hello everybody thanks for coming to
this talk
privacy aetherium so today I'm gonna
talk about like where we are at the
moment and kind of where we want to go
so in aetherium over the last like six
to twelve months we've had a lot of new
and exciting your knowledge proof stuff
coming up yeah
so for example we have a bunch of mixers
that are coming out tornado cash is live
on May 9 at the moment micro mix is is
in progress there's the Argent hopper is
live on mainittu and maybe there's more
than I'm not saying that I left out and
then we have certain kind of other
interesting privacy applications like
ads like which will be coming out about
to run their trusted set up and as well
as just doing transactional privacy we
also have private applications to do
with private signaling like semaphore
private voting private hours there's
this really cool pull up signaling up at
this event where you can get a pork
token and deposit into a private pool
and then start to make private signals
using this which is pretty cool and then
we also have like a private voting where
it's impossible to prove that you voted
a certain way which is important for
like quadratic voting and things like
that so that's the start and talk about
the mixers first so so there's a bunch
of snack baits misconnect based mixers
at the moment and this is work like what
they do is pretty simple so basically
you have some money you deposit it into
the mixer and some time later you
withdraw that money and this question
mark here kind of shows that you don't
know which depositing switch withdrawal
yeah so there's three of these there's
there's three of these that I know about
micro makes hopper and tornado which is
in production so what are the problems
with this so one of the problems is that
there's like a single denomination you
deposit one either and you withdraw one
either and there's no kind of way to do
internal transactions
to solve for example if you want to send
some money to your friend you have to
deposit the money into the mixer we're
draw it and then send it to your friend
which is kind of annoying especially
because there's like only a single
denomination allowed so you can only
ever send your friend 0.1 ether or less
than 0.1 ether which is a little bit
knowing and the third problem is that
there's you need to pay for the gas for
the transaction but we have this kind of
chicken and the egg situation so for
example imagine I wanted to I have
address a in address B and B has 0
either and a has 10 ether and I want to
transfer one either from the dress a to
address B but I don't want to link the
two together so the first thing I do is
I deposit the money into the mixer and
then I need to withdraw that money to
the new address but I don't have any gas
in the new address account so there's no
way for me to withdraw it there unless I
send so money there first which which
kind of defeats the purpose of putting
it in the mixer in the first place
because because if you send it from
address a to address B you you link
those two accounts together so what we
do instead is we come up with some kind
of transaction abstraction where we we
make it like another network of nodes
that will pay the gas of a transaction
and also get repaid that gas at the end
of the transaction so those are the kind
of three main problems of mixers and
here is some some of some kind of
attacks that we can leverage the
anonymize people so first of all one big
problem that we have is that there's no
there's no like metadata and there's no
like metadata privacy here so when you
go into any of the mixers there's a user
interface and and when you deposit your
coin you you have to send information to
to the boxing and that information is
sent through that you to create a
transaction and you broadcast that
transaction through and pure up so
everybody is able to know who said who
deposited so in Fuhrer is able to know
whose IP address sent which money into
the mixer but more seriously and pure is
also able to know whose IP address
withdrew money from the mixer because
when you make a withdrawal you also need
to send some information to it your you
need to request information from a pure
and you also need to broadcast a
transaction so in Fuhrer knows the
metadata you're requesting and you have
to be very careful about
metadata that you request and and you
have to be very careful by the metadata
you request and sorry just one second
yeah you had to be very dated careful
about the metadata you request and the
relayer nose the nose the you nose your
IP address when you withdrawal so so so
what can you do to limit this so you can
use tor yeah so if you log in with tor
to the mixer which is totally possible
you can do your deposit on your
withdrawal through toward but very few
users actually do this and we should try
and encourage people to do this as much
as possible so you should use to work
for the withdrawal but you shouldn't use
it for the deposit and the reason for
this is that if you use it for the
deposit in the withdrawal you can kind
of break your anonymity set up into two
groups group number one is the people
who use towards a deposit and group
number two is people who do good number
one is people using towards the deposit
in group number two is people who did in
a new store and this attack can be be
quite serious especially when you have a
small anonymity set so for example
imagine that there is 100 coins in the
mixer and one person deposits a coin
weight store and then sometimes later
the same person withdraws the same coin
with toward know someone which was a
coin with tor it seems pretty logical to
say that okay the person who deposited
with tor is also the person who would
true with tor it seems like that is kind
of reasonable because why would you
deposit with store and then remove tor
for the withdrawal it doesn't really
make so there are these kind of
heuristic attacks that you can do that
you need to be careful about yeah so in
the long run we should have tor by
default yeah we should have tor by
default by default for the deposit and
the withdrawal so then there's also
temporal attacks so imagine that we have
a mixer that has this huge amount of
ease a deposit deposited imagine there's
1 million coins the positive into the
mixer and a tea and then did this what
these ones have been there for a long
time and then one day someone comes
along and deposits one either in and
then some
later somebody withdraws one either from
from the pool so it seems pretty
unlikely that the one without one of the
1 million people who had the money
deposited there for a long time suddenly
decided to come along and withdrawal
like you can I would be pretty confident
to say that the person who deposited is
also the person who withdrew in that
scenario so you can have these kind of
heuristic attacks that you say okay the
last person to withdraw the last person
the deposit is the next withdrawal so
you have to be careful about by the
amount of time that you leave your funds
in the mixer so to defend against this
some UI is force you to deposit for a
certain amount of time but there's also
problems with that that you that I can
talk about in the questions afterwards
if people are interested and then the
third problem is that the anonymity said
is quite small the current most popular
mixer has about 200 deposits at the time
that I made the slides I'm not sure how
many it is now but so this is an animal
anonymity set of 200 which is which I
suppose people don't think of when it's
not my level of anonymity to say on one
of 200 I think that that's like a higher
standard so we need to sort of be kind
of careful about the privacy guarantees
that we that we tell people about when
we discuss these systems so okay so
let's talk about like how can we pick
some of these problems so for example
how can we get more people to deposit
into the mixer because I will that will
kind of make a lot of these problems a
little bit less severe because 200 seems
like a very small subset so one way to
do this is to increase people's
confidence in the mixer to increase
confidence in their implementations and
the crypto components so what we would
like so yeah that's one thing we could
do another thing we could do is we could
combine multiple mixers together these
three mixers that are very similar but
there is also very compelling reasons
why we should have mixers that are more
different just from the security point
of view it would make sense to have the
mixers that are based upon different
hash functions different different
crypto components so in the case that
one of them fails there's still other
ones that are still working for example
we find out a bug in some of
or something like that and the third
possible thing we can do is is to
perform an MPC trosset setup so the
moment that all the mixes in in in in
deployment have been have notice it set
up they have just a single well they
have a trusted set up but they just have
a single party that you need to trust in
order to be to be confident that the of
the private super coins or not to be
confident that they won't just one day
steal all the money from the mixer which
is which is a possibility that we need
to be careful about the four thing that
we can do is we can integrate with
wallets because a lot of people don't
really worry about their privacy and if
we integrate with wallets we can help
provide these people privacy without
them having to explicitly opt-in because
at the moment you have to go through a
series of technical steps that are kind
of difficult to perform although they
use the user experience of some of the
mixers it's very nice it's still it's
still like extra work for people to do
so I'm one one idea that that we were
interested in in promoting as the first
step to integrate with with wallets is
to create create this create new private
address yeah so similar to create new
private tab in browsers we could have
users at the when they create their
wallet deposit some money into the mixer
and then later they have the option to
create a new private address when they
would where they would draw those funds
to their new address okay so the first
solution is to do the or the firstly we
should talk about the trusted set up so
at the moment we're running a trusted
set up and we have had eight
participants so far and we've been
running it for about fourteen days I'd
like to invite everyone here to
participate in the trust and set up at
they have time so we're currently
running phase one and we'll we can run
phase two which is circuit specific
later but it's important to remember
that both need to be to contain a single
honest participant in order for the for
the resultant circuits to be secure so
here's some links about how you can how
you can join the trusted set up you can
join this email group and share your
your desire to participate
yeah and the second thing we can do is
we can audit audit the mixes so micro
mixes of being audited at the moment by
a BDK consulting
this is including an audit of circum Lib
which will also help the some other
mixes definitely tornado cache that use
a bunch of components from from circum
live in their mixer so but we still need
to all it the the circum compiler and
the the code for the NPC trusted set up
and both of these needs to be audited
before we can say to be really confident
about the security of our mixer also we
still use some experimental components
for example the hash function is Mimzy
and as far as I know that's never been
deployed before so but I'd like to thank
people with already network and either
in foundation for funding the audit of
the mixer and circum Lib components yeah
and in order to increase our confidence
about the security of the hash functions
we're also announcing a bounty for
collisions of the main C hash function
yeah so there's there's two rounds or
there's two difficulties 80-bit security
if you find a collision you get 100 or
10,000 u.s. dollars and if you if you
break the 128-bit security you get
20,000 US dollars so you can make you
can so here's the link to with more
information about about the bounty and
I'd like to thank the etherion
Foundation and oil coin for
contributing to the bounty on these hash
functions so please attack it if you if
you like
okay so there's also been a bunch of
ideas that people have proposed for
including for increasing the size of the
anonymity set and some of these and
here's some of these ideas that I think
won't work for example there's this idea
of having an interest rate or paying
people to deposit into the mixer so the
idea here is that we have a mixer that
has some money in it and whenever
someone deposits their money we
deposited in the compound where we earn
interest and then we take that interest
and we used
to pay other people to put their money
into the mixer yeah so it's like a
reward to increase the size with the
privacy pool so this seems like an
interesting idea but it it's been tried
before so Z cash had a similar idea
where they would reward their they would
force their minors to deposit their
rewards into the privacy pool and it
turns out that this doesn't really work
because the minor is are only interested
in money Z cash they're not not
interested in maintaining the privacy of
their coins that they mind
so whenever a minor would mine coins
into the fives a pool they would always
withdrawal them to the same address so I
don't think that this so what I feel
like in this situation these two cases
are quite similar and we should be
careful about doing sort of experiments
like this and the reason for this the
reason why I think this won't work is
that the incentives here are misaligned
that the users want to use a privacy
tool to get privacy but the depositor is
the interest or the reward seekers want
to do it to make them want to deposit to
make the reward but the depositors don't
have any interest in maintaining privacy
after they were trough and and for that
reason I don't think I'm for that reason
I think that's pretty likely that they
will maintain their privacy after they
would rob because they have this capital
that they want to invest and as soon as
they withdraw what they'll want to put
it somewhere else to make some more to
make it gains more interest but I'm open
to changing my mind about this if we see
some like experimental results or some
use case where it works a little bit
better so also not to talk too much
about mixers as like are currently
working on confidential transactions
that there's I mean they're trusted set
up soon and here's a link if you want to
participate in their chosen set up and
their roadmap concludes like full
privacy as opposed to just confidential
transactions and they're also talking in
the future they're going to use a
universal set up based on plunk which is
pretty interesting and maybe that will
be applicable to the broader privacy
community so what can we do in the
future it seems like we have these
mixers that are like very functionally
limited
what can we do to improve that so so one
idea is that we should add more tokens
to the mixer and had more denominations
but I kind of feel like the mixers at
the moment are not really fit for this
purpose because the privacy said is so
limited that if you have people
depositing into multiple privacy pools
it's very difficult to tell how many
people deposit it and what true oh no
it's very easy to tell how many people
deposit never true and you need to have
like a high liquidity in order to in
order to ensure ensure privacy or to
give people good privacy guarantees so
instead of this I would I would propose
that we should focus on making general
privacy can private transactions I see
that mixer sounds like a pragmatic first
step but in the future we should try and
make a privacy pool where people don't
ever withdraw or don't withdraw for a
long time so in order to do that yeah so
in order to do that what what kind of
features should we should we provide so
firstly we should provide private atomic
swaps I think that this this makes a lot
of sense on aetherium because there's
multiple tokens and unless we allow a
way to transfer Tran to convert between
different tokens inside the private pool
then there is no way to join these
anonymity sets together so if we have
this kind of atomic swaps inside the
mixer we'll be able to kind of trade
between multiple different tokens so
this work has already been started some
people are working on this it's largely
in the prototyping phase except for
aetherium 9 and 3/4 which has which is
well it's a 9 and 3/4 is a little bit
different than what I was proposing at
the first two the first two things are
proposal for this and I know that 0 pool
is it is is actively working on this
yeah and 93 theorem 9 supporters is
another interesting privacy private
project yeah ok so conclusions about the
mixer so first of all I think we should
be really careful about the claims that
we make about these systems I feel like
we
have like a responsibility to sort of be
honest and fair with other people when
we talk about this and the privacy
guarantees that we we provide because
like maybe someone's life might depend
on the security or the privacy that's
provided by these fixers and I think
it's really important that we're we're
up front with people about about the
guarantees that they get well they're
definitely the mix is that we have now
we're definitely better than what we had
before mmm it definitely gives you a
much higher level of privacy than we had
before and it's a pragmatic first step
and it's it's it's it's a good step on
the direction that were in a direction
that we need to go at the same time
these are very new tools the snark
programming programming starts and
building things which snags have has not
been around for a long time and there's
very little stuff in production and for
that reason we need to be sort of very
careful about using these I predict that
at least one snack gap will be hacked
before Def Con next year and and I'm
pretty confident about that so and also
it's important to support the people who
are building these applications and to
understand if some sort of mistakes
happen because the only way that we kind
of improve and get better at this is by
experimenting and making mistakes so as
well as being very clear with people a
bit about the limited private guarantee
privacy guarantees we the mixers provide
we should also be very careful about
kind of security and warning people to
be very careful about using them okay so
other important things that are going on
oh wow okay other important things that
are going on is like voting collusion
resistant voting I be resistant voting
censorship resistant signaling anonymous
login from Adam Stiles I'm sorry I'm
very close to my time is up so we also
need a lot of help there's a lot of
there's a lot of projects that I listed
before that need to be worked on and
built so I'd like to invite people who
are interested in working on this to
join this telegram group where there's
like a nice
community of people working on things
yeah and I'd also like to thank all
these people who contributed and sort of
helped and getting great work in this
space this year and last year and for a
long time so I'd like to thank all of
them and now I'm done
I have 17 seconds for questions thank
you
[Applause]
you