Building shielded transactions using ZKP - @semenov_roman_ at @ETHDubaiConf

Transcript

yeah so uh let's talk a bit about uh privacy so the blockchain uh is like a twitter for a bank account so all transactions are public by default so when you pray to someone this person is able to look for entire transaction history or check all your holdings and it's not very convenient so for most users it's unacceptable in traditional finance all transactions are private by default and especially for businesses they are not very comfortable sharing their cash flows and clients and all the stuff so

for a good adoption the blockchain needs to have good privacy options and with growing popularity of chain analysis tools it becomes easier and easier to track other people's funds and financial history so privacy should be like a feature and not a product so there are many separate privacy chains that have only a single feature privacy but we want to have this the feature in ethereum monitoring blockchain just one of many features that ethereum has and it's possible to implement

all the privacy features on ethereum current ternary cache version that is on production is just the first step it's possible to do much better than that so uh i'll give a brief overview of privacy on other blockchains in crypta so i will not mention uh like privacy based on like custodial mixers or sjx technology because it's not secure at all so the good privacy options are on bitcoin the best we have is coinjoin those are transactions that have like

hundreds of inputs of the same amount and hundreds of outputs and they are mixed between each other so anonymity set for each transaction is separate so each output can originate from one of possible like 100 inputs there are there's mimblewimble technology for example beam and green chains have are based on this technology but it provides only confidentiality so mimblewimble hides the amount that is transferred but doesn't hide the transaction graph who transfers to whom so next there is a manera in manera for each transaction there are 10 fake

inputs and two like real inputs so this is decoy-based system and it's pretty hard to analyze it but it's still possible so some data still leaks and by exploring like 10 trees it's in some cases it's possible to de-anonymize manera transactions so zcash is one of the best privacy technologies and it perfectly hides a transaction graph but it probably needs more usage to be good and then there are two options on ethereum hardstick and tornado cache

tornado cache has more usage but hard stack in the long term has pretty good technology so it makes it can take some time to implement it but it's pretty good so the current ternary cache stats it has half a billion of tvl and two percent of all existing ether has already passed through tornado cache smart contracts uh it has volume around like five billion dollars a year and plenty of transactions so pretty good anonymity set it also has some drawbacks

so internet cache we have pools of uh fixed amounts like one ether 10 ether and 100 they are like separate and they have separate anonymity sets and it's also not very convenient to use those fixed amounts because you often need some custom amount to pay someone and it's also pretty expensive so 1 million gas for deposit and 4400k for withdrawal and the recently internal cash released a new version that fixes some of those problems so it allows to transfer arbitrary amounts and it works

like a shielded pool with you take some model inside so it's possible to do joints splits private shielded transfer inside the pool and it also uses uh gnosis chain under the hood so it looks like you're still on ethereum but you never need to switch the network but the transaction are much cheaper thanks to usage of sidechain so here is a quick demo just a sec so in nova we connect metamask with mainnet and we can deposit

some arbitrary amount to our account so the transaction will forward the funds to a gnosis chain and then deposit them into shielded pool on tornado cache all in a single action the video is sped up so it takes around like two minutes to do this action so after transaction is confirmed you will have some funds in your shielded account and you can [Music] do a shield transfer to other users that are already registered in the same

shielded pool in the noaa you can transfer any amount and for sure the transfers the fee is less than one cent and the transfer is pretty fast it all happens inside this shielded pool and then it's possible to withdraw your funds back to mainnet and there are fixed amounts that we recommend to withdraw but it's possible to set any custom amount so you just hit withdraw generate snark proof and the funds will be on the target address on the main net and you never need to switch the network in the

metamask it always stays mainnet so here's a simple explanation how it works so when you deposit you send the transaction to metamask with metamask 2 xdi bridge it will transfer funds to gnosis chain and then put them in tornado pool when you do shielded transfer it is done using a re-layer so you generate snark proof send it to relayer and relayer will send the transaction to gnosis chain for you to preserve the privacy and when you withdraw you also send the transaction through a relayer

the international will send the funds to x-day bridge and x-day bridge will send it to your target mainnet address so the tornadication nova was rolled out to mainnet a few months ago it still has limit of one ether per deposit so we want to avoid like in case the bug was is found we want to avoid people losing funds so it's still in better mode but so far no bugs were found and it has over 3000 ether deposited considering there is a limit that is pretty good

usage stats 1 million tvl and plenty of transactions so let me explain a little bit uh how it works under the hood uh i'll try to make some simple explanation but yeah i hope it will be clear so how the ternary cache classic works first uh it maintains uh internal miracle tree of so-called commitments when you send the deposit you send some ether along with some hash and the smart contract will put your commitment

in its miracle tree so how the zero knowledge actually works here so when you deposit you generate two random numbers called secret and nullifier if you hash two of those numbers nullifier and secret you get what we call commitment hash or simply commitment this is the string that gets inserted in the miracle tree and there is also another entity nullifier hash if you hash only one of those random numbers you get nullifier hash that is linked to your commitment hash but for external observer they look like two

entirely different numbers so only you know this connection so when you do a deposit you send this commitment along with ether and it gets inserted into the tree and when you do a withdrawal you generate a zero knowledge proof proving two things first that your commitment is in the miracle tree so you generate a miracle proof for that and also the smart contract will check that your nullifier hash hasn't been published yet this is protection for from double spends so when someone sends a proof that has already known nullifier hash

that means this ternary cache node was already withdrawn so for snarks the public inputs are merkel root so the smart contract will check that his its miracle root corresponds to the one used to generate the snark proof and nullifier hash will be also public and privately uh when you're generating a snare proof you will provide a nullifier secret and miracle proof this is visible only to you and uh the sniper proof is generated in the browser so those private inputs never leave your client side like your browser then

tornado cache nova is a little bit more complex system but is based on the same concept so it makes the note a little bit more complex so now your node contains the amount that you are sending a public key that owns this node and also some secret number so if you hash all those three numbers you get the commitment that is inserted in the tree when the node is generated and uh there is also nullifier hash that is computed a little bit differently but the same concept is important that is

somehow linked to your node so its commitment hash and nullifier hash are linked so when we do a transaction um it is simple join split transaction that takes two inputs and produces two outputs so it basically spends two nodes and generates two new nodes and the snark checks that input amount so sum of input nodes is equal to output amount and also checks that spender knows the private keys and also for each node it checks all the rules

that is checked internet cache classic version so here the public inputs would be miracle root two nullifiers or two input nodes two new commitments that get inserted in the miracle tree as a result of this transaction and then there are private inputs basically your node private key to spend those notes and miracle proof for each one so essentially uh this is uh you take some model uh similar to bitcoin but private this is the same technology that is used in zcash shielded pools so a pretty similar pool but on ethereum

so what also can be implemented in the next version of the protocol would be token support and it's pretty easy to add so in addition to amount we can just add additional field asset id and that's pretty much all that is needed to add the token support uh also shielded atomic swaps are possible so swaps inside the privacy pool and there are some other features that we want to implement like diversified addresses so uh it's pretty pretty convenient if you have a single private key and can

generate any amount of addresses corresponding to the same private key so each time you give someone the address to send you shielded ether you can give out different address but all of them will point to your same wallet also viewing keys for compliance so tornado cash classic has a compliance tool that allows you to prove your origin of funds for example if you withdraw from tornado cash and send to centralized exchange you can also provide this compliance report to show where the funds come from so this new version will also support that and then

it probably will use some layer 2 technology like roll up like we are looking for different roll-ups and we hope that they will have better bridges because now we implemented like the ternary cash nova is deployed on gnosis chain because it's the only one chain that provides fast withdrawals to ethereum magnet optimistic roll-ups has seven days delays and polygon has three hour delay so we hope that other chains will have better bridges soon and the transactions fee on the new version will probably be paid with a

single unified asset like torn because when you transfer different erc20s you need to pay a fee to re-layer but you don't want to expose which asset you are transferring so it's pretty good idea to have all the transaction fees paid with a single asset for any transaction so this is pretty much it if anyone has questions all right we'll start here hi you mentioned erc721 support how would that work realistically right because they're well non-fungible uh yeah so uh erc 721 nfts will remain

private as long as they're in the shielded pool so you put nft in the shielded pool and will be able to transfer it to someone in uh shielded transaction and it will be not visible that you transfer this nft it will remain on the balance of tornadic nova and you can also sell it using atomic swap to someone else but when someone withdraws this nft from the shielded pool it's of course visible where they withdraw it all right so uh does tornado use blockchain

foreign analysis or elliptic or cipher blade at the start where they verify what sort of funds are coming into if they sort of suspect funds or say hack funds is that sort of verified sorry can you repeat it yeah so the question is when someone deposits into tornado do you verify uh what sort of funds are those so in the sense like do you use blockchain forensic tools like cipher blade chain analysis so some of these to verify whether they are from uh yeah uh so we as a developers don't have any access to smart contracts like tornado car smart contracts because the contracts are immutable there is no

admin access so all the contributors have the same access to it as any other regular user so there is no one can that can change or send their transactions sure i'm just saying but the deposit would happen from a particular address imagine that address is tagged that this has been used for for example uh an illegitimate activity that can be served through this to the smart contract through an oracle which oracle would probably track these are the set of addresses that have been marked with a certain label so yeah so in the same way that you cannot

send a regular ethereum transaction for example there are tainted funds in some ethereum addresses you cannot tell miners to not accept transactions from this address so you cannot prevent anyone from do doing a regular transfer in ethereum in the same way it works with tornado cash you cannot prevent anyone from interacting with a smart contract it's trustless okay and do you see like have you kind of dealt with law enforcement agencies coming to tornado cache and sort of requesting for any modulations or modifications around what's being done right now uh so there is not possible to do it's not

possible to do any modifications even if you want to the contracts are already deployed but usually law enforcement guys they go and ask for logs from infura etherscan and all those other web 2 services and often this is enough to solve the cases understood you also mentioned one thing around compliance auditability i didn't understand that but where you said if you're moving funds to a centralized exchange you would be able to showcase those logs i didn't clearly understand what exactly was that so the user that has the node that allows him to withdraw

the funds the same node can be used to generate the cryptographic proofs that links deposit with withdrawal so the user can selectively disclose his private data to someone so the choice is in the hands of the user and how long before noah would sort of go live for all sort of users right now i think it has a million tvl that is out there yeah so tornado cache classic also has the compliance tool that is widely used all right anyone else have a question stand up raise your hand if you do oh right here

hello so you have proposed one solution you have proposed one solution where you will try to generate multiple public keys from a single private key how you intend to do that can you repeat that multiple public addresses from a single private key right how you intend to do that uh this is uh involves a little bit of math but essentially you mix some random number to your private key to generate new addresses so each time you will get a new one but uh yeah it's very complicated to explain in one minute

any any reading material on that zcash has similar features that is widely documented so if you're interested you can just look up diversified addresses in zcash our implementation will be pretty similar okay thank you hi thank you so much my question is fairly simple how would you describe zero knowledge proofs to people who don't yet understand or better said to maybe an eight-year-old thank you oh how do you explain to a five-year-old yeah it's a thing that allows you to prove something without disclosing what exactly you're proving like for example that i know code to a

padlock but i don't want to tell you exactly what code it is just the fact that i know it's yeah um actually it's not a question it's more of the zero knowledge proof analogy i don't know if you know that to a corporate you'd use the sudoku example so let's say i played sudoku and i beat you but i want to prove to you that i beat you without showing you the answer you'd be able to verify the lines and the boxes without actually showing the sudoku solution so that's how you prove zero knowledge proof that's actually pretty good i like it all right any other hands um so let's have a round of applause

[Applause] you