Crest | Mobile-First Privacy on Bitcoin: How Crest Implements Privacy - Berat YILMAZ | Common S3nse

[music] uh yeah so why do we build crest uh and that's because uh bitcoin users have no privacy uh by default at least on the L1 and there the existing privacy solutions on bitcoin are not really usable at least at scale and we also have this belief of the privacy applications on crypto cannot gain adoption by ignoring Bitcoin uh because it's the most uh held crypto asset uh that shows we think uh that people have a preference for it and it's the since it's the most held crypto asset we also think it's the most surveiled one as well so uh we think the privacy applications shouldn't ignore Bitcoin And we also think a privacy application shouldn't be just for the technical people since everyone has a right to privacy. Uh so it should be they should be built for everyone. Uh and that's uh what's been motivating us at Crest and uh it it's uh really motivated by two problems. Uh the first problem is that Bitcoin's privacy problem since it's a public ledger. any action you do, any transaction you do on bitcoin is publicly readable by the other others and the way this is done is by uh some called chain analysis heristics.

I want to give an example here. So imagine you have a you have a bitcoin transaction and it has multiple inputs and an outside observer can say that probably the multiple inputs are coming from the same user and also uh also imagine another transaction that has two outputs. One of the outputs is uh is a round number say 05 bitcoin and the other one has decimal places in it. So probably the decimal one is the change and the the round number is a payment. So you can link the change to the original UTX.

So and you can say these probably belong to the same user. So you can uh by this sort of analysis you can do uh some the anonymization attacks on people. So uh and to combat this bitcoin users have a few options. They can swap their bitcoins into a privacy coin. they can sell their Bitcoin for Zcash or Monero but uh that's most most of them don't want that because they want to keep holding Bitcoin.

They want to stay in the Bitcoin ecosystem or they can uh do some manual manual UTXO management work. They can sing uh they can manage each single UTXO and try not to uh link uh ones coming from different sources by labeling them. uh they can separate the sources but this is uh a resource intensive work either you spend your time if you're using some specialized software you are using your battery and even then even if you take all the measures uh if you do everything right and you do a single mistake one day then you are anonymized so this is not an ideal solution either solution is to use a centralized mixer so you basically send your bitcoins to an entity and some other people do as well. And then they mix it uh they put it in a a single wallet, let's say, and they then they give it back to you to a fresh address of you some time period later. So the link between your initial deposit and your withdrawal is broken.

Uh but that's also a problem because you are sacrificing the custody of your bitcoins. Uh so they can do all sorts of things with it. they can steal your bitcoins. So that's not preferable either for most of the users. The second problem is that the existing privacy solutions are not really usable.

They can have complicated to exist. They might be hard to use for most of the people. Uh if there are zk solutions, they may have long proving times. Uh that can also hinder usability because you need to wait for your transaction to go through. uh in some cases they can require some domain expertise uh it can require you to use a CLI uh which is also not good for most of the people needing privacy right and the last uh problem with them is that they can have frequent transaction failures and I need to give an example here the most common method of native privacy on bitcoin coin joins coin joins suffer from this and the way they work is that uh a group of users put their uh inputs together uh and they also send encrypted outputs to a coordinator entity and this coordinator entity assembles uh these in inputs and encrypted outputs together into a single bitcoin transaction.

So the problem is that uh this is a single transaction and it needs to be sent at some point of time. So if you wait long enough uh then you suffer the problem of what if someone spends the bitcoin they committed into this transaction and then everybody needs to start over which results in a transaction failure and if you wait if you don't wait enough while sending this transaction then your anonymity set is limited to the narrow amount of people you gathered in let's say one day. So uh if you compare this to a shielded pool on Ethereum uh you can see that it's an inferior solution even though it also uh does the same purpose of mixing. So our proposed solution to these problems is that uh you take a shielded pool as ek privacy pool and put that on top of an execution environment that can run it. So not Bitcoin uh because Bitcoin cannot run a shielded pool.

It has no smart contracts. It has no programmability. Uh but you can have an let's say an AVM execution environment and make it as close as possible to Bitcoin. You can have so you can have a Bitcoin L2 and then it's Bitcoin secured and you can have a trust minimized bridge to Bitcoin, a nice bridge, not a multisig one like uh WBTC uses on Ethereum. And you can then deliver this combination through a a usable easy to use mobile wallets to achieve our goals and solve these problems.

That's our solution. So for us this looks like uh putting a privacy pool on top of Citria and Citria is a Bitcoin L2. Uh the important uh feature of [clears throat] Citria for us in this case is that its native token uh is CBTC and CBTC is like uh it's one to one in Bitcoin to in value but it has the programmability capabilities of ETH since it's the gas token of an AVM chain and the way it's uh minted is through a trust minimized bridge. So it is better than the other existing bitcoin merging solutions to the EVM chains. Uh so this is a good combination to have a privacy pool on top of uh there there is some uh other features of crest.

Of course we are generating all the necessary zk proofs for the privacy pool function in on device. Uh the app sends the proofs to a smart contract on Citria and it works the same way as as a as a cache for the privacy pools. Uh and of course it has all the underlying privacy provider has all the necessary circuits for the actions you can take. Uh we do not run our own privacy pool. We will be using a provider for that on then they will deploy on but I cannot say who yet.

But it's a it's a respected privacy provider and on top of that uh we also have the feature of compliant compliant privacy in the form of proof of innocence proofs. So if you don't know the proof of innocence is when you deposit into a shielded pool and you can prove that you do not belong to a set of malicious addresses without revealing you who you are. So you can prove that you're not a you're not sanctioned, you're not a terrorist. Uh and you don't need to reveal who you are. Um Crest supports the this style of proofs and it's required uh if you want if you want to use Crest basically and a fun fact here is that the proof of innocence was coined by the same team developing Citroya back in 2022.

Um another important mechanism also natively supported by crest with an ICUX is rage quit mechanism. So for this proof of innocence proofs to work in practice you need to you need a service provider basically to provide these proofs to users and then there's the problems problem of what if this service provider do not serve this proof to any an innocent user uh uh just to censor them. So it shouldn't become an an entity that can freeze your funds basically. So there's this lequit mechanism. It doesn't give you any privacy but you can at least withdraw back to the original owner that of that deposit.

Uh so this proof do not turn into a a trap for the users. Let's say there is also uh of course all the keys uh private keys also the ving keys do not move into any third parties it's fully local on device and you do not need to generate these proofs every time you do a private transfer. It's just uh done on the first initial deposit and all the people in that line that you privately transfer to can also use that proof and yeah our goal is to bring privit privacy to everyone to democratize it. Uh so we allow on boarding from bitcoin from lightning from ethereum easily. Uh also we have this feature of auto shielding.

So in crest you have two wallets uh one public wallet and a one private wallet. Your public wallet is just a stray address. Uh it's a regular EVM account. Uh so whenever you make a [clears throat] deposit it comes first to your public address but app automatically shields it. Uh so it does a transaction uh by depositing your funds to a private pool.

So you instantly gain the necessary privacy uh without doing anything and all the proofs are generated really quickly. So it doesn't really different any from any uh self custodial wallets even though it has all these privacy features behind and you don't of course need to know anything any domain expertise or you don't need to uh manage your tech so no manual management either. Uh the app does it for you. And so here is the receive page. As you can see, you can receive your funds in form of uh private payments from another Quest user.

You can come from Bitcoin, you can come from Lightning and also Ethereum. Uh so yes, uh we are launching soon. If you're interested in crest, uh you can join us. You can join our weight list here and you can follow us on X. Uh thank you.

If you have any questions, I can take them. Okay. Thank you.