AnonKlub

Transcript

hello everyone H welcome this is a new series called PSC showcase where we will have some PSC projects presenting and you can go to the website the PSC website H the URL is pscd and take a look at the list of projects the projects are in pcde projects and this is the first session this will be recorded H so the first session for the first session we have go here ER who will be presenting Anon club and you can ask questions during the presentation in the

chat and at the end of the presentation you can also ask to speak and ask question to so yeah got you the floor is yours you can start when you want thanks Vian hi everyone I don't know how many people there are in this call but I think I can safely assume that some of you have already been eligible for an N drop and if you privacy you probably wished uh back then you had the possibility to anonymously receive your airdrop tokens instead of being coer to reuse that address that was included in the airdrop Snapchat

and anod Club is exciting because it enables these kind of applications I'm go I'm an engineer at PC and I will talk about what challenges Anon Club is trying to solve how it's built and show a quick demo um before we dive in I will assume that you've unter the terms on this slide I will not explain in details what they are but if you consider them at Black and you have an intuition about them you know what's coming in and coming out you should be fine for for the rest of this talk um along with Anonymous airdrops that I mentioned applications such as

Anonymous chat groups Anonymous voting mixers or Anonymous nft meeting all require you that you member of a group especially that you um uh the address you own is part of the of a list and to make this first check this is americ proof this is a wellknown problem and then you need to prove that you own this address that you check that is part of the of the set and this is an ecds signature and the the main challenge so when we think about privacy is that from the signature data you can recover the publicly and you then you can recover

the address and by definition public is not very private so yeah you cannot build this Anonymous applications just like this so what do you what do you do you think about ZN and you say yeah let's put this SSA signature and the mer proof into the snar and then we have everything private uh this is what we wanted uh you're able to con if someone gives you a list of addresses you can convin convince him uh that you own an address which is in the set without telling him which one um and this unlocks all the applications you see at the top of this slide now the main difficulty comes from

uh the fact that Computing ecdsa signatures into a snack is complicated due to something called wrong field arithmetic the most common proving Frameworks involve pairing cryptography that re require pairing friendly cures like being 254 uh that as the name suggest has a 254 bits length size uh but the stuff you want to prove you can do within the snack the ecdsa signature involves a curve that has uh 256 bits so eccp um 20 256 K1 and this m this mismatch of bits is

bad because it requires you to do this wrong field atic if you a good comparison to have a nutrition is think about a long trip that you need to split in in lot of different chunks it's a lot of extra work is complicated and it just makes your circuit bigger and it's bad for for proving and verification time and what some people have done is side step this difficulty by using snack friendly curves and then you get applications such as uh semafor or or tornado cach and a significant drawback of this protocols is that they require

interactivity uh what happens there is that there's a sign sign up step you need to register um your nullifier and then the anonymity set size is just is only equal to the number of people that have signed up before you and this is very limiting because the the first P person that interacts with the prod will have much less anonymities that than the last person and with Anon club we want to build something where we have access to the full anonymity set immediately and for this you need to con to constrict your anonymity set beforehand and you need to deal directly with ecdsa signature and NFI within the

snack uh here's is a list of tools um for building ZK ecdsa that we explored the initial version of anon Club was built with C ecdsa the good thing about circom is that the tooling is mature and it's a bit easier to start with with regard to Circuit writing complexity and it supports uh onchain verification uh the drawback is that it does wrong fed arithmetics so the circuit is is quite Big 3 million constraints in our case and we had a proving time of 10 minutes which means we needed a dedicating proving server for privacy applications

um server side proving is bad because uh you don't want to leak a leak a link between your proof inputs and the proof itself and to fulfill that need of generating proofs uh client side in the browser uh personal Labs built an optimization of circum ecdsa called uh efficient ecdsa and then something even faster called Spartan ecdsa that uses well Spartan and a fork of circum this Fork allowed them to pick a curve that is compatible with right field arithmetic and then you get a much smaller circuit and faster improving time and this is what we use in the

current version of Alon Club we're able to build proes in the browser in 20 seconds uh but unfortunately we lost the ability to to verify proofs on chain and so now we're about to uh to leave span and rebuild everything with Halo 2 so that hopefully we can take all the boxes which are the client side uh proving and being able to verify the proof on chain um how Anon Club is built so I mentioned the the previous tool before and there's a query server that we use to fetch all the this list of

addresses that um match different criterias that you can Define for instance you can decide to fetch all the addresses that on at least a given balance of esc20 tokens of which all the addresses that uh have voted for a given um decision for a d and we use different data providers for this uh we use June June uh the graph and Google B then to build the meel tree um we use a rest crate that we then package in wasm and then we wrap this into a web worker so that we can put it in the in

our uh web client same for the SP and proof so first we have a rest crate that we package in wasm and then we put this in a in a we and then you get uh a web app that you can access at this address and I will now show quick video I won't do this live because I don't believe in the in the demo good uh okay so first you can you will be asked uh what kind of proof you want to generate do you want or what kind of anonymity set you're interested in do you want to fetch your list of addresses like I mention that own a given balance

of given asset some e or some esc20 or do you want to prove you on on an nft of a given collection then you just uh input the addresses of either the es20 contract the minimum balance um otherwise you can also upload a file directly if you preface the data you want and this is what I'm doing in this uh in this then you just then you sign a message and then your proof is being

generated then should it takes a I know the M Tre was built first so it took two 3 seconds and now the proof will be will be built and this takes a bit more time 15 to 20 seconds and then you get your result here that you can either copy or download and then once you have this file you can you there should be services that will ask you to upload it and then they will verify it so I don't demo this verification step in the demo because it's not very

exciting and then next slide hey what we plan to work on next so I haven't touched uh so much on the uh nullifiers so it's one of the main difficulty we face so um if you don't know what an alfier is it's you can compare it to an nounce for transactions it prevents you from doing something twice and in the case of um ZK proof or uh it prevents you from reusing the same proof twice if you think about this

Anonymous air drop use case you don't want people to be able to claim their their tokens twice so you uh people are Anonymous but you still need to be able to tell them people a path so you need a nullifier and nullifiers need some specific properties like being unique deterministic uh only require the public key to be verified in the case of ecdsa it's a bit hard because ecdsa involves some Randomness and the most promising solution for for nullifier in the case of DSA is plume um but plume the to build the plume signature or plume nullifier you need access to the

secret key to the private key and it means you need to twg the wallets and they aren't wallets supporting it yet so it means we wish we could use plume right now but instead we will do something uh simpler and not as robust in terms of security uh like just hashing hashing the public here um then as I mentioned we plan to uh migrate to Halo to um we had already a Discord but um back to when we were still using ccom uh this Discord but is asking the user toload pre generated proof and then it will allow you to the

server it's a way to build Anonymous uh Discord servers and then a CLI um because I think it's important to have uh tools you can use offline to generate the proof so the web app is nice but actually you should be able to build the proof offline if you already have the anonity set you want to deal with and yeah this is the organization on GitHub is Anon club and our main repo is also called an and that's it for my presentation thank you for listening and that's it thank you thank you so much H

so um feel free to ask question everyone can ask question can mute thems and ask questions and great presentation by the way very interesting you can also ask questions in the chat as you prefer so we have one question reasons to for moving to Halo

to so the main reason is because with Spartan we aren't able to uh verify proof on chain with the verify your smart contract and for to have a more trustless application it's something we want to have great there is thank you for that there is another one uh which configuration of Halo 2 psc4 with BN 254 are you using if I'm not mistaken yeah this is what we are using to wrong but there's a

isanda working with me on on Anon Club also in the in the meeting maybe maybe you can add more more better answer that that this question than me hey everyone yeah we're we're using uh PC version of hell 2 and also H2 wrong that has some crates uh that are already pre-built ships for ecdsa and hello 2 um and um we're we're mainly going to depend on sigb 256 K1 um H not not R1 um for the questions from on um maybe we will'll take a look at this later um about this random um yeah

um generation the random Generation Um of the curve but this is still yeah in progress and yeah eccp 256 L1 so we first we F we focus on yeah dealing with Halo 2 with the K1 curve but I would like also to support disc because obviously I'm also thinking about mobile devices um but then what I know is that plume is not compatible with the mobile devices because iPhone won't let you access so easily the the private key so if we build something for mobile then we cannot use the best

nullifier uh we know so we need to use something which is a bit worse and then yeah it's all about tradeoff that we yeah what we want to build next so uh are there there any applications using it right now again sorry can you repeat so have you seen any application using anoc Club right now uh applications integrating with Anon club or yes yes uh don't think

so they can be use in real life like a an application and it will work fine so the there's the the web app you can use already then the if you want to build with it with it you can use our libraries and integrate it in your own app and yeah and the next question so next big plans for Anon Club what I like to roll out is the refractor this Discord but and really have it live somewhere maybe at PC so that yeah each uh people at PLC would would need to communicate at the club project or me

one address and then this would be the PSC anonymity set and then they could join anonymously a Discord server and we would not know who who have who has joined right so interesting thank you are there any other questions okay if there are no more

questions so yeah we can wrap it up here thank you so much for presenting G and everyone for attending and have a nice day for you thank you thanks for having me thank you thank you byebye