Andronikos Nedos - Using threshold ECDSA and passkeys as the foundation for browser-based wallets

Transcript

well the morning slot uh is mine thank you all for coming uh yeah it's hard to uh uh be here in 10:00 a.m. and I'll try not to uh well I'll try to keep you awake so I want to talk about uh web wallets or you might have heard of uh web wallets as well particularly self- custody web wallets uh you might have heard of them as smart account wallets or account abstraction wallets so before I start any show of hands anyone here that has used at least on a self custody web wallet or an account abstraction wallet two three 4 nice okay five and uh anyone here that uses

account obstruction wallets regularly good okay all right so I like uh uh web wallets um so before we proceed let's do a brief taxonomy of wallets right so typically users they have to to choose between um user experience okay so before that like the fundamental as a as a wallet Builder or as a wallet user you um you have a choice to make and the choice is really where the private key is going to be

stored so what we facing is um that we have we can choose between a good user experience for example um um on the on the left hand side um where your private ke are going to be owned by an institution and you have Kraken um um coinbase five blocks and you know with good user experience on the right hand side um you have your user self self custodial wallets uh metamask Exodus the coinbase wallet Argent you can make a case that um AR should really be at the center and here

what you're faced with as a user is that you uh you have to download something you have download an app on your desktop you have to download a mobile app and so the user experience suffers and I'll go more into it in in later slides right so this has been the situation up until maybe 10 months ago or like a year ago and then account obstruction EIP 4337 came into being and the situation has changed so now in ethereum there is a rapid pace of development on web wallets and um we're in the middle category now where we have the users no longer have to choose you can get great

security um and great ux um so we have already um you know in in 12 months we have uh we have a lot of a lot of choice we have wallets like gire like Dao like soul soul wallet um so what is so great about web wallets right um onboarding I would say is vastly improved I'll talk about onboarding uh in the next few slides we have no Reliance on desktop or mobile Labs um why is that important um this makes a big difference in locals

where uh crypto wallets might be legal right and so uh you get stopped in the street um they set your phone and they find a mobile app uh in your wallet like this is not great with a web wallet you can have an incognito browser you can transact in crypto you can own your assets and and no one can find out about it they also work in jurisdictions where you don't have access to app stores as well which also is an important point I would also argue that there is uh the speed of development really is a key differentiator in web wallets like web wallet development is web development so web web wallets have a an ecosystem that has been in progress for

30 years to uh with all the libraries and the you know the thousands of people really that participate in it um simple to test uh with a web wallet you can clone the GitHub repo you run mpm run and suddenly you have the web wallet right there in your browser um to test it you can extend it very easily um and I think this is really contributing into this Renaissance in in qu development um I would also say that it makes composition easier uh I think we are not that far away from a situation where we have um um component libraries

just for wallets like the same way that we have um uh undesign for example for like General ux I think this is where the ecosystem is going um uh you know where we there's going to be a lot of Rus a lot of safe components and and I think this is all great I also want to make the case that um with web wallets s um Security will become a ux issue this is a conjecture but uh um what I mean by that is um that uh we have been we have been hampered by um really complicated development

practice and I think with a web wallet we can iterate very quickly on on uxs um that are easy to use safe and secure so on boarding problems um and what why I just want to further motivate web wallets right so why why are they great like first of all seat phrases um uh I mean it's not hard to uh you know to to to consider SE phrases a problem um if any of you have seen the latest wallet connect report um

20 21% of users in the report they claim to have lost access to the wallet uh because they lost their uh their password and the SE phrase um and another stering 11% % um they claim to have lost access to the wallets because um they were victims of fishing attacks [Music] so we can do a lot better um like we're never really going to solve the problem in in crypto wallets if users current users are used to logging into their bank account with

a face ID and then we expect them to take note of like complicated uh SE phrases and remembering passwords so very quickly what are the problems with SE phrases so yes they can be lost um they are liable to fing attacks uh they're physically vulnerable you write them down put them in your jeans you put your jeans in your washing machine your seat phrase is gone um and they're also prone to human error and really the same problems exist with passwords um passwords uh disrupt um the user process um they force users to

remember and if you don't really want to remember then you use the same password with all the problems that this entails um passwords are also easily forgotten and they can be easily hijacked so okay so now we have web wallets um are we done you know is this it I would say that there's still some work um to be done um let's take one example for example you incorporate you as a wallet Builder incorporate pases into your um ethereum uh smart account wallet um the signature verification for web

bothen is not natively supported by ethereum the p256 uh you should have to support p256 in a smart contract um that smart contract is going to be expensive to run it's also going to be error prone there are uh efforts out there to have the p256 verification as a pre-compile which I think is great but we're not there yet as last I knew is going to be deployed is already deployed in polygon um I would say really for me like the biggest problem is that ethereum account AB fraction wallets rather Can Only Hold ethereum right so if we believe in a multi-chain and a cross chain future

then we as wallet Builders uh we want to allow our users to hold any asset that they want right um and I would also say that the count abstraction has really um it has not simplified unfortunately gas management it has made it a lot more complex um this is on the Bas this layer I think with layer twos um the situation is is different and I think we're starting to see a lot of gas subsidies really on Layer Two so in the end I think we're going to have uh uh Wallet account obstruction wallets in layer twos um where the users don't

have to pay for gas but for now the the gas management situation is complicated and the smart uh smart account wallets you have to to be written in solidity um that's not necessarily a bad thing but can we do better can we bring can we enlarge the ecosystem of wallet developers can we have Smart contract uh smart contract wallets the front end the back end written in in different languages so yes can we do better can we have a web wallet that is cross chain um so it can hold e the not only

ethereum assets but it can hold Bitcoin it can hold ICP for example um it can hold Solana that is fully on chain so the browser can verify that the static assets of the wallet are legit um where we avoid SE phrase and password so it works with pases um where we have like gas subsidies so it's effectively free to use and where we don't have to use uh solidity um the ecosystem of Ras developer is about an order of magnitude greater than uh um uh than solidity uh so if you if you can develop your wallets in say rast or python or

typescript then you you have expanded the ecosystem so I want to talk to you about how we do it in definity where we develop um a uh a showcase wallet called o um where it can hold not only ethereum but ICP assets um you can go to it right now at o.com um and so I want to talk to you about how how this is possible by using thresold signatures some facilities on the intern computer and then intern identity so intern comp comp

first how many of you have heard about the internet computer good so what is the intern computer protocol is a platform that is built uh with and for applications of threshold crypto what this means is that uh uh the inter computer the inner workings of the ICP of the intern computer protocol works with thr proog but it don't also allows applications are built on top of it to use it to use threshold crypto um very quickly the the inter the ICP works with independent known providers um whether he have their own

whether he have node machines in their own data centers like worldwide um and it's based on the premise of like Sovereign Hardware much like Bitcoin for example so like there are no node machines that are hosted on um uh on on big Tech Cloud uh ICP also um combines nodes in order to form efficient uh and very performant subnets um we have a thing uh that is called deterministic centralizations where the placement of node machines um uh in a particular subnet is controlled by the uh by a dow

and the the Dow takes into account the node providers the data centers the geography jurisdiction in order to have the heterogeneous um subnet as heterogeneous subnet as possible so what is this complicated slide with like a lot of lines uh this is really there to say that you as a as a smart contract developer you create a smart contract on ICP deploy it it's going to go into a into a subnet but uh you the ICP provides the rooting infrastructure necessary to interact with any other smart contract on on the

ICP Network so it Roots uh messages like a cross updets so and here we're going into a more complicated slide I would say the two things to remember from here is that um in ICP um consensus Works across um consensus Works ac across thresold crypto and uh there is a root subnet and then we have multiple subnets um and every subnet has their own uh public key so what have we achieved we

have subnets with their own public key too many public keys can we do something about it so the root subnet on ICP certifies the public keys of um the the every subnet that is being spawned that is um so what this creates is a situation where uh messages on any subnet can be very easily verified and not only that but a very very light client can validate any message on the internet computer by have simply by having the root public

key of the root subnet and the delegation and and the certificate so that's fine so what's the big deal with that right before we go into that what what from the requirements that are stated like what have we achieved so far so yes we we have a web wallet um we haven't really explained why it is cross chain yet but we know that it is fully on chain um and it is it is fully on chain because with threshold cryptography we can assert that contents on the internet computer um um they are they are legit um so with thr cryptography we sign the contents of

the web wallet and because of the delegation from the root subnet to the to the other subnet a browser can very very quickly verify that the uh smart the the uh web wallet assets they um uh they're they're verified right so ICP also uh allows it has the reverse gas model so developers pay for gas and um you can uh create smart contracts on ICP in uh in rust or python or typescript okay so next I'm going to talk about uh threshold cryptography um

so I'm not a cryptographer but I have I have a PD distribute systems um but uh so I'm going to try my best to to stay high level for the next couple of minutes um uh and describe threshold cryptography graphy so what is a threshold cryptography and particularly threshold ddsa um threshold cdsa is a protocol that is part of the icp's cheny signature toolbox um uh signatures are computed using secret chairs and the private key is never uh reconstructed um what this means is that

every canister so canister is a smart contract on on ICP uh has control over unique cdsa key pair it can request signatures on behalf of users um and the corresponding private key is never revealed and so this is a key difference between ICP and ethereum is that canisters on ICP they can sign transactions on behalf of authenticated users there is some uh uh confusion really on um uh what is stressful cryptography versus multisig um really if we take a group um like a group setting we say some members in a

multisig situation every member of the group they have their own public and private key um then uh a subset of that group uh signs um uh signs a message and then it is down to the receiving party blockchain so in the case of Bitcoin um the blockchain itself can validate uh multisig in the case of like ethereum there's a smart contract can do that but uh it is down to like a smart contract the blockchain to uh to verify that the message is signed by m out of n participants so this is in direct contrast really with the uh thresold signature in thresold signature uh in thresold signatures there is

one public key that represents the group and then the I is uh fragmented uh across all the members of the group it is never reconstructed never revealed and so when you sign a message with threshold cryptography it is indistinguishable from signing a message from a particular user with a private key and that is a key difference like our head of product in definity makes a very nice analogy that thres cryptography is a kein to the limited liability Corporation while uh multisig is a key to uh partnership uh so here um really the

only thing to know is that uh smart contracts on on ICP they can own crypto they can sign transactions on behalf of users um and so going back to the requirements what do we have now we have a web wallet now we know that we can uh that it uh it can hold uh assets across multiple chains so it is cross chain uh we've said that is fully on chain um we haven't really yet talked about the py uh part um but uh the reverse gas model uh is is uh by default on on ICP and we can also C the wallet in in Rust and JavaScript um and the last thing I want to talk about

briefly is internal identity so what is internal identity um two things really to take from it internet identity is a uh is another smart contract on ICP it is controlled by a dowo it is hold on a special subnet and what it does it is effectively abstracts away the pain of like dealing with pases and so it offers features like uh onboarding like device management uh like device recovery um and so it is used as an authentic indication layer and as a session management layer and uh here we have completed the

sort of the list of requirements so using threshold cryptography intern identity and some of the features of ICP we can have a web wallet that holds uh crypto assets um maybe I'll stop here I have a okay so I have a couple of other slides that I can go quick on uh on o uh you go to o.com you see the the landing page uh if you're in your mobile you can log into o with the face ID the wallet is initialized and then that's how it looks so you can see here that like you can select between internet computer and ethereum maget and your assets are there and any transaction that you do is going to be

thresold signed um either with thresold BLS or thresold ddsa depending on the Network that you read I'm not going to go through the account setup and transacting I want to stop here and maybe leave some time for questions Andrew Nichols we thank you very much and congratulations for such a good presentation uh does anyone here have a question we are going to take the microphone towards you hello and thank you for this uh presentation I would be worried about censorship what are your counter measures to censorship I mean we know we

heard a presentation on Friday that uh ethereum validators are already Banning uh transactions to uh mixers and um in this case the account could even be frozen so what what are your counter measures there yeah and this is a it's a difficult problem thanks for uh thanks for the question um right now where we rely on censorship is simply the heterogenity of node providers on uh on every subnet so the Dow uh attempts at least to have subnets

that are as diverse in terms of uh the the organizations that know own the nodes their geographies and so just from that we try to avoid sensorship and collusion like both sensorship and collusions are very high in our list on on uh how to avoid um yeah and and how to how to prevent and avoid them so we don't have any other than that like this is the right the solution to have as diverse subnets as possible we have just one last final

question here uh I don't know much about ICP but uh maybe you can tell us if you have a way to ensure that uh all the parts of the private key so I understand they are running on some random VMS somewhere do you have a way to ensure that uh not all the parts of the key are like Landing you know on a property of the same company or the same data center yeah yeah no that's an excellent question I mean so the only thing the only thing to say on this is that

the say the founders of thresold cryptography work in definity um uh you know the people that have really led the field on thresold uh on threshold cryptography the other thing to say is that the code is open source and the protocols have been published in conferences right so like what really so they're open for public scrutiny uh that they do indeed uh that the private is never reconstructed uh that is really the that is really the risk right that the either get access to the yeah I mean if you yeah so the protocols the protocols are designed so

they tolerate malicious nodes right and so thres cryptography really means that like there is a super majority of nodes on a particular subnet agree and then they and then they sign so any it can tolerate uh malicious nodes that are less than the super majority of nodes right so if there istion super majority then the game is lost but like it can tolerate malicious nodes okay thank you very much and then we can conclude our section congratulations Andre nich thank you