Blockchain Security/Privacy: dont keep it too simple!

Transcript

all right hello everybody um originally there was an animation on this slide but i think the conversion to pdf screwed up the animation so we're just going to pretend it's like a zero knowledge title um i'm christopher you may have noticed if you were looking at the original schedule that this talk was originally planned to be given by fatima uh whom i work with at helix unfortunately she could not make it today due to some last-minute schedule changes so i'm stepping in for her fair warning i may be giving a slightly different talk than she planned to give so you know if you were looking for that you might be surprised but i hope you're not bored um i'm going to talk about security and privacy uh in general and then in the mata which is a product that we at healy x are working on

and before i do that so that i hopefully can keep you all entertained i want to conduct a brief survey of privacy familiarity so who has heard of zcash raise your hand who has used zcash keep your hand up ah there's quite a stark difference in these two numbers who has heard of tornado cash raise your hand who has used tornado cash keep your hand up right okay so what i conclude from this is that privacy has a user experience problem who's heard of z cash 95 percent of people use usually cash like three people and i'm going to talk a little bit about that but first let me just say namada is joint work by adrian awa and myself and everyone at helix unfortunately way too

many to list but you can find us find us here so maybe you're already convinced but just in case you're not i want to talk a little bit about why privacy matters because i think there are a few reasons you know both first order reasons in second order third order fourth order and order reasons to worry or want to worry about privacy i think a first sort of first ground of why privacy matters is for local sovereignty for national and for community defense at all sorts of different scales if the data about what you're doing and this can be in a nation this can be in a dao this can be in a group of friends can is visible to everyone else in the world or to like people who have some kind of especially

asymmetric power advantage over you they can always use this data they can select from it to misrepresent what you're doing they can use it to target you if they know some of your actions if they can paint you in a particular light which might not represent a sort of fair assessment of what's going on and the only way to defend against this at community at the community level at many different scales is privacy that's reason one reason two is something i'll call nudge cap nudge surveillance capitalism so who's heard of the phrase surveillance capitalism raise your hand okay okay this was popularized originally in a book uh the age of surveillance capitalism by shashana zubaf boy it's like four or five years ago now but it refers to

this trend of what you might call data monopolists using their intense or extreme amounts of data about everyday interactions to kind of slightly alter actions to put advertisements in front of you to show you particular youtube ads when you search something on your phone uh even you know to the point of like uh detecting where you are in the world and showing you like pertinent ads for local things right and this doesn't you know at the surface level if there's not any direct infringement on rights it doesn't necessarily seem like a catastrophe i mean maybe these ads are more relevant to you right it's the argument they make but it is this kind of it's this kind of nudge right like these companies have become very adapted

figuring out when precisely to show you an ad to change your behavior just slightly you know maybe you were considering going to lo the local coffee shop and they can show you an ad for starbucks maybe you were considering buying a phone and they can convince you to buy a slightly different phone right this these changes seem small but they add up you know if 50 of people who might have considered going to the local coffee shop now go to starbucks then the local coffee shops go out of business right so even though the individual decision uh seems not to change very much in aggregate the effects can be very large and very concerning third reason why privacy matters is uh that it is i would say a necessary substrate for the protection of rights so let's take the case of abortion which was say

recently the subject of a lot of debate in the united states of america and in other places regardless of your views on the particularities of this question if you don't have privacy for what you're doing then pretty much anyone can target you so if you use a period tracking app if you search for certain things on google at certain times you know even on about half somebody else these companies have more than enough data to identify perhaps not with certitude but with high probability you know what you might what kind of medical procedures you might be considering or a significant other might be considering and this can be looked up in fact this data is already sold to say activist groups on on multiple sides of this issue and they can use it to target people uh

you know regardless of of yeah regardless of sort of your views on the on the social question uh without privacy there's no no real substrate protecting individual rights you know it's only up to a kind of benevolence of not only you know what your government decides but what everyone else decides and that is a that's quite a tall order so and if you want robust protection of individual rights you really need privacy so that it's you want to make the cost of targeting very high right and this brings me to my fourth point which is that it's kind of odd that we need to be making arguments for privacy because privacy throughout most of history was the default it's not only that you know uh some governments maybe claimed uh not to

target people on the basis uh or claimed kind of adherent stage of individual rights but also that it was like quite expensive to operate a secret service and it required wrecking your society and it required hiring all these people who have to go around who could themselves be deceived right but with this kind of global surveillance network enabled of course by these very devices you hold in your pockets violating individual rights just becomes very easy and when it's very easy it's very tempting to do it's very tempting to come up with justifications for why governments need to be doing it that turn into propaganda but we should really consider here the long arc of history privacy is the historical default it's only digital systems deployed in this kind of totalitarian surveillance fashion that have changed that equilibrium also privacy is hard especially usable

privacy is hard so you know of course these aren't blockchains but here's some examples i know my my father who i love very much always wrote his passwords on post-it notes and stuck them to the front of the screen luckily we lived in a remote oregon in a place where that was pretty unlikely you know someone was pretty unlikely to see that but if you run around with your laptop you know you open your laptop posted notes on your screen someone's got their phone with their camera going by oops right so um if you lock your bike to yeah that post not going to work so well etc etc so privacy is hard and in order for it to work in practice privacy has to be combined with usability in a way such that not only is the technology capable of delivering the privacy guarantees in

theory but also the use of the technology delivers them for people in practice now i wanted to talk a little bit about the state of privacy in blockchains so so far at least as far as i'm aware users have had two choices which i kind of demonstrated in my expositional questions here when they wanted privacy the first choice is to use a sovereign chain which reissues assets generally all assets or a specific asset which the only asset you can use so zcash ironfish right both fall into this category where you can use zcash and get privacy but you have to use zac the other choice available has been some sort of privacy preserving solution built on a smart contract chain so tornado cache aztec some other solutions in ethereum fall

into this category and both options at least seems to me come with some pretty serious trade-offs um if you use a sovereign chain which reissues assets you may not necessarily have the asset that you want to spend privately you know zcash amazing project but the monetary economics of zack are not necessarily suited to like paying people for coffee right doing regular everyday transactions and these other kinds of like more you know exchange-related transactions for which you really want privacy because they convey essential data about your purchase habits so we say um privacy preserving solutions built on smart contract trains are usually more flexible with regards to assets but because they have to be built on a smart contract chain they tend to be more expensive to use they require longer latency times and the privacy guarantees

are not generally as strong because just like it's difficult to build something that's compatible and fast and cheap at once so users including like me and acideliax want simple understandable privacy they want it for any asset they want fast and cheap settlements they want strong security guarantees these users man they want everything they just like don't compromise but can we provide that so we're working on a blockchain called numata which aims to kind of synthesize across these trade-offs so nemata is a sovereign proof-of-stake blockchain uses tendermint to bft consensus it has something called cubic slashing which i'll talk about in a bit to discourage validator centralization it has a native trustless ethereum bridge it is focused exclusively on enabling

multi-asset private transfers for any asset and accordingly it treats privacy as a public good let me spell out what all of that means so naman's key feature is something called the multi-asset shielder pool the multi-asset shielded pool is an extension of the sapling a lineage of circuits originally developed by the electric coin company for zcash that extends sapling to be acid agnostic so that in one shielded pool you can transact privately with both fungible and non-fungible tokens and we've crafted also the sort of implementation architecture for web assembly proofs that can be crafted or written authored approved in browsers and mobile devices and the usual sort of set of additional keys for selective disclosure of particular transactions without compromising all of your transaction

history so the key feature of the multi-asset shield pool is that privacy is additive so if you use many different assets different users can be using different assets the model doesn't care they can be using eth ustt etc cryptokitties nft is all in the same shielded pool and the more assets that are used in that shielded pool because when you send a transaction it doesn't reveal which asset was sent the more privacy everybody gets but we don't think that's enough uh privacy is a public good in that if you use a system if you use a shielded pool not only do you like get some privacy for your own individual transaction by doing so um but you give more privacy to everyone else who's using the same shielded pull so we've come up with a system called burn mint which

creates a kind of incentive for privacy while allowing the interactions to remain completely private where when users deposit assets synthesis fielder pool they get a kind of uh boy i stray away from the term yield because it's a bit nebulous but uh they get they get a kind of you could call this a like public good subsidy right or privacy yield for putting assets in the shielded pool there's no risk involved it's just like this this is intended as a positive nudge right if you're considering sending a transaction and maybe you don't care about privacy but if you send it in the shielded pool you're creating privacy for other people so we want a way to like capture a little bit of that value that you're creating for other people and pay it back to you to give you a reason to do that so burn a mint accomplishes that

right uh security so if you look at many proof of stake networks right now uh you observe a pretty concerning power law in stake distributions i.e proof of stake is centralizing so this is a snapshot of the cosmos blockchain top seven validators taken this morning from a block explorer and you see that the key threshold in bft networks is two is one-third right more than one-third of participants can compromise safety or liveness and you see here that the number of participants required to reach more than a third is seven out of 150 validators it's seven oops not great um so why um one reason i think is that current proof of stake incentive schemes do not reflect the risk the network of validator centralization right if we could find a way to price that in then

there would be some reason for validators not to have such a steep power law of stake distributions so how do we do this in namado we implement something called cubic slashing cubic slashing attempts to punish correlated faults because the more correlated the faults are the more the risk uh is to the safety and the safety and liveness of the network right so with cubic slashing when infractions are detected uh instead of just like slashing individual infractions the network kind of keeps infractions for a period of time and figures out how many infractions and what total stake associated to those infractions happened within a particular period then the amount of slash is proportional to the cube of the total voting power involved so this means that even if you if you try and split up your validators to get

around this if you set up all your validators with the same setup and they get slashed at once you get punished as if they were one big validator so the idea is that this creates a kind of anti-correlation incentive that maybe they're still you know maybe there's still binance right but at least now binance has some reason to split up its validators and run them in different jurisdictions and use different software stacks so they're unlikely to be slashed all at once and this does provide better security and practice to the network right so uh another important factor for security especially uh for chains as stomata is which do not want to reissue assets uh is bridges and the word bridge used to mean something specific and now it kind of means something very general uh there are things called optimistic bridges uh you know i'm just an old uh

cranky old guy but i don't know her optimistic bridge is really bridges kind of something else um with nevada's bridge we try and avoid additional security assumptions so we do this in particular by making the validators do extra work right got some validators that are getting paid might as well make them do extra work in a mono we make the validators run ethereum full nodes and this allows us to have a kind of trustless bridge where on ethereum we have a light client for pneumata on nemata nomada validators run ethereum full nodes so if you're using this you don't you have just the same security as you would using only nomada but you can bridge all of your assets from ethereum another thing we add to the bridge is the kind of defense and depth so many bridges you know you see like lots of publicized

blitz bridge hacks xxx million and basically all of these could have been prevented even without architectural changes to the bridges if they just had a little bit of defense in depth i.e limits like no more than a hundred thousand dollars per hour it does not seem super hard um but uh of course costs extra gas extra implementation work but we think this is important so for the modest bridge we have limits on deposits and limits on transfer throughput and defense and depth changes the value of attacking a bridge so it also like greatly improves the sort of practical security attackers will go somewhere else i think i'm probably running out of time so i'll finish this up quickly uh in case you're interested in nevada we have already a private test net running

contact me if you'd like information and hopefully we'll be able to provide some privacy with better ux in a few months later this year thank you very much and maybe i have time for one question on the berlin mint how do you cover the return leg so when you have to mint back on the original taint chain how do you make that the original token or is that a bridge right uh so burn mint is a function that runs purely on namata it's independent from the bridge uh the bridge nemata uses to ethereum and two other chains uh the bridges are based on the ibc sort of token transfer system so escrow does anyone has more questions

no yes that's all then thank you [Applause]