DappCon 2023: The Future of Privacy and Proof of Innocence - Ekrem Bal

Transcript

okay hello everyone um today I'm going to talk about the future of privacy and proof of Innocence to start who am I I am ekram one of the co-founders at chainway and I'm also leading the development of proof of innocence and private po version one you can find my socials it all so chainway we our blockchain infrastructure company focused on bitcoin ethereum and zero knowledge technology here you can see my co-founders orun Asad mad and me so why privacy is important on

blockchains actually there are a lot of reasons I will state two of them one of it is security because in ethereum and every other blockchains generally every transactions are are public meaning that people can de anonymize you if they interact with you and this could lead to targeted attacks or scams even though you think that you're using Hardware wallets using a lot of encryption you can be beaten to until you give your private key another important reason is user adoption because there is this

thing called chilling effect when on public blockchains whenever you're going to do a transaction you think twice because it will stay on the blockchain forever no matter what you do so we need privacy for user adoption okay so what's Tornado cache tornado cache is one of the most po popular privacy protocol on ethereum it is a smart contract where you deposit to tornado cache wait some amount of time and withdraw after that

with a new Fresh address with using zero knowledge technology this withdrawals cannot be linked with your deposits you break the link between your deposit and withdrawal and since you withdraw the new you address you become you gain some privacy it works like this as you can see alas B Eve deposited to the anonymity set we call this anonymity set because more people deposits meaning that you will gain more anonymity and as you can see on the right side withdrawals are just some addresses

without any link to deposit and since torado cach is a great priv priv protocol and used by a lot of people it has a big anonymity set that means it is used it also used by a lot of illicit accounts this is a report from chain analysis and as you can see there are a lot of deposits from sanctioned addresses stolen funds and also Central centralized exchanges so tornado cache has a problem you have to share the same anonymity set with everyone this can be defi hackers sanctioned addresses North Korean

hackers you have to share the same anonymity set okay maybe you have not you have not to share the same an set because Tado cach has a compliance tool which means that you put your Tado cach note over there here and it shows your deposit and withdrawal it links your deposit to withdrawal but you lose your whole privacy so this is meant to like give to centralized exchanges Banks but you have to trust them to not be share this compliance report because it breaks your anonymity so even though cash had this compliance tool it got sanctioned

by ofac so now us students cannot use tornado cache after the sanctions the usage of Tado cash has dropped a lot because people are scared that they will not use their withdrawal on centralized exchanges so after the sanctions we thought can privacy and compliance coexist and the answer is with proof of Innocence We Believe yes okay so what's proof of Innocence let's say there are three three deposits on tornado cash one from

Alice one from Bob and one from Eve let's say that if is publicly known hacker or illicit account since ethereum is public you can trace it before the deposit happens so let's say e is a North Korean hacker with proof of Innocence a withdrawal can also say that I am either Alis or Bob meaning that I'm not Eve so they proved their innocence so if everyone uses this as you can see the second withdrawal couldn't prove that they're not Eve meaning that they are Eve so we

can break the anonymity of Bad actors if everyone uses proof of Innocence so I'm going to get a little bit detail about technical details over here so whenever you do a deposit to a tornado cache your depos deposit is added to a Merkle tree as you can see there are six deposits so some deposits can be from illicit accounts these deposits can be linked with a public key to a leaf index let's say as you can see here deposit 2 and deposit 5 are known from Bad actors and let's say deposit 4 is your deposit whenever you do a withdrawal you

prove that you are inside the Merk tree meaning that you deposit it once there's also a nullifier to prevent double spending but you basically make a Zer knowledge proof that you're are inside the Merkle tree and give it to a Smart contract smart contract verifies this and gives you gives your deposit in a new Fresh address so for proof of Innocence you provide a zero knowledge proof of your specified inclusion Tre as you can see here this inclusion tree does not have deposit 2 and deposit 5 so if you if you prove that you are inside this tree you

also prove that you are not bad actor you are not those deposit two and deposit five there's also a point here that you should also share your inclusion tree leaves cuz since this is a Merkle tree only the root doesn't mean anything you also should share 1 3 4 six to whom you're sharing proof of Innocence okay I want to tell you about an analogy of about proof of Innocence imagine yourself at a private pool if someone pees in the pool people may wrongly assume it's

you with proof of Innocence you can vindicate yourself without disclosing your identity you're still Anonymous but you didn't pee inside the pool by applying game the we expect Bad actors to stay away from the pool because they will know they will be excluded from others so basically proof of Innocence gives you the ability to exclude yourself from list of deposits without revealing your whole identity it's just a tool on top of priv privacy protocols which make gives you more

ability you don't now you don't have to share the same Anonymous set with illicit accounts North Korean hackers defy hackers you can exclude them also shout out to private pools which is a tornado C tornado cache fork with built-in proof of Innocence okay so tornado cach and privac pools only works for same amount of deposit and withdrawals meaning that you can only deposit one E 10 e 100 e or .1 e and this means that uh we are human beings and we can sometimes have fingerprints so with like good her

sticks actually you can identify you can link some deposits to withdrawals so what's next next is having a privacy protocol with arbitrary amounts shielded transactions and buil in proof of Innocence meaning that you can deposit any amount you want inside the pool you can send some money to anyone else inside the pool and you can also prove your innocence by proof of innocence in this private pool means that your source of funds are from are not from a bad actor bad list we're working on two ongoing projects right now which is priv sports

version one which is basically a tornado NOA fork with buil-in proof of Innocence but it requires some recursive Zer knowledge Pro for inclusion sets and rail gun rail gun is already working privac protocols with like arbitrary amounts and shielded transactions and since it's already working adding proof of Innocence on top of rail gun is a challenge okay what's the biggest challenge let's say this green rectangle is the privac pool and Alice deposits two e Bob deposits three e and Eve which is a publicly known bad actor deposits seven 7 e so Bob wants to send two e to Alice since it's a shield transaction

Alice doesn't know the source of funds so Alice since Alice doesn't know the source of funds they can't use that because it can be from EU but also Bob doesn't want to reveal his identity when sending money privately because you duck yourself you don't want to do that so what's the solution Bob adds a proof of Innocence to the transaction meaning that hey Alice take this to e and you can be sure that this to e is not coming from Eve so now Alice knows that the money does not come from Eve and use it more confident also Alice can join these two

and make a withdrawal with four e also stating that this four e withdrawal is either from Bob or Alice and not from Eve so some more technical challenges here let's say Alice and Bob sends you money with a proof of Innocence Alice sends you one eth with the inclusion tree only including one three and four Alice removed deposit two and deposit five CU they're known to be from Eve which is a bad actor and let's say Bob sends you two e with proof of Innocence with an inclusion set that has

only three and four Bob removed two and five and also Bob removed one because he wants to be safe maybe so how we going to use these two inclusion sets and make a new inclusion set and also let's say when you're are withdrawing there are also new deposits let's say six and they're known to be safe and you want to include them as well so this is a hard challenge actually in technical side because you have to prove that your inclusion tree is a superet of these received two inclusion trees and the power of recursive zero knowledge proves you can prove that this your inclusion Tre is a super set of

this also there's another challenge with choosing your inclusion set because this privac Pro doesn't have three deposits they have thousands so you cannot choose by hand and decide if it's a bad actor or not so there will be intermediates which we call them Association set providers where they provide you your inclusion set your Association set one of the possible Association set providers can be automatically add every deposit to the inclusion set after 7even days to be sure and in that seven days if the deposit is connected connected to a known bad behavior this can be large

scale tfts sanctioned addresses and they can use some analysis from chain analysis JLS and Etc also check out wiic new paper which goes in deep of this associ Association set providers and privacy pools and hopefully to the Future where we find the Practical equilibrium between privacy and regulations thank you for [Applause] listening and any questions can you please elaborate on

the creation of the Privacy proof now the proof of Innocence I I don't understand how I can prove that I am on one um branch of the tree MH but not on one of the two leaves at the very end okay so you're asking how the the process of creating proof of Innocence Okay so this is the inclusion tree this is the inclusion tree that you want to prove that you are inside this tree right so

first you choose an inclusion tree create the tree and inside the zero knowledge circuit you prove that you are a valid leaf on that tree you give this Merkle path until the root and you provide that you know what leave and you have that leaf and this Leaf also is inside the original tree and you prove that you are inside the tree you also give the leaves of this inclusion tree meaning that a verifier can generate the inclusion tree locally calculate the inclusion tree route and

verify that your proof is proved according to that inclusion tree route so now they can be sure that you're inside that inclusion tree and they can see what's included I think I'm missing some Basics here I will come and ask later okay sure um and just want to verify my assumption my assumption is that proof of innocence is a a public thing so whereas um the original um compliance Tool uh you

shared it privately with an exchange or someone accepting your money and this is something that for example a block Explorer can report on is that correct it can be either public and private we like we think that for public proof Finance you provide a more abroad inclusion tree cuz if you make your inclusion tree smaller you lose some anonymity and whenever you're ruling your proof public you want to make inclusion Tre more bigger but for example if you're going to use a centralized exchange or a bank and they want another smaller inclusion tree to make sure that you are not a bad actor you can also rep proof and only send

that proof to decentralized exchange so that this can be both and okay and maybe second question to verify um this proof is always generated on withdrawal yeah so you never would like create a proof that when you when you deposit but maybe that doesn't even make sense yeah deposits are public you can see you can link link deposits with leaves but also in arbitrary amount Shield of transactions privacy protocols you also give proof of Innocence privately to whom you sent to so if I'm sending you money I also

provide you with a proof of Innocence so that you can trust the the money one question what if uh you deposit in the Shila pool and then you're not on a list or something and then you make this proof of Innocence sorry can can you repeat it sorry what if you deposit in a sha pool and you created this proof of Innocence because your address is on like no list and then you instantly trust like send it to someone else Shield it but you have this valid proof can you like it's not possible to make this utex o like okay black black this is right so you're

asking you deposit to a shielded pool and then you instantly send to someone else yeah okay so in that case you cannot add like you should add last s days deposits but what you can do is you add last seven days deposits and from the receiver after 7 days if last s days are safe they can also add that last seven days to the inclusion set and then go again thanks thank you yeah know thank you for for sharing

all of that uh can you put the slide about the miracle tree which Slide the miracle tree the proof of inclusion and so on oh the first ones or last ones yeah well it doesn't doesn't matter actually okay so um if so when when you want to prove that that transaction or or that um uh that entity is within that Merle tree uh the first question that I have is what do you do do if it is on different blocks or across time uh CU um it might not be within the same Miracle route right you don't want to have a huge one across time so do you keep an array of

all different uh roots of the miracle tree and prove it until maybe in the last uh day or week or what do you do to to uh because you're comparing it to the root of the tree and that might have been pasted uh if you decide to do it in different days so I'm not sure if I get your question correct but there is this Global merry that has been stored on chain and includes all deposits and in the shielded mode it also includes all transactions Shield of transactions outputs so yes contract keeps changes of last let's say 10 Roots so whenever you send your proof it checks that if it's a

valid route and with your inclusion tree you provide your inclusion tree route and the verifier checks that with the given leaves if the calculated roote equals The Descent proves root did I answer your question yeah yeah thank you thank you