Vitalik Buterin at ETHWaterloo: Blockchains and Privacy through Strong Cryptography

[Applause] okay um so first of all I mean thank you all for coming it's good to be back in Waterloo I hope that people will find in this presentation at least somewhat interesting and informative because it is about a topic that people do do often talk about quite a lot kind of in passing but you know there doesent tends to be as much of an people talking about you know what what does privacy Jana Block she and actually mean in a much more detail so that basically is the thing that I wanted to try to get into a bit today so first of all what are block chains good at right so block chains are good at several things so first of all block chains are good at ensuring this that the state of some application so the kind of the current state of some application that the block chain is trying to interpret is valid so what that means is that there are good at ensuring that whatever the current state is it got to what it is to brew some process that follows the rules so one simple example what the application could be a currency and valid could mean well it got there through a series of valid transactions and so you know if right now I have 200 bitcoins it means that someone actually sent 200 bitcoins to me it's not the case that they just kind of popped in there somewhere out of thin air so the system got to where it is in a way that follows the rules they are good at ensuring a transparency of process which means that we can know how it got there not only do you know that the current state is the result of following the rules you can actually know things about the transactions that got you there so not only do you know that one particular account has some number of coins you know when I got them you know what transactions I achieved that results now as we're going to just discover over the course of this talk there are ways to have transparency of process which is not absolute but it's still a very desirable goal in many contexts and also irreversibility so if some change to the application state happens if for example I get fifty more coins and I go up from having two hundred bitcoins to 250 then you know that's an operation that happens once and it stays as an operation that has happens history does not revert itself now block chains are less good at currently two kinds of things one of them is scalability and so you know block chains currently processed somewhere around three or six transactions a second lots of other applications process anywhere between ten and a hundred thousand and there are less good at privacy so for today let's focus on privacy so a block chain is a fully public ledger anyone can see all transactions that are published to it this over here is a screenshot of a site called ether cio which basically runs a node that contains a full copy of the etherium blockchain and everything that's happened in the etherium network and shows it in a way that's nice and pretty and somewhat easier to intercept for people to understand so this over here is a transaction that goes from an account I can control by the foundation this is basically transferring a thousand either from a cold wall into a hot wallet so anyone can see every single transaction that happens people can look up what the effects of the transaction were on ether skin when it happened we our money was moved from what address it was moved to to what address it was moves to so this kind of transparency is often good and it's good for several reasons so first of all there is the instrumental reason which is that it helps guarantee integrity of process so the fact that everyone can see and verify any transaction on the blockchain means that you have got a virtual army of 25,000 people or I guess more precisely 25,000 computer on the internet who are actually running software and making sure that the blockchain as it is right now actually did get get to where it is through a series of transactions that all follow the rules and also very often transparency of specific parts of the process or certain outputs of process execution is highly desired so a few examples voting so people wants to be able to see in an in a voting system that their vote was counted and they want to be able to see that the total was computed correctly charitable organizations if you have a charitable organization you might wants to actually just make your finances fully open because this way you you know you don't really have that much to hide and you're convincing people that your organization is running things anyway which is fully honest and reliable supply chain tracking you know we're did Product X come from you might have some series of links each of these links are represented on the blockchain and you might want to be able to trace back any single product through the blockchain if you have some kind of identifier that identifies all we see in the specific product government finance so this is an actual use case I've talked to at least three governments about basically this has just use a state issued cryptocurrency that could be run on you know some kind of blockchain like system that would be used internally basically between tax collection and corruption yay so one signaling theory fact when someone says at least three they usually mean three so what's not great about transparency if you know someone's address you can pretty much track how they spend their money now over here I could have put up some clever it's a clever screenshot that basically shows of what my addresses are but that would have unfortunately been a somewhat expensive demonstration so it was my own privacy but if I mean if you can look things up on the Internet to if you know someone's address and you know who they send money to you now know someone else address so if I know Alice's address and I already separately know that Alice sends transactions to Bob I now also know Bob's address and you know if you then now that you know Bob's address you can look up how Bob spends his money and if you already know that Bob I know with some schedule since some transactions to Charlie then you can link those transactions up to transactions on the blockchain and now you know which address Charlie corresponds to so basically privacy leaks often ends up being contagious also same for non-financial applications so the same sort of thing applies to just any kind of applications that use information - or they use the blockchain to record information that has to do with relationships or information that has to do with any kind of sequential or repeated behavior so what can we do about this basically nothing go home now we could do a lot of things so this is a very nice and a pretty website you know you see it looks really nice they probably probably stole a couple of fonts to make it look like something made by Google this is um something called a mixer and the idea basically is it's a system where you send bitcoins to the mixer and the mixer sends bitcoins to other addresses and basically these are also other addresses that are controlled by you but the idea is of the system does not leave any kind of open link between the address that your bitcoins came from and the addresses that the service is sending the bitcoins to so this is a diagram this is a fairly low tech solution you have a bunch of people on the left they send coins and this could be implemented in basically any blockchain into and the reason why there is a happy face in the middle there is that the thing in the middle is basically just a guy like everyone else and so there's a guy in the middle that operates the system everyone sends some coins to a guy and the guy sends some coins out to some new addresses and there is obviously going to be some kind of one-to-one mapping between the happy faces on the left and the happy is on the right but this mapping is not public it is known only to the mixer in the middle and therefore you know if you trust a mixer then this gives you privacy if you do not trust a mixer then you can go basically repeat the process five times and as long as one of the 5-prime mixer is a one that's trustworthy then you know you've achieved the privacy game so security properties strong privacy if you trust Bob over here in the middle you keep your money if you trust Bob over here in the middle requires ongoing use to maintain privacy so mixing is something that you just have to keep on doing if you wants to make sure that your transactions cannot be easily linked to your other transactions now this is one category of solution and I will point out that it's a category of solution that can be easily expanded to applications other than cryptocurrency and that's something that I will go into later we can also talk about other solutions the general category of interactive security based applications and there are many different kinds of constructions in here including state channels including plasma including you know write and according just a whole bunch of things that work in somewhat similar ways the general principle here is don't use the block change for every transaction so instead of using the blockchain for every transaction directly you can conduct activity on some kind of off chain layer but the off channel layer is specifically designed in such a way that if the parties in some particular interaction on the option layer disagree so if there's a dispute then you can just push everything onto the chain and everything just gets worse actually gets adjudicated and resolved on the chain so you're kind of using the blockchain as a court the reason why quartz provides security is not because they adjudicate every single transaction but because number one they adjudicate the transactions that do end up going through them and number two the threat of a transaction going to court basically means that people have much less incentive to try to cheat in the normal so basically because the unchain resolution makes triggering a dispute expensive it's usually you never need to use it at all except you need you do need to use the chain to enter or exit a system this was originally conceived first and foremost as a scalability technology so basically because every one of these transactions is happening off chain it is it is a transaction that does not have to contribute toward the currently fairly low transaction limit of existing block chains but it has other benefits like privacy so basically in any if you look at an estate channel for example so this is an interactive system that operates between two parties in the simplest case then if these two parties have 500 interactions between each other inside the channel these interactions are all fully private because they're in fully private in the sense that the only two people that know about those interactions are just those two participants now the entry into the channel is still on the blockchain it's still public the exit is still public but everything in the middle is private so this is one kind of technology that will achieve some benefits and now you know there are many different people working on various kinds of this one thing that people often talk about in the context of privacy is this idea of private chains the general idea of a private chain basically is hey let's have a blockchain but instead of having a blockchain where everybody gets to be a noted everyone gets to download and verify the data let's have a blockchain where only a few people gets to download and verify the data and these few people are like big and big institutions like the banks which are obviously reputable they're never going to cheat you and so you know you get a scalability gain and you suppose we get a privacy again now private chains tends to usually be split into two categories the first category is consortium chains so basically just take ten banks and put them on the same chain in the second is fully private chains that are controlled by one entity so the further the former I really should not be viewed as giving you privacy because it's like okay so instead of putting your data on to a platform where everyone can see it you're putting your data yours your data and your customers data onto a platform where only your 10 biggest and closest competitors can see it you're supposed to laugh so in the latter by default it's basically just a centralized server right so there are systems where you create a kind of consortium chain like architecture where you go down to 10 to 50 notes but the in transactions are encrypted and for each individual transaction only a few people see a decryption key now if you do this wrong then you're basically completely sacrificing guarantees of process integrity because basically you might have situations where any particular process could be affected by some encrypted transaction that happened somewhere else and this transaction is one that you don't have the key for and later on it turns out that you know basically everyone accepted this transaction but this transaction just does something that completely mismatches with something that happened by some other transaction that happened to be encrypted under a different key if you do this right and you can't do this right then this is basically a state channel or Plasma like system so there are architectures that use the sort of stuff that do make some sense but you do have to think somewhat carefully about how you use these kinds of architectures and like quite often a lot of this actually it actually does end up being possible on a Pablo chain as well right so basically my general advice is treat multi-party party lodgers and basically as if they are public and build applications that use these systems in ways where you can make sure that the private data doesn't get on the ledger or at least guess only gets on the ledger in an encrypted form in the first place now in the challenges how do you do this while achieving guarantees of integrity of process at the same time so how do you encrypt data in yet at the same time prove that your basically your encrypted data satisfy some set of rules with normal kinds of encryption this is not supposed to be even possible because encryption is supposed to output things that look like random but as we'll see there is advanced forms of cryptography that actually can do some interesting things so let's start with the ring signatures so the original motivating use case for ring signature is this story suppose you have a diplomat who wants to leak a trade agreement in the diplomat wants to prove his status so he wants to prove but he actually is a high-ranking diplomat that actually has access to the real trade agreement in order to show that the leak is credible but the diplomat does not wants to reveal his identity because you know he likes his wife and he does not want to go hide go hiding out in Moscow for the rest of his life so the diplomat creates a cryptographic signature that proves that he is one of some set of people but reveals zero information about which one of that set of people he is it turns out that it's possible to use fancy math to actually do this now here's the fancy math as you can see a ring signature actually looks like a ring you know it takes all the public keys and and okay you know in the darkness pine stone blah blah blah like if he wants to get any kind of to sentence description of how this mathematically works the basic idea is you can think about you can think of it as actually being a literal ring in the sense that you start with a number then for every participant in the ring so for every public key so so for every individual that could be the the signer basically you hash the number but you don't use the regular hash function you use a special kind of hash function where if you have the private key then you can compute it backwards but if you only have the public heath and you can only compute it forwards and what a rigged signature looks like is it looks like a series of numbers where you start with some number then you have should you get the next number then you have sure you get the next number you hash it in hash it again and after you hashed the hash at the last time then suddenly you realize that you just get your original number back and now normally this is not supposed to be possible unless in at least one of these of these places you're capable of actually of reversing the hash and calculating it backwards so basically unless you have the trapdoor and at least in at least one place you cannot make this kind of ring if you do have the trapdoor in one place and it doesn't matter what place then you can't make the ring so but the ring itself reveals nothing about which one of the trapdoors you have so this is the basic principle about about a ring signature and if you wants to learn more feel free to look up the word ring signature on Google there's lots of very good math there there is something called a linkable ring signature as well now the way you can think about a way or linkable rigged signature as being a kind of specialized to ring signature that leaves when you can think of as being a cryptographic trace of which member of the ring signed it now the cryptographic trace in itself is not useful for determining who which new member of the ring actually signed it because if it was then it would lose the purpose of the purpose of being a ring signature now what is the trace useful for well two signatures from the same person are going to have the same trace and that can be detected so you can't so the trace is not useful for figuring out who signed the ring signature but it is useful for identifying pairs of rank signatures where the same key was used to sign both of them now what does this give you well what's first of all look at this in the context of a voting scheme so in the context of a voting scheme you have some set of people and you can think of each of these people as being represented by a key you want each of these people to be able to vote but you only want each of these people to be able to vote once and you want each of these people to be able to vote privately so well what kind of cryptography makes sense for a vote well we can try ring signature now how do we prevent people from voting twice and how do we prevent for voting twice without compromising any privacy well linkable ring the signature is basically provide exactly the right properties another obvious use case better mixers so basically you can see that here we can replace Bob with cryptographic magic now maybe there is going to be some politicians complaining about Bob's unemployment's but oh well you know I'm sure Bob can find other work to do because the crypto space is booming so basically you have crypto met cryptographic magic here and cryptographic magic does basically the exact same thing that Bob did before except a cryptographic magic just is rings ring signatures and anyone beat anyone can trust the result and you know basically number one you do not need to trust Bob to keep your money and number two you do not use your trust Bob to keep your privacy so this is an improvement but there is other interesting use cases of the blockchain as well so here's one interesting one identity Oracle's so person P so we'll say person Paul proves to entity X so we'll say xylophone that they are a unique human so that he might be a citizen or non citizen of country Zimbabwe and into the xylophone adds Paul through an on chain whitelist what is the purpose of the whitelist well the whitelist is a kind of generic public utility that can then get used by blockchain applications and smart contracts that require this notion of identity verification so if you have an application that has some need to either only accept let's say one accounts from each individual human so not allow people to create 10,000 accounts or let's say you want to accept people only from some countries not accept people from some countries well you can use this whitelist and it's something that's on the blockchain it can be publicly queried and it gives you the information that you need use cases so regulatory compliance so if you have some applications then you can base you can do things like excluding individuals from specific countries so for example let's seems to be popular to exclude exclude US citizens for a lot of applications and you might some sometimes you might want to exclude North Koreans as well there's a bunch of lists it's complicated you might also want to limit the dollar amount per person so for example one way in which you might avoid hitting some regulatory thresholds is by creating an application where you might only allow each person to process what's say 999 dollars worth of some currency that you're creating and a lot of countries have various laws in various contexts that say that if you fall under those thresholds then you know you don't need to collect certain kinds of kyc information or worry about certain like a certain things but if you go above the thresholds than you do and basically like with this kind of technology you might be able to like through an application might be able to prove that it complies with these kinds of rules without revealing extra information about actually which individuals participated in in the system civil resistance so make online polls more secure including very highly informal polls like the equivalent of Twitter updates oh sorry Twitter upvotes all right sorry up votes are on reddit twitter has likes and retweets I forget so basically you know you can make create systems where you have one person one account but at the same time people cannot be unique people individual people cannot be linked to the individual accounts that they're that they're using there's also a system so I quadratic voting there's many different kinds of game theoretic mechanisms and a lot of them actually do require this notion of civil resistance in order to achieve their security so you know there are a bunch of use cases for the sort of thing so the question is basically you know how do we achieve this in a way that also preserves privacy so Paul proves to xylophone that they are a unique human you know might have a video called he might show a passport they might do a bunch of things you know as ila phone might run some run some machine learning algorithms they prove that they're a human they might prove that they're a citizen of Zimbabwe but they're not a citizen ever see MBA and so then into the xylophone adds Paul to an Unchained whitelist and we'll call this white list let's say Willie Paul publishes a ring signature that proves membership in Willie so Paul proves that he his public key is part of Willie without revealing which member of Willie he is proving himself to be at this particular point in time Willie is actually represented by an on chain smart contract and the smart contract verifies that the signature is correct and it verifies that the cryptographic trace does not match any other cryptographic trace that has already been used and if it appear finds a signature then it admits some other accounts that Paul specifies to another unchain whitelist so we'll have a second on Jane whitelist and we'll call it Walter right if you have an account in Walter then you can then you can have an account in Walter you can use a ring signature to prove that you have an account inside of this whitelist Willie and if you if you do this then the smart contract that controls the whitelist Walter will assign you one account in that white list as well but so Walter has exactly the same properties as Willie exactly the same membership as Willie accept even the entity that manages the entire system does not know the specific mapping ability of individual to account so basically this is the sort of thing that you can do with ring signatures right basically you can maintain a kind of a simple resistance you can prove membership membership in arbitrary sets and you can do all of this with basically without compromising privacy so for the first time in history we can have fully privacy preserving civil resistance fully privacy preserving proof of being a citizen of ZM beyond not being a citizens of Zimbabwe not being a citizen or not being a resident of the state of New York etc etc so and this is something that actually has already been implemented on the bobstine test network ZK snarks so z ki Snorks or i mean i view of them as being kind of like one of the three cryptographic god particles where the other two would be a fully homomorphic encryption and in distinguished indistinguishability obfuscation and it happens to be the one of the three cryptographic god particle is it's actually the easiest to implement now why do I have so much respect for the technology basically because it's super generic and what that means is that you can use it in a really huge amount of cases ZG snarks generalized like the generalized ring signature is a generalized regular signature is new general eyes a whole bunch of things they are this kind of really super powerful thing that kind of encompasses all of the above combined so here is what they do Ezequiel are quite Co proof that you know some number or some piece of data X which satisfies f of X equals y F is a program and F is public Y is also public and X can have some secret parts in some public parts now a Z key snark comes in the form of chrome of a cryptographic proof so the cryptographic proof basically just is a bunch of what's called elliptic curve points and that total amount of data you need to express them is 288 bytes and a sneaky snark can be verified in constant time even if the original program takes hours to execute so not only is now another important property is Ziggy snart satisfies your knowledge property so they prove that you know this number but they say nothing else about what that number is now there is a prove aside overhead it just to warn you with a large constant factor so basically expect making one of these proofs to take thousands of times longer than it takes to actually compute function after normally but you know based if if proving takes a long time verification is more expensive than other things other things but it's still relatively cheap if you want to know much more about the gory math behind this I wrote this big long three-part series of articles about it after researching the topic for a few months it's hard but hopefully you can pour through it yes this will be on the exam so Zeki snarks can do linkable ring signatures so this is actually kind of fun so basically here is just one kind of sketch of how you might use Zeki snarks to do linkable ring signatures so any individuals private key is going to be some number X their public key is going to be the hash of X and the trace is going to be the hash of X plus one now if you want to make a ring signature then basically and now as we remember F has f kin how is a program and why is going to be well we'll just set Y to be one and X could have private parts and public parts so the private part of X will be your private key and the public parts of X will be in well number one the entire list of public key is that you want to prove membership in an x' number two of your trace now the reason why the trace has to be public is basically so that if someone makes two rigged signatu signatures with the same key then they can be mapped to each other all right um so the function f does two checks first of all it checks is the hash of the private key one of the public keys and the second thing is it checks that the trace actually is the hash of the private key post one if both of these passed and it returns one otherwise it returns zero and we're looking for basic y equals one so we want to prove that both of these things actually are true and so in this way basically you can kind of turn the functionality of a ring of a linkable ring signature into the language of a z case dark and this is roughly what z cash actually does um z cash by the way is a cryptocurrency that uses Z key Snorks as basically the critical part of its private of its a strong privacy solution and you know it has actually been using this technology for basically almost an entire year actually something like 304 355 days as of today so congratulations e cash for almost surviving an entire year yeah so basically what are the use cases of Zika snarks well you can prove integrity of process you can provide selective transparency so he can be so transparent about whatever you wants you could be private about whatever you want with no compromise of privacy to anything that you want to still keep secret there are a couple of exceptions so for example time stamps so you can't hide when transactions happen even if you're hiding their contents and also the Zika starts by themselves do not hide IP addresses but there is other technology that can fill that gap so this is basically the kind of the ultimate partner technology to block chains and the reason why I say this is because block chains are good at providing guarantees of correctness of process and authenticity and they do this at the cost of privacy and zakiya snarks basically give you back the privacy now ring signatures also give you back the privacy but they are a kind of more efficient but more limited to offer a subset of applications so Zika Starks have some limitations so it takes a while to make a proof verification is more expensive than verification of other things the tooling to easily use as you're now a Zika snarks is not yet fully out there and there is this weird thing called a trusted setup which basically means that because of like very weird details and how the cryptography works actually I'm in order for the whole system to work basically there has to be the ceremony that was run by six people and these six people did do this cryptographic ceremony to generate what's called a proving team now basically if all six of these people were dishonest and colluded during the ceremony they could maintain the right to create fake proofs so they cannot compromise privacy but they can maintain the right to create fake proofs as long as at least one of the six people did actually did delete the data that they used to participate in the ceremony after they participated then the system is fully safe and no one can cheat it now we do have in the case of Z cache specifically we do have some fairly good evidence that they deliberately provided that shows that all six of the participants actually deleted the data after they participated in the ceremony but if you wants to create a trusted set a deuce your knowledge proofs for Z key Starks for some different function f then you would basically have to create a trusted setup and you'd have to repeat this process and you have to make sure that it's done well so these are limitations there are new kinds of zero knowledge proof scald ZK Starks um so as T air k instead of SNA RK that resolved particularly the last issue and some other issues but you know that's still in the pipeline so what can is you as a victim of the etherium water will hackathon do with privacy technology so first of all things that you can do now well you can think about low-tech ways to improve privacy so simple thing just to use different accounts for different applications try to avoid unnecessarily leaking information on the blockchain if you can get away with putting a hash of something on the blockchain instead of putting the original thing then do it just small things like that number two use state channels get excited about state channels will of state channels soon ring signatures so aetherium is launching an update in a few days and this app called Byzantium which will introduce support for different kinds of cryptography including rigged signatures and ZK snarks and soon it will be possible to actually use these technologies to build applications on top of them now if you wants to experiment with this stuff now you know I actually do encourage people I'm in the hack if they are technically capable to definitely try experimenting and just with any features of the upcoming byzantium fork we do have a small price that we're impromptu announcing three ether for the most the most interesting use of a new of new aetherium byzantium features including the new various cryptographic various cryptographic operations so yeah if you'll feel free to look into that hack into it you know and try to use that to do interesting things and later on you know there we do expect there to be better and better tooling for actually implementing things like ZK snarks where basically the experience for working with all of this all all of these spooky cryptographic god algorithms is basically just going to look like writing a program for a computer and once we get there then you know writing applications that'll be per that are both private and secure will be a much easier and much more interesting and hopefully a lot more fun so thank you [Applause]