Bank3: efficient temporary shielding of assets

Transcript

[Music] good afternoon everyone uh welcome to the LIF stage we're going to have very interesting talk starting soon uh next speaker is Vincenzo from akkr research he's the lead lead cryptographer from there and today he's going to be talking about Bank three efficient temporary shielding of assess please welcome Vino with amazing Applause hello everyone so azr stands for Aragon ZK research we were until last year part of the Aragon ecosystem and now we are in independent group doing research uh focusing on Dow for real PE people so in

fact uh what we will talk about today is a part of our ecosystem that we will build in the next month so first H motivation that was one of the original motivation we uh designed uh the concept of Bank three uh last year it started in the spring of the last year so uh the motivation is a bank for da okay da are one of the main uh tools in the tum ecosystem and there are many Dows with very large treasuries so we envision the following mechanism each Dow can deposit their own uh treasuries in the bank 3 Market contract okay so at any point of time time a

given Dow that we call D for example will have a certain number of coins in the bank for example n coins okay and will this will not visible by anyone for example if in the past Alis deposit m coins in favor of the Dow d uh at some point the Dow d can decide to withdraw such m coins and only at that moment that withdrawal time it will be visible that Tellis did the transaction the deposit in favor of the Dowd but what will be still hidden is the quantity of left coin of the Dowd at the bank so this corresponds to a real world situation for example when I withdraw uh 1,000 EUR at an ATM maybe

someone behind me can see that I I withdraw 100 1,000 EUR but should not know how much wealth I still have at the bank if I have zero Euro or if I have 1 million of Euro left at the bank okay so we can go from this concept we can adapt this concept from D to wallet okay so oops this not does not visualize very well I don't know why my PowerPoint oh I don't know I send the pptx okay anyway no problem so in this slide there there is Alis Alis send m

coins uh to Bob specifying just the public key of Bob okay and before withdrawal what we have the situation that Bob has n coins at the bank after withdrawal Bob will have n minus m coins and will be visible at sent to Bob m coins what will be not reible is this quantity n minus M so how many coins are still left for Bob at the bank at the bank okay and Bob can uh in any time at any time can search which transaction is in favor of him using what using just the ability to use his personal uh

wallet his metam mask uh wallet okay so uh we designed this concept uh last year from the spring of last year and then we discovered that very interesting related work for examp did document Bonet D naif proposed private Dows that are conceptually uh and technically also very similar to the our concept of Bank of Dow with very small difference for owers require only aing on chain whereas Bon solution requires doing uh elliptic car operation on chain and also uh last year boin in turn building on idea from the Bitcoin Community proposed the

concept of steal aldress that actually are very technically very similar uh to ours concept of bank or wallet uh the difference that in ours the deposit are uh tied to the specific bank three smart contract so this enable specific banking features and also fullback mechanism that we will see next soon okay and novalty of our work that we move uh forward we go from down and wallet to we generalize this concept to real world identity in fact last year we also proposed a system of independent interest that's called leag of identity Loy okay legal identity is essentially a decentralized identity based encryption

and signature uh system for encryption over use Bon frankly ccr2 encryption scheme so the idea is roughly the following Alis can encrypt a message in favor of Bob using Bob real word identity is Gmail address okay Bob at any point can get from the league of identity the token for his email address just proving possession of his email address or uh it work also for Microsoft account Twitter and we even support uh digital ID cards and the application of legal identity include encrypted chat messages creation of D for Organization for example you

could if your organ organization uh as a domain at old crypto.com and this is a domain uh whose email ad are with Gmail or Microsoft every uh member of the organization who has such an email can join the the Dow okay and can sign transaction in the da or you could have the Dow of influencer on Instagram with more than 1 million of follower and you we can even support D with encrypted uh proposals uh yes again the here the the does not visualize well but the slide was exactly the same except that Ellis

now use the mail address of Bob okay so this we can go to an identity based variant of Bank three so Alis goes to an email address who used email address of Bob so it can send uh deposit coins in fav of Bob even before Bob creates a wallet but here I like before there is uh another property that we want ACH it would be very annoying for Bob if at withdrawal time before or after withdrawal it's known that transaction was for the Bob's email the property we achieve here is that the email specified by Alis is hidden forever okay so that

Alis can use as mean of deposit the man in for of Bob the Bob's email address but this will be hidden okay and again here Bob can use the ability of logging into his Gmail address to check if there are transaction deposits in fa uh of him so what the I there is something with the slide so we can exploit um a feature nice feature of um Google that actually was even present before in Facebook but was removed that

is linking your Google profile to phone number okay so you can Alis can for could have just the phone number of Bob okay and using the phone number of Bob can deposit coins in favor Bob even before Bob created a Gmail account so at withdrawal time Bob could decide hey now I want to withdraw I create a Gmail account I can link my Gmail account to the phone number specified by Bob okay and then you can go to the league of identity uh Network to get the token for his phone number and so can withdraw okay actually after withdraw could even a link his gmail profile from the from

his um email uh sorry from his um Gmail account and this can be seen as a variant of web three variant of a system that now is popular in Poland is called bleck so wrapping all together the the fature and the property that achieve are the following so Alis can deposit asset crypto asset in FV of Bob okay just specifying either a public key of Bob that can be a public of a different blockchain for example Bitcoin or ethereum if you wish if she wishes or a real world identity of Bob she has these two uh two mode of operation and real

world identity orob can be email address phone number Twitter account and we even support social security number associated to digital ID card the deposit is recorded into bank three contract so it's temporar shielded at withdrawal time uh it will be visible which ethereum address sent the coins to B but will be not visible which means Al is used to send the coins to Bob for example the the email address or the phone number or the Bitcoin uh publicy okay so we can say that the identity of Bob is hidden uh forever so it's not a mixer we don't

have the leg legal issues of mixer but still Bob can have some nice privacy fishes examples of application Bob can have a physical shop can sell a sandwich and can specify a quer code to receive payments in in it in it Bob can withdraw a deposit at any point of time creating a new itum address okay but it will not be visible uh how much coins is earning Bob for example if Ellis deposit one coin Charlie deposit two coin and then uh um Bob withdraw the the first deposit of Al Alis will not be visible that the the deposit of of Charlie was still in

favor of Bob okay or another application is to organization that won't receive donation in in crypto not even not having a wallet for example I could desire to to donate to an organization in crypto they don't have a wallet I can do it using an email address for example and actually the the organization could even decide to pass this asset to someone else for example to char in exchange for a service using legal identity so in in a way that in the end the organization is able to use this crypto asset without ever having a wallet having created the wallet so in this situation um there are

some usability security issues that become more uh that are shared with most uh blockchain because in blockchain user can uh send asset to wrong address okay if they mistype uh and theet can be lose uh forever check some mitigate and solve the problem partially but there are more sophisticated attack like address poisoning attack in this slide I mention a famous case of a crypto user who lost uh about 70 millions of dollars in Bank three in the identity based variant of Bank three the problem can become more SE severe because mistyping an email

address can be a real problem right so I mean potential solution are the user interface should prefer of course Square code and this is is is is in endshake variant in which Ellis and Bob meet physically for examp in a shop okay and moreover the nature of the bank three SM contract allow to implement what we call fall back mechanis for example Alice could make a payment to Bob in a way that she has for example 24 hour to claim it back for example like I think it's the case for web banking also web banking also has uh this option for transfers well again the slide does not work but our sub impation is very uh

simple so what we do is the following so Alis encrypt under the public of Bob B again if we are using if the public ke is a Bitcoin or eum public key we'll use some specific Defan like system if will be the identity real world identity of Bob we will use the encryption system of leg of identity butly the system is Alis encrypt some random value under the identity of b or the public of Bob so and then Ash this value and transmit to the blockchain the cipher text and Ash so Bob has some secret to the Crypt the cipher text in the case of Bitcoin

publicy will be the Bitcoin secret key in the case of the identity will used the league of identity Network to get the token to decrypt this cyer so we have this random value R so since there is the ash of this random value on chain Bob can send this pre Mage to the to the smart contract to prove that he can withdraw and will receed the fund actually for security we need also to other thing and more importantly we need also that Bob prove give a z knowledge proof of correct decryption because if it's Alis to create this hyex Alis will also know this random value R so she could act as

Bob as receiver to prevent this attack Bob should also send a proof of correct decryption or in endshake variant in which Bob and Ellis meet phys basically the cipher Tex can be created uh by Bob so we don't have this issues and all our implementation both for wallet D and the identity based variant can be can be seen uh in this uh framework okay but actually I mean when you you go specific for implementation of Dow is uh the deficient more deficient implementation um will be a bit different because we want more efficient solution so we have a demo uh for ethereum for

test net and we also have a command line interface uh for the Dow variant the problem for the D variant is actually is also problem shared with the Bonet dunai solution is that in case of Da who holds the secret key you there should be some Dow manager no because you encrypt you the the deposit is encrypted somehow under some public key so you have this problem there there should be a committee for decryption and the committee of token holders that uh is it's not clear uh who who they are there is a solution that is enabled by League of identity with League of identity uh

the legue of identity could could issue some special legal identity token that allow uh just to decrypt just after presenting for example a signature of the a majority of the token holders okay so token holders a majority of the token holders can get some signature and uh prove to the legal identity network uh to have the majority of token in the Dow so can get this token to to enable uh decryption so this is another uh solution that we envision so actually um yeah um in uh in our uh our abstract solution

we say there there is anes okay there is uh so we we ask we send on chain a cyer text encrypt this random value and also we it actually you can go more abstract and you can you can replace the HH by some genor like public key and in this case you can uh you can give very efficient offchain solution for the proof of liquidity problem so for example I uh Bob have I have one chain on this this Bank three uh smart contract I hold some assets okay some uh some coins or some tokens and I would

like to prove someone that I have at least X coins right if you think of this is easy in uh in uh um I mean uh in blockchain uh but the novelty here that this can be linked to a specific real world identity right so and so Bob can prove for example that uh his specific email address Bob gmail.com or in the case of his even his social security number if is deposit were in favor of his social security number um as tied I mean this this identity owns a certain number of assets on chain okay

and here we can have uh proof that are deniable or not cryptographically this would me so if you have an interactive proof the proof will only convince the verifier so verifier cannot pass this knowledge to someone else so it's convinc that uh Bob for example holds 10 uh e of 10 tokens but cannot pass this information to Charlie or you can have transferable proof Bob wish to prove to everyone now universal proof to Bob could wish to prove uh everyone that he holds uh at least X coin uh at bank three smart Contra and this proof are

very very very efficient so uh actually I mean the we we talked about Bank three but uh this will be just the start for our project uh our demo is on ethereum we will have a solution for eal but we envision a more complex ecosystem we are designing a ZR chain this will be a chain in the cosmos uh in the cosmos ecosystem we have developing a cosmos s DEC uh tool with some nice features and this chain will

be connected anyway uh to other chain via IC and Via Bridges to ethereum why are we are doing that because we are building not just this Bank three system but a more broad credit liar now we need to build a credit lier that is that needs to express more complex uh features for example we aim at implementing Rosa rotating saving and credit uh associ Association that is a system very popular in some part of Africa and also Asia Mutual Credit Association peerto beer landing and also uh local uh currencies okay if you are interested

you can scare these qu codes and uh they will point to our website or you can search az. or I'm sorry for the slide I transmitted the slide this morning yeah first let's give a Applause to our speakers thanks thank you very much amazing talk yeah I mean technical isue always happen it doesn't matter how much you prepare but you delivered all the content very nicely so thank you for the talk again uh anybody have a cions so let me take a privilege of asking first question it's really interesting

to see that Bank Of Da uh tried to tackle the rearward problem building a new credit layer it seems like we already have a like working demo and now like having some further plan to implement um in this case like a uh does it matter actually like a local jurisdiction to kind of understand with the payment system or it can be easily implemented to any uh implementation scenario uh uh well I mean uh for example for for Rosa what what we really Target is to um to create solution for real world people for people uh who know each others okay this is not the case actually in now for

examp in theum EOS but not only eum so there are system you know for people WS very large asset essentially okay so what we aim is that a group of people who informally meet together and already do maybe something maybe on paper can can pass to crypto and can have some tool you know to easy their work and maybe it's S A motivation for them to on board and to use crypto technology Yes sounds good very interesting I'm looking forward to see further uh implementation going forward so I gu yes uh we can have one another question or you can take the advantage

of uh break time asking questions to speaker right away anyone who want to ask questions otherwise I think we will conclude the session right now and we will see you soon please give Applause one more time thanks