slides.tex (63182B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \usepackage{adjustbox} 9 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 10 \usetheme{boxes} 11 \setbeamertemplate{navigation symbols}{} 12 \usepackage{xcolor} 13 \usepackage{tikz,eurosym} 14 \usepackage[normalem]{ulem} 15 \usepackage{listings} 16 17 % CSS 18 \lstdefinelanguage{CSS}{ 19 basicstyle=\ttfamily\scriptsize, 20 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 21 sensitive=true, 22 morecomment=[l]{//}, 23 morecomment=[s]{/*}{*/}, 24 morestring=[b]', 25 morestring=[b]", 26 alsoletter={:}, 27 alsodigit={-} 28 } 29 30 % JavaScript 31 \lstdefinelanguage{JavaScript}{ 32 basicstyle=\ttfamily\scriptsize, 33 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 34 morecomment=[s]{/*}{*/}, 35 morecomment=[l]//, 36 morestring=[b]", 37 morestring=[b]' 38 } 39 40 \lstdefinelanguage{HTML5}{ 41 basicstyle=\ttfamily\scriptsize, 42 language=html, 43 sensitive=true, 44 alsoletter={<>=-}, 45 morecomment=[s]{<!-}{-->}, 46 tag=[s], 47 otherkeywords={ 48 % General 49 >, 50 % Standard tags 51 <!DOCTYPE, 52 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 53 % body 54 </body, <body, 55 % Divs 56 </div, <div, </div>, 57 % Paragraphs 58 </p, <p, </p>, 59 % scripts 60 </script, <script, 61 % More tags... 62 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 63 }, 64 ndkeywords={ 65 % General 66 =, 67 % HTML attributes 68 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 69 % SVG attributes 70 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 71 % CSS properties 72 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 73 % CSS3 properties 74 transform:, -moz-transform:, -webkit-transform:, 75 animation:, -webkit-animation:, 76 transition:, transition-duration:, transition-property:, transition-timing-function:, 77 } 78 } 79 80 \lstdefinelanguage{JavaScript}{ 81 basicstyle=\ttfamily\scriptsize, 82 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 83 keywordstyle=\color{blue}\bfseries, 84 ndkeywords={class, export, boolean, throw, implements, import, this}, 85 ndkeywordstyle=\color{darkgray}\bfseries, 86 identifierstyle=\color{black}, 87 sensitive=false, 88 comment=[l]{//}, 89 morecomment=[s]{/*}{*/}, 90 commentstyle=\color{purple}\ttfamily, 91 stringstyle=\color{red}\ttfamily, 92 morestring=[b]', 93 morestring=[b]" 94 } 95 96 \usetikzlibrary{shapes,arrows} 97 \usetikzlibrary{positioning} 98 \usetikzlibrary{calc} 99 100 \title{GNU Taler} 101 \subtitle{Deployment Plan 2021} 102 103 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=0.5cm]{gnu.png} \includegraphics[width=0.5cm]{ashoka.png}\hfill} 104 %\setbeamercovered{transparent=1} 105 106 \author{F. Dold, C. Grothoff} 107 \date{\today} 108 \institute{Taler Systems SA} 109 110 111 \begin{document} 112 113 \justifying 114 115 \begin{frame} 116 \begin{center} 117 \Large {\bf GNU Taler as a CBDC solution} 118 \vfill 119 \includegraphics[width=0.66\textwidth]{logo-2020.jpg} 120 \vfill 121 \end{center} 122 \begin{textblock*}{4cm}(.5cm,6.7cm) % {block width} (coords) 123 {\Large {\bf \href{https://taler-systems.com/}{taler-systems.com}} \\ 124 Twitter: @taler \\ 125 mail@taler.net } 126 \end{textblock*} 127 128 % Substitute based on who is giving the talk! 129 \begin{textblock*}{6cm}(6.7cm,6.7cm) % {block width} (coords) 130 {\hfill {\Large {\bf Christian Grothoff} \\ 131 \hfill {\bf Leon Schumacher} \\ 132 \hfill {\bf Florian Dold}} \\ 133 \hfill \{grothoff,schumacher,dold\}@taler.net } 134 \end{textblock*} 135 136 \end{frame} 137 138 139 \section{Introduction} 140 141 \begin{frame}{What is Taler?} 142 \framesubtitle{\url{https://taler.net/en/features.html}} 143 \noindent 144 Taler is 145 \vfill 146 \begin{itemize} 147 \item a Free/Libre software \emph{payment system} infrastructure project 148 \item ... with a surrounding software ecosystem 149 \item ... and a company (Taler Systems S.A.) and community that wants to deploy it 150 as widely as possible. 151 \end{itemize} 152 \vfill 153 \noindent 154 However, Taler is 155 \begin{itemize} 156 \item \emph{not} a currency 157 \item \emph{not} a long-term store of value 158 \item \emph{not} a network or instance of a system 159 \item \emph{not} decentralized 160 \item \emph{not} based on proof-of-work or proof-of-stake 161 \item \emph{not} a speculative asset / ``get-rich-quick scheme'' 162 \end{itemize} 163 \vfill 164 \end{frame} 165 166 \begin{frame}{Taler: Payment System Architecture} 167 \vfill 168 \begin{center} 169 \includegraphics[width=1\textwidth]{operations.png} 170 \end{center} 171 \end{frame} 172 173 \begin{frame}{The Taler Software Ecosystem} 174 \framesubtitle{\url{https://taler.net/en/docs.html}} 175 Taler is based on modular components that work together to provide a 176 complete payment system: 177 \vfill 178 \begin{itemize} 179 \item {\bf Exchange:} Service provider for digital cash 180 \begin{itemize} 181 \item Core exchange software (cryptography, database) 182 \item Air-gapped key management, real-time {\bf auditing} 183 \item LibEuFin: Modular integration with banking systems 184 \end{itemize} 185 \item {\bf Merchant:} Integration service for existing businesses 186 \begin{itemize} 187 \item Core merchant backend software (cryptography, database) 188 \item Back-office interface for staff 189 \item Frontend integration (E-commerce, Point-of-sale) 190 \end{itemize} 191 \item {\bf Wallet:} Consumer-controlled applications for e-cash 192 \begin{itemize} 193 \item Multi-platform wallet software (for browsers \& mobile phones) 194 \item Wallet backup storage providers 195 \item {\bf Anastasis}: Recovery of lost wallets based on secret splitting 196 \end{itemize} 197 \end{itemize} 198 \end{frame} 199 200 201 \begin{frame}{Taler: Unique Regulatory Features for CBs} 202 \framesubtitle{\url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03}} 203 \begin{itemize} 204 \item Central bank issues digital coins equivalent to issuing cash \\ 205 $\Rightarrow$ monetary policy remains under CB control 206 \item Architecture with consumer accounts at commercial banks \\ 207 $\Rightarrow$ no competition for commercial banking (S\&L) \\ 208 $\Rightarrow$ CB does not have to manage KYC, customer support 209 \item Withdrawal limits and denomination expiration \\ 210 $\Rightarrow$ protects against bank runs and hoarding 211 \item Income transparency and possibility to set fees \\ 212 $\Rightarrow$ additional insights into economy and new policy options 213 \item Revocation protocols and loss limitations \\ 214 $\Rightarrow$ exit strategy and handles catastrophic security incidents 215 \item Privacy by cryptographic design not organizational compliance \\ 216 $\Rightarrow$ CB cannot be forced to facilitate mass-surveillance 217 \end{itemize} 218 \end{frame} 219 220 \begin{frame}{Requirements: Online vs. Offline CBDC} 221 \framesubtitle{\url{https://taler.net/papers/euro-bearer-online-2021.pdf}} 222 \begin{itemize} 223 \item Offline capabilities are often cited as a requirement for CBDC 224 \item All implementations must either use restrictive hardware elements and/or introduce 225 counterparty risk. 226 \item[$\Rightarrow$] Permanent offline features weaken a CBDC solution (privacy, security) 227 \item[$\Rightarrow$] Introduces unwarranted competition for physical cash (endangers emergency-preparedness). 228 \end{itemize} 229 We recommend a tiered approach: 230 \begin{enumerate} 231 \item Online-first, bearer-based CBDC 232 \item (Optional:) Limited offline mode for network outages 233 \item Physical cash for emergencies (power outage, catastrophic cyber incidents) 234 \end{enumerate} 235 \end{frame} 236 237 \begin{frame}{Taler: Project Status} 238 \framesubtitle{\url{https://docs.taler.net/}} 239 \begin{itemize} 240 \item Cryptographic protocols and core exchange component are stable 241 \item Current focus: Merchant integration, settlement integration, wallet backup 242 \item Pilot project at Bern University of Applied Sciences cafeteria 243 \item Internal alpha deployment with a commercial bank in progress 244 \end{itemize} 245 \end{frame} 246 247 248 \begin{frame}{Next Steps: Possible Projects and Collaborations} 249 \vfill 250 \begin{center} 251 \includegraphics[width=1.0\textwidth]{taler-in-use.png} 252 \end{center} 253 \end{frame} 254 255 \begin{frame}{Area I: System Integration and Partnerships} 256 \framesubtitle{\url{https://lists.gnu.org/mailman/listinfo/taler}} 257 Pilots with CB and international CB support organizations could: 258 \begin{itemize} 259 \item Study integration with the underlying RTGS layer: 260 \begin{itemize} 261 \item Develop standardized operational procedures 262 \item Assess transaction performance at scale 263 \item Perform cost analysis in CB environment 264 \item Assess effort for integration with commercial banks 265 \end{itemize} 266 \item Analyze regulatory considerations for different legislations 267 % \item Building awareness of Taler as a bearer-based retail CBDC 268 \item Perform independent security audits of Taler components 269 \item Determine and possibly close gaps in the existing solution 270 \end{itemize} 271 \end{frame} 272 273 274 \begin{frame}{Area II: Development/Research Extensions} 275 \framesubtitle{\url{https://myoralvillage.org/}} 276 We have ideas for protocol extensions and ``programmable money'': 277 \begin{itemize} 278 \item Mediated wallet-to-wallet payments (instead of customer-to-merchant) 279 \item Privacy-preserving auctions (trading, currency exchange) 280 \item Age-restricted private payments for children (youth protection) 281 \end{itemize} 282 CBs should also consider funding research to improve: 283 \begin{itemize} 284 \item General digital wallet usability and availability 285 \item Accessibility features for illiterate and innumerate users 286 \item Projects that facilitate integration at retailers 287 \begin{itemize} 288 \item Hardware and software support for embedded systems 289 \item Integration into off-the-self E-commerce systems 290 \end{itemize} 291 \item Protocol extensions for automated tax reporting 292 \end{itemize} 293 \end{frame} 294 295 296 \begin{frame} 297 \frametitle{Do you have any questions?} 298 299 \vfill 300 Further reading: 301 {\tiny 302 \begin{enumerate} 303 \item{David Chaum, Christian Grothoff and Thomas Moser. 304 {\em How to issue a central bank digital currency}. 305 {\bf SNB Working Papers, 2021}.} 306 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 307 {\em Enabling Secure Web Payments with GNU Taler}. 308 {\bf SPACE 2016}.} 309 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 310 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 311 Available upon request. 2016.} 312 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 313 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 314 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 315 \item{Phillip Rogaway. 316 {\em The Moral Character of Cryptographic Work}. 317 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 318 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 319 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 320 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 321 \item{David Chaum, Amos Fiat and Moni Naor. 322 {\em Untraceable electronic cash}. 323 {\bf Proceedings on Advances in Cryptology, 1990}.} 324 \end{enumerate} 325 } 326 \begin{center} 327 {\bf Let money facilitate trade; but ensure capital serves society.} 328 \end{center} 329 \end{frame} 330 331 332 \begin{frame}{Backup Slides} 333 \end{frame} 334 335 336 337 \begin{frame}{Taler Protocol} 338 \framesubtitle{\url{https://taler.net/papers/thesis-dold-phd-2019.pdf}} 339 \begin{itemize} 340 \item Core concept: Blind-signed tokens of value 341 \item Based on stable, proven cryptographic constructions and primitives 342 (Chaum-style eCash with extension) 343 \item Concrete protocol with focus on data minimization 344 and transparency/auditability through digital signatures. 345 \item Documented in detail in a PhD thesis by Dold 346 \item Exchange implementation has undergone external security audit 347 \end{itemize} 348 \end{frame} 349 350 351 352 %\begin{frame}{CBDC is a Hot Topic} 353 % \vfill 354 %\begin{center} 355 %\includegraphics[width=1.0\textwidth]{cbdc-news.png} 356 %\end{center} 357 %\end{frame} 358 359 \begin{frame}{CBDC Initiatives and Taler} 360 Many initiatives are currently at the level of requirements discussion: 361 \begin{minipage}{7cm} 362 \begin{itemize} 363 \item ECB: Report on a Digital Euro / Eurosystem report on the public consultation on a Digital Euro 364 \item Bank of England: Just initiated a task force 365 \end{itemize} 366 \end{minipage} 367 \begin{minipage}{5cm} 368 \includegraphics[width=0.8\textwidth]{cbdc-news.png} 369 \end{minipage} 370 \vfill 371 Taler can serve as the foundation for a \emph{bearer-based} \emph{retail} CBDC. 372 \begin{itemize} 373 \item Taler replicates physical cash rather than bank deposits 374 \item Taler has unique design principles and regulatory features that align with CBDC 375 requirements 376 \item ECB survey has identified privacy as a primary requirement of end users 377 \end{itemize} 378 \end{frame} 379 380 \begin{frame}{Design principles: Aligned with CBDC} 381 \framesubtitle{https://taler.net/en/principles.html} 382 GNU Taler must ... 383 \begin{enumerate} 384 \item {... be implemented as {\bf free software}.} 385 \item {... protect the {\bf privacy of buyers}.} 386 \item {... must enable the state to {\bf tax income} and crack down on 387 illegal business activities.} 388 \item {... prevent payment fraud.} 389 \item {... only {\bf disclose the minimal amount of information 390 necessary}.} 391 \item {... be usable.} 392 \item {... be efficient.} 393 \item {... avoid single points of failure.} 394 \item {... foster {\bf competition}.} 395 \end{enumerate} 396 \end{frame} 397 398 399 400 \begin{frame}[fragile]{Taler: Bank Perspective} 401 \begin{adjustbox}{max totalsize={.9\textwidth}{.7\textheight},center} 402 \begin{tikzpicture} 403 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 404 \node (origin) at (0,0) {}; 405 \node (exchange) [def,above=of origin,draw]{Exchange}; 406 \node (nexus) [def, draw, below right=of exchange] {Nexus}; 407 \node (corebanking) [def, draw, below left=of nexus] {Core Banking}; 408 \node (nginx) [def, draw, above=of exchange]{Nginx}; 409 \node (postgres) [def, draw, below left=of exchange]{Postgres}; 410 \node (postgres-nexus) [def, draw, below right=of nexus]{Postgres}; 411 412 \tikzstyle{C} = [color=black, line width=1pt] 413 414 \draw [<-, C] (exchange) -- (nginx) node [midway, above, sloped] (TextNode) {REST API}; 415 \draw [<-, C] (postgres) -- (exchange) node [midway, above, sloped] (TextNode) {SQL}; 416 \draw [<-, C] (postgres-nexus) -- (nexus) node [midway, above, sloped] (TextNode) {SQL}; 417 \draw [<-, C] (nexus) -- (exchange) node [midway, above, sloped] (TextNode) {Internal REST API}; 418 \draw [<-, C] (corebanking) -- (nexus) node [midway, above, sloped] (TextNode) {EBICS/FinTS}; 419 420 \end{tikzpicture} 421 \end{adjustbox} 422 \end{frame} 423 424 425 \begin{frame}{Taler: Exchange Details} 426 \begin{center} 427 \begin{tikzpicture} 428 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 429 \node (origin) at (0,0) {}; 430 \node (httpd) [def,above=of origin,draw]{httpd}; 431 \node (secmod-rsa) [def, draw, right=of httpd] {secmod-rsa}; 432 \node (secmod-eddsa) [def, draw, left=of httpd] {secmod-eddsa}; 433 \node (postgres) [def, draw, below=of httpd]{Postgres}; 434 \node (aggregator) [def, draw, right=of postgres]{aggregator}; 435 \node (transfer) [def, draw, below left=of postgres]{transfer}; 436 \node (wirewatch) [def, draw, below right=of postgres]{wirewatch}; 437 \node (nexus) [def, draw, below=of postgres]{Nexus}; 438 439 \tikzstyle{C} = [color=black, line width=1pt] 440 441 \draw [<->, C] (httpd) -- (postgres) node [midway, above, sloped] (TextNode) {}; 442 \draw [<->, C] (httpd) -- (secmod-rsa) node [midway, above, sloped] (TextNode) {}; 443 \draw [<->, C] (httpd) -- (secmod-eddsa) node [midway, above, sloped] (TextNode) {}; 444 \draw [<->, C] (aggregator) -- (postgres) node [midway, above, sloped] (TextNode) {}; 445 \draw [<->, C] (wirewatch) -- (postgres) node [midway, above, sloped] (TextNode) {}; 446 \draw [<->, C] (transfer) -- (postgres) node [midway, above, sloped] (TextNode) {}; 447 \draw [->, C] (transfer) -- (nexus) node [midway, above, sloped] (TextNode) {}; 448 \draw [<-, C] (wirewatch) -- (nexus) node [midway, above, sloped] (TextNode) {}; 449 \end{tikzpicture} 450 \end{center} 451 \end{frame} 452 453 454 \begin{frame} 455 \frametitle{Taler: Auditor Details} 456 \begin{center} 457 \begin{tikzpicture} 458 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 459 \node (origin) at (0,0) {}; 460 \node (httpd) [def,above left=of origin,draw]{auditor-httpd}; 461 \node (report) [def,above right=of origin,draw]{auditor-report}; 462 \node (postgres-A) [def, draw, below=of origin] {Postgres (Auditor)}; 463 \node (postgres-E) [def, draw, below=of postgres-A] {Postgres (Bank)}; 464 465 \tikzstyle{C} = [color=black, line width=1pt] 466 467 \draw [->, C] (postgres-E) -- (postgres-A) node [midway, above, sloped] (TextNode) {sync}; 468 \draw [<->, C] (httpd) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 469 \draw [<->, C] (report) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 470 \end{tikzpicture} 471 \end{center} 472 \end{frame} 473 474 475 \begin{frame} 476 \frametitle{Taler: Merchant Details} 477 \begin{center} 478 \begin{tikzpicture} 479 \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em]; 480 \node (origin) at (0,0) {}; 481 \node (frontend) [def,above=of origin,draw]{merchant-frontend}; 482 \node (backend) [def,below=of frontend,draw]{taler-backend}; 483 \node (postgres) [def, draw, below left=of backend] {Postgres}; 484 \node (sqlite) [def, draw, below=of backend] {Sqlite}; 485 \node (alt) [def, draw, below right=of backend] {...}; 486 487 \tikzstyle{C} = [color=black, line width=1pt] 488 489 \draw [->, C] (frontend) -- (backend) node [midway, above, sloped] (TextNode) {REST API}; 490 \draw [<->, C] (backend) -- (postgres) node [midway, above, sloped] (TextNode) {SQL}; 491 \draw [<->, C] (backend) -- (sqlite) node [midway, above, sloped] (TextNode) {SQL}; 492 \draw [<->, C] (backend) -- (alt) node [midway, above, sloped] (TextNode) {SQL}; 493 \end{tikzpicture} 494 \end{center} 495 \end{frame} 496 497 498 \begin{frame} 499 \frametitle{Taler: Wallet Details} 500 \begin{center} 501 \begin{tikzpicture} 502 \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em]; 503 \node (origin) at (0,0) {}; 504 \node (gui) [def,above=of origin,draw]{wallet-gui}; 505 \node (core) [def,below=of gui,draw]{wallet-core}; 506 \node (sync) [def, draw, below left=of core] {Sync}; 507 \node (taler) [def, draw, below right=of core] {Taler}; 508 \node (anastasis) [def, draw, below=of core] {Anastasis}; 509 510 \tikzstyle{C} = [color=black, line width=1pt] 511 \draw [<->, C] (gui) -- (core) node [midway, above, sloped] (TextNode) {}; 512 \draw [<->, C] (core) -- (sync) node [midway, above, sloped] (TextNode) {Backup}; 513 \draw [<->, C] (core) -- (taler) node [midway, above, sloped] (TextNode) {Payment}; 514 \draw [<->, C] (core) -- (anastasis) node [midway, above, sloped] (TextNode) {Key Escrow}; 515 \end{tikzpicture} 516 \end{center} 517 \end{frame} 518 519 \begin{frame} 520 \frametitle{High-level Deployment Recipe} 521 \dots as a bank 522 \begin{enumerate} 523 \item Create an escrow bank account for the exchange with EBICS access 524 \item Provision offline signing machine (or account during testing) 525 \item Provision two PostgreSQL databases (for LibEuFin Nexus and exchange) 526 \item Provision user-facing exchange service and secmod processes 527 \item Provision LibEuFin Nexus (connected to escrow account and providing 528 an internal API to the exchange) 529 \item Test using the ``taler-wallet-cli`` 530 \end{enumerate} 531 \end{frame} 532 533 534 \section{Integration with the core banking system} 535 536 \begin{frame} 537 \vfill 538 \begin{center} 539 {\bf Part II: Integration with the core banking system} 540 \end{center} 541 \vfill 542 \end{frame} 543 544 \begin{frame}{Exchange escrow account access} 545 The Taler exchange needs to communicate with the core banking system \dots 546 \begin{itemize} 547 \item to query for transactions into the exchange's escrow account 548 \item to initiate payments of aggregated Taler deposits to merchants 549 \end{itemize} 550 551 In a Taler deployment, the \emph{Taler Wire Gateway} provides an API to the exchange 552 for Taler-specific access to the Exchange's escrow account. Multiple implementations 553 of the Taler Wire Gateway exist: 554 555 \begin{itemize} 556 \item a self-contained play money demo bank 557 \item LibEuFin, an adapter to EBICS and other protocols 558 \end{itemize} 559 560 \end{frame} 561 562 \begin{frame}{LibEuFin} 563 LibEuFin is a standalone project that provides adapters to bank account 564 access APIs. 565 566 \begin{itemize} 567 \item LibEuFin provides both a generic access layer and an 568 implementation of the Taler Wire Gateway API for the exchange 569 \item currently, only EBICS 2.5 is supported 570 \item other APIs such as FinTS or PSD2-style XS2A APIs can be added 571 without requiring changes to the Exchange 572 \item tested with a GLS business account 573 \end{itemize} 574 \end{frame} 575 576 \begin{frame}{LibEuFin Concepts} 577 \begin{itemize} 578 \item A LibEuFin \emph{bank connection} is a set of credentials and parameters 579 to talk to the bank's account access API. 580 \item A LibEuFin \emph{bank account} is the information about a bank 581 account (balances, transactions, payment initiations) stored locally 582 within the LibEuFin service. A LibEuFin bank account has a default Bank 583 Connection that is used to communicate with the bank's API. 584 \item A \emph{facade} provides a domain-specific access layer to bank accounts 585 and connections. The \emph{Taler Wire Gateway Facade} implements the 586 API required by the Taler exchange and translates it to operations on the 587 underlying account/connection. 588 \end{itemize} 589 \end{frame} 590 591 \begin{frame}{LibEuFin Tooling} 592 \begin{itemize} 593 \item \texttt{libeufin-nexus} is the main service 594 \item Almost all configuration (except DB credentials) 595 is stored in the database and managed via a RESTful HTTP API 596 \item \texttt{libeufin-sandbox} implements a toy EBICS host for protocol 597 testing 598 \item \texttt{libeufin-cli} is client for the HTTP API (only implements a subset 599 of available functionality) 600 \end{itemize} 601 \end{frame} 602 603 \begin{frame}{LibEuFin Setup Overview} 604 \begin{itemize} 605 \item Obtain EBICS subscriber configuration (host URL, host ID, user ID, 606 partner ID) for the Exchange's escrow account 607 \item Deploy the LibEuFin Nexus service 608 \item Create a new LibEuFin bank connection (of type \texttt{ebics}) 609 \item Export and back up the key material for the bank connection (contains 610 EBICS subscriber configuration and private keys) 611 \item Send subscriber initialization to the EBICS host (electronically) 612 \item Export key letter and activate subscriber in the EBICS host (manually) 613 \item Synchronize the bank connection 614 \item Import the account into LibEuFin 615 \item Create a Taler Wire Gateway facade 616 \item Set up scheduled tasks for ingesting new transactions / sending payment 617 initiations 618 \end{itemize} 619 \end{frame} 620 621 622 623 \begin{frame}{LibEuFin Implementation Limitations} 624 \begin{itemize} 625 \item LibEuFin is less stable than other Taler components, and future 626 updates might contain breaking changes (tooling, APIs and database 627 schema) 628 \item Error handling and recovery is still rather primitive 629 \item The Taler Wire Gateway does not yet implement automatic return 630 transactions when transactions with a malformed subject (i.e. no reserve 631 public key) are received 632 \end{itemize} 633 \end{frame} 634 635 \begin{frame}{LibEuFin EBICS Limitations} 636 The GLS accounts with EBICS access that we have access to have some limitations: 637 \begin{itemize} 638 \item SEPA Instant Credit Transfers aren't supported yet 639 \item Erroneous payment initiations are accepted by the GLS EBICS host, 640 but an error message is later sent only by paper mail (and not reported 641 by the CRZ download request) 642 \item Limited access to transaction history (3 months) 643 \end{itemize} 644 \end{frame} 645 646 \begin{frame}[fragile]{LibEuFin Setup Guide} 647 \vfill 648 \begin{center} 649 \url{https://docs.taler.net/libeufin/nexus-tutorial.html} 650 \end{center} 651 \vfill 652 \end{frame} 653 654 655 \section{Operator security considerations} 656 657 \begin{frame} 658 \vfill 659 \begin{center} 660 {\bf Part III: Operator security considerations} 661 \end{center} 662 \vfill 663 \end{frame} 664 665 666 \begin{frame}{Key management} 667 Taler has many types of keys: 668 \begin{itemize} 669 \item Coin keys 670 \item Denomination keys 671 \item Online message signing keys 672 \item Offline key signing keys 673 \item Merchant keys 674 \item Auditor key 675 \item Security module keys 676 \item Transfer keys 677 \item Wallet keys 678 \item {\em TLS keys, DNSSEC keys} 679 \end{itemize} 680 \end{frame} 681 682 683 \begin{frame}{Offline keys} 684 Both exchange and auditor use offline keys. 685 \begin{itemize} 686 \item Those keys must be backed up and remain highly confidential! 687 \item We recommend that computers that have ever had access to those 688 keys to NEVER again go online. 689 \item We recommend using a Raspberry Pi for offline key operations. 690 Store it in a safe under multiple locks and keys. 691 \item Apply full-disk encryption on offline-key signing systems. 692 \item Have 3--5 full-disk backups of offline-key signing systems. 693 \end{itemize} 694 \begin{center} 695 \includegraphics[scale=0.1]{pi.png} 696 \end{center} 697 \end{frame} 698 699 700 \begin{frame}{Online keys} 701 The exchange needs RSA and EdDSA keys to be available for online signing. 702 \begin{itemize} 703 \item Knowledge of these private keys will allow an adversary to 704 mint digital cash, possibly resulting in huge financial losses 705 (eventually, this will be detected by the auditor, but only 706 after some financial losses have been irrevocably incurred). 707 \item The corresponding public keys are certified using 708 Taler's public key infrastructure (which uses offline-only keys). 709 \end{itemize} 710 \begin{center} 711 \includegraphics[width=0.5\textwidth]{taler-diagram-signatures.png} 712 \end{center} 713 \vfill 714 {\tt taler-exchange-offline} can also be used to {\bf revoke} the 715 online signing keys, if we find they have been compromised. 716 \vfill 717 \end{frame} 718 719 720 \begin{frame}{Protecting online keys} 721 The exchange needs RSA and EdDSA keys to be available for online signing. 722 \begin{itemize} 723 \item {\tt taler-exchange-secmod-rsa} and {\tt taler-exchange-secmod-eddsa} 724 are the only processes that must have access to the private keys. 725 \item The secmod processes should run under a different UID, but share 726 the same GID with the exchange. 727 \item The secmods generate the keys, allow {\tt taler-exchange-httpd} to sign with 728 them, and eventually delete the private keys. 729 \item Communication between secmods and {\tt taler-exchange-httpd} is via 730 a UNIX domain socket. 731 \item Online private keys are stored on disk (not in database!) and should 732 NOT be backed up (RAID should suffice). If disk is lost, we can always 733 create fresh replacement keys! 734 \end{itemize} 735 \end{frame} 736 737 738 \begin{frame}{Database} 739 The exchange needs the database to detect double spending. 740 \begin{itemize} 741 \item Loss of the database will allow technically skilled people 742 to double-spend their digital cash, possibly resulting in 743 significant financial losses. 744 \item The database contains total amounts customers withdrew and 745 merchants received, so sensitive private banking data. It 746 must also not become public. 747 \item The auditor must have a (current) copy. Asynchronous replication 748 is considered sufficient. This copy could also be used as an 749 additional (off-site?) backup. 750 \end{itemize} 751 \end{frame} 752 753 754 \begin{frame}{taler-exchange-wirewatch} 755 {\tt taler-exchange-wirewatch} needs credentials to access data about 756 incoming wire transfers from the Nexus. 757 \begin{itemize} 758 \item This tool should run as a separate UID and GID (from 759 {\tt taler-exchange-httpd}). 760 \item It must have access to the Postgres database (SELECT + INSERT). 761 \item Its configuration file contains the credentials to talk to Nexus. 762 \item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}. 763 \end{itemize} 764 \end{frame} 765 766 767 \begin{frame}{taler-exchange-transfer} 768 Only {\tt taler-exchange-transfer} needs credentials to initiate wire 769 transfers using the Nexus. 770 \begin{itemize} 771 \item This tool should run as a separate UID and GID (from 772 {\tt taler-exchange-httpd}). 773 \item It must have access to the Postgres database (SELECT + INSERT). 774 \item Its configuration file contains the credentials to talk to Nexus. 775 \item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}. 776 \end{itemize} 777 \end{frame} 778 779 780 \begin{frame}{Nexus} 781 The Nexus has to be able to interact with the escrow account of the bank. 782 \begin{itemize} 783 \item It must have the private keys to sign EBICS/FinTS messages. 784 \item It also has its own local database. 785 \item The Nexus user and database should be kept separate from 786 the other exchange users and the Taler exchange database. 787 \end{itemize} 788 \end{frame} 789 790 791 \begin{frame}{Hardware} 792 General notions: 793 \begin{itemize} 794 \item Platforms with disabled Intel ME \& disabled remote administration are safer. 795 \item VMs are not a security mechanism. Side-channel attacks abound. Avoid running any 796 Taler component in a virtual machine ``for security''. 797 \end{itemize} 798 \end{frame} 799 800 801 \begin{frame}{Operating system} 802 General notions: 803 \begin{itemize} 804 \item It should be safe to run the different Taler components (including Nginx, Nexus 805 and Postgres) all on the same physical hardware (under different UIDs/GIDs). 806 We would separate them onto different physical machines during scale-out, but not 807 necessarily for ``basic'' security. 808 \item Limiting and auditing system administrator access will be crucial. 809 \item We recommend to {\bf not} use any anti-virus. 810 \item We recommend using a well-supported GNU/Linux operating system (such as 811 Debian or Ubuntu). 812 \end{itemize} 813 \end{frame} 814 815 816 \begin{frame}{Network} 817 \begin{itemize} 818 \item We recommend to {\bf not} use any host-based firewall. 819 Taler components can use UNIX domain sockets (or bind to localhost). 820 \item A network-based 821 firewall is not required, but as long as TCP 80/443 are open Taler should 822 work fine. 823 \item Any firewall must be configured to permit connection to Auditor 824 for database synchronization. 825 \item We recommend running the Taler exchange behind an Nginx or Apache 826 proxy for TLS termination. 827 \item We recommend using static IP address configurations (IPv4 and IPv6). 828 \item We recommend using DNSSEC with DANE in addition to TLS certificates. 829 \item We recommend auditing the TLS setup using \url{https://observatory.mozilla.org}. 830 \end{itemize} 831 \end{frame} 832 833 834 \begin{frame}[fragile]{RFC 8905: \texttt{payto:} Uniform Identifiers for Payments and Accounts} 835 \vfill 836 Like \texttt{mailto:}, but for bank accounts instead of email accounts! 837 \vfill 838 \begin{verbatim} 839 payto://<PAYMENT-METHOD>/<ACCOUNT-NR> 840 ?subject=InvoiceNr42 841 &amount=EUR:12.50 842 \end{verbatim} 843 \vfill 844 Default action: Open app to review and confirm payment. 845 \vfill 846 \includegraphics[width=0.25\textwidth]{einzahlschein-ch.jpeg} 847 \hfill 848 \includegraphics[width=0.2\textwidth]{de-ueberweisungsformular.png} 849 \vfill 850 \end{frame} 851 852 853 \begin{frame}[fragile]{Benefits of {\tt payto://}} 854 \begin{itemize} 855 \item Standardized way to represent financial resources (bank account, bitcoin wallet) 856 and payments to them 857 \item Useful on the client-side on the Web and for FinTech backend applications 858 \item Payment methods (such as IBAN, ACH, Bitcoin) are registered with 859 IANA and allow extra options 860 \end{itemize} 861 \begin{center} 862 {\bf Taler wallet can generate payto://-URI for withdraw!} 863 \end{center} 864 \end{frame} 865 866 867 868 \begin{frame}{Customer-to-customer payments} 869 \begin{itemize} 870 \item Customer-to-bank account will be easy. 871 \item Wallet-to-wallet transactions require withdraw ($\Rightarrow$ customer authorization!) 872 \end{itemize} 873 \end{frame} 874 875 876 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 877 \begin{minipage}{6cm} 878 \begin{enumerate} 879 \item Pick random primes $p,q$. 880 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 881 \item Pick small $e < \phi(n)$ such that 882 $d := e^{-1} \mod \phi(n)$ exists. 883 \item Publish public key $(e,n)$. 884 \end{enumerate} 885 \end{minipage} 886 \begin{minipage}{6cm} 887 \begin{tikzpicture} 888 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 889 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 890 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 891 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 892 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 893 894 \tikzstyle{C} = [color=black, line width=1pt] 895 896 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 897 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 898 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 899 \end{tikzpicture} 900 % \includegraphics[width=0.4\textwidth]{seal.pdf} 901 \end{minipage} 902 \end{frame} 903 904 905 \begin{frame}{Merchant: Create a signing key (EdDSA)} 906 \begin{minipage}{6cm} 907 \begin{itemize} 908 \item pick random $m \mod o$ as private key 909 \item $M = mG$ public key 910 \end{itemize} 911 \end{minipage} 912 \begin{minipage}{6cm} 913 \begin{tikzpicture} 914 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 915 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 916 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 917 \node (seal) [draw=none, below=of m]{M}; 918 \tikzstyle{C} = [color=black, line width=1pt] 919 920 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 921 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 922 \end{tikzpicture} 923 \end{minipage} 924 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 925 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 926 \end{frame} 927 928 929 \begin{frame}{Customer: Create a planchet (EdDSA)} 930 \begin{minipage}{8cm} 931 \begin{itemize} 932 \item Pick random $c \mod o$ private key 933 \item $C = cG$ public key 934 \end{itemize} 935 \end{minipage} 936 \begin{minipage}{4cm} 937 \begin{tikzpicture} 938 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 939 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 940 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 941 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 942 \tikzstyle{C} = [color=black, line width=1pt] 943 944 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 945 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 946 \end{tikzpicture} 947 \end{minipage} 948 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 949 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 950 \end{frame} 951 952 953 \begin{frame}{Customer: Blind planchet (RSA)} 954 \begin{minipage}{6cm} 955 \begin{enumerate} 956 \item Obtain public key $(e,n)$ 957 \item Compute $f := FDH(C)$, $f < n$. 958 \item Pick blinding factor $b \in \mathbb Z_n$ 959 \item Transmit $f' := f b^e \mod n$ 960 \end{enumerate} 961 \end{minipage} 962 \begin{minipage}{6cm} 963 \begin{tikzpicture} 964 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 965 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 966 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 967 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 968 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 969 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 970 \tikzstyle{C} = [color=black, line width=1pt] 971 972 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 973 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 974 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 975 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 976 \end{tikzpicture} 977 \end{minipage} 978 \end{frame} 979 980 981 \begin{frame}{Exchange: Blind sign (RSA)} 982 \begin{minipage}{6cm} 983 \begin{enumerate} 984 \item Receive $f'$. 985 \item Compute $s' := f'^d \mod n$. 986 \item Send signature $s'$. 987 \end{enumerate} 988 \end{minipage} 989 \begin{minipage}{6cm} 990 \begin{tikzpicture} 991 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 992 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 993 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 994 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 995 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 996 \tikzstyle{C} = [color=black, line width=1pt] 997 998 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 999 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 1000 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1001 \end{tikzpicture} 1002 \end{minipage} 1003 \end{frame} 1004 1005 1006 \begin{frame}{Customer: Unblind coin (RSA)} 1007 \begin{minipage}{6cm} 1008 \begin{enumerate} 1009 \item Receive $s'$. 1010 \item Compute $s := s' b^{-1} \mod n$ % \\ 1011 % ($(f')^d = (f b^e)^d = f^d b$). 1012 \end{enumerate} 1013 \end{minipage} 1014 \begin{minipage}{6cm} 1015 \begin{tikzpicture} 1016 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1017 \node (b) [def, draw=none] at (0,0) {$b$}; 1018 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1019 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1020 \tikzstyle{C} = [color=black, line width=1pt] 1021 1022 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 1023 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1024 \end{tikzpicture} 1025 \end{minipage} 1026 \end{frame} 1027 1028 \begin{frame}{Withdrawing coins on the Web} 1029 \begin{center} 1030 \includegraphics[height=0.9\textheight]{figs/taler-withdraw.pdf} 1031 \end{center} 1032 \end{frame} 1033 1034 1035 \begin{frame}{Customer: Build shopping cart} 1036 \begin{center} 1037 \begin{tikzpicture} 1038 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 1039 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 1040 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 1041 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 1042 \tikzstyle{C} = [color=black, line width=1pt]; 1043 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 1044 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1045 \end{tikzpicture} 1046 \end{center} 1047 \end{frame} 1048 1049 1050 \begin{frame}{Merchant Integration: Wallet Detection} 1051 \lstset{language=JavaScript} 1052 \lstinputlisting{figs/taler-presence-js.html} 1053 % \caption{Sample code to detect the Taler wallet. Allowing the 1054 % Web site to detect the presence of the wallet leaks one bit 1055 % of information about the user. The above logic also works 1056 % if the wallet is installed while the page is open.} 1057 % \label{listing:presence} 1058 \end{frame} 1059 1060 1061 \begin{frame}{Merchant Integration: Payment Request} 1062 % \begin{figure}[p!] 1063 \lstset{language=HTML5} 1064 \lstinputlisting{figs/taler-402.html} 1065 % \caption{Sample HTTP response to prompt the wallet to show an offer.} 1066 % \label{listing:http-contract} 1067 % \end{figure} 1068 1069 % \begin{figure*}[p!] 1070 % \lstset{language=HTML5} 1071 % \lstinputlisting{figs/taler-contract.html} 1072 % \caption{Sample JavaScript code to prompt the wallet to show an offer. 1073 % Here, the contract is fetched on-demand from the server. 1074 % The {\tt taler\_pay()} function needs to be invoked 1075 % when the user triggers the checkout.} 1076 % \label{listing:contract} 1077 % \end{figure*} 1078 \end{frame} 1079 1080 1081 \begin{frame}{Merchant Integration: Contract} 1082 % \begin{figure*}[t!] 1083 {\tiny 1084 \lstset{language=JavaScript} 1085 \lstinputlisting{figs/taler-contract.json} 1086 % \caption{Minimal Taler contract over a digital article with a value of \EUR{0.10}. The merchant will pay transaction fees up to \EUR{0.01}. The hash over the wire transfer information was truncated to make it fit to the page.} 1087 % \label{listing:json-contract} 1088 % \end{figure*} 1089 } 1090 \end{frame} 1091 1092 1093 \begin{frame}{Merchant: Propose contract (EdDSA)} 1094 \begin{minipage}{6cm} 1095 \begin{enumerate} 1096 \item Complete proposal $D$. 1097 \item Send $D$, $EdDSA_m(D)$ 1098 \end{enumerate} 1099 \end{minipage} 1100 \begin{minipage}{6cm} 1101 \begin{tikzpicture} 1102 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 1103 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 1104 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 1105 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 1106 \tikzstyle{C} = [color=black, line width=1pt]; 1107 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 1108 \tikzstyle{C} = [color=black, line width=1pt] 1109 1110 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 1111 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 1112 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1113 \end{tikzpicture} 1114 \end{minipage} 1115 \end{frame} 1116 1117 1118 \begin{frame}{Customer: Spend coin (EdDSA)} 1119 \begin{minipage}{6cm} 1120 \begin{enumerate} 1121 \item Receive proposal $D$, $EdDSA_m(D)$. 1122 \item Send $s$, $C$, $EdDSA_c(D)$ 1123 \end{enumerate} 1124 \end{minipage} 1125 \begin{minipage}{6cm} 1126 \begin{tikzpicture} 1127 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 1128 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 1129 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 1130 \node (c) [def, draw=none, above=of contract] {$c$}; 1131 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 1132 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1133 \tikzstyle{C} = [color=black, line width=1pt] 1134 1135 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 1136 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 1137 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1138 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 1139 \end{tikzpicture} 1140 \end{minipage} 1141 \end{frame} 1142 1143 1144 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 1145 \begin{minipage}{6cm} 1146 \begin{equation*} 1147 s^e \stackrel{?}{\equiv} FDH(C) \mod n 1148 \end{equation*} 1149 \end{minipage} 1150 \begin{minipage}{6cm} 1151 \begin{minipage}{0.2\textwidth} 1152 \includegraphics[width=\textwidth]{coin.pdf} 1153 \end{minipage} 1154 $\stackrel{?}{\Leftrightarrow}$ 1155 \begin{minipage}{0.2\textwidth} 1156 \includegraphics[width=\textwidth]{seal.pdf} 1157 \end{minipage} 1158 \end{minipage} 1159 \end{frame} 1160 1161 1162 \begin{frame}{Payment processing with Taler} 1163 \begin{center} 1164 \includegraphics[height=0.9\textheight]{figs/taler-pay.pdf} 1165 \end{center} 1166 \end{frame} 1167 1168 1169 \begin{frame}{Giving change} 1170 It would be inefficient to pay EUR 100 with 1 cent coins! 1171 \begin{itemize} 1172 \item Denomination key represents value of a coin. 1173 \item Exchange may offer various denominations for coins. 1174 \item Wallet may not have exact change! 1175 \item Usability requires ability to pay given sufficient total funds. 1176 \end{itemize}\pause 1177 Key goals: 1178 \begin{itemize} 1179 \item maintain unlinkability 1180 \item maintain taxability of transactions 1181 \end{itemize}\pause 1182 Method: 1183 \begin{itemize} 1184 \item Contract can specify to only pay {\em partial value} of a coin. 1185 \item Exchange allows wallet to obtain {\em unlinkable change} 1186 for remaining coin value. 1187 \end{itemize} 1188 \end{frame} 1189 1190 1191 \begin{frame}{Diffie-Hellman (ECDH)} 1192 \begin{minipage}{8cm} 1193 \begin{enumerate} 1194 \item Create private keys $c,t \mod o$ 1195 \item Define $C = cG$ 1196 \item Define $T = tG$ 1197 \item Compute DH \\ $cT = c(tG) = t(cG) = tC$ 1198 \end{enumerate} 1199 \end{minipage} 1200 \begin{minipage}{6cm} 1201 \begin{tikzpicture} 1202 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1203 \node (t) [def, draw=none] at (0,0) {$t$}; 1204 \node (ct) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{dh.pdf}}; 1205 \node (c) [def, draw=none, above left= of ct] {$c$}; 1206 \tikzstyle{C} = [color=black, line width=1pt] 1207 1208 \draw [<-, C] (ct) -- (c) node [midway, above, sloped] (TextNode) {}; 1209 \draw [<-, C] (ct) -- (t) node [midway, above, sloped] (TextNode) {}; 1210 \end{tikzpicture} 1211 \end{minipage} 1212 \end{frame} 1213 1214 1215 \begin{frame}{Strawman solution} 1216 \begin{minipage}{8cm} 1217 Given partially spent private coin key $c_{old}$: 1218 \begin{enumerate} 1219 % \item Let $C_{old} := c_{old}G$ (as before) 1220 \item Pick random $c_{new} \mod o$ private key 1221 \item $C_{new} = c_{new}G$ public key 1222 \item Pick random $b_{new}$ 1223 \item Compute $f_{new} := FDH(C_{new})$, $m < n$. 1224 \item Transmit $f'_{new} := f_{new} b_{new}^e \mod n$ 1225 \end{enumerate} 1226 ... and sign request for change with $c_{old}$. 1227 \end{minipage} 1228 \begin{minipage}{4cm} 1229 \begin{tikzpicture} 1230 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1231 \node (blinded) [def, draw=none]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1232 \node (planchet) [def, draw=none, above left= of blinded] {\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 1233 \node (cnew) [def, draw=none, above= of planchet] {$c_{new}$}; 1234 \node (bnew) [def, draw=none, above right= of blinded] {$b_{new}$}; 1235 \node (dice1) [def, draw=none, above = of cnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1236 \node (dice2) [def, draw=none, above = of bnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1237 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1238 1239 \tikzstyle{C} = [color=black, line width=1pt] 1240 1241 \draw [<-, C] (cnew) -- (dice1) node [midway, above, sloped] (TextNode) {}; 1242 \draw [<-, C] (planchet) -- (cnew) node [midway, above, sloped] (TextNode) {}; 1243 \draw [<-, C] (bnew) -- (dice2) node [midway, above, sloped] (TextNode) {}; 1244 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 1245 \draw [<-, C] (blinded) -- (bnew) node [midway, above, sloped] (TextNode) {}; 1246 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1247 \end{tikzpicture} 1248 \end{minipage} 1249 \pause 1250 \vfill 1251 {\bf Problem: Owner of $c_{new}$ may differ from owner of $c_{old}$!} 1252 \end{frame} 1253 1254 1255 \begin{frame}{Customer: Transfer key setup (ECDH)} 1256 \begin{minipage}{8cm} 1257 Given partially spent private coin key $c_{old}$: 1258 \begin{enumerate} 1259 \item Let $C_{old} := c_{old}G$ (as before) 1260 \item Create random private transfer key $t \mod o$ 1261 \item Compute $T := tG$ 1262 \item Compute $X := c_{old}(tG) = t(c_{old}G) = tC_{old}$ 1263 \item Derive $c_{new}$ and $b_{new}$ from $X$ 1264 \item Compute $C_{new} := c_{new}G$ 1265 \item Compute $f_{new} := FDH(C_{new})$ 1266 \item Transmit $f_{new}' := f_{new} b_{new}^e$ 1267 \end{enumerate} 1268 \end{minipage} 1269 \begin{minipage}{4cm} 1270 \begin{tikzpicture} 1271 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1272 \node (t) [def, draw=none] at (0,0) {$t$}; 1273 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1274 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1275 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1276 \node (cp) [def, draw=none, below left= of dh] {$c_{new}$}; 1277 \node (bp) [def, draw=none, below right= of dh] {$b_{new}$}; 1278 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1279 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1280 1281 \tikzstyle{C} = [color=black, line width=1pt] 1282 1283 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1284 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1285 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1286 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1287 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1288 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1289 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1290 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1291 \end{tikzpicture} 1292 \end{minipage} 1293 \end{frame} 1294 1295 1296 \begin{frame}{Cut-and-Choose} 1297 \begin{minipage}{4cm} 1298 \begin{tikzpicture} 1299 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1300 \node (t) [def, draw=none] at (0,0) {$t_1$}; 1301 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1302 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1303 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1304 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1305 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1306 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1307 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1308 1309 \tikzstyle{C} = [color=black, line width=1pt] 1310 1311 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1312 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1313 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1314 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1315 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1316 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1317 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1318 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1319 \end{tikzpicture} 1320 \end{minipage} 1321 \begin{minipage}{4cm} 1322 \begin{tikzpicture} 1323 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1324 \node (t) [def, draw=none] at (0,0) {$t_2$}; 1325 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1326 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1327 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1328 \node (cp) [def, draw=none, below left= of dh] {$c_{new,2}$}; 1329 \node (bp) [def, draw=none, below right= of dh] {$b_{new,2}$}; 1330 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1331 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1332 1333 \tikzstyle{C} = [color=black, line width=1pt] 1334 1335 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1336 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1337 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1338 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1339 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1340 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1341 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1342 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1343 \end{tikzpicture} 1344 \end{minipage} 1345 \begin{minipage}{4cm} 1346 \begin{tikzpicture} 1347 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1348 \node (t) [def, draw=none] at (0,0) {$t_3$}; 1349 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1350 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1351 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1352 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1353 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1354 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1355 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1356 1357 \tikzstyle{C} = [color=black, line width=1pt] 1358 1359 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1360 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1361 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1362 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1363 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1364 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1365 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1366 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1367 \end{tikzpicture} 1368 \end{minipage} 1369 \end{frame} 1370 1371 1372 \begin{frame}{Exchange: Choose!} 1373 \begin{center} 1374 \item Exchange sends back random $\gamma \in \{ 1, 2, 3 \}$ to the customer. 1375 \end{center} 1376 \end{frame} 1377 1378 1379 \begin{frame}{Customer: Reveal} 1380 \begin{enumerate} 1381 \item If $\gamma = 1$, send $t_2$, $t_3$ to exchange 1382 \item If $\gamma = 2$, send $t_1$, $t_3$ to exchange 1383 \item If $\gamma = 3$, send $t_1$, $t_2$ to exchange 1384 \end{enumerate} 1385 \end{frame} 1386 1387 1388 \begin{frame}{Exchange: Verify ($\gamma = 2$)} 1389 \begin{minipage}{4cm} 1390 \begin{tikzpicture} 1391 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1392 \node (h) [def, draw=none] at (0,0) {$t_1$}; 1393 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1394 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1395 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1396 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1397 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1398 1399 \tikzstyle{C} = [color=black, line width=1pt] 1400 1401 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1402 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1403 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1404 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1405 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1406 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1407 \end{tikzpicture} 1408 \end{minipage} 1409 \begin{minipage}{4cm} 1410 \ 1411 \end{minipage} 1412 \begin{minipage}{4cm} 1413 \begin{tikzpicture} 1414 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1415 \node (h) [def, draw=none] at (0,0) {$t_3$}; 1416 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1417 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1418 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1419 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1420 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1421 1422 \tikzstyle{C} = [color=black, line width=1pt] 1423 1424 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1425 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1426 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1427 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1428 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1429 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1430 \end{tikzpicture} 1431 \end{minipage} 1432 \end{frame} 1433 1434 1435 \begin{frame}{Exchange: Blind sign change (RSA)} 1436 \begin{minipage}{6cm} 1437 \begin{enumerate} 1438 \item Take $f_{new,\gamma}'$. 1439 \item Compute $s' := f_{new,\gamma}'^d \mod n$. 1440 \item Send signature $s'$. 1441 \end{enumerate} 1442 \end{minipage} 1443 \begin{minipage}{6cm} 1444 \begin{tikzpicture} 1445 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1446 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 1447 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 1448 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1449 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 1450 \tikzstyle{C} = [color=black, line width=1pt] 1451 1452 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 1453 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 1454 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1455 \end{tikzpicture} 1456 \end{minipage} 1457 \end{frame} 1458 1459 1460 \begin{frame}{Customer: Unblind change (RSA)} 1461 \begin{minipage}{6cm} 1462 \begin{enumerate} 1463 \item Receive $s'$. 1464 \item Compute $s := s' b_{new,\gamma}^{-1} \mod n$. 1465 \end{enumerate} 1466 \end{minipage} 1467 \begin{minipage}{6cm} 1468 \begin{tikzpicture} 1469 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1470 \node (b) [def, draw=none] at (0,0) {$b_{new,\gamma}$}; 1471 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1472 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1473 \tikzstyle{C} = [color=black, line width=1pt] 1474 1475 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 1476 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1477 \end{tikzpicture} 1478 \end{minipage} 1479 \end{frame} 1480 1481 1482 \begin{frame}{Exchange: Allow linking change} 1483 \begin{minipage}{7cm} 1484 \begin{center} 1485 Given $C_{old}$ 1486 1487 \vspace{1cm} 1488 1489 return $T_\gamma$, $s := s' b_{new,\gamma}^{-1} \mod n$. 1490 \end{center} 1491 \end{minipage} 1492 \begin{minipage}{5cm} 1493 \begin{tikzpicture} 1494 \tikzstyle{def} = [node distance= 3em and 0.5em, inner sep=0.5em, outer sep=.3em]; 1495 \node (co) [def, draw=none] at (0,0) {$C_{old}$}; 1496 \node (T) [def, draw=none, below left=of co]{$T_\gamma$}; 1497 \node (sign) [def, draw=none, below right=of co]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1498 \node (customer) [def, draw, below right=of T] {Customer}; 1499 1500 \tikzstyle{C} = [color=black, line width=1pt] 1501 1502 \draw [<-, C] (T) -- (co) node [midway, above, sloped] (TextNode) {}; 1503 \draw [<-, C] (sign) -- (co) node [midway, above, sloped] (TextNode) {}; 1504 \draw [<-, C] (customer) -- (T) node [midway, above, sloped] (TextNode) {link}; 1505 \draw [<-, C] (customer) -- (sign) node [midway, above, sloped] (TextNode) {link}; 1506 \end{tikzpicture} 1507 \end{minipage} 1508 \end{frame} 1509 1510 1511 \begin{frame}{Customer: Link (threat!)} 1512 \begin{minipage}{6.3cm} 1513 \begin{enumerate} 1514 \item Have $c_{old}$. 1515 \item Obtain $T_\gamma$, $s$ from exchange 1516 \item Compute $X_\gamma = c_{old}T_\gamma$ 1517 \item Derive $c_{new,\gamma}$ and $b_{new,\gamma}$ from $X_\gamma$ 1518 \item Unblind $s := s' b_{new,\gamma}^{-1} \mod n$ 1519 \end{enumerate} 1520 1521 \end{minipage} 1522 \begin{minipage}{5.7cm} 1523 \begin{tikzpicture} 1524 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1525 \node (T) [def, draw=none] at (0,0) {$T_\gamma$}; 1526 \node (exchange) [def, inner sep=0.5em, draw, above left=of T] {Exchange}; 1527 \node (signed) [def, draw=none, below left=of T]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1528 \node (dh) [def, draw=none, below right=of T]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1529 \node (bp) [def, draw=none, below left= of dh] {$b_{new,\gamma}$}; 1530 \node (co) [def, draw=none, above right= of dh] {$c_{old}$}; 1531 \node (cp) [def, draw=none, below= of dh] {$c_{new,\gamma}$}; 1532 \node (coin) [def, draw=none, below left = of bp]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1533 \node (psign) [def, node distance=2.5em and 0em, draw=none, below = of cp]{\includegraphics[width=0.2\textwidth]{planchet-sign.pdf}}; 1534 1535 \tikzstyle{C} = [color=black, line width=1pt] 1536 1537 \draw [<-, C] (dh) -- (co) node [midway, above, sloped] (TextNode) {}; 1538 \draw [<-, C] (dh) -- (T) node [midway, above, sloped] (TextNode) {}; 1539 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1540 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1541 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1542 \draw [<-, C] (coin) -- (bp) node [midway, above, sloped] (TextNode) {}; 1543 \draw [<-, C] (T) -- (exchange) node [midway, above, sloped] (TextNode) {link}; 1544 \draw [<-, C] (signed) -- (exchange) node [midway, below, sloped] (TextNode) {link}; 1545 \draw [<-, C, double] (psign) -- (cp) node [midway, below, sloped] (TextNode) {}; 1546 \end{tikzpicture} 1547 \end{minipage} 1548 \end{frame} 1549 1550 1551 \begin{frame}{Refresh protocol summary} 1552 \begin{itemize} 1553 \item Customer asks exchange to convert old coin to new coin 1554 \item Protocol ensures new coins can be recovered from old coin 1555 \item[$\Rightarrow$] New coins are owned by the same entity! 1556 \end{itemize} 1557 Thus, the refresh protocol allows: 1558 \begin{itemize} 1559 \item To give unlinkable change. 1560 \item To give refunds to an anonymous customer. 1561 \item To expire old keys and migrate coins to new ones. 1562 \item To handle protocol aborts. 1563 \end{itemize} 1564 \noindent 1565 \begin{center} 1566 \bf 1567 Transactions via refresh are equivalent to {\em sharing} a wallet. 1568 \end{center} 1569 \end{frame} 1570 1571 1572 \end{document}