Barry WhiteHat | Private communication with stake based rate limiting | CrossLink Taipei 2019

okay it's okay okay so thanks for coming to the talk today I'm gonna talk about private communication with state pacemaker so so what we so basically what we wanted to here's everything it's private but it's also the auspices so let me sort of get into an alliance clay let's get to the point so when we use popular movies in general we have to communicate challenging because when you use it it comes easy to come instead to these people to sentence or communications it's also possible for users if you try to use it makes it easier to sentence so these are kind of problems that are things that we need to be careful so let's take see how it works them what's a few drawbacks either so what I got is who here is you store before it oh yes basically I think that's kind of it so always like mission but there's some major problems with tour for example there is if you use tour a lot you you probably see this view here where you want to go through a website and the reason for this is that because I didn't get to it or that he used for towards become like kind of abuse because people use it to for example set up millions and billions of team investments or upload a lot of videos to you and what is it towards but slow and it's really very annoying to have to deal with with this gonna capture all the time to the point where people don't really use toy or it just it just hurts so one idea that okay why can't we use used word with you today to give like no bikes to do in accounts so one of the reasons are is that is that in the in the current situation if you receive the transit if you see look like invalid information or a big dogs attack you know exactly because every time you receive a message you know we're capable I mean if that process is kind of abusing the system or or trying to to sell you too many transactions or selling you acknowledge reductions it since the ignore them if you simply stop responding to requests and refuse to send them information but that's not the case with this kind of private I didn't write because when you see the message you don't know where it came from dad you you know which person it came from you don't know which node because of that it becomes difficult to kind of have great ability to say oh I only want to see one message per second very useful so these communications but we also want have this like strong really so if these dos attacks or spawned attacks where were kind of a little bit more resistant to that okay so let's look at it I like an example that already exists so one example of a dart resistant to privacy mechanism is whisper it's basically what whisper whisper works is that every time you create a message great like a proof-of-work did you provide that loop important with your message when the point when I receive your message I first validating for the proof of work is invalid I know your message about acceptance is video so they may be how these kind of apply we have this kind of liminal second because we have limited computational power that's difficult so we have a limited number message so you can see so like what kind of weird example of how this could be using your wife is that yeah and you would presumably receive less communications because you put this living on the people that but there's a problem for example if you put this like I could live it up people they could be just good at people's feet you a lot more the people who worked and similarly this works with computational right because and this computational power can be like beat or I think it's similar company one when aw a second I can pay a huge so okay so we don't have to work will work so let's try a Dooku mistake because we didn't come up with this mechanism word so what we do so we make a smack on tacitly saying okay everyone who wants to say yes to what suddenly positively yeah become a list of all the people it's every time someone says the message they sign them as they can they send it to two more person and if I receive two messages from the same person for the same in the same people so every time someone said a message they say this is for a party and if they have actually so excited they sign that if I receive imagine I received two messages from two different messages from a single user the same unique mark I guess I can remove their deposit so basically right but the problem here it is it is pretty fast because we are so we just completely lose our privacy but we have this kind of strong guarantees and if someone abuses the system we can kind of parent that in some way you can okay so let's try it out - ethers for staying basis nothing happened for so basically what we do time privacy's we use we use something but you use a zero knowledge proof so lazy or not it's a way to prove that you operation or whole deserving children but I would be like all that potential ease so basically what we do is we aspire contract for people to process money a public key that they're going to use to sign their transactions they define they find a special public in other words inside there is a logical insiders garage so basically we make this group of several more people do the same thing again inside the sign the messages so for every epoch which we defined as this external modifier use this kind of kind of funny messenger signal and they put these two things as an input to attack inside this they prove that they know a public key that route they reveal and something called so in this case the developer is like the hash of the private key on the external so each so because so let me do an example this is kind of like the hardest few slides all the talking and it'll get a little bit easier in that's so so let's just do an example okay so we have and each user can create as your knowledge proof and this is your piece of information okay so let's see here for two epochs okay so a teapot change the expert modifier from yeah so we the first epoch has three messages second it has a single message okay so here are the messages that that the user said we don't know which user sends messages but we do we know that what you do send messages but we have a strong guarantee that one of the demon Eric groups and so the first message is hello so someone's headed hello they calculated which happens to be the more communities true and they reveal their external so he's someone I admire is like you need to every user Percy yeah so every epoch everybody to do its typical the fire but do you really a teapot you can only reveal it okay so it's like like a receipt or a unique ID that changes that's probably a better explanation we have a city to interchange so if you look at the external parts you see that is for external parts but we have to is another part of that as I say so what is what we know based on Eastern otherwise in you say yes exactly exactly so they're coming from the same user right because we have these nullifiers that are our unique perky buck we know that some user has broken our guarantees and someone is a double double send any message this is kind of what we want to do in seconds yeah instead of using signatures before that we use Nellie's is going to external fires knowledge that was the video to understand so that's going ok so just just you can parlay the same okay we have this way of proving the group without revealing who you are we have it's like obtainable obtainable Lola fire that every every time you pop so so all together so I think that is more then there's no that just use it as a reference this works only part I can receive messages and I know one sending two messages and ignore that but it is two people and they were packets much more because every time i received i have to share with the other person because they so so this is to prevent like double there's no way we do this is we need to reveal there so what we do is that when we have our stag we will thereby McKean we reveal of their panic yeah yeah I can punish that so so maybe more than two messages or more than like it's okay to reveal a piece of a secret if we in such a way I reveal one piece I don't have any information but if I reveal two pieces I can totally reconstruct the secret now this is not an interesting tool that we can use so this is work so basically what we do hope you like the idea that you could reconstruct the public weal if you have optically and if you have n minus one you have n minus 1 points you could you can do meter interpolation and so what we do is we put the secret as a single coefficient of this polynomial and then we randomly set movers rowlett arrest yeah and then what we do is we calculate points on this polynomial and give them to people in sugars and simple and calculate the secret and if they get one there is no they have no information okay so this is like some kind of explore later what did you think I can only do what we're going to use in order to build a whole system ok so what we do so what we do is we construct this Shamir sequence Erik shared root so basically we we calculate about to seriously purchased I mean we kind of mean we put them into a purple route yeah and we movie yeah we reveal a network of food and we reveal that logic ok so now we still don't have information we have a list of the secrets that we have like diseases that exist we don't know what I do know secrets are so what we do instead yeah yeah Ashley a secret share and here is polarizing in the signature okay so if we go through we see that we have two new lines that are the same again so from before we know that that means the one is that two signals okay so now we have a way to punish them what we do is we check out their secret they will be learning so they'll reveal its secrets this is an opportunity to instruct their pilot from that we can go to the spread contract we can stash them so now it's a base you can touch them okay yeah so let's just go through exactly what I happened what what I do when I receive a message first thing I do is I check that snack-food was holiday then I checked diet we we've not received the same message before it because if you receive the same message twice it doesn't reveal a separate secret then we check the markup on the cheek area and if all that works out we accept we don't have to share this with anyone else but we can just what we can do is we can say I receive this message and if it's a sales message I can sack them in the future I can find I can just I don't have to store it for a month Oh it was okay so that side so conclusions so we can make like this privately to be twins with strong remedy requires using their knowledge groups we do we don't necessarily have to start every user every time they come on every time they need the whole set that's it but we can do that at once it's just I mean still ask them probabilistic standing as I said that they might get slashed also there's a whole bunch that were interested may be interested in collaborating with people on so when people have other ideas if I see stuff okay so everything works well but one thing that would be nice to be able to receive events or processing messages because if I'm part of the network I'm sending it equals messages for them I wouldn't be able to receive the payments yeah they say I'm sending message for me to this person do something called limits so probably it's basically works popular if we're thinking this instead of second it's gonna be paying you $1 I pay you $100 I give you $100 one of the little types and these two things are the same I mean dude is a mr. Chancellor but any Sables more dog that pays almost okay yeah so what we do is we use this Villa fire as like this for this and then we have a legatee awkward people commit it so every time I get a message it's like a probabilistic lyrics and then at the end of every we have this lottery system we tab into private number we say that okay we're going to pay people who have eczema all the parts that are sufficient to prove the state was quality and access to like computation in your hash power uses are issued with an equality and state distribution and with that like how many applications here oh yeah I got surprised but this is different because with the proof of stake in each animal you need to have like you get words they proportional to how much sticking out but in this situation we could have like you can put down one dollar in its crew and then you have this kind of strong guarantees about rate limiting and you also and you also don't need to you know you know we don't have to have like you can send more messages because you're producing I guess people get into problems in the future if we had like huge networks we wanted to have like a granular limitations then I guess you can just add yeah yep because this relies upon singing engine so you need to know about the current state of the chain you need to know about the whose state and balance of state and slash like slashing status and things like that do you see any issues with using this or they are one bit the way like say you want you want to privately they consensus messages you need to be syncs okay there's any sort of circular issues that are out there well one thing we get to do is we could we can say that okay you could have like dot syntax in the short term but in the longer term go get slashed so we can say that okay you will have like I'll start to ignore you as in the siding as soon as soon as you 72 messages we can switch your private key and I'll be able to tell all the future of messages you all said and I'll also be able to have all the previous messages you've sent it and then what I can do is have like a sort of a soft pork and I'll just think more your messages until I have a chance to statue this my contact and we could even go a step further and say that okay and then I would share those messages with everyone else I would share with all my peers I would say oh this user broke the rules to use their public key is their private key don't listen to them so we could we kind of got a casa fits with the network nice form a small question in big major question so the small version is just like a bit of a technicality with what happens with some of these sends like the exact same message repeatedly committing Hockley was it that's only fun okay so you can tell me the same that's usually twenty times but it wouldn't reveal any new nullifier stuff when people just a call right thing like that not me because we because we're doing this in a peer-to-peer network kind of you kind of assume you're gonna receive the same message another promise the next bigger question is how do you envision groups for me I mean the opposite situation but like yeah you don't need very much stake to participate but like you could be you could be in the group like 50 times it's bit more sting rays and I mean that's part of how should we remember two days if you get the other in order to tell or how it might be used in a particular situation okay yeah so there's a few like applications that we can do this for one application is to sort of as like a universal login and you can like login your limit in the web times so the obvious kind of where to application would be like money so he can anonymously not entity began said even the media wouldn't know who logged into how many different accounts so that one use case event only there's like so the style is kind of use case where you want like whisper with saying just send a bunch of messages that's a use case it's interesting so if people want to join the group more than one time that seems to be that's interesting so one thing we can do is if we implement the kind of payment mechanism we could have a system where when more people join more people are incentivized to participate at transfer messages that's one thing that we could do another thing I suppose that that's a that you have to accept I you have to accept people coming forward and saying I want to join water and then the next question is - what if someone comes along and says oh I got a joint a million times that I notice it easily exactly the rate limiting and I'm not going and I'm gonna toss the system that way a million dollars in a million messages per second I'm gonna use that maliciously so one thing we could do to limit either to burn a portion of that but it's still include that in your in your kind of over colors of jeans that you have adults attacking it cost you school and I guess that's the kind of difference between the previous and the current mechanism really / it will stake mechanisms your rate limited to the messages that you can send because you can be slashed but this essentially adds the flavor packs which so just by posting a state like you you have stated risk and you're limited to the amount of allotted messages you can send every buck but now if we have to go a layer of practice it kind of I was more thinking about using before like peer to peer rate limiting I just I know you're talking right before like who puts save messages right way to put these two also it would rather talk at with the students they can bury so I do have one small question which is we can see various types of mixed networks that coming out and I think there are different ways to implementing an ALICE network either optional munching so I'm obviously using a proper state launching right like so we can have a sort of a smack on track and it could actually be implemented on any project and I wondering what's your opinion on those solutions that do anonymous network like object so it's the almost network it is impossible to be turbidity and then in the India sort of their basic networking module likely to be I was opinion that without me get a good solution I'm not really sure I suppose I'm sort of trying to its billing on wait yeah everybody else get very they can [Applause] you