'The Limitations of Privacy' - Barry Whitehat

so hello everyone yeah what's that uh hello everyone and thanks anna for introducing me and today i'm going to talk about some of the limitations of privacy so so like basically what i want to talk about here is that that like when we want to make private applications where we start out thinking that oh well we can just take ethereum and make everything in ethereum private or take a random blockchain and make everything inside it private but it's actually more complicated than that it turns out that making private things is this kind of complicated and private paradigm and that's what i'm going to try and explore today um so let's dig in so let's take an example of some things that we want to make private for example we want to be able to make private transfers so you can just send private money to people we want to be able to make private trades uh on it on an exchange so other people can't see what you're trading and we would like to be able to make private smart contracts and more general things but in this talk we're gonna discuss how why that's not really possible without some like major cryptographic breakthroughs um with the with the same kind of trust assumptions that we're we're comfortable with or we currently have uh so let's start a bit slowly and let's take an example of some of the applications that you can use to make private transfers so for example we can use tornado cache tornado cache is a mixer on ethereum so basically you can deposit uh in this picture it's 0.1 either and you get added to a group of people who've also deposited 0.1 ether and then you're able to make it zero knowledge proof to prove that you were one of the people who performed the deposit and also prove that you haven't performed a withdrawal and if you can make those two proofs then the smart contract will let you withdrawal 0.1 ether so that's how tornado cache works and aztec and zkopro are similar to this but they have like a higher scaling benefit so aztec is a zk roll up which means it's a zk zk roll up which means it uses zero knowledge boost for privacy but it also uses zero knowledge proofs for scalability zk optimistic roll up is is a little bit different ziggy optimistic rollups uses zk technology for privacy and it uses optimistic roll-up techniques like what optimism and arbitrary use for scalability so and all of these support private transfers and zkopro also supports private atomic swaps so you could theoretically build a private exchange using zika optimistic roll-up um so let's okay so that's so we can do transfer so let's talk about like private trades a little bit more so we have this idea of like i i like maybe people are familiar with like dark pools dark pool is basically a way to prove it it's it's like this idea from from like the financial world where you have an exchange where all of the orders that you place are private the traditional markets that they have all trades are published while they're searching for someone to match with them and basically the way that it works now is that there's just some kind of central party that will that will promise not to share your orders with anyone else until it gets unless you get it can execute it and then it'll just execute your order and give that to you so we would like to be able to do that with with ethereum as well but the problem is that like you need to find someone to make your trade and we're not really comfortable having like a centralized party that says oh yeah it's okay you can trust us we're going to we're going to make we're going to make this trade for you and and we're not going to tell anyone what trade you want to make unless until we we're just going to settle it for you we're just not really comfortable making that assumption because like who would we even pick to do that like who would who would we pick such that everyone would say oh yeah i'm okay to trust that person to do this so instead we want to do this in a private way and we know that we're able to settle the trade with zika optimistic role for example or with some other role that was ek zeke roll up or something else that we could build but we're not able to find our trading partner which is a problem um so the one of the ways that we have to do this is to use a multi-party uh multi-party computation methods to try and find the person we're trading with and i'll talk about that a little bit later so so let's talk about okay so basically what we have here is what we've done so far is we've talked about like the uh zk applications where there's like a private state that users users are able to to kind of that okay so imagine i'm in tornado cache when i deposit my node in when i deposit my 0.1 ether i join i go into this kind of group and i have some secret information that only i know that lets me prove that i'm part of this group that's that's my private state but there's also this idea of global state that we have this kind of global state which is the list of all of the people who have performed a deposit until now that's like our global state but the problem comes when we want to have global private state right when when we want to have state that nobody knows but also everyone needs to know it in order to be able to withdraw um so this comes this becomes a problem when we want to make like private generic smart contracts because in ethereum a lot of or in like cryptocurrency in general a lot of our all of our smart contracts need to have this kind of global state like global state is any like public variable in your smart contract anything that everyone needs to know the example that i use i like to use is uniswap where we have like a global state which everyone needs to know in order to make a trade because you need to be able to make a proof about that state in order to prove you're not kind of cheating anyone yeah so that's what global state is and when we have global state that we want to hide it becomes really difficult for us to do that like you can because like okay let's imagine again let's say we have a global state that we don't want anyone to know and we every user in the system needs to know that global state in order to to withdraw their coins from you as well for example if we that just is impossible right it's not possible to have both at the same time so let's take an example and dig a little bit deeper so i don't know if everyone knows unit swap but basically unit swap is is uh is a an exchange where you have a you have a token pool of full a token a and token b and there's this different there's there's this these these tokens have been gathered together in a pool in a smart contract and you're able to withdraw token b by depositing token a and you're able to withdraw token a by depositing token b but you need to know the ratio between token a and token b the the you need to know the ratio of the amount of token a and the amount of token b in the pools in order to to find out how much of token b you're able to withdraw when you deposit a certain amount of token a this is an example of of like global state right this is a global state that's constant everyone needs to know you need to know the ratio of the pool in order to be able to make trade so if you want to make a private version of this we can make pool a and pool be private but we can't make the ratio between pool a and pool b private because we need to be able to prove that we need to be able to prove that ratio is correct when we're withdrawing the amount of money that we're that we want so if you if you made it private so so you can you can say that okay but yeah we can make it private though we just no you can't really do that so so you can say that yeah you can't make it private but like then as soon as someone makes an update to the it makes a single trade on uniswap no one else will be able to because they won't know the new state you need to know the state in order to be able to make to make a transaction um yeah so so now i went like so at the start of the call anna was kind of alluded to this a little bit and this is kind of something that we've maybe have a bit of a disagreement about that uh multi-party is so anna said that oh yeah so there's starting to be amms of automatic marker makers which is basically what uniswap is that are that are private but the way that those have been built is using multi-party computation and multi-party computation as a trust model that's that's a lot different than the trust model that we are we're used to um so for example zero knowledge groups you you have to choose in order to main maintain privacy you need to trust only yourself you are the only person you need to trust yourself or one of everyone else because there's an attack where like imagine you're in a private system and everybody else decides to reveal hey this wasn't me or everyone else decides to reveal their private information then you by fact of by just being there as well being the only person who didn't do that anyone can look and say oh this this must have been this person because it couldn't have been anyone else so you know if so for zero knowledge groups you need to trust like you yourself and like the general rest of the group uh they can give up their privacy in order to kind of take your privacy away with multiparty computation it's much different with multi-party computation you see you need to use you need to trust m of n trusted parities in this model so basically a multi-computation is where you take a secret and you split it up into n pieces yeah you trust n people to hold a piece of this secret and every time an execution happens m of these people needs to come together to perform the computation so for example in the multi-party computation unit swap m of the of the parities would come together to to perform every trade so there's just a difficult trade-off here where we have m parties and we have we want m to be really big right because we want the number of people who need to come forward to to break privacy to be a lot but at the same time if m people aren't available at one time then we're not able to make a trade right the liveness disappears so we have this difficult trade-off where we're choosing between liveness and privacy so that's why i'm a little bit worried about multi-party computation for this use case i will talk a little bit more about how we use multi-party competition for other things but that isn't a one-off end trust model where just you need to have a single honest party in order to in order to keep your your privacy um yeah so that's the second method that's that's kind of used that we're not really talking about here mostly what i'm talking about here is your knowledge but actually a little bit of mpc later and then there's a trusted hardware model which is basically i don't know it's it's something i'm very skeptical about it's basically saying that oh listen i let's just trust intel to do this intel produced this this special chip that they say you're not able to you're not able to inspect exactly what the cpu is doing so you're not able to tell what's going on inside it so you can make proof you can make a you can make some some code you can load it into the into the chip and then you're able to execute that code but you're not able to find out the new state but i i am just very skeptical about this because it just involves trusting trusting some hardware manufacturer and that's just it's very difficult to validate that that is done correctly um it's actually it's it's probably impossible i mean how can you check a piece of hardware has been built according to specifications you would need to to analyze it on like a a nanometer level i'm i'm not even sure we're able to resolve that layer that level of of detail but anyway that's that's my kind of side round about trusted hardware uh so let's continue so okay so now it's okay so that's the kind of the end of part one i've kind of talked about like the different truss models that we have and i also talked about like the different techniques that we have to do things and i also talked about like this kind of global state private state paradigm where you can't have both and if you have both you start to lose some of your so you just basically lose privacy and for this reason we can't like there was talk before that like okay let's make every minute here in private let's just spend all of our time to make everything in cryptocurrency private by the transfers private smart contracts and it's just not possible to do that right because if you make things private you lose this very important feature which is private global state oh no you lose this feature of global state you can have you can still have private global state but you you sell a private global state but you lose no you can't like you can still you can still have private global state but like that's not really global though something is private it like needs more people to kind of yeah it's it's yeah you can have global state but you can't have privacy and global state those two things just don't really go together uh and this is something that zach is going to talk about later um because i think i i think that zach from aztec i think that his talk is going to go into into more detail about the type of of things that he does or that they do to try and get around this limitation uh and i'm going to talk about that a little bit too so so let's go let's so the first thing i want to talk about is unirep so this is like a reputation system that that uses snacks in order to to have this ability to like to both risk and win and lose reputation so what we wanted to do is like this is just okay what we're doing is we're building up like a reddit style social network where you're able to upload people and you're able to download people and we have this concept of karma and the way that it works is that every every week you make a post and you have a certain have a certain address and during this week people are able to kind of send you attestations they're able to send you kind of up votes and they're able to send you down votes and when i make a post i attach my my epoc address and at the end of every epoch i gather i make a zero knowledge proof that gathers together all of these attestations all of my up votes and down votes i add them together and i add them to my like uh profile but this is a private profile it's not public every time i make a post i need to so so at the end of every week we have an epoch transition where we move from the old state to the new state everyone applies there everyone applies their kind of ups and and downvotes and we start again with a new week and basically what happens is that you have to have a certain number a certain amount of camera or uploads and uploads in order to be able to make posts so this is a kind of a private reputation system that's kind of adjusting to to people's people's uploads and downloads we're able to have we're able to have this kind of reputation system so this is a project i'm pretty excited about and we're working on it now and there is a lot of room here to do like further work um there's there's more things that we can we can build with this uh like it's it's a private reputation system so there's there's a lot of there's a lot of possible applications for example we could make like a private uh coven tracker that was one project we were thinking about thinking about doing where you would where you would every time you go out you would give your epoc address to the restaurant you were going to for example then if they have some copic case they will get air dropped they will they will send you some negative reputation to your to your um to your your profile and then you won't be able to go out for a certain amount of time until you've done a quarantine we're using this in this example to kind of quarantine people privately because the way that it works right now is like you go to a restaurant and you give them your phone number and they'll form you if there's some problem is a little bit yeah it's a little bit more less private um but anyway i feel like i shouldn't have used that example but anyway that's uh that's uni wrap so there's a there's a whole bunch of other things we can use using rep for this is just the kind of beginning for steps excited to see it's an experiment i'm excited to see how it progresses uh yeah so i'm going to talk about the npc stuff now so basically uh the stuff so so there's two kinds of npc there's the m of those and it's defined by the trust model there's an m of n trust model where you have to trust m of the of the parities in the multi-party computation and there's a n minus one uh there's a m minus one uh just uh multiply computation but you have to just trust one party and what we're doing here is we have like a simple npc protocol where you say when we just make uh we make a check that a equals b yeah and in this example we can say that a and b are exchanges that are trades that we want to make so basically what we'll do is we'll go to some smart contract we'll advertise that hey i want to make a trade on tokenpayer x yeah i want to trade these for diet or something and you make a pulse there and you put your ip address and then what happens is people will contact you and say hey i'm also interested in making a trade on that pair would you like to perform this multi-party computation to see if our orders are compatible so basically you you agree to that and then and you both do this npc where you do some crypto stuff and you send some information back and forth and then you at the end of it you see you get two numbers and you say there's number one equal number two and if number one equals number two that means your orders are the same if under number one doesn't mean one number two that means your orders are different so if your orders are the same at the same you can be like okay yeah it's time to time to trade we have a we have a trade match on our trade it's time to it's time to execute this so this is this is a nice project that's kind of coming along uh we've been sort of waiting for a way to privately setter settle the orders but now we're at the point where where we hope that soon we'll have some kind of zk private way to do atomic swaps and once we have that then we will be able to implement this yeah so that's fun it's a nice kind of private way to do order matching but some of the limitations here are that it's you have to do this with a lot of people right let's say you want to make a trade on some token pair and you're basically going out and just doing this thing with everyone to try and find someone who happens to match with you and there's some problem there's some attacks that people can do like someone can make like thousands and thousands and thousands of orders uh that are fake and they can use that to kind of grind to try and find the order that you want that they that you have so they can just set up like a million orders from like zero to a million and they can just repeatedly do mpc with you until they find the price that you want to sell at um so that's one problem another problem is that like someone can do the npc with you it can turn out that yeah the trades the orders match and then it's not possible to actually execute the order that seems that's another another problem uh that they're able to kind of back out of this but yeah i feel like it's starting like where we are now it's it's a good first step and we can sort of try and tackle these other problems later another example of some oh so this is a fun one where okay so let's say that we want to build a reputation system that's basically like a friend of a friend thing right that like if someone's a friend of a friend you will you can trust them a little bit because you know that friend and you trust that friend so you can kind of transfer some of your trust in that friend to this other friend so it's easy it's a reputation to keep that system that people kind of use in their daily lives but it's also hard to to do it in a private way um so basically what we have is that we have a network of users that have have connections to different people and this is kind of our like global state but we want to keep it private for the users right we want everyone to just know who their friends are and not know who their friends or friends are so imagine that someone is like okay i want to find this friend red x and they so what they do is they reach out to all of their friends and say hey i'm looking for a friend uh but i don't want to tell you who i'm looking for can you perform this npc with me to see if they're one of your friends and the friend says okay of course so so let's yeah so let's say we're looking for bob and i ask alice alice i'm looking for a friend but i don't want to tell you who who i'm looking for can you help me and i said sure sure so alice takes a list of all of her friends and i take a friend i'm looking for bob and we together perform this mpc together whereby we'll get a single boolean results we'll either get this alice is friends with this person or not based upon just checking out each of her friends and if one of them works out that means we found a connection so then we can use zkp's on top of this to kind of find the connect to kind of make proofs of these connections um yeah so you can make a vip that and prove that this connection exists but this is just really really complicated because you have to have to ask everyone i have to go to alice and i have to ask her to check every one of her friends against this person i'm checking i'm searching for which takes a long time it doesn't take a long time but it's annoying and then if you don't find a connection you you can you have a choice between going one layer deeper in the tree and you can say dallas hey alice will you will you connect me with each of your friends so i can ask them if they're friends with his friend that i'm searching for like once you start doing that it just it just blows up because you can start searching many many times for the same person so it can be really difficult to track uh yeah so that's my talk um yeah i have a little bit of time for questions now but let me just wrap things up so like at the fair we talked about how some of the private stuff that we've been doing we then explored why global state is really important to smart contacts and why privacy and global state don't really go together we talked about some of the other methods that we can use to overcome this multi-party computation and trusted hardware and i kind of complained about both of them a little bit and then we talked about okay what are some other ways that we can approach this problem so we discussed that and here we are yeah we have some other we really jumped through a lot of hoops in order to do the kind of global search in the in the last project blindfold um but anyway that that was a talk and i'm happy to answer any questions sounds good okay i you you challenged something i said and so i need to talk to you about that that's the first question um you you did publish a really kind of well-known post about how you cannot make private uh amms this is going back to the amm question private amms using zkp's and i don't know if you're aware but there are some projects that are exploring doing that but there are trade-offs so they may be able to use zkp's to like shield the identity but not the the amounts like i guess it's sort of when i put it in the list of potential privacy use cases um it it does reference what you talked about but it may not be the complete privacy that one would hope for yeah i understand yeah so okay so there's kind of two directions here there's one is the npc which we've seen some interesting stuff published from andrew miller i think recently the other approach is yeah that's totally possible too um i guess that i would argue that it's not covering that it's just hiding the user right it's not it's not hiding it you're not hiding what you're trading so i guess yeah is it a private amm that's maybe the question maybe the word private amm doesn't exactly capture that in that case yeah possibly i'd also like to refer those people to a paper by mary mahler a couple of years ago about how so this is a really fun paper so what they did was they tried to find um they tried to they did an analysis of the z cache privacy private pool and you see the way zcash works is you can deposit you can withdraw and you can transfer so what happened was a lot of people would deposit transfer once and then withdrawal so you it was easy to track because you could see the amount of deposited and you see 10 minutes later it gets withdrawn so they use this to to kind of track a lot of of what was going on so i would be concerned that that would also be possible with this kind of private use but i think it's for sure a useful experiment and i would support people people doing that and if i can help them in any way i would be happy to help yeah i also am really curious to hear uh more about as aztec and zach does his talk because i know that there's like there's some techniques that they're using to try to solve for these problems while still using zero knowledge proofs it's almost like i think what you describe like these mpc type models like mixing it in a way like having both of those things acting at the same time or i know that there's this idea of adding like batching that kind of pooling trades in order to sort of hide it through that like creating little mini i guess mixers as you do it so okay i'm excited to find out more we i learned about this pretty recently so i don't know is there maybe is there anything like what's the future i mean you've described a few projects that you're working on right now but are there any like long shot projects that you're that you're thinking about and maybe even you could give ideas to the people in the audience to start working on tinkering with i don't know i normally try and be a little bit more conservative on long shot projects [Laughter] i think that it's kind of cool to [Music] yeah so okay so one of the things that is like a big area to explore is to use the tooling that aztec have used to make their zkc cable up to make some other recursive proofs so some other is the zk app that's based upon recursive groups and i think there's a lot of room there to build some pretty exciting stuff nice all right well i think that wraps up this block um we're going to be taking a short break uh but thank you so much barry for your chat no problem yeah i was happy to thank you for your talk we had a chat there was a talk sorry it's late here in uh in europe that's cool cool yeah thanks thanks so much thanks so much perry and uh i think this is also where i get to thank anna for being an amazing co-host for today and uh you did an amazing job highlighting how this ecosystem has evolved and kind of kick us off with the rest of the day so thank you so much for giving us your time and uh can't wait to see you all in person for the next uh real zk summit so totally