Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Ava Labs x CBER Ep 7: Blockchain Privacy and Regulatory Compliance
41 Plays1 month ago
Professor Fabian Schär (University of Basel) discusses the ability for blockchain users to attain privacy in their transactions while also remaining compliant with regulations. Of note, prominent blockchains do not provide anonymity as commonly believed; rather, forensic methods can be used to reveal the transaction behavior of users. Mixers (e.g., Tornado Cash) combat forensic methods and offer further privacy. Nonetheless, mixers have come under regulatory pressure because they can be used for illegal activities such as money laundering. This podcast explains why blockchain identities are not anonymous and the details surrounding mixers. The podcast then explains a method whereby a user employing a mixer could prove that they have not participated in money laundering, potentially achieving both privacy and regulatory compliance. Regulatory implications are discussed.
Recommended
Transcript
Introduction to 'Crafting the Crypto Economy'
00:00:06
Speaker
Hello and welcome to Crafting the Crypto Economy. I am Silvia Sanchez, Project Manager at OWL Explains by Avallabs, and today we bring you a transformative podcast series in partnership with the Crypto and Blockchain Economic Research Forum. This series features leading faculty from renowned global universities exploring various elements in the blockchain ecosystem. These episodes are a bit longer than our usual hootenannies, since we will be getting very deep.
00:00:33
Speaker
And also, each episode will have its accompanying paper posted on our website for further reading.
Blockchain Privacy with Fabian Scherer
00:00:38
Speaker
And with that, I will hand it over to our moderators Fahad Saleh and Andreas Park. Hello, everyone. and Welcome to another edition of Aole Explains Crypto and the Crypto Blockchain Economics Research Forum podcast series on crafting the crypto economy. Today, we're very happy to have Fabian Scherer here with us. ah Fabian is a professor of distributed ledger technology of blockchain and FinTech at the University of Basel. He had the Center for Innovative Finance. He's written um his PhD thesis and a book on Bitcoin blockchain and crypto assets. And he has been an expert for several hearings for central banks, the OECD and IOSCO. So for the particular topic that we're just in today, he is one of the people in the world that have thought about this most deeply.
00:01:27
Speaker
Now, what we want to discuss today is blockchain privacy, broadly defined, and then some specific ah proposals that Fabian made together in a paper with Vitalik Buterin on how to enhance blockchain privacy. So for just for some background, I myself come from the field of microstructure, which is talks about trading and markets. And I was drawn to blockchain precisely because of the lack of privacy. So one thing that I realized when I looked into this first was On the blockchain, you can see everything that people have done. And in microstructure, normally, this is data that's incredibly hard to get. It's very, very sensitive. And really, nobody wants to give it to you. ah Whereas on the blockchain, everything that's just available, and I thought this is super cool. um But as we, and anybody who thought about this more deeply knows quite quickly, this is possibly problematic.
Why is Privacy Vital in Blockchain?
00:02:17
Speaker
um Now maybe I should, instead of me blabbering about this, maybe I should have Fabian talk a little bit about this. So Fabian, why don't we just start and tell us why why did you get interested in blockchain privacy and what what brings you to this to this conversation?
00:02:31
Speaker
Thank you very much. I think there was an an excellent introduction in Rails and you already outlined really well the problem and also that there are many facets to it. From a researcher's point of view, obviously it's it's it's great. It's wonderful if you have all that data available. and so With my researcher head, I see the same way as you. I think it's amazing what you can do with that data. um But it would be nice to think that we are the only ones collecting that data. And so there are certain risks involved. And I think as we we probably get into later on, ah privacy has some value and is something really important, right? And the world without any privacy is probably not a good thing.
00:03:08
Speaker
But first of all, thank you very much for the invitation. It's a great honor to be here also to you for and then looking forward to this conversation. I know it sounds great. So let's start with something very simple, right? um You know, in principle, all transactions on a blockchain are done by accounts.
00:03:26
Speaker
Right? um These are essentially addresses, public addresses. you know I'm i' skipping over some details here. And they are pseudonymous. So, there's just a collection of letters and numbers and you know nothing says something about an individual. why Where does the where's the problem of privacy comes in here? Yeah. For Ethereum, you're absolutely right. think I think this will be probably be the the main blockchain we talk about and the main system we talk about today.
00:03:53
Speaker
um There are other models, and even if we just talk about Bitcoin, yeah are there is not really such a concept as accounts. It's it's something a little different. It's called UTXOs. But of course, in in principle, you're absolutely right. It's represented by pseudonyms. So you will never see Andreas, so far, the Fabian on the blockchain directly. and But we have pseudonyms, which look a little bit like account numbers. And initially, even if you read the Bitcoin white paper,
00:04:22
Speaker
um Many people thought that this pseudonymity might be sufficient to obtain some sort of privacy. I would make the argument and I think this is not too controversial by now and many people agree that this is completely insufficient because once you have my address as an example because we interacted once, we had a train transaction going from you to me or from me to you, um you know my address, right? And even if I if i switch my address as this is quite
00:04:54
Speaker
common in the UTXO model, you can still see that I have switched my address and that another address is associated with this first address.
Technical Insights: Blockchain Transactions and Pseudonymity
00:05:01
Speaker
So what you can do is you can construct this transaction graph and you can pretty much see anything I have done in the past and anything I will do in the future. And this is, of course, extremely powerful. It is exciting from a researcher's perspective, but it's also quite dystopian when you think about it, what other people could do with that. Can I just ah i just ah interject with this? ah A slight technical question on that point about um using the transaction graph to essentially infer the activities of ah of a particular person. um how How precise i is that? like Are these heuristic algorithms or that that work with high probability or are they actually
00:05:47
Speaker
I guess what I'm saying is from the transaction graph, graph ah what guarantees do we have of the extent to which you can actually unmask the behavior of people? And does it depend on whether we're talking about something that uses a UTXO structure like Bitcoin versus more of this account-based system that we see on, for example, Ethereum? It does to some extent. Both of them are pretty bad.
00:06:09
Speaker
So, I mean, there is very little privacy right and on either one of these systems by default. And the idea is because it's it's a public blockchain and you have to be able to validate everything by default. All of these transactions are completely visible and the entire transaction graph is visible. The reason why I say it still matters is because ah in a plain vanilla setup with an account-based model, which is using one address for all kinds of interactions and any of the transactions you're sending out are coming from this address.
00:06:40
Speaker
So even if you interact with smart contracts, initially, it starts with a so-called externally owned account, which is just an address. That's super easy. And also, I mean, yeah, you can you can basically say with certainty when when something originates from an address that is the same person. When the UTXO model, it's a little it's a little different, right? In the UTXO model, you usually, when you get a change, so you spend the UTXO,
00:07:04
Speaker
And let's say this UTXO, this output has a value of 0.1 Bitcoin, and I only want to spend 0.01 Bitcoin, then the the rest, the difference, the 0.09 Bitcoin go back to a newly created address of mine.
00:07:21
Speaker
This is basically the separate UTXO. And then for an observable, ah you would need some heuristics to determine which of those UTXO go to the destination, the new destination of which of those are just a change address. So there you need some heuristic.
00:07:36
Speaker
and based algorithms. By the way, so in the account-based system you could do something similar. as with an i mean I see your point about like in the UTXO system you sort of have to break your notes and so there's kind of this natural point where you're going to be basically outputting to yourself um with a different address probably. But in in an account-based system you could also just send your funds um ah To yourself with a different account and you could even make a practice of like every time I send funds to anybody I will actually have the out I'll actually send more than I need to and I'll break it by sending It to somebody else. I mean a little bit to one of my other accounts um but I guess my real question was more about let's say take that note breaker idea from the UTXO structure and
00:08:25
Speaker
um How reliable is let's call it the science the forensic science of correctly determining. ah ah This correctly determining which addresses actually are mine.
00:08:40
Speaker
ah Is it heuristic, and to what extent ah can we be sure that it actually is successful at, let's say, de-anonymizing? In many cases, it's probabilistic. For example, the the example I just mentioned, where you just have these two outputs and you don't necessarily know as as an outside observer which one is the change and which one is the actual payment, there, of course, you have many potentially identifying characteristics that you could use.
00:09:07
Speaker
perform from all the data, but it's it's never 100%. But of course, there are exceptions. So then on the transaction graph, let's assume um that you split a UTXO and then later on into let's say five five new UTXOs and then later on some of them are joined together again. and This is a pretty strong indication that this is the original person. That's just one example, right? So there are various heuristics by which you can obtain a relatively high probability
The Dystopian Risks of Public Blockchain Transactions
00:09:38
Speaker
that you have the right person. And of course, the data is here. It's immutable. it's It's not going anywhere. And the algorithms, the information we have, and the things we can use to make sense of it, they only get better. So so also the computational resources, of course.
00:09:55
Speaker
But maybe it would be before we go into the the the the real details of all the the tracing, maybe it's useful for the audience to just actually get an idea of the extent of where this is and how this is problematic. So the way I think about it is um you make a payment, right? So imagine you use the blockchain actually just to use a payment, maybe in a stable coin. So you have your wallet and you you go somewhere and you purchase something. um Let's say you do it the online, obviously, right? This is ah this is the obvious application.
00:10:22
Speaker
You go to an online shop um and as a consequence of this, basically this shop would have the ability to see anything that you do thereafter. If you go to a competitor, if you buy a complimentary good, anything that you've done.
00:10:36
Speaker
If you go to a newspaper, you have a subscription that you pay with your crypto. They can basically see whether you went to a liquor store afterwards, like or if you go to buy anything other than that you know that is socially as acceptable, like marijuana in some countries and so on. They can see all of that and potentially use all of that ah you know in some form.
00:10:55
Speaker
to describe you in your against you in some form. thats That's probably a correct depiction here, right? Unless you unless you do something else. Absolutely. And but this even versus something I mentioned earlier, right? It's not even just the past transactions. It's also potentially the future ones. So they can grace you back because all of the data is stored immutably.
00:11:14
Speaker
But also they can observe what you will do in the in the future and just keep watching. And because they can link it to a person, they actually know everything about you. right So same thing, for instance, if you pay your taxes with crypto, if that's ever an option, they could actually see anything that you haven't spent your money on thereafter. So this is i mean this is there's a lot of things that i could be quite dystopian and unsettling about this. So now let's talk maybe in in your paper with Vitalik, you proposing some solutions but maybe we can talk for a moment about the existing solutions that we have and that brings us straight to a very controversial topic which is tornado cache. Would you be able to explain maybe to the average audience that is just maybe interested but doesn't really know how tornado cache
Tornado Cash: Anonymity and Controversy
00:11:59
Speaker
works? I can try.
00:12:02
Speaker
With which this context, right and now that we understand that there is absolutely no privacy by default in public blockchains and what you're doing is essentially publishing your entire transaction graph and your account statement and all of your palances and everything about you out in the open and communicating that to the entire world, there clearly is some need for some form of privacy. And you know the two extreme
00:12:29
Speaker
positions would be, they could say, everyone needs to be completely anonymous. So you can deduct absolutely no information whatsoever. That would be one end of the spectrum. And the other end would be you have no privacy whatsoever. And as you will see later on, probably an ideal solution is somewhere in between. Now, tornado cache was one of the most popular ah solutions to that problem.
00:12:53
Speaker
and and Some people refer to it as a mixer, some refer to it as a privacy enhancing protocol. What it does essentially is it's like a pool of assets and you have deposits, you have withdrawals,
00:13:08
Speaker
Anyone can clearly see what addresses have deposited to Tornado, and anyone can clearly see what as addresses have withdrawn from Tornado. All it does, it breaks the link between the deposits and withdraws. It uses something that's called zero knowledge. The knowledge ECK snarks to be specific, and all it does, it it verifies whether somebody who tries to withdraw has previously deposited to that pool without revealing the link between a specific deposit and they would crawl. And thereby, you get some form of privacy, and depending, of course, on the size of the anonymity set. right if If you're the only one using that pool, then you will get no privacy whatsoever. So as the number, so if there's one person, it's clear as you don't know, but if there's two, it gets a little more private, but you kind of you're mixing with an individual with a particular entity, or whatever, i one address. And if there is a million, then it's very unlikely that there's any way of associating one with the other.
00:14:06
Speaker
right That's probably the way to think about this. Exactly. Okay. All right. that's That's quite interesting. um It's probably useful actually maybe um if we just, if i and I'm just going to interject this just for the audience to understand is, um you know, there is various different perspectives for privacy in in the world and and in particular say European Union, canada so I'm in Canada here, Canada, the US and all, they have actually different viewpoints on on what privacy you're entitled to and what you're not entitled to. The US, for instance, has very strong protections against searches. So you cannot, as a policeman, go to a house, a car, or any other private property and and just make a search without you know for for any form of illicit activity or the like. right Even if you suspect that you need a court order to be allowed to do it.
00:14:57
Speaker
um or you need the permission of the person to do it. But there's a curious thing, by the way, in the US, which is the Bank Secrecy Act. I'm i'm not sure how if if you guys know about this, but so the Bank Secrecy Act essentially is the opposite of it. but It basically it says that because you deal with a bank, you revealed information to a third party already, and therefore you have no protection from searches.
00:15:19
Speaker
um Notably, in Canada, for instance, that doesn't apply. If you are using a bank, you actually have a reasonable expectation of privacy. There was recent a recent Supreme Court ruling actually in Canada on that. um And I think Fabian, you're in and Switzerland. You also have a different view on that one here. Oh, absolutely. as So what what people what what privacy people are entitled when it comes to information that they share with their financial institution. So it's kind of important to understand that it's actually various different viewpoints on that.
00:15:48
Speaker
There's also questions about the public space, right so but it's acceptable to have CCTV cameras to monitor the public space. In the UK, this is very widely acceptable. In in China, it's it's common practice not only that the cameras are there, but they are also used to identify you in person. And I think in other places, this would be not just frowned upon, but would lead to possibly a revolt. right um So I'm not sure what the rules are in the US, s but the important part here to um to to emphasize is that there's really quite different understanding of what privacy you're entitled to. And this is where this blockchain, the world of blockchain gets quite interesting, right because
00:16:29
Speaker
Blockchain is a financial transaction um or rather blockchain assets, at least in many cases have a financial use. and you know They can be shifted around without the financial institutions that normally would be used in order to monitor who you are, what you do and the like. and and know we're We're worried that this could be used at scale for some form of criminal activity. right So this is really why we're talking about but why there's actually any controversy even around the usage of tornado cash. If it was a matter of I want to protect my privacy, I don't think a government legitimately, I mean most, at least not even not the US, would legitimately object to this kind of level of privacy that you want to have for yourself. So really the the question that we have is the problem of illicit actions.
00:17:16
Speaker
And I think, in a way, you've thought about this very, very carefully, right? And and you've kind of tried to figure out a way how you maybe can can solve that problem. So let's first start with, if you go back to tornado cache as a mixer, I think the concern that you have is that you know if the three of us create this mixer um to to to to hide our, I mean,
00:17:38
Speaker
maybe with some other people that that scan is not a problem but the problem would be if we have if we invite a criminal in right who mixes their money yeah and therefore uh mixes his or their dirty money with ours right and so this is this is this is where this really comes in and maybe i'm not sure Fabian do you want to comment a little bit about what's going on also on the legal space there with with some of your cash no i think that's the concern and this is also what makes it um extremely controversial. and Essentially, there are two use cases, right and you you already entered the world's both of them. Either I can use tornado cache to legitimately get privacy on funds that come from a legitimate source. and because i mean Clearly, there's some demand for privacy
00:18:26
Speaker
even for legitimate funds. I don't want just the entire world to see what I just bought. I don't want just a random third party and to be able to to trace all of my future payments. so There is some legitimate demand for privacy. and The other one, as you also ah point out, is illicit activity. With tornado cash specifically, there has been a lot of empirical evidence from the on-chain data. And in some cases, it was completely clear that it has been used to obfuscate where forms that originated from a hack, for example, landed on. So essentially, money laundering, right? That's what it also has been used for. On, I think it was August 8, 2022, so a little more than two years ago, the US Treasury, OFAC,
00:19:17
Speaker
placed the tornado cash, smart contracts on the SDN, which is the sanctions list, which was quite interesting because even though there have been crypto addresses on the sanctions list before, this was the first time when a smart contract, so protocol was placed on this list. So this was something completely new.
00:19:37
Speaker
And I think the main reason why they did it that, at least that's also what they stated in the ah press release, is because there was a lot of evidence that tornado cash has also been used by a North Korean hacker group. And I think this in particular is why this this entire topic is so charged and so controversial, right? Because there really there are these two use cases. Now I can also maybe elaborate a little bit how I see it. I think there are two risks associated with privacy or the lack thereof. I think if you if you have the complete anonymity, and if I can just do whatever I want in the financial system without any chances,
00:20:23
Speaker
of being called if it's something illicit and clearly that's not good. like think It's basically anarchy in the financial system and I would say probably everyone agrees that there should be a certain threshold where you face consequences and that there should be some way ah for the police and regulators to find out when something went wrong. but so Long story short, I think we have to face the fact that there are bad people in the general public. but Obviously, not all of them, there are legitimate reasons for privacy, but there is some group with bad intentions. And I think this is well understood by by policymakers and regulators and pretty much anyone. Now, the the second risk might not be understood as well, unfortunately. This is the risk that in governments,
00:21:16
Speaker
and the institutions, there can also be bad people. And it's probably also not a good idea if you grant full power to see everything, to observe everything to a government official. This is what I was saying earlier, right? There there are all these two extremes, and probably a good solution is somewhere in between. So ideally a solution where you can create a separating equilibrium, where people who have nothing to hide,
00:21:45
Speaker
can retain some privacy, but then criminals, and I think the hard part is who defines who a criminal is, because this also depends on the on the societal context and everything, um they cannot use these tools to obtain some privacy, right? But you already see, I mean, I will argue it makes a big difference whether we are talking about at a democratic state, right?
00:22:14
Speaker
where the majority of the people would say the law and the policies and everything are legitimate. Or if they're talking about a state where there is a potential dictatorship. right I think privacy in one is much more valuable than in the other. And I'm afraid that in many cases when policymakers discuss these topics, they just see the first problem. They understand that there is a risk that the general public might try to cheat.
00:22:43
Speaker
I try to evade taxes, I try to loan the money, but they don't understand the risk of this absolute power. and what it could do to an an institution and even to a government. large extent Well, I mean, i you know, I mean, we can have this debate, obviously, for for hours on this topic, but I don't think actually need to go all the way to a dictatorship to to have a possibility where ah somebody in a position of power and a government can inflict pain and costs and damage you
00:23:15
Speaker
Even in a democratic state and so the fact of if you give people power I mean this is something that we know if you give people power power corrupts people abuse power and things can go wrong right so you know a I mean the reality is is that you there's so many different ways in which you can be put to ah good but could face some pain. right So you can have a and review which is not ah it's not legitimate, where somebody just imposes a cost on you. There's so many different ways how this can go wrong.
00:23:46
Speaker
um and know i think I think there's there's as much broad is's even broader than what you what you bring up, if if I may. if i No, I agree. And I think people also have to understand that this is not a steady state. right This is a constant shift. So I trust most institutions today. I think we are in a very exceptional historic period where we have strong institutions, where we have, for the most part, really good institutions. But it would be incredibly naive to believe that this could never change.
00:24:14
Speaker
right and that you If you put something in place, and if you say this is all this this is potentially a very important building block for the financial system, then you always have to think of the future and what could go wrong. and It's not a good idea to put something in place where there is no privacy whatsoever. but but By the way, if I can just add a little bit here, it's not clear to me that the The good faith interest in having privacy always has to do with concerns about government. Sometimes it seems like it's even concerns about business. right so For instance, if you're going to promise me that the government is perfect and so on, and let's just you know take that as an assumption.
00:24:53
Speaker
ah I still might be concerned that if I have all this public data out there that businesses are going to use it to manipulate my behavior, to enhance their bottom lines, et cetera. um So I don't think we you really have to even be skeptical about government prospect prospectively to want to or to believe that there could be a positive value to privacy ah from a good faith actor.
00:25:22
Speaker
Oh, and it goes even further. You can imagine that you know ah then ah somebody has, let's say, in a legitimate child that they want to support without the spouse knowing or something that happened in their past. They want to conceal it and they have a right to do this, even though this is you know very much in the private space, that also is something that you should have the right to to privacy to. right so There's a lot actually it's a huge spectrum of different areas where you can expect to have a right to privacy. and Even if not everybody agrees to it, I think you know there's choices that one makes and and go and countries have made these choices that they protect people's privacy no matter what. right so
00:25:59
Speaker
i think So this is actually, I think, I mean, it's an important discussion, but in some sense, it's important to say, we can't just throw this out of the window. And just because something of financial value is involved doesn't mean that you can lose all rights through privacy, right? So you have privacy to to to your writings, right? To to communications, right? So and and and money is is something that, you know, you shouldn't lose it just because something could have value you in in a different form, financial value.
00:26:26
Speaker
I think it would be incredible danger incredibly dangerous so and with many examples that we've just mentioned. so Now, let's talk about going back to um something that you said, and and I hope I'm not putting you on the spot on on something which is but its really hard to do, but you mentioned um when you described how tornado cache works is that when you do the withdrawal, you use what's referred to as a
Understanding Zero-Knowledge Proofs
00:26:49
Speaker
zero-knowledge proof. Now, this is something which is a very, very technical problem, but I'm wondering if you for whatever reason since you thought about this so hard and so for such a long time you maybe have an explanation to explain to this audience just how is your knowledge proof works is that something that you can come. I mean on it on a very high level what it does is you prove whether something is true or wrong so you can prove a fact without revealing any additional information besides the fact that this part is true like that's that's the basic ideal.
00:27:21
Speaker
And for CK snarks, specifically, CK obviously stands for zero knowledge. Snark, yes, is for succinct, which means that you can efficiently prove that. So it's neither use a lot of data, nor lots of computations, which is of particular importance, of course, in the blockchain context. And then the NA, the non-interactive means and that you don't have to go back and forth, right? So there are many variations of zero knowledge proofs, where you give me a challenge.
00:27:54
Speaker
Then I reply to that challenge. And then it's it's ah just a probabilistic a concept where you keep repeating that, you send me new challenges and new challenges and new challenges. And after a while, if I get all of them right, then you are convinced.
00:28:07
Speaker
for this particular context that I'm telling you the truth. But this, of course, only works in an interactive way, and it only works for one ah pair of prover and verifier. And this is also not too useful in in a blockchain context, so it must be non-interactive. And then the argument of knowledge part, it's just the idea that you can prove some statement. and What you're doing in this context in particular is two things. Number one, you're proving that you have previously deposited,
00:28:36
Speaker
So you you know some secret that is associated with a prior deposit. This is important, right? If they this would not be the case, then anyone could trust the problem that would not be ideal. And the second part, which is equally as important, is that your deposit can only be used once. but So it's it's essentially a double spending protection. And this is done with something that's called a nullifier.
00:29:02
Speaker
And the basic idea is that as a by-product when you're computing that proof, ah you end up with a deterministic number, this nullifier. It's always the same for for for a given deposit, but it cannot be associated with the deposit.
00:29:19
Speaker
And then you have this list of all the previously used nullifiers. So when I would try to spend the same deposit again with crawl the same fonts again, essentially, then you would see even though the rest of the proof matches out that the nullifier has already been used up and is already on the list. And I mean, I'm i'm not going into the details of circuits, but essentially what you can think of a circuit and then This is basically used for proving and verifying. It's like a function where I can prove to you that given a certain set of arguments that includes the address where I want to withdraw to, some additional information and and and specific and nullify ah and that and of course my proof that this is a valid proof, right? So that i i'm just ah you can easily verify using the verifier circuit that I, given these parameters, have spoken the truth.
00:30:11
Speaker
so In a way, this is actually i mean you know intuitively, in many ways, there are different components here that you describe. right so The one thing is that you prove something to somebody without revealing actually what it is that you even prove. right so I think there's one part, and then the other part is that you have to make sure that there's a double-spend protection, right so you can't do the same thing twice. right so that's i mean it's It's very fascinating as see how this works. and Ultimately as I understand that this is essentially based on math right and it's based on science um Which is for those you know who listen who you know it maybe it's a useful piece of information it It's not something that somebody comes up in a garage is actually ah Number theory right ultimately number and graph theory. I think is involved in this topic so now assume
00:30:57
Speaker
that all of this, I mean, we know all of this works in tornado cache. I think that the Zero Knowledge Boost works there too. So, but what is the innovation that that you have come up with, which makes this, ah should make this all of a sudden palatable, what's palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable, palatable,
00:31:22
Speaker
pal I'm not sure if it's acceptable, that's not for me to be frank, it's a proposal. something we looked into and essentially what we have tried to do is find some middle
Balancing Privacy and Regulation: A New Proposal
00:31:33
Speaker
ground. Like I already said multiple times that an ideal solution is most likely not at the two extreme positions, it's somewhere in between. And this is exactly what we have tried to propose with with this paper. But I think we first have to take a step back again, once again to tornado, because and I would argue a first relatively simple implementation
00:31:57
Speaker
of ideas that go in the same direction already have been part of tornado cache with tornado cache there was something implemented that's called a compliance tool and the basic idea of the compliance tool was that with your private information that you had you could disclose to the third party of your choice how your withdrawal is linked to the deposit. And you could prove that mathematically. right So as an example, let's say you Andreas, you are the the bank, commercial bank, and you're accepting crypto assets and I'm the potential customer prospect who's bringing in the crypto assets. Then what you can see by default, what you can always clearly see is that I have
00:32:41
Speaker
previously used tornado, right? This would be visible on the blockchain and this fact that I've been using tornado would not be hidden. But of course you could not go further back without any additional information because then you have this privacy enhancing pool and you would not know to which of these deposits might have been linked.
00:33:00
Speaker
So what you could do in that case, and this has been part of the original tornado cache proposal, is you would ask me, Fabian, can you give me the additional information I need, basically a proof, to link that withdrawal to a deposit? And when I give you this information through that compliance tool, then you could analyze the blockchain or transaction graph as if I had never used tornado cache in the first place. I didn't i mean, in a in another paper, and that we have published before the one it just referred to, and we've published with the Federal Reserve Bank of St. Louis, Mathias Nordland, I have argued that there would have been other options than just outright sanctioning all of the use cases for tornado cache. So ah what the the Treasury could have said instead, that just as an example, is whenever you use it and you want to use these fonts in the
00:33:57
Speaker
that context in the regulated context, like for for example, going to a commercial bank, then you have to provide that proof to the commercial bank that you have to show where these funds went through. I think this would have the advantage of giving the user privacy um against everyone else. torqueify everyone else right So but basically did the rest of the world and everyone observing the blockchain would not know anymore how these phones are connected, how the deposit of phones are connected. But for you as the commercial bank, you could still make that link. You could do the KYC checks, you could do the AML checks as if I have never used tornado cash in the first place.
00:34:41
Speaker
So but if I could just ask for one, let me just interrupt for one second just just to clarify. So um I mean, I think you what I'm just going to say is probably not as clever as what you have in mind. But I mean, basically, what you're saying is, okay, so I use tornado cache somewhere in a step multi step of 20 different transactions and somewhere in between is tornado cache. And so all that you're saying is you have just you just tell them what are the 10 steps that I use before tornado cache? Is that what you're saying? Or is there something clever, which No, it's it's it's I would argue it's clever. I mean, what you can do is um the link that is broken by tornado cache is really just the fact that an observer, an outside observer cannot associate the withdrawal of the deposit, right? And what I could do is I could tell you, you being the commercial bank in that example, I could provide to you the proof how my withdrawal and how my deposit are linked to each other.
00:35:36
Speaker
So there's a mathematical proof where I can basically disclose and show you proof to you that this withdrawal originated from a given, from a specific de deposit. And once you have that proof, once you have that information, you just use the tools that are already in place. right I mean, this blockchain analysis is something banks are doing anyways.
00:35:59
Speaker
So when whenever a customer comes to a commercial bank and they are not using Tornado and then of course the commercial bank is obliged that they look into the transaction graph where this is coming from, they ask the right questions. and So in a sense nothing would change if you ask for this information.
00:36:16
Speaker
One thing would change. and this was This is what I try to argue. but I don't have to disclose my entire transaction history to the entire world. I just give it to you. There's some trust required, but no one else will be able to see it. So I'm just going to give you now exactly an argument for why that is not actually acceptable either. um If you're a hedge fund and you um and the recipient of funds is is another um institution where you want to make some investments with,
00:36:43
Speaker
And you know your your your hedge fund strategy would be visible from your public addresses on the blockchain, but if if property disclosed. Then with this mechanism, the recipient of your funds would still be able to figure out your strategy, which is kind of a business secret that you want to avoid at all costs. right So um in some sense, even though you give this to one party and you say, OK, for compliance reasons, I have to provide some information, but you already but begin, you actually come you know you're probably providing too much information. Oh, yeah, I agree. I mean, it's far from perfect. And also, if I can add to that, another problem of that solution is you have to cross this one entity, right? I mean, in in this case, I clearly have to cross two. So it's far from a perfect solution. Well, I think with all of these proposals, what we have to realize is there will not be perfect privacy in a regulated context. And I think there's this
00:37:41
Speaker
For some people, and I probably would count myself one of them, this is very unfortunate to hear, but I think it's realistic, right? Because that there is crime, there is illicit activity, and obviously there needs to be some regulation. And that's why we tried to come up with something, and I think this is now the segue to the other people.
00:38:02
Speaker
that like just to report Before you go there, can I just ask ah a sort of a high-level questionnaire about sort of the typical use cases for a good faith actor? Because we've been talking now about basically it sounds like using tornado cash as a way to transfer funds. um So say I want to pay you, I deposit at tornado cash and provide you the information so you can withdraw. Sounds like that's what we've been discussing.
00:38:28
Speaker
um i But I suppose another case that I was thinking about was something like, I want to use this to sort of i detach my own history for my own future. So I deposit with one address, and then I withdraw with a different address. And then, you know, presumably, then you don't know those two people are the same. What is so I guess, yeah, for the good faith actor, our Which of those two I guess is the is the usual use case? um Because I actually hadn't thought about this idea that I'm going to use it basically as a way to ah to to transfer funds ah to somebody else. I had thought of it more as just a way to kind of detach my own transaction path from my transaction future.
00:39:15
Speaker
There are both variations, right? There are implementations, and this was not the original tornado implementation, to be clear, but there are the options that you can have transfers in the pool itself, that's possible. and With the traditional tornado implementation of the original one, this was not the case, there you really use it, you break the link. So, let's say we there was a transaction in the past between the two of us, but And then I don't want you to be able to observe my address anymore. What I could do is I could use the rest of my fonts, move them to a tornado, set up a new address, and then you would not be able to watch my address anymore because you don't know which one of these withdrawals we need to be deposited. That's the basic idea. So I would say this is the most common use case. I see. Okay. I'd like to give you a somewhat more practical example. I'd imagine you have
00:40:06
Speaker
10 or 15 separate addresses on the blockchain with fonts on them. And then you want to deposit them with a commercial bank, the one that accepts crypto assets. Now, let's further assume that these 15 addresses are not linked to each other in any way on the blockchain. At least here in Switzerland, I don't know of all the countries, but here in Switzerland, most of these commercial banks that accept ah crypto assets, they give you one deposit address.
00:40:37
Speaker
What would happen in this case is just by depositing these funds to the commercial bank, I would leak to the entire world that these 15 addresses are related to each other, are connected to each other and belong to the same person, which is not a good idea. right This would give ah just the general public so much more information to work with and something that clearly I would not need to disclose to the general public. Of course, I need to give some information to the commercial bank, but this is not something that should be on the blockchain. So what you could do,
00:41:07
Speaker
If you were allowed to use something like tornado, the privacy nonsense and protocol, is you could move these funds through that protocol first. You could provide the proof where everything came from through the commercial bank. They could still check it. They could still do all of the KYC AML checks with you.
00:41:24
Speaker
But the general public, all the third party observers would not be able to understand, they would not be able to see that these 15 addresses belong to the same person. This would be just one very specific example of a use case. So now let's move on to the particular proposal that you had that you worked on with with Vitalik and and you other co-authors. So what what exactly is the trick that you're going here for here now? so so Because this one is much cleverer, right? than the partial revelation and the trust that you need for a particular entity, right? I would say it's an extension of it. Yeah, it's more flexible. I mean, what we talked about so far ah can also be achieved with with that proposal. It's actually just ah a subset of the solution space, as you will see. So, yeah, you're more flexible. and The paper is joint work with Vitalik, as you've mentioned, with Mathias Nordl, I mean, Soleimani and Jacob Billum.
00:42:22
Speaker
And basically, we wanted to find various ways in which something like a privacy enhancing protocol, something close to tornado could be used potentially in ah in a regulated context. And I think it's very important to state once again, potentially, because clearly it's not for us to decide whether that is legal or not. um What we do in that paper is ah we try to find solutions ah for a protocol that gives you a lot of flexibility and at least in theory would allow to be combined with whatever is asked of that person. like and at The most extreme case would still be this one-to-one proof where I just would completely disclose everything to you, or you could even be an extreamer, you could say you completely disclose everything to the entire public, then it wouldn't make any sense anymore. We could also do that.
00:43:18
Speaker
Now, what is new is um that you can form association sets of of any size. like that the I would say one of the problems with tornado cache is that you have a really hard time ah dissociating yourself ah from a known hack, let's say. the only The only option you have with tornado is just providing that 100% proof and link your deposit with crawl and give it to someone.
00:43:43
Speaker
What you can do with the extension of privacy pools is you can create custom association sets, where you, for example, say, um my withdrawn is one of these 10 deposits, and I can prove that mathematically. I'm not telling you which one, but I can construct the proof such that you can see that my withdrawn is one of these 10. Or what you could also do, and mathematically, it's really the exact same thing,
00:44:13
Speaker
um You could create ah an exclusion proof where you say, my withdrawal is any of the deposits except for this one. There's this known hack, that's not me. And I can mathematically prove it, that's not me. Or if there are if there is evidence that not Korean hackers have used the protocol, you can clearly provide a proof that this is not you.
00:44:35
Speaker
So you have you have lots of more options you can prove against multiple association sets. And the basic idea is that whatever might be the requirement from a jurisdiction, you can put it in an association set. You could do one with with just KYC addresses as an example, or whatever restriction you might have in place, and then prove that you're part of it.
00:44:57
Speaker
so I mean, there's there there are nuanced differences there, right? So when you try to prove that you're not a criminal, um from a known criminal, okay, so that's one thing, that's that's something which is...
00:45:08
Speaker
not showing something is probably it's actually interesting to show something that you're not somebody that's actually interesting as all by itself. um the The association sets were saying I'm one of these 10 addresses has actually acquired a lot because now you have to trust that these 10 addresses. Oh, absolutely. I think the the weakness you're already pointing towards right and this is something that we also have in the limitations is the biggest question is who construct these association sets.
00:45:35
Speaker
and Because clearly, it it needs to be someone who has an understanding of what is going on. And and b ideally, you don't want to create a monopoly, but it would be a really bad situation if you just have one entity with all the information and construct these association sets, because then we would be in the same situation as we previously discussed. So that's, for example, why we argue that this should not be a closed system, that anyone should be able to propose these association sets.
00:46:02
Speaker
anyone should be able to join and then depending on which jurisdiction you're in depending on the regulatory requirements of course some of these associations that might be sufficient and others will not be right it could be an association set for your private community and which can be interesting but probably from a legal point of view it doesn't have too many implications just Just to clarify, so these association sets, do they have to be baked into the smart contracts themselves? Or is it something that um in the construction of the proof, I can say, look, I didn't receive funds from this set of addresses, even though it's not defined you anywhere in the code? It's in the construction of the of the proof, right? And you can either do that in a way that you store it in the smart contract. So that this would be a public proof.
00:46:54
Speaker
something that would be available. But what I could also do, and I think it's particularly interesting in a one-to-one mapping, I could share it just with one counterparty, with one specific counterparty. So I could have some vague information on the public blockchain and the more specific ah information is required and shared up with with my commercial bank again.
00:47:13
Speaker
But then then I don't I guess see the issue with like who defines them and so basically I was thinking about like the natural use case being I want to prove that for instance. ah My withdrawal isn't sourced by any address on the off act sanction list or something like that right um and so it sounds like you're saying I don't need.
00:47:35
Speaker
let's say cooperation with whoever is deploying the underlying smart contract or even the ah depositors who I want to disassociate myself with, I can just say, yeah, okay, the Department of Treasury gives me the list and I say, look, here's the proof. I didn't actually, my funds don't are not sourced from them.
00:47:55
Speaker
That is correct, but clearly there's some market power. right And the the way it it works currently is you have these various crypto compliance firms and that are specialized in observing the blockchain and basically looking at the transaction graph. And this would still be a requirement in order to be able to create such an association that you still need additional information. Now, what I'm worried about, and I think this is something I would encourage lots of researchers to think about, because this is clearly unsolved in our proposal, is how do we prevent the situation where we create a monopoly? but i mean We have some ideas, and I think the openness certainly helps, but there is a huge risk
00:48:35
Speaker
that the association set provider, because of network effects, because of the additional information they get, because of economies of scale, and many, many different reasons, in fact, it could become a really ah dominant and powerful marketplace. And this is basically what I'm worried about.
00:48:52
Speaker
Can you find a little bit context on sorry could you just find a little bit more context on beyond the specific addresses that say I would want to disassociate myself with? If I want to construct that association set, what ah what information do I need?
00:49:07
Speaker
I mean, you can always construct any association set to yourself. right There are no restrictions whatsoever. You can prove against anything you want. But it sounded like in terms of the monopoly, it sounded like you were saying there's some some difficulty to doing it. Otherwise, I don't see what the concern is with the monopoly.
00:49:23
Speaker
The concern is that clearly there are associations that have bigger implications, right? If I create an association set where me and some of my colleagues say this is all of us, we verify that all of us are from the University of Prague.
00:49:46
Speaker
We could do that, right? But clearly this is an association set, but this has no legal implications, not important. So I think what we talk about is association sets that are accepted from a legal point of view and have some legal meaning.
00:50:02
Speaker
And clearly, this is not something just anyone could do in that regard, right? There is information required and there is the question, is it accepted as something legitimate, so probably some licensing and and involved?
The Market Dynamics of Privacy Solutions
00:50:19
Speaker
This is what I'm worried about, not the association set in general.
00:50:24
Speaker
I mean, one thought I did have was that so it it seems like what's being suggested is very clearly a step forward, at least for the fact that for the narrow use case of the case that a particular government agency has already a list out there and really just wants sort of ah wants verification that funds aren't sourced from from that list. This seems to to address that. I take Fabian's point earlier about there can, I suppose, become ah
00:51:01
Speaker
an industry around trying to cultivate an even richer list um and and make it the one that everybody cares about. And that that's a concerning thing if sort of a private sector entity would be get would, but I suppose get into that business. um But something as narrow as I want to prove that I didn't, you know, that I'm not associated with an OFAC sanctioned address as defined by ah the list the Treasury has out there right now. It seems like this certainly captures that. It does have the issues that Andreas alluded to earlier about the backward compatibility of like they'll update the list and and i and I hope I kept my secrets so that I can right i can provide the the the next to your knowledge proof. um But I guess
00:51:51
Speaker
i what are the what are the What are the reasons why this hasn't been implemented yet, I guess, is what I'm wondering, because it it doesn't I don't see a downside. I see it's not a perfect solution to everything, but I don't really see a downside relative to the current setup. I think it's a very controversial topic. but then the Everyone is just extremely reluctant in doing something. when you Many talk to to regulators, and in fact, we we have done that. right When we published the paper, we went on some kind of a tool and just wanted to tell regulators that this is out there, what was the intention, and that we in no way mean to suggest that this is compliant, but it should be seen as it as a toolset. right And I would say the general response was quite positive, but of course,
00:52:45
Speaker
This doesn't mean that any of the regulators would just say, yes, that that is the perfect solution and let's go with it. There is a lot of risk aversion.
00:52:56
Speaker
hit Especially when you look what's going on with with tornado cache right now in the US, also what happened in the Netherlands before, understandably so. right I think it's it's ah not the easiest topic to work on.
00:53:13
Speaker
And this is also why, i of course, I am always telling again, this is a research paper, we are not implementing this in any way, we're not suggesting this is legal, it's just a research paper we did. I think this is important. So I think these are the reasons. From ah from a technological point of view, and also from the use cases, when you look at it objectively, when you look at the flexibility you have,
00:53:35
Speaker
then I also personally don't see any downsides. If anything, I would argue it doesn't go far enough. right dad I'm certain there are better solutions for privacy and something some solutions that could provide even more privacy, but from a regulator's perspective, I also personally i don't see any concerns. I think it would be a good middle ground and certainly a step in the right direction.
00:54:03
Speaker
I mean, it would be we ah I would like to believe super honest in the paper and already point towards the limitations ourselves. The limitations are that there clearly is a trade-off between the anonymity you can achieve right in terms of the size of the association set, its stability for example.
00:54:21
Speaker
the which the more people you have in the association said the less accurate it gets, the less stable it gets. but this is This is one problem. Then we talked about the reproofing issues that might be highly impractical, which certainly is also a problem. And then what I'm most worried about is is the potential monopoly that this could create. i and We have to be really careful. And this is not something that would be done in the protocol. It's just with the companies around the protocol, the regulation that would regulate these specific companies is well providing these services. I think we need to be really careful not to create a monopoly in the compliance space, in the blockchain compliance space, where one company has all the information, where one company essentially makes decisions of what transaction is in the association set and what transaction is not in the association set. So, I think these are the downsides and the risks that we need to talk about.
00:55:17
Speaker
So I don't think a government would get into the business of an association sector provider. and When you look, especially at financial market regulators today, and the way I understand it, and typically I don't have a legal background, the way I understand it is that most financial market regulators, ah they make the rules, but then they ask an external firm, like in many cases, in all of it, a consultant agency, to check if whoever they are auditing is in line with these rules. right But I don't think they would actually go down to the specific association set level and say, this is OK and this is not OK. So at at some point, I think it's unrealistic to assume that the government would do this. And also,
00:56:05
Speaker
probably not very efficient and would introduce new risks if you if you have a government agency doing that. But aren't they implicitly already doing that with stuff like specifically identifying addresses from the Ethereum blockchain on twittering for the OFAC sanction list?
00:56:21
Speaker
Yeah, but I mean, when you look at the off extension list, and I mean, it's it's a long list, to be clear, right it's ah it's a very long list, but there aren't too many crypto addresses on there. and It's not that they look into every individual transaction and say, this is a good one, and this is a bad one. When there is an obvious hack, or when there is something going on, um where where there is clear evidence,
00:56:45
Speaker
that this originates from illicit activity, then of course, and this will be on the list. And of course, OFAC is active in regard to that transaction. But I think it would be unrealistic to expect them to look at every single transaction and say, this is green light and this is red light. This gets a go and this cannot be done in that way. Right. I guess probably one of the one of the reasons we might not see this being implemented yet is that whoever would implement it is probably concerned, whoever might implement it, let's say, would be concerned about potential litigation they would face based on actions on their platform, um owing to the fact that it's not exactly clear um how people would prove that they aren't
00:57:40
Speaker
part of some money laundering scheme, owing to the fact that it's not at all clear what the list of bad addresses are. Because I think what you're saying is to the extent of the government, let's say the US government puts out lists, these are not supposed to be representative of the entire set of bad addresses. They're just saying these particular addresses are bad addresses. um ah and And so you could imagine a situation where ah despite the fact that this is all in place,
00:58:07
Speaker
um essentially whoever deployed the technology is going to face litigation. And I think this gets back to your point about risk aversion on all sides, right? There's a risk aversion from the private sector about potential litigation. There's risk aversion on the government sector about making clear statements about what will or what what will make you immune to the potential litigation. um and And given that situation, if everybody's risk averse, you probably just do nothing and say,
00:58:36
Speaker
And nothing in this context is not really a good option, right? Because nothing means that all of the transaction data, all of the information is publicly accessible, and this is incredibly bad. It's it's not a good solution. Yes, it's it's not the socially optimal outcome, but it may well be the equal living outcome, for at least for the moment. Yeah, and that's why I think the tornado cash court decision will be a really important one. like sweepy a landmark ruling, the one in the US. Because essentially, I mean, as I mentioned, some form of this, a very simple one already was in tornado cache with the compliance tool. It's not sophisticated in the sense that it can prove against custom association sets, but they had the option in there that they could make a proof and show the specific counterparty how you would crawl associates to a single deposit. We will see.
00:59:32
Speaker
All right, maybe with that, I'm going to conclude. Thank you so much for your time on this topic. um And this this has been a great experience. And I think I hope the listeners will enjoy this podcast. Thank you.
00:59:46
Speaker
We hope you enjoyed this podcast. Thank you for listening. As a reminder, you can find additional materials on owlexplains.com and can stay updated by following us on social media. That's all for today.