slides.tex (57741B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \usepackage{adjustbox} 9 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 10 \usetheme{boxes} 11 \setbeamertemplate{navigation symbols}{} 12 \usepackage{xcolor} 13 \usepackage{tikz,eurosym} 14 \usepackage[normalem]{ulem} 15 \usepackage{listings} 16 17 % CSS 18 \lstdefinelanguage{CSS}{ 19 basicstyle=\ttfamily\scriptsize, 20 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 21 sensitive=true, 22 morecomment=[l]{//}, 23 morecomment=[s]{/*}{*/}, 24 morestring=[b]', 25 morestring=[b]", 26 alsoletter={:}, 27 alsodigit={-} 28 } 29 30 % JavaScript 31 \lstdefinelanguage{JavaScript}{ 32 basicstyle=\ttfamily\scriptsize, 33 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 34 morecomment=[s]{/*}{*/}, 35 morecomment=[l]//, 36 morestring=[b]", 37 morestring=[b]' 38 } 39 40 \lstdefinelanguage{HTML5}{ 41 basicstyle=\ttfamily\scriptsize, 42 language=html, 43 sensitive=true, 44 alsoletter={<>=-}, 45 morecomment=[s]{<!-}{-->}, 46 tag=[s], 47 otherkeywords={ 48 % General 49 >, 50 % Standard tags 51 <!DOCTYPE, 52 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 53 % body 54 </body, <body, 55 % Divs 56 </div, <div, </div>, 57 % Paragraphs 58 </p, <p, </p>, 59 % scripts 60 </script, <script, 61 % More tags... 62 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 63 }, 64 ndkeywords={ 65 % General 66 =, 67 % HTML attributes 68 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 69 % SVG attributes 70 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 71 % CSS properties 72 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 73 % CSS3 properties 74 transform:, -moz-transform:, -webkit-transform:, 75 animation:, -webkit-animation:, 76 transition:, transition-duration:, transition-property:, transition-timing-function:, 77 } 78 } 79 80 \lstdefinelanguage{JavaScript}{ 81 basicstyle=\ttfamily\scriptsize, 82 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 83 keywordstyle=\color{blue}\bfseries, 84 ndkeywords={class, export, boolean, throw, implements, import, this}, 85 ndkeywordstyle=\color{darkgray}\bfseries, 86 identifierstyle=\color{black}, 87 sensitive=false, 88 comment=[l]{//}, 89 morecomment=[s]{/*}{*/}, 90 commentstyle=\color{purple}\ttfamily, 91 stringstyle=\color{red}\ttfamily, 92 morestring=[b]', 93 morestring=[b]" 94 } 95 96 \usetikzlibrary{shapes,arrows} 97 \usetikzlibrary{positioning} 98 \usetikzlibrary{calc} 99 100 \title{GNU Taler} 101 \subtitle{Deployment Plan 2021} 102 103 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=0.5cm]{gnu.png} \includegraphics[width=0.5cm]{ashoka.png}\hfill} 104 %\setbeamercovered{transparent=1} 105 106 \author{F. Dold, C. Grothoff} 107 \date{\today} 108 \institute{Taler Systems SA} 109 110 111 \begin{document} 112 113 \justifying 114 115 \begin{frame} 116 \begin{center} 117 \LARGE {\bf GNU} 118 119 \vfill 120 \includegraphics[width=0.66\textwidth]{logo-2020.jpg} 121 \end{center} 122 \begin{textblock*}{4cm}(.5cm,6.5cm) % {block width} (coords) 123 {\Large {\bf \url{taler.net}} \\ 124 IRC{\bf \#taler} \\ 125 {\small (on freenode)} \\ 126 twitter@taler \\ 127 mail@taler.net } 128 \end{textblock*} 129 130 % Substitute based on who is giving the talk! 131 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 132 {\hfill {\Large {\bf Florian Dold \&} \\ 133 \hfill {\bf Christian Grothoff}} \\ 134 \hfill \{dold,grothoff\}@taler.net } 135 \end{textblock*} 136 137 \end{frame} 138 139 140 \section{Introduction} 141 142 \begin{frame}{What is Taler?} 143 Taler is 144 \vfill 145 \begin{itemize} 146 \item a Free/Libre software \emph{payment system} infrastructure project 147 \item ... and a community that wants to deploy it 148 as widely as possible. 149 \end{itemize} 150 \vfill 151 Be it at your local hackerspace or with a (central/retail) bank 152 \vfill 153 \end{frame} 154 155 \begin{frame}{What is Taler NOT?} 156 However, Taler is 157 \vfill 158 \begin{itemize} 159 \item \emph{not} a currency 160 \item \emph{not} a long-term store of value 161 \item \emph{not} a network or instance of a system 162 \item \emph{not} decentralized 163 \item \emph{not} based on proof-of-work or proof-of-stake 164 \item \emph{not} a get-rich-quick scheme 165 \end{itemize} 166 \vfill 167 \end{frame} 168 169 \begin{frame}{Why is Taler needed right now?} 170 \vfill 171 \begin{center} 172 \includegraphics[width=1.0\textwidth]{cbdc-news.png} 173 \end{center} 174 \end{frame} 175 176 \begin{frame}{Design principles} 177 \framesubtitle{https://taler.net/en/principles.html} 178 GNU Taler must ... 179 \begin{enumerate} 180 \item {... be implemented as {\bf free software}.} 181 \item {... protect the {\bf privacy of buyers}.} 182 \item {... must enable the state to {\bf tax income} and crack down on 183 illegal business activities.} 184 \item {... prevent payment fraud.} 185 \item {... only {\bf disclose the minimal amount of information 186 necessary}.} 187 \item {... be usable.} 188 \item {... be efficient.} 189 \item {... avoid single points of failure.} 190 \item {... foster {\bf competition}.} 191 \end{enumerate} 192 \end{frame} 193 194 \begin{frame}{Taler: Payment System Architecture} 195 \vfill 196 \begin{center} 197 \includegraphics[width=0.7\textwidth]{operations.png} 198 \end{center} 199 \end{frame} 200 201 \begin{frame}{Implementation Details: Cryptography} 202 \begin{itemize} 203 \item Exchange signs tokens of value into existence 204 via blind signatures (= Chaum-style e-cash with some extensions) 205 \item Main innovation: Refresh protocol that allows efficient 206 transactions while preserving income-transparency of merchants. 207 \item Based on proven constructions and primitives (SHA512, X25519, 208 Ed25519, cut-and-choose, RSA blind signatures) 209 \item Agility: RSA blind signatures could be replaced by elliptic curve blind 210 signatures (Clause Blind Schnorr Signatures) 211 \item Other niceties like forgettable fields in digital contract between 212 customer and merchant 213 \end{itemize} 214 \end{frame} 215 216 \begin{frame}{Implementation Details: Components} 217 Taler is based on modular components with a well-defined API: 218 219 \begin{itemize} 220 \item {\bf Payment Service Provider:} Exchange API service, DB, wire 221 gateway, crypto software security modules, auditing 222 \item {\bf Merchant:} Merchant Backend API, DB, storefront(s), back-office UI 223 \item {\bf User:} wallet-core, wallet UIs (WebExtension, CLI, Android), backup, key escrow and recovery (Anastasis) 224 \end{itemize} 225 \end{frame} 226 227 \begin{frame}{Hands-On Resources} 228 \begin{itemize} 229 \item {\bf Demo:} \url{https://demo.taler.net} 230 \item {\bf Sources:} \url{https://git.taler.net} 231 \item {\bf Docs:} \url{https://docs.taler.net} 232 \item {\bf Swiss National Bank Paper on Taler:} \url{https://www.snb.ch/en/mmr/papers/id/working_paper_2021_03} 233 \end{itemize} 234 \end{frame} 235 236 \begin{frame}{Taler in Use: BFH University Cafeteria} 237 \vfill 238 \begin{center} 239 \includegraphics[width=1.0\textwidth]{taler-in-use.png} 240 \end{center} 241 \end{frame} 242 243 244 \begin{frame} 245 \frametitle{Do you have any questions?} 246 247 \vfill 248 References: 249 {\tiny 250 \begin{enumerate} 251 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 252 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 253 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 254 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 255 {\em Enabling Secure Web Payments with GNU Taler}. 256 {\bf SPACE 2016}.} 257 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 258 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 259 Available upon request. 2016.} 260 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 261 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 262 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 263 \item{David Chaum, Amos Fiat and Moni Naor. 264 {\em Untraceable electronic cash}. 265 {\bf Proceedings on Advances in Cryptology, 1990}.} 266 \item{Phillip Rogaway. 267 {\em The Moral Character of Cryptographic Work}. 268 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 269 \end{enumerate} 270 } 271 \begin{center} 272 {\bf Let money facilitate trade; but ensure capital serves society.} 273 \end{center} 274 \end{frame} 275 276 277 \begin{frame}{Backup Slides} 278 \end{frame} 279 280 \begin{frame}[fragile]{Taler: Bank Perspective} 281 \begin{adjustbox}{max totalsize={.9\textwidth}{.7\textheight},center} 282 \begin{tikzpicture} 283 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 284 \node (origin) at (0,0) {}; 285 \node (exchange) [def,above=of origin,draw]{Exchange}; 286 \node (nexus) [def, draw, below right=of exchange] {Nexus}; 287 \node (corebanking) [def, draw, below left=of nexus] {Core Banking}; 288 \node (nginx) [def, draw, above=of exchange]{Nginx}; 289 \node (postgres) [def, draw, below left=of exchange]{Postgres}; 290 \node (postgres-nexus) [def, draw, below right=of nexus]{Postgres}; 291 292 \tikzstyle{C} = [color=black, line width=1pt] 293 294 \draw [<-, C] (exchange) -- (nginx) node [midway, above, sloped] (TextNode) {REST API}; 295 \draw [<-, C] (postgres) -- (exchange) node [midway, above, sloped] (TextNode) {SQL}; 296 \draw [<-, C] (postgres-nexus) -- (nexus) node [midway, above, sloped] (TextNode) {SQL}; 297 \draw [<-, C] (nexus) -- (exchange) node [midway, above, sloped] (TextNode) {Internal REST API}; 298 \draw [<-, C] (corebanking) -- (nexus) node [midway, above, sloped] (TextNode) {EBICS/FinTS}; 299 300 \end{tikzpicture} 301 \end{adjustbox} 302 \end{frame} 303 304 305 \begin{frame}{Taler: Exchange Details} 306 \begin{center} 307 \begin{tikzpicture} 308 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 309 \node (origin) at (0,0) {}; 310 \node (httpd) [def,above=of origin,draw]{httpd}; 311 \node (secmod-rsa) [def, draw, right=of httpd] {secmod-rsa}; 312 \node (secmod-eddsa) [def, draw, left=of httpd] {secmod-eddsa}; 313 \node (postgres) [def, draw, below=of httpd]{Postgres}; 314 \node (aggregator) [def, draw, right=of postgres]{aggregator}; 315 \node (transfer) [def, draw, below left=of postgres]{transfer}; 316 \node (wirewatch) [def, draw, below right=of postgres]{wirewatch}; 317 \node (nexus) [def, draw, below=of postgres]{Nexus}; 318 319 \tikzstyle{C} = [color=black, line width=1pt] 320 321 \draw [<->, C] (httpd) -- (postgres) node [midway, above, sloped] (TextNode) {}; 322 \draw [<->, C] (httpd) -- (secmod-rsa) node [midway, above, sloped] (TextNode) {}; 323 \draw [<->, C] (httpd) -- (secmod-eddsa) node [midway, above, sloped] (TextNode) {}; 324 \draw [<->, C] (aggregator) -- (postgres) node [midway, above, sloped] (TextNode) {}; 325 \draw [<->, C] (wirewatch) -- (postgres) node [midway, above, sloped] (TextNode) {}; 326 \draw [<->, C] (transfer) -- (postgres) node [midway, above, sloped] (TextNode) {}; 327 \draw [->, C] (transfer) -- (nexus) node [midway, above, sloped] (TextNode) {}; 328 \draw [<-, C] (wirewatch) -- (nexus) node [midway, above, sloped] (TextNode) {}; 329 \end{tikzpicture} 330 \end{center} 331 \end{frame} 332 333 334 \begin{frame} 335 \frametitle{Taler: Auditor Details} 336 \begin{center} 337 \begin{tikzpicture} 338 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 339 \node (origin) at (0,0) {}; 340 \node (httpd) [def,above left=of origin,draw]{auditor-httpd}; 341 \node (report) [def,above right=of origin,draw]{auditor-report}; 342 \node (postgres-A) [def, draw, below=of origin] {Postgres (Auditor)}; 343 \node (postgres-E) [def, draw, below=of postgres-A] {Postgres (Bank)}; 344 345 \tikzstyle{C} = [color=black, line width=1pt] 346 347 \draw [->, C] (postgres-E) -- (postgres-A) node [midway, above, sloped] (TextNode) {sync}; 348 \draw [<->, C] (httpd) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 349 \draw [<->, C] (report) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 350 \end{tikzpicture} 351 \end{center} 352 \end{frame} 353 354 355 \begin{frame} 356 \frametitle{Taler: Merchant Details} 357 \begin{center} 358 \begin{tikzpicture} 359 \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em]; 360 \node (origin) at (0,0) {}; 361 \node (frontend) [def,above=of origin,draw]{merchant-frontend}; 362 \node (backend) [def,below=of frontend,draw]{taler-backend}; 363 \node (postgres) [def, draw, below left=of backend] {Postgres}; 364 \node (sqlite) [def, draw, below=of backend] {Sqlite}; 365 \node (alt) [def, draw, below right=of backend] {...}; 366 367 \tikzstyle{C} = [color=black, line width=1pt] 368 369 \draw [->, C] (frontend) -- (backend) node [midway, above, sloped] (TextNode) {REST API}; 370 \draw [<->, C] (backend) -- (postgres) node [midway, above, sloped] (TextNode) {SQL}; 371 \draw [<->, C] (backend) -- (sqlite) node [midway, above, sloped] (TextNode) {SQL}; 372 \draw [<->, C] (backend) -- (alt) node [midway, above, sloped] (TextNode) {SQL}; 373 \end{tikzpicture} 374 \end{center} 375 \end{frame} 376 377 378 \begin{frame} 379 \frametitle{Taler: Wallet Details} 380 \begin{center} 381 \begin{tikzpicture} 382 \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em]; 383 \node (origin) at (0,0) {}; 384 \node (gui) [def,above=of origin,draw]{wallet-gui}; 385 \node (core) [def,below=of gui,draw]{wallet-core}; 386 \node (sync) [def, draw, below left=of core] {Sync}; 387 \node (taler) [def, draw, below right=of core] {Taler}; 388 \node (anastasis) [def, draw, below=of core] {Anastasis}; 389 390 \tikzstyle{C} = [color=black, line width=1pt] 391 \draw [<->, C] (gui) -- (core) node [midway, above, sloped] (TextNode) {}; 392 \draw [<->, C] (core) -- (sync) node [midway, above, sloped] (TextNode) {Backup}; 393 \draw [<->, C] (core) -- (taler) node [midway, above, sloped] (TextNode) {Payment}; 394 \draw [<->, C] (core) -- (anastasis) node [midway, above, sloped] (TextNode) {Key Escrow}; 395 \end{tikzpicture} 396 \end{center} 397 \end{frame} 398 399 \begin{frame} 400 \frametitle{High-level Deployment Recipe} 401 \dots as a bank 402 \begin{enumerate} 403 \item Create an escrow bank account for the exchange with EBICS access 404 \item Provision offline signing machine (or account during testing) 405 \item Provision two PostgreSQL databases (for LibEuFin Nexus and exchange) 406 \item Provision user-facing exchange service and secmod processes 407 \item Provision LibEuFin Nexus (connected to escrow account and providing 408 an internal API to the exchange) 409 \item Test using the ``taler-wallet-cli`` 410 \end{enumerate} 411 \end{frame} 412 413 414 \section{Integration with the core banking system} 415 416 \begin{frame} 417 \vfill 418 \begin{center} 419 {\bf Part II: Integration with the core banking system} 420 \end{center} 421 \vfill 422 \end{frame} 423 424 \begin{frame}{Exchange escrow account access} 425 The Taler exchange needs to communicate with the core banking system \dots 426 \begin{itemize} 427 \item to query for transactions into the exchange's escrow account 428 \item to initiate payments of aggregated Taler deposits to merchants 429 \end{itemize} 430 431 In a Taler deployment, the \emph{Taler Wire Gateway} provides an API to the exchange 432 for Taler-specific access to the Exchange's escrow account. Multiple implementations 433 of the Taler Wire Gateway exist: 434 435 \begin{itemize} 436 \item a self-contained play money demo bank 437 \item LibEuFin, an adapter to EBICS and other protocols 438 \end{itemize} 439 440 \end{frame} 441 442 \begin{frame}{LibEuFin} 443 LibEuFin is a standalone project that provides adapters to bank account 444 access APIs. 445 446 \begin{itemize} 447 \item LibEuFin provides both a generic access layer and an 448 implementation of the Taler Wire Gateway API for the exchange 449 \item currently, only EBICS 2.5 is supported 450 \item other APIs such as FinTS or PSD2-style XS2A APIs can be added 451 without requiring changes to the Exchange 452 \item tested with a GLS business account 453 \end{itemize} 454 \end{frame} 455 456 \begin{frame}{LibEuFin Concepts} 457 \begin{itemize} 458 \item A LibEuFin \emph{bank connection} is a set of credentials and parameters 459 to talk to the bank's account access API. 460 \item A LibEuFin \emph{bank account} is the information about a bank 461 account (balances, transactions, payment initiations) stored locally 462 within the LibEuFin service. A LibEuFin bank account has a default Bank 463 Connection that is used to communicate with the bank's API. 464 \item A \emph{facade} provides a domain-specific access layer to bank accounts 465 and connections. The \emph{Taler Wire Gateway Facade} implements the 466 API required by the Taler exchange and translates it to operations on the 467 underlying account/connection. 468 \end{itemize} 469 \end{frame} 470 471 \begin{frame}{LibEuFin Tooling} 472 \begin{itemize} 473 \item \texttt{libeufin-nexus} is the main service 474 \item Almost all configuration (except DB credentials) 475 is stored in the database and managed via a RESTful HTTP API 476 \item \texttt{libeufin-sandbox} implements a toy EBICS host for protocol 477 testing 478 \item \texttt{libeufin-cli} is client for the HTTP API (only implements a subset 479 of available functionality) 480 \end{itemize} 481 \end{frame} 482 483 \begin{frame}{LibEuFin Setup Overview} 484 \begin{itemize} 485 \item Obtain EBICS subscriber configuration (host URL, host ID, user ID, 486 partner ID) for the Exchange's escrow account 487 \item Deploy the LibEuFin Nexus service 488 \item Create a new LibEuFin bank connection (of type \texttt{ebics}) 489 \item Export and back up the key material for the bank connection (contains 490 EBICS subscriber configuration and private keys) 491 \item Send subscriber initialization to the EBICS host (electronically) 492 \item Export key letter and activate subscriber in the EBICS host (manually) 493 \item Synchronize the bank connection 494 \item Import the account into LibEuFin 495 \item Create a Taler Wire Gateway facade 496 \item Set up scheduled tasks for ingesting new transactions / sending payment 497 initiations 498 \end{itemize} 499 \end{frame} 500 501 502 503 \begin{frame}{LibEuFin Implementation Limitations} 504 \begin{itemize} 505 \item LibEuFin is less stable than other Taler components, and future 506 updates might contain breaking changes (tooling, APIs and database 507 schema) 508 \item Error handling and recovery is still rather primitive 509 \item The Taler Wire Gateway does not yet implement automatic return 510 transactions when transactions with a malformed subject (i.e. no reserve 511 public key) are received 512 \end{itemize} 513 \end{frame} 514 515 \begin{frame}{LibEuFin EBICS Limitations} 516 The GLS accounts with EBICS access that we have access to have some limitations: 517 \begin{itemize} 518 \item SEPA Instant Credit Transfers aren't supported yet 519 \item Erroneous payment initiations are accepted by the GLS EBICS host, 520 but an error message is later sent only by paper mail (and not reported 521 by the CRZ download request) 522 \item Limited access to transaction history (3 months) 523 \end{itemize} 524 \end{frame} 525 526 \begin{frame}[fragile]{LibEuFin Setup Guide} 527 \vfill 528 \begin{center} 529 \url{https://docs.taler.net/libeufin/nexus-tutorial.html} 530 \end{center} 531 \vfill 532 \end{frame} 533 534 535 \section{Operator security considerations} 536 537 \begin{frame} 538 \vfill 539 \begin{center} 540 {\bf Part III: Operator security considerations} 541 \end{center} 542 \vfill 543 \end{frame} 544 545 546 \begin{frame}{Key management} 547 Taler has many types of keys: 548 \begin{itemize} 549 \item Coin keys 550 \item Denomination keys 551 \item Online message signing keys 552 \item Offline key signing keys 553 \item Merchant keys 554 \item Auditor key 555 \item Security module keys 556 \item Transfer keys 557 \item Wallet keys 558 \item {\em TLS keys, DNSSEC keys} 559 \end{itemize} 560 \end{frame} 561 562 563 \begin{frame}{Offline keys} 564 Both exchange and auditor use offline keys. 565 \begin{itemize} 566 \item Those keys must be backed up and remain highly confidential! 567 \item We recommend that computers that have ever had access to those 568 keys to NEVER again go online. 569 \item We recommend using a Raspberry Pi for offline key operations. 570 Store it in a safe under multiple locks and keys. 571 \item Apply full-disk encryption on offline-key signing systems. 572 \item Have 3--5 full-disk backups of offline-key signing systems. 573 \end{itemize} 574 \begin{center} 575 \includegraphics[scale=0.1]{pi.png} 576 \end{center} 577 \end{frame} 578 579 580 \begin{frame}{Online keys} 581 The exchange needs RSA and EdDSA keys to be available for online signing. 582 \begin{itemize} 583 \item Knowledge of these private keys will allow an adversary to 584 mint digital cash, possibly resulting in huge financial losses 585 (eventually, this will be detected by the auditor, but only 586 after some financial losses have been irrevocably incurred). 587 \item The corresponding public keys are certified using 588 Taler's public key infrastructure (which uses offline-only keys). 589 \end{itemize} 590 \begin{center} 591 \includegraphics[width=0.5\textwidth]{taler-diagram-signatures.png} 592 \end{center} 593 \vfill 594 {\tt taler-exchange-offline} can also be used to {\bf revoke} the 595 online signing keys, if we find they have been compromised. 596 \vfill 597 \end{frame} 598 599 600 \begin{frame}{Protecting online keys} 601 The exchange needs RSA and EdDSA keys to be available for online signing. 602 \begin{itemize} 603 \item {\tt taler-exchange-secmod-rsa} and {\tt taler-exchange-secmod-eddsa} 604 are the only processes that must have access to the private keys. 605 \item The secmod processes should run under a different UID, but share 606 the same GID with the exchange. 607 \item The secmods generate the keys, allow {\tt taler-exchange-httpd} to sign with 608 them, and eventually delete the private keys. 609 \item Communication between secmods and {\tt taler-exchange-httpd} is via 610 a UNIX domain socket. 611 \item Online private keys are stored on disk (not in database!) and should 612 NOT be backed up (RAID should suffice). If disk is lost, we can always 613 create fresh replacement keys! 614 \end{itemize} 615 \end{frame} 616 617 618 \begin{frame}{Database} 619 The exchange needs the database to detect double spending. 620 \begin{itemize} 621 \item Loss of the database will allow technically skilled people 622 to double-spend their digital cash, possibly resulting in 623 significant financial losses. 624 \item The database contains total amounts customers withdrew and 625 merchants received, so sensitive private banking data. It 626 must also not become public. 627 \item The auditor must have a (current) copy. Asynchronous replication 628 is considered sufficient. This copy could also be used as an 629 additional (off-site?) backup. 630 \end{itemize} 631 \end{frame} 632 633 634 \begin{frame}{taler-exchange-wirewatch} 635 {\tt taler-exchange-wirewatch} needs credentials to access data about 636 incoming wire transfers from the Nexus. 637 \begin{itemize} 638 \item This tool should run as a separate UID and GID (from 639 {\tt taler-exchange-httpd}). 640 \item It must have access to the Postgres database (SELECT + INSERT). 641 \item Its configuration file contains the credentials to talk to Nexus. 642 \item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}. 643 \end{itemize} 644 \end{frame} 645 646 647 \begin{frame}{taler-exchange-transfer} 648 Only {\tt taler-exchange-transfer} needs credentials to initiate wire 649 transfers using the Nexus. 650 \begin{itemize} 651 \item This tool should run as a separate UID and GID (from 652 {\tt taler-exchange-httpd}). 653 \item It must have access to the Postgres database (SELECT + INSERT). 654 \item Its configuration file contains the credentials to talk to Nexus. 655 \item[$\Rightarrow$] Configuration should be separate from {\tt taler-exchange-httpd}. 656 \end{itemize} 657 \end{frame} 658 659 660 \begin{frame}{Nexus} 661 The Nexus has to be able to interact with the escrow account of the bank. 662 \begin{itemize} 663 \item It must have the private keys to sign EBICS/FinTS messages. 664 \item It also has its own local database. 665 \item The Nexus user and database should be kept separate from 666 the other exchange users and the Taler exchange database. 667 \end{itemize} 668 \end{frame} 669 670 671 \begin{frame}{Hardware} 672 General notions: 673 \begin{itemize} 674 \item Platforms with disabled Intel ME \& disabled remote administration are safer. 675 \item VMs are not a security mechanism. Side-channel attacks abound. Avoid running any 676 Taler component in a virtual machine ``for security''. 677 \end{itemize} 678 \end{frame} 679 680 681 \begin{frame}{Operating system} 682 General notions: 683 \begin{itemize} 684 \item It should be safe to run the different Taler components (including Nginx, Nexus 685 and Postgres) all on the same physical hardware (under different UIDs/GIDs). 686 We would separate them onto different physical machines during scale-out, but not 687 necessarily for ``basic'' security. 688 \item Limiting and auditing system administrator access will be crucial. 689 \item We recommend to {\bf not} use any anti-virus. 690 \item We recommend using a well-supported GNU/Linux operating system (such as 691 Debian or Ubuntu). 692 \end{itemize} 693 \end{frame} 694 695 696 \begin{frame}{Network} 697 \begin{itemize} 698 \item We recommend to {\bf not} use any host-based firewall. 699 Taler components can use UNIX domain sockets (or bind to localhost). 700 \item A network-based 701 firewall is not required, but as long as TCP 80/443 are open Taler should 702 work fine. 703 \item Any firewall must be configured to permit connection to Auditor 704 for database synchronization. 705 \item We recommend running the Taler exchange behind an Nginx or Apache 706 proxy for TLS termination. 707 \item We recommend using static IP address configurations (IPv4 and IPv6). 708 \item We recommend using DNSSEC with DANE in addition to TLS certificates. 709 \item We recommend auditing the TLS setup using \url{https://observatory.mozilla.org}. 710 \end{itemize} 711 \end{frame} 712 713 714 \begin{frame}[fragile]{RFC 8905: \texttt{payto:} Uniform Identifiers for Payments and Accounts} 715 \vfill 716 Like \texttt{mailto:}, but for bank accounts instead of email accounts! 717 \vfill 718 \begin{verbatim} 719 payto://<PAYMENT-METHOD>/<ACCOUNT-NR> 720 ?subject=InvoiceNr42 721 &amount=EUR:12.50 722 \end{verbatim} 723 \vfill 724 Default action: Open app to review and confirm payment. 725 \vfill 726 \includegraphics[width=0.25\textwidth]{einzahlschein-ch.jpeg} 727 \hfill 728 \includegraphics[width=0.2\textwidth]{de-ueberweisungsformular.png} 729 \vfill 730 \end{frame} 731 732 733 \begin{frame}[fragile]{Benefits of {\tt payto://}} 734 \begin{itemize} 735 \item Standardized way to represent financial resources (bank account, bitcoin wallet) 736 and payments to them 737 \item Useful on the client-side on the Web and for FinTech backend applications 738 \item Payment methods (such as IBAN, ACH, Bitcoin) are registered with 739 IANA and allow extra options 740 \end{itemize} 741 \begin{center} 742 {\bf Taler wallet can generate payto://-URI for withdraw!} 743 \end{center} 744 \end{frame} 745 746 747 748 \begin{frame}{Customer-to-customer payments} 749 \begin{itemize} 750 \item Customer-to-bank account will be easy. 751 \item Wallet-to-wallet transactions require withdraw ($\Rightarrow$ customer authorization!) 752 \end{itemize} 753 \end{frame} 754 755 756 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 757 \begin{minipage}{6cm} 758 \begin{enumerate} 759 \item Pick random primes $p,q$. 760 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 761 \item Pick small $e < \phi(n)$ such that 762 $d := e^{-1} \mod \phi(n)$ exists. 763 \item Publish public key $(e,n)$. 764 \end{enumerate} 765 \end{minipage} 766 \begin{minipage}{6cm} 767 \begin{tikzpicture} 768 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 769 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 770 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 771 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 772 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 773 774 \tikzstyle{C} = [color=black, line width=1pt] 775 776 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 777 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 778 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 779 \end{tikzpicture} 780 % \includegraphics[width=0.4\textwidth]{seal.pdf} 781 \end{minipage} 782 \end{frame} 783 784 785 \begin{frame}{Merchant: Create a signing key (EdDSA)} 786 \begin{minipage}{6cm} 787 \begin{itemize} 788 \item pick random $m \mod o$ as private key 789 \item $M = mG$ public key 790 \end{itemize} 791 \end{minipage} 792 \begin{minipage}{6cm} 793 \begin{tikzpicture} 794 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 795 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 796 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 797 \node (seal) [draw=none, below=of m]{M}; 798 \tikzstyle{C} = [color=black, line width=1pt] 799 800 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 801 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 802 \end{tikzpicture} 803 \end{minipage} 804 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 805 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 806 \end{frame} 807 808 809 \begin{frame}{Customer: Create a planchet (EdDSA)} 810 \begin{minipage}{8cm} 811 \begin{itemize} 812 \item Pick random $c \mod o$ private key 813 \item $C = cG$ public key 814 \end{itemize} 815 \end{minipage} 816 \begin{minipage}{4cm} 817 \begin{tikzpicture} 818 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 819 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 820 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 821 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 822 \tikzstyle{C} = [color=black, line width=1pt] 823 824 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 825 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 826 \end{tikzpicture} 827 \end{minipage} 828 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 829 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 830 \end{frame} 831 832 833 \begin{frame}{Customer: Blind planchet (RSA)} 834 \begin{minipage}{6cm} 835 \begin{enumerate} 836 \item Obtain public key $(e,n)$ 837 \item Compute $f := FDH(C)$, $f < n$. 838 \item Pick blinding factor $b \in \mathbb Z_n$ 839 \item Transmit $f' := f b^e \mod n$ 840 \end{enumerate} 841 \end{minipage} 842 \begin{minipage}{6cm} 843 \begin{tikzpicture} 844 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 845 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 846 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 847 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 848 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 849 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 850 \tikzstyle{C} = [color=black, line width=1pt] 851 852 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 853 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 854 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 855 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 856 \end{tikzpicture} 857 \end{minipage} 858 \end{frame} 859 860 861 \begin{frame}{Exchange: Blind sign (RSA)} 862 \begin{minipage}{6cm} 863 \begin{enumerate} 864 \item Receive $f'$. 865 \item Compute $s' := f'^d \mod n$. 866 \item Send signature $s'$. 867 \end{enumerate} 868 \end{minipage} 869 \begin{minipage}{6cm} 870 \begin{tikzpicture} 871 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 872 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 873 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 874 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 875 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 876 \tikzstyle{C} = [color=black, line width=1pt] 877 878 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 879 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 880 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 881 \end{tikzpicture} 882 \end{minipage} 883 \end{frame} 884 885 886 \begin{frame}{Customer: Unblind coin (RSA)} 887 \begin{minipage}{6cm} 888 \begin{enumerate} 889 \item Receive $s'$. 890 \item Compute $s := s' b^{-1} \mod n$ % \\ 891 % ($(f')^d = (f b^e)^d = f^d b$). 892 \end{enumerate} 893 \end{minipage} 894 \begin{minipage}{6cm} 895 \begin{tikzpicture} 896 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 897 \node (b) [def, draw=none] at (0,0) {$b$}; 898 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 899 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 900 \tikzstyle{C} = [color=black, line width=1pt] 901 902 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 903 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 904 \end{tikzpicture} 905 \end{minipage} 906 \end{frame} 907 908 \begin{frame}{Withdrawing coins on the Web} 909 \begin{center} 910 \includegraphics[height=0.9\textheight]{figs/taler-withdraw.pdf} 911 \end{center} 912 \end{frame} 913 914 915 \begin{frame}{Customer: Build shopping cart} 916 \begin{center} 917 \begin{tikzpicture} 918 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 919 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 920 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 921 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 922 \tikzstyle{C} = [color=black, line width=1pt]; 923 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 924 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 925 \end{tikzpicture} 926 \end{center} 927 \end{frame} 928 929 930 \begin{frame}{Merchant Integration: Wallet Detection} 931 \lstset{language=JavaScript} 932 \lstinputlisting{figs/taler-presence-js.html} 933 % \caption{Sample code to detect the Taler wallet. Allowing the 934 % Web site to detect the presence of the wallet leaks one bit 935 % of information about the user. The above logic also works 936 % if the wallet is installed while the page is open.} 937 % \label{listing:presence} 938 \end{frame} 939 940 941 \begin{frame}{Merchant Integration: Payment Request} 942 % \begin{figure}[p!] 943 \lstset{language=HTML5} 944 \lstinputlisting{figs/taler-402.html} 945 % \caption{Sample HTTP response to prompt the wallet to show an offer.} 946 % \label{listing:http-contract} 947 % \end{figure} 948 949 % \begin{figure*}[p!] 950 % \lstset{language=HTML5} 951 % \lstinputlisting{figs/taler-contract.html} 952 % \caption{Sample JavaScript code to prompt the wallet to show an offer. 953 % Here, the contract is fetched on-demand from the server. 954 % The {\tt taler\_pay()} function needs to be invoked 955 % when the user triggers the checkout.} 956 % \label{listing:contract} 957 % \end{figure*} 958 \end{frame} 959 960 961 \begin{frame}{Merchant Integration: Contract} 962 % \begin{figure*}[t!] 963 {\tiny 964 \lstset{language=JavaScript} 965 \lstinputlisting{figs/taler-contract.json} 966 % \caption{Minimal Taler contract over a digital article with a value of \EUR{0.10}. The merchant will pay transaction fees up to \EUR{0.01}. The hash over the wire transfer information was truncated to make it fit to the page.} 967 % \label{listing:json-contract} 968 % \end{figure*} 969 } 970 \end{frame} 971 972 973 \begin{frame}{Merchant: Propose contract (EdDSA)} 974 \begin{minipage}{6cm} 975 \begin{enumerate} 976 \item Complete proposal $D$. 977 \item Send $D$, $EdDSA_m(D)$ 978 \end{enumerate} 979 \end{minipage} 980 \begin{minipage}{6cm} 981 \begin{tikzpicture} 982 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 983 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 984 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 985 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 986 \tikzstyle{C} = [color=black, line width=1pt]; 987 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 988 \tikzstyle{C} = [color=black, line width=1pt] 989 990 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 991 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 992 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 993 \end{tikzpicture} 994 \end{minipage} 995 \end{frame} 996 997 998 \begin{frame}{Customer: Spend coin (EdDSA)} 999 \begin{minipage}{6cm} 1000 \begin{enumerate} 1001 \item Receive proposal $D$, $EdDSA_m(D)$. 1002 \item Send $s$, $C$, $EdDSA_c(D)$ 1003 \end{enumerate} 1004 \end{minipage} 1005 \begin{minipage}{6cm} 1006 \begin{tikzpicture} 1007 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 1008 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 1009 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 1010 \node (c) [def, draw=none, above=of contract] {$c$}; 1011 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 1012 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1013 \tikzstyle{C} = [color=black, line width=1pt] 1014 1015 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 1016 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 1017 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1018 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 1019 \end{tikzpicture} 1020 \end{minipage} 1021 \end{frame} 1022 1023 1024 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 1025 \begin{minipage}{6cm} 1026 \begin{equation*} 1027 s^e \stackrel{?}{\equiv} FDH(C) \mod n 1028 \end{equation*} 1029 \end{minipage} 1030 \begin{minipage}{6cm} 1031 \begin{minipage}{0.2\textwidth} 1032 \includegraphics[width=\textwidth]{coin.pdf} 1033 \end{minipage} 1034 $\stackrel{?}{\Leftrightarrow}$ 1035 \begin{minipage}{0.2\textwidth} 1036 \includegraphics[width=\textwidth]{seal.pdf} 1037 \end{minipage} 1038 \end{minipage} 1039 \end{frame} 1040 1041 1042 \begin{frame}{Payment processing with Taler} 1043 \begin{center} 1044 \includegraphics[height=0.9\textheight]{figs/taler-pay.pdf} 1045 \end{center} 1046 \end{frame} 1047 1048 1049 \begin{frame}{Giving change} 1050 It would be inefficient to pay EUR 100 with 1 cent coins! 1051 \begin{itemize} 1052 \item Denomination key represents value of a coin. 1053 \item Exchange may offer various denominations for coins. 1054 \item Wallet may not have exact change! 1055 \item Usability requires ability to pay given sufficient total funds. 1056 \end{itemize}\pause 1057 Key goals: 1058 \begin{itemize} 1059 \item maintain unlinkability 1060 \item maintain taxability of transactions 1061 \end{itemize}\pause 1062 Method: 1063 \begin{itemize} 1064 \item Contract can specify to only pay {\em partial value} of a coin. 1065 \item Exchange allows wallet to obtain {\em unlinkable change} 1066 for remaining coin value. 1067 \end{itemize} 1068 \end{frame} 1069 1070 1071 \begin{frame}{Diffie-Hellman (ECDH)} 1072 \begin{minipage}{8cm} 1073 \begin{enumerate} 1074 \item Create private keys $c,t \mod o$ 1075 \item Define $C = cG$ 1076 \item Define $T = tG$ 1077 \item Compute DH \\ $cT = c(tG) = t(cG) = tC$ 1078 \end{enumerate} 1079 \end{minipage} 1080 \begin{minipage}{6cm} 1081 \begin{tikzpicture} 1082 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1083 \node (t) [def, draw=none] at (0,0) {$t$}; 1084 \node (ct) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{dh.pdf}}; 1085 \node (c) [def, draw=none, above left= of ct] {$c$}; 1086 \tikzstyle{C} = [color=black, line width=1pt] 1087 1088 \draw [<-, C] (ct) -- (c) node [midway, above, sloped] (TextNode) {}; 1089 \draw [<-, C] (ct) -- (t) node [midway, above, sloped] (TextNode) {}; 1090 \end{tikzpicture} 1091 \end{minipage} 1092 \end{frame} 1093 1094 1095 \begin{frame}{Strawman solution} 1096 \begin{minipage}{8cm} 1097 Given partially spent private coin key $c_{old}$: 1098 \begin{enumerate} 1099 % \item Let $C_{old} := c_{old}G$ (as before) 1100 \item Pick random $c_{new} \mod o$ private key 1101 \item $C_{new} = c_{new}G$ public key 1102 \item Pick random $b_{new}$ 1103 \item Compute $f_{new} := FDH(C_{new})$, $m < n$. 1104 \item Transmit $f'_{new} := f_{new} b_{new}^e \mod n$ 1105 \end{enumerate} 1106 ... and sign request for change with $c_{old}$. 1107 \end{minipage} 1108 \begin{minipage}{4cm} 1109 \begin{tikzpicture} 1110 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1111 \node (blinded) [def, draw=none]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1112 \node (planchet) [def, draw=none, above left= of blinded] {\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 1113 \node (cnew) [def, draw=none, above= of planchet] {$c_{new}$}; 1114 \node (bnew) [def, draw=none, above right= of blinded] {$b_{new}$}; 1115 \node (dice1) [def, draw=none, above = of cnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1116 \node (dice2) [def, draw=none, above = of bnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1117 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1118 1119 \tikzstyle{C} = [color=black, line width=1pt] 1120 1121 \draw [<-, C] (cnew) -- (dice1) node [midway, above, sloped] (TextNode) {}; 1122 \draw [<-, C] (planchet) -- (cnew) node [midway, above, sloped] (TextNode) {}; 1123 \draw [<-, C] (bnew) -- (dice2) node [midway, above, sloped] (TextNode) {}; 1124 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 1125 \draw [<-, C] (blinded) -- (bnew) node [midway, above, sloped] (TextNode) {}; 1126 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1127 \end{tikzpicture} 1128 \end{minipage} 1129 \pause 1130 \vfill 1131 {\bf Problem: Owner of $c_{new}$ may differ from owner of $c_{old}$!} 1132 \end{frame} 1133 1134 1135 \begin{frame}{Customer: Transfer key setup (ECDH)} 1136 \begin{minipage}{8cm} 1137 Given partially spent private coin key $c_{old}$: 1138 \begin{enumerate} 1139 \item Let $C_{old} := c_{old}G$ (as before) 1140 \item Create random private transfer key $t \mod o$ 1141 \item Compute $T := tG$ 1142 \item Compute $X := c_{old}(tG) = t(c_{old}G) = tC_{old}$ 1143 \item Derive $c_{new}$ and $b_{new}$ from $X$ 1144 \item Compute $C_{new} := c_{new}G$ 1145 \item Compute $f_{new} := FDH(C_{new})$ 1146 \item Transmit $f_{new}' := f_{new} b_{new}^e$ 1147 \end{enumerate} 1148 \end{minipage} 1149 \begin{minipage}{4cm} 1150 \begin{tikzpicture} 1151 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1152 \node (t) [def, draw=none] at (0,0) {$t$}; 1153 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1154 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1155 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1156 \node (cp) [def, draw=none, below left= of dh] {$c_{new}$}; 1157 \node (bp) [def, draw=none, below right= of dh] {$b_{new}$}; 1158 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1159 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1160 1161 \tikzstyle{C} = [color=black, line width=1pt] 1162 1163 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1164 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1165 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1166 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1167 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1168 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1169 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1170 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1171 \end{tikzpicture} 1172 \end{minipage} 1173 \end{frame} 1174 1175 1176 \begin{frame}{Cut-and-Choose} 1177 \begin{minipage}{4cm} 1178 \begin{tikzpicture} 1179 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1180 \node (t) [def, draw=none] at (0,0) {$t_1$}; 1181 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1182 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1183 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1184 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1185 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1186 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1187 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1188 1189 \tikzstyle{C} = [color=black, line width=1pt] 1190 1191 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1192 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1193 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1194 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1195 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1196 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1197 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1198 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1199 \end{tikzpicture} 1200 \end{minipage} 1201 \begin{minipage}{4cm} 1202 \begin{tikzpicture} 1203 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1204 \node (t) [def, draw=none] at (0,0) {$t_2$}; 1205 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1206 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1207 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1208 \node (cp) [def, draw=none, below left= of dh] {$c_{new,2}$}; 1209 \node (bp) [def, draw=none, below right= of dh] {$b_{new,2}$}; 1210 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1211 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1212 1213 \tikzstyle{C} = [color=black, line width=1pt] 1214 1215 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1216 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1217 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1218 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1219 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1220 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1221 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1222 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1223 \end{tikzpicture} 1224 \end{minipage} 1225 \begin{minipage}{4cm} 1226 \begin{tikzpicture} 1227 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1228 \node (t) [def, draw=none] at (0,0) {$t_3$}; 1229 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1230 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1231 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1232 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1233 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1234 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1235 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1236 1237 \tikzstyle{C} = [color=black, line width=1pt] 1238 1239 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1240 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1241 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1242 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1243 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1244 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1245 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1246 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1247 \end{tikzpicture} 1248 \end{minipage} 1249 \end{frame} 1250 1251 1252 \begin{frame}{Exchange: Choose!} 1253 \begin{center} 1254 \item Exchange sends back random $\gamma \in \{ 1, 2, 3 \}$ to the customer. 1255 \end{center} 1256 \end{frame} 1257 1258 1259 \begin{frame}{Customer: Reveal} 1260 \begin{enumerate} 1261 \item If $\gamma = 1$, send $t_2$, $t_3$ to exchange 1262 \item If $\gamma = 2$, send $t_1$, $t_3$ to exchange 1263 \item If $\gamma = 3$, send $t_1$, $t_2$ to exchange 1264 \end{enumerate} 1265 \end{frame} 1266 1267 1268 \begin{frame}{Exchange: Verify ($\gamma = 2$)} 1269 \begin{minipage}{4cm} 1270 \begin{tikzpicture} 1271 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1272 \node (h) [def, draw=none] at (0,0) {$t_1$}; 1273 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1274 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1275 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1276 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1277 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1278 1279 \tikzstyle{C} = [color=black, line width=1pt] 1280 1281 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1282 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1283 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1284 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1285 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1286 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1287 \end{tikzpicture} 1288 \end{minipage} 1289 \begin{minipage}{4cm} 1290 \ 1291 \end{minipage} 1292 \begin{minipage}{4cm} 1293 \begin{tikzpicture} 1294 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1295 \node (h) [def, draw=none] at (0,0) {$t_3$}; 1296 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1297 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1298 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1299 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1300 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1301 1302 \tikzstyle{C} = [color=black, line width=1pt] 1303 1304 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1305 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1306 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1307 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1308 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1309 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1310 \end{tikzpicture} 1311 \end{minipage} 1312 \end{frame} 1313 1314 1315 \begin{frame}{Exchange: Blind sign change (RSA)} 1316 \begin{minipage}{6cm} 1317 \begin{enumerate} 1318 \item Take $f_{new,\gamma}'$. 1319 \item Compute $s' := f_{new,\gamma}'^d \mod n$. 1320 \item Send signature $s'$. 1321 \end{enumerate} 1322 \end{minipage} 1323 \begin{minipage}{6cm} 1324 \begin{tikzpicture} 1325 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1326 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 1327 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 1328 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1329 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 1330 \tikzstyle{C} = [color=black, line width=1pt] 1331 1332 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 1333 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 1334 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1335 \end{tikzpicture} 1336 \end{minipage} 1337 \end{frame} 1338 1339 1340 \begin{frame}{Customer: Unblind change (RSA)} 1341 \begin{minipage}{6cm} 1342 \begin{enumerate} 1343 \item Receive $s'$. 1344 \item Compute $s := s' b_{new,\gamma}^{-1} \mod n$. 1345 \end{enumerate} 1346 \end{minipage} 1347 \begin{minipage}{6cm} 1348 \begin{tikzpicture} 1349 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1350 \node (b) [def, draw=none] at (0,0) {$b_{new,\gamma}$}; 1351 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1352 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1353 \tikzstyle{C} = [color=black, line width=1pt] 1354 1355 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 1356 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1357 \end{tikzpicture} 1358 \end{minipage} 1359 \end{frame} 1360 1361 1362 \begin{frame}{Exchange: Allow linking change} 1363 \begin{minipage}{7cm} 1364 \begin{center} 1365 Given $C_{old}$ 1366 1367 \vspace{1cm} 1368 1369 return $T_\gamma$, $s := s' b_{new,\gamma}^{-1} \mod n$. 1370 \end{center} 1371 \end{minipage} 1372 \begin{minipage}{5cm} 1373 \begin{tikzpicture} 1374 \tikzstyle{def} = [node distance= 3em and 0.5em, inner sep=0.5em, outer sep=.3em]; 1375 \node (co) [def, draw=none] at (0,0) {$C_{old}$}; 1376 \node (T) [def, draw=none, below left=of co]{$T_\gamma$}; 1377 \node (sign) [def, draw=none, below right=of co]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1378 \node (customer) [def, draw, below right=of T] {Customer}; 1379 1380 \tikzstyle{C} = [color=black, line width=1pt] 1381 1382 \draw [<-, C] (T) -- (co) node [midway, above, sloped] (TextNode) {}; 1383 \draw [<-, C] (sign) -- (co) node [midway, above, sloped] (TextNode) {}; 1384 \draw [<-, C] (customer) -- (T) node [midway, above, sloped] (TextNode) {link}; 1385 \draw [<-, C] (customer) -- (sign) node [midway, above, sloped] (TextNode) {link}; 1386 \end{tikzpicture} 1387 \end{minipage} 1388 \end{frame} 1389 1390 1391 \begin{frame}{Customer: Link (threat!)} 1392 \begin{minipage}{6.3cm} 1393 \begin{enumerate} 1394 \item Have $c_{old}$. 1395 \item Obtain $T_\gamma$, $s$ from exchange 1396 \item Compute $X_\gamma = c_{old}T_\gamma$ 1397 \item Derive $c_{new,\gamma}$ and $b_{new,\gamma}$ from $X_\gamma$ 1398 \item Unblind $s := s' b_{new,\gamma}^{-1} \mod n$ 1399 \end{enumerate} 1400 1401 \end{minipage} 1402 \begin{minipage}{5.7cm} 1403 \begin{tikzpicture} 1404 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1405 \node (T) [def, draw=none] at (0,0) {$T_\gamma$}; 1406 \node (exchange) [def, inner sep=0.5em, draw, above left=of T] {Exchange}; 1407 \node (signed) [def, draw=none, below left=of T]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1408 \node (dh) [def, draw=none, below right=of T]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1409 \node (bp) [def, draw=none, below left= of dh] {$b_{new,\gamma}$}; 1410 \node (co) [def, draw=none, above right= of dh] {$c_{old}$}; 1411 \node (cp) [def, draw=none, below= of dh] {$c_{new,\gamma}$}; 1412 \node (coin) [def, draw=none, below left = of bp]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1413 \node (psign) [def, node distance=2.5em and 0em, draw=none, below = of cp]{\includegraphics[width=0.2\textwidth]{planchet-sign.pdf}}; 1414 1415 \tikzstyle{C} = [color=black, line width=1pt] 1416 1417 \draw [<-, C] (dh) -- (co) node [midway, above, sloped] (TextNode) {}; 1418 \draw [<-, C] (dh) -- (T) node [midway, above, sloped] (TextNode) {}; 1419 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1420 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1421 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1422 \draw [<-, C] (coin) -- (bp) node [midway, above, sloped] (TextNode) {}; 1423 \draw [<-, C] (T) -- (exchange) node [midway, above, sloped] (TextNode) {link}; 1424 \draw [<-, C] (signed) -- (exchange) node [midway, below, sloped] (TextNode) {link}; 1425 \draw [<-, C, double] (psign) -- (cp) node [midway, below, sloped] (TextNode) {}; 1426 \end{tikzpicture} 1427 \end{minipage} 1428 \end{frame} 1429 1430 1431 \begin{frame}{Refresh protocol summary} 1432 \begin{itemize} 1433 \item Customer asks exchange to convert old coin to new coin 1434 \item Protocol ensures new coins can be recovered from old coin 1435 \item[$\Rightarrow$] New coins are owned by the same entity! 1436 \end{itemize} 1437 Thus, the refresh protocol allows: 1438 \begin{itemize} 1439 \item To give unlinkable change. 1440 \item To give refunds to an anonymous customer. 1441 \item To expire old keys and migrate coins to new ones. 1442 \item To handle protocol aborts. 1443 \end{itemize} 1444 \noindent 1445 \begin{center} 1446 \bf 1447 Transactions via refresh are equivalent to {\em sharing} a wallet. 1448 \end{center} 1449 \end{frame} 1450 1451 1452 \end{document}