DAPPCON 2019: Multi-Sig Transactions with NFC Smart Cards - P. Grassberger & D. Hofer (lab10)

Transcript

okay welcome to the talk when smart cards meet smart contracts we're going to show two demos today and we're going to hope that the internet connection works and then we have some time hopefully for Q&A afterwards so first to introduce ourselves this is my colleague TD and I'm Peter and we're both co-founders and developers at leptin collective we decentralized cooperative with 40 members most of us are in Graz in Austria but we have some some other

colleagues distributed in in Austria as well so if you're in the neighborhood come to visit us yeah so as a cooperative we have a vision for society so we always said we want a free and fair society but recently we've reshaped our vision and now are working for a zero carbon society and we want to use the blockchain to do that we ourselves also initiated a Furion sidechain that's not using proof of work and we started a year ago it's called artists so to give

you an overview for our demo we have setup here we've created or we developing a card a card mini our card this is a smart card like this one here this is like a prototype for now and it's an NFC card so you can scan it with an NFC reader or in the future are also with your smartphone and it has a high security chip in it by infinium so this chip can sign blockchain sangjun's on on the card itself and so for that the keys are on this card the

private keys and they're generated on the card itself and can never can never be extracted so you're safe there with your private keys yeah I really said you can sign here in transactions with that yeah so let's move so it started with a project we named calculate Camus C which in German would be kinda it kind of music and in English it would be no money no music this was done in the context of hackathon conducted by

Infineon early this year the ingredients are an old school record player which you can see here it's portable which is convenient some great Austrian music and a Raspberry Pi which controls a power socket and talks to the artists book chain it's a rather high-risk demo because it's pretty complex but let's see if it works in Berlin yeah great let's tune it back so what happened now is when the reader detects

the card it it signs a transaction so what's happening here is we are using an AC 20 token which is basically streamed from from the car to the let's say operator of the player and as long as this stream is ongoing the music is playing and we are using tokens which were minted on a theorem in 2017 in the context of art projects the so-called play tokens we moved them to artists via token bridge and an artist they became a streaming token this is a token which

implements your C 20 plus EP 2100 which is our proposal for the interface of such a streaming token and when I removed the card it should broadcast the transaction for stopping the stream and yeah that worked too so that was the first demo and what we did next was so after this project which was more about fun and about getting hands on we thought about what what would be interesting more interesting things to do with this card and we we decided that you know is safe system is

pretty interesting and and thinks we could combine out of that and just a brief intro for those who are not familiar with it at its core it's a smart contract based multi-sig mature wallet which was designed and developed with great care by kenosis formally verified etc and it also has a module system which allows to build interesting things for example it will be possible to to make more granular policies for how the different owners can operate the wallet our colleague

Thomas Halloran in his magician costume here he couldn't make it to the Epcon but he was like the lead developer of this project it was funded by a gecko grant we applied for rather last minute but we applied for a small amount and we're going to show a video for this one okay I'm just going to try to narrate

over it okay um we have a laptop with an NFC card reader and we have several cards and the first one we can use to deploy save so the card signs a transaction and deploys a save and then you can add different cards as a more t6o so you need two of three cards to sign a transaction and by laying the card on the NFC reader you can read out the address so this is like the second card and the third card these are our NMR theme so cat the dog and my keys so

now it's free cards register it for the save and then you can confirm this transaction with the initial card you used to deploy this and also save so and then you can make transactions from other you first you need to fund this safe so we have another account or another card that we put on this card reader to to transfer funds to this safe so now it's it's funded with one 80s and the next step is to transfer some coins

to another account so we scan another card read out the address and then it says okay we need to collect signatures to make this transaction so we as I already mentioned we only need two or three cards so we're going to take one out of the deck of three cards and just use the attitude to sign this transaction so we're using this monkey card here as the first one and the dark card is the second one and then we have two out of three signatures and we need to finish that off with again this initial card we used to set

up the safe with yeah that was the demo and then you can start over and found it again and yeah okay this is our presentation so we I hope you have a bit time left for some questions if you want to go into technical details otherwise we have our contact details over there and also you can check out our projects and get up so are there any questions sorry to do with what aha well this

project not directly regarding government 3-1-1 less than when were series project we are now focusing on is setting up a fund which allows to which basically combines the idea of offsetting carbon with investing in PV installations and what we try to do there is using the blockchain to facilitate the process for example to oh we will start with with crypto assets oh well somebody can easily pain some crypto so we start by doing it ourselves we have a policy now that also lights done by lap time members need to be

offset by the system we are using the eye for a start and and we also want to use it to make it as bronze as transparent as possible because that's often an issue with with the assistance transparency and we are was looking into systems like like the comments style stack and there's a lot a lot of emergent components and we're trying to somehow compose those in ways which make it easier to achieve such things that's one example which has is more like directly connected to this vision then that's another country the card is most

about reducing the Android battery system because a big problem still for most outside of the crypto community is to handle keys in the first place and that's very convenient with the card as long as you physically have the card you have the key you are don't need to worry about it being stolen because it can't be extracted so that's in a way a component which makes it easier to access ecosystem exactly yes yes that's something we went did with many of the

demo cards we put the QR code of the address that's often easier than scanning it with an MC yeah and the gravity so the broad key is generated on the card remains there and yeah and there's also a signature counter so even if somebody would use it to assign something in between that could also be detected that's some magic which Infineon knows I am NOT people into this they told us that it's comparable to the to the chips they are using in passports and there's pretty strict regulations

around it so I don't really know in depth details about that but the idea is that it's it should be as hard as possible to to get to this key and we even when we discussed possible extensions to the interface at several points I said no we don't want to do that because that may increase the risk that an attacker may figure out how the secrets work and then be able to extract the key that's you can there's also an option to to insert a seat for from the outside to generate the key so you can put random

data from the outside yeah but still through the card needs to do dum-dum-dum random number generation if you're interested there is a pretty extensive user manual online on just look for Infineon blockchain on github I guess that covers I'm not familiar with the details there so so far I'm trusting that but before we will actually release something we will for sure also dig into that more did you think about any like real life use cases for this multi signature scheme with the card yes I

mean we're still in that's any brainstorming phase I think that one strength of this combination of the card with with the myristic with the ignosi safe is that you can have the convenience of the card where so at first side you could say okay if you can't extract the key that means you can't backup it and the great thing is if you combine that with you know see save then you could build it in a way that even if you lose a card you don't lose completely lose access to the fan so you have a lot of freedom how to build recovery for that so I think that's one interesting use case I think another interesting use case could be to

something like notaries where today's I experienced that if you have a multi shareholder company with the shareholders being in different countries there are still often paper being sent around and complicated and expensive and that could also be something where maybe this could help to make that easier and cheaper sorry the first use case ain't notice you mean the first demo the second I would say they liked

it so yeah it was I mean this this was the clear inside up as an MVP and it was also rather one of the or I think the smallest project in this round but the feedback was positive so future use cases obvious obviously would use a smartphone and other card reader you have to carry around with you and so there's this potential for for more use cases I think they were impressed and funded us so but you have to ask notice about future but we're good we're happy to apply for more grants and do more use cases and if there's if there's no more

time or no more questions you can use afterwards and also try it yourself [Applause]