Elena Nadolinski I Ironfish 2.0, The Safe Privacy Layer for EVM I Pragma Singapore 2024

[Music] all right next up I want to get on to our third speaker and for this I'd like to bring on Elena to tell you about ironfish 2.0 so please give Elena a big round of applause hello hello does this work okay cool awesome hi everyone um thank you so much for being here I know these conferences are uh you know sometimes not as not as fun but last conversation was pretty great um cool so I'm here to talk to you about privacy um and so first you know why are we making a big deal about privacy anyways and uh transparent chains which is basically all chains uh they exp they they expose all transaction details so for instance I saw this some Twitter ones where you know oh my gosh how great you can get notified when your friends get a big win it's like well actually maybe you don't want your friends to know that um and uh because of how we use uh cryptocurrency today we're basically linking our real identities to our accounts so for instance like that's Chris Dixon's you know kind of wallet and you can kind of see all the nfts he has um and then for transparent chains we also have like built-in surveillance of all of our transactions and that's how we know all of Trump's Holdings um and I think there are people from here that actually representing that project um and so there are other reasons why transparent chains are kind of a a bad idea in terms of using crypto for real world payments and so then the question Becomes of like how do we make how do we bring privacy to crypto and crypto is not new to privacy projects um apparently there are 700 more than 700 privacy projects that have been tried or potentially are still trying um but out of those all 700 I still don't know what I would use if if I wanted to send $20 privately to to someone to anyone um and so when I think about the 700 plus privacy projects that we have today I feel like you know that that uh the the woman math meme Lady of like okay but what do I use like if I just want to send private usdc like there's 700 projects and they all say that there are privacy projects but what do I use like what protocol do I use what chain what asset um a lot of these privacy based projects also tell you that uh depending on the amount that you send you have different types of privacy guarantees and that's really confusing too so how do we just you know build a privacy protocol that literally just lets me send any amount of money privately in an easy way um and that's basically what I've been working on for with iron fish for quite a long time um and we're slowly but Surly getting to a solution that I think will actually work and so there are many ingredients that are going to be kind of going into this privacy layer and a lot of them pretty technical um and I'm going to walk you through some of those technical details just so you can kind of get a flavor flavor of the kind of massive amount of effort that it takes to build a cross-chain privacy layer um and probably why it's been a really really hard time for other privacy projects to launch something that's usable so um there's something called masp um so so yeah so all these ingredients combined give us a privacy layer and so iron fish right now is layer one proof work privacy layer and we did that because you can't just sprinkle privacy on top of a transparent chain you have to build it from the ground up um right now it is fully decentralized with nodes all all around the world um and we are going to support wrapped bridged assets from 27 plus chains hopefully in a few weeks um and once again iron fish is a privacy pool that supports many many Assets in in a single pool so that transactions are indistinguishable from from one another um kind of a big topic for privacy pools is definitely regulation um and so for for iron fish our bridge is going to have sanction screening um on the Ingress meaning that transactions that go into the pool uh will be screened for Bad Bad actors Okay cool so let's dive this is going to be pretty technical so bear with me but again I want you to get a feel of how much effort it takes to actually build a privacy protocal like this so um uh so iron first started with something called sapling which is the zcash Privacy protocol and we modified it to kind of give it uh a different type of flavor and we also Implement some implemented something called Mass which is multi-asset shielded protocol meaning that it can support many assets um and it is pretty highly technical but I think it's super interesting and there are a lot of moving pieces that that that kind of have to come together so for iron fish because we started off with sapling the key creation is quite complex um but really you kind of have to care about just three keys which is you have your secret key you have your public key and you have your vew key um so the vew key lets the holder actually uh see all the information about your account and your public key obviously lets you request money so secret key just like in ethereum that is your private key that's where you keep private um the V key lets you actually uh generate a transaction but not sign it and see all the transaction history and then the public key we did modify it from the zcash original protocol such that there's a Ono one mapping of one private key to one public key because we thought it was confusing the way they did it um so for iron fish we also have the concept of an asset which I think is super cool because iron fish is actually a utxo chain and so if you think about Bitcoin or other utxo chains they don't particularly have assets and for iron fish we do and an asset has kind of a definition of what that is which actually it gets used to uh to Hash all that data and make it into a point on the Jubjub curve which is a type of a elliptic curve and that is actually what going to get was going to be used to create this multi acid Shield pool layer so important information for later and then the node structure because iron is a utxo chain we still have to kind of keep that um that structure but we did add an AET identifier for every single note so now every single note has the value the AET type the owner and some other information about it um and because it's a privacy protocol all these notes go into a Merkel tree that that is an Adon Merkel tree so then you can use that Merkel tree to actually spend notes that revealing which note that is um and so unlike other privacy chains we did make iron fish more modular so for a transaction we actually have different types of descriptions that you can attach on a on a on that transaction so you can do things like spend uh you can create more notes you can B you can Mint new assets and then you can also burn new assets as well um and so uh this is kind of the ingredient for how to make a multi-asset privacy privacy pool um what we did do is we actually made it so that the mint and the burn transactions or the Min the bur um uh descriptions have some publicly available information so that you could actually monitor whether or not a bridge that is bridging over assets is behaving properly uh so because that information is actually public for users to verify cool so the spend description um it is quite complex and so it has things like a value commitment what are we spending a value commitment is a Peterson commitment meaning that the actual value is hidden but you do get um something that you can actually later on use for balancing um and then has things like the nullifier so the nullifier is unique to the node that you're spending and you have to reveal it as part of that uh uh transaction um so again spend a description basically lets you spend a note without even revealing what you're spending and that's exactly what the ZK narc that's attached to that spend description does it basically says there is a note it's in the tree I'm not even going to show you which one I'm I'm even going to hide my signature um and all you have to know is that the nullified that I produced is correct uh but pretty much nothing else about the transaction and then the output description basically let's um let's the recipient get that note so that their wallet later on can decrypt it and then can spend it as part of a spend description in the subsequent uh transaction and the Zeki s for that kind of does kind of does exactly that basically says that I have the authority to create a new note for the recipient that I'm sending that to and then the mint description is pretty interesting because again it actually lets you create a different type of asset on top of this privacy pool um and uh yeah this the znar basically proves that I am authorized to Mint more of this asset or I can transfer the ownership to a different asset um and then the the burn description is actually pretty simple it just says anyone can burn any asset for any reason there's no zkp magic involved so the cool thing about it is is that every single one of these descriptions has what's called a value commitment which again is a f of commitment meaning that it hides the value of the note that you're trying to spend um into a Peters commitment which is something that you can use for balancing the equation later on and every single value has a unique value generator that is specific to that asset and that's the important part that lets you balance a transaction even though the transaction can have many different assets within it again in a totally private way so kind of in a you know like the intuition behind it is that when you balance such a transaction that spends minus outputs equals the transaction fee minus the mints plus the burns plus this binding verification key that is part of the transaction to make it all Balan um you can kind of think of it okay like for spense in the outputs I have the value commitment and for other things I can do a pseudo value commitment to kind of make the math work out and make sure that the transaction does indeed balance um cool and so with that we basically can do account balancing on that transaction um even though the transaction might have various different Assets in it again without ever showing the world what those assets are or who who the recipient the sender or the amount is so I know that was a lot and I just kind of want to get you this intuition behind how a privacy protocol Works um and again this is very similar to how like sapling works we just expanded that to have multiple assets um and so even though you didn't get all that that's totally fine you'll actually see the same pattern being used in many many other privacy protocols so for instance aack Alo that just launched tornado cash even um all of them kind of used a really similar model of there's a meracle tree and I'm going to prove that a note exists in the Merle tree I'm going to reveal a nullifier such that it cannot be used again so this is actually a very very similar pattern and you can kind of like work a lot to expand that pattern to do what you want okay cool so the other part of the ingredient is okay now that we have a privacy pool that can support multiple assets we still need to be able to support Bridges so that Bridges can let users transfer assets from other chains onto this privacy pool and that is actually kind of hard to do because most bridges require multi- and you know if you've ever used dcash there actually is not really a private multisig for any privacy like Pro protocol like at all and so that this part actually becomes extremely difficult um and so there is a protocol called Frost uh and it's a schnore threshold signature and then there's an expansion of that which is called dkg and dkg lets you have distributed key generation meaning that all the parties that actually are making the multisig wallet can do so independently without a trusted dealer um and that actually has never been done before for like any privacy protocol like production wallet ever and so uh that is a pretty big engineering feat that the iron fish and the if Labs team have done um and then we're also going to have a ledger integ creation for ironfish uh Frost EKG which again no privacy protocol has uh full multi- Ledger support um and so the idea behind uh something like a frosty kg wallet is that let's say you're trying to set up a party of five um you have five participants all of them individually create something called an identity using their own secret um and then there are three rounds that they basically the participants kind of interactively uh interactively share their secrets in order to create a shared public key and a view key so it's kind of a wallet that doesn't have a spend key per se it has multiple spend keys from all those participants but a single public key um and then any participant can create a transaction uh from that derive UK key u but unsigned transaction and then a participant can initiate that uh signature appication to actually sign the transaction and that's basically how you achieve threshold signature multisig wallets um so we have it right now it's a CLI wallet it's maybe not the most useful or easy to use but it does exist U and then we'll have Ledger support for it as well and it doesn't doesn't have to be easy to use because it's very specific to bridge operators to be able to actually build those multi wallets in order to to bridge those transactions um and so yeah why this is important is because multi6 lets you actually uh work with these Bridges um and so this is a short demo of actually this working so we're partner up with a bridge call chain port and this is all test net so this is not live yet um this is a very very spread up video um but here we are able to basically transfer a bill token from sepolia to ironfish um and it'll get Minted as a wrapped asset on iron fish uh so this is my ironfish wallet it's kind of hard to see but there's a bridge transaction uh that that got put into my ironfish wallet so now this build token which is an erc20 um is in the Privacy pool of iron fish and then the video kind of Loops again um cool and so that's basically kind of how you achieve uh a wrapped uh bridged acid privacy layer um and so what we're hoping to do with iron fish is actually connect iron fish to pretty much every single evm L2 that there is or every single evm chain so that iron Fish can be uh PRI lay for all those assets um cool and that is all coming quite soon so if you have any questions please let me know and then you can follow us on Twitter to to kind of keep track of things right thank you [Applause] [Music]