EthCC 2: Dr Sebastian Bürgel

hello everyone and sorry to keep you for me a lunch break for a little bit further and I would like to introduce you to our work that we did at validity labs on decentralized messaging beyond whisper so my name is sebastian and i'm co-founder and CTO of validity labs we're blockchain development company based in sook and in switzerland and this is one of the i would say most exciting projects that we're working on right now yeah and with this i would like to start actually the title of my talk is a love story right about our two protagonists Alice and Bob some of you might have heard of them before now Alice and Bob right so they have this this kind of relationship and Alice expresses her unconditional love for Bob and Bob expresses his feelings for her in some digital form you guys like that like would you would you operate in that way yeah maybe not like how stupid do you think Alice and Bob are right they also don't do that they have of course end-to-end encryption right end-to-end encryption of the communication between the two parties and everything should be fine now unfortunately there is a third party in this relationship and this third party is Charlie and well Charlie does not see what exactly the content is that Alice and Bob are exchanging Charlie knows that these two are communicating because Charlie is either working at the ISP of Alice and Bob or she she works at some sort of central service provider so she just knows the fact that these two are talking and is relatively unhappy about that fact right so if you think about building such such applications in a digital way which we actually which we actually tried here is like working on a project called mio so when we worked on mio we realized this is not really good enough so some of the lessons learned that we have to focus on is that end-to-end encryption is oftentimes insufficient so we do not just have to protect the sender that the message itself but also the sender and recipient of a message and that is what we're aiming at with our messaging protocol hopper and what we specifically aim for is to provide this metadata privacy that this kind of example that I gave initially should have told you so we're protecting who is talking to who when are they talking metadata such as how big a message is right if I see that all of you are sending in Theory messages and then there's two people exchanging emoticons which are three characters I learned a lot or what IP addresses they are communicating from all these all these sort of metadata we want to protect right in order to have a privacy preserving means of communication between the two parties and the goal of this metadata encryption is to to yeah as expressed here by Michael Hayden the former president of the NSA who said we kill people based on metadata which is a bit an extreme example of how bad metadata leakage is right but what we want to do is again to protect metadata and thereby preserving privacy for both the sender and the recipient and that's not just actually a problem for our our lovers Alice and Bob but as we've seen very recently also for like much bigger organizations such as the Swiss police so the Swiss police ran into a funny issue recently and the issue that they the data problem that they run into looks like this yeah anybody recognizes this car yeah what what brand model is that Tesla exactly now one of the issues of this great car called Tesla is that you sign once cific class in the terms and conditions and that is that a few people can listen to absolutely everything that is happening inside this Tesla car at all times now while that might have a bit more trivial solution there's further problems with that if you look at it a bit more closely you have this smart car right we're all into smart technology and and smart things and connected things they leave a huge data trail behind and that brings us into this problem of intermediaries such as network operators AT&T in the US or Swiss come in Switzerland right so network operators that now gain insights into for example how the police is operating and we have to ask ourselves the question is that really good yeah if you're a for-profit entity to really want to leak proprietary information to some sort of weird other for-profit entities that are network operators does that make sense and especially if you're like for example a police you should definitely not leak this sort of data so that shows us metadata is not just a problem for private individuals but for much larger set of people and what we see today is about these messaging protocols is that centralized web infrastructure and I think we don't have to talk very much about that here is largely by and large violating our privacy on the other hand we see some decentralized infrastructure that are not really having incentives to run it so for example if we think about tor right so I don't know how many of you guys are running tor notes at home to our exit notes specifically the problem is that you just don't have incentive to do so and you have a non zero cost and non zero risk especially legal risk for running a tor exit note that you know you'll run into trouble so that's one example of missing incentives and we talk in a theorem ecosystem about the incentive of what is the incentive of running a note right it kind of goes in a similar direction running a minor has incentive running a note which is important core infrastructure is missing incentives so here we say that mass adoption and scale of decentralized and privacy-preserving infrastructure needs economic incentives right so and this is this is one of the core aspects that we that we bring in with hopper um so basically hopper is a decentralized so it means anybody can participate to some people surprisingly that is different from Tor right so in tor you have a central entity that is signing off on who can participate as a as a note in a Tor network and who cannot yeah so hopper is decentralized it is incentivized so you earn money by participating in that network we will look a little bit how that works in practice it is privacy-preserving so we we do not only protect a message but also its metadata and it's a messaging protocol of course so anybody can build on top of it so it's not our goal here to build a status 2.0 or you know WeChat 2.0 it's a protocol that any of these other projects can leverage and how do we do that we built on this onion encryption that you also know from tor where instead of relaying a message directly from myself to a recipient I do so via relay errs and it's important to understand because privacy is not something that you can get yourself right so privacy is something that needs cooperation from others like quite generally stating that and specifically here for the application of messages we do utilize these relayer nodes which are relaying a message but what they actually provide to us is not just the service of relaying a message but thereby producing privacy now why would these guys do that well they earn money for it and we will now look at a little bit more in detail in how that works so basically hopper comprises two layers it has a message layer and as a payment layer and what has to be said is that the payment layer does not de anonymize the message layer now you could think about a naive implementation right so you you relay some messages and I pay you in Bitcoin so the thing with that is that if you see on chain payments that can be linked to the message layer that this leaks a lot of privacy that we wanted to that we set out to protect in the first place so this is this basic layers which will now digest in a bit more detail so the message layer as I mentioned already is based on this honest onion encryption on a network layer we leverage a package format called Sphinx that has some very nice properties that are proving upon what for does and we have been a first implementation that's building on top of the p2p which you might have heard from from a bunch of other people around here and on a payment layer we have basically some some fancy payment channels with with some additional features and coordinated payout we have that implemented in solidity and for now we have an implementation that we will show in a minute that is running on Rob stone so with that let's get into the message layer and we will now look at a different interaction so now it's not just Alice and Bob it's also their good friends Charlie and Dave so Alice is initiating a conversation with Dave she wants to get a message across to Dave let's look at how this works under the hood so alice is basically finding a route through this network so she's connecting from her hopper node to a bunch of other hopper notes that she picks on whatever strategy is is valid right so you might want to I don't know have some parties that are trustworthy or that are in very different in opposing sometimes political regimes so you can come up with fancy strategies for that so then of course she she needs some header right so she needs to tell Bob where to send the message next and one important feature here is that every relayer only sees the next hop right so Bob does not know actually that the message is eventually ending up with Dave and Charlie does not know that the message actually originated from Alice so if we look at the header just in a very simple simple example here we have this this chain off of next hopper addresses right so we have this this address of Bob of Charlie so basically only Bob should see that the message goes as a next step to Charlie so when alice is sign this message to Bob Bob can basically decrypt or unblind this first part of the header information but not the next that's important yeah so we don't want Bob to D anonymize the entire chain of traffic and then Bob has the message and now we also want to prevent Bob from just extracting the payment and not doing anything right not passing it on so Bob actually needs the cooperation of the next downstream node which happens to be charlie in order to unblind this payment which is actually an update transaction and a payment channel so Bob involves Charlie passes on some part of the message and by passing on part of the message if I go back here you see that this encryption Bob head takes the first part of this encryption shell off right that's what we call this onion encryption you have this shell layers in an onion like fashion of encryption Bob telic takes that off and now this this body gets passed on to Charlie and basically charlie is is passing a key half to Bob with which Bob can unblind this transaction and now sees okay this is an this is an updated transaction of the payment channel so we see the new value that is stored in this payment channel some payment channel ID and some signature for it with which Bob can go on chain and close the payment channel if and when needed and now of course the game continues now charlie has the message and what we also see is that that this this first part of the routing information is basically removed so Bob removes it and pads it with some additional info again in contrast to tor we don't want to leak that ure layer number two if you know that your relayer number two then you know that the next person is most likely going to be a recipient of that message so we do that now the message is with Charlie and we repeat the game right so Charlie first needs to find out well where do I send this stuff to so charlie is basically uh none decrypting the first part of the routing information and is then seeing oh I have to send it to Dave so what she sees there is the hopper address of Dave and will look up in a DHT how to contact actually Dave contact Dave and Dave will again collaborate with Charlie to to unblind the updated payment journal information and Dave then has the the takes off the last layer of the of the onion encryption and what we see is Dave is then finally able to see the plaintext message that has been sent by Alice yeah so this is a short walk through off the of the message layer and although we have touched upon it in this in this form a description and a brief summary of the of the payment layer works like this that alice is basically encrypting the payments or in this example it's 200k away it's a relatively small payment for this one individual for this one individual and transaction so Bob needs the collaboration of Charlie so receives the second key half to decrypt the payment with that Bob now has the 200 Giga way but because Charlie knows hey there's actually a message coming in to me Charlie already has has received the next part of this of this payment which again is encrypted and with collaboration of Dave can decrypt it so actually Bob kind of has to forward this payment of 100 Gig away to the next to the next relay note yeah and in this way we have an incentive structure for all real Ayres and also have kind of prevented that real Ayres can't cheat and have this take the money and run attack yeah so a relay er cannot just extract the value not relay anything and run away because they need the collaboration of the next downstream note in order to to get that payment out good so that is a brief overview of this of this message protocol and with this I would like to move on to our first public demo and you see our github repo down here our code is open source available you can look at it this is a warning also right this is the first time we demoed this anywhere in public I'm quite excited about it but yeah please excuse us if the Wi-Fi here is not as as favorable to us so I'll connect to Robert so and Robert is gonna walk you through a short example of how Hopper works in practice and how you can relay information okay well first of all what you see here you see here we need as we are building a decentralized network we need some bootstrap not that one is boots up north this tells you notes how to connect your network how to find other nodes we have another node this one this one and this one and of course we need someone who sends the messages and let's have another node on this one and in order to construct such a path through network as we as it is Saucer lectured well we need to crawl the network and try to find some other nodes and well you're lucky we have found enough hello nodes and now we're able to select one of these nodes for example the first one let's say take the first one and send a message to the first node the first node is identified by this address I hope you can see it it's not so that's a good readable and now we can type in a message and let's let's send this message to the first intermediate node that is this one and we see that this node is now opening a payment channel the payment channel has this channel ID and we see here that note here is receiving the first message it receives the payment channel opening request and then and then we can also see here on raphson that there was most likely some transaction Proximus a bit slow but yeah you see here we have Unchained transactions so it is live also on Robson and at the end of the day you will see that this not received the message so this was the demo cool thank you Robert so that was just a first and very early demonstration of of what you can do with hopper so currently our our first test net comprising four nodes is relatively small but bear with us we hope it's growing and yeah so that that gives you some idea of what hopper can do and of course that's not all right so there's a lot of stability improvements we need to do and that is that is currently ongoing especially with regards to opening payment channels so if we open these if we open these payment channels we need some sort of smart strategy and currently as you can guess this the strategy is not as smart so we open them on demand right so that's one testing and documentation is of course pretty important and to make it ultimately usable we need api's and libraries that's that's the next step that we're working towards right so the command-line application that robert showed you running on top of hopper is is like one first example but having a proper library and API for that would be more useful and finally yes we're also looking for funding for that so if somebody's interesting working with us do let us know um yeah and with this I would like to close here and I'm very open to questions and maybe this is also the right time to give a shout out to kind of an more informal discussion group that we're having here with the Webb 3 foundation with status and with some other researchers around here to try to find out how we can really make a useful a useful messaging protocol that is useful for a variety of blockchain and Beyond applications right that want to be privacy preserving censorship resistant and decentralized in nature that's what we're really after here and please come to us let's discuss afterwards let's try to find out how we can make this useful to you guys and how we can structure this from the beginning in a way that's useful to as many people as possible with that thank you very much and I'm open for questions so I have a question so the onion The Onion Routing is a very good thing and I have two questions so first question is is it possible to make it dynamic and the second question how are you going to have you ever thought about incentivizing that the second note that is relaying is going to send the data about the transaction verification for this for this first note how so the first question is around the dynamics right so yeah so it's actually a very good question because especially if we look at applications like status that are focused on mobile applications we have notes we have a relatively high churn rate notes coming in and dropping out so maybe that's not an ideal maybe that's not an ideal relay or note because you know I mean that have a lot of package loss so you could have multiple paths going out in parallel but eventually I think that that there will be we will have some sort of some sort of reputation system that you see okay how online are these nodes are they actually available before you send that message so I would when I think about how what the endgame of this is I don't think the endgame is that you have a full node running on every mobile I think that you have this running in your living room you know in your TV set-top box this thing is running on there all the time and then this thing is online because that's that I can yeah also generate profits and the second question what is the incentive for second relay or give give data to the first three layer ah yeah very good one right so how does actually the next downstream node why would the next downstream node actually collaborate with the previous node to work here well the next downstream node wants to make money as well right so the next downstream node wants to make money and they they can only do that if they if they gave something back to the to the first party right so thereby we incentivize them to really collaborate and in giving giving something back there yeah thanks for the presentation I had a question about swarm sows four months ago they were releasing this messaging system as well how does it come here yeah so basically I mean what we're aiming for with hopper is to have point-to-point communication nets that's maybe one important one if you look at at several other ones they are not geared tome so much towards point-to-point communication but more for broadcasting that's one and then having this incentive layer to to operate any sort of this network it's another one because if you look actually at I mean whisper whisper ships with death for a while and it's by default off right and I think if it's by default on we will see quite some people complain because it does have quite some traffic requirements we've seen how you know mobile phones went hot when you when you used whisper in that setting maybe if you run it on some top-notch machine you don't bother so much if you run it Raspberry Pi maybe you do run into issues so we think this needs incentives that's one core differentiating factor between hopper and other approaches that we've seen good time thank you [Applause]