DAPPCON 2025: Onchain Privacy Now - Kassandra

Transcript

Hello everybody and uh can you see my slides? Great. Um so yeah this talk is more of an intervention and for those of you have seen parts of it before uh I'll try to make it a little different and uh uh interesting to you as well. Uh I am Cassandra kgass or K. You can call me any of those names if you like. And uh yeah we need onchain privacy now on Ethereum. it can be done and we can do it together. So this talk is not at all about um a fancy new zero knowledge proof scheme or a uh a new primitive or some galaxy brain uh moon math. Uh it is amazing

that all of that is happening and this has far surpassed our wildest dreams in the cryptography space in terms of how well that's moving forward. So the theory is doing great. It needs to keep going. But where we are highly lacking is on practice. We need to take the tools that are now fully ready, fully production ready and put them into practice on Ethereum. So we have the technology. It's a time to put these Legos together and roll up our sleeves and build something new and interesting. And most importantly, if you remember anything from this talk, it should be maybe this slide and the next one.

We must rethink the Ethereum wallet UX from the ground up. What we have with all of these tools is the ability to uh revitalize the Ethereum user experience and basically have no trade-offs. have a user experience which is just as good or better than the experience you're already used to now with brow browser wallets except you'll have things like completely crosschain abstracted and privacy built in by default the maximal privacy this is the moment for this shift and uh I think one of the reasons I uh highlight the wallet is that um sure there are constructions which I'm very excited about like fully private ZK

roll-ups um but none of those are ready are fully production ready today. Um so similarly there are some ideas to upgrade the Ethereum L1 and embed privacy directly into the Ethereum L1 but that is also going to take a long time to go through the EIP process to ship upgrades on the L1 is quite slow. So where can we make a huge dent in privacy practical privacy onchain is at the authentication or the wallet layer where we have just a tremendous amount of new tools that we can use. But in order to utilize those new tools and to dream up this totally new wallet user experience that should help like I think it's existential for

Ethereum. let's save Ethereum with this with these dreams we can have uh is we need to make one fundamental shift in my point of view and that is that a user is not an address identity is your identity is not an address or a key pair your wallet is not an address or a key pair I think the fundamental user experience uh problem holding us back with the wallets that people use today and the way that they propagate transactions on Ethereum is that people are thinking with this very low-level primitive of initiating track uh transactions from a single EOA and that when you do an

operation you're going to your wallet has a drop- down where you change address by address and so even if you know that you can use many addresses and address is not technically your identity we still use addresses as like a proxy for identity how many of you have done many interactions across many different DAPs on the same address before. How many of you do almost all your interactions on just one single address? It's me. Um, so, uh, I think this is a huge problem and it's it's creating tremendous linkability problems for all of what you're doing. So, we need a new approach on this. And I think if we're willing to make this shift, which I understand why it's difficult

one, I understand why it was there historically because up until the most recent hard fork, Pectra, it was not possible to initiate an Ethereum transaction without having e uh EOA funded with ETH. There was no way around it. And because of the fact that it needs to be funded with ETH, it's a tremendous amount of friction to be using a different address for every single interaction that you do. Um because every single one of those address needs to manage its gas balance. Um so uh however things have already changed. We already have this uh uh we have uh 7702 uh in the most recent upgrade and this is almost a forcing function for wallets are going to change their user experience and so this is the

moment to bake all these new things in and dream big. So what are the tools we have uh available to us today? Well, it's a tremendous amount of tools. Like really exciting chain specific addresses. There's an ERC for that. We're pretty much all the way through. Uh very closely related is the uh crosschain interop standard, the open intense framework. This is uh 7683. And this is also pretty much ready to go live if not completely. So these are absolute table stakes of things we can add into the wallet to not ambiguously reuse addresses. Another big problem we have with key pairs is that people ambiguously reuse their address. If it's an EOA, you use it on all chains as you can send me funds on all of those

chains. But this is a bad way to think about address space. You don't necessarily have this uh with smart contracts, right? This rule can be violated. If you're using a a safe or some sort of smart wallet, maybe you don't have that smart wallet initiated on all chains. And so we should not be uh we should not be ambiguously reusing addresses in this way. We should have a chain specific address. So you can go to kzg.earbbitum and you'll uh that will route you to my public address on arbitum which would be a different address than the one that I have on mainet etc etc um just as the public address. So uh this is going to help us solve chain abstraction the first two. Then for privacy we have things like uh stealth addresses which is what I'll be going more into in this

talk. We also have zk mixers widely deployed and utilized now. We have privacy pools and rail gun and tornado cache recently unsanctioned and usable again. So uh we've got uh all of these ready for production today. We have EOA superpowers with 7702 which I think is key for upgrading the wallet UX. If we break away from this uh address by address abstraction and make Ethereum wallets more like Bitcoin wallets where as much as possible make every address a one-time use address. Um, we also have full uh account abstraction and things like gas abstraction, relayers, pay masters, all uh all some of that in the works, some of it already shipped. We have uh we'll have to rethink wallet app

interactions in this new paradigm because now wallets if they're going to be more sophisticated chain abstracted uh private by default probably you want the interaction with the DAP to be like uh the payload for that to come to the wallet but in such a way that the wallet can now you know complete this payload with wallet specific features uh to make it a much more uh featurerich experience where you can have the seamless I just authorize my DeFi interaction with my browserbased wallet uh the way you're used to but under the hood actually a much more complex and interesting and uh privacy preserving construction can be going on uh at the wallet layer. Uh you also need to deal with like the anonymous uh communication aspect because if you dox your IP when you call

your RPC or if you leak you know if your RPC knows about what you're asking for information for when you're reading from the chain things like this this can be a big problem. And then we have some things that are coming soon around the corner but not yet here which I think are worth highlighting. Uh so these are less important to me because I really want to focus on what we can already do today. But soon we can have very lightweight local nodes. We already have something like Helios but soon maybe everyone can be running in a testing node on their phone when we get like all the beam chain upgrades shipped. Uh we also have priv fully private ZK rollups. So this would also be a really really useful construction to finally hit mainet with Aztec which should be coming soon. So we have all of these tools.

This is a lot of stuff and almost all of it there is fully ready for you to use on Ethereum mainet today. So why are our wallet experiences stuck in the stone age where it's like in my opinion the metaphor is uh it's something like uh like shipping Ethereum without solidity and everyone has to use assembly and write in pure op codes. It can be done. That's what I think. I think the way that uh we use wallets today is a great fallback for a way that you can just concretely interact with the chain and understand what you're doing. Uh but not a great user experience. We need a more complex abstraction. Again, Bitcoin wallets themselves to have a much more

complex abstraction over address space and you never reuse addresses. It's just how the wallets are built. So why don't we have this on Ethereum now that we have 7702? Nothing stops us from having this. So, my gauntlet to all of you is to take these tools, take these Legos, put them together, dream big, and ship a radically new, uh, wallet experience. Uh, who's going to do it? I'm going to help you. Uh, so, uh, I want to talk a little bit about just one of the tools here, uh, one construction, uh, a little bit, uh, which I am a big advocate for, which is stealth addresses. and we'll hear more from Fluid Key who have been doing uh the the first people to really uh actually deploy this in a way that people are using it and playing around

with it. Um uh so I want to talk about how I think stealth addresses fit into the stack of this new kind of Ethereum wallet that I'm envisioning. So first of all, why stealth addresses? So like what are they? What problem are we solving? And we're solving transaction unlinkability. And so the the classic uh thought experiment I would give you to understand stealth addresses is there's a way already that we could get um the benefits of stealth addresses just in a much more uh clunky way without stealth addresses which is I want to receive funds from uh someone in this room but I don't want it to be visible on the chain that it's me who was receiving the funds. So if you send it to kcg it's very easy to link that back to me. I have all this uh activity

that I've done that's linked to my to my identity. So what I could do is generate a fresh address and then communicate that fresh address to you over a private channel and then you could send me the funds to that fresh address and I got unlinkability of this uh uh my uh the reception of these funds is delin to my identity. Now great. However, this has a few problems. One, it means the receiver always has to do something if they want to receive something delin. So that's not an amazing UX. And two, if this private channel wherein I relayed that address that you should send to gets leaked, then of course all the benefits, all the privacy goes away. And so stealth addresses is just a small

upgrade to this where we add a little protocol, very very simple, something that works on Bitcoin. It's like extremely out of protocol and light. Uh very easy cryptography as well, but it allows a sender to generate a fresh EOA that you, the receiver, will be able to mine the private key for in the future if the sender just publishes some uh public information that the receiver needs in order to mine the private key for the address where the funds were sent to. So, it just uh allows uh one-time setup uh for this uh private reception. And then ev uh now senders can do this uh send to you with this uh with this protocol very easily in a privacy preserving way. Uh and so I think this is a really really useful

primitive partially because it's extremely simple cryptography. So how does it work? Well, now welcome to the cryptography section. We'll see uh how much we do. But if not, we don't necessarily have to talk too much about it because you can go to this link and read uh Vitalik's article introducing stealth addresses. Uh the most important thing is that it's quite trivial and simple. That's what makes it so nice. Um and yeah, you're still working over EOAs, which might have some drawbacks, but it also has some nice things for users where uh even if you lost your really fancy wallet privacy software, you could probably uh default back to just like operating on these addresses in the old-fashioned way. You might not be able to preserve the privacy for as long, etc. But uh but yeah, we have nice fallback conditions in my opinion. Uh so

uh maybe a show of hands of for who would it be interesting to actually go uh like walk through the math. It's fun because the math is incredibly simple. So if you're just willing to do a tiny bit of cryptography uh we could do that but then we'd spend some time on this and you might go I can do this at home. So uh I'm actually we're going to skip or not based on people's interest. So who wants to do the math part for the next three minutes? Okay. And who doesn't want to do the math part? Okay. Some of the mathy people. So, okay, that was too that was not near.

Who didn't vote? Yeah. Yeah. Okay. So, I guess we're going to do a little bit of the math since most of you didn't vote. Uh, so the important thing here is it's we're going to do just the just the really broad strokes. What you have is what you're utilizing is a very classic Diffy Helman key exchange and you're utilizing the actual elliptic curve cryptography for the public key which hashes to an address and private key pair construction that we have on Ethereum and that we have on Bitcoin and many other blockchains as well. And so it's a very very light protocol where you do a diffy helman key exchange and you get a you derive a shared secret with the between the sender and the receiver. the

receiver who published some public information on a registry. Hey, this is my stealth public key. Um, uh, the sender can now take that stealth public key, do some sort of key exchange, derive a shared secret with that stealth public key and, uh, and use that shared secret to compute only the public key for an address that the receiver will be able to mine the private key for, thanks to uh, some little cryptography tricks. But uh but yeah once you once you derive this public key from the shared secret that hashes to an address you simply send the funds to that address you then have to publish some uh the ephemeral key that you use to der to create the

shared secret on uh on what we call the announcer and uh now all stealth address receivers have to scan all announcements and check if that announcement was for them. If so, they can find the private key for that address and now they have control of the funds that were sent to this randomized address. So, uh we the TLDDR is it's super simple elliptic curve crypto. There's no fancy ZK stuff. That's really cool. Um there's also two uh ERC's that were developed and fully uh deployed for this and uh they are on the major chains already and I would really uh I would really promote people interoperating with the standard um because today almost nobody is using it

on mainet and you get a lot more benefits if everyone who's doing stealth address style things is uh p pushing announcements on chain to the same place. Uh so I'm a big fan of us actually uh we have this shelling point. We now have these canonical contracts deployed. I'd be very happy if we were using them much more today. There are very very few announcements being made on the announcer contract. And so yeah what are these two ERC's? They're just canonical place for people publishing where their stealth meta address where their stealth public key is. That's one contract, the registry contract, and another contract for making these announcements where you announce this ephemeral public key data which is needed for a receiver to actually uh mine the private key or basically be

able to access the funds that were sent to them stealthily. So, uh we have these things that's great. Um so, what's what do I see as like the lowest hanging fruit that would change things a tremendous amount? This is like table stakes. All the wallets should implement this. One of the reasons I like uh stealth addresses because this is absolutely simple to get MetaMask grabby etc to implement in my opinion which is Alice wants to send some token to Bob. One of the coolest things about stealth addresses fully generalized works for ETH works for all ERC20s works for uh NFTs works for credentials works for anything because it's just an uh it's just a trick that's being used on top of actual address space. So Alice wants to send some token to Bobeth on Ethereum.

uh she simply writes receiver Bob ETH at ETH under the hood the wallet and picks the amount of token under the hood the wallet resolves Bob at ETH to Bob's public mainet address which might be different from Bob's public arbitum address so that we don't have this ambiguity as we had before and then we're going to look up with Bob's public address on the registry contract I just told you about to find uh Bob's stealth meta address and Then uh the the wallet client will generate one of these ephemeral Rs to do this little cryptography trick. Uh generate this stealth address uh where Bob will be able to access the funds. Send the amount of tokens over to that stealth

address and announce this ephemeral data which will allow Bob to find uh to uh to access the funds. This could happen in such a way that you just open your wallet, you say uh let's send to Bob and uh you would have to manually uncclick the private transaction whenever Bob whenever whatever address they put in the receiver field uh has a stealth meta address has this uh you know has registered with this scheme. It would just automatically do this and you'd have to actually opt out of privacy. And in my view, it's these types of things, standards that go are widely adopted that will uh allow privacy to go past that inflection point where we're really getting those compounding benefits from it because the none of these systems

almost every privacy system has the issue that it's not very private unless everyone uh a lot of people are using it. So uh one more thing uh this is some tweet I made but uh I think the important thing uh just like I was mentioning is I'm really focused on standards that we can deploy across different uh applications and and things like wallets and so forth because it's awesome the private privacy tech we already have but if people have to go seeking out specific privacy applications to get privacy it's going to be really hard for us to reach that inflection point And so uh yeah we are at this critical juncture where we are ready to build awesome privacy tech and

awesome user experiences. I believe most of it needs to be free and open- source software because nobody will pay extra for privacy. This is like a known uh this called the privacy paradox which is if you ask people is privacy important to you they all say yes but then when you put an experiment in front of them where they have to click two buttons instead of one to have privacy they all go ah never mind I don't need the privacy. So uh it needs to be frictionless and both that both means it needs to not have be gatekept. You need to not have to go seek out that application. You uh you you need to not pay extra for it and also the UX needs to be just as good or better than the UX you have now because bad UX is another friction point. So my belief is we need

to generate eventually some standards for like a new wallet standard. Like today we have these seed phrases that every wallet uses a seed phrase they can easily interoperate. We need something a little bit more robust that includes privacy, chain abstraction, etc. So, I have zero minutes left, but uh here's me shilling the potential wallet standard. Um, and the idea is we need this multi-address construction. So, how does that work? Well, your seed phrase would turn into this ab abstract concept called user identities. In my opinion, best would be if each user identity actually maps to something like an ENS because that makes it really easy for people to understand. What is a user identity? Well, it's a bag of a you have actually this user identity is

multi-chain. So you have a main address, a bob.eth address on each network that might be different. But then when you zoom in to a single network, that's just the very public address that you purposefully link uh things to your identity with you when you operate over this bob.eth user identity, you actually operate over a much more complex abstraction that in my opinion might look something like this. you have a number of addresses that when you generate them your yourself, you can simply generate a new address on your you don't need to do the stealth address trick because you can generate a new address on on your seed phrase easily.

But if you third party reception from other people sending you funds and credentials, those would be sent to stealth addresses. And finally, you also need to utilize mixers mixing ETH for instance. So that if you have mixed ETH, you can now use that ETH to pay relayers to operate over this big fancy construction which is many addresses seamlessly by using 7702 7702. Even though you have many uh you might have many addresses, you can operate over all of them seamlessly in a single transaction by asking some relayer to upgrade all your accounts to a smart account and then do the interactions that you want to do. And if you can then pay that relayer with some anonymized ETH, you have a very very interesting wallet construction in my

opinion that could try to maximize your privacy in in in some nice ways. So, uh, why do I think stealth addresses specifically are a good are good Lego in the possible privacy stack is well, I think the fallback to simple EOS is actually kind of a feature. There are maybe some interesting things. We might hear from fluid key about some maybe interesting uh other ways to approach this as well. But I think that it's a feature because if you lose this wallet client that's super fancy that you saw here. Okay, it does all this really fancy stuff under the hood. But what if you lose that wallet client and now you have to operate. Well, technically you could go mine all the private keys here and maybe you lose the privacy. You'd send ETH directly from your public account and dox them, but you'd still be

able to access all your funds. It's also cool because uh yeah, direct transfers to a third party is super super easy and doable today. like I like I showed in my little example. Uh 7702 makes it so we can have this like seamless experience. Finally, very important is okay, mixers are even better. You get unlinkability and untraceability, but that only works for assets with enough uh utilization where you can actually bootstrap a sufficiently private mixer pool. So what about all the other assets? What about NFTs? What about like low liquidity random memecoin assets? Well, the best you can do is something like a stealth address for those. And yeah, it pairs well with mixers together so you can get like this unified privacy experience.

Um, so thank you to all these people. Uh, Julie, you're on the list there. So, thank you. And, uh, uh, and to many more as well. So, uh, let's, uh, ship privacy uh, together. You can find me there. Thank you guys so much. Um Cassandra actually question here like you're telling that we should redesign rethink the way the wireless UX works now but how we ensure that we don't uh repeat the same mistakes that were made before uh when we linked the address uh to identity and to many other things like what should be the way of approaching uh all these standards that

we don't follow the same let's say development practices or business choices. What are architectural choices? Yeah, that's a great question that I don't even know I have a great answer for, but uh what I would say is yeah, one way maybe is to not standardize too early. So, I'm actually super excited about making these things standards because I believe that's where you reach that shelling point. But for now, I would be very pro- uh wide experimentation. And your version of the new wallet standard that includes all these features might not look like the version that I'm proposing here. That's just a proposal. I think what we can do is let these standards be emergent from these uh new experiments that come out.

See what's best and then wait a bit and allow like the best standard to emerge and then really push for that getting widely adopted so that you can go from, you know, take your seed phrase from one wallet client to another. but magically get find uh you know interoperate seamlessly with all this like cool abstraction and privacy built in and so forth. So yeah, I would just say don't standardize too early. Keep minds open is really important with standards like wait to like don't uh fall in love with your the your particular solution like I'm super excited about stealth addresses but if it turns out there's a better way that only uses mixer technology and that's like going to just make the whole privacy stack simpler let's do that. The most important thing

is that uh uh we get somewhere that feels good. And what I'd say is we're never going to get somewhere perfect. These will probably still be holdover solutions because if we get fully private rollups, you know, maybe everything will just happen there. I don't know. Maybe the L1 will ship native privacy in different ways that could reshape it. But we should really focus on what we can do now because we already have a number of tools now that we can use to ship like uh at least a v2. MetaMask again is still just in the stone age in terms of the the UX in my opinion. So let's get to the uh bronze age and maybe the future's still coming.

Yeah, just hey just two uh thanks for the talk. Just two quick questions. First one is I think those require some like custom cryptography uh like work to be done on the front end. Are you aware of any great JavaScript libraries for cryptography? Uh uh JavaScript libraries. Yeah. So there is a stealth addresses SDK in JavaScript already which is super useful. I use it in the front end I made at stealththetherreium.e.limmo. You can go there and you can send uh stealth you can send stealth payments and I use their library. I also wrote a version of similar library that's in rust. So if you want to do like backend something you can use my rust library.

Uh there should be a lot more coming and I believe there is some work going on on an in some interesting SDKs that uh could be coming soon but I'm not sure. And the second question is why did Umbra fail? Uh yeah, I don't know exactly and I think I believe they're also working on like a new version. It's the people who created Umbra who eventually created those standards, these two ERC's. They're they're authors on those ERC's and their first version didn't use those. So it's like they did exactly what I was talking about. They created a thing, used stealth addresses, shipped it as their own personal privacy thing or like their uh you know their standalone tool and then thought about how can we make this something that's actually an open standard that not just our wallet construction but everyone

could use. So I think great things came out of Umbra. But yeah, again I think for most privacy uh solutions. The uh I would say two two things for most you always have the issue of is a privacy solution you have to go seek out if you want privacy and that always makes it a lot harder to like reach these shelling points instead of it being something built in to user experiences that you already know and love and seek out. Um and then two stealth addresses had this problem. They built that before 7702. So it has this clunky problem of okay how do you keep privacy once you have assets littered across many stealth addresses none of them are funded with ETH so you need to find a way to operate over these addresses so there were some like UX issues there which now can be solved by

the fact that we have these EOA superpowers and we can upgrade EOAs on the fly and make them like smart accounts which I think can potentially