ZKV presents Privacy in Cosmos: Privacy, a holistic approach

Transcript

what we're going to touch is as anna says from the motivations for privacy uh and some kind of essentially what concerns users have a kind of big picture of how privacy works which i call from a kind of more holistic perspective more about multiple layers of the blockchain and if we have time we won't go deep into them but we'll sort of explain uh some of the motivation behind what we're doing at nem and how that could possibly uh help cosmos in the future so let me just get back to here let's wait one sec uh okay so first thing is let's think about privacy do do i mean i think an important question is does anyone even

care about what privacy is so there's surprisingly little at least published uh usability studies i hope all of you great cosmos projects are actually talking to your users but what little we have says that actually people are interested in privacy but they're very concerned at least over bitcoin which is all we have data on so about a third of the people uh do believe um uh bitcoin is uh anonymous which is completely crazy but that's again talking to non-technical users that's why many of them are using it um and another big section about half don't think it's anonymous but believe it can be used uh anonymously however uh you know the vast majority of users 80 this study

believe it's possible to follow their transactions and even a quarter which is actually quite i was quite surprised at this pretty large have tried to use bitcoin over tor so so the essential concern is uh you know bitcoin users uh and cryptocurrency users in general are using cryptocurrency in part because they believe it's private uh and uh they are very concerned about not being private and then there's like a whole other set of users so this was a kind of collection of random bitcoin users uh my background which i'm gonna overview briefly is that we also looked into why people are using things like signal why do people are concerned about privacy in general so we did a large number of uh interviews um with various users

including uh people in syria who are fighting isis and had all these sort of confusions over um a signal versus whatsapp versus text messages people involved in the iranian revolution and uh which 2009 didn't work out very well and generally you know everyone was really concerned of privacy but there's also a lot of concerns that they needed things to be usable uh and that slogans like you signal use tour simply doesn't make sense uh for lots of people in different countries because it's impossible to download them due to sanctions on the play store or uh you know they they don't find them particularly usable and so we did like a a very large study of of of

why uh people which we call uh high risk users these are people that aren't just using uh privacy to attempt to hide their cryptocurrency transactions but actually using price enhanced tools because they're afraid of some form of government repression uh either theoretically such as done in civil society with eff or in practice such as people on the ground and russia ukraine uh various countries in the middle east and developers and you know you can read the whole study it's reference at the bottom but effectively uh the take home disconnect was uh take home message is there is a huge disconnect and a lot of people in the audience are developers um between the properties desired by developers

uh and what users believe those properties that the software delivering uh actually is right so uh you know particularly this is particularly came out when we kind of interviewed people who could suffer short-term concrete physical harm such as being imprisoned or tortured due to security and privacy failures uh versus people primarily in the united states and europe who don't necessarily suffer that in the short term although obviously with trump and whatnot who knows things sort of looked like they were going that direction in the quote unquote west as well uh and the general feeling which we even got this is actually quote uh from someone in syria they said you know we really didn't have any concerns about security but then people started disappearing and then uh the essential

role of the study uh was that you know people have a lot of concerns over server seizures but this is very important there is a huge concern among particularly among high-risk users these are people who are most likely to be hurt or killed due to failures and metadata collection and being able to use things pseudonymously and they were pretty irritated that most tools they were trying to use uh didn't support uh these use cases you can see actually there's much more concern from these users about privacy than there is about things like decentralization like how many different nodes are running and uh you know people were particularly concerned about their device being

seized uh which we often assume is safe in the west and that people were you know people did all sorts of crazy things to hide their contact list uh and to hide their and prepare for house searches and that uh you know again everyone really liked things like tor and people wanted to use uh tort and other tools to hide to prevent metadata collection um but even developers were super confused this is where i'm gonna kind of take the rest of talk so um we talked to many developers i think this is developer german secure messaging app or maybe it's somebody from rise up i forget but eventually uh you know some of them basically would say stuff like oh well don't worry

you know we're not logging anything and if we're not logging anything then we're not collecting metadata and therefore it's uh private and uh that's that's wrong right so i think it's important uh can everyone everyone still see the the screen sharing properly yes good okay so uh so i think it's important that there's obviously this kind of looming concern about privacy both from bitcoin users and from human rights activists uh all sorts of people but the problem is no one really has a good grasp on what privacy is right so and the reason is there's not a clear definition in fact what you have is you have diverse traditions of privacy so uh primarily honestly coming from not

computer science uh historically but from the legal sphere so the concept of modern concept privacy has developed uh in the in the united states comes from this uh desire to be not photographed by uh uh samuel warren lewis brandeis and the right to privacy from you know the desire to escape the paparazzi uh to have some personal individual space which is not public um and in europe things took a totally different direction right so europe obviously uh had the holocaust as the book ibm the holocaust wonderful book details uh data processing even in early stages in the 1940s and 30s was used to help enable the holocaust so after world war

ii there was a lot of concern over mass data processing how to prevent uh maybe not mass day collection at least regulate and prevent abuse and this led to a more constitutional framework which is more about discrimination but has all privacy aspects for the general uh data protection regulation and so we have this these very different legal traditions and very different uh you know feelings of privacy so as we saw earlier in the user study some people believe being private simply the right to use a pseudonym not use your real name other people uh believe it's the right to really reveal partially or have multiple personalities and other people want to reveal absolutely nothing so the way that maybe think about this

in a bit more of a healthy fashion sort of say well there's a spectrum of privacy on one hand you're being absolutely anonymous and on the other hand you're totally identified with your real name and there's a sort of spectrum in between and so we're going to deep dive a bit on what this spectrum means so what this uh this is a classic work that i think everyone should read it's circulated for about 10 years before officially published and it tries to say well what is really being anonymous and it comes down to this kind of quite technical definition uh not mathematical but at least technical and so far as that is a bit precise by fights man called unlinkability so unlikability is within any given system that does data processing uh

there are a number of items let's assume you're an attacker you're interested in some of these items they're called items of interest and if you observe an item and you want to link it uh to a user or to another item you can link it all sorts of stuff after the way you define the linkability is that after observing the item i can't link it to any other items and that's kind of abstract but actually does kind of technically hit the hit hit the uh hit the hammer on the uh hit the nail on the head so to speak and so then we can think about maybe historically what kinds of unlinkability are useful so one big problem a lot of the early cypherpunks had was scientology would go after them so they would publish some something about xenu or whatever on

a on a cypherpunks or some uh use that archive and then some church would go after them and say i you should take this down and so people really want to send email anonymously and so one way to think about what do what does it mean to synonymous emails actually there's two kinds of different anonymous emails and you can think about this in terms of unlinkability you have sender unlinkability where any particular message is not linkable to the sender uh so this means i can send the email anonymously so you don't know my name but you can receive an email uh from me of course it's maybe hard to send one back and that's a whole separate technical problem but you can see that sender unlinkability is one thing and they also have this thing called receiver recipient unlinkability uh where the actual you know i would

like to send the message out but i don't i don't want to know who receives it so maybe i'm receiving i'm sending out a emergency call for help and i'm okay uh or let's say you know i'm okay if anyone receives it who's uh authorized a medic but i don't really want to know which medic received that's a bit of a contrived example but you can imagine this is very different than cinder and linkability and you may want both and what you actually end up having is this kind of more complex and nuanced view of privacy where you have things like unlinkability but you also have other things at least i see in the blockchain space often kind of mixed up with unlinkability right so you see unobservability for example unobservability simply means that the state of items of interest

uh are not are indistinguishable because they're all sort of the same type so this could be done for example if i'm interested not in and seeing if you're of observing if you're when you're online or when you're offline and let's say i send fake traffic so it hides the real traffic this makes it a bit unobservable when i'm sending my real traffic so that's unobservability then you have even another property which i think a lot of people in the blockchain space are interested in uh which is very hard to achieve which is undetectability can i even tell if you're using a system at all right um and so this for example would be something that's usually useful for censorship resistance not in the the kind of blockchain way of saying well how many nodes do i have if no goes

down is there a trusted third party is my system censored but more saying hey uh i would like for it not even be known that i'm using tor i don't even know that i'm browsing to go through uh checking my email i would like that's people don't know i'm using the internet at all and so these things are typically accomplished through uh like signal through domain fronting which tries to hide the factory using signal by pretending on amazon or google authentication proxy which tries to disguise for example one kind of web browsing is another kind of more innocent web browsing and this is actually historically when people say censorship resistance sometimes they actually mean undetectability and not lack of trusted third parties so you can see it gets it gets kind of

complicated right um it privacy actually uh you know there's different kinds of unlinkability and the next obvious question is how do i measure unlikely how can i say that one system or one kind of system is more linkable than another and i think there's kind of two definitions uh which people should know one is the obvious intuitive one which is the anonymity set so this is the the total number of users a given item of interest or message can be linked to and there's a kind of obvious upper bound here right so unless your system is actually undetectable uh it's not larger than the number of people that use the system right so if torres two million daily users uh obviously nami said for you know at

best right it would be around two million though you know the circuits are much smaller so in reality it's it's it's much much smaller uh you know same with the cryptocurrency transaction let's say i'm using samurai wallet or whatever and i'm mixing some transactions or tornado cash and i think tornado catching messages on their web page right you can say well how many messages is how many other cryptocurrency transactions am i mixing with is it 10 people is the 100 right so is it a thousand is it is it 10 000 that's my anonymity set but there's another really useful uh measurement which is called entropy right so entropy is a bit better because the the fact that matters anonymity sets are are not a great measurement because they're sort of timeless

and adversaries observe privacy enhanced systems you know blockchains or secure messaging apps or web browsing like tor over time right so they could say i if i'm doing a traffic analysis let's say i'm in the nsa copying all your traffic down i'm going to try to correlate stuff and this changes every time i observe a message i may learn a little bit more about you so entropy is a very good way to sort of say given a new usage of the system by a new user given a number of users uh how much how is the system essentially do i learn anything if everything appears could be equally likely uniformly random that i don't learn anything so it's a high entropy system a low entropy system is obviously revealing something about

users you can do all these nice per measurement messages it's very old work that's reference there from denises and diaz has a similar paper on informatic information theoretic metrics for anatomy so this tends to be and this is where uh this does be a little bit different than how cryptographers think about things but i think it's a very useful way for real world systems and because real world systems and this is kind of my second big point before we delve into the the weeds a bit um you know real world systems uh the internet is a good is a great reward system so you have this thing called osi model and the internet you can imagine has layers there's bits there's the the ethernet you know what goes through the cable there's the mac address there's the ip address there's applications on top of

this which could be for example monitoring you via cookies and these are on different layers in the system and you know packets are composed of frames to compose the bits and packets give you essentially data transfer which gives you applications and the important thing remember is that there's within any given technical system there's multiple layers and a leak and one layer of abstraction is essentially can lead to the elimination of privacy on the rest of the layers right so these are often what you call side channel attacks right so the one that a lot of cryptographers think about is am i releasing by you know maybe processing the key for so long some time information does that timely information leak any leak anything about

my key but there's also much more simpler models where it's like well it's like even using the system sending this much traffic for example through a vpn does the timing and volume of those packets reveal anything about me and the answer is usually yes so privacy is very hard because you have all these different layers and you have different layers in any blockchain system so layer zero your kind of udp or tcpip stack your associated networking choice is there for your kind of peer-to-peer broadcast uh then you have your layer one you know bitcoin and cosmos your atom your tendermint chain uh what's stored on chain we could even include smart contracts a layer two which are often just other chains quote unquote side chains which are really just kind of

layer ones or zk roll ups or these sort of things but you also can imagine payment channels all these auxiliary services and finally the top there's applications so when you're building a privacy enhanced application you have to kind of think well can i build on top of a privacy enhanced layer two and a layer one uh so for example you know could i use cosmos and tendermint as my underlying blockchain and then even with tendermint cosmos like what happens on the network level can leaks the network level uh lead to even if i'm using all the wonderful privacy tech on layer one does that hurt me so you have this really and that's why privacy is so hard because it's not easily reducible to like a zero knowledge proof or cryptographic

often very fragile cryptographic primitive is really this kind of like holistic multi-level uh system it's very hard for most people to think in multiple layered way you know including myself um and so then the problem is you have all of these different choices even in a single layer so i think everyone already knows this i'm gonna go through it pretty quickly but you know again when bitcoin and cryptocurrency started the obvious thing to do is you say oh i want to hide my amount so we'll just we just need addition so you're just gonna use something very similar like an additive homomorphic encryption scheme like palae and this is you know liquid coin join samurai wasabi uh even mimblewimble is basically just a slight variation on this to be less interactive but these all have really large packet sizes

and you don't really get too much flexibility in what you can do right you can basically do addition and you know with level homework you can't really do explanation exponentiation and stuff and then the next kind of weird world was the world of monero and now mobile coin we kind of add some secure enclaves on top and but you essentially boil down to rig signatures but again you know your anatomy set is kind of limited to the number of people in your ring signature right so this is not a great technique either and so i guess the latest and greatest which i'm not going to really go into but which other people will is zero knowledge proofs which you give you know your anatomy set will then equal all the users ideally all the users that have ever used the system and that particular version that would

be wonderful and that's where it's aiming people aiming at z cash some primitive stuff like tornado cash which more of a mixer so small nominee sets compared to z cash and also new work on ethereum like aztec and i'm not i think on on the cosmos level it's still kind of open season figuring out what zero knowledge techniques work best on cosmos but the great thing about cosmos is it's so flexible and you don't have these terrible pair and gas cost so hopefully we can get zero knowledge proofs working on uh on priva on cosmos but i think what's interesting is that i do want to just point out this kind of motivates them and i'll try to wrap up here in about 10 minutes um is that all of no matter like i don't really care if you're using a zero

knowledge proof system like a zk stark or some newer zk stars one trusted setup like plonk i suppose the per circuit trusted setup regardless doesn't matter because on some level if you go back to the layer cake you're still dependent on layer 0 which is the peer-to-peer networking level and all of these peer-to-peer solutions all the peer-to-peer solutions in the kind of cryptocurrency space there's a vast variety of them they're all uh not so secure and often broken in their own a unique and wonderful way which i kind of overview here and um therefore you kind of also want to separate these levels right so we have concrete attacks uh uh aaron

tremor is a kind of new one here in 2020 uh where you know even if you're using let's say uh uh groth 16 zk snark on chain uh that's wonderful but you network level data can still be used as a side channel to de-anonymize the on-chain level and obs and people say well this is really realistic likely so uh we have some examples from 2015 that chain analysis was doing this on a large scale and the bitcoin uh and the bitcoin network so bitcoin is like 10 000 nodes back then in 2015 it was probably a few thousand but regardless ranked with a few thousand full nodes and observing peer-to-peer traffic you can get a large enough grasp that you can more or less

uh get most transactions through uh observe a huge percentage transactions uh and that was definitely possible bitcoin and you look at smaller networks i forget how many full nodes zcash has but i haven't actually get that number from that community but it's a few hundred right so it's really easy to observe uh and i would assume like i don't really know how many like quote-unquote cosmos full nodes are there most networks are pretty small so again observing these peer-to-peer networks is easy and so it's great that the validators are producing technology like sentry nodes and stuff try to prevent this but fact the matter is uh passive adversaries that just observe your network are still very powerful and so zcash mentions you know the authors of the

paper are quite intelligent they say well look we need uh we really need to look at this kind of layer zero technology uh we need to use something like a tour or even a mixnet uh and that's that's pretty awe and and so the problem you kind of have with a lot of these technologies there's kind of a a a joke and the early days of internet that your server is always kind of insecure so people really focused on using tls and that using tls was like using an armored car to deliver messages between two homeless people living on benches because it was just so easy to penetrate servers and you know using zk snarks on blockchains without some peer-to-peer protection they're kind of

like armored cars it's kind of a reverse problem communicating uh via paper airplanes right so this we need to i i kind of want to just emphasize this that you have to really focus all the levels and if you don't build on a good networking stack you are effectively kind of building on a a castle on sand and i think i covered that so one way to do this i'm not going to really go into nim per se but i'm going to kind of give a little bit of background on one way to tackle this stuff which is a mixnet uh proposed by david chalm and it's a really wonderful and easy to read paper and you know this sort of stuff is is not complicated right so a lot of zero knowledge proof cryptography i

think is is much more complicated intuitively uh you know fiat shamir secret sharing than what we're doing uh there's no for example polynomials what you basically sort of say is hey if i were to hide a message how would i hide it and the way you hide a message is you encrypt it but then you basically collect a bunch of them you mix them up and it's you know it's a little bit like an on-chain mixer you randomly permute them and you send them in a different order and there's many variations on how to do this this is the classical chome and batch mits net which is elixir where you basically the mix nodes use the messages goes to three mixes comes out and this technique is really nice because from a cryptographic perspective you can do some probability over it

uh so there's that wonderful paper by chido set out and a universal composability treatment of mixnets a little bit complicated but uh does show you can apply formal methods uh two mixnets uh but the problem with mixed nets is that obviously if you look at that technique sorry go up again you know you're this is there's obviously a problem here right because if i'm seeing a bunch of messages to mixer and i'm not just sending like a few cryptocurrency transactions i'm sending you know bytes and bytes and bytes of packages the capacity is going to be limited by the weakest mixed net the lowest capacity mixed node so that's obviously a problem uh and people also didn't like mixnets because there is it's unclear if they could scale really well and it doesn't seem

obvious how chaum and net scale so people kind of moved a different design called crowds this is actually very similar to a more recent design called dandelion essentially it's the same design and the intuition is quite great again it's like back to nominee sets you can only be anonymous in a crowd anonymous routing requires you go through these multiple hops but the problem is how do you trust the people uh that are affording your traffic and if you can't trust them you get these attacks they can capture your route they can gain information this is called a predecessor attack and so the main result of crowds uh was that uh this is actually much harder than it appears um and that crowds was kind of well-known broken so

from crowds uh came the tour design and uh you know tor basically does something similar crowds ship shoes through a bunch of peer-to-peer relays uh with a lot of the attacks kind of being a little bit controlled by a director authority system and another uh great technique store added and a lot of dv most of the decentralized vpns we've seen orchid sentinel they're just kind of weird versions of tor but the fact that matters even tours is verbal to some kind of traffic analysis because obviously it's not it's first in first out on your packets so they're not mixing them like charm would mix them and therefore you can de-anonymize those packets uh via their timing and volume information and and at least in closed-world

experiments by quantile like deep learning gives you you know 95 identifiability which is which is pretty bad uh and i i think regardless i'm not going to name dave's going to do that later but nim tries to develop a way to scale trauma and mix nets and add fake cover traffic to get some of those nice unobservability properties and uh but what i i do want to end on is okay so we just said well look there's all these different anonymous layer zero solutions there's all these different uh awesome anomalous uh privacy enhanced layer one solutions um you know do users care can users using this tech and the challenge i want to leave everyone watch is the answer i believe is currently currently no

right so you have all these different kinds observers people can just read the blockchain people that can read all the traffic so you know you can define these different threat models and what we did is we did a sort of large-scale study of about 60 users because again talking to users is the way you understand what they're trying to do and i really emphasize this want the cosmos community more of this and we just said well can anyone buy anything anonymously uh with zcash and if you can buy something anonymously with zcash uh can you do it uh using kind of tor vpn or some form of layer zero protection so we did the study it's like most cryptocurrency studies a little bit bizarrely diverse definitely skewed towards white dudes but uh more people from asia and africa than

than you would expect and mostly kind of beginners but people who think they're interesting you discover cryptocurrency users say that everyone thinks they're an expert which is kind of the reverse of what you have in normal usability studies uh and we got people to install the zcash wallet which actually you know most people did decently good at uh people did have uh while most people could install the wallet because it's just kind of a button or two people did have trouble distinguishing the z the z address from a t address this is a shielded or private address from a non-private or public address so this led to some issues hilariously privacy advocates that hate google often had issues installing the software and some users would give up due to uh

slow synchronization issues uh but the main thing we discovered is that you know honestly when you use privacy tech there is often this kind of contradiction in development where you say well should it be optional so if you're saying users can turn on and should be on by default so for example signal wants all messages to be encrypted and secured by default and zcash is more of like an optional thing at least in the these older wallets like zek wall i think that's moving more towards being on by default but the fact of the matter is having anything where user has to kind of understand if something is on or not at least the yacht lots of usability issues and then of course you know we try to get the users to install tor uh that was uh super exciting for them and uh users in general uh

were a bit more successful installing tor than wallets uh but they had some trouble with the binaries and trouble understanding what ip addresses were and then only a very this is they had to buy something and only about uh one four people have trouble determining if the privacy was optional if it's on or off how the two things work together and so basically only the result is only one quarter of uh users could actually get real network level and wallet level privacy on top of zcash so i do think we can do better uh that's the challenge for the audience here and i have a minute or two maybe to answer uh questions so i hope so this is very different than your like classical blockchain

kind of zk talk but i do think some sort of broad overview would be useful thanks a lot