Decentralizing Accountability using Privacy Preserving Blueprints or Who Watches the Watchmen

Transcript

[Music] so can you hear me yeah so I also work at iog so I'm also in the blockchain space um and uh yeah so today I will talk about um privacy and accountability and in particular about how the people that try to hold us accountable can also be held accountable and so that uh that topic the whole topic of privacy by Design and uh and kind of how to make sure that there is no kind of abuse by uh kind of centralized Powers is very dear to me um to think about privacy I kind of have this two pictures one is

like a like a tribal Society galarian Society um where everyone maybe knows each other but if you want to be alone you can you can go somewhere and have a private conversation so there is kind of no um no power indifference maybe you don't have much privacy it might be quite invasive everyone knowing everything about you so that's kind of one model the other model is that of a big city where you can actually be private in a crowd and that's kind of a system where there was only physical cache there were no CCTV cameras so like um New York at the turn of the kind of last century um and uh the beginning of the the previous Century so these are kind of two ways of privacy and they're

very different but they are also very very different from the kind of privacy that we have uh nowadays which is very restricted mostly by our own habits and choices we carry our phones with us we are rarely offline um there's kind of a lot of data is collected about us and uh so I think and a lot of it is more and more centralized so I think the goal of AUM I think that's a big vision is to kind of create something that's more decentralized more aarian and um I find that that very um appealing um so I spent um a week offline last week and missed a lot of world events I think there was quite some politically important stuff happening I'm still catching up to some

extent um one of the things that happened is that um Trump kind of pardoned the kind of the CEO of of Silk Road and I think that kind of it's quite a controversial topic and because I want to talk about kind of um abuse resistance law enforcement and that the like it's probably quite relevant so I asked my friends uh chat gbt and deeps and co-pilot of how how that um what lessons can be learned from from s quote and uh so came up with kind of five bullets as I asked and one is that it's an example for like the power of anonymity and privacy online in a way so you can using Tor and Bitcoin you can create U

marketplaces um that obviously prevents uh a lot of regulatory challenges because what happens on the marketplace is often illegal and uh it's it's difficult to to control um I think there were like obviously there was TRS on Silk Road but there were also other things you could hire Hitman lists and trade organs if you kind of have if you need a urgently an organ transplant so there's a lot of complicated stuff there it also highlights the difficulty of building um such a thing so in the end the FBI didn't have too much trouble taking it down once they kind of um zoomed in and like got their hands dirty so there it's it also shows how difficult it is to actually secure such a thing and um it

was quite a centralized system in the end um the uh founder was alre actually kept a lot of control to himself and I think that also made made the system vulnerable um it also showed that Bitcoin can be used for selling and buying things online so and that's um so you don't need the conventional banking system and then again you're back to ethical um challenges and ethical considerations of how um in a decentralized world we can make sure that um we do things that we like and not too many things that we don't like um I also asked about kind of how about privacy in a in a complicated volatile world so privacy um has different aspects one is protection from

surveillance um let's see yeah I can scroll here um and I think Edward Snowden showed that surveillance is a lot um a lot more prevalent than we saw it earlier and I think it's getting more and more um problematic it also provides safeguarding of personal freedom um so it's fundamental for that it helps prevent um abuse of power so if you if if you have privacy much easier if you don't have privacy it's much easier to put you under pressure and people that say uncomfortable tools can be targeted much much easier that also means that maintaining trust in institutions it

becomes harder instance whistle whistleblowing becomes more difficult and in princip and moreover privacy is very important for um freedom of speech so in the internet um that we have now we used to have some amount of privacy so and if you are um a hacker or if you're like a very techsavvy you can still create um pseudonyms and you can have multiple um versions of yourself you don't you can still hide behind smokes and mirrors but average people usually cannot do that so it's if you you will be not only will be known what kind of dog you are but also what kind of dog food you like and so on so

there's very little privacy on the internet and um for those that kind of think a yeah I have nothing to hide I really like this saying by Edward Snowden who is a person that didn't get pardoned last week unfortunately who said what I quite like is that saying that you don't need privacy because you have nothing to hide is like like saying that you don't need freedom of speech because you have nothing to say so I think these two things are really quite connected so um in my research I looked at uh privacy uh By Design how to build systems that kind of are private by Design and there um and we can think of um of an online like Marketplace as an example I take something maybe slightly

less controversial like a like a chat system a secure chat system let's make one that is really privacy preserving so the first is like we want to have privacy preserving service provisioning so what would we want there so it should be at least endtoend encrypted we want to have as little of um plain text Data online as possible so endtoend encryption is kind of one thing that we want for a chat system and most chat systems like WhatsApp and Signal provide something like that next we want to um have traffic analysis assistance so who is talking with whom that is very private invasive metadata it's it's used by the NSA to kill people so metadata is often enough

to um uh to to find out and target people um so we want traffic analysis protection so systems that can help there is tour or Nim there was a nice talk on Nim which is a blockchain incentivized Anonymous communication system so that could be integrated and indeed that's also something that Sil quote um used then um there's you might need privacy respecting data analytics so you might have to compute on um some private data for instance in a chat system to discover who is online or who are my friends are my friends also using the system so you might have to perform some um data analytics and you want to do that in a privacy

observing way using trustage execution environments is for instance also another option I think signal has also been using that for contact UM managing contacts another aspect that I worked on quite a lot is um Anonymous payment and identity management so these are systems like Anonymous credentials or ccache so you can imagine in a chat system you could integrate this with a payment system and so you can um not only talk with someone but you can also send them money and potentially you can do that across borders so it becomes quite a powerful um system and that's when kind of the fifth leave of a system is often kind of not not that easy to realize is comes in

and that's abuse resistant law enforcement so for instance you want to have age controls you want to prevent abuse hate speech money laundering trafficking and so on so there's a lot of bad things that can happen and uh so and that is probably one of the reasons why like truly Global um fast usable payment does not really exist I think Facebook wanted to build such a thing at some point but they didn't they couldn't get it couldn't get it really done um I think Bitcoin gets close but again it's it's not uh all that straightforward I think this is kind of I think in order to kind of get everyone together and build such a system we have to also think about um the abuse and so and what I will talk about is one proposal to do

this um many of the kind of existing proposals often have the problem of trap doors so You' have to find some party or the set of parties and then the question is how many of them that you trust and if they kind of collude if they get compromised by um by a powerful actor let see a national government then the system really becomes quite quite broken um and so that that most Security Professionals are very much against that and this is also shown um in a debate around um in the European Union and the the UK around chat U System and protecting it's it's veiled under kind of

protecting Children online but it's kind of it's the Online safety bill in the UK which has passed and the so-called chat control Bill protecting Children online in the Europe Union which hasn't passed and I think it passing in the European Union would be quite problematic because probably in the UK a single country it's not that easy to kind of implement this um in a too Draconian way but if the European Union would do it would could go quite far so that's um and what they want is really a back door or client side scanning which is also quite problematic so there have been a lot

there has been a lot of academic work around finding um suitable trade-offs between privacy and accountability it really goes back to David Cham who invented Anonymous kind of mix networks and the like and also Anonymous credential and then there has been a lot of work um by kind of myself and other people that are more kind of more serious more important I think even like than me so like um shaffi gas is the kind of inventor of C knowledge has also thought about how to apply Z knowledge to accountability and secret courts then there's Matthew green a famous cyber security expert who's looked at abuse resilient law enforcement um then I worked with um

arus gas also from iog on um parad which is a um distributed and um regulation compliant um cbdc so centrally Bank digital Co system but we also have shown how to bring the same regulation compliance to stable coins and other um decentralized systems and last but not least I we I developed with um and and SK and other students several students um A Primitive called privacy preserving blueprints which I want to talk about about here and what all of those Works say is that privacy and accountability can can coexist and that um what and what we

kind of have to decide as a society is which kind of trade-offs do we um do we want what what are we willing to to um to accept so towards that goal I want to kind of set the stage and and introduce different stakeholders we have users that's all of us then we have verifiers these are kind of service providers could be a smart contract um on on eum for instance that verifies uh credential showings and then decides whether transaction is valid or not and then we have the authority that wants to kind of regulate us and what the authority says that in order to protect your your children I must see everything often that's kind of because that's the

current state of the art the the police has access to to like before um yeah can everything is in plain text so they they kind of they not really willing to give give that up too freely um then verifiers um need to satisfy kind of policies they need to know um who they're interacting with potentially whether they are old enough and so on but they have like a restricted set of business policies for instance that users are older than 21 that they're coming from a certain country while the AUD really wants to instance see the Social Security number so they exactly know who they're talking about and can um kind of point to a certain database where all the actions

of the user are recorded So what's the user's position it's often complacency like what can I change as a single person um ads and free stuff is is good I need to kind of move around in the world and I also love my kids so I cannot really object to those arguments either but then kind of what happens is that yeah sometimes we cannot rely on our liberal democracies to be kind of completely stable sometimes bad things happen and we want to actually do something that requires us to have privacy so kind of we might well come to a point where we want we will change our mind and say privacy is a human right and now I really need it because I'm I'm

in trouble so we have to kind of protect that um as we go and there's like Snowden has w there's a cryptographer called Phil W who talked about the moral responsibility of cryptographic work and he also makes that case um very um very well so what's um our our goal so we want to kind of bring the different requirements of these different parties um together and find a good a good tradeoff so we have the auditor who wants to investigate things and now I abstract it out a little bit so he has

some information that he uses to investigate um a case let's say he has a list of suspects it's called that list X and he wants to hide that so he doesn't reveal who is your respecting otherwise they would kind of flee or hide themselves stop stop running Sil quot for instance and would be much harder to catch them then there are users who have attb and they want to keep those kind of attributes and their identity private when they're interacting with the verifier and then we have the verifier which wants to check whether the users attribute satisfy a policy p and in addition they want they their kind of

task is to help the auditor learn what he needs to know so we model that using a function f so we say the auditor should see F of XY which is a public function of the private input of the auditor X and the private input of the user y so that's that's kind of the functionality what what we want to achieve it's a form of kind of multiparty computation non-interactive multiart computation because the user interacts with the verifier and then there's a cipher text that the auditor can use to learn F of XY so as I said the goal is to keep kind of X private to the auditor so he can he has confidentiality for the

investigation and to keep why private to the user so the user has privacy and to strike the trade-off we want to reveal F of XY so here's an example we have um a list of user identities at the auditor that should be investigated the transactions of those users and only those users should be traced then we have the function which reveals the identity of a user if the user is in the list of suspects and otherwise no information is revealed and so we can using Z knowledge proofs we can prove that that uh that

list is not too big that all of those suspects actually were kind of issued um a search warrant by a judge and so on so we can provide a lot of kind of accountability um in on top of this mechanism so that's um our contribution so we um we have a new primitive for privacy and accountability it's modeled after publicy encryption as we will see and it integrates well with Anonymous credentials but also with um like privacy coins like Monero or cach so you can go there as well um we have a fory

security notion and efficient instantiations for um certain functions we have very efficient inations for others we kind of buildt on fully morphic encryption so it's a bit less less efficient but also that for instance by summer they also working on um making that practical and uh so and on top of that we also built many extensions and future work so we have two more papers you know on the same subject so this was published in Crypt 2023 and have some follow-up work that I will talk at the end if there's time so that's the the Primitive so that's the kind of the API of what a

blueprint screen gives you so we have the auditor which generates a key um a key pair a secret key and the public key and the public key encodes um in a hidden way um the Auditors um like investigation information let say the the list of suspects X and that public key can be passed to the user so the Box always says this is encrypted this is hidden from any everyone so so X is pro like PK of X is given to the user and the user now can use this public key to encrypt um his um identity information and create the escro that then encrypts F of XY but only F of

XY the verifier can um verify that this ESC was computed correctly and then there's a decryption algorithm that allows the auditor but only the auditor to learn f ofx y but nothing else that's it's that's the the Primitive that that we want to use to guarantee accountability so if by the way if you have any questions I'm happy to um be interactive so there's there's some something that is kind of missing here this is a simplified kind of um dactic presentation um so if anyone kind of sees what's confusing here

yeah R yes so you're saying that if there were bad actions in the past how can can we investigate those yeah so that that's true so one thing we do for the when we apply this for instance to the cbdc system called parad that we designed so there we have a tracing key which allows so if you if you know that tracing key you can um you can see all the past transactions of a user so what we can do is we can um escrow the tracing key using the a blueprint scheme and then you learn that key which allows you to see everything in the past as well so that kind of it's it's by kind of having

a a symmetric key that you you then encrypt with the blue the the blueprint system you can see everything but that has the downside that it's maybe too much right so so how to find the right tradeoff so you can look somewhat in the past but not too far or but and you cannot look into the future in case the suspect was actually innocent so there there there is future work that um can be done there yeah so it's a it's a good good point MH in one of the examples X is a list yeah so it depends on what the function f is so we give an efficient instantiation for X being a list yeah yes so if you you would have to add

dami values if you want to hide the size of the list um it depends on the on the size of the public key so the public key would be kind of linear in the the size of the list typically but it it can be like a an arbitrary big um list it depends on on X yeah that's right and that's that's somewhat inherent because it needs to encode that information sure so have yes I think so there you can encode

X also as an as in a in a in a computational way to kind of say everyone that is older than than 21 for instance is a target so that would then be a more complex functions but then indeed you can keep the public key smaller but you need then for instance to use f morph encryption to implement it so it's kind of that's we don't have an efficient instantiation for um kind of this succinct encoding of list for instance yes I think that that it's more efficient yeah yeah because you know for the

any salt inside yes oh yeah the key generation is of course randomized so every time you you run it even with the same X you get a different key and a different different secret key and a different public key that's right yeah maybe one more question um yeah thank you I'm I'm slightly actually confused um so the user here is Computing escrow of pkx comma y yeah so what is escrow the this function escrow what does it do so it um it encrypts y with the public key X I will get to that specifically so it it kind of it does like a you can think of it as a

two-party computation where it computes the first um round of the two-party computation okay which is then um or it's actually the second round so the the Computing the publicy is the first round and then Computing that is the second round and then deting and why why is a message sent by the escrow by the why the user sends it to the verifier so the user creates the escrow and then sends it to the verifier okay okay thank you maybe it becomes a bit more clear um so one thing that I kind of all light it here is is um how do we know that the Y is a good y the user could put any y there so so how how do we trust the user to to put his real y

there so that's kind of um how we need to connect it to some other external system so you would have to connect it to an anonymous credential system or to a d like a digital identity system like um or to to a payment system that has some notion of accounts or or identities and the way we do it is by using commitments so we assume that there is a a commitment to the users um Y and then the S quote takes um actually the randomness of the commitment basically that allows us to recompute the commitment as input and creates a proof that um that the the y in the commitment is the same as the y in the sqo and then

using Z we can tie all of those things together so we can tie this to to the currency system or the to the identity management system and or yeah and so on ISS that as a verifier knows the why and Rand and random SS so how can uh how can this mechanism prevent the verifier to sp sp so the verifier doesn't know the why he only knows the commitment and the eso so he doesn't get to see the salt R for instance or and and the so it this the verifier only gets to see the kind of the commitments and the cipher

text yeah so I think I will go um a bit faster over the formal security notion but we have we need like four four properties for blueprints one is blueprint hiding namely that the public key um hides the the the value X it's bit like semantic security for encryption then we need soundness which says that if verify escrow verifies for a particular escrow and a particular commitment for for a public key to X and a commitment to Y then the escrow really is an evaluation of f on X and Y and we need U privacy against um Auditors and there are two types of Auditors one is

if the auditor is honest then we don't want anything to to kind of be learned by anyone because except for that auditor um so so that means that F of XY is like a a cipher text that no one can can decrypt except for the auditor and then even if the auditor is dishonest and he for instance if if he reveals the secret key to everyone or he he then um it still does not reveal more than F of XY and and it we will actually show that information theoretically no more information than F of XY is contained in the es value so this is um we Define that using kind of a game based notion

where um we have the real world on the left and kind of the simulated World on the right um and the um the attacker can create arbitrary public Keys um for some X and um some X values and then we check that those public Keys verify with respect to a commitment to X that's a another way of how how do we bind the X to some external system for instance to search warrants and so if that verification fails then the game aborts so we then like that the users if if that verification fails users should never do an escrow so users only produce escos if that verification succeeds so let's

assume that that verification succeeds then the adversary can make users create escos for some arbitrary values Y and R Prime of the choice and users create escos so in the real world those are the escos that should now contain only F of XY um in the ideal world we provide a simulation um algorithm a bit like in C knowledge to Define Z knowledge and that simulation algorithm only learns f ofx y and nothing else which kind of models that all this simulated ESO can uh reveal is f of XY and so the security against this one is Auditors is now you cannot distinguish those

two so now we come a bit to constructions so the recipe is that it's like a passively secure non-interactive secure computation um of the value F where the auditor provides the first message and the user provides kind of the second message based on the first message and from that you can learn FFX Y and then we compile this passively secure scheme using non-interactive Z knowledge and commitment schemes into the full blueprint scheme we have two constructions one is for all functions using fully homomorphic encryption where the passively secure scheme is just evaluating things on homomorphic Cipher texts and uh we have an efficient one

for this watch list scheme where you have encryptions where the public key basically con contains encrypt Cipher texts that um correspond to suspects and you do matching against those suspects and that we realize using Al M and diff Helman assumption using quite efficient scheme so this is the how we construct it um so a key generation of the list of suspects um contains the values XI which are like suspect names and we compute a polinomial that has XI as its roots and that the property then that if

you valuate that polinomial on um on an actual um on someone that is in the watch list then it will to zero and then we kind of add the identity of the user to this zero value which then reveals it if the user is not um on the on the watch list then it valate to some nonzero value and we multiply it with a with a random s to turn it into something completely random and then if we add this completely random thing to why will still be random and that's kind of what what um um what gives us the security so what I described here is Tri not secure

because I just reveal the coefficients which encode the polinomial which reveals basically what its roots are so to make it secure we um encrypt everything so we generate a algal key pair and we encrypt the efficients of the polinomial and then we do an encrypted evaluation of pols so that's basically our our construction so we have uh two followup works one is updatable Blueprints and that the idea here is that we don't want to just have a single kind of um action of the user that is investigated but many actions of the user so and then you

can think of it as um an accumulated credit score of the user and you only get kind of De anonymized investigated if your credit score your suspiciousness score gets too big so the predicates of an updatable blueprint scheme um will be um over kind of the sum of the um yeah of the suspiciousness score and we also have another paper that um optimizes kind of blueprints we call it Olympic blueprints because it came out the time of the French um Olympic Games and so we make it both faster um by kind of compressing the size of of the escrow proof we have bigger functionality we can now encrypt the keys for cbtc

systems that someone asked about so we can do backward tracing with that system and we also have stronger security because we prevent U frame ability so in the in the original system if the auditor and a malicious user collude they could frame um an innocent user and could say the innocent user did something bad while he didn't actually do something bad it was just the auditor and the malicious user colluding so we Define security against that mechanism so um so bit more about updatable blueprints so the predicate here is um a predicate on a value by the investigator here it's a threshold on the credit

score and the sum of the increments that were done on the suspiciousness score so that's one of the predicates we can have predicates uh that um that also support more complex functionalities so then um yeah I mentioned Olympic blueprints the non-f framing property and we think that this one because it allows us to encode um actual tracing keys for kind of payment systems is particularly suited for essentially Bank digital currencies and um a future work would be to do um with ractive tracing or investigations where we can specify specific um intervals um

that are wor investigating um and also what kind of very interesting work would be is to integrate this work into actual systems or to integrate it into um like systems like parad or Anonymous credential systems to so to Define um the kind of kind of a whole system which employs blueprints in certain aspects good so whopping up a bit about this line of work I can say a bit more about um other areas I work on afterward um so we we have the motivation to kind of find a good trade-off between privacy and accountability and also the

accountability of the Watchmen so they need to prove and if they do an investigations they have this public key with the hidden X they need to prove that this is actually um Justified that they run this investigation so we can find trados and what we really need is kind of to fix the function f and how we certify X and Y and what the requirements are um for transactions to be kind of accepted under certain conditions so we give U strong simulation based security Notions and efficient constructions so that's that's blueprints so zooming out a bit

um to kind of the bigger state of the world so I like this image of the leaton which is like political science from the 18th century which is like saying that well there human beings are inherently bad we need someone who has the Monopoly of violence in a way that fixes things so that's the leathan and in the modern world kind of what that kind of centralized Sy system controls is is our data and the data comes like from all our devices so that's kind of uh the place where I kind of almost the current point in history that but what I would like to move towards is one where we kind of protect ourselves from overreach also by that kind of central Party by

building um privacy enhancing systems that are secure by Design um I think there several such systems like a Leo atst have been discussed and I think this would also be good um systems for implementing blueprints or extending blueprints with um there's a system called Midnight in iog that I'm also contributing to and it has this vision of having smart contracts that have both an unshielded part and the shielded part um where the shielded part is kind of protected by SE knowledge proofs so you only um kind of reveal properties about those things so kind of build building um blueprints on

top of that integrating it with with midnight would be a very nice thing there are also lots of other uh systems that this could be could be used with um also in theerum ecosystem I would say yeah so I've not done this um alone so I kind of I have some collaborators um even the room um but I also grateful to my PhD students my posts and other colleagues um at edinborg and elsewhere so this is just the the C knowledge lab um and yeah I think there have there have five minutes for questions I have a nice research map of things that I worked on before I think when I got invited I actually was asked

to talk about um TLS and formally we verifying the TLs protocol and I think that is also kind of related to this topic because if you build such a system that has like a privacy by Design system with this um investigation Powers we we need to make sure that there are no bucks so formal verification plays a big role um there as well yeah so I also created this research map of all the things that I think should happen and that we should work on but yeah I I think I I can stop here um and yeah some of them are related to

blueprints others are just doing other things than thank you very much Mark thank you very much and in case you have any questions please raise your hands any questions to the speakers okay well thank you very much for your presentation could you please go back to the slides where you basically draw the verifier user oh yeah let's go to one of them mhm that's yeah so yeah no that I think there was the pictures right uh yeah uh before that sorry yeah yeah yeah yeah there's one um yeah so my question is um is the pkx actually from the auditor also somehow sent to the verifier or is it only or uh the verifier only obtained from us okay

yeah it needs to be sent to the verifier as well yeah I mean I think it yeah because otherwise the user could create its own and and cheat yeah that's a good point yeah yeah and also I just wonder because this is non interactive so is it possible that um like the auditor actually send out multiple pkx to the verifier and then user um why just kind of like pick one of the pkx well just regardless how they manage to know some of the others just pick one uh such that the polinomial is verified to a nonzero Point um and then send send it to the verifier so the verifier kind of like takes the uh encrypted uh fxy from the user where the

user computed from their own y but with a different pkx and yeah the verifier when they verifies it can verify the pkx is correct but at the same time they just kind of mismatch so that the user can trick to yeah so I think it at any given time probably it should be one public key that um that is valid or when the user could also be be kind of asked to create multiple SOS with respect to different public keys there could be multiple Auditors for instance that each have their pkx um that they want to use for investigations and the user has to create an Esq for each of them for instance but you're right so if the user manages to kind of use the PK that uh

where he's not a suspect then he manages to evade investigation yeah thank you thank you very much for the questions any other questions we have um a minute or two for the last seems like not the case thank you very much then for your speech and thank you for listening [Music]