Onchain Privacy Now

Hello everybody, and can you see my slides great? So yeah, this talk is more of an intervention and for those of you who have seen parts of it before I'll try to make it a little different and Interesting to you as well. I am Cassandra KZG.ethercast or K. You can call me any of those names if you like and Yeah, we need on-chain privacy now on Ethereum.

It can be done, and we can do it together so this talk is not at all about a Fancy new zero knowledge proof scheme or a a new primitive or some galaxy brain moon math It is amazing that all of that is happening And this has far surpassed our wildest dreams in the cryptography space in terms of how well that's moving forward So the theory is doing great. It needs to keep going, but where we are highly lacking is on Practice we need to take the tools that are now fully ready fully production ready and put them into practice on aetherium So we have the technology It's a time to put these Legos together and roll up our sleeves and build something new and interesting and most Importantly if you remember anything from this talk it should be maybe this slide and the next one We must rethink the aetherium wallet UX from the ground up What we have with all of these tools is the ability to Revitalize the aetherium user experience and basically have no trade-offs have a user experience Which is just as good or better than the experience you're already used to now with browser wallets Except you'll have things like completely cross-chain abstracted and privacy built in by default the maximal privacy this is the moment for this shift and I think one of the reasons I highlight the wallet is that Sure, there are constructions, which I'm very excited about like fully private zk roll ups But none of those are red are fully production ready today so Similarly there are some ideas to upgrade the aetherium l1 and Embed privacy directly into the aetherium l1 But that is also going to take a long time to go through the EIP process to ship upgrades on the l1 is quite slow So where can we make a huge dent in privacy? practical privacy on chain is At the authentication or the wallet layer where we have just a tremendous amount of new tools that we can use But in order to utilize those new tools and to dream up this totally new Wallet user experience that should help like I think it's existential for aetherium Let's save aetherium with this with these dreams. We can have is we need to make one fundamental shift in my point of view and that is that a User is not an address an identity is your identity is not an address or a key pair Your wallet is not an address or a key pair. I think the fundamental user experience a problem holding us back with the wallets that people use today and the way that they propagate transactions on aetherium is that people are thinking with this very low-level primitive of initiating Transactions from a single EOA and that when you do an operation You're gonna your wallet has a drop-down where you change address by address And so even if you know that you can use many addresses and address is not technically your identity We still use addresses as like a proxy for identity How many of you have done many interactions across many different deaths on the same address?

Before how many of you do almost all your interactions on just one single address? It's me so I think this is a huge problem and it's it's Tremendous link ability problems for all of what you're doing So we need a new approach on this and I think if we're willing to make this shift Which I understand why it's difficult one I understand why it was there historically because up until the most recent hard fork Petra It was not possible to initiate an etherium transaction without having a EOA funded with ETH there was no way around it and because of the fact that it needs to be funded with ETH It's a tremendous amount of friction to be using a different address for every single interaction that you do Because every single one of those address needs to manage its gas balance so However, things have already changed. We already have this We have 7702 in the most recent upgrade and this is almost a forcing function for wallets are going to change their user experience And so this is the moment to bake all these new things in and dream big So what are the tools we have? Available to us today. Well, it's a tremendous amount of tools like really exciting chain specific addresses.

There's an ERC for that We're pretty much all the way through very closely related is the cross-chain interrupt standard the open intense framework This is a seven six eight three, and this is also pretty much ready to go live If not completely so these are absolute table stakes of things we can add into the wallet to not Ambiguously reuse addresses another big problem We have with key pairs is that people ambiguously reuse their address if it's an EOA you use it on all chains as you can Send me funds on all of those chains, but this is a bad way to think about address space Yeah, you don't necessarily have this with smart contracts, right? This rule can be violated if you're using a safe or some sort of smart wallet Maybe you don't have that smart wallet initiated on all chains. And so we should not be in We should not be ambiguously reusing addresses in this way we should have a chain specific address that you can go to kzg.e at arbitrum and you'll That will route you to my public address on arbitrum, which would be a different address than the one that I have on mainnet Etc, etc Just as the public address. So This is going to help us solve chain abstraction the first two then for privacy We have things like stealth addresses, which is what I'll be going more into in this talk We also have ZK mixers widely deployed and utilized now We have privacy pools and railgun and tornado cash recently unsanctioned and usable again So we've got all of these ready for production today We have EOA superpowers with 7702, which I think is key for upgrading the wallet UX if we break away from this Address by address abstraction and make aetherium wallets more like Bitcoin wallets We're as much as possible make every address a one-time use address We also have full account abstraction and things like gas abstraction relayers paymasters all All is some of that in the work some of it already shipped We have will have to rethink wallet app interactions in this new paradigm because now wallets if they're going to be more sophisticated chain abstracted Private by default probably you want the interaction with the DAP to be like the payload for that to come to the wallet But in such a way that the wallet can now, you know complete this payload with wallet specific features to make it a much more Feature-rich experience where you can have the seamless I've just authorized my defy interaction with my browser based wallet the way you're used to but under the hood actually a much more complex and interesting and Privacy preserving construction can be going on at the wallet layer.

You also need to deal with like the anonymous Communication aspects because if you dox your IP when you call your RPC or if you leak, you know If your RPC knows about what you're asking for information for when you're reading from the chain things like this This can be a big problem and then we have some things that are coming soon around the corner, but not yet here Which I think are worth highlighting So these are less important to me because I really want to focus on what we can already do today But soon we can have very lightweight local nodes We already have something like Helios But soon maybe everyone can be running in a testing node on their phone when we get like all the beam chain upgrades shipped We also have private fully private ZK roll-ups So this would also be a really really useful construction to finally hit mainnet with Aztec which should be coming soon So we have all of these tools. This is a lot of stuff and Almost all of it there is fully ready for you to use on a theory of mainnet today So, why are wallet experiences stuck in the Stone Age where it's like in my opinion the metaphor is it's something like like Shipping aetherium without solidity and everyone has to use assembly and write in pure opcodes. It can be done That's what I think I think the way that We use wallets today is a great fallback for a way that you can just concretely interact with the chain and understand what you're doing But not a great user experience we need a more complex abstraction again Bitcoin wallets themselves To have a much more complex abstraction over address space and you never reuse addresses. It's just how the wallets are built So why don't we have this on aetherium now that we have 7702 nothing stops us from having this So my gauntlet to all of you is to take these tools take these Legos put them together Dream big and ship a radically new wallet experience Who's gonna do it? I'm gonna help you So I want to talk a little bit about just one of the tools here one construction a little bit Which I am a big advocate for which is stealth addresses and we'll hear more from food key We've been doing the first people to really Actually deploy this in a way that people are using it and playing around with it So I want to talk about how I think stealth addresses fit into the stack of this new kind of aetherium wallet that I'm envisioning So first of all, why stealth addresses so like what are they?

What problem are we solving and we're solving transaction unlink ability And so the the classic thought experiment I would give you to understand stealth addresses is there's a way already that we could get The benefits of stealth addresses just in a much more clunky way without stealth addresses Which is I want to receive funds from someone in this room But I don't want it to be visible on the chain that it's me who was receiving the funds So if you send it to KTG eat, it's very easy to link that back to me I have all this activity that I've done that's linked to my to my identity so what I could do is generate a fresh address and Then communicate that fresh address to you over a private channel And then you could send me the funds to that fresh address and I got unlink ability of this Much the reception of these funds is de-linked to my identity now great However, this has a few problems one It means the receiver always has to do something if they want to receive something de-linked So that's not an amazing UX and to if this private channel wherein I relayed that address that you should send to Gets leaked then of course all the benefits all the privacy go goes away And so stealth addresses is just a small upgrade to this where we add a little protocol very very simple something that works on Bitcoin it's like extremely out of protocol and light very easy cryptography as well but it allows a Sender to generate a fresh EOA That you the receiver will be able to mine the private key for in the future if the sender just publishes some Public information that the receiver needs in order to mine the private key for the address where the funds were sent to so it just allows a one-time setup for this private reception and then Now senders can do this send to you with this with this protocol very easily in a privacy preserving way And so I think this is a really really useful primitive partially because it's extremely simple cryptography So, how does it work? Well now welcome to the cryptography section We'll see how much we do But if not, we don't necessarily have to talk too much about it because you can go to this link and read Vitalik's article introducing stealth addresses The most important thing is that it's quite trivial and simple. That's what makes it so nice And yeah, you're still working over EOAs, which might have some drawbacks But it also has some nice things for users where even if you lost a really fancy wallet privacy software You could probably Default back to just like operating on these addresses in the old-fashioned way You might not be able to preserve the privacy for as long etc. But but yeah, we have nice fallback conditions in my opinion So maybe a show of hands of for who would it be interesting to actually go? Like walk through the math.

It's fun because the math is incredibly simple So if you're just willing to do a tiny bit of cryptography, we could do that But then we spend some time on this and you might go I can do this at home. So I'm actually we're gonna skip or not based on people's interest. So who wants to do the math part? For the next three minutes. Okay, and who doesn't want to do the math part?

Okay, some of the math people so okay that was too close it was not near the who didn't vote Yeah. Yeah. Okay. So I guess we're gonna do a little bit of the math since most of you didn't vote So the important thing here is it's we're gonna do just the just the really broad strokes What you have is what you're utilizing is a very classic Diffie-Hellman key exchange And you're utilizing the actual elliptic curve cryptography for the public key which hashes to an address and private key pair construction that we have on aetherium and that we have on Bitcoin and Many other blockchains as well And so it's a very very light protocol where you do a Diffie-Hellman key exchange and you get us you derive a shared Secret with the between the sender and the receiver the receiver who published some public information on a registry Hey, this is my stealth public key The sender can now take that stealth cub public key do some sort of key exchange derive a shared secret with that stealth public key and and Use that shared secret to compute only the public key For an address that the receiver will be able to mine the private key for thanks to some little cryptography tricks But but yeah Once you once you derive this public key from the shared secret that hashes to an address You simply send the funds to that address you then have to publish some the ephemeral key that you use to direct to create the shared secret on on what we call the announcer and Now all stealth address receivers have to scan all Announcements and check if that announcement was for them if so They can find the private key for that address and now they have control of the funds that were sent to this randomized address so We are the TLDR is it's super simple elliptic curve crypto. There's no fancy ZK stuff.

That's really cool there's also two ERC's that were developed and fully deployed for this and They are on the major chains already, and I would really I would really promote people interoperating with the standard Because today almost nobody is using it on mainnet and you get a lot more benefits if everyone who's doing stealth address style things is Pushing announcements on chain to the same place So I'm a big fan of us. Actually, we have this showing point. We now have these canonical contracts deployed I'd be very happy if we were using them much more today There are very very few announcements being made on the announcer contract. And so what are these two ERC's? They're just canonical place for people publishing where their stealth meta address where their stealth public key is That's one contract the registry contract and another contract for making these announcements where you announce this ephemeral public key data which is needed for a receiver to actually Mine the private key or basically be able to access the funds that were sent to them stealthily.

So we have these things. That's great So what what do I see as like the lowest hanging fruit that would change things a tremendous amount This is like table stakes all the wallets should implement this and one of the reasons I like stealth addresses because this is Absolutely simple to get metamask grabby etc to implement in my opinion Which is Alice wants to send some token to Bob's out east one of the coolest things about stealth address is fully generalized It works for East works for all ERC 20s works for NFTs works for credentials works for anything because it's just an app It's just a trick that's being used on top of the actual address space. So Alice wants to send some token to Bob dot ETH on aetherium She simply writes receiver Bob dot ETH ETH at ETH Under the hood the wallet and picks the amount of token Under the hood the wallet resolves Bob dot ETH at ETH to Bob's public mainnet address Which might be different from Bob's public arbitrum address so that we don't have this ambiguity as we had before And then we're going to look up with Bob's public address on the registry contract. I just told you about to find Bob's stealth meta address and then the the wallet client will generate one of these ephemeral ours to do this little cryptography trick Generate this stealth address where Bob will be able to access the funds Send the amount of tokens over to that stealth address and announce this ephemeral data, which will allow Bob to find To access the funds this could happen in such a way that you just open your wallet you say let's send to Bob and You would have to manually Unclick the private transaction whenever bought whenever whatever address they put in the receiver field Has a stealth meta address has this, you know has registered with this scheme It would just automatically do this and you'd have to actually opt out of privacy and in my view These types of things standards that go are widely adopted that will Allow privacy to go past that inflection point where we're really getting those compounding benefits from it because there's none of these Systems almost every privacy system has the issue that it's not very private unless everyone a lot of people are using it so One more thing this is some tweet I made but I think the important thing Just like I was mentioning is I'm really focused on standards that we can deploy across different Applications and and things like wallets and so forth because it's awesome the private a privacy tech We already have but if people have to go seeking out specific privacy applications to get privacy It's going to be really hard for us to reach that inflection point. And so Yeah We are at this critical juncture where we are ready to build awesome privacy tech and awesome user experiences I believe most of it needs to be free and open source software because nobody will pay extra for privacy.

This is like a known It's called the privacy paradox, which is if you ask people is privacy important to you They all say yes But then when you put an experiment in front of them where they have to click two buttons instead of one to have privacy They all go. I don't mind. I don't need the privacy. So It needs to be frictionless and Both that both means it needs to not have be gatekept You need to not have to go seek out that application you are you you need to not pay extra for it And also the UX needs to be just as good or better than the UX you have now because bad UX is another friction point So my belief is we need to generate eventually some Standards for like a new wallet standard like today. We have these seed phrases that every wallet uses a seed phrase They can easily interoperate.

We need something a little bit more robust that includes privacy chain abstraction, etc So I have zero minutes left, but here's me shilling the potential wallet standard and the idea is we need this Multi address construction. So how does that work? Well, your seed phrase would turn into this abstract concept called user identities in my opinion Best would be if each user identity actually maps to something like an ENS because that makes it really easy for people to understand What is a user identity? Well, it's a bag of a You have actually as user identity is multi-chain So you have a main address a Bob Doddy's address on each network that might be different But then when you zoom in to a single network That's just the very public address that you purposefully link Things to your identity with you when you operate over this Bob Doddy's user identity You actually operate over a much more complex abstraction that in my opinion might look something like this You have a number of addresses that when you generate them yours Yourself, you can simply generate a new address on your you don't need to do the stealth address trick because you can generate a new Address on your seed phrase easily but if you third-party reception from other people sending you funds and credentials those would be sent to stealth addresses and Finally, you also need to utilize mixers mixing East for instance So that if you have mixed East you can now use that East to pay relayers to operate over this big fancy Construction which is many addresses seamlessly by using 7 7 0 no 2 7 7 0 2 even though you have many You might have many addresses you can operate over all of them seamlessly in a single transaction by asking some relayer To upgrade all your accounts to a smart account and then do the interactions that you want to do and if you can then pay That relayer with some anonymized East you have a very very interesting wallet construction in my opinion I could try to maximize your privacy and in some nice ways. So Why do I think stealth addresses specifically are a good are good Lego in the possible privacy stack is well I think the fallback to simple eoas is actually kind of a feature There are maybe some interesting things when I hear from fluid key about some maybe interesting other ways to approach this as well But I think that's the feature because if you lose this wallet client, that's super fancy that you saw here Okay, it does all this really fancy stuff under the hood But what if you lose that wallet client and now you have to operate?

Well, technically you could go mine all the private keys here and maybe you lose the privacy send east directly from your public account and dock Them but you'd still be able to access all your funds It's also cool because yeah direct transfers to a third party is super super easy and doable today Like I like I showed in my little example 7 7 0 2 makes it so we can have this like seamless experience Finally very important is okay mixers are even better You get unlink ability and untraceability, but that only works for assets with enough Utilization where you can actually bootstrap a sufficiently private mixer pool. So what about all the other assets? What about NFTs? What about like low liquidity random meme coin assets? Well, the best you can do is something like a stealth address for those and yeah It pairs well with mixers together so you can get like this unified privacy experience.

So thank you to all these people Julie you're on the list there. So thank you and And to many more as well, so let's ship privacy together you can find me there. Thank you guys so much That we should redesign everything the way the wallets UX works now, but how we ensure that we don't Repeat the same mistakes that were made before When we link the address To identity and to many other things like what should be the way of approaching all these standards that we don't follow the same Let's say development practices or business choices or architectural choices yeah, that's a great question that I don't even know I have a Great answer for but what I would say is yeah one way maybe it's a not standardized too early So I'm actually super excited about making these things standards because I believe that's where you reach that selling point But for now, I would be very pro wide experimentation and your version of the new wallet standard that includes all these features might not look like the version that I'm proposing here That's just a proposal. I think what we can do is let these standards be emergent from these new experiments that come out See what's best and then wait a bit and allow like the best standard to emerge and then really push for that getting widely Adopted so that you can go from you know, take your seed phrase from one wallet client to another but magically can't find You know interoperate seamlessly with all this like cool abstraction and privacy built in and so forth So yeah, I would just say don't standardize too early Keep minds open is really important with standards like wait to like don't fall in love with your Your particular solution like I'm super excited about stealth addresses But if it turns out there's a better way that only uses mixer technology and that's like going to just make the whole privacy stack simpler, let's do that the most important thing is that We get somewhere that feels good. And what I say is we're never going to get somewhere perfect These will probably still be holdover solutions because if we get fully private roll-ups, you know, maybe everything will just happen there I don't know.

Maybe the l1 will ship native privacy in different ways that could reshape it But we should really focus on what we can do now because we already have a number of tools Now that we can use to ship like at least to be to Metamask again is still just in the Stone Age in terms of the UX in my opinion So let's get to the Bronze Age and maybe the future still coming. Yeah Hey Thanks for the talk. Just two quick questions. First one is I think those require some like custom cryptography Like work to be done on the front end. Are you aware of any great JavaScript libraries for cryptography?

JavaScript libraries. Yeah, so there is a stealth addresses SDK in JavaScript already, which is super useful I use it in the front end. I made a stealth theorem East limo You can go there and you can send stealth. You can send stealth payments and I use their library I also wrote a version of the similar library that's in rust So if you want to do like back-end something you can use my rust library There should be a lot more coming and I believe there is some work going on on an in some interesting SDKs that could be coming soon, but I'm not sure and the second question is why did umbra cache fail? Yeah, I don't know exactly and I think I believe they're also working on like a new version It's the people who created umbra who eventually created those standards these two ERC's They're authors on those ERC's and their first version didn't use those So it's like they did the exact what I was talking about They created a thing use stealth addresses shifted as their own Personal privacy thing or like their you know Their standalone tool and then thought about how can we make this something that's actually an open standard that not just our wallet construction But everyone could use so I think great things came out of umbra.

But yeah again, I think for most privacy solutions the I would say two two things for most you always have the issue of is this privacy solution You have to go seek out if you want privacy and that always makes it a lot harder to like reach these shelling points instead Of it being something built in to user experiences that you already know and love and seek out And then to stealth addresses had this problem. They built that before 7702 so it has this clunky problem of okay How do you keep privacy once you have assets littered across many stealth addresses? None of them are funded with ETH. So you need to find a way to operate over these addresses so there were some like UX issues there which now can be solved by the fact that we have these EOA superpowers and we can Upgrade EOAs on the fly and make them like smart accounts, which I think can potentially