The Future of Privacy: Private and Permissionless Systems without Black Hats

Transcript

uh he's going to do a talk called the future of privacy private and permissionless systems without black hats so we're going give a huge round of applause for Adam [Music] gungal hello everyone uh I'm Adam from Alf zero and I'm going to talk about privacy a bit about attributability I'm not really going to go talk about compliance uh the particular uh agenda is first I'll show some trade-offs between privacy transparency and attributability and for second I quickly introduce to some currently explored approaches to anonymity on the

blockchain and finally I'd outline the idea of merging anonymity with protection against mixing illicit funds uh so first to provide some kind of like a background when it comes to the flavor of privacy that that we have on the blockchain kind of by default we we have pseudonymity this is something that I think everyone is is very used to this is like since the times of Bitcoins we don't have like real names on the blockchain we have addresses which at least initially I think looked Anonymous enough so people thought that well since it's only like a random identifier like the Bitcoin transactions are kind of kind of anonymous uh right now we already think

I are well aware that that's not true there are specific companies which are uh which the entire business model of tracking tracking Bitcoin transactions and transactions on the other chain so in practice most of these identifiers can be attached to at least IP address or like in many cases actual the real legal name of the user so the second like level of privacy that we can have is anonymity so uh in anonymity instead of seeing uh seeing spe specific identifiers for each users we just see the type of action that happened with no indication whatsoever about who did that or whether it was related to any other

action or not this lack of relation is called unlinkability it's actually the most important uh aspect when it comes to tracking so why we can track transactions on the Bitcoin is because one transfer is related to another I mean we can see that this funds went from address A to B and then then from B to C if we don't have link ability there is no tracking possible and the strongest uh strongest flavor is like full privacy where we just see that something happens this is not very common in in blockchain setting so on the uh during the talk I'm going to focus on on this two first uh flavors and uh and something in between

them and I'm going to use two guiding examp example here both are like bad behaviors of the system uh so first one is what happens on on most chains including ethereum so like this is transaction traceback so whenever I send uh some amount of if or other token to a friend he can basically backtrack the transaction to my address and see entire history of spending of from my address so I would imagine most of you same as me are using different addresses for different purposes just for the sake of not being kind of um spied by well our friends and and enemies uh so this is of course horrible user experience and by

the way I think many people are using centralized exchanges as kind of like a mixing mixing devices to break the linkability this is very much centralized way of of like achieving even basic privacy so like very very much unwanted so this is the the like bad example coming from lack of privacy and then there is privacy abuse cryptographic money laundering uh so like this is a I think well-known example lazaros group connected to North Korea hacks a axi Infinity then they deposit funds into one of the mixers in this case that was called Tornado cash and the trace is effectively lost I mean they are literally going away with

stealing hundreds of Millions worth of dollars worth of tokens so this is kind of like a privacy abuse yes we do not want to be spied uh upon by our friends we do not necessarily want also North Korea to fund well whatever fund with stolen funds um so that seems pretty contradictory like I we don't want good people to be spite upon but we do want bad people and who decides which are which so uh but before we go into the solutions uh some uh some let's explore slightly deeper uh how private are actually the the basic Solutions so uh when it comes to normal synonymous transfers well like

let's this is some kind of like imaginary situation so here easily we can identify parties because they are using the same the same set of addresses so what do we do here let's say that party B is like and that's that's us let's say we wanted to behave be remain anonymous but we send this free transfers and let's say that party a is a well-known employer and party C is a well-known Hacker House so well basically like this pattern already I mean this is of course a to scenario but this pattern already allows to identify us at least to high extent I mean like yes so we are employer of this

particular we are employee of this particular employer based in this particular place and that's only from the transaction pattern then we can go one step higher which is which is not full anonymity but this is um an idea to enhance at least anonymity in some way the idea is called stealth addresses uh on ethereum and uh it's a cryptographic primitive without going into details it mimics the process of creating a fresh address for every new operation so we never do the use the same address twice and it allows like a convenient way for someone to send us funds into also generated address without asking us for

for this particular address so it's like a clever cryptographic way mimicking the best possible uh use of of new address creation so surely it's better uh so it's much harder I mean we can still cluster of course the transactions of uh of these two parties but it's not oh sorry it's not so easy to Cluster transactions of party B so like in some cases we may be able to identify something BAS based on just like uh timings but by default it's not so easy to tell that this party B is actually a single party so it does give some privacy because it's harder to Cluster

things but it does not actually solve our uh guiding scenario I mean we can still backtrack transactions as we're going to see in the next slide so how a black hatut sees private transfers so when it comes to eum T address basically the situation with black cats is usually that like there is some big well-known hack and then the funds from this hack deposited into some particular address and everyone can see that because this is a public address on a public blockchain and then black has want to do something about it I mean like somehow mix it with something or or hide it so when it comes to steal addresses this is just not possible I mean they can generate fresh addresses

all the time but like the graph we we we can always backtrack the transactions so like wherever the funds will go we can always see that yeah these are the funds originating from the HCK so like ethereum stal addresses doesn't help at all for this this kind of money lering unfortunately it doesn't help much with our problems as a user either because like if we send some funds to our friend he can also backtrack the transaction and we'll see our history to some extent uh when like very are also like fully private platforms with fully private transfers or Solutions uh allowing for that like for example mentioned tornado cash rail gun in Alo we are working on a shielder

uh of the the same same idea is uh zcash shielded transfers uh and here like if there is no particular fraud protection the situation looks like this so there is this well known by every one address with elicit funds deposited then this funds go to this magical cryptographic box and if they sit there long enough and you can basically drop the funds out of it kind of anonymously and unlink so effectively the trace is lost so what would we like to achieve with this kind of like a merged attributability attributability anonymity system so we would like to

preserve transaction privacy for regular users so we don't want to be pick up by like whoever we interact with on the blockchain and we would like to somehow this allow mixing illicit funds so first the more naive idea for the potential solution so let's think about a system where it works as a classical uh classical like a mixing solution but um we always send info about what we do to some kind of like a comittee of of the guys which are send keep keeping all this information they can keep it like in a secret sharing form so like a lot of them need to actually collaborate to

reveal anything uh and if we don't I mean they they need to kind of like accredit every every operation so if we don't actually provide them correct data like we will not be able to do anything in this in this system and then like the idea is that like whenever there is like a request to reveal transfers originating somewhere um at some at some illicit address these guys well they do that I mean they they they reveal some particular part of what was hidden so uh I mean it kind of works but that's cheating also and in particular this this committee they have like a really really big Power in this system

they can basically reveal any everything and what's even worse they can reveal everything and no one will know about it so like of course one of the problems is like collusion for for the let's say based on the government request or something like that but the other problem is like economical um Arguments for collusion I mean they may do that for the sake of for example front running the orders or for the sake of some other like complicated D5 things so it may be the case that there is actually a very good business model for them for revealing everything and not telling anyone about it like either it's taking from from some interested party or directly interacting with defi based

on this revealed information so uh yes in a way this system uh has all this all this all this this two properties but uh it introduces pretty complex like game theoretical uh thing here and well it's also with a transaction privacy is usually the thing that we would like this transfer to never be revealed like not even in 20 years and like what's going to happen with this Committee in 20 years hard to say I mean like they may of course see working as this particular committee and they will still have the secrets so the secrets can be revealed post factum then which is also a

problem so we don't want to introduce a privileged third party or at least not as privileged to be able to reveal everything on U on demand and this already kind of like the first glance it looks uh impossible I mean yes so we do do not want to reveal anything about normal users we do want to reveal uh something about uh like illicit funds and we don't have want to have a third party which decides which is which so of course we're not going to have a perfect solution here we we we're looking for like a good tradeoff a good trade-off is um sometimes it's refer to as a proof of Innocence so what's the idea the idea is

that uh we do have this mixing device uh so uh by the way you can think about it as a mixer uh but like nowadays they this this solutions became more and more General like our shielder for example is able to work with arbitrary denominations so it's not only a mixer like like in case of old uh School tornado basically you can keep all your tokens at all time all times at this particular magical box so basically you can think about it as your private wallet there is no reason for you to keep funds anywhere else but this this private box so basically every transfers

you initiate can be can be anonymous and uh how this proof of Innocence think works so yes we do need to have some specific party which will say which addresses are illicit but as we going to see the the power is much less in of this power power of the party is much less in this system so whenever there is a haug which is identified and there is an address doing deposit to the system uh this address ends on like a sanction Oracle there is an onchain contract which uh holds all the addresses which are identified to be uh to be related to the hacks uh and such and then whenever user want to do

withdrawal he provides a proof a zero knowledge proof that uh this fund did not originate at any of the addresses on the on the Oracle so this is zero knowledge proof meaning that this proof does not provide any other information uh above what I just said that this fund did not have anything to do with uh with the uh addresses on the oracle and uh yes and like there are two options basically for users so either they they provide this proof then that they are innocent or if for some reason they cannot provide this

proofs I mean like of course like what what can be the reason the reason is that of course the funds are originating in one of the addresses well we do not actually freeze this funds the other option is always they can reveal everything so like if they reveal the trace they can always withdraw so there is like no fund free but well if they are not able to provide the proof of Innocence they need to they cannot use it as a mixing device um so that's the general scheme of course it's it's pretty complex in particular this this uh proof I didn't make a deposit from any of this addresses this is called non-inclusion proof and like technically it's a pretty tricky thing to to be proven but possible

um so uh to maybe to two more like things that may be not clear from the system so of course first thing is who controls the list of this problematic addresses uh so yes it requires a controller so there is a privileged party in the system what's what's important is that this party cannot reveal uh anything and in particular every reveal is kind of public because they need to publish this this address on the on the Oracle so like they cannot just just reveal everything and don't tell anyone about it everything they do is public which holds them attributable uh and like the second question is like

so what if hacker deposits and quickly withdraws before even the the address ends on The Blacklist so yes this is possible but like if any of you ever read more into about the mixers like basically they they doesn't mix fun I mean to mix fun you need to sit in the mixer for longer time if you deposit like hundred million of dollars and 5 minutes uh later you withdraw $100 million like this is pretty obvious to to link these two actions so like when we are talking about this more most problematic cases these are almost always very big amounts and for example in this year rail protocol on ethereum again Lazarus group tried to mix where I

think something about like 200 million they they have been sitting in the rail gun for half a year and that was not enough I mean like it was possible to to link uh deposits and withdrawals even though it was it took half a year to to kind of anonymize and that was not enough for to an anonymize such a big amount so um yeah I mean this is a tradeoff obviously as as as I said there is a privilege party here although much uh less powerful thank you so when it comes to the questions what do I do I just read here oh uh what would be the difference uh in hortic onchain analysis between

Bitcoin and stealth addresses so the difference is that uh on bitcoin like if someone is not a privacy conscious user probably some is this person is using a single address on bitcoin meaning like the single key uh and then it's it's super obvious to find entire like live history of the transaction we can just see every UT EXO which was ever created with this particular key and we see everything when it comes to the steal addresses it is not uh I mean it's still backtrack but the difference is that uh that we cannot tell whether the funds

have been transferred between user a and user b or whether it was the same user so like if it was the same same private key it is obvious that that's the same user and in in the case of stealth addresses like we cannot I it's slightly harder to Cluster users I mean it may happen that I had some funds and then I did an operation after which they ended up on different address but this is still my address and by in other scenario this is address of another another party so we cannot easily tell which of these scenarios uh is it so it's like harder to to just find entire history of a single user some things can still be

[Music] identified I think that's the only question by from the system so yep does the Ser knowledge Gru have some expired date because otherwise once the deposit funds they get the proof and uh they can withdraw may maybe six months after uh so like the the proof is per withdrawal like we each time we want to do withdrawal we need to generate this proof so constraint if it's not time constraint the proof you prove I not in The

Blacklist but you don't submit the S oh okay yeah you always need to prove that you are not in the current Blacklist I mean yes I mean The Blacklist is time stamped and like if you want to do withdrawal now you need to prove that you are not in the current Blacklist from from this time stamp so like in the sense yes of course it has uh it has this uh like a understanding of time of in a way and by the way we are out out of time so thank you very [Applause] much