Building Privacy-Protecting Infrastructure by Oskar Thorén | Devcon Bogotá

foreign [Music] so today I'm going to talk about building privacy protecting infrastructure what it is why we need it and how we can build it and we look at vacu which is the communication layer for web free and also look at how we're using CK technology to send device and protect the vacuum Network we'll also look at circuit which is a library we've been building to make it easy to use signals proofs in different environments and at the end of this talk uh I hope you'll come away with a better understanding of the importance of privacy protecting infrastructure and how we can build it so that's briefly about the back in me I'm the director of research atvac and we build public good protocols for the census web with a focus on privacy and communication we do applied research based on which we build protocols libraries and Publications and we're also the custodians of protocols that reflect a set of principles it has its origins in the status app and basically trying to improve on the underlying protocols and the infrastructure we build vacu among other things so privacy is the power to selectively reveal yourself its requirement for freedom is self-determination just like you need decentralization in order to get sensorship resistance you need privacy to enable freedom of expression to build applications that are decentralized and privacy predicting you need the base layer the infrastructure itself to have these properties we see this a lot it's easy to make trade-offs at the application layer than doing them at the base layer you can have custodial Solutions on top of a decent size and non-costal network where participants own their own keys but you can't really do it Opposite and if you think about it even something as basic as the buildings can can be seen as a form of privacy protecting infrastructure is completely normal and obvious in many ways but when it comes to your digital realm and mental models and we are speaking about it it hasn't sort of cut up from us yet for most people I'm not going to go into too much detail about the need for privacy or what happens we don't have it but suffice to say it's an important property for an open Society when we have conversations through peer-to-peer offline conversations we can talk privately and we if we use cash to buy things we can do Commerce privately on internet great as it is a lot of forces that makes it the natural state of things not the default big take as you turn users into commodity a product and monetize users attention for advertising to optimize for your attention they need to surveill your habits and activities enhance Bridge your privacy as opposed to more traditional business models where you're buying a product and incentives are maybe more aligned and to sort of build these uh sensors resistant and and price predicting and enable these types of apps that enable free frame expression and we need credible basically infrastructure that have these properties so infrastructure is what lies underneath there's many ways with many different ways of looking it but I'll keep it simple as per the original web free vision so you had a theorem for computing consensus Swan for storage and Whisper for messaging and vacuum has taken over the mantle from whisper and is a lot more usable today than with than Whisperer was for many reasons on the Privacy front we see how ethereum is struggling it's a big ux problem especially when you try to add privacy back on top it takes a lot of effort and it's a lot easier to censor and we see this with recent actions around 200 cache compare this with something like ccash or Monero where privacy is there by default there are also problems when it comes to the peer-to-peer networking side of things for example with ethereum valid data privacy and hostile actors and jurisdictions if someone can easily find out where certain validator is physically located that's a problem in many parts of the world being able to have stronger privacy protection guarantees will be very useful for high value targets and this doesn't even begin to touch on so-called apps that make a lot of sacrifices in how they function from the way how domain Works to how websites are hosted and Reliance on centralized services for communication we see this time and time again where centralized single points of failure they work for a while but then eventually fail and in many cases an individual user they might not care enough and for platforms the Lord to take shortcuts is strong and this is why it's important to be principal but also pragmatic in terms of the trade-offs that you allow on top and we'll touch more on this when it comes to design goals and around the modularity that Vector has so synonyms proofs are a wonderful new tool and just like smart contracts enable programmable money synops proofs allows us to express fundamentally new things in line with the great tradition of trust minimization you can prove statements while revealing the absolute minimum information necessary and this fits the definition of privacy the power to selectively reveal yourself perfectly and I'm sorry I don't need to tell anyone in this room but this is truly revolutionary and technology is advancing extremely fast and it's often our imagination is limit so what is vacuum it's a set of model protocols for pay to be communication as a focus on privacy security and being able to run anywhere and it's a spiritual successor to whisper and by modeler we mean that you can pick and choose protocols and how you use them depending on constraints and trade-offs so for example band refuses versus privacy it's designed to work in resource restricted environments such as mobile phones and Ware browsers and it's important that infrastructure meets users where they are and support their real world use cases just like you don't need your own Army and a castle to have a private bathroom you shouldn't need to have a powerful always on node to get reasonable privacy and sensor persistence we might call this self-sovereignty one way of looking at vacuo is as an open service network there are nodes with varying degrees of capabilities and requirements for example when it comes to things like bandwidth usage storage uptime privacy requirements latest requirements and connectivity jurisdictions we have this concept of adaptive nodes that can run a variety of protocols and a node operator can choose which particles they want to run naturally be some nodes that Doom consumption and other nodes to do more provisioning and this gives rise to radio for service network where servers are provided for and consumed so many different protocols that interact the evacu relay protocol is based on lipidwb Goss itself for p2b messaging and we have things like filter for band restricted nodes to only receiver subsider messes light push for nodes which sort connection Windows to push message into a network store for those that want to retrieve historical masses and then on the payload layer we also have things like support for noise handshakes and key exchange and this means that as developers you can get end-to-end encryption and expected guarantees out of the box we have support for setting up secure channel from scratch and all of this paced away for providing things like singles double directed at a protocol level much easier we also have experimental support for Multi-Device usage it's not worth noting that similar features have existed in for example the status app for a while but with this we make it easier for any platform using vacuo to reduce this there are a lot of other protocols as well related to things like pay Discovery topic use and so on and you can check out our specs for more so when it comes to Tobacco Network there are a few sort of immediate problems um for example when it comes to network spam and incentivizing service nodes we want to address these while keeping the private guarantees of the base layer I'm going to go into both these so the spam problem Rises on the glossop player when N1 can overm the network with Masters the service optimization is a problem when nodes don't directly benefit from reversing of a certain service this can happen if they are for example not using the protocol directory themselves as part of normal operation or if they're on social inclined to provide a certain service and this depends a lot on how an individual platform choose to use the network so since the peer-to-peer relay network is open to N1 there's a problem with Spam and if we look at some existing solutions for dealing with experiment traditional medicine system a lot of entities like Google Facebook Twitter telegram Discord they use phone number verification and while this is largely stable resistant it is centralized and not private at all historically uh whisper use proof of work which isn't good for heterogeneous networks and things like peer scoring are open to simple attacks and doesn't directly address spam protection in an anonymous PHP Network and the key idea here is to use Orlando for private economic spam protection using CK Snorks I'm not going to go into too much detail of our land here with some write-ups on back.dev bison house we've been pushing a lot of this from outside and I believe it's also another talk by Taylor uh PC tomorrow afternoon who's going to go into all any more detail but I'll briefly go over what it is and so the interfaces circuits and talk about how it's used in vacuum so our land stands for rate limiting nullifier it's an anonymous rate limiting mechanism based on CK snarks in my resume meeting we mean that you can only send n messages in a given period and by anonymity we mean that you can't link link message to a publisher we can think of it kind of as a voting booth we're only allowed to vote once every election it can be used for spam protection in pwm messaging systems and also rate limiting in general success for a decent plus capture there are basically three parts to it so you register somewhere and you can signal and then finding there's a verification and slashing phase you put some Capital at risk and this can either be economic or social and if you top a signal you get slashed so here's what the private and public input to the Circuit looks like the identity secret here is generated locally and we create an identity commitment that is inserted into Mercury and we use Market proof to Pro membership reticent members can only single once for a given Epoch or externalifier for example every 10 seconds in Unix time and our online identifier is for a specific online app we also see what the circuit output looks like and this is calculated locally so y here is the share of a secret equation and the internal nullifier acts as kind of unique fingerprint for a given app user EPO combination how do we calculate this Y and enter the nullifier this is done using Shamir secretary semi secretary is a based on idea of splitting a secret into shares and this is how we enable slashing of funds in this case we have two shares if a given identity is zero singles twice in an Epoch external fire A1 is the same and then for giving all an app inter internal file also stays the same X is the single hash which is going to be different and why is public output so we can reconstruct the identity secret with identity secret revealed this gives access to for example Financial stake so this is how our land is used with uh relay gausserver protocol so node registers and lock sub funds and after that they can send messages it publishes a message containing this your knowledge proof and some other details it's really a node listens to the membership contract for new members and also keeps track of relevant metadata and the Merkle tree a metadata is needed to be able to take double signaling and perform slashing before forwarding a message it does some verification checks to ensure that a no duplicate messages that the Synology proof is valid and that no double signaling has occurred it's worth noting that this can be combined with traditional PS coding for example things like duplicate messages or invalid CK proofs in line of vacuum's goal of modularity all in really is is applied on specific subset of Pub sub and content topics so you can think of it as a kind of a extra secure Channel so where are we at with our land relay deployment uh We've recently launched our second test net and this is using all in really really with the smart content on girly it's integrated with our example P2P chat app and it does so through three different clients that could go back to and JS Vector for browsers and this is our first peer-to-peer cross-client tested for online relay here's a screenshot of a short demo in the list of time I'm not going to do a demo here I'll actually do tomorrow afternoon um but basically this shows a user registering in a browser and a singling through jsbacco and it then gets relayed to in vacuum node that verifies the proof and when more than one message is sent in a given Epoch it detects the spam and discards it slashing hasn't been implemented full yet in the client and his work in progress and if you're curious and want to participate you can join the effort on our vac Discord we also have tutorial set up for all the clients that you can play around with and that's the QR code right there as part of this and in order to make this work in multiple different environments we've also been developing a new library called circuit I'll talk about this a bit later so going back to the idea of sort of the service network let's talk about service credentials so idea behind service credentials and private settlement is to enable two actors to pay for and provide services without compromising their privacy we do not want the payment to create a direct public link between the service provider and requester recall that the sort of the vacuum service network illustration with adaptive nodes uh where when nodes will choose which protocols to run and a lot of these aren't very heavy and they sort of enabled and work by default for example they're really protocol and other Protocols are much heavier to provide such as for example storing historical messages it's desirable to have additional incentives for this especially for platforms that aren't Community Based where some level of altruism can be assumed for example status communities or wallet connect Cloud infrastructure so you basically have a node Alice that's often offline and it wants to consume historical messages on some specific content topic and you have another note Bob that runs the server at home whether you want a storage historical message for the last several weeks uh Bob's happy to provide this service for free because he's excited about running project protecting infrastructure but he's using it and he's using it himself but his node is getting overrun by freeloaders and it feels like he should pay something to continue to provide a service so Alice deposits some funds in a smart contract which registers it in a tree similar to certain other private settlement mechanisms a fee is taken or burnt in exchange he gets a set of service controls and once he wants to occur with some criteria as he sends this is a bob bob responds what size of response cost and receiver address and then Alice then sends a proof of Delegation of a service token with a payment as a payment Bob verifies the proof and resolves the query the end result is that Alice has consumed some service from Bob and Bob has received payment from this there's no direct transaction link between Alice and Bob and gas fees can be minimized by extending the period before settling on chain this can be complemented with altruistic service provisioning for example by splitting in a peer pull into two slots or only providing a few cheap queries for free the service provisioning is General and can be generals for any kind of request response previously we want to keep private and this isn't a perfect solution by any means but it's an incremental Improvement on top of the sales quote and it can be augmented with more Advanced Techniques such as better non-reputable node repetition proof of correct service provisioning Etc and we are basically currently in a raw spec proof concept stage of this and we expect to launch a testing to this later this year or early next so circuit is a set of serenology modules written in Rust and designed to be used in many different environments the initial goal is to get the best of both worlds with circum solidity and JavaScript on one hand and the rust sequences ecosystem on other and this enables people to leverage circum-based constructs from non-javascript environments for the online module it is using circum circuits via Arc circum and rust for scaffolding it exposes a cffi API that can be used for other system programming environments like name mango it also exposes an experimental awesome API that can be used through web browsers and vacuous peer-to-peer infrastructure running in many different environments such as Nim JS go and Rus and mobile phones and web browsers so this is a requirement for us Socom and jsrings is access to things like dab developers tooling generating Verification codes circuits and raw strengths is that it's a system based and easy to interface with other language runtimes like nimgo rust C it also gives access to other rusted seek ecosystems such as artworks which opens the door for using other constructs like Halo 2. this becomes especially relevant for Concepts where you might not want to do a sort of a trust setup or with circus or more complex or custom and performance requirements are higher and so on in general with circuit we want to make it easy to build and use Synod proofs in a multitude of environments such as mobile phones and web browsers currently it's too complex to write privacy predicting infrastructure with Synology proofs considering all the languages and tools you have to learn all the way from JavaScript solidity and circum and how to write the circuits to rust was them ffi and that's not even touching on things like secure key storage or mobile Dev luckily more and more products are working on this including various D cells and it would also be exciting if you can sort of make a useful tool stack for JS list CK devs to sort of reduce cognitive overhead uh similar to what we have with something like Foundry I also want to mention a few other things we're doing um one thing is protocol specifications and we think this is very important for peer-to-peer infra and we sell a lot a lot of we see a lot of other products that claim to be doing P2P infrastructure but they aren't very clear about guarantees or stable something is or the actual semantics of it this makes it hard to have multiple implementations to collaborate across products and analyze things objectively related to this is publishing papers we put out free so far related to vacca and online really and this makes it easier to interface with Academia and there's a lot of good reasons out there and we want to build build a better bridge between Academia and research and Industry another thing is Network privacy so vacuum is modeler with respect to private Securities and there's lots of knobs to turn here depending on specific deployments and requirements so for example if you're running the full relay protocol you currently have much stronger receive anonymity than if you're running a filter protocol from a bandwidth or current or connectivity restricted node we have to make this pluggable depending on specific user needs so for example mixedness such as Nim they come with some trade-offs but are definitely a very useful tool in this Arsenal a good mental model to keep in mind here is the unlimited trilemma where you can only pick two out of three when it comes to low latency low bandwidth uses and strong anonymity uh we're currently exploring things like done dealing like additions to the relay Godzilla protocol which would provide for stronger anonymity especially in a multi-node botnet attacker model as part of this we're looking into things like different parameter choices and and more generally possibilities for low latency usage this could make it more amendable for latency sensitive environments Associated validated validated privacy especially under very specific threat models in general theme is do we want to be rigorous about the guarantees we provide under what conditions and for what precise threat models and we have a lot of specs around this and adversary models and so on another thing that I mentioned Earl is this noise payload encryption and specif specifically things like allowing for pairing different devices with QR codes and that's sort of it's very useful for developers because we live in a Multi-Device world and we want to use things from different devices There's a summary uh we're going over with privacy protecting infrastructure is why we want it and how we can build it and we've seen our CK is a fundamental building block for this we looked at vacuo the communication label web free and how it uses serial knowledge proofs to stay private and function better we also looked at circuit and how we can make it easy to do Synology proofs in different environments finally we also looked at some other reasons we've been doing and all of the things mentioned in this talk and a lot more is available as write-ups specifications or discussions on on our Forum or GitHub uh here's some links uh if you find any of this excitement to work on feel free to come up to talk to me and we're also hiring and I've started expanding into other privacy infrastructure technology such as uh private improvable computation with CK awesome and the QR code is a link to our Discord thanks any questions [Applause] uh hello one of the main challenge I perceive uh in a crypto messaging is uh the fact that producers has instant advised to pay to have a massage broadcasted but there is no incentive and for layers to distribute it to Consumers that much and this makes centralized solution usually would come as you want to have something like I don't know metamask to be able to relay things to users with insurance and everything which make it in return a sensorship sensitive where then nation state can pressure be centralized actors into not Distributing the message and if you rely only on peer-to-peer you might still need then some very old-fashioned index or layer which can also be centralized to this message is here so how do you specifically in your protocol solve this making sure that there is instances of a distributor to receive a message so okay repeat the question so if you're in a decentralized messaging protocol you have consumers that want to receive sage and as you put it yourself sometimes I don't really have a lot of resource they don't necessarily want to verify their identity and everything but there is no direct incentive for broadcasters to have of the product message that these consumers want to send this message to the consumers if I'm not getting paid for it yes so I think we're I guess we're splitting this this problem up a bit uh it's definitely a general problem if you have sort of some multi-hop module if you want to keep that private and incentivize that in general that leases are very heavy models the way we are basically simplifying the problem and cutting it up is looking empirically at the problems we see today and a lot of those problems as you kind of mentioned with methods and things like that come exactly when you are in a restricted environment and you have to use some kind of service some request response kind of thing there and this is exactly what we're trying to do with the with the things like the subsequentials and these things and there's also a lot of things going on here when it comes to Discovery and like finding and and ranking these types of nodes but when we look at the real Network just like if you look at gossip sub usually the participants in the network are incentivized to sort of relay message and furthermore because of for anonymity reasons we are encouraging the use of a single pop sub topic which means that sort of your reeling messages in a network in general because you don't necessarily know the contents of it so it's kind of a byproduct byproduct of normal operation so it depends a bit on what layer you look at it if it's sort of the normal operation or if you're looking at the edge kind of thing and then the reputation thing is another aspect of it okay so there is no direct instances in the network it's just a side effect of producers wanting more users uh kind of like this this levels of it right there's different types of incentives uh and uh they're really Network itself empirically it's not a big problem right now it is definitely a recess area and it's not something that we are looking into and we have some ideas around it but it's not actually a high priority if you look at empirical problems we're having the problems we're having are more around this kind of edges where there's a search positioning as well as how you discover things in the web browsers and and reputable nodes and these sort of things so that's higher priority uh and and empirically but things might evolve and yeah do you have any more questions yeah I have two questions first is is all I'm based on semaphore second second question is is there any gas payment involved in uh zero knowledge verification if if if there is how do you prevent from uh exposing the identity uh from guest payment yes that's a good question so our land is you can look as kind of semaphore but then more things when it comes to actually preventing uh double uh double double signaling um so semaphore plus some other stuff to do that then do the slashing and so on uh as for the CK like CK verification this is actually something that's a bit different with this peer-to-peer infrastructure because it's not happening normally on the blockchain it's actually you're verifying it on each peer-to-peer node sort of that that's running this thing so that doesn't require uh gas usage when it comes to slash things if you've detected the double signaling then you you have to go on chain obviously and interact that and that will also verif verify the proof but you can use the relays and these types of things but as part of normal operation you're not actually interact with blockchain it's all happening peer-to-peer right unfortunately time is up uh but thank you Oscar uh again I'm going to repeat the fact that you can go talk to Oscar uh outside of the room so please uh follow up on our conversation there uh so again thank you