An article to understand the privacy protection technology on Ethereum
Editor's Note: This article comes fromEthereum enthusiasts (ID: ethfans)Editor's Note: This article comes from
Ethereum enthusiasts (ID: ethfans)
Ethereum enthusiasts (ID: ethfans)
, Author: Dean Pierce (ConsenSys Due Diligence Department), Robert Drost (ConsenSys R&D Department), and Mason Nystrom (ConsenSys), translation & proofreading: Zeng Mi & A Jian, reprinted with authorization by Odaily.
In an increasingly connected world, where our information is recorded, copied, distributed and sold at an increasing rate, maintaining the level of privacy we expect is no easy feat.
Most things are not black and white, and privacy is no exception, it runs the gamut from completely public to completely private. Therefore, when we talk about privacy, we must first clarify the following three issues.
Are people willing to pay money for privacy?
What are the trade-offs in reaching a private transaction on a public chain?
This paper aims to simply examine the actual privacy needs on public blockchains and explore the trade-offs of implementing privacy solutions at an abstract level.
first level title
Question 1: How important is privacy?
Anonymity (or identity privacy) is a form of privacy. In the context of public blockchains, anonymity means that participants can conduct transactions (such as exchanged currencies, tokens, or data) without revealing identity information (related to themselves or historical transactions). Although this is only one aspect of privacy, it is also becoming more and more important as the blockchain evolves.
Enterprises and users have completely different demands for privacy. Businesses often want to protect the privacy of their transactional data, such as product names, quantities, prices, addresses, and personally identifiable financial information, among others.
The identities of network participants are often disclosed, but it is also necessary to decide how much information to disclose based on the identity of the other party. For example, a freight forwarder may not need to know what is in a container, just when it will arrive. Banking regimes also restrict access to transaction data. For enterprises that want to develop privacy solutions on Ethereum, Ernst and Young (Ernst and Young) use zk-snarks technology to achieve the evening (Nightfall) protocol of private transactions on Ethereum, and JP Morgan Chase (JP Morgan). ) Anonymous Ethereum (Anonymous-Zether) developed on Quorum (Translator's Note: Quorum is an open source blockchain platform built on Ethereum) is a good learning sample.
Enterprises often have strong business needs or compliance needs for privacy. In contrast, users have always lacked privacy concerns and protection awareness. Still, users want to protect their identities, credit card information and other sensitive data from identity theft or fraud. Sometimes, users want to trade anonymously, which requires both parties to the transaction to have privacy protection. It is a pity that in our daily life, privacy does not exist naturally, and most people are willing to sacrifice their privacy in exchange for convenience or free rights (such as accepting cookies, using free WiFi, tracking Internet records, etc. ).
first level title
When we often speak of privacy in the context of communications, we mean protecting what is sent between participants. In fact, in addition to this, privacy is also used in the broader construction of communication channels and basic network layers. We see this construct in the evolution of public key cryptography to other key exchange mechanisms used to generate end-to-end secure network/transport layer protocols (IPSec v2, SSL). Furthermore, the existence of such constructs allows us to safely use DNS lookups and Tor-based relays. There has been quite a bit of academic research in the area of common standards, and the results have been used by enterprises to maintain privacy and confidentiality in data transmission - although many of these techniques are already found in retail user technology stacks It defines its own applicable scenarios - thus benefiting end users.
Let's focus on the blockchain field - although Zcash has been born for nearly 3 years, only 5% of the existing ZEC is stored using SNARK technology (and nearly half of them use the old version of SNARK technology ). Approximately 95% of ZEC is stored in transparent addresses with no privacy at all. Through this phenomenon, we can infer that perhaps most users are not aware of the need to pay for privacy.
first level title
Question 3: Privacy Tradeoffs
The third question is more technical and requires us to conduct a more in-depth study on how to protect privacy on Ethereum and the trade-offs of various mechanisms involved. Just as blockchain networks need to make tradeoffs between scalability and decentralization, so too do privacy mechanisms and the technology itself. Let’s first study the privacy solutions that other privacy-focused blockchains have implemented, and then discuss some privacy solutions on Ethereum.
secondary title
Lessons from other privacy-focused blockchains (Monero and Zcash)
In 2017, due to the introduction of RingCT, the ability of ring signatures to hide transaction data has been greatly improved. RingCT uses zero-knowledge range proofs to enrich the types of signatures that can be batch-processed at the same time. At the same time, the introduction of RingCT also enforces minimum mixing requirements, mitigating the linkability attacks that plagued earlier versions of Monero. However, there is no gold, and ring signatures are not a perfect solution. One of its main problems is that it takes up a lot of disk space to store the Monero blockchain. Additionally, ring signatures do not scale to large groups, currently limited to 10-15 participants per group.
In late 2018, we saw the introduction of "Bulletproofs" on the Monero blockchain - an exciting new zero-knowledge structure that allows the number of signatures in the ring to scale logarithmically, reducing the number of exchanges required storage. This improvement allowed Monero to catch up with other blockchain projects.
Speaking of zero-knowledge proof, Zcash is the first project to eat crabs. It is the first to adopt zkSNARK technology. Using this technology, users can send purely private transactions that are only visible to the recipient. To an outside observer, ZEC sent to a private address seems to disappear into a giant cryptographic black box, when the recipient wants to transfer their ZEC back to a non-private address (almost the same as a standard Bitcoin address When it is exactly the same), the ZEC that originally disappeared seems to appear out of thin air, and the observer will never see the connection between the sender and the receiver. But it has to be mentioned that zero-knowledge proofs require more computing resources, which in turn will make transactions more expensive.
Threats to Fungibility
Transactions on the Ethereum network have pseudo-anonymity (that is, the address of the transaction is associated with the public key corresponding to the private key held by the user, rather than the username/password), and at the same time, thanks to its distributed And transparent features, many new technologies can show their talents.
However, similar to Bitcoin, when such technology is used to transfer digital assets such as Fungibility (also known as "fungibility", ECR-20 tokens and ETH can be regarded as homogeneous assets) When operating, if users have no idea of the breadth of information they are sharing, their identities may be exposed by Ethereum without knowing it. The exposure of the real identity corresponding to the public and private keys will seriously threaten privacy security. Considering the openness of blockchains such as Bitcoin and Ethereum, when you naively use their native transaction frameworks for transactions, the transfer traces of all assets are as easy to leave and be traced as breadcrumbs—even Homogeneous assets.
Address generation method for privacy protection
As privacy technologies continue to advance, many more complex threat models are taken into consideration. In 2012, BIP32 introduced Hierarchical Deterministic keys (Hierarchical Deterministic keys), through which we can use a set of mnemonics to generate an infinite number of "brand new" Bitcoin addresses. This means that users can generate a new address every time they receive money, and all of these addresses can be easily imported and exported between wallets. The key is here, doesn't it sound convenient?
Ethereum also has the same function, although if the newly generated address wants to interact with the smart contract, it needs to ensure that the Ethereum in the address is enough to pay the Gas fee. However, the problem is compounded by the fact that many systems built on top of Ethereum link users' real-world identities to their addresses in many ways. The additional large amount of metadata associated with Ethereum addresses makes Ethereum particularly vulnerable to deanonymization attacks. Fortunately, although some smart contract functions will expose Ethereum to such threats, smart contracts can also be used by cutting-edge cryptography systems to bring users safe and seamless private transactions.
Zero-Knowledge Scheme and Trusted Initial Setup (Trusted Setup)
Many zero-knowledge scenarios require a "trusted initial setup". This means that the whole scheme relies on the generation of special random numbers, and anyone who knows these random numbers can gain insight into the internal operation, which sounds like a very unreliable prototype... In order to partially alleviate the problem of Worrying, a complex random number generation process came into being to ensure the credibility of the structure. This process usually requires several honest community members to independently generate their own private random data, and then combine these data in a certain way. As long as any member deletes TA's random data, the final calculated data is safe. of. Therefore, the associated scheme is not at risk unless all participants collude.
It should be pointed out that the Bullet Proofs used by Monero do not require a trusted setup, but the zkSNARKs implemented in Zcash do. You can check out Zcash's trusted setup process documentation in the now famous RadioLab article. In contrast, STARKs don't require any trusted settings, they use the choice of hash function as their "settings", rather than any special numbers. Various forms of trusted setup processes have been proposed, such as the perpetual Powers of Tau multi-party computation process.
secondary title
Zero Knowledge Notes (ZK-Notes)
Zero-knowledge works its magic when the owner of a ticket decides to perform a "joinSplit" operation - the owner of a ticket can take any number of tickets it controls and create a set of outputs that don't necessarily belong to anyone else bill. This, combined with the stealth address technique mentioned above, allows each new ticket created to be attributed to a completely new Ethereum address (an address that has never been used on the Ethereum network).
Let's look at a common usage scenario. A "zero-knowledge asset" contract can be connected to any token compatible with ERC20 format. Users can deposit tokens into this contract and obtain a zero-knowledge bill as a proof of deposit. When the user wants to To get your deposit back, simply "burn" the ZKT. With this mechanism in place, we can covertly trade any asset in existence on the Ethereum network. The proof adopted by the AZTEC protocol is easier to use than ZK-Snark, but the trusted startup facility is still a hurdle that cannot be bypassed.
Aztec is also using other novel schemes to achieve trusted initial setup. PLONK is a new type of efficient ZK-SNARK structure, which only needs to be trusted once, and then all programs can reuse the setting. And, since PLONK's gas demand is not high, it is efficient enough for practical use on Ethereum. Based on such transaction capabilities, AZTEC CEO Tom Pocock believes that PLONK can write complex logic programs in a way that perfectly protects privacy.
secondary title
Introducing secure multi-party computation to zero-knowledge
This scheme has been used in ZKBoo before, and has been applied to Ligero recently. It "compiles" the secure multi-party computing protocol into the ZK-PCP system (the earliest ZK system that uses probability proofs), and its implementation requires the prover ( "in the head") submit a copy of the secure multiparty computation protocol, and verifiers can then randomly evaluate any participant's view (view). To put it bluntly, it means that an entity with relevant data information can simulate a distributed calculation among multiple parties, and then display a copy of the calculation at a random point in the evaluation. More importantly, the use of MPC holds promise for creating private smart contracts.
Similar to ZK-STARK, MPC-based proofs have the following advantages:
Transparent - the generation of random numbers is public information
Scalable - MPC-based proofs have (quasilinear) proof time and verification time, allowing for high efficiency in batch operations
When using such techniques, one also needs to consider how they are trade-offs that are optimal for small to medium "circuits"/problems - as this can create potential scalability issues for verifiers.
secondary title
hardware limitations
When Zcash first proposed using zk-SNARKs to send transactions, there were concerns about the computational resources required to generate hidden transactions, as it could take hours to generate a transaction. But we've come a long way since then, and we can now do similar tasks in a few seconds on a browser or even a mobile device.
secondary title
Coin mixers have been getting a lot of attention recently. Back in May, Vitalik published an article explaining the motivation and general outline of the next coin mixer design on the Ethereum network.
When wallets or individuals want to conduct native private transactions, the Ethereum mixer can come in handy. The traceability of Ethereum gives bad guys an opportunity to obtain information such as wallets and accounts behind specific transactions by tracking them. The currency mixer can realize anonymous transactions by exchanging ether coins.
image description
-View the types of Ethereum mixers and their respective calculation and gas costs through the GitHub status of the mixer-
An independent mixer at the application layer can never guarantee 100% privacy of users, it can only provide probabilistic guarantees. However, it is more than enough for the vast majority of personal and business needs.
secondary title
Who will pay for Gas? relay risk
Finally, don't forget to consider the security of wallet interaction and operation. The default settings of the wallet need to be safe enough to protect user privacy, but not too troublesome for users to get started. As for how to achieve this, we are still working hard. All of these mixer schemes require a large number of participants in order to obtain the desired privacy protections, so the tool must be accessible to the masses, but any shortcuts can introduce serious privacy violations. Let’s take a very simple example. A user mixes some ethers with a coin mixer, and then uses some of them for privacy protection. After a while, he forgets which wallet has sent a private transaction, and then Transferring the remaining ether in the wallet that once sent the private transaction back to a public address directly related to its identity... It is a complete failure :(
looking to the future
From the technologies mentioned above and many other technologies that are making efforts in this field, it is easy to find that privacy technology on Ethereum is gaining more and more attention, and these developments may soon be promoted on a large scale . Although it may seem contradictory to achieve privacy on a public chain, zero-knowledge and other privacy technologies will enable various cutting-edge new ways of playing. At the same time, with these solutions, users no longer have to worry about financial privacy.
first level title
looking to the futureAlthough this article does not provide a complete overview of all privacy solutions on Ethereum, it examines various ways to achieve enterprise and user privacy. The censorship-resistant technology that brings freedom has inspired many, many projects in the cryptocurrency ecosystem. In order to create a crypto-native world, the ability to transact anonymously or protect personal information is critical. There is no silver bullet for protecting privacy, but there are many methods and mechanisms for providing privacy for specific use cases.
Therefore, we continue to research and evaluate privacy solutions on Ethereum to help educate and advance the development of such technologies. In the future, you will also find a range of content from us, including articles on specific privacy solutions, reports explaining various privacy technologies, and more in-depth analysis of projects and companies currently building privacy solutions.
