Privacy on x402

Transcript

Thank you. Hi everyone. Hi everyone. Um I'm Rahul. I'm a product lead at Aztec and I'm not going to talk about Aztec per se, but I'm more going to talk about how do you think about privacy for X42. I'm following Shafu's talk. He spoke about how one of the most important things right now is figuring out privacy. But it's not so simple and I'm going to talk about some of those things. So, uh, the first thing to think about when you want to think about privacy is like, well, what use cases do I even care about? Um, I strongly believe that the way X402 will play out is not a user like a human paying for things via X42.

It's also not a user paying an agent who then pays a resource, let's say, but instead it's either an agent directly talking to what I call a company. So that could be a big corporate like Google, an IoT machine. Or it could be the other way around, a company paying its agents, its users for its services. A good example is how Brave does things today where they want to pay people who use Brave because they are not because they're using their data for ads. The reverse is an agent paying the company because it's trying to read like microp payments and stuff. Importantly, what you don't see here is a user, a human, a human wallet ever being involved. In

both of the use cases, you have a se you have several problems that I think will limit X42's mass adoption. One of them is when an agent is paying the company, you can sort of reverse engineer what the payment is for, who it is, which agent it is. Um, and from a legal point of view, it might create a lot of issues because you can even know perhaps what user is involved talking to the agent to do certain things. There's a lot of data protection laws all over the world. This would lead to a lot of issues. In the second use case of a company paying an agent, I also foresee a few problems.

One of them is everyone can see that user X or agent X is getting paid this much. The other one is a company might actually leak a user or an agent's patterns. A lot of agents, kind of similar to highfrequency trading, have proprietary algorithms. They do proprietary stuff. It's their secret source. They might not want to show everyone publicly how they're making the kind of data and the answers that they are. Um, and because of this, I think a lot of big companies may not actually use X42. And I would rather have a world where everyone uses crypto and X42 and all of its innovations.

Um, so let me recap what are the things that get leaked and then we can walk through what are the things we want to hide which what people mean by privacy and how can we hide them. So obviously there is if I use X42 language and I can clarify what these mean is the first thing that gets leaked is a resource. A resource is the company that rewards the microp payments like New York Times for showing an article. The second is the agent. In today's usage of X42, a lot of this is also the user, the actual user wallet, the actual agent wallet that's doing things on behalf of the user. The third thing is metadata. That could be things like how many tokens are being transferred, what token at what time.

That leaks a lot of information, more than you would realize. And the final thing is the facilitator, the the the server, let's say, that's actually facilitating the act of X42 payments. That only happens if you're in today's world where all the facilitators seem to be sponsoring fees. So you can see who actually is crediting the transaction, right? So you reveal the two, you reveal the from, you reveal the message sender, and you reveal all of the other metadata along the way. Not that nice. Okay, the next question is okay fine. What of these do we actually want to hide though? People say we want private x42 but like which of these need to be private? Which of these do we care about? Which of these should actually be

public is a very important thing. Blockchains were built on this idea of transparency. Uh Shafu had built X402 scan. A lot of those great resources can only be built when you have transparency. So you may not want to hide absolutely everything, especially if it's a new space where you want to track data, you want to see analytics, you want to figure out what what you can improve as an industry, all of us together. A resource is something you may want to hide. Um I personally think that the transparency of seeing which resource is being used, which resource has the most adoption is quite nice from an analytics point of view.

An agent is probably definitely something you want to hide. You don't want to leak which user it is or like what the user wanted the agent to do and therefore what agents have been used because that leaks a lot of users patterns. You definitely want to hide the metadata. There is no reason why I want to know that like person A is being paid 10 cents to person B. That doesn't even help with analytics to be honest. Um, you still know that a transaction happened. You still know that an X42 thing happened, but you don't need to know the ex exact details of that. Um, I'm happy to talk about this later in Q&A if people think I'm wrong. And the final one is facilitator. Again, the

transparency of which facilitator is being used might be quite nice. You might have a reputation system for what's the best facilitator. For that, you might want to know which facilitator is doing the right things and choose accordingly. That can be onchain, that could also be off-chain. I work on blockchains. I would rather things be onchain. Um, okay. The next question to think about is let's say we agree that the things to hide are these two in the middle, number two and number three. Okay. Well, but who do you want to hide this from?

That's also a very important question. The reason this is important is well the resource New York Times in this case likely wants to know which agent is querying and how much the agent wants to be paid. Keeping it private from the resource is kind of weird because now why would the resource talk to you if it doesn't know what you are and how much is going to be paid. So you kind of want to let the resource know all of the details. So from the resources perspective, everything has to be public. What does the agent need to know? Well, the agent is the person that's executing all of these things. is the one that's paying. So from the agent's perspective, it should be public too.

What does the facilitator need to know? That's an important question to ask. Does the facilitator actually need to know what agent and what resource is being involved? Don't they just need to verify and send a transaction and make sure it settles? Do they need to know all of these weird metadata in the middle? I don't think so. What about everyone else? Random onchain people like us who just want to look at what's happening. Do we need to know everything? I don't think so. We might need to know what the facilitator is. We may need to know what the resource is from analytics, but we definitely don't need to know what the token amount is, what token it is, and all of these things.

[snorts] The point I'm getting to is anytime you say you hear someone say, "Oh, we need privacy for XY Z." The real question to think about is well what do you actually need to hide and who you need to hide from because privacy is clearly a spectrum. We went from oh let's make x x402 private to figuring out what are the things that hap that are known to then figuring out what are the things we want to hide to then figuring out what are the things we want to hide other people from and who too.

So privacy is a pretty huge spectrum. We need to think about things very properly to design better systems. An easy way to think about the spectrum of privacy is using these mental models. Transparent is the world most of us live in today when we use blockchains. Everything is known. Anonymity is when you don't know who the sender and the recipient is, but you do know the amount that's being transferred. A lot of the old privacy protocols worked this way.

Confidentiality is when you know it's sort of the inverse of anonymity. You know who the sender is. You know who the recipient is but you don't know the metadata in the middle. Zama is doing a lot of cool job around this kind of things. Privacy is by default you can hide everything so you see all of the black boxes. Is the most powerful tool in the world but optionally you can decide to leak whatever it is you want to do. Selective disclosure is what this is called in the privacy industry. So by default everything is hidden but you can choose what to make it public and this is what mean this is what I meant by privacy is a spectrum. Which of these do you want?

Who of these you want to hide from as well is an important question. Okay. Well I work at Aztec. I promise not to shill Aztec too much except one slide. I just want to talk very quickly on like let's say X42 was built on Aztec today. What could it be hidden? The only thing you need to know about Aztec, if you don't know about us today already, is we have the best booth in all of Dev Connect. We have amazing swag and we're a privacy L2. But because privacy is a spectrum, it's not just a private chain.

We actually al we have private state, private contracts, but we also have public state and public contracts. So people may not even know what code you're running. People definitely do not know what transactions is creating. But you can also encue public calls which will then tell people what you are doing. So if X42 was on Aztec you would see stuff like the agent um sorry can people hear? Does my mic work? Okay. Yeah it does.

Yeah. Cheers. Um what you definitely would see is you could see the agent like the agent has to see everything. They're the one creating the transactions. are quite easy. Resource is the one receiving the transaction. We'll talk about one challenge over there later. Um the facilitator may or may not need to know anything at all. Especially if the facilitator is not sponsoring your transaction fee, it doesn't need to do anything on chain. So it doesn't need to know anything. Um but by default because Aztec is private, no one else sees anything. You can't you get all of this kind of for free with very minimal changes. But that's an idealistic goal. The reality is almost all of X42 transactions today happen on base. Base is a public blockchain.

Users are on base. Let's talk about how to make private on base where everyone is already. So first of all, we want to we may want to hide agents from other people. I use the word offiscation. Because base is public, it's actually not possible to completely hide the to and the from in an easy sense without massive trade-offs. But what you can do is offiscate it. Let's say everyone uses Rahul agent but if everyone's using Rahul agent everyone sees that Rahul agent is paying for things but no one can know that which actual user is starting the transaction because everyone's using Rahul agent right so you can offiscate the actual user intent behind the scenes by constructing it so that everyone has the same entry point

the second one is offiscating the resource the person who's gets paid there are some fun interesting ways to do this one is let's say you have money on base which all of us do hopefully it's a great chain you can bridge it into Aztec and then have the chain being paid there and this way you can you can hide you definitely still leak who the two is you may leak who the amount is but you can hide the recipient because that's an Aztec address which is fully private and no one knows how to track it if a transaction happens and which address it actually even is which is a very cool thing to think about hey I can send a transaction to someone without myself knowing who the someone is without anyone being able to track who

the someone is as well. Um, that's the power of privacy. The other way is to do stealth addresses. This is what a lot of teams currently are trying to do, but I think personally it has massive UX trade-offs. It means every time you get a payment, you want to create a new address. So, you have hundreds and thousands of addresses. It's a big issue if you scale. Um but hey the good news is this works on Ethereum today. Creating an address is very easy. You have some issues in terms of consolidation of all of the addresses but it kind of works.

The final approach for offiscating a resource is using privacy pools like rail gun and zero xbow or privacy pools as they call themselves. Um the way this works here is you sort of deposit similar to bridging into a whole private chain. These rail gun and zeroxbo are not a chain on themselves. They only allow people to deposit and withdraw assets but still on the same chain. So it's still like a bridge but you're still on the same chain. It's a wrapper token in many ways. So this would help you offiscate who the resource is. The final thing we wanted to hide was the payment metadata, the token, the amount and such. There are only two ways that we can do it from what I could infer. One actually is Zama. Zama is an

FHE protocol that does confidentiality. Uh let me remind you that confidentiality is just hiding the payment metadata, but you still keep the two and from public. So it has some trade-offs. But Zama also like zero XBO is not its own chain. It's a wrapper token. So you can like wrap into confidential USDC and do the transaction there. The agent and the resource is still known, but the token the payments are not. Especially if you offiscate the agent over here then it's quite nice actually. The other the final way of doing this is by is if if you already have money in a privacy pool like Zeroxbo or rail gun or Aztec.

It's kind of cheating. Let's assume you already have money there then well because you have money there you can kind of create the transaction already on these chains. You can withdraw to a new address and this way no one actually knows when the transaction happened. They know that a transaction got settled obviously, but they don't know how much it was for and who it was for. This has the trade-off of the fact that you already need money in these systems. So, it's not as quite nice. The point is privacy is a spectrum, which means everywhere they're trade-offs and we need to learn which trade-offs we're okay with, which is why I had question marks on my previous slide on like, hey, what are the things we actually want to keep private?

This is why they're question marks. Like, it's a user decision. It's a facilitative decision and you have different mental models on how you can achieve it. The final thing I will say is all of the privacy systems have some trade-offs. One of them is latency. You can only give privacy to resting assets, which means if I keep moving around, if I keep doing degenerate things, if I keep walking around all of Dev Connect, people will see me more and more. But if I hide in a corner, it's much harder for people to know who I am. So, but that means you need a lot of latency in your systems. But we like payments to be fast. The other one is a very interesting problem in computer science called note discovery which is the idea if I'm paying someone privately how do they discover that they got the note

because unlike public blockchains everything is sort of encrypted. So for my perspective or the ethers scans perspective all of this is garbbled data. How do I know which data is mine? The naive solution is you just sort of brute force the entire Merkel tree. This is how Zcash works today. Interestingly um how Aztec works today is using old school defy helman and doing some encryption. I can talk about it later if people are interested. Um yes as um I'm going to wrap up my talk um a little bit about Aztec. As I said we are a fully programmable chain. The reason this is quite important is because privacy is a spectrum. Users and developers know exactly what they want to keep private. We can't just sort of slap privacy on things. There's a lot of

decisions we need to make. Um, and that's why we have optional privacy at every level. We have selective disclosure and we like to sort of think about extending all of the functionality of Ethereum using bridges to make things like private x 402 possible. Um, just a quick note on our road map. Right now we have we just went live on mainet as part of our ignition chain and in 3 months from now we'll have what we call alpha which is enabling all the smart contracts live on Ethereum L1 with a chain that already has 500 sequences and so we have the sort of the only private and decentralized L2 and we're going to hit stage two quite soon in all of Ethereum. Um that was it. Thank you. I'm open for any questions.

>> [applause] >> Okay, we have time for one question. So, please raise your hand if you have any and our volunteer is going to come to you. Raise your hand. >> Amazing. Either the talk was very nice or very confusing. >> Yeah. Uh in any case, I mean it's it's also a completely new topic. So, if your question comes to mind in meanwhile, please catch him outside. Um, and let's just finish with a big applause. >> Thank you guys.