Kohaku : privacy for everyone, by default

Transcript

Hello everyone. Uh so we're going to go for a small presentation and a small demo of the Kohaku implementations that we have in the wide and then we will discuss about the future of Kohaku and the project itself and then we will take some questions from you guys. So first what is Kohaku? Maybe some of you still don't know. So it's a an SDK that exposes strong uh privacy and security primitives. Uh it's a power user oriented reference uh implementations um that ships on top of that SDK uh to showcase the features. So right now we have one which is the

Kohaku CLI and very soon we will have more um and it's also a bunch of collaborations with other wallets to implement the SDK either in full or in parts. So what's available today right now we have packages for rail gun I see the team here uh tornado cache privacy pools and providers which are a wrapper around some EVM features so you have some light clients inside you can have IOS or Calibri and spoiler you will have a new light client joining the roster next week it's called lean light and it's uh like clients written in lean and we also

have a social recovery kit um that has been done by Wonderland. I don't know if they're around but they've done a great job with the recovery kit and we have more cool stuff. So the next question usually is when Kohaku. Um, what I can tell you is that it's going to be before GTA 6 and after World of Warcraft, which releases tomorrow. >> So, it's between tomorrow and a month from now or two months from now.

So, it's coming very, very soon. >> And there is already a beta extension that you can access. Um, AV, can you please play video one? Uh, and so here we can see what it looks like to shield funds on private pools inside Empire wallet and vlog.

What do you think, V? Looks good. Looks good. >> Well, it's not impressive. It looks like a regular send and that was the goal basically. Um, we just wanted to make it easy and simple. Um, and that's about it. That's just a send. Voila. And so this one was the good positive use case when you have a good Wi-Fi. And now we can have a look at a tornado cache uh deposit in video two. And this one is with bad Wi-Fi and a VPN. So it's going to take a bit

longer, but you can see the the full flow in the worst case scenario. So first you create a new account for which you can back up the recovery phase. You go into private, select the the right account. And so this is going to be painfully

slow with a VPN and hotel Wi-Fi, but it's still just a regular send. That's the point. It's going to get faster. I warned you this was the worst case scenario. Um, and voila. And what's cool is that you can batch um deposits and you can and we deployed uh recently

three new pools. So you have 0.01 0 uh 03. So you can basically make the precise amount uh that you want. And voila. Okay, perfect. Uh, we can go to video three.

And so this one is the Kohaku CLI. Did you try it already? V >> the cog. I mean I've tried previous versions but not the latest one. >> Okay. >> And so you can batch notes. This is very convenient. So this is for it looks like it's a power user um thing but well it's not that complicated when you look into it. And so cool thing here we have both to

enabled and we are using um PI to do the read. So we have a specific server that allows us to query um the chain without revealing the information that we are quering. So this is pretty cool. This was not possible uh last year and we made a lot of progress on this. Um when you serve a P you need an expensive GPU. So we need to figure out how to scale that but so far so good.

And voila. Can you switch to the slides, please? So private reads uh we had two track in Kohaku one about uh TE with or RAM. So this is using uh obvious RAM technology inside the TE. Um so the operator cannot see what you're requesting. Uh we have an implementation that works that was done by Oblivious Labs. Um it works very well but the only

problem with this solution is that you need a TE and um most nodes don't have a TE and we have the P fetching that we just saw uh that we just witnessed. It works pretty well but it requires expensive GPUs. Um so question for you V. Do you have any idea how to incentivize uh serving private reads? >> Yeah, I think incentivization is probably one of the harder problems, right? And it uh I mean it applies both at this kind of Kohaku and user layer and it also applies for uh like the consensus layer and just how do we do

like distributed storing of of Ethereum state, right? And uh I think one of the big kind of results is that any mechanism that tries to kind of make incentives out of the protocol is always going to be unstable because people can game it, right? People can pretend to be uh both the server and the listener at the same time and uh like never actually make it available and it's like very hard to get around those kind those kinds of things. um the incentive that's most practical I think ultimately just has to be an incentive that's uh paid by the person by the person who's getting the data right so I think uh like there should always be some level of free tier and uh you know there's a question of

like how do you meter that is it like IP address is it a zk proof of of reputation or something else um and then uh for anything above that like realistically I think it should just be something like like it should feel like paying a transaction fee, right? And you know, we're all used to paying transaction fees, and a transaction fee is more than enough payments to pay for many requests going to a server. Um, and uh a single transaction fee could potentially pay for like thousands of requests immediately, right? So like I'm and I'm anticipating then uh you know like servers that are able to make money off of that to just be a like for at least some of them to be able to altruistically provide kind of whatever

what the free tier is, right? So I'm hoping that like we can find that kind of architecture and like to just administer the payments. We have plenty of building blocks, you know, we have the peer-to-peer networking, we have ZK API, we have uh a lot of different things, right? There's an And uh the question is just like how to both make that user friendly enough and also how to make it uh compelling for people to participate on the serving side, right? But like if we like solving I think this problem it's uh not just uh important for like private reading. It's also important for being able to sca safely scale Ethereum state, right?

Because one of the challenges is basically if the states in the history start like ballooning up much more then how do we reliably ensure that people store it and uh incentivizing that is one of the solutions. >> Yeah, last week we made ZK API cheap. >> Um but I think it's still 100k gas. Uh so yeah, we need to make that cheaper if we want >> 8288 can make zk operations much cheaper. >> That's true. Yeah. And shorter term, Glamster Dam can make gas cheaper. It's the whole point of all of the the EPBS and BAL bundle and gas repricing bundle is to enable more scaling.

>> True. If we bundle all of this, maybe we can Yeah. >> And so what's next uh for Kohaku tomorrow? M >> um so we have been planning a next generation of privacy protocol to join the roster of um the Kohaku privacy protocols. >> What are you looking for in this uh next generation? What are the things that you want to see the most? I mean, I you basically just look for I'm looking forward to making kind of properly private, properly secure, properly formally verified flows for as many of the things that we care about

doing just to like have something that has a good canonical implementation, right? And uh you know, we saw sends um we're also uh you know, we're working on social recovery, right? I think that's being released uh like very soon. Um then we're working on uh I mean I think in the social recovery space like there's just so much more you can do to keep increasing the UX of that. Um there then uh working on uh I mean potentially even like more secure ways of interacting with applications. Um like basically replacing the whole kind of broken you know like download the UI from a server model eventually. Um on

the privacy side like be properly comprehensive right so we're doing a good job of privacy of rights doing a have a good road map for privacy of reads network layer privacy is another big one right like you don't want to leak you who you are when you're sending through your IP address and uh you know like kohaku integrates tour already but tour is very far from perfect and uh we want to be imp keep uh improving on that um ideally Um me it's good that we're um moving toward being toward being quantum safe. Um it's uh also good that uh Kohako is like start there there is this

the CLI there's like all of this work of like figuring out how how to incorporate um incorporate it into into browser wallets. Um it's uh like I think to me my hope is like basically you know like step one sort of hardening which means basically both uh ensuring that the work that's done is secure and ensuring that the work that's done is comprehensive and then two is like actually getting it getting it out there in use like I'm looking forward to the uh at least the Ethereum Foundation dog fooding all of this for all of its internal operations like to me that's like the first milestone you know if we can't use this stuff ourselves what's the point right and then you go from here.

>> Yeah, I think this is ongoing. Um, we're currently rolling out I see the the finance team in the crowd. They're rolling out this um more wallet integrations. So, Cake and Anon wallets could be the next ones. >> I just crossed Joe Lubin >> in the corridor earlier today. So, >> I'm working on it for MetaMask. I think it could be the next next one. What do you think? >> Mhm. Yeah, that's good. >> Good strategy. Okay. Um, next one.

Should we wait? This is a hot topic uh these days. Should we wait for HAR to get the lin things uh oneclick migrate button? >> I would say no. Um I would say uh like I I think we should have a uh an as easy as possible migrate button. And if the lack of frames means that it has to depend on Pimlo for now then fine right and uh like we accept that that's uh not ideal from a decentralization standpoint but it is what we what like what we can do and uh and then uh you just like as the technology becomes available to improve the properties then you improve them right >> so you would be for waiting for a star

>> no I'm saying no don't wait for a star yeah like basically do the post the qu postquantum migration that we can now and then probably the only missing piece is basically yeah like the ability to send without a bundler right and uh yeah and that's the piece that that >> but we do need to modify easy recover for permit >> need to modify what >> easy recover >> easy recover right and that's that is true yeah so the thing that we can implement today is uh not a perfect solution right but it's still something that provides value to people like for like a lot of people I think will want a uh a new wallet that is quantum safe also like people like myself like I

would want to upgrade all the keys on my multisig to be in quantum safe and uh like I would love to have the tooling to do that um like even like given the urgency of quantum I think uh like I think there's a lot of value in having a a best effort solution pretty soon and then keep improving its uh its properties and its guarantees as the technology to make that happen becomes available. >> Makes sense. Makes sense. I agree. I hope in the room listen to that. Um could the cohaku endame be just a lean specification of our ideal wallet and users would end up generating their own.

>> Do you think that's a a future that >> Yeah, I think very possible. Right. I think this is uh one of my thesis of computing is that I think like computing is going to become more liquid in the sense that uh like we could see a world that gets closer to a situation where no two people are running the exact same code, right? Basically because everyone can just uh use AI to modify it to fit their needs. And the biggest challenge of that kind of world is basically how do you make it secure, right? And uh I think a big part of this is that there's going to be a need to like create more and more of these secure cores like things that uh where there has been a lot of effort put into securing them, formally verifying them, auditing the statements that are being formally

verified. Um and uh like doing all of that hard work. Um and then uh of course you know you can make modifications but then every modification you make like you basically either spend more like your own effort on uh verifying that or you you know you take the risk that the uh modification you make doesn't break the properties or potentially you know you make the modification and that's or like as a wrapper around it right and like you keep the core the same and then you like wrap around it and you and you uh retain the properties like I like this is a big part of why I've like over the last year and a half just kept on becoming more and more bullish on the CLI, right? Because a CLI is not something that people have to interact

with directly. They can tell their bot to interact with it. They can make a UI wrapper around it. They can tell their bot to make a UI wrapper around it. And uh like I think it's fine that you have all of these uh different form factors and people customize it to meet their own needs. I think the best that we can do is just uh like really uh make that c central piece uh secure and uh you know when it has to be customized even uh create opportunities to for like make that that customization be secure and uh from then on it's up to people what they do with it.

>> So you mentioned using a bot an agent to like control the wallet. Um, did you look into decision models, uh, like Jev or others? >> I mean, I know what they are, but I haven't like played around deeply with them yet. >> I think these are going to be the ones that we use for wallets because >> um, they give you a deterministic answer with a probability and >> it's much better than regular LLM. So >> yeah, so >> I do think there is a world where next one of the next Kohaku thing would be to work on a decision model design for the wallets.

>> Yeah, I mean I think one of the things that we haven't done enough and like we you know like both as EF and as the community can do more is also like fine-tune smaller models specifically for Ethereum and crops and security related use cases, right? Like I think my views for a long time have been basically that on kind of raw generic performance local can never compete with Frontier, right? But uh at the same time, you know, the thing like we're not looking for raw generic performance here like we have a very specific need which is to help people securely navigate the Ethereum world and ideally even securely navigate issues like privacy and uh and and personal data as well, right? And uh

like that's a narrower set of tasks and I think you can optimize a smaller model to be an expert at it and like really seriously pushing that direction as far as we can. >> Yeah, I agree. I think we don't need a Nobel Prize uh level to do some wallet orchestration. >> Mhm. >> Okay, I see we're running out of time. Um I think we're going to take some questions. Banji. >> Oh, hey guys. Can you hear me? Hi. Super exciting. I think I think what's really cool about Kohaku and thank you guys for explaining is also like um the fact that you're building this for an end user is

amazing. I think we've had a lot of criticism within Ethereum world being like you guys aren't building for end users etc. And I think exactly seeing presentations like this, seeing how simple that was. Like that looked like any other transaction and it's under the hood. It's doing crazy stuff. Um so it's really really exciting to see. I think the community is very excited for it and the questions also show that. So question one, we all know why privacy transactions will be adopted quickly. Pill emoji, but when will we have real adoption? 10 years later, will we still walk in with an orange wristband and use a web two app?

H do you want to take this one or I take it? >> I'll take it. Um when will we have real adoption? Uh if we're talking about volume, it's when hardware wallets are going to work properly with uh privacy protocols. Right now, um Royal Gun has it and it's the only one. Um I think it's released. Is it? It is released. uh so you can go and and try it once it becomes a standard and integrated in most of the hardware wallet in an easy way. This is where the volume will unlock. Um 10 years later will we still walk uh in no no uh AI is

going way too fast. Uh I think in two years you will not even it's very unlikely that you spend time on a front end. Uh, so no. Explain me kohaku like I am five. >> How do you feel? >> More secure, more private, still easy to use. >> Goodlook fish. >> Mhm. >> Uh, how does Kohaku translate translate to use case outside of crypto? Uh, good question.

>> I think you could reuse um you could reuse probably the anon PC technology and the P work that we've been doing. Actually P is kind of holy grail of um cryptography that is >> being researched in in many many different area. uh the te oram u work that we've been doing with oblivious lab is live in signal if I'm not mistaken so when you use signal you actually use the same technology so yeah kohhaku does translate some use case outside of crypto but yeah it's mostly a ethereum wallet SDK so yeah

um okay another mass question for you >> I I love the mask Yo, Vitalic brother browser remove that mask. Okay, now um what's the biggest misunderstanding about Kohaku? Um h I think in the beginning people were expecting um maybe us to launch a wallet. Uh it's not the case. We're going to launch a bunch of reference implementations. Um this is not a wallet. we are going to integrate with other wallets. I guess this was the main misunderstanding for some people.

Do you want to take next one? How do you see the future of AI integrated with privacy focused projects like Kohaku? Will combining and privacy make web 3 more secure or could introduce new privacy and security risks? I think it'll do both. I mean I think the risks of AI toward privacy is obvious right like basically any data that gets leaked AI is like so much better at analyzing it and any bug or vulnerability that exists AI is so much better at finding it. I think AI is also good at improving both privacy and security if you use it that way, right? So for example, I mean obviously you know we know about AI for formal verification. I think also on the user side like we can do much more with

AI assistance like basically flagging when you're about to do something that might be risky. Um like you could prevent a lot of scams that way. Also for privacy um using doing your actions through AI instead of doing them directly really reduces how much of your own footprint you put into them which I think is uh also very good for anonymization. So AI I think it pulls in your in both directions right and I think it's uh up to us to really uh enhance the the positive benefits of it. >> Okay we're running out of time but I see a question that I want to take. It's we can verify transactions on it scan but where do we verify that this is uh the real vitalic >> um vitalic what is the

square of 35 so no easy 37 >> okay 25 is 12 25 37 is 1369 this is