147 – Sarah Meiklejohn: Anonymity, Central Bank Cryptocurrencies And The Academic View On Bitcoin

Transcript

[Music] this episode of epicenter is brought to you by Jax Jax is a user-friendly wallet that works across all your devices and handles both Bitcoin and ether go to jx. and embrace the future of cryptocurrency wallets and by The Ledger Nano s the hardware wallet which sets the new new standard in security and usability get it today at Ledger wallet.com and use the offer code epicenter to get 10% off your order and by hide.me protect yourself against hackers and Safeguard your identity

online with a first class VPN go to hide. me/ epicenter and sign up for a free account today hi welcome to epicenter the show which talks about the technology startups and people driving decentralization and the global blockchain Revolution my name is Sebastian guio and my name is Brian Fabian crane um today is a it's a bit of a special show so we've started absent of Bitcoin it's now been more than 2 and a half years in January of 2014 and from kind of the very start when we or briefly after we started we already started kind of branching out and doing a whole bunch of topics that went beyond Bitcoin we started doing the First shows on ethereum uh just when the

show was a few months old and we had conversations already back back then about changing the name s was like yeah Bitcoin EP Bitcoin it's too narrow it doesn't really reflect what the show is about and at the time I was kind of saying well no but it it's it's this umbrella term right it's not just uh big on itself but it also represents the kind of larger space uh this movement this technology and that was true back then but that's definitely not the case anymore so we've been speaking out for quite a while to to change that because the show is about a whole bunch of stuff right it's about Bitcoin it's also about ethereum zcash and a lot of other new protocols coming up new cryptocurrencies

permission ledgers the application of smart contracts permission ledgers in existing systems so all of those and because of that we've decided to to Rebrand to to choose a new name that is more reflective about where the show is at today so that's why it's come to the time for us to Rebrand and for our new identity to reflect all of this uh so at this point going forward the show will now be called simply epicenter of course we'll continue to do regular episodes about Bitcoin uh and all the other topics that we we usually cover so the the I guess the content doesn't change simply the name changes uh in order to uh to reflect the broader ecosystem of decentralized Technologies uh and distributed systems so as a listener you

won't need to change a thing uh all our feeds and distribution channels will remain the same you'll still be able to get the podcast feed at the same place you get you get it now you don't need to change any settings you can still watch the videos at uh on YouTube on our Channel and our social media presence will also remain the same so none of that will change uh you could just keep listening and also we're excited to announce our brand new website EP center.tv which will be rolling out progressively in the coming weeks uh the new website will have lots of new features uh for instance one of the main things that uh the website our current website doesn't have which will be uh available on the new website is the ability to watch the videos because our current website didn't even have our

videos so we're really excited about that and some other new features uh like uh we'll have some uh the ability to search content by topic or by guest um so we've been working on this new website for for a long time and we're really excited about it we hope you'll like it too and we're open to your feedback uh if you have any comments or or feedback on how we can improve the website we're definitely open to that so you can reach us at all the regular places you normally reach us um so yeah without uh without further Ado um we'd like to uh introduce a new show epicenter and also introduce Our Guest for today so today we have Sarah Mel John as our guest she's an assistant professor in computer science at University College London where I also used to study once upon a time she's

been doing uh research uh on bitcoin for four years he's published a whole bunch of papers I think the one that's gotten the most attention had a name was named after an Italian Western called for A Fistful of Dollars although this one was for a fist is full of Bitcoin so she's been doing a lot of really interesting work on bitcoin and we're very excited to to have her on so thanks so much for joining us today Sarah oh yeah hi guys thanks for having me on yeah so I actually came came across because I was thinking like well we need to like think a little bit about who what guests have on of course I'd heard your name before and seen kind of your work but then I was sort of looking at at Google Scholar about just articles

about Bitcoin and then you came up a few times and I was like a we should really talk about this stuff sure especially so if we talk about deanonymization it's also a topic that I think we've done a few episodes on at the very least we've done one with chainalysis once and I'm not sure to what extent I don't remember to an extent we've we've covered some of the um some of the uh privacy enhancing techniques but do you just want to give us a little bit of background about uh what you were looking at in this research sure so um we basically got looking at Bitcoin in I think 2012 like early 2012 um and you know at the first

we weren't really sure what we wanted to look at I mean we just kind of thought it was interesting it was you know not as big as it is now so kind of the first few you know use cases were coming out and so we thought we' just kind of look into it um and previously you know I'd been doing a lot of work in cryptography a lot of work in like Anonymous credentials electronic cash and stuff like that so maybe kind of naturally our interest was in in the privacy of this things um and also at the same time kind of just a general question of you know what are people really using these things for at the moment I mean you know in the beginning you had heard so much of course about Silk Road um you know in the infamous sort of pizza transaction

but the question was you know what's going on with these currencies um what are they being used before we were seeing all these transactions um you know how can we kind of take this just Ledger of transactions and try to assign meaning to it you know try to figure out what is being represented in that ledger and so that basically is how we got started with um this topic of you know deanonymization um and again really just trying to figure out what individual transactions were representing um so basically we as I said started doing that and eventually our approach boiled down to kind of two things so one side of things was clustering different Bitcoin addresses

together right so if one person can go use a lot of different pseudonyms then if we're trying to figure out you know the transactions that belong to that person we need to have some way of assigning you know Common ownership to their pseudonyms um and then the other one was this kind of actual tagging of addresses right so even if you can cluster all these addresses together if you don't know then who they belong to it's just sort of oh one cluster transferring to another cluster um and you don't again you don't know the actual actors here so that was that was sort of our approach so the the idea of De anonymizing Bitcoin uh I I I guess sort of goes contrary to the you know the the

initial ideas of Bitcoin um where you know payments are meant to be anonymous or at least pseudonymous uh what kind of reception has your research uh received from the the broad Bitcoin Community yeah it's been mostly kind of negative or certainly was at the beginning you know people saying oh how could you it's unethical um but you know I I think to be honest um you know so most of those concerns um stemmed from this very legitimate question of you know what were we doing with our data set right so we had collected addresses um by doing our own set of transactions okay and we had used that um sort of

tagging of transactions to feed into this clustering and so we had built up this kind of database of observable addresses right which addresses belong to whom and so you know I think it's fair to say well you know I didn't consent to that in some way and now you might be sharing that data set with you know God knows who and that's really not fair so I think you know as the years have gone by people have realized you know we're not the enemy right so for one thing we only did transaction with people who were willing to do transactions with anyone and so what that actually really translated into is we didn't do transactions with people at all we mostly did transactions with Services okay so we mostly opened accounts with exchanges and did transactions there so we weren't you

know de anonymizing a person we were de anonymizing Mount goau let's say or you know silkroad or something like that um and then the other thing is you know that now um you know our technique and the techniques that were kind of built around the same time have been incorporated into you know these commercial products right so this is now a service that people are doing um and so it's sort of I mean maybe it's you know that we've we we look sort of less bad in the face of what's Happening Now um so I think you know the reception initially was kind of you know people were a bit shocked um but you know the other thing is I mean people really sort of deeply embedded in the Bitcoin Community already knew this was possible

you know they already knew that pseudonymous doesn't mean Anonymous and so I don't think it really came as a surprise to any of them in particular so you know I think after the sort of initial shock maybe people realized that you know in some sense I would hope that our research could be viewed as more useful than anything else because at least it's drawing awareness to something that was already possible and that you know for all anyone knew law enforcement or whoever was already doing anyway and all we did was make that fact public so you mentioned the the things of clustering users and then uh trying to sort of tag and say okay who is this are there other things that are being done do you know some of the the

commercial products now do they they also rely on some other techniques yeah so I mean I've you know only talked to a handful of them um the ones I've talked to I I've been quite surprised that basically they are doing this these things manually right so you know when when we did this project I mean you know I basically spent a full month just sitting there you know transacting with Mount gaau and then you know so depositing Bitcoins into Mount GX waiting for the six confirmations you know waiting for them to maybe mix them up a bit withdrawing them depositing them into insta wallet I mean it was really really dull um so I was pretty surprised to to hear from them that

basically um you know while some of the clustering techniques that they're using maybe have gotten well definitely have gotten more sophisticated um the way that they are tagging addresses sounds like it's it's pretty much just what we were doing you know they basically hire someone to sit there and and do this kind of stuff um which which I really found quite shocking I mean I really thought of it as just this total like academic exercise you know proof of concept but um but it's not apparently now during this process right so you you you de anonymized a lot of a lot of entities in there and you kind of looked at also the history of how

Bitcoin was used throughout its its time and how different Services came about and usage pattern changed can you share a bit what are the most interesting takeaways from from looking at doing almost this archaeological uh digging in in the underground of Bitcoin sure um yeah so I guess I am going to sound like a bit of a historian in here um so I think you know one of the things that we noticed was that the sort of usage of wallet Services um had gone through quite a lot of you know Peaks and troughs right so in the beginning you know people were were using these wallet Services quite

extensively so I'm completely blanking on the name of of one of the first ones um but it was really really popular you know in our clustering that cluster showed up huge there were a lot of Bitcoins going into it um and then that service suffered a a theft um you know maybe the creators made off with all the funds it was never really clear um and so then you saw for a long time that people weren't using them and then you saw sort of another Peak where people um started using insta wallet quite heavily right and then they stopped using that as well because of their also Heist uh possibly theft who knows um so in general that that was sort of one Trend um then obviously I mean we we sort of

did manage to chart you know the bit the you know the rise and the fall of services like Mount gaau and Silk Road um less so with the newer dark markets um of course one of the biggest things that that really kind of was annoying in our analysis was um stuff like Satoshi dice you know just completely clogging all of the transactions I mean just jumping up to you know 60% of all transactions and we'd be like oh there's this really interesting pattern going on you know let's investigate it and then we'd go into it and it would just be some Satoshi dice tick and we were like oh never mind and it was just it was really frustrating I mean if you sit there and read a lot of the details of the paper you know a lot of the heuristics um that that we developed you

know in particular this one around change addresses I mean we just had to tweak it so many times you know because of Satoshi dice or because of stuff like this because it would just have such a massive effect on everything we came up with just due to the sheer volume of transactions um so that was that was sort of an interesting one um and then yeah we just sort of had our own you know set of weird interactions I guess I mean the one that I think people like to quote from our paper is that you know our our experience with the mixing services that existed back in 2013 was pretty uh pretty unimpressive I'd say so they um they either failed completely to mix our coins so we would send them

Bitcoins and they'd send us back our own Bitcoins so um not so much erasing the transaction history um or one of them just stole our Bitcoins so that was that was great um guess what do you expect um but yeah I don't know I mean it was it was definitely very interesting you know I I can only imagine what you'd see if you kind of kept this stuff up and and saw what's going on with the market today let's take a short great to talk about Jax Jax is a multicoin wallet created by the people at the central now in the past if he had a whole bunch of cryptocurrencies it was a pain to handle them you either had to leave them on an exchange which was insecure or you had

to have all these different wallets which was a hassle fortunately now with Jacks those medieval days of darkness misery and suffering are over Jack supports multiple cryptocurrencies and new ones are being added but it's not just storing cryptocurrencies you can do with Jacks but you can also exchange them directly from with inside the wallet thanks to their shape shift integration and since there's only one seed Jax makes it super easy to back up and sync to the other devices Jax works with Windows Mac OS Linux Android iOS and has browser extensions for Firefox and chrome so go to jx. that's jx. to download the wallet and get

started today we'd like to thank Jax for those the support of epicenter so could you uh explain then if we dive into this more technically how clustering Works to De anonymize users sure so uh basically what we did was we used two techniques so the first one um has been used by a lot of other papers um basically every other paper that's done stuff like this um and this is based on sort of um this co-and thing right so basically in Bitcoin you know transactions can have many inputs and many outputs but the idea is that if you see two addresses used as the same input right so the the transaction has to be signed by the secret key corresponding to every input address um and so the

idea is that you know people are sort of well people are very unlikely to share uh secret Keys um since that would allow them to spend each other's Bitcoins and they're also unlikely um although we'll maybe get into this later to to sort of sit around and sign each other's transactions so the idea is um that if you see two addresses used as the input in a same in the same Bitcoin transaction then they probably belong to the same person and again with people it maybe gets more complicated with Services it's really I think quite a safe assumption even today okay so a service is just going to create a transaction and sign it itself and and send that out so this is the first teristic is basically every address um

shared ownership okay and of course this collapses is you know things a lot more than say just you know for one transaction right so if you look at you know addresses a B and C and A and B were used as input to the same transaction and then in a different transaction B and C are used as the input you know now you can collapse a b and c all into the same cluster and so actually this is already like an extremely effective heris right but in our analysis um the issue was you know we we didn't just want to sort of cluster things we wanted to be able to track flows of Bitcoins and in as I said Bitcoin address uh transactions can have both many inputs and many outputs and so if you've got a

multi-output Bitcoin transaction and you're trying to say okay where's where are those Bitcoins going um it kind of obscures what's going on right because you don't really know which output is meaningfully representing sort of the output of the transaction so this led uh gave rise to the sort of second heris stic um which was based on this usage of Bitcoin change addresses okay so in the sort of standard Bitcoin client um at least as it was in in 2013 2012 um basically the client would create a new Fresh change address every time change was needed and by change I really just mean you know the standard notion of change you know I want to pay for something with a 10 pound note but it

only costs six pounds so I'm going to get four pounds um back so of course in Bitcoin you know you can't I I'm not gonna give you the 10 pounds first um you might just take them so I kind of create this transaction where I just send four pounds back to myself um and maybe somewhat ironically the idea was that these this use of fresh change addresses okay so a new change address for every transaction the idea was that this was somehow more Anonymous than just reusing say one of the input addresses or reusing an address that you've already used okay because a priori if you look at these transactions um and it's a fresh change address you can't necessarily tell which is the

change address and which is the the legitimate one but it turns out you know that there are some identifying characteristics okay and in particular this sort of fresh one- ESS of change addresses um allowed us to at least attempt to identify them so I say attempt to I mean I think in the end we were successful in reducing the false positives but you know it was extremely Tri okay so if you just said right um I'm going to just look at every onetime address as a change address and assume then that I can cluster that address in with the input addresses um you're going to end up with like every service in Bitcoin as one cluster okay

so it was really um it would really just collapse the whole network if you just did things that way so we had to do quite a lot of tweaks um you know I I won't get into all of them but quite a lot of convin vincing ourselves that the false positive rate was as low as possible um before we could finally apply this Uris stic and I would say this euristic i' would probably not consider you know safe for use today you mentioned that uh in you may see transactions with multiple inputs where you have many of the of the same inputs uh is that right so well you could um what would be the use for that why would someone have two of the same inputs in one in one

transaction well so I mean technically in Bitcoin an input is not just an address right it's an instance of an address right so if I receive if I have an address that I'm you know telling everyone about um if I receive Bitcoins into that address um in one transaction and then I receive Bitcoins into that address in another transaction um it's not like the Bitcoins are just sitting in that address right so inputs to a Bitcoin transaction are really more unspent transaction outputs rather than addresses and so each input is actually referring back to the transaction in which it received Bitcoins so even though it could be the same address um

the fact that it received Bitcoins in a different transaction um means it still needs to be referenced separately hopefully that makes sense yeah absolutely now we talked a little bit about the reception you've gotten right that people were kind of uh being a bit skeptical but if we what about you like what is your opinion about the ability to to do this kind of thing in general do you think this is a problem because it undermines the kind of privacy that people can have when they use Bitcoin or cryptocurrency you think that's going to be a roadblock in terms of getting ad option or do you think it is a good

thing because it can be used to to track thieves and to prevent money laundering perhaps I mean I'm going to try to take a pretty neutral position on this I mean I would say you know I it's a bit surprising that people were thinking that a currency they're transacting with that has a globally visible transaction Ledger you know every transaction can be seen by anyone forever um it's a bit surprising that people would think that was you know going to provide them with a lot of privacy to begin with right I mean I know it's using pseudonyms and of course looking at those pseudonyms they have nothing to do with your real identity um and of course it's true that even you know all these deanonymization techniques it's not like they fully

actually de anonymize anyone right it's not like in our paper we've got the real world identities of people you know listed next to all of their Bitcoin addresses um but you know I I think you know I would say that that expectation to me was never particularly realistic um so you know I I would say again I I think our paper was you know a a good thing in terms of demonstrating the feasibility of this and then letting people make their own decisions I mean you know there's always cash if you want really really genuinely opaque Anonymous transactions um now of course there are the sort of roll out of of new ledgers like zcash um and then these overlays

onto Bitcoin like coin join and stuff like that that are designed to make things you know more Anonymous but you know the truth is I mean again you've got this public transparent transaction Ledger um so I think just acknowledging that that is you know never going to get full anonymity in the sort of airtight cryptographic sense um is sort of useful to just guide people in terms of the decisions they're making about you know what they're doing with this currency great so we also talked touched briefly about a a coin join and and you wrote a paper recently that talked about some of the Privacy enhancing technologies that are available in

general can you give a brief overview about what you think are the most interesting and important ones sure so I I mean I think you know coin join is is probably one of the more interesting ones to me I mean it's so sort of simple in a certain way you know what it allows you to do um it's also seen you know actual adoption as far as I can tell um and you know I think it's it it is relatively effective I mean the the point of the paper we wrote was that you know there were all these claims that you know oh if the values are different you know just do subset sum right just see sort of what adds up to what and you can figure it all out um and we actually achieved I mean granted we were using like my laptop rather than some really

beefy machine um you know we we found that it was actually pretty difficult to really do this effectively um and you know part of that is that it's really difficult to even know what's a coin join to with right so coin joins typically have sort of more than average inputs maybe and more than average outputs um but increasingly a lot of the way you know exchanges are kind of handling things um and wallet services are handling things some of their transactions look like that too and so it's not actually possible to say and just to to give some context on coin joint some some people may not be familiar with it right coin joint is

essentially if you're going to say okay we're going to try to confuse people like you uh about like whose address is who so if for example I want to pay I want to buy coffee s wants to buy some drugs on Silk Road we sort of like mix our inputs and outputs and like sign each other's transactions or or make one big transactions to mix them uh and then uh it will be hard to know uh whose output actually came from whose input is that roughly yeah so it's basically you know what I said before about that heuristic of oh you know if there are two input addresses um they probably belong to the same person um you know and I said who's going to bother to sit

around signing each other's transactions well coin join is basically the answer to that so coin join is basically saying you know find two people no of course with coin join there is still the question of of how do you find these people um but you know coin join basically says right you guys get together sign each other's transactions um this first heuristic this co- spend turistic is now out the window I mean you can't apply it at all um and the other sort of nice thing about coin Trin was you know there were these mixing Services right but you know as I said with our experiences with them um you know trusting them with your coins I mean literally sending them your coins and then hoping they'd send you someone else's coins back I mean that that's a flawed trust assumption right I mean why

would you trust some service that you found via tour um so coin join also addresses that thing and then it's sort of fully decentralized right I don't have to trust you if I want to mix my coins with you and you mentioned that this is actually seen some adoption can you share anything like what services use it how has the percentage of coin joint transactions increased over time so again I mean I can't say 100% because you know I don't know what's a coin join and what's just some transaction with many inputs and many outputs um I will say you know we did a very rough guess at what a coin join might look like and regardless of you know whether it was true the number of transactions you know

um matching that pattern did kind of go up pretty exponentially um starting roughly around the time coin join was proposed so like September November 2014 or something like that um and then the other thing is the way we engaged with coin joins or shared coin as it was called was using um blockchain un info's wallet service so they actually had it integrated as a feature um in the service and I mean early implementations of it were a little bit buggy and I'm not sure if they even support it now but you know the fact that it was this technique was integrated into one of the main wallet Services um kind of speaks volumes about its adoption I think so there have been some other proposals on

how to you know have privacy in a cryptocurrency uh some of those has been actual cryptocurrencies like like Dash we've had zcash uh as a topic on the show before Monero as well um what is your opinion on on these uh privacy enabling cryptocurrencies I mean to be honest I'm I'm a bit torn on them I mean I you know I think well certainly you know cryptographically you know stuff like zcash is is really interesting um you know it's really great to see that you know the feasibility of it um you know I'm I'm in a lot of Senses a big supporter of it um on the other hand you know a sort of fully Anonymous um cryptocurrency you know it is it is ultimately a little

worrisome um you know just thinking about sort of you know the kinds of people who would gravitate towards that you know what people are doing with it um you know and I I I do think also from a sort of you know regulatory law enforcement perspective I mean you know we've been it's it's been pretty positive right mostly the response that we've seen to bitcoin um and I think you know a big part of that is that law en enforcement again maybe after some initial shock is looking at this saying you know well actually this transparency Works to our benefit and you know if we just sort of learn to to deal with this you know this is I mean in some sense it's a lot better for them if you know drug dealers or whoever are using

Bitcoin than using cash right I mean you can learn a lot more from the Bitcoin transaction Ledger than from cash which again is is really opaque so you know in some sense I'd also wonder you know know if we sort of see real adoption of of stuff like cach or Dash or whatever you know what the response would be there right because there you really can make essentially no case um about the ability of you know law enforcement to effectively you know neutralize threats or whatever um so that that I think would be really interesting to see you know how it plays out let's take a break to talk about The Ledger Nano s the new flagship Hardware

wallet by Ledger I'll pass it over to Ledger CTO nikab Baka who can tell you all about Ledger's security features and SDK so lure Nano s is a personal security device based on a secure element screen and button so that you can verify everything that is done on device and make sure that you are really doing what you want it to do compared to our previous solution this device is based on the latest generation secure element the sd31 from STD M core the sd31 is an is using a secure arm core which means that you can have the same ease of development that you would have on a generic microcontroller but benefit from the security features of a secure element security features include an application firewall at the lowest level

that let you protect applications from each other which means that you can load multiple application on the hardware wallet even post insurance and you as a developer will be able to leverage these features to load your own application without our authorization and without any kind of authorization from the vendor we will be providing this device with an open SDK um that let you do anything you want with this device we provide sample applications for cryptocurrencies different cryptocurrencies so Bitcoin ethereum uh and we will also provide Pho authenticator and you will be free to add everything you like for example you could add some secure messaging some encrypted chat and you'll see that the

solution is quite powerful and very easy to develop with the Nano s sets the new standard in Hardware wallet security and usability you can get yours today at Ledger wallet.com and when you do be sure to use the offer code epicenter to get 10% off your first order we'd like to thank Ledger for their support of epicenter coming back to uh you know specifically your research and denization do you have any um experience or or or uh yeah has Law Enforcement uh used those techniques do you of any instances where law enforcements has used use those techniques to De anonymize transactions and potentially like you know Catch a Criminal well I mean I guess Everyone likes to point to sort of

you know what's publicly known right in the sort of um Ross Alber case you know that one of the appendices or whatever was essentially um you know blockchain tracking analysis you know from him to Silk Road or Silk Road to him um I I've definitely talked with law enforcement um you know they don't necessarily keep me in the loop uh in terms of what they're doing so I I I genuinely don't know you know exactly what version of these deanonymization techniques they they may or may not be using but um I've certainly talked with them now this is probably a kind of a question that doesn't have a real answer I suspect but let me ask it anyway do you think there

is a way to have sort of The Best of Both Worlds to have uh some ability for for law enforcement for governments to prevent money laundering but at the same time also have a privacy for the users is there is there a way to have both I mean basically no you know there there are ways technically to you know achieve things that look kind of like that assuming you know honest governments and stuff like that right I mean there's escrow systems or you know I identity registration um but you know the Assumption there is that you know basically your identity is

sort of locked up in some way that only if law enforcement came along with you know probable cause and whatever whatever that they could unlock it or someone could unlock it for them um and unfortunately this assumption just doesn't satisfy anyone anymore right especially not people in these communities I mean so basically the answer is not in any way that you could really see being adopted I mean you could propose a system where technically all the features were there um but you know I I suspect no one would believe in it um maybe we yeah just maybe it's a bit cynical but I I basically think that the assumptions that would be necessary to guarantee that you know your identity wasn't going to be revealed unless blah

blah blah um people just wouldn't buy that anymore although I guess you could have something like with what you talked about right if if sort of the the information was guarded somewhere and then you had some kind of multi- type thing that gave gave access to law enforcement so at least you could have for example have a record of every request being made and the evidence presented by law enforcement so that someone can go back and perhaps one could construct systems that would at least give a decent amount of um assurances well again it's it's technically feasible to do these things I mean maybe it's even interesting to sort of see what it would look like but again I mean the the issue with these

things is not just that you know most people in this space would just assume that law enforcement was just de anonymizing everyone um it's that that kind of thing it's almost impossible to make that visible right so this this sort of deanonymization where they're just um you know getting every identity out of escrow so to speak um it's very very difficult to imagine how to make that like a visible known process as opposed to something they can just invisibly do behind the scenes um without anyone knowing how many identities they're you know opening up and and which ones and stuff like that and of course if you could know

which ones then it would kind of defeat the purpose so that that is the part that you know is technically um kind of it's not clear what that would look like maybe if you could make it visible you know how often this was happening um and forcible then people would be more attracted to it but um yeah again I I think technologically there are interesting questions maybe it's feasible maybe it's not um sociologically there's quite a lot of you know obstacles for a system like that today's magic word is currency c r ncy head over to let stock bitcoin.com

to sign in and for the magic word and claim your part of the listen [Music] reward so moving on to another topic uh that you've uh done a lot of research on and re and written a paper about is a central bank cryptocurrency so of course we've had David andant on uh quite a few months ago uh to talk about this topic uh and and recently has come up into news since the uh Bank of England has announced that they are working on a project to build a central bank cryptocurrency um which I personally find is really interesting um could you talk to us about uh about you know your

research around this specifically the protocol that has been developed uh that that you've uh co-authored called RS coin sure um so basically I I moved to London almost exactly two years ago um and you know I was sort of you know giving talks meeting people um working in kind of fintech and stuff like that in London um and got introduced to someone at the bank of England um and learned that they had formed very recently this digital currency group um kind of went met them talked with them they pointed me at um This research agenda that they had just published um This One Bank research agenda and in this agenda was this question of you

know how would central banks issue cryptocurrencies so you know I mean anyone who's sort of spent you know any academic anyway who spent time looking at you know stuff like Bitcoin um you know finds it a bit worrisome that you know there's so much hashing going on and that you know the scalability is seven transactions per second I mean it's a pretty common list of complaints that you know people have um or you know limitations that people see in these systems and so you know already I had sort of talked with my colleague um George jesis my now co-author about you know some of these limitations and about you know ways to maybe get around them and so this kind of naturally coincided with you know looking at this question

of how would central banks issue cryptocurrencies and so our feeling was you know full decentralization is ultimately quite a sort of paranoid requirement I guess like if you say my system has to be fully decentralized I don't trust anyone you know I don't trust any group of people I just want this sort of to be spread out as much as possible um you know that that's not um a setting that we always find ourselves in right I mean I can name sort of lots of computing settings where I would be willing to trust you know a set of people and so our question was you know if if you're willing to relax there and if you're willing to trust say a set of people um you know

many people it doesn't have to be small um what would it look like instead okay and in particular if you sort of inject a central bank into this picture okay and you have this sort of central point of trust to what extent can you minimize the trust that you place in the central bank but still get much much better uh properties in terms of these kind of scalability limitations okay so to what extent can you overcome these by placing trust in some kind of central party um hopefully not too much trust um and and that was basically how the project got started so one of the main characteristics of a or roles of a central bank is is money uh issuance um

could you explain how in your proposed uh protocol uh the central bank would have the ability to issue uh money into the system and extract money from the system yeah so it's it's really quite simple actually so basically um the bank is the only one who's allowed to um issue new coins um and that's because the sort of rules of the system are that um all sort of new transactions so creation transactions where the coins come from nowhere um have to be signed by the bank so you check if the signature on that transaction is valid under the public key belonging to the

bank and if it's not then it's not a valid coin generation and if it is then great so it's very simple sort of technologically you know how we make that limitation um actually the question of extraction is um is a really interesting one so in our system um it's not just the central bank that can extract coins from the system um so right in any you know system like Bitcoin or whatever based on sort of public and private Keys um basically anyone can destroy coins right and we've seen lots of examples in Bitcoin of people destroying their Bitcoins or just accidentally um you know wiping the hard drive that the keys were stored on and so just losing their Bitcoin

um and so that's that's also a a property of our system in the end as well that anyone can um still you know burn their coins if they want to although I guess would it be possible let's say I in Bitcoin I had my heart drive with a million dollars on or something and I throw it in the dump and then it's gone yeah uh I mean I guess there wouldn't be CU I mean if you could prove that it's lost potentially you could go back to to Central Bank say listen uh it's lost can you reissue my money right but I again I don't see how I mean lost is indistinguishable from dormant right so I can't prove that I

don't know a secret key right unless I guess sometimes it gets sent to an address where you know that there's no private key know or yeah although that's an interesting like crypto question whether you can prove that it's like a hash I mean the thing is it's hash right so I don't think you can even prove that that it's a hash for which no secret key exists I mean there is that one Bitcoin address right which is the hash of like the all zero string but even for that I don't really know how you'd quite prove it interesting crypto question so what would some of the advantages be for a central bank to to do something like that sorry just to

clarify do you mean the advantages for the Central Bank itself or the advantages of for a government to say okay we're gonna we're gonna go ahead we're gonna issue our national currency British pound for example on uh on a blockchain and and run it as a sort of cryptocurrency why would they do that yeah I I honestly can't answer that so you know I I don't work for the bank of England I'm not an economist I mean you know I think we've asked them that um I I think they did recently publish something with with you know some ideas um in in sort of economic terms but yeah to be honest you know we we were really focused on the how and not so much on

the why let's take a short break and talk about hi. me hi. me is a VPN provider and if you don't know yet why you should need a VPN provider let us help you I'm sure you like me and when all the crazy Revelations came out during the Snowden time uh of all the the spying that is being done by the NSA and other government agencies you were shocked and you said not with me not with my own rights now the way government agencies can spy on you there's many of them but the most easiest way is by simply going to your ISP and getting all your traffic capturing all your traffic and the VPN can protect you from that it can give

you a secure tunnel from your computer to any of the exit nodes all over the world so that all the traffic goes to this secure pipe that's encrypted cannot be intruded on and with he. me you can choose any of their their 30 exit noes all over the world so you can enter the internet in a secure location the best thing about hide.me is that they have a free plan which includes 2 GB of unthrottled bandwidth per month so you can go to hide.me epicenter to create your free account and when you use that URL you'll automatically get 35% off if ever you decide to go premium Now the premium plans are really great they include unlimited bandwidth access to all of the 30 exit nodes that high. me provides and

you can install it on up to five devices at a time so you can have this running on your phone your tablet your computer at work your personal computer and just be completely protected all the time and of course high. me accepts Bitcoin so we'd like to thank high. me for their support of epicenter Bitcoin so in in your paper you ex you you talk about minets uh which are I guess sort of validat of transaction could you explain how then what so what is the what does the transaction validation system uh look like uh in RS coin Yeah so basically um these minets as you said are there to validate transactions and the idea is that you know rather than using a very expensive

broadcast channel like Bitcoin uses um users can actually be aware of these minets directly okay so this is again the big big tradeoff in terms of trust that RS coin makes which is we say that there's sort of this list of known menetes these minets have you know some real identity okay so they could be like a commercial bank or something like that and users can actually go directly to menet um with their transactions to process um the sort of space of transactions is sharded up um so this means that each minet is an owner of a certain sort of subset of all transactions okay so again we're sort of avoiding voiding this situation in which

every minet needs to hear about every transaction this is really the thing that makes Bitcoin so very expensive um and the idea is that users will now go to minets with their transactions minets will sort of process their own little space um you know of of these transactions um obviously talking at some point with with other minets um who they might overlap with and then at the sort of end of some predetermined time interval that we call a period minet Send these transactions to the central bank and you know by sort of the magic of um consensus the set of transactions that the bank receives is hopefully if everyone's been behaving well um already consistent okay so

there's no double spending there's no well mostly double spending is the thing we're worried about so this is a good set of transactions and all the central bank has to do is kind of you know set Union and publish these transactions and this is the sort of set of transactions that have happened so if you let's say now barkless was one of those mints and uh does that mean if I hold some money it is held with a particular minted kind of and I have to S my transaction there or can I say my transaction anywhere well so the way we've designed the system um we designed it to eliminate um communication amongst minets okay so the way it currently

works is that a user will sort of have this lookup table and they'll say right here's my transaction um who do I send it to okay so the transaction itself sort of determines the mnet it needs to get sent to so yeah it's not the case that oh I all my transactions go through Barclays or all my transactions go through HSBC they go to whichever mtet is responsible for that particular transaction and then if I have another transaction it may go to a different minet now of course I I should mention you might imagine a system in which you know while I say well I know bar plays you know that's my that's my bank can't I just send all my transactions there um and the answer is basically yes but then that's that just requires another layer of sort of communication right so

Barclays would then sort of forward your transaction to the mtet who is actually responsible for it so it's a bit of just a technical detail um but in the system as it's currently laid out transactions just sort of go to whichever mtet um is responsible for that transaction and if if you dig a little bit deeper so let's say I want to say send some money to sasan uh and and then my transaction it would get sent to the minted where his address is managed at or I I don't totally understand how this works yeah so basically you you have some coins and you received them in a certain transaction and that transaction just

you know it has some hash and the hash of that transaction determines which minets are going to be responsible for processing that transaction so when you go to send those coins onward um it's just sort of determined by that hash so it's it's really quite a random well not literally random but yeah it has nothing to do with you or the recipient or your address or which address you're using it's really just dependent on this sort of you know random string of characters that represents the transaction and so what about double SP and let's say now the minets were maybe some corrup corrupt employee or

something like that or maybe one of the minets itself is is sort of dubious um is it possible then for them to facilitate double spend of money so if one of the minets is is bad then no um if a lot of the minets are are bad then yeah this becomes a problem so um in particular we have these two sort of models one is a nice friendly model where we say there's an honest majority of minets per Shard so that means that when I'm processing my transaction um a majority of the mtet that are looking at it are good okay they're going to not sign off on double spending so if you're in that setting then we can guarantee that

double spending is not going to make it into the Ledger you know full stop even if there are in every Shard you know um one or two bad mint tets we we can still can make that guarantee and of course of course this depends on the number of minets per Shard right so this is your classic like distributed system redundancy thing right I mean it could be three five seven whatever um now there is you know we we we're cryptographers we have to be paranoid professionally so you know there is the possibility well what if you have a dishonest majority per Shard and so in that setting um we actually can't guarantee that double spending isn't going to make it into the letter but what we can guarantee is um AUD ability basically of these minets and so in

particular we can say that um if double spending does make it into the Ledger um we can force minets to essentially log their activity throughout this period and we can then go back and look through that activity and see which minets were responsible for getting that double spending Into The Ledger okay and then again because we do have this sort of central point of trust in this Central Bank we can actually take action against those minets okay and they can be punished appropriately for allowing devil spending to make it into the Ledger let's look at it this way if if uh I don't know if this would be possible or not but would it be possible let's say you had you know like all the

major banks in in England for instance um and a majority of them were in disalignment or uh not agreeing with economic policy uh could we see some sort of um I like a economic banking coup where like a majority of banks would take over the system and form their own like new Central Bank uh where they would impose their own monetary policy well I mean you know ultimately you know RS coin as we've proposed it is just sort of another Ledger right so I mean of course it it really just depends on adoption and on what people want to do right I mean if if the banks say you know I don't agree with your policy um

I'm not going to act as a for you anymore then they could stop acting as a mtet and they could go off and you know form sort of yeah some system without the central bank or some system with another Central Bank um but you know ultimately these things are all driven by adoption right I mean maybe no one's ever going to use something like RS coin they're all just going to keep using Bitcoin right or something like that so I mean it they can certainly set up Alternatives um you know in our imagining of the system minets have you know quite a lot of pre-existing incentives going on with the Central Bank um that would lead them to want to act as minets but sure it's in their power to to stop at any point so one of the things uh that uh strikes

me as interesting in in this sort of new paradigm where a a central bank currency now has a payment system integrated into it is the need or Reliance that we have on payment system so today we have cash and we've built all of these uh electronic pay pay systems uh to to allow for electronic transfers since cash doesn't allow for that so sort of at the macro level when you look at it now where what What Becomes of payment service providers and in a new paradigm where a central bank currency has a payment system integrated into it do they become redundant or do they have do they have uh are they still valid in

that system I guess is my question yeah I it's a good question I probably haven't thought enough about it to have a great answer I mean you know I think in all of these things you know we we just see a sort of shift right so with commercial banks for example you know you could imagine that rather than having individual users hold accounts with Central uh commercial Banks um these commercial Banks would instead shift to acting as these mtet right and maybe the Central Bank you know as it does now could actually delegate some of these responsibil ities of you know generating new coins and stuff to some of these mnet um over time um now of course I'm not really envisioning any sort of near future scenario where you

know we stop having bank accounts um and start doing all this kind of stuff I mean for one thing in this system you know there is a bit more of a burden placed on the central bank to maintain things you know than in the system where this is all sort of just outsourced to the commercial Banks um here I'm probably revealing my complete lack of understanding of the banking system um but yeah I mean you you know you would definitely see a shift in the sort of role of of payment processors and Commercial Banks and all that and I guess one one thing is also is that you put a burden on the user since now the user has to protect their keys so perhaps then in that case the banks could you know continue to act as custodians of of private keys to you

know avoid just like people just losing their money uh outright um another thing that's really interesting about this is the and of course this is dependent on whether or not a central bank issued cryptocurrency whether that that Central Bank would uh keep the protocol open um well is the ability for people to uh innovate at the edges so you know if if you allow basically just anyone to create wallets or create applications built on top of the Central Bank currency you basically have a a a scenario like Bitcoin where um you can allow Innovation at the edges um have you thought of some of the perhaps use case you know interesting new use cases or business models that this would uh enable again probably you know not

enough to really get into it I mean I will mention this definitely was you know one of the things that came up you know in our conversations with the bank you know that it was sort of you know the system we have now is very fixed right if a you know cool new startup comes along and they want to be a competitor to a central bank or even to one of the really established payment processors you know there's quite a high barrier to entry to a lot of these systems right I mean it's sort of unimaginable that a startup would come along and just start acting as like a clearing bank right or start participating in these kind of like really um nitty-gritty Interiors of this system um and so one of the things they emphasized was you know that they wanted

to kind of lower this barrier to entry right they wanted a system in which startup could come along and you know start acting as a mtet and start doing this kind of stuff um and then as you mentioned I mean I think there's lots of other you know interesting ways to innovate here I mean as you said you know users shouldn't be storing their own Keys we don't really want users to actually have to contact you know look up who the minets are and go contact them so you could imagine creating kind of you know much better interfaces there um so yeah I mean again probably haven't thought it through enough but I would say lots more room to innovate so also we mentioned a few times we've done an episode before with uh with David andal who wrote this paper

fedcoin right and he sort of looked at the same thing but from economists perspective and and one of the things that we talked about there which is interesting and I think the payment processor aspect is an interesting question even even more fundamental question is what happens with the role of banks right because if you have uh something like that right the Central Bank issued money then all of a sudden the whole fractional Reserve System system doesn't really make so much sense anymore because you actually have everything becomes kind of like cash and with cash of course you don't have uh the the kind of Leverage and credit that you have in that you can have with today's digital money system so it's

it's it would be a very fundament it very fundamentally sort of challenges the entire way of how the banking system works so we talk with him about that we're also realizing oh this is actually and this is actually an extremely disruptive thing and what was also of course interesting that some of the sort of you know Bitcoin users are like oh terrible you know this is not try you know trying to keep everything the same it was like if you actually look at it it's like no this is not keeping everything the same at all it would have massive implications which is probably also why it's not going to happen anytime soon at least that's what I suspect well I mean you could imagine a sort of hybrid world right in which you know something like this gets rolled out

along side the existing banking system right so the you know digital Sterling or whatever you want to call it um wouldn't replace the pound sterling it would be sort of an alternative now again this gets back to the question of why um why I use this which I really genuinely don't know how to answer um but yeah I mean you you could imagine you know some kind of roll out that wasn't you know fully disruptive that was kind of you know just a bit of experimentation you know see see how it gets adopted see what people are you know sort of using it for what are the interesting use cases um rather than trying to yeah just completely replace what's going on

now and and also one of the things we mentioned with David which uh I'm I'm really sure how this would play out but if if you have most of the major uh economies uh issuing Central Bank currencies on a on an open cryptographic Ledger and all of a sudden you know someone in Guatemala can really easily use the US dollar than what happens to all of these you know second and third tier currencies uh when you know anyone in the world can start using first tier currencies do they simply evaporate or I mean I don't have enough economic knowledge to know anything about that but uh it just seemed to me that if if this were to be massively adopted by large countries uh we may also see a

shift in how currencies get issues worldwide yeah I mean again uh not enough for knowledge to to answer I mean yeah one of the things we we did kind of talk about though was you know how different Chains would interact with each other and you know how trades would be made across chains and you know as you said Guatemala or a lot of you know countries in Central America either just used the US dollar or pegged to the US dollar you know so how would that kind of thing work um so these are all you know very very interesting I think follow-up questions um you know again certainly don't have the answer now so you've quite done quite a lot of research on on some of these Bitcoin questions and now with with RS coin what

are some of the questions you find interesting today and would like to look at at this point well um you know I'm still interested in these kinds of questions of you know scalability and just the basic you know trade-offs that are being made I think you know we we've just we've seen a few examples along the design space you know the full decentralization but then quite limited scalability um you know we've seen kind of maybe our answer we've seen other things going on you know I'm still very interested in exploring that um I'm also you know still very interested in this question of how to balance you know privacy and transparency right so I mean

I think again we we've seen uh and discussed that you know Bitcoin is is one way a very very imperfect way um we've seen zcash as another approach but you know zcash is largely I mean zcash is sort of for Bitcoin you know I think going outwards um to stuff like you know ethereum you know how are you going to start balancing privacy there you know people are talking about you know the blockchain is the solution for every problem you know medical records stuff like that I mean then you really start to you know wake up and and think you know what are you talking about you can't store people's medical records on a blockchain that's insane um but you know I mean as we talk about storing you

know all this different kind of information you know how is this really going to work um so all these different use cases so you know for me it's really about you know we've got a lot of sort of interesting prototypes out there um you know things that people actually can play around on um I think I'd quite like to go a bit in the other direction and start with interesting use cases and interesting applications and then work backwards a bit you know and think what are the requirements of this setting you know is privacy I mean I think privacy is probably always going to be something that's quite critical but you know in in for example the Central Bank setting you know this was basically our answer to that right we were saying okay we're this is not a setting where you need

decentralization right I mean it's just if you believe in central banks if you are a central bank and you want to issue a digital currency you don't need full decentralization that's very clearly Overkill so what's the solution and this is how we came up with our s coin and so I think in general you know it's maybe time things are maybe mature enough to start looking more at the use cases and then working backwards to an appropriate architecture for those use cases you know rather than just saying you know oh you need to use Bitcoin or oh you need to use ethereum that sounds very interesting and I agree I think that will be a a huge task is to figure out how to actually use all of this technology in in all of these new applications that people think about and and I I certainly

do think that there's so much interesting potential there and so much can be done but at the same time people do kind of forget about a lot of the complexities and problems that first have to be solved and I think privacy is certainly an excellent example of that and a hard problem to solve right yeah definitely I don't expect to you know have an answer for you in a week um but you know this is the the perk of the academic Lifestyles we've got lots of time to to work on these tricky questions well thanks so much for coming on Sarah uh it's it's been a pleasure and we certainly look forward to seeing all the the future papers and research coming out of your uh out of your work and out of your lab and U so I think that's

that's great work you're doing so thanks so much all right yeah thanks so much for having me again and of course thanks so much for listeners we were going to have links to to Sarah's papers and also to her academic page so if you if you want to keep up with with her work we'll have that in show notes so you can check that out and uh we'll be back next week so epicenter is part of the LTB Network you can find this show and lots of others on let.com and yeah we put out new episodes every Monday you can find it on on all the apps iTunes Android Etc just look for epicenter and and you should find it so thanks so much and we look forward to being back next [Music] week no