Privacy that doesn’t break the chain

Transcript

Okay, AV issues. Uh Can someone quickly lend a hand here? Okay. Uh thanks for bearing with the AV issues. Uh hey, welcome to the most exciting track in uh ECC. So, thank you for staying all uh all day long for me.

Appreciate you. Uh I'm Tomer, I'm CPO at Steel Development Foundation. Uh I've been in crypto for almost 9 years. Um and for the past couple of years, really focused on uh privacy specifically. So, this talk is about uh what we've learned in discussions with institutions um about privacy. So, if you're in this room, you probably uh are already sold on privacy. Uh but just to level set, uh blockchain's the only financial system where everything is completely visible. Every transaction is visible to everyone. Uh so, even if your bank account is private and your paycheck is private, uh once you move uh on chain, everything is public. For individuals,

for individuals, this means that anyone with a block explorer can effectively reconstruct your entire financial history, which is not great. But for institutions, it's even worse. It means that uh volumes, relationships, payroll, trading strategies, everything is completely visible to the world and worse to your competitors. So, when we talk to financial institutions, they make it very clear that not having a way to manage visibility is a non-starter for any meaningful engagement with blockchain.

So, uh you should say this is easy. We've been working on privacy and blockchain for the past 10 years. We have uh you know, tornado cash, zcash, and so on and so forth. But, uh not exactly. So, you know, we've been working on um uh privacy in crypto in a very kind of like ideological cypherpunk way in which we're promoting complete financial freedom, which is um awesome, but for this next wave of adoption, we really need institutions. So, we need them to feel comfortable bringing their uh assets on chain. We want them to make payroll. We want them to accept merchant payments. We want them to engage with blockchain in a meaningful way.

So, for these institutions, privacy means something a bit different. They means It means uh managing visibility in a way that gives them uh control, allows them to stay both competitive and compliant. And so, this mistake that we've made is really building privacy that is absolute. But, what institutions are telling us is that privacy is in fact a spectrum. Privacy is not binary. It's a spectrum with an enormous number of permutations. Jurisdiction varies. So, a regulated asset that is issued in the US adheres to a very different regulatory regime than one in uh an

equivalent one in Germany. We have variants by use cases. So, the type of privacy you need for payments is different from remittances, lending, or trading. And we also have a lot of variants in technology. So, you know, we talk a lot about zero-knowledge cryptography here, but ZK, FHE, MPC, TEEs, all of them bring different types of performance to the table, tip different types of privacy guarantees, and what they can actually hide. So, the real problem is that we've been treating privacy as basically like a single feature, but it's actually this multi-dimensional design space.

And so, not recognizing this privacy spectrum has led to what I like to call privacy dead ends. And so, you know, when we started looking at privacy for Stellar a couple of years ago, we realized that most privacy solutions out there today fall into one of two failure modes or dead ends. One of them is the all-or-nothing failure mode. And so, these are privacy solutions that have basically two modes, either full transparency or full privacy.

Nothing in between. So, this can take the shape of a privacy of a pool of a specific pool. This can take the shape of an L2 or an app chain, but regardless, the premise is all the same, all or nothing. This is not good enough for institutions, they need more room and nuance for regulated financial institutions. The other failure mode is the permission chain, which is a bit of a sensitive topic here. I've been in I've been in crypto for almost 9 years, and I think that permission chains are something that every couple of years, you know, like new ones emerge, they die off, and then suddenly they re-emerge. And I think that one disturbing thing we've seen recently is there are more permission chains emerging, and you know, this time around that it's on the

premise of privacy. Now, yes, they're private. They're private because it's a database on your computer, right? And so, you know, what we're seeing is that institutions are looking for open participations network. They see the value of interoperability. They see the value of composability, verifiability, and so permission chains or centralized databases are a dead end. Okay, so how do you avoid these type of privacy dead ends? Um we think the answer is simple uh by having a clear architectural separation in the privacy stack.

So, transparency should come first. The base layer should stay open and auditable. This might come as a surprise given that this is a talk about privacy, but um transparency is a core value proposition of blockchain for institutions. The fact that an executive at an asset management company can uh go into a block explorer and see the circulating supply of an asset and see the high-level distribution, that is not a bug, that is a feature. They love it. We want to make sure that uh we provide this value moving forward.

And so, we suggest on top of that layering in building blocks for privacy. So, the base layer should provide the primitives that enable privacy without enshrining a specific privacy protocol. We've seen L1s try to enshrine privacy protocols. It doesn't end well. Sometimes it's buggy. Sometimes it's just um uh sometimes it's obsolete by the time it comes out. And so, uh what we did at Stellar is take a building blocks approach. Uh we actually launched uh the Xray protocol upgrade a couple months ago, uh which introduced a very rich set of zero-knowledge cryptography primitives so that you can come and build whatever privacy protocol you want

on top. And that's the final layer, privacy protocols on top. Different protocols for different privacy guarantees, different administrative controls, and different underlying tech. And most importantly, there will be many privacy protocols, and that's okay. So, we keep talking about these uh different privacy protocols for different use cases. Uh let's give some examples. And so, I want to focus on private payments because there's a lot of interesting stuff happening in DeFi in general private private trading, etc. But, these are still a ways out, and payments are by far the most important, most immediate use case.

And in private payments, we're seeing two major families of uh privacy happening these days. One of them is confidential tokens. So, confidential tokens hide the what. They hide They hide the payment amount, and they hide the balances. But, the sender and receivers are still visible. So, this is great for when counterparty relationships are known. For example, um in a payroll situation, everyone knows that I'm employed by SDF, so that's not uh that's not a problem to disclose, but with that said, the amounts and balances are.

So, there are a bunch of different implementations of this. Uh we're We at Stellar are part of the confidential token association with others like OpenZeppelin and Zama. Um and we're in the process of building an implementation specifically for that. And the nice thing about confidential tokens is that even though they deliver a fairly narrow uh sense of privacy, it's still something that is uh usable, has value, um and more importantly, it's scalable, and the compliance story is fairly easy because uh the counterparties are known.

The second family we're seeing, the second family of private private payments, are privacy pools. So, these are payments uh payment protocols that hide both the what and the who. So, funds are mixed mixed together, so that senders and receivers are not uh are not shown, they're hidden. And this provides anonymity uh on top of confidentiality. So, some notables examples of that are Oxbow in the Ethereum ecosystem that have been doing a really great job. We've also seen Nethermind launch Stellar private payments on Stellar, which is kind of like a building block to build privacy pools on Stellar.

And privacy pools have a much stronger privacy guarantee, but they inherently mix funds. So, that's dangerous because it means that legitimate funds can be commingled with illicit funds. That's a problem, but there are there are ways to tackle this that I will cover. Um so, this demonstrates how we have different privacy guarantees. Again, privacy is a spectrum. And so, the question is how do we build administrative tools that allow us to control to enable the compliance with these protocols and others.

So, at Stellar, we've been working with various builders in the space to define compliance menu of opt-in administrative control. Now, the asterisk in this in compliance is deliberate. I am not a lawyer, and also the space of privacy and blockchains is so new that we don't really know what compliance looks like. So, these are the administrative controls we're starting to see as requirements. This is not a comprehensive list, and the idea is to have these as configurable and opt-in as needed.

So, the first thing we're seeing, the first control, is selective disclosure, usually using view keys. So, the user chooses to reveal specific transaction details to specific parties. This allows the user to show a specific source of funds on demand. So, for example, if I'm depositing it to Coinbase, Coinbase wants to know where these funds are coming from, I can show them a cryptographically secure source of funds. It's a very powerful primitive. It's existed for a while, but unfortunately we haven't really seen great protocols built on top of it.

But I believe we're going to see more of that coming soon. The next administrative control in this compliance menu is non-selective disclosure. So in this scheme, a third-party auditor is able to hold a key that view all transactions within a scope. So that means that an issuer or a pool operator has these keys, and if law enforcement, for example, needs to trace a specific transaction or specific user, they basically have like a door to knock on, so they so they know who to look for.

The next administrative control is association sets. So this was pioneered by the privacy pools paper a few years ago by Vitalik, Emin, and others, utilized by Oxbow. And the idea here is that this addresses the need to basically have some sort of filter on who can participate in a pool, so that even though a pool is commingled funds, we know that everyone in this pool have went through some minimal set of compliance checks.

Then the question is what happens if someone passed the compliance check, but then later was proven to be problematic, or the funds had like some some problematic source. And so for that, we're seeing various solutions that look like forced transparent withdrawals. So the idea is basically if you're if you're removed from the association set, you're forced to withdraw, but not in a private way. So your privacy guarantees are not maintained, but you're still in control of your funds.

Oxbow calls this rage quit, uh but we're seeing a lot of these type of uh of use cases coming up. Um and the last one is clawback. So, yes, clawbacks are a bit triggering for us in crypto, uh but um you know, tokenization at full is at full speed. Regulated asset issuers require clawback, and we if we want them to uh participate in a meaningful way, then yes, we need to have clawback capabilities. Again, this is a private uh this is a privacy-compliant menu. You don't have to choose all of them. Different assets, different use cases are going to see different ones.

Um if you're in this room, and any of this is offensive to you, please come and talk to us. This is uh an ongoing process, and we're learning um and and we're coming up with these as as required. Um so, kind of like just to wrap up, um in crypto, we've been building privacy, uh which is great, but we've been really focused on ideology and Cypherpunk values. These are great, but not enough anymore, cuz institutions require something that is um a bit more nuanced. Um privacy is a spectrum. We have different jurisdictions, different use cases, different tech, um and there's no single answer, and that's completely okay. That's part of the process.

The right approach, in our opinion, is transparency first. We want to keep the base layer open. We want to provide the right building blocks to build privacy protocols on top. Things like confidential tokens, things like privacy pools, and administrative controls as needed for these use cases. Now, all these building blocks are already in place. We have a non-hostile administration in the US, which is awesome. We have institutions that are at the table, finally. They're understanding the value of blockchain. They want to engage.

And we have a lot of tech that is already in place. And so there are no excuses. We're building privacy that doesn't break the chain. And if that's interesting to you, awesome. Come build with us on Stellar. Thank you so much. Do you have any questions for the speaker? Great talk. I would just to know if you can mention some product or example of

the clawback in the privacy how it how it works because I haven't seen it in production yet. Yeah, so we haven't seen we haven't seen any of these yet. Stellar private payments is a project by Nethermind. The V1 is already open-source and live and you can check it right now. It's a privacy pools implementation that has a bunch of administrative controls on it, mostly association sets and non-association sets. For V2, we're building the rest of the administrative controls that I just shown in the in the menu. So the idea is that a regulated asset can participate in this pool because today if you look at assets like like commodities, anything that's that's kind of like under the like the SSC

restrictions, currently they require clawback capabilities. And for example, we've worked with the DTCC on on building clawback into the base Stellar protocol. And so if you have Stellar asset today as an issuer, you also have an opt-in capability for clawback. I think we were the first network to introduce something like this. Again, because of the requirements of regulated issuers. And so now we're taking the next step of bringing this into privacy solutions. >> Okay.

Uh super interesting. Thank you very much. Um that's a very like uh thorough understanding and like landscape of privacy, I think uh today. I'm super curious about the use cases that you're seeing uh that some of these institutions or companies um are wanting to have on chain and that are requiring some levels of privacy. Yeah, I think the immediate ones are uh payroll. We're seeing a lot of demand for payroll, especially even for us at SDF, for example. You know, we're in we're in we're in the US. Um we we're really um big on dogfooding our own tech, but payroll is something that we've been unable to achieve until now because of the lack of privacy. And I do believe that by the end of 2026, we can have

full payroll on chain. Uh we're we're we're hearing from uh merchant uh merchant solutions. Um you know, PayPal are really great example. They launched PYUSD a couple of years ago. They launched PYUSD on Stellar uh a few months ago. They really want to do merchant payments, but it's not realistic to do that without some form of uh of privacy. Um and then uh I think probably that one of the biggest one is is basically tokenized uh kind of like real-world assets uh because we're seeing a lot of regulated assets like uh you know, we have 1.4 billion dollars worth of uh assets on uh on Stellar right now, RWAs.

And there's a limited capability of distribution right now because of the lack of privacy uh control. So, that's something that uh I think will be like a huge um uh kind of like multiplier for the adoption of RWAs. Thank you. Thank you. Great talk. So, one of the questions I had is a I think there's a distinction in privacy when you're talking about institutions and also like retail like the the normal people, you know?

So I I I I want to know what is your take on that is like the the promises of you know Cypherpunk and things like that are more to users, you know, real world real users and what you're talking about is more the the needs of the institutions. So what is your take on that? Yeah, I'm you know, I'm a big fan of of Zcash. I might hold a Zcash at the you'll never know. Um but but the reality is that at the end of the day this separation of institution and retail doesn't make sense because at the end of the day you need to be able if you want really meaningful retail adoption, you need to make your money useful. Money useful means interacting with institutions. It means your employer being able to pay you in in in crypto. It means you being able to

make a purchase in crypto, right? So yes, there is kind of like a limited set of use cases for like peer-to-peer transfers and if you're in like, you know, Noisebridge in San Francisco and you want to hang out with your buddies and like, you know, move Zcash around for fun, great. I love that. That is not what adoption looks like.