MPC vs Account Abstraction: Better Together?

Transcript

welcome everybody for the next speech by Luka isalovic we will try to start a little bit like one minute earlier so to give Luca a little bit more time so I guess everybody can take the seat and Luca the floor is yours thank you uh so hello everyone my name is Lucas hilovich I'm co-founder and city of bislet so the the theme of today's talk is going to be MPC versus account abstraction but not like in in is like which technology is going to Prevail as the top one you're gonna use but whether we can combine them in order to produce better QX and better security for for the end users also it's not

going to be like too technical so we're gonna mostly talk about the product and the ux rider rather than the implementation itself so I'd like to open this by looking at a few headlines from the last year that like made some traction and that's downfall of these companies like FTX Celsius Voyager and so on but not in terms like uh what happened but I'm going to ask why was there so much money there in the first place you know and that probably has something to do with these other types of headlines we see every few weeks and that's like x amount of money was lost to the mismanagement of private keys or there was a hack or whatever so essentially if you're going to be in crypto for for the long term self-casted

is important but also it's hard because if you turn hard like everyone would be doing it and that's usually not the case as we can obviously see what's making it hard is the private Keys We simply don't know what to do with them first like when the first wallets came up we had files we were supposed to like download these files and keep them secure in whatever way we can that usually like as we can see also we had seed phrases which didn't improve things much because again it just doesn't make sense like imagine this real world situation where a customer would go into the bank and there would be this Bank employee opening accountant and by the time you're done they give you like this

and say okay like these are these words and keep them safe but if you don't like if anyone see this ever in the future your money is gone irreversible like done so if that was the case like nobody would be using Banks and not to mention like the hacks and other stuff you have to worry about so multi-six like improved improve the situation like slightly but again like we're not using them much why it's because of the ux and the issue is at a bare minimum you have to have multiple wallets so and like the optimal solution is to have multiple devices and even even if you figure that out that's just for the for the one coin like multi-sync implementation is different for for

Bitcoin for ethereum we have Smart contracts for another thing we have totally different stuff so we have to figure it out for for each coin differently for the end user again like if we introduce like friction they're just gonna do what's easiest for them so finally we come to the NPC I'm sure you've heard the term like over over the years on Twitter at least and read it so it basically stands for multi-party computation and the general definition is that we have multiple parties with their private inputs that join like jointly compute some some output like in these rounds of communication that's like a basic definition and why say it like that is because this wasn't like um invented for crypto by the way this is from from the 80s the multi-party computation like

it's in cryptography not not in crypto and also by saying it like that it sounds like pretty similar to the multisig because we have these private shares and in multi-sync we have private Keys we have joint output and in in multisig we have like design transactions so what's that what's the difference there the the MPC is working like layer below multi-sig so instead of like specific blockchain implementation we are working with like cryptographic Keys directly so what that allows us to do is is to have like seamless experience for multiple different coins and instead of private keys we're working with key shares which are by itself like nothing significant it's just it's just a string you know the piece of like text that's also important for the for the Privacy standpoint because right now if

you show me like multi-sig for example on ethereum which is probably something like the noisy safe or rather smart contract I can pretty easily like identify how many signers there are when did they sign a transaction and like how many left and basically everything regarding the policy of your wallet and and then your company maybe if you're using it for the company and for the differences for the MPC on the blockchain it looks like any other transaction so I cannot say anything it could be like one sign or 20 signers I don't know anything about that also it's off chain so I don't have to deploy any data on chain and also I don't have to store it in the area of change and that also makes it free which is not again the case with the with the ethereum's powerful specifically like Bitcoin is different we have native

multi-sik there also pretty big one here we talked about ux and friction between users but also there's a friction between like um these Technologies and and development and the product they're they're using so daps already deployed don't change they they're not required to change anything to support multi-sig like even if you if you support any other wallet you're supporting multicycle already I mean NPC sorry and then comes account abstraction like I'm sure everyone everyone here like heard about it so we're not going to go like too deep into explaining what it is so everything we've been using up to now is eoa like externally open account and account abstraction is basically a smart account on the blockchain that's like controlling uh some money so

I'd like to ask here is like um we had this for years you know glossy safe wasn't invented like last year we had uh accounts holding crypto with different um like rules and policies over the years so so why are we talking about account abstraction now and that's uh probably like standardization you know 437 and that's important because standardization gives us a framework like that that we can follow in order to build our products and and that is like explaining the expanding the ecosystem because Frameworks like fuel further adoption between developers I mean also um instead of like signed messages with account abstraction we have these user operations which are basic basically

intense for the user like some user wants to do something instead of like sending assigned message he sends user operation and that's important as well because we have a standard way of defining these things user wants to do and that allows us to do gas abstraction bundlers pay masters whatever there are few downsides of account abstraction in TVM only and you have to pay fees in order to get wallet and that's that's a pretty big one for the users because again um I was just checking like a few days ago it costs around 10 or 15 bucks to to deploy an urgent wallet that's not good only ethereum mainnet and also some dabs require additional support like not everything works out of the box

so we have an issue there as well like um if you're a developer at this company like imagine going to to who's ever above you and saying like yeah we need to support 437 however like that's for the this two percent of the user base instead of like fixing this button that's not working for for months and it's like annoying everyone else that's hard sell as well um so this is an example of user operation that's standardized by the way that account abstraction is using and um down down below we can see that we have this signature uh in the user operation and signature comes from the private Keys that's like in reference to the digital signature and that's weird because I was reading on Twitter just just like a few days ago

and then ever since uh cont abstraction came along that we don't have private Keys like we have this different thing we eliminated private Keys we have sign in with Google now so what's happening with this well what happened is that we used MPC already to make a better like every time you use sign in with Google to to do anything with uh smart wallets you already use MPC and how does that work well uh we have these companies that are basically authentication providers and they have in the background a decentralized network of NPC nodes okay holding these private shares shares of the key and by signing in with Google you are giving the network an authorization to use your key on your behalf to find user operation that goes

again to the to the account abstraction wallet and then it goes on the network so we have already like achieved better ux on account abstraction by using NPC I don't see like much talk about that like we talked about we talked about eliminating private keys with account abstraction but it's not it's not there because again we need signature for each user operation so we need to have some private key somewhere um so we used MPC to make a better but can we also use AA to make MPC better so why would we even want to do that you know the a is going to deprecate the MPC well it's not as we can see like right now we are already using it so we need

to make it better and also there are different shades I know we're here at like ECC so we're all like go ethereum here but there are other changes as well that we need to take care of um the big issue with NPC as we know is like a reshare so we can we can engage in this algorithm where nodes exchange their old shares for their new shares and that's an issue because node can always save their own their own share and use it after the fact after we after we're done reshare whenever they want uh and that's an issue in decentralized systems because we cannot control them however most MPC implementations right now are not decentralized they are between you as a customer and some other company as MPC provider whether it be like fire blocks or web3 auth or

whatever we're using for for these services so it's basically always two out of two and if we don't want to make that like a custodial wallet uh where we don't have like full control we have to make this company give up their share to us whenever we want and um like the most the most like common case I've seen so far is they they give you this key to download in like a file format or or like they encrypt it then you have to enter this password whatever so basically we've made a full circle you know we've come to the beginning where we had this Bitcoin wallets where you download the key so it's not good for for the ux standpoint so how can we make this better you know

uh we can use a to make this recovery of the shares decentralized there are these things now called decentralized access control and encrypted encrypted the decentralized networks so there are pretty interesting papers on this and interesting protocols developing that for example like ceramic lit you know pretty awesome project and we can use these decentralized axis controls in order to say to as a user to the MPC provider okay I don't want your share right now because I don't want to like take care of it I don't know what to do with it however I wanna I want you to make it available for for me to to get it at like you know whenever I want like in case you're not around I want to make a transaction without you so we can say to this

MPC provider okay encrypt the share with with the symmetric key and make like make it accessible with my account abstraction wallet so I can produce a signature in order to get that key and download it whenever I want so why are what are we getting with this first like you don't get it right away because you don't want to store it and secondly you can get it whenever you want with the like policies however you set it up so for example you don't want to worry about it at the start like with this recovery so you want to make it as fast as possible so you just say okay I'm signing in with Google another MPC wallet by the way to authorize my account abstraction wallet to authorize the recovery of my MPC share however later like for example you're using

company wallet you want to use multiple of these like authorizations so you sell us you set it up with your company members so multiple sign in with Googles and then uh a new CTO comes around and says like this is not good uh we're using sign in with Google we are dependent bad one so you can always exchange it like the good thing with the account abstraction is we can always change who has designing permission which key so I can attach for example my Hardware wallet or multiple Hardware wallet so I can compose this as much as I want because again we've gone full circle here here we're using MPC in order to authorize account abstraction then using another account abstraction in order to recover MPC share kind of like um like the movie The Inception thing here going on and the

best thing is like we could do it as much time as we want like we can do it just once or 10 times whatever so composable security is good security and what we've achieved is we have achieved decentralized recovery of MPC shares and by the way this is not uh just uh theoretical like made up uh stuff based on some paper somewhere we're actually uh doing it right now at bizlet and it's going to be available in production next month for for our customers uh the end goal with this is basically to increase the ux of the wallets and by increasing ux we're going to increase the security and and of course this decentralization because what's important here is like we have this secure solution and we have them for

years like nozi safe and so on but nobody is using them because your user is always going to use what's easiest and that's not that's not it we have to make the secure solution easiest to use and by doing that we're going to promote decentralization so uh that's it for me uh I don't have I think we have time for any questions right now so if you want to talk about this further you can always find me at the conference and I'll be happy to talk to you thank you you were actually very fast so we have like three minutes for questions so are there any questions no one question is here

great great just a question about them I I can hear you if you want to stand up don't worry hello yeah just a question about NPC how can you uh revoke share like if you have a centralized that has a share how can you revoke it yeah that's that's basically the issue it's called the uh you cannot revoke the share you can issue new shares uh which correspond to the same output so for example if you have new shares that that when they engage they produce the same signature as the old chairs right but you still didn't revoke those exactly exactly you cannot rework revoke all shares because the Departments can always save them like you can say we're not using them but that's not stopping me from like saying okay I saved them

and I can use them later but that's that's an issue in decentralized environments like so if what you're saying is that the only way for me to revoke some centralized service again here is change the uh change the address change the key I'll change the address I'll change the signature key if it's using it yeah but you cannot change exactly so so the only way for you if you if you already have like some NPC provider and you're using it for your wallet the only way to move away from them is to send money to another wallet because they can always like save their share if you say don't use it like they say okay but you know nothing is stopping them from using it in the future yes I think uh you know one big premise

but what you're saying is that there's like a protocol like cleat or something under the hood that basically decentralized the shell storage or like one of the share storage or multiple shares but at the end of the day that's like that's like the the main trust point and how do you know that there's no collusion in that Network and all that like I mean that's uh that's a big assumption the main premise is yeah you're right so uh we have to use ipfs or storage or some Network like that in order to store this share somewhere for the long term uh if they're compromised well I guess yeah it's not going to work so this essentially uh yeah it's gonna rely on ipfs in on on storage being decentralized or these other networks whatever decentralized network storage

we have a few of them now so I wouldn't say it's like a new technology is in regards to decentralized storage networks so I think we're pretty good there I say okay so the share is encrypted on like lead and whatever it's not that they have shares like and they can do like signatures under on their own it's literally just like an access control mechanism you store it on some conditions it will give me back but they encrypted show yeah yeah basically it's going to give you the Share encrypted and you can decrypt it with the your account account abstraction well for example we're using a cloud abstraction but you can use any wallet for example you can decrypt it with your uh Ledger account or whatever you're using and uh that's that's an interesting thing here because uh that's just for share of the

of your provider you always have your share on the other side also can be encrypted and stored in the same or different way and that's what I mean meant like uh with composable security you can choose to do like the simplest way now but for example store it on Google Drive and have like ipfs as a backup and then you can store it again on storage you can basically store it on 10 different decentralized network and says and say something like okay if one of these fails I have other nine whatever you can do all of that thanks sure first of all congratulations very good talk thank you I don't know if you heard about MEF kgf and what's your thought about about it yeah um so I'm not quite

familiar with that but I'd like to talk to you or I mean after the fact if you can uh you know explain thank you very much [Applause] [Music]