A trustless Ethereum mixer using zero-knowledge signalling by Wei Jie Koh, Barry WhiteHat (Devcon5)

[Applause] thank you so much for coming weekend from Singapore to me some privacy samba DF and today yeah it's a my honor to share my work on the process of four months to mix up giving using symbolic proofs okay there's no mic right yeah yeah okay is that better yeah okay so around the middle of Ostia the monopolist yeah there was a lot of my activity on Twitter people are talking about mixers because atomic posted a hack and d/a means push-ups for people to build mixers on native app and there was a bit of a mix-up and a song where we sort of interest in the slaves so today I'm going to show you one excessive time then it's obviously I built the novel by henning Co big girl can and we build this from the zero knowledge signaling cattle semaphore and explain that meters but before we do this I just wanna give a high-level discussion about why do we need privacy and the usual argument for policy is there is an interest human rights or that is something that everybody wants even they don't think that needed in a moment but I think that's one something that people though they talk about is why people need privacy of even specifically and I think that's a this is interesting because if they were users privacy more than any other complaint because if TM has defined as because Indian has attempts the more they use for different applications the more than be practicing and negative entity 25 users tend to click more data than any other chain because in any other change yeah because it any other chain line never OSE catch you you are just setting crypto back and forth you haven't necessarily taking that data to want change back contracts but in Italy you have smart contracts have meaning and the meaning is something that you said to that it is a personal data is said to be the set of rules I said that those privacy because you're giving that punching activity defying and the smart contracts point because if I not take back and you use your your address to sign up for that week or that event now someone knows that you went for that pocket or you just buy coffee now the peristyle can stop you because I know you're in your balance and then it gets linked that to other defy apps so it's not good so you want to fix that with any way possible and mix up it's just a one step towards adding more privacy to is even there is a fantastic we caught on the state of mixers that are determinate with you see this is like a problem overview of all the mixers up there right now but to take a bit of focus on party mix so how does it work yeah so the two transactions the user only does one transaction was it death into the contract this is Anthony but they do that they also pass in the identity commitment which is the hatch of a EDSA Kentucky and some random data when they want a big drop base generally as it is not proof that Afiya membership in the set of all identity commitments already in the span contract they said intervene layer the bill a the video contract passes on be the proof to me Michael makes smart contract which verifies the truth and sense that but it also says that can be bought to retail so user doesn't have to pay asked to withdraw and this is good because if they can take yes they would have to get the gas or the each to pay the gas and that would defeat the purpose of the positives so at the risk of a devil filling a tableau for people show a level so this is what micro mixer app it's a covert suppose you might want at deposits or many die deposits so that's just mixed 0 1 F so this is where we deposit the funds [Music] and it's just gonna take a long time to cut system is a right demo okay so what we do here is that the goal is to educate users to leave the deposits as long as possible we we don't want to tell users them the more deposits there are the more times that you have becomes as possible for them for standard to fill in for the pool of deposits of their own with the old funds and in the false impression that another anonymity who is is very large when in fact they might know most of the transactions and either to me it reminds you because they they stand for it so we're trying to do here is just to encourage users to have have better best practices and that it is not anti and thank us take days attack behavior in order to maximize accuracy so what we do here is that we just encourage them to withdraw only after midnight UTC unabated and the deposit so that they don't they haven't told that like the trigger the code about privacy you have but that that can be better way try to get users and this is just what way for the sin of a devil can also be can basically generate the do that the drama right now it's not Sunday vetoed encourage this is where we generate the Zika snap proof we don't know all the identity commitments whether it's not contrived we generated welcome welcome proof socket from Italy and then we just this takes like 30 seconds - because it's because it is not a long time to prove a short man very fine and while this runs get us to the next slide okay so yeah so this is more like a lot details of an architecture of ethics we have a UI we have EDSA East all inside the users browser in Turkish knowledge the reason that we use EVs 80s for the identity of this one is because this is most unfriendly that easily as a keys and this poses a challenge for water spiders because if we need to have other ways to store this key for the purposes of this demo is not encrypted or anything like that this is a home all public that in cover in a different discussion we have it's all into the contract and we have a relay server that has a PRF accept proofs and also manages the nominees for setting the transfer section to be right now this this contract supports either 0.1 Google Earth or 20 tiny deposits reason that we have fixed allowances that we want that if we have that we can surf on arbitrary amounts because that would be otherwise uses in your case of gas right now we are using a sexualized belayer in the future and Internet has meaning network where we have differently there is the compete on fees to to which you continued for the for users to set the transactions to be they and Kathy was a little we have that final we have a function that lets you generate proven Senate as a transaction against for that in case you need to be properly and we allow you to we have the in terms of proof generation that impressive work in a web browser and is in our program right now before I go into the more technical details of which is the underlying stock gadget that powers all thing let's see this done hi it's downloading it so right now we can see that this still generated proof it needs two pieces of data the submit anything in this thing so if you pin and it just takes like it's very foggy the browser just and just to be sure of very can get it and smell it and it's just true and so I set it to the B layer which will sell it to the customer so fingers crossed user is no guess what is because the user just says transaction data out of key to an API and we will see how the contract says that soft a small portion as we want to be mayor and he compact the funds to the recipient address they see that this is we want for the email and SSD 170 mix so involved and I'm 10 1 that is to go into technical details but anybody have any preference right now it's a gas cost I guess first of all it draws 77,000 against positive this because we have we serve up to the power 20 deposits in this part of the world the what about deposits that I guess possibilities yeah both under turn I'm the receiver has to constantly every layer in aerodrome what happened the village' can send such exceptions cannot cannot change so they don't have to trust me but just need to trust me they're to me they don't have to trust it that after deposit and took away I only knew it to anyone anymore railing for you is not Oh deposit directly into the contract yeah the villian only sense passes about makatea for the last question so like we have like two measures of like the activity of this contract which is I guess like a number of deposits to practice like the number of observed Rawls and like for a given deposit you can look at the number of the girls that person's own to like get a very very weak like what yeah they said if you're thinking about this like more seriously like what here is that can you use you would say that EXA on the biggest weakness of this one thing so right now I'm saying that we need to educate users on the best premises that's practices that are believing in the contract as long as possible and and not and educators as that the size of your voice not necessarily the best metric of privacy it is a tough question yeah is a bifurcation you ain't no extra extra context egg whites oh you can you can anybody can write a minute yeah but so the beginning system is something that's being built by not by Sacre boys was coming later today this kind of our scope of isn't this so in the next five minutes I'll try to explain a bit all of the CIA stuff sorry could you speak a bit louder yeah okay yeah I'm sorry about that so basically the mixer is one application of summer power which is city staff circuit and smart contract whatever for does is allows you to register your identity and allows you to broadcast any other three straight [Music] and influence Thomas signaling so to applies the default to a thing so the identity registration is a deposit and drawing funds is broadcasting a signal and in the same thing that that was significant doesn't work implements the aesthetic this is the summary of busy it's not true improves three things that the identity calm event exists X IDE for the tree that this Center was fully for us at once for this one for the second one and it also relies on the storage service par contracted check whether the file exists inside a storage but also the circuit check for the day hash it's better and finally there's also a EVPs aho verification then it shows that we given that the practically clear that the user used possum was associated with a particular user sign the to capture the signal and be satisfied so in my three minutes I can explain the whole thing that I'm happy to sit down everybody just to tie it to the coordinator yeah yeah so just to summarize to deposit we know the steps into the draw me the contract and yeah as we mentioned there's a whole is a very quickly about how humans things can be about my scuse us and this was so they look at see cash so this one that's one downside of this system the under Thomason is seeing it's tough and smart contract significant security flaws and so far is the classic set up so to mitigate the last two first of all we have in this ceremony where we're so any sickest time its transverse Emma is divided into two parts the first phase is something is common to all ze snap circuits and between the often party to mutation ceremony where anybody can join n share of that setup and this is going to last forever as long as even want to do this and a music is not circuit can take a point in this chain of of of constitutions and branch off to the second phase the circuit specifically for the setup so doing this something called a perpetual problem house everybody so far left we unite seven husbands and we are going to keep doing this and we're gonna pick a fight in which we do the trusses set up for evening sir we are also founded do a network and that yeah and one going on it and you have just going to this process right now so we have any people to yes and he never for this to make is possible and when anybody they that you can never spend that like it this is the name of the bidding Network some again definitely check it out and finally all the sauce footage of its songs you can find here every month I love you I'm happy to answer any questions in person and thank you so much for coming [Applause]