# An Introduction to Privacy and Anonymous Communication: A Hands-On Workshop

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 58:15
- Topics: blockchain, smart contracts, distributed ledger, ethereum
- Watch: https://streameth.org/watch/yt-PveslzdXZhE
- YouTube: https://www.youtube.com/watch?v=PveslzdXZhE

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/5/an-introduction-to-privacy-and-anonymous-communication-a-hands-on-workshop

This workshop will go over the basics of privacy, starting with anonymity and unlinkability. We'll show that privacy is a 'holistic' systems-level concept, and not just an application of zkSNARKs on-chain. Various types of privacy notions (unlinkability, undetectability), and threat models, will be explored, as well as the various levels where privacy leaks happen (layer 0 on the network level, layer 1 on the chain, and layer 2 application issues). The workshop will then invite coders to describe their own privacy problems, and we'll offer advise and hands-on work through with systems like mix-networks (Loopix), anonymous credentials (Nym), and other systems. 

Speaker(s): Dave Hrycyszyn, Jedrzej Stuczynski
Skill level: Beginner
Track: Privacy
Keywords: technical

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Applause] I work for a project called NIMH and we're talking about privacy and block panes and decentralized systems and distributed systems today a little bit about the internet and sort of more general systems outside the block chains and where a project is basically about privacy the kinds of things we're going to talk about today why are we doing this like what what are one of the things that were interested in what kind of problems were interested in solving getting the quick definition of privacy and we're going to talk about two core technologies so that we are working on one of them is called a mixed net which is a kind of better than tor way of anonymizing your internet traffic and the second one is decentralized credentials so that's kind of like the quickest way I've ever tried to figure out to explain it to people with something like a decentralized a lot but it's actually much more powerful than that so you can actually use it to anonymize pretty much any crypto currency transaction or block a transaction using anonymizing claims which I'll explain in great detail in just a moment then we'll do a quick demo and then we have a discussion how many of you here are developers who have projects that maybe have interests in privacy you can be useful to have different privacy preserving things that's great I'm super happy ok good so hopefully we can have a really good discussion as well I think we should introduce ourselves first just as people so my name is andrew scott and their head of my research - investing technologies and in particular and identification metals cool and my name is Dave Harrison as you can see from my last name I got quite an early start with encryption I'm a founding member of decentralized derivatives platform called the Vega protocol I previously built a started scalable blockchain and consensus system called chain space moved to Libre very briefly and I thought that it was actually more interested in working on Internet privacy issues since that's why I'm working here at the wider team this is the kind of production team including some of our coders and other surrounding people and we actually have quite a large team of advisers from across Europe from four or five different universities across Europe basically so our goals we have one goal it's pending mass surveillance why would we want to do this quick quick kind of overview I kind of think that the present situation on the Internet is something like crypto Wars - so it's like the sequel to the crypto Wars for those of you who miss crypto Wars one the original episode the 1990s were quite there were quite bold attempts by Lina's government to legislate things like hardware backdoors into computers and network systems and they basically want to work reroute all cryptography at the time that was so they're kind of big aim strong cryptography in the 90s was classed as ammunition and it was subject to export bans so that you couldn't share it outside the United States many arguments against privacy were advanced at that time and if the anti privacy advocates had won in the 90s most of internet systems that we use today would probably never have happened but as it turns out the original crypto Wars were one during the course of the nineties I think that the available the availability of SSL probably did more to advance here security and privacy of Internet in the nominees than anything else is rarely viewed this way but SSL and success protocols like TLS are a practical and very important contribution to help ensure a civil rights worldwide Transport Security is the core infrastructure of global civil society in my view it also ensured that a lot of new industries categories so things like e-commerce internet banking private messaging photo sharing many of the convenience of the modern life that we take for granted everything would be very different today if the coders of starting in the 90s have been prevented from protecting user data now today just like in the 90s we have a kind of new technical set of possibilities in front of us and the same arguments about privacy are being advanced I think that we have to we have to win the kind of crypto Wars to in order to make both global civil society secure and also take advantage of the new economic opportunities that we have in front of us yeah so that's in a nutshell the reason why we're doing this how ok so you might rightly ask how we're planning to do this we have basically two core technologies in our system the first one as I said as a mix then which is a better than tor network security layer and Anya's Mixon expert she's going to talk about what better than tor means not to rag on tour because it actually does a really good job but there are certain attacks against tour and we think we can just generally do a better job the second thing which I'll talk about is a signature scheme that provides these properties and I'll go into those in detail in a little bit but first I'll hand off to money it's the first time using the clickers Obama's accident like explode the screen or try not to so before we're gonna jump to like discussing what big networks are alleges discuss what privacy actually means to privacy the fundamental human right and we can think about privacy in the context of legal basis in the content in the context of human need and we can also think about privacy in the context of computer security so in context of computer security and in any other the most general way to define privacy is that privacy is the ability for us to decide what type of information we would like to share with other people or disclosed about ourselves and privacy is a is a very complex topic because when we are building privacy enhancing systems we have to make sure that we're gonna consider each of the components of the system in terms of privacy so it's a very holistic property which means that the information leakage in one of the components of the system may vary significantly decorate the privacy properties provided by given the most and hence cryptographic techniques in the other component of the system so with because today we are talking about them and them is a system for enhancing the privacy properties of the online users the most basic component of the system which we want to run online is the network layer security and when we're thinking about the network layer security one basic thing which were thinking about is the anonymity so what is anonymity anonymity in general is the property which allows us to remain indistinguishable among other people performing smart actions or of patience and in the online world we gonna talk about anonymous communication at the network layer so we would like to hide the fact who is communicating before or who is exchanging information with home and the witness anonymity is important so if you're gonna think about network layer security you have to think about the metadata so when the internet was first introduced in DARPA it was developed as a small side project focused on fast packet switching and it was intended to be used for casual communication not for an exchange of confidential information there further was a very small amount of thought put into securing actually this communication and how it turned out this little project ended up being a worldwide project and we all use internet nowadays for everything and every online activity which we perform lives a digital fingerprint what it means that every operation would you perform with every operation which you perform online is associated the metadata what is this metadata the best way to define metadata is to say that it is everything about your communication except the content so this is information for example about who is communicating with whom how often both times of the day what is the dynamic of the group what is the sequence of communication from which location you're communicating with people and so on and so on and when the priests program was revealed the NSA was saying that no big deal that here were trying to record your communication because we are not reading your content we're the metadata but it turns out that this metadata carries a lot of sensitive information about the users which very often is as revealing as the content itself you don't actually try to prove the messages and look if it wanted to infer a lot of information about the users which in result allows you to infer what are the relationship whether they're political or sexual preferences religions and so on and so on so let's look at a couple of examples of privacy enhancing technologies which are very popular nowadays I'm pretty sure you saw or heard at least about one of them and let's think whether they offer us anonymity at the network level or not and how good is this anonymity so the first example is as to an encryption I'm quite sure that to you either use I've heard about PGP for emails or add to an encrypted instant messaging applications by whatsapp signal telegram and so on so this is a very good example of a progressing and hansung technology which allows you to have confidentiality so which allows you to hide the content of your communication but it doesn't protect the network player metadata associated with your communication so even though you're hiding your actual messages you're not hiding the fact with whom and however you're communicating another example are the privacy enhancing crypto pies so I think I don't have to convince anyone that bitcoin is not anonymous but let's look at for privacy friendly coins like for example zip hash so seepage is a very nice promise privacy supporting point because it offers a good privacy properties on chain thanks choosing the zero knowledge technology but it does not protect the network layer so in result the adversary who has access to the network layer is able to correlate users transacting just looking at their net addresses and the example is VPN also the threshold fighters network so here we are getting a little bit closer towards securing the network layer of communication because actually VPNs of a some type of network level protection by a frank and encrypted channel between the user and the VPN provider which acts as a proxy but what is the limitation of the VPN or VPNs are centralized which means that simply you have to trust the PPM provider that he will be behaving honestly because he is the one who sees your traffic between the user and the public Internet so in results you have to trust that the VPN is not malicious or it does not keep any logs about your online activities and does not share with anyone so the research in anonymous communication networks is definitely not known already in the early 80s David champion ear the idea of the first-ever anonymous Network called the mixed Network so I will try to give like a very brief crash course on what mixed networks are so let's start first what is a mix mix is simply a router and that will project for any type of Internet traffic which would like to use and it makes network is just a set of such mix now and don't be particularly face that I'm showing the mix ontology just a single sequence in general you can have many topologies of this network but just for cyclic simplification I have just a single path but on top of being just a network router the mixes have some security properties which allow you to remain anonymous a player so what are those properties the first property is that it makes transforms the received packets cryptographically what does it mean that if Alice wants to send a message to Bob she gonna and coat her message into a special cryptographic packet format in such a way that each mix on the package with Alex Alice and Bob will remove one layer of this cryptographic protection so if some of you know Onion Routing it's a very similar idea so we layer and crimp the packets and what this gives us is the property called bitwise unlink ability this means that if the adversary observes any single mix and he sees packets coming in and packets coming out he won't be able to correlate them looking at the binary representation so the bit pattern of the packets in and out does not correspond to each other another property of the mixed networks and the mixes is not related anymore to the bitstream but rather to the timing of the packets so most of the routers of the network work at the first in first out basis which means the first packet coming in will be probably the first coming out so imagine your mix works like that and the adversary observes the mix and he says packets coming in and out and even though we cannot correlate them based on their binary representation you will be able to correlate them looking at the time of their arrivals and departures that's why the mixes do not forward packets at the first-in first-out role instead of that they reorder the packets following some secret permutation what this does is that the timing correspondence between the incoming and outgoing packets is broken up and there are many different ways to perform this reordering following presentation the original chance mix net words operated in synchronised batches which meant that the mix is waiting the whole round with which can be for example an hour or something like that and gathered some packets processes them and at the end of the round shuffles flowing a secret permutation and flashes to the next hole so those two properties the bitwise and unlink ability and the timing and likability allow you to achieve anonymity of your communication because the mixes are combined in long chains and thanks to that none of the mixes knows who is the sender and recipient because they only know that previous and the last and then at the next hold so they don't know what is the whole path and who is sending messages to home and at the other and at the same time the adversary who's observing even the entire network can sniff all the packets at all the links won't be able to correlate your communication so as long as at least one mix in the path is honest your strong anonymity remains so any mixed network designs had a couple of limitations in terms of performance mostly scalability and very high latency overhead because those batching plants required a lot of time to wait for many packets to arrive that's why the nimac network is based on the modern mix network design called topics which solves the problems of traditional mix networks so a little bit about how name mix at work works and how we solve those issue of limited performance in traditional mix networks so the first is the network topology so apology means that mixed notes are roped into layers and the traffic is flowing from first layer to the last layer in one direction and why did we pick the stratified topology it's because as research has shown the stratified topology has debates the best trade off between the anonymity and performance and it's a topology which scales horizontally which means that you can very easily scale your network if the number of users using it increases or the volume of traffic increases because you simply have to incrementally add more nodes so for example tourists an example of a network of an anonymous network which also scans horizontally in terms of the bitwise amicability and the cryptographic packet format which were using we're using the Sphynx packet format if some of you know lightning networks you will know that exactly the same cryptographic packet format is used in the Lightning networks and the Sphinx packet format offers the unlink ability of the binary pattern and make sure that all the messages are padded to the same length but it also ensures resistance to packing and replay attacks and it allows to encode all the relevant information will fit the packet with what means that the sender as soon as he sends the message into the network we can go offline which for example does not happen in tour because it or you have to be online all the time to be able to communicate when you're sending packets because you have an open circuit in the because we're using Sphinx we can just set the message and go online and in terms of this mixing operation this reordering we use the so called continuous time axis and this is a very nice technique for mixing at the packets how it works we don't have synchronized friends we do not batch messages instead of that each packet is delayed with some random amount of time and the sender when he's preparing the packet to be sent into the mix Network encapsulate those random delays from each mix on the path this delay is randomized and that makes when he strips the level of cryptographic protection because I see this delay and she knows for how long you should keep the packet before flashing it and why actually this is a good technique for mixing well we are picking the delays from the exponential distribution and the exponential distribution has a very nice property called memoryless property what it means imagine you are the adversary and you're observing and mixed knot and you see one packet arriving at some pot at some time and then another packet arriving to the mix at another time and then you see a packet leaving the mix this memory and memory less property tells you that you cannot guess which of the incoming packets is that one would you observe going out because the timing at which the packets departure from the mix is not related to their arrival times and what it gives like in the big picture it increases the anonymity set because in the synchronized mix networks you have the unlimited set of the size of how many messages you've managed to gather during the run here because everything works in a continuous manner and the exponential distribution is known to hell you're you're under limit it's much larger because you actually have to consider all the messages which you have ever seen arriving to the mix not as being potentially the one departure and the last thing about the new swing set is that you know it's very intuitive that when we are talking about anonymity the larger the group of people among which you're anonymous the better is your anonymity so mix that works better often use covering traffic but the problem with the traditional mix network design was that this covered traffic usually required a lot of bandwidth and that's why in them and in the dim sum example we're using a tunable covered traffic and Chernobyl means that when the volume of real traffic increases in the mix network you can tune down the amount of common traffic which you're using and vice versa if the amount of real traffic is dropping and the type of covert particles were using is called a loop covered traffic alone means that the sender and the recipient of this packet is the same person and both the clients and the mix notes are sending blood-covered traffic following the Poisson distribution this ensures that the potheads the real ones and the loop packets are very nicely mixed together so the adversary can not distinguish looking at some sample of traffic whether he sees real messages or loop messages and so on but the local messages they also have another burgnik advantage they allow to detect and prevent active attacks in which either malicious mixes or malicious adversary can block or drop some of the packets in the network this are properties which were not in the traditional mix at work designs so it's a very big advantage okay just to wrap up about the names mix that what is like the key takeaways you should remember is that we have a mixed network which has a anonymity versus performance trade-off the network scales very well we can adjust the latency which we need in our system depending on the amount and volume of traffic which we have we can detect and resist active attacks and so that's about mixels thanks Anya so that's half of our system and by the way we're going to try to do well we're gonna succeed in doing a demo because we don't have any dependencies on internet a shuttle movie last night in my hotel room so we'll actually be able to see some of the stuff happening so we've built a small chat application just as a kind of tester and we you'll be able to see messages going into the mix net going between two terminals as a kind of simple example but you could use mix Network many more things than chat we can use it to pretty much anonymize any of your blockchain transactions any of your crypto currency transactions or anything else for that matter yeah the second part of our system is a system of privacy preserving credentials so these are working at different layers here a mixed net defends you at the network layer whereas the credentials that we have can defend you at the layer of your transactions or your block chain so the mix that protects your IP traffic as it's traveling across the element unprotected wilds of the internet and the privacy preserving credentials allow you to code cryptographic claims and use them so we're using a signature scheme called coconut so what is coconut well coconut is a signature scheme and as you may know all signature schemes have at least these three algorithms that you need to be able to generate your keys be able to verify a signature that you received and you somebody has to be able to sign okay so given given the public key of the first that you want to assign a message for you should be able to assign that thing and it's anybody who has the public key that was signed which they should be able to verify right so everybody's pretty much familiar with these things who a lot of know that you know it's very good cool so name signatures are it is a signature scheme but we have several additional properties so the first property that we've had to the server normal 3 we have blind signatures or blind issuance this do people know what that means some people not everybody okay cool so again david chung cryptographic genius invented blind signatures which have some additional properties and functions let's take a fictional ecash scheme just to kind of use an example to try to walk through what a blind signature is so i'm going to create a cryptographic claim so a piece of cryptographic material that basically says what I want to end up with is a bear a bear or token saying I have $1 ok that's that's already don't take it out of the blockchain world for just a second so I'm gonna create this claim saying Dave has $1 and it'll be in clear-text cool so I've lined it locally on my client and that turns it into gobbledygook so it just it's just a you know a piece of string E string eNOS and I'm gonna send it to the bank over the network along with a dollar if I could transmit a dollar through the through the pipes the bank is gonna then sign it and saying they attest yet Dave definitely has a dollar we're rolling it cool now he's got this claim that he can run around with and they give me a signature back so they've signed basically a piece of blind cryptographic material they give it back to me and now I now I unwind the credential and I can basically D Link it back from what I got back from the bank so I now have a bearer token which attests that I on a dollar and yet the bank never actually they can't really identify because that you know that all the other materially in that blinded credential they never saw they just saw some gobbledygook so this process of that to create the clear text blinded clear text locally send it to the signer the signer signs it return it to the creator and the creator on the blinds it to use it as bearer token this is the kind of general process of wine signatures now some of you may have noted that there's a problem with the mind issuance you may but I detect what it might be exactly so the cider has just been presented with this gobbledygook and they signed it and then given it back to me so it could have said dave has $1,000,000 in it and they would be unable to tell without some further active verification so if you're the you're the bank you get some gully the youthful solution to this is to use as your knowledge proof attesting that the message contains one dollar but reveals nothing else so the serial number of the credential my identity anything like that so there's a bit of zero knowledge of action inside this so coconut our signature scheme has this hero knowledge proof abilities that's one of the things that it does so we can do my dishes cool a second thing that we have is the concept of reran demise of bold signatures does anybody ever run across this before now it's a pretty weird one I'm gonna demonstrate it in a little bit but this type of signature has an additional algorithm to these three which is basically randomized so you basically can take a signature and then from that signature you can call a call to randomized method on it and you can basically generate a brand new credential which is cryptographically equivalent to the original credential that you originally had in your hand is completely delinked become completely anonymizes the cryptographic that here they have in the bearer token so it looks like a brand new credentialism s are unthinkable between the two but it can still be verified through cryptography and this as if it was the original one so I'll demonstrate that in a bit but that basically can make your bearer tokens untraceable so you get a very very backward and some kind of authority you call the random re randomize method on it you get a new bearer token as the same cryptographic material but the authority can't say guess was they have that generated this because I saw that one and I gave it to it's that kind of makes sense getting cool okay so what is this used for so you could create multiple signatures and show them to different people but the people that you show it to cannot link you back to the original original signature or any of the other rear end of my signatures but the underlying messages in in this case is all the same so that caught the crypto got the content is all the same across all these credentials so we basically have multiple anonymized bearer tokens that can each be validated as if they were the originals so we have the property of unlink ability cool we also have a concept of selective disclosure so in a traditional scheme when you sign the message and somebody wants to be verifies the message they have to verify the whole thing okay so selective disclosure means that instead of needing to verify the whole message you can have people verify only certain attributes in the message keeping other parts of it private so let's consider an example again to make things easier let's assume that we have a passport so my passport has my name my nationality age photo and place of issue in it right so these are the attributes in the passport let's say I want to go to the pub and have a drink and they like I mean I'm so old that I would never need to prove that I'm old enough to get it but other people might need to actually like produce some kind of ID and you know you could in an electronic kind of way you might send your whole passport over right and identify yourself completely but actually can anybody see what we to get into the Pelletier age page and photo right and actually we're doing you really want to say you know how old is Davis is really super ancient what we really just want to say is he's over 18 right so that's that's that's basically what we want to selectively disclose so coconut allows us to do this so you're basically signed a tuple of all fields in the passport and when it comes to verify the verifier can verify only some of the attributes despite the fact that the rest of them are still there you can selectively choose to quote disclose these things and you can selectively choose to declare disclose from different ones to different people basically so yeah so basically we have three parties we have the passport authority the subject that's whoever wants to go in the pub and then we have the the relying party we call it which is the bouncer at the pub door right and you can basically choose to selectively disclose some or all of the attributes of the message so when you put it all together selective disclosure can be applied to normal signature schemes without winding without reran demise ation so you can get a signed message from an authority and disclose them selectively and this provides privacy against the relying party the bouncer and also against the passport of 30 right oh sorry if you go to this if you go to the pub again or if the if the passport authority wants to without the other properties that is blind issuance and rear analyzable signatures they can identify you the second time you go to the pub as being the same person right or the passport authority to break your anonymity if they wanted to if we combine all of these things blinded credentials re randomize Mel signatures and selective disclosure we can protect the users provide privacy against multiple shows that is uses of the credential at the pub so the bouncer will always think it's the first time you've been there which might be important in certain applications and we can also protect you against the passport Authority who has no way of linking the credentials you're using to what they've issued now keep in mind we're not really talking about making a passport Authority any kind of authority that you want to have it can assert any useful information about anything in your applications can be contained inside an in credentials so all the elements thus far basically existed in the cryptography literature and we were we're just stringing them together so like this isn't some you know mind blowing the new set of things maybe you haven't heard of it before but all of this stuff basically exists but they only existed in centralized systems so up until now it's been impossible to string these things together in decentralized systems and that's what kokin Eyes coconut basically gives you is this one more thing which is threshold issuance so you can actually have a decentralized set of authorities all generating the part of a credential so that allows the the kind of the decentralization of the kind of blockchain ization of abusing these kinds of attributes for the first time so we're not aware of anybody else who's done this so it makes all of these other things like blind issuance rear end of my signature selective disclosure use a bowl in a blockchain context so this is known as a threshold signature scheme so that's basically what coconut does and what the mix that does well they'll break for some questions here just to keep things going back and forth and then I'll do a quick architecture diagram of what we have running right now and then I'll show thee that can show some of this stuff in action yeah cool so questions any yeah okay so the question is what is that timing in replay attack so attacking attack is if the adversary is able to slip to snip a package going for the network and then sleep like a single bit for example in order to be able to like trace this packet per day in the network so if you don't have a cryptographic packet for my schedule to be resistant to that it will just flip a bit and then you will be able to trace the packet the replay attack a can be used also for tagging it means that you're repeating the same packet once again just for example to see where it will go again so you're able to sniff it and then resend it again you mentioned that you like set out to basically build something that's better than tour in terms of network security so the main attack against tor is essentially a government agency running like over 30% of all nodes and by having a majority of exit nodes they just see where the all the packets end up how do you address that attack so for example the thinking tour is that all the packets are going like all of your packets from the nation packets are going by the same circuit and so with the same entry and exit knob here in the mix Network effort packet is going by an independent path which is selected randomly so this is already causing a little a little bit of trouble because then it's not that the agent I just know like try to control some of the exit nodes and so on another thing is they will be when we random big stones there are a couple of techniques which allow you to detect any notes based on the reputation so try to build a reputation which notes are there honest ones and which might be malicious ones so exactly yeah so we basically did just a complete are give a quick maybe visual over Vienna might help partly answer some of the question we basically have to two chunks of our to two parts of our system at the top here is the mix net and then we also have validator notes of decentralized authorities that communicate among themselves and it kind of B of T round four they're doing that and we have some dummy service providers over here built as well to talk about you know to answer your question we have a system which we haven't yet built so all of it all of the stuff I've just drawn here actually is running right now and you people can start to integrate it against it try it out the this this new thing that I'm about to talk about doesn't yet exist as running code is it's only a few weeks old so it's kind of we just haven't had a chance yet to actually put it together but it's essentially a way of saying okay cool the original loop mix design I need to take a bit of a detour but I'll get back to it was okay cool your client starts sending stuff so we have a packet which is like here think of it as I guess on repair encrypted Russian dolls that all kind of open operate so the center Galba the littlest one is though the message you actually turn us in then there's these layers of encryption and that basically defines a path that goes in here comes out here goes this way ends up at this storage node over here and then the offline client maybe that was here maybe somebody comes out of the Metro something like that grabs that and actually gets the content delivered right now the original design of Lubich which is something that on you worked on what's very individualistic so you can do Luke Luke traffic it's called and you can be spitting even if you're not sending any real messages through the system you might be spitting new traffic through your cigar your packet might go boom boom boom boom book and actually loop back around to you and say cool well my message made it through so you said maybe one every ten times you sent they'll do pack it around and you can you can basically see cool these guys delivered my message right the problem we have to solve is okay for if this is me I'm a good person I would never say anything wrong how can we if we just rely on the user's to do this measurements that I could also be an attacker right so we have to come up with a way of verifying the the behavior of each of these nodes in a way that's publicly verifiable in a way that's kind of akin to like BFD consensus system right because I could say hey my my back it never made it past here and if we rely on my individual judgment I could be the attacker trying to damage the reputation of this node right so we basically come up with a way of using the verifiable randomness function to pre generate a bunch of packets and assign them to clients the clients will send them through the Viera will be revealed at the end of a timed round and we can then check does the Merkel trees of each of these nodes which they've been keeping for record-keeping purposes basically they have to show the Merkel trees and the commitments inside the marble trees that each node has they send that back to the staking authorities and the state authorities can then verify did they do the right thing add a kind of system level not at the individual level so this is something we've just come up with it's probably the first time that anybody's come up with kind of a incentivization system that works with a mixed net like this so we're quite proud of it we haven't we're checking the quality of service offered by the make make sense and if we see that some mixes are behaving dishonest or that or in a malicious way we're just cutting from their stakes so cool as as far as I'm stunned it and taller just has very simple we just send the messages out directly there's a mixed network want to use a Poisson distribution for the sending out of messages and also different classes of applications will have different profiles how do you want to create those profiles for the different applications what processes and tools are interested create noise so just make sure I understand your question you're asking like if people we discuss different use cases where people send different volumes of traffic it's also like a chop okay yeah what it will have different yeah so just to give you a little bit of the background in the looping Society and hence in the Linda's mix net we and force kind of the clients to send following a following a Poisson distribution what does it mean imagine you have a phone and you press the button send your message is not immediately is injected into the mix network instead of that it's buffered in like a special here which is controlled by the Poisson process and from time to time at random times disposal process weights up and checks this backward if there is a real message you take this message and send it if there is no real message he sends an undercover message what this gives you is that you're sending pattern and so from the perspective of the adversary who's observing your client it just looks like you're always sending something but whether you're sending krill traffic or just cover traffic we don't know that so coming back to our beers question if we have different use cases like instant messaging or given someone is fast sending the other is slow sending then we can adjust this Poisson process to be sending faster or slower but we actually all the time confiscate is sending pattern of the client so the other side cannot tell whether you're actually communicating with someone or you're just being completely you know on hold so yeah so we we have a very very preliminary let's call it demo nobody trusts the judges on our graphic design or anything like that I'm just gonna show we just built built a client cool we have a really cool like set of graphical and introduction to the client to it as well you started basically I'm about to run it here to see just so you can see what it says I've edited an ALICE user so it's like Luke's client in it Alice so Alice now get some private private and public keys generated and stored on her system now it started to run in the kind of boo-boos client binary which you'll be able you can you can integrate against if you're actually interested in like trying to make your applications work with a mix then we have a bunch of running mix net notes we have this topology of six notes running on the internet right now with two storage nodes at the end so even if you're kind of end user clients are offline you can do that as soon as we told Alice as soon as Alice said Hana to run this client the client automatically starts sending packets so it starts encrypting packets through the system and sending them back to herself right so starts generating covered traffic as soon as the client has started up this client doesn't do anything else than that so you might be a bit disappointed if you just like fired up in the newbie doesn't really do anything but it is actually doing something if you like if you wireshark yourself you'll be able to see in a cover traffic going however yeah we're basically within the next week our plan is to build a set of socket interfaces so you can just have this binary sitting inside your application you can connect to it by either a web socket or a TCP socket and just push bytes into it and those will be those bytes that you push into it will basically go through the mix net and you'll be able to send messages so that's a kind of example of that we're building a chat client and we've got it built up the show right here so I'm just gonna I'm just backing out I'm saying okay cool we're gonna go to the chat client demo and I'm gonna spark it up so we're gonna use this Alice thing just Alice user cool so now I'm going to test what Alice's public key is and she has to figure out who she wants to communicate with we've also made a bog user and I'm just gonna start him in another terminal there startup bog good cool key select Alice's public key which has to be sent out of fans he has to know that cool now we have this two message thing now just as that kind of goes through I'll just explain what's going on we have two clients both of them start sending cover traffic and we have a dashboard that you can actually see on the internet right now it's at dashboard Jim tech dotnet and you can we're always sending cover traffic through that anyway and you can basically see the cover traffic going through the nodes is it you can see it tells you you know this note here let's say in the last one second it sent 20 packets and it received 18 packets or 12 packs or whatever whatever times to be so you can basically get a view overall of the whole network and what within it yeah so you can see the speeds this is actually going through from my hotel room in Japan to our mix net in [Music] Europe somewhere through the six notes and then back up back to Japan so it's you can see the speeds actually not that bad as far as when something is typed in here or you can see it appear on the other side quite rapidly so it's yeah it's definitely sub-second latency it's like sort of 300 400 milliseconds I'd say of latency that gets added at that thing so we can also see the mixed notes and the validators here as well okay if I bet just back it up a little bit you'll be able to see right here yeah cool over on the right-hand side there you can see it says received and sent in that one second period that's what the mixed nodes actually receiving in and you can see you can kind of tell that the orbital reordering is happening inside the nodes because otherwise the numbers would be exactly the same I've sent and received in that one second period uh they're not across all of this thing said so that's the reordering of the packet of the packet [Music] yeah yeah so there's there's the the rico's that we have are completely open the chat client might not be but that's more oversight the the main notes that both have been in validator notes that run the credential system and the mixed notes that run the the mixed mixing system it's all open right now so you can you can look at it have a look to it it's not super beautiful yeah services no clora so right now we're running a directory server at directory w tech dotnet bit centralized at the moment but that's a temporary things we need to bootstrap the network and then I need to figure out is going to be as far as just you know deciding in advance how to miss mix man so so they're a couple of reasons why the first one is if you're in the center and your pick delays in advance for each halt you know where your packet should arrive at the other end this allows you to flex our program expecting an acknowledgment for your packet so you will know whether your message go to the other end or not whether one of the mixes dropped it or not so that's one of the advantages yeah it's the main one because also it will allow you to detect malicious mix now if your packet you didn't get the acknowledgement for your packet this means that maybe your packet will throw someone on the way and you should investigate which of those makes notes potentially dropped your packet and so on I just see that your received and sent I expected that to be equal tender so you're not received edges they're supposed to be different because the the packet says they received our help for random amounts of time so that's why we have the reordering so they were the same that's when we would be unhappy because then we would be going like why why it's just me what if it's just passing the same things in and out in the same order and it's not reordering anything what's actually doing is it's you we can tell it's working because it's holding the packets for a random interval and therefore we can see that it's actually mixing but why didn't some notes have one messages and yeah so they also like imagine like in one second Felicity and packets in the other second you Center five of them and then you receive another five and then you said 15 so like oh cool sorry go ahead the Everson scheme for in the notes my public key or and so the client the client binary is the thing that you'll want to use it's written and go right now so if you're a go user you can just compile the client right into your into your software if you're not going users where we're gonna provide socket connections so let's say you were a JavaScript air just for instance there'll be a WebSocket connection you basically you're a patient us to fire the binary up that will take care of all the key generation all of the loop cover traffic all of the kind of Mason any stuff for you and then you're you subscribe to events on that WebSocket and you can push events into the socket so from your point of view you're making a chat application with a WebSocket or you making some other application talk it in JavaScript and it goes into the the go binary the go binary goes hey cool does this guy have any like real stuff to send no cool send a cover message good or if you have real stuff to sin yes and will send will send your real stuff it will take care of all of that stuff for you and the the client also takes care of going to the directory server looking up where all the nodes are downloading like grabbing their public keys getting the whole network topology everything like that and then the client will automatically do your client-side writing for you so you never as an application developer need to think about you know what past am I going to choose or anything like that it's all done for you so if I had inside but for example asserted like a sentient file could I read prophase curl to the register file by going through its proxy locally you would need to packetize it that would be the one thing that you need to do in that case of you you need to chop up that file into chunks that match the size of the of the mix net packets and at the other end of your application you would need to provide some way of turning those packets into something that maybe gets reordered if you need ordering in your application so that's the yeah kind of it's uh it's like super anonymous UDP I guess we were just reinvented this one more thing that we've got here which is a quick demo of the credentials I'm just going to jump forward a tiny bit just to see you can see it running code we're just about to this was loading up some configuration files but basically what we have here is a wonderfully designed QT thing which basically will take some GRC 20 NIM tokens and just that's a kind of demonstration it's not pretty real reason what I'm trying to do is demonstrate the kind of flow so basically what's gonna happen is the client that's this white thing you see on the screen will ask for hey here's aetherium we're gonna ask for aetherium to basically pump some aetherium tokens into newm into this tetraman around which is what we're actually using for that for the validators that will create some names on in the in the tenorman side of things you'll then get back a credential from the validators so all these guys will respond to you and say cool yeah here's your here's here's each piece of your credential because you get a you know a threshold credential we can then re randomize their credential and I will show that working and then you can spend the credential with a service provider and the service provider can then redeem it over here and say cool pay me and we can have double spend reduction there as well so that's that's the basic flow of the cocoanut credentials so cool we just got ten nibs in we're gonna create a credential that code supplied names in this case don't get sucked in by thinking you always have to quit currency inside your credentials this is a very general purpose system so the name credential is the same thing as like like this application is like a smart contract as it's what's a smart contract is to the EVM the the basic thing underneath all of this is very general purpose cool we've got back a partial credential our client has reassembled it over here and I'm pressing the re randomize button and you can see the credential changing right there as I'm pressing it so I just free randomize at five times it has now the same five names inside the credential that it always had but it is a totally different credential than what we got back from these issuing authorities so they can't run on me anymore they can't tell who who who they gave it to even if they colluded unable to do that so we then send the credential former client to some kind of service provider to pay for something could be for anything um that's great the service part of redeemed it that means it's been spent I then tried to spend it again and it said no you've already spent it the really interesting thing I'm gonna reran demise it another five times here so you can see the credential changing again so sorry that's a bit thank you I try to spend it now and despite the fact that it's a brand new credential the blockchain has rejected it as being already spent so the cryptographic material in there has been recognized even if it's a different credential so we still have double spending protection even with the randomization cool that's pretty much it so any other questions how was your work thunder we have some investment from different sure it doesn't right now but eventually the vision is that it will eyes having that time to plumb it all together quite yet but yeah I'm not sure I don't know which be our instruction I think I heard yeah yeah and on the I yeah I can the person who invented the two people invented the scheme Martin Gritty here NS I'm not sure where they're planning to use that so I can't say sorry if I just wanted to say that following your question we're working on a research paper about this so in the research the public client will still generate the path but the mixed nerds will need to say what they saw and then factor afterwards the vieira comes into play everybody opens up the box and goes hey did did Timmy mix net no to like actually said the correct pockets and there's there's going to be a record of what he was supposed to have sent basically yeah is only produced special measurement messages which are checking the quality of service the regular messages is after the client what he is using wiping the power from the cloud he likes and so on thank you very much for at a time but if you want to keep on chatting out in the hall please come say hello and if anybody's interested in trying out some of the code or trying to develop against this and [Applause]