foreign
[Music]
and he's gonna tell us about a private
exchange application that was built on
top of ZK Opera yeah
thank you for coming
my name is takamichi today
I'm going to talk about the Private
Exchange
yes
I'm software engineer at the privacy and
scaling Explorations team at EFM
Foundation
and
yep say
I want to explore a privacy preserving
decentralized exchange on gko proof
for this project
we are aiming for more private
peer-to-peer exchange system
and private exchange consists of three
different zero knowledge protocols to
protect users privacy
and I in this talk I'm not going very
deep on the technical details of the
protocol but I will show how those
protocols works and how the protocols
are used in private exchange
all right before diving right into the
private exchange
um let me start with one question
so why do we need privacy
I think there are many reasons for many
different people
and for many different use cases
so I'd like to share my opinion on this
today
the Privacy is important because it can
contribute to censorship resistance
like own public blockchain like ethereum
like the transactions on the all the
transactions on the blockchain are all
visible to everyone
so it can be censored um
mostly like in a smaller Networks
because the number of the validators and
the block Builders are later to be
relatively small
to the censorship likely to be happened
more often
for example
um if you want to spin up minor roll up
on ethereum
this is the case
and for second
it also can mitigate the Mev or front
running
if the privacy of the transactions can
be kept
at work
to prevent the mov and front running
but most importantly
it is a human rights the Privacy is a
human rights
here is a quote from the universal
Declaration of the human rights and
article 12
so my opinion is
we don't need any reason
to work uh
um protecting privacy
we need privacy because it's human
rights
and we should care when we're building
an application
and today in this talk I will walk you
through how we approach
um to protect privacy when building a
decentralized application like private
exchange
all right
let's get into the interesting part
what is private exchange and how it
works
so what we are trying to achieve with
the Private Exchange
is to make exchange process more private
yes very simple
and don't let users to expose their
information
or intentions
that's our goal here
so what exchanges do
exchange let users exchange their tokens
in this diagram Alice sends 1.0 if to
exchange and gets
1050 500 die in exchange
there are more functionalities
but I'd like to focus this one function
today
and there are two popular constructions
in
decentralized exchanges today
the first one is automated Market maker
in this kind of Exchange
users can typically users can exchange
their tokens without a counterparty
this means that at least just interacts
with a smart contract
and doesn't need to anyone else
doing an opposite trade
the price is calculated automatically in
the smart contract
and others can exchange tokens on that
price
the second approach
is an order book
in order book
Alice puts something called an order
to order book
and the order contains information such
as token pair amount
and a price
in this example I just wants to die in
exchange of eight an amount she wants is
one thousand five five hundred die
and the price is one thousand and five
hundred die per it
and if there happens to be some other
order by Bob
who wants to do the opposite trade
attending one thousand five hundred die
4 1 8.
then the order book attempts to match
the orders
and execute the swap transaction by
sending transaction on chain
and one thing to note is that order
books can be on chain or of chain
if the order book is on chain
Alice Post an order to the smart
contract order book then Bob finds the
order on the smart contract and takes it
by sending transactions
and if the order book is of Jane
there is typically some intermediary
order book provider
that collects all the orders and trying
to match the orders
but in either way
the orders bulb and Alice sense includes
the information that uh
order book provider or smart contracts
can
find a pair okay
now it's time to think how we can
execute the process more privately
in order to make exchange process
private we come up with a relatively
simple peer-to-peer exchange system
and it is some somewhat similar to an
order book construction here but it
tries to keep information private as
much as possible
so let's look at the Autobook diagram
again
here we can see
the parts that are not private in this
diagram
the contents of the orders Alice and Bob
sends to the order book
are not private
and the transaction that Autobook sends
to the blockchain
is not private so how do we make this
more private here we use three zero
knowledge protocols
blind fine and socialist millionaire
problem and zko Brew
foreign
let us think of how we can make others
more private
in the order book system
order book is the one who collects all
the orders from users
and make matches
so Alice and Bob needs to send the order
data to the Autobook provider
but
if they can compare prices
and make a much a more P2P way
by directly directly sending messages to
each other
then
they don't need to reveal the data to
the order provider at all
oh wait
how does Bob Reach Out Alice in
peer-to-peer Network
we use land find
protocol here
land find is a network
that peers have neighborhood lists
and Bob
can look up Alice
and prove that he can reach to Alice in
the network
but importantly
Bob can search for Alice in the network
but without revealing that Bob is the
one who is searching for Alice
so the neighbors that receives a message
from Bob will never learn that Bob is
the one
who is searching for Alice
so in this way uh Bob have
like some privacy of that
key
um
have some intention to take the Alice's
order in the public aboard
now
a bob can reach out to Alice to execute
the peer-to-peer order matching
thanks to the Socialist millionaire
problem here
we can do the private peer-to-peer order
matching
socialist millionaire protocol
is used to check the equality of two
values
but without revealing the actual values
so the idea is
that they have some numbers in mind
let's say Bob have X in mind and Alice
have y in mind
then they
don't directly um
sending the original values
but instead they derive some values by
by calculating
um
some mathematics and also they use some
random values
and exchanging messages
then after the exchange uh complete they
can test that if the original values
that Bob has in mind and Alice has in
mind are same or not
but here Bob cannot calculate back using
the
received value to y
and Alex cannot calculate X from the
derived messaging values
foreign and we use this protocol to
check if the price is
that Bob wants and Alice wants much or
not
and here's how things work in private
exchange
so firstly Alice creates
information to public board but without
a price
we call this an advertisement
and Bob finds the advertisement on
public board
and search Alice in the blind fine
Network
the price matches
they proceed to create transactions
and this way
we could omit the intermediary
who acts as comparing the price and
making making a match
and preventing posting prices they want
to public
now the order is partially private
because they can
post an advertisement without a price
and now we should think about
how we can make these transactions
right hand part private
so here comes TKO prove
DK opru is an abbreviation of zero
knowledge optimistic roll up
we use ticket proofs
for privacy and optimistic roll-up
technology as a layer to technology
protocol
and in essence
we can make secret transfers
with a cheap fees
we can prove that
those transfers are valid using ticket
proofs but without revealing the
contents of the transfers
but there is
another thing
a secret Atomic swap
so there is a feature called Atomic swap
on zko Brew
and let's say that Alice and Bob agreed
on Sam Price using socialist million
problem and they can create they want to
create the transactions
called Atomic swap
to make swap transactions or a pair of
transactions
and has to be included in the same block
so in this uh
case Bob send Alice
1500 500 die
and Alice sends
1.0 is to Bob
the two transactions have to be included
in the same block
and if not it's not valid transactions
anymore
and of course the transactions contents
are secret
even block Builders called coordinators
cannot see the contents of the
transactions
so using the secret Atomic swap
the transactions
sent on the blockchain
is private now
so here is a diagram complete diagram of
the Private Exchange
all right so let's go over the private
exchange flow again
so firstly
Alice and Bob joins the network called
Blind fine
so that they can reach to each other but
without revealing that they are finding
someone in the network
next Alice posed an advertisement on the
board
but without a price
and next Bob finds the advertisement
and Bob search for Alice
and a blind find
if they successfully Bob finds the Alice
he
start executing socialist media on a
problem
to compare the price that they want
and if the price are same
they can create
Atomic sub transaction
and send it to ZK Oprah
in this process
advertisement is partially private
and price matching is done privately
and peer finding
is done privately
and transactions contents is also
private
so
what I've talked today
is one simple example
of a privacy application
and
what I talked was firstly I started with
a what does this application do
so in our case it is an exchange
so exchange let users to exchange their
tokens
and in that process which part of the
exchange
process is should be uh private
in our case it is an orders and
transactions sent on chain
and lastly
I talked about how to make those
informations
private
we use three general knowledge protocols
line find and socialist millionaire
problem
and decal Brew
and as a result
the private exchange does not reveal
transactions content
and it does not reveal price of the
orders
to public
and it also does not reveal the
peer-to-peer routing in the network
but at the same time
there are challenges in this
constructions
firstly
socialist maybe on a problem
can check the equality of the values
therefore it's not easy to compare
for example to use a range
to create a match
so in the application it's harder to
find the counterparty elect Bob
if the SMP can work only this way
secondly
and advertisers
needs to stay online while waiting
incoming social estimate on a problem
messages
so Alice after sending advertisement on
public board
she has to stay online until Bob shows
up
and finally
users need to join line find network
before starting the process and also run
the blind find process
while in the application
so these
are the challenges
and it directly affects you the user
experience
of application
but
some of the challenges can be mitigated
on the application layers but some
other nice Improvement of the
cryptographic protocol layer
so in privacy and scaling exploration
scheme we do many privacy projects like
applications and also cryptographic
protocols to improve privacy
in this blockchain space
if you're interested in those Projects
please take a look at our home page and
Discord
and I want to give a shout out to the TK
Opera team once up
Jane Jimmy Geo chance jelly Rachel
thank you
[Applause]
um questions please
um first quick question is the s p uh
interactive or non-interactive as
interactive so you so you have to
basically so like if there's a list of
advertisers a user will have to
communicate with every Advertiser right
yes
so this doesn't really scale well as it
increases is N squared like complexity
for yes okay so that's that's uh yes
that's also uh our ux challenges as well
yeah sort of on the same vein um one
question I had was
um because you know you still have to do
the SMP to find the price
um you sort of know a general idea of
the price because you have other markets
that you can measure the price from and
so
um is there any prevention mechanism for
like a mass de-anonymization of the of
the price the ads uh in a way that
somebody could just keep trying to uh
discover the price and build up an order
book that sort of matches the
expectation of the ads because there's
no obligation to actually trade on any
of these ads right so you could just try
to Brute Force
um figure out the actual order uh yeah
yeah yeah
um so
uh for current implementation we don't
have like such features but as you said
it needs like the uh many times of SMP
trial to find a
the price matches and also
we don't have like the prevent it to
prevent such details like types of
attacks right now so yep we need to uh
work on that ux Improvement as well
thanks
thank you
[Music]