ZK11: Protecting against Bad Actors in Private Systems - Damian Straszak

Transcript

[Music] hi so I'm Damian I'm with RF zero and let me start by setting the stage so I would like to talk about private systems and the problem of Bad actors so I me first explain what do I mean by by a private system or a privacy system uh is the way I call them in this presentation um so I want to be as general as possible here um and capture essentially all the systems that you are

probably familiar with whether these are Standalone chains whether these are rollups whether this are smart contracts so say zcash astec uh tornado and so on so if you look from uh this stand large enough all these systems are very similar are pretty much the same and they work in the following way so there is a user which has uh say public address on a on a public blockchain and the user enters the system by depositing some funds then they are inside the system inside the Privacy system um then they make some transactions this could be

some transfers this could be maybe some defi interactions um think of like regular blockchain uh uh interactions uh which have to do with some assets tokens right um then at some point after maybe a couple of days they might withdraw the funds either part of the funds or all the all of the funds but the point is that uh the trace in inside of this private system is kind of hidden okay so what is this Trace uh for the purpose of this talk I think of the trace as the set of state of this

particular user uh that has happened when it was in the private system okay uh so normally you would then prove in Z knowledge that the state transition between each subsequent state was done correctly okay this is common between all these systems that I mentioned before okay so so for this talk this is our model of a private system um and I will refer to the trade uh refer refer uh to this to this sequence of tra of States as the trace okay so I will uh so this will this will come up quite often this

talk um great uh so what's the problem that we are probably all famili familar with is a problem of um people essentially abusing the system so if things are fully private uh things are permissionless then well you can use such a uh private system to launder money this is quite obvious actually it has happened and it's happening all the time and obviously this is bad this is bad because then people associate crypto with uh you know fraud uh users are affect ected by sanctions such as forun cash people end up in jail you know we don't like this right uh so we would

like uh some solutions to that and what we would like to achieve is essentially a word where there are private systems which offer privacy um but which don't have B actors so we would like to disincentivize uh Bad actors for from participating in s systems uh so that well uh these systems are safe to use for normal people okay for people who just don't want to abuse the system they just want privacy uh which is something that uh I think all we all all agree with that uh it's it's essential right and this is this is what blockchain is

currently lacking um so I would like to give a let's say synthesis of knowledge on uh on this topic um and offer some kind of a viewpoint on how to categorize all the approaches and maybe then conclude on like what we can do today what we will be able to do later once enough progress is done um and yeah let's see where it goes uh so one thing I will not talk about is legal uh not talk about regulations compliance and so on I'm not a lawyer so I am not very competent uh this is actually very important in this

problem uh but essentially out of scope in this St great so there is one assumption I would like to make and I think it's a pretty important one when building such a system a private system one thing that you don't want to do uh when trying to solve this problem of B actors is actually confiscating freezing or or slashing funds okay uh so as a as a protocol architect that you might be tempted to think okay so now we have found this bad guy so here is stolen some funds so maybe maybe we could just take the funds

right or maybe we could freeze them maybe we could uh somehow penalize this guy because he is bad right um and I can tell you like we have thought a lot about that um we have been talking to many people and um well this is just a bad idea for many many reasons including legal reasons like what you do if uh if there are some false positives and so on so essentially if the thing you do to penalize productors is deanonymization this is enough okay so if someone comes to the system system uh just to launder money and we say oh but if you do that

and essentially we're we will de anonymize you so you will not gain anything and it's enough right they will not come uh they will not uh use the system to laer money because there is some point so this is enough right and this is also a nice assumption to make because then you can have a like very simple view on what the system really does so the system is really defined in or the protocol is really defining when can you de anonymize or when can you reveal trace or the part of the trace and who can do that essentially so this is essentially how you define the Privacy system uh with respect to this this problem okay and now once we have

this like simple uh model in mind we can uh categorize approaches and there just two approaches uh or two categories one category of uh approaches is voluntary reveal so you allow the user to reveal information about the trace and any reveal that is happening uh must be accepted by the user okay this is one this is one category nobody can uh reveal anything about the users Trace without the user's consent and the opposite is obviously inv voluntary

reveal uh so there could be some powerful parties in the system who can reveal without users consent and well uh this is a quite brutal slide so don't get scared now um but uh well um unfortunately this is the picture so when you when you saw the previous slide you thought okay voluntary reveal yeah this is something we like this is what we fight for here right um and this is what the solution should be and yeah I also agree with that that this is really what we would like the solution to be

but for many reasons some of them are will explain in the stock uh it's not so simple and making thing voluntary is kind of weak um so things that actually work must be involuntary this is a little bit sad but uh that's the reality and well the obvious reason for that is uh the following um so as a hacker I mean well if I have a choice to reveal or not uh it's quite obvious what what the choice will be um maybe it's it's it's it's too simple I mean uh people who have thought about that uh they they are

probably seeing like some some sties here it's not so simple I mean voluntary reveal but to whom maybe there is like depending on who do you reveal with to like they can kind of force you to reveal uh so it's it's not that simple but let us maybe look at a couple of approaches from this voluntary R category so that we see really what we are talking about here so one general idea that has come up in the literature uh is proof of Innocence so Alise upon let's say leaving the system withd drawing from

the system uh is supposed to prove in zal knowledge that whatever she did or maybe that the deposit she did was from a legit addressed uh so there could be a black list list of uh addresses uh related to let's say a Haw or you know uh addresses that are uh somehow elicit and basically what we can do technically is prove that alysis address is not within this uh list um why this is not ideal the the problem of that is that typically the list The Blacklist is updated uh infrequently so what Alise can do is

enter the system and live shortly after and she essentially has laed money and nobody can uh yeah can can do anything about that because the Black List was updated too late so this is this is a serious problem with this so there comes another idea which is also often used is very useful and it has come a lot in literature which is the idea of viewing so this is essentially ability for a lease to prove to certain parties what the trace looks like or maybe what the deposit was it's basically um allowing Alise to reveal part of the trace to anybody wants for

instance let's say Alise wants to deposit some funds to a central centralized exchange so she is just sending the proof look my funds are legit so what you would expect the uh the The Exchange to say is well yeah that's a nice proof uh but well we are not yet there um it's it's complicated there is no standard uh no exchange will will essentially integrate this now this is something that um eventually will happen at least this is our hope but

uh it's not there yet so this this is kind of a problem for now so on the other hand involuntary reveal um how would it work so essentially um what you do when interacting with this uh private system is you attach some kind of encrypted data call it call data to the transactions which allow by certain party to reveal what this interactions were okay and then it if at any point of time let's say it is discovered that a certain deposit to the Privacy system

comes from a let's say lit address then there is a process which allows to essentially recover the whole trace of this uh user okay how is this done technically well I I can explain after the talk because uh yeah it's it's lightning talk so I I yeah I cannot include all this detail here uh but it's not not very hard uh you can do it with snarks quite easily um the problem here is obviously well so who decides who to reveal and who actually has the power to reveal uh and we all know the solutions

right this is quite obvious um and yeah this is a joke uh the problem is really uh non obvious and well there is lots of work required to kind of understand what can we do here uh what should be should the process be um yeah this these are all uh questions which as to be answered but um I would say to conclude um I think the future is really uh an ideal system which is based on involuntary reveal which has all these nice Solutions viewing Keys proofs

of Innocence maybe proofs of Innocence against a couple of different blocklists depending on the on the party you are talking with like all these things can be done but there needs to be adoption there needs like every single exchange every sing single uh onramp offramp needs to adopt this otherwise there will be leaks right if someone is accepting funds that are essentially ilicit then they are spreading like this is this is not something we can do so everyone would need to essentially uh adopt that and for now what we can do until maybe there is further adoptions we can um probably incorporate solutions

that our summary between we can have some involuntary Ral um component in the system uh that is somehow fair and users are happy with it so I guess this is this is some kind of a direction that this is um um going to at least this is this is our um impression now uh so thanks all for listening and we have than no okay