Why Institutional Custody Breaks on Shielded Chains | Lukas Helminger (TACEO) at ETHConf

Good afternoon everyone and thank you for the nice acquaintance. So, we're building a network for encrypted computing and now we're focusing on the identity and finance layer, and today I want to talk to you about a problem that we've discovered over the last few weeks. This will be a fairly short conversation because, looking back, the problem is pretty obvious, but we haven't seen anyone discuss it or address it, at least publicly. Now, to appreciate the scale of the problem, we first need to look at the scale of storage today. Most of you are probably very familiar with this, but nevertheless, take a look at some numbers.

Hmm, for example, this is from Coinbase. At the peak of the crypto market, it had approximately 300 billion in assets under custody. And also, if you look at ETFs, most ETFs are held on Coinbase. And it's not just one company; it's a whole industry. If you look at Bitco's numbers, they are not very different different .

And if you look at each other, there is truly a dominant figure in this space: Fireblocks. Um, that's a different metric, but approximately 10 trillion transactions are secured through their storage solutions with over 2,000 institutions. You can appreciate how important institutional storage is to this market and to cryptocurrency itself. Before we can see what the problem is, let's take a look at the privacy space a little bit. Privacy has been experiencing a major renaissance for several months.

And to highlight here a few such projects based on CK. You have Alio, which is a tier one project, uh, CK, uh, which is largely based on the Leexi model, which is also the same underlying infrastructure that Adst runs on, which is L2. There are several artists on Ethereum like Midnight Kadani, Maiden, L2 and Ethereum and of course everyone knows Ccash and recently we also have a roadmap for Ethereum which is about client-side verification. So I would include that in that bucket as well. All of these models provide for independent storage.

So you hold your own key, you run your own client-side verifier so the secret never leaves your hands, and you have maximum privacy. This is how all of these systems were designed, because they were designed with a unique privacy value proposition. But on the other hand, we have the institutional world, and for the institutional world institutional world , when only one person owns the key, it creates a real risk, especially for regulated organizations. They usually separate transaction signing and of course also add a lot of auditing capabilities. Today, institutional storage, so modern, looks like something like how you split your key into three parts, for example, so that no one party owns the whole secret and can't spend money on their own.

The part is that when they want to make a transaction they have to merge, but you don't want to merge physically and have the key in one place, recovered, but usually the scheme can look like the client has a share, a custodian, and a backup share. So backup share. So , how do you sign and authorize a transaction? The settings you are using are called threshold signatures threshold signatures , which are a special form of multiparty switching protocols. Multiparty computing is a branch of cryptography that studies how we can compute data from different parties without revealing their input.

Just as we want to share the results, but our input should remain confidential to each of us, which is exactly what each of us, which is exactly what you want to have in the case of a custodian. One of the most well-known algorithms is ECDSA, as it is widely used in many blockchains, and there are several threshold algorithms for it. And that's exactly what most modern storage solutions from Coinbase, Fireblocks, look like; everyone has their own MPC solution or something like that built on open source. So what should we do when we like the world of SE knowledge? Now things are starting to break because in public chains every transaction is authorized by a signature.

In the world of SE knowledge, we have transactions, which are essentially serial proofs of knowledge, which is much more complex than a signature. One could even say that such signatures are a very special case of consistent proof of knowledge. None of these custodians have a solution for how to threshold SE proof of knowledge, because that would be equivalent to thresholding a signature, and so many of them cannot configure it. Fortunately, academia gives us a way to threshold refutation, and in academia we call these collaborative SNARKs, or cos snarks for short, and they were introduced four years ago by Bonet and Alex. Essentially, you take a multi-party computation protocol and put a consistent proof of knowledge into it, and in this way you threshold the entire proof system and the entire zero- knowledge proof generation.

And it's very similar, and, uh, you have the same properties as in threshold signatures, you have, for example, parties that come together in an interactive protocol and create a transaction create a transaction . So the SE knowledge proof and the result of the SE knowledge proof are no different from the standard proof. So you don't need to adapt the protocol, you can just use it on the blockchain to verify your transactions. What progress have we made today? We have been developing this technology for over two and a half years.

Over the past few weeks, there has been a demand and awareness that there is a problem that collaborative projects can solve. So we built the entire toolchain, the entire stack, and also the network that went live two months ago and is doing about 100k transactions a day for use cases in the space of identity, private payments, private tokenization. But now, fortunately, we already have all the tools available to support most of these changes. For example, co-ircum is a way in which you can use use any circum. It is a subject- subject- oriented language for zero- disclosure evidence.

You can use threshold cubes with our tools our tools . The same goes for noir, which is closely tied to the adst ecosystem and approval system. The good part about these overheads is that they aren't that bad. You can imagine that adding two complex technologies like multi-party computing and proof of knowledge and intertwining them has a very bad impact on performance. But this article also showed that the combination of these two technologies is happening unexpectedly quickly.

So today it is already possible to use the asset custodian in the same way as in the case of collaborative snacks, as well as with multiix. So if you are an asset custodian and need help implementing protected assets, that's when we want to talk to you because we believe this is one of the blockers that has not yet been addressed for increasing privacy and its accessibility for institutions . Thank you.