? As a solution, we will compute a relatively practical proof
of knowledge proof within the MPC program such that all parties contribute to
the witness. The resulting effect is to guarantee that the difference between
the sum of the input balances and the sum of the outgoing balances is zero. An
MPC protocol [8] enables a collection of parties to interact with each other
in several “rounds” of communication in order to compute a function $f$ and
learn the output $y=f(x_{1},x_{2},\ldots,x_{n})$ where $x_{i}$ is party
$i^{\prime}s$ input. Such that even if up to $t$ parties are malicious (for
some collusion tolerance $t$); they cannot learn the other parties’ inputs
i.e. they are kept secret. We distinguish between two types of input/output
privacy, which are:

  * •

Weak Input/Output Privacy is defined such that the execution of a smart
contract does not reveal any parties’ inputs/outputs to the public. But the
inputs/outputs of each party are not hidden from each other.

  * •

Strong Input/Output Privacy is defined such that parties’ inputs/outputs are
not leaked to both the public and to each of the other parties.

Furthermore, we distinguish between two types of PSC evaluation: non-
interactive PSC (NI-PSC) and interactive PSC (I-PSC). In the former, the
blockchain executes the smart contract function and no interaction is needed
between the contract participants. In contrast, interactive PSC involves
executing the smart contract function off-chain by all parties interacting for
the purpose of executing an MPC protocol to compute the smart contract
function. This is the setting primarily explored in this paper. We do however
briefly touch upon non-interactive PSC in Section V but we leave further
development to future work.

We consider a cryptocurrency that supports transaction privacy. More
precisely, we expect, for example, to inherit a blockchain that implements the
$\mathsf{Blockchain}_{\mathsf{cash}}$ program in [3] and a user program that
implements the $\mathsf{UserP}_{\mathsf{cash}}$ protocol in [3] i.e. the
operations of mint and pour from ZCash/Hawk that provides transaction privacy.
To avoid implementing these operations in this work, we interface with such a
construction through a commitment scheme that is defined by the PSC evaluation
protocol. First, we formalize an (interactive) PSC evaluation protocol in this
paper as shown in Section II. In the formal definitions sections we also
specify the set of input coins $\mathsf{coin}_{1},\ldots,\mathsf{coin}_{n}$
which are commitments to hidden values
$\mathsf{\$val}_{1},\ldots,\mathsf{\$val}_{n}$ respectively. Next, we
construct a concrete PSC evaluation protocol as shown in Section III that
allows the contract participants to evaluate a smart contract function off-
chain that yields a new set of coins
$\mathsf{coin}^{\prime}_{1},\ldots,\mathsf{coin}^{\prime}_{n}$ that hide the
output values $\mathsf{\$val}^{\prime}_{1},\ldots,\mathsf{\$val}^{\prime}_{n}$
from the smart contract such that the blockchain can be sure that
$\sum_{i\in[n]}\mathsf{\$val}^{\prime}_{i}=\sum_{i\in[n]}\mathsf{\$val}_{i}$.
Finally, we prove our protocol $t$-secure for collusion tolerance $t<n$
assuming the hardness of the discrete logarithm problem in the random oracle
model (Section IV). Although this security notion is weaker than security in
the universal composability framework, it shows our protocol resists a wide
variety of attacks from a malicious adversary that can _statically_ corrupt
$t<n$ parties. We intend to prove full security in the UC framework [9] in
future work.

One of the primary goals of our protocol is to minimize the computation
overhead of the MPC program to ensure practicality. With this in mind, we use
simple and lightweight cryptographic tools such as standard sigma protocols
that can be computed efficiently. We also exploit a simple trick that involves
decomposing the output coin commitment into commitments to its individual
bits, then for each bit, sending both candidate commitments (a commitment to a
zero and a commitment to a one) in random order to the blockchain, and
choosing between the candidates using a simple multiplexer circuit in the MPC
program based on the output value of the coin. Therefore, this idea
simultaneously functions as a range proof and a way to reduce computation in
the MPC program (we can use SPDZ[10]) to a simple multiplexer circuit. The
associated cost of this approach is the requirement of two NIZK proofs for
every bit. These proofs are however not computed within the MPC program so the
approach remains practical.

###  I-A Example of a Private Smart Contract

Consider a sealed bid auction as a Private Smart Contract as shown in Figure
1. In a sealed-bid auction, one of the participants is the seller and the
other participants are bidders. Each bidder submits a bid and the bidder with
the highest bid wins the auction. All bids are kept private.
Consider a function $f$ that implements this smart contract. Suppose there are
$k$ bidders, and in total $n=k+1$ parties (recall the seller is one of the
parties). The seller is designated as the first party. We define:

  * •

$f((\mathsf{\$seller},\cdot),(\mathsf{\$bidder}_{1},\cdot),\ldots,(\mathsf{\$bidder}_{k},\cdot))$

    * –

$\mathsf{\$highest}\leftarrow 0$

    * –

$\mathsf{winner}\leftarrow 0$

    * –

For $i\in\\{1,\ldots,k\\}\mathrel{\mathop{\mathchar 58\relax}}$

      * *

If $\mathsf{\$bidder}_{i}>\mathsf{\$highest}$

        * ·

$\mathsf{\$highest}\leftarrow\mathsf{\$bidder}_{i}$

        * ·

$\mathsf{winner}\leftarrow i$

    * –

$\mathsf{\$seller}^{\prime}\leftarrow\mathsf{\$seller}+\mathsf{\$highest}$

    * –

$\mathsf{\$bidder}^{\prime}_{\mathsf{winner}}\leftarrow 0$

    * –

For
$i\in\\{1,\ldots,k\\}\setminus\\{\mathsf{winner}\\}\mathrel{\mathop{\mathchar
58\relax}}$

      * *

$\mathsf{\$bidder}^{\prime}_{i}\leftarrow\mathsf{\$bidder}_{i}$

    * –

Return
$(\mathsf{\$seller}^{\prime},\mathsf{\$bidder}^{\prime}_{1},\ldots,\mathsf{\$bidder}^{\prime}_{k},\mathsf{out}\\\
\mathrel{\mathop{\mathchar 58\relax}}=\mathsf{winner})$

Figure 1: Example of a Private Smart Contract: A Sealed Bid Auction

###  I-B Overview of Interactive Private Smart Contracts

Private Smart Contract (PSC) execution involves three phases as shown in
Figure 2. The first, which we call the freeze phase (a term borrowed from
Hawk), is where each participant sends its input coin to the blockchain. The
blockchain “freezes” the coins so that they cannot be spent and records them
for use later. The second phase is computation. This occurs off-chain and
involves the parties running an MPC protocol between them. The third phase is
what we call finalization where at least one party must notify the blockchain
of the result of the MPC program. There are a set of output coins resulting
from smart contract execution (one for each party). The blockchain has to
check that the sum of the input coins is equal to the sum of the output coins.
Once this is asserted, the blockchain can award the output coin to each party;
we call this contract closure111A contract is said to be closed when the zero-
sum constraint is evaluated to be satisfied and the payouts are made..

Figure 2: How Interactive Private Smart Contracts will Work

##  II Formal Definitions

We distinguish amounts of currency with a leading “$” (dollar sign) symbol
before the associated variable name or literal value to enhance readability.
We define the set of valid currency values $\mathbb{V}$ as the set of non-
negative integers less than a strict upper bound $L$. More formally, we have
that $\mathbb{V}\mathrel{\mathop{\mathchar
58\relax}}=\\{\mathsf{\$val}\in\mathbb{Z}\mathrel{\mathop{\mathchar
58\relax}}0\leq\mathsf{\$val}<L\\}$. For convenience, we choose $L$ as a power
of 2 i.e. we let $L=2^{\ell}$ for some positive integer $\ell$.

###### Definition 1

An $n$-party smart contract is an $n$-ary function
$f\mathrel{\mathop{\mathchar
58\relax}}(\mathbb{V}\times\\{0,1\\}^{\ast})^{n}\to(\mathbb{V}^{n}\times\\{0,1\\}^{\ast})\cup\\{\bot\\}$
satisfying the following property:

  * •

For all choices of $\mathsf{\$val}_{1},\ldots,\mathsf{\$val}_{n}\in\mathbb{V}$
and $\mathsf{in}_{1},\ldots,\mathsf{in}_{n}\in\\{0,1\\}^{\ast}$, one of the
following statements is true

    1. 1.

$t=\bot$ (failure)

    2. 2.

$t=(\mathsf{\$val}^{\prime}_{1},\ldots,\mathsf{\$val}^{\prime}_{n},\mathsf{out})\land$

$\sum_{i\in[n]}\mathsf{\$val}^{\prime}_{i}-\sum_{i\in[n]}\mathsf{\$val}_{i}=0\;\text{(zero-
sum constraint)}$

where
$t=f((\mathsf{\$val}_{1},\mathsf{in}_{1}),\ldots,(\mathsf{\$val}_{n},\mathsf{in}_{n}))$.

###  II-A Coins

Following on from Zcash [1] and Hawk [3], we define a _coin_ as a commitment
to some value $\mathsf{\$val}$ with randomness $r$ using some binding and
hiding commitment scheme $\mathsf{Com}$. We write this as
$\mathsf{coin}=\mathsf{Com}(\mathsf{\$val};r)$. We assume the inclusion of a
mechanism to provide transaction privacy in a manner such as Zcash and Hawk,
but we endeavor to sidestep repeating the details here by defining an
appropriate interface between such a mechanism for transaction privacy and a
PSC evaluation protocol. We achieve this by assuming that the value associated
with the input coin $\mathsf{coin}_{i}$ of each party $\mathcal{P}_{i}$ is
private; that is, hidden from the blockchain and the other parties. Execution
of the smart contract produces an output coin $\mathsf{coin}^{\prime}_{i}$ for
each party $\mathcal{P}_{i}$ whose value is also hidden from the blockchain
and the other parties. A particular PSC evaluation protocol, defined
momentarily, specifies the commitment scheme that it uses to bind a value
$\mathsf{\$val}$ to a $\mathsf{coin}$ using randomness $r$.

###  II-B PSC Evaluation Protocol

We now present the notion of a private smart contract (PSC) evaluation
protocol. This is a protocol that consists of a blockchain program, which
handles three types of messages $(\mathsf{freeze},\cdot)$,
$(\mathsf{compute},\cdot)$ and $(\mathsf{finalize},\cdot)$ and a collection of
user parties $\mathcal{P}_{1},\ldots,\mathcal{P}_{n}$. We defer to the full
version a formal generalized definition of a PSC evaluation protocol using the
blockchain model of cryptography [3] in the universal composability (UC) [9]
framework. Our definition here is more specialized as it specifically
addresses the case of interactive PSC, which is what our protocol targets in
this paper. In interactive PSC, computation of the smart contract function
occurs off-chain, most likely using a multi-party computation protocol.
Several elements of our definition are inspired by the blockchain model [3]
but our model here is effectively “stripped-down” and tailored to the task in
hand. We require a special trusted incorruptible entity $\mathcal{M}$ that is
defined as follows. If $\mathcal{M}$ receives a message
$(\mathsf{input},F,x_{i})$ from every party $\mathcal{P}_{i}$ for $i\in[n]$,
then it privately computes $y=F(x_{1},\ldots,x_{n})$ and sends $y$ to every
party $\mathcal{P}_{i}$ with the message $(\mathsf{output},F,y)$. Note that
there is an authenticated and private channel between $\mathcal{M}$ and every
party $\mathcal{P}_{i}$. Such an entity $\mathcal{M}$ allows us to model a
correct and secure idealized MPC protocol.

###### Definition 2

A PSC evaluation protocol $\pi$ (in the interactive setting) is a tuple
$(\mathsf{Com},B,U)$ where $\mathsf{Com}$ is a commitment scheme used to
establish input and output coins,
$B=(\mathbf{\mathsf{Init}},\mathbf{\mathsf{Freeze}},\mathbf{\mathsf{Finalize}})$
is the blockchain program (modelled as a tuple of stateful PPT algorithms) and
$U=(\mathbf{\mathsf{Init}},\mathbf{\mathsf{Create}},\mathbf{\mathsf{Freeze}},\mathbf{\mathsf{PrepareCompute}},\mathbf{\mathsf{Finalize}})$
is the user program. The program $B$ is passed to the blockchain program
wrapper $B^{\prime}$, defined in Figure 3, to produce a blockchain
functionality. The program $U$ is passed to the user program wrapper
$U^{\prime}$, defined in Figure 4 to specify user behavior during execution of
the protocol $\pi$.

Blockchain program wrapper $B^{\prime}(B)\mathrel{\mathop{\mathchar
58\relax}}$ Init: $\mathsf{Contracts}\leftarrow\\{\\}$ Call
$\mathbf{\mathsf{B.Init()}}$ (i.e. Call program $B$) Send blockchain state to
$\mathcal{A}$. Freeze: Upon receiving $\mathsf{msg}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{freeze},\mathsf{id},P,\cdot)$ from $\mathcal{P}$: Send
$(\mathsf{msg},\mathcal{P})$ to $\mathcal{A}$ Assert $\mathcal{P}\in P$ If
$(\mathsf{id},\cdot,\cdot,\cdot)\notin\mathsf{Contracts}$:
$\mathsf{Contracts}\leftarrow\mathsf{Contracts}\cup\\{(\mathsf{id},P,P^{\prime}\mathrel{\mathop{\mathchar
58\relax}}=\\{\\},\mathsf{freeze})\\}$ Assert
$(\mathsf{id},\bar{P},P^{\prime},t\mathrel{\mathop{\mathchar
58\relax}}=\mathsf{freeze})\in\mathsf{Contracts}$ Assert $\bar{P}=P$ Assert
$\mathcal{P}\notin P^{\prime}$ If
$\mathbf{\mathsf{B.Freeze}}(\mathsf{msg},\mathcal{P})=1$: (i.e. Call program
$B$) If $P^{\prime}\cup\\{\mathcal{P}\\}=\bar{P}$:
$t\leftarrow\mathsf{compute}$ Replace
$(\mathsf{id},\bar{P},P^{\prime},\mathsf{freeze})$ in $\mathsf{Contracts}$
with $(\mathsf{id},\bar{P},P^{\prime}\cup\\{\mathcal{P}\\},t)$ Send blockchain
state to $\mathcal{A}$ Compute: Computation is performed off-chain Finalize:
Upon receiving $\mathsf{msg}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{finalize},\mathsf{id},\cdot)$ from $\mathcal{P}$: Send
$(\mathsf{msg},\mathcal{P})$ to $\mathcal{A}$ Assert
$(\mathsf{id},P,P^{\prime},\mathsf{compute})\in\mathsf{Contracts}$ If
$\mathbf{\mathsf{B.Finalize}}(\mathsf{msg})=1$: Replace
$(\mathsf{id},P,P^{\prime},\mathsf{compute})$ in $\mathsf{Contracts}$ with
$(\mathsf{id},P,P^{\prime},\mathsf{finalized})$ Send blockchain state to
$\mathcal{A}$

Figure 3: Blockchain program wrapper $B^{\prime}(B)$ for PSC evaluation.
Note that $\mathcal{A}$ is the adversary.

User program wrapper $U^{\prime}(U)\mathrel{\mathop{\mathchar 58\relax}}$
Init: $\mathsf{Computations}\leftarrow\\{\\}$ $\mathsf{Coins}\leftarrow\\{\\}$
Call $\mathbf{\mathsf{U.Init()}}$ (i.e. Call program $U$) Freeze: Upon
receiving message $(\mathsf{freeze},f,P,\mathsf{\$val},\mathsf{in})$:
$r\xleftarrow{\$}\\{0,1\\}^{\ell_{\mathsf{Com}}}$
$\mathsf{coin}\leftarrow\mathsf{Com}(\mathsf{\$val};r)$
$\mathsf{Coins}\leftarrow\mathsf{Coins}\cup\\{(\mathsf{\$val},r)\\}$
$\mathsf{id}\leftarrow\mathbf{\mathsf{U.Create}}(f,P)$
$\mathsf{msg}\leftarrow\mathbf{\mathsf{U.Freeze}}(\mathsf{id},(\mathsf{\$val},r),\mathsf{in})$
Send $\mathsf{msg}$ to blockchain Compute: Upon receiving message
$(\mathsf{compute},\mathsf{id})$:
$(\hat{f},P,x)\leftarrow\mathbf{\mathsf{U.PrepareCompute}}(\mathsf{id})$
$\mathsf{Computations}\leftarrow\mathsf{Computations}\cup(\hat{f},P,\mathsf{id})$
Send $(\mathsf{input},\hat{f},P,x)$ to $\mathcal{M}$ Finalize: Upon receiving
$\mathsf{msg}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{output},\hat{f},P,y)$ from $\mathcal{M}$: Assert
$(\hat{f},P,\mathsf{id})\in\mathsf{Computations}$
$(\mathsf{msg},\mathsf{coin}^{\prime}_{1},\ldots,\mathsf{coin}^{\prime}_{n},\mathsf{out},(\mathsf{\$val}^{\prime},r^{\prime}))\leftarrow\mathbf{\mathsf{U.Finalize}}(\mathsf{id},y)$
$\mathsf{Coins}\leftarrow\mathsf{Coins}\cup\\{(\mathsf{\$val}^{\prime},r^{\prime})\\}$
Send $\mathsf{msg}$ to blockchain Remove $(\hat{f},P,\mathsf{id})$ from
$\mathsf{Computations}$

Figure 4: User program wrapper $U^{\prime}(U)$ for PSC evaluation.

The fundamental correctness condition expected of a PSC evaluation protocol
$\pi\mathrel{\mathop{\mathchar 58\relax}}=(\mathsf{Com},B,U)$ is as follows.
Let $f$ be an $n$-ary smart contract function as defined in Definition 1. For
any $\mathsf{\$val}_{1},\ldots,\mathsf{\$val}_{n}\in\mathbb{V}$ and
$\mathsf{in}_{1},\ldots,\mathsf{in}_{n}\in\\{0,1\\}^{\ast}$ such that
$((\mathsf{\$val}^{\prime}_{1},\ldots,\mathsf{\$val}^{\prime}_{n}),\mathsf{out})\leftarrow
f((\mathsf{\$val}_{1},\mathsf{in}_{1}),\ldots,(\mathsf{\$val}_{n},\mathsf{in}_{n}))$
for
$\mathsf{\$val}^{\prime}_{1},\ldots,\mathsf{\$val}^{\prime}_{n}\in\mathbb{V}$
and $\mathsf{out}\in\\{0,1\\}^{\ast}$. Then we say that $\pi$ correctly
executes $\pi$ if the following experiment terminates and outputs 1 with all
but negligible probability.  Experiment
$\mathsf{Exper}_{\pi}(f,P,(\mathsf{\$val}_{1},\mathsf{in}_{1}),\ldots,(\mathsf{\$val}_{n},\mathsf{in}_{n}))$:
Run blockchain process $\mathcal{B}$ with program $B^{\prime}(B)$ Run
$\mathcal{P}_{i}$ with program $U^{\prime}(U)$ for $i\in[n]$ Send
$(\mathsf{freeze},f,P,\mathsf{\$val}_{i},\mathsf{in}_{i})$ to
$\mathcal{P}_{i}$ for $i\in[n]$ Wait until
$(\mathsf{id},P,P,\mathsf{compute})\in\mathcal{B}.\mathsf{Contracts}$ Send
$(\mathsf{compute},\mathsf{id})$ to $\mathcal{P}_{i}$ for $i\in[n]$ Wait until
$(\mathsf{id},P,P,\mathsf{finalized})\in\mathcal{B}.\mathsf{Contracts}$ Return
$\sum\mathsf{\$val}^{\prime}_{i}=\sum\mathsf{\$val}_{i}$ where
$(\mathsf{\$val}^{\prime}_{i},\cdot)\in\mathcal{P}_{i}.\mathsf{Coins}$

To clarify on the experiment above, when a process $\mathcal{X}$ is run with a
program $X$, the initialization procedure $\mathbf{\mathsf{X.Init}}$ is
executed first and then the control is transferred to a message loop where the
program waits for incoming messages which are dispatched to their appropriate
handlers. We denote by $\mathsf{transcript}_{\pi,\mathcal{S},\mathcal{R}}$ the
sequence of messages sent from $\mathcal{S}$ to $\mathcal{R}$ during the
execution of protocol $\pi$. Of particular interest is
$\mathsf{transcript}_{\pi,\mathcal{B},\mathcal{A}}$ where $\mathcal{B}$ is the
blockchain and $\mathcal{A}$ is the adversary. In fact, in our security
definition, which is presented next, the objective is to simulate the protocol
and produce a transcript that is computationally indistinguishable from that
produced in the real world.

###  II-C Security

We now present a security definition that is strictly weaker than security in
the UC framework, which we leave to an extended paper. The security definition
we describe in this section is modelled on the typical simulation-based
security notion for MPC. However, there are some notable differences. Firstly,
the adversary $\mathcal{A}$ interacts with a blockchain, which is modelled as
an entity that is trusted for availability and correctness which shares its
internal state with the adversary. Secondly, in the real world, the contract
participants $\mathcal{P}_{i}$ interact privately with a trusted third party
$\mathcal{M}$ that cannot be corrupted by the adversary nor can the adversary
access the contents of the private channels between $\mathcal{M}$ and
$\mathcal{P}_{i}$.

Let $I=\\{i_{1},\ldots,i_{t}\\}$ be the set of indices of the $t\leq n$
corrupted parties. Additionally, we let $\bar{I}=[n]\setminus I$ be the set of
indices of the honest parties. Let $f\mathrel{\mathop{\mathchar
58\relax}}(\mathbb{V}\times\\{0,1\\}^{\ast})^{n}\to(\mathbb{V}^{n}\times\\{0,1\\}^{\ast})\cup\\{\bot\\}$
be an $n$-party smart contract function as defined in Definition 1. We denote
by $\vec{\mathbf{x}}$ a vector of _inputs_ from all $n$ parties to the
protocol; that is, we have $\vec{\mathbf{x}}\mathrel{\mathop{\mathchar
58\relax}}=(x_{1}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{\$val}_{1},\mathsf{in}_{1}),\ldots,x_{n}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{\$val}_{n},\mathsf{in}_{n}))$. Let $\pi$ be an interactive
PSC evaluation protocol as defined in Definition 2.

####  II-C1 Real World

We now give the experiment for the real world execution of $\pi$ in the
presence of an adversary $\mathcal{A}$.

|  Experiment
$\mathsf{REAL}_{\pi,\mathcal{A},I}(f,P,\vec{\mathbf{x}})_{\mathcal{D}}$:
---
|  Run blockchain process $\mathcal{B}$ with program $B^{\prime}(B)$
|  Run $\mathcal{P}_{i}$ with program $U^{\prime}(U)$ for $i\in\bar{I}$
|  Parse $(\mathsf{\$val}_{i},\mathsf{in}_{i})\leftarrow x_{i}$ for
$i\in\bar{I}$
|  Send $(\mathsf{freeze},f,P,\mathsf{\$val}_{i},\mathsf{in}_{i})$ to
$\mathcal{P}_{i}$ for $i\in\bar{I}$
|  Wait until $(\mathsf{id},P,\cdot,\cdot)\in\mathcal{B}.\mathsf{Contracts}$
|  Send $(\mathsf{compute},\mathsf{id})$ to $\mathcal{P}_{i}$ for
$i\in\bar{I}$
|  Output $\mathcal{D}(\mathsf{transcript}_{\pi,\mathcal{B},\mathcal{A}})$

Idealized Entity $\mathcal{M}\mathrel{\mathop{\mathchar 58\relax}}$ Init:
$\mathsf{Inputs}\leftarrow\\{\\}$ Input: Upon receiving
$(\mathsf{input},F,P,x)$ from $\mathcal{P}$: Assert $\mathcal{P}\in P$ Remove
$(F,P,\mathcal{P},\cdot)$ from $\mathsf{Inputs}$ if it exists
$\mathsf{Inputs}\leftarrow\mathsf{Inputs}\cup(F,P,\mathcal{P},x)$ If
$(F_{j},P_{j},\mathcal{P}_{j},x_{j})\in\mathsf{Inputs}\;\land$ $F_{j}=F\land
P_{j}=P$ for all $\mathcal{P}_{j}\in P$: $y\leftarrow
F(x_{1},\ldots,x_{n^{\prime}})$ where $n^{\prime}=|P|$ Send
$(\mathsf{output},F,P,y)$ to $\mathcal{P}_{j}$ for all $\mathcal{P}_{j}\in P$

Figure 5: Idealized entity $\mathcal{M}$ that privately and correctly executes
a designated function on inputs supplied by a set of parties, which are kept
private.

Furthermore, the blockchain executes blockchain program $B^{\prime}(B)$.
Recall from the definition of $B^{\prime}$ that the blockchain sends its
internal state to $\mathcal{A}$ after it handles every message.

####  II-C2 Ideal World

In the ideal world, a simulator $\mathcal{S}$ interacts with an ideal
functionality $\mathcal{F}$ that executes the smart contract function $f$. All
parties send their inputs to $\mathcal{F}$, then the function $f$ is computed
and the result returned to $\mathcal{S}$. The goal of simulation in the ideal
world is for $\mathcal{S}$ to simulate the adversary’s view in the real world
i.e. it must produce a transcript that is computationally indistinguishable
from the transcript generated in the real world. We denote by
$\vec{\mathbf{x}}_{J}$ for $J\subseteq[n]$ the sub-vector of
$\vec{\mathbf{x}}$ containing the components of $\vec{\mathbf{x}}$ at every
index in $J$.

|  Experiment
$\mathbf{\mathsf{IDEAL}}_{\mathcal{F},\mathcal{S},I}(f,P,\vec{\mathbf{x}}))_{\mathcal{D}}$:
---
|
$\mathsf{transcript}\leftarrow\mathcal{S}^{\mathcal{F}_{f,P}(\vec{\mathbf{x}}_{\bar{I}},\cdot)}(f,P,\vec{\mathbf{x}}_{I})$
|  Output $\mathcal{D}(\mathsf{transcript})$

###### Definition 3

A PSC evaluation protocol $\pi$ is $t$-secure if for all $I\subseteq[n]$ with
$|I|\leq t$, all polynomial-time computable smart contract functions $f$, all
polynomial-sized $\vec{\mathbf{x}}\in(\\{0,1\\}^{\ast})^{n}$ and all subsets
of participants $P\subseteq\\{\mathcal{P}_{i}\\}_{i\in[n]}$, then for all PPT
adversaries $\mathcal{A}$, there exists a PPT simulator $\mathcal{S}$ such
that for any PPT distinguisher $\mathcal{D}$ it holds that

$\displaystyle\Big{|}\mathsf{Pr}\Big{[}\mathsf{REAL}_{\pi,\mathcal{A},I}(f,P,\vec{\mathbf{x}})_{\mathcal{D}}\rightarrow
1\Big{]}-$
$\displaystyle\mathsf{Pr}\Big{[}\mathbf{\mathsf{IDEAL}}_{\mathcal{F},\mathcal{S},I}(f,P,\vec{\mathbf{x}})_{\mathcal{D}}\rightarrow
1\Big{]}\Big{|}$ $\displaystyle\leq\mathsf{negl}(\lambda)$

where $\mathsf{negl}(\lambda)$ is a negligible function in the security
parameter $\lambda$.

##  III Our PSC Evaluation Protocol

The protocol we present ensures both contract closure and immediate
closure222A protocol is said to support immediate closure if the blockchain
can instigate contract closure after receiving a single accepted finalization
message.. Our first idea is to instantiate the commitments used for coins with
Pedersen commitments[11]. Let $\mathbb{G}$ be a finite cyclic group of prime
order $p$. Let $g$ and $h$ be two generators of $\mathbb{G}$. Then a Pedersen
commitment is defined as

$\mathsf{Com}(x;r)=g^{x}\cdot h^{r}$

Consider input coins
$\\{\mathsf{coin}_{j}=\mathsf{Com}(\mathsf{\$val}_{j};r_{j})\\}_{j\in[n]}$ and
output coins
$\\{\mathsf{coin}^{\prime}_{j}=\mathsf{Com}(\mathsf{\$val}^{\prime}_{j};s_{j})\\}_{j\in[n]}$.
Then by the homomorphic property of Pedersen commitments[12, 11], we have

$\prod_{j\in[n]}\mathsf{coin}^{\prime}_{j}/\mathsf{coin}_{j}=h^{\sum_{j\in[n]}s_{j}-r_{j}}$

if and only if
$\sum_{j\in[n]}\mathsf{\$val}^{\prime}_{j}-\mathsf{\$val}_{j}=0$. Our protocol
leverages the Schnorr sigma protocol [13] to prove knowledge of the discrete
logarithm in base $h$ of
$\prod_{j\in[n]}\mathsf{coin}^{\prime}_{j}/\mathsf{coin}_{j}$. Note that this
sigma protocol can be transformed into a non-interactive proof of knowledge in
the random oracle model via the Fiat-Shamir heuristic [14].

###  III-A Initialization

We define the algorithms $\mathbf{\mathsf{B.Init}}$ and
$\mathbf{\mathsf{U.Init}}$ before we proceed any further. In the blockchain
program, we initialize a set called $\mathsf{FrozenCoins}$ that will contains
coins that are frozen. Therefore, we have

  * •

$\mathbf{\mathsf{B.Init}}()$:

    * –

$\mathsf{FrozenCoins}\leftarrow\emptyset$

    * –

$\mathsf{FreezeRecords}\leftarrow\emptyset$

  * •

$\mathbf{\mathsf{U.Init}}()$:

    * –

$\mathsf{Identifiers}\leftarrow\emptyset$

    * –

$\mathsf{SecretElems}\leftarrow\emptyset$

A set of $m$ participants decide to create a private smart contract by
specifying an $m$-ary smart contract function $f$ along with a set of
participant identities $P$ (i.e. their pseudonyms in the underlying
cryptocurrency). For simplicity, we often assume that $P$ contains all
participants we have defined in our security definition i.e. $m=n$ and
$P=\\{\mathcal{P}_{i}\\}_{i\in[n]}$ but this is without loss of generality
since it is easy to see that any subset of $m\leq n$ participants can be
supported. We assume that each party gives their consent to the smart contract
function $f$ that is used; that is, each party has knowledge of the code of
$f$, inspects it and agrees that it is fair. Specifying and validating the
correctness of $f$ is beyond the scope of this paper and literature abounds on
this. For example, we would assume that each party contributes its own
preconditions and post-conditions to the smart contract code in order to
establish consensus. Although we do not aim to keep $f$ itself private in this
paper, the astute reader will observe that it is straightforward to achieve
this with our protocol. We now specify the $\mathbf{\mathsf{U.Create}}$
algorithm which takes as input a smart contract function $f$ and a set of
participants $P$ and returns a unique identifier for this pair. Let $H$ be a
collision-resistant hash function, modelled as a random oracle in the security
analysis (as we shall see later), that maps an arbitrary-length string to a
uniformly random string $\\{0,1\\}^{\lambda}$ where $\lambda$ is the security
parameter.

  * •

$\mathbf{\mathsf{U.Create}}(f,P)$:

    * –

$\mathsf{id}\leftarrow H(f\parallel P)$

    * –

$\mathsf{Identifiers}\leftarrow\mathsf{Identifiers}\cup\\{(\mathsf{id},f,P)\\}$

    * –

Return $\mathsf{id}$.

Much of what we have defined thus far is “boilerplate” and possibly common to
any PSC evaluation protocol. Next, we define the algorithms used in the freeze
phase.

###  III-B Freezing Coins

In the freeze phase of the protocol, we employ the sigma protocol from [15]
that proves in zero knowledge that a commitment commits to $0$ or $1$. We use
its transformation (in the random oracle model) into a NIZK via the Fiat-
Shamir heuristic [14], and denote the scheme by
$\mathsf{BNIZK}\mathrel{\mathop{\mathchar
58\relax}}=(\mathbf{\mathsf{BNIZK.Prove}},\mathbf{\mathsf{BNIZK.Verify}})$. We
have already established that $\mathbb{V}$ denotes the set of valid amounts of
currency. Here we ordain the upper limit $L$ of a valid amount of currency to
be $2^{\ell}$ such that a valid amount of currency lies in the range
$[0,2^{\ell})$ for some $\ell$. In addition, we decompose an output coin
$\mathsf{coin}^{\prime}$ into a product of $\ell$ commitments corresponding to
the binary decomposition of the output value. For each
$k\in\\{0,\ldots,\ell-1\\}$, the party generates two commitments, one of them
commits to zero and the other commits to one. Importantly, it permutes the
order of these commitments when it sends them to the blockchain so that the
blockchain does not know whether the first or the second one commits to zero
etc. More precisely, for each $k\in\\{0,\ldots,\ell-1\\}$, we sample a bit
$b_{k}\xleftarrow{\$}\\{0,1\\}$ and compute $c^{(k,b_{k})}$ as a commitment to
$b_{k}$ and $c^{(k,1-b_{k}})$ as a commitment to $1-b_{k}$. We prove in zero
knowledge that both commitments commit to a bit using $\mathsf{BNIZK}$ and
sends both commitments along with the proofs to the blockchain. These steps
take place in the $\mathbf{\mathsf{U.Freeze}}$ algorithm, which we now
formally define:

  * •

$\mathbf{\mathsf{U.Freeze}}(\mathsf{id},(\mathsf{\$val},r),\mathsf{in})\mathrel{\mathop{\mathchar
58\relax}}$

    * –

Assert $(\mathsf{id},f,P)\in\mathsf{Identifiers}$

    * –

$\mathsf{coin}\leftarrow\mathsf{Com}(\mathsf{\$val};r)$

    * –

For $k\in\\{0,\ldots,\ell-1\\}$:

      * *

$b_{k}\xleftarrow{\$}\\{0,1\\}$

      * *

$s^{(k,0)}\xleftarrow{\$}\mathbb{Z}_{p}$

      * *

$s^{(k,1)}\xleftarrow{\$}\mathbb{Z}_{p}$

      * *

$c^{(k,b_{k})}\leftarrow\mathsf{Com}(b_{k};s^{(k,b_{k})})$

      * *

$c^{(k,1-b_{k})}\leftarrow\mathsf{Com}(1-b_{k};s^{(k,1-b_{k})})$

      * *

$\pi^{(k,b_{k})}\leftarrow\mathbf{\mathsf{BNIZK.Prove}}(c^{(k,b_{k})},(s^{(k,b_{k})},b_{k}))$

      * *

$\pi^{(k,1-b_{k})}\leftarrow\mathbf{\mathsf{BNIZK.Prove}}(c^{(k,1-b_{k})},(s^{(k,1-b_{k})},\\\
1-b_{k}))$

    * –

$\mathsf{SecretElems}\leftarrow\mathsf{SecretElems}\cup\\{(\mathsf{id},\mathsf{\$val},r,\mathsf{in},\\\
\\{(c^{(k,0)},c^{(k,1)},s^{(k,0)},s^{(k,1)})\\}_{0\leq k<\ell})\\}$

    * –

$\begin{array}[]{ll}\mathsf{msg}\leftarrow(\mathsf{freeze},\mathsf{id},P,\mathsf{coin},\\\
\\{((c^{(k,b_{k})},\pi^{(k,b_{k})}),(c^{(k,1-b_{k})},\pi^{(k,1-b_{k})}))\\}_{0\leq
k<\ell})\end{array}$

    * –

Return $\mathsf{msg}$

where $\mathsf{id}$ is the contract identifier, $P$ is the set of contract
participants i.e. $\\{\mathcal{P}_{i}\\}_{i\in[n]}$.

The blockchain responds by executing the following steps, which are part of
the $\mathbf{\mathsf{B.Freeze}}$ algorithm that we now define:

  * •

$\mathbf{\mathsf{B.Freeze}}(\mathsf{msg},\mathcal{P})$:

    * –

Parse $\mathsf{msg}$ as

$\begin{array}[]{cc}(\mathsf{freeze},\mathsf{id},P,\mathsf{coin},\\\
\\{((c^{(k,b_{k})},\pi^{(k,b_{k})}),(c^{(k,1-b_{k})},\pi^{(k,1-b_{k})}))\\}_{0\leq
k<\ell})\end{array}$

    * –

For $k\in\\{0,\ldots,\ell-1\\}$:

      1. 1.

Assert $\mathbf{\mathsf{BNIZK.Verify}}(c^{(k,b_{k})},\pi^{(k,b_{k})})$

      2. 2.

Assert $\mathbf{\mathsf{BNIZK.Verify}}(c^{(k,1-b_{k})},\pi^{(k,1-b_{k})})$

      3. 3.

$C^{(k)}\leftarrow\\{c^{(k,b_{k})},c^{(k,1-b_{k})}\\}$

    * –

$\mathsf{FreezeRecords}\leftarrow\mathsf{FreezeRecords}\cup\\{(\mathsf{id},\mathcal{P},\mathsf{coin},\\\
\\{C^{(k)}\\}_{0\leq k<\ell})\\}$

    * –

$\mathsf{FrozenCoins}\leftarrow\mathsf{FrozenCoins}\cup\\{\mathsf{id},\mathsf{coin}\\}$

    * –

Return $1$

###  III-C Computation

Consider a smart contract function $f\mathrel{\mathop{\mathchar
58\relax}}(\mathbb{V}\times\\{0,1\\}^{*})^{n}\rightarrow\mathbb{V}^{n}\times\\{0,1\\}^{*}$.
Let $\mathsf{\$val}_{i}$ and $\mathsf{in}_{i}$ be the input currency value and
input string of party $\mathcal{P}_{i}$ respectively.
All parties obtain the tuples
$(\mathsf{id},\mathcal{P}_{i},\mathsf{coin}_{i},\\{C_{i}^{(k)}\\}_{0\leq
k<\ell})$ from the blockchain.

We now define the following function $\hat{f}$. We use the notation
$\mathsf{\$val}[k]$ to denote the $k$-th bit of $\mathsf{\$val}$.

MPC Function $\hat{f}$
$\hat{f}((\mathsf{\$val}_{1},r_{1},\mathsf{in}_{1},(c_{1}^{(k,0)},c_{1}^{(k,1)},s_{1}^{(k,0)},s_{1}^{(k,1)})_{0\leq
k<\ell})$,
$\ldots,(\mathsf{\$val}_{n},r_{n},\mathsf{in}_{n},(c_{n}^{(k,0)},c_{n}^{(k,1)},s_{n}^{(k,0)},s_{n}^{(k,1)})_{0\leq
k<\ell}))$
$((\mathsf{\$val}^{\prime}_{1},\ldots,\mathsf{\$val}^{\prime}_{n}),\mathsf{out})\leftarrow$
$f((\mathsf{\$val}_{1},\mathsf{in}_{1}),\ldots,(\mathsf{\$val}_{n},\mathsf{in}_{n}))$
For all $j\in[n]$: For all $k\in\\{0,\ldots,\ell-1\\}$: $c_{j}^{(k)}\leftarrow
c_{j}^{(k,\mathsf{\$val}^{\prime}_{j}[k])}$
$r\leftarrow\sum_{j\in[n]}(\sum_{0\leq k<\ell}2^{k}\cdot
s_{j}^{(k,\mathsf{\$val}^{\prime}_{j}[k])}-r_{j})$ Compute proof $\pi$ with
Schnorr protocol with knowledge $r$ and base $h$ Return
$(((c_{1}^{(k)})_{0\leq k<\ell},\ldots,(c_{n}^{(k)})_{0\leq
k<\ell}),\pi,\mathsf{out})$

Figure 6: Definition of the function that is evaluated by the MPC protocol.
This function is built from $f$, the smart contract function.

We can observe two things here. Firstly, all parties must collaborate to
produce an accepting proof $\pi$, which serves to validate the zero-sum
constraint. The second point is that symmetric encryption of the
$\mathsf{\$val}^{\prime}_{i}$ is not needed since the value
$\mathsf{\$val}^{\prime}_{i}$ can be read by $\mathcal{P}_{i}$ (and only
$\mathcal{P}_{i}$) from $((c_{i}^{(k)})_{0\leq k<\ell}$.

Now we define the $\mathbf{\mathsf{U.PrepareCompute}}$ algorithm:

  * •

$\mathbf{\mathsf{U.PrepareCompute}}(\mathsf{id})$:

    * –

Assert $(\mathsf{id},f,P)\in\mathsf{Identifiers}$

    * –

Assert
$(\mathsf{id},\mathsf{\$val},r,\mathsf{in},\\{(c^{(k,0)},c^{(k,1)},s^{(k,0)},s^{(k,1)})\\}_{0\leq
k<\ell})\\\ \in\mathsf{SecretElems}$

    * –

Fetch $(\mathsf{id},\mathcal{P}_{i},\mathsf{coin}_{i},\\{C_{i}^{(k)}\\}_{0\leq
k<\ell})$ from $\mathcal{B}.\mathsf{FreezeRecords}$ for each
$\mathcal{P}_{i}\in P$ (recall we assume that $|P|=n$)

    * –

Define function $\hat{f}$ as in Figure 6 using function $f$.

    * –

$x\leftarrow(\mathsf{\$val},r,\mathsf{in},(c^{(k,0)},c^{(k,1)},s^{(k,0)},s^{(k,1)})_{0\leq
k<\ell})$

    * –

Return $(\hat{f},P,x)$

###  III-D Finalization

Since this protocol supports immediate closure, a valid finalization message
from a single party is sufficient to instigate contract closure. The MPC
protocol is executed between the parties during the computation phase and it
concludes with a final output $y$ that is accessible to all the parties.
Therefore, we now define the algorithm, namely $\mathbf{\mathsf{U.Finalize}},$
that processes this $y$ and produces a $\mathsf{finalize}$ message to be sent
to the blockchain along with extracting all output coins
$\mathsf{coin}^{\prime}_{1},\ldots,\mathsf{coin}^{\prime}_{n}$.

  * •

$\mathbf{\mathsf{U.Finalize}}(\mathsf{id},y)$:

    * –

Assert $(\mathsf{id},f,P)\in\mathsf{Identifiers}$

    * –

Assert $(\mathsf{id},\mathsf{\$val},r,\mathsf{in},\\\
\\{(c^{(k,0)},c^{(k,1)},s^{(k,0)},s^{(k,1)})\\}_{0\leq
k<\ell})\in\mathsf{SecretElems}$

    * –

Fetch $(\mathsf{id},\mathcal{P}_{i},\mathsf{coin}_{i},\\{C_{i}^{(k)}\\}_{0\leq
k<\ell})$ from $\mathcal{B}.\mathsf{FreezeRecords}$ for each
$\mathcal{P}_{i}\in P$ (recall we assume that $|P|=n$)

    * –

Parse $y$ as $(((c_{1}^{(k)})_{0\leq k<\ell},\ldots,(c_{n}^{(k)})_{0\leq
k<\ell}),\pi,\mathsf{out})$ For all $j\in[n]$:

      1. 1.

For all $k\in\\{0,\ldots,\ell-1\\}$:

        1. (a)

Assert $c_{j}^{(k)}\in C_{j}^{(k)}$

      2. 2.

$\mathsf{coin}^{\prime}_{j}\leftarrow\prod_{0\leq
k<\ell}(c_{j}^{(k)})^{2^{k}}$

    * –

$c\leftarrow\prod_{j\in[n]}\mathsf{coin}^{\prime}_{j}/\mathsf{coin}_{j}$

    * –

Assert $\mathbf{\mathsf{Schnorr.Verify}}((c,h),\pi)$

    * –

Let $i^{\prime}$ be the index of _this_ party

    * –

For $k\in\\{0,\ldots,\ell-1\\}$:

      1. 1.

If $c_{i^{\prime}}^{(k)}=c_{i^{\prime}}^{(k,0)}$:

         * *

$v_{k}\leftarrow 0$

Else:

         * *

$v_{k}\leftarrow 1$

    * –

$\mathsf{\$val}^{\prime}\leftarrow\sum_{0\leq k<\ell}v_{k}\cdot 2^{k}$

    * –

$r^{\prime}\leftarrow\sum_{0\leq k<\ell}s_{i^{\prime}}^{(k,v_{k})}\cdot 2^{k}$

    * –

Fetch $\\{\mathsf{coin}_{i^{\prime}}\\}$ from
$\mathcal{B}.\mathsf{FrozenCoins}$ for $\mathcal{P}_{i^{\prime}}\in P$

    * –

$\mathsf{coin}^{\prime}_{i^{\prime}}\leftarrow\mathsf{Com}(\mathsf{\$val}^{\prime},r^{\prime})$

    * –

Replace $\mathsf{coin}_{i^{\prime}}$ in $\mathcal{B}.\mathsf{FrozenCoins}$
with $\mathsf{coin}^{\prime}_{i^{\prime}}$

    * –

$\mathsf{msg}\leftarrow(\mathsf{finalize},\mathsf{id},((c_{1}^{(k)})_{0\leq
k<\ell},\ldots,(c_{n}^{(k)})_{0\leq k<\ell}),\\\ \mathsf{out},\pi)$

    * –

Return
$(\mathsf{msg},\mathsf{coin}^{\prime}_{1},\ldots,\mathsf{coin}^{\prime}_{n},\mathsf{out},(\mathsf{\$val}^{\prime},r^{\prime}))$

The message that is returned in the algorithm above is sent by the contract
participant to the blockchain, which processes it in the following algorithm
$\mathbf{\mathsf{B.Finalize}}$:

  * •

$\mathbf{\mathsf{B.Finalize}}(\mathsf{msg})$:

    * –

Parse $\mathsf{msg}$ as $(\mathsf{finalize},\mathsf{id},\\\
((c_{1}^{(k)})_{0\leq k<\ell},\ldots,(c_{n}^{(k)})_{0\leq
k<\ell}),\mathsf{out},\pi)$

    * –

Assert
$(\mathsf{id},\mathcal{P}_{i},\mathsf{coin}_{i},\\{C_{i}^{(k)}\\}_{0\leq
k<\ell})\in\mathsf{FreezeRecords}$ for each $\mathcal{P}_{i}\in P$ (recall we
assume that $|P|=n$)

    * –

For all $j\in[n]$:

      1. 1.

For all $k\in\\{0,\ldots,\ell-1\\}$:

        1. (a)

Assert $c_{j}^{(k)}\in C_{j}^{(k)}$

      2. 2.

$\mathsf{coin}^{\prime}_{j}\leftarrow\prod_{0\leq
k<\ell}(c_{j}^{(k)})^{2^{k}}$

    * –

$c\leftarrow\prod_{j\in[n]}\mathsf{coin}^{\prime}_{j}/\mathsf{coin}_{j}$

    * –

Return $\mathbf{\mathsf{Schnorr.Verify}}((c,h),\pi)$

##  IV Security Analysis

In this section we give a proof of security for our PSC evaluation protocol
$\pi\mathrel{\mathop{\mathchar 58\relax}}=(\mathsf{Com},B,U)$ defined in the
previous section. More precisely, we prove that $\pi$ is $t$-secure for all
$t<n$ in accordance with Definition 3 assuming the hardness of the discrete
logarithm problem in the random oracle model. We must construct a simulator
$\mathcal{S}$ that uses an adversary $\mathcal{A}$ to simulate a transcript
that is computationally indistinguishable to any PPT distinguisher
$\mathcal{D}$ from the transcript produced in the real world execution of
$\pi$. To correctly make use of $\mathcal{A}$ in the simulation, we must
correctly simulate $\mathcal{A}$’s view which requires us to simulate the
honest parties, the blockchain and $\mathcal{M}$. The simulator is permitted
access to an ideal functionality $\mathcal{F}$ that computes the smart
contract function. Note that the current version of our protocol, for
simplicity, does not provide verification for the smart contract output string
$\mathsf{out}$ nor does our correctness condition check its veracity. We note
that it is straightforward to modify the protocol such that the output string
is included in the Schnorr proof such that the resulting proof serves to
encompass a “vote” amongst all participants of the correctness of
$\mathsf{out}$ since the MPC program is assumed to be correct.

###### Theorem 4

Assuming a $t$-secure MPC protocol, our PSC evaluation protocol is $t$-secure
for all $t<n$ assuming the hardness of the discrete logarithm problem in the
random oracle model.

###### Proof:

We prove the theorem via a hybrid argument. Our goal is to move to a hybrid
where we no longer depend on the inputs of the honest parties i.e.
$(x_{i}\mathrel{\mathop{\mathchar
58\relax}}=(\mathsf{\$val}_{i},\mathsf{in}_{i}))_{i\in\bar{I}}$. Recall that
$I$ denotes the set of indices of the corrupt parties whereas $\bar{I}$
denotes the set of indices of the honest parties. The reductions underlying
indistinguishability of the various hybrids are relatively straightforward and
for brevity sake, we omit them here.

Hybrid 0: This is the real system.

Hybrid 1: The change we make in this hybrid is to simulate $\mathcal{M}$ and
its output $y$ that it sends to all parties. We receive the
$(\mathsf{input},\cdot)$ messages from the adversary for the corrupted parties
and obtain the inputs of the corrupted parties. In this hybrid, we still have
access to the inputs of the honest parties. We obtain $y$ be computing the
function $\hat{f}$ in Figure 6 and send it to all parties as an
($\mathsf{output,\cdot}$) message, therefore simulating $\mathcal{M}$. This
hybrid is distributed identically to the previous hybrid.

Hybrid 2: The change we make in this hybrid is to the Schnorr proof $\pi$
component of $y$ (i.e. the output of $\hat{f}$). Instead of computing the
proof normally, we use the simulator for the NIZK. Therefore, we no longer
need the randomness $r_{i}$ and $s_{i}^{(k,b)}$ to generate $\pi$ and it can
still be generated even when the zero-sum condition does not hold. The hybrids
are indistinguishable from the zero-knowledge property of the Schnorr
protocol.

For $i\in\bar{I}$ and $k\in\\{0,\ldots,\ell-1\\}$:

Hybrid 3, i, k: In this hybrid, we do not compute the proofs $\pi_{i}^{(k,0)}$
and $\pi_{i}^{(k,1)}$ using $\mathbf{\mathsf{BNIZK.Prove}}$ but instead use
the simulator for $\mathsf{BNIZK}$. Indistinguishability of the hybrids
follows form the zero-knowledge property of $\mathsf{BNIZK}$.

For $i\in\bar{I}$ and $k\in\\{0,\ldots,\ell-1\\}$ and $b\in\\{0,1\\}$:

Hybrid 4, i, k, b: In this hybrid, we compute the commitment $c_{i}^{(k,b)}$
as a commitment to a uniformly random element of $\mathbb{Z}_{p}$.
Indistinguishability of the hybrids from the perfectly blinding property of
Pedersen commitments.

For $i\in\bar{I}$:

Hybrid 5, i: In this hybrid, we change the input coin commitment
$\mathsf{coin}_{i}$ to a commitment to a uniformly random element of
$\mathbb{Z}_{p}$. Indistinguishability of the hybrids from the perfectly
blinding property of Pedersen commitments.

Hybrid 6: In this hybrid, we change how we compute
$(\mathsf{\$val}^{\prime}_{i})_{i\in I},\mathsf{out})$ by instead calling the
ideal functionality $\mathcal{F}$ and sending it the inputs of the corrupted
parties, which have been obtained from $\mathcal{A}$. This hybrid is
distributed identically to the previous hybrid. This hybrid has no dependence
on the inputs and outputs of the honest parties and hence we obtain a
simulator that uses the adversary $\mathcal{A}$ to produce a transcript that
is computationally indistinguishable from the real world (Hybrid 0). We have
shown that privacy holds. In regard to correctness, if $\mathcal{A}$ sends a
finalization message to the blockchain with a proof that is accepted where the
zero-sum constraint does not hold, then we can construct an algorithm that
uses $\mathcal{A}$ to produce a proof that violates soundness of the Schnorr
NIZK, which contradicts the statement of the theorem. The result follows. ∎

##  V Conclusion and Future Work with NI-PSC

The protocol presented above facilitates Interactive Private Smart Contracts
(I-PSC) wherein an Interactive protocol (MPC) between the parties is executed
replacing the manager in Hawk in order to determine the outcome of the smart
contract and reach consensus on the payout distribution. At least one of the
parties must then notify the blockchain of the outcome so that the blockchain
can instigate contract closure. A disadvantage of I-PSC is that all parties
must remain online for computation to proceed. A more desirous and powerful
alternative is a protocol facilitating Non-Interactive Private Smart Contracts
(NI-PSC) wherein the blockchain performs the computation of the smart contract
while retaining input privacy; that is, its computation is oblivious to the
inputs. Parties need not be online during computation nor are they required to
interact. Furthermore, there is no possibility for aborts as in the
interactive case and the execution of smart contracts can be scheduled for
specified times and use public information such as stock prices, a situation
that may lead to aborts in the interactive case e.g. a stock price that
negatively affects a party’s position in a contract may encourage that party
to abort the protocol. In a NI-PSC, only one round of interaction with the
blockchain is needed to execute a private smart contract, namely the freeze
round. In the freeze round, each party sends a message containing (1). a
unique identifier $\mathsf{id}$ that identifies the contract (e.g. a hash of
the contract function, execution number and set of participants); (2). the set
of participants $P$; (3). the party’s input coin; and (4). protocol-specific
information. The round is complete when the blockchain receives a valid freeze
message with matching $(\mathsf{id},P)$ for every $\mathcal{P}\in P$. The
blockchain can then independently compute the output of the smart contract and
instigate contract closure.

###  V-A Realizing NI-PSC

NI-PSC can be realized with a primitive known as Non-Interactive MPC (NI-MPC).
We assume we are in the PKI (public key infrastructure) model where the
parties know each other’s authentic public key. Then, in NI-MPC, each party
need only send one message, which contains its input and the function to be
evaluated. Given the messages from all parties, the desired function can be
computed on the parties’ inputs. Choosing the function $f^{\prime}$ described
in our protocol above as the function computed by NI-MPC would fully realize
NI-PSC. Known constructions of NI-MPC rely on indistinguishability obfuscation
(iO) [16, 17], which has not been realized from standard assumptions. Basing
NI-MPC on standard assumptions is a stubbornly difficult open problem because
NI-MPC for general functions implies iO. Since “pure” NI-PSC is so difficult
to achieve under standard assumptions, we intend to consider various
relaxations as part of future work in order to give constructions under
standard assumptions.

## References

  * [1] E. B. Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza, “Zerocash: Decentralized anonymous payments from bitcoin,” in _2014 IEEE Symposium on Security and Privacy_. IEEE, 2014, pp. 459–474.
  * [2] A. Miller, M. Möser, K. Lee, and A. Narayanan, “An empirical analysis of linkability in the monero blockchain,” _arXiv preprint arXiv:1704.04299_ , 2017.
  * [3] A. Kosba, A. Miller, E. Shi, Z. Wen, and C. Papamanthou, “Hawk: The blockchain model of cryptography and privacy-preserving smart contracts,” in _2016 IEEE symposium on security and privacy (SP)_. IEEE, 2016, pp. 839–858.
  * [4] H. Kalodner, S. Goldfeder, X. Chen, S. M. Weinberg, and E. W. Felten, “Arbitrum: Scalable, private smart contracts,” in _27th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 18)_, 2018, pp. 1353–1370.
  * [5] E. Ben-Sasson, A. Chiesa, E. Tromer, and M. Virza, “Succinct non-interactive zero knowledge for a von neumann architecture,” in _23rd $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 14)_, 2014, pp. 781–796.
  * [6] J. Groth, “Short pairing-based non-interactive zero-knowledge arguments,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 2010, pp. 321–340.
  * [7] A. Banerjee, M. Clear, and H. Tewari, “Demystifying the role of zk-snarks in zcash,” in _2020 IEEE Conference on Application, Information and Network Security (AINS)_. IEEE, 2020, pp. 12–19.
  * [8] R. Canetti, U. Feige, O. Goldreich, and M. Naor, “Adaptively secure multi-party computation,” in _Proceedings of the twenty-eighth annual ACM symposium on Theory of computing_ , 1996, pp. 639–648.
  * [9] R. Canetti, “Universally composable security: A new paradigm for cryptographic protocols,” in _Proceedings 42nd IEEE Symposium on Foundations of Computer Science_. IEEE, 2001, pp. 136–145.
  * [10] T. Araki, A. Barak, J. Furukawa, M. Keller, Y. Lindell, K. Ohara, and H. Tsuchida, “Generalizing the spdz compiler for other protocols,” in _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 880–895.
  * [11] T. P. Pedersen, “Non-interactive and information-theoretic secure verifiable secret sharing,” in _Annual international cryptology conference_. Springer, 1991, pp. 129–140.
  * [12] J. Groth, “Homomorphic trapdoor commitments to group elements.” _IACR Cryptol. ePrint Arch._ , vol. 2009, p. 7, 2009.
  * [13] C.-P. Schnorr, “Efficient identification and signatures for smart cards,” in _Conference on the Theory and Application of Cryptology_. Springer, 1989, pp. 239–252.
  * [14] A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification and signature problems,” in _Conference on the theory and application of cryptographic techniques_. Springer, 1986, pp. 186–194.
  * [15] J. Groth and M. Kohlweiss, “One-out-of-many proofs: Or how to leak a secret and spend a coin,” in _Annual International Conference on the Theory and Applications of Cryptographic Techniques_. Springer, 2015, pp. 253–280.
  * [16] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan, and K. Yang, “On the (im) possibility of obfuscating programs,” in _Annual international cryptology conference_. Springer, 2001, pp. 1–18.
  * [17] P. Ananth, A. Jain, and A. Sahai, “Indistinguishability obfuscation from functional encryption for simple functions,” _Eprint_ , vol. 730, p. 2015, 2015.