SilentWhispers: Enforcing Security and Privacy in Decentralized Credit Networks

Transcription

1 SilentWhispers: Enforcing Security and Privacy in Decentralized Credit Networks $ Giulio Malavolta Saarland University Pedro Moreno-Sanchez Purdue University Aniket Kate Purdue University Matteo Maffei TU Vienna NDSS 2017

2 Yet Another Talk about Cryptocurrencies? TumbleBit and CoinShuffle++ are excellent ideas to provide privacy in Bitcoin 2

3 Yet Another Talk about Cryptocurrencies? TumbleBit and CoinShuffle++ are excellent ideas to provide privacy in Bitcoin Bitcoin (as other permissionless cryptocurrencies) relies on a blockchain: High storage requirement (>100 GB) High power consumption for proof-of-work 2

4 Yet Another Talk about Cryptocurrencies? TumbleBit and CoinShuffle++ are excellent ideas to provide privacy in Bitcoin Bitcoin (as other permissionless cryptocurrencies) relies on a blockchain: High storage requirement (>100 GB) High power consumption for proof-of-work Is it possible to have a decentralized payment system without a blockchain? 2

5 Credit (or IOU Settlement) Networks: Basics 3

6 Credit (or IOU Settlement) Networks: Basics Transactions in the real world pay $100 Bob Alice IOweYou $100 Bob Alice 3

7 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation Bob pay $100 Alice Bob 100 Alice IOweYou $100 Bob Alice 3

8 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation pay $100 Bob 100 Bob Alice Alice IOweYou $100 Bob Alice During a hike with Alice & Bob pay $10 Dave Carol IOweYou $10 Dave Carol 3

9 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation pay $100 Bob 100 Bob Alice Alice IOweYou $100 Bob Alice During a hike with Alice & Bob Dave pay $10 Carol Dave Carol IOweYou $10 Dave Carol 3

10 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation pay $100 Bob 100 Bob Alice Alice IOweYou $100 Bob Alice 10 During a hike with Alice & Bob Dave pay $10 Carol Dave Carol IOweYou $10 Dave Carol 3

11 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation pay $100 Bob Bob Alice Alice IOweYou $100 Bob Alice 10 During a hike with Alice & Bob Dave pay $10 Carol Dave Carol IOweYou $10 Dave Carol 3

12 Credit (or IOU Settlement) Networks: Basics Transactions in the real world A credit network representation pay $100 Bob Bob Alice Alice IOweYou $100 Bob Alice During a hike with Alice & Bob Dave pay $10 Carol Dave Carol IOweYou $10 Dave Carol 3

13 Credit Network Examples Academic proposals: Ostra: preventing spam [NSDI 08] Bazaar: strengthening e-commerce [NSDI 11] SumUp: Sybil-resilient content voting [NSDI 09] Industry deployments: Ripple: A real-life online payment network Stellar: Another real-life online payment network 4

14 Credit Network Examples Academic proposals: Ostra: preventing spam [NSDI 08] Bazaar: strengthening e-commerce [NSDI 11] SumUp: Sybil-resilient content voting [NSDI 09] Industry deployments: Ripple: A real-life online payment network Stellar: Another real-life online payment network 4

15 Ripple Credit Network 5

16 Ripple Credit Network 5

17 Ripple Credit Network 5

18 Ripple Credit Network 5

19 Ripple Credit Network 5

20 Ripple Credit Network 5

21 Ripple Credit Network 5

22 Ripple Credit Network AED $ CAD 100 5

23 Ripple Credit Network AED BTC 10 BTC 5 $ CAD 100 5

24 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM

25 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM Tx time Worldwide, cross-currency tx Integrity 5

26 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM Tx time ~ 1 day Worldwide, cross-currency tx Integrity ~ 5 seconds 5

27 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM Tx time ~ 1 day Worldwide, cross-currency tx High fees Integrity ~ 5 seconds Tiny fees 5

28 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM Tx time ~ 1 day Worldwide, cross-currency tx High fees Integrity Bank only ~ 5 seconds Tiny fees Public verifiability 5

29 Ripple Credit Network AED BTC 10 BTC 5 $ 60 CAD 100 XYZ 40 XID 100 GDW 10 FMM Tx time ~ 1 day ~ 5 seconds Worldwide, cross-currency tx High fees Ripple can significantly improve cross-currency remittance and settlements Tiny fees Integrity Bank only Public verifiability 5

30 Public Verifiability & Privacy Problem The Ripple Ledger Transaction Details Credit Graph 6

31 Public Verifiability & Privacy Problem The Ripple Ledger Transaction Details Credit Graph Listening to Whispers of Ripple: Linking Wallets and Deanonymizing Transactions in the Ripple Network Pedro Moreno-Sanchez, Muhammad Bilal Zafar, Aniket Kate. PETS 16 6

32 Public Verifiability & Privacy Problem The Ripple Ledger Transaction Details Credit Graph Listening to Whispers of Ripple: Linking Wallets and Deanonymizing Transactions in the Ripple Network Pedro Moreno-Sanchez, Muhammad Bilal Zafar, Aniket Kate. PETS 16 Current credit networks employ a global ledger 6

33 Our Contributions We question the need for a global ledger and global consensus 7

34 Our Contributions We question the need for a global ledger and global consensus SilentWhispers: Decentralized credit network with security and privacy guarantees defined in UC framework Inspired by our work in NDSS 15 7

35 Our Contributions We question the need for a global ledger and global consensus SilentWhispers: Decentralized credit network with security and privacy guarantees defined in UC framework Inspired by our work in NDSS 15 SilentWhispers overcomes several challenges: existence of a path, credit on a path and integrity of transactions 7

36 Our Contributions We question the need for a global ledger and global consensus SilentWhispers uses distributed landmark routing, secure multiparty computation and 2-step transactions SilentWhispers: Decentralized credit network with security and privacy guarantees defined in UC framework Inspired by our work in NDSS 15 SilentWhispers overcomes several challenges: existence of a path, credit on a path and integrity of transactions 7

37 Our Contributions We question the need for a global ledger and global consensus SilentWhispers uses distributed landmark routing, secure multiparty computation and 2-step transactions SilentWhispers: Decentralized credit network with security and privacy guarantees defined in UC framework Inspired by our work in NDSS 15 SilentWhispers overcomes several challenges: existence of a path, credit on a path and integrity of transactions SilentWhispers is feasible in practice and offers interesting alternatives to current emerging payment systems 7

38 SilentWhispers: A Decentralized Credit Network 8

39 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network 8

40 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Alice 8

41 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Net-flow is what matters: Net-flow of a user must not change without the user s consent Alice 8

42 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Net-flow is what matters: Net-flow of a user must not change without the user s consent 5 Alice Charles Charles In-flow = 450 Out-flow = 40 Bob 25 Net-flow = 410 Alice 8

43 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Net-flow is what matters: Net-flow of a user must not change without the user s consent 5 Alice Charles Charles In-flow = 450 Out-flow = 40 Bob 25 Net-flow = 410 Alice 8

44 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Net-flow is what matters: Net-flow of a user must not change without the user s consent 5 Alice Charles Charles In-flow = 450 Out-flow = 40 Bob 25 Net-flow = 410 Alice 8

45 SilentWhispers: A Decentralized Credit Network Local Information suffices: Credit links of a user determine his credit in the network In-flow = Charles Out-flow = Bob 25 Net-flow = 410 Net-flow is what matters: Net-flow of a user must not change without the user s consent 5 Alice Charles Charles In-flow = 450 Out-flow = Bob 25 Net-flow = 410 Alice 8

46 Challenges Find paths between users Calculate credit available in the path Ensure integrity of transactions And more 9

47 The routing challenge 10

48 Routing Challenge: Landmark Routing 11

49 Routing Challenge: Landmark Routing Determine credit path from sender to receiver 11

50 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks 11

51 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) 11

52 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths 11

53 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths 11

54 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths U2 U3 11

55 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths U2 U3 U1 U4 11

56 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths Distributed BFS: Local information suffices U2 U3 U1 U4 11

57 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths Distributed BFS: Local information suffices U2 U3 U1 U4 11

58 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths Distributed BFS: Local information suffices U2 U3 U1 U4 11

59 Routing Challenge: Landmark Routing Determine credit path from sender to receiver Common problem in standard networks and ad-hoc networks The max-flow approach: Not scalable enough: O(V 3 ) or O(V 2 log(e)) Landmark routing [Tschusiya 89] Calculate subset of all paths Distributed BFS: Local information suffices Enough in practice 1,2 More efficient than max-flow 1,2 U2 U3 1 [Our work in NDSS 15] 2 [Viswanath et al. EUROSYS 12] U1 U4 11

60 Calculation of credit available in a path 12

61 Credit in a Path: SMPC

62 Credit in a Path: SMPC

63 Credit in a Path: SMPC [x]: Secret share of x [30] [30] [30] 13

64 Credit in a Path: SMPC [x]: Secret share of x [30] [30] [30] Given [x] it is not possible to know x 13

65 Credit in a Path: SMPC [x]: Secret share of x [30] [15] [30] [15] [30] Given [x] it is not possible to know x 13

66 Credit in a Path: SMPC [x]: Secret share of x [30] [15] [25] [30] [30] [15] [25] [25] Given [x] it is not possible to know x 13

67 Credit in a Path: SMPC [x]: Secret share of x [30] [15] [25] [10] [30] [25] [30] [15] [25] [10] [10] Given [x] it is not possible to know x 13

68 Credit in a Path: SMPC [x]: Secret share of x [credit in path] [30] [15] [credit in path] [25] [10] [30] [25] [30] [15] [25] [10] [10] [credit in path] Given [x] it is not possible to know x 13

69 Credit in a Path: SMPC [x]: Secret share of x [credit in path] [30] [15] [credit in path] [25] [10] [30] [25] [30] [15] [25] [10] [10] [credit in path] Given [x] it is not possible to know x 13

70 Credit in a Path: SMPC [x]: Secret share of x [credit in path] [30] [15] [credit in path] [25] [10] [30] [25] [30] [15] [25] [10] [10] [credit in path] Given [x] it is not possible to know x Given enough copies of [x] one can reconstruct x 13

71 Integrity of the transactions 14

72 Transaction Integrity and Dispute Resolution 15

73 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle 15

74 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example:

75 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 (5)

76 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 (5) (5)

77 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 (5) (5) Ok, received! 15

78 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 (5) Ok, received! 15

79 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 (5) Ok, received! Incentive 15

80 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: Ok, received! Incentive 15

81 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: Ok, received! Incentive Integrity: All landmarks cannot make the user lose credit 15

82 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 No! our credit is 15! Ok, received! Incentive Integrity: All landmarks cannot make the user lose credit 15

83 Transaction Integrity and Dispute Resolution 2-step transaction: on hold and settle Example: 5 No! our credit is 15! Ok, received! Incentive Integrity: All landmarks cannot make the user lose credit Accountability: In case of dispute, users must prove the link value Local logs suffice to determine the valid current value The disputed value is bounded 15

84 Evaluation 16

85 Evaluation and Discussion 17

86 Evaluation and Discussion C++ prototype implementation Secret Sharing-based MPC library: Shared 17

87 Evaluation and Discussion C++ prototype implementation Secret Sharing-based MPC library: Shared Setup using Ripple transactions: Maximum path length: 10 links Maximum number of paths: 7 landmarks (Ripple Gateways) 17

88 Evaluation and Discussion C++ prototype implementation Secret Sharing-based MPC library: Shared Setup using Ripple transactions: Maximum path length: 10 links Maximum number of paths: 7 landmarks (Ripple Gateways) Computing available credit on a path in ~1.3 seconds Different paths in parallel 17

89 Evaluation and Discussion C++ prototype implementation Secret Sharing-based MPC library: Shared Setup using Ripple transactions: Maximum path length: 10 links Maximum number of paths: 7 landmarks (Ripple Gateways) Computing available credit on a path in ~1.3 seconds Different paths in parallel Feasible to run in practice current Ripple transactions 17

90 Evaluation and Discussion C++ prototype implementation Secret Sharing-based MPC library: Shared Setup using Ripple transactions: Maximum path length: 10 links Maximum number of paths: 7 landmarks (Ripple Gateways) Computing available credit on a path in ~1.3 seconds Different paths in parallel Feasible to run in practice current Ripple transactions SilentWhispers has attracted attention from industry: KOINA: 17

91 The Landscape of Emerging Payment Systems 18

92 The Landscape of Emerging Payment Systems Cryptocurrencies Ripple SilentWhispers Transfer of funds Direct transactions between any two wallets Transactions only via a path with enough credit 18

93 The Landscape of Emerging Payment Systems Cryptocurrencies Ripple SilentWhispers Transfer of funds Direct transactions between any two wallets Transactions only via a path with enough credit Transaction flexibility Fixed currency agreed between sender and receiver Support for cross-currency transactions 18

94 The Landscape of Emerging Payment Systems Cryptocurrencies Ripple SilentWhispers Transfer of funds Direct transactions between any two wallets Transactions only via a path with enough credit Transaction flexibility Fixed currency agreed between sender and receiver Support for cross-currency transactions Transaction verification Globally verified Locally verified by users in the path 18

95 Take Home Message 19

96 Take Home Message A credit network does not require a global ledger or global consensus 19

97 Take Home Message A credit network does not require a global ledger or global consensus SilentWhispers: A decentralized credit network enforcing security and privacy and overcoming several challenges 19

98 Take Home Message A credit network does not require a global ledger or global consensus SilentWhispers is feasible in practice and it has attracted attention from industry SilentWhispers: A decentralized credit network enforcing security and privacy and overcoming several challenges 19

99 Take Home Message A credit network does not require a global ledger or global consensus SilentWhispers is feasible in practice and it has attracted attention from industry SilentWhispers: A decentralized credit network enforcing security and privacy and overcoming several challenges SilentWhispers is an interesting alternative in the landscape of emerging payment systems 19

100 Take Home Message A credit network does not require a global ledger or global consensus SilentWhispers is feasible in practice and it has attracted attention from industry SilentWhispers: A decentralized credit network enforcing security and privacy and overcoming several challenges SilentWhispers is an interesting alternative in the landscape of emerging payment systems 19