Practical Approaches to Interoperable Blockchain Privacy

Transcript

everybody for coming to this talk. >> Yeah. Okay. Sorry. [laughter] I know that. >> Mandrian. Yes. >> Um so next up we have Igor Mandregan, co-founder of Gateway.fm FM and uh we'll be talking about practical approaches to interoperable blockchain privacy. >> Okay. Uh thank you so much. I know that there is uh there've been plenty of uh talks around privacy and uh before we start I actually uh do a little bit while I'm setting

this up. So the story behind all of this contraption is that I I was doing quite a lot of presentation from home and then on the way here when I was landing basically departing I figured out that yeah all my slides are on HTML on my machine that's at home and uh I'm not bringing like work machines here because of the latest hacks and whatnot. So I need to do something. So, so what I did is uh SSH to like one of the digital ocean machines that I have and basically asked the power of AI to make this presentation in the ASKI art uh because I'm I'm from Basil. It's the city of art

and pharmacy. So, put them all together. We have some uh hopefully funny slides. I hope I should be able to see something. So we do mosh this machine. Uh let's try to see if the internet actually works. It is. I didn't update this machine for a while. So uh if there are hackers in the audience, you can try to exploit it in the meantime, but it doesn't have anything anything cool in it anyway. So let's see if it actually starts. But in the meantime, I'm Eager.

I'm the CTO and co-ounder of Gateway. And uh we are this uh we've been through multiple phases. We started as a purely an RPC provider. Then after that we basically joined as um uh like a validators. We've been doing RPC for Nosis. We've been doing validators for Nosis. After that we went much more into like roll up as a service or L2 as a service business and after that uh we now are doing what we call an orchestration layer for blockchain services for enterprises and enterprises is very important word in the talk today. So what I will going to talk about the privacy today is from enterprise lens and enterprise uh

perspective. Uh so yeah let's try to launch this thing now. Okay I actually prepared two decks for two talks today. So let's try to do it like this. So yeah uh practical privacy. This is a little bit about me. So let's skip it. So again different privacy there are different privacy use cases. We can make it bright for those who maybe it's better visible. But there are different privacy use cases. There are different tools with different trade-offs. Very very important the the trade-offs are in privacy because you cannot have the universal solution that

fits everybody. So my talking here again I'm talking through the enterprise lens. I'll talk a little bit about our solution and then what I'll do is I'll try to kind of show my thinking behind it and show the landscape of the market of where who is and what are their trade-offs and stuff like that. So we developed this solution. We call it an open privacy proxy. Uh and basically it's a very specific RPC based role-based access controls with identity solution that basically sits in between your RPCs and your customer. that adds authentication and authorization to the RPC and then it sits on top of like any

uh EVM node uh that is possible uh to run right now. We tested it already on uh multiple chains like we tested it on pure bezel, we tested it on OP, we tested it on arbitrum, we tested it on Linux, we tested it on CDK. So it it's kind of quite universal in here. Again, as I said, any EVM uh and then what I want to go to the actual details here is our thinking uh behind how we developed it because I'm not here to just okay shill our product or anything.

I just uh uh I'm interesting to show you the exact thinking. So yeah, blockchain started of course public and they were actually against the privacy to some extent because I mean bitcoin was launched when when it was the financial c crisis. So a lot of things were behind closed doors that was wrong. So let's fix it with math openness consensus uh yada yada and we basically it designed to leak the data be it from the state be it from meool each transaction that's being sent like everything uh metadata as well and uh there are a lot of people who can

basically if we set up like the threat model there are multiple players who can uh basically watch uh some information for example we're starting from the customers like Nosis Pay for example since it's public anybody can see balance of anybody's credit card there if they know the address right so it's all public for other chains like on Ethereum you see all the transactions and and stuff like this on Bitcoin as well of course there are meth finders ironically meth finders were the first reasons for privacy in EVM blockchains because um we know that privacy came with a lot of like controversy from a lot of players which part of privacy ever went was controversial is something like encrypted uh memp pools. So

basically as soon as you fight meth this a little bit of privacy that nobody can read your transaction pool is is good. Of course there are insiders and we call it operator privacy that means if we at gateway are running uh like the L2 or the chain or we are running the RPC or running the validators or anybody else who do that they also might see or might not see your chain data. Finally, there is very important piece here that there are analysts and hackers who look at historical data. So, blockchain is permanent. You send something, it's there forever. So, there are people who look at the historical data and try to find information out of that.

And u again important vocabulary here. There are like three uh tiers of privacy if you want. One is anonymity and one of subset of anonymity just less powerful is pseudonymity which was in blockchain since forever means it's okay you have your wallet but your wallet is not linked to you so you're obsiding which is very frowned upon and anonymity basically hides who is transacting full anonymity you basically see the transaction But you don't even know how many parties are transaction.

Pseudonymity you know how many parties but you don't know where this pseudonym belongs. Then we have conf confidentiality that means that it hides what is being transferred or what is being transacted. Was there a fact of transactions or not? And the third one that I also added is basically selective disclosure. It means that we applying anonymity and confidentiality differently to different players. So maybe general public doesn't see something but your financial auditor does. Again I'm saying that it's very much from the enterprise perspective, compliant organization, finance and stuff like that.

Then uh a little bit more on the complant privacy. What I think is that again if we're getting just privacy uh it's very easy to put be a little bit e either in the gray area fully in the black area of kind of legal/compliant field. What extra thing that we always need to add is also to add kind of identity because we we actually trying to like and we see a lot of privacy solutions that try to be practically useful. They're trying to put some pieces of identity somewhere.

Okay, you pass the KYC or you actually in here or some other things. We use ZK and some advanced stuff uh around the identity. But yeah, so basically uh to have privacy compliance you don't only need to hide information but you also ideally for again compliance reason need to link it to certain identities. It could be again identity also could be very much privacy preserving right identity could be ZK based and stuff like this but privacy is really uh needs uh identity and actually the most uh privacy stack actually skip it like gateway doesn't because we use directly identity inside I think previdium and nightfall come with some identity

pre-built in the rest are basically okay you have a wallet uh and as I say uh wallet that native ch is what was the chain by by default but we can move like if we want to be again play with compliance we want to move from wallet native chains to identity native chains it has actually has a pretty cool [clears throat] side effect because we saw like latest hacks let's say on humanity and h protocol which had a multisc that had multiple wallet had three out of six I think wallet or something like this turns out three wallets were on the same user's machine so in our terms at least If you have an identity chain, it will show there's only one user in the multistick even though there are three

wallets, right? So that's a I mean it's a trade-off, but it has some cool side effects to have like a identity native uh uh chains. Some of the account obstruction protocols are kind of trying to bring something like this, but it's uh again we are quite early in there. Uh and this is how again we use JWT claim or technically speaking JWTZ claim because it has ZK proofs for different claims inside and we basically when when you install our privacy suit on top of your chain every call is going and needs to be identified with your actual identity based on the identry uh identity protocol.

Um yeah and this basically makes it uh not only privacy but we also call it like accountability layer. So sometimes it's not your goal to to stop transactions. Sometimes your actual mandate is like just make sure you can disclose it to the auditors later if something weird is happening. So the goal sometimes is actually not to stop. I was actually very one interesting discussion and one procurement company of big enterprises that specifically had in the checklist uh something that was saying something along those lines that okay do you have a mode in your system that looks at all the compliance rules and if they are broken never stops the transaction but puts it like like just aside and it's still executed but puts a

notification. And I was like, "Okay, why why do you want to do that?" Like, and said, "Okay, but if we stop the transactions, we're opening ourselves to hell of a lot of lawsuits from people if okay, if your compliance system is a little bit off or something, you you're basically opening too much can form. So for us, it's cheaper to have a mode that until certain level of damage. If something weird is happening on the chain, you just okay, we flagged it and we allowed it, right? So because it's cheaper things and again If you look at how privacy was achieved in the web two world for decades, it's basically was combination of some kind of role-based access control and some kind of identity service. When you sign

into like Amazon, you have your IM account and then you set up. Okay, now you're an admin, you can see that or you an admin, you can create users and somebody else can do something else. uh developers can deploy things, users can read this data. Your financial data is hidden from everybody except the financial team. So it's uh basically and we also work on the least privilege and fail closed principles. That means that people only have need to know basis on the chain and also if something fails it just closes information from everybody so there are no accidental leaks. So it's all like ages old. So the goal for us and for for me in this thinking was to bring it all basically on chain as

closely as we could again because our target is specifically enterprises. So if we look at the others like uh also but two things how you basically privacy comes at some cost right you it's not built in in the chains right now. So you have two options like if you have an app uh on chain you either change your app and basically you somehow rewrite your smart contracts you introduce some FHE or ZK in them or you in your app integrate some of the privacy services or you change the chain in some way shape or form right so it could be okay you deploy another chain which has

privacy or you deploy an ad stack or or something like this or you put like our privacy suit or or something like this you need to do something you cannot basically avoid this and different different um solutions have different trade-offs on that. Uh so the players again there is of course the original Zcash of course there's tornado as well some OG players now there's adtec being launched there is logos being built uh uh then there is miden that's close to mainets that's also provides privacy there is very enterprisy nightfall 4 initially by uh ey which is they call themselves zk

rollups because it's covered by basically both bridging is protected by ZK and also operations inside ZK. There is ZK syncs previdium solution which is very close uh to what we are doing in in in the ideas. There is SAMA which is probably the most famous FHE uh full homorphic encryption usage uh on chain. Uh there's HAL protocol with this shielded pool uh and yeah we have our own solutions as well. So there's plenty and this is just the main players. We have much more than that and we had much more than that before. I had a friend actually who used to sit on one of my first jobs like on the desk like like here and then we lost contact for a

while and then like three three years ago we met with him and turns out he's in blockchain and he's doing some privacy thing based on the ring signatures. Like it's was very cool to to see some people there. Again almost every privacy solution is basically follows the same architecture if you think about it. So you have some kind of a ways to deposit money into that. So your money is not minted inside this solution or hope like atte some some issues. Then you have your own application. Then you have some kind of a off-chain domain where because the information still needs to live somewhere. So this off-chain domain can

be either inside your app or it could be run by the operator or something like this and then let's say you have Ethereum or something where you send some kind of commitments into that to prove that the operations on on chain were were correct. So basically everybody if you look at like Nightfall they have a lot of in here then they have client and proposer that have offchain domain and and the app and they have some kind of a bridge inside. If you look at our solution, uh basically we have your own chain which you can think of offchain domain. We have a bridge and ZK here and we have the application that stores the keys. It's like everything follows the same.

Um yeah one interesting note that some of the solutions they achieve privacy through cryptographical means meaning okay we encrypt it you have the key you can decrypt it others can't others don't others like us and let's say maid and some others it's just purely rolebased access control means okay you just don't have this data not even encrypted you don't even have cipher text cipher text are forever on blockchain so putting cipher text in my opinion on the blockchain is always a little dubious because again blockchain information stored forever and so far if you look at the encryption schemas eventually they become obsolete eventually somebody finds the hack if

not I don't know quantum computers become available but then there's a bug in your implementation and then if you're on chain and your cipher texts are on chain good luck reenrypting this stuff so usually if you want to do encryption you want to keep it offchain for the future reasons again with AI right now this the speed of attacks on on cryptographical things and the speed of quantum computers is like uh progress is quite a lot so my point was there that we want to keep the state offchain and we want to make sure that if encryption improves so we don't want to use encryption for privacy we want to use encryption for verification of uh correctness just like maiden does for example

operator privacy like we decided like we don't bother with that because our enterprises actually benefit from being able to see everything. Uh but then of course Zcash at stack operator pretty much see nothing. Zkey sync is like ours. If you're operator you see everything. If you're not operator you see nothing. Uh Zama I think logos is also in in here. So there is basically operator sees nothing if it's private transaction. Maiden in the future as well. Now before my net operator also see quite a lot uh and sama again it's uh basically very few things that operator can do in nightfall it's

interesting because operator doesn't see basically there is confidentiality like I said from the operator so you don't see what is going on but it leaves hell of a lot of meta information uh there so you can re reconstruct at least the the transaction did happen identity models Again most of them are anonymous key pairs. Uh nightfall previdium uh chosen to use allow list with X509 standards for identity. We use uh DID standards. Uh we use DID identry which is I mean used to be polygon ID now privado uh or billions. Uh but then we also can use any verifiable ZK DID

standards really. Right now we just have plug-and-play verification for for those ones. Uh what's cool with that for us is that since we have flexible DI calls, we also can mix it with like KYC and some other properties your organization roles and stuff like that. So complexity very important right now uh implementation complexity especially looking into how many hacks are there and how difficult is it to audit, how difficult is it to uh implement this thing. So if you look at the again FHE is still modern cryptography uh ade like these are quite complex. So older solutions of course less complex just because we know more about them. Uh and then previdium and us are quite

smaller and the goal was there that's right now AI is much better in offensive than in defensive. So it's better like tinkering around and finding issue in your protocol then it can actually reason and make sure that your protocol is coherent. So the least amount of moving parts and the least amount of uh complexity is the better uh for now. Maybe it's going to be different five years from now, but that's what we chose to do. And the cost of privacy on top. So you're already running your chain. Let's say I'm I'm subtracting this cost, but the cost purely cost in money like how much does it cost to run a privacy?

Again, FHE EVM very high cost. ZK as well like if you look at the Nightfall, their provers are very expensive. Anything based with modern cryptography is quite expensive to run per transaction basis. Again, plain AVM of course basically zero cost and then access control solutions are like very lightweight. So I think both previdium and us just add like milliseconds to RPC calls. That's it like and not much hardware do you need for this very important piece that a lot of things a lot of players are because probably they're looking from the enterprise standpoint but you also need to stay compliant that means your operations of this tool needs to be compliant for SOC

for example that means that if somebody changes something there needs to be paper trail of changes who changed why on which request who approved yada yada all the paper trail so we selected by running this thing more like an infrastructure. There is a UI but uh this UI could be done made read only. So we basically use UI mostly for UI demos and then if you really want to configure it you configure it through your infrastructure deployment pipelines and if you're already compliant organization then mean that means that your infrastructure deployment pipelines are already covered by all this paper trail.

So again it's very important uh piece in here. Um, and you can basically deploy [clears throat] our solution either like if you already have your own private chain and you want to add access control to it, you can and you control everything then you can basically put it as a layer or if you want to run it on a public like on a public something then you basically use our thing. We deploy it together with little encrypted ref uh which is an AVM and then you lock your money in and use it like as a shielded pool if you want.

Uh again trade-offs very important. I mean we give away trustlessness in this case for enterprises. They will not play this game anyway. They want control over trustlessness. So that's what you're giving away. I mean you're getting very cheap, easy to reason and uh practical privacy. Um yeah, I probably will skip this one. My point in here also was that I wanted to talk about how we think about thought about when we designed this solution. I'm not here to sell anything. This thing would be open sourced like end of this month. And if you want to contribute or use it, you like just look at our Twitter. We'll just share

the GitHub repo because my goal as well is that I see right now with AI like just from my demos I've seen a few teams already trying to do the same type of privacy and for me it's like why why are we bothering like we'll open source it let's make one good solution for that particular problem and just work on this together. So we open sourced it at like Apache license so you can then do whatever you want. We just want to make sure that before that it passes at least the initial audit from uh from the security companies. Uh that's what we're waiting for. So that's it. Again, I'm not here to shield or anything. You can just check um like our Twitter or something our website when we open source it. And that's what I wanted to

say. Yeah. Thank you so much. >> Thanks. Are there any questions for Eager? So, so the reason you're using a zero knowledge proof for the access control layer is it to hide who is making the query. >> Uh, what we basically are doing that you have this thing, right? And it's it's a black box and you want to ensure uh security and to ensure security like the typical blockchain solution is okay we'll run validators and they will all execute and make sure that there is an

economic incentive. An alternative to that is that ZK prover executes everything and then publishes the official proof to L1 which is not leaking any privacy that everything that's happened in this blockchain happened according to the rule of the blockchain. That's about it. So it's it's correctness enforcement. >> Okay. Okay. So the the CKDs you talked about is for the for that not for the access control places. One place is correctness which is the KVM and another is identity where we can use but it's not ours invention it's the identity invention when you can actually get the claims let's say I can get a zk proof that the every user is over 18 years old so they are able to do financial

transactions or I can have like a zikk proof that the users are not in the sanctioned countries or something like this so we use this for identity enforcements as well So two places. Yes. >> Okay. So you use that inside of your system to enforce that sort of rules. >> Yeah. Yeah. But we use external components for that. So our system itself is not generating proofs or anything. It's uh it uses verifier from ident 3 and it uses verifiers from well currently SP1 but in the future want to move to this as quickly as possible. >> Any other question?

No. Thank you. >> Thank you so much.