Greetings! In this talk I will be talking about Gladius, our LWRP's hybrid safer, which supports fast-distributed decryption. This is work by Giron Kong, myself, Varun Maran and Professor Nigel Smart. So, securely distributing decryption means that several distrustful parties want to jointly decrypt some cycle text. And the way you do that is by secret sharing the key among the parties. So, each party will hold a secret share of the secret key, and by that you can define some access structure. So, for example, if you have a threshold T, then it means that any subset of at least the parties can use their shares and recover the secret key. So, those are the qualified parties, and on the other hand, less than T parties can't use their shares in any way. So, those are the unqualified parties. So, the parties with the shares engage in a protocol which implements the decryption functionality. And since they don't trust each other, the communication has to be secured. So, intuitively this means that the protocol should be as secure as the primitive that it implements. So, for example, if the underlying encryption scheme is in CCA, security means that an adversary was given access to the decryption oracle shouldn't be able to distinguish between cycle texts without possessing the secret key. And similarly, at the level of the protocol, the adversary that controls some unqualified party, and is given access to the decryption oracle coming from the functionality shouldn't be able to distinguish between cypher texts without possessing the qualified parties shares. So, we want to construct a public key encryption for which we can implement the decryption algorithm using a secure protocol. And we want to do that efficiently. So, we start by fixing some requirements from the underlying primitive. So, the public encryption should be in CCA secure, should be post quantum and should be able to encrypt messages of any length. So, what we are really looking for is an hybrid construction. So, in an hybrid construction, it is not enough to design a fast distributed decryption for the chem part only because the chem part is embedded in a larger circuit and the other components might be quite expensive for distributed computing. And indeed, it has been an open problem for quite a long that of having an unhybrid constructing constructing and hybrid. Having the the world encryption circuits optimized for multi-party computation techniques. In this paper, we try to solve this problem. So, the most famous hybrid is that from Kramershop. It combines a chem and a dem into a public encryption. Key generation is that from the chem and to encrypt a message. You first generate a small session key. You encrypt, you encapsulate it using the chem and the public key. And this will form the first ciphertext, while the message is efficiently encrypted with the them components in the session key. And this will be the second ciphertext. With that, the encryption is quite obvious. So you first encapsulate K from the ciphertext and you will use the session key to decrypt the second ciphertext and get the message. So, we get in CCA security. If we start with in CCA components. And we are able to encrypt messages of any length because we can simply use any symmetric key cipher in a mode of operation. The problem it comes when we try to distribute the encryption algorithm. So everything that involves the secret key needs to be implemented as a secure protocol. So, we start by securely computing the decapsulation. And the result is super key is should still be kept secret. And this means that we also need to implement as a secure protocol the decryption of the them. Now this last step is the problem, especially for long messages when you are using. I don't know as in a mode of operation, the decryption under general multi-party computation techniques is quite expensive. So it would be great if we avoided this last step. So the name idea is to just simply release this the session key. Make it public so that we can perform the decryption over clear data. So no need of any secure protocol. What I mean is that once we get the secret key, we just reveal it. So we can perform the decryption over clear data. And yeah, the problem is that the reason of this CC attack because an adversary who gets the challenge C1 star C2 star then forms this cipher text C1 star C2 where C2 is a completely random cipher text. And he queries the decryption Oracle on this cipher text, which is allowed because it is different from the challenge. So let's look. Let's see what happens on when he queries the Oracle. So the first component will be correctly decrypted by definition. And yeah, following our strategy, the decision key will be revealed and yeah, the second component probably will result in error because it's random, something completely random. So the adversary high probability will get the valid session key and error message, whatever the second component is. So we will just use the session key to decrypt the second challenge and get the full message. So security is completely broken. Now, our hybrid, our proposal comes from is the result of trying to fix this security flow. And yeah, this is what we propose our hybrid construction. Again, we are combining a public key encryption with a symmetric encryption. It's very similar to kind of show. And the difference is we are using a secure hash function here. So after generating a session key and encapsulating it and after the encryption of the message we authenticate the session key using this hash function. So we are linking K to the second cipher text. As a result we get an additional cipher text here. The effect of this on the encryption algorithm is that we will need to perform a verification of the hash. So if this verification passes. Namely evaluating the over C2 and K will produces the third cipher text, then we will reveal, we will broadcast K, along with the message. Otherwise, we will return just an error message. And if you already guessed that by using on hash function this way. We are basically preventing the previous attack. Indeed, if the adversary follows the previous strategy, so by submitting something like challenge and other stuff. In reality, the verification here will fail. And the adversary will get nothing. So the only way for the adversary to get the session key is either of course submitting the challenge but this is not allowed, or by finding a collision in the hash function. So the previous attack is prevented. So notice that's by placing on a hash function here. Authenticated K here. We have the following advantage that we don't need the randomness from our public encryption. And indeed we can just use a deterministic public key encryption. We should be still secure enough, so as to prevent some brute force attacks on the first cipher text. So the right security notion we are interested in is one way CPA. So, putting everything together we are able to prove that leaking the key this way. Still, it is secure produces something secure, namely, if we start with a one way CPA deterministic public key encryption, and a one time in CPA symmetric encryption, then we will get a public encryption which is secure in the random model. Now, let's go to the protocol, secure protocol that implements the distributed description of this hybrid. So this is a picture that gives you the idea of what should be performed in a secure way. So everything that involves the secret key or the session key should be done securely. So these operations are marked with thread. So, first week decrypt the first cipher text using the key, the result is the session key which is still secret, which is then passed to the hash function gene which will verify that the session key comes from a valid encryption. And if this verification passes, then we are able to leak broadcast the session key and pass it to the decryption and execute this decryption the clear the decrypting the second components, the cipher text and get the message. Now, in order for this to be efficient as a secure protocol, we basically need two things, evaluating efficiently g over secret data and evaluating performing a secure protocol efficiently for the public encryption. So, the first requirement is can be easily met by using any MPC friendly hash function as a gene. So, the only thing that is left to do is to find a good candidate for this public encryption. So, we are also presenting, we are also proposing the second hybrid, which is exactly the same as before, except we now add two more hash functions, one here and one here, producing a fourth cipher text. And also, we will need to redo this hash functions evaluations in the, in the decryption. So, if we do so, then the previous statements holds in the quantum random Oracle model. The reason for this is quite technical and you can find the details in the full version of the paper. Also, we can provide a general distributed circuit for the decryption of the second hybrid, which is similar to the previous one, except now we need to implement as a protocol these two additional hash evaluations. So, they need to be evaluated over the secret session key. So, again, for. So everything is almost exactly as before. And the only things that need to be implemented as secure protocols are the decryption and the actual evaluations. So, first we can use again NPC hash functions. And for this we need to find a good public encryption for which we can do the decryption efficiently with a protocol. So, what is left to do is to find a public key encryption which is that a mistake, but still one way CPA secure. We would like it to be post quantum pose. If we plug something a pub, a public key encryption, which is post quantum based on post quantum assumptions in second hybrid then we will get. We will get the, the, the unhybrid public key encryption, which is also going to. So, the standard way of having of getting a deterministic public key encryption is by the randomizing probabilistic encryption. There is a technical encrypt with hash, which basically takes a probabilistic in CPA public encryption and gives you a deterministic one way CPA public encryption. Basically, you replace replace the randomness with the hash of the message. To get the one way CPA security, you have to redo these operations again in the decryption. So, this is basically what the, what one of the variants of the fush is actually come out to transform that. And so, again, we have a problem if we try to do this in a distributed way. And the reason is that this message in our case is going to be the session came which is still secret at this point so we would need to reevaluate the hash function over secret data and use it as a seed. For the randomness of the encryption, encryption which has to be computed over the secret session key. So, especially when the encryption algorithm is using some weird probabilistic probability distribution them this operation is really expensive for general multi-party computation techniques. So, I hope you are convinced that this approach doesn't really work in our case. So, we would like to find something that doesn't use randomness to get security. So, one operation that is intrinsically secure intrinsically random is the running map. So for two integers p and q where p is less than q. So, this running map that takes an integer and scales it by p over q and approximates it by the nearest integer. And this hides the lower bits of the input. If the input is sufficiently random. So, this running map is basically one way. So, we have something that doesn't need additional noise or randomness to be one way to be secure. And that's perfect we want to base our encryption on that. So, here is an assumption based on such constructions, which is related to the learning with others problem. And guess what the name is learning with this problem. So, here, instead of having a nice linear system, you have a rounded linear system. So, the basic version of the decision learning with roundings says that for a secret vector on the public matrix, this rounded matrix by vector product looks indistinguishable from a completely random vector. We also have the decision ring LWR. If you consider the same problem over polynomial rings, and the decision module LWR. If you are considering adding more structure and considering matrices of polynomial rings. You have the search LWR problem, which says that it's difficult to retrieve S from many LWR samples. So, on top of that, we are able to construct our public key encryption. So, it's really simple. The encryption, so is probably is deterministic. And this comes from the fact that we are base, we are basing the encryption directly on the running map. So, you see that we don't need any we are not using any randomness. And the, the encryption is quite fast for distributed techniques because and the reason lies on the fact that we are using LWR techniques constructions in the key generation. Now, what is left to do is to argue the one way CPA security. And this is just a combination of search LWR here, because this is saying our public key is undistinguishable from a pair of random matrices, and the search LWR, which is basically the fact that the encryption is our encryption is a one way map. So we are done. All right, we started with the problem of finding constructing the public key encryption, for which we could do the decryption in a distributed way quite efficiently. So, as I mentioned, this problem reduces to that of considering hybrid cypress. So we started looking at the kind of shop hybrid, which was the problem of requiring one to evaluate the description of the them over the secret session. This operation is costly for in in a distributed way. Also, it requires some components so quite demanding. So the idea is that we leak the session key before doing the decryption so the decryption then becomes just an operation over clear data so there is no need for any secure protocol. And we are able to do that without consequences securely so we can leak the key securely because we are using hash function as an authentication for the session key. So this hash function is useful because we can use minimal assumptions for our public key encryption, we just need a deterministic public key encryption. So what we get. The end is a very general transform that takes a deterministic one way CPA public encryption with a one time in CPA them and gives you a in CCI public encryption in the random oracle model. We can get full security in the quantum model if we had two more fashions. Finally, we are able to show that these possible to construct a public encryption which is deterministic at steel on the way CPA secure. Based on the LWR assumption. We are basing encryption directly on the rounding map, which basically is avoiding us doing expensive the randomization procedures. Putting everything together. We get the first practical. Post quantum public encryption, for which we can implement the decryption using a secure protocol in in efficient way in very efficiently. So this concludes my talk if you have questions about paper, please feel free to contact me by email. Take care.


Hi, I'm Peter Burris and welcome to another Cube Conversation. Got a great conversation with a CMO today. We're going to spend some time talking about some of the changes affecting the tech industry and specifically affecting marketing in the tech industry. And we're going to be having that conversation with Megan Eisenberg who's a CMO of MongoDB. Megan, welcome to the Cube. Thank you, thank you for having me. Well, so we're going to spend some time talking about a number of different things, but MongoDB is an especially interesting company in the context of this conversation. Why don't we start by, tell us a little bit about MongoDB. Sure, MongoDB is a leading modern general database platform downloaded by 35 million developers and is used by the hottest private companies like Coinbase to storied brands like HSBC. So if we think about it, the reason why I think this is especially interesting is because MongoDB is an open source company so that means that that has some specific marketing challenges. Yes. It recently went through an IPO and the marketing role in an IPO is especially interesting. But very importantly, here's where I want to start. That in many respects, the tech industry has always been set up to sell products. And the proposition was, I know about my product as a seller, you don't know that much about it, user. So I'm going to spend an enormous amount of time bashing you about why my product is better. That's changed a bit as we move to this digital transformation and the role that data plays in helping companies transform. It's less about what the vendor's doing and more how the company utilizes the technology. It's kind of this underlying from a product orientation to a services orientation. It has a continuous relationship. Yes, that's right. Especially in the open source world where you have a continuous relationship with your developers. Tell us a little bit about how, at least in your experience at MongoDB, that relationship that from a product orientation to a service, ongoing service orientation, affects marketing. Sure, I mean, we think a lot about how our users are using the product. We want to win the hearts and minds of developers. They're out there building new ideas. They're using it. When we enter a company through one developer, we have the opportunity to spread to many others. If we think of all size businesses, there's thousands, if not tens of thousands, of databases and applications. So we want to make sure they have a great experience that we're collecting data that's useful to help them and that it spreads to others. Now, let me amplify what you just said. Because, again, we could go back and think about other technology companies where the role was to explain what a relational database was and why it was better than something else. And what you just described is no, we want to create a community of users that are constantly developing their own visibility, their own insight. And our job is to call the best of that and use that as part of the marketing experience. Have I got that right? Yeah, that's right. Developers are actually quite social and when they're out there building or they find something new, they're creating apps, they're creating new tools, they're sharing that knowledge. And so from a marketing standpoint, we do a lot of work with developer relations, building apps out there speaking to language communities, we're out there at conferences, really showing what the technology can do. So many years ago I had a conversation with a CEO who's now worth billions of dollars. And I asked him specifically, I felt that marketing had been essential to his success. And he said something very interesting. He said, ah, I'm marketing. That's what I put between my engineers and my salespeople to make sure they don't kill each other. Yeah. That can't be the role of marketing in a community-oriented company. Tell us about how marketing stands in collaborative, collaborative arrangement with product and sales at MongoDB. Sure, so I mean, for myself personally as a CMO, I think the success of marketing is its relationships not only with sales, but with engineering. And that they're really sales I see as an internal customer understanding what they need to be successful, making sure that we're talking to the right persona that we're helping them build pipeline. We're putting tools out there that are helping the user go through the experience. And from an engineering standpoint that we're collaborating that there's a feedback loop as people are using the product. We want it to be a frictionless experience when they meet us out in the field or they come to our website. And that part's important as they're registering for the product as they come in as they start to use the product and making sure we all have access to that data. It helps sales better do their job, engineering build a better product, and marketing better really hook the user in. So marketing helps sustain that journey. Yes. But also ensuring that sales is getting the appropriate information and insight on what customers are doing. But it's multimodal today. I mean people talk about multi-channel all the time. Talk a bit about how you anticipate the engagement model changing as more personas get involved, as technology gets more deeply embedded, as the risk profile changes. And very importantly, especially for a company like MongoDB, as the number of use cases explodes. Yes. I mean it's a good point. From a marketing standpoint, we're going direct to developers who want to do self-serve with our MongoDB Atlas product all the way to the CIO and CTO who are trying to digitally transform their businesses. And they're all different channels. It's not just email, it's social, it's your website, it's how you interact with them in the field, it's supporting your sales team. It's our developers that are out there working in the field and building the product. So you're right. At MongoDB we have 28 technologies in our MarTech stack and we've sun set seven. So we've experimented with 35. And the reason is because there's a lot of work around website making a better experience. There's work around social media, how we design what we put out there, what we're doing in the field, making sure every experience, every form you fill out is really optimized for that customer experience. Yeah, it's creating some sort of value for the customers. Yeah. They don't have distraction, not an annoyance. But if you think about it, another CMO once said here in theCUBE that they kind of summarized some of the new role of marketing is that marketing is creating the community and marketing is sustaining the community. Where community really is defined as people who are doing something in common. So your customers are trying to apply this technology that has enormous flexibility. I'm going to ask you to explain a little bit about that in a second. Well, I think it's too deep. To a lot of new use cases. And that's what your users are trying to do. And bringing those together so they can share insights, share experience, improve the quality of the tool, speed the process through the rate at which this all happens is got to be a central feature of the marketing mission at MongoDB. Is that right? Yes, definitely. I mean, we're very much focused on the developer, their experience, winning their hearts and minds and creating advocates. People and developers that come and use the product and love it and build upon it and have things that they've learned that they want to share. We have a pretty detailed documentation for new folks. We have a MongoDB university where we've had over 800,000 developers take courses. It's definitely a highly engaged group that wants to innovate and they want to use the hottest technology. They don't want to be on legacy. Legacy databases came out 40 years ago. The likes of Oracle, right? That was designed before cloud, before mobile, before the volume of variety of data that we have today. And so if you want to build new apps you have to do it in a new modern way and MongoDB is a real alternative to those legacy databases. Yeah, so one of the things I think is especially important as we think about some of this stuff ultimately is you said you want to build out the developer community and make sure that that engagement is strong while at the same time obviously sustaining relationships with other personas that are going to write the checks probably through your sales organization. Yes, yes. What is the role of diffusing knowledge through a service? I mean, do you have a university or do you, how does content get designed and instrumented at MongoDB to catalyze that community activity? Yes, I mean content's very important all the way from our developer advocates and relations are building content to educate developers to help them learn about the product, use the product. And then for the C level execs that are trying to transform their businesses they're trying to learn about microservices, blockchain, there's a lot of content and we see it like HubSpot really educated the marketing community around inbound marketing. We're doing a lot of work to educate and work with developers and create that digital watering hole so they can learn what they need to build their next app. Especially on the idea of complex rich natural data. Yes, that's right. We believe that MongoDB is the natural way and the best way to work with data and you can put it where you want intelligently as well as the freedom to run it anywhere. Our MongoDB Atlas runs on all three major clouds with AWS, GCP and Azure and that ability to migrate we're on 54 different regions. So really anywhere in the world you want to have your app running we've got it set up for you. So MongoDB as a database company is trying to reduce the limitations of how well database can handle more complex data. The engineering is using an open source approach to try to ensure that there's a high quality offering associated with that promise. You're deploying it on a lot of different platforms cloud not cloud. So that people don't face fundamental infrastructure constraints to try to get advantage of that. That creates an enormous number of opportunities for someone to come in and try it. The whole try by motion or land and expand as people like to talk about how is MongoDB refining that notion of land and expand through its marketing mission? Sure I mean well certainly we're making it frictionless for you to sign up self-serve you can go put a credit card in we've got a free tier where you can quickly experiment try it out. As your application grows and becomes mission critical we've got the tools that you need to maintain it we've got security and all the features you would need to run a modern application and we've set it in a way where no matter where you are in the world or who you want to collaborate with it's easy for you. It's very frictionless for the developer it's a natural way to develop and you're not worried about the operational overload that comes with relational or legacy databases. So we've talked a lot about how MongoDB is working with developers let's pivot a little bit and talk about how MongoDB worked with potential investors. I've been fascinated by the role the marketing plays within IPOs. You've got finance with a very very well defined role sales that typically has a very well defined role. The marketing's tried to straddle that fine line between driving new volume but being very careful about what you say and how you say it to keep people feeling confident and comfortable in a financial standpoint. You joined MongoDB three years ago. Yes, yes three years ago. You had an IPO about halfway into your tenure. Tell us a little bit about that. Sure, I mean October 2017 the company went public. It was a very exciting time. Certainly the first time that I had been with the company and taken them public. I was fortunate enough our CEO, Dave Iticharia had done it multiple times as a leader and as a board member. And so he brought a lot of knowledge around that. And as a marketer you're thinking how do you stay within the guidelines but make sure everyone's aware of what you're doing. Certainly if you've been doing it in the past you can keep doing, if you're not hyping the market you can keep doing what you've been doing. You can run your events. You can talk about the product. The day of is a really big day to get in front of media. I was really impressed by what the team did to align media interviews. I think we had 24 different interviews in one day and we had over 50 or 60 stories break within the next week or so. So that was exciting just that timing because you can't line those up too soon. You've got to make sure everything's a go and it really worked out. And now we're just excited about the future of the market. $60 billion market by 2020 according to IDC. So we've got a massive opportunity in front of us. So what can we do? Certainly for a marketing standpoint what do I need to be doing to get on that and work through that? So MongoDB is a growth company. Yes. Good, solid set of employees. Tell us a little bit about how marketing's role is going to change over the next couple of years as MongoDB tries to grab more of this $60 billion opportunity. Yeah, I mean we've definitely have a strong vision around where we're going with our products and solutions as a database platform. We're doing a lot of work with partners. We've got some great stuff going on with SIS like a center and Infosys and Wipro who have modernizing the tech stack and working with really large companies and we're part of that offering. So we'll be working heavily with that. We're very close with the cloud vendors with AWS and Microsoft Azure and GCP. So a lot of good work going around that and we'll continue to grow our cloud offering itself Atlas, MongoDB Atlas. It's only been around two years. It's already 14% of our business now has grown 400% over the last year. And so excited to see. Yes, thank you. Yeah, thank you. That's a really exciting part of the business and with so much moving to the cloud it's the right place to be. I feel like we've done a great job really looking at where we need to be and then highlighting that in the market. So last question, Megan. Sure. MongoDB is carving out an interesting spot for itself within the marketplace. As you focus in customers, customers are increasingly dictating how the market's going to evolve. It's an interesting dynamic, especially that community approach. But there's always efforts to pull it back especially from some of the entrenched database competitors. How are you guys trying to both keep the focus and what the customer needs, drive them to this modernization while at the same time acknowledging and recognizing that they can't change everything on day one. That you have to coexist. Yeah, so MongoDB is doing a lot of work around migrations, making it very easy and frictionless. If you're going to move to the cloud this is the perfect time to move off legacy databases. And we see it with our customers. They're struggling with 40 year old technology. They need a more modern approach. They want a single view of their data. They're dealing with so much of it and it's the right time when they move to the cloud. So we're making sure our product is on all the major clouds, which it is and all the regions that we've got the tools that they need and that that process is really simple. All right, Megan Eisenberg, CMO of MongoDB. Thank you very much for being on theCUBE. Thank you for having me. It's been a great conversation. And once again, you will see additional CUBE conversations until next time. I'm Peter Burris. Thank you very much for watching.