DFNS 🛠️ Web3 Wallet Infrastructure - Joshua Siegel

foreign [Applause] [Music] hi everyone from Heath Paris great to meet you I'm Josh Siegel I'm the chief product officer of Defense so yeah very excited to introduce you to defense today and hope that you will choose to hack with us so we're going to go through a brief introduction talk about the prizes that we're going to be offering then we're going to tell you a bit about the platform at a high level and then we're going to jump right into the technical details we're actually going to onboard onto the platform exactly like you will and then get into our SDK so that you can get up and running and productive as quickly as possible so yeah defense is wallet infrastructure for web 3 we provide a seamless API and in the back end we Implement multi-party computation threshold signature scheme wallets so we our goal is to be the kind of easiest to use and most powerful wallet API to create simple embedded wallets and that is one of the reasons that we strongly encourage you to give us a shot because really you can do pretty much anything on any blockchain that supports our underlying cryptographic schemes the signature schemes we support are ecdsa which is used across every evm chain ethereum Bitcoin Etc and at DSA which is used across like Solana and cardano Etc so you can use us with any of the other sponsors if you need a wallet to do anything then you can use us and you uh will have a greater chance of walking away with some money in your pocket because we're actually offering six prizes a first price two thousand dollar prize then a thousand dollar prize and then a four five hundred dollar prizes so we really want you know to get as much participation as possible and we're just looking for creative ideas anything you want to do if you want to use defense independently to build some project that you've been envisioning that's great but we absolutely encourage you as well to kind of look at the other sponsors the other prizes and we can integrate with pretty much any of these folks and to use defense as your wallet layer as you're implementing your project so jumping into defense in a little bit more detail now we are MPC and TSS cryptography experts so what that means is there's a bunch of different ways to potentially secure private key material you can put it in a Hardware security module like a ledger but there is a single point of failure there obviously you can do what's called Shamir secret sharing where you kind of split it up into different components but then it still exists at the time of creation and at the time of signing or you could do mpctss which uh creates what's called symmetrical shares and through a process called distributed key generation and at the time of creation the private key never exists in its full form on any server in memory or on disk and also at the time of signing it never exists so that's why we feel like it is kind of the best technology out there to secure private key material because that private key in its entirety never exists it's only the shares and those Shares are you know very key cryptographic material that must be secured and we secure those in kind of a novel way taking a look at our decentralized key management Network that's what's on the right side here we create a signing Network and we distribute the key shares all over between different partners in different regions and geographies such that no single partner ever holds a threshold of key shares such that they could move funds on Chain by themselves basically the network itself is credibly neutral and only through the coordination of the defense platform can we Federate a request to the network to say hey come together and actually sign a request so what becomes critical in this architecture is the security of the defense platform itself which is why we've innovated on our authentication infrastructure in order to sign every request into the platform just like you would sign a transaction going to a blockchain using a signing secret that we never see which kind of guarantees that we are a technology platform we're fully non-custodial so this breaks down into a dashboard which you'll see when you on board with us our authentication apis which actually validate that signing secret the signature that comes in are authorization apis that say who can do what within our system based on very granular controls and then the key apis which are the wallet apis creating a wallet interacting with the erc20 721s transactions signatures a whole policy engine and governance layer that actually looks at the metadata of transactions and applies policies to them and then a callback layer that responds to the events on chain or in the system with posts back these are built on a set of blockchain microservices that actually speak to the native chains as well as our decentralized key management Network which is the the heart of our technology and we build all our cryptography from the ground up so if you want to start building with defense we'd love to have you on board and we will go ahead and provision a testnet environment for you all you have to do is go to ethparis.defense dot Co and just give us an email address in your team name that's all that we need and we will go ahead and sign you up great so you've gotten in touch with us and you've given us your email address and your team name we've gone ahead and provisioned a environment for you on our testnet infrastructure which is called defense dot ninja and you should see an email like this in your inbox where you can just go ahead and grab this registration code here and then click here and that should pre-populate your username with your new org ID and then just paste that registration code here these registration codes only last four hours so if it's been four hours just click email me a new registration code and you'll get a new one so at this point you're going to create an account and what this is going to do is pop up web often so you may have seen this before this is passwordless authentication implemented with pass keys so I'm going to do this device and click continue that's going to give me a fingerprint uh logo there I'm just going to go ahead and secure my fingerprint and that's it I now have a pass key on this laptop secured by my Biometrics and a recovery kit here which you can pretty much ignore for the purpose of the hackathon but this is one way that you can retrieve your keys in the event that you lose your device so I'm going to go ahead click done my registration successful here is my username I'm going to log in using those same authentication credentials so here web authent pops up again and then I just touch my finger and that is signing a challenge and sending it back to the server and voila I'm logged in that is two-factor authentication which is pretty cool something I am and something I own so at this point what I'm going to do is click on the icon in the top right here and then just go to settings and then I can see all of my account settings here so what I'm going to do is start inviting my team members so I'm going to go to users and here's the user of my org which is just me I'm going to invite my team member so let me try Josh plus eth Harris team fence dot Co and I'm an employee because I'm a member of that team you can ignore the external ID field and click create once again this is an action you have to sign because this is changing the organization so I'm going to again sign this action by touching my finger to my laptop and that will go ahead and create the new user uh yeah once we've got the new user on the system you can click back to list all of the users that are here and you also need to assign permissions to users and generally we you know Advocate principle of least privilege when creating permissions and you can use that through our API but we've given you a shortcut because you don't necessarily want to be messing around with all the different you know levels of permissions just for hackathon so right here is a little permissions missing icon so on your new team member you have permissions as the original org owner just go ahead and click that this is again changing the system so we're going to require you to sign that request this is how our authentication system works so you just touch your finger again and and you have just given your teammate permissions to the system there it goes there's the check mark and that teammate should now receive an email just like you did with a registration code they're just going to go through the same process and that is how they will get into the system so next we'll we'll show you how to set up a service account so you can start signing API requests from the server side okay so now that we've invited all of our team members uh to defense and they have accounts we're going to go ahead and we're going to set up what's called a service account so let's just go click on service accounts here so think of service accounts like any type of machine account like a set of API keys right that are long-lived so this is the type of account you will use from the server side in order to call the defense API so just go ahead and click new service account and you can give it any name that you want so let's just call it Paris now you'll see immediately that we require a public key in a pem format and again this is because all the requests that come to our API that can change state in our system or on chain just put post or delete requests need to be signed by a secret that we never see at the fence and so that would be the corresponding secret key to this public key so you need to kind of create one of these in any way that you know using uh you know a service like Amazon key management or just by the command line so if you take a look at our documentation here at docs.defense dot Co just go to docs.defense.com and then take a look at our Advanced topics authentication credentials and then we've got a section on generated key pair uh just you know for uh utility we've given you some examples of how you can do this from the command line so let's go ahead and create a create a private key here and that is very fast and list that out so that's the private key you never want to ever want to show that and then you create the corresponding public key so let's just go ahead and cap that public key right there and we see that we've got this key pair so let's just grab this guy and copy that and then we'll go back into here and we will paste in that uh the public key and click create now again this is a action that's changing the state of the system so what do you expect do you expect that action needs to be signed and so once again I'm going to sign with my web offend credentials and that will go ahead and create the key pair uh or excuse me the the service count in our system and now one time in one time only it will also return an access key right so this is actually a jot token that you're going to use as the bearer token in the authorization header of every request that you send up so again the service account really has two Secrets it's got this one which is the jaw token which I'm going to go ahead and copy and then take that and put that in a secure location and that's just standard rest based you know API authentication authorization Bearer and then you're going to put that jaw token but then it's also got the secret that we created here in the Shell which you're going to use to sign those requests right so now I have both my jaw token and I've Got My Signing secret and I've got the new service account which I could just click here and now that I've copied securely copied my my jaw token and this is what you'll use to access the defense API okay now that we've created the service account we're going to go ahead and create an application so just go ahead and click on applications here so applications are going to scope your credentials to a specific what's called relying party so let's take a look at the information when you click new application here so I'm going to start by just calling it you know my application something along those lines and you definitely want to choose a client-side application now even though you're going to be sending requests from the server side no that's a bit confusing but this these are the fields that are required by the client side application so we've got both a relying party and An Origin right and so actually I'm going to start with the origin and this is kind of the full URL of the application that would you'd eventually be calling from the front end so let's just imagine that it's you know https app.

myco.io or something like that and the relying party really just tends to be this last portion the myco.io so I'm just going to specify those things again external ID is an optional ID that you can reference from another database but you can ignore or that for the most part go ahead and click create as always this is changing state in the system so I'm going to have to sign this request with my web authent credential here and then this will create a new application in the system and when I go and I click applications then I'm going to see my new application you'll notice there was a default application for the defense dashboard that is specifically on defense.ninja and app defense.ninja which is where we are right now this is the application where my credentials are scoped every time that I execute a web authent transaction to use the dashboard but here's my new application you'll notice now I have an app ID here and then I've got the expected rawing party ID and the origin and in just a moment we're going to see how we're going to use these fields we've just created in both the service account and the application in order to initialize our SDK so we can start calling the API so now that we've created the service account and the application we're going to go ahead and jump into our typescript SDK which is available here in github.

com defensed external defensed X typescript SDK and we're looking at a specific example for setting up a service account we're going to kind of dive into this code and take a look at it so the first thing of course that I'm going to do is I'm going to bring up the shell I'm just going to run npmi on the defense SDK and defense key signer SDK key signer and so those will install and then if I also have a couple other packages installed I've got some node types here and I've got the dot m package installed so from there let's just take a look at Visual Studio code and let's walk through this code and then we'll walk through the corresponding environment variable file and figure out how to populate that uh so we've got a few Imports going on we're importing these this blockchain network here which is going to be a set of enumerated types from the defense SDK foundations here we've got the defense API client which is the main client you're going to use to call the actual uh API through the SDK from defense SDK and we've got what we're calling an asymmetric key signer here and this is what's actually going to take that that secret that you use to create the service account and it is going to use that as a callback to actually do the signing for you so that you don't have to make all the API calls required to do the handshake for the API request signing and then of course we've got dot end fearforprocess.n um great so we've got a main function we're just going to configure.ev and then the first thing we're going to do is take this asymmetric key signer and pass it a number of variables right first the actual secret key this is the secret signing key that you used when we created the key pair for the service account and then the cred ID which is also belongs to the service account and finally the app origin which you just specified when you created the application and these are all pointing to environment variables in our environment file file which we will fill in in just uh just a moment so once we have this key signer now we have the kind of object that the API client can call back into to execute the signature right and so what we're going to do is then create the actual defense API client itself here's defense API and what we're doing is we're passing into it the app ID right which is the ID of the application that we just saw we're passing into it the access token and so this is the jot token that was returned when we created the service account that we securely stored and then we have the base URL which is just the URL to the API which is api.defense.ninja and then we pass in the signer object that we created right up front and so this is the fundamental configuration of the SDK and then on top of that we basically just start using the SDK these are all asynchronous methods so we're going to call await on them and then we call on that defense API wallets dot create wallet and we're going to pass in a body parameter here which specifies the parameters to pass in the body of this API call and in this case we just have a network and we're referencing this enumerated type that's coming off of the blockchain network here and then we're going to console log that and then we are also going to list and await this function as well list wallets which will basically just show us what wallets we have after we have created this initial wallet and once again we are just taking the results of this list and we are stringifying them and then printing them to the console and then simply calling this function so yeah that's a pretty simple setup of the SDK and some simple usage of the SDK so we're going to go ahead and take a look at the environment variable file now and we're going to populate that okay now that we've had a chance to look at the code sample here let's jump into the environment variable file so I've just copied this down from m.

example from the repo and remove some of the fields so that we can populate them now starting at the top we've got the defense API URL so for your purposes this will be https api.defense.ninja this again is our testnet environment so you're going to be working off of the test chains like Corley safolia or Mumbai if you're coding on the polygon side for example after that we've got defense app ID so let's just jump right back into the dashboard and you've just created my application here and right underneath there we've got the app ID so we're just going to copy that app ID and put it right here into our file and then we've got the app origin and again we just specified that which is the full HTTP s URL here as the app origin so we'll plug that in there and then we've got a descent cred ID so this is actually referring back to the service account and here you'll see there's a signing key cred ID so we're just going to grab this value right here and we are going to plug that into the environment here to run and save that and then the final two values in the environment variable file are the secrets uh that we are keeping that give the service account access to the API so the first one is the defense private key and this is the signing secret that we created on the command line and save down it's uh this one the dot dot pem file and the one tricky thing here is that these pem files are formatted with built-in new lines and so you can copy them directly into the environment this way assuming you're using the dot m uh environment package if you're not sometimes it will choke when it gets to this new line and occasionally you may have to try putting a new line characters and putting this all on a single string it's a little bit of a pain it's not our fault it's just environments generally to make sure that that key gets pulled in correctly and that you can sign your transactions appropriately and then the second one is the defense access token which is that JWT which I call Jot token which came back when you created the service account and you copied that to a secure location so now just throw that in here so give me a second I'm going to configure my environment uh here and then we will go ahead and run this very simple typescript example here Okay so we've got the environment all configured with my secrets and now I'm just going back in the Shell here and I'm just going to run you know simple TS node on this file that I created here and do a little praying and then hopefully the SDK is set up and we actually see some of these console logs come out when we create the wallet there we go we've created the wallet and then we've listed uh the wallets that are there and this items array here so yeah fairly fairly simple and straightforward you know from here you can take that same defense API dot wallets and you could execute all the different wallet functions you should see full intellisense there so you should see all the functions self-documenting in the context of your IDE we are currently working the SDK is brand new so thank you you're going to be helping us beta test it and we're currently working on all the documentation for it now you'll find all the documentation in the same location you find everything else which is at docs.defense dot Co and uh yeah that's it thanks so much for choosing to hack with defense uh at East Paris and as you you get into it if you have questions don't hesitate to contact us you can contact us either at ethparis defense.com and there'll be a bunch of us monitoring that email address or more natively just go into the if Global Discord and you should be able to find us at a channel called partner defense so yeah thanks so much and we look forward to hearing from you