EthCC 2: Fatemeh Shirazi, Oskar Thorén, & Sebastian Bürgel

together it's kind of the next implementation or next upgrade I'd say two different code base but to whisper so having a gossip network on whisper super important and it'll also be I think able to being incorporated into theorem as well as polka-dots so give it up for the the messaging panel I'll let them introduce themselves individually [Applause] okay correct so now we're going to do something that is a bit different business regard to the format and also a bit with regard to the topic so you've been listening to people giving talks all day so we thought you might want to have something different instead of having one person talking you're now going to have four person people talking so this is the second was the highest chance that people will start fighting and throwing insults at each other but actually I hope that's not going to happen also we're going to talk a lot about privacy and not so much about blockchain now so what we hope is that at the end of the session you would have a good overview of what are different what is kind of big privacy area actually means what other key terms that were interested in and how does that relate to what we're planning to do so I'm Stephanie and I'm assistant professor at tiered afternnon advanced and now going to introduce the power panel speakers very quickly and then we're going to dig into the content so I'm going to start with Sebastian who is the CTO at Verity wraps and is working on implementations regarding anonymous messaging then we have Oscar from stereo and he is more on the engineering set and under research side of the messaging protocols we have Harry from them and Andrea who has a very who has an interest in privacy enhancing technologies in general and on blockchain baseball in particular and Fatima from the BAP 3 foundation who until very recently did a PhD on privacy-preserving distributed systems @q Dervin so these four people are going to help us to get a better understanding on what is messaging what is anonymous messaging how does it relate to blockchain and what added key components that we want to use so let's start with something that is really high level we all know messaging apps such as signal may be on the privacy-preserving side but most of you are properly using whatsapp maybe right now so why do we need a new decentralized messaging protocol and maybe even going a step further back but actually do you mean when you say messaging yeah so I think it's it's maybe let's look back in his in his blockchain context I still remember it at DEFCON 1 at a theorem DEFCON 1 we we heard that he theorem actually comprises three layers one of them was a blockchain the next one was messaging the third one was storage right so and then then kind of whisper and swarm which was pillar two and three were we're kind of consequently being a little bit cut down if I may say so but one thing that we've seen is what is needed is for example if you have a transaction in the blockchain context you want broadcast that right you want other peers to know that you have signed a transaction and maybe some of them includes that in a block what I would call broadcasting and that's what whisper was originally designed to do and then we see also applications which are more in their kind of point-to-point communication like you said initially for yeah for for example messaging is between two people and if you will apply if you apply whisper - this point-to-point communication that might not be such a good idea so that's maybe starting to get into that you know know your tools and yeah I think status has had some experience on your past right doing it and sure so first I talk briefly about sort of secure messaging because that's kind of what we're doing here and what is it like like you can start with very basic things like end-to-end encryption which is sort of becoming the very basic standard that most messaging apps for end users actually implement but then you have more interesting properties like perfect forward secrecy posts peep post compromised security and these types of things but all of these are kind of that conversational security layer and and one way of looking at secure messaging in general is to break it apart into different different hormonal pieces so you could think of like trust establishment which is how do you know that who you're talking to is actually the right person that in terms of guarding against manual mill attacks and deceptive things and then you have conversational security which is what most people think of which is like enter an encryption and forward secrecy and these sorts of things and then you can also think of sort of transport privacy where this is maybe something that's that would set product like it's apart from something like signal where you also you look at privacy as a security feature so you want to protect the metadata and we'll go into that a bit more in detail what that actually means in terms of sender limit II receive anonymity and unlink ability and so on [Music] so I guess yeah I can talk briefly about sort of whisper and where we are coming at because so status right now we are using whisper and production have been for quite a while and I think we're probably the biggest user of whisper right now this panel is called with version two which is a bit of a misnomer because as the person was saying whisper sort of broadcast based and it's not really the same type of protocol what we are looking develop here is more something point-to-point and I guess it's status one stick we made earlier is that we we assume that we're supposed is protocol that we're going to use and then we use it and build up an app but it's not really the right semantics in terms of having reliable communication if either of is one one chat or private group chat and so on and there's all sort of mistakes we made in terms of trying to retrofit the right behavior we want on top of whisper and so on I could talk about more about her later but maybe someone else it might be a good idea I guess we now talked a bit about whisper as it is now is not what we actually want because if you're really thinking about messaging to one other person or to a small group you do not want to broadcast everything to everyone but what are the advantages of being decentralized in comparison to having something like signal which has an to end encryption but via a centralized server Fatima do you want to talk about also the idea we have is to provide privacy preserving communication and once you have centralized control over the communication it is very difficult to provide that privacy preservation against that central authority whoever that is so going back to what Oscar mentioned last protecting the metadata basically protecting home where a message is all originated and where it is going to go so the source and the destination that is the basically the key goal that we have here and just encrypting the message like signal does or so like a lot of communications - it does hide the content of the communication so you don't know you don't have to not know what is written inside or what is said but you still would know where it has originated and there it has landed in the end and sometimes just knowing these two points is enough to even guess what is content of that communication so in order to provide provide truly privacy preserving communication just encrypting it like signal does or many other apps do is not enough because just knowing the endpoints would reveal a lot of the content already and then when we talk about sender or receiver are a Matisse and anonymity basically means that when a message is sent you don't be done we do not know where it has been originated now the question is whether this anonymity or this privacy preservation is against the communication parties or just an external entity a receiver annuity is the other aspect of it so basically it means that a receiver would not reveal who it is when he is receiving a message so that's the basic so I think it's good to separate these two levels a bit so you want you want some sort of privacy preserving messaging and you have you know the network stack and you have the application stack so I'm going to talk first by the network stack and then a little bit about the application stacks the application is the thing which the user actually sees which is sending messages on top of the network stack but the network stack itself which is the actual packets going back and forth TCP IP UDP whatever can also reveal this meta tag revealed who's talking to who so so for example a signal or with whatsapp or any other centralized service if I'm sending messages up to the signal server and down if I'm an adversary and I'm not very powerful at all well there's some encrypted Internet traffic going on I might able to figure out who it's going to but I am for example a powerful adversary such as anyone like the NSA or anyone who works at the Amazon you can observe the AWS cluster that signals using I get to observe all the uplink traffic and all the downlink traffic and I can observe the size the patrons of the packets being sent up and down and the timing of those patterns the timing and that these this is enough to really de naanum eyes a lot even if the sender and the receiver are not explicitly attached as you know plane tax additional data on top of like an encrypted aad packet so so that's enough by itself even if your packet is somehow perfectly encrypted the metadata is enough to get you in trouble and you know and there's also a lot of operational issues with a centralization so for example if I'm in a place you notice I'm in you know row Java like a meter taki I'm fighting Isis also the internet gets cut which happened when last time Turkey invaded and all of a sudden my six signal stops working I can't I can't send messages because I can't get to that Amazon cluster behind signal so I think what we there's a lot of advances the main thing that I think most people think of and think of Network level anonymity is tor so you say okay well I'm gonna jump into this kind of peer-to-peer network and I'm gonna hop I'm gonna take one hop to someone through the entry node another hop and then exit node I'm exiting out and there's three hops or maybe more if you are so so decide basically enough to mask my IP address and maybe I can even hop to something inside the Tor network like a hidden service and then you know there's all sorts of weird stuff that happens headed services and you know you can have and and that helps it we provide additional amount of money but the problem with tours there's two problems and maybe you can discuss it more if you want one is that so tor even though the relays the things that you bounced your traffic around are effectively a peer-to-peer network the who is in the network at any given time like the PKI you want to call it perhaps that that's controlled by a centralized directory authority system which is basically established by the Tor project and is kind of the Friends of the Tor project Rogers friends effectively so that's a weak point and that weak point was attacked by Lisbon squad I think there a few years ago doing Chaos Computer Congress and take it out at a certain point and this causes problems with routing the second problem which i think is a little bit more fundamental the tour which also affects VPNs is the threat models a little bit weird right so the threat model says well if you have some local adversary you go in this peer-to-peer network maybe you'll come out on another end this is also an issue this is a general assumption of peer-to-peer networks it's kind of a security by obscurity argument you're basically saying if the the peer-to-peer networks big enough the adversary can only observe a small part of it and students like get inside that Network then maybe the adversary can tell I'm coming out but the problem is today with the vast expansions of computing power we have adversaries often can observe the whole network and particularly for high-value networks like crypto currency transactions Bitcoin etherium and I think there's the the alternative design to tor which is what the NIM projects working on which is what we've also been working at in RIA with the panoramix project is that it's called a mixed network and the mixed network as three things not you know different mix networks add to - tor when then packets come in they are because it's a mixed network they're mixed it's not Bitcoin tumbling it's the packets are actually kind of randomly permute 'add and then they're shipped to another mix node and they're randomly permute it again so that helps defeat patterns in the traffic you also can add a delay a timing delay to your mixed network enabled traffic that timing delay breaks these attacks or someone's looking at the you know if I talk if I see a packet the signal and then a few seconds later packet goes down to you if there's a delay there maybe someone else wants a packet another packet comes out it's hard to distinguish what packet I sent so this delay is quite useful the third thing is dummy traffic tort is not that they're considering it but they don't add any kind of cover traffic or fake traffic into the mix and so we've actually just one dummy traffic was originally viewed as too expensive when tor is kind of booting up in the early days of the internet but now the Internet's much more high capacity so mix networking projects like loop picks is probably designed with the most advanced cover traffic work really allow you to really have a third party adversary even as powerful as for example the NSA has complete a complete view of your network the combination of mixing the messages with harmony leis and dummy traffic essentially allow the distribution of traffic between each node to remain more or less constant appearing to the adversary which then gives you a very high level of anonymity much better than torso my personal hope is that some of these concepts even though they're not really pioneered with an appear to peer setting loop except server setting but we can use some of these concepts that been developed a mixed networks and apply them to the peer to peer setting okay I guess now at a point where the introduced what is not working so well the centralized services and then Harry already talked about a lot of the alternatives biased or not what we're looking for as well so now we should probably talk about what are we looking for what are the ideas what do you want to do with mixed networks that up to now have never been used peer to peer context and it's so that now we can use them as real peer-to-peer systems and not as partially centralized systems such as the Tor network do you want to start yeah I'm just like to take a step back a bit again no because I think is in a theorem conference so a lot of you guys are probably familiar with whisper just want to show of hands like how how many people know how whisperer works the way it currently all right a few people just briefly sort of how whisperer works because this is of still the name of this this panel and might provide some kind of contrast to what we're going to talk about next so wisp is broadcast based it's a sub protocol of dev PDP so the way it works is you connect to some you have some boots up nodes and you connected to a random subset of nodes and a way to look at it you can either look at it as kind of like a messaging system where you can look at it as say as a value store at leaves tea with ephemeral values that have some kind of time to live so you essentially you you create a message and you do some proof of work to send it out to network and in each node they relay it to other nodes and then you use also use this topics where is sort of signal what's your incident so here the thing topics I'm interested in and then you can combine this into a bloom filter this is not an essential part of whisper because by default you're sending messages to all the nodes which is not great from a scalability point of view because you're sending a message to some node and another node and then you can get duplicate messages and so on so one way of comedy in this is having these kind of bloom filters where you say these are only men some incident but what that does is it leaks a lot of sort of metadata because you're saying here's two things I'm interested and I guess also the theoretical whisper which is this thing where you have a lot of bandwidth and not not much latency which provides some kind of receive anonymity because you send all this message around and then only the person has the actual a key where it's met your key or or a symmetric karateka topography they can actually decrypt a message so you don't know where message is for but in practice like for example we use mobile devices and and you can't you need to have a pretty tight bloom filter in order not to be overwhelmed by bandwidth users and you can't really relay all the messages just because the network consumption is renders I guess another thing also which is this proof-of-work aspect which is a great construct with something like Bitcoin a theorem or something proof stake is obviously better but with proof of work for this type of thing with heterogeneous devices is not very useful because it's always going to be very very expensive to do it on on a mobile device compared to doing it on a or national regular computer so your phone just heats up and so on so so we need other types of constructs to deal with spam and these types of things that's impersonal aspect which you run into sort of in the real world and going back to how Harry was saying that one way of looking at annuity is you sort of have these different properties you can play with so you have latency and bandwidth and then your anonymity set the number of people using is your system and you can play with these parameters in order to have some some guarantee that this no these two people talking or not that's sort of you you you can't pinpoint that these two people are talking maybe it's like well the out of these million people we know that some people are talking you know you know someone's using system but you don't know that two people wouldn't that are talking that those ties in terms of timing attacks and so on where if you have latency to play with us SAAC as a parameter it means that you can you can sort of disappear in the sea and similar we would when it comes to bandwidth and cover traffic and these types of things that was not your original question but just wanted to provide some bit more grounding on whisper and so on yeah that might be a good point here so the original question was we now established some of the key terms and you just helped establishing some more buy-in and by explaining how exactly this pervert's so we've seen that there are couple of issues posed with the centralized solutions and existing decentralized solutions so let's talk a bit about building blocks that you want to have in your solution and you're working fully anonymous fully decentralized messaging system yeah let me jump in here so we're at validity labs working on an implementation that might serve some or hopefully as much as possible off of these requirements right and we call it hopper and and at hopper we're thinking okay this we heard now is these problems that very nicely described off tour for example right and the other thing is like how many nodes do you actually have there and to to underline this this problem a bit let's do a short experiment I mean where this crypto conference here are there any people in the room that were ever mining any sort of crypto assets okay so I see about like a quarter or third or so and how many of you guys here are running or have ever been running a tor node I see a few hands that's good that's more than I expected why would nobody else if you like run a tor node like you're mining you had like all your your GPUs and all your crazy power consumption I mean you went through quite some trouble for that but why aren't you running tor well why would you right so the thing is there is not much in for that and there's an absolutely nonzero legal risk and if you if you check out tour and and you read what like some some how-to is you you come into this legal explanations that maybe you should proactively like contact your ISP and be nice to them and if you're at university you should also explain it to them which is all fair and square but this is a totally non zero cost right so what we say and I know that there's some people that don't agree with us on that is we say if we want to run truly decentralized networks that can run at global scale for things like WeChat or or you know any sort of messaging mainstream applications we need a very different scale from what we have today where we have a few hundred to a few thousands of these notes and specifically exit nodes and tor so for that we need to incentivize these guys right so if you want to run this thing just like you are incentivized to run a minor you should be incentivized to run a relay node in for example a hopper Network and of course now there's there's a naive implementation right where you can where I can I can just get paid for relaying your messages but the problem is this would totally be anonymized your your messaging layer and you're back to square one so yeah having a payment layer that does not the anonymize your messaging layer is is basically off importance and specifically how we approach that you can find out on Thursday afternoon I have a talk briefly we leveraged payment channels it's a little bit sophisticated payment channels that need cooperation from the next downstream note in order to get my payout so that I cannot just you know not relay your messages but take all your money so that's that's the gist of it I would say so again incentivization for the critical network infrastructure is in our eyes one important aspect that we are trying to implement with hopper and for some other interesting aspects he wants to take over one open question which blood labs working on and you know is how would you pay for these mix nodes or how will you pay for these hopper nodes or these whisper nodes in general I think it's a very important question there's also some basic questions of what does it mean to send a message and what security properties and privacy properties do you want for a message so how many people here have used signal whatsapp I don't know how many people here are signal users okay how many people here have tried to use a signal group okay how many people tried to remove somebody from a signal group okay you can't do it yeah so so there's all the the the interesting thing with a lot of group messaging apps as the question is you know when we first started looking at messaging we we didn't really there was a really sophisticated design for example in PGP for groups I just take a symmetric key maybe III encrypted everyone's public asymmetric key and then I give them a symmetric key and then they can decrypt the message and that's that's amazing and that kind of works for PGP but the fact of the matter is that let's say I send a message to like you know some sketchy person and he takes that symmetric key and then he gives it to his friend all right that gives it to them like sketchy guy from Google and all of a sudden that guy can read all my messages right so one way you and he know it can you read of my messages he can read on my messages into the indefinite future and all my past messages so the main the main thing that kind of signal protocol provided was this sort of double ratchet mechanism which what he says every time we send a message back and forth we're going to give you we're going to kind of generate a new key and we can authenticate and that lets us basically provide so that if the key is intercepted a point you can't read my previous messages and you can't read my future messages but the problem with the signal protocol is that it's not clear how to scale that to large groups that's why it's very easy to people post people for large groups use telegram or something they don't use signal and the reason is because signal really is designed is a one-to-one protocol you know I'm sinking message to him he's singing messages to me kind of based off of off-the-record messaging and in the sort of generic way and when you start scaling then I basically have a message I want to send to you then if I want to send it to a group the group it currently signal I either just I do another ratchet with you and maybe a third ratchet with you but the problem with that way of sending messages is what if I send one message to you and we're in a group together all four of us but then I encrypt a different message and send it to him right and he can't tell right that's pretty bad so we want to prevent that any kind of future messaging design also it seems to be pretty inefficient that I'm Rhian crypting the same message in doing this ratchet game with all these different people over and over again that's not very efficient so there's new work at the internet Engineering Task Force on a new protocol called message layer security which basically even though it's not a blockchain protocol basically uses a Merkel tree in order to say well the group a group is not defined by people who ratchet messages to each other but it's defined by access to a common group secret so I sinned I have a great access to group secret that proves I'm in the group and then when I send the message it's broadcast to everyone in the same group and that group is defined by access to the group secret and then you use a Merkel tree so we're all leaves of a big Merkel tree and there's some top node up there and every time I send a message that ratchets up to the top node that top node since the message down to everyone and then we ratchet that group secret so the group secret changes every message so we get the nice properties that signal doesn't provide which is it's scalable we think it scales at least they're like fifty thousand nodes pretty easily and it keeps the group has some level of authenticity but what we've sort of left out of this design which something a lot of people want is this other concept which maybe I'll let someone else explain called deniability I don't know if you want to go into deniability systems when a message was being passed along note the the note that is receiving a message would not know that the previous sender was the original center of the of the message or just an intermediate node and that would give some sort of deniability so if if I'm sending a message and the next Center cannot know whether it was me who said who origin who who sent them there is no way to prove that I was the original sender or I was just someone who is passing it along I have some sort of deniability it's a very weak sort of privacy because of course if this is occurring a lot of time so if every time that Bob is communicating a message I am one of the and intermediaries if there is a probability that I was the sender but it gives some sort of a weak privacy preserving property but it's not considered a strong property generally but that was one of the very early ways to provide some sort of privacy preserving communication in peer-to-peer settings essentially the my ability is great if you're in a court scenario and someone has to prove that you have on Santa mask that sent a message Danny well then deniability will get you out if you're in an oppressive regime and nobody cares if there is any decent quartz a tray you know if the pure suspicion that you did something can get you into trouble deniability we're not solve safe use so this is very want anonymity to summarize that and also you know it's if we really want anonymity plus decentralization like these designs like the signal design and the message layer security design and even the mix that design we don't have fully decentralized working versions of any of them and so there's all sorts of problems well I'm trying to make a group with these three people here but let's say Oscar disappears for a while which happens not only you know happens to nodes all the time in peer-to-peer systems what happens to that group secret we keep updating it and how do we fix it when Oscar reappears and these were two questions these are questions of concurrency and decentralization our questions that really need a lot more work in order to get all these properties so you want to be encrypted you want to be anonymous but you also really want to be kind of reliable you don't want messages to just sort of disappear into the either every time you send them yes it is a really important point when it comes to peer-to-peer systems and messaging specifically is the fact that we don't have the same availability assumptions like if you have some centralized missing service you can you can figure out you can have a server you have some kind of load balancing you can get nine sigma reliability whatever like that's it's kind of it's the salt problem but this becomes much more hairier when we're talking about Peter by missing and you'd probably it's probably too expensive to stick all the messages on some blockchain whatever or yours available so how do you sort of solve this problem so there's a few ways one one thing we started exploring at statuses similar to how you build TCP on top of IP to get rid of reliability semantics you can do something similar with data synchronization and idea there is that you have a bunch of nodes and they have sort of their own view of the world they have sort of a log after off after messages and then you append to your local log and then you you sort of sync up with other nodes is some group context so this would be for example at the nodes between some group or might also be some help notes of stay online because another problem is that if you're on a mobile device you're most you're flying rights if you talk to someone and and you both offline and how do you actually get misses to the other node in this different ways of sort of dealing with that but a bit idea with with data synchronization is that you get some form of reliability semantics and you get some assurances that the other person actually gets the message even though they might they might be delayed so it's some kind of like you offer some message and then you have acknowledgments and retransmissions and these types of things and when it comes to these this thing about sort of how we deal with key rotation it's kind of a subtle matter and it's an app called prior and have a bramble protocol and what they do is that you sort me go sheet in advance what your assumptions are in terms of when you come online so maybe maybe you are saw in the jungle somewhere and you don't even use the internet to sync up your using the sneaky net in cube or whatever you can still have a protocol that deals with these types of situations where you sort of say well you have forward secrecy but you have some ratchet so it's you do key rotation every few weeks or whatever so it's possible to think about these things but you need to suffer for it in their protocol design have sane defaults and maybe some negotiation mechanism one aspect of a newer mixed net design called lieu picks that NIMH project and folks of interacts have implemented is that historically we actually had mixed networks a little bit like late 90s and there like the cyberpunk mailing lists sort of there's this problem of people kept you know one innocent anonymous messages and the promising anonymous message is that why it was like why didn't these really take off why dat or take off and makes networks then it and the reason in the 90s one reason didn't take off is you know you wants an anonymous message but you never know if that message got received you kind of send the message into a black box it would hang out for a few hours a few days you never know if the guy ain't got it right so that's the problem of a very simple problem that you have an anonymous messaging is you might want just like you have a tcp/ip and most other thing some sort of receipt then the message got delivered so the main I guess new developed makes networking are one of the more interesting ones our last few years has been this concept of the loop-the-loop and lupus which basically you send an anonymous message through the network it drops off and then it kind of loops back because the loopback is also covered by the anonymous network that loop back is anonymized but doesn't need to be anonymized the person that sent the original packet so they basically even though the receiver gets an anonymized packet a third party can't really tell who sent the packet because there's a bunch of packets and dummy traffic going around I can tell if my packet god delivered so these sort of reliability notions end up being they're not abstract they're actually what kills or doesn't kill someone like incentive structures a protocol in terms of real world usage yeah before getting more into incentives I would like to mention some things that we had talked about here but which which might not not have been so clear that we have this fundamental trade-off right so if we design any sort of messaging applications and I think for an application developers like running here it's important to be aware of that that we have this fundamental trade-off of throughput and privacy right so if you want messages to get super fast to some party you will not have very high privacy if you want super large packages of data to get relatively quickly to some party you will also not have really good privacy right so you will get privacy if you're willing to accept some sort of latency and if you're willing to accept some sort of you know overhead traffic so let's say if I'm willing to to accept like a few seconds of latency and and that there's there's a bunch of traffic that somebody sends around that that is fine right that that is covering me so so always like whatever we built we have to be aware of that what we're what we're really aiming aiming for and ideally coming back also to what sort of properties we would be aiming for this should ideally be configurable right so you should be able to say you know what sort of for example for an application like status well it might be I don't know if we have a chat between Oscar myself caring back-and-forth is not acceptable to like five minute delays right but maybe for other applications or industrial use cases it's totally okay to have five minutes like when we sign some important deal between between both of us it just doesn't matter because how would we do today we would send a letter and it will take a few days and we're just fine with that so that's that's a trade-off that I think we could live with and it's that's important to generally be well so the party who's deciding on the trade of application developer right I mean ideally it should be configurable at run time that we have basically settings that we can say yeah what am I willing to do right so ideally this should be configurable either at at run time or at by by the application developer yeah another thing I think so in terms of providing a privacy by default the way we look at it status we're trying to create sort of like on the order of seconds to actually have usable instant messaging to two points one is one thing that's different sort of about mixed networks now versus a couple decades ago it's I think this this realization is development that bandwidth is not cheaper so used to be the case that you sent it to some some mails or whatever and then you had to wait six hours to actually get it there but with sort of faster internet and so on people are sort of using this this bandwidth parameters were tweaking it and having cava traffic and so on which is what has brought the latency way down and where it's actually more competitive with something like tours it you can actually get reasonable anonymity or privacy or on the order of seconds another aspect in terms of this this tunability is that if you have privacy by default so for example in in the in the status app the way we have certain limitations in terms of packet size and so on but you can still do interesting things for that so we have an extensions component where if you want to send images you essentially send like like a hash to I professors form whatever and this can be sort of an opt-in mechanism where you can get these sort of more user-friendly stuff but it's sort of private private but if and then if you want bells and whistles you can add on top of it and the same thing if you wanna have real-time communication or anything like this it's something you opt into and having it be private by default this is very important because it's sort of you're helping other people by by sort of being part of its unlimited Etsy and this is also where you civility comes in and it kind of becomes tricky with certain trade-offs because you wanna have maximum security maximum privacy and so on but you also want to have good usability because if you don't you don't actually have many people using this protocol and that means that the enemies have is reduced so that's another sort of very important thing to think about I mean I think the way to think about it is your Anatomy says the amount of possible people that this could be you know sending this message or receiving this message and you want that to be as large as possible so you want as many different people if you if I make it a perfectly cryptographically deniable like really great cover traffic mixed network system that's you know whispers 3.0 but it's just like I'm sending messages to Sebastian it's kind of pointless right cuz everyone knows that it's me and Sebastian talking even though everything in the middle is like this weird black box so you really one thing you you really wanted you want is many people using the system as possible in anonymity basically is built on company and wants more people using it and I think the interesting question for Whisperer is how you know there's different constraints important traffic can be kind of slow maybe other traffic needs to be faster like instant messaging traffic cryptocurrency traffic's over separate class can we get all these different classes of traffic running through the same kind of decentralized peer-to-peer anonymous routing infrastructure that's a really interesting question what trade-offs is that even possible what trade-offs are there and and is that possible that's why ultimately something like whisper has to be a sort of common infrastructure between not just status not just an improv not jess validity but ideally is a common for structure shared between many many different projects and everyone it's not a zero-sum game everyone wins and the great thing about it is the more people that use an anonymous overlay Network the less fake traffic you have to have if you have tons of real traffic coming in if you're just hammering that network with new real traffic then you don't need to generate so much a dummy traffic you don't need to generate so many so much fake traffic so it's kind of it's actually it's a little bit a win win there if we can get more people using the infrastructure if it cannot tell the different applications apart based on the traffic fingerprint I mean that's there's there's some work that has been done there so for implementation we use this Sphinx package format for example which tries to to address some of this right so that like a simple example would be I think we discussed this before the message size right so if all of you are sending etherium messages just like some normally theorem transactions around which are a few hundred byte in size and then parent myself are sending each other in multi counts right like three character things plus a header it's pretty trivial to identify ourselves but yeah if you if you basically have a package format that protects kind of the size of the message as well as the header then you can you can solve a lot of a lot of these issues around any sort of metadata that is associated to the package itself just briefly talk about the secure messaging more broadly as well like you can look at privacy as a security feature but you can also kind of look at something like censorship resistance as a security feature and this is maybe a bit below it's more under sort of network PGP layer but something which taught us very well is they have sort of discount pluggable transport which means that even instead of more lockdown countries or Internet infrastructure so you can just of communicate even and guard against deep packet inspection as well so if you can provide that kind of thing that means that you can't actually censor communication which i think is kind of one another aspect of secure communication as well so pluggable transports do is it sort of says you know you may actually be using this cool whisper protocol but we're gonna make that traffic look like HTTP s traffic over TLS 1.2 so we can't distinguish it and that's that's that's really useful I do want to point out that that whisper ends up being incredibly important and mixed networks in general because effectively there's been tons of work on zero knowledge proof sets etc on the chain but you know in the in the in the threat model for all this is that quite sensibly everyone gets a copy of this friggin chain and so that any like halfway decent chain analytics company can just like walk through the the currency trancey transactions but I mean what we do know from the Snowden revelations everything else is that in it's been many years so this capability is becoming increasingly easy to access is that actually just capturing all the traffic in and out of a server such as capturing all the traffic in and out of a signal server capturing all the traffic that - for example - Bitcoin seeding nodes or whatever this is all really really possible nowadays by by my adversaries so even though there's not like a record of all the peer-to-peer traffic that gets sent through someone could be making that record in fact someone probably is making that work record so you need this level zero networking protection provided by a new version of whisper based on mix Nets or effectively doesn't really matter if you're using something like Z cache or theorem has these cool zk snarks because the fact of the matter is you've just the anonymize yourself by sending a peer-to-peer broadcast yeah I think any theorem context of things this is really important really I mean we're talking about wall that I see two discussions right which we which we had and which start being solved in a theorem ecosystem right now and the first one is that okay we we should have some sort of privacy on on chained we've seen the first implementations of privacy preserving tokens recently which I found really cool and the second thing is we also realized it's not such a cool idea if everybody just uses aetherium through meta masks which connects to the default in foreign right and and people have have acknowledged that and some people are working on on having more distributed notes out there but we need to have we need to have at the core level the ability to well shield yourself from some adversary that observes and says hey we have this person that is again interfacing some other a theorem note and we see a certain size of a transaction going out and therefore it is quite likely that you were probably playing crypto kiddies right now right and if cryptic it is a censored in some place you will probably run into some real world issues so I mean this this sort of base level security for any sort of applications even if we have all these fancy crypto stuff on top I think it's really important to to get in there okay I think Oscar wants to make one last point and then maybe you're going to ask some questions yes I think the answers of protocol and specification or fit and so on it's really important to look at the whole picture so when it comes to real humans and as of the privacy entities they get so I'll give a few examples so one is in the stash of example we're sort of using whisper and it's sort of a nice e-marketing claim to make that our whispers is talk and provide privacy and so on but it's a bit dishonest because it doesn't take into account extra reality and how people use use death and so on so for example in order to get offline messages you actually need to have a direct TCP connection with a so called mail server which sort of replays messages for you and there's lots of other examples like that for example most of us probably look at ffs can write and and if you do that and you're tying your IP to transactions and this is something that I think Peter at the foundation has been talking about and there's lots of these types of things when you're just bringing up out your phone out of your pocket you actually leak it off metadata so there's all of work that goes on that that has to be done in terms of being rigorous about what what guarantees we provide that aren't just on sort of the protocol specification level but also in terms of real world usage and when it comes to things like light notes and these types of things lots of people use meta masks and infer NFS scan and so on we actually have a fun experiment it's called chaos unicorn day we're dead here set we're gonna shut down access to all sort of manual mill attacks centralized services for one day and see how things works that means in Ferrara or cluster which means that if our boot nodes will disappear every scan and all this kind of web 2.0 sensor services and that's gonna be April to first so if anyone but any teams out here who actually believe in this and rotation and want to build better systems feel free to reach out to me and you can participate and sort of see what breaks and actually make this thing reality and not just on paper okay so up to now we learned there's some really cool ideas out there for anonymous decentralized messaging and we can use systems like mixed nuts that have been around for a long time and are very searching is you know decentralized we do no longer want to cheat for surfing centralized services and being a highly dynamic environment where people disappear and might appear again which poses a couple of challenges that all of these people going to serve in the next couple of months and here so if you have any questions remarks anything you want to do now it's the time to speak up so any questions yes I wasn't quite clear if there is actually a coordinated whisper 2.0 or whatever ABC XYZ project between all of you folks or if it's actually individual yes so I think it's a misnomer to call whatever this effort is whisper 2.

0 so there's a sort of separate whisper specification effort that's ongoing because they're sort of incompatibilities between clients and so on and so it needs proper specs that's one thing which is in terms of improving whisperers stamps and then I think a lot of teams sort of just organically like we had Webb free foundation status and ability labs like we were in all looking at this problem and coming to the general conclusion that some extent based approach would probably be the best in terms of privacy guarantees and scalability because of the recent things have happened Nicodemus on and then various products were stuff in different stages so we're free foundation had a bunch of research that have been looking into for a long time but it labs already had of implementation and from sales point of view which just starting to look into these things and now it's kind of summed like a collaborative effort where we had their workshop in Brussels a month ago and we also have a public trial channel that you can draw in if you enter get up real good what was that workshop called or and what does the riot channel called for examples is there a name search for web free messaging you'll find a blog post on your web - Asian or status and then it's github w3f slash messaging and then the right channel something similar and we're looking for more teams to join because this is an important part of instructure and it's not just for a theorem and it's not just for web free it's any any people who believe in sort of this peer-to-peer decentralized privacy space right so we would want to make it as sort of accommodating as possible I mean before I sold my soul to the blockchain I used to work at a standards body the world of Web Consortium and that work still Cocina work at the IETF ordering about messaging work so I mean our interest is that eventually maybe we don't call whisper maybe call something else I don't really care but I would really like to see a unified spec or set of specifications with very clear and topper ability around this work and maybe some areas are more experimental you know in some areas are less experimental but we should be able I think with the next year or so to standardize a core functionality because I think we kind of agree on the general design but you know devil is always in the details thank you that ounces oh the asticus um I've thought a lot about the deniability problem in the past and this is my take on it if you really want both yeah I'm disappointed you haven't even heard the question yet if you really want bulletproof deniability like you basically have to send every possible message so if we're communicating in one bit messages I have to send you both one which is correctly signed and zero which is incorrectly signed and then the problem with this obviously is that the message size grows exponentially but for short messages and with compression you may be able to handle that it seems there's a paper Ron Rivest paper from LinkedIn 1980s where he talks about winnowing and chafing it's a very short paper he's trying to solve a different problem but he fundamentally comes to the same same conclusion anyway I just curious I mean do you think something that extreme is like realistic for short text messages or is it is that hopeless you talk about like the sin to send everyone everyone said everyone everyone's message basically so to everybody everyone's message that model well it doesn't have to be everybody it's just if you and I want to communicate in an in a deniable way and let's say we're communicating with 8-bit messages that's that's 2 to the 8th was like 256 I need to send all 256 possible messages - yeah so I mean I think I mean you know you could do that right I think a lot of the research area of all the area we're trying to do is trying to make things really efficient and a lot of my ability that like people want out of what we're doing is cryptographic deny abilities they also sort of say well how do I you know how do I make sure that you know this sort of signature can't be linked to me and so there's a little bit of a I think I think there's there's like a lot of the problems with my ability this is worked I think Nick Unger and other people I'm looking at is the approach it it's a little cryptographic deniability little bit different than like sort of like this sort of overarching holistic concept deniability or for any men who did this message really come from and connecting these is also pretty tricky as well ITF we viewed it as out of scope but we're interested in it how do you want to talk briefly about this paper that you get wrote about they're sort of high risk users there's just there's this paper we wrote at an RIA where we actually there's network love deniability but there's also deniability between users and saying well you know so the classic example is off-the-record messaging it's deniable and cryptographically and that's great and it's it's a good protocol it's a bit gaining its age but it's it's it still maintains the security properties but the fact that matter is what we discovered we did ninety interviews but most of the people who are what we called hires to users people in Russia Syria Ukraine but also pretty well-known people like Chelsea Manning right so Chelsea Manning used OTR to communicate to Adrian Lama back oh by the way I happen to leak this stuff and then you know when it actually got the court you know the the fact that oh you're used you are how do you really prove it's Chelsea Manning well that didn't really hold up in court so I think my general take on deniability is that probably is more less of a cryptographic problem it more like a kind of network level problem if you want to have that property so yeah I was had a question regarding this the storage requirements when sending messages to peers that might be offline in the network so I was wondering because we briefly touched on this like when you discuss about sneakernet sneaking ads and when he discussed about you know this protocol about negotiating a availability upfront and and so on and have it percolate down to to the way to the protocol itself how are you thinking about what appear is down when a peer is offline how do we store that message where do we store it what happens can we negotiate a front if like a period in which that message is going to be stored and as well can we aggregate messages so that you know once the peer is down for a long time we compile those messages and just send them as one you know these patterns that emerge as well you know an enterprise settings so there are a number of enterprise systems Kafka and so on that you know have been dealing with similar requirements and yeah it's a good question I think it's it's there's several parts so one level is sort of I think it's probably best to think of the mix of designers kind of stateless so it might sort of store ephemeral messages in some in order to have cover traffic and so on but I think in terms of accounting for resources your one on the one hand you have so if you have to pay for relaying and so on and then paying for offline stores and so on and if you have a data synchronization layer on top then it's actually denotes themselves they store it and then you might want to have some sort of helper nodes that also help store it and they they can get paid for it but that's kind of like a separate payment mechanism and then essentially within some sync group you you have this messages and then you can construct a dag and maybe some kind of rolling buffer where you request all the messages and essentially with the tag like you have message dependencies so if in a group chat you have pointers to the previous messages and so on but but in terms of precise storage requirements I think that depends on the group context and also if you have very large groups and then the tag can grow big this is matrix experience because they have a similar approach and I think that's an open open question let me just quickly add to that initially I would say okay that's actually living on a separate layer from the communication protocol it's just a separate protocol or application but then again if one once we started bringing in incentives it was actually well I have an incentive to relay a message to you if I make money on that I have an incentive to to hope that you come back online right so thereby you basically I am basically now incentivized to store to some extent well how long well it's it's kind of a supply and demand question how much does it cost me to store versus like how much a year am I going to be paid for you being online so that's some of the interesting aspects that you do gain by having an incentive layer in it that does require the receiving party to actually receive and confirm the reception of some package yeah it's just sealing this microphone oh that's good I guess we're running out of time so I did not ask you guys before if you have prepared closing statements does anyone want to make a closing statement that sort of rounds up the panel I mean I think this is very important infrastructure and one thing I've noticed is that lots of different projects and they're still trying to create the own solution and everyone has their own sort of perfect study of how things should work as well I think it's really important that we collaborate on this because it's a critical piece of infrastructure and and if people are using the same network that's better for a nimitta set it's better for Novas specification and the chance to actually create something that will live on beyond us and beyond any company beyond any specific contributors or service or whatever so if you're in SUNY space please come in and join us and collaborate in this effort and like it's very early days and there's lots of things to work on and it's yeah I really encourage people to yeah coming to Conor with us and sort of make this finger reality and let's build an opus position together if you're interested in helping the NIM project we will probably be hiring fairly soon we already have a dev team but we're looking to expand so if any developers are really excited by mixed networking we would like for people to get it get in touch and I think that it's probably the most exciting project in my opinion in the entire space because to be honest very you know very few people are really looking at level zero networking protection and everything else is built on top of it so if we don't get it right we don't improve it all the higher level infrastructure which everyone seems to be more excited by all these daps and whatnot will also be screwed in the long run yeah let me add that's we will have a talk on Thursday at 12:15 in this room so Thursday 12:15 shameless black here to talk about these specific properties implementations and if Robert needs a little bit less sleep then we will also have a demo so to show how decentralized anonymous privacy preserving and incentivized messaging could actually work in practice so I hope you've gotten a good overview and what is going on with regard to this burnt anonymous messaging and you heard all the advertisements about people looking for new people to work for us about talks that will go into details on some of them existing constructions and with this we are going to give over to the next talk which I have no clue but it is about so I can't announce it okay thank you guys