boj.tex (29480B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 9 \usetheme{boxes} 10 \setbeamertemplate{navigation symbols}{} 11 \usepackage{xcolor} 12 \usepackage{tikz,eurosym} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 \usepackage{adjustbox} 16 17 % CSS 18 \lstdefinelanguage{CSS}{ 19 basicstyle=\ttfamily\scriptsize, 20 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 21 sensitive=true, 22 morecomment=[l]{//}, 23 morecomment=[s]{/*}{*/}, 24 morestring=[b]', 25 morestring=[b]", 26 alsoletter={:}, 27 alsodigit={-} 28 } 29 30 % JavaScript 31 \lstdefinelanguage{JavaScript}{ 32 basicstyle=\ttfamily\scriptsize, 33 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 34 morecomment=[s]{/*}{*/}, 35 morecomment=[l]//, 36 morestring=[b]", 37 morestring=[b]' 38 } 39 40 \lstdefinelanguage{HTML5}{ 41 basicstyle=\ttfamily\scriptsize, 42 language=html, 43 sensitive=true, 44 alsoletter={<>=-}, 45 morecomment=[s]{<!-}{-->}, 46 tag=[s], 47 otherkeywords={ 48 % General 49 >, 50 % Standard tags 51 <!DOCTYPE, 52 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 53 % body 54 </body, <body, 55 % Divs 56 </div, <div, </div>, 57 % Paragraphs 58 </p, <p, </p>, 59 % scripts 60 </script, <script, 61 % More tags... 62 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 63 }, 64 ndkeywords={ 65 % General 66 =, 67 % HTML attributes 68 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 69 % SVG attributes 70 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 71 % CSS properties 72 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 73 % CSS3 properties 74 transform:, -moz-transform:, -webkit-transform:, 75 animation:, -webkit-animation:, 76 transition:, transition-duration:, transition-property:, transition-timing-function:, 77 78 } 79 } 80 81 \lstdefinelanguage{JavaScript}{ 82 basicstyle=\ttfamily\scriptsize, 83 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 84 keywordstyle=\color{blue}\bfseries, 85 ndkeywords={class, export, boolean, throw, implements, import, this}, 86 ndkeywordstyle=\color{darkgray}\bfseries, 87 identifierstyle=\color{black}, 88 sensitive=false, 89 comment=[l]{//}, 90 morecomment=[s]{/*}{*/}, 91 commentstyle=\color{purple}\ttfamily, 92 stringstyle=\color{red}\ttfamily, 93 morestring=[b]', 94 morestring=[b]" 95 } 96 97 \usetikzlibrary{shapes,arrows} 98 \usetikzlibrary{positioning} 99 \usetikzlibrary{calc} 100 101 \title{GNU Taler as a Retail CBDC} 102 %\subtitle{} 103 104 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=2.3cm]{bfh.png} \includegraphics[width=1.6cm]{fub.pdf} \includegraphics[width=0.4cm]{ashoka.png} \includegraphics[width=0.4cm]{gnu.png} \includegraphics[width=1cm]{logo-2021.pdf} \hfill} 105 %\setbeamercovered{transparent=1} 106 107 \author[C. Grothoff]{{\bf C. Grothoff}} 108 \date{16.3.2022} 109 \institute{Taler Systems SA} 110 111 112 \begin{document} 113 114 \justifying 115 116 \begin{frame} 117 \begin{center} 118 \LARGE {\bf GNU} 119 120 \vfill 121 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 122 \includegraphics[width=0.66\textwidth]{logo-2021.pdf} 123 124 as a Retail CBDC 125 \vfill 126 \end{center} 127 \begin{textblock*}{6cm}(.5cm,7.7cm) % {block width} (coords) 128 {\Large {\bf \href{https://taler.net/}{taler.net}} \\ 129 \href{https://twitter.com/taler}{taler@twitter} \\ 130 \href{https://taler-systems.com/}{taler-systems.com}} 131 \end{textblock*} 132 133 % Substitute based on who is giving the talk! 134 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 135 {%\hfill {\Large {\bf Florian Dold \&} \\ 136 \hfill {\bf Christian Grothoff} \\ 137 \hfill grothoff@taler.net } 138 \end{textblock*} 139 140 \end{frame} 141 142 \section{Introduction} 143 144 \begin{frame}{Main Points} 145 \framesubtitle{\url{https://taler.net/}} 146 Our retail CBDC: 147 \begin{itemize} 148 \item is token-based (no accounts), centrally issued (not DLT); as efficient and cost-effective 149 as modern real-time gross settlement (RTGS) systems operated by central banks; 150 \item is designed to provide an electronic equivalent to banknotes, therefore no material 151 impact on monetary policy and/or financial stability expected; 152 \item guarantees privacy for the payer, combined with KYC/AML/CFT compliance and 153 income transparency to ensure taxes are paid; 154 \item is implemented as Free/Libre and Open Source Software (FLOSS) to provide 155 transparency, accountability, and security (part of the GNU project). 156 \end{itemize} 157 \end{frame} 158 159 160 \begin{frame}{Payment Systems: Accounts vs. Tokens} 161 \framesubtitle{\url{https://taler.net/papers/accounts-dangerous-2022.pdf}} 162 Two types of payment systems: 163 \begin{enumerate} 164 \item {\bf account-based system}: transfer occurs by charging the payer’s account and crediting 165 the payee’s account (e.g., bank deposits) 166 \item {\bf token-based (value-based) system}: transfer occurs by transferring the value itself, or a 167 token that represents the monetary asset (e.g., banknotes) 168 \end{enumerate} 169 Key difference is the information carried by the information asset: 170 \begin{itemize} 171 \item account (assets): associated with a transaction history 172 \item token (assets): carry information about value and entity that issued the token 173 \end{itemize} 174 Bitcoin, and distributed ledger technologies (DLTs) in general, are account-based systems! 175 Novelty is that the ledger is distributed (decentralized). 176 \end{frame} 177 178 179 \begin{frame}{Simplistic CBDC Designs} 180 \framesubtitle{\url{https://edwardsnowden.substack.com/p/cbdcs}} 181 \begin{itemize} 182 \item Account-based CBDC (e.g., Bindseil 2020, Berentsen and Schär 2018): 183 \begin{itemize} 184 \item simplest solution: central bank account for all 185 \item responsibility to perform KYC and ensure AML/CFT (could be outsourced); 186 \item potential for mass-surveillance (threat to CB independence); 187 \item in direct competition with commercial banks 188 \end{itemize} \pause 189 \item Token-based CBDC: 190 \begin{itemize} 191 \item requires a system to ensure that electronic tokens are not easily copied 192 (hardware-based or software-based) \\ $\rightarrow$ double-spending problem 193 \item KYC and AML/CFT compliance? 194 \end{itemize} 195 \end{itemize} 196 \end{frame} 197 198 199 \section{What is Taler?} 200 \begin{frame}{What is Taler?} 201 \begin{center} 202 Taler is an electronic instant payment system based on tokens. 203 \end{center} 204 \begin{itemize} 205 \item Uses electronic coins stored in {\bf wallets} on customer's device 206 \item Like {\bf cash} 207 \item Pay in {\bf existing currencies} (i.e. CHF, EUR, USD, JPY) 208 \end{itemize} 209 \vfill 210 \pause 211 \noindent 212 However, Taler is 213 \begin{itemize} 214 \item \emph{not} a currency 215 \item \emph{not} a long-term store of value 216 \item \emph{not} a network or instance of a system 217 \item \emph{not} decentralized 218 \item \emph{not} based on proof-of-work or proof-of-stake 219 \item \emph{not} a speculative asset / ``get-rich-quick scheme'' 220 \end{itemize} 221 \end{frame} 222 223 224 \begin{frame}{Some of the people behind GNU Taler} 225 {\tiny 226 \begin{itemize} 227 \item Prof. David Chaum (original research) 228 \item Dr. Florian Dold (cryptography, systems engineering) 229 \item Dr. Belén Barros Pena (UX design, accessibility) 230 \item Prof. Christian Grothoff (research \& development) 231 \item Prof. Andreas Habegger (research, hardware) 232 \item Dr. Thomas Moser (economics) 233 \item Dr. Richard Stallman (advisory) 234 \item Leon Schumacher, MBA (business) 235 \item Prof. Hansj\"urg Wenger (research, deployment) 236 \item Dr. Michael Widmer, MBA (legal) 237 \item Jonathan (iOS wallet) 238 \item Marcello (bank integration) 239 \item Marco (scalability, snack machine) 240 \item \"Ozg\"ur (security audit, age restrictions) 241 \item Sebastian (Web interface) 242 \item Stefan (documentation, project management) 243 \item Torsten (Andorid wallet) 244 \end{itemize} 245 } 246 \end{frame} 247 248 249 \begin{frame}{Design Principles} 250 \framesubtitle{https://taler.net/en/principles.html} 251 GNU Taler must ... 252 \begin{enumerate} 253 \item {... be implemented as {\bf free software}.} 254 \item {... protect the {\bf privacy of buyers}.} 255 \item {... must enable the state to {\bf tax income} and crack down on 256 illegal business activities.} 257 \item {... prevent payment fraud.} 258 \item {... only {\bf disclose the minimal amount of information 259 necessary}.} 260 \item {... be usable.} 261 \item {... be efficient.} 262 \item {... avoid single points of failure.} 263 \item {... foster {\bf competition}.} 264 \end{enumerate} 265 \end{frame} 266 267 268 \begin{frame}{The Big Picture} 269 \begin{center} 270 \includegraphics[width=0.8\textwidth]{bp.png} 271 \end{center} 272 \end{frame} 273 274 275 \begin{frame}{Taler: Unique Regulatory Features for CBs} 276 \framesubtitle{\url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03}} 277 \begin{itemize} 278 \item Central bank issues digital coins equivalent to issuing cash \\ 279 $\Rightarrow$ monetary policy remains under CB control 280 \item Architecture with consumer accounts at commercial banks \\ 281 $\Rightarrow$ no competition for commercial banking (S\&L) \\ 282 $\Rightarrow$ CB does not have to manage KYC, customer support 283 \item Withdrawal limits and denomination expiration \\ 284 $\Rightarrow$ protects against bank runs and hoarding 285 \item Income transparency and possibility to set fees \\ 286 $\Rightarrow$ additional insights into economy and new policy options 287 \item Revocation protocols and loss limitations \\ 288 $\Rightarrow$ exit strategy and handles catastrophic security incidents 289 \item Privacy by cryptographic design not organizational compliance \\ 290 $\Rightarrow$ CB cannot be forced to facilitate mass-surveillance 291 \end{itemize} 292 \end{frame} 293 294 295 \begin{frame} 296 \frametitle{Taler Core Components} 297 \framesubtitle{\url{https://taler.net/en/docs.html}} 298 \begin{center} 299 \scalebox{0.3}{ 300 \begin{tikzpicture} 301 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 302 \node (origin) at (0,0) {}; 303 \node (exchange) [def,above=of origin,draw]{Exchange}; 304 \node (customer) [def, draw, below left=of origin] {Customer}; 305 \node (merchant) [def, draw, below right=of origin] {Merchant}; 306 \node (auditor) [def, draw, above right=of origin]{Auditor}; 307 % \node (regulator) [def, draw, above=of auditor]{CSSF}; 308 309 \tikzstyle{C} = [color=black, line width=1pt] 310 311 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 312 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 313 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 314 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 315 % \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report}; 316 317 \end{tikzpicture} 318 } 319 \end{center} 320 {%\tiny 321 \begin{itemize} 322 \item {\bf Exchange:} Service provider for digital cash 323 \begin{itemize} 324 \item Core exchange software (cryptography, database) 325 \item Air-gapped key management, real-time {\bf auditing} 326 \end{itemize} 327 \item {\bf Merchant:} Integration service for existing businesses 328 \begin{itemize} 329 \item Core merchant backend software (cryptography, database) 330 \item Back-office interface for staff 331 \item Frontend integration (E-commerce, Point-of-sale) 332 \end{itemize} 333 \item {\bf Wallet:} Consumer-controlled applications for e-cash 334 \begin{itemize} 335 \item Multi-platform wallet software (for browsers \& mobile phones) 336 \item Wallet backup storage providers 337 \end{itemize} 338 \end{itemize} 339 } 340 \end{frame} 341 342 343 \begin{frame}{Usability of Taler} 344 \vfill 345 \begin{center} 346 \url{https://demo.taler.net/} 347 \end{center} 348 \begin{enumerate} 349 \item Install browser extension. 350 \item Visit the {\tt bank.demo.taler.net} to withdraw coins. 351 \item Visit the {\tt shop.demo.taler.net} to spend coins. 352 \end{enumerate} 353 \vfill 354 \end{frame} 355 356 357 358 \begin{frame}{How does it work?} 359 \framesubtitle{\url{https://taler.net/papers/thesis-dold-phd-2019.pdf}} 360 We use a few ancient constructions: 361 \begin{itemize} 362 \item Cryptographic hash function (1989) 363 \item Blind signature (1983) 364 \item Schnorr signature (1989) 365 \item Diffie-Hellman key exchange (1976) 366 \item Cut-and-choose zero-knowledge proof (1985) 367 \end{itemize} 368 But of course we use modern instantiations. 369 \end{frame} 370 371 372 %\begin{frame}{Definition: Taxability} 373 % We say Taler is taxable because: 374 % \begin{itemize} 375 % \item Merchant's income is visible from deposits. 376 % \item Hash of contract is part of deposit data. 377 % \item State can trace income and enforce taxation. 378 % \end{itemize}\pause 379 % Limitations: 380 % \begin{itemize} 381 % \item withdraw loophole 382 % \item {\em sharing} coins among family and friends 383 % \end{itemize} 384 %\end{frame} 385 386 387 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 388 \begin{minipage}{6cm} 389 \begin{enumerate} 390 \item Pick random primes $p,q$. 391 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 392 \item Pick small $e < \phi(n)$ such that 393 $d := e^{-1} \mod \phi(n)$ exists. 394 \item Publish public key $(e,n)$. 395 \end{enumerate} 396 \end{minipage} 397 \begin{minipage}{6cm} 398 \begin{tikzpicture} 399 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 400 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 401 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 402 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 403 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 404 405 \tikzstyle{C} = [color=black, line width=1pt] 406 407 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 408 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 409 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 410 \end{tikzpicture} 411 % \includegraphics[width=0.4\textwidth]{seal.pdf} 412 \end{minipage} 413 \end{frame} 414 415 416 \begin{frame}{Merchant: Create a signing key (EdDSA)} 417 \begin{minipage}{6cm} 418 \begin{itemize} 419 \item pick random $m \mod o$ as private key 420 \item $M = mG$ public key 421 \end{itemize} 422 \end{minipage} 423 \begin{minipage}{6cm} 424 \begin{tikzpicture} 425 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 426 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 427 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 428 \node (seal) [draw=none, below=of m]{M}; 429 \tikzstyle{C} = [color=black, line width=1pt] 430 431 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 432 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 433 \end{tikzpicture} 434 \end{minipage} 435 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 436 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 437 \end{frame} 438 439 440 \begin{frame}{Customer: Create a planchet (EdDSA)} 441 \begin{minipage}{8cm} 442 \begin{itemize} 443 \item Pick random $c \mod o$ private key 444 \item $C = cG$ public key 445 \end{itemize} 446 \end{minipage} 447 \begin{minipage}{4cm} 448 \begin{tikzpicture} 449 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 450 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 451 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 452 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 453 \tikzstyle{C} = [color=black, line width=1pt] 454 455 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 456 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 457 \end{tikzpicture} 458 \end{minipage} 459 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 460 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 461 \end{frame} 462 463 464 \begin{frame}{Customer: Blind planchet (RSA)} 465 \begin{minipage}{6cm} 466 \begin{enumerate} 467 \item Obtain public key $(e,n)$ 468 \item Compute $f := FDH(C)$, $f < n$. 469 \item Pick blinding factor $b \in \mathbb Z_n$ 470 \item Transmit $f' := f b^e \mod n$ 471 \end{enumerate} 472 \end{minipage} 473 \begin{minipage}{6cm} 474 \begin{tikzpicture} 475 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 476 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 477 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 478 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 479 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 480 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 481 \tikzstyle{C} = [color=black, line width=1pt] 482 483 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 484 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 485 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 486 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 487 \end{tikzpicture} 488 \end{minipage} 489 \end{frame} 490 491 492 \begin{frame}{Exchange: Blind sign (RSA)} 493 \begin{minipage}{6cm} 494 \begin{enumerate} 495 \item Receive $f'$. 496 \item Compute $s' := f'^d \mod n$. 497 \item Send signature $s'$. 498 \end{enumerate} 499 \end{minipage} 500 \begin{minipage}{6cm} 501 \begin{tikzpicture} 502 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 503 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 504 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 505 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 506 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 507 \tikzstyle{C} = [color=black, line width=1pt] 508 509 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 510 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 511 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 512 \end{tikzpicture} 513 \end{minipage} 514 \end{frame} 515 516 517 \begin{frame}{Customer: Unblind coin (RSA)} 518 \begin{minipage}{6cm} 519 \begin{enumerate} 520 \item Receive $s'$. 521 \item Compute $s := s' b^{-1} \mod n$ % \\ 522 % ($(f')^d = (f b^e)^d = f^d b$). 523 \end{enumerate} 524 \end{minipage} 525 \begin{minipage}{6cm} 526 \begin{tikzpicture} 527 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 528 \node (b) [def, draw=none] at (0,0) {$b$}; 529 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 530 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 531 \tikzstyle{C} = [color=black, line width=1pt] 532 533 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 534 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 535 \end{tikzpicture} 536 \end{minipage} 537 \end{frame} 538 539 540 \begin{frame}{Customer: Build shopping cart} 541 \begin{center} 542 \begin{tikzpicture} 543 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 544 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 545 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 546 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 547 \tikzstyle{C} = [color=black, line width=1pt]; 548 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 549 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 550 \end{tikzpicture} 551 \end{center} 552 \end{frame} 553 554 555 \begin{frame}{Merchant: Propose contract (EdDSA)} 556 \begin{minipage}{6cm} 557 \begin{enumerate} 558 \item Complete proposal $D$. 559 \item Send $D$, $EdDSA_m(D)$ 560 \end{enumerate} 561 \end{minipage} 562 \begin{minipage}{6cm} 563 \begin{tikzpicture} 564 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 565 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 566 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 567 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 568 \tikzstyle{C} = [color=black, line width=1pt]; 569 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 570 \tikzstyle{C} = [color=black, line width=1pt] 571 572 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 573 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 574 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 575 \end{tikzpicture} 576 \end{minipage} 577 \end{frame} 578 579 580 \begin{frame}{Customer: Spend coin (EdDSA)} 581 \begin{minipage}{6cm} 582 \begin{enumerate} 583 \item Receive proposal $D$, $EdDSA_m(D)$. 584 \item Send $s$, $C$, $EdDSA_c(D)$ 585 \end{enumerate} 586 \end{minipage} 587 \begin{minipage}{6cm} 588 \begin{tikzpicture} 589 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 590 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 591 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 592 \node (c) [def, draw=none, above=of contract] {$c$}; 593 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 594 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 595 \tikzstyle{C} = [color=black, line width=1pt] 596 597 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 598 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 599 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 600 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 601 \end{tikzpicture} 602 \end{minipage} 603 \end{frame} 604 605 606 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 607 \begin{minipage}{6cm} 608 \begin{equation*} 609 s^e \stackrel{?}{\equiv} FDH(C) \mod n 610 \end{equation*} 611 \end{minipage} 612 \begin{minipage}{6cm} 613 \begin{minipage}{0.2\textwidth} 614 \includegraphics[width=\textwidth]{coin.pdf} 615 \end{minipage} 616 $\stackrel{?}{\Leftrightarrow}$ 617 \begin{minipage}{0.2\textwidth} 618 \includegraphics[width=\textwidth]{seal.pdf} 619 \end{minipage} 620 \end{minipage} 621 \vfill 622 The exchange does not only verify the signature, but also 623 checks that the coin was not double-spent. 624 \vfill 625 \pause 626 \begin{center} 627 {\bf Taler is an online payment system.} 628 \end{center} 629 \vfill 630 \end{frame} 631 632 633 \begin{frame}{Requirements: Online vs. Offline Digital Currencies} 634 \framesubtitle{\url{https://taler.net/papers/euro-bearer-online-2021.pdf}} 635 \begin{itemize} 636 \item Offline capabilities are sometimes cited as a requirement for digital payment solutions 637 \item All implementations must either use restrictive hardware elements and/or introduce 638 counterparty risk. 639 \item[$\Rightarrow$] Permanent offline features weaken a digital payment solution (privacy, security) 640 \item[$\Rightarrow$] Introduces unwarranted competition for physical cash (endangers emergency-preparedness). 641 \end{itemize} 642 We recommend a tiered approach: 643 \begin{enumerate} 644 \item Online-first, bearer-based digital currency with Taler 645 \item (Optional:) Limited offline mode for network outages 646 \item Physical cash for emergencies (power outage, catastrophic cyber incidents) 647 \end{enumerate} 648 \end{frame} 649 650 651 \begin{frame}{Scalability} 652 On paper, the design scales linearly with computing resources: 653 \begin{itemize} 654 \item Front-end logic at the central bank only needs to perform a few signature operations, a 655 single CPU core can typically do a few thousands per second. 656 \item Front-end servers need to talk to a database to prevent double-spending. A single database server can handle tens of thousands of such operations per second. 657 \item All operations are easily split across multiple database servers by simply assigning 658 each database server a range of values. 659 \item The frontends need to talk to the backends using an interconnect. The size of an 660 individual transaction is typically about 1–10 kilobytes. Modern interconnects 661 can support millions of such transactions per second. 662 \item To securely store 1-10 kilobytes per transaction, using AWS pricing, the cost of the 663 system (storage, bandwidth, computation) at scale would be 0.0001 USD per transaction. 664 \end{itemize} 665 \end{frame} 666 667 668 \begin{frame}{Scalability in numbers} 669 On a {\bf single desktop system}, we measured: 670 \begin{itemize} 671 \item {\bf 1k+} withdraws\&deposits/second (client and server doing 2048-bit RSA) 672 \item {\bf 50k+} import inbound wire transfers per second (to RTGS) 673 \item {\bf 33k+} transactions aggregated/second 674 \item {\bf 62k+} export outbound wire transfers per second (to RTGS) 675 \end{itemize} 676 We are now configuring the Grid5000 for larger-scale experiments. 677 \end{frame} 678 679 680 \begin{frame}{Taler: Project Status} 681 \framesubtitle{\url{https://docs.taler.net/}} 682 \begin{itemize} 683 \item Cryptographic protocols and core exchange component are stable 684 \item Current focus: KYC process at commercial bank, age-restricted payments, programmability, P2P payments 685 \item Internal alpha deployment with a commercial bank in progress 686 \item Pilot project at Bern University of Applied Sciences cafeteria 687 \end{itemize} 688 \begin{center} 689 \includegraphics[width=0.7\textwidth]{taler-in-use.png} 690 \end{center} 691 \end{frame} 692 693 694 \section{Competitor comparison} 695 \begin{frame}{Competitor comparison} 696 \begin{center} \small 697 \begin{tabular}{l||c|c|c|c|c} 698 & Cash & DLT & HW-Token & CB-Account & GNU Taler \\ \hline \hline 699 Online &$-$$-$$-$ & + & $-$ & ++ & +++ \\ \hline 700 Offline & +++ & $-$$-$$-$ & $+$ & $-$$-$ & $-$$-$ \\ \hline 701 Cost & $-$ & $-$$-$$-$ & $-$ & + & ++ \\ \hline 702 Speed & + & $-$$-$$-$ & $+$ & o & ++ \\ \hline 703 Taxation & $-$ & +++ & $-$$-$ & +++ & +++ \\ \hline 704 Payer-anon & ++ & $-$$-$ & ??? & $-$$-$ & +++ \\ \hline 705 Payee-anon & ++ & $-$$-$ & ??? & $-$$-$ & $-$$-$$-$ \\ \hline 706 Security & $-$ & ??? & $-$$-$ & o & ++ \\ \hline 707 Migration & +++ & $-$$-$$-$ & $-$$-$$-$& o & + \\ \hline 708 Libre & $-$ & ??? & $-$$-$$-$& N/A & +++ \\ 709 \end{tabular} 710 \end{center} 711 \end{frame} 712 713 714 \begin{frame}{Taler Systems SA: Commercial support} 715 \framesubtitle{\url{https://taler-systems.com/}} 716 Pilots with banking organizations often involve: 717 \begin{itemize} 718 \item Share knowledge on Taler deployment (training package) 719 \item Provide deployment for evaluation (sandbox package) 720 \item Support integration with core banking (integration package) 721 \end{itemize} 722 \hfill 723 \begin{center} 724 {\bf Contact me or Leon Schumacher for details.} 725 \end{center} 726 \end{frame} 727 728 729 \begin{frame} 730 \frametitle{Do you have any questions?} 731 \vfill 732 References: 733 {\tiny 734 \begin{enumerate} 735 \item{David Chaum, Christian Grothoff and Thomas Moser. 736 {\em How to issue a central bank digital currency}. 737 {\bf SNB Working Papers, 2021}.} 738 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 739 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 740 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 741 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 742 {\em Enabling Secure Web Payments with GNU Taler}. 743 {\bf SPACE 2016}.} 744 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 745 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 746 Available upon request. 2016.} 747 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 748 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 749 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 750 \item{David Chaum, Amos Fiat and Moni Naor. 751 {\em Untraceable electronic cash}. 752 {\bf Proceedings on Advances in Cryptology, 1990}.} 753 \item{Phillip Rogaway. 754 {\em The Moral Character of Cryptographic Work}. 755 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 756 \end{enumerate} 757 } 758 \end{frame} 759 760 761 \end{document}