Public chain + privacy is on the rise, is the Layer 2 privacy protocol worth looking forward to?

Many people may not have noticed that on February 13, Qtum quietly released a Layer 2 privacy protocol - Qtum Phantom Protocol (Phantom Privacy Protocol).

Odaily learned that this agreement is not only a key promotion plan of Quantum Chain, an old public chain, this year, but also one of the few domestic privacy solutions that can be implemented.

Around Phantom and its zero-knowledge proof algorithm, Odaily had an in-depth dialogue with Zheng Yi, the chief developer of Qtum China.

As Zheng Yi said, the vast majority of people's understanding of privacy is limited to knowing the privacy currency and its representative technology. Few people really think about how much we need for privacy. If there is a demand, then the public chain With so many, why is privacy technology not standard?

image description

secondary title

Public chain entry privacy

Quantum Chain takes a fancy to privacy in 2019.

At the beginning of the year, Grin and BEAM of the Mimblewimble series became popular in the market. One month later, the Litecoin Foundation announced that it would join hands with the BEAM team to implement MW on Litecoin to enhance the privacy of transactions.

A faster payment experience is the biggest innovation of Litecoin based on the Bitcoin code. Adding privacy options, allowing users to hide their account balances and keep their transfer relationships private, is indeed a further improvement in user experience.

But for 2.0 public chains like Quantum Chain and Ethereum, what is the significance of building a Layer 2 privacy layer?

Zheng Yi put forward two reasons.

First of all, Qtum and its ecological currency also need to enhance their own privacy.

Quantum Chain, born in 2017, is mainly compatible with the Bitcoin transaction model and the Ethereum virtual machine to support smart contracts on a simple, stable and secure underlying architecture.

The addition of the Layer 2 privacy layer this time is not to "enable" smart contracts, but to enhance its own currency functions. In the two years since its launch, Quantum Chain has failed to become the "bottom computer" of the blockchain world like the pioneer Ethereum. Hoping to transform the world through smart contracts has become far away, Qtum turned to aim at Qtum's "currency function".

Many people in the industry hold the view that the best alternative to traditional banknotes is neither electronic currency nor ordinary encrypted digital currencies such as Bitcoin with "account balance disclosure", but privacy currency.

In the era of mobile payment, electronic currency is accelerating the replacement of traditional banknotes, but at the same time, the centralized platform regards personal privacy as a means of profit, and the digital traces of a person's life will be permanently preserved. Detailed "navigation" of an individual's life by transaction.

“The death of cash is the death of freedom.” Some even chanted such slogans, and expressed hope for privacy currencies.

Quantum chain is one of them. Zheng Yi revealed that after the implementation of Phantom, Qtum will also provide an open source protocol similar to algorithmic stablecoins (typically DAI), allowing users to freely create highly anonymous stablecoins, while also making Qtum a more powerful currency issuance platform.

Another reason why Quantum Chain is interested in privacy is that privacy is one of the "high-tech" technical fields in the blockchain, and it has great potential at the same time.

Just like the cryptography technology before Bitcoin became famous, privacy technology has not yet had a benchmark product "out of the circle". But that doesn't negate its potential to become a fundamental component of the blockchain world.

Therefore, mastering this future technology is quite attractive to public chains like Quantum Chain, which have been running stably for several years and urgently need to find a breakthrough direction.

secondary title

Based on zk-SNARK improvement

zk-SNARKs has been continuously improved and promoted since it was proposed in 2014, and has now become one of the most mainstream privacy technologies in the blockchain world. Phantom, not only inherited zk-SNARKs, but also added some effective innovations.

According to Zheng Yi, there are three main reasons for choosing zk-SNARK.

First of all, among all kinds of privacy technologies, zk-SNARK has the strongest anonymity. It can hide both the transaction amount and the transaction address, making it impossible to trace the connection between transactions.

As shown in the figure, MimbleWimble, as a cutting-edge zero-knowledge proof algorithm, has the same anonymity as zk-SNARK. Therefore, Quantum Chain has also considered adopting the MW scheme, and has done a number of studies with the BEAM team, and released a white paper on the Layer2 MW scheme.

However, due to the lack of mature MimbleWimble researchers in China, it was shelved and the earlier born zk-SNARK was selected.

According to Zheng Yi, there are currently two main developers of Phantom, both from the Qtum community. Their solution first appeared in a privacy technology hackathon held by Qtum last year, and was later funded by Qtum and jointly developed by the two parties.

Going back to zk-SNARK technology, many people take it for granted to equate it with zero-knowledge proof, but it is not. In cryptography, zero-knowledge proof, like "Byzantine generals", refers to a type of "problem" that needs to be solved, and zk-SNARK is just one of the solutions.

I believe that many people are not unfamiliar with the concept of zero-knowledge proof. Zero—Knowledge Proof, which was proposed in the 1980s, refers to the fact that the prover proves to the verifier and makes him believe that he knows or owns something, but cannot disclose any information about the proven thing to the verifier during the proof process. information.

to 2014. Ben-Sasson, a researcher at the Israel Institute of Technology, and others applied this verification idea to digital currency, and an anonymous transaction scheme supported by the zk-SNARKs algorithm was officially born.

Let's talk about the inherited part first. There are two forms of tokens specified in Phantom, one is public tokens (that is, common QRC20), and the other is hidden tokens.

The process of implementing private transactions with zk-SNARKs is roughly the same. When Alice wants to anonymously transfer a QTUM to Bob, she needs to exchange the QTUM for a privacy token, say zk-QTUM. Then, she initiates a transaction request to the system. Then the system will generate a set of parameters for Alice's transaction information through an algorithm; then, the verifier (that is, the PoS node on Qtum) will verify this set of parameters.

When this set of parameters meets the requirements specified by the system, the verifier executes Alice’s request and transfers her zk-QTUM to Bob’s account, but this result is not recorded on the chain, and the on-chain part is only generated by Alice’s transaction information The parameters (also called "proof") and the result of the verifier verification.

As a result, no one knows the specific transaction information except the two parties, but the validity of the transaction is guaranteed.

secondary title

Phantom innovation

Phantom's improvements to zk-SNARKs are mainly focused on the fact that anonymous transactions cost less Gas and the creation time of transactions is shorter.

First, Phantom uses the Shrubs Merkle tree to store "commitments" to improve efficiency.

In a zk-SNARKs solution, a ticket represents the amount and recipient of an anonymous asset. The bill commitment is a unique sign generated by the system through a trapdoor function based on the bill information, so that the verifier can verify the transaction without viewing the original data.

After the bill commitment is generated, it will be stored in the Merkle tree. Every time a transaction is added to the chain, the tree needs to add a leaf node to store its bill commitment, so the entire Merkle tree needs to constantly update the state, consuming a lot of calculations.

In Phantom, it innovatively introduces a structure called Node Merkle tree, which converts the data and hash values ​​recorded on the original tree into root nodes that record multiple subtrees (Node), and gives multiple subtrees (Node) tree builds a Merkle tree.

image description

Node Merkle Tree

"This is an idea of ​​exchanging space for time, that is, increasing the storage space of the tree in exchange for lower calculations required to update the tree." Zheng Yi concluded.

The second innovation of Phantom is that an on-chain encrypted transmission method called In-band Secret (on-chain secret distribution) is added on the basis of zk-SNARKs.

In the original solution, because the address and amount of the anonymous transaction are not published on the chain, the recipient of the transaction cannot see the update of his account from the chain. To solve this problem, the sender of the transaction usually needs to send the transaction information (including the unencrypted address and amount) to the receiver through the off-chain method.

The method of sending is ancient and manual, such as taking a screenshot and transmitting it through social platforms such as WeChat, or the receiver tells the sender an IP address for the sender to connect to. After obtaining the original transaction information, the receiver can use it to construct a transaction and spend the funds transferred to itself.

In order to realize anonymous transactions, zk-SNARKs introduces this primitive and cumbersome operation under the chain.

On-chain secret distribution technology can make the whole process on-chain and efficient. The realization idea is to support the sender to encrypt the transaction information with the key and upload it to the chain. At the same time, the key can also be transmitted to the chain through key sharing. Recover the transaction key and restore the original transaction data.

secondary title

The least "sexy" tech

For the future of privacy, the potential is huge, but as Zheng Yi said, due to problems such as high technical difficulty, few development resources (researchers), and unknown market space, privacy has not yet achieved a major technological breakthrough.

Privacy projects based on improved zero-knowledge proof algorithms also face the "privacy impossible triangle" of privacy, usability, and scalability.

The problem of usability is the most prominent, which is mainly reflected in the high cost of privacy transactions (mainly referring to transaction fees).

As shown below, among various zero-knowledge proof algorithms, using the Σ-Bullets technology developed by Aztec Protocol to conduct private transactions costs the least, 0.9 Milion (Gas Used) * 5 GWei (current Gas Price) = 0.0045 ETH (in ETH 200 US dollars (approximately 6.3 yuan), the transaction cost can reach 3 times that of ordinary transactions; while for other schemes, the cost of each private transaction can even reach 3-8 times that of Aztec.

The high cost of use will inevitably scare away many potential adopters of the budding privacy technology. But that's pretty much the status quo that privacy is hard to change.

What is even more pessimistic is that teams like Aztec that can propose highly innovative algorithms are rare in the world. Among the teams that overcome the privacy problem, there are many projects such as Zether, which are jointly developed by Stanford researchers and the Visa research department but are still in the experimental demonstration stage; zk-STARKs, PLONK, etc., which are regarded as the evolution of zk-SNARKs, are still in the experimental stage. room stage.

In this regard, Zheng Yi believes that some privacy developers may have fallen into a misunderstanding, that is, excessive pursuit of theoretical rigor, and taking too long on some super difficult problems, resulting in slow progress or even difficult delivery.

For the "impossible triangle" that is difficult to realize, Zheng Yi believes that it can be solved through economic problems. Just like the design of Bitcoin, it faces the possibility of being double-spend at any time, but Satoshi Nakamoto makes the person who acquires this ability pay a huge price through the setting of the mining algorithm, so as to reduce the occurrence of this event as much as possible probability, rather than wait until this problem is completely resolved before launching Bitcoin.

In addition to the pursuit of perfect interpretation by existing developers, Zheng Yi believes that another major obstacle to the development of privacy technology is that because it is too sophisticated, projects that are hyped in the market are rarely involved. The high demand for cross-chain is not due to the fact that people's demand for cross-chain has exploded, but more because it quickly gained the market as a story.

Without a voice, privacy naturally lacks corresponding attention, thus entering a cycle of lack of development resources.

Of course, looking optimistically, compared with the past, there are more and more privacy projects now, and the usage scenarios are no longer limited to private transactions, but cover private smart contracts and the use of privacy technologies to ensure data integrity and security .

For example, Filecoin uses zk-SNARKs technology to help verifiers verify that miners have indeed copied and saved user files. In this process, miners only need to upload concise proofs to the chain, and do not need to publish the specific information of the stored files, thus effectively protecting user privacy.

According to Zheng Yi's understanding, the mining mechanism of Filecoin has made many practitioners who want to profit from mining actively research zk-SNARKs.

In such a step-by-step adoption, the privacy technology, which is an important cornerstone of the blockchain world, may usher in the day when the network effect will be formed.