Threshold Workshop | James | Web3's Day-One-Decentralized Access Control Plugin | ETHDam 2024

[Music] all right so I've been introducing everybody else uh throughout your day now I have the pleasure of introducing myself uh I'm James I'm from threshold uh today I'm going to be talking to you about Taco Taco is an access control layer that is endtoend encrypted endtoend decentralized and has been since its Inception um why isn't being decentralized from day one why is that a big deal uh so the people who are building on top of Taco are dealing with some pretty sensitive stuff imagine having to secure something as important as inheritance or seed phrase recovery or Health Data uh these aren't hypothetical situations these are things that people are building right now with taco and they need private secure trust minimized solutions from day one the they are not problem spaces that can accept any sort of compromise when it comes to their decentralization um before I get into too much detail here's the link to a nice simple demo if you'd like to it just takes you to our a GitHub page uh it's a one page node.js uh demo I'll put that back up in a few minutes as well um so first of all what is threshold threshold is the first successful onchain merger between two existing projects those two projects were both wellestablished powerhouses new Cipher and keep and the result of that merge was a multi-application network centered around the concept of threshold cryptography um so consider the traditional approach to handling sensitive cryptographic operations for example digital uh signature digital signing signatures uh generating Randomness or um managing decryption Keys these operations in the past would have been handled by one entity one server um and that's very efficient but it centralizes trust and power and those are things we're really trying to avoid at the moment um threshold Network addresses those issues by spreading the cryptographic operations across a large network of nodes independent nodes independent entities that's an important distinction uh So within the threshold Network we have several applications that are builts on top of threshold cryptography uh the one PE uh one notable one is tbtc which is the largest decentralized Bitcoin bridge to ethereum currently with a tvl of I think over $180 million do at the moment and growing fast and that same network is what's powering Taco the access control product they're doing it's doing the whole thing so why does web 3 need Taco why is this important so in our journey towards these better digital spaces we we're aiming for platforms that respect our privacy they don't exploit us everything is fair um and transparent and a often overlooked piece of that puzzle is selective decryption uh what do I mean by that it's making sure that only correct devices correct individuals have access to certain data it's uh crucial for it's it's crucial for our digital interactions like who has access to what and actually it's applicable outside of web 3 as well um think of any anytime you are paying for something online and getting something in return that is a access control that is happening with a very simple condition of have you paid um and at the moment our tools are limited as developers um there are traditional methods like asymmetric encryption and public key infrastructure and these are great these are very secure um they do all the pro all the processing is client side which is excellent but they are difficult to scale well whilst maintaining user friendliness think like pgp on your email it's just it's it's not mainstream um despite being around for a very long time uh another alternative is to use centralized Services things like Amazon KMS uh they're very convenient but again you're placing significant trust in a third party who has repeatedly proven they do not deserve our trust and then final arguably worst option is uh what we refer to as dinos dinos will eventually go extinct it stands for decentralized in name only um there are plenty of services across the web 3 space that claim decentralization and when you dig in you'll find that the essential decryption Keys effectively are held by either one one entity or a small permissioned set of entities think Ren BTC which hailed itself as a decentralized Bitcoin to ethereum bridge and then wasn't it was just completely drained um these are the kind of things we're talking about uh so is Taco any different yes it absolutely is let's get into that um so how do how does how does all of this work how is Taco decentralized from day one so imagine we need to secure some data First We Begin by selecting a set of nodes from the threshold network uh let's say like select 30 nodes from the threshold Network we're going to refer to this group as a cohort a cohort of nodes uh the cohort of nodes undertake a distributed key generation process dkg uh this is a really important step um during during this process they are generating and sharing and aggregating and verifying a bunch of cryptographic material and if any node attempts to compromise the process the whole thing fails so the entire operation is designed such that only honest participation by all nodes will lead to success if anyone starts messing around bump it fails start again with a different set of nodes the end result of the D kg process is a public key and a distributed private key the public key is stored on chain for applications to use and each node in the cohort keeps its own piece of that distributed private key as a data owner how do I then you uh what do I then do as a data owner I want to encrypt and share stuff so first you would Define the specific condition under which your data can be encrypted um for example you're running a live stream and it can only be accessed if a viewer can prove that they own two specific nfts um just a a random example the those conditions that we've just outlined they are embedded within the data at encryption time so they're all packaged up together they're super flexible I get into the a bit more in a minute um but they are very modular and composable and you can have quite complex condition logic if you require that encrypted payload can then be stored anywhere this is this is super important so Taco is completely storage agnostic um which opens up a whole world it allows us to use our favorite decentralized Storage Solutions things like R weave things like IP PFS that have no encryption or sharing built in suddenly they're completely opened up um I can even use old school thirdparty centralized Services Amazon Google all of these kind of things any cloud provider you can think of and I am safe in the knowledge that the only person who can the only people who can access my data are those who satisfy the conditions I set no one else will be able to what about on the consumer side if I satisfy the conditions I want to be sure that I have access to the data that's a re you know it has to work both ways um so as a recipient I going to retrieve this encrypted payload whether it's on R weave maybe someone emailed it to me you know a side Channel however I get it I then present it along with my credentials to the threshold Network and this is where the threshold cryptography magic happens um when I present this package and I present my um my uh credentials to the network each node goes and verifies those credentials it checks those credentials against the conditions and each node makes a decision on are the predefined conditions met and decides whether to Grant access and return a decryption fragment um so again this is a really important piece the nodes are just returning decryption fragments they are not decrypting the data if a user if a recipient is then able to collect enough decryption fragments and reach the threshold which is the threshold in threshold cryptography let's say 20 of 30 once they've collected those 20 fragments they will be able to re rebuild the underlying plain text locally so the nodes never have any access to the um they don't see the encrypted data they don't see the plane text they see nothing they're just sending back these little pieces that mean the end recipient can plug them all together and rebuild the things they need to build so let's have a look at a case studies this is one of our uh earliest adopter Master file um Master file are attempting to transform how we think about digital digital content so imagine owning a movie or some music piece of art Etc not just as a digital file but an asset with Associated decryption rights people have talked about doing this with nfts and it's never quite worked this is how this is how you get it to work um by combining they they're building on taco and arweave uh So when you buy an nft from masterfile it's not just it's not just a receipt that you bought this film or this art it also acts as the decryption rights ownership of that nft is what grants you access to the content um and so you have because they're using arweave which is permanent storage and they're using Taco which will give you permanent access as long as you satisfy the conditions you now have access to this content forever it is effectively yours until you decide to sell the nft or transfer it to someone else or whatever you have full ownership of those access rights and at the same time the Creator is safe and happy knowing that they are getting paid directly by the sale of these nfts and they have no fear of unauthorized distribution um the only people who can access own the nfts so it goes both ways both parties win um if we compare this to the traditional model say like Spotify you spend years building up your nice playlists on Spotify and then one month you don't pay your subscription and boom it's gone it's not yours um you're locked in to paying quite a large sum of money over the course of your lifetime when you think of you know I'm not going to stop listening to music as I get older I'm going to be paying my Spotify subscription until the day I die which is a lot of money over the course of a lifetime of a person um these traditional media that traditional media companies are actually really interested in um web 3 and using it for securing their media but they are wary of platforms say using platforms say like open C where there's a real centralization risk they're the ones that are actually pushing for large they're the ones that are pushing for true decentralization because they're scared of unauthorized distribution and digital Rights Management um and all that kind of stuff and this is what this is what Taco solves all right let's have a should we have a look at some code live demo time what could possibly go wrong let's see I need to sorry I'm mirroring my screen oh great perfect perfect ah I knew it all right so I'm just going to quickly pop into thisn file this is not how you should do it in production this is just some basic configuration we need an RPC provider we need an encryptor provider private key and we need a need a consumer private key um the ritual ID refers to the cohort of nodes um that we talked about before that did the dkg ceremony and the domain is toer which is what we are calling our our test net um we will then do some basic setup I'm just reading in we need a connection we need to read in those private Keys um we're going to go and get the ritual connect to the provider using ethers and log some stuff um this is just some setup all right so let's encrypt first thing we do is um we can see here line 49 message equals two bytes of the message string so we're just going to convert the uh message our plain text to bites then we're going to set up a condition so our condition is these few lines the chain is 8002 which is polygon's test net the method is get balance we want to check the user address and we're going to compare greater than zero so all this is doing is checking that the user has a positive balance the as I said these conditions can be extremely generic uh we can provide a contract address in the condition and then any method that we like that exists on that contract um and any return value test so if you have extremely complex ition logic you can just deploy a smart contract that contains it all meaning it's super transparent for your adopter and users and then point this at it they're also composable uh you can do things like checking the block height if you want time based conditions so it has the block height has to be greater than this and less than this so you get a nice specific window and at the same time this function on this contract returns true and this function on this other contract returns false um and the user must have a positive balance you can just plug all of these things into each other and get some nice uh complicated and updatable uh condition logic and then we call the encrypt function from the Tacko web API this is this is literally as uh complicated as it gets provide the provider the domain which was the test net the message our condition um which cohort we're using and who is who is signing this who is actually encrypting this and then we'll return those bytes on the decrypt decrypting side it's even easier we get a message kit using from byes and then we call the sorry we call the decrypt method again from the Tacko web API and provide a few of those same pieces of information and that's all we need to return it's it looks like more lines of code than it is but really there are about three lines of code that are actually happening here we've abstracted away all of the work for you um and then so if I run this example this is actually what will be happening I'm just going to connect print the string um what the cipher text is get the decrypted bytes I will yeah call encrypt two bytes print what I get then I'm going to call decrypt from bytes and print what I get and of course they should be equal if everything is working well uh so let's uh of course my terminal is opened on the other window apologies there we go we have a excellent going to all right let's run this so we're printing our config all right it's already done amazing uh it's super fast this is our message this is the cipher Tech when we encrypt it um uh we send it off to the Taco the threshold Network and it all comes back and we're able to decrypt locally amazing that's because I know that that private key has a positive balance uh how do I prove that this is real and I'm not just you know printing some nice stuff for you well let's change the condition let's make the condition such that I have an absolutely massive balance on testnet something like this I can tell you that I don't have this much testnet polygon Matic uh so now encrypting again excellent we get the cipher text back we then take that Cipher text send it to to the threshold Network and this time the nodes say absolutely not so the threshold of responses is not not met that's the threshold in threshold cryptography and we can see the individual responses um rate decryption conditions not satisfied the nodes all agree that the decryption conditions are not satisfied okay um so yeah that's as easy as easy as it is just a few lines of code and your you've got your decentralized endtoend access control um we have a booth downstairs um an very active Discord bounties please come and say hello if you have any questions come downstairs and say hello we're nice and friendly and thank you for listening I really appreciate it [Music]