Why Institutional Custody Breaks on Shielded Chains

Transcript

[applause] >> Good afternoon everyone and thanks for the nice introduction. So, at the CEO we're building network for encrypted compute. And we're focusing at the moment at like the identity and the finance layer. And today I want to talk to you about a problem that we discovered in the last couple of weeks. It will be quite a short talk because in hindsight the problem is quite obvious, but we haven't seen anybody discussing it or addressing it publicly at least.

Now, to appreciate the size of the problem, we first have to look like at the scale of custody today. Most of you are probably very familiar with it, but nevertheless like look at some numbers. So, this one is from Coinbase for example. At the height of the crypto market, it had roughly 300 billion assets under custody. And also if you look at ETFs like most of the ETFs like are custodied with Coinbase. And it's not like one company. It is like a whole industry. If like you look at the numbers of BitGo, like they're not falling really far away.

And if you look at one another like really dominant figure in that space, Fireblocks, it's a different metric, but like 10 trillion transaction volume secured through their custody solutions with over 2,000 institutions, you can appreciate like how important institutional custody is for this market and for crypto itself. Now, before we can see what like the problem is, let's look at the privacy space a bit. So, privacy has like a big renaissance since like a few months. And to highlight here a few projects like that are based on CK. You have Aleo, which is like a layer one CK

um project which is like much largely based on the sexy model, which is also like the same foundational infrastructure that Aztec is running on, which is a L2 on Ethereum. And you have several others like midnight, Cardano affiliated, Miden, and L2 on Ethereum. And of course, everybody knows Zcash. And more recently also, we have um roadmap for Ethereum that goes with client-side proving. So, I would also put this in this bucket. Now, all of those models assume self-custody.

So, you hold your own key. You run your own prover, client-side proving. Um so that the secret never leaves your hand and you have maximum privacy. That's how all of the systems were designed because they were designed with like the unique value proposition of privacy. But on the other side, we have institutional world. And for institutional world, like having only a single entity or person holding the key creates like a really risk, especially for regulated entities. Now, what they do usually is to split the signing of the transaction. And of course, after they begin to like a lot of like uh audit capabilities.

Today, institutional custody like state of the art is looking like something on the line of those. Like you have uh you share your key into three parts, for example. So that no party ever holds the whole secret and can uh single-handedly spend money. Now, this parties, when they want to do transact, they have to come together. But you don't want them come together like physically and having like the key at one place uh restored, but usually the setup could look like a customer has a share, a custodian, and a backup share.

Now, how do you do the signing then and authorizing the transaction the setting? You use what's called like threshold signatures, which are special form of multiparty computation protocols. Multiparty computation is like a field of cryptography that studies how can we compute on data from different parties without revealing their input? Just like we want to share the output together, but like our input data should be stayed private with each of one of us. Exactly what you want to have in the custodian case.

One of the more famous algorithms there is ECDSA because it's used in a lot of blockchains and there are like several thresholdized algorithms for this. And that's how like most of the state of the art custody looks like from Coinbase, Fireblocks. Everybody has its own MPC solution or like building an open source. Now what what do we do when we come to like the zero-knowledge world? There are things starting to break now. Because on public chains every transaction is like authorized by a signature. In the zero-knowledge world, we have transactions are essentially zero-knowledge proofs, which is much more complex than a

signature. You can even say like signatures is a very special case of a zero-knowledge proof. Now, none of those custodians has any solution how to thresholdize the zero-knowledge proof because this would be the equivalent to like thresholdizing the signature. And that's why a lot of them cannot custody shielded assets because they would have to run or hold the key at one point at one entity. Thankfully like academia gives us a way to thresholdize this proving. And in academia, we call this collaborative SNARKs or co-SNARKs in short. And they were introduced uh 4 years ago by then Boneh and Alex.

And essentially, what you do is like you use a multiparty computation protocol and you put the zero knowledge proof inside it. And that way, you thresholdize the whole proving system and the whole generation of the zero knowledge proof. And very similar and uh like you have the same properties then with threshold signatures. You have this like the the parties that come together in an interactive protocol and create the transaction so the zero knowledge proof. And the outcome the zero knowledge proof is indistinguishable from a standard proof.

So, you can you don't have to adapt the protocol. You can just use it on chain to verify your transactions. Now, how far have we come today? Um we've building this tech for now over 2 and 1/2 years. The The part that came now in the last couple of weeks is like the demand and the realization that there is like a problem collaborative SNARKs can solve on this side. So, we built the whole tool chain, the whole stack, and also the network, which did go live uh 2 months ago and does like 100 K transaction uh per day for use cases in identity space, private payment, private yield, private tokenizations.

But now we have thankfully like already all the tooling available to support most of those changes. So, for example, co-circuits is like a way where you can like any circuit circuit. So, this is a domain-specific language for zero knowledge proofs. Uh you can like thresholdize with our tooling. The same goes for Noir, which is like closely attached to the Aztec ecosystem and their proving system. The good part about it is that the overhead is like not that bad. You would imagine like adding two complex technologies like multiparty computations and zero-knowledge proofs and making like interline it's very bad for like performance. But this was like also shown in this paper that

this is unexpectedly fast if you combine those two. So it's already possible today to like custody the then assets in the way like you do with collaborative snarks as you did with like multi-sig. So if you like into the custodian business and need help to onboard shielded assets, that's when we want to talk to you because we think that for like the growth of privacy and to making it available to institution, this is like one of the blockers that is like still not addressed today.

Thank you. >> [applause]