Security Mechanisms & Cryptography with OG Web3Auth Founder Zhen Yu Yong

Transcript

welcome back to the rollup High Roller Community as always nothing on the rollup is to be ConEd as Financial advice we are just an Educators in the defi space toss us a quick like give us a share a repost send it to a friend who may want to watch this and finally give us a sub or a follow it means the world to help support credibly neutral educational content in def5 we're here to educate Empower and enrich you and let's jump in so when did you uh when did you start with web 3 off uh um what th specifically I think 2019 2019 I was at the THM foundation for as a researcher been doing that for one year and um it was doing out Singapore so me

and my co-founder back then we always used to do different side projects we were in the phase of coding where you kind of feel like Academia is cool so you kind of think like oh my gosh I totally want to read papers I want to inflo cryptographic schemes you know oh it's so cool you know um and and so we had a lot of different types of projects that kind of spun out of it um there's one that did like ring signatures I'm not sure if they're familiar a little bit oh nice um okay I'm really well vered so maybe you could give a high level like uh explanation um because I I did math in college so I'm fantastic somewhat

somewhat uh yeah so I mean ringes um kind of are a uh also Monero uses ring they do they do for all transfers and they use it designated verifier property so in particular what ring signes are um in in concept are you have you have a whole bunch of uh you have a group of public Keys which can sign which any one of them can sign a signature where you don't know which public key actually signed so for example you could have uh this can be used for like whistleblowing properties you you could like sign on behalf of the public keys of everybody on let's say the Tesla Factory flow and say that you know production schedules aren't on track um

and then you could thetically sell the information as somebody who's on the Tesla public Flor right and then you know it's like yeah yeah so I mean that was one of the projects M um and uh we and uh so we did quite a few of these different things um and we through off started out as one of these different projects that uh I just basically caught the eye of a couple people and they like oh wow it's back then um it was just a basic kind of like dkg what's a zkg zkg it's a distributed key generation okay so it's just generating a key from multiple locations such that none of these different

locations know the key key I mean have have have they have a part of the key they don't have the full part um they they have part of the key and uh two a full key that they know does definitely does exist okay so DK are often used um in a lot of the ZK ceremonies actually generating some of the initial ZK proofs they're one of the fundamental things to it uh zkd are also just a general cryptographic primitive we have particularly used it and we paired it up to a like or so it kind of was a dkg set of if you will like um uh nodes uh or instances that basically was was

like an oracle to uh your your final public private keer which you can get by let's say Google l so it's kind of like proxying all in a way um and then and yeah I mean I think people were more attracted just to the Google aspect they just saw oh like you know cryptographic jargon blah blah blah but I get a Google a holy um and then they were like yes invest um now I was back in 2019 um so we started out as a wallet oh uh it was called the Taurus wallet I'm not sure if you're familiar uh but it was familiar one of the back then there were no other wallets that

were competing with metamask oh on metamask was basically had dominance and they also beat out like Mist okay Mist used to be like a desktop native wallet um so they beat out missed and uh and we had just come in and daps were just starting to become a thing so we were basically went around going like hey like nobody wants to install a Chrome extension they just want to you know log in with Google into your app um use this Stars wallet right and it was was a desktop or it a browser based browser extension so it was a brows not even an extension it was a browser based wall oh okay so it's kind of like it existed with the domain security model um where

a domain would basically be loaded in your uh in your website as an ier and then uh kind of you would have kind of the PayPal like flow um when signing transactions so when you click sign you go out into the be a popup or there will be a redirect and you would have to sign and go back into so a lot of apps love that um and we did get quite a few Integrations we integrated with crypto kitties backs uh just starting we did I don't know let's see um when when were you first in this 20 20 2016 2016 so so okay so I did not buy a crypto

Kitty e one um it was like a copy of Pokemon but like ah no I wasn't around there either but like uh the parody wallet I was using my ether wallet back and my ether wallet was also a browser online yeah wallet yes now my ether wallet I could click create a wallet and it used username and password so it knew my seed phrase and my private key oh what's that you know I thought will either the wallet you click create wallet and it just was just sin forence and it the SE phase out to you no maybe well I think you you could my hether wallet you could do username in password

okay um maybe it did both I think it probably did both yeah in particular but yes sure um yeah I mean that the username password would be I'm not famar warl like username password implementation in particular but I think there was a different company that did that um cortis they for this they got acquired by uh they got acquired by um shape shift oh shape shift yes yeah we go this way it's a bit loud over there I think okay yeah oh sure so they acquired shape shift and um I mean shap shift to five them okay uh so so 2020 2016 you were saying uh no

this was in 2019 okay that was 2019 um we did that for about a year or two apps loved it but people didn't really uh apps loved it but users it might be like the timing of it or it might be I'm not sure for whatever reason but we weren't seeing retention from the Taurus wallet yes so like the taus wallet still exists today by the way you can still try it out and play around it still has about 200k 200k months active uses wow which is like a decent wallet and is there applic like which are some of the more prominent applications that are using course varable okay um like you can connect with wall connect any app

just like just like any other application but I think we've stopped pushing out the tus wall like long ago these are just like I don't know I don't know where they come from we have on taus um and uh and so so like we realized that retention didn't seem to be there right um and uh so what we did was we kind of like in 2020 well 202 whoa fell and died um dude it's genocide genocide you have

died that's that's deep um so you had to Pivot in 2020 so21 uh 2020 20 late 2020 um we kind of pivoted into a lot of people kept asking us like hey like we love it we love the experience but like we want to own the whole Music Experience ourselves we don't wanted to deal like the popups we want to kind of like build our own wallet that's why I kind of like we pivoted into um or we launched our W as a service product service and that product became much more popular yeah and people were paying for it so like so like we just we just full steam ahead

went down that direction um very soon eclips like whatever users we were doing back there and then now we have maybe about um you know we we launched some of the top wallets in the space like trust wallet um we just launched a safe uh that was just launched uh at Dev connect like two days ago congratulations um anima Brands okay they Lo ID wallet you know sequence uh skyw Weaver sequence and polyon sounds familiar it's one of the wallets one the most popular wallet B on polygon um that's that's that's also followed by us uh zero Dev which is the most popular conk um uses those as well

um uh like along with safe wallet is like you know safe core SDK uh what El see so we have about now at Peak we have about 12 million us a month M on all these different applications logging in now we have about 10 uhuh yeah and uh it still has social login at its core so the tech has evolved as Tech requirements evolve um back then it just used to be social Lans behind the dkg but then we realized that people wanted kind of um a little bit more device based control and device based management of

the key they didn't they were okay with it initially but they wanted more security as time went on right so now we have kind of like an MPC cell um that does like two of three okay right and also even more recently in the last kind of like eight months we've also integrated AA into different aspects of sta so now there's also a construction build on top of it you you can deploy with like you know safe a COR SDK zero Dev um unip pass any one of the sdks you can actually take we off plug it in in particular and then extend your stack to whatever AA setup that you'd like to set up to um yeah so it has evolved over the years um according to customer demands I

think ultimately World continue to evolve I think a big thing about authentication is that everybody wants it slightly differently in identity right and they have custom needs different Stacks like gaming applications want to do it on Unity what what's up you just junk oh no way so like so like different people want like unity and different stuff um so yeah so I think that's that's that's more or less how we we just into the C store and just build more L yeah what are you hearing from the customer

nowadays um about you know they they said oh we want a more integrated experience you said okay here we'll we'll take porus which does iframe and it's almost like a manag service we'll give you web three off and they said they want more security so you switch from the the uh distributed key generation to more of an NPC style format yeah so there's been technical Evolutions from kind of the beginning stages in 2019 to

um and and dkg and and uh NPC are those two separate forms of key generation and and private key storage so MPC is they're all different forms of manipulating your eway which is your externally owned account which is just words for a public private keeper and a cryptographic private private keeper um and uh and and so like um they they're different but in the similar field of cryptography okay uh FPC

is a very very large on relon actually and before crypto became its number one use case MPC has been researched for like like 20 over years in particular my old and it used to refer to privacy use cases more privacy is was one of its biggest use cases um and uh what NPC stands for is multiparty computation which is splitting up computation to be done on different instances such that these instances protect a um a particular secret most of the time now in when when when using MPC

for Key Management right you are basically that secret that you're managing is a users public private keeper or a users EA so NPC basically splits the US public private keeper up into multiple different parts and then you use these different parts in kind of like a threshold manner just like a multi um to basically sign and secure use a p private keeper now you might immediately ask me wait Zen like why don't just use a multi that's s multi right two of three two of four take the keys you sign and then it execut that that's exactly it right so it does exactly sound like a multi right you could do three or four or five or four

four six or whatever spit Keys up until and yeah yeah yeah yeah it's it keeps going on right so you might go like hey like like why isn't this a multi right so the main reason why NPC became um like NPC is actually the de facto MPC is actually the def facto Enterprise standard M for managing keyas like are you fam of like fire blocks you fam of like um yeah so and and these companies all like if you if if you're an exchange like bance bance use NPC enally to secure their assets they enally cold wall all of them all use PC

and um this is the same for coinbase it's the same for it's the same for like it's the same for uh a lot of your Venture funds out there all use MPC uh and the main reason why MPC has one over the multics in Enterprise space is because MPC allows you the the interface for NPC ised by the KE which essentially allows you to interact with any um with uh with any chain with a multi you have to deploy it and you can

only interact one is this because it's a smart contract yes okay exactly yeah multis are smart contracts and there specific to chains okay whereas MPC is not specific to chains and I on like any chain and because of that as well it's like it's it it because it's offchain it doesn't cost any money like on the thir today if you're to point and no say that it's going to cost you 50 to 60 bucks that's the same with any a little bit cheaper with any asdk today right use a com fraction on Main that that's what you're paying to the point right like this you know companies didn't want to pay companies don't want

to go through a hassle um that's is one chain right and like some chains don't support multi some chains are nonm some ch evm people didn't want to deal with any of that people just wanted you know uh so so Universal solution that can apply across whichever change yeah so so NPC like so NPC had become the def facto kind of um solution for uh for for Enterprise and we thought that hey let's democratize onpc such that any user can use that um as they want to and and today that's what you get with let's say any wallet that integrates we through

you get NPC out of the V right out of the box okay almost wallet as a service right is very understandable easy to understand underneath the hood it is MPC as a service is that uh it is NPC has a service as one of the multiple servic that could provide you one function okay because we also have a under the hood as well and how is this where social login is a layer on top of NPC so social login controls and manages the EA um to essentially a uh to essentially uh a constructed World um and uh yeah and so NPC is more of like one of the

Technologies NPC as a service okay um yes so the ecosystem has evolved now it's now it's AA but previously the R Used to Be NPC like a year and a half ago or like two years ago it was like oh wow everybody needs NPC now it's AA a constraction um yeah so now everybody's integrated in construct yeah yeah that's uh that is the new narrative it is um and in these in these formats whether it's dkg or it's uh account abstraction or it's MPC whichever um whichever format of key

generation is used is there you know that the saying is not your keys not your coins right yes so when web3 off generates a private key public key pair is that is web 3 off or or is one single entity holding the keys or are the in in whichever key generation uh process these are distributed across multiple parties so what a non-custodial solution which means that which our definition of noncustodial is uh is one property that is very strong and then the second property that is more Loosely applied

the first property is that nobody but the user has access to their poly proofit cheaper the second property is nobody can deny access to a user poly proofit cheer ah and is it the user's choice and uh so our default set up on web off right is it starts with a two of two um so think of a multisig but two of two multisig okay in particular it is two of two multisig is between yourself uhuh uh on your device once the time um as well as one on web through off which is managed by your Google

L okay and you say go ahead this web segment um actually you you you you ask first when the Google account manages the second key pair yeah how does it do that so it we actually take so that's where the dkg comes in with the dkg dkg so we take this think of it as two parts uh right one key split into two parts okay one of the parts list on your device uhhuh the second part is split into yet another five parts okay we call these parts shares so now we have six parts so

now we have we have six parts but we have we have six parts but five of the parts con constitute one part of the of the pair yes okay okay so think of it as two of two uhhuh and then one of the two of to split into three or five okay okay and and that's and and this it's five right it can be three five five out nine but we we have different constructs for different customers um and um it's run by large ecosystem stakeholders so we runs one um polygon runs one um a th name service runs another uh and is this

is this polygon running for uh uh one of the five or one of the nine for everyone or is it only for polygon implementation it it's for it depends on what you select okay as a developer developers choose what they want the setups to be at the end of the day so we've had some people just want to run it in themselves completely this through out now you might ask hey if it's three out five why would you like why don't just you run one right MH like why if you're running all five why I just run one if I'm in control of all five and I want if I choose that now now there is benefit in

in large key stakeholders doing one of the five or exactly exactly so even inal companies have different teams different IM setups that's why binance uses NPC in teling right in particular because then they can ensure that it's split amongst a certain different demographic artist and not just you know in big companies you get people who just take it and run right like like you can't have that happen right right so so some large of custum was definitely go for like these setups just in t just to kind of like secure themselves thend themselves almost yeah right yeah in in the infighting the internal conflict yes like like not so much conflict but you know manage or um whether intentional or

unintentional operational uh obscurities that could could lead someone or or a number of the signers to intentionally act against the company's interest or in their own self interest take as like a safe know like like a safe to because this actually holds money at the end of the day you steal this you get one factor of a user key um and you you you can then potentially do things which get a second factor and kind steal right so this is money involved here so this is actually just like you know think of yourself as a bank and like how many people have access to the sit how many people like and the reason why it's not 5 out five

it's three out five or five out nine or whatever it's because you also need redundancy right if it's five out five any one of the actors can go oh I'm not signing and there nothing you can do the money is stuck yeah that gives this person full control over like you know kind of like what so so yeah that's a setup um and and then users naturally can add more factors or developers can add more factors and give more factors to the end user really this is a lot easier to show rather than to tell if you guys try um if you try like app to or Transformers W or you can try like really just any web

off demo um you'll you if you log in and then you log in three times right we'll actually ask you to set up a third Factor factor which is then like Google but then the the third factor is like okay you can do like authenticate okay yeah or you can do it with another social or you can even use a password okay right so like ultimately it starts a two of two but then it goes into two three and and and is like the process that we like to uh like you know we care about security a lot and we talk about a lot and it's because we know like the scams and the potential things that exist and

we keep hearing it when a crypto right every other day B just got hacked by 20 million right yeah like every other day somebody gets hacked some entity gets hacked money is stolen it's it's uh it's it's it's and that's and that's and and um so we know of the repercussions but like this is not necessarily not all users care this much actually when you're talking about like applications that mostly use web through off they mostly use them for a better onboarding a better user experience uhuh so what that means is that these applications are like you know G yeah maybe yes you have an nft but just one

um you know like like you're you maybe you're in like a donation app a good dollar you're in the social app right you just locate to tweet with your friends you initially as a user most of the time when you first log in don't care you care you you care nothing about your account actually you you don't care if you lose your account if you lose your account you wouldn't be sad at all this goes all the way up to maybe $100 even or somebody who depending on the POS net worth and you know the what they used to the amount of value that they associate with the account starts off very low yeah grows with the amount of money or time spend in the appli exactly exactly so what we have is we we we

entially always draw a chart and we basically go like when is that point when a user should be setting up two or three okay when is the user should be setting up more than two Al most our users are just comfortable two3 to be honest and as a good level of security um but uh but yeah so it's kind of like an incremental a progressive wolf security as well as self custody because you know in a two of skin right remember I talked about the two properties of self custody um yes you said uh one of them is not being able to um no one can cut you off from your keys

yes that was the second one and the second one the first one is no one can access your okay right so with the first one right like that's true in the two of two right no one can access your keys because the a third party only has access access to at most one factor right right right right you are the second Factor yes but because they can deny your signature your signature for your first Factor the second property isn't necessarily true yeah right so the second property only becomes true once you have two or three and you're managing factors outside of this thir part as long as you yeah you manage two of those three and the other person so so in this setup if it's two of three

maybe I have one key stored locally on my machine yep another let's say Google so or some social login has another form of yep a key Y and the third one is my two Factor authentication yep so then when I sign into to Google that unlocks one of those keys and then I have to either have be on existing device be the have device or have the two the two fact yes but Google on their own cannot access my account yes they can also not shook me off because I have the other two keys yes yes yes so incremental security incremental

self custody um as of when the user requires it um yeah and that's basically the setup that we try to push out everybody has to want edited version of this sometimes Some people prefer to be custodial first and shift into non- custody after Some people prefer to like so they just do one of one initial right for example Some people prefer to just start off of two or three right off the bat and even increment it depending on the use case right so it really just depends like a financial app like you know like like who's issuing like a ETF will start everybody at 123 and require 123 R back okay but like a gaming application may

start oneon-one first and then shift to two out two okay okay and then that this was a like amazing like construction of like uh Security application so I'm thinking like now theoretically like what does this unlock like and and maybe a little bit more practically like what are you seeing in in data and like empirically what are what are your partners telling you who are you seeing adopt like what are you most excited about in kind of the next right like going forward so I com to when it comes to current adoption right um it's actually

quite split between different Industries uh we have like 20% like on nfts 20% on gaming 20% on defi or payin um and then a whole section of others start to head back uh or maybe we go around okay sure yeah uh so so like so like there this so so it's quite distributed across different I would say Industries uhuh uh I think one thing that aligns people is that they want often they want to learn the whole USIC experience uhuh but they want to you know Target mainstream users one word like millions or billions of users

blah blah blah blah blah I can't tell you the number of times app has told me bro I'm going to unb 20 million users for you and then they launch as like 200k um but yeah so currently um it's it's quite even uh I think what I'm most excited about we started to try to think about not just um like providing wallets to users but also allowing you know we have 10 million users that's a lot of users uh particular it's like somehow more than the whole crypto like like like maybe not whole crypto but it's like matching that in way it's because not

all of our users transact okay like a lot of the applications they don't they don't necessarily always transact maybe they connect with Google and they don't do anything maybe they connect to Google and they have an address and sometimes they sft sometimes they do l so this is this is wild cods one of the really really OG people who enbl donations on chain very um in particular and they built they they they allowed you to buy animals no not buy them but like like like buy nfts that represented taking care of animals oh that's nice yeah have you heard of oh Hardware attacks no um token that's always for

sale um but it's a token that always has a price okay when you purchase it you choose the price and then hardcoded in each NF is fixed Advantage um so like let's say one NF is 10% per month so do you set the price to 100 100% $100 okay then you would pay $10 per month to the organization that's uh doing research protecting the animals that was the basic idea is it still going yeah it's all on chain uh I haven't worked on it all many

years was one of the cor projects you guys just to wall yeah guys edus wallet see back in the day so no I think they're there very cool wow so and this enables um uh maybe it was zoos or pet owners or uh Humane Societies to accept donations and crypto is that right yeah I mean I'm South Africa there's a lot of like

Wildlife organiz so that's where it started um so I had their friends in that sort of space and then right now they you can buy a license to kill a vinals i and they and they say it's conservation but when I was yeah I mean oh sorry let's go ahead yeah I do I do not support killing right yeah and yourself what are you what do you have we're recording an interview but this is a great um use case like this is a very talking about use case yeah so that's really cool that uh you came in I do um I do education so I'll

to try to put things in simple terms for people to understand cool so where where would I gather this um the rollup yeah do the rollup company