Stealth address | Nic Lin, imToken | ETHTaipei 2023

privacy and then how also how still address can help okay I'm Nick Lane I'm a developer I'm token labs and here are the links to my slide if anyone is interested I'll pass here for 10 seconds okay so here's my agenda I'll be separating my talks into four parts the first one is different aspects of privacy there are different aspects of privacy when we mentioned privacy and I'll be talking about that in a bit and the second part is the Privacy tools I will briefly go over some privacy tools common privacy tools people use today to protect their own privacy and third one is the main topic the sale address I will show you how it works at a high level and some of these benefits and downsides and challenges and the next one is the summary so uh different aspects of privacy but uh why are we talking about privacy this is because all the transfers on chain are public this includes sender receiver and even a transfer amount and so that's why we need privacy and there are many PR many tools to protect unusual and privacy there are way to turn on the cash maybe many of you have heard about and there is still address and those and there's also Aztec although they they all protect uh privacy but are they the same just different implemented in different implementation details well no they don't understand and each of them protects different aspects of privacy so what are different what are the different aspects of privacy before giving you my definition I will first give you two quick example the first one is that say you want to donate to a campaign to free SPF and you probably don't want your friend or family to know that you made the donation so you want privacy in this case and second is that you own 10K East that's a lot and you don't want people to know that you own this month this much ether uh because uh you are afraid of being kidnapped or blackmail so you need privacy and here I will give you my definition about two different aspects of privacy there may be more about here in this talk I will only cover this too so the first one is unlinkability the second one is anonymity so only ability is like the example I give you uh previously you don't want people to know that you donate to free SPF and also it's something like you need a clean untraceable one eth it's basically saying that you don't want people to know that where this one it comes from you don't want people to see the sender sends one eth to your account you don't want a link you don't want this link to be seen and for anonymity it's like you don't want people to know that you have 10K if you don't want people to know that you own this asset this asset maybe belongs to an address but you won't you don't want people to know that you control the address okay so our linkability is about breaking the link between sender and receiver anonymity is about hiding the identity of owner of an asset and from now on in my talk I will refer to unlinkability as transfer privacy I know some of you may argue that transfer privacy refers to hiding the transfer information but please bear with me let me use this definition use this name to refer to our linkability if you have any better suggestion for the name for the definition please do reach out to me after the talk and also I'll refer to anonymity as asset privacy and here's one important thing to note is that if you care about asset privacy you care about hiding the identity of the owner of an asset regardless of how you receive or who you receive the essay from or who are going to send the access to those are transfer privacy so I will give you some quick examples to get you familiarize with the definitions I just gave you example one your salary is paid Unchained but you don't want people to see your savings so this is asset privacy you don't want people to see you own this SS example two you're giving an nft for recognition or as a membership proof perhaps the free svf campaign gave you a special MMP after you made a donation but uh you don't want people to see that you have this nft so this is also as a privacy and example three uh say you found a vulnerability of a D5 protocol and want to explode it but you don't want people to see that you found the exploit you don't want people to see that you transfer from your main account to your export account and launch the exploit you don't want people to see the link so this is transfer privacy and example four you want to support a journalist or a campaign by donation but you don't want a government or public to see that you donated you don't want people to see that you transfer to a journalist or campaign you don't want the link to be seen and this is transfer privacy last example if your organization or campaign opens for donation but you don't want people to see how much you receive then this will be asset privacy you don't want people to see that the donation the total amount of donation you receive okay so here's the first takeaway of this talk uh please to know that there are different aspects of function privacy there are transfer privacy and asset privacy transfer privacy is about breaking the link between sender and receiver and asset privacy it's about hiding the identity of the owner of an asset and when you need answering privacy you need to think about what kind of privacy do you want exactly okay that's the first part second is the Privacy tools and here I will briefly go over three uh common privacy tools people are familiar with and I will show you is what kind of Wireless specs or privacy each of these tools achieve so the first one to limit cash is a mixer and it works basically like this people throwing money into this mixer and this mixer is a box protect protected by dark magic like zero knowledge proof nobody can see how it works and he will speed our money to different addresses so since the money is almost up nobody can tell exactly who transfer the money to uh account D account e or F it could be a or b or c nobody knows for sure so that's how basically how mixer works and it's true and it shows transfer privacy because he breaks the link between the sender and the receiver second tool is the state address um at the very high level uh still address works works like this first sender transfers to a new address that only the receiver can control and once he completes the transfer he will inform the receiver about how to get control that's basically how the address works at a very high level so since the sale address the standard transfer money to a new address and nobody knows who controls the address then still address can achieve as a privacy because nobody knows who actually owns asset no who actually owns the money and the third one is Sac Aztec is a privacy layer tool all the information all the transfers there are private this includes standard receiver and amount and since everything is just private Esther can achieve both transfer privacy and asset privacy okay so after the first part you will know that there are different experts to action privacy and for your use case you need to figure out exactly what kind of privacy you need and then you will find the right tools to achieve your privacy uh the true to achieve the Privacy that you want so it's about finding the right tools for your use for your use case okay third part the main topic still address uh so as I mentioned uh that's how still address works at a very high level sender transfer to a new address only receiver can control and informs receiver about how to get control and so only in the center receiver will actually know the address belongs to receiver as shown in this picture uh Alice the sender transfer 100 usdt to a new address that only Bob can control this address and from the point of view of rest of the people they don't know that Bob actually controls this address so they don't know that Bob actually owns this 100 usdt um but let's take a step back um is there any way to do this to do this achieve the CML account that only the sender receiver knows the address belongs to the receiver well some of you might already be thinking is pretty simple just have the receiver generate a new address and give it to the sender right yeah so it works so you're basically worked at this first Bob the receiver will generate a new address for Alice the sender and he will pass the new address to Alice then Alice can complete the transfer by transferring 100 usdt to this new address that Bob just gave him a gave her and for the rest of us for the rest of everyone they still don't know that part actually controls the address but this knife approach has two problems the first one this approach requires interaction before transfer what does it mean say everything works well Alice wants to transfer Bob in a stealthy way so he will ask Bob for a new address and Bob will generate a new address for her to complete the transfer uh it works well but what if Bob is not online or are sleeping then Alice wouldn't get a response then at least wouldn't have to aliens wouldn't be able to complete the transfers this is this is bad especially for the sender and second problem is that the receiver has to keep track all the addresses given out imagine if Bob today is uh is in charge of an organization or campaign opens for donation and for each donor login to his website asking to donate he will generate a new address for the donor or for the request you will generate a new address way to request so you you can imagine that most of the people or some of the people probably are not going to make donation in time maybe they have a problem within the internet or maybe they just go out and run errands and perhaps they will finish the donation in 12 hours uh three days or one week six months nobody knows but Bob does not want to miss out on any chances or receiving the donation so he has to keep track all the addresses you cannot just uh cannot it cannot just delete those addresses from his database he has to look look for it monitor those addresses for as long as he won the donation so this will be a challenge task for receiver so as you can see this naive approach is either bad it's bad for standards user experience is also bad for receiver because it's very costly for receiver or his wallet to manage to monitor all these addresses given out so naive approach has problems and it probably doesn't work and let's get back to still address so still address doesn't have the problem that an iPhone 9 approach does instill address sender transfer to a new address without interaction with receiver view for him this is good and then he will only inform receiver after a transfer so instill address no interaction is required beforehand and receiver does not need to keep track of any addresses because he does not give out any so next I will separate the steps of how steel address work into two phase phase one send the transfer to a new address only receiver can control first sender will generate the random number let's call it r and then from this r on this random number a new key pair can be derived from receiver's key pair and you can see in the left picture Bob has a key pair public key and private key the one on top is publicly the one on the bottom is the private key so the public key will be public information of course and Alice using the random number he just generated along with Bob's Bob's public key he can derive a new public key and this public key is going to be the address that Alice transfers transfers the money to and for Bob he can use his private key in the bottom along with the same random number that L is generated he can derive a new private key and this property is going to be the one that can control the address the ls just transfer the money to so that's basically the core of still address it's very simple even the elite curves cryptography we are familiar with can do the trick it's very simple so after a standard transfer to a new address the only thing left is to inform receiver about this random number and the sender can do it either by sending the random number probably to the receiver press via telegram Twitter or messenger or sender can choose to encrypt the random number and post it to a public to a public bulletin board and this bulletin board can be a contract and all Bob has to do all the receiver has to do is to from time to time go check out the bulletin board see if there's any encrypted render number for him okay so this is uh how basically how easy the steel address works it's very easy it's very simple two steps send the transfer to a new address and send it informs the receiver okay uh here I want to quickly mention a small problem a tricky problem for receiver I will call it the spending fee problem so this problem is basically about when the receiver wants to spend his skilled access still SS the the money he received from the sender he needs to found this still address first he needs to find a way to fund it and if you if the receiver is now being cautious uh he will actually accidentally break the asset privacy guarantee if it decides to transfer ether from his main account from his public account to the sale address then everybody will see these two address are linked then everybody will be able to know that Bob actually controls This Ss then that means Bob actually owns this assets on the 100 usdt so if but if the receiver insists on transferring ether from his main account then he probably has to do it using tornado cache or instead of having receiver uh find a way on his own to fund his STL address you can use some of approaches to make this user's experience better for example the first one is the control and relayer pattern using this pattern the receiver can pay with his distilled assets for example if the sale address is contract and L is the sender will send the money to the sale edge still address contract and saying that only the still address can claim this hundred usdt and of course the the address is controlled by Bob and when Bob wants to expand the assets he will have the relayer relayer third body relayer he can have the relay carry approved on Trend to the sale address and once the address verifies the ownership then he can approve the transfer and he will first stand out for example five usdt to the relayer sfe and the rest will go to the design designated receiver maybe Carol so in this case receiver is the one that's paying for The Ether paying for the minor fee and Bob the receiver can pay the relay with his still assets the usdt and now that we have account adaptation in place we can also do it with account abstraction Alice the sender can just transfer the money to an account abstraction contract that Bob has control over and when Bob wants to spend the money he would send the proof to pay Master payment Master this is basically the same as the relayer and you have the pen Master carry approved function to the area contract to execute and a country will verify the ownership proof and then he will transfer the five-year City to paymaster and the rest will go to the designated receiver okay so the spending fee problem is actually not part of the still address design there is no rule in the sales address saying that how receivers should fund is still address is complete the choice of the implementer okay we've mentioned the benefits of Steel address and of course there are some downsides to it so the main problem the main downside of their address is that every steel address user has to scan over all the transfer still addresses are still transfers in the history and try to decrypt the encrypted random number to see if the random number is for him and you cannot get away with it because all the random number is encrypted you cannot tell if this transfer if this random number is for you by simply looking at it you have to try and decrypt it yourself so uh second take away of this talk is important still address achieves as a privacy not transfer privacy for example if the sender don't want people to see him transferring to receiver then sender should use turnar cash to transfer some of you might be thinking that since this new address nobody knows who really owns this new address why does the standard why does Alice even bother to transfer using to internet cache uh well that's true the Privacy guarantee holds until the receiver decides to spend the money if the if the receiver if Bob is now being careful enough he'll accidentally break in the transfer privacy of Alice if they transfer the money back to his main account then everybody will know that La is actually transfers to Bob and that's not what what is wrong so if you care about if you want to protect your transfer privacy on your own instead of relying on receiver being cautious or smart then you should transfer you should protect your own transfer privacy by using internet cache and it also applies to when the receiver wants to spend his asset if the receiver don't want people to see how he spends the stealth assets receivers should use terminal cash to transfer like here he will transfer from his new address using internet cash to whoever the receiver is so again uh important takeaway still address achieves as a privacy only not transfer privacy okay some challenges first one scanning as I mentioned everybody every user has to scan over all the transfer history and you will for every transfer you have to first derive a sure secret this is the sure secret between sender and receiver is used for the encryption and after you get a shared secret he will apply some Elite curves operation on top to see if the resulting address is the still address that the sender transfer money to if the address doesn't match that means the transfer is not for him luckily there are some improvements made to alleviate this scanning performance issue it's called viewtech and with viewtag you only have to derive sure secret and hash the share secret and compare it with a hashed value provided by standard if the value match that means the transfer is probably for you if it doesn't match that means the transfer is not for you and the Second Challenge is that still address do not work well with social recovery for those of you who doesn't know what social recovery is is basically a mechanism for you to for your Smart Country wallet to recover your private key in case you lost your private key so why does it work well with social recovery is because still address works by deriving a new key from an old one while social recovery works by replacing the key with a new one so it's basically not compatible not quite compatible with each other there are some tricks you can apply to make it work but there are some limitations and complexity issues to that approach okay so as far as summary it's not just privacy there are different aspects of engine privacy there are transfer privacy and asset privacy transfer privacy is about breaking the link between sender and receiver asset privacy is about hiding the identity of the owner of an asset and once you figure out different aspects of privacy you have to for your use case think about what kind of privacy you want and pick the right tools for your use case there are tornado cache which protects transfer privacy still address which protects asset privacy their asset which provides maybe full privacy and still address achieves only asset privacy not transfer privacy and finally here are some links to the material I covered today uh I highly encourage to read them the first one is guitar Exposed on sale address which is very informative the second one is the EIP for sale address and the third one is the Umbra protocol it's one of the earliest projects that I know of implements the idea of still address on ethereum is contrast and tests are well written and it has been better tested for more than two years and for the spending fee problem he used the contract and relay pattern to solve the to solve the spending fee problem just like toenail cash and the fourth the last project the Euro project this is a Shameless plug this is the project me and my colleagues develop at Tokyo and it implements uh still address and it solves as many fee problem by using the contract and expression pattern and we are integrating with EMS and social apps like telegram Twitter and social depths like dance to make the sending and receiving easier and we also working on to make it an SDK for easier World integration and overall the goal of the project is to make social payments social privacy payment easier questions [Music] so you mentioned for the transfer privacy that you would usually use something like a mixer like tornado cash in order to kind of move those funds or de-link them from with that transfer privacy between stealth accounts one problem with that might be though that those funds would be like marked or tainted for example if someone eventually wanted to take those funds and move them into a centralized exchange or use them in a more traditional Financial likes case so that may like that chain of custody for those specific tokens could be figured out and it may be refused by certain entities is there a way to work around that or another approach you might be able to take to um like handle that right now or is that just kind of a limitation of like more centralized entities like governments or Banks uh black listing uh or deny listing like certain chains of token custody um do you mean that uh if the money flow through a centralized entity and it's been tainted so like yeah just like an example let's say I go through tornado cash to fund a uh to send to eventually a stealth address so I basically burned from like say for the US government I've now burned that crypto wallet um and I can't use that with like say coinbase now in those funds that came out of tornado cash I'm going to send that to someone else at their stealth address that person then wants to take from that stealth address and go to say another exchange or you know something like that they're not going to be able to pull it out because they can see through that chain that at some point those tokens touched tornado cash yeah so is there another approach you might be able to take to have that transfer privacy um without going through something like tornado cash um I think standing through Aztec my help eventually if the governments also deem also C Aztec as a as a threat he will also probably apply the same sanction or Benny mechanics on top so from my point of view I I don't think there's like any practical solution to get around with this okay thank you question uh oh uh I'm sorry that I didn't get the uh the idea behind uh why does Bob need to scan over all the steals transfer history in the previous slide you just say Alice could send secret r value privately to Bob so the Bob has known that what exactly are it so uh why does Bob need to scan over all the transfer history um yeah that's a good question uh it's basically the difference between I will call maybe centralized and decentralized approach in a centralized approach you just stand this random value random number privately to the receiver but this you will rely this service uh this guarantee of payment or receiving the payment is depend now depends on the tools the channel communication tools you use to pass this value and if the communication tools fails then you will probably lose your money and the decentralized approach will be to post all this information on channel but the downside will of course be that you have to everyone will have to scan over all the one question in one slide you had the example of where the user generated the stealth address received funds from Alice and then immediately withdraw to his own address to show us an example how how that would break transfer privacy but just just to be clear in that sense it wouldn't make sense even even if you if you use tornado cash on those pool those two transactions it wouldn't make sense to use the stealth address in the first place right because you could just immediately do like a tornado cash transfer from from Alice to Bob the stealth address makes only sense if you use it to actually hold tokens longer instead of just a way to Route assets right or tomorrow maybe um maybe we can check later at the top oh okay yeah sorry about that okay so time is up so thanks link for his presentation he will present the impact of a chain force and Rios on Cross Chain Bridge