ConsenSys Research Results: Achieving Privacy on Ethereum
Editor's Note: This article comes fromCrypto Valley Live (ID: cryptovalley)Editor's Note: This article comes from
Crypto Valley Live (ID: cryptovalley)
Crypto Valley Live (ID: cryptovalley)
, Author: Dean Pierce (ConsenSys Diligence), Robert Drost (ConsenSys R&D Department), Mason Nystrom (ConsenSys), translation: Flash Chan, Odaily reproduced with permission.
In an increasingly connected world, where our information is increasingly categorized, copied, shared and sold, maintaining a certain level of privacy is an important challenge.
Privacy is not a binary structure, but a category that fluctuates from completely public to completely private. So, when it comes to privacy, there are three issues to discuss first:
What privacy do consumers and businesses want to protect?
Are people willing to pay the price for privacy?
What are the trade-offs of implementing private transactions on a public blockchain?
The purpose of this paper is to briefly examine the actual privacy needs on public blockchains and discuss realistic paths to privacy solutions.
One aspect of privacy is anonymity, or the right to keep one's identity private. In the context of public blockchains, anonymity refers to the ability of parties to exchange something (money, tokens, or data) without revealing their identities or other information about their transactions. While this is only one aspect of privacy, its importance has grown with the development of blockchain.
Cryptoassets like BTC and ETH are increasingly being tracked, and by linking public addresses in transactions, it is possible to analyze and link to the address' true identity when converting cryptoassets and fiat currencies. The end result of this is that the identities of both parties to the transaction become public. Since public blockchains must essentially provide a log of all transactions, it is increasingly important to use cryptographic algorithms and protocols to protect the privacy of users and businesses.
Businesses and consumers have very different needs when it comes to privacy. Businesses often need to maintain the privacy of transactional data such as product names, quantities, prices, addresses, personally identifiable financial information, and more.
Network participant identities are generally known, but depending on role identities, may need to be retained or made available to other participants.
For example, a freight forwarder may not need to know the contents of a certain ocean container, only that the container has arrived. Banking rules also limit who can access transaction data. EY's Nightfall protocol, which uses zk-snarks for private transactions on Ethereum, and JPMorgan Chase's development of Anonymous-Zether for Quorum are typical examples of privacy solutions developed by enterprises for Ethereum.
Companies tend to have strong commercial motives or privacy regulations, in contrast, consumers tend to be less privacy-conscious and generally less concerned. Consumers may simply want to protect their identities, credit card information or other sensitive data from fraud or identity theft. Sometimes consumers want to transact anonymously, which requires that both the sender and receiver of the transaction remain anonymous. However, in daily life, privacy is often ignored by users, and most people are willing to sacrifice their privacy rights for convenience or free access (accepting cookies, using free wifi, etc.).
Through academic research and enterprise adoption, many results have been derived from open standards, and many of these technologies have found their way in individual user technology stacks, ultimately benefiting end users.
As far as the blockchain is concerned, only about 5% of the existing ZEC is stored using SNARKs, even though Zcash is almost 3 years old. About 95% of ZEC is stored in transparent addresses with little privacy. Based on this low adoption rate, we can infer that perhaps most users do not yet have the need to pay the cost and effort for privacy.
Looking back, the success of the built-in privacy layer (such as SSL) has made the Internet a trusted commercial medium, and the mainstream adoption of blockchain technology still cannot avoid the important issue of privacy.
secondary title
Privacy Tradeoffs
This question is more technical. We need to dig deeper into how to achieve privacy on Ethereum. Blockchain networks trade off scalability for decentralization, and there are trade-offs between privacy mechanisms and technologies. We will start by examining what other privacy-focused blockchains have achieved, and then discuss privacy solutions on the Ethereum network.
Other typical blockchain projects that focus on privacy (Monero and Zcash)
Before getting into the details of Ethereum, let’s introduce Monero and Zcash, two major players in the privacy coin space.
In the early days of altcoins, Monero was special because its code was not based on BTC at all, but a completely unrelated encrypted asset project called Bytecoin (Bytecoin was the first encrypted asset to use the CryptoNote protocol).
The original CryptoNote design mixed (mixins) the transaction sender's signature with many other decoy signatures, thus obfuscating the sender of the transaction. This, combined with the stealth address output, provides very strong privacy guarantees. The "ring signature" scheme has long been recognized as an advanced built-in mixer, which is nothing new.
In 2017, with the introduction of RingCT, the ability of ring signatures to hide transaction data has been greatly improved. RingCT uses Zero-Knowledge Range Proof (ZKRP) to increase the types of signatures that can be processed in batches.
At the end of 2018, we saw the introduction of "Bulletproofs" on the Monero network, an exciting new zero-knowledge structure that scales logarithmically with the number of signatures in the ring, reducing the required transaction size. This improvement brings Monero functionality in line with other blockchain projects.
Zcash is the first crypto asset to use zksnark. Using this technique, users can send completely private transactions that are only visible to the recipient. To an outside observer, the ZEC being sent to a private address appears to disappear into a large cryptographic black box, and when the recipient wants to move their tokens back to a non-private address (similar to a standard BTC address), the tokens Seems to come out of nowhere, with no observable connection between sender and recipient.
An important note about zero-knowledge proofs is that it requires more computing power to run, which in turn makes transactions more expensive.
secondary title
The Ethereum network provides pseudo-anonymity (ie: transactions are linked to public key addresses signed by the user's private key, rather than signed by username/password), and its distributed nature and transparency make many new technical functions a possible.
However, similar to BTC, Ethereum also unknowingly exposes users who may not realize the breadth of their shared information when using alternative digital asset transfers.
One threat to privacy is that the user knows the identity associated with the public and private keys. Considering the public nature of blockchains such as BTC and Ethereum, naively using their built-in transaction frameworks is like leaving breadcrumbs for others to track the transfer traces of assets (even fungible assets).
Guaranteed privacy by generating addresses
As privacy technologies continue to evolve, many more complex threat models can be considered. In 2012, BIP32 introduced Hierarchical Deterministic keys, which allow a single seed phrase to generate a never-ending stream of "new" BTC addresses. This allows users to generate new addresses every time they accept a transaction, and all of these addresses can be easily exported and imported into a new wallet without having to import multiple randomly generated keys separately.
Ethereum has the same functionality, but the newly generated keys cannot interact with the smart contract until the required ETH funds are available. Compounding the problem is the fact that many systems built on Ethereum link users' real-world identities to addresses. This extra metadata linked to Ethereum addresses would make Ethereum particularly vulnerable to deanonymization attacks. Fortunately, the smart contract functionality that exposes Ethereum to these threats can also use cutting-edge cryptography, enabling secure, seamless, private transactions.
secondary title
Many zero-knowledge structures require so-called "Trusted Setups". This means that the entire construction relies on the generation of special random numbers that anyone who knows these random numbers will be able to peek into the inner workings of.
Zero-Knowledge Notes (ZK-Notes)
To allay this concern, developers have devised complex schemes to generate random parameters to ensure that constructs can be trusted. This usually involves several trusted members of the community, each getting their own private random data, and combining them with each other in some way, if "any" party deletes their key data, the secret value is safe. Therefore, the structure can only be put at risk if all parties involved collude.
It is worth noting that Bulletproofs used by Monero do not require a trusted initial setup, but zksnark in Zcash does. The trusted initial setup of Zcash is documented in RadioLab. In contrast, STARKs do not require a trusted initial setup, as they choose to use a hash function as the "setup", rather than any kind of special number.
secondary title
As a pioneer in the Ethereum privacy field, AZTEC Protocol uses a "zero-knowledge notes" system to track hidden financial information. These notes are visible on the Ethereum network, including the owner of each note, but the amount stored on each note is hidden from everyone except the owner of the note.
In a common use case, a "ZK-Asset" contract can be connected to any ERC-20 compatible token and allow users to deposit tokens to generate ZK-Notes, or, burn ZK-Notes to withdraw. This mechanism enables any existing asset on the Ethereum network to be traded in a privacy-preserving manner. The proofs used by the AZTEC Protocol are easier to use than zk-snarks, but still require a trusted initial setup.
Aztec is also using other novel solutions to establish trusted settings. PLONK is a new, efficient ZK-SNARK structure that requires a single trusted setup that can be reused by all programs. Due to the low requirements for gas, PLONK is effective enough in the practical application of Ethereum.
AZTEC Protocol CEO Tom Pocock believes that PLONK can be used to write complex logic statements while maintaining perfect privacy.
secondary title
Combination of ZK and Secure Multi-Party Computation (Secure MPC)
This approach, implemented in ZKBoo and Ligero, enables verifiers to "compile" the secure multiparty computation protocol into the ZK-PCP system (one of the first ZK systems to use probabilistic proofs) by requiring the prover to submit a copy of the secure multiparty computation protocol. Randomly evaluate one of the views. This means that an entity with knowledge of the relevant data can arbitrarily simulate a distributed computation among multiple parties, and then display a copy of the computation at a random point of evaluation. More importantly, using MPC makes it possible to create private smart contracts.
Like ZK-STARK, MPC-based proofs have the following characteristics:
Transparent: The generation of random numbers is public information;
Scalable: MPC-based proofs have quasi-linear proof time and verifier time, and can efficiently perform batch calculations;
Some of the trade-offs around using such techniques relate to how they are optimized for small to medium "circuit" problems, which can cause scalability issues for verifiers.
secondary title
hardware limitation
When Zcash first introduced the idea of using zk-snarks to send transactions, there were serious concerns about the computational power required to use covert transactions, since it would take hours or longer to generate a single transaction. But since then, we've come a long way and are now able to do similar tasks in a browser or even on a mobile device, in seconds.
secondary title
mixer
Ethereum mixers facilitate local private transactions for wallets or individuals. The traceability of ETH means that specific transactions can be tracked and linked to other wallets or accounts. Mixers are used to exchange ETH to further anonymize transactions.
Many groups are working on making Ethereum mixers more practical. Below is an up-to-date graph of computation and gas fees for storing and withdrawing mixed ETH.
A single mixer at the application layer may not yet provide users with absolute privacy, but only probabilistic guarantees. However, this is already sufficient for most personal and business needs.
secondary title
Who pays for the gas fee?
A fatal flaw of these approaches is that, at the end of the day, someone needs to pay the gas fee to get the output. Where did all this ETH come from? If the ultimately paid ETH can be traced back to a user, then that user can be de-anonymized, which defeats the purpose itself.
This creates a privacy "chicken and egg" scenario where the only way to accept anonymous ETH is to already have anonymous ETH. In Vitalik's blog post about mixers, he solves this problem with a simple relayer registration contract. In this protocol, relay operators who commit to publishing arbitrary transactions can register an HTTP endpoint so that such transactions can be published anonymously.
Finally, wallet tampering and operational security must be considered. How to figure out safe defaults to protect users without making them too cumbersome is an ongoing discussion. All of these hybrid solutions require a large number of participants with a reasonable expectation of privacy, as the tools need to be easily accessible to the masses. However, any shortcuts can lead to some pretty serious privacy violations. For example, a user who mixes some ETH, spends some of it on something that is supposed to be private, may later forget which wallet they used for the private transaction, and send the rest of the ETH back to a wallet publicly associated with them. address.
