Web3 is Blocked on Keyservers - Ashoat Tevosyan

so yeah so my name is asho i'm a founder of i'm the founder of com uh which is a startup building like a web three discord powered by key servers right so in this talk uh i'm not gonna try to show you too hard i'm trying to do kind of a short and technical talk and this is kind of the talk that you know i i pitched this startup like five times a day uh and you know i always wish i could give this talk this is sort of like the technical talk and i'm gonna really try to zoom in on to the question of like why are key servers necessary right and the fundamental premise of our startup is today web 3 is blocked on key servers and and what i mean by that is you know we have a kind of a world where you sort of have to pick between two things one is you can have like a centralized web 2 product that has a lot of product functionality you know it's very powerful can do a lot of stuff and on the other side you have kind of more decentralized applications things that have antenna encryption things that support sovereignty that on the other hand uh you know uh don't have the exact same product functionality and you know you look at kind of the the world of web 3. you know you guys are all probably on discord or all on telegram you know unfortunately centralized applications so the question here is like how do we as a community move out of that space how do we get to a world where you know web3 communities are actually using products with web3 values um let me see um and this is a this is a fun talk to give because you know most of the most the time when i give this talk one thing i've noticed is you know people that don't really know kind of the space too deeply will kind of buy into what i'm saying really quickly right the people that really know like what it takes to build a decentralized kind of you know discord or decentralized telegram start to push back because the reality is there's actually been a lot of projects that have tried to do this and there's a lot of really cool cryptographic techniques to kind of enable this stuff and so in this talk we're going to zoom in this is really fundamentally kind of a tech talk and one thing i'm just going to say we're not going to be talking about the ux challenges of getting people to set up a key server i'm optimistic about it obviously they're you know something that's not something that completely will be easy uh but that's outside the scope of this talk all right first i'm going to start with a quick definition of what a key server is so if any of you here have worked in like enterprise key management you may have heard this term before we aren't using it in the same way okay so we're hijacking the term um so a key server in our system fundamentally it's a personal private application server right so in our vision of the world each of you has a key server right your key server owns your private keys and your personal data and your key server has to always be online right it's got to be something that's truly a server can respond to requests at any time and last piece here you know kind of how we envision key servers going we want to kind of provide an alternative to the application development model that exists today where you know you have a centralized cloud server that provides it back and in our model we replace that with a federated network of user owned key servers now to really explain why key servers are necessary i'm going to spend the rest of the talk talking about previous attempts to build private messengers without key servers and so to get started here um can i get a show of hands i want to see who who here knows who moxie marlon spike is all right not too bad not too bad who here is red moxie marlon spike's web 3 critique anybody all right we got some folks uh you know and how i look at this you know i saw a tweet like maybe a couple months ago web3 needs better critics and i i really truly believe this and moxie moxie's a great critic um and i kind of have a hot take i'll throw this out there i actually think signal was the first web3 project right and i look at this basically because you know fundamentally to implement antenna encryption signal has to decentralize the database before signal there was a centralized database in the cloud for every messaging app with signal actually your phone owns your pri your actual private keys and your private data right uh and moxie's been working kind of on this problem for a long time and you know we all know kind of signal has some limitations you know there's a reason a lot of us used to use telegram instead and moxie's been you know butting his head at these kind of limitations for for eight years right and so it should come as no surprise that the very first thing he mentions in his critique right right at the start people don't want to run their own servers and never will right and if you kind of the most two most salient quotes from this article to me first one is web3 should give us the richness of web 2 but decentralized i believe in that deeply right that is what i think the goal of web 3 should be right and the second one people will never run their own servers moxie is a doomer right so moxie you know i can't blame them right so far you know to date people have not been running their own servers and so it's kind of a good mainstream bet to say that you know it won't actually happen right i disagree but that's outside so for the talk um so you know uh taking another kind of perspective on the other side of this so paul durov he's the founder of telegram right and he's very very sensitive about the fact that telegram is not antenna encrypted right and you know it's funny because telegram launched with antenna encryption believe it or not when they first launched they had support for a bespoke antenna encryption protocol called mt proto and over time they have iteratively just de-emphasized that and today it's you got to go through like a menu tree to even start an encrypted chat and telegram right and you know if you ask him you know what's the difference fundamentally he talks about this thing seamless sync he also sometimes calls it cloud sync right and what he's really getting at right is is you know the user experience around backups oh enter um you know the the quote here from the article he wrote we didn't want to deprive our users of functionality that they enjoyed in other apps and doomed telegram to join the ranks of niche apps right 502 he's a doomer he too doesn't believe that there's any way to solve this problem right but similar to moxie he gets that it's a very serious problem all right so you know you can sort of imagine now a spectrum right a spectrum going from you know telegram on one end which focuses on product functionality you know that's their priority and trades off sovereignty and on the other hand you can look at signal to say you know signal's a pretty sovereign platform you have privacy you own your own data but obviously the product functionality is is pretty limited right telegram can do a lot of stuff signal can't right i mean you've got a thousand person channels in telegram you've got a web client you know you can scroll up to see message history when you get added to a chat right and you know when i'm when i'm usually giving a pitch this is usually where i stop you know because i i don't want to get too technical but the rest of this talk we are going to dive deep right and we're going to talk about other attempts to actually try to bridge this gap to try to build a private messenger that guarantees sovereignty with the same sort of functionality that telegram has so enter there it is so key base who here has heard about key base before raise your hand okay okay so we have some folks we have not everyone uh key base is you could think of it as like a decentralized slack that's not where they started but that's kind of where they are today and they take a couple really opinionated different takes on end to end encryption right so the first thing to know about key base key base is the only end-to-end encrypted application that i know of that doesn't use double ratchet or something very similar to double ratchet apple doesn't really tell us what they do but they're probably doing double ratchet so key base does something very different key based takes a single symmetric key and uses that to encrypt all of the data in the channel right so you lose something called forward secrecy which is a you know cryptographic principle uh but you know there are trade-offs here um and and you know so key base relaxes some of those cryptographic guarantees concretely something called forward secrecy which is this principle that if someone you know steals the key they aren't able to actually read the future messages right uh so just as a quick comparison again it's a tech talk a lot of kind of a lot of words here i'll try to break it down in double ratchet every single message has its own key right and that's a crucial thing to understand right before you can decrypt message n plus one you first have to decrypt message n right and so on top of that you know if you're in a group chat if you want to send a message to 10 people what you have to do in an antenna encrypted application that uses double ratchet is you actually encrypt that 10 separate times send that to 10 separate people right and so you can imagine now the scalability challenge is inherent here right you know as the group continues to grow every message has to be downloaded to every single individual client and on top of that as the number of members grows each individual message has to be re-encrypted that many times so it's an o of n squared problem and this is why you know looking at products like discord and telegram that are meant to kind of scale the larger communities no one's ever actually successfully built sort of you know a private equivalent of that outside of key base and key base kind of made this this uh trade-off on key base i mentioned the whole channel has one shared key the ciphertext of each message is backed up on key key basis servers and that enables clients to be thin clients again right whereas in signal your client owns your data in signal you know your client has to handle like all the work of like search happens on your client you know like storing all the data happens on your client in key base you don't really need to worry about that uh now the thing is though despite key basis cryptographic trade-offs it still can't reach feature parity with telegram and this is this is you know this is the app that was willing to put you know the most on the line trade off the most cryptographic principles right but the the best example here to talk about a search if you go on key based and you go to the search bar and you type in a query and you hit enter here's what key base does key base proceeds to download each message one by one by one to your client decrements it on your client searches it on your client if it finds it it shows it to you and then you have the choice to say next or you can say i'm done right and if you say next then it spins again it spins and spins and spins it fills your hard drive up with messages it might take an hour hopefully eventually you find what you're searching for obviously you know as a user this is this is a broken product experience you know and how i look at this is there's a reason you know web3 communities are on telegram and discord and and not on key base right um now the next slide is the most technical of the slides so uh gonna do my best here so i want to talk about searchable encryption though there's been a technique for a while i was initially pioneered you know the year 2000 was the first research paper i could find about it uh really the best research paper though came out in 2006 so that's really when it became kind of a mainstream concept and searchable encryption uh to understand it i'm going to first have to explain a little bit about search so there's a core part of a search engine called the tokenizer right and the tokenizer what it does is it takes a bunch of text and breaks it down into smaller individual tokens these are not crypto tokens these are just like uh short short strings right and so uh the way uh this the the place that this tokenizer is used is actually in two spots it's used first when indexing content so when looking at you know uh let's say where it's google so the content would be a web page you first tokenize the content of the web page and then when you're executing a search query you tokenize the search query right and the whole point what a search engine fundamentally does is it's matching those tokens it's matching tokens uh from your search query to tokens from documents right now tokenization obviously a very critical part of search and in searchable encryption the way it works is it actually inserts itself on the into the tokenization layer so what's going on in searchable encryption is after tokenization you encrypt each token um in a way that the server isn't able to figure out like what is this token really and as long as you encrypt the tokens during indexing in the exact same way that you encrypted tokens during search the server can match up these you know cryptographic encrypted tokens and not actually know what's going on right so you might ask you know why why didn't keybase do this why don't other folks do this in general and and the reason fundamentally is any change in the tokenization algorithm now requires re-indexing all of your content right and this kind of comes back to the same problem we started from you know like signal has all the data on your phone and if it was possible to treat your phone like a server signal wouldn't have any limitations it does but apple in particular apple less so google apple really is very restrictive and does not let you just issue background requests and you know if it's the case that a change to a tokenization algorithm requires re-indexing all that content that can only be done on the phone and so we're back to square one we're back to a world where the device that owns your private keys unless they can function as a server is not actually able to you know handle search for you all right so i talked about key base um next one i want to talk about is matrix.org here and i think i have not too much time left so i'll try to go fast um enter there's matrix.org all right so so matrix.org actually does implement double ratchet unlike unlike uh keybase like we talked about uh but matrix.

org does a lot of stuff other antenna encrypted apps do not do so it's it's got the full backup and it's also has a web client and you might ask how does it do it and the answer is basically brute force so if any of you here use matrix.org for end-to-end encryption you know what i'm talking about if you log into element which is the mainline web client for for matrix.org uh and you haven't logged in before your browser is going to freeze there's a github issue about this your chrome browser freezes for 10 minutes while you know you download literally every message all the backup to your web browser decrypted in your web browser and then you actually are storing it in your web browser and web browser's not not really that great at being full clients here right uh oops so oh five minutes oh that's not too bad uh so uh yeah so matrix.org and key base both solve the backup problem but do it very differently right and so matrix.org just has a big blob of your data right and that gives you a bit more privacy because the metadata is kind of hidden key based instead breaks it back up down to kind of individual pieces right okay so now i'm gonna i'm gonna end the talk with a bit of shilling here uh so key servers solve everything right all the stuff we've been talking about the challenges the key base faces the challenges that you know uh uh the matrix org face stem from the fact that they do not have a server that has access to plaintext data the solution with key servers is we can have a server with access to plaintext data but it can be owned by the users instead of that data being owned by a cell phone that data can actually be owned by your key server right and you know all the stuff we talked about you could have a thin web client that just talks to your key server so web works great you can have the full protection of double ratchet right because you can just query your key server whenever you need to you can have backup be done in the background by your server and obviously you can scale the larger communities because you know uh i mentioned earlier signal on the group chat you need to encrypt something end times if you have a key server hosting a community you can just send that message to that key server once and it can handle the fan out for you right so personal private servers enable the best of both worlds they make it possible to have the security and privacy of signal while having the product functionality of telegram the last thing i'll say i believe key servers are inevitable i believe they are going to happen because as time goes on the amount of information we have about people grows at an exponential rate and you know today we worry about privacy for messaging but tomorrow we're going to have you know privacy for glasses that record everything you see in everything you hear you know privacy for your personal ai that knows literally your whole life right and you know key servers really are the only way to get this future tech while preserving privacy and privacy matters much more when it's your whole life being tracked so yeah that's a talk any questions