DAPPCON 2024: Elliptic Curve Pairing Stealth Address Protocols - Marija Mikić

Transcript

hi everyone uh it is nice to be here um as you already heard my name is Maria I am Senior Z researcher in team 327 in ethic 42 company but also I am assistant professor at faculty of mathematics in Belgrade and uh I'm also head of department for differential equations at the same faculty but also I'm co-founder of mathematical Academy and mathematical Academy is some kind of private school where we are working with talents talented kids in the field of mathematics physics and cryptography and for example this year our students the best of them obtain 41 medals on the

state competition so we are very proud of them uh and also last year with cooperation with ethereum Foundation Miss we organized probably the first zero knowledge proof course on balcon so today's topic is elliptic curve steal address protocol so let's start uh we will talk today about private transactions uh I think that everybody here knows that there are blockchains like zcash and Monero that have some cryptographic methods at their core that enables privacy of transaction but there is a great need to introduce private transactions on the public blockchains

such as ethereum so when we talk about private Transaction what we really want to hide we want to hide the amount of transaction recipient address sender address maybe all three stuff but maybe one of them and we can obtain this uh using different cryptographic methods for example we can use zero knowledge proofs like Z cash we can use th addresses we can use ring signatures or we can use fully homomorphic encryption so today's topic is related to stealth addresses and what are stealth addresses we want to have the protocol like we have today but we want to hide the

recipient address so for example we have two people Alice and Bob Bob will be receiver and Alice will will be the sender so Bob first needs to generate some kind of stealth meta address and he can send this uh stealth meta address directly to Alice or he can add this stealth meta address in some registry and after that Alice can uh do some calculation and uh calculate Bob new address and she can send the money to this new address and after that Bob is able to control all the assets from this address so every time when someone

wants to send the money to Bob he he will use uh this steal meta address but Bob will uh uh obtain new address every time okay so how we can achieve this well we can use different cryptographic methods one of them is dy Helman based um so first both will generate her uh his pair of keys private and the public one we knows that we obtain the public key uh as a result of multiplication private key and the generator point from elliptic curve okay so the public key will be the point on elliptic C and Bob will add this public key in the um this registry this

will be steal meta address of Bob okay so in order uh to Alice to calculate Bob's new address she will go to this registry and find this steal meta address of Bob she will generate her pair of keys the private one and the public one and after that she will add uh her public key in this ephemeral publicy registry and send money to Bob after that Bob will calculate his address and he can uh use this address and spend the money from this address address but uh we did not talk about how both of them them can calculate this

address because both of them will calculate this address in different way okay um both of them will calculate share key what is the share key the share key uh will be the result of multiplication uh this what is this this is when Alice calculate share key she will multiply her private key with the public key of Bob okay and Bob will calculate this share key as a result of multiplication his private key with public key of Lis but why this equality holds because here firstly we use that uh public key

is a result of multiplication of private key and Generator point from elliptic curve and after that we use just commutativity of multiplication of numbers and after that we uh then again used that uh um result of multiplication private key and Generator point on elliptic curve is a public key so both of them can calculate this share key but in different ways and for example let's think about this uh that share key is for example the public key uh for this new address of Bob uh there there will be a problem because Alice and Bob has both uh uh both have

different private keys and both can spend the money from this address and we want that only Bob can spend the money from this address in order to obtain this we need to include something uh in the private key of this new address that only Bob's knows so we need to include private key of Bob for his stealth meta address so both of them Alice and Bob sender and recipient can calculate this shared secret and can H the secret but only Bobs know this little little M and this little m is private key for Bob's new uh for Bob's uh meta address and we know that we obtain a public key as a

result of multiplication of private key and Generator point on elliptic curve so when we multiply this with generator Point what we obtain we obtain public key of Bob and this public key is in the registry so both of them knows this public key and of course both of them can calculate Shar Secret in this way we obtain that both of them can calculate the address but only Bobs can spend the money from this address this is the basic concept um and we can add more things we can add one more feature for example uh we can add the viewing key uh so we can add uh Little V and um large V uh what

is the viewing key for example if you have a tax inspector and you want to prove that you uh paid all your uh fees for transactions all your taxes for your transactions well you need uh to be able to prove this and uh because of that we include one more key and uh this key we will uh uh we will give to tax inspector and with this key tasks inspector can see all our steal addresses and he can calculate uh all the uh taxes that we paid for these transactions for example and uh because of that this uh uh

viewing key needs to be included here in the calculation of the shared secret so this is just one feature in order to uh obtain that person who has the a viewing key can calculate our address but of course no one except Bob can spend the money from this address and uh we can add one more thing what is it uh we can add the view tag uh we we are adding The View tag in order to uh obtain that Bob can calculate his address in a faster way so Alice when send her public key in the registry she

will add one bite of shared secret so when Bob uh is finding he address he will uh first matching his address his share key with one bite if there is a matching he will calculate the address and this is just for optimization and uh as we already mentioned uh there are different way to achieve this uh and optain St others protocol this was the one way this is dy Helman method that include multiplication on elliptic curve and hashing uh but for example here my friend Mio and I created

two new protocols that uh using elliptic curve pairing instead of calculation of share key as a result of multiplying scalar and point on elliptic curve but we have two protocols one of them is with double key and the second one with single key uh this one with single key includes only one number and from the this number you can obtain viewing key and spending key so you have double keys but just you have one number and from this number you will obtain two pair two two keys uh these Protocols are are really great protocols but um uh these Protocols are not Quantum resistant protocols in order to obtain that we

have Quantum resistant protocols we create Miko and I uh two new protocols uh this uh ring learning with errors and model learning with errors steal others protocols but of course we can obtain a post Quantum algorithm if we use fully homomorph encryption because the basic concept that we use in polymorphic encryption are are learning with error technique so we can do this um in different way of course but today we will talk about elliptical pairing stealth others protocol so let explain what was our motivation our motivation

was uh the paper based the others protocol that was written by vitalic and Tony and others and uh they already Implement uh these stuffs like this and this they use dual keyers protocol weal about this protocol a moment ago uh they use this elliptic curve and use UT tags but they also mention then they want to have on the top of this uh new protocols uh that uh using elliptic curve pairings or latis based schemes or or to have post quantum to resistance so this was our motivation and because we are using

pairings we need to say a few words about pairings and uh to fully understand how pairings work uh we need to have deeply mathematical knowledge so uh we we will not go into our details we will just have uh we will just tell that we have one um bilinear map and elements uh from for this uh are subgroups of elliptic curve um over final field and they have the same order and uh G1 and G2 will be generators for these uh subgroups and we will use here just

property two uh what says this property two uh when we have S is the point on the first subgroup and T is the point on the second subgroup on the the curve A and B are Scholars so A and B can commute okay coordinately and we obtain the same result as we pair uh these points s and t uh to the exponent of a result of multiplication A and B so we will use this so how our protocols work we want to have the same structure as we had before but here we can see uh well uh when uh this this little key is private

key for spending uh and this little V is the viewing key we will multiply a little uh key with generator point on the second subgroup on elliptic curve but to get a uh large V we will multiply Little V the viewing key with generator point from the First subgroup on elliptic curve and we will add a large v a large K to this r registry and after that uh sender will uh scan this registry find the mat address uh generate uh Alice will generate her pair of keys uh the the public key will be a result of multiplying this private key

with generator point from the first from the first uh subgroup on elliptic curve and she will calculate uh the address as the results of pairing so uh she will pair uh results of multiplying her private key with this public uh uh viving key and public key of Bob that is is in this register so she can calculate this public in this way after that she will add her public key in this FAL public key registry and of course the viewing tag like we had before and Bob will calculate his address in a different way he will will prove that he

has a spending key the spending key will be result of multiplication of little little key and a little V so spending and viewing key and only Bob's know spending key and after that he will calculate his address in this this way and both of them will obtain the same result because we use the property two that we mention um a moment ago uh so we had different different technique but we obtain the same result as we had it before but now uh we can just uh uh say a few things about single key um uh elliptic curve um pairing

protocol so what we have here we have here a little key little key is a spending key okay this is a private key of Bob but the viewing key will be obtained as a result of multiplication little key with generator point on the second subgroup and the public key for this steal meta address will be a result of multiplication little uh key with a generator point from the first subgroup so we have viewing key and we have the public key and this large V and large K will be in this registry after that we mix um the technique that we had before in dual key Del others protocol and uh for example we calculate s uh s is uh

not um share key uh like we had in the Helman approach uh s will be a result of pairing so we have that s is result of pairing but uh the public key of the address we can uh calculate like in Dy Helman approach and uh uh this is very similar that we already had uh what is important here that uh this will be the spending key for this new Bob address and little key uh Only Knows Bob so both of them can calculate this share key but only Bob uh can spend the money from this address and uh for for the end uh

implementation results uh we compare our results uh with results of dual key St others protocol without and with viewing tag and uh the green uh is our uh implementation on L curve pairing with double key Del address protocol and we can see here that we obtain the best results uh uh this is time in uh milliseconds and this is um number of uh public key included in the fmrl public key registry so when sender want to calculate uh his address uh in uh using uh elliptic curve preparing dual Key T others protocol he can uh do it in uh

the fastest way so this is very important and uh this is a result for our single key protocol we obtain the worst results but uh uh I think that it is very interesting to have this as a concept as theoretical result so we can use single key in order to obtain everything we want but we we we we cannot uh uh do it efficiently so this is everything for from me for today thank [Applause] you and you guys know what time it is it's time for our Q&A do we have any

questions for Maria perfect in this front row hi thanks for the talk um what are the potenti for this to be implemented say in ethereum does does ethereum have all required cryptographic Primitives and if not what is missing uh well we are in um negotiation with ethereum Foundation to implement this so everything is clear and we just waiting for for them to to implement this yeah well thank you so much thank you and another round of applause