EthCC 2: Istvan Andras Seres

Hey Mizzou may I COO so hello everyone my name is Ashton and today I'm going to talk about a privacy enhancing technology for a theorem called mixes which is an efficient trustus coin mixing for aetherium this is a joint work with Daniel Chris and Peter Daniel is also here today so if you have any questions regarding the project please contact us afterwards so what is the motivation for blockchain privacy I'm going to talk about layer 1 privacy layer 0 privacy is an orthogonal problem for this obviously if you're not if you don't have any privacy already on the network layer you cannot have any meaningful anonymity guarantee on the blockchain layer on the transactional ledger layer and why do we need this just imagine this is my favorite coffee shop in Budapest called addicted to caffeine and just imagine if I would buy my favorite flat white with ithi room then with a single transaction I would expose my entire account balance and transaction history so this is clearly unwanted and/or if I would get my salary in aetherium then all the rest of the world would know how much the university pays me right and another example to motivate privacy on the transaction ledger in 2014 Edward Snowden posted a Bitcoin address on reddit that please if you want to support me send donations to this Bitcoin address and then after a few days Barack Obama created a law saying that if you send some bitcoins to that specific address then you committed crime right so we need financial privacy if we don't want to live in a world if we don't want to live in an Orwellian dystopia like the one described in 1984 and yeah so this is let let's shoot for the moon and then if we don't reach it and we will land in the start and land among the stars so from a privacy perspective these these coins these communities are models in the sense that we would like to obtain on the theorem the same level of anonymity guarantees that already achieved in these currencies and I argued that 2018 was an excellent year for from a privacy perspective because also more narrow and Zika communities made a really great advancements to bring privacy to the masses so if you remember before sampling creating a Zika transaction was honestly a pain in the ass and now you can easily generate a Z cash transaction already with with your favorite smartphone so now due to bullet proofs and settling privacy is really affordable and reachable even only if you just have a simple smartphone so this should be our role models this is the anonymity we would like to achieve on aetherium and where are we now but first what is blockchain privacy so we need anonymity and confidentiality and unlimited means that we would like to hide our identity inside the group right but we also would like to achieve confidentiality a transaction is confidential if the well you transact it is concealed in a way encrypted if you wish but it would be an oversimplification so we want anonymity and confidentiality anonymity is usually achieved by mixers for example Bitcoin community is way ahead of us in in terms of privacy enhancing solutions because a lot of Bitcoin wallets already provide a built-in support for con mixers unlike aetherium and we confidentiality for example one of the phrase most favorite projects in the theorem space is Aztec protocol they provide confidential transactions for a theorem and ether for example a new work from benedictines at all claims to provide anonymity and confidential it at the same time but it is not that practically at once the third transaction would cost seven million gasps yeah it will hopefully it will go lower but right now it's not that practical so just who who doesn't know what is a coin mixer or do you know what is the main idea so there's someone who doesn't know right okay so the basic idea is really simple there are K people K Sanders how can a suitcase Sanders and they want to send funds through the mixer to pay receivers and but but they would like to do it in a way where the mapping between the senders and the receivers is concealed to obtain some privacy in my talk I will not talk about centralized private point mixers obviously if you would use a centralized for-profit company to mix your coins and let's defeat the whole purpose so in the worst case they steal your coins and even if you send your coins to the mixer mixing service they don't send back or they send back some coin but it's still tainted so in my talk I will solidly focus on decentralized mixers so yeah if you use centralized coin mixing services don't do that and what is our threat model our threat model is that maximum K minus 2 senders and recipients can be compromised we cannot have a weaker assumption because if already K minus 1 senders and recipients are compromised obviously you cannot hide yourself in the troop because all the compromised node will know that who you are in that group so this is the maximum the the weakest assumption we can have and what is the security goal we would like to achieve K anonymity it also means K anonymity is like closeable deniability so you can plausibly deny that you send some funds to Edward Snowden because the US government would not know who are you between those K guys who sent funds to Edward Snowden so we would like to achieve K anonymity then we would like to we would like to achieve prevention so once you've deposited coins to the mixer then no one no compromised people should be able to steal from the honest guys and once you deposited some coins to the mixer then obviously you should be able to withdraw your funds so these are the three main goals we would like to achieve but first let's have a look of the previous work have been done in this field two researchers from UCL Sarah Michael John and Rebecca Mercer created Mobius which which uses ring signature the same technology as monorail uses and the problem with ring signatures is that the gas cost of verifying a ring signature linearly increases in the size of the anonymity set so you can imagine that this technology only supports small anonymity sets so if we come if we consider eight million gasps then currently not more than twenty five people could use movies to mix their coins and obviously in a real case scenario we would like to have much larger anonymity sets and the second work which is also an excellent work created by Barry whitehead who is quite known in this community it's AZK snart based solution to to provide mixing services the problem with ZK snarks is that it requires a trusted setup and we don't really like trusted set ups because it's hard to get it right as we already saw it with with the sapling upgrade and what happened and what not before and but on the good side an advantage of mixing was that it provides constant transaction cost for depositing to the mixer and withdrawing from the mixer but this is this constant is quite huge as you will see so what is our goal we would like to achieve we want to achieve create a mixing protocol which doesn't rely on trust is set up and this gas efficient obviously we would like to use as as low blockchain resources as possible because we would we don't want to use gasps that much while we achieve the same those free security properties I mentioned so plausible deniability theft prevention and availability the cryptographic idea of our ours is was to use and apply verifiable shuffles in this context a verifiable shuffle was invented by Andrew Neff and American cryptographer so a shuffle or multiplies public keys with the secret scalar then permutes the order and they the shuffle can create a zero knowledge proof which says that these were the original integers public keys these are the shuffled public keys and this transformation was done correctly this is the zero knowledge proof what it says and this was so just imagine that we have four public keys the shuffle er doesn't know obviously the corresponding secret keys the shuffle er multiplies all these public keys with the secret scalar C and then permutes the order of the shuffled public keys and with an F proof can prove that this shuffled public keys were computed correctly and note that if the shuffle er publishes the secret scalar C then this whole mapping can be trivially read redone again so we require that the show that the shuffle should not dispose this secret scalar see this works great under this decision diffie-hellman assumption which is quite a standard cryptographic assumption but the problem is that the naff proof is is quite gas inefficient it burns and requires a lot of gas to verify such as your knowledge proof so this is not a way to go instead what we want to do is instead of creating a direct proof that the shuffle was created correctly we don't want to prove that the shuffle was created correctly rather we require all the recipients to be online and check whether they see an error in the shuffle so they will only require an indirect proof from the recipients whether they are specific public key is still contained in the mixer and this is called John Patterson zero knowledge proof which which says that if you know secret a and P you can prove that the tuple is a D th tuple and this is a this burns way less gas then the a direct nath proof so let's say again this in the scenario we have four public keys initial public keys we perm with the shuffle or multiply it with the secrets colored and permutes the order after a certain time we require all the participants to to send fraud proofs champa doors and proofs if they if if there is no such a fraud proof then everyone is able to withdraw from the mixer but it can happen that this the shuffle err is malicious and let's say it replaces one of the recipients within with another public key and in this case with the child patters and zero knowledge proof a recipient for can prove to the smart contract that the shuffle was malicious and wanted to cheat and this zero knowledge proof is way less it doesn't burn that much I guess the trade-off here is that all the recipients during the course of mixing should should be online otherwise if they don't see that such a malicious act happened that they they can just lose their funds so this is the trade of what we made here but at least it's it's our goal was to create something which is gas efficient okay and note that here the shuffling even though the shuffling happens off chain the shuffle itself the the set of shuffled public keys should be stored in the Block in the block the smart contract should be written there and this so still the shuffling transaction still linearly increases in the anonymity set so can we do better than that because we still didn't achieve our initial goal yeah we can do better than that because we can we can perform this shuffle inside the state channel inside of chain this was our next inside what we implemented with the help of Chris Backlund and here in this state channelized me to see if implementation what happens is that shuffling occurs left of chain and then we will have a single deposit transaction and withdrawal transaction and in the middle shuffling happens off chain Chris wrote a really good write-up about this on medium so I encourage you to have a look at their right if you go to medium /p is a research you will find it article how he adapted the mixing protocol into a state channel interstate channelized version so what are our results so you can have you can see that Mobius withdrawal transaction scales linearly in the set in the number of participants so if you multiply 300 gas with 25 then basically we are over the blow gas limit so that's not something really good on the other hand mixing mousse is really nice it gives you constant deposit gas costs and we draw gas costs but it's still quite a huge constant and if you have a look at the mix if the channel implementation what we see is that basically two single value transfers can provide you plausible deniability modulo that when you need to do some shuffling of chain let's have a talk about message complexity some may be using mixing mousse require to unchain transactions unfortunately if you want to do the the trusted setup that then you need to create a multi-party computation which also requires linear number of messages from the parties and unfortunately what we lost in this trade-off when we channelize mixi is that we need to have Big O n of chain messages in this state channel so if you would like to I here edit some references and please if you have a look at our github repo and if you want to integrate our solution to provide into your wallets to provide enhanced privacy for your clients please let us know we would be really glad to help you integrate this mixer to your wallets with that I conclude and take any questions if you have thank you any question cool thank you