Building MPC Wallets

Transcript

[Music] foreign lindel the head of uh cryptography at coinbase and one of the select few of people over 50 at the conference so I'm going to talk about um simultaneously improving both security and usability of crypto wallets using NPC and I want to start with something that I call the self-custody Dilemma so we all want self-custody we'll understand that with self-custody it's your keys and your coins you don't need to rely on anybody else however self-custody puts the owners of responsibility completely on the user you have your response want to make sure that your keys don't get lost you're

responsible to make sure that your keys don't get stolen and if they are stolen or lost then you lose all of your assets the solutions that we have like mnemonics which are supposedly are helpful for the user you can write down a mnemonic in a better way than writing down a binary string but it results in very poor user experience especially when we think about the masses so don't think about the people in this room think about everyone who we want to start getting into the field and uh and the current method of self-casting just doesn't suit them and won't work on the other hand a custodial solution has great user experience if I forget my password I can go to my organization my custodian just like my bank and ask them to reset my password they can deploy

fraud mitigation and policy enforcement on their side which cannot be bypassed and in general they're much much better at secure hearing keys and digital assets than the average user in fact they're probably better if they have a serious security team of course probably better than even expert users but it's not decentralized and you have to rely on them and this whole field is about decentralization so how can we solve this dilemma and I just want to note again for the people in in here because we're so used to it that we don't even think about it but let's say I want to install adapt I might want to install a wallet to to to run adapt and I send them suddenly told that write this long series of uh words down and if you lose them you'll lose everything forever and

no one it will be able to help you this is not a very very helpful intro to the the the space of blockchain and cryptocurrency and if we keep doing this then it's not going to reach the masses so what we want is to get the user experience and the security of an exchange of a responsible exchange maybe where I need to stress but while still being self-custodian and with MPC we can actually achieve that and that's what I'm going to talk about uh here today so firstly what's MPC I think everybody knows what NPC is but I've been doing it since 1998 and for 20 years nobody knew what it was so I still feel the need to say but it's very briefly it's a subfield of cryptography been researched

since the late 80s there are literally thousands of research papers about this we have a very deep understanding about the theoretical foundations of MPC it's a very active area of Applied research today and it's being used extensively now in the crypto space but also in other spaces as well and the basic idea is to be able to compute on private data without revealing anything but the result of that computation and the best way to think about it and interestingly not only is is this the easiest way to think about it it's also actually how we formulate it mathematically in our formal definitions what an NPC protocol achieves and is essentially a trusted party without trust it's actually very very aligned with everything in the blockchain space

so we have a set of parties who are interacting and sending messages there's no there's no trusted party at all but the MPC protocol behaves as if there was an Incorruptible trusted party or inter in Incorruptible secure element that everybody sends their input to that party computes the output or computes the function and gives the output to the parties as needed and security is maintained as long as at least one of the real parties in the real world where there is no trust is honest there are actually different models with honest majority dishonest majority won't go into it but let's just uh think about it in this way for now so how do we use NPC for signing or also called threshold threshold signing you generate a key by in a shared way in a

way that sums up to the real key so I get K1 the other party gets K2 thinking for two party right now and K1 plus K2 equals K so if the key was the number 100 I might have 33 and the other part is 67 but it could be any possible combination and that also means that any single value gives no information about the key so if I only have K1 I actually have no information about the key K and when I say information actually mean in the mathematical sense and then you sign on a transaction by running an NPC protocol between these two devices between these two parties they'll send messages back and forth and at the end they'll get a signature but what are the guarantees that we have so the security guarantees that we have and again if you want to think formally think about that

there is some trusted party that we send out key shows and give back the results so the first thing is that privacy means that nothing but the result is learned and that means that you don't know anything about the key so you get the signature which is what you're supposed to get but you don't learn anything else so the key remains private and this is even if one of the parties is completely corrupted they're running malicious code to attack the protocol they know exactly what the protocol is the only thing they don't know is the secrets that's the foundation of cryptography and still nothing can be learned but the second property which in this case is arguably even more important is that of correctness and that means that even if one of the parties is corrupted they can't make the result of the signature be something that I didn't agree to so I

might agree to transfer 10 000 USD CTU but uh I don't want you to cheat and actually have it resulting you getting a million usdc that's a bit much for for our lunch together so correctness guarantees that only what I agreed to sign on will actually be uh signed upon and nothing else and importantly security is mathematically proven so these aren't hand waving uh sort of uh techniques where we think it's going to be okay because the attacker can't do a b and c I said we have a very strong theoretical foundation and we're able to formally prove security of course and as I mentioned a little bit later on we have to be careful that the security proof is validated and that the protocol that we

actually Implement matches exactly what's what has been proven I'll talk about that a little bit at the end I just want to speak a little bit of what I mean by Corruptions because it's a little bit strange if I have a wallet and I'm splitting a key between myself and a service provider what does it mean that I'm corrupted I certainly don't want to steal my own money for myself most service providers at least reasonable ones don't want to steal from their customers otherwise they go bankrupt so what we're really referring to is uh for example the user side malware mobile devices are not very secure devices and if malware can be installed and therefore steal some by everybody's uh your all of your assets

that would be a complete disaster and that was what we would mean by corruption here so the idea is I would get Security even if someone has complete control of my mobile device or my laptop whichever whatever I'm using on the service provider side we have questions of a breach we want to make sure that even if the service provider is breached nothing can be stolen and this is in very deep contrast to some exchanges that have been breached in the past and and user a lot of user funds were stolen and another issue is of course corrupt insiders when you're dealing with billions of dollars there's a lot of motivation for corrupt Insiders so how does an NPC Wallet work we're sharing the key between the user device and mobile Ira browser on your laptop whatever it is and the service provider

and the basic properties that we obtain are that the service provider firstly cannot transact without the user the service pro just doesn't hold the key they have one share of the key and they can't do anything without the user this already starts feeling like self-custody but on the other hand the malware on the mobile can't steal the key because there's only a share of the key so that starts feeling also a little bit about what what we would get from the property of using a custodian in an exchange because even if someone breaches my device they can't steal my key you can deploy fraud mitigation and policies maybe what like with my bank I want to have a limit of ten thousand dollars a day that I can transfer unless I do some special process uh or there

can be things like my credit card company does if they see something which looks very strange they can reach out and check that it's really me and because NPC requires both sides to to approve and sign then you can actually enforce this on both sides and you can therefore cannot bypass it which you could for example in a regular self-custodial wallet and the backup of the user share and this is a really important point that I want to get back to later on the backup of the user share is much easier because it's not my entire key it's only one share of the key so even if somebody steals that it's not that they can't do anything without also being able to authenticate to the service provider and do everything else that they need to carry out a transaction so this is uh the basic idea

behind what we're going to achieve I just want to stress that in the form that I mentioned now it's not actually really self-custody because self-custody means that I can carry out the operation it's myself this is maybe what you would call non-custodial in the sense that the service provider can't carry out any operation but need by themselves but neither can I in order to get self-casted you need to do something else which I'll talk about in the next slide I just want to one point out one thing that many people think that okay so we've heard about NPC it's a nice idea and how do I deploy NPC well I need a signing protocol the key generation protocol and that's basically it and I can find a paper online and then and then implement it but actually you need

a lot more in order to back up only one one seed which is what you would want to do you need HD key derivation in MPC and you also need to ensure the backup is valid and what happens if one of the parties is corrupt and what they do is they just make they corrupt the backup and make a complete garbage that's uh an attack which we wouldn't which we couldn't we cannot last I mean this is your knowledge proof that we've actually provided uh a correct backup and by zero knowledge I mean zero knowledge actually uh that doesn't reveal anything we also need to make sure that the correct inputs are used the whole way so what I've backed up is what I use in the HD key derivation and what comes out of the HD key derivation is what I use in the

signing and basic NPC actually doesn't uh provide all of that so you need to make sure that you have all of that included in your solution and that that's all uh described in the white paper that we've just released about how coinbase coinbase is was or while it is a service users NPC so all the details are in that white paper and have a link at the end of the presentation so how does our coinbase was solve the backup problem this is one of the biggest problems again this is the probably the hardest problem for users in terms of usability and it's one of the weakest uh points as well so the first thing we have is something we called a server service provider aided back up so a backup that coinbase participates to help users restore if they're foreign

phone falls in the toilet or it's stolen or lost or anything else and this is uh what you would use 99.99 of the time and the way it works is very simple when I install the wallet automatically my share is uploaded to my cloud my iCloud or my Google Drive or whatever it is and uh it's we use hardening but we don't need the user to add a a strong password or anything like that because this would again make it very difficult to get to get going so it's made fully automatic but it's only one share and the service provider holds the other share and then if I lose my phone and I want to restore I need to do strong authentication exactly like I would do with my bank or

an or an exchange so I have the user experience of an exchange I simply buy a new phone install the app connect it to my iCloud or Google drive or whatever it is and then I strongly authenticate to coinbase and voila everything works just as beforehand it's actually not exactly as I said here but morally it is the technical details are in the white paper you can have a look but the second thing we add is a self-custody backup and if you choose to take this back up then what that means is you will we're after you did MPC key generation you have shares on each side you each party is coinbase and the user encrypts their share under a public key belonging to the user might be in The Enclave on their mobile protected by biometric authentication

and passcode and it might be on a UB key in the future which would give a stronger security and you could even step up as time goes on and the full key is never revealed and this key is very strongly protected and never used so again once again the key is never revealed at any point it's never open at meant at any point but the user is able to extract the key if they want to leave or this you know some disaster that they're they're unable to work with the service provider so so if we looking at this way how does an NPC Wallet help what with our original goal which is to achieve the user experience and security of an exchange a good exchange while being self-custodial so first in terms of

self-custody the service provider cannot do anything by themselves they just don't have the key material in contrast the user can single-handedly retrieve their key via the self-custody backups this is full self-custody on an ongoing basis it's not used on an ongoing basis you cooperate with the service provider and that makes your life easy it makes it very uh the user experience great and it also makes it very secure but that's exactly what you want an ongoing experience that's great while still being self-custody in terms of security the user only holds one share so break into their mobile you still don't get anything they have no mnemonics so there's no problems with social engineering and fraud and risk policies can be run like I said beforehand likewise with usability it actually

fills to the user exactly like a web to experience working with an exchange change they the backup is automatic they don't even notice it they never see a mnemonic and they can run something which feels to them like a password reset even though under the hood there's some very heavy cryptographic machinery happening but they don't see it so who cares I mean I care because I'm a cryptographer but no one else does uh a few words of warning if you're going to deploy an NPC solution so firstly MPC academic papers are not software specifications there are many details missing simple things like checked at this point is actually on the curve and not zero or that this pyre ciphertext is not zero and other things like that and if you don't actually run those tests the protocol can be completely broken

that's a poor uh that's something poor to say against about the academic world but that's the fact right now and therefore you need a cryptographer to bridge between an academic paper and a software specification and once you've done that even with that you need to independently review the academic paper proofs are not always correct the fact is published the so-called illustrious conference does not mean that it's fully correct it means that the idea is makes a lot of sense but it certainly doesn't mean it's always correct beyond that you need a specification because a software engineer needs something which actually makes sense for them to implement and not very generic high level cryptographic sentences describing something which could be a thousand

lines of code and or more like a hundred maybe and uh then you need independent reviews that everything matches along the way that's what we do at coinbase it's a very rigorous process we actually do a twice internally in our team in our cryptography team and in the security audit team and also even externally beyond that as well but that's really what you need so my argument is that MPC wallets can solve one of the major problems of usability and usability and utility in this field will be unlocked when wallets reach the masses it's easier backup you achieve a web to top experience that's truly decentralized which is exactly what we're looking for all the details are in the white paper we wrote this is part of our belief in transparency and

that's the QR code to the white paper so uh happy for you to read it and send any feedback thank you very much [Applause] okay maybe stand outside okay sorry [Music]