J1 PAIN 05 Silur Sublinear improvements in ringCT and blockchainagnostic implementation

so hi thanks for coming and thanks for the organizers for arranging the talks this way my talk had plenty of intro by Jacob and Matthew Pryor ring city had a funeral here I see many Monroe enthusiasts here thank you for - what I have here is a recent advance from Monroe research lab on Ring City we overcame the sub linear scaling problem also the mix-and-match attack there will be a part of my talk where I will have to stop because these rich parts of this rich the research is still confidential information and I won't have time for questions either because I will have to jump in for my team in the other room so ring signatures it was greatly introduced by Jacob I couldn't can do better basically it enables a group to sign a message no it allows you to sign a message on behalf of a group instead of yourself without leaking identity or or anything about your public key and a good thing about this is that choosing the other public is for this ring requires no coordination besides publishing it for example on a blockchain so you can just select an samples from previous transactions and they have nothing to do with their private keys on this we can make this even better with multi layer rings so you make your span signature splitting up your balance in L parts forming a matrix and you only have to prove for the blockchain that you know an entire column of this matrix that's basically our private here the problem with this one is that now we require coordination from the other guys because with this column all public Keys can be only used once the city part of Ring City the confidential transactions are what's hiding the amounts or ring signatures are hiding your identity and confidential transaction schemes are hiding the amounts you are sending we are doing it with Patterson commitments and range proofs you see that topologically we are trying to reach some linearity here so first we lock in the amount you want to spend and then your ways to not be able to play with different linear combinations for the same amount by Range proof so you can't have negative stuffs and I think that public research that we have improvements on Range proof too called ballot proofs from boot but that's for another time so quick intro on commitment schemes a commitment scheme is an algorithm that has an input and a random nouns they are equal if with a different nonce on the same input they are the same they are hiding if with the same random nouns with different inputs are the same and it's binding if the probability of differentiating two different commitment scheme on inputs and randomness are below a bound you define this may sound a little hard an easier way we cryptographers like to explain is that you are in a room there is a computer with a keyboard you enter something data leaves the room you have nothing to do about that it's a black box that something came in and you have to decide whether you are in a world where it's random junk coming into the computer or it depends on your input so the closer your chances are to 5050 with this game the better security have you have this is just an example of that if the probability of differentiating is it random or the same equal commitment scheme if it's 50/50 or good and P is the differentiate from this 50/50 probability so ring city now has three algorithms a key generation basic stuff a key image a public key a spending that outputs spend signature from the secret keys key images the matrix that we talked about now commitments that you know an entire column of this matrix the commitment that can open up this this is the trapdoor in this cryptographic scheme and of course the message you want to provide into an advisory and a verification for all these inputs the current weakness sees for this besides scalability we know that currently we need all all times and size of proofs and both Matthew and Jacob explained how it won't work once for example manaro block chains got much much bigger but there are the mathematical problems here that there are some elements in this finite field that you can't make the commitments on for the matrices for example the Noll element you can do that and of course the mix and match attack that was presented last year in a white paper dionan izing Manero it's just half of the story it's not practically easily feasible attack but it exists by sending a signature with the same key but different key images it's a really basic stuff less entropy is less security so we appended two new definitions of balance at mana research lab in 4d schemes the first is key image uniqueness so double span checking works now by checking that your key images hasn't been used ever on the blockchain before and extract ability it's a it's a proof that us suspender have a trapdoor key that hides you the index of the matrix which was your real private key and that just junk is just a proof that you have this key you don't have to provide that it's a zero knowledge so strewing city RTR a 3-ring city arc TRS string city we still haven't decided which name we will go on with this scheme most likely it will be RTR as justice it's actually the abbreviation of the names of the authors of the white paper so instead of Patterson commitments which was aagama commitments with Fiat Schomburg transforms Fiat Schomburg transform basically is a really fancy way of making proof of knowledge non-interactive and zero knowledge it's not quite efficient or rather if you start from scratch making it known interactor zero knowledge you will probably get better results but a fourier transform is is sufficient for for this use case thus we can get rid of the noir variants of multi six because even those noir proves skill really where and they are highly efficient they have this interactive parts so if you try to eliminate multiple rounds of communication which spender and verifier you are no you are just to step back because you have to hash everything upend it make another proof and you are leaving the scalable margin again and the headline here is that our result this scheme results in O log and overhead for proofs instead of o L times and so it's visible on aetherium or in Bitcoin but for other reasons too the key theorem here is that every Patterson commitment or gamma a gamma ciphertext can be lifted as an a gamma commitment for Patterson commitments is easy you just have to happen your second generator under the commitment error and for a gamma we know that that for every multiplicatively homomorphic commitment to one is a valid multiplicative additively homomorphic commitment to zero and we only have to prove that we know one opening to zero that we are not creating balance on the blockchain from thin air no no other amounts involved so we can use this little trick for here this achieves us the sub linearity and stuff addresses so you can use the same public key on the blockchain multiple times but the track reading just the transaction on the chain we won't linked me to your public key so it's harder for nasty three-letter agencies to track down your your transaction history in this new scheme there was quite some attention on commitments and D commitments because in this new scheme we redefine public keys and key images as commitments and your D commitments your single D commitment is your private key and you just have to append this non-interactive zero knowledge proof by the future mere transfer that you have this opening commitment first yes you can open the public key to your key images agama have really has a really nice homomorphic property that you don't have to do on chain or off chain around that I have to Dec commitment for the public key that has the same key image that will be a lot of computational and storage overhead you can do directly public key quotient group commitment of the key image because as on the previous slides we see that using the same randomness value zero is hiding in a commitment scheme that was the first part can we yeah nor more more a little more more one more I think now one more yeah this one so the first part is our trick here we can cut two steps on the verification because we are hiding we you are using a hiding commitment scheme with a gamma thanks we can yep yep next one you have to prove that you know the secret in the index in the matrix that holds your private key we can use the same trick on every column of this matrix to get n commitments to 0 and this is the part that I won't have time to explain and I can't really explain until the publish of the white paper butl made a modification of the growth and Col wise non-interactive zero knowledge proof basically you input these matrices of commitments that you claim that you can open up to 0 and the return value is that how many of them actually opens up to 0 so how do we use this on the blockchain what what all this is about so we replaced public keys and private keys with commitments and the commitments for achieving scalability and more privacy so we can use these key images we used in the spending and verifying algorithms as public Kings on a blockchain so we achieved key image uniqueness the new security definition we introduced so lack of entropy with users and transactions won't affect your privacy anymore the reduced overhead won't give us the extra stability this is a mistake in the presentation it will give us the scalability Patterson commitments will hide our amounts that we are spending and the multi layered links are hiding our metadata as users and the second part of our headline here that this scheme works with any group that we assume diffie-hellman is hard this means any known cryptographically used elliptic curve for example p25 6k one used in Bitcoin and I exactly did that so the empower glass implementation the guys at mana or if research lab allowed me to start is actually targeted towards a theorem and not Manero but it will be blockchain agnostic this means that you can do ring signatures on Bitcoin Manero and III on with the same library it's using open ssl it supports plenty of elliptic curves except the useful ones so we will need either they will have to accept my montgomery patch or I have to introduce level of abstraction sorry developers and you if you are here and some of you know that my specialty in the Tyrian foundational research is quantum proof cryptography and of course there is a quantum proof ring learning with errors generalization of this scheme on the way long term so thanks for your attention hope you I can publish the white paper with the lab bit more specific after the conference feel free to ask me questions after I've I've left a room on the way a war after the evil some talk next room thanks you