DAPPCON 2018: Practical Privacy: Why Does Privacy Matter and How .... - Lucas Vogelsang (Centrifuge)

Transcript

hello everyone as Nadia introduced me very kindly my name is Lucas I work at centrifuge I'm based in New York but very frequently here in Berlin I'm very happy to talk to you today about privacy before I start I'll give you a very quick introduction about what centrifuge does we'll be referring to what we're doing a little bit essentially we're building an operating system for companies to use to transact between among each other to use theorem for the decentralized and trustless communication what does that mean precisely it means that I can send documents and receive documents such as invoices payment notifications ship

purchase orders through our network without relying on a central entity we do that with etherium and we have our custom peer-to-peer protocol that is based on the p2p that is doing all of the privacy the the heavy lifting in the privacy so this talk is about privacy so I'll start with a very basic introduction the definition of privacy is that it's a state or condition of being free from being observed or disturbed by other people what does that mean for us as engineers and building DAPs it means for me it means that whenever we're building something we should focus on forcing the user to reveal as little information about

whatever they're trying to do as possible so if you can do something without sharing who you are then make them to do it without sharing who they are well Matt Green inventor of Z cash used this on a slide recently he said well like bitcoin is like Twitter for your bank account well what does that mean for us i working with aetherium is it Twitter for everything else it's a Twitter for your life everything you do well let's hope not and let's see how we can actually avoid ending up that way I could go on about why privacy is important all day for you to death but I just want to give you two quick examples to show sort of like how privacy

actually matters for Google and how what works looking about example number one Joe is using coinbase to fund his aetherium wallets that he then uses to trade Kitty's read them sell them but he also uses them to to participate in discussion and fund fun political causes that might not always align with whatever his employer thinks well this is all good and fine like his coin base is keeping his information private he financed he he fun Suzie theorem wallets with his bank account but well a few years down the road coin base gets hacked and now suddenly everything that is where was private is

now public including his contributions to those political causes and well good luck for Joe finding a new job with that information I out in the open example number two Carla wants to go on vacation she has had a very tough month and work and decides to splurge on a five-star hotel and treat her to something she buys a she makes a reservation on this decentralized travel site well she hasn't booked her flight yet so after she pre made that expensive hotel reservation she heads back to kayak and wants to book her flight it turns out that her fights only is 50% more expensive because kayak saw that

she bought an expensive hotel room and now thinks that well she probably can afford to pay much more for her flight than she she actually would have to if kayak didn't know this information so let's get into how well let's talk about privacy and what we what is going on in he's hearing right now well selling cats is kind of a thing people do and it's kind of fun but it's actually not really that important and also not that urgent but though the value of eath is something that people talk about a lot it's also not that important but we have important stuff going on such as how we can make our smart contracts safer so people don't lose money or ethos and get locked up stuff like that we definitely have this giant burning

thing that is scalability that we all need to figure out for ëthere IAM and apps to be to become popular to actually like work it for everyone but there's also this thing privacy that is sort of off the radar I would say right now because well I agree we need to scale to solve scalability first but once we do that for real-world usage that's something beyond just trading kiddies privacy is going to come very quickly so let's make sure we do not miss the train on that and actually like to start thinking about that now at centrifuge we want to build and we're working with companies so they will be from they want asking us about privacy so we've designed our protocol with that in mind we're not no

no it's it's that's funny so we we we built this we built our protocol with zero metadata leakage and zero like requirements for actually revealing anything on chain we use sort of a two layered architecture we use etherium for identities and anchors anchors is what we call our commitments of the states that have that is off chain a theorem as you know is public go it has a global consensus which makes it really safe but because of that it's expensive and the downside is also that it's public channels sort of our layer two solutions where we sort of use channels and state

channels in the dock for document exchange it's private it's scalable it has a high throughput and it allows us both to like achieve scalability and privacy I'll go into a little bit of detail but looking at like what is the difference between those two blockchain consensus you essentially publish your transaction everyone can Val verified but and therefore you have a high likelihood that it's that is respected by everyone but it's also public to everyone state channels you only really go on saying when you have to so either to settle certain things that have been have been coordinated in a state channel or if you have a dispute if the if the

two parties or one of the party in a channel is not not behaving the way they're supposed to this moves all of the data the heavy lifting Chane and gives you the security sort of as a last resort to use on Shane as a courthouse if you can't come to an agreement between just the members of the channel how do we use this well I mentioned lit p2p in the p2p is really cool utility it's actually built by the guys at protocol labs it it powers ipfs they're distributed file system it's a it's a framework that lets you build apps that talk to each other over a peer-to-peer network quite easily and it

takes care of all these nasty things you as an engineer you really don't want to learn about know about which is like such as natural like discovering other peers protocol translation etc it also has is one feature that for us is quite important it has a security layer that is very similar to SSL TLS which basically allows you to ensure that whoever you're talking to really is who they're talking to by verifying that they that they possess the private key to a public key and I've mentioned that we keep our identities at centrifuge on chain so imagine Alice and Bob wanting to interact with each other they announced on aetherium this is the public key that I'm using you can find

me on the p2p with that key and now when they want to talk to each other Alice just needs to verify the Bob signs the initiates a connection with the Rye key and and vice-versa so this gives us a way to like secure this this often communication quite easily the other thing that we do in the p2p and that we then post we theorem are these sort of state commitments we call those anchors where essentially what you do is you hash the this the state and you commit that hash on chain so that one later on you can prove that that was what was agreed upon that was the the state that you had by revealing sort of the preimage of that hash now let's dig

a little bit deeper into anchors but for that I just need to give the obligatory explanation of what a miracle tree is a miracle tree is really good at having large sets of data with improving that a certain element is part of that set Merkle trees are used in every block chain for at least one thing it for example you can prove that your transaction was included in a block by submitting the miracle tree that shows that this item is part of this miracle route that's part of the block header but we use it actually for something slightly different in the end it's we're still using a miracle tree but what we're doing is well if you look at an invoice for example it has certain fields such as the amount the buyer the

supplier the due date etc but what we do now is we construct this Merkel tree not just out of different and a number of different invoices but we take each field of that invoice we flatten it into a flat structure and we created a miracle tree out of that that allows you to reveal to share then or to prove that a certain value of that invoice is whatever it is by submitting a miracle proof for that field and this is then what we anchor on chain those are our state commitments so I've shown this graph before but to summarize again like instead of putting invoice items we actually make this tree bigger we have each individual field of the invoice

that you can then say I just want to show you who the supplier is of this invoice and what the amount is without telling you any of the line items or like the information that I want to keep private we call that precise proofs we've published a little bit of open source code on this that you can find on github to summarize it's we what we do with precise proofs is we actually allow you to validate transaction details instead of just a transaction signature in a larger block so feel free to check it out centrifuge on github you'll find it now that I've sort of talked a bit about how we keep state off chain and how we allow different entities or how you can how

you can build something that allows different entities to communicate well there's certain certain times where you want to go on chain and you actually want to have an interaction with a different DAP or like a decentralized exchange or whatnot so you have to start building bridges that let you improve something for that is has existed only off chain and sort of interact with it on chain and now I'll give you one example we have n ft s I hope everyone's familiar with those and if these are non functional tokens that you can sort of mint out of whatever you want and then you can trade those and sell those in a standardized way in in the supply chain world it's very common

for companies to borrow money between the time that they submit an invoice to their customer and the time that is actually do so for those 30 60 90 days and they would go to banks today but there's actually no reason why we couldn't do that with sort of a a supply chain finance tap on etherium well what we as a supplier I don't want to reveal the the business I have on chain right but I would want to create an NF T that I can then sell well we can use those precise proofs that I've mentioned so that the NFT registry can list a set of fields that they want to verify as an example i want to verify that this invoice has been accepted that it's been that it serve a certain amount etcetera i so as a supplier I would submit that

proof I prove that I'm one of the owners of that document meaning I am the supplier that NFT registry can then verify the precise proof by going to those anchors that I've mentioned and then can mint that token and now I as a supplier I can sell that token and receive financing for an invoice without having to actually interact with the bank and that bank knows that this NFT is backed by something that they that they can then later on verify by themselves going into the peer-to-peer network and requesting that document so this is one of those bridges another bridge different example again using the invoice as an example let's say I'm

shipping something from Germany to New York I this is a very important big order for me and I need to make sure that it arrives on time and it arrives not damaged and if it gets lost that I get redeemed for it because I will I will go out of business if I don't well so you would go to an insurance company and you would submit the information of what you're trying to ensure they would keep that data probably in some of their archaic si P system or like database said who knows what will happen to it and then you and then give you a price you pay it and then you're done with it you could also go to this insurance tab that is not privacy enabled you could submit all of those details publicly and

the insurance tab could verify itself or give you a price itself and make you pay that price and then you could insure it but actually what you can do is you can use also you can use your knowledge proofs to to do that in a way without revealing anything about the invoice at all so I'll try to explain snarks in 30 seconds basically the idea is that you can you can prove something the the correctness of a calculation or the correctness of certain statements without revealing what the values of those statements are so for example I can prove to you that the invoice is the origination address is in Germany and the destination is the United States

that the value is of a thousand dollars and that the output of the snark for example in this example it would be the the insurance amount is two percent of the invoice amount because the price to ensure an item from Germany to the US according to the list that the insurance contract gives me is two percent so I can create this narc that anyone can verify that I've made this correct calculation that gives gives gives an output that says okay this the insurance price is two percent of a thousand of a transit area is is 20 dollars it doesn't say two percent it just says it's 20 dollars what what is behind it all of

the information I have to said the country the amount and the percentage that is completely unknown but as at the insurance contract and anyone else for that matter can verify that this was a valid calculation of of an insurance or an insurance fee so what I can do is I can take this I can create this narc I prove this norik as a supplier I take that along with the payment of those twenty dollars made that through the insurance contract that insurance contract verifies it verifies that there's a there exists a hash on chain of this document that I've I've just proven I've used to I've requested insurance for and by verifying that snarky can't just say well I accept your payment of $20 I don't know exactly

what you're doing where you're shipping it from where you're shipping it to but I know that you've given me the right price for whatever it is thus being able to sort it to certify that I have insurance now and then allowing me to claim in case of damage without actually knowing anything at all so those are like two of the examples that we use sort of to build bridges between our off chain and on chain protocol I hope this was a bit of an insight and some idea that gives you ideas for how you could incorporate some of these technologies into your own product but to summarize there's always this on chain off chain trade-off on chain extremely secure

public and you have this global state so you can make sure that something is unique but it's expensive and it's very hard to do privacy however if you want to scale you want your sum at some sooner or later force to move off chain or in some sort of side chain anyway so that usually plays velvetescape with privacy because if you move stuff off chain you can also make them private very easily global consensus is not always needed in our example as supplier and they buyer they don't care about whatever the thousand other thousands of other theorem notes that are validating the chain care about their transactions as long as I know that Alice has signed my invoice I'm fine so it's actually not

always needed think about how you can how we can look at these problems in a way that you don't need to just assume that there's a global verification also the examples I've mentioned this is something we're working on right now and say the technology is already there look at lit p2p look at Socrates on a theorem that lets you create snarks for and validate those and/or verify those and our contracts I then much more is to come but I'd encourage you to think about it that way and lastly if you're designing a protocol if you're designing an application it's a lot easier to make sure that it has privacy from day one than if you're trying to take something

that is public and you try to tack on privacy with some sort of extra stuff so that's it thank you for listening you can find me on Twitter you can email me this is our website I love to talk about privacy so reach out to me or