bb.tex (29496B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 9 \usetheme{boxes} 10 \setbeamertemplate{navigation symbols}{} 11 \usepackage{xcolor} 12 \usepackage{tikz,eurosym} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 \usepackage{adjustbox} 16 17 % CSS 18 \lstdefinelanguage{CSS}{ 19 basicstyle=\ttfamily\scriptsize, 20 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 21 sensitive=true, 22 morecomment=[l]{//}, 23 morecomment=[s]{/*}{*/}, 24 morestring=[b]', 25 morestring=[b]", 26 alsoletter={:}, 27 alsodigit={-} 28 } 29 30 % JavaScript 31 \lstdefinelanguage{JavaScript}{ 32 basicstyle=\ttfamily\scriptsize, 33 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 34 morecomment=[s]{/*}{*/}, 35 morecomment=[l]//, 36 morestring=[b]", 37 morestring=[b]' 38 } 39 40 \lstdefinelanguage{HTML5}{ 41 basicstyle=\ttfamily\scriptsize, 42 language=html, 43 sensitive=true, 44 alsoletter={<>=-}, 45 morecomment=[s]{<!-}{-->}, 46 tag=[s], 47 otherkeywords={ 48 % General 49 >, 50 % Standard tags 51 <!DOCTYPE, 52 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 53 % body 54 </body, <body, 55 % Divs 56 </div, <div, </div>, 57 % Paragraphs 58 </p, <p, </p>, 59 % scripts 60 </script, <script, 61 % More tags... 62 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 63 }, 64 ndkeywords={ 65 % General 66 =, 67 % HTML attributes 68 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 69 % SVG attributes 70 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 71 % CSS properties 72 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 73 % CSS3 properties 74 transform:, -moz-transform:, -webkit-transform:, 75 animation:, -webkit-animation:, 76 transition:, transition-duration:, transition-property:, transition-timing-function:, 77 } 78 } 79 80 \lstdefinelanguage{JavaScript}{ 81 basicstyle=\ttfamily\scriptsize, 82 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 83 keywordstyle=\color{blue}\bfseries, 84 ndkeywords={class, export, boolean, throw, implements, import, this}, 85 ndkeywordstyle=\color{darkgray}\bfseries, 86 identifierstyle=\color{black}, 87 sensitive=false, 88 comment=[l]{//}, 89 morecomment=[s]{/*}{*/}, 90 commentstyle=\color{purple}\ttfamily, 91 stringstyle=\color{red}\ttfamily, 92 morestring=[b]', 93 morestring=[b]" 94 } 95 96 \usetikzlibrary{shapes,arrows} 97 \usetikzlibrary{positioning} 98 \usetikzlibrary{calc} 99 100 \title{GNU Taler as a Retail CBDC} 101 %\subtitle{} 102 103 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=2.3cm]{bfh.png} \includegraphics[width=1.6cm]{fub.pdf} \includegraphics[width=0.4cm]{ashoka.png} \includegraphics[width=0.4cm]{gnu.png} \includegraphics[width=1cm]{logo-2020.jpg} \hfill} 104 %\setbeamercovered{transparent=1} 105 106 \author[C. Grothoff]{{\bf C. Grothoff}} 107 \date{17.12.2021} 108 \institute{Taler Systems SA} 109 110 111 \begin{document} 112 113 \justifying 114 115 \begin{frame} 116 \begin{center} 117 \LARGE {\bf GNU} 118 119 \vfill 120 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 121 \includegraphics[width=0.66\textwidth]{logo-2020.jpg} 122 123 as a Retail CBDC 124 \vfill 125 \end{center} 126 \begin{textblock*}{6cm}(.5cm,7.7cm) % {block width} (coords) 127 {\Large {\bf \href{https://taler.net/}{taler.net}} \\ 128 \href{https://twitter.com/taler}{taler@twitter} \\ 129 \href{https://taler-systems.com/}{taler-systems.com}} 130 \end{textblock*} 131 132 % Substitute based on who is giving the talk! 133 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 134 {%\hfill {\Large {\bf Florian Dold \&} \\ 135 \hfill {\bf Christian Grothoff} \\ 136 \hfill grothoff@taler.net } 137 \end{textblock*} 138 139 \end{frame} 140 141 \section{Introduction} 142 143 \begin{frame}{Main Points} 144 \framesubtitle{\url{https://taler.net/}} 145 Our CBDC: 146 \begin{itemize} 147 \item is token-based (no accounts), centrally issued (not DLT); as efficient and cost-effective 148 as modern real-time gross settlement (RTGS) systems operated by central banks; 149 \item is designed to provide an electronic equivalent to banknotes, therefore no material 150 impact on monetary policy and/or financial stability expected; 151 \item guarantees privacy for the payer, combined with KYC/AML/CFT compliance and 152 income transparency to ensure taxes are paid; 153 \item is implemented as Free/Libre and Open Source Software (FLOSS) to provide 154 transparency, accountability, and security (part of the GNU project). 155 \end{itemize} 156 \end{frame} 157 158 159 \begin{frame}{Payment Systems: Accounts vs. Tokens} 160 Two types of payment systems: 161 \begin{enumerate} 162 \item {\bf account-based system}: transfer occurs by charging the payer’s account and crediting 163 the payee’s account (e.g., bank deposits) 164 \item {\bf token-based (value-based) system}: transfer occurs by transferring the value itself, or a 165 token that represents the monetary asset (e.g., banknotes) 166 \end{enumerate} 167 Key Difference is the information carried by the information asset: 168 \begin{itemize} 169 \item account (assets): associated with a transaction history 170 \item token (assets): carry information about value and entity that issued the token 171 \end{itemize} 172 Bitcoin, and Distributed Ledger Technologies (DLTs) in general, are account-based systems! 173 Novelty is that the ledger is distributed (decentralized). 174 \end{frame} 175 176 177 \begin{frame}{Simplistic CBDC Designs} 178 \framesubtitle{\url{https://edwardsnowden.substack.com/p/cbdcs}} 179 \begin{itemize} 180 \item Account-based CBDC (e.g., Bindseil 2020, Berentsen and Schär 2018): 181 \begin{itemize} 182 \item simplest solution: central bank account for all 183 \item responsibility to perform KYC and ensure AML/CFT (could be outsourced); 184 \item potential for mass-surveillance (threat to CB independence); 185 \item in direct competition with commercial banks 186 \end{itemize} \pause 187 \item Token-based CBDC: 188 \begin{itemize} 189 \item requires a system to ensure that electronic tokens are not easily copied 190 (hardware-based or software-based) \\ $\rightarrow$ double-spending problem 191 \item KYC and AML/CFT compliance? 192 \end{itemize} 193 \end{itemize} 194 \end{frame} 195 196 197 \section{What is Taler?} 198 \begin{frame}{What is Taler?} 199 \begin{center} 200 Taler is an electronic instant payment system based on tokens. 201 \end{center} 202 \begin{itemize} 203 \item Uses electronic coins stored in {\bf wallets} on customer's device 204 \item Like {\bf cash} 205 \item Pay in {\bf existing currencies} (i.e. CHF, EUR, USD) 206 \end{itemize} 207 \vfill 208 \pause 209 \noindent 210 However, Taler is 211 \begin{itemize} 212 \item \emph{not} a currency 213 \item \emph{not} a long-term store of value 214 \item \emph{not} a network or instance of a system 215 \item \emph{not} decentralized 216 \item \emph{not} based on proof-of-work or proof-of-stake 217 \item \emph{not} a speculative asset / ``get-rich-quick scheme'' 218 \end{itemize} 219 \end{frame} 220 221 222 \begin{frame}{Some of the people behind GNU Taler} 223 {\tiny 224 \begin{itemize} 225 \item Prof. David Chaum (original research) 226 \item Dr. Florian Dold (cryptography, systems engineering) 227 \item Dr. Belén Barros Pena (UX design, accessibility) 228 \item Prof. Christian Grothoff (research \& development) 229 \item Prof. Andreas Habegger (research, hardware) 230 \item Dr. Thomas Moser (economics) 231 \item Dr. Richard Stallman (advisory) 232 \item Leon Schumacher, MBA (business) 233 \item Prof. Hansj\"urg Wenger (research, deployment) 234 \item Dr. Michael Widmer, MBA (legal) 235 \item Jonathan (iOS wallet) 236 \item Marcello (bank integration) 237 \item Marco (scalability, snack machine) 238 \item \"Ozg\"ur (security audit, age restrictions) 239 \item Sebastian (Web interface) 240 \item Stefan (documentation, project management) 241 \item Torsten (Andorid wallet) 242 \end{itemize} 243 } 244 \end{frame} 245 246 247 \begin{frame}{Design Principles} 248 \framesubtitle{https://taler.net/en/principles.html} 249 GNU Taler must ... 250 \begin{enumerate} 251 \item {... be implemented as {\bf free software}.} 252 \item {... protect the {\bf privacy of buyers}.} 253 \item {... must enable the state to {\bf tax income} and crack down on 254 illegal business activities.} 255 \item {... prevent payment fraud.} 256 \item {... only {\bf disclose the minimal amount of information 257 necessary}.} 258 \item {... be usable.} 259 \item {... be efficient.} 260 \item {... avoid single points of failure.} 261 \item {... foster {\bf competition}.} 262 \end{enumerate} 263 \end{frame} 264 265 266 \begin{frame}{The Big Picture} 267 \begin{center} 268 \includegraphics[width=0.8\textwidth]{bp.png} 269 \end{center} 270 \end{frame} 271 272 273 \begin{frame}{Taler: Unique Regulatory Features for CBs} 274 \framesubtitle{\url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03}} 275 \begin{itemize} 276 \item Central bank issues digital coins equivalent to issuing cash \\ 277 $\Rightarrow$ monetary policy remains under CB control 278 \item Architecture with consumer accounts at commercial banks \\ 279 $\Rightarrow$ no competition for commercial banking (S\&L) \\ 280 $\Rightarrow$ CB does not have to manage KYC, customer support 281 \item Withdrawal limits and denomination expiration \\ 282 $\Rightarrow$ protects against bank runs and hoarding 283 \item Income transparency and possibility to set fees \\ 284 $\Rightarrow$ additional insights into economy and new policy options 285 \item Revocation protocols and loss limitations \\ 286 $\Rightarrow$ exit strategy and handles catastrophic security incidents 287 \item Privacy by cryptographic design not organizational compliance \\ 288 $\Rightarrow$ CB cannot be forced to facilitate mass-surveillance 289 \end{itemize} 290 \end{frame} 291 292 293 \begin{frame} 294 \frametitle{Taler Core Components} 295 \framesubtitle{\url{https://taler.net/en/docs.html}} 296 \begin{center} 297 \scalebox{0.3}{ 298 \begin{tikzpicture} 299 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 300 \node (origin) at (0,0) {}; 301 \node (exchange) [def,above=of origin,draw]{Exchange}; 302 \node (customer) [def, draw, below left=of origin] {Customer}; 303 \node (merchant) [def, draw, below right=of origin] {Merchant}; 304 \node (auditor) [def, draw, above right=of origin]{Auditor}; 305 % \node (regulator) [def, draw, above=of auditor]{CSSF}; 306 307 \tikzstyle{C} = [color=black, line width=1pt] 308 309 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 310 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 311 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 312 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 313 % \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report}; 314 315 \end{tikzpicture} 316 } 317 \end{center} 318 {%\tiny 319 \begin{itemize} 320 \item {\bf Exchange:} Service provider for digital cash 321 \begin{itemize} 322 \item Core exchange software (cryptography, database) 323 \item Air-gapped key management, real-time {\bf auditing} 324 \end{itemize} 325 \item {\bf Merchant:} Integration service for existing businesses 326 \begin{itemize} 327 \item Core merchant backend software (cryptography, database) 328 \item Back-office interface for staff 329 \item Frontend integration (E-commerce, Point-of-sale) 330 \end{itemize} 331 \item {\bf Wallet:} Consumer-controlled applications for e-cash 332 \begin{itemize} 333 \item Multi-platform wallet software (for browsers \& mobile phones) 334 \item Wallet backup storage providers 335 \end{itemize} 336 \end{itemize} 337 } 338 \end{frame} 339 340 341 \begin{frame}{Usability of Taler} 342 \vfill 343 \begin{center} 344 \url{https://demo.taler.net/} 345 \end{center} 346 \begin{enumerate} 347 \item Install browser extension. 348 \item Visit the {\tt bank.demo.taler.net} to withdraw coins. 349 \item Visit the {\tt shop.demo.taler.net} to spend coins. 350 \end{enumerate} 351 \vfill 352 \end{frame} 353 354 355 356 \begin{frame}{How does it work?} 357 \framesubtitle{\url{https://taler.net/papers/thesis-dold-phd-2019.pdf}} 358 We use a few ancient constructions: 359 \begin{itemize} 360 \item Cryptographic hash function (1989) 361 \item Blind signature (1983) 362 \item Schnorr signature (1989) 363 \item Diffie-Hellman key exchange (1976) 364 \item Cut-and-choose zero-knowledge proof (1985) 365 \end{itemize} 366 But of course we use modern instantiations. 367 \end{frame} 368 369 370 \begin{frame}{Definition: Taxability} 371 We say Taler is taxable because: 372 \begin{itemize} 373 \item Merchant's income is visible from deposits. 374 \item Hash of contract is part of deposit data. 375 \item State can trace income and enforce taxation. 376 \end{itemize}\pause 377 Limitations: 378 \begin{itemize} 379 \item withdraw loophole 380 \item {\em sharing} coins among family and friends 381 \end{itemize} 382 \end{frame} 383 384 385 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 386 \begin{minipage}{6cm} 387 \begin{enumerate} 388 \item Pick random primes $p,q$. 389 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 390 \item Pick small $e < \phi(n)$ such that 391 $d := e^{-1} \mod \phi(n)$ exists. 392 \item Publish public key $(e,n)$. 393 \end{enumerate} 394 \end{minipage} 395 \begin{minipage}{6cm} 396 \begin{tikzpicture} 397 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 398 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 399 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 400 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 401 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 402 403 \tikzstyle{C} = [color=black, line width=1pt] 404 405 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 406 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 407 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 408 \end{tikzpicture} 409 % \includegraphics[width=0.4\textwidth]{seal.pdf} 410 \end{minipage} 411 \end{frame} 412 413 414 \begin{frame}{Merchant: Create a signing key (EdDSA)} 415 \begin{minipage}{6cm} 416 \begin{itemize} 417 \item pick random $m \mod o$ as private key 418 \item $M = mG$ public key 419 \end{itemize} 420 \end{minipage} 421 \begin{minipage}{6cm} 422 \begin{tikzpicture} 423 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 424 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 425 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 426 \node (seal) [draw=none, below=of m]{M}; 427 \tikzstyle{C} = [color=black, line width=1pt] 428 429 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 430 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 431 \end{tikzpicture} 432 \end{minipage} 433 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 434 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 435 \end{frame} 436 437 438 \begin{frame}{Customer: Create a planchet (EdDSA)} 439 \begin{minipage}{8cm} 440 \begin{itemize} 441 \item Pick random $c \mod o$ private key 442 \item $C = cG$ public key 443 \end{itemize} 444 \end{minipage} 445 \begin{minipage}{4cm} 446 \begin{tikzpicture} 447 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 448 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 449 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 450 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 451 \tikzstyle{C} = [color=black, line width=1pt] 452 453 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 454 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 455 \end{tikzpicture} 456 \end{minipage} 457 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 458 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 459 \end{frame} 460 461 462 \begin{frame}{Customer: Blind planchet (RSA)} 463 \begin{minipage}{6cm} 464 \begin{enumerate} 465 \item Obtain public key $(e,n)$ 466 \item Compute $f := FDH(C)$, $f < n$. 467 \item Pick blinding factor $b \in \mathbb Z_n$ 468 \item Transmit $f' := f b^e \mod n$ 469 \end{enumerate} 470 \end{minipage} 471 \begin{minipage}{6cm} 472 \begin{tikzpicture} 473 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 474 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 475 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 476 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 477 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 478 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 479 \tikzstyle{C} = [color=black, line width=1pt] 480 481 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 482 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 483 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 484 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 485 \end{tikzpicture} 486 \end{minipage} 487 \end{frame} 488 489 490 \begin{frame}{Exchange: Blind sign (RSA)} 491 \begin{minipage}{6cm} 492 \begin{enumerate} 493 \item Receive $f'$. 494 \item Compute $s' := f'^d \mod n$. 495 \item Send signature $s'$. 496 \end{enumerate} 497 \end{minipage} 498 \begin{minipage}{6cm} 499 \begin{tikzpicture} 500 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 501 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 502 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 503 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 504 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 505 \tikzstyle{C} = [color=black, line width=1pt] 506 507 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 508 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 509 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 510 \end{tikzpicture} 511 \end{minipage} 512 \end{frame} 513 514 515 \begin{frame}{Customer: Unblind coin (RSA)} 516 \begin{minipage}{6cm} 517 \begin{enumerate} 518 \item Receive $s'$. 519 \item Compute $s := s' b^{-1} \mod n$ % \\ 520 % ($(f')^d = (f b^e)^d = f^d b$). 521 \end{enumerate} 522 \end{minipage} 523 \begin{minipage}{6cm} 524 \begin{tikzpicture} 525 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 526 \node (b) [def, draw=none] at (0,0) {$b$}; 527 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 528 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 529 \tikzstyle{C} = [color=black, line width=1pt] 530 531 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 532 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 533 \end{tikzpicture} 534 \end{minipage} 535 \end{frame} 536 537 \begin{frame}{Customer: Build shopping cart} 538 \begin{center} 539 \begin{tikzpicture} 540 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 541 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 542 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 543 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 544 \tikzstyle{C} = [color=black, line width=1pt]; 545 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 546 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 547 \end{tikzpicture} 548 \end{center} 549 \end{frame} 550 551 552 \begin{frame}{Merchant: Propose contract (EdDSA)} 553 \begin{minipage}{6cm} 554 \begin{enumerate} 555 \item Complete proposal $D$. 556 \item Send $D$, $EdDSA_m(D)$ 557 \end{enumerate} 558 \end{minipage} 559 \begin{minipage}{6cm} 560 \begin{tikzpicture} 561 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 562 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 563 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 564 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 565 \tikzstyle{C} = [color=black, line width=1pt]; 566 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 567 \tikzstyle{C} = [color=black, line width=1pt] 568 569 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 570 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 571 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 572 \end{tikzpicture} 573 \end{minipage} 574 \end{frame} 575 576 577 \begin{frame}{Customer: Spend coin (EdDSA)} 578 \begin{minipage}{6cm} 579 \begin{enumerate} 580 \item Receive proposal $D$, $EdDSA_m(D)$. 581 \item Send $s$, $C$, $EdDSA_c(D)$ 582 \end{enumerate} 583 \end{minipage} 584 \begin{minipage}{6cm} 585 \begin{tikzpicture} 586 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 587 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 588 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 589 \node (c) [def, draw=none, above=of contract] {$c$}; 590 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 591 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 592 \tikzstyle{C} = [color=black, line width=1pt] 593 594 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 595 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 596 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 597 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 598 \end{tikzpicture} 599 \end{minipage} 600 \end{frame} 601 602 603 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 604 \begin{minipage}{6cm} 605 \begin{equation*} 606 s^e \stackrel{?}{\equiv} FDH(C) \mod n 607 \end{equation*} 608 \end{minipage} 609 \begin{minipage}{6cm} 610 \begin{minipage}{0.2\textwidth} 611 \includegraphics[width=\textwidth]{coin.pdf} 612 \end{minipage} 613 $\stackrel{?}{\Leftrightarrow}$ 614 \begin{minipage}{0.2\textwidth} 615 \includegraphics[width=\textwidth]{seal.pdf} 616 \end{minipage} 617 \end{minipage} 618 \vfill 619 The exchange does not only verify the signature, but also 620 checks that the coin was not double-spent. 621 \vfill 622 \pause 623 \begin{center} 624 {\bf Taler is an online payment system.} 625 \end{center} 626 \vfill 627 \end{frame} 628 629 630 \begin{frame}{Requirements: Online vs. Offline Digital Currencies} 631 \framesubtitle{\url{https://taler.net/papers/euro-bearer-online-2021.pdf}} 632 \begin{itemize} 633 \item Offline capabilities are sometimes cited as a requirement for digital payment solutions 634 \item All implementations must either use restrictive hardware elements and/or introduce 635 counterparty risk. 636 \item[$\Rightarrow$] Permanent offline features weaken a digital payment solution (privacy, security) 637 \item[$\Rightarrow$] Introduces unwarranted competition for physical cash (endangers emergency-preparedness). 638 \end{itemize} 639 We recommend a tiered approach: 640 \begin{enumerate} 641 \item Online-first, bearer-based digital currency with Taler 642 \item (Optional:) Limited offline mode for network outages 643 \item Physical cash for emergencies (power outage, catastrophic cyber incidents) 644 \end{enumerate} 645 \end{frame} 646 647 648 \begin{frame}{Scalability} 649 On paper, the design scales linearly with computing resources: 650 \begin{itemize} 651 \item Front-end logic at the central bank only needs to perform a few signature operations, a 652 single CPU core can typically do a few thousands per second. 653 \item Front-end servers need to talk to a database to prevent double-spending. A single database server can handle tens of thousands of such operations per second. 654 \item All operations are easily split across multiple database servers by simply assigning 655 each database server a range of values. 656 \item The frontends need to talk to the backends using an interconnect. The size of an 657 individual transaction is typically about 1–10 kilobytes. Modern interconnects 658 can support millions of such transactions per second. 659 \item To securely store 1-10 kilobytes per transaction, using AWS pricing, the cost of the 660 system (storage, bandwidth, computation) at scale would be 0.0001 USD per transaction. 661 \end{itemize} 662 \end{frame} 663 664 665 \begin{frame}{Scalability in numbers} 666 On a {\bf single desktop system}, we measured: 667 \begin{itemize} 668 \item {\bf 1k+} withdraws\&deposits/second (client and server doing 2048-bit RSA) 669 \item {\bf 50k+} import inbound wire transfers per second (to RTGS) 670 \item {\bf 33k+} transactions aggregated/second 671 \item {\bf 62k+} export outbound wire transfers per second (to RTGS) 672 \end{itemize} 673 We are now configuring the Grid 5000 for larger-scale experiments. 674 \end{frame} 675 676 677 \begin{frame}{Taler: Project Status} 678 \framesubtitle{\url{https://docs.taler.net/}} 679 \begin{itemize} 680 \item Cryptographic protocols and core exchange component are stable 681 \item Current focus: KYC process at commercial bank, scalability evaluation, age-restricted payments, P2P payments 682 \item Internal alpha deployment with a commercial bank in progress 683 \item Pilot project at Bern University of Applied Sciences cafeteria 684 \end{itemize} 685 \begin{center} 686 \includegraphics[width=0.7\textwidth]{taler-in-use.png} 687 \end{center} 688 \end{frame} 689 690 691 \section{Competitor comparison} 692 \begin{frame}{Competitor comparison} 693 \begin{center} \small 694 \begin{tabular}{l||c|c|c|c|c} 695 & Cash & DLT & HW-Token & CB-Account & GNU Taler \\ \hline \hline 696 Online &$-$$-$$-$ & + & $-$ & ++ & +++ \\ \hline 697 Offline & +++ & $-$$-$$-$ & $+$ & $-$$-$ & $-$$-$ \\ \hline 698 Cost & $-$ & $-$$-$$-$ & $-$ & + & ++ \\ \hline 699 Speed & + & $-$$-$$-$ & $+$ & o & ++ \\ \hline 700 Taxation & $-$ & +++ & $-$$-$ & +++ & +++ \\ \hline 701 Payer-anon & ++ & $-$$-$ & ??? & $-$$-$ & +++ \\ \hline 702 Payee-anon & ++ & $-$$-$ & ??? & $-$$-$ & $-$$-$$-$ \\ \hline 703 Security & $-$ & ??? & $-$$-$ & o & ++ \\ \hline 704 Migration & +++ & $-$$-$$-$ & $-$$-$$-$& o & + \\ \hline 705 Libre & $-$ & ??? & $-$$-$$-$& N/A & +++ \\ 706 \end{tabular} 707 \end{center} 708 \end{frame} 709 710 711 \begin{frame}{The Future: System Integration and Partnerships} 712 Pilots with banking organizations could: 713 \begin{itemize} 714 \item Share knowledge on Taler deployment 715 \item Study integration with the underlying RTGS layer: 716 \begin{itemize} 717 \item Develop standardized operational procedures 718 \item Perform cost analysis in banking environment 719 \item Assess effort for integration with commercial banks 720 \end{itemize} 721 \item Analyze regulatory considerations for different legislations 722 \item Perform independent security audits of Taler components 723 \end{itemize} 724 \end{frame} 725 726 727 \begin{frame} 728 \frametitle{Do you have any questions?} 729 \vfill 730 References: 731 {\tiny 732 \begin{enumerate} 733 \item{David Chaum, Christian Grothoff and Thomas Moser. 734 {\em How to issue a central bank digital currency}. 735 {\bf SNB Working Papers, 2021}.} 736 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 737 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 738 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 739 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 740 {\em Enabling Secure Web Payments with GNU Taler}. 741 {\bf SPACE 2016}.} 742 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 743 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 744 Available upon request. 2016.} 745 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 746 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 747 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 748 \item{David Chaum, Amos Fiat and Moni Naor. 749 {\em Untraceable electronic cash}. 750 {\bf Proceedings on Advances in Cryptology, 1990}.} 751 \item{Phillip Rogaway. 752 {\em The Moral Character of Cryptographic Work}. 753 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 754 \end{enumerate} 755 } 756 \end{frame} 757 758 759 \end{document}