プライバシー強化技術（PET）のインタラクティブガイド — ユースケースに合った PET を見つけて、実装を探索し、論文を技術にマッピングします。
ユースケースについての質問に答えると、推奨される PET が理由と DeFi の例とともに表示されます。
A prover convinces a verifier that a statement about private data is true, without revealing anything beyond the truth of the statement itself.
"I am KYC-verified" without revealing identity. Privacy Pools: "My funds come from a clean subset" — user proves membership in an association set.
"My balance is sufficient, I'm not double-spending" — without revealing amount or sender. Powers Zcash Sapling/Orchard, Aztec.
"This batch of N transactions is correctly executed" — single succinct proof verified on L1. Powers zkEVM rollups.
Multiple provers jointly generate a ZK proof without sharing inputs — e.g., Renegade's colzkSNARK for dark pool order matching validity.
Shortest proof (~200 bytes), O(1) verification. Requires per-circuit trusted setup. Used in Zcash Sapling.
Universal trusted setup (one SRS for all circuits). Slightly larger proofs. UltraHONK = Aztec's production variant.
Transparent (no trusted setup), post-quantum secure, larger proofs (~100KB). Used by StarkNet, Polygon.
Prover must know all private inputs. Cannot compute on others' private data — that's MPC's role.
複数パーティが共同で計算 a function on their combined private inputs. No party learns others' inputs — only the final output.
Compute on encrypted data without ever decrypting it. One party outsources computation to another who never sees the plaintext.
Malicious security ≈ 10–100× overhead vs semi-honest.
Two parties (buyer/seller) run MPC to compute whether orders match, revealing only the matched quantity — not unmatched order details.
MPC for distributed key management. Multiple signers jointly produce a signature without reconstructing the private key.
Economic penalties (bonds) enforce honest behavior. P2DEX and Rialto: participants stake collateral; misbehavior slashes stake.
Encrypt data → send to untrusted server → server computes on ciphertexts → encrypted result returned → decrypt locally. Server never sees plaintext.
Zama's fhEVM: contract state is encrypted under FHE. Validators execute on ciphertexts without seeing values. Enables confidential ERC-20 balances.
Bids submitted encrypted; FHE used to determine winner without revealing losing bids. Practical today for small parameter sizes.
Searcher computes arbitrage profit on encrypted transaction pool — finds profitable arb without seeing individual transaction amounts.
GPU/ASIC acceleration under active research (Intel HEXL, nGraph-HE).
| Criterion | MPC | FHE |
|---|---|---|
| Number of parties | n ≥ 2, known set | 1 client + 1 server |
| Latency | Network RTTs (ms–sec) | Compute-bound (sec–min) |
| Circuit complexity | Scales with gates | きわめて遅い for deep circuits |
| Trust model | Threshold of honest parties | No trust in server |
| Practical today | Yes (SPDZ, dark pools) | Simple ops only |
| DeFi use case | Dark pool matching, threshold sig | Sealed auctions, private state |
Add calibrated noise to query outputs so individual records cannot be identified from published results. Provides a formal mathematical guarantee.
For any two adjacent datasets D and D' (differ by one element), for any output S:
Smaller ε = stronger privacy = less accuracy. Typical ranges:
LP strategy hiding in AMM price functions. Adding calibrated noise to price curve so liquidity provider positioning cannot be reverse-engineered from on-chain observations.
Axe inventory direction hiding under continual observation. 2-year production deployment at JPMorgan. DP applied to revealed inventory positions over streaming data.
DP applied to matching outputs rather than inputs. Protects which orders matched and at what quantities in dark pool settings.
ノイズ混入集約 price discovery — adds indistinguishable noise to price signals derived from order flow, hiding individual participant contribution.
Two parties with sets A and B compute their intersection A∩B. Neither party learns anything about elements not in the intersection — the set itself stays private.
Practical for sets up to millions of elements.
Bank holds customer list. OFAC/regulator holds sanctions list. PSI computes overlap without either party revealing non-matching elements to the other.
Research proposal: two institutions check if they have matching orders (buy side vs sell side) without revealing unmatched order book entries to the counterparty.
Multiple institutions find shared KYC-verified customers without sharing their full customer databases — reduces duplicate KYC burden.
Only tells you the overlap — no other properties computed. Requires fixed set structure.
Split a secret (e.g., private key) into n 個の共有. Any t shares can reconstruct; t-1 shares reveal nothing about the secret.
Secret s encoded as f(0) for a random degree-(t-1) polynomial f. Share i = f(i). Any t points reconstruct f (and thus s) via Lagrange interpolation. t-1 points are information-theoretically random.
t-of-n signers each produce a partial signature on a message. Any t partials combine (with Lagrange coefficients) into a single group signature. No private key is ever reconstructed.
パーティ jointly generate a public/private keypair without any single party knowing the private key. Eliminates trusted dealer requirement. Pedersen DKG is the standard.
Ciphertext encrypted under a shared public key; decryption requires t partial decryptions. Used for time-lock encryption and commit-reveal without a trusted party.
DAO treasury or protocol fund managed by team. t-of-n approval required for withdrawals. Gnosis Safe (smart contract), or true threshold ECDSA/BLS for gas efficiency.
Threshold issuance of unlinkable credentials. Multiple issuers each sign a partial credential; user aggregates into one credential no single issuer can trace. Used in PEReDi CBDC design (Kiayias/Kohlweiss).
Transactions encrypted under committee's public key; submitted to mempool encrypted; decrypted only after finalization by threshold validators. Prevents front-running because content unknown during ordering.
Binance, Coinbase, and Fireblocks use threshold ECDSA/EDDSA for hot wallet key management. Keys never reconstructed — signing happens via MPC among HSM nodes.
Filter and sort to find papers by PET, venue, or use case.
| Paper / System | PET(s) | Use Case | Reasoning | Status |
|---|