Zero Knowledge & Account Abstraction

Transcript

thank you everyone for coming to this talk thanks for the organizers again for having me this year it's really great to see how atcon evolves sorry for the technical blunder with the display here I'm Sor and this year again I brought you an independent topic named Zero knowledge and contraction hybrid web 2 and web three applications need hybrid privacy so I'm Sor I'm a postquantum cryptography researcher and an independent developer working on a plethora of projects in the ecosystem I also co-founded a couple of my own startups uh I publish uh cryptographic papers and I Implement some of the novel ideas from Vari labs in the ecosystem

too on the agenda we have uh the necessity and the novelty of smart wallets so a little history on them then comparing the two most popular versions of how we do or did account abstraction namely delegating and the current version uh that rules the contest traction then why the second version one exactly in my opinion then I'm going to present the most popular uh developer SDK approaches that I've seen as a developer when I'm working with the concept Direction and then I'm going to list some case study how they can be combined with zero knowledge technology to bring hybrid web to privacy into these new uh use cases so smart smart contract wallets

per se are nothing new really we uh we realized immediately with the capability of smart contract wallets and smart contracts uh themselves that they can drive wallet interactions to acting as a proxy the standardization was the thing that was really lacking in the whole uh ecosystem so how do you integrate them how do you develop them um every project try to tackle this problem with their own own way so interoperability was kind of non-existent which can't go uh being a wallet ecosystem so what the main problem was how do we combine the best properties of

a smart contract and uh wallet an an externally owned account one of the approaches was EIP 3074 account allegation it was an elegant version but it required new op codes added to the evm if you remember and we don't really like that it's a little hassle to introduce to the network and the second one that currently rules the ecosystem in terms of account abstraction is EIP 4337 account abstraction that has a second uh mol for user operations and the amazing thing about this approach is that we finally decoupled user operations or user

interactions intentions with the blockchain train from the technical knowledge that's needed to interact with it so now we are uh especially on this conference we got used to the fact that you have to know how nones work on the network how the the basics how the consensus algorithm works if your transaction didn't go up then you have to search for this hash and that but it's actually not really normal in a in an IT industry that you expect so much from a user and that's exactly why all the newb are complaining about ux issues here and with a abstraction why we expect so much from this technology because we finally decoupled the technical knowledge and just like on an iPhone the user only expresses its

intention with the blockchain now but this also comes with the backside so web 3 was not uh designed this way at the beginning in mind and as the new providers and tooling arise that eases user interaction it comes at a cost usually it's a privacy cost as we saw with uh Facebook Google Etc so the major abstracted wallet providers and the user operation executors bundler can pose some privacy uh concerns on you they might become the new chain laes but this is just a personal view the good thing though is that now we have uh

touring complete code executed on the chain that also stores our assets and and intentions are much easier to express in zero know circuits than uh having the refraction of only elliptic curve mathematics when we are operating on our assets so we could bootstrap and piggyback new use cases or existing use cases in ZK with the new relaxed threat model the relaxed threat assumption that we hold our assets on something that can execute arbitrary to incomplete code for this we have two uh most popular smart contract wallet models at least those ones that I've had to work with

integrating this to clients the newest one and the simplest one is the basic owner model what coin based smart wallet uses is been released not so long ago and it does enjoy quite a popularity especially of course on base chain and we have the plugin version the ERC 60 and 00 plugins which are taking a lot from the owner model but more standardized and the permission system is more extensive there so on the noive uh owner model it's nothing new when we realize that instead of a lipti private key holding your assets and having an

address we could have the same with a contract wallet then you can iterate this uh iterate this process many times so the owner of the account of extracted wallet can be another contract or a handful of contracts that have to sign simultaneously and you have uh and you already have a multi system those owner contracts could have inside the code time limits uh time stamps uh investing logic implemented so you can't interact with your account of structured wallet without having completed these permissions in this one so it's a super simple and elegant way to interact and coinbase uh smart wallet uses this model inside their contracts on the base

chain the RC 6900 model is more extensive here it has a permission model the all of the calls in the plug-in system are standardized which mean that we can create a Marketplace for such plugins in contracted wallets which will be especially useful when privacy comes into the uh equation too so you can just download the latest most popular privacy plugin into your model here the permission system is uh really welld designed so a access control is uh enjoys a really good threat model you explicitly have to give time based and capability based access um properties to

the plugins that you install here so with these two in mind let's start with the case studies the most popular one of course is social recovery and chronological it was also the first one to be used in uh in a contracted wallets and it comes with the most uh privacy concerns because of course the use case is that you lost your private key uh too many uh sadly too many private cares and addresses are dormant on ethereum because of the Lost case so it was a a really gaping question that needed to be answered and with com abstraction the

way for social recovery is that if you could prove somehow that you are still the same person behind the computer created The Lost private key then you could potentially recover it it's a very general way that's why every project tackled it in its own way clave was I'm not sure if they are indeed the first ones to have a contest Direction social recovery implemented but they are definitely amongst the first ones and if you use this feature you are familiar that the way n works that prior to the private key compromise or loss you have to delegate um guardians so-call Guardians from your Twitter um social list social friend list I don't even know how it's called

as I don't have Twitter so from your friends you have to appoint um Guardians into your wallet which is kind of a clunky ux if you ask me in terms of security then if you indeed lost access to your account abstracted wallet then you have to ask these Guardians to attest so and if a treas is reached from the group then you can assign a new uh driver or signer K under the contracted wallet so everything is under the same address all the assets are in the same smart contract you are just you just have a new capability in terms of Access Control to sign with another private ke

the more elegant way and I think uh the project was mentioned during this conference already is ZK email so very shortly how it works is that you can prove in zero knowledge using the properties of the DK IM signature system used in emails to that you received an email from support twitter.com but what's even more interesting is that you can select parts of the email uh and selectively disclose them so you can prove on chain and I can verify that you received a mail from support at twitter.com saying that your username requested a password forgot request from them which kind of proves that you are

indeed uh in possession of the Twitter account in question and once I verify this proof on chain because we have the Merk three of the accepted DKI and public case in this project um then I can recover your account of Tred wallet just by your Twitter username which you already Pro that you have access to and you can uh use the same methodology for a plora of uh other social providers second one and even more interesting version you might be familiar with the use cases here actually because all of the winners of the startup competition uh yesterday that was that were announced implemented

one of these uh case studies uh because I also made um this talk in Brussels so you might be familiar with everything that's presented here a super underrated project we see is tiis notary they've been around for quite a while actually a little before TLS 1.3 became a well spread standard in web Technologies back then it was easier to use them now it's uh combination of multi party Computing and zero knowledge proofs kind of work the same as uh ZK email you can selective the disclose that the server behind the website sent you this and that content so you go on Twitter and you want to prove on chain how many

followers you have then you go to your profile settings it says how many followers do you have and you can prove without the possibility of client side cheating that the Twitter server having this TLS ke indeed proved or said to you that you have this and that many followers but the problem is that TLS notary is an interactive protocol so you can't just directly go into proving TLS notary and act it uh make it act as an oracle for the contracted uh system that we just built here but thankfully if you combine it so you need another layer on top of TLS notary if you combine it with Vector

oblivious linear evaluations then you can make a hybrid ZK snark NPC and on the whole combination another ZK snark to make it um vb3 compatible because uh Vector oblivious linear evaluations especially excel in interactive systems and there are already project the projects that are exploiting this idea next case study we have ZK kyc that enjoyed quite popularity in uh in Brussels so both of these Technologies can uh help you go through an onchain uh kyc

process without actually putting person personal identifiable information on chain so you can prove that you're not a US citizen because some sub said so and you are above the age of 18 because some sub said so by either selectively disclosing parts of the verification email that you received from some sub or parts of the uh front end that that your kyc provider of choice sent you after the process the same methodology can be used for Fiat gating so not just about your identity but about your assets you can also Express stuff based uh on your account abstracted uh interactions on chain this is especially useful for real

word asset tokenization so you can go on to your bank's website combine it with TLS notory and you canot test on an onchain auction for example that you have the necessary liquidity which is like a protocol in uh Fiat based auctions you you cannot test that you are uh eligible for such gating next if you remember vitalik's um blog post about an introduction to how stal addresses work on ethereum it has a couple mentions of zero knowledge technology combined but not deeply uh into detail if you remember you have

a meta address that your sender can derive arbitary addresses from and when you want to spend something that arrived onto your stealth address you have to subscribe to a a tag system or like you have to parse the chain where you lost stopped from search for your public key which of course only you can do identify that it belongs to your original root meta address and then you can spend your assets from it but the problem is yeah the where do you search these taxs from currently it's an event based signature based we combining it with the contraction you can do it straight from your uh account abstracted main wallet

because the meta address itself is not a privacy issue if it's leaked because everyone is deriving their uh or your sta address is from the published meta address so there is absolutely no problem just pin it into the a wallet and uh you listen to your events for your meta transactions or Stat transactions from your account abstracted version and you don't have to combine it with the rest of the events it can also benefit from the guest sponsorship most easily so if you remember one of the big issues is that if I send you an nft into a stal address you try to spend it it doesn't have a balance for a gas but once you start to fund it you have a privacy issue because

you just created the link between your main wallet and your Styles wallet but account obstructions the ERC 4337 has this guest sponsorship model built in which is truly amazing and combining stest with the contion system can benefit from both and also account abstracted wallet can't just verify ecdsa using EC recover when you have to authenticate your signer wallet but additional forms of encryption whatever fits into the guas limits um of your implementation and potentially means better post Quantum security too last one I have uh Anonymous account

extracted group wallets which literally takes two lines of code to verify so the use case is that you are part of a group or you are part of a big company you want to do um a group wallet but what you don't want to expose which one of the group members is signing a particular transaction you only have want to prove that you are part of this this is the classic Monero uh ring signature model or the semap for zero knowledge model and if you have a verifier modifier in this um account abstracted wallet then you can off the shelf combining it with semop for proofs have the best of Monero and the best of

ethereum in in really just two lines of code so you have kind of R signatures group signatures behind an contracted wallet with uh semors so as conclusion as usual when we introduce better ux in order to achieve better user adoption into a technology that comes at the cost and usually it's a security cost because they will always be at war with each other this means is that yeah user operations are great you have to express your intent now that intent has to be interpreted somewhere and intentions can be linked to personal identity so you have to be careful with those and

today's bundlers and user operation executors might become tomorrow's chain Alis or Google but thankfully zero knowledge systems uh boomed really in recent years both in terms of engineer ing capability with Pro the VMS and the proving systems and developer tooling most of the times I'm really thankful that I don't need to particularly uh engineer with circuits anymore in best case you have access to a general purpose ZK evm an ethereum compatible even and for the use cases I presented here you already have of the Shelf solutions for zkl TLS notary to cover

90% of the privacy issues presented now on account abstracted uh in the account abstracted ecosystems so slides are online as usual feel free to ask questions on the telegram here they might get uh edited based on your questions here thank you very much for your attention