Privacy Pools: Where Will Privacy Pools Go After Vitalik's New Paper and Tornado Cash?
Original author: Kaori, BlockBeats
Original editor: Jaleel, 0x 26, BlockBeats
When it comes to privacy involving human nature, although blockchain data is publicly transparent and traceable, it seems that we have found a utopia of freedom and equality. However, on the other hand, how to protect transactions or personal privacy has also become an unavoidable issue. Despite the need for privacy protection, the tricky part is that we still live in a digitally centralized regulatory society. The journey to enable privacy and regulation to coexist on public blockchains will be a long one.
Last week, Vitalik and four other authors published a paper called "Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium," which sparked widespread discussion.
The authors of this paper stated that it avoids the legal debate of who is right or wrong and aims to solve the problem that Tornado Cash cannot distinguish between illegal user behavior and normal user behavior. Based on existing privacy protocol technology, it proposes a new technical solution called Privacy Pools.
The problem that Privacy Pools aims to solve is whether privacy and regulation can really coexist on public blockchains.
How Privacy Pools Prove That Money Is "Clean"
As a neutral infrastructure, the core idea of Privacy Pools is to allow users to publish zkSNARK proofs to prove that their funds come from known legitimate sources or not from illegal sources, without disclosing the entire transaction process publicly.
In other words, by using Privacy Pools, you can prove in a way that anyone can verify that my deposit is legal and not from those illegal funds. Then provide this proof, and you don't need to disclose your exact deposit information anymore, thus protecting transaction privacy.
With the support of the zkSNARK proof model, the specific implementation of Privacy Pools requires another core configuration, the Association Set.
The so-called Association Set is generated by the Association Set Provider (ASP) following certain rules. For example, the rule of this Association Set is "including" - "all deposits from trusted trading platforms," while the rule of another Association Set is "excluding" - "all deposits except those marked as risky." Then users only need to prove their membership in the Association Set, without disclosing which Association Set they have chosen, just by making a commitment, they can demonstrate compliance without fully disclosing their transactions.
Users deposit to Privacy Pools, and each deposit is assigned a unique secret/coin ID. When withdrawing, users specify an associated set that is related to their deposit. By providing a nullifier, they prove that they indeed have this deposit and that the deposit belongs to the selected associated set, allowing them to display it without revealing the specific deposit. In special cases, users can also provide more direct proof to the counterparty to explain the specific deposit.
One notable feature of Privacy Pools' associated sets is that ordinary users are incentivized to prove that they belong to a legitimate associated set in order to "prove their innocence," while illegal users cannot provide this proof, achieving "separation equilibrium."
In his paper, Vitalik provides a vivid and illustrative explanation of one use case, which is excerpted here for readers to understand.
Let's assume there are five users: Alice, Bob, Carl, David, and Eve. The first four are honest, while Eve is a known thief. Although Eve's true identity may be unknown, the public knows that funds received at the address marked as "Eve" are stolen.
When each user makes a withdrawal, they can choose an associated set that must include their own deposit. This means that when choosing an associated set, each user cannot exclude their own deposit.
For Alice, Bob, Carl, and David, to avoid association with the known bad actor Eve, they can choose an associated set that does not include Eve. This way, they can prove that they are not associated with Eve.
However, Eve faces a problem. They cannot choose an associated set that only includes themselves because it would immediately reveal that they are a bad actor. In an attempt to hide their actions, Eve may choose an associated set that includes all five users in an attempt to confuse and obfuscate.
Because the other four users have chosen association sets that do not include Eve, this makes Eve's attempts futile, as people can determine through process of elimination that Eve is the bad actor.
The result is that through the selection of association sets, Alice, Bob, Carl, and David can prove that they are not associated with the known bad actor Eve. Eve cannot hide his bad behavior because his association set includes everyone.
The graph in the paper further illustrates the differences between these two types of proofs. Membership proof includes a specific deposit set, while exclusion proof's association set includes all deposits except for a specific deposit set.
In theory, Privacy Pools "still allow" North Korean hackers or any illegal users to use the protocol, but they are unable to generate high-quality whitelist proofs just like Eve. Although they may still be able to generate low-quality or outdated proofs to briefly confuse regulators, it is easier for regulators to locate illegal users compared to before.
Association Set: For and Against
The introduction of association sets allows users to prove their membership in the set instead of proving a direct link between withdrawals and deposits. However, there are many concerns and debates in the community about whether association sets can truly protect user privacy.
As mentioned earlier, association sets are generated by off-chain set providers following certain rules. But who is responsible for generating these association sets? Why should users trust these providers of association sets? And how can it be ensured that illegal addresses will not appear in these association pools in the future?
Some Twitter users have expressed concerns about how this is different from conducting CoinJoin transactions on Coinbase for compliant privacy. Although Privacy Pools are non-custodial privacy, used only to prove that you are not associated with illegal transactions, Coinbase has full control and custody of funds and has complete knowledge of user identities. But how do we know if association set providers have more or less knowledge about users selecting association sets compared to Coinbase's knowledge about its users?
One of the co-authors of the paper, Jacob Illum, a researcher at Chainalysis, an encryption industry research institution, said in a podcast that it is impossible for ordinary users to provide associated sets, as this requires some background and ability in blockchain forensics or blockchain analysis. Only those who have this ability, such as some analysis organizations or large financial institutions, can become associated set providers (ASPs).
At the same time, users need to choose associated sets that are large enough to protect transaction privacy as much as possible, because the smaller the set, the greater the risk of exposure once the contents of the set are leaked.
The editor-in-chief of AX 1, VL (@VladislavLiu), said that illegal "users can still deceive the system with low-quality whitelist proofs. The paper suggests using third-party whitelist providers (i.e., associated set providers), but this brings another set of problems. What if these providers are not good enough? Or what if they are compromised?"
The paper provides several solutions for who is qualified to provide these associated sets, but in reality, no institution or organization has come forward to say that they can. This is the problem that Privacy Pools will soon face, and it is the challenge faced by all those who want to obtain blockchain privacy rights—trust or distrust, compromise or non-compromise, or indifference to privacy.
"Tornado Cash" VS "Privacy Pools"
When it comes to on-chain privacy protection, we have to mention Tornado Cash. Since Privacy Pools is an improvement based on Tornado Cash, let's see what the differences are between the two.
The main idea of Tornado Cash is to mix a large number of deposit and withdrawal behaviors together. After depositing tokens into Tornado, depositors provide ZK proofs to prove that they have made deposits and then withdraw from a new address, thereby cutting off the correlation between the deposit and withdrawal addresses. As a result, only the deposits and withdrawals can be seen on the chain, and the corresponding relationship between the two cannot be seen, so it has anonymity.
Related reading: "The most ingenious ZK application: Look back at the principle and business logic of Tornado Cash".
The key issue with Tornado Cash is that it is difficult for legitimate users to decouple from the criminal activities attracted by the protocol. If it is necessary to prove irrelevance, it relies on Tornado Cash's centralized server. Users need to provide specific information about the withdrawal to the server, and the server uses its own database to check which deposit corresponds to this withdrawal, and then generates this proof. However, as mentioned earlier, Privacy Pools put the transactions of legitimate users into a whitelist through the setting of association sets, so that illegal users cannot prove that their transactions belong to this association set, thus distinguishing between legitimate and illegal users.
In other words, Tornado Cash uses a general anonymous pool - all deposits and withdrawals are mixed in one pool. Privacy Pools use customizable anonymous sets - users can choose the deposit and withdrawal methods they want to mix according to their preferences and needs.
Twitter user @0x Arhat made a table to compare the two from the perspectives of flexibility, disclosure, privacy level, and other aspects.
Because Privacy Pools can customize the content of association sets, they can customize and update the association sets according to different jurisdictions or changing rules and requirements. And each association set has its own funding pool and proof rules, thus avoiding fund contamination. However, all deposits of Tornado Cash are placed in one funding pool, which easily leads to anonymous violations.
Privacy Pools also incentivize users to behave honestly in terms of compliance and reputation, while Tornado Cash operates on an basis without trust and permission, naturally attracting the favor of illegal users.
These are some settings envisioned by the paper authors that can allow Privacy Pools to avoid the fate of Tornado Cash, achieving a combination of regulation and privacy. To achieve this, it is necessary to sacrifice some privacy and add some "flexibility" on the basis of complete privacy and no permission.
KOL Eva Beylin (@evabeylin) believes that Privacy Pools can not only enhance transaction privacy, but also contribute in various aspects such as DAO governance (membership), node reputation, KYC compliance, and more. Privacy Pools may have a better future than Tornado Cash.
How to use Privacy Pools
Currently, Privacy Pools is still in the testing phase and users can test the protocol on the Optimism Goerli testnet.
1. Create Note?item_id=888" target="_blank" rel="noopener noreferrer">View more Wallet
2. Generate a mnemonic phrase and securely store it.
3. Set a password.
4. Download the Secrets file and upload it when logging in.
5. The registration steps are complete. When logging in, click "Choose File" and upload the downloaded json file, then enter the password.
Innocent in Privacy, Guilty in Privacy
Tornado Cash founder's experience has dealt a blow to the belief in "code is speech," and the emergence of Privacy Pools has once again raised questions about the decentralization of blockchain. For example, using Privacy Pools proves whether the source of funds has violated the original purpose of privacy protection. However, in order to comply with regulations, concessions seem to have to be made to strike a balance between the two, as more and more people realize that complete anonymity is no longer feasible in today's world.
In the end, there is a natural conflict between complete privacy and regulatory compliance that we cannot ignore, but we can make our own choices and seek a balance. Privacy Pools may not be the solution for everyone, but it is indeed a solution for many.
Where that balance lies requires not only industry builders to ponder, but also legislators and law enforcement to think about, because if you label privacy as a crime, then only criminals will have privacy.
References:
1.https://papers.ssrn.com/sol3/papers.cfm? abstract_id= 4563364
3.https://www.techflowpost.com/article/detail_13920.html
