Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 15 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Towards a Feature-Complete and Backwards-Compatible Privacy Layer for Ethereum | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/towards-a-feature-complete-and-backwards-compatible-privacy-layer-for-ethereum/

Eth EOAs and token standards (ERC20/721/1155) are terrible for end-user privacy. Can we build an alternative to them that preserves the existing functionalities while providing meaningful anonymity and privacy? This talk explores the functionality requirements of Eth user accounts, such as asset use authorization, asset & identity provenance, what privacy means in the areas of DeFi, NFTs, and identity, as well as concrete ways to build such an ecosystem.

Speaker(s): Wei Dai, Kyle Charbonnet
Skill level: Intermediate
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: Privacy,Anonymity,Token standards

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Ers, why do we need privacy layers and how are we going to get a private layers that people need so first, let me State the why for privacy layers, obviously, the reason why we need privacy is because we don't have it right now. If you're going to Easter CN, every single transaction is public right, you're able to see the entire history of all the wallets.

A

So the second reason why we need privacy is that if we want mainstream adoption of blockchain Technologies, we really need privacy right. It's one of the main hurdles alongside scalability, and um you know, identity and other issues and finally, uh I'd like to just quickly address on uh you, know: privacy and regulation issues and there's effectively a spectrum Solutions right.

A

When you build privacy technology we're on one side, you build fully self-sovereign Solutions, where only the individual control, their information and assets and the other side you could give you know a lot of control to The Entity, actually controlling this ecosystem, uh while preserving privacy between individuals and so on, the right side. You have something like cptcs and the livestock has something like Toyota cache right and perhaps actually in the middle. We'll have something uh that's more or less.

A

uh Maybe you know Best of Both Worlds, where we could have a privacy preserving system yet give some limited form of control to you know some set of authorities. Okay, so enough enough on the, why? uh Let's talk about what I mean by privacy layers?

A

um So uh just reiterate, everything on ethereums is public, so you're able to see everything on users again and first, uh what I wanted to find is the notion called anonymity. So anonymity is the inability to tell who is doing a transaction right. So if somehow you're going to etherscan- and you look at transaction- and you can't really tell who the address you know whose engineering address then we say that this system- that's the anonymity and second, is the notion of confidentiality.

A

If you're going- and you cannot see exactly what the trades are, then we say this system is confidential and it turns out. Confidentiality is really really hard on ethereum, it's pretty much impossible, and so, unless you want to redesign entirety of ethereum right, so um on the other hand, anonymity is actually quite easy right. We can use any mixer to mix the funds and every single time we want to do an operation. However, this is very, very unusable right to the extent that only you know we only when you very much need this.

A

Would you do such a thing right? Normal users would not uh do this for every single operation that would do um D5 protocols.

A

um So the goal is really to make this very usable right. How do we get usable anonymity for ethereum? So um so what I mean by again? So just reiterate, the system will have anonymity. If you go to etherscan- and you cannot see uh you know who's already using all these contract calls right. So the question is: can we get something like this with ethereum right?

A

um So and you know we don't? We don't want uh privacy, uh an enemy just for payments. We want this type of identity for any type of smartphone, so you can see you know on ethereum. You can do many many different things.

A

um You know it's, it's an ecosystem of the apps, not just payments, not just you know, peer-to-peer swapping of assets, not just in empties it's whatever. You can imagine on top of token standards right. We want to have identity by default for all the apps. So that's the question um um and that's also what I mean by a privacy layer approach layer for ethereum should have the following. um You know set of features, but let us look at what are the current solutions for privacy layers?

A

um If you look at the inside ecosystem, we have many many different, UVM chains. That's you know more or less. uh You know you can run a d app and typical. You know any any of them and you have many many uh applications, sometimes um one popular chain, sometimes on money chains and what are the Privacy Solutions? Well, we have some mixers and we'll have uh you know some solutions that offer some type of D5 compatibility and we have solutions that more or less act as a layer two and with privacy.

A

So, for instance, Aztec and zika. Opera are good examples of this and, on the other hand, we have also about privacy, old ones, uh and the examples are like, for instance, for example, allele uh and Manta, where uh you know it's a separate chain, uh it might be a different ecosystem and you have a bootstrap a lot of liquidity, and so it turns out, you know, there's no single solution that works with all the D apps.

A

So if you look at what these Solutions do uh so real guide and see, copper actually allow you to support some limits in the form of swaps and uh project, as I connect uh allow, you know actually pretty good differential probability, but it's not completely compatible with every single D app right. So for as that connects, you need to write this custom Bridge contract and in fact you know that's. Basically, if you go to every single Aztec hackathon like that's what people do with you know they build Bridge contract for everything of the app.

A

uh You know, and that's not scalable if you want to want this, to support every single D5 projects out there. So uh you know this is observation. We don't have a private solution that um you know it's default and really usable right, so um so yeah. So let's look at um what what I mean by privacy later and what we should get in this previous layer. So, first of all, it should be feature complete.

A

Okay. So uh so what do you mean by that? You should have two features. You should be able to use this. You know privacy layer exactly the same way. You would use. You know ethereum right, so you should be able to use um a browser's private suppression solution or any the app that you want um any, and ideally you know with basically the same interface right. You go to you go into a Dr front end.

A

You click some buttons uh and you you know you do a swap and second, um you should be able to disclose what you have done. Okay, so if you look at you know existing privacy Solutions, it's actually really hard to tell someone else that you did something. um You know the interface is not intuitive, whereas right now for the transparent solution. If you give someone your address, they know you know they can see entire history right, so we want some type of form of information disclosure right.

A

So if you own set of nfts- and you want to prove to your friends that you know I own this at nfts and I- authorize a message- uh you can do- that you should be able to do that really really easily right.

A

um Okay- and the second thing you should you should do- is be backwards compatible right, because we'll have all this amazing ecosystem out there, obviously apps that people use, um we don't want to you, know, throw it out to waste and build something completely brand new like we want to reduce the existing ecosystem.

A

So the ecosystem should be to support your 220 721 1155 standards, um and you know you should more or less work with existing applications right and finally, most importantly, you should actually offer some from a privacy which in this case anonymity right so recall back to the previous slides.

A

um You will be the form you know, use this thing and everybody will use this privacy, layer and you're going to either scan. No one can figure out who did what action right. So the question for my talk is you know: can we build such a thing and actually the goal of my talks to convince you that we could build such a privacy layer for ethereum today and we're building one okay?

A

So so, let's look at how we're going to do this right. So um so, let's look at this. You know set of three things we want for our privacy layer and it you know if you kind of categorize them the first uh two you know two features are basically what the smart contract wallet gives you right. So, if you're familiar with their kind of abstraction or you know any type of smart contract wallet, this is the two things that this should offer. You right you should.

A

You should be able to use it on any single application and it's backwards compatible. And the second thing second feature: that's you know it's really. What a mixer offers you right, what a short approve gives you so I realized. You know some of you might not know what a sort of pull or you know mixer is. So let me just reintroduce the two two concepts so, first of all, what do you show that pool a shielded pool?

A

Allows you to unlink deposits withdrawals right, so this is the most basic form of privacy solution that you know we've had since the Bitcoin days right, so it allows you any user to deposit and later on, you should be to withdrawal, but by the time that you withdraw, nobody else should know uh who's actually withdrawing right, so you withdraw to a fresh UAE address, so that's the no geometry pool or mixer, and second, uh let's recall Notions. uh Actually this should say wallet, uh let's recall those of a contract.

A

What is your contract wallet well for a contract wallet? The users actually do not own a uoa anymore right so for, for instance, for account obstruction. uh You will have different uh address that we use, um and you know, but basically you know for your for your smart contract wallet. You should be able to do the exact same things that you would do with. You know your metamask right. You should be able to submit it.

A

Arbitrary Smart Control calls and get executed right, and this is done in the form of a intermediary uh contract wallet that verify some signature and carry out the calls for you. Okay, so that's not contract wallet and recall we want to do before. We know we said that you know the the thing we want to build is basically a shielded Pool, Plus or Smart Control wallet. So so here's what we're actually going to do we're going to take the two and just put them together.

A

Okay, um so it seems to be a shielded contract wallet right. So what can I do? You should be able to use anything? uh That's on ethereum and every single time you use the wallet. Nobody should actually know who's actually using the wallet right. So there's one single shielded: contract wallet, that's shared by all the users in the ecosystem.

A

um Okay, so so you know that's on a very high level, but how does this actually work um right? So for sure the pools like, like we said before it, supports deposits and withdrawals and for contract, wallets you'll support, arbitrary calls and we'll put them together. You will support again deposits and withdrawals, but but also crucially, something that you you can use to to call and eat the app. You know the app all right, so so here's the picture, here's how it's going to work!

A

um It's going to be a smart contracts in ethereum, where it allows any any user to you know, enter this ecosystem and once they enter they're able to use it as if it's you know, a metamask wallet and when different users have an application transactions, they will. You know they'll be reflected on chain. So if you want to call Unison up, you want to call openc, um you should just work and, furthermore, on etherscan you have no idea of who's actually behind the scene during this operation right and that's a bonus.

A

Actually, we can make this um smart contract or contract wallet compatible with account abstraction or eip4337 Okay. So as it turns out like there's two problems, you know, if you want to build this, if we want to build this, you know just combine and show the pool with the smart contract wallet.

A

The first problem is that when user submits a transaction that you know contains arbitrary calls, you can actually just steal the funds of the entire contract right. um So here, if the user only owns supposedly on one ethereum in the pool, but it constructs a call, you know that consumes 20 ethereum, um you know this. Is we shouldn't? Let this happen right, because you know um people would be able to still the entirety of the funds of the entire protocol. So uh what's the solution?

A

Well, the solution for this problem is that we actually just separate out of two contracts uh into a contract that actually holds the the other funds, what we call a vault contract and a wallet contract which I will actually carry out the calls.

A

um So in this way, users will unwrap the tokens that they have and only the tokens that they have is uh inside the wallet when they're actually not call.

A

This is actually kind of equivalent to the other way of doing it, which is you also have a router and have the wallet holding all the funds and putting the things into the router.

A

So there's kind of two equivalent solutions to solve the same problem and the second problem that, if you know, if you were to do this, which I think is the main reason why we don't have these things before you know, is that for this type of privacy preserving show the pools you need to know the exact amount of tokens uh which is called. You know, that's, including the nodes before um you insert it into the protocol right.

A

So so everything has to be known in advance, whereas in D5 protocols you have no idea how much tokens you're getting back right. So there's this uncertainty of smart contract decides how much you get back, but traditionally for children pools. uh You know everything has been only in advance, uh and so that's this is like uh you know.

A

One feature that would you know didn't really know how to do before um and there's a solution for this, which is that um we have this notion of refunding to Anonymous address, uh so we have to be able to randomize, accuracies and refund to them. I realized I. Actually, you know basically spread through my uh entire deck and the end of the talk.

A

um So, let's recap: what have you learned in this talk? So first off privacy is really important. We do not have privacy on ethereum. We need some type of privacy solution for ethereum, that's really usable before ethereum can go mainstream and a shielded contract wallet. Combining a shielded pool and control wallet is our best shot at this backwards, compatible feature complete privacy, layer and finally, we're building this out.

A

um We, you know, hope to put something on the public and- uh and the hope is that you know long term for this ecosystem. Most people will actually be inside. You know a privacy layer instead of the standard, uoa layer and, if you're interested in contributing to this effort. uh Please come talk to me and I realized I didn't do a soft introduction at the beginning. My name is wayday a research partner at Ben capricel and um come ask me if you have more questions about this project, but I'll take any questions from here.

A

B

Hi uh congrats for the work I think privacy is very important. I've worked for a few years on having trying to make users uh have Smart contract wallets by default, and the big problem is the gas cost of of just having to onboard someone and already having to spend like ten dollars, five dollars, sometimes a hundred dollars. How do you think that that can be solved.

A

um Yeah very good question I. Think two things uh one is the you know actual cause of gas over time as we build these scalability layers should go down right as we build more Roll-Ups um and the second is uh we could use batching to um amortize the gas cost. So usually you know actually in 457, there's notion of uh bundlers and aggregators, where you know you compress authentication information.

A

uh You know from multiple transaction from multiple transactions into into a single authorization for for all the transactions, and you know, there's different tricks to kind of further optimize the gas cost uh so over time. Through these, you know two Avenues. The hope is that the the additional cost incurred to to get a contract wallet with privacy- uh it's not prohibitive for for users, for you know, for vast majority of users.

C

uh Great talk I'm interested in how you figure out, ofac and tornado cache, um because if this is like an opt-in where this person coming from hi over here, oh yeah hi. No, how you think about, uh because if you look at tornado cache and the ofax sanctions, how do you think about sort of avoiding that kind of thing with? Because my understanding is that this would be like an opt-in, smart counter wallet. So how can you avoid that and kind of adverse selection? And these types of things.

A

Yeah, so um so, referring back to my slides, where I showed the special Solutions you, you know I think as a builder, we should be flexible in kind of so good. What is privacy right? Privacy is appropriate, full of information.

A

I, don't think. Privacy is as absolute notion where everything should be private to you. uh You know: there's there's some societal, like consensus on what is appropriate for a lot of information right and everybody can have their own interpretation of that. You know. um Government agencies have their own interpretation. Individuals in ethereum community can have you know, you know our interpretation uh and they might be incompatible but I think as Builders.

A

We should be open to different versions of you know what is appropriate for all of information, uh because technology is really flexible um and you know over time there should. There will be communities that might be incompatible, but, like you know, we should work towards the solution. uh That's more toward the center I would say where we include as many users in your ecosystem as possible, yet give some sort of control, perhaps maybe to some set of people to be able to prevent illicit activities.

D

So, when you say you're we're building this already, how far have you got.

A

We have prototype contracts, you know it's very early stage um uh yeah, so the idea has been been there for you know a while, but um the building is just just speaking of traction and you know we'll have basically two people full-time on this, but.

D

Why not embed these Innovations into an existing contract wallet like margin.

A

Or something so this well there's many many different contract was out there with different Focus. It's. This is a contractual with privacy. um You know I think it doesn't make sense to well I mean we could take existing. You know we'll take the existing fourth of the seven. uh You know standard uh reference code base and just you know fit this into there.

A

um If the main difficulties is actually not being a contract wallet I'll show you like how to add privacy I think, because when you also changed the front-end apis, so I mean every single smart contract. All in have to do this, but like I, think for for privacy is more important because the a lot of command is seem to change right. So, if you think about how currently you pull balances ready accounts, you first connect your wallet. You pull like you know.

A

What is the connected wallet address and you like go to the contract and pull okay? What is your action that balance that cannot be made privacy preserving right because you get who it is? So you have to change that into something. Like you know, connect to wallet can I get the usdc balance.

A

um You know so so a lot of things to change uh when something needs to be. You know it's you want to imagine a privacy preserving system, so I would love to collaborate with. You know, uh contract wallet projects uh and that's also another reason why we're trying to stay compatible with 437, because we can reuse. uh We, you know, have the same bundler infrastructure and this you know account abstraction man pool. So we will be part of that ecosystem and contribute to the efforts as well.

E

Great Doug, thanks uh what.

A

E

What kind of zero knowledge protocol you decided to.

A

Use um yeah, so so you know, as it turns out the easiest way to prototype. Something like this is circle still like. There's nothing better out there that you can. You know, drive a zero dollar shortcut and have like solidly verifier and, like a you, know, approval that's rather than like a browser circle on this, the only ecosystem. So this is like another ranks, I would use. You know the like most efficient proof system out there, like it, probably more like plunk, but that tooling is not there um and also like over time.

A

It sounds like you're familiar with this type of systems, but like over time, uh there'll be like kind of two separate proof systems right. So one is on the user side, where you essentially want zero knowledge property only for privacy. uh So you know what is this thing? It's a the overall design is very similar to, like any other, show the pool.

A

You have a Merkel tree of notes, right, you're, referring to a note and spinning it without revealing which no you're you're referring to right, um and that for that you needs your knowledge to preserve your privacy, and you actually don't really use extinctions and we're going to have this like aggregation layer that roll up these user spending proofs, and for that you really want to synchronous right. You want to be able to verify on the contract side really efficiently right, and so uh you know I think this.

A

This is something that have been discussed a lot in Devcon in the past couple days, which is you have the notion of inner proof and outer proof right. So for us, this inner proof will basically be the user proof that has zero knowledge right. We can use I think over time. You know which we'll probably evaluate things. That's really fast in the browser adds to your knowledge and maybe some type of compression.

A

You know it's like maybe Spartan or something, and then on the outer proof we'll have you know, probably gross 16 or Planck that really compresses the other proofs right, um yeah.

E

So one approach to solving this problem would be to make backwards compatible contracts on ethereum. Other approaches might be to wait until there's an L2 that has more Primitives built in that support. This and I'm just curious to learn more about your thinking of. If it ever makes sense that privacy will be in one place and non-private things can exist in another.

A

I think yeah so yeah. The question is, you know: do we build privacy sources on top of existing things? Where do we build a new ecosystem to build privacy, presumed Solutions and I? Think the key question is what are the Privacy supported and what is the features of those applications, and um so it turns out that the short answer is: there's no privacy, preserving ecosystem right now out there that actually support more features: the anonymity okay.

A

So if you look at like a Leo uh or like Mina, it's really just a solution to build roll ups. Like you know, with zero knowledge, you cannot get privacy for share States, so I actually discussed this in another toggle mine.

A

So if you think about the features we can support, I think unless you have vastly more capabilities to support privacy, Brazil Solutions, which I think is actually in the privacy of share State, um it doesn't make sense to have a complete brand new ecosystem, because privacy that that's achievable, is the same, so there's no benefit to building a new ecosystem that do the same thing right. So therefore, so if that's the case, we should build on top of the existing ecosystems, because everyone is there, we're desperately need privacy, Solutions and it's possible to build it.

A

So you know, let's not reinvent the wheel,.

D

Is it working yep, so it sounds like you need a sequence of maintaining the Marco tree. Have you got thoughts on how you're going to decentralize that or whether you will.

A

Yeah, so there's actually kind of two two different things right. So four, four, three, three seven you have the notion of bundlers um and- and we could basically use that, so we could actually so bundlers um so I think it's yet to determine exactly what's in the standards, but uh isn't that for every single contract wallet bundler needs to run custom code to be able to compress different user operations to one.

A

uh So we could it's interesting compatible to that standards when you know when it's more finalized to be able, you know to to have essentially supplied into that ecosystem right, so it could be like different 437 bundlers. That's supporting different smart contract wallets and will be one of them and in that, in that way we can decentralize uh bundling, and the second is yeah. So exactly so, there might be this management of Merkel trees. That's separate to many. You know, compressing multiple user operation proofs into one and we can make that permissionless.

A

Yeah I think it's a current thinking right. So um so it's okay. What is the overall story? Is that so because we support backwards and platform I will support the exact same set of operations. We, like users, need to pay more gas right.

A

It's like that's the you're, paying the same amount of gas by default um and the additional things that's you know the overhead to like maintain everything, and the idea is to like make it as small as possible, and the only way to do that is to can Outsource these aggregated work into some sequence or bundler. So so it's basically necessary if you want to make this really usable and so yeah. So you know to decentralize I think you know make it permissionless and some really design incentives around this right.

A

That's because these are bundlers sequences, are providing a service, um instant Advanced behavior and make it provincialized and design kind of this ecosystem. That's so self-sustainable right, uh because, because I think that uses wallpaper privacy, uh if it's cheap enough and you can get this network effect right.

E

Thank you so much boy.