The Hard Kind of Censorship Resistance | Eric Tung - Mel Systems

[Music] hi hi um the topic of my talk is the hard kind of censorship resistance so who am I my name is Eric and I am the Creator and maintainer of GE an open source circumvention tool so a circumvention tool you can think of it as a VPN for places like China that actually have a lot of technology to block vpns so it's like an adversarial VPN it has more than 500k daily users mostly from places like Iran and China where other VN don't work for the past few years I've also been working on Mel which is a new um Clean Slate blockchain optimized to interoperate with offchain code through L clients that's some with a mouthful but the idea is that it's a blockchain designed to be consumed through light clients by offchain code and give their security to opin code and not primarily be consumed by smart contracts so this talk will have two overall Parts first I want to talk about two different kinds of censorship resistance there's the kind that we always talk about in crypto but there's also a much trickier to solve kind that I will want to call band resistance and then we'll also look at how can we make web 3 band resistance which turns out to be a lot harder than doing it in traditional systems like vpns so usually in web 3 when we talk about censorship resistance we mean something like the protocol can't discriminate against particular use cases right like you can't co-opt ethereum to freeze accounts taint coins or damage the blockchain's neutrality at least we hope we can't right that's what we say when we say we want ethereum to be censorship resistant um and this is the usual sense that we use the word in the crypto web 3 world we mean a property of the protocol that its in Integrity is protected that it's um everything inside it is fungible and we actually know how to solve this pretty well the nice thing is that decentralization plus encryption is pretty much a silver bullet for this sort of thing you know decentralization means there's no central point of control hopefully um and privacy techniques such as ZKA things and encryption uh reduce visibility by these nodes Etc in into actually what users are doing and the idea is that you can't censor transactions if you can't even know what's going on on the blockchain but there's actually a completely different kind of sensorship resistance that's also really important which is actually a more common notion of the word sensorship resistance in the Privacy tools and censorship circumvention tools space which I'm also very familiar with uh this kind of sensorship resistance means that the entire protocol resist censorship that denies usage of the protocol so to use that ethereum as an example we're not talking about nodes censoring transactions or validator censoring some smart contract we're talking about nation states and isps shutting down or blocking access to let's say all of ethereum traffic and so for clarity just so that it's not confusing I'll call this kind of censorship resistance ban resistance since it's resistance against Banning the protocol itself self and there's a whole area of research into this producing tools like you know tour plugable transports uh stenography Etc uh but the interesting thing is that a ban resistance is not actually a common goal in web 3 projects um even the most like privacy focused web 3 projects are easily blocked in places like China and that's very unfortunate because a large fraction of Internet users actually use networks where ban resistance is important and perhaps even more important than our usual notion of censorship resistance and these adversaries are really common like China like Iran like Russia Etc and they use these Powers a lot to interfere with new protocols so how do we actually achieve ban resistance um well the first thing to know is that it's actually possible there's always there is this common misconception that uh if you want your thing to work in China it's just like a security by obscurity game and you can't defeat the Chinese firewall that's not true um we actually have good methods of achieving strong band resistance however they are all rather imperfect as they're it's definitely not as mature as our solutions for sensorship resistance and the worst thing about this is that um all the current methods are hoplessly centralized and this is really scary because we actually want B resistance for decentralized stops uh it's a little hard to explain what I mean by hopelessly centralized so let's just look at a concrete example um which is which is the usual way state-of-the-art circumvention tools sensorship resistant VPN basically how do they work that includes tor's snowflake project that includes my own Project G and includes other projects like Lantern they basically all follow this architecture uh I don't think there's a kind of name for this architecture or design pattern so I'm just call it going to call it snowflake style bootstrapping but the way this works is that we first have a broker and um what a broker is that it's a central server that's accessible through a transfer protocol that has a property known as collateral Freedom uh what does collateral freedom mean is it means that if you want to block that service you have to block a lot of other innocent services and cause a lot of collateral damage so one example would be let's say you have a GitHub repo and you uh push code to that repo to upload it to the server and and you pull code from that repo to download it from the server and the server is on the other side looking at the same repo in this case you know uh it's really hard to block access to the server without blocking access to GitHub which will ruin a lot of other people's days and the interesting thing is that this meth the broker can doesn't need to be very fast right this transport can be really clunky and difficult to use but the idea is that we now have this unblockable broker that cannot be blocked without massive collateral damage uh the broker then gives different users different proxy servers or VPN servers or whatever nodes you want and this means that if you're the bad guy you can't just talk to the broker get the list of all the servers and block everything the list of servers you get will be the different list of server from will be different from the list of the servers that your victim gets so you're only going to be blocking yourself not anybody else and finally the users connect to these proxies with ob fiscated protocols um what this really what this just means is that if you you're the bad guy and you are the ISP simply by looking at the packets you cannot detect that let's say this looks like tour so you can't block the central bootstrapping point you can't list the servers and you also can't know like can't detect the traffic by their protocol signature and that thus you have band resistance this is like an illustration from tor's website on how snowflake works with you know the broker the client in the little bubble which like is like ch basically and getting um a list of snowflake proxies and then using those to get to the destination now just from that description we already see this is like inherently centralized in web 3 Inc compatible so to speak while the broker first of all has to be trusted it knows everything it can betray everybody to the sensor and not only is that the case we also rely on external web 2 uh services like GitHub for collateral Freedom the idea is that you have things like GitHub that one they're too big to block and two they're actually not under the control of the sensor so the sensor cannot tell GitHub to block this repo and this is something that's true for China and Iran that's not generally true um this is a very like specific case that sometimes happens and overall this is very much not in alignment with web 3 goals of trustless we don't want to like just imagine that the world outside of China is trusted and we can just trust GitHub and Amazon or whatever so so far we have a pretty bleak pck uh P picture we see that sensorship resistance against protocal internal discrimination the usual sense we use the word is achievable through decentralization cryptography lots of projects do this pretty well but censorship resistance against Banning the protocol is really hard to reconcile with decentralization and we looked at a specific example to see how difficult that is but actually making centralized decentralized networks band resistance is really important because you know when we talk about censorship resistant web 3 um we really mean stuff like user autonomy economic freedom Etc but all these things mean nothing if the system that supports it the access to that system can be arbitrarily denied to people and more interestingly threats of banning a protocol can also subvert internal censorship resistance like the one we usually talk about in web 3 what if somebody says to a project please remove your privacy features or we will unlist you from exchanges or will block all your traffic from China then perhaps the internal censorship resistance of that protocol is not that secure either so how can we build a decentralized system that has a band resistance well my first idea was can we build decentralized collateral Freedom can we make a decentralized protocol have the sort of social dynamics of something like GitHub or Amazon cloudfront where blocking this one protocol means breaking a ton of innocent apps um this initially sounds really attractive right because first of all we all want popularity and mass adoption of web 3 here it doesn't it actually helps band resistance rather than conflicting with it we don't need to stay under the radar and even if this one protocol is super slow and clunky let's say only Bitcoin makes this maybe we can bootstrap from this like we do in Snowflake and get like composable band resistance for everybody else the unfortunate thing is that I don't think this is likely to work um there are two main problems first of all is that yes maybe if Bitcoin really makes it and like every single uh government uh thinks that it cannot ban Bitcoin sure but how do you get to that scale without somebody killing you while you're still growing and the other more subtle point is that for a lot of protocols like cryptocurrency protocols the sensor can block the good part of the protocol that's actually sensorship resistant while minimizing collateral damage let's say you have a world where you still can use ethereum but you have to use custodial wallets you have to use approved rpcs and something like the great firewall of China make sure that you this is enforced by Banning other traffic off the internet and well in that case the collateral damage would actually be pretty small and most of the ecosystem would still work except the few things that the sensor doesn't likes so instead of um collateral freedom I decided to go another Direction which is decentralized information asymmetry uh remember back in the snowflake design we had this broker that gave every person different servers can we we replicate this every user sees different service part of snowflake in a decentralized network and the really interesting thing is that if you have a invite only peer-to-peer Network that is possible um so just as a very toy like simple toy example imagine every user connected to a few friends using OB fiscated protocols so you can't detect these connections by looking at the packets and we actually have pretty mature technology for doing this and users only know their friends in the protocol they cannot ask their friends to tell them about their friends and they never learn anything more about the network users can only join by invite being invited by people and then messages can be broadcasted with gossip so you have a topology something like this where every node has a few friend neighbors but if you're the green node there this is all you ever get to know about the network so even if you are evil um you can only blocklist those three nodes um and your dad the damage you can cause to the rest of the network by cooperating with a sensor is very limited and this is really ban resistance because sensors can't find nodes by looking at packets and sensors can also not enumerate like yeah I I the nodes right that's the the name of a project I was working on but you can't enumerate the noes because you can only see the immediate neighbors and you have to fool every node to manually friend you for you to block them so this is enough to run broadcast networks like blockchains that this is already quite interesting this design Al although there are obviously two problems you know broadcast doesn't let you run most interesting things it pretty much only lets you run blockchains uh it's very inefficient for stuff like actually talking to a web server also incentives and scaling right like imagine you're in this friendto friend Network there's no reason why you would add more friends because all you're doing is increasing the chance that you give your information way to somebody you don't trust who works with the sensors and then you get kicked off the network in China um so you have this incentive problem where everybody's interest is in not growing the network and this obviously doesn't scale and um so how can we extend this to a general purpose Network it actually turns out that it's possible to do so you can actually efficiently route two-way communication not just gossip the solution is that you can actually gossip a global routing table without the IP addresses of the notes uh so that you every note has a good picture of where to send package to get to that particular node you you can also add Nim like mixet features to improve privacy and actually improve like Network internal censorship resistance the first kind we talk about you want the nodes in the network not to be able to censor each other and most importantly you can actually add incentives uh you can incentivize nodes to actually find and maintain puring relationships with trustworthy friends and this makes scaling possible if I know somebody who where the profit I get from peering with that person on the network is greater than the potential loss from that person actually working with the government and blocking me then I will actually be incentivized to grow the network so I am actually working on such a general purpose band resistance Network layer called a rendle from a character in tolken Legend area um um so what is an air rendle it's the it's an experimental peer-to-peer communication protocol designed to be the first strongly band resistant decentralized Network so it uses this sort of friend-to-friend information asymmetry system that I discussed it has privacy goals similar to Nim or ITP it has an API similar to the Internet so you have addresses you send packets through other addresses and it has a really simple incentive system based on if you send traffic you just pay your immediate friend who handles the traffic this is inspired by how you pay for bandwidth on the internet you pay your ISP and your ISP pays their isps and this is also a foundational protocol in the larger project where I'm which I'm working on which is called Mel um so Mel is a blockchain but part of the Mel vision is that the composability happens off chain not onchain and you want this ecosystem of composable network protocols that Jud iously use blockchain like clients to secure themselves and they don't run on the blockchain so in a rendel's case we just use the blockchain for incentives and anti-spam and there are no like smart contracts other than that and a rendal mean is composable with any network app that needs band resistance because it has the API of the Internet it's not really like a Mel ecosystem project because the that doesn't really exist uh the Mel project is really about building building blocks that any internet internet app can compose with so the current status of a rendle is that it's open source it's an early public Alpha most things other than the incentive system are done we already have a few dozen volunteer nodes a lot of them actually come from places like China and Iran and the aisc does work the traffic is still flowing we eventually want to integrate air rendal as a backend to my other project gu which is a currently centralized circumvention tool with a large user base and we want this to be a kind of experiment to deploy the first large scale peer-to-peer Network that's dark and band resistance to ISP level sensors and I we also want air rendle to not just be like this project that me and my small team and at Mel works on we want it to be something that has a lot of community community input because it's such a composable piece it has the API of the internet so you can find our Docs at docs. ar. Network and you might want to help out if you're interested in anything related to protocol aisc mix Nets payment channels or state channels or anything related to decentralized networks and band resistance so yeah um that's our website and GitHub and Discord and thank you guys for coming to my talk uh I'll be around if you have any questions thanks so much