How to Design Privacy Protocols That Black Hats Will Not Use | European Blockchain Convention

foreign [Music] hello everyone I'm Anna gongol from alab zero oh and they have a pointer and I'm gonna talk about privacy and some trade-offs between privacy and anti-money laundering techniques mostly in that technical way semi-technical so uh what I'm gonna specifically talk about is how I try to explore some trailers between privacy transparency and do some some commentary on compliance I quickly introduce the ideas I know how people approach this problem I'm not gonna provide the best solution to the problem and I'm not gonna pitch our projects too much because well I don't like talks where people pitch and projects too much so um to getting started let's define a few few topics uh so it's not only in blockchain case but in general we can we can divide anonymity into several categories from pseudonymity which is what usually happens on bitcoin where users have distinct pseudonyms or addresses and they can transact between each other and then it's enough that we assign address to a user to be able to track a given user it also gives some additional trackability that we're going to explore in a moment there is anonymity which is a stronger flavor of privacy so in Anonymous system what we know is only what happens and there is no way of telling who is performing this action so for example we can see that someone is sending one eater to someone else but there is no way to link this transfer to any other transfer that ever happened and private system is a system where basically everything is considered so the only thing we know is that something happens because some data is landing on chain but there is no way to tell what kind of data is it and what actions are performed so uh first maybe maybe quick recap for or for how how normal is transaction transfers work so this is basically how Bitcoin works uh so people have addresses addresses can transact with each other and for example this is actually ether so the mint address let's say is sending one eater to the Violet address every month and then every month Violet address is sending 0.2 liter to a pink address so first of all any Observer can easily easily uh block this this actions because this is the same address so obviously it's the same party uh then maybe somewhere maybe some temporal relations between the transfers like here for example if something happens every month and then if even if some of his users wants to be anonymous but other are not for example if mint is a well-known employer with a well-known address and the pink one is for example well-known Hacker House when it's pretty easy to to tell who the violent one is well he's the employee of this particular employer who is living in this particular Hacker House so even though like in principle the system offers some anonymity in practice it can be very often broken there are companies which are doing this professionally and they claim usually that something like 80 to 90 percent of Bitcoin addresses can be can be actually linked to and to individuals um so there is an idea of stealth addresses and ethereum this is something that is speeched as a privacy Improvement for ethereum what does it do basically is that each time I'm sending a transfer to someone uh I'm generating a new address to this person and I'm doing some cryptographic trick so this person will be able to actually receive the money but it's gonna work the same way as this person would generate a new address just for the purpose of me sending money to this person so uh what can be tracked here first of all well it's only for the receiving addresses so when I'm if I'm the sender chances are I'm actually sending money from the same address several times because usually I'm uh I have more funds on this address than I want to spend in a single transaction and the other thing is that there is this property of linkability so we have if we have a situation from from the slide before uh we can link the first transfer two transfers in January January are linkable because there is the same address which first receives the funds and now transfers it further so uh for example this is for me personally very very uh hard when when interacting with blockchain and whenever I want to send funds to anyone just to I don't know like a very small transfer there's always this thought that well okay so this person will be able to peek into my wallet after I do it I mean like whenever I interact with anyone this person will know my wallet from my address from which the transfer came so we'll be able to tell a state of my address so of course probably most of you is are using multiple addresses this is of course not very user friendly and also it doesn't actually offer cryptographic kind of protection it's just a heuristic to make make things a bit harder to track so still addresses uh kind of work offers some anonymity although doesn't solve this this problem of of people looking into our our account and there are fully private transfers so zcash liminal which is our products we all basically use very similar similar technology stack and well what's visible on train here is basically just the aggregated number of how many transactions are happening so there is no way to track anything which is on a way nice but but it's also problematic as a data title of my presentation is about black hats so color black hat sees private transfer so well blackheads doesn't actually like ethereum itself I mean whenever there is some hack of course like every uh everywhere in the internet we can read where these fans from the Hacked are actually deposed because it's easy to track things on ethereum so uh so usually stories that uh that the hack is discovered and then the address at video store and funds are is just public for everyone so just mixing through ethereum doesn't help at all here it's very easy to track this once so it's very easy to to put red flags on all the addresses that have been receiving the stolen funds basically nothing changes here I mean as I said before there is full linkability so it's easy to track across across the transfers where the funds are are being deposited so uh well stealth addresses gives some flavor of anonymity not for black black as well and there are private transfers which unfortunately are uh the heaven for for black house because whenever the funds are getting there like the trace is absolutely lost so uh so the question now is can we make it somehow better can we make it so that our normal transfer recipient will not be able to pick into our wallet but also in a way that black cards will not be able to launder arbitrary amounts of money in the system so it's a hard problem and there is no like clear solution for it there are several approaches though [Music] the first one is called anonymity revokers this name actually comes for from academic paper I'm not even sure whether the deployment will be will be called the same um so the idea here is that there is a specific set of of nodes which are holding threshold encryption of everything that happens in the system so basically we can imagine the system which works exactly like zcash so fully private transfer system but there is this special committee so when the hacker story would look like this well hacker stolen phone fans are deposited to the Privacy system then while the hack is identified let's say we're on ethereum Target is identified and the funds and this particular deposit to the Privacy system is identified as well so like basically everyone knows that the funds have came from this address so when some authorities come to the anonymity revokers and say well uh there was this hack and they request to reveal everything that is related to this particular deposit and then anonymity revokers as they hold encryption of everything that ever happens in the system by just reveal everything step by step by step and well it's kind of unclear what happens then I mean freezing funds is usually problematic but revealing is enough actually I mean like with hacker attempted to mix the funds and failed that's that's good enough when it comes to designing safe privacy systems so what's the problem here so the core problem is that there is no way of of preventing anonymity revokers to just secretly reveal everything I mean they don't need to do any chain interaction to reveal things they just have encrypted data so they could just collaborate and decrypt everything so the problem here is that the data are not under users control um but well the benefit is that this this solution is pretty simple when it comes to technical technical details so yeah it has some benefits but it comes with a great cost that that privacy is compromised to some extent and the second um second class let's say I'll call it here proof of Innocence because of uh recent uh tornado cash related protocol so what what proof of Innocence does is um well let's say let's come back to the hacker story so here it would look like this hacker deposits funds to uh to a privacy system and the hack is of course identified and the address becomes public and then well authorities there is there is no anonymity revokers now no one to to ask to reveal anything so what the authorities can do they can just save it well so this address is problematic whenever anyone interacted with it well it's gonna be problematic so there is just they are creating this kind of list of problematic addresses and then whenever one of some addresses is accepted as the problematic which is of course unclear what does it mean and who actually accept this addresses but let's let's leave this part for a while uh it becomes possible for users to generate proofs that the funds they are withdrawing from the system never interacted with this particular address so as a user of a system I can provide proofs of my innocence I can I control entirety of my data so no one can can peek into my transactions but I myself can can prove that my funds are not coming from from public listed address so advantages are clear it's full privacy and compromised there is no one who could actually peek into my into my history and well everything under user control problems like too much of it in such a small window so I'll make another slide with problems and so first problem like partially technical partially legal who controls the list of problematic addresses it's of course a very problematic matter so um probably some kind of Dao or some kind of decentralized governance but it's yet uncle clear I don't think anything like this was ever implemented uh when what happens if stolen fans mix with the regular users funds inside of the system so there is no clear answer for this question and but fortunately it's not a problem which is related to blockchain itself I mean the same problem basically happens in normal Finance if someone steals money and then mixes this money with money of of the regular users then it's just just the same problem as here so I'll consider it pretty problematic but not specific to this particular use case uh how to keep trace of private funds forever I'm not gonna dig too deep into that but generally with privacy protocols become more and more complicated then more and more are we we're trying to to keep this track so summing up uh the the pubs here are two Unlimited revokers which are making a bit worse trade-off for our users so it's all very very um kind of risk that the Privacy will be compromised but the benefit is that they offer pretty straightforward system and can be probably quicker implemented and proof of Innocence based systems which which doesn't compromise privacy but may be limited when it comes to the technical capabilities like for example throughput or or how long the track can be actually remembered uh we're exploring more of the latter part the proof of Innocence part as we want to keep all the data under user control uh and probably will you'll see something about it this year The Way Forward uh well we need to find the system but replica is the Privacy we have in real life because right now we kind of accepted that that blockchains are less private than normal finances but well it should not be the case the second is that we need to fight the system but reasonably prevents black cards from from using private transfers for for mixing funds and well it's not clear which solution is the best I truly believe that the second path is better thank you thank you