commit 3e5367a2c554c330347a4788b1445a7326655aa0
parent 0f82c7b0c1f8ac611619d7ffe64c93b53c56187c
Author: Christian Grothoff <christian@grothoff.org>
Date: Tue, 11 May 2021 23:53:28 +0200
update comprehensive presentation
Diffstat:
5 files changed, 707 insertions(+), 66 deletions(-)
diff --git a/illiterate/illiterate.tex b/illiterate/illiterate.tex
@@ -35,11 +35,11 @@
executed in fiat currency with privacy and regulatory compliance, which
makes Taler suitable for a Central Bank Digital Currency (CBDC).
- My Oral Village has been developing user interfaces for electronic
+ My Oral Village (MOVE) has been developing user interfaces for electronic
payment systems that can be used by illiterate and innumerate groups,
with field experience from Kenya and Pakistan where substantial
- portions of the population cannot read or comprehend multi-digit
- numbers.
+ portions of the population cannot read multi-digit
+ numbers or text.
We propose to integrate the user interface work of My Oral Village
with the Taler payment system to create an inclusive payment solution
@@ -82,12 +82,14 @@ The unique sales propositions of Taler as it exists today are:
\item Ease of use (one-click, instant, no authentication during payment, again like cash)
\end{itemize}
-The last point is crucial for the proposed CBDC implementation: because
-payments with Taler only require authorization and not authentication, we
-believe the payment process with Taler is easy enough to be made accessible to
-illiterate or innumerate people. The proposed work will extend this list
-by making Taler {\bf suitable for illiterate and innumerate adults}. We also
-have plans to make Taler suitable for (numerate) children.
+The proposed work will extend this list by making Taler {\bf suitable for
+illiterate and innumerate adults}. After consultation with My Oral Village, we
+believe the payment process with Taler can be made safe and convenient for
+their use. Based on years of direct field research, MOVE develops
+locally-validated solutions that blend graphical representations of money,
+iconographic navigation cues and metaphors, and experimental insights from
+cognitive psychology. We also have plans to make Taler suitable for (numerate)
+children.
\subsection{Taler architecture}
@@ -172,13 +174,16 @@ transition into financial inclusion.
Our suite of ``oral information management'' (OIM) tools and solutions enable
poorly schooled individuals to safely and confidently engage in formal
-financial transactions. We are currently designing a mixed (digital and
+financial transactions. We are currently piloting a hybrid (digital and
paper-based) solution for entrepreneurial pastoralists in northern Kenya, and
-our testing our ``cash calculator'' for Android in Pakistan. We recently
-designed a passbook for new credit union members in Sierra Leone. With
-MicroSave, we wireframed a full 'concept-level' mobile money app for northern
-India. Our solution for savings groups in the Solomon Islands has been adopted
-by the Ministry of Women two local NGOs.
+testing our ``cash calculator'' for Android in Pakistan. We recently designed
+a passbook for new credit union members in Sierra Leone. With MicroSave, we
+wireframed a full 'concept-level' mobile money app for northern India. Our OIM
+solution for savings groups in the Solomon Islands has been adopted by the
+Ministry of Women and the Anglican Church of Melanesia. We are also developing
+a field experiment in Kenya with a team of numerical cognition researchers at
+the Universities of Tuebingen and Western Ontario.
+
\subsection{Company profile: Taler Systems SA}
@@ -259,8 +264,8 @@ available on all relevant platforms. However, consumer systems are
much less diverse and hence this effort is significantly smaller.
Deploying Taler at scale should have no major impact on monetary
-policy because the issued CBDC would be 1:1 backed by rand
-in the escrow account at the SARB. However, if there is a
+policy because the issued CBDC would be 1:1 backed by fiat currency
+in the escrow account at the central bank. However, if there is a
significant shift from the use of credit-cards to CBDC, there might
be a reduction in M2 from fractional reserve banking as CBDC is
debit-based while credit-cards are credit-based. Thus, instead of
diff --git a/presentations/2021-cb/slides.tex b/presentations/2021-cb/slides.tex
@@ -273,7 +273,7 @@ However, Taler is
\begin{frame}{Area II: Development/Research Extensions}
\framesubtitle{\url{https://myoralvillage.org/}}
-We have ideas for protocol extensions and ``smart money'':
+We have ideas for protocol extensions and ``programmable money'':
\begin{itemize}
\item Mediated wallet-to-wallet payments (instead of customer-to-merchant)
\item Privacy-preserving auctions (trading, currency exchange)
diff --git a/presentations/comprehensive/main.pdf b/presentations/comprehensive/main.pdf
Binary files differ.
diff --git a/presentations/comprehensive/main.tex b/presentations/comprehensive/main.tex
@@ -12,6 +12,7 @@
\usepackage{tikz,eurosym}
\usepackage[normalem]{ulem}
\usepackage{listings}
+\usepackage{adjustbox}
% CSS
\lstdefinelanguage{CSS}{
@@ -117,14 +118,12 @@
\vfill
% \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf}
- \includegraphics[width=0.66\textwidth]{taler-logo-2018.pdf}
+ \includegraphics[width=0.66\textwidth]{logo-2020.jpg}
\end{center}
-\begin{textblock*}{4cm}(.5cm,6.5cm) % {block width} (coords)
- {\Large {\bf \url{taler.net}} \\
- IRC{\bf \#taler} \\
- {\small (on freenode)} \\
- twitter@taler \\
- mail@taler.net }
+\begin{textblock*}{6cm}(.5cm,7.7cm) % {block width} (coords)
+ {\Large {\bf \href{https://taler.net/}{taler.net}} \\
+ \href{https://twitter.com/taler}{taler@twitter} \\
+ \href{https://taler-systems.com/}{taler-systems.com}}
\end{textblock*}
% Substitute based on who is giving the talk!
@@ -235,6 +234,7 @@ identity.'' \hfill --Edward Snowden, IETF 93 (2015)
\begin{frame}
\frametitle{\includegraphics[height=0.5cm]{pics/bitcoin.jpeg}?}
+ \framesubtitle{Background: \url{https://blockchain.com/charts/}}
\centering
\noindent
\includegraphics[width=\textwidth]{pics/btc-transaction-cost.png}
@@ -279,7 +279,7 @@ ZeroCoin, CryptoNote (Monero) and ZeroCash (ZCash) offer anonymity.
\end{center}
\vfill
\begin{center}
- \includegraphics[scale=1.5]{taler-logo-2018.pdf}
+ \includegraphics[scale=1]{logo-2020.jpg}
\end{center}
\vfill
\begin{center}
@@ -293,7 +293,6 @@ ZeroCoin, CryptoNote (Monero) and ZeroCash (ZCash) offer anonymity.
\section{What is Taler?}
\begin{frame}{What is Taler?}
- \vfill
\begin{center}
Taler is an electronic instant payment system.
\end{center}
@@ -304,6 +303,36 @@ Taler is an electronic instant payment system.
or use it to create new {\bf regional currencies}
\end{itemize}
\vfill
+ \pause
+ \noindent
+ However, Taler is
+ \begin{itemize}
+ \item \emph{not} a currency
+ \item \emph{not} a long-term store of value
+ \item \emph{not} a network or instance of a system
+ \item \emph{not} decentralized
+ \item \emph{not} based on proof-of-work or proof-of-stake
+ \item \emph{not} a speculative asset / ``get-rich-quick scheme''
+ \end{itemize}
+\end{frame}
+
+
+\begin{frame}{Design principles}
+ \framesubtitle{https://taler.net/en/principles.html}
+GNU Taler must ...
+\begin{enumerate}
+ \item {... be implemented as {\bf free software}.}
+ \item {... protect the {\bf privacy of buyers}.}
+ \item {... must enable the state to {\bf tax income} and crack down on
+ illegal business activities.}
+ \item {... prevent payment fraud.}
+ \item {... only {\bf disclose the minimal amount of information
+ necessary}.}
+ \item {... be usable.}
+ \item {... be efficient.}
+ \item {... avoid single points of failure.}
+ \item {... foster {\bf competition}.}
+\end{enumerate}
\end{frame}
@@ -317,7 +346,7 @@ Taler is an electronic instant payment system.
\node (customer) [def, draw, below left=of origin] {Customer};
\node (merchant) [def, draw, below right=of origin] {Merchant};
\node (auditor) [def, draw, above right=of origin]{Auditor};
- \node (regulator) [def, draw, above=of auditor]{CSSF};
+% \node (regulator) [def, draw, above=of auditor]{CSSF};
\tikzstyle{C} = [color=black, line width=1pt]
@@ -325,24 +354,190 @@ Taler is an electronic instant payment system.
\draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins};
\draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins};
\draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify};
- \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report};
+% \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report};
\end{tikzpicture}
\end{center}
\end{frame}
+\begin{frame}{The Taler Software Ecosystem}
+ \framesubtitle{\url{https://taler.net/en/docs.html}}
+ Taler is based on modular components that work together to provide a
+ complete payment system:
+ \vfill
+ \begin{itemize}
+ \item {\bf Exchange:} Service provider for digital cash
+ \begin{itemize}
+ \item Core exchange software (cryptography, database)
+ \item Air-gapped key management, real-time {\bf auditing}
+ \item LibEuFin: Modular integration with banking systems
+ \end{itemize}
+ \item {\bf Merchant:} Integration service for existing businesses
+ \begin{itemize}
+ \item Core merchant backend software (cryptography, database)
+ \item Back-office interface for staff
+ \item Frontend integration (E-commerce, Point-of-sale)
+ \end{itemize}
+ \item {\bf Wallet:} Consumer-controlled applications for e-cash
+ \begin{itemize}
+ \item Multi-platform wallet software (for browsers \& mobile phones)
+ \item Wallet backup storage providers
+ \item {\bf Anastasis}: Recovery of lost wallets based on secret splitting
+ \end{itemize}
+ \end{itemize}
+\end{frame}
+
\begin{frame}
% TODO: replace with simplified NEW architecture picture!
\frametitle{Architecture of Taler}
\begin{center}
- \includegraphics[width=0.9\textwidth]{illustrations/taler-arch-full.pdf}
+ \includegraphics[width=1\textwidth]{operations.png}
+\end{center}
+\end{frame}
+
+
+\begin{frame}[fragile]{Taler: Bank Perspective}
+\begin{adjustbox}{max totalsize={.9\textwidth}{.7\textheight},center}
+\begin{tikzpicture}
+ \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em];
+ \node (origin) at (0,0) {};
+ \node (exchange) [def,above=of origin,draw]{Exchange};
+ \node (nexus) [def, draw, below right=of exchange] {Nexus};
+ \node (corebanking) [def, draw, below left=of nexus] {Core Banking};
+ \node (nginx) [def, draw, above=of exchange]{Nginx};
+ \node (postgres) [def, draw, below left=of exchange]{Postgres};
+ \node (postgres-nexus) [def, draw, below right=of nexus]{Postgres};
+
+ \tikzstyle{C} = [color=black, line width=1pt]
+
+ \draw [<-, C] (exchange) -- (nginx) node [midway, above, sloped] (TextNode) {REST API};
+ \draw [<-, C] (postgres) -- (exchange) node [midway, above, sloped] (TextNode) {SQL};
+ \draw [<-, C] (postgres-nexus) -- (nexus) node [midway, above, sloped] (TextNode) {SQL};
+ \draw [<-, C] (nexus) -- (exchange) node [midway, above, sloped] (TextNode) {Internal REST API};
+ \draw [<-, C] (corebanking) -- (nexus) node [midway, above, sloped] (TextNode) {EBICS/FinTS};
+
+\end{tikzpicture}
+\end{adjustbox}
+\end{frame}
+
+
+\begin{frame}{Taler: Exchange Architecture}
+\begin{center}
+\begin{tikzpicture}
+ \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em];
+ \node (origin) at (0,0) {};
+ \node (httpd) [def,above=of origin,draw]{httpd};
+ \node (secmod-rsa) [def, draw, right=of httpd] {secmod-rsa};
+ \node (secmod-eddsa) [def, draw, left=of httpd] {secmod-eddsa};
+ \node (postgres) [def, draw, below=of httpd]{Postgres};
+ \node (aggregator) [def, draw, right=of postgres]{aggregator};
+ \node (transfer) [def, draw, below left=of postgres]{transfer};
+ \node (wirewatch) [def, draw, below right=of postgres]{wirewatch};
+ \node (nexus) [def, draw, below=of postgres]{Nexus};
+
+ \tikzstyle{C} = [color=black, line width=1pt]
- $\Rightarrow$ Convenient, taxable, privacy-enhancing, \& resource friendly!
+ \draw [<->, C] (httpd) -- (postgres) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (httpd) -- (secmod-rsa) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (httpd) -- (secmod-eddsa) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (aggregator) -- (postgres) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (wirewatch) -- (postgres) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (transfer) -- (postgres) node [midway, above, sloped] (TextNode) {};
+ \draw [->, C] (transfer) -- (nexus) node [midway, above, sloped] (TextNode) {};
+ \draw [<-, C] (wirewatch) -- (nexus) node [midway, above, sloped] (TextNode) {};
+\end{tikzpicture}
\end{center}
\end{frame}
+\begin{frame}
+\frametitle{Taler: Auditor Perspective}
+\begin{center}
+\begin{tikzpicture}
+ \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em];
+ \node (origin) at (0,0) {};
+ \node (httpd) [def,above left=of origin,draw]{auditor-httpd};
+ \node (report) [def,above right=of origin,draw]{auditor-report};
+ \node (postgres-A) [def, draw, below=of origin] {Postgres (Auditor)};
+ \node (postgres-E) [def, draw, below=of postgres-A] {Postgres (Bank)};
+
+ \tikzstyle{C} = [color=black, line width=1pt]
+
+ \draw [->, C] (postgres-E) -- (postgres-A) node [midway, above, sloped] (TextNode) {sync};
+ \draw [<->, C] (httpd) -- (postgres-A) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (report) -- (postgres-A) node [midway, above, sloped] (TextNode) {};
+\end{tikzpicture}
+\end{center}
+\end{frame}
+
+
+\begin{frame}
+\frametitle{Taler: Merchant Perspective}
+\begin{center}
+\begin{tikzpicture}
+ \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em];
+ \node (origin) at (0,0) {};
+ \node (frontend) [def,above=of origin,draw]{merchant-frontend};
+ \node (backend) [def,below=of frontend,draw]{taler-backend};
+ \node (postgres) [def, draw, below left=of backend] {Postgres};
+ \node (sqlite) [def, draw, below=of backend] {Sqlite};
+ \node (alt) [def, draw, below right=of backend] {...};
+
+ \tikzstyle{C} = [color=black, line width=1pt]
+
+ \draw [->, C] (frontend) -- (backend) node [midway, above, sloped] (TextNode) {REST API};
+ \draw [<->, C] (backend) -- (postgres) node [midway, above, sloped] (TextNode) {SQL};
+ \draw [<->, C] (backend) -- (sqlite) node [midway, above, sloped] (TextNode) {SQL};
+ \draw [<->, C] (backend) -- (alt) node [midway, above, sloped] (TextNode) {SQL};
+\end{tikzpicture}
+\end{center}
+\end{frame}
+
+
+\begin{frame}
+\frametitle{Taler: Wallet Architecture}
+ \framesubtitle{Background: \url{https://anastasis.lu/}}
+\begin{center}
+\begin{tikzpicture}
+ \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em];
+ \node (origin) at (0,0) {};
+ \node (gui) [def,above=of origin,draw]{wallet-gui};
+ \node (core) [def,below=of gui,draw]{wallet-core};
+ \node (sync) [def, draw, below left=of core] {Sync};
+ \node (taler) [def, draw, below right=of core] {Taler};
+ \node (anastasis) [def, draw, below=of core] {Anastasis};
+
+ \tikzstyle{C} = [color=black, line width=1pt]
+ \draw [<->, C] (gui) -- (core) node [midway, above, sloped] (TextNode) {};
+ \draw [<->, C] (core) -- (sync) node [midway, above, sloped] (TextNode) {Backup};
+ \draw [<->, C] (core) -- (taler) node [midway, above, sloped] (TextNode) {Payment};
+ \draw [<->, C] (core) -- (anastasis) node [midway, above, sloped] (TextNode) {Key Escrow};
+\end{tikzpicture}
+\end{center}
+\end{frame}
+
+
+\begin{frame}{Taler: Unique Regulatory Features for Central Banks}
+ \framesubtitle{\url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03}}
+ \begin{itemize}
+ \item Central bank issues digital coins equivalent to issuing cash \\
+ $\Rightarrow$ monetary policy remains under CB control
+ \item Architecture with consumer accounts at commercial banks \\
+ $\Rightarrow$ no competition for commercial banking (S\&L) \\
+ $\Rightarrow$ CB does not have to manage KYC, customer support
+ \item Withdrawal limits and denomination expiration \\
+ $\Rightarrow$ protects against bank runs and hoarding
+ \item Income transparency and possibility to set fees \\
+ $\Rightarrow$ additional insights into economy and new policy options
+ \item Revocation protocols and loss limitations \\
+ $\Rightarrow$ exit strategy and handles catastrophic security incidents
+ \item Privacy by cryptographic design not organizational compliance \\
+ $\Rightarrow$ CB cannot be forced to facilitate mass-surveillance
+ \end{itemize}
+\end{frame}
+
+
\begin{frame}{Usability of Taler}
\vfill
\begin{center}
@@ -401,6 +596,7 @@ Taler is an electronic instant payment system.
\begin{frame}{Use Case: Anti-Spam}
+ \framesubtitle{Background: \url{https://pep.security/}}
Today, p$\equiv$p provides authenticated encryption for e-mail:
\begin{itemize}
\item Free software
@@ -458,7 +654,20 @@ Taler is an electronic instant payment system.
\end{frame}
-\begin{frame}{Taxability}
+\begin{frame}{How does it work?}
+We use a few ancient constructions:
+ \begin{itemize}
+ \item Cryptographic hash function (1989)
+ \item Blind signature (1983)
+ \item Schnorr signature (1989)
+ \item Diffie-Hellman key exchange (1976)
+ \item Cut-and-choose zero-knowledge proof (1985)
+ \end{itemize}
+But of course we use modern instantiations.
+\end{frame}
+
+
+\begin{frame}{Definition: Taxability}
We say Taler is taxable because:
\begin{itemize}
\item Merchant's income is visible from deposits.
@@ -473,19 +682,6 @@ Taler is an electronic instant payment system.
\end{frame}
-\begin{frame}{How does it work?}
-We use a few ancient constructions:
- \begin{itemize}
- \item Cryptographic hash function (1989)
- \item Blind signature (1983)
- \item Schnorr signature (1989)
- \item Diffie-Hellman key exchange (1976)
- \item Cut-and-choose zero-knowledge proof (1985)
- \end{itemize}
-But of course we use modern instantiations.
-\end{frame}
-
-
\begin{frame}{Exchange setup: Create a denomination key (RSA)}
\begin{minipage}{6cm}
\begin{enumerate}
@@ -660,17 +856,6 @@ But of course we use modern instantiations.
\end{frame}
-\begin{frame}{Merchant Integration: Wallet Detection}
- \lstset{language=JavaScript}
- \lstinputlisting{figs/taler-presence-js.html}
-% \caption{Sample code to detect the Taler wallet. Allowing the
-% Web site to detect the presence of the wallet leaks one bit
-% of information about the user. The above logic also works
-% if the wallet is installed while the page is open.}
-% \label{listing:presence}
-\end{frame}
-
-
\begin{frame}{Merchant Integration: Payment Request}
% \begin{figure}[p!]
\lstset{language=HTML5}
@@ -769,6 +954,33 @@ But of course we use modern instantiations.
\includegraphics[width=\textwidth]{seal.pdf}
\end{minipage}
\end{minipage}
+ \vfill
+ The exchange does not only verify the signature, but also
+ checks that the coin was not double-spent.
+ \vfill
+ \pause
+ \begin{center}
+ {\bf Taler is an online payment system.}
+ \end{center}
+ \vfill
+\end{frame}
+
+
+\begin{frame}{Requirements: Online vs. Offline Digital Currencies}
+\framesubtitle{\url{https://taler.net/papers/euro-bearer-online-2021.pdf}}
+\begin{itemize}
+ \item Offline capabilities are sometimes cited as a requirement for digital payment solutions
+ \item All implementations must either use restrictive hardware elements and/or introduce
+ counterparty risk.
+ \item[$\Rightarrow$] Permanent offline features weaken a digital payment solution (privacy, security)
+ \item[$\Rightarrow$] Introduces unwarranted competition for physical cash (endangers emergency-preparedness).
+ \end{itemize}
+ We recommend a tiered approach:
+ \begin{enumerate}
+ \item Online-first, bearer-based digital currency with Taler
+ \item (Optional:) Limited offline mode for network outages
+ \item Physical cash for emergencies (power outage, catastrophic cyber incidents)
+ \end{enumerate}
\end{frame}
@@ -1190,6 +1402,7 @@ But of course we use modern instantiations.
\end{center}
This signature means that $M$ was the {\em first} to deposit
$C$ and that the exchange thus must pay $M$.
+ \vfill
\begin{center}
Without this, an evil exchange could renege on the deposit
confirmation and claim double-spending if a coin were
@@ -1291,18 +1504,79 @@ and (likely) would presume an evil exchange, forcing it to pay both merchants.
\end{frame}
-\begin{frame}{How to support?}
+\begin{frame}{Taler: Project Status}
+\framesubtitle{\url{https://docs.taler.net/}}
+\begin{itemize}
+ \item Cryptographic protocols and core exchange component are stable
+ \item Current focus: Merchant integration, settlement integration, wallet backup
+ \item Pilot project at Bern University of Applied Sciences cafeteria
+ \item Internal alpha deployment with a commercial bank in progress
+ \end{itemize}
+\end{frame}
+
+
+\begin{frame}{Next Steps: Possible Projects and Collaborations}
+ \vfill
+\begin{center}
+\includegraphics[width=1.0\textwidth]{taler-in-use.png}
+\end{center}
+\end{frame}
+
+
+\begin{frame}{Area I: System Integration and Partnerships}
+ \framesubtitle{\url{https://lists.gnu.org/mailman/listinfo/taler}}
+ Pilots with banking organizations could:
\begin{itemize}
- \item Join: \href{https://lists.gnu.org/mailman/listinfo/taler}{taler@gnu.org}, \href{irc://irc.freenode.net/\#taler}{\#taler}
- \item Coding \& design: \url{https://gnunet.org/bugs/}
- \item Translation: \url{https://git.taler.net/www.git/tree/locale/fr/LC_MESSAGES/messages.po}
- \item Integration: \url{https://docs.taler.net/}
- \item Donations: \url{https://gnunet.org/ev}
- \item Funding: \url{https://taler.net/en/investors.html}
+ \item Study integration with the underlying RTGS layer:
+ \begin{itemize}
+ \item Develop standardized operational procedures
+ \item Assess transaction performance at scale
+ \item Perform cost analysis in banking environment
+ \item Assess effort for integration with commercial banks
+ \end{itemize}
+ \item Analyze regulatory considerations for different legislations
+% \item Building awareness of Taler as a bearer-based retail CBDC
+ \item Perform independent security audits of Taler components
+ \item Determine and possibly close gaps in the existing solution
\end{itemize}
\end{frame}
+\begin{frame}{Area II: Development/Research Extensions}
+ \framesubtitle{Background: \url{https://myoralvillage.org/}}
+We have ideas for protocol extensions and ``programmable money'':
+ \begin{itemize}
+ \item Mediated wallet-to-wallet payments (instead of customer-to-merchant)
+ \item Privacy-preserving auctions (trading, currency exchange)
+ \item Age-restricted private payments for children (youth protection)
+ \end{itemize}
+Central banks should also consider funding research to improve:
+ \begin{itemize}
+ \item General digital wallet usability and availability
+ \item Accessibility features for illiterate and innumerate users
+ \item Projects that facilitate integration at retailers
+ \begin{itemize}
+ \item Hardware and software support for embedded systems
+ \item Integration into off-the-self E-commerce systems
+ \end{itemize}
+ \item Protocol extensions for automated tax reporting
+ \end{itemize}
+\end{frame}
+
+
+\begin{frame}{How to support?}
+ \begin{description}
+ \item[Join:] {\small \url{https://lists.gnu.org/mailman/listinfo/taler}}, \\
+ \url{irc://irc.freenode.net/\#taler}
+ \item[Develop:] \url{https://bugs.taler.net/}, \url{https://git.taler.net/}
+ \item[Translate:] \url{https://weblate.taler.net/}, \url{translation-volunteer@taler.net}
+ \item[Integrate:] \url{https://docs.taler.net/}
+ \item[Donate:] \url{https://gnunet.org/ev}
+ \item[Invest:] \url{https://taler-systems.com/}
+ \end{description}
+\end{frame}
+
+
\begin{frame}{Conclusion}
\begin{center}
{\bf What can we do?}
@@ -1310,9 +1584,9 @@ and (likely) would presume an evil exchange, forcing it to pay both merchants.
\vfill
\begin{itemize}
\item{Suffer mass-surveillance enabled by credit card oligopolies with high fees, and}
- \item{Engage in arms race with deliberately unregulatable blockchains, and}
- \item{Enjoy the ``benefits'' of cash \\
- \hfill \includegraphics[height=0.3\textheight]{atm-rupee.jpg} \hfill}
+ \item{Engage in arms race with deliberately unregulatable blockchains}
+% \item{Enjoy the ``benefits'' of cash \\
+% \hfill \includegraphics[height=0.3\textheight]{atm-rupee.jpg} \hfill}
\end{itemize}
\vfill
\begin{center}
@@ -1332,6 +1606,9 @@ and (likely) would presume an evil exchange, forcing it to pay both merchants.
References:
{\tiny
\begin{enumerate}
+ \item{David Chaum, Christian Grothoff and Thomas Moser.
+ {\em How to issue a central bank digital currency}.
+ {\bf SNB Working Papers, 2021}.}
\item{Christian Grothoff, Bart Polot and Carlo von Loesch.
{\em The Internet is broken: Idealistic Ideas for Building a GNU Network}.
{\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.}
@@ -1358,6 +1635,365 @@ References:
\end{frame}
+\section{Integration with the core banking system}
+
+\begin{frame}
+ \vfill
+ \begin{center}
+ {\bf Part II: Integration with the core banking system}
+ \end{center}
+ \vfill
+\end{frame}
+
+
+\begin{frame}
+\frametitle{High-level Deployment Recipe}
+\dots as a bank
+\begin{enumerate}
+ \item Create an escrow bank account for the exchange with EBICS access
+ \item Provision offline signing machine (or account during testing)
+ \item Provision two PostgreSQL databases (for LibEuFin Nexus and exchange)
+ \item Provision user-facing exchange service and secmod processes
+ \item Provision LibEuFin Nexus (connected to escrow account and providing
+ an internal API to the exchange)
+ \item Test using the ``taler-wallet-cli``
+\end{enumerate}
+\end{frame}
+
+
+\begin{frame}{Exchange escrow account access}
+The Taler exchange needs to communicate with the core banking system \dots
+\begin{itemize}
+ \item to query for transactions into the exchange's escrow account
+ \item to initiate payments of aggregated Taler deposits to merchants
+\end{itemize}
+
+In a Taler deployment, the \emph{Taler Wire Gateway} provides an API to the exchange
+for Taler-specific access to the Exchange's escrow account. Multiple implementations
+of the Taler Wire Gateway exist:
+
+\begin{itemize}
+ \item a self-contained play money demo bank
+ \item LibEuFin, an adapter to EBICS and other protocols
+\end{itemize}
+
+\end{frame}
+
+\begin{frame}{LibEuFin}
+ LibEuFin is a standalone project that provides adapters to bank account
+ access APIs.
+
+ \begin{itemize}
+ \item LibEuFin provides both a generic access layer and an
+ implementation of the Taler Wire Gateway API for the exchange
+ \item currently, only EBICS 2.5 is supported
+ \item other APIs such as FinTS or PSD2-style XS2A APIs can be added
+ without requiring changes to the Exchange
+ \item tested with a GLS business account
+ \end{itemize}
+\end{frame}
+
+\begin{frame}{LibEuFin Concepts}
+ \begin{itemize}
+ \item A LibEuFin \emph{bank connection} is a set of credentials and parameters
+ to talk to the bank's account access API.
+ \item A LibEuFin \emph{bank account} is the information about a bank
+ account (balances, transactions, payment initiations) stored locally
+ within the LibEuFin service. A LibEuFin bank account has a default Bank
+ Connection that is used to communicate with the bank's API.
+ \item A \emph{facade} provides a domain-specific access layer to bank accounts
+ and connections. The \emph{Taler Wire Gateway Facade} implements the
+ API required by the Taler exchange and translates it to operations on the
+ underlying account/connection.
+ \end{itemize}
+\end{frame}
+
+\begin{frame}{LibEuFin Tooling}
+ \begin{itemize}
+ \item \texttt{libeufin-nexus} is the main service
+ \item Almost all configuration (except DB credentials)
+ is stored in the database and managed via a RESTful HTTP API
+ \item \texttt{libeufin-sandbox} implements a toy EBICS host for protocol
+ testing
+ \item \texttt{libeufin-cli} is client for the HTTP API (only implements a subset
+ of available functionality)
+ \end{itemize}
+\end{frame}
+
+\begin{frame}{LibEuFin Setup Overview}
+ \begin{itemize}
+ \item Obtain EBICS subscriber configuration (host URL, host ID, user ID,
+ partner ID) for the Exchange's escrow account
+ \item Deploy the LibEuFin Nexus service
+ \item Create a new LibEuFin bank connection (of type \texttt{ebics})
+ \item Export and back up the key material for the bank connection (contains
+ EBICS subscriber configuration and private keys)
+ \item Send subscriber initialization to the EBICS host (electronically)
+ \item Export key letter and activate subscriber in the EBICS host (manually)
+ \item Synchronize the bank connection
+ \item Import the account into LibEuFin
+ \item Create a Taler Wire Gateway facade
+ \item Set up scheduled tasks for ingesting new transactions / sending payment
+ initiations
+ \end{itemize}
+\end{frame}
+
+
+
+\begin{frame}{LibEuFin Implementation Limitations}
+ \begin{itemize}
+ \item LibEuFin is less stable than other Taler components, and future
+ updates might contain breaking changes (tooling, APIs and database
+ schema)
+ \item Error handling and recovery is still rather primitive
+ \item The Taler Wire Gateway does not yet implement automatic return
+ transactions when transactions with a malformed subject (i.e. no reserve
+ public key) are received
+ \end{itemize}
+\end{frame}
+
+\begin{frame}{LibEuFin EBICS Limitations}
+ The GLS accounts with EBICS access that we have access to have some limitations:
+ \begin{itemize}
+ \item SEPA Instant Credit Transfers aren't supported yet
+ \item Erroneous payment initiations are accepted by the GLS EBICS host,
+ but an error message is later sent only by paper mail (and not reported
+ by the CRZ download request)
+ \item Limited access to transaction history (3 months)
+ \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile]{LibEuFin Setup Guide}
+\vfill
+\begin{center}
+\url{https://docs.taler.net/libeufin/nexus-tutorial.html}
+\end{center}
+\vfill
+\end{frame}
+
+
+\section{Operator security considerations}
+
+\begin{frame}
+ \vfill
+ \begin{center}
+ {\bf Part III: Operator security considerations}
+ \end{center}
+ \vfill
+\end{frame}
+
+
+\begin{frame}{Key management}
+Taler has many types of keys:
+\begin{itemize}
+\item Coin keys
+\item Denomination keys
+\item Online message signing keys
+\item Offline key signing keys
+\item Merchant keys
+\item Auditor key
+\item Security module keys
+\item Transfer keys
+\item Wallet keys
+\item {\em TLS keys, DNSSEC keys}
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Offline keys}
+Both exchange and auditor use offline keys.
+\begin{itemize}
+\item Those keys must be backed up and remain highly confidential!
+\item We recommend that computers that have ever had access to those
+ keys to NEVER again go online.
+\item We recommend using a Raspberry Pi for offline key operations.
+ Store it in a safe under multiple locks and keys.
+\item Apply full-disk encryption on offline-key signing systems.
+\item Have 3--5 full-disk backups of offline-key signing systems.
+\end{itemize}
+\begin{center}
+\includegraphics[scale=0.1]{pi.png}
+\end{center}
+\end{frame}
+
+
+\begin{frame}{Online keys}
+The exchange needs RSA and EdDSA keys to be available for online signing.
+\begin{itemize}
+\item Knowledge of these private keys will allow an adversary to
+ mint digital cash, possibly resulting in huge financial losses
+ (eventually, this will be detected by the auditor, but only
+ after some financial losses have been irrevocably incurred).
+\item The corresponding public keys are certified using
+ Taler's public key infrastructure (which uses offline-only keys).
+\end{itemize}
+\begin{center}
+\includegraphics[width=0.5\textwidth]{taler-diagram-signatures.png}
+\end{center}
+\vfill
+{\tt taler-exchange-offline} can also be used to {\bf revoke} the
+online signing keys, if we find they have been compromised.
+\vfill
+\end{frame}
+
+
+\begin{frame}{Protecting online keys}
+The exchange needs RSA and EdDSA keys to be available for online signing.
+\begin{itemize}
+\item {\tt taler-exchange-secmod-rsa} and {\tt taler-exchange-secmod-eddsa}
+ are the only processes that must have access to the private keys.
+\item The secmod processes should run under a different UID, but share
+ the same GID with the exchange.
+\item The secmods generate the keys, allow {\tt taler-exchange-httpd} to sign with
+ them, and eventually delete the private keys.
+\item Communication between secmods and {\tt taler-exchange-httpd} is via
+ a UNIX domain socket.
+\item Online private keys are stored on disk (not in database!) and should
+ NOT be backed up (RAID should suffice). If disk is lost, we can always
+ create fresh replacement keys!
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Database}
+The exchange needs the database to detect double spending.
+\begin{itemize}
+\item Loss of the database will allow technically skilled people
+ to double-spend their digital cash, possibly resulting in
+ significant financial losses.
+\item The database contains total amounts customers withdrew and
+ merchants received, so sensitive private banking data. It
+ must also not become public.
+\item The auditor must have a (current) copy. Asynchronous replication
+ is considered sufficient. This copy could also be used as an
+ additional (off-site?) backup.
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{taler-exchange-wirewatch}
+{\tt taler-exchange-wirewatch} needs credentials to access data about
+incoming wire transfers from the Nexus.
+\begin{itemize}
+\item This tool should run as a separate UID and GID (from
+ {\tt taler-exchange-httpd}).
+\item It must have access to the Postgres database (SELECT + INSERT).
+\item Its configuration file contains the credentials to talk to Nexus.
+\item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}.
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{taler-exchange-transfer}
+Only {\tt taler-exchange-transfer} needs credentials to initiate wire
+transfers using the Nexus.
+\begin{itemize}
+\item This tool should run as a separate UID and GID (from
+ {\tt taler-exchange-httpd}).
+\item It must have access to the Postgres database (SELECT + INSERT).
+\item Its configuration file contains the credentials to talk to Nexus.
+\item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}.
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Nexus}
+The Nexus has to be able to interact with the escrow account of the bank.
+\begin{itemize}
+\item It must have the private keys to sign EBICS/FinTS messages.
+\item It also has its own local database.
+\item The Nexus user and database should be kept separate from
+ the other exchange users and the Taler exchange database.
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Hardware}
+General notions:
+\begin{itemize}
+\item Platforms with disabled Intel ME \& disabled remote administration are safer.
+\item VMs are not a security mechanism. Side-channel attacks abound. Avoid running any
+ Taler component in a virtual machine ``for security''.
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Operating system}
+General notions:
+\begin{itemize}
+\item It should be safe to run the different Taler components (including Nginx, Nexus
+ and Postgres) all on the same physical hardware (under different UIDs/GIDs).
+ We would separate them onto different physical machines during scale-out, but not
+ necessarily for ``basic'' security.
+\item Limiting and auditing system administrator access will be crucial.
+\item We recommend to {\bf not} use any anti-virus.
+\item We recommend using a well-supported GNU/Linux operating system (such as
+ Debian or Ubuntu).
+\end{itemize}
+\end{frame}
+
+
+\begin{frame}{Network}
+\begin{itemize}
+\item We recommend to {\bf not} use any host-based firewall.
+ Taler components can use UNIX domain sockets (or bind to localhost).
+\item A network-based
+ firewall is not required, but as long as TCP 80/443 are open Taler should
+ work fine.
+\item Any firewall must be configured to permit connection to Auditor
+ for database synchronization.
+\item We recommend running the Taler exchange behind an Nginx or Apache
+ proxy for TLS termination.
+\item We recommend using static IP address configurations (IPv4 and IPv6).
+\item We recommend using DNSSEC with DANE in addition to TLS certificates.
+\item We recommend auditing the TLS setup using \url{https://observatory.mozilla.org}.
+\end{itemize}
+\end{frame}
+
+
+\section{Integration considerations}
+
+\begin{frame}
+ \vfill
+ \begin{center}
+ {\bf Part IV: Integration considerations}
+ \end{center}
+ \vfill
+\end{frame}
+
+
+\begin{frame}[fragile]{RFC 8905: \texttt{payto:} Uniform Identifiers for Payments and Accounts}
+ \vfill
+ Like \texttt{mailto:}, but for bank accounts instead of email accounts!
+ \vfill
+ \begin{verbatim}
+ payto://<PAYMENT-METHOD>/<ACCOUNT-NR>
+ ?subject=InvoiceNr42
+ &amount=EUR:12.50
+ \end{verbatim}
+ \vfill
+ Default action: Open app to review and confirm payment.
+ \vfill
+\includegraphics[width=0.25\textwidth]{einzahlschein-ch.jpeg}
+\hfill
+\includegraphics[width=0.2\textwidth]{de-ueberweisungsformular.png}
+ \vfill
+\end{frame}
+
+
+\begin{frame}[fragile]{Benefits of {\tt payto://}}
+ \begin{itemize}
+ \item Standardized way to represent financial resources (bank account, bitcoin wallet)
+ and payments to them
+ \item Useful on the client-side on the Web and for FinTech backend applications
+ \item Payment methods (such as IBAN, ACH, Bitcoin) are registered with
+ IANA and allow extra options
+ \end{itemize}
+ \begin{center}
+ {\bf Taler wallet can generate payto://-URI for withdraw!}
+ \end{center}
+\end{frame}
+
\end{document}
diff --git a/presentations/comprehensive/taler-in-use.png b/presentations/comprehensive/taler-in-use.png
Binary files differ.
