boi.tex (27979B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 9 \usetheme{boxes} 10 \setbeamertemplate{navigation symbols}{} 11 \usepackage{xcolor} 12 \usepackage{tikz,eurosym} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 \usepackage{adjustbox} 16 17 % CSS 18 \lstdefinelanguage{CSS}{ 19 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 20 sensitive=true, 21 morecomment=[l]{//}, 22 morecomment=[s]{/*}{*/}, 23 morestring=[b]', 24 morestring=[b]", 25 alsoletter={:}, 26 alsodigit={-} 27 } 28 29 % JavaScript 30 \lstdefinelanguage{JavaScript}{ 31 basicstyle=\ttfamily\scriptsize, 32 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 33 morecomment=[s]{/*}{*/}, 34 morecomment=[l]//, 35 morestring=[b]", 36 morestring=[b]' 37 } 38 39 \usetikzlibrary{shapes,arrows} 40 \usetikzlibrary{positioning} 41 \usetikzlibrary{calc} 42 43 \title{GNU Taler as a Retail CBDC} 44 %\subtitle{} 45 46 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=2.3cm]{bfh.png} \includegraphics[width=1.6cm]{fub.pdf} \includegraphics[width=0.4cm]{ashoka.png} \includegraphics[width=0.4cm]{gnu.png} \includegraphics[width=1cm]{logo-2021.pdf} \hfill} 47 %\setbeamercovered{transparent=1} 48 49 \author[C. Grothoff]{{\bf C. Grothoff}} 50 \date{16.3.2022} 51 \institute{Taler Systems SA} 52 53 54 \begin{document} 55 56 \justifying 57 58 \begin{frame} 59 \begin{center} 60 \LARGE {\bf GNU} 61 62 \vfill 63 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 64 \includegraphics[width=0.66\textwidth]{logo-2021.pdf} 65 66 as a Retail CBDC 67 \vfill 68 \end{center} 69 \begin{textblock*}{6cm}(.5cm,7.7cm) % {block width} (coords) 70 {\Large {\bf \href{https://taler.net/}{taler.net}} \\ 71 \href{https://twitter.com/taler}{taler@twitter} \\ 72 \href{https://taler-systems.com/}{taler-systems.com}} 73 \end{textblock*} 74 75 % Substitute based on who is giving the talk! 76 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 77 {%\hfill {\Large {\bf Florian Dold \&} \\ 78 \hfill {\bf Christian Grothoff} \\ 79 \hfill grothoff@taler.net } 80 \end{textblock*} 81 82 \end{frame} 83 84 \section{Introduction} 85 86 \begin{frame}{Main Points} 87 \framesubtitle{\url{https://taler.net/}} 88 Our retail CBDC: 89 \begin{itemize} 90 \item is token-based (no accounts), centrally issued (not DLT); as efficient and cost-effective 91 as modern real-time gross settlement (RTGS) systems operated by central banks; 92 \item is designed to provide an electronic equivalent to banknotes, therefore no material 93 impact on monetary policy and/or financial stability expected; 94 \item guarantees privacy for the payer, combined with KYC/AML/CFT compliance and 95 income transparency to ensure taxes are paid; 96 \item is implemented as Free/Libre and Open Source Software (FLOSS) to provide 97 transparency, accountability, and security (part of the GNU project). 98 \end{itemize} 99 \end{frame} 100 101 102 \begin{frame}{Payment Systems: Accounts vs. Tokens} 103 \framesubtitle{\url{https://taler.net/papers/accounts-dangerous-2022.pdf}} 104 Two types of payment systems: 105 \begin{enumerate} 106 \item {\bf account-based system}: transfer occurs by charging the payer’s account and crediting 107 the payee’s account (e.g., bank deposits) 108 \item {\bf token-based (value-based) system}: transfer occurs by transferring the value itself, or a 109 token that represents the monetary asset (e.g., banknotes) 110 \end{enumerate} 111 Key difference is the information carried by the information asset: 112 \begin{itemize} 113 \item account (assets): associated with a transaction history 114 \item token (assets): carry information about value and entity that issued the token 115 \end{itemize} 116 Bitcoin, and distributed ledger technologies (DLTs) in general, are account-based systems! 117 Novelty is that the ledger is distributed (decentralized). 118 \end{frame} 119 120 121 \begin{frame}{Simplistic CBDC Designs} 122 \framesubtitle{\url{https://taler.net/en/news/2022-07.html}} 123 \begin{itemize} 124 \item Account-based CBDC (e.g., Bindseil 2020, Berentsen and Schär 2018): 125 \begin{itemize} 126 \item simplest solution: central bank account for all 127 \item responsibility to perform KYC and ensure AML/CFT (could be outsourced); 128 \item potential for mass-surveillance (threat to CB independence); 129 \item in direct competition with commercial banks 130 \end{itemize} \pause 131 \item Token-based CBDC: 132 \begin{itemize} 133 \item requires a system to ensure that electronic tokens are not easily copied 134 (hardware-based or software-based) \\ $\rightarrow$ double-spending problem 135 \item KYC and AML/CFT compliance? 136 \end{itemize} 137 \end{itemize} 138 \end{frame} 139 140 141 \section{What is Taler?} 142 \begin{frame}{What is Taler?} 143 \begin{center} 144 Taler is an electronic instant payment system based on tokens. 145 \end{center} 146 \begin{itemize} 147 \item Uses electronic coins stored in {\bf wallets} on customer's device 148 \item Like {\bf cash} 149 \item Pay in {\bf existing currencies} (i.e. CHF, EUR, USD, JPY) 150 \end{itemize} 151 \vfill 152 \pause 153 \noindent 154 However, Taler is 155 \begin{itemize} 156 \item \emph{not} a currency 157 \item \emph{not} a long-term store of value 158 \item \emph{not} a network or instance of a system 159 \item \emph{not} decentralized 160 \item \emph{not} based on proof-of-work or proof-of-stake 161 \item \emph{not} a speculative asset / ``get-rich-quick scheme'' 162 \end{itemize} 163 \end{frame} 164 165 166 \begin{frame}{Some of the people behind GNU Taler} 167 {\tiny 168 \begin{itemize} 169 \item Prof. David Chaum (original research) 170 \item Dr. Florian Dold (cryptography, systems engineering) 171 \item Dr. Belén Barros Pena (UX design, accessibility) 172 \item Prof. Christian Grothoff (research \& development) 173 \item Prof. Andreas Habegger (research, hardware) 174 \item Dr. Thomas Moser (economics) 175 \item Dr. Richard Stallman (advisory) 176 \item Leon Schumacher, MBA (business) 177 \item Prof. Hansj\"urg Wenger (research, deployment) 178 \item Dr. Michael Widmer, MBA (legal) 179 \item Jonathan (iOS wallet) 180 \item Marcello (bank integration) 181 \item Marco (scalability, snack machine) 182 \item \"Ozg\"ur (security audit, age restrictions) 183 \item Sebastian (Web interface) 184 \item Stefan (documentation, project management) 185 \item Torsten (Andorid wallet) 186 \end{itemize} 187 } 188 \end{frame} 189 190 191 \begin{frame}{Design Principles} 192 \framesubtitle{https://taler.net/en/principles.html} 193 GNU Taler must ... 194 \begin{enumerate} 195 \item {... be implemented as {\bf free software}.} 196 \item {... protect the {\bf privacy of buyers}.} 197 \item {... must enable the state to {\bf tax income} and crack down on 198 illegal business activities.} 199 \item {... prevent payment fraud.} 200 \item {... only {\bf disclose the minimal amount of information 201 necessary}.} 202 \item {... be usable.} 203 \item {... be efficient.} 204 \item {... avoid single points of failure.} 205 \item {... foster {\bf competition}.} 206 \end{enumerate} 207 \end{frame} 208 209 210 \begin{frame}{The Big Picture} 211 \begin{center} 212 \includegraphics[width=0.8\textwidth]{bp.png} 213 \end{center} 214 \end{frame} 215 216 217 \begin{frame}{Taler: Unique Regulatory Features for CBs} 218 \framesubtitle{\url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03}} 219 \begin{itemize} 220 \item Central bank issues digital coins equivalent to issuing cash \\ 221 $\Rightarrow$ monetary policy remains under CB control 222 \item Architecture with consumer accounts at commercial banks \\ 223 $\Rightarrow$ no competition for commercial banking (S\&L) \\ 224 $\Rightarrow$ CB does not have to manage KYC, customer support 225 \item Withdrawal limits and denomination expiration \\ 226 $\Rightarrow$ protects against bank runs and hoarding 227 \item Income transparency and possibility to set fees \\ 228 $\Rightarrow$ additional insights into economy and new policy options 229 \item Revocation protocols and loss limitations \\ 230 $\Rightarrow$ exit strategy and handles catastrophic security incidents 231 \item Privacy by cryptographic design not organizational compliance \\ 232 $\Rightarrow$ CB cannot be forced to facilitate mass-surveillance 233 \end{itemize} 234 \end{frame} 235 236 237 \begin{frame} 238 \frametitle{Taler Core Components} 239 \framesubtitle{\url{https://taler.net/en/docs.html}} 240 \begin{center} 241 \scalebox{0.3}{ 242 \begin{tikzpicture} 243 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 244 \node (origin) at (0,0) {}; 245 \node (exchange) [def,above=of origin,draw]{Exchange}; 246 \node (customer) [def, draw, below left=of origin] {Customer}; 247 \node (merchant) [def, draw, below right=of origin] {Merchant}; 248 \node (auditor) [def, draw, above right=of origin]{Auditor}; 249 % \node (regulator) [def, draw, above=of auditor]{CSSF}; 250 251 \tikzstyle{C} = [color=black, line width=1pt] 252 253 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 254 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 255 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 256 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 257 % \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report}; 258 259 \end{tikzpicture} 260 } 261 \end{center} 262 {%\tiny 263 \begin{itemize} 264 \item {\bf Exchange:} Service provider for digital cash 265 \begin{itemize} 266 \item Core exchange software (cryptography, database) 267 \item Air-gapped key management, real-time {\bf auditing} 268 \end{itemize} 269 \item {\bf Merchant:} Integration service for existing businesses 270 \begin{itemize} 271 \item Core merchant backend software (cryptography, database) 272 \item Back-office interface for staff 273 \item Frontend integration (E-commerce, Point-of-sale) 274 \end{itemize} 275 \item {\bf Wallet:} Consumer-controlled applications for e-cash 276 \begin{itemize} 277 \item Multi-platform wallet software (for browsers \& mobile phones) 278 \item Wallet backup storage providers 279 \end{itemize} 280 \end{itemize} 281 } 282 \end{frame} 283 284 285 \begin{frame}{Usability of Taler} 286 \vfill 287 \begin{center} 288 \url{https://demo.taler.net/} 289 \end{center} 290 \begin{enumerate} 291 \item Install browser extension. 292 \item Visit the {\tt bank.demo.taler.net} to withdraw coins. 293 \item Visit the {\tt shop.demo.taler.net} to spend coins. 294 \end{enumerate} 295 \vfill 296 \end{frame} 297 298 299 300 \begin{frame}{How does it work?} 301 \framesubtitle{\url{https://taler.net/papers/thesis-dold-phd-2019.pdf}} 302 We use a few ancient constructions: 303 \begin{itemize} 304 \item Cryptographic hash function (1989) 305 \item Blind signature (1983) 306 \item Schnorr signature (1989) 307 \item Diffie-Hellman key exchange (1976) 308 \item Cut-and-choose zero-knowledge proof (1985) 309 \end{itemize} 310 But of course we use modern instantiations. 311 \end{frame} 312 313 314 %\begin{frame}{Definition: Taxability} 315 % We say Taler is taxable because: 316 % \begin{itemize} 317 % \item Merchant's income is visible from deposits. 318 % \item Hash of contract is part of deposit data. 319 % \item State can trace income and enforce taxation. 320 % \end{itemize}\pause 321 % Limitations: 322 % \begin{itemize} 323 % \item withdraw loophole 324 % \item {\em sharing} coins among family and friends 325 % \end{itemize} 326 %\end{frame} 327 328 329 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 330 \begin{minipage}{6cm} 331 \begin{enumerate} 332 \item Pick random primes $p,q$. 333 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 334 \item Pick small $e < \phi(n)$ such that 335 $d := e^{-1} \mod \phi(n)$ exists. 336 \item Publish public key $(e,n)$. 337 \end{enumerate} 338 \end{minipage} 339 \begin{minipage}{6cm} 340 \begin{tikzpicture} 341 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 342 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 343 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 344 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 345 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 346 347 \tikzstyle{C} = [color=black, line width=1pt] 348 349 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 350 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 351 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 352 \end{tikzpicture} 353 % \includegraphics[width=0.4\textwidth]{seal.pdf} 354 \end{minipage} 355 \end{frame} 356 357 358 \begin{frame}{Merchant: Create a signing key (EdDSA)} 359 \begin{minipage}{6cm} 360 \begin{itemize} 361 \item pick random $m \mod o$ as private key 362 \item $M = mG$ public key 363 \end{itemize} 364 \end{minipage} 365 \begin{minipage}{6cm} 366 \begin{tikzpicture} 367 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 368 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 369 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 370 \node (seal) [draw=none, below=of m]{M}; 371 \tikzstyle{C} = [color=black, line width=1pt] 372 373 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 374 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 375 \end{tikzpicture} 376 \end{minipage} 377 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 378 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 379 \end{frame} 380 381 382 \begin{frame}{Customer: Create a planchet (EdDSA)} 383 \begin{minipage}{8cm} 384 \begin{itemize} 385 \item Pick random $c \mod o$ private key 386 \item $C = cG$ public key 387 \end{itemize} 388 \end{minipage} 389 \begin{minipage}{4cm} 390 \begin{tikzpicture} 391 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 392 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 393 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 394 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 395 \tikzstyle{C} = [color=black, line width=1pt] 396 397 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 398 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 399 \end{tikzpicture} 400 \end{minipage} 401 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 402 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 403 \end{frame} 404 405 406 \begin{frame}{Customer: Blind planchet (RSA)} 407 \begin{minipage}{6cm} 408 \begin{enumerate} 409 \item Obtain public key $(e,n)$ 410 \item Compute $f := FDH(C)$, $f < n$. 411 \item Pick blinding factor $b \in \mathbb Z_n$ 412 \item Transmit $f' := f b^e \mod n$ 413 \end{enumerate} 414 \end{minipage} 415 \begin{minipage}{6cm} 416 \begin{tikzpicture} 417 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 418 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 419 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 420 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 421 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 422 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 423 \tikzstyle{C} = [color=black, line width=1pt] 424 425 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 426 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 427 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 428 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 429 \end{tikzpicture} 430 \end{minipage} 431 \end{frame} 432 433 434 \begin{frame}{Exchange: Blind sign (RSA)} 435 \begin{minipage}{6cm} 436 \begin{enumerate} 437 \item Receive $f'$. 438 \item Compute $s' := f'^d \mod n$. 439 \item Send signature $s'$. 440 \end{enumerate} 441 \end{minipage} 442 \begin{minipage}{6cm} 443 \begin{tikzpicture} 444 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 445 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 446 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 447 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 448 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 449 \tikzstyle{C} = [color=black, line width=1pt] 450 451 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 452 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 453 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 454 \end{tikzpicture} 455 \end{minipage} 456 \end{frame} 457 458 459 \begin{frame}{Customer: Unblind coin (RSA)} 460 \begin{minipage}{6cm} 461 \begin{enumerate} 462 \item Receive $s'$. 463 \item Compute $s := s' b^{-1} \mod n$ % \\ 464 % ($(f')^d = (f b^e)^d = f^d b$). 465 \end{enumerate} 466 \end{minipage} 467 \begin{minipage}{6cm} 468 \begin{tikzpicture} 469 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 470 \node (b) [def, draw=none] at (0,0) {$b$}; 471 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 472 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 473 \tikzstyle{C} = [color=black, line width=1pt] 474 475 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 476 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 477 \end{tikzpicture} 478 \end{minipage} 479 \end{frame} 480 481 482 \begin{frame}{Customer: Build shopping cart} 483 \begin{center} 484 \begin{tikzpicture} 485 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 486 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 487 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 488 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 489 \tikzstyle{C} = [color=black, line width=1pt]; 490 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 491 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 492 \end{tikzpicture} 493 \end{center} 494 \end{frame} 495 496 497 \begin{frame}{Merchant: Propose contract (EdDSA)} 498 \begin{minipage}{6cm} 499 \begin{enumerate} 500 \item Complete proposal $D$. 501 \item Send $D$, $EdDSA_m(D)$ 502 \end{enumerate} 503 \end{minipage} 504 \begin{minipage}{6cm} 505 \begin{tikzpicture} 506 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 507 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 508 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 509 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 510 \tikzstyle{C} = [color=black, line width=1pt]; 511 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 512 \tikzstyle{C} = [color=black, line width=1pt] 513 514 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 515 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 516 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 517 \end{tikzpicture} 518 \end{minipage} 519 \end{frame} 520 521 522 \begin{frame}{Customer: Spend coin (EdDSA)} 523 \begin{minipage}{6cm} 524 \begin{enumerate} 525 \item Receive proposal $D$, $EdDSA_m(D)$. 526 \item Send $s$, $C$, $EdDSA_c(D)$ 527 \end{enumerate} 528 \end{minipage} 529 \begin{minipage}{6cm} 530 \begin{tikzpicture} 531 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 532 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 533 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 534 \node (c) [def, draw=none, above=of contract] {$c$}; 535 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 536 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 537 \tikzstyle{C} = [color=black, line width=1pt] 538 539 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 540 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 541 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 542 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 543 \end{tikzpicture} 544 \end{minipage} 545 \end{frame} 546 547 548 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 549 \begin{minipage}{6cm} 550 \begin{equation*} 551 s^e \stackrel{?}{\equiv} FDH(C) \mod n 552 \end{equation*} 553 \end{minipage} 554 \begin{minipage}{6cm} 555 \begin{minipage}{0.2\textwidth} 556 \includegraphics[width=\textwidth]{coin.pdf} 557 \end{minipage} 558 $\stackrel{?}{\Leftrightarrow}$ 559 \begin{minipage}{0.2\textwidth} 560 \includegraphics[width=\textwidth]{seal.pdf} 561 \end{minipage} 562 \end{minipage} 563 \vfill 564 The exchange does not only verify the signature, but also 565 checks that the coin was not double-spent. 566 \vfill 567 \pause 568 \begin{center} 569 {\bf Taler is an online payment system.} 570 \end{center} 571 \vfill 572 \end{frame} 573 574 575 \begin{frame}{Requirements: Online vs. Offline Digital Currencies} 576 \framesubtitle{\url{https://taler.net/papers/euro-bearer-online-2021.pdf}} 577 \begin{itemize} 578 \item Offline capabilities are sometimes cited as a requirement for digital payment solutions 579 \item All implementations must either use restrictive hardware elements and/or introduce 580 counterparty risk. 581 \item[$\Rightarrow$] Permanent offline features weaken a digital payment solution (privacy, security) 582 \item[$\Rightarrow$] Introduces unwarranted competition for physical cash (endangers emergency-preparedness). 583 \end{itemize} 584 We recommend a tiered approach: 585 \begin{enumerate} 586 \item Online-first, bearer-based digital currency with Taler 587 \item (Optional:) Limited offline mode for network outages 588 \item Physical cash for emergencies (power outage, catastrophic cyber incidents) 589 \end{enumerate} 590 \end{frame} 591 592 593 \begin{frame}{Scalability} 594 On paper, the design scales linearly with computing resources: 595 \begin{itemize} 596 \item Front-end logic at the central bank only needs to perform a few signature operations, a 597 single CPU core can typically do a few thousands per second. 598 \item Front-end servers need to talk to a database to prevent double-spending. A single database server can handle tens of thousands of such operations per second. 599 \item All operations are easily split across multiple database servers by simply assigning 600 each database server a range of values. 601 \item The frontends need to talk to the backends using an interconnect. The size of an 602 individual transaction is typically about 1–10 kilobytes. Modern interconnects 603 can support millions of such transactions per second. 604 \item To securely store 1-10 kilobytes per transaction, using AWS pricing, the cost of the 605 system (storage, bandwidth, computation) at scale would be 0.0001 USD per transaction. 606 \end{itemize} 607 \end{frame} 608 609 610 \begin{frame}{Scalability in numbers} 611 \framesubtitle{\url{https://taler.net/en/news/2022-06.html}} 612 On a {\bf single desktop system}, we measured: 613 \begin{itemize} 614 \item {\bf 1k+} withdraws\&deposits/second (client and server doing 2048-bit RSA) 615 \item {\bf 50k+} import inbound wire transfers per second (to RTGS) 616 \item {\bf 33k+} transactions aggregated/second 617 \item {\bf 62k+} export outbound wire transfers per second (to RTGS) 618 \end{itemize}\pause 619 \vfill 620 In a distributed experiment on {\bf Grid5000}, we measured 621 \begin{center} 622 {\bf 28'500+} transactions (withdraw\&deposits)/second 623 \end{center} 624 as part of a Bacherlor's thesis. Opportunties for further improvement were identified. 625 \end{frame} 626 627 628 \begin{frame}{Taler: Project Status} 629 \framesubtitle{\url{https://docs.taler.net/}} 630 \begin{itemize} 631 \item Cryptographic protocols and core exchange component are stable 632 \item Current focus: KYC process at commercial bank, age-restricted payments, programmability, P2P payments 633 \item Internal alpha deployment with a commercial bank in progress 634 \item Pilot project at Bern University of Applied Sciences cafeteria 635 \end{itemize} 636 \begin{center} 637 \includegraphics[width=0.7\textwidth]{taler-in-use.png} 638 \end{center} 639 \end{frame} 640 641 642 \section{Competitor comparison} 643 \begin{frame}{Competitor comparison} 644 \begin{center} \small 645 \begin{tabular}{l||c|c|c|c|c} 646 & Cash & DLT & HW-Token & CB-Account & GNU Taler \\ \hline \hline 647 Online &$-$$-$$-$ & + & $-$ & ++ & +++ \\ \hline 648 Offline & +++ & $-$$-$$-$ & $+$ & $-$$-$ & $-$$-$ \\ \hline 649 Cost & $-$ & $-$$-$$-$ & $-$ & + & ++ \\ \hline 650 Speed & + & $-$$-$$-$ & $+$ & o & ++ \\ \hline 651 Taxation & $-$ & +++ & $-$$-$ & +++ & +++ \\ \hline 652 Payer-anon & ++ & $-$$-$ & ??? & $-$$-$ & +++ \\ \hline 653 Payee-anon & ++ & $-$$-$ & ??? & $-$$-$ & $-$$-$$-$ \\ \hline 654 Security & $-$ & ??? & $-$$-$ & o & ++ \\ \hline 655 Migration & +++ & $-$$-$$-$ & $-$$-$$-$& o & + \\ \hline 656 Libre & $-$ & ??? & $-$$-$$-$& N/A & +++ \\ 657 \end{tabular} 658 \end{center} 659 \end{frame} 660 661 662 \begin{frame}{Taler Systems SA: Commercial support} 663 \framesubtitle{\url{https://taler-systems.com/}} 664 Pilots with banking organizations often involve: 665 \begin{itemize} 666 \item Share knowledge on Taler deployment (training package) 667 \item Provide deployment for evaluation (sandbox package) 668 \item Support integration with core banking (integration package) 669 \end{itemize} 670 \hfill 671 \begin{center} 672 {\bf Contact me or Leon Schumacher for details.} 673 \end{center} 674 \end{frame} 675 676 677 \begin{frame} 678 \frametitle{Do you have any questions?} 679 \vfill 680 References: 681 {\tiny 682 \begin{enumerate} 683 \item{David Chaum, Christian Grothoff and Thomas Moser. 684 {\em How to issue a central bank digital currency}. 685 {\bf SNB Working Papers, 2021}.} 686 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 687 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 688 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 689 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 690 {\em Enabling Secure Web Payments with GNU Taler}. 691 {\bf SPACE 2016}.} 692 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 693 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 694 Available upon request. 2016.} 695 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 696 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 697 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 698 \item{David Chaum, Amos Fiat and Moni Naor. 699 {\em Untraceable electronic cash}. 700 {\bf Proceedings on Advances in Cryptology, 1990}.} 701 \item{Phillip Rogaway. 702 {\em The Moral Character of Cryptographic Work}. 703 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 704 \end{enumerate} 705 } 706 \end{frame} 707 708 709 \end{document}