[Applause]
I work for a project called NIMH and
we're talking about privacy and block
panes and decentralized systems and
distributed systems today a little bit
about the internet and sort of more
general systems outside the block chains
and where a project is basically about
privacy the kinds of things we're going
to talk about today why are we doing
this like what what are one of the
things that were interested in what kind
of problems were interested in solving
getting the quick definition of privacy
and we're going to talk about two core
technologies so that we are working on
one of them is called a mixed net which
is a kind of better than tor way of
anonymizing your internet traffic and
the second one is decentralized
credentials so that's kind of like the
quickest way I've ever tried to figure
out to explain it to people with
something like a decentralized a lot but
it's actually much more powerful than
that so you can actually use it to
anonymize pretty much any crypto
currency transaction or block a
transaction using
anonymizing claims which I'll explain in
great detail in just a moment then we'll
do a quick demo and then we have a
discussion how many of you here are
developers who have projects that maybe
have interests in privacy you can be
useful to have different privacy
preserving things that's great I'm super
happy ok good so hopefully we can have a
really good discussion as well I think
we should introduce ourselves first just
as people so my name is andrew scott and
their head of
my research - investing technologies and
in particular and identification metals
cool and my name is Dave Harrison as you
can see from my last name I got quite an
early start with encryption I'm a
founding member of decentralized
derivatives platform called the Vega
protocol I previously built a started
scalable blockchain and consensus system
called chain space moved to Libre very
briefly and I thought that it was
actually more interested in working on
Internet privacy issues since that's why
I'm working here at the wider team this
is the kind of production team including
some of our coders and other surrounding
people and we actually have quite a
large team of advisers from across
Europe from four or five different
universities across Europe basically so
our goals we have one goal it's pending
mass surveillance
why would we want to do this quick quick
kind of overview I kind of think that
the present situation on the Internet is
something like crypto Wars - so it's
like the sequel to the crypto Wars for
those of you who miss crypto Wars one
the original episode the 1990s were
quite there were quite bold attempts by
Lina's government to legislate things
like hardware backdoors into computers
and network systems and they basically
want to work reroute all cryptography at
the time that was so they're kind of big
aim strong cryptography in the 90s was
classed as ammunition and it was subject
to export bans so that you couldn't
share it outside the United States many
arguments against privacy were advanced
at that time and if the anti privacy
advocates had won in the 90s most of
internet systems that we use today would
probably never have happened but as it
turns out the original crypto Wars were
one during the course of the nineties I
think that the available the
availability of SSL probably did more to
advance here
security and privacy of Internet in the
nominees than anything else is rarely
viewed this way but SSL and success
protocols like TLS are a practical and
very important contribution to help
ensure a civil rights worldwide
Transport Security is the core
infrastructure of global civil society
in my view it also ensured that a lot of
new industries categories so things like
e-commerce internet banking private
messaging photo sharing many of the
convenience of the modern life that we
take for granted everything would be
very different today if the coders of
starting in the 90s have been prevented
from protecting user data now today just
like in the 90s we have a kind of new
technical set of possibilities in front
of us and the same arguments about
privacy are being advanced I think that
we have to we have to win the kind of
crypto Wars to in order to make both
global civil society secure and also
take advantage of the new economic
opportunities that we have in front of
us
yeah so that's in a nutshell the reason
why we're doing this
how ok so you might rightly ask how
we're planning to do this we have
basically two core technologies in our
system the first one as I said as a mix
then which is a better than tor network
security layer and Anya's Mixon expert
she's going to talk about what better
than tor means not to rag on tour
because it actually does a really good
job but there are certain attacks
against tour and we think we can just
generally do a better job the second
thing which I'll talk about is a
signature scheme that provides these
properties and I'll go into those in
detail in a little bit but first I'll
hand off to money
it's the first time using the clickers
Obama's accident like explode the screen
or try not to so before we're gonna jump
to like discussing what big networks are
alleges discuss what privacy actually
means to privacy the fundamental human
right and we can think about privacy in
the context of legal basis in the
content in the context of human need and
we can also think about privacy in the
context of computer security so in
context of computer security and in any
other the most general way to define
privacy is that privacy is the ability
for us to decide what type of
information we would like to share with
other people or disclosed about
ourselves and privacy is a is a very
complex topic because when we are
building privacy enhancing systems we
have to make sure that we're gonna
consider each of the components of the
system in terms of privacy so it's a
very holistic property which means that
the information leakage in one of the
components of the system may vary
significantly
decorate the privacy properties provided
by given the most and hence
cryptographic techniques in the other
component of the system so with because
today we are talking about them and them
is a system for enhancing the privacy
properties of the online users the most
basic component of the system which we
want to run online is the network layer
security and when we're thinking about
the network layer security one basic
thing which were thinking about is the
anonymity so what is anonymity anonymity
in general is the property which allows
us to remain indistinguishable among
other people performing smart actions or
of
patience and in the online world we
gonna talk about anonymous communication
at the network layer so we would like to
hide the fact who is communicating
before or who is exchanging information
with home and the witness anonymity is
important so if you're gonna think about
network layer security you have to think
about the metadata so when the internet
was first introduced in DARPA it was
developed as a small side project
focused on fast packet switching and it
was intended to be used for casual
communication not for an exchange of
confidential information there further
was a very small amount of thought put
into securing actually this
communication and how it turned out this
little project ended up being a
worldwide project and we all use
internet nowadays for everything and
every online activity which we perform
lives a digital fingerprint what it
means that every operation would you
perform with every operation which you
perform online is associated the
metadata
what is this metadata the best way to
define metadata is to say that it is
everything about your communication
except the content so this is
information for example about who is
communicating with whom how often both
times of the day what is the dynamic of
the group what is the sequence of
communication from which location you're
communicating with people and so on and
so on and when the priests program was
revealed the NSA was saying that no big
deal that here were trying to record
your communication because we are not
reading your content we're
the metadata but it turns out that this
metadata carries a lot of sensitive
information about the users which very
often is as revealing as the content
itself you don't actually try to prove
the messages and look if it wanted to
infer a lot of information about the
users which in result allows you to
infer what are the relationship whether
they're political or sexual preferences
religions and so on and so on so let's
look at a couple of examples of privacy
enhancing technologies which are very
popular nowadays I'm pretty sure you saw
or heard at least about one of them and
let's think whether they offer us
anonymity at the network level or not
and how good is this anonymity so the
first example is as to an encryption I'm
quite sure that to you either use I've
heard about PGP for emails or add to an
encrypted instant messaging applications
by whatsapp signal telegram and so on so
this is a very good example of a
progressing and hansung technology which
allows you to have confidentiality so
which allows you to hide the content of
your communication but it doesn't
protect the network player metadata
associated with your communication so
even though you're hiding your actual
messages you're not hiding the fact with
whom and however you're communicating
another example are the privacy
enhancing crypto pies so I think I don't
have to convince anyone that bitcoin is
not anonymous but let's look at for
privacy friendly coins like for example
zip hash so seepage is a very nice
promise privacy supporting point because
it offers a good privacy properties on
chain thanks choosing the zero knowledge
technology but it does not protect the
network layer so in result the adversary
who has access to the network layer is
able to correlate users transacting just
looking at their net
addresses and the example is VPN also
the threshold fighters network so here
we are getting a little bit closer
towards securing the network layer of
communication because actually VPNs
of a some type of network level
protection by a frank and encrypted
channel between the user and the VPN
provider which acts as a proxy but what
is the limitation of the VPN or VPNs are
centralized which means that simply you
have to trust the PPM provider that he
will be behaving honestly because he is
the one who sees your traffic between
the user and the public Internet so in
results you have to trust that the VPN
is not malicious or it does not keep any
logs about your online activities and
does not share with anyone
so the research in anonymous
communication networks is definitely not
known already in the early 80s
David champion ear the idea of the
first-ever anonymous Network called the
mixed Network so I will try to give like
a very brief crash course on what mixed
networks are so let's start first what
is a mix mix is simply a router and that
will project for any type of Internet
traffic which would like to use and it
makes network is just a set of such mix
now and don't be particularly face that
I'm showing the mix ontology just a
single sequence in general you can have
many topologies of this network but just
for cyclic simplification I have just a
single path but on top of being just a
network router the mixes have some
security properties which allow you to
remain anonymous
a player so what are those properties
the first property is that it makes
transforms the received packets
cryptographically what does it mean that
if Alice wants to send a message to Bob
she gonna and coat her message into a
special cryptographic packet format in
such a way that each mix on the package
with Alex Alice and Bob will remove one
layer of this cryptographic protection
so if some of you know Onion Routing
it's a very similar idea
so we layer and crimp the packets and
what this gives us is the property
called bitwise unlink ability this means
that if the adversary observes any
single mix and he sees packets coming in
and packets coming out he won't be able
to correlate them looking at the binary
representation so the bit pattern of the
packets in and out does not correspond
to each other another property of the
mixed networks and the mixes is not
related anymore to the bitstream but
rather to the timing of the packets so
most of the routers of the network work
at the first in first out basis which
means the first packet coming in will be
probably the first coming out so imagine
your mix works like that and the
adversary observes the mix and he says
packets coming in and out and even
though we cannot correlate them based on
their binary representation you will be
able to correlate them looking at the
time of their arrivals and departures
that's why the mixes do not forward
packets at the first-in first-out
role instead of that they reorder the
packets following some secret
permutation what this does is that the
timing correspondence between the
incoming and outgoing packets is broken
up and there are many different ways to
perform this reordering following
presentation the original chance mix net
words operated in synchronised batches
which meant that the mix is waiting the
whole round with which can be for
example an hour or something like that
and gathered some packets processes them
and at the end of the round shuffles
flowing a secret permutation and flashes
to the next hole so those two properties
the bitwise and unlink ability and the
timing and likability allow you to
achieve anonymity of your communication
because the mixes are combined in long
chains and thanks to that none of the
mixes knows who is the sender and
recipient because they only know that
previous and the last and then at the
next hold so they don't know what is the
whole path and who is sending messages
to home and at the other and at the same
time the adversary who's observing even
the entire network can sniff all the
packets at all the links won't be able
to correlate your communication so as
long as at least one mix in the path is
honest your strong anonymity remains so
any mixed network designs had a couple
of limitations in terms of performance
mostly scalability and very high latency
overhead because those batching plants
required a lot of time to wait for many
packets to arrive that's why the nimac
network is based on the modern mix
network design called topics which
solves the problems of traditional mix
networks so a little bit about how name
mix at work works and how we solve those
issue of limited performance in
traditional mix networks so the first
is the network topology so apology means
that mixed notes are roped into layers
and the traffic is flowing from first
layer to the last layer in one direction
and why did we pick the stratified
topology it's because as research has
shown the stratified topology has
debates the best trade off between the
anonymity and performance and it's a
topology which scales horizontally which
means that you can very easily scale
your network if the number of users
using it increases or the volume of
traffic increases because you simply
have to incrementally add more nodes so
for example tourists an example of a
network of an anonymous network which
also scans horizontally in terms of the
bitwise amicability and the
cryptographic packet format which were
using we're using the Sphynx packet
format if some of you know lightning
networks you will know that exactly the
same cryptographic packet format is used
in the Lightning networks and the Sphinx
packet format offers the unlink ability
of the binary pattern and make sure that
all the messages are padded to the same
length but it also ensures resistance to
packing and replay attacks and it allows
to encode all the relevant information
will fit the packet with what means that
the sender as soon as he sends the
message into the network we can go
offline which for example does not
happen in tour because it or you have to
be online all the time to be able to
communicate when you're sending packets
because you have an open circuit in the
because we're using Sphinx we can just
set the message and go online and in
terms of this mixing operation this
reordering we use the so called
continuous time axis and this is a very
nice technique for mixing at the packets
how it works we don't have synchronized
friends we do not batch messages instead
of that each packet is delayed with some
random amount of time and the sender
when he's preparing the packet to be
sent into the mix Network encapsulate
those random delays from each mix on the
path this delay is randomized and that
makes when he strips the level of
cryptographic protection because I see
this delay and she knows for how long
you should keep the packet before
flashing it and why actually this is a
good technique for mixing well we are
picking the delays from the exponential
distribution and the exponential
distribution has a very nice property
called memoryless property what it means
imagine you are the adversary and you're
observing and mixed knot and you see one
packet arriving at some pot at some time
and then another packet arriving to the
mix at another time and then you see a
packet leaving the mix this memory and
memory less property tells you that you
cannot guess which of the incoming
packets is that one would you observe
going out because the timing at which
the packets departure from the mix is
not related to their arrival times and
what it gives like in the big picture it
increases the anonymity set because in
the synchronized mix networks you have
the unlimited set of the size of how
many messages you've managed to gather
during the run here because everything
works in a continuous manner and the
exponential distribution is known to
hell you're you're under limit
it's much larger because you actually
have to consider all the messages which
you have ever seen arriving to the mix
not as being potentially the one
departure and the last thing about the
new swing set is that you know it's very
intuitive that when we are talking about
anonymity the larger the group of people
among which you're anonymous the better
is your anonymity so mix that works
better often use covering traffic but
the problem with the traditional mix
network design was that this covered
traffic usually required a lot of
bandwidth and that's why in them and in
the dim sum example we're using a
tunable covered traffic and Chernobyl
means that when the volume of real
traffic increases in the mix network you
can tune down the amount of common
traffic which you're using and vice
versa if the amount of real traffic is
dropping and the type of covert
particles were using is called a loop
covered traffic alone means that the
sender and the recipient of this packet
is the same person and both the clients
and the mix notes are sending
blood-covered traffic following the
Poisson distribution this ensures that
the potheads the real ones and the loop
packets are very nicely mixed together
so the adversary can not distinguish
looking at some sample of traffic
whether he sees real messages or loop
messages and so on but the local
messages they also have another burgnik
advantage they allow to detect and
prevent active attacks in which either
malicious mixes or malicious adversary
can block or drop some of the packets in
the network this are properties which
were not in the traditional mix at work
designs so it's a very big advantage
okay just to wrap up about the names mix
that what is like the key takeaways you
should remember is that we have a mixed
network which has a
anonymity versus performance trade-off
the network scales very well we can
adjust the latency which we need in our
system depending on the amount and
volume of traffic which we have we can
detect and resist active attacks and so
that's about mixels thanks Anya so
that's half of our system and by the way
we're going to try to do well we're
gonna succeed in doing a demo because we
don't have any dependencies on internet
a shuttle movie last night in my hotel
room
so we'll actually be able to see some of
the stuff happening so we've built a
small chat application just as a kind of
tester and we you'll be able to see
messages going into the mix net going
between two terminals as a kind of
simple example but you could use mix
Network many more things than chat we
can use it to pretty much anonymize any
of your blockchain transactions any of
your crypto currency transactions or
anything else for that matter yeah the
second part of our system is a system of
privacy preserving credentials so these
are working at different layers here a
mixed net defends you at the network
layer whereas the credentials that we
have can defend you at the layer of your
transactions or your block chain so the
mix that protects your IP traffic as
it's traveling across the element
unprotected wilds of the internet and
the privacy preserving credentials allow
you to code cryptographic claims and use
them so we're using a signature scheme
called coconut so what is coconut well
coconut is a signature scheme and as you
may know all signature schemes have at
least these three algorithms that you
need to be able to generate your keys be
able to verify a signature that you
received and you somebody has to be able
to sign okay so given given the public
key of the first
that you want to assign a message for
you should be able to assign that thing
and it's anybody who has the public key
that was signed which they should be
able to verify right so everybody's
pretty much familiar with these things
who a lot of know that you know it's
very good
cool so name signatures are it is a
signature scheme but we have several
additional properties so the first
property that we've had to the server
normal 3 we have blind signatures or
blind issuance this do people know what
that means some people not everybody
okay cool
so again david chung cryptographic
genius invented blind signatures which
have some additional properties and
functions let's take a fictional ecash
scheme just to kind of use an example to
try to walk through what a blind
signature is so i'm going to create a
cryptographic claim so a piece of
cryptographic material that basically
says what I want to end up with is a
bear a bear or token saying I have $1 ok
that's that's already don't take it out
of the blockchain world for just a
second so I'm gonna create this claim
saying Dave has $1 and it'll be in
clear-text cool so I've lined it locally
on my client and that turns it into
gobbledygook so it just it's just a you
know a piece of string E string eNOS and
I'm gonna send it to the bank over the
network along with a dollar if I could
transmit a dollar through the through
the pipes the bank is gonna then sign it
and saying they attest yet Dave
definitely has a dollar we're rolling it
cool now he's got this claim that he can
run around with and they give me a
signature back so they've signed
basically a piece of blind cryptographic
material they give it back to me and now
I now I unwind the credential and I can
basically D Link it back from what I got
back from the bank so I now have a
bearer token which attests that I on a
dollar and yet
the bank never actually they can't
really identify because that you know
that all the other materially in that
blinded credential they never saw they
just saw some gobbledygook so this
process of that to create the clear text
blinded clear text locally send it to
the signer the signer signs it return it
to the creator and the creator on the
blinds it to use it as bearer token this
is the kind of general process of wine
signatures now some of you may have
noted that there's a problem with the
mind issuance you may but I detect what
it might be exactly so the cider has
just been presented with this
gobbledygook and they signed it and then
given it back to me so it could have
said dave has $1,000,000 in it and they
would be unable to tell without some
further active verification so if you're
the you're the bank you get some gully
the youthful solution to this is to
use as your knowledge proof attesting
that the message contains one dollar but
reveals nothing else
so the serial number of the credential
my identity anything like that so
there's a bit of zero knowledge of
action inside this so coconut our
signature scheme has this hero knowledge
proof abilities that's one of the things
that it does so we can do my dishes cool
a second thing that we have is the
concept of reran demise of bold
signatures does anybody ever run across
this before now it's a pretty weird one
I'm gonna demonstrate it in a little bit
but this type of signature has an
additional algorithm to these three
which is basically randomized so you
basically can take a signature and then
from that signature you can call a call
to randomized method on it and you can
basically generate a brand new
credential which is cryptographically
equivalent to the original credential
that you originally had in your hand is
completely delinked become completely
anonymizes the cryptographic that
here they have in the bearer token so it
looks like a brand new credentialism s
are unthinkable between the two but it
can still be verified through
cryptography and this as if it was the
original one so I'll demonstrate that in
a bit but that basically can make your
bearer tokens untraceable so you get a
very very backward and some kind of
authority you call the random re
randomize method on it you get a new
bearer token as the same cryptographic
material but the authority can't say
guess was they have that generated this
because I saw that one and I gave it to
it's that kind of makes sense getting
cool okay so what is this used for so
you could create multiple signatures and
show them to different people but the
people that you show it to cannot link
you back to the original original
signature or any of the other rear end
of my signatures but the underlying
messages in in this case is all the same
so that caught the crypto got the
content is all the same across all these
credentials so we basically have
multiple anonymized bearer tokens that
can each be validated as if they were
the originals so we have the property of
unlink ability cool we also have a
concept of selective disclosure so in a
traditional scheme when you sign the
message and somebody wants to be
verifies the message they have to verify
the whole thing okay
so selective disclosure means that
instead of needing to verify the whole
message you can have people verify only
certain attributes in the message
keeping other parts of it private so
let's consider an example again to make
things easier let's assume that we have
a passport so my passport has my name my
nationality age photo and place of issue
in it right so these are the attributes
in the passport let's say I want to go
to the pub and have a drink and they
like I mean I'm so old that I would
never need to prove that I'm old enough
to get it but other people might need to
actually like produce some kind of ID
and you know you could in an electronic
kind of way you might send your whole
passport over right and identify
yourself completely but actually can
anybody see what we
to get into the Pelletier age page and
photo right and actually we're doing you
really want to say you know how old is
Davis is really super ancient what we
really just want to say is he's over 18
right so that's that's that's basically
what we want to selectively disclose so
coconut allows us to do this
so you're basically signed a tuple of
all fields in the passport and when it
comes to verify the verifier can verify
only some of the attributes despite the
fact that the rest of them are still
there
you can selectively choose to quote
disclose these things and you can
selectively choose to declare disclose
from different ones to different people
basically so yeah so basically we have
three parties we have the passport
authority the subject that's whoever
wants to go in the pub and then we have
the the relying party we call it which
is the bouncer at the pub door right and
you can basically choose to selectively
disclose some or all of the attributes
of the message so when you put it all
together selective disclosure can be
applied to normal signature schemes
without winding without reran demise
ation so you can get a signed message
from an authority and disclose them
selectively and this provides privacy
against the relying party the bouncer
and also against the passport of 30
right
oh sorry if you go to this if you go to
the pub again or if the if the passport
authority wants to without the other
properties that is blind issuance and
rear analyzable signatures they can
identify you the second time you go to
the pub as being the same person right
or the passport authority to break your
anonymity if they wanted to if we
combine all of these things blinded
credentials re randomize Mel signatures
and selective disclosure we can protect
the users provide privacy against
multiple shows that is uses of the
credential at the pub so the bouncer
will always think it's the first time
you've been there
which might be important in certain
applications and we can also protect you
against the passport Authority who has
no way of linking the credentials you're
using to what they've issued now keep in
mind we're not really talking about
making a passport Authority any kind of
authority that you want to have it can
assert any useful information about
anything in your applications can be
contained inside an in credentials
so all the elements thus far
basically existed in the cryptography
literature and we were we're just
stringing them together so like this
isn't some you know mind blowing the new
set of things maybe you haven't heard of
it before but all of this stuff
basically exists but they only existed
in centralized systems so up until now
it's been impossible to string these
things together in decentralized systems
and that's what
kokin Eyes coconut basically gives you
is this one more thing which is
threshold issuance so you can actually
have a decentralized set of authorities
all generating the part of a credential
so that allows the the kind of the
decentralization of the kind of
blockchain ization of abusing these
kinds of attributes for the first time
so we're not aware of anybody else who's
done this so it makes all of these other
things like blind issuance rear end of
my signature selective disclosure use a
bowl in a blockchain context so this is
known as a threshold signature scheme so
that's basically what coconut does and
what the mix that does well they'll
break for some questions here just to
keep things going back and forth and
then I'll do a quick architecture
diagram of what we have running right
now and then I'll show thee that can
show some of this stuff in action
yeah cool so questions any
yeah okay so the question is what is
that timing in replay attack so
attacking attack is if the adversary is
able to slip to snip a package going for
the network and then sleep like a single
bit for example in order to be able to
like trace this packet per day in the
network so if you don't have a
cryptographic packet for my schedule to
be resistant to that it will just flip a
bit and then you will be able to trace
the packet the replay attack a can be
used also for tagging it means that
you're repeating the same packet once
again just for example to see where it
will go again so you're able to sniff it
and then resend it again
you mentioned that you like set out to
basically build something that's better
than tour in terms of network security
so the main attack against tor is
essentially a government agency running
like over 30% of all nodes and by having
a majority of exit nodes they just see
where the all the packets end up how do
you address that attack so for example
the thinking tour is that all the
packets are going like all of your
packets from the nation packets are
going by the same circuit and so with
the same entry and exit knob here in the
mix Network effort packet is going by an
independent path which is selected
randomly so this is already causing a
little a little bit of trouble because
then it's not that the agent I just know
like try to control some of the exit
nodes and so on another thing is
they will be when we random big stones
there are a couple of techniques which
allow you to detect any notes based on
the reputation so try to build a
reputation which notes are there honest
ones and which might be malicious ones
so exactly yeah so we basically did just
a complete are give a quick maybe visual
over Vienna might help
partly answer some of the question we
basically have to two chunks of our to
two parts of our system at the top here
is the mix net and then we also have
validator notes of decentralized
authorities that communicate among
themselves and it kind of B of T round
four they're doing that and we have some
dummy service providers over here built
as well to talk about you know to answer
your question we have a system which we
haven't yet built so all of it all of
the stuff I've just drawn here actually
is running right now and you people can
start to integrate it against it try it
out the this this new thing that I'm
about to talk about doesn't yet exist as
running code is it's only a few weeks
old so it's kind of we just haven't had
a chance yet to actually put it together
but it's essentially a way of saying
okay cool the original loop mix design I
need to take a bit of a detour but I'll
get back to it was okay cool your client
starts sending stuff so we have a packet
which is like here think of it as I
guess on repair encrypted Russian dolls
that all kind of open operate so the
center Galba the littlest one is though
the message you actually turn us in then
there's these layers of encryption and
that basically defines a path that goes
in here comes out here goes this way
ends up at this storage node over here
and then the offline client maybe that
was here maybe somebody comes out of the
Metro something like that grabs that and
actually gets the content delivered
right now the original design of Lubich
which is something that on you worked on
what's very individualistic so you can
do Luke Luke traffic it's called and you
can be spitting even if you're not
sending any real messages through the
system you might be spitting new traffic
through your cigar your packet might go
boom boom boom boom book and actually
loop back around to you and say cool
well my message made it through so you
said maybe one every ten times you sent
they'll do pack it around and you can
you can basically see cool these guys
delivered my message right the problem
we have to solve is okay for if this is
me I'm a good person I would never say
anything wrong how can we if we just
rely on the user's to do this
measurements that I could also be an
attacker right so we have to come up
with a way of verifying the the behavior
of each of these nodes in a way that's
publicly verifiable in a way that's kind
of akin to like BFD consensus system
right because I could say hey my my back
it never made it past here and if we
rely on my individual judgment I could
be the attacker trying to damage the
reputation of this node right so we
basically come up with a way of using
the verifiable randomness function to
pre generate a bunch of packets and
assign them to clients the clients will
send them through the Viera will be
revealed at the end of a timed round and
we can then check does the Merkel trees
of each of these nodes which they've
been keeping for record-keeping purposes
basically they have to show the Merkel
trees and the commitments inside the
marble trees that each node has they
send that back to the staking
authorities and the state authorities
can then verify did they do the right
thing
add a kind of system level not at the
individual level so this is something
we've just come up with it's probably
the first time that anybody's come up
with kind of a incentivization system
that works with a mixed net like this so
we're quite proud of it we haven't we're
checking the quality of service offered
by the make make sense and if we see
that some mixes are behaving dishonest
or that or in a malicious way we're just
cutting from their stakes so cool as as
far as I'm stunned it and taller just
has very simple we just send the
messages out directly there's a mixed
network want to use a Poisson
distribution for the sending out of
messages and also different classes of
applications will have different
profiles how do you want to create those
profiles for the different applications
what processes and tools are interested
create noise so just make sure I
understand your question you're asking
like if people we discuss different use
cases where people send different
volumes of traffic it's also like a chop
okay yeah what it will have different
yeah so just to give you a little bit of
the background in the looping Society
and hence in the Linda's mix net we and
force kind of the clients to send
following a following a Poisson
distribution what does it mean imagine
you have a phone and you press the
button send your message is not
immediately is injected into the mix
network instead of that it's buffered in
like a special here which is controlled
by the Poisson process and from time to
time at random times disposal process
weights up and checks this backward if
there is a real message you take this
message and send it if there is no real
message he sends an undercover message
what this gives you is that you're
sending pattern and
so from the perspective of the adversary
who's observing your client it just
looks like you're always sending
something but whether you're sending
krill traffic or just cover traffic we
don't know that so coming back to our
beers question if we have different use
cases like instant messaging or given
someone is fast sending the other is
slow sending then we can adjust this
Poisson process to be sending faster or
slower but we actually all the time
confiscate is sending pattern of the
client so the other side cannot tell
whether you're actually communicating
with someone or you're just being
completely you know on hold so yeah so
we we have a very very preliminary let's
call it demo nobody trusts the judges on
our graphic design or anything like that
I'm just gonna show we just built built
a client cool we have a really cool like
set of graphical and introduction to the
client to it as well you started
basically I'm about to run it here to
see just so you can see what it says
I've edited an ALICE user so it's like
Luke's client in it Alice so Alice now
get some private private and public keys
generated and stored on her system now
it started to run in the kind of
boo-boos client binary which you'll be
able you can you can integrate against
if you're actually interested in like
trying to make your applications work
with a mix then we have a bunch of
running mix net notes we have this
topology of six notes running on the
internet right now with two storage
nodes at the end so even if you're kind
of end user clients are offline you can
do that as soon as we told Alice as soon
as Alice said Hana to run this client
the client automatically starts sending
packets so it starts encrypting packets
through the system and sending them back
to herself right so starts generating
covered traffic as soon as the client
has started up this client doesn't do
anything else than that so you might be
a bit disappointed if you just like
fired up in the newbie
doesn't really do anything but it is
actually doing something if you like if
you wireshark yourself you'll be able to
see in a cover traffic going
however yeah we're basically within the
next week our plan is to build a set of
socket interfaces so you can just have
this binary sitting inside your
application you can connect to it by
either a web socket or a TCP socket and
just push bytes into it and those will
be those bytes that you push into it
will basically go through the mix net
and you'll be able to send messages so
that's a kind of example of that we're
building a chat client and we've got it
built up the show right here so I'm just
gonna I'm just backing out I'm saying
okay cool we're gonna go to the chat
client demo and I'm gonna spark it up so
we're gonna use this Alice thing just
Alice user cool so now I'm going to test
what Alice's public key is and she has
to figure out who she wants to
communicate with we've also made a bog
user and I'm just gonna start him in
another terminal there startup bog good
cool key select Alice's public key which
has to be sent out of fans he has to
know that cool now we have this two
message thing now just as that kind of
goes through I'll just explain what's
going on we have two clients both of
them start sending cover traffic and we
have a dashboard that you can actually
see on the internet right now it's at
dashboard Jim tech dotnet and you can
we're always sending cover traffic
through that anyway and you can
basically see the cover traffic going
through the nodes is it you can see it
tells you you know this note here let's
say in the last one second it sent 20
packets and it received 18 packets or 12
packs or whatever whatever times to be
so you can basically get a view overall
of the whole network and what
within it yeah so you can see the speeds
this is actually going through from my
hotel room in Japan to our mix net in
[Music]
Europe somewhere through the six notes
and then back up back to Japan so it's
you can see the speeds actually not that
bad as far as when something is typed in
here or you can see it appear on the
other side quite rapidly so it's yeah
it's definitely sub-second latency it's
like sort of 300 400 milliseconds I'd
say of latency that gets added at that
thing so we can also see the mixed notes
and the validators here as well okay if
I bet just back it up a little bit
you'll be able to see right here
yeah cool over on the right-hand side
there you can see it says received and
sent in that one second period that's
what the mixed nodes actually receiving
in and you can see you can kind of tell
that the orbital reordering is happening
inside the nodes because otherwise the
numbers would be exactly the same
I've sent and received in that one
second period uh they're not across all
of this thing said so that's the
reordering of the packet of the packet
[Music]
yeah yeah so there's there's the the
rico's that we have are completely open
the chat client might not be but that's
more oversight the the main notes that
both have been in validator notes that
run the credential system and the mixed
notes that run the the mixed mixing
system it's all open right now so you
can you can look at it have a look to it
it's not super beautiful yeah services
no clora
so right now we're running a directory
server at directory w tech dotnet bit
centralized at the moment but that's a
temporary things we need to bootstrap
the network and then I need to figure
out is going to be as far as just you
know deciding in advance how to miss mix
man so so they're a couple of reasons
why the first one is if you're in the
center and your pick
delays in advance for each halt you know
where your packet should arrive at the
other end this allows you to flex our
program expecting an acknowledgment for
your packet so you will know whether
your message go to the other end or not
whether one of the mixes dropped it or
not so that's one of the advantages yeah
it's the main one because also it will
allow you to detect malicious mix now if
your packet you didn't get the
acknowledgement for your packet
this means that maybe your packet will
throw someone on the way and you should
investigate which of those makes notes
potentially dropped your packet and so
on I just see that your received and
sent I expected that to be equal tender
so you're not received edges they're
supposed to be different because the the
packet says they received our help for
random amounts of time so that's why we
have the reordering so they were the
same that's when we would be unhappy
because then we would be going like why
why it's just me what if it's just
passing the same things in and out in
the same order and it's not reordering
anything what's actually doing is it's
you we can tell it's working because
it's holding the packets for a random
interval and therefore we can see that
it's actually mixing but why didn't some
notes have one messages and
yeah so they also like imagine like in
one second Felicity and packets in the
other second you Center five of them and
then you receive another five and then
you said 15 so like oh cool
sorry go ahead the Everson scheme for in
the notes my public key or and so the
client the client binary is the thing
that you'll want to use it's written and
go right now so if you're a go user you
can just compile the client right into
your into your software if you're not
going users where we're gonna provide
socket connections so let's say you were
a JavaScript air just for instance
there'll be a WebSocket connection you
basically you're a patient us to fire
the binary up that will take care of all
the key generation all of the loop cover
traffic all of the kind of Mason any
stuff for you and then you're you
subscribe to events on that WebSocket
and you can push events into the socket
so from your point of view you're making
a chat application with a WebSocket or
you making some other application talk
it in JavaScript and it goes into the
the go binary the go binary goes hey
cool does this guy have any like real
stuff to send no cool send a cover
message good or if you have real stuff
to sin yes and will send will send your
real stuff it will take care of all of
that stuff for you and the the client
also takes care of going to the
directory server looking up where all
the nodes are downloading like grabbing
their public keys getting the whole
network topology everything like that
and then the client will automatically
do your client-side writing for you so
you never as an application developer
need to think about you know what past
am I going to choose or anything like
that it's all done for you so if I had
inside
but for example asserted like a sentient
file could I read prophase curl to the
register file by going through its proxy
locally you would need to packetize it
that would be the one thing that you
need to do in that case of you you need
to chop up that file into chunks that
match the size of the of the mix net
packets and at the other end of your
application you would need to provide
some way of turning those packets into
something that maybe gets reordered if
you need ordering in your application so
that's the yeah kind of it's uh it's
like super anonymous UDP I guess we were
just reinvented this one more thing that
we've got here which is a quick demo of
the credentials I'm just going to jump
forward a tiny bit just to see you can
see it running code we're just about to
this was loading up some configuration
files but basically what we have here is
a wonderfully designed QT thing which
basically will take some GRC 20 NIM
tokens and just that's a kind of
demonstration it's not pretty real
reason what I'm trying to do is
demonstrate the kind of flow so
basically what's gonna happen is the
client that's this white thing you see
on the screen will ask for hey here's
aetherium we're gonna ask for aetherium
to basically pump some aetherium tokens
into newm into this tetraman around
which is what we're actually using for
that for the validators that will create
some names on in the in the tenorman
side of things you'll then get back a
credential from the validators so all
these guys will respond to you and say
cool yeah here's your here's here's each
piece of your credential because you get
a you know a threshold credential we can
then re randomize their credential and I
will show that working and then you can
spend the credential with a service
provider and the service provider can
then redeem it over here and say cool
pay me and we can have double spend
reduction there as well so that's that's
the basic flow of the cocoanut
credentials so cool we just got ten nibs
in we're gonna create a credential that
code supplied names in this case don't
get sucked in by thinking you always
have to quit currency inside your
credentials this is a very general
purpose system so the name credential is
the same thing as like like this
application is like a smart contract as
it's what's a smart contract is to the
EVM the the basic thing underneath all
of this is very general purpose cool
we've got back a partial credential our
client has reassembled it over here and
I'm pressing the re randomize button and
you can see the credential changing
right there as I'm pressing it so I just
free randomize at five times it has now
the same five names inside the
credential that it always had but it is
a totally different credential than what
we got back from these issuing
authorities so they can't run on me
anymore they can't tell who who who they
gave it to even if they colluded unable
to do that so we then send the
credential former client to some kind of
service provider to pay for something
could be for anything um that's great
the service part of redeemed it that
means it's been spent I then tried to
spend it again and it said no you've
already spent it the really interesting
thing I'm gonna reran demise it another
five times here so you can see the
credential changing again so sorry
that's a bit thank you
I try to spend it now and despite the
fact that it's a brand new credential
the blockchain has rejected it as being
already spent so the cryptographic
material in there has been recognized
even if it's a different credential so
we still have double spending protection
even with the randomization cool that's
pretty much it so any other questions
how was your work thunder we have some
investment from different sure it
doesn't right now but eventually the
vision is that it will eyes having that
time to plumb it all together quite yet
but yeah I'm not sure I don't know which
be our instruction I think I heard yeah
yeah and on the I yeah I can the person
who invented the two people invented the
scheme Martin Gritty here NS I'm not
sure where they're planning to use that
so I can't say sorry if I just wanted to
say that following your question we're
working on a research paper about this
so in the research the public client
will still generate the path but the
mixed nerds will need to say what they
saw and then factor afterwards the
vieira comes into play everybody opens
up the box and goes hey did did Timmy
mix net no to like actually said the
correct pockets and there's there's
going to be a record of what he was
supposed to have sent basically yeah is
only produced
special measurement messages which are
checking the quality of service the
regular messages is after the client
what he is using wiping the power from
the cloud he likes and so on thank you
very much for at a time but if you want
to keep on chatting out in the hall
please come say hello and if anybody's
interested in trying out some of the
code or trying to develop against this
and
[Applause]