Ethereum Foundation DevCon 6 - ZKPs: Privacy, Identity, Infrastructure & More Track, 15 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Private Exchange on ZKOPRU by Takamichi Tsutsumi | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/private-exchange-on-zkopru/

Give a presentation about private-exchange application on zkopru which consists of three different zero knowledge protocols including socialist millionaire problem, blind find, and zkopru. In the presentation, I will show how the private exchange works.

Speaker(s): Takamichi Tsutsumi
Skill level: Beginner
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: Privacy,ZKP,ZKOPRU

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

And he's gonna tell us about a private exchange application that was built on top of ZK Opera yeah.

B

Thank you for coming. My name is takamichi today I'm going to talk about the Private Exchange, yes, I'm software engineer at the privacy and scaling Explorations team at EFM, Foundation and yep say I want to explore a privacy, preserving decentralized exchange on gko proof for this project. We are aiming for more private peer-to-peer exchange system and private exchange consists of three different zero knowledge protocols to protect users, privacy and I.

B

In this talk, I'm not going very deep on the technical details of the protocol, but I will show how those protocols works and how the protocols are used in private exchange.

B

All right before diving right into the private exchange. um Let me start with one question, so why do we need privacy.

B

I think there are many reasons for many different people and for many different use cases. So I'd like to share my opinion on this today.

B

The Privacy is important because it can contribute to censorship resistance, like own public blockchain, like ethereum, like the transactions on the all the transactions on the blockchain are all visible to everyone, so it can be censored um mostly like in a smaller Networks, because the number of the validators and the block Builders are later to be relatively small to the censorship likely to be happened more often, for example, um if you want to spin up minor roll up on ethereum.

B

This is the case.

B

And for second, it also can mitigate the Mev or front running if the privacy of the transactions can be kept at work to prevent the mov and front running.

B

But, most importantly, it is a human rights. The Privacy is a human rights.

B

Here is a quote from the universal Declaration of the human rights and article 12. So my opinion is, we don't need any reason to work uh um protecting privacy.

B

We need privacy because it's human rights and we should care when we're building an application, and today, in this talk, I will walk you through how we approach um to protect privacy when building a decentralized application like private exchange, all right, let's get into the interesting part, what is private exchange and how it works?.

B

So what we are trying to achieve with the Private Exchange is to make exchange process more private, yes, very simple, and don't let users to expose their information or intentions.

B

That's our goal here.

B

So what exchanges do exchange? Let users exchange their tokens.

B

In this diagram, Alice sends 1.0 if to exchange and gets 1050 500 die in exchange.

B

There are more functionalities, but I'd like to focus this one function today, and there are two popular constructions in decentralized exchanges. Today, the first one is automated Market maker.

B

In this kind of Exchange users can typically users can exchange their tokens without a counterparty.

B

This means that at least just interacts with a smart contract and doesn't need to anyone else doing an opposite trade.

B

The price is calculated automatically in the smart contract and others can exchange tokens on that price.

B

The second approach is an order book. In order book, Alice puts something called an order to order book, and the order contains information such as token pair amount and a price.

B

In this example, I just wants to die in exchange of eight an amount she wants is one thousand five five hundred die and the price is one thousand and five hundred die per it.

B

And if there happens to be some other order by Bob, who wants to do the opposite trade attending one thousand five hundred die 4 1 8., then the order book attempts to match the orders and execute the swap transaction by sending transaction on chain.

B

And one thing to note is that order books can be on chain or of chain.

B

If the order book is on chain, Alice Post an order to the smart contract order book, then Bob finds the order on the smart contract and takes it by sending transactions, and if the order book is of Jane, there is typically some intermediary order book provider that collects all the orders and trying to match the orders, but in either way the orders bulb and Alice sense includes the information that uh order book provider or smart contracts can find a pair okay.

B

Now, it's time to think how we can execute the process more privately.

B

In order to make exchange process private. We come up with a relatively simple peer-to-peer exchange system, and it is some somewhat similar to an order book construction here, but it tries to keep information private as much as possible.

B

So let's look at the Autobook diagram again here we can see the parts that are not private in this diagram.

B

The contents of the orders Alice and Bob sends to the order book are not private and the transaction that Autobook sends to the blockchain is not private. So how do we make this more private? Here? We use three zero knowledge protocols, blind fine and socialist millionaire problem and zko Brew foreign.

B

Let us think of how we can make others more private in the order book system order book is the one who collects all the orders from users and make matches so Alice and Bob needs to send the order data to the Autobook provider, but if they can compare prices and make a much a more P2P way by directly directly sending messages to each other, then they don't need to reveal the data to the order provider at all.

B

Oh wait: how does Bob Reach Out Alice in peer-to-peer Network we use land find protocol here?

B

Land find is a network that peers have neighborhood lists and Bob can look up Alice and prove that he can reach to Alice in the network.

B

But importantly, Bob can search for Alice in the network, but without revealing that Bob is the one who is searching for Alice. So the neighbors that receives a message from Bob will never learn. That Bob is the one who is searching for Alice.

B

So in this way, uh Bob have like some privacy of that key, um have some intention to take the Alice's order in the public aboard.

B

Now a bob can reach out to Alice to execute the peer-to-peer order. Matching thanks to the Socialist millionaire problem. Here we can do the private peer-to-peer order matching.

B

Socialist millionaire protocol is used to check the equality of two values, but without revealing the actual values.

B

So the idea is that they have some numbers in mind. Let's say: Bob have X in mind and Alice have y in mind.

B

Then they don't directly um sending the original values, but instead they derive some values by by calculating um some mathematics and also they use some random values and exchanging messages.

B

Then, after the exchange uh complete, they can test that if the original values that Bob has in mind and Alice has in mind are same or not, but here Bob cannot calculate back using the received value to y and Alex cannot calculate X from the derived messaging values, foreign and we use this protocol to check if the price is that Bob wants and Alice wants much or not,.

B

And here's how things work in private exchange, so firstly, Alice creates information to public board, but without a price.

B

We call this an advertisement and Bob finds the advertisement on public board and search Alice in the blind, fine Network, the price matches they proceed to create transactions.

B

And this way we could omit the intermediary who acts as comparing the price and making making a match and preventing posting prices. They want to public.

B

Now the order is partially private because they can post an advertisement without a price.

B

And now we should think about how we can make these transactions right hand, part private,.

B

So here comes TKO prove DK. Opru is an abbreviation of zero knowledge, optimistic roll up. We use ticket proofs for privacy and optimistic roll-up technology as a layer to technology protocol and in essence, we can make secret transfers with a cheap fees.

B

We can prove that those transfers are valid using ticket proofs, but without revealing the contents of the transfers.

B

But there is another thing.

B

A secret Atomic swap.

B

So there is a feature called Atomic swap on zko Brew and let's say that Alice and Bob agreed on Sam Price using socialist million problem and they can create. They want to create the transactions called Atomic, swap.

B

To make swap transactions or a pair of transactions and has to be included in the same block, so in this uh case Bob send Alice, 1500, 500, die and Alice sends 1.0 is to Bob.

B

The two transactions have to be included in the same block, and if not, it's not valid transactions anymore and, of course, the transactions contents are secret. Even block Builders, called coordinators cannot see the contents of the transactions.

B

So using the secret Atomic swap the transactions sent on the blockchain is private. Now.

B

So here is a diagram complete diagram of the Private Exchange.

B

All right, so, let's go over the private exchange flow again, so, firstly, Alice and Bob joins the network called Blind fine, so that they can reach to each other, but without revealing that they are finding someone in.

C

B

Next Alice posed an advertisement on the board, but without a price and next Bob finds the advertisement.

B

And Bob search for Alice and a blind find.

B

If they successfully Bob finds the Alice, he start executing socialist media on a problem to compare the price that they want and if the price are same, they can create Atomic sub transaction and send it to ZK Oprah.

B

In this process, advertisement is partially private and price matching is done privately and peer finding is done privately and transactions. Contents is also private.

B

So what I've talked today is one simple example of a privacy application and what I talked was. Firstly, I started with a what does this application do? So, in our case, it is an exchange so exchange. Let users to exchange their tokens.

B

And in that process, which part of the exchange process is should be uh private.

B

In our case, it is an orders and transactions sent on chain and, lastly,.

B

I talked about how to make those informations private.

B

We use three general knowledge protocols, line, find and socialist millionaire problem and decal Brew.

B

And, as a result, the private exchange does not reveal transactions content and it does not reveal price of the orders to public, and it also does not reveal the peer-to-peer routing in the network.

B

But at the same time, there are challenges in this constructions.

B

Firstly, socialist, maybe on a problem, can check the equality of the values.

B

Therefore, it's not easy to compare, for example, to use a range to create a match. So in the application it's harder to find the counterparty elect Bob if the SMP can work only this way.

B

Secondly, and advertisers needs to stay online while waiting incoming social estimate on a problem messages so Alice after sending advertisement on public board, she has to stay online until Bob shows up and finally, users need to join line, find network before starting the process and also run the blind find process while in the application.

B

So these are the challenges and it directly affects you, the user experience of application.

B

But some of the challenges can be mitigated on the application layers, but some other nice Improvement of the cryptographic protocol layer.

B

So in privacy and scaling exploration scheme we do many privacy projects like applications and also cryptographic protocols to improve privacy in this blockchain space.

B

If you're interested in those Projects, please take a look at our home page and Discord and I want to give a shout out to the TK Opera team once up Jane Jimmy Geo chance jelly Rachel.

B

B

um Questions please.

D

um First, quick question: is the s p, uh interactive or non-interactive as interactive, so you so you have to basically so like. If there's a list of advertisers, a user will have to communicate with every Advertiser right? Yes, so this doesn't really scale well, as it increases is N squared, like complexity for yes,.

B

Okay, so that's that's! uh Yes, that's also uh our ux challenges as well.

C

Yeah sort of on the same vein, um one question I had was um because you know you still have to do the SMP to find the price.

C

um You sort of know, a general idea of the price, because you have other markets that you can measure the price from, and so um is there any prevention mechanism for like a mass de-anonymization of the of the price, the ads, uh in a way that somebody could just keep trying to uh discover the price and build up an order book that sort of matches the expectation of the ads, because there's no obligation to actually trade on any of these ads right. So you could just try to Brute Force um figure out the actual order.

C

B

Yeah yeah, um so uh for current implementation, we don't have like such features, but, as you said, it needs like the uh many times of SMP trial, to find a the price matches and also we don't have like the prevent it to prevent such details like types of attacks right now so yep. We need to uh work on that ux Improvement as well.

B

Thanks, thank you.