Ben DiFrancesco: Umbra – Privacy Preserving Token Transfers #496

Transcript

welcome to epicenter the show which talks about the Technologies projects and people driving decentralization at the blockchain Revolution and Clinica ants and today I'm speaking with Benny Francesco who is the CEO of scope lift and creator of Umbra a privacy layer for each based token transfers Ben if the planetary view on yeah thank you so much for having me really appreciate it excited to chat good so um I think the very uh uh the very clear first question here is tell us about yourself who are you how did you get into this space and is it true you are originally in aerospace engineer uh yeah sure absolutely yes I am

originally an aerospace engineer so um uh believe it or not growing up I was kind of a nerd and so I was interested in I know really shocking unusual in this space very unusual but um but so I was interested in computers from a very early age I kind of like played around and started teaching myself to program I was also interested in like Aviation and Aerospace and you know NASA and all that kind of stuff and so I went to school for aerospace engineering because I was very excited about that and I really enjoyed kind of the coursework and the you know the sort of like overall idea of doing aerospace engineering and then when I got out of school I went to work at a large aerospace engineering firm

here in the States and what I learned pretty quickly is that the reality of aerospace engineering at least at these big firms is very different from kind of the um you know uh idealistic view that I had as a young kid going to study it so in reality you know aerospace engineering for good reason is very um slow basically you know you can work on a project an aircraft project for for many years before it can come to fruition there are a lot of people involved in any given project and in general especially again at these big firms things are very bureaucratic and slow moving and it also turns out that at these big firms engineering firms traditional engineering firms really in general they desperately need more people to program because there's all kinds of stuff that needs to be done

software wise building software but it's hard to get people that have the knowledge to build the software but also have the engineering side of things and So within um this large firm I was doing all software engineering work anyway and what I realized was that I wasn't loving my job I loved I really enjoyed the programming side of things the software side of things what I didn't like was the bureaucracy the top heaviness the slow moving side of things and so I left uh Boeing and went into kind of I basically started freelancing and then eventually grew my company scope lift into a consulting firm a Dev shop for lack of a better word and this was probably around 2012 2013 at the time I was not doing work in crypto but I was

following crypto so I had found Bitcoin I had was really fascinated by it and I was following the project I was doing stuff on the side um you know for fun I uh like built a a mining rig and I was mining Dogecoin believe it or not um like at probably at a loss in my house but like paying more for the electricity than than the Dogecoin I was mining but um but I was following it there wasn't really much of a crypto industry of the time except for like a few uh companies um out there so it was really when ethereum launched that I uh sort of got really excited about crypto because I realized this was it went from like oh this is an interesting kind of um interesting kind of you know thing digital scarcity that's been invented to

oh this is like a whole new platform and as a software engineer I can build things on top of this and this is going to allow us to create all brand new kinds of software that do things we couldn't previously do before and so that kind of when I learned about smart contracts and saw ethereum coming together that like um light bulb kind of went off and so again I continued to sort of follow the project started tinkering with ethereum and smart contracts and then it really wasn't until uh the boom of 20 2017 it's like 2018 when I started picking up projects scopeless started picking up projects by this time it was a small consultancy and we started picking up actual crypto projects and by 2019 I decided to really shift The Firm 100 into focusing on crypto so we wound up our Legacy

projects our web 2 and kind of uh we were doing some native mobile work as well and decided to focus 100 on crypto sort of having to start from the ground up with business development and all that kind of stuff but um but uh really it's been an awesome ride because as you know the space in you know since 2019 this base has changed an enormous amount and we've had the opportunity in that time to to Really contribute to a whole bunch of stuff in the ethereum ecosystem in particular and some other Epi systems as well but mainly we're focused in ethereum and um and that's been really gratifying and a lot of fun and uh yeah that's kind of the long-winded explanation to your question can you tell us about some of the projects you've created attributed to

um over the years yeah absolutely we've done a lot of work with a lot of great projects we've been lucky to get to contribute to you know uh projects certainly your audience would have heard of optimism um uh Bitcoin we've done a ton of work with them uniswap uh endowments um mobile a bunch of other uh really really cool projects and then of course we also have done some of our own internal projects over the years um with varying degrees of success and the one that has a decent amount of has probably the most traction of the the internal stuff that we've built is uh Umbra amra is also the project we're here to talk about today um but maybe before we dive into that how is it kind of being a Hired Gun on some some project that kind of um

scoring that with building your own I I imagine that's a really difficult line to toe yeah I mean yes and no I mean I think um me personally and I think as a culture the company selects for this we're like we're a seven person team we're all Engineers we're all very we just like to build things um basically I think would be the culture and so it's like really a culture focused on on engineering excellence and you come to us with hard problems and we help you solve them is kind of the approach that uh that we take and you know I think like I just have fun we have fun doing that right so I think it's um I'm always uh impressed when people can um you know find an idea that they're so passionate about like a singular project

that they're willing to sort of grind on that for years and years and years uh my mind likes to kind of jump all over the place and so it's been awesome to get to contribute to a whole bunch of uh different projects and to you know have a few things going on at any given time it also just gives us like a really wide view of the space because there is so much going on right and even with that wide view it's like it used you know in 2017-ish you could reasonably like have a sense of everything going on in ethereum as one person if you're really paying attention by then it was starting to already get hard now it's like literally impossible you can barely keep a an eye on a sliver of the activity that's happening in the ecosystem at any given time but you know we we get to we

get to see a relative to to maybe other folks who get to see a wide breadth of that so that's a lot of fun of course there is some tension with our client work and our own projects that we would like to to push forward but we've been really lucky especially with Umbra to you know get funding in the form of Grants from a lot of different uh sources a number of different sources in the ecosystem and so we've been able to you know push that forward while at the same time valuing it balancing it with our client work in the ecosystem in a nutshell um what does Umbra set out to do yeah cool so Umbra is a privacy tool it's a stealth address system and um it's different from some of the Privacy tools that maybe your audience

would be used to so it's primarily about receiving uh payments um or or receiving a transaction sent to you by a known sender where the fact that they've sent it to you isn't um isn't immediately isn't legible on chain isn't obvious on chain so another way to say that is it's about receiving payments where only the sender and the receiver know who the receiver is right so the sender is visible on chain the receiver is stealth that's the stuff where the stealth address side of things comes into play so unlike some other tools that your audience may be familiar with you know like tornado cash being the the most prominent example for

example would be it's not a mixer right so a mixer is primarily about taking funds that you control but are you know Docs in some way there it's it's known that you control These funds in this address and then moving them through the mixer and when they come out the other side of the mixer they're in an address that you control but it's no longer clear that you're the owner of them so it's breaking the link between address a and address B both of which are controlled by the same entity right and that's not what Umbra does that's what a mixer does and we're not a mixer so Umbra is about um I want to receive a payment it could be e-commerce it could be you know you're paying an invoice because I'm a

business and we work together could be you're paying my salary you know um whatever it is we have some economic relationship you want to pay me but we don't all want it to be obvious on chain that you have sent this amount of money to me so if you use umrut basically what it looks like is you've sent some tokens or some ether to an address that has never been seen before on chain now behind the scenes it turns out that I control that address and only I I control that address and as soon as you've sent those funds they're essentially custodied by me and could not you couldn't recover them no one else could recover them only I have the ability to remove them from that stealth address that they've been sent to but on

chain who that address is controlled by is uh not visible or legible at all so that's sort of a quick summary of of what Umbra enables so if I look at um my uh regular say metamask and it let me derive um a de facto unlimited number of addresses from a single C Trace right so basically if we coordinate ahead of time what I could do is I could just um I could just make a new address from the seed phrase that I'm already using and give you that but what Umbra actually does it actually lets you kind of I mean it works differently we'll talk about

how it works in just a bit but in the net you would generate a new address on my behalf right yeah that's a great that's exactly right that's a great way to think about it right so yes like the Privacy uh sort of trade-offs that you get from Umbra are the same as if you uh if I you were gonna pay me and I generated a fresh address you know just went into metamask and clicked add new or created some some private keys and imported It Whatever generated a fresh address and then sent that address to you and then you sent the funds to that address that's that's the Privacy the trade the Privacy uh properties that you would get from that interaction are the Privacy properties that you get from Umbra the difference

is that it's a non-interactive protocol in other words we don't have to do that out of band coordination um in order for you to get a fresh address that only I control you can as you alluded to effectively generate a fresh address on my behalf that only I can control but still looks completely um completely unused and new on-chain and it basically looks like a regular address on chain um if it 100 looks like regular address on chain there's nothing there's nothing special about it because it is it is a special address it's just generated using some cryptography okay so everything is saying I want to pay you um say 15 die or whatever how do I go

about creating this address and that you and only you and have the private key tool cool yeah so do you want to dive into this from at the technical level at like the user experience level yeah I think that's a great question let's um let's get the maths straight first and then we can go through the user experience after Okay cool so I'm going to describe the way that it works in Umbra today and the principle is the same right the underlying math principle is the same there are slightly different constructions like ways that you could put it together um and so like different stealth address schemes might have slightly different constructions but I'm going to describe the one that we use in Umbra and the underlying you know principles are all

the same regardless of the exact implementation details so um to do that I'm gonna have to back up a little bit and talk about elliptic curve cryptography which is the kind of cryptography that underlies basically all of the cerium right so elliptic curve cryptography is asymmetric cryptography in other words you have not just uh you know with symmetric cryptography you have a private key and you use that private key to encrypt something and then you use that key to decrypt something so the key is the secret and the the key lets you uh encrypt it and decrypt it right in asymmetric asymmetric cryptography you have a private key and you have a public key right and so that and those two things are a pair right so for every private key there's an Associated public

key and vice versa and if you have the public key you can't derive the private key but you can use the public key to encrypt something so to take some text or data and encrypt it so that it can't be viewed and then once that's encrypted with the public key only the owner of the private key can decrypt it right so this is what we use in things like you know um you know private uh chat apps right like signal or whatever right so I you know the app does this process where you can see my public key and then you send you take you write a message the app encrypts it with my public key sends it to me I decrypt it once on it's on my device with my private key when it went over the wire uh nobody could could read

it right um so that's the same cryptography that underlies all of ethereum and the private key and the public key in these scenarios are just uh big numbers right so they're big integers and your ethereum address the ethereum address that you have in metamask um is derived from the public key of the associate of the private key right so it's actually the hash of your uh of your public key just defines your ethereum address and so when you send a transaction on ethereum you sign it with that uh private key with the private key and then you broadcast it out then people running nodes have to validate that the signature is correct and then execute whatever actions it has to include in that blockchain okay sorry

for that um that background but I think it's important to establish what I'm going to talk about next which is how getting back to how Umbra works right so the way that it turns out right and this is just a property of the math but it turns out within elliptic curve cryptography you have this big number for your private key and this big number for your public key and the math that's going on isn't like normal math right it's not like the math where we where we multiply numbers together right the way that we we learn to do it in in grade school right it's a different kind of math called elliptic curve math basically and I won't get into exactly what that is and how it works because it's out it's even further outside of the scope than the scuff I've already described but basically it turns out the

way that it the way that the the properties of of this math and the way that it works is if you take the number that is your private key and you pick another number a random number and you multiply it by that random number so private key times random number gives you another new number right if you use that number you you can use that number as a private key and generate a new public key right with me so far is that making sense so private key times random number new new number new private key right so if it turns out if you go back to that original private key the associated public key if you take that public key and you multiply it by the same random number right then the public the the resulting number that you get

the resulting public key that you get is the public key that Associates with or is paired with that private key that we got in the first step right so in fact the way that Umbra works is in Reverse so what you as the sender do or what the software does on your behalf behind the scenes is it takes a public key associated with the receiver it multiplies it by a big random number and it generates a new public key from that operation and again this is all elliptic curve math that's going on not normal math and then what the user on the other side the receiver can do is take that same if you can communicate that same random number to the user we'll talk about that in a second but if you if you

somehow send that other that random number to the user they can take it multiply it by their private key and get the private key for the associated uh public key that we that you calculated as the sender in the first step so again a little confusing but um hopefully that sort of made sense I'll let you ask some questions yes absolutely so but that still leaves me to get the random number to you encrypt right because if I send it to you unencrypted then anyone can just try out which public key uh belongs to right right yeah so you may be one this is exactly so basically the question you're asking is okay that that sounds that sounds neat but what good has it done because I still have to send you that

random number before you can figure out how to generate the the new address the new public key which Associates with the stealth address the new address so how do you how how do we do that I still have to send it to you and I might you might as well just sent me an address right so like what have we what have we gained by doing all this this math so what Umbra so what Umbra does to make this non-interactive is remember we talked about how these public and private key pairs allow for this asymmetric encryption right so effectively what we do then is we take the public key and we use it to encrypt that random number that we just uh created and we use to generate the new address and then we once we've encrypted that random number we take that encrypted data that nobody can decrypt

except you as the holder of the private key and we announce it on chain through an event in a smart track right so Umbra is a smart contract system there's an Associated smart contract your funds flow through that smart contract when you make the payments and we make an announcement an event that gets uh broadcast on chain with that uh encrypted um data inside of it and so then what you do as the receiver when you use Umbra is you come you log on and you look at all the payments that have happened through Umbra every event that's occurred through Umbra since the last time you used the app and then you basically tried to decrypt each one and you're not going to be able to decrypt most of them but you will be able to

decrypt the ones that are payments to you and so when you decrypt them you get that random number that you need and you can use it along with your private key to generate the private key for the new stealth address that received the funds and so we basically use uh events on ethereum and indexing those events processing those events locally on your computer because we want to keep it privately obviously to enable the um this data to be communicated in a non-interactive way okay I think I follow so far um isn't it an awful lot of overhead for you to kind of look at every single event not knowing whether this may be decrypted message for you so basically

if this is something that kind of is used that scale is that even computationally feasible yeah yeah really good question so in computer science terms this is like an O of n problem so it's a linear it's it scales linearly right so that's not terrible but it's not great right what it means is every time someone sends a transaction every other user of the system is going to have to decrypt attempts to decrypt that transaction um when they go to receive their own payments so the way there are there are a couple kind of approaches that you can use to deal with that um and I would kind of put them in two buckets right one bucket is like sort of like researchy uh sort of things right so you

could think of like uh Gossip protocols and different things that we can do like research that we can do to take this linear problem and make it like a an O log n problem again in computer science there terms right so one that is more scalable um and those are there is research being done on that and we're very interested in that we're kind of following it and paying attention and would like to even potentially contribute to it in the future um but then the other bucket of Solutions and these are the ones that we've pursued so far and there's still a bunch of more of them that we can pursue to make things more efficient are what I would call like the engineering hack bucket of solutions right and so these are solutions that don't make the they don't they don't solve the problem in

that it's still a linear it's still an O of n problem but they can take a lot they can do a lot of things to improve the user experience basically reduce the constant time um uh cost that comes with with with doing this right so in the long run you know if we were going to scale this up to every payment on Earth which by the way I don't think it needs to or should like there are there are a lot of different privacy Solutions and different ones are appropriate for different use cases right and so Umbra has a set of trade-offs that are valuable in certain situations but not necessarily everyone but if we were to scale this up to every every payment on Earth we we need one of those sort of like researchy solutions to come through in order to uh to make this scalable but

we can get really far with uh what I would call the kind of like engineering hacks in terms of still providing a useful uh an acceptable user experience in the sort of like short to medium term and so that's kind of where we are today and and I can dive into like what some of those are some of the ones we've done already some of the ones we're looking at in the future but uh but yeah that's kind of the high level answer so in in my understanding of what I what I gleaned from my answers that um the computation still needs to be done in the background somewhere it's just done such that it doesn't bother the user so much is that correct yeah yeah so so like let me let me dive into like some of those possibilities right so one of them is the one that you

maybe alluded to right so when I described the system earlier I uh I said that we take the public key and we use that to generate the stealth address and then we also take the public key and we use that to encrypt the data in reality in Umbra the way that we do it is we actually have two separate public keys and when you set up Umbra as to be a receiver to receive payments you generate two private key two public private key Pairs and you publish the public the two public keys in a registry and one of those is a spending key and the other is the viewing key so the first one is used to generate the stealth addresses the viewing key is used to do the encryption and decryption of these events and so what that means is one option that you have an imperfect

option for sure but at least an option is you can give some third party that viewing key so that they can do the monitoring and decrypting on your behalf and then just let you know when you've received a payment but that third party is not able to withdraw your funds so obviously you've you've given up your privacy to that third party but you haven't given up control of your funds to that third party uh and there are a lot of there are now that that isn't perfect for everyone right there are plenty of people who are going to say well that's not a trade-off I I want to make but there are plenty of people who might say that that actually does work for them so for example if you're using this for like receiving payments or you know invoice payments or salary payments or something like that you know just

like today you're probably okay with your your invoicing software company or your bank or whatever knowing about your um about your salary payment or your invoice payment you're okay with them knowing that you just don't want it like broadcast and legible to literally everyone who knows how to go to etherscan right so um it might be an acceptable privacy trade-off for you to give a a trusted third party the ability to to see what you've been paid but not withdraw the funds right in fact that's an improvement over today where your bank literally can see they're not really your funds at all right uh they're the banks until you until you withdraw them so that's one sort of like simple simple low-tech solution to to this problem um putting that aside and talking about

well what if I'm an individual user who doesn't want to give up my privacy what options do I have there's still a bunch of stuff out there so one of them obviously is just like caching right so once you've decrypted like ethereum is you know past blocks are immutable right so once we've scanned an event once we don't ever have to scan that one again and so if you use Umbra to receive payments regularly like every week or two weeks or a month you're only going to have to scan the events from the last time and decrypt the events from the last time that you um that you use them another obvious one is just parallelization right these are totally independent uh things right and so computers are getting more and more uh parallel like uh your MacBook you know these days has like 32 cores or

more and so we can blast those across all the processors on your phone or your computer and decrypt them in parallel they're not contingent on each other at all and so that that's a big help in reducing the time there's another solution called view tags this is something that actually comes from Monero we don't have this implemented currently but it's something that we're looking into and I won't get into the details there but basically it's a it's a constant time speed up where you can get as much as maybe like a 6X constant time speed up on the decryption and the the kind of short explanation of it is like there's sort of like a two-step process one of them is uh is computationally inexpensive and then the other is the actual decryption the

process that we do today and you can do the computationally inexpensive step to basically rule out uh big chunks of the transactions before actually doing the full computationally expensive step to see if it's definitely one for you and so you can like rule out five six of the transactions before you even do the expensive step and then only decrypt the expect the uh the six that are left and so you get a big speed up there so this is just like a you know a short sampling of of some of the things that are out there but there's a there's a lot of juice to squeeze in terms of making this uh fast enough to work for users today before we hit hit the limit you know again in the like median term these approaches can get us pretty far

so let me recap and then kind of let's go over the user experience so just to kind of uh kind of reiterate how it works so I want to send you funds um so you have a uh you you have an address uh you have a public address and basically I generate a random number and multiply your address by that random number and then I encrypt the random number to send it to you and then you can generate um the private key to that new public key that I had generated with the random number and I can send funds to that to that address yep that was a good good

summary the public key um that you generate that I go off of is that just a standard um ethereum address so basically if I if you give me your meta mask and it can only perform this but where exactly does Umbra actually come in yeah yeah really good question so as we said earlier as like elliptic curve cryptography is what underlies all of ethereum right so your address any address that you use in metamask or whatever is is backed by a standard public key on uh like like the ones that we use in Umbra um now the the address itself is

actually the hash of that public key and so if you know anything about hash functions like you can't reverse a hash function you can verify it if you have the plain text but you can't take a hash and figure out what the plain text was right so if I give you just an address that isn't actually enough information for you to know what the pub P of that address is so the public key has to be shared somewhere now it turns out when you sign a transaction and send it to the ethereum network um you effectively at that point reveal the public key of the address right and so once at least one transaction has been broadcast on the network for a given address we can recover the public key that that underlies that address and then we can use it in Umbra to do

everything that we just described that is possible in umrah like nothing about the way Umbra Works prevents you from doing that and in fact we even support it in our front end but we support it behind a flag that we call like an advanced mode flag and we put like all kinds of friction in front of the user before we allow them to do that the reason is because as the receiver the only way for you to receive your funds is to take the private key associated with your address and to uh then put put that private key into a wallet or like the front end of Umbra that supports looking for these transactions right that gives you all the functionality and so obviously we don't want users pasting their private

Keys into like random uh front ends even our own right it's just not a good security practice that we want users getting in the habit of doing and so we allow you to do it if you know what you're doing like our app is open source you can pull it down locally run it locally paste your private key in there if you want feeling better about that we're not logging it or something like that if you know how to audit the code yourself Etc but it's not something anybody should do normally and so the way we have it set up is when you come to the Umbra app as a as a default user if you don't go through the trouble of turning on this advanced mode you sign a very specific message a human readable message it says like you know this this message is used to generate your Umbra

Keys you sign that message and we use the signature to generate uh two public private key pairs the viewing key and the spending key that we talked about before and what this allows you to do is we generate those keys from the signature from your address and so only you as your as the wallet holder can generate those keys but you know you don't have to back up any new key material right so if your seed phrase is backed up somewhere you know in a safe or where on a piece of Steel then you know you're you're fine as long as you can recover that that address you can sign that message and recover your Umbra funds as well so no new key material comes into play but it's still not actually the underlying key that's used

for all of your other ethereum stuff and then once we've generated that public private key those two public private key pairs we publish the two public keys in a registry so it's just a really simple contract that you store you know you take your address you associate it with two public keys and then as a sender you would come and you would look up the software looks up in that registry the address and pulls the public key for the viewing key and the spending key you know uses the spending key to generate the address uses the viewing key to encrypt it and announce it on Umbra so that's the uh the kind of scheme and the approach that we've taken for kind of like a user safety uh user safety reasons but under unbreakable can I download this as a

desktop app because that would kind of alleviate the not of your security concerns no yeah really good question right now it's only a web app um and we host it uh in the front end ourselves we've explored before maybe packaging it up you know like using some of these Technologies like electron or whatnot to like package apps up um so that they can run locally on the desktop that's probably something that we should look into more in the future we're also actually um sometime soon it's on our roadmap to deploy Umbra to um like a decentralized storage uh solution which you know doesn't really alleviate the exact problem that you were describing but is is something that I think is also useful the app is also open source right so if you're a developer and you know like the basics of you know npm and stuff like that you

can pull the app down and get and spin it up and run it locally but right now we don't have a desktop app it's probably something that we should explore sometime in the future okay so let's talk about the users again so the receiver and the sender do they both need to be an umbra users at least in in the non-advanced mode yeah good question so um just to back up real quick I want to add something that I I should have also included we hope in the future that like this stealth address Tech like the stuff that underlies Umbra will also be integrated in wallets so that users can use it directly in the wallet so I think in the long run that's like the the ideal gold standard of how users would interact with this this stuff it would

just be like an option in your wallet so again you wouldn't even have to worry about those private Keys all the keys existing anywhere anywhere else um and that's sort of why we developed Umbra as more of a protocol as opposed to like just adapt we have a front end we have a first party front end but it's really just a set of standards that anybody can plug into and we should talk more about our work to at the in the future to talk about uh to make an EIP a standardized EIP to push for exactly that uh future but um so getting back to the question that you asked which is what is the user experience like for the sender and the receiver do they both have to be like um reusers so right now the receiver in order to receive payments again if you're not going to do

this advanced mode thing which we again recommend against the receiver has to do one transaction per Network to publish their public private key pair that is used in the rest of the system so if I want to receive payments with um the first step that I have to do is go to Umbra click setup and it'll say you know sign this message click sign in metamask and then it'll say submit this transaction it's a very low gas cost transaction we've optimized it as much as possible compressing the public Keys Etc and then you accept that you pay the network fee and it publishes those public Keys it's a one-time thing after that you can receive as many payments as you want from Umbra and then what you

would do as someone who wants to get paid with Umbra is you would you would send you would tell your sender hey can you pay me via Umbra just go to this this doc go to this app go to app.umber.cash and pay me there and so as a sender you go to those site and you click on send and you've got a form that just has like two address token amount right very very straightforward you don't have to do any setup all you have to do is fill in those fields and click Send and it sends the tokens right or the or the user underlying uh via Umbra you don't need to know any of the details of all the stuff that we just described the software is taking care of all that for you automatically on chain it looks just like um well yeah uh we

need to talk a little bit more about what it looks like on chain tokens versus ether Etc but for you as a user it's just like another transaction interacting with a contract the gas fees are only slightly above what the uh gas cost would be for a normal transaction again like this is one of the advantages I'm real compared to other privacy Solutions like zero knowledge proofs are super cool and awesome and have a lot of really cool use cases but currently at least they're very uh expensive to validate on ethereum right maybe some pre-compiles in the future will make that cheaper but right now uh you know validating zkp's at smart contract level is expensive we're not using zkps there's no you know zero knowledge magic happening and so the gas costs both for

sending and receiving are minimally minimal compared to just sending and receiving in the clear so um yeah that's um that's a quick overview of the user experience for the receivers and the senders so if I um do this by your web app what's the information that you can use Umbra can glean from that so basically if if you say send funds to me and you say and send it to fns.ish and obviously ambra will know um who's sending what to whom because the address is kind of generated some aside for you right so the address is generated not

server-side no it's generated client-side right so yeah so the web app is doing all the Generation Um now if we're malicious and we publish code in our front end that isn't doing what we say it's doing or is logging things back to our server or whatever um then obviously we can we can get that information but we're not and you don't have to trust us on that you can go look at the open source version and run it locally yourself um to to validate that um but yeah everything is done client-side so as for us as Umbra we can't um what's what's visible to us is what's visible to everyone else which is you sent a transaction to a stealth address that stealth address looks like a brand new address on chain we don't know who controls that stealth address

um and we'll never know who controls that stuff the Jess unless unless they intentionally docks themselves or do something stupid on the withdrawal side of things which is something we should we should talk about about preserving your privacy as a receiver but um but yeah and same with the decryption as a receiver right all of that is happening client-side so unless of course like we talked about earlier you delegate your viewing key to your third party intentionally and as far as I know there's no Services doing that right now we've thought about building one ourselves and you know giving users that option but so far we haven't and not sure if the demand is there for that or not at this point um but unless you so unless you delegate that to someone else intentionally um then everything is done client-side so if you go to the app like all the

decryption is done on our side we don't know which stealth addresses you control or you don't okay so um I haven't checked in for like a month how how long would it take me to kind of go through all the transactions to to see whether I actually received anything yeah so it depends on the network right and Depends because it depends on how many transactions other people have sent right so like if if we deploy to a new network tomorrow um and do a couple test transactions it'll be like instant because it's really quick but I think the network that currently has the most transactions that have gone through Umbra is polygon um I think it's on the order of low hundreds of thousands so maybe like I don't know maybe a hundred thousand

two hundred thousand something like that in total um on polygon uh I think that's right I think that's roughly right um something on that order of magnitude uh and right now I was actually just doing some testing with this yesterday because we were tracking down a small Edge case bug and I think on my my computer you know like kind of a middle of the road uh eight core or whatever developer machine it was taking me like three or four minutes to decrypt everything uh you know to fetch the fetch the data that actually takes uh a little bit of time as well they have to fetch the announcements and then you have to uh decrypt them and you know it was like the total time was three or four minutes so that's not ideal but uh obviously with like caching and stuff um that gets better and that's currently

the worst case uh scenario for um polygon um one thing that is oh yeah and one thing that's worth noting there is that um as he said like it gets worse as more people send transactions and so one thing that we also do is there's a small toll associated with each send that you do on Umbra and the reason is we don't like there's a a griefing attack that you could do if you just you know whatever when it like it doesn't you can't steal anything it's not stealing funds or anything but you could just make everyone's life Difficult by like wash sending a bunch of you know transactions through to yourself you're not losing any money and but you're adding all these events to the send

history that now become this sort of like um you know uh this sort of like uh challenge for everybody else to decrypt on their side right and so there's a small toll that's associated with each Cent that you have to pay and that's purely as like a Spam mitigation method right so if if you have to pay a couple of cents which is basically what we have it set to right now for each send then um you're going to be you know discouraged from sending thousands and thousands of these which is what it would take to make a notice of difference in the description time and that's only on low fee networks by the way on mainnet the gas fees themselves are enough deterrent to do that but you know on on Roll-Ups or side genes like polygon the fees are low enough that someone who just felt like

you know felt like causing problems for everybody could do that for pretty cheap and so we want to make sure we have a mechanism to prevent that sure what happens to the fiends yeah good question right now they are just custody by the contract we have an admin key it's the only admin it's the only privileged role in the system that we have right now that admin has the right to withdraw those fees but again it's on the order of like cents per cent you know and we've had a few hundred thousand transactions across all of our networks over time so you can kind of do the the math on how much that is uh it's not a ton but it's it's there to uh prevent spam now it is an interesting question because we are working to try to develop an EIP standard to sort of

make this like a global standard that anybody could use and so then the question becomes like okay well what that's fine for Umbra which is developed by scope lift but what happens when this is when we're trying to make this into a totally decentralized public good um where do those fees go should we just burn them um but uh part of the challenge too is that you want to be able to adjust those over time right to say oh you know gas has gone up on this roll-up Network so we actually don't even need the Phoenix more we want to set it to zero well that's an admin privilege as well so how do you who gets that if you're trying to deploy this as a totally decentralized protocol which is the goal and so that becomes that is one of the challenges that we have right now and that we're

trying to uh to figure out what the CIP you could also just read Nikon right I mean there's no network effects that played here right so obviously you could just always do a redeploy and kind of Set It reset the fees yes that would be an option I guess the only like challenge with that is you know it just makes the like client software more complicated you know if there's like multiple places that you have to check if there's been payments and stuff like that um so yeah there's like an overhead cost associated with it but you're right um there's nothing where it's like there's not like a liquidity pool or something like there might be with a D5 protocol where redeploying doesn't you know a redeployment has some

disadvantage compared to the original good point so we've been talking about sending it but obviously you could also send any elc20 token um and then in principle um basically if I if I stand for instance uh you um five optimism tokens you may be in a position where you cannot withdraw them from the address without doxing yourself because you have no gas um no eating for gas on new dress um how how do you go about that yeah really good question so um basically there are two paths in umbra's contract and one is for sending

the base asset so ether or like Matic if you're on polygon or whatever and then the other path is for sending your C20 tokens and they're different for exactly this reason and so when you send ether through Umbra what we do is we actually take that ether and we send it straight to the stealth address right and then you as the receiver you can withdraw from that stealth address but what that really means is just sending a transaction as that stealth address to send the ether to wherever else you want to send it to um and that's an interesting question we I think we'll come back to in the future but where to send it to you but but that's that's a separate question from the one you asked as a if you receive tokens and we did that with tokens let's say we just sent the tokens straight to

an address like you said you now have to fund that address how do you do that without doxing yourself this becomes a challenge because you have to pay gas fees to actually move the tokens so the way that we solve that is when you send tokens in Umbra we custody the tokens in the address and the stealth address the stealth receiver is the OWN has to sign a message in order to withdraw them they kind of withdraw them directly so you're not completely reliant on a real area if you can fund the stealth address without doxing yourself that's the route you can you can choose to go but by default what's going to happen is you're going to use a relaying service to uh to withdraw the funds uh from from the contract so you have to sign a message with the stealth address that received

them you have to agree when you send that message to pay a small fee to the relayer to compensate them for the gas and then the relayer will take your transaction and or take your signed message and use that to submit a transaction on chain that the Umbra contract will validate and say okay yes the stealth address agreed to let this relayer withdraw for them to pay this fee and send the tokens to this new to this other address uh while paying the fee to the relayer so that's the system that we have in place for Umbra for erc20 tokens I mean that makes total sense how do you go about receiving nfts so basically obviously that works for vulnerable tokens because you can you can just sell

um you know whatever portion of it but if you receive an nft uh how do you send it on yeah so the concept of stealth addresses work for nfts unlike other privacy tools right because you can send an nft to a stealth address and the same properties apply in that as it would be if you're sending tokens like okay I see that you've sent it to an address but I don't know who actually controls that address so so unlike you know uh mixers or something that rely require fungibility the Privacy properties that you get from stealth addresses applied to nfts equally as they do to fungible tokens which is pretty cool there are challenges with like the one that you described right so currently today uh the current version of member that we

have in production does not support nfts and this is one of the reasons why it doesn't uh right there are solution there are things that you could do there the simplest and easiest and we do hope to and plan to support nfts in the future in future versions of Umbra one of the easiest things that you could do there would be to give the sender the option to include some you know base assets and East uh along with then of T when they sent it right so instead of it being a transaction that just sends the nft the transaction could go through the smart contract send the nft and a small amount of eth to the stealth address such that the user on the other side could use that yeast to pay for gas to move the nft in the future so that would probably

be the simplest solution if you don't want to do that then you get into well what basically mixing and matching privacy tools so how can I fund how can I use some other privacy tool to fund the stealth address um in a non-docxed way such that I can then uh remove the uh the nft without reeling myself you alluded to this idea even after having received something on on a new Staff address and there's a myriad of ways to kind of still give my identity away um so what what should I do uh maybe I can turn around what shouldn't I do good question yeah so so the obvious thing that you shouldn't do is just immediately send the funds from your

stealth address to a doxed wallet right if you do that it's going to be pretty obvious that this these were funds that were sent to you so and that's actually like a lot harder to communicate than you would think to users and this is one of the challenges that we've had with Umbra which is the uh crypto Community as a whole has kind of because it was basically the first privacy solution available mixers were that is um the crypto Community has kind of anchored on mixers as like their um their mental model around what privacy tools mean in crypto and so a lot of people think like okay well if it went in and then I take it out well it's private or something you know like as if like that's just there's like some magic

that happened in between the two things but that's not the case right you send it to a new address and so if you want to preserve your privacy you have to make choices that that do that right um right now there are not a ton of great options so one option would be this is probably I would say the biggest challenge that stealth addresses still have and I think we're exploring a bunch of possible ways to solve this but um but there's a you know there's um it's it's it's still a challenge so one option would be if you've received funds to a stealth address you can either just leave the funds in that stealth address or withdraw them to a new a brand new address and just continue using that address right so if you receive like a big payment of ease or something like

that that's like an easy thing to do you could then take that Heath and swap it and you know invest in D5 or do whatever and just continue using um continue using that uh that address and no one except the person you sent it to you knows that you control it right um that's fine if you have now that one obvious question is well even that solution doesn't work for tokens right so what do you do with tokens one of the things that we've built into the Umbra contracts is this concept of a post withdrawal Hook and the post withdrawal hook uh basically says when you take your funds out of umro and you withdraw your funds from Umbra not only can you move the funds to some other location but you can take arbitrary actions as well so you can basically do an

arbitrary trans action on the network in addition to moving your funds at the same time and you can submit that all through the relayers you can pay for the relayer to do it and so like one example of a post withdrawal hook that we could build we actually have the contracts for this but we have it integrated into the front end yet but it's a question as to whether the ux is good or or not and whether users really want it but one of the things we could build for example would be if you received die say you receive a 10 000 die and you want to do what I just described which is just keep using that without you know unchain without doxing yourself you could do a post withdrawal hook to swap some of that die for each so now you have you know uh nine thousand nine

hundred die in a new address with a hundred dollars worth of each to pay gas fees and then you can you know deposit it in Ave and earn yield or whatever else you want to do right so the broader point is that this this idea of a post withdrawal hook gives us the surface area to integrate and the fact that you know ethereum is a composable chain and has all these other things available gives us the surface area to integrate with other things that allow you to make privacy preserving um decisions so another obvious option would be you know there's a bunch of other privacy tools out there that do different things like just just one that we've we've done some work with them and we're interested in in their tool as well it's called railgun I don't know if

you're familiar with with railgun at all but it's an interesting privacy solution um but you Aztec would be another one that your that your users would be familiar with right so when you think about those kinds of uh Solutions they're Solutions where you kind of have to enter into a shielded uh ecosystem right and so you could create a post withdrawal hook where you withdraw your funds and immediately Shield them into some other uh privacy preserving ecosystem like Aztec or railgun or any other that that could that is or could be developed in the future right um so that's another sort of like unchain native solution the truth is that what I think most of our users are doing today is a lot less sexy but is practical for a lot of use cases which

is they get paid with Umbra like I said they're doing some work for a Dao you know we've talked to users who are doing this they're getting paid by a dow they don't want that completely legible Unchained the Dow pays them via Umbra and then they withdraw their funds directly to an exchange right and so they send the funds to an exchange and they cash out to Fiat or send them back on chain somewhere else you know effectively using the um the exchange as a as a mixer obviously not a very good mixer because the you are right so you have to be okay with that that privacy trade-off but again for a lot of use cases that is uh acceptable I mean even if you're okay with the exchange knowing who who you are these days exchanges only give you one deposit in us so if you use that

trick and it's like one one one time trick yeah it depends different different exchanges do different things a lot of them do do one uh deposit address per asset these days you know if you don't if you only ever used it for Umbra right then it allows you to consolidate the payment so you can say like okay these different payments all must have been going to the same entity but you still don't know who that entity is but you're right it's a problem so yeah there are um there this this is I would say the biggest challenge that stealth address addresses have the Privacy properties are really nice in terms of receiving payments in this non-interactive way that aren't obvious on chain but then it's not necessarily easy to make privacy preserving um decisions uh after that after you've received the payments right and so this

is one of the things that we're working on as I alluded to there's this possibility for Integrations via these withdrawal Hooks and I think it's one of the places where we can make a lot of improvements in the future um and like like I said before like I don't think stealth addresses are like a um are like the Silver Bullet for privacy like they're they're one tool that has a specific or a set of specific use cases and and properties that are useful for certain things and I think in the long term in general for for the ethereum ecosystem and for you know crypto ecosystems in general I think the there's not going to be like one tool that like oh this is how you do privacy it's going to be more like there's a bunch of different tools that give you different properties and you have to

sort of know how to use them in conjunction with each other to get the level of privacy that you want and need um for whatever your kind of situation is and I think we can do a lot to make that the ux for doing that easier um but I think that's sort of the reality of of privacy uh in crypto is that there's there's always going to be multiple tools and you'll have to understand the properties of the different tools and and make decisions to kind of like get the level of privacy you need yeah I mean other user I mean to us it seems almost normal but I mean if if you explain it to anyone else it would seem crazy right basically it's like um yeah so um what actually happened is you have

several units and in your in your different pockets and you know you can't can't make them can't put like uh five dollars from one to the other or everyone will know that they both belong to you and if you if you wanna if you want to kind of consolidate you have to you have to get like really big tasks um kind of like the ad Tech already gone and energy and you have to put it in the past and then in the past you can you can exchange money from one uh what it to into a new wallet and then basically there's a not too abstract a way here for the average user there is for sure and so the ux there's a ton of work to do to make the ux better

um you know I think like a couple things I would say to that one is that all that does sound insane and N is to a certain extent like it'll get better but it's never going to be it's never going to be like it's never going to be zero friction right um like all other things being equal a a solution that gives you more privacy is probably going to have some additional friction and some additional cost than a solution that doesn't right just sort of logically that's the the case and then so users have to decide the level of privacy that they want and need and are willing to pay for and willing to put up for with an additional amount of friction um one of the things by the way that is just a reality of the Privacy space uh in my opinion and learned this firsthand

with Umbra is that privacy is one of those things that everyone says they want and everyone says that they're willing to put up with some friction or additional cost to get but revealed preferences seem to be that a large chunk of the population a majority a large majority actually uh doesn't feel that way because if you put even the smallest amount of friction or additional cost in their way to achieve privacy they just don't do it um they choose not to do it and so um yeah that that's just like you know for some of us like myself like it just is that's insane like it just like we like why would you know but that that does seem to be the reality um that's okay like people can and should make the decisions that they want

but we want these tools to exist and to have the lowest friction and barriers as possible um out there the other thing that I'll say about something that makes building a privacy tool challenging is that um there are users out there who do care about privacy and care about it quite a lot and um for whatever reason um maybe their circumstances maybe just their disposition really want the maximum privacy that they can get and they are willing to pay for it um it turns out though that it's really hard to talk to those people because they value their privacy and so doing user research for a privacy tool and understanding the use cases that people care about and what they're using and what they're not is really hard

um because those people don't want to talk to you for good reason right so uh this is just a general structural problem with creating privacy tools it's really hard to understand your user base it's really understand hard to understand if you have product Market fit or not um and you know I don't have a great answer to that we kind of just have to like stumble forward I mean even something like as simple as like we right the Umbra app does not have any client-side analytics in it at all right and that's because we felt like it doesn't really seem uh right to like have a privacy tool and a front end for our privacy tool and then be like logging every single action that our user takes tied to their IP address right so we don't do that um but that handicaps us right because

we don't know like oh like that feature that we shipped are people really using that or not like we don't know and we can't tell easily right um you know some things have like a footprint on chain that you can follow like okay we know that people are sending this token because we can see the funds flowing through we don't know who they're sending them to but they're doing it so obviously like people wanting to to send that token um but we don't you know other than that like more detailed intricate stuff we don't know because we is not to you know invade our users privacy because it's a privacy tool and that would be counterproductive right so um it's just it's just a structural a structural problem with developing privacy tools I would say in general I also find that people usually say they

they value their privacy but no one actually runs their own node I mean in Fiora sees everything you do correct correct yes but it's not that difficult to run one but people don't have right so basically then kind of you need to be quick and um same to our same for desktop um apps so I think people should really use them anyways I have one more and one more um area that I would kind of like to explore and and that's smart wallets and construction so in my understanding kind of using this stealth address um but only works for Eos right it doesn't work for smart contract wanted

as um it does okay fantastic I see you nodding so talk me through it so sort of like so the scheme the the scheme that we use today that I described earlier is we have you use your eoa to sign a message to uh generate that public private key pair we effectively do that as a convenience layer thing right like it's a because we want the um we want users to be able to to to use the setup they already have which for most people is a wallet like metamask or a wall connect wallet on their phone or whatever with an eoa right and and so that's sort of like the setup that we have today um signing messages but but there's no

reason that that is the way that the that you have to generate the public private key pair in that way right so like you can generate a public private key pair in any way that you would like and uh as long as you publish it in the registry and don't lose the associated private Keys then and you're good um and so there's nothing that like prevents this from working with uh a different wallet and in fact you know these um account of structure laws some of the ones that exist I'm not going to be able to remember on my head but there's like a standard for how they do message signing like how you sign a message with a notice safe or whatever like you know maybe maybe you would know a bit more about that actually but um you know the um yeah there are ways that

you can do that now where it gets tricky is like some of these wallets they have like the idea of like social recovery and stuff like that right where it's like you if you you can completely lose your private keys and still like get all of your assets back um that part doesn't work with Umbra because at the end of the day there is a public and a private key uh there is a there is a public key published somewhere and that's the public key that someone is using to to generate the stealth address that's receiving the funds and so there has to be a private key that you like preserve somewhere right and don't lose and so if you you know use some wallet that has count abstraction and social recovery and you lose the private key that's associated with that

um and the one that you you lose the private key that was used to like generate the public key on Umbra and then someone sends you funds um just because you social recovered the rest of your app doesn't mean you're going to be able for the rest of your your assets that were stored in that that wallet doesn't mean you're going to be able to go get your funds that haven't yet been withdrawn from Umbra out of the system right because those funds were sent using a specific public key if you lose some private key there's nothing that we can do right so I wouldn't say it's not possible to use with these you know smart wallets and whatnot it just adds like a layer a little bit of layer of complexity in it again at the end of the day you have to you have to retain this this key

material right um and if you know today if you're using an eoa we do that via the signature so it's not a big deal you already have to retain the key material of your eoa you're fine but when you get into these like social recovery mechanisms and whatnot it adds a layer of of complexity that you have to think about maybe Switching gears a little bit um how do you think we get to a word where people care about privacy right because basically if you think on it there had been so many Revelations over say the last 20 years or so back in the day people said you know why would anyone spy on me and I'm boring I have nothing to hide

um and so on but it's because I'm so apparent that this is not a blocker even if you're reading boring lots of things can still be learned from you and and I learned from you and unless you are incredibly um sophisticated and what do you think it would take for people to win back their outrage and kind of ask to take back their privacy or just take back that privacy do you think um it's kind of a little bit like you know the analogy where then the Frog that's being slowed and boiled right so what when's the point you kind of jump out is it going to kind of make people care

um about their own privacy I don't know if there if there was I I wish I knew it I don't know that I don't I don't know is the short answer I mean well I have a few thoughts on it like in terms of like individuals like quote unquote Everyday People whatever that that means normies yeah not meant pejoratively uh at all like I'm not sure the majority of them are are ever going to Care unless like things get really bad in whatever jurisdiction or you know particular Locale that they're in right like and and um and they really are being targeted in an obvious and visceral way that motivates them to uh you know really start taking it seriously um I just you know I'm not sure that and so maybe we can move the dial a little bit get a higher percentage of people to

start caring but I'm not sure that uh you know unless unless for you as an individual things get really bad your most people are going to Care uh and you know look at to a certain part of the answer is like that's maybe that's okay like if people want to make those decisions like that's that's their prerogative etc etc you know to me it's like self-evident that you should want um better privacy but like obviously it seems not to be for everyone right um that that's like a self-evidently good thing so yeah it's just an interesting interesting reality um and I'm not sure I have an answer on the individual level one thing that I will note it and this is like part of our thesis with Umbra as well is that like where as individual you know people seem not to unmask care about privacy as

much as they quote unquote should whatever that means right like uh it it does seem it seems self-evident that businesses and Commercial applications care about some level of privacy more than uh more than maybe the average user does right so if you're a business and you're have some relationship with a vendor and you're paying them some amount right that's not something that you're trying to hide from like a nation-state but it isn't something that you want blasted out in public for everyone right and same with maybe like uh things like um paying for things on e-commerce right like I think that this is another example where maybe you can get like the average user to care at least a little bit right like okay would you want every single e-commerce vendor that you used like is there anything

that you buy that maybe you don't want everyone know knowing that you're buying that thing right like like maybe would be better if there was some kind of privacy payment system that that kept that at least um not completely legible so um yeah I mean I don't know I don't have a a silver bullet there I think um certain people are just never gonna care people will care maybe when it's things get really bad in their particular situation businesses will care and then some percentage of the population does care and um I think we just have to find ways to to make these tools available so that when and if people need them or want them you know they have have the option and make it as easy as possible to to adopt them I think that's that's a fair assessment

so um where can people learn more about um where can they um look at the code where can they join the community absolutely so you can go to app.umbra.cash to use the app you can you know publish your keys with one uh cheap transaction and then you can receive payments there you can join our Discord which is linked on the site as well and um that is where we do announcements and people chat and you know if there's ever any tech support or anything needed you can find it there the GitHub page is also linked on the app but it's a scope lift slash uh Umbra Dash protocol and

it's a monorepo that has the front end the smart contracts and the the SDK for interacting with those contracts all are hosted there and you can check that out if you're a developer and then uh Umbra is on Twitter at Umbra cash and you can follow us there for announcements and whatnot as well perfect thank you so much for coming on Ben it's been a pleasure thank you very much it's really been a great conversation appreciate it