Minimum Viable Privacy: Introducing Hopper by Julien Niset

[Applause] thanks was taking around my name is an easy I'm one of the co-founders at argent and today actually I would not be speaking about our agenda will be speaking about hopper which is an open-source privacy research that we did develop early actually this most of this work was done by believe and big enough community this is going to be today I'm going to blow my face so that should be better so I was saying we're going to be speaking about Arjun but about copper which is what was most innovative and irregular proteins of the credit goes to him and if you have any deep technical question you should also ask em to it on Twitter so I just said I'm going to be speaking about logic but I think there is some value in briefly describing what logic is because it gives some context of why we started working on the privacy it sir so Arjun is the smart contract base what else we a lot of cool features we have seen this recovery you can block for the transaction you can freeze your account there's no obstruction of gas or the transaction fees and we used as an ESS all so so basically what we try to do is abstract most of the complexity of the blockchain and enable an experience similar to once again on the best mobile banking application today but in a fully no mr. Devaney and the vision for that is that we wanna enable actually people which are outside to access the blockchain and so just it is not to build our you financial system for people that actually I'm not really tech savvy there's some kind of expectation of what that system or the feature that that system should provide for example people assume that if you transact that doesn't give the person who transacting with access to your theory for example I mean future Runge's making a transaction to my insurer I mean not P okay for my church that I just visited an oncologist two weeks ago this kind of information should not be disclosed that should be private of course a material which is a public nature with full transparency you donate these properties this also economical argument for privacy is the fact that you money or token to be fungible if I send you one eater you want that eater to be worth one either now if you know where that either comes from actually you will believe that it has this value because it can be tainted for example it comes from an exchanging act that token may be worse miss they're actually one either so these properties are very important so if you want to be inspirational you can say that privacy is necessary for an open society in the electronic age if you're a bit more pragmatic we actually allow users saying that they were not they were feeling uncomfortable by thinking about the one end of which they had a lot of funds with their hard to buy and actually this is seven quote is really the use as we try to solve so we really ask a question can we actually invest I use case a user wants to find his heart and wallet which has no fun and send it from our wallet and can we do that search tab and two addresses are between the process is pulling on this video it is mobile friendly and actually this point has driven developed chosen to design Locker and of course it has to be economically viable in terms of gas if you transfer one either but you click on find either in class to make that transaction happen this is not practical fortunately there are solution to address that use case and as you probably all know ZJ snarks can be quite useful for that we didn't start from scratch so we should also give some credit to the team of very white line in which a that was a little bit earlier that done a great work and it's not miss amiss and now semaphore and so which what basically we we're trying to extend what they are at dump it on top of what they're done but really customize it and make it practical for our target new skills so others upper or be serious words it's that basically if I want to send an aunt to someone I will a secret which is a leaf in a vertical three and the person that wants to reach for that town needs to prove that it knows the secret behind one of the count and then this common hasn't been spent yet so the principle is is quite simple in practice always water work because we do have an iOS application that you guys should try which is in alpha now but it exists it's a good way to see what it does so basically the client using the the opera application will generate the leaves so we just do a char 250c of a secret and the destination reference using your hardware model to make a deposit to the mixer contract and you attach as a family of course other people will do the same and each transfer is of identical value as you will see this is critical and I'm reserved basically in a sea of identical transfer of course the motivate the more people will deposit either of the mixer contract and the more you'll need et set increases I put in a stir it's because it is not as simple as that but it provides me the intuition are we getting finally after a certain time the person wants to be true the comment again using the Opera can tell the mixer to send the fun to the destination and you do that by sending a a proof the mixer comes back you verify the proof and if the proof is correct we'll send this one to the destination address for example that might be that sequence complete transfer and correct you received one eternal quality so this one when the user experience is actually quite simple know what is in working practice so not good it because the CGA smart framework for mixers but basically you want to prove that you know secret three Weatherly to the sha-256 of the secret in a destination address you wanna prove that that common hasn't been spent it so actually you can translate that automatic mathematical equation and that will give you circuits so in your case these are the the set of equations that we want to solve this is the secret inputs that we want to prove we know we don't be reading them and of course there is some public inputs so using this you can actually build your circle and have your verify your approver using a library such as that in terms of small contractor small contracts is quite simple at first example is API we have two main method commits when you deposit your funds and you attach your leaf as data at individual function where you specify the cubic input data so the destination only fire which proves that there's no double span and then you're the proof that you are constructed using the Zika slug framework so that's kind of the general framework as I mentioned we are similar to all the mixers but it's all about the choices that you make for implementation so in the case of hopper we use Minzy for the Asha function of the work of three which stands for minimal multiplicative complexity the intuition for that is that in the Zeke is knox remark you get your equation you translate that into a circle with addition and yes and actually the number of constraints that you will health depends of the reputation is that you have so if you actually function with minimum multiplicative complexities that means less constraint that means generating approve will be easier of chain and that means that it is more mobile-friendly so we've made that choice so that you could actually generate the proof of a mobile within five six seconds of course there's a few drawbacks of using MCs I've always in engineering is a question of compromises if you mean C's there are more expensive but um because there is no pre-compile to exceed as we will see there is an NP for that but that's all for now maybe see some changes quite expensive so actually when you deposit a leave you need to update your worker 3 and that requires gas and also in see them invested and if you are a is presentation this morning that I landed that eternal Foundation is funding research on MCS for specific events so to mitigate the risk associated with disease we are actually using Shan 256 for the leaf of the tree we're not going to the cryptography behind it but the intuition is that even it means he turns out to be non primitive resistant it will still as privacy assuming that means he of one half of the the inputs is pretty much resistance the problem is that using sha-256 means more secret constraint and so again we've increased the generation of the proof so as an Israeli in our in our use case we want people being able to transfer one deed from Hardware wallet to a larger one it that has not been funded yet so that comes the question is called as the person we joined the money will pay there's no heat they cannot pay for the gas and so again it is to use the layers and so in our case we have deploy along B layer there's work been done by the simapro team of the gas network station to actually use a network of layers and yet if then the relay will be made that we drove transaction on your behalf and we will be repaid the gas that used by taking a small cut on the deposit as we discussed on the panel there is somebody to tell me there's some risk as using layers because of course you're using a centralized may not be centralized but using system we love it yes we're making Lydia cause that means that people can use your ID address to kind of reduce your anonymity so there's no consideration to to take into that in one possible solution is to have a really a market with victim talk another important question with mixer is one to betray your funds because of course if you deposit your funds that you return immediately then it completely break their anonymity if you deposit your funds but you always return em up to 24 hours it's the same people naturally tend to to a pattern and so this is something that needs to be mitigated by actually the UX of building mixer all do you incentivize users to actually behave correctly or in a smart way the problem is that yeah whatever anonymity you use for example in our we just illustrate the number of other lives that I've been deposit since we deposited so that can be represented unanimity said but again this is not admittedly because say there is any 17 maybe 16 our other deposit they come from the same person which is actually trying to target so it's been tricky to to find from the privacy matrix and so the next person of opera yet is to basically only enable you to betray your fans after a certain time so that all usually positive depositing within what they will be incentivized to be true more or less at the same time so again you you cannot increase energy so I mentioned that will enable transfer of 1e again this makes sense we let people deposit point 77 either for example and then someone will close point 77 this is a good probability that these two people are actually connected again you've recreated a thing that we try to break so yeah it is to fix the amount that people can deposit so they become indistinguishable now the one improvement that we can do because of course if there is only the positive one it is quite kind of limiting so again is that it would make the contract for 1e contract attendee contract for unworthy but the promise that you split your enemy tea set and again this is no ability there are a solution and this is something that we work a new future or that you want people to work on is the possibility to use jumps encircled so basically yet is that you always deposit multiple of one key and then one you want to be true you can actually combine two these into one and so you can for example we grow 100 100 without breaking it another limitation of upper is that this body around 32,000 leaf per contract and the reason is that you have an Oracle 3 and the more then you want to America 3 the more expensive it is in terms of gas and seen you wanted to keep this and there are billions of the deposit individuals it's kind of leaving the number of level that you can aid in America 3 and so the number at the level of us believe that you can deposit so we have fixed a 15 which is the gasser on a medium the problem is that once you fill up your 3 to deploy new culture so I'm talking about some of the limitations or upper fortunately there's a lot of areas for improvement one is a lot optimization so you could attach the public input into one which would reduce the number of cars raining you can optimize the contract for the moment the contract is in plain solidity there's some step that will be written in assembly that would reduce consumption by fifteen to twenty percent and again that enables you to increase the depth of your three and so the the possible deposit that can be of a single contract and there is work on you VIP 1108 well yes d which is a pre compiled form in c so that we really reduce the gas computing it sees that means updating the Merkel three women shippers again we can use a much bigger tree another functional improvement that is part of the next iteration offer is to store a buffer of the reason mercury moves because now when you want when you want to create your your proof you need to have a miracle tab to delete that one the problem is that by the time you completely approve that we take five six seconds and then you submit your transaction to the blockchain yeah admitted fifteen thirty or one minute to be mine it is possible that someone deposits a new leaf in between which will update you three and absolutely or broken path is no longer valid so by keeping the mystery of three four five work routes actually you can improve the number of people that will succeed as I mentioned the klo pistol Patrol using just bleep and then we can work on a clear market so that's it that was kind of brief but I you guys enjoy if you want if you interested by upper you can check us on kita the project is fully open source and the idea for us is be the tool for the communities and this is not to be other projects or feel free to contribute if you have question you can think us on Twitter or telegram and if you interested by arthritic and on wallet right now let's keep the waiting list using the link that is there I don't know if you guys have any questions how much gas does it cost so we blew it into other millions for millions of the positive lol yes expertly to make the proof that we combine to Merkel Eve into one so say I believe a secret College has won either another one that that's one eater I do John Smith and suddenly everybody's perfect so either and once that is done and so if I meet will be tuned interested in the end I can actually flow different because it's a different amount yes different circle but again you came from line the Jung's beat with the rope so that actually in his basement you can Janice see like that but we need your needs to belabor customers because we still need to know the secret be a nice town so it's more like a transfer with someone else unless you will transfer in the second period is more to the yellow to Charles [Applause]