Private and Permissionless Systems without Black Hats

Transcript

thank you hi I'm diamond starshak and I am with olive zero I would like to talk about privacy on blockchain and specifically about one particular challenge that all the Privacy systems are kind of facing and it's the challenge of Bad actors essentially using this kind of private systems to launder money and that's what this talk is about so let me first try to explain what's the deal about privacy on blockchains so some people might say well

blockchains are already private right so I just have some pseudo-random account which looks like a random sequence of numbers and nobody knows that's that's me and well that is kind of correct right so blockchains are pseudonymous and uh yeah this is this is actually a good property but of course it doesn't give you privacy really so consider this scenario where Alice has an account and she is doing many kind of kinds of transactions like uh she's transferring some money she is taking her tokens she's swapping the tokens like or a

bunch of transactions but then at some point she decides to transfer some money to Bob her friend okay so well what's the issue the issue is that Bob can see the whole history of Alice's transactions right and you might say okay it's just Bob right uh at least it's maybe a good friend of alysses Alice might not have any uh anything to hide from Bob but uh well that's not uh not not a good argument because there are many other entities watching they're observing the blockchain all the time and extracting information and extracting value out of this information

right so these are the entities that we would like to we would like to secure the user from um well so you might say okay so here is a simple solution Alice might do just a simple trick right uh instead of sending the transfer to Bob directly from from her main account she could just well send the funds to a temporary account and then to Bob okay so then Bob doesn't quite see the whole history and well is it already private and the answer is not quiet so this is a very simple trick and the kind of

entities that are interested in your in your information uh your history of transactions they know these tricks right they they can easily bypass it they have like a complicated Machinery running all the time to detect these patterns and they will be like they will know what you're doing so this is not something that you you that will that will save you right um but what are we trying to do here actually so here is some kind of uh intuition what is the goal here we are trying to break the link uh we are trying to break the link between the two accounts that Alice

wants to use so previously Alice just sent some funds from one account to another and expected that there will be no one who will be able to tell that the both the account accounts are alices right and this is exactly what we want to achieve we want to break the link between the two accounts so that nobody will be able to tell that this is one entity behind both okay um awesome so how to do that well there is one well-known solution to this problem actually and it's working and it's to send the funds to a third party

okay and then ask the third party to give you the funds back but on a different account so who is this third party typically it's a centralized exchange or some such entity right which is an entity that well you can trust but it might hurt you right so maybe it is not an ideal solution to the problem that we have at hand um right so how to solve the problem in a different way well just use the moon map right and this is what you have probably seen already uh you can build this kind of anonymity pool this is uh how I will

call them today um which are essentially some kind of containers for users tokens and the way to build them is using cryptography and in particular CK snarks and this kind of zero knowledge proof technology and the way it works is at least deposits on tokens to the anonymity pool and then after some time which is kind of important she cannot just withdraw immediately she withdraws to a different account and because of this magic of your knowledge proofs no one is able to link their two

accounts and this is essentially how all these privacy protocols work uh of course the like certain differences uh whether you can transact inside of the anonymity pool or not like these are the main differences but tornado Aztec they're all very similar to that they all match this this kind of a pattern right to gain uh privacy um awesome so in this talk sadly I will not explain snacks I will not explain the moon map because I think there are like excellent resources on that already which have been created over the last two three years like you can take a look

at the moocs specifically the blockchain mock the zkp mooc on YouTube and they are really excellent for learning all these things um great so now the question you might ask is okay so let's say we can do that we can break the link is this already giving us privacy and um my answer would be kind of it gives us anonymity which is basically the ability to send many transactions and without the outside Observer being able to link the transactions together

but note that the transactions are still public right that the contents of the transactions are public in particular the values and so on right so actually in the previous talk this was also mentioned and there was a term shielding and privacy right and this is the same thing I just called it anonymity and privacy but the concept is the same so I will not talk about privacy like the full privacy today I will only talk about anonymity but obviously privacy is also important and it's also something we work on great so well I just try to explain why privacy is good and why I want it but here is the reason to kind of have some

doubts like what we have observed over the years of of such protocols existing is there are some problems with them as well and most notably tornado cash has been used for laundering money and well this is not something that we want right so ideally we would like to let the legit users right to use the system to use the anonymity pool and kind of don't let blackheads the Bad actors in and yeah this sounds tricky and it is tricky um so yeah I will talk a little bit about that today

and uh essentially I would like to give you some kind of a survey what is known about this problems what are the known approaches uh what works what doesn't and so on so that we we have some we gain some understanding about this problem uh great uh so the first idea here would be to use a trick called voluntary reveal right so what we will do is allow a lease to generate generate a specific cryptographic key upon withdrawal from the pool which allows any party that has access to this key to

see the link okay to see that Alice used this account to deposit and then use the other account to withdraw okay so this is kind of useful uh when it comes to some audits like Alice wants to prove the source of funds and she can just reveal selectively to someone who she trusts right so this is some kind of a way to let Alice keep her data keep ownership of her data and let her do what she wants the bad part of of this idea is that well I guess whether blackheads will reveal or not

um well you guessed right they will not there is nothing that forces them to reveal so they will they will just keep the information private so this is not really helping us with this particular problem so let's try another idea which is known as proof of Innocence um so this is the variant on on deposit so the way it works is we have some kind of a blacklist maintaining this Blacklist is kind of a challenge but let's let's forget about it for a moment and upon depositing the funds Alice goes through a blacklist I mean the contract

essentially checks The Blacklist whether alysses account is is there and if it is there it doesn't allow Alice to join um and then well when she wants to withdraw she just withdrawals normally and yeah if you think a little bit about it then you can kind of realize very quickly that it's actually stupid because what the Blackheart will do uh it will just right before deposit it will just send the funds to a fresh account and and just deposit from this account so it's like uh it's not helping much uh and and this is not a good solution

another idea is to do a similar thing but on withdraw okay it's a proof of Innocence so now instead of doing this and on deposit you do this check on withdrawal so um the the when you are withdrawing your account from you from which you deposited like this is kind of important and this is the first account the deposit account is checked Against The Blacklist if it's there you cannot withdraw um and well this is a little bit different it works a little bit better because like the reason is that now the black hat cannot really wait forever for

withdrawing right and they are kind of forced to withdraw it very quickly and yeah it's it's kind of annoying um right so is this a good solution um well I would say it has some good properties it is not solving the problem right away but yeah it gives some hope right we might use it to to do something good okay so what's the problems like one problem is that this Blacklist needs to be updated very frequently so for instance what if not then the black cat could just deposit and

withdraw right away which is maybe not great for privacy but still it's kind of annoying that you can even do that because yeah his account might not be on The Blacklist yet when he is withdrawing and there are many other annoyances that like maybe the the the black hat might roll us and split the funds into like thousands of accounts and then deposit it's kind of annoying to maintain The Blacklist um right so here is another idea uh volume limiting and this is essentially saying we make the Restriction that each

account is allowed to deposit only up to a particular amount let's say 10K USD and well this sounds good actually because this is a way to because blackheads will come with like a large amount of money they will come with Millions not not 10K and normal users they will probably come with 10K maybe 20K something small right so this is uh looking like it works for regular users and doesn't work for black hats but obviously this doesn't work either because black hats are smart right they will just create thousands of accounts and split the Hacked funds into

into them and so this is this is doing nothing essentially so the good part is nothing but it's annoying and it doesn't work right so it's it's pretty bad but maybe we can do something using the same idea but be a little bit smarter so suppose we had such a nice kind of an ID system which has some IDs whatever it could be and each ID has some allowance for depositing into the anonymity pool this allowance could be I don't know for a month or whatever like this is this is not the point uh suppose like we have such a thing

and what we could do is then let the user upon deposit reference to its own ID privately okay so no one is able to see what id is this user depositing with um and this deposit would also include a check for allowance okay so if this user if this user is above its allowance it will not pass okay so well this looks kind of good um the ID is never revealed publicly and for this reason the uh yeah the the different deposits from the same user

are unlinkable um well the issue here of course is is this ID system how do we get this right so this is essentially a civil protection thing the way we solve simple protection in blockchain is proof of stake right but this doesn't work for blackheads uh it doesn't work at all because they have a lot of tokens and we need a different way to solve simple protection and not using tokens right so this is an ID system that is not based on wealth it must be based on something else maybe some kind of reputation maybe some kind of proof of original funds maybe I would

say the cursed word kyc um like there are many different possibilities here and the good thing is that all these all these ideas all this uh all these sources of IDs can be kind of combined into one system not sure how to then pick the allowances and so on like this is very tricky but yeah there is some hope maybe that this can be made work uh great so what are the challenges here uh it's essentially what I just said um that it's not clear how to make this like how to create such ID system and then uh if we create such a aggregated

system merge out of a couple of components then well the truth is that the system is as good as its weakest component okay so if there is a you know like a fishy ID provider then well you can pass on to some like shade users and it's no good um also like that is always this problem that maybe the blackheads will then buy some IDs just to get into the anonymity pool which is uh annoying but well possible um of course like this also affects the user experience um well you need an ID to to be private of course this is annoying and from the

technical perspective you need to like upon a transaction upon deposit you always need to create this zero knowledge proofs to compute the the smart proofs and if we add like another component to the system like an ID system this will be obviously more complicated and if this is more complicated the proof is taking long longer to compute and even now Computing the proofs in the browser is kind of a pain so like there are many challenges here but yeah it there is some hope with with this idea so well so here's the conclusion like we have a couple of ideas um for countering black hats like there

is no Magic Bullet and this is something that uh that has to be admitted there are many different ideas each of them has some something new to bring but neither of them solves the problem right away right so we need to combine them we need to find something like a combination of these ideas um to make the system mass user friendly as possible and not allow blackouts so to make it blackheads unfriendly right this is what we are doing in another zero in a project called liminal which is a privacy framework on on lf0 and as I mentioned like what I talked about

today is anonymity there is also this another layer uh privacy which is built on top and it tries to make the transaction content also private which we work on using multi-party competition and that's it for today thanks for listening [Applause] yes uh yeah thank you are you talking with Regulators as well because it's all very nice in the end but you know that even if you worked very hard in doing

something that could be compliant you have to control about on the decisions that are made and you can be flagged as a like money laundering yeah so that's an excellent question and the answer is yes we do work with Regulators we have lawyers and talk to them so essentially the issue here is that if you ask the lawyer whether tornado cash is compliant they they would answer you yes of course it is compliant and it's because the law is not quite precise on that there is lots of issue a lot of um lots of um questions about like how to interpret the law uh yeah the situation is not

super clear that that that's something I can say it also it depends on the jurisdictions so it's different in Switzerland it's different in the US it's different in in other jurisdictions and yeah that that's that's a a big Challenge and yeah every privacy privacy system is essentially facing this challenge any other questions no seems we are Goods thank you awesome thank you