NEAR Whiteboard Series with NEAR | Technical Deep Dive Sessions, 16 Apr 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Whiteboard Series with NEAR Protocol | Ep: 46 Dr. Sebastian Bürgel from HOPR

Description

The Whiteboard Series with NEAR is a set of video interviews with Web3 Founders solving some of blockchain's biggest challenges. It's a deep dive into their story, what they're developing and how it helps bring Web3 to the world.

In this episode, NEAR co-founder Illia Polosukhin (https://twitter.com/ilblackdragon) talks to Dr. Sebastian Bürgel (https://twitter.com/SCBuergel) founder of HOPR (https://twitter.com/hoprnet) to learn more about the protocol's mission to help change data privacy for good.

Whether it’s individuals, companies or institutions – the HOPR protocol provides full control over privacy, data and metadata. HOPR lays the groundwork for a more sovereign and safe internet.

Follow the latest from HOPR on:
YouTube: https://www.youtube.com/HOPRnet
Telegram: https://t.me/hoprnet
Twitter: https://twitter.com/hoprnet
Discord: https://discord.gg/dEAWC4G
LinkedIn: https://www.linkedin.com/company/hoprnet

Follow the latest from NEAR Protocol on:
Website: https://near.org/
Dev Docs: https://docs.near.org/
Apps on NEAR: https://awesomenear.com/
Learn to Build On NEAR: https://www.near.university/
Discord: https://near.chat/
Blog: https://near.org/blog/
Twitter: https://twitter.com/NEARProtocol
GitHub: https://github.com/near https://github.com/nearprotocol
#Blockchain #FutureIsNEAR #NEAR #nearprotocol

A

Hello, everyone- this is ilya from uh not so sunny zurich, but it was really nice mountain view, and I'm here with sebastian founder of hopper and we're going to dive in and learn more about it. Do you want to introduce a little bit about yourself and then yeah sure.

B

Thanks, first of all, for coming to not so sunny zurich to talk about privacy here, yeah um sebastian, founder of oper, we're, as we say, changing data privacy for good. What we're doing specifically is a metadata private data relay network that provides data privacy on a transport layer, so bringing data from a to b.

A

Okay, uh maybe let's dive into the problem first. So can I understand why do.

B

Users and developers care about this sure, so, let's take, for example, we have a data exchange between alejandro and zoe right, so we have our first protagonist alejandro and, for example, alejandro might be using emitter mask wallet right, and what do we actually do when we submit, for example, ethereum transactions right? So we send it to somebody else in this case to zoe and zoe might be an rpc provider.

B

And what is kind of interesting is that today, when these two exchange data, they also make to each other visible their ip address.

B

So, for example, in the case of a minimized user and an rpc provider, the rpc provider sees where you live, they can link your accounts and all sorts of other things, so we want to solve that.

B

Now, interestingly, people sometimes say hey, you know I get privacy by decentralized technologies by, for example, running my own node, but, interestingly enough running your own. Full node is not enough, because you basically just have the ip address of that node, which becomes a synonym of your wallet's ip, so yeah. Basically, what what people sometimes then do? Is you use a vpn right, so in our case, maybe we have uh chao as a new actor in our model here and um you.

C

B

We just relay everything we had showed so far so good, but I guess, as we know well with vpns, we're just trusting that guy now with everything right, your browsing history, and if they know what power you have when you submit crypto transactions, which they can now link, it's probably going to get even worse than vpns already are.

A

Yeah so much fun, training.

B

Extracted value vpn extracted value. I like that exactly yeah, it's like like what, if like these guys, find out that, for example, like your transactions, which you're submitting like, for example, to estimate gas price right. So typically people just submit this transaction. Say hey tell me, you know what gas amount I should send typical example. You can front run the whole thing for nfts d5, whatever okay, well,.

A

I mean if you have ssl messaging here, that would be harder to it.

B

Will be harder, but, interestingly, so many times only by looking at the packet size, you can infer a lot of information right, and this is exactly what we mean by metadata by how frequently like how big data packets, you can still infer a lot.

B

So one thing that does better than just a vpn is tor and what tor actually does is it introduces two additional nodes right. So let's call this one here betty and then we have one other note over here and.

D

um That one is ciao, no jon. We already got in our story too bad, so that one is dimitro.

B

And now what you can do in in this story is basically so all our five friends are acting together and you're relaying data packets from one to another, and by doing so you are basically not really knowing where data came from where it goes to and who is exchanging data with who so so far so good with tor.

B

Maybe let's dive into onion encryption, which is uh something that is quite typical for for tor here.

A

So mentioned that this is probably run by russian federation. This is by the united states.

B

Exactly, for example, right, that's that's actually kind of good right, because you want different actors which are ideally, you know, ideally not colluding, no exchange.

A

Information no exchange.

B

Of information, that's perfect right, that's perfect! So effectively. What we would like to see is that there is a data packet which gets forwarded along the way right and this data packet is encrypted, but it's not just encrypted once, but it's and that's why it's called onion encrypted multiple times right. So we have multiple layers of encryption that are being um that are being passed around.

B

So basically, when we have the first relayer in our in our chain alejandro, he is like encrypting this packet four times betty gets the package he peels off the outer layer of this encryption. That's why onion right and passes it on and so on, so that, finally, only zoe can see the data that is actually being sent around, so that is on a high level.

B

What what tor is really doing.

A

And so, when you're sending this, you actually need to know the full route to your destination.

B

Exactly so in case of tor um er, tor source rooted right, so you select the path, and this path that alejandro is is choosing is typically like long living. So typically something like multiple minutes. So that's actually one of the weaknesses. So you can look at the packet like, let's say, I'm the internet service provider of alejandro and zoe. I can link these. I can basically see exactly how big is the packet here. How big is it over there and link these two?

B

And if I don't do that, just for one packet, but you know take these, take this long living route that is is persisting. I can eventually you know, even with not so hard resources find out. What's going on good, so well, not so good, that's it! Yes, that's the weakness of twitter just to question.

A

Like zoe, presumably elsa should receive an encrypted message for zoe, so yeah.

B

A

Is seeing is metadata about this? Exactly yes,.

B

So basically, the rightmost packet, like it contains the actual payload which is still encrypted and zoe takes off the last layer of encryption yeah, good okay. So uh how do we get better than that?

B

um So one thing, as I mentioned, like this weakness of the trust assumption of tor- is that the first and last node is not colluding, and it specifically is the thing that we are wanting to improve, and maybe one thing to mention because we'll pick it up later on is the economic sustainability of tor tor's been around for longer than bitcoin, but tourism been growing really for the past at least half a decade, so we see tor has under 10k nodes and tor has you know under 2 000 exit nodes, so this last one which is of course a very touchy one because it gets accessed to the wide internet.

B

So you know bringing economic incentives to that game. Is the second major uh difference here. So how does that work? What uh we do in a mix net like hopper, is actually there's not just a packet coming along this route here to chow, but there's actually multiple other packets. That are also being sent to chao and chow is sending these data packets out also to to other people.

B

So what happens? There is actually you receive a packet. You.

C

B

It for a short amount of time, while you're also receiving other packets.

B

You transform them, so they look different between incoming and outgoing packets, so you cannot link them and you mix them up and send them out in a different order, and this combination of like transformation of mixing and having this artificial delays is actually what brings significant better privacy than what you have at tor, because only if you have like access to that machine, do you know which packet corresponds to what so what we call this global passive adversary.

B

You know either your internet service provider or, like the you know, three-digit agency of your choice will not be able to find out which packet corresponds to which and they cannot link incoming and outgoing traffic good. So that's the.

C

B

Fundamentals of a of a mixnet um yeah.

A

No yeah, I mean.

B

Let's, let's actually then go to uh the second thing, which is uh the weakness of tor which, which we mentioned in the beginning, is this linkability by just observing like not even caring about all that, but just mixing packets? If you observe here and you preserve over there so effectively, what we're doing in hopper is packets. We make packets look indistinguishable from one another and how we do that is by basically either shrinking them or padding them all to the same size.

B

And, interestingly, it's not just about the packet itself, but also about the header. So the header gives away usually a whole lot about what like, who you're communicating with and so on again worst case. You know you can just see to whom is this packet addressed now that is being protected by using a packet format? That's called sphinx, it's used by the bitcoin lightning network and by a bunch of other projects.

B

So it's it's made for such mixnets and it's basically called sphinx, because we don't just have this unencrypted payload in the packet, but we also have a have a header that has a bunch of a bunch of information in here, for you know relaying that relaying that packet, and we augment that in case of hopper, by also having like some some payment information that we that we append to it now, um the first step, maybe to uh to realize for what's going for what's going on here is we have like some some key material here so there's some some.

C

A

B

That is, that is um defined by the center of the packet, and basically, this alpha is an offline diffie-hellman. That alejandro is doing with all these downstream notes so effectively by knowing their pub key alejandro is choosing a is choosing a secret and his secret x. um He does an elliptic curve multiplication times g times the base point here um yeah, so that is like the the immediate material, which is then multiplied with the pop keys of these. uh Of all these notes, and thereby you establish a shared secret and this master secret.

B

We will, I mentioned because we'll get back to it many times we will use it to derive all sorts of keys good now um so this is. This is the first part of the of the information of this packet and um there's other stuff. As, for example, you need some some routing information right.

B

So that's that's this beta in here, which tells basically betty well, where do you send this thing and some other stuff and finally there's an integrity tag in here, which is just allowing you to make sure that nobody altered the packet while it was in transport, but.

A

Isn't routing information responds.

B

A

B

No in this case, not because the the onion really is only the um is only the encrypted payload, and what is interesting is how do we protect this header such that you cannot in transport, extract stuff from it and actually sphinx does something pretty interesting here. So if we look at the header, um this header contains information like when alejandro, like formats, the packet for all the downstream nodes right. So they all need to be able to process this.

B

So in a naive implementation, you could basically say: okay, well, betty just pulls out her information and passes on the rest, but that exposes some metadata information in the header, because you could just observe how the header shrinks- and you know where you are in the relay chain.

B

So what sphinx actually does is it takes all these these pieces of the header information for the individual nodes, and that is then blinded. So it is first blinded with a blinding factor that only betty can derive. I mark it with this hatching here.

B

So basically, only betty is able to like remove this hatching right, so only betty can can remove that then there's a second layer which can then only be removed by ciao. So that's everything from here downwards generates.

A

Because yeah yeah.

B

Like each layer encrypts exactly exactly it's not part of the payload, but it's following the exact same principle, exactly like you say so, basically you repeat the same thing right so like this first part can only derived be derived by betty, the second by chao and so on.

B

So we have like a bunch more hatchings for each of the of the notes that participate there and now what what sphinx basically does is like when betty receives this packet.

B

She removes this and she pads, then, um in the end, like some kind of noise data which is indistinguishable from the um which is indistinguishable from actual information and what that means is for us as outside observers, we can tell like what's going on right, so she would just remove this part here and the pen decided, so that are some of the pretty pretty interesting neat things that sphinx is doing to protect metadata in the header.

B

All right, um then, I said the second kind of interesting thing of hopper is that um we want.

C

B

Incentives, so what we want to do is that you know child for participating in here is receiving a payment, but for doing that, we don't want to reveal who's spending exactly.

C

B

So there's a bunch of things that could go wrong. So in a naive version, it's like you know, especially maybe bitcoin people say hey. You know you can solve all of the world's problems with bitcoin lightning networks solve everything, for example right, but so one thing like in a naive example even like on chain right. So in a native example, what we don't want is we do not want to see. Okay first, like you know, alejandro is sending money to betty.

B

Betty is sending money to child child, sending money to dementia and dimitri desiree right so that one you take so even.

A

B

Exactly so that would that would reveal everything that's going on here. So that's bad! How do we hide it by going l2? Basically, so what we have at hopper is a payment channel network, so alejandro has a payment channel open to betty betty to child child, dimitri and so on. Interestingly, we do not have an incentivization between dimitra and zoe, because we say you know: zoe is part of a service provider who has an inherent interest to receiving set data, so maybe, as a quick recap, what does that mean?

B

It basically just means that you commit funds which can then be released by the other party with off-chain information which is being passed along so effectively. Alejandro is staking some hopper token in a payment channel towards betty betty is taking upper tokens in a payment channel towards ciao. So if you want to think like ultra high level, it's a little bit like pys, where you stake money in order to secure a network. Just in our case, it's not an l1 right. We don't secure a blockchain here.

B

This is used to incentivize packet information which are being sent around yes and then, after we have established these payment channels, they can be used for sending actual packets around, and uh one interesting thing is that basically alejandro sends like a locked, uh a locked amount of money to to betty here.

B

So it's locked up because, like there's a free writer problem in a naive implementation here, so the free writer implementation, uh the free writer problem, is what, if betty just exactly she just says: hey, thank you and off I go so what we bring in here is to solve this free writer problem. It's basically a a key sharing mechanism.

B

So this money- let's say initially, it's like three hopper.

B

Realistically, it's less, but just for you know explaining this betty needs two pieces of information in order to unlock this payment. So basically she needs two keys, the first key she can derive herself and the second key will be passed on to her. um Maybe let's remove some of.

B

Some of the arrows, otherwise it gets a bit messy. um So the second part this the second key, gets delivered by child to her. So this second key half here gets delivered and those two together um are giving her the information for how to release that payment of the payment channel cool. So let's maybe dive one layer, one layer deeper into what's actually happening here. So I mentioned that. Actually we have this. We have this key information out of out of the sphinx format, so this alpha, which we then use to derive further keys.

B

So we have a master secret, which is it's not just this, but it's actually we have an alpha zero, which is derived for betty with an alpha one which is derived for chao and so on, and um basically this alpha is it shouldn't be the same, because if it was always the same, what could happen is that maybe dmitry down there is extracting some of that learning about the alpha and maybe dimitro is colluding with one of these gpas this. You know bad guys who have network level overview and can de-anonymize information from the network.

B

So that's why these alphas are basically iteratively changing, so every one of them is calculating the alpha for the next party, which also then ensures that the path is being followed, because if anybody else would like you know forward this packet to somebody else, they wouldn't have access to the private key of that party and therefore they could not modify the alpha.

B

So what we have here is actually um the secret that we're using here I will call um s1, and that is the one that betty um derived herself right. So let's call it s1o and the second key half that we get back from chaos or ciao is basically sending this.

B

This key half is um s2 and it's effectively an acknowledgement right, so betty is taking the packet passing it to ciao and charles as an acknowledgement coming back to to us with this key half um good so and what we then want to validate, because that is something that needs to be validated by our smart contract is actually are these values here, legit right, so we don't want betty.

B

Exactly right- and it could be two things right- it could be. She made up this thing because she's not actually betty or it could be that you know she made a gap, acknowledgement exactly yeah. So how do we do that? Well, we do it by basically doing an elliptic curve multiplication. So again we multiply this here with some base point again, it's a plus here and effectively. This value is something that has been signed off by alejandro I'll I'll get to that in a in a second in detail, um but for now so we have.

B

We have basically this this secret value here, the sum of s own plus s, acknowledgement which betty needs to provide to the smart contract. But um now, basically um another thing could happen right here. So what what could happen is here that she doesn't know if she got betrayed so before she does the actual work she wants to know. Well, is this stuff actually legit?

B

So what we actually have here? So we can basically just uh re rewrite this this equation here. So this is s on times g plus s2, the acknowledgement.

B

Times, g and this value we actually provide in the header ahead of time, and we call this value here. Actually a hint.

B

And this hint is actually part of the beta which we, which we have up here now, what what is this? What does this do? So we have this as own which she can derive herself, and we have this value from this together she can validate if the payment information of these two skis exactly that's exactly what we, what we wanted to, what we wanted to establish here um and she can do that before she get that stuff from the smart contract.

B

uh Sorry before she got it to chow and check with a smart contract. Hey is this: is this legit or not, and then everything is fine, um just a little nuance. Basically, we have this. This elliptic curve multiplication which, unfortunately, you can't do in ethereum. So there's just like this very, relatively silly easy verify. So you can kind of abuse, easy verify um actually to do an elliptic curve multiplication, which is a bit weird but yeah. You have to work with what you got.

A

All right, so so, let's maybe like just kind of mechanically right. So let's say I'm the alejandro, I'm just joining the network. So the first thing I do, I go to smart contract and I pretty much commit to lock some of my funds with betty, like I explicitly on smart contract, revealed that correct. I I like specifically to.

B

Betty specifically to bet yeah okay, why? Because we want to, of course, avoid double spends right. So that's why? If you would commit to anybody, you know, maybe one of these.

A

B

Your friend and you're, just you know extracting funds. So so if we have a smart contract right, so alejandro came in.

D

With you know, storing, like let's say, 10 for betty yeah.

B

Now and a bunch of others right so probably he wants to open a bunch of other payment channels as well.

A

Right so also when I was ciao, there was.

A

And so then, when, when they're actually constructing this message, they are kind of committing like.

B

Actually, on the smart contract, none of this is so far stored on this. No.

A

I'm more I'm more thinking like this, like three hopper right, like they're, committing based on the route that they consider.

B

To take so initially, when you open your payment channel on a smart contract, you're committing something only on an individual edge base in this network, so you're committing only money to the edge of alejandro to betty alejandro.

A

To chow and so on, but what I'm saying like when I'm sending this message, I need to put some like I'm putting the amount of here. Yes, this amount is.

B

This amount that you send is committed to this edge at first and then the what happens is actually betty will commit to forwarding funds to chow. So what is actually happening is that betty is sending again like a hopper packet here, which contains in this case now two hopper.

A

Yeah, so so my question here, if I'm committing to three will that reveal that they have a three hops in that case, so in the current version of the protocol, it does reveal that yes, so we're thinking.

B

About some numbers to obfuscate this number here right, so you could like obfuscate it up or down. um That is currently a version that is, that is revealed. That's correct. All right.

A

Again, I mean, presumably, you can have like some zero like if, if, if this smart contract actually had uh was the zero key right yeah, then you can just.

B

Send uh that is true, although we are trying to avoid that for now, because, like we're thinking about throughput here right, so ideally we want this like packet transmission to be fast. So that's why we're trying to avoid. I know zero knowledge. Stuff is like very hot and stuff, but it's very slow. It's very slow, especially if we're thinking you know you want to send like dozens of packets. A second.

A

All right so so then um you're still encrypting kind of useful layer. So so I'm as alejandra I joined this network. Yeah first thing I need to do. I need to discover kind of as much many nodes as possible exactly in the network, all right and so are the nodes registered on a smart contract. Somehow.

B

So effectively, if you're thinking about it, who would you want to open a payment channel to it? You would only want to open payment channels to other nodes who are already kind of committed to the smart contract. Yes, by having payment channels themselves so effectively what you're doing is. We are also using the smart contract as a discovery mechanism.

B

Okay, so you're, basically going there and saying hey, you know: what's your like who's there and you do see the pop key there and from that you know to whom you can uh commit stuff all right, so they have a pop key, which is.

A

Kind of their their official pub key and then I'm assuming they also registered their id address yep.

B

That's correct, actually, there's the ip address is not there, but we have a dht for that, but you could as well just store it. Actually, there yeah that's that's totally possible, but yeah. You can potentially just when you're registering yep yeah exactly.

A

Okay, so then yeah so I come in I'm like okay, here's some cool folks um look up. Maybe the latency for the sap address is fine.

B

Exactly we're doing a health check, so what we're doing is actually um we're trying to probe the network. So far. The current version, which we have is like quite simple like I'm probing it but we're thinking about like some transitive trust or something that's a bit better to.

A

B

A view yeah, that's a very interesting, but let's, let's put a note on that.

A

um Just like basic mechanics right so have pub key. I discovered some I'm like okay I'll commit to this folks, I'm sending so so. Then I build a route right so yeah. How do I build a route.

B

Yeah, so basically, what you want to what you want to assure is basically you're the new guy. You open something to betty, and if you want to build a route you want to find out well, where does benty have open payment channels too yeah, so you're basically consuming the topology of the of the graph? And but the interesting thing is you remember when I mentioned initially that this last hop here is not incentivized, so it's basically not a path finding problem, but it's more path.

B

Selection, because you know any sort of connection of these guys is possible because your last hop is going to be here disconnected off the screen.

A

Yeah, because you can't go like.

B

This exactly exactly yeah we're assuming they're they're like we're, assuming that on the tcpip level, they are like connectable to one another, but.

A

That, if they don't like your budget, let's say you, you build a path, but the pass is deadly to, for example, withdrawal, yeah and there don't have uh nothing, not a valid path.

B

Not about that so then it would just drop better than right. uh Actually, you would, as as you do, the path selection like we, we basically uh implemented it just a path selection. You you wouldn't find that.

A

Yeah but let's say somebody did send it yeah, then it.

B

Would just it would just like, oh like that, that thing is not fun, that it doesn't work packet drops okay and similar, like it better see some from someone.

A

Who had not opened a challenge.

B

Same thing and actually another one, so it could be that a channel is like other funds right. So it could be that you have. You know not enough. You know if you only have one hopper left in the balance, but the packet costs two well. You drop the packet. Also, okay,.

A

So, potentially I mean and then kind of eventually the packets can get lost because of this yep, uh because somebody saw it didn't top it off.

B

Exactly so, it's basically it's it's kind of similar. You know as as packets hop around the internet. If there's you know somebody pull the plug somewhere. Packets get lost and you need to like retransmit and try a different route.

B

A

Okay, then yeah, that's your turn back yeah. So so I like, I can generate this hint, which is for the next uh next one in the route.

B

House actually sorry, the hint got gets uh created by the sender by elephant. That's right.

A

I I in this case is center yeah and then so, how um like? How is it generated? Such a child can actually set the acknowledgement yeah.

B

So basically, the same thing, which we, which we have done here is, is repeating right. So basically, this uh this key derivation, uh which is being done by chao, uh repeats right, so chow gets the packet, so chow again has an alpha, which is you know their alpha yeah so from that he extracts this one. He gets this one from dimitro. He gets this downstream thing and uh compares it to a value which is signed off by the previous um by the by the previous note.

B

So what is actually happening here is that part of this payment information- I just wrote hopper here, but what is actually happening is we are also sending a signature.

B

I, as betty, am signing off on the funds that I'm willing to transfer to ciao, which is a signature actually over over these values here so uh over the hint over the amount and and some other stuff that we can get to and uh we're doing that because- and it's maybe next problem- we don't want anybody here like to modify the amount, for example,.

C

B

So we we want, um in this case, ciao to be able to only extract two hopper and not an arbitrarily much higher amount. And since this amount differs like depending where you are in the route and potentially you know, whoever.

C

A

B

um This amount is being signed off by betty and then the smart contract is um is basically validating that this hint is matching something that that has been signed off um by the upstream note.

A

B

A

How is this this uh computed.

B

um The hint is, basically, you know well this this acknowledgement, so the ass acknowledgement is not.

A

Something that betty knows right because yeah, but he knows so how does ciao called coincidence so, for example, he calculated his so he got that.

B

A

And then he sends back after already calculating this. He can send the knowledge. Yes exactly.

B

So the packet goes from betty to charlotte yeah. I understood.

A

First, so so he already receives his like s3 arc, yeah right.

B

That he gets from dimitro yeah, so he goes.

A

How does he sound as true what's.

B

So basically, the the packet gets formatted. The entire packet gets like transformed betty, calculates the alpha for chao and forwards, the entire packet to chow yeah, and then the first thing that child does before passing it on is get back with the s to act. To betty and ciao extracts this as to ack again by his alpha in the packet that he got from from betty deriving.

D

B

Secret, which was established with alejandro but nice enough, chao, doesn't know it was actually alejandro from that. He is basically doing a key expansion um and from this key expansion he's getting the s2 egg, which you know he knows, and in that case alejandro new already to send the hint value in a header.

B

So so I see so I I actually thought that as to arc actually contained in some way that actually no it's it's actually all derived from the pack and that's kind of the nice thing if you're thinking about it on a high level right. So the nice thing is that betty will format will uh forward the packet to chow. Chow will again check some stuff, like is this legit and if yes, then get back then send the acknowledgement exactly so.

A

This is this is kind of neat and that this stuff, why why does chow, wants to send the quality.

B

That's a really good question: um what if ciao is like not not such a nice person and not sending this stuff back? um That is a problem, but in that case betty would just close the channel because they would just assume ciao is offline. So it's the same as if ciao like from betty's view, it's the same behavior as if child just dropped the packet and in such a case she would just close the channel and saying you know what, like. I don't play with you anymore, because you never get back to me.

B

So I'm I'm not in business with you anymore. So, even though, like eventually like got.

A

Charged one for one of the messages: yes, yeah, just closed yeah.

B

It depends like this. This will depend a little bit how we, how we see this thing happening in action right, so we will need.

D

B

Find out how bad is like a free, rider and churn problem here and saying you know, maybe once I forgive you, but if you do it like three times in a row, I'm just saying you know what cut it. Okay,.

A

Is there a minimum like let's say I want to be a child.

D

Yes, uh is there a minimum.

B

Limits that you need to have no, not really well. Actually one thing that is the minimum is like for three hops. You need like three times the minimum amount of uh of tokens that is required for one packet. It doesn't make sense to stay less, but that amount is super low. So there's there's virtually no. No minimum limit.

A

B

I can register like a million of those you could, but there is basically a cost to that right, which is the on-chain transaction fee and you block some some capital. So yeah you can you, but in in principle you could absolutely do it now. The interesting thing is: let's: let's consider that as an attack scenario.

C

B

So, let's consider you're doing you're launching a million nodes here which are all symbols of one another and um kind of coming, a bit to the trust assumption of hopper we're assuming that there's at least one honest and effectively mixing node. Now, if it's all you I'm right right, so uh what do we do to mitigate that um effectively? It's it's kind of hard right, because on the one hand we want this to be a permissionless network.

B

On the other hand like this is a problem, so in the in a path selection um that is implemented, you are literally defining who do? I trust trust is something very subjective, so we make it like very easy for people to implement their own path. Selection strategies, the one that we have implemented so far- is weighing the uh probability of selecting a note with the total stake that they have staked so effectively. Yes, you could, like you know, launch notes, but I would only select one of them once in a blue moon.

B

So that's how we defend against that one. Okay, so.

A

It is kind of ish proof of.

B

Stakish yeah, it has some. It has some properties which are very similar to pos systems. Yep, okay, there's actually some more problem that I think we haven't talked about, and that is the problem of. um I don't want. If I'm in this relationship right off between betty and chow, um if I'm ciao, I don't want to be tricked into always receiving losing losing payment information right so in just not winning something, and another thing that that we're doing here is uh we're actually not settling this every single time.

B

What we're doing is probabilistic payments because again, like in this scheme, in a naive implementation, if you have a hundred percent win probability, you see. Okay, betty is claiming something on change house claiming something on chain dimitro. Let's assume this blockchain is like super fast and stuff and doesn't cost us anything.

B

So exactly I I have some in mind which are also evm compatible. So um the thing that is kind of interesting is in such a setting. uh We, we really want to make sure that this um that this can't be tricked. So what we do is probabilistically you would win once every millionth payment only you would receive a payout, so it's probabilistic.

B

Now, if we make it probabilistic, it solves some issues in a it, doesn't disclose the path to the general public by on-chain information. Two, we save a bunch of time and money because even the fastest blockchains are probably you know not going to be fast enough for kind of packet relay networks.

B

So it's kind of two birds, one stone, but uh what we want to make sure is that this probability can be tweaked and it shouldn't be tweakable from two sides. Betty shouldn't trick ciao into char always losing child should not trick betty into um into always winning the payout and what we do um for the for, for the one side is basically on this smart contract that you have here. You are basically committing a pre-image, and this pre-image is not known to the issue of this. We call them by the way tickets.

B

So what you're issuing issuing here is not a payment like payment is something you will. You know you will receive it's more like a like a lottery ticket. Exactly so when betty is issuing a ticket for ciao, this probability is containing an element which is only known to chao and not to betty in order to not get tricked.

B

So when chao is actually redeeming a ticket he will provide, um he will provide like the the pre-image to the image which is stored on the smart contract, which is basically just just a hash, and then um the smart contract evaluates well. Was this really a win or not? And this is information which is not known to betty. It can also not be cheated by ciao because they they committed to it ahead of time and that's how we avoided it. So, just practically speaking like.

A

Ready to generate some number right and then child has a like committed to a hash of number. Yes of the problem. The child number, the study number and so smart contract like when chao actually finds like, like the winning condition, is like mb, plus and c. You know, modular a million is zero or something.

B

Yeah, it's it's similar to that exactly so. The only thing is that this this number is uh stored on a on a smart contract per image for each channel for each chat. So so, but when he wins, you submit your ticket, then exactly he rotates it, which also means, by the way, just to come back to what he said when you join.

D

B

You basically um compute uh precompute a few of these hashes and uh commit this to the smart contract and we don't need to.

A

In each channel, in each.

B

Channel you have like an a1 and a2 yeah, exactly okay, exactly yeah, and in that way um we can avoid that. You know the the ticket ticket gets, gets tweaked um good. Okay, we talked about the probabilistic payments um and what it what it solves. We talked a little about a little bit about uh path selection. So what.

A

If you just send exactly the same number, all the time.

B

Like the number is not chosen by betty, the number is what chao committed to this was a larger ticket. The lottery ticket is not actually a number that gets uh sent along there. What is happening there is actually, it only depends on the number that is here, along with a challenge which is sent along with the packet yeah. So what how does it charge for? So? The challenge is actually formed by the sender, which is alejandro in this case.

B

So alejandro is providing the challenge for all for all downstream nodes, and then we combine this challenge with the with the hash that is only known to chow, and therefore you know chow can not. um Yeah can cannot tweak it because.

A

Chow committed.

B

To it and that he doesn't know the pre-image.

B

But so I mentioned.

A

A hundred can just like what, if I just send the same challenge all the time.

B

A

B

Send the same challenge all the time. The winning probability includes the pre-image of this number here. So, if you send the same number all the time, the randomness is influenced by what is locked here.

A

Yeah but so so, let's say like this: specific challenge does not hit anybody's, and so I just keep sending you so you.

B

Keep sending it as they change.

A

This himself right.

B

Correct but ah okay, so we have a replay protection that does not allow you to send this challenge multiple times.

D

C

B

um Yeah you, you cannot send us so yeah. This is like alexander's gnomes and um yeah. Okay,.

B

Good, maybe one thing to talk about on the network on a network overview is a little bit. What is required for this to be private, so what is required for this to be private? Is that there's, at least one honest note, so not colluding with any gpa who was overview of the other parts of the network or colluding with others as well, but also needs to be effectively mixing, so it doesn't help you. You know if you have a good.

A

B

Exactly and you're the only one that utilizes this note. So what we're doing here is um to launch this network. We are using something that's called cover traffic and what cover traffic is is is kind of fake traffic that is indistinguishable from real traffic and um yeah. The question when you introduce such a mechanism in an incentivized network is a little bit well, a who's, paying and b.

B

How do we incentivize it in a way that is um that is, is kind of safe, so, in the first version, uh what we're doing is well, who is paying we, we basically finance it from token inflation. So this is a little bit similar if you want to think by analogy of like block, rewards right, yeah, so block rewards are basically like kicking.

A

B

Exactly exactly so, when ethereum launched right, they were just empty blocks, but still people would just you know mine that stuff. Why? Because they got if- and this is kind of a similar- a similar concept here on the cover traffic um and in the first version, the the the interesting thing is not just as in a you know, mining network, where you just need to think about you know who pays for it, but also who sends it.

B

So. The first version that we're having built right now, which is naive, is that's us. Hopper association is like blasting out cover traffic in order to bootstrap the network. Now, what's the problem with that, the problem is that in theory, hopper association sees all these routes right so effectively. The cover traffic is meaningless. If you assume that hopper association would be colluding with this with this network.

B

So that's what we're looking in a v2 which is using a you know, trusted compute setup such as a you know, trusted execution environment um or, like some other multi-party computation schemes, which are allowing you to disperse this cover traffic in a fashion that you can a not cheat again. If you send cover traffic all to yourself that would suck right and that two is still providing significant traffic for all.

B

The participants in the network in order to yeah have effective, mixing of all the nodes and participants in this network in a new execution environment because, like presumably it's going to be running on every of these nodes.

A

But there's no way outside of execution around like a secure executive environment to actually like create random path, which they cannot like route to.

B

Themselves, yeah, so the cool thing, the cool thing.

B

This is again it's it's not built like this is a bit speculative here, but the cool thing about the te is also like you have actual deniability of knowing which route your packet took, which is kind of cool right, so you can effectively do the entire packet formatting and like send it out to the first note show you need to send where you send it out to the first note, but afterwards you don't know what, where it goes right, because what you get out of the te is basically just like this.

B

This box here, which is you know, pre-assembled but like you, can make any use of that.

B

Yeah- um and maybe one other thing are these- these numbers, which we put here right. So whenever you have token numbers in there, the question is: what happens if token goes 10x or goes down minus 90 right um yeah? So that would be a bit bad right, because if if this just gets too pricey for um for for people to to utilize, then yeah- it's it's just not useful anymore.

B

So, typically, what we see in decentralized networks uh when we have such issues um again by analogy, um would be the block size right so um or or like some fees, some on chain fees that you have you.

D

B

Model right, so you have supply and demand, and somehow this system equilibrates itself. The problem is in case of hopper. We want to provide privacy if you want to provide privacy, and we see you know somebody's sending like 1.111111 tokens and the other one is always sending like two. You can pretty easily make out who are sending a packet.

C

B

Observe their behavior, so we cannot use the typical model that is used, for example, for gas prices of transactions on the.

C

B

Hand it needs to be dynamic, so what we're envisioning here is that there is some sort of a dynamic kind of voting system to adjust this price up or down, but this process must be slow, so it cannot happen like on seconds or minutes but like on you know weeks every couple of weeks. There is like this.

B

This thing can be adjusted up or downwards and in order to make sure that the utility of the network is not in danger, basically a badly behaving betty extracting too much money and like sending out only one hopper is actually mitigated by having that embedded in the header information.

B

So actually, um apart from, like part of this beta, I mentioned that we have uh this hint in there already, actually also the the challenge which you mentioned is in there and what is also in there for every single one of them is an amount which every single one of the downstream nodes is expected to receive.

B

So to prevent anybody from manipulating it. But again you can only read yours. So, if we're looking again back in these hatchings and how information is hidden, um you can only ever like read what is what is meant for you.

B

So in the header we have basically this this trust anchor to say. Okay, I you know nobody. Nobody was misbehaving before and I will always extract the one like, for example. If, um if I got, if I'm left with less than one like, I wouldn't forward the packet, I would just drop it.

A

So how does when you're submitting this right to the smart contract with you know? What is the challenge and your number yeah? How do you submit the amount because you're submitting the you're submitting the amount, the full amount that betty said, which is like part of it, is yeah? You you only like the alejandra are assigned to you. You know the amount that's for ciao.

B

Yeah, this is full amount. What is exactly so? What is what is received there in the in the payment channel is like is the full amount of two hopper, but this is something that has been signed off on by betty. So betty has provided a signature over this and plus uh some some other values all right, but this.

A

Is probabilistic right, alejandro actually didn't pay baji. So I I.

B

Yeah, so what could happen? What could happen? Is that you're just damn unlucky right. So what could happen is that betty didn't actually receive a payment, but she gets to pay ciao yeah. That is true. That can happen, but you know over time that should average out that's basically by equivalence like that. Lucky bitcoin miner, with the usb miner, was mining a block.

C

B

One thing to highlight on this thing: on a on a high level: is this: um it's a trade-off. What we have in here. We talked about the delays in the beginning. We talked about this cover traffic and like the the route here.

B

So one thing that is interesting is that there's a fundamental trend of trade-off between strong anonymity, low bandwidth, overhead and low latency right.

C

B

If you want to have something which has you know, super high quality privacy, you would want each of these nodes to like cage the packet for a long time, and you would to have like a super long uh relay chain right, but what it means is. You would have a lot of bandwidth overhead for the network which you have to pay for and the second one is it would take longer.

B

So um what we want to do here is to basically make this configurable for the sender alejandro right. So alejandro can choose how many hops um he wants to send now. One funny thing is like, since, if if we looked at at this whole setup is in the sphinx packet format, we need to define a maximum number of hubs in the network.

B

So otherwise you know you can everybody.

D

B

What what you're doing.

D

B

Yeah effectively, you should have like fast packets and full packages, exactly so we're thinking like having having two tiers right. So one is like, for you know maximum three, and maybe one is for longer, but actually, uh if you look at the uh anonymity set how it grows as you increase, the root is actually like: it's flattening out somewhere and there's some analysis that have been done. Also.

A

There seven is planning.

B

Actually, like three is already pretty good, so that's also the reason, apparently why tor has has a choice of three.

C

B

Not something much more because it just it just flattens out, eventually it doesn't add much, um but what it does add is of course, trust in each individual one right so again it the anonymity set, might not grow significantly.

B

But what does change quite a bit? Is you know the likelihood that you have one note, at least in your chain, which is which is honest, so um yeah? It's just something that you, unfortunately always have to consider, because when you use a network like hopper like people are going to say well, like performance is poor yeah well, yeah! That's because of this.

A

Very fundamental, so what's your latency, like you said, I mean the cash flow period of time. They said in different order. What's the latency yeah.

B

So we are actually trying that out right now, so right now, um what we're doing is we're having a fixed delay of um a few hundred milliseconds. I don't remember the exact number, but what is interesting is actually uh it shouldn't be just fixed. So there's you know.

C

Some research yeah.

B

Exactly there's some some uh research uh going into into that saying. You know that you should ideally have like some poisson personal distribution. Now the interesting thing with the poisson distribution is, you know, there's non-zero probability, that's almost infinitely long now, an infinitely long latency is pretty bad.

B

So what that means is there's inherent packet loss in such a protocol. If you want proper anonymity, but again, that's something that is required because you want to have kind of deniability of what is what is going on and yeah.

B

Another thing to to add there is on this on this cover traffic front, which is uh something that we're we're thinking about is not just sending this linear um flow that we have have here, but there's like some some other research where people like people loop it back actually so and by doing that by looping, a small fraction of the of the packets back to you, you can observe what is going on in the network and you say: hey.

B

I receive fewer packets as I should receive per this distribution, so probably there's something nasty going on like somebody's deliberately trying to censor me, for example.

B

So that is something that you can do in such a you know free routing scheme, as we have with hopper. So you can, you know, build a lot of other mechanisms on top of it, which is just part of your path, selection right, so you use path. Selection. However, you wanted to in your in your application.

A

Got it and then your kind of liveness is mostly depends on pretty much like peer-to-peer, but if appears is not responding, you're just dropping them.

B

Yeah, it's actually a pretty interesting design space that we have here with this incentives that we bring into such networks because, like you, could I'm not saying it's necessarily a great idea, but you could bring punishments right. So if you have too high churn, like churn, really harms this network yeah. So if.

A

You'll close a lot of state channels. At the same time,.

B

Exactly or like, if they were not online for long enough or you know, if, if downstream notes, didn't like make any revenue like you, you can just punish it.

A

In the account like some of the same they're, too easy to game and then yeah explain a bunch of channels and then dropping the exact things yeah, so yeah yeah there's definitely a lot a lot more things to innovate. Here.

A

Awesome! Well, thanks for watching when we're seeing this in production on in browsers near you.

B

A

B

Near you, so we are currently working on, so we are currently working on stabilizing the infrastructure layer so basically making this network stable for node operators. Actually one thing that we didn't talk about, which is a big headache for us.

B

We want to make this truly decentralized, so, if you're, using that from your home, router like from a laptop between your home router and me also- and they should still talk to one another, having that in a decentralized fashion is something that's, you know not so easy connection, so uh the whole nit topic is a big one yeah. So we are actually right now having an uh a test net online that people can just play around with and uh over the course of uh 2022.

B

We want to bring overlay features that you have from you know. I would call it more. You know higher level protocols near you, um so like tcp, like features when we have tcp like features, then you can build stuff like socket connections and with that off you go, but we'll need the course of 2022 to build these overlay features in so that you cannot just use it for trivial. First, applications that we're showing right now so we have like this chat application.

B

How you can um you know just just send some stuff through it, but you want to get delivery guarantees you want to there's also another thing: we didn't talk about this return path right, so how does zoe send stuff back so in things it's again, not something something new, there's a very cool way of um ensuring that you can, in a privacy, preserving fashion, send stuff back so.

A

B

Can send stuff back to alejandro without knowing to whom she's actually sending stuff? So that's very, very cool and yeah. That's that's the roadmap uh for the year awesome sounds good well. Thank you check out hopper and um see you for the next episode. Thanks for having me here.

B