zkSummit: ZKAPs: How to use Privacy Pass for payment-based access to your application - Anna Kaplan

Transcript

hi and hello um I'll give a talk today about Z caps I'm going to talk about how to use their knowledge proofs of payment based access to your application hi I'm Anna Kaplan I am a security researcher and the graduate student I work for the authority and I study attack University of Munich and I'm excited to be here so Z caps this is going to be a very that's a practical approach and we're going to look at a practical protocol so I hope you like it I made to show you technicalities as well but we're not going to use a crazy the kiss in our construction but just a very kind of

simple like I say discrete logarithm equivalence proof I hope you're as excited as I am okay so what are we going to tackle today okay that works now we are going to look first at the use case and think about like why and like okay I'm going to explain to you what was actually the problem I want to just solve because this is the case right we have this really cool constructions with your knowledge proofs but then like people have used cases and they really want to use them and it's somehow the problem is how to bring those together so I'm you're going to tell you about a use case we had and the police authority have and again I'm going to talk about I'm going to go a little deeper into the

use case which is actually a cloud storage solution called private storage and then another thing came up another private thing privacy pass and which another team and another group did and which then Lisa thority adapted for the use case and use the underlying technologies and privacy paths to use for their cloud sorts Lucian and their problem so I'm going to explain this is kneecaps and I'm going to explain the capstan and then we're going to think about extensions or more I want to motivate you to use kneecaps or this ideas in your

for your problems and your use cases okay let's dive in so what happened was I'm now like in the top I hope that's all right so what happened was that is that least authority I cannot like I'm so sorry I cannot put my window down somewhat this is not working okay so least authority build a private cloud storage solution the idea that you have a tote storage it's private though and it's the focus is really on the privacy so there's client-side encryption and the cipher like it's like the your text is encrypted and it's like

getting like separated and put like somewhere else and there is a grade and it's not a CL there's no user counts we like it's based on capabilities so it's like I really like privacy focused solution so this was the use case um the problem was though that to use that you had to pay right like some point of companies to make money so the customer isn't to pay the company and for that this is very you stripe and charge me as partners and as a customer you had to provide your name and email address implication and transaction data and all

of this data and all of this was shared to strive in charge me so actually you're like all personally I was like yeah basically all your personal aid it was collected for the payments and as a privacy focused company this is not something that you want just to but put it all together and summarize it again the problem was really like just to how to separate this accounting step from providing a service step so in the top you see that like a customer pays with credit card and all this gets processed sent accounting and then counting is like saying okay this person paid so you can provide the service and the problem was we didn't want to do that so this

isn't at the bottom charge kinda and this is where the recaps came in ah that's where we use the caps to zero knowledge Nexus passes the idea is that like still just like chain goes on kind of but then the accounting in the accounting step what happens is that such passes get sent to the user and then the user can redeem those access passes to get the service to actually get the service so the service provider doesn't know who the customer is which is something that least Authority wanted so I think the high-level idea is explained

not quite well hopefully and just to give you like the outcome already so yeah that was the cloud storage solution before was called simple secure storage service by this authority and this authority came together from other privacy focused VPN provider not another about a which is called private Internet access and they announced private storaged which then used the zero knowledge access passes that I'm talking about so you can absolutely check out private storage where those implemented cool ok so how did like how come ok this is better half not great no ok so how

come that like the seer knowledge access pass has actually got to be used there was another work which is called privacy past which was worked by alex Davidson Ian goldberg Nick Sullivan Church tankinson filippova sorta from 2018 and this work was done with health fair and club fair had another problem they wanted to soul um actually so the problem was rising because of these amazing things that you see there um everybody knows that the CAPTCHA right the problem is basically that as like for cloud fair clouds were needed to prevent malicious attacks common

spammers to yell attacks from the web and quadra did that through IP reputation assessment and to do that um you need to actually use CAPTCHAs to like this is kind of a solution right how would you know if it's a good I P address you wanna check for the human and as a tour user you I think you've seen those quite some time so yeah and this was kind of kind of problem but then again if you use a privacy focused solution like to a browser you have to solve all those captures all the time and proof that you have a good IP address so the idea was to bring something to people where they have like a pass they can do it once and

you don't have to do it all the time because otherwise they'll look like this like because they sometimes cannot solve the CAPTCHA right like this is basically me all the time anyways but this was the idea and and now I'm going to talk about the background of français passes so again the idea right like you wanna say that like you are human but you don't want to do it all over so you gotta pass the ideas based actually on a solution but charm from 1983 which is called a cache and the idea there is that you take if you have a token and you blind it you and then you get a blind signature from the service so in the end

you can the issuance and redemption are not linkable because you have this life signature and you can like later pass it on so as you see it's like 1983 um I'm not sure how like yeah how much you know but I think like fast crypto was not there yet to me like yeah so what happened was that after we equip 2016 kind of this idea like these ideas got merge it was like kinda the question was how to actually apply this idea of blindness signatures to maybe not always all captures on filippo and George came up with a first specification um to get this like blinded token and yeah so get

that sign and all this and then happy reading later so that those are in linkable to Klopfer but as i meant before 1980s crypto was not very fast it's actually kind of slow and this is was not working so it packs in 2016 Alex came on as well and they asked for help and then when I mentioned then EcoP reps Oh pirates are oblivious pseudo-random functions so you think about them I guess pure off stuff like like some kind of blinding factor as well they are

based on elliptic curves and what then happened is that George came up with a batch solution which is also like verified oblivious pseudo-random functions but redemption batching them also to get more efficiency in the end you can think about difference between VOP or absentee cash because publicly verifiable has VOP rafts only verifiable in the redemption faced by the insurance so this is kind of be kind of the idea and also I'm going to show you um all this work but still this is kind of about the idea going from this cash idea to elliptic curve vo Piero's ok so this

was a group background on privacy past and you see already like ok you have this idea of like like you want to provide a service later you have to do something before and then you get past this this is exactly what the Lisa thority then adopt it um just to give you the general idea for for a cash so you have this token here blind it with and it was the soft capture to the ferry because you want to have some service from the ferry apparently which is a magical package the ferry then signs it in a blind way and we can unwind it and then later send this to the ferry kind the intervention face to get our magical

service so where we're zero knowledge proof sign you straight in in the construction for the ecv or pas de lack is used so basically you just show that two discrete logarithms like they equivalent like they yeah so you basically just show that you can just think of that as a like a special construction yeah so this is where is your knowledge was actually come into play okay just for like to put the privacy past chapter um altogether surprised has now exist as an extension for Firefox and Chrome and

other ideas where where this could like what this could be used is a session reception for TLS or to have some mechanism like referral um or if you just want to have if you just want to like prove like I don't know a single bet something's true or not and you can use that okay cool let's dive in into Z caps now so again this is kind of a problem right paying somewhere but wanting a service or something else pass this is what I wanted like um hopefully like give to you that this problem can

be solved this is our problem and as I said we'll have like some token we can have more tokens actually like we can have a lot of them I mean a lot okay this is not allowed hoarding it's not allowed intensive covet I needed to bring in a corona joke I mean this conference was put on online so yeah anyways so we have a batch of tokens but I'm going to show you the protocol one so the slide you have already seen this is kind of a high-level idea how does this actually work we're going to look at the issuance first what is going to happen with a rockstar

so what happens is actually the Rockstar select some random values which are actually unhatched to develop two curves which gets him the tokens ti2 eyes he also select the blinding factor for which he then can blind his tokens so here it's just I just showed you just put three on there but for privacy paths I just kept this metaphor you bring your self capture for Z caps we actually check with the provider that you paid but just in the issuance phase so don't not an indention pass right so this is kind of a separation I did but then happens is this that Fairy in this case

us at least Authority checks that capture or the payment process uncalculated ID like proof for the signature and there's also like some other value probably put up before and so the fairy or the server then blindly signs those blinded tokens that you send it and sends over to the arc and the rock star can then unlined this values stores of T is and the an eyes and checks of course first day like this is for issuance phases what happens the nation's face for Redemption face what

we do is actually we have some requests a de which is just a bunch of data like an HTTP request and stuff like that and the rock star the user in this case has to generate a shared key step SH key thing which is just a hash of an unspent token so this is the TU and and you in my notation generate a shared key here you see where this comes in right so the rock star then sends over to tu and generally an H Mac which is share key and just request data and I'm in a Redemption face for the were for heavy ferry what happens is that's

the server again recalculate circles data like it sees the requests coming in checks to you on its double spend list because it has a list which and then checks it calculates again big tu because it knows the hash function signs that and can then calculate the shared key as well while doing so and then this is this is where the signature comes in element in and takes a checks actually the H Mac and if that works then it knows okay this user issued stroke enzyme missed token yes not spend so it can just store to you value printable

spending and sent right actually the service yay so this is kind this is kind of the whole idea behind it but there's still not a full specification just so you know and there is I like just to in this talk to make it a little more compensable I just wrote hash function but actually it's three hash function hash functions used so we have one hash function for the issuance chase another hash function for redemption fish and a third hash function for the D like proof inside of your like proof just think of it yeah construction yes and then obviously like also there is we have some public data

which is first sure to everyone to then calculate also in a deal like proof you have to make sure like which you say oh I signed this to something like you have to the equivalence has to be kind of kind of made but you can't have a look of a specification I'm sharing the links in the slide later but just to give you an idea it's not this is kind of the idea it's not a crazy thing and you can absolutely use that for your use case in your application and this is what this talk is actually trying to tell you in its hole okay um this is the idea and there's even coat this is what I wanted to tell you as well so you can

absolutely have a look at our code on Zeke apps so what we do is actually there is just pipe and bindings on the break private space library so we just use another private space library and change that to our for our system and here I just wanted to show you how it actually looks like so this is yeah it's just um yeah we actually call call these things so thanks a lot and this slide is empty because we wanted to see your applications your extensions when you

use Zeke abs or access passes for your use case so happy to see those and the started links and references slides are shared and if you have any questions please reach out we are happy to help happy to answer questions there is my email address but there's also the Twitter profile of least Authority and everybody the least authority is very excited about this and happy to help I think yeah so please reach out and if you've any questions let us know thanks for watching is tok again and bye bye