Privacy in Ethereum by Barry WhiteHat (Devcon5)

hello everybody thanks for coming to this talk privacy aetherium so today I'm gonna talk about like where we are at the moment and kind of where we want to go so in aetherium over the last like six to twelve months we've had a lot of new and exciting your knowledge proof stuff coming up yeah so for example we have a bunch of mixers that are coming out tornado cash is live on May 9 at the moment micro mix is is in progress there's the Argent hopper is live on mainittu and maybe there's more than I'm not saying that I left out and then we have certain kind of other interesting privacy applications like ads like which will be coming out about to run their trusted set up and as well as just doing transactional privacy we also have private applications to do with private signaling like semaphore private voting private hours there's this really cool pull up signaling up at this event where you can get a pork token and deposit into a private pool and then start to make private signals using this which is pretty cool and then we also have like a private voting where it's impossible to prove that you voted a certain way which is important for like quadratic voting and things like that so that's the start and talk about the mixers first so so there's a bunch of snack baits misconnect based mixers at the moment and this is work like what they do is pretty simple so basically you have some money you deposit it into the mixer and some time later you withdraw that money and this question mark here kind of shows that you don't know which depositing switch withdrawal yeah so there's three of these there's there's three of these that I know about micro makes hopper and tornado which is in production so what are the problems with this so one of the problems is that there's like a single denomination you deposit one either and you withdraw one either and there's no kind of way to do internal transactions to solve for example if you want to send some money to your friend you have to deposit the money into the mixer we're draw it and then send it to your friend which is kind of annoying especially because there's like only a single denomination allowed so you can only ever send your friend 0.1 ether or less than 0.1 ether which is a little bit knowing and the third problem is that there's you need to pay for the gas for the transaction but we have this kind of chicken and the egg situation so for example imagine I wanted to I have address a in address B and B has 0 either and a has 10 ether and I want to transfer one either from the dress a to address B but I don't want to link the two together so the first thing I do is I deposit the money into the mixer and then I need to withdraw that money to the new address but I don't have any gas in the new address account so there's no way for me to withdraw it there unless I send so money there first which which kind of defeats the purpose of putting it in the mixer in the first place because because if you send it from address a to address B you you link those two accounts together so what we do instead is we come up with some kind of transaction abstraction where we we make it like another network of nodes that will pay the gas of a transaction and also get repaid that gas at the end of the transaction so those are the kind of three main problems of mixers and here is some some of some kind of attacks that we can leverage the anonymize people so first of all one big problem that we have is that there's no there's no like metadata and there's no like metadata privacy here so when you go into any of the mixers there's a user interface and and when you deposit your coin you you have to send information to to the boxing and that information is sent through that you to create a transaction and you broadcast that transaction through and pure up so everybody is able to know who said who deposited so in Fuhrer is able to know whose IP address sent which money into the mixer but more seriously and pure is also able to know whose IP address withdrew money from the mixer because when you make a withdrawal you also need to send some information to it your you need to request information from a pure and you also need to broadcast a transaction so in Fuhrer knows the metadata you're requesting and you have to be very careful about metadata that you request and and you have to be very careful by the metadata you request and sorry just one second yeah you had to be very dated careful about the metadata you request and the relayer nose the nose the you nose your IP address when you withdrawal so so so what can you do to limit this so you can use tor yeah so if you log in with tor to the mixer which is totally possible you can do your deposit on your withdrawal through toward but very few users actually do this and we should try and encourage people to do this as much as possible so you should use to work for the withdrawal but you shouldn't use it for the deposit and the reason for this is that if you use it for the deposit in the withdrawal you can kind of break your anonymity set up into two groups group number one is the people who use towards a deposit and group number two is people who do good number one is people using towards the deposit in group number two is people who did in a new store and this attack can be be quite serious especially when you have a small anonymity set so for example imagine that there is 100 coins in the mixer and one person deposits a coin weight store and then sometimes later the same person withdraws the same coin with toward know someone which was a coin with tor it seems pretty logical to say that okay the person who deposited with tor is also the person who would true with tor it seems like that is kind of reasonable because why would you deposit with store and then remove tor for the withdrawal it doesn't really make so there are these kind of heuristic attacks that you can do that you need to be careful about yeah so in the long run we should have tor by default yeah we should have tor by default by default for the deposit and the withdrawal so then there's also temporal attacks so imagine that we have a mixer that has this huge amount of ease a deposit deposited imagine there's 1 million coins the positive into the mixer and a tea and then did this what these ones have been there for a long time and then one day someone comes along and deposits one either in and then some later somebody withdraws one either from from the pool so it seems pretty unlikely that the one without one of the 1 million people who had the money deposited there for a long time suddenly decided to come along and withdrawal like you can I would be pretty confident to say that the person who deposited is also the person who withdrew in that scenario so you can have these kind of heuristic attacks that you say okay the last person to withdraw the last person the deposit is the next withdrawal so you have to be careful about by the amount of time that you leave your funds in the mixer so to defend against this some UI is force you to deposit for a certain amount of time but there's also problems with that that you that I can talk about in the questions afterwards if people are interested and then the third problem is that the anonymity said is quite small the current most popular mixer has about 200 deposits at the time that I made the slides I'm not sure how many it is now but so this is an animal anonymity set of 200 which is which I suppose people don't think of when it's not my level of anonymity to say on one of 200 I think that that's like a higher standard so we need to sort of be kind of careful about the privacy guarantees that we that we tell people about when we discuss these systems so okay so let's talk about like how can we pick some of these problems so for example how can we get more people to deposit into the mixer because I will that will kind of make a lot of these problems a little bit less severe because 200 seems like a very small subset so one way to do this is to increase people's confidence in the mixer to increase confidence in their implementations and the crypto components so what we would like so yeah that's one thing we could do another thing we could do is we could combine multiple mixers together these three mixers that are very similar but there is also very compelling reasons why we should have mixers that are more different just from the security point of view it would make sense to have the mixers that are based upon different hash functions different different crypto components so in the case that one of them fails there's still other ones that are still working for example we find out a bug in some of or something like that and the third possible thing we can do is is to perform an MPC trosset setup so the moment that all the mixes in in in in deployment have been have notice it set up they have just a single well they have a trusted set up but they just have a single party that you need to trust in order to be to be confident that the of the private super coins or not to be confident that they won't just one day steal all the money from the mixer which is which is a possibility that we need to be careful about the four thing that we can do is we can integrate with wallets because a lot of people don't really worry about their privacy and if we integrate with wallets we can help provide these people privacy without them having to explicitly opt-in because at the moment you have to go through a series of technical steps that are kind of difficult to perform although they use the user experience of some of the mixers it's very nice it's still it's still like extra work for people to do so I'm one one idea that that we were interested in in promoting as the first step to integrate with with wallets is to create create this create new private address yeah so similar to create new private tab in browsers we could have users at the when they create their wallet deposit some money into the mixer and then later they have the option to create a new private address when they would where they would draw those funds to their new address okay so the first solution is to do the or the firstly we should talk about the trusted set up so at the moment we're running a trusted set up and we have had eight participants so far and we've been running it for about fourteen days I'd like to invite everyone here to participate in the trust and set up at they have time so we're currently running phase one and we'll we can run phase two which is circuit specific later but it's important to remember that both need to be to contain a single honest participant in order for the for the resultant circuits to be secure so here's some links about how you can how you can join the trusted set up you can join this email group and share your your desire to participate yeah and the second thing we can do is we can audit audit the mixes so micro mixes of being audited at the moment by a BDK consulting this is including an audit of circum Lib which will also help the some other mixes definitely tornado cache that use a bunch of components from from circum live in their mixer so but we still need to all it the the circum compiler and the the code for the NPC trusted set up and both of these needs to be audited before we can say to be really confident about the security of our mixer also we still use some experimental components for example the hash function is Mimzy and as far as I know that's never been deployed before so but I'd like to thank people with already network and either in foundation for funding the audit of the mixer and circum Lib components yeah and in order to increase our confidence about the security of the hash functions we're also announcing a bounty for collisions of the main C hash function yeah so there's there's two rounds or there's two difficulties 80-bit security if you find a collision you get 100 or 10,000 u.s. dollars and if you if you break the 128-bit security you get 20,000 US dollars so you can make you can so here's the link to with more information about about the bounty and I'd like to thank the etherion Foundation and oil coin for contributing to the bounty on these hash functions so please attack it if you if you like okay so there's also been a bunch of ideas that people have proposed for including for increasing the size of the anonymity set and some of these and here's some of these ideas that I think won't work for example there's this idea of having an interest rate or paying people to deposit into the mixer so the idea here is that we have a mixer that has some money in it and whenever someone deposits their money we deposited in the compound where we earn interest and then we take that interest and we used to pay other people to put their money into the mixer yeah so it's like a reward to increase the size with the privacy pool so this seems like an interesting idea but it it's been tried before so Z cash had a similar idea where they would reward their they would force their minors to deposit their rewards into the privacy pool and it turns out that this doesn't really work because the minor is are only interested in money Z cash they're not not interested in maintaining the privacy of their coins that they mind so whenever a minor would mine coins into the fives a pool they would always withdrawal them to the same address so I don't think that this so what I feel like in this situation these two cases are quite similar and we should be careful about doing sort of experiments like this and the reason for this the reason why I think this won't work is that the incentives here are misaligned that the users want to use a privacy tool to get privacy but the depositor is the interest or the reward seekers want to do it to make them want to deposit to make the reward but the depositors don't have any interest in maintaining privacy after they were trough and and for that reason I don't think I'm for that reason I think that's pretty likely that they will maintain their privacy after they would rob because they have this capital that they want to invest and as soon as they withdraw what they'll want to put it somewhere else to make some more to make it gains more interest but I'm open to changing my mind about this if we see some like experimental results or some use case where it works a little bit better so also not to talk too much about mixers as like are currently working on confidential transactions that there's I mean they're trusted set up soon and here's a link if you want to participate in their chosen set up and their roadmap concludes like full privacy as opposed to just confidential transactions and they're also talking in the future they're going to use a universal set up based on plunk which is pretty interesting and maybe that will be applicable to the broader privacy community so what can we do in the future it seems like we have these mixers that are like very functionally limited what can we do to improve that so so one idea is that we should add more tokens to the mixer and had more denominations but I kind of feel like the mixers at the moment are not really fit for this purpose because the privacy said is so limited that if you have people depositing into multiple privacy pools it's very difficult to tell how many people deposit it and what true oh no it's very easy to tell how many people deposit never true and you need to have like a high liquidity in order to in order to ensure ensure privacy or to give people good privacy guarantees so instead of this I would I would propose that we should focus on making general privacy can private transactions I see that mixer sounds like a pragmatic first step but in the future we should try and make a privacy pool where people don't ever withdraw or don't withdraw for a long time so in order to do that yeah so in order to do that what what kind of features should we should we provide so firstly we should provide private atomic swaps I think that this this makes a lot of sense on aetherium because there's multiple tokens and unless we allow a way to transfer Tran to convert between different tokens inside the private pool then there is no way to join these anonymity sets together so if we have this kind of atomic swaps inside the mixer we'll be able to kind of trade between multiple different tokens so this work has already been started some people are working on this it's largely in the prototyping phase except for aetherium 9 and 3/4 which has which is well it's a 9 and 3/4 is a little bit different than what I was proposing at the first two the first two things are proposal for this and I know that 0 pool is it is is actively working on this yeah and 93 theorem 9 supporters is another interesting privacy private project yeah ok so conclusions about the mixer so first of all I think we should be really careful about the claims that we make about these systems I feel like we have like a responsibility to sort of be honest and fair with other people when we talk about this and the privacy guarantees that we we provide because like maybe someone's life might depend on the security or the privacy that's provided by these fixers and I think it's really important that we're we're up front with people about about the guarantees that they get well they're definitely the mix is that we have now we're definitely better than what we had before mmm it definitely gives you a much higher level of privacy than we had before and it's a pragmatic first step and it's it's it's it's a good step on the direction that were in a direction that we need to go at the same time these are very new tools the snark programming programming starts and building things which snags have has not been around for a long time and there's very little stuff in production and for that reason we need to be sort of very careful about using these I predict that at least one snack gap will be hacked before Def Con next year and and I'm pretty confident about that so and also it's important to support the people who are building these applications and to understand if some sort of mistakes happen because the only way that we kind of improve and get better at this is by experimenting and making mistakes so as well as being very clear with people a bit about the limited private guarantee privacy guarantees we the mixers provide we should also be very careful about kind of security and warning people to be very careful about using them okay so other important things that are going on oh wow okay other important things that are going on is like voting collusion resistant voting I be resistant voting censorship resistant signaling anonymous login from Adam Stiles I'm sorry I'm very close to my time is up so we also need a lot of help there's a lot of there's a lot of projects that I listed before that need to be worked on and built so I'd like to invite people who are interested in working on this to join this telegram group where there's like a nice community of people working on things yeah and I'd also like to thank all these people who contributed and sort of helped and getting great work in this space this year and last year and for a long time so I'd like to thank all of them and now I'm done I have 17 seconds for questions thank you [Applause] you