dg-fisma-2026-alt.tex (20389B)
1 \documentclass[aspectratio=169,t]{beamer} 2 \input taler-macros 3 \usepackage{eurosym} 4 \usepackage{array} 5 6 \newcommand{\TITLE}{NEXT \\ GENERATION \\ INTERNET} 7 \newcommand{\SUB}{GNU Taler: technology and results} 8 \newcommand{\AUTHOR}{Tanja Lange, Christian Grothoff, Leon Schumacher} 9 \newcommand{\SPEAKER}{Lange, Grothoff, Schumacher} 10 \newcommand{\INST}{NGI TALER} 11 \newcommand{\DATE}{\\ \ \vspace{0.5cm} \\ October 20\textsuperscript{th} 2026} 12 13 % Do not edit this part 14 \title{\TITLE} 15 \subtitle{\SUB} 16 \date{\DATE} 17 \author[\SPEAKER]{\AUTHOR} 18 \institute{\INST} 19 20 \begin{document} 21 22 \begin{frame}[plain] 23 \maketitle 24 \end{frame} 25 26 27 % ---------------------------------------------------------------------- 28 \begin{frame}{What GNU Taler is} 29 \begin{minipage}{0.47\textwidth} 30 {\bf It is} 31 \begin{itemize} 32 \item Free software payment {\bf infrastructure}: wallets, merchant 33 backends, bank integrations 34 \item {\bf Digital cash} --- bearer tokens in an existing currency, 35 issued against a bank debit 36 \item A design where the {\bf payer is unlinkable} and the 37 {\bf payee is identified} 38 \end{itemize} 39 \end{minipage} 40 \hfill 41 \begin{minipage}{0.47\textwidth} 42 {\bf It is not} 43 \begin{itemize} 44 \item A currency, an asset, a store of value 45 \item A blockchain: no mining, no ledger, no consensus 46 \item Decentralised issuance --- that stays with a regulated 47 institution 48 \item One network: anyone may run an instance 49 \end{itemize} 50 \end{minipage} 51 52 \vfill 53 \begin{center} 54 {\small In development since 2015. A GNU package, licensed AGPL/GPL/LGPL.} 55 \end{center} 56 \end{frame} 57 58 59 % ---------------------------------------------------------------------- 60 \begin{frame}{Three operations, and that is all} 61 \begin{enumerate} 62 \item {\bf Withdraw.} The wallet asks a regulated operator --- the 63 {\em exchange} --- for coins. The customer's account is debited, and 64 the operator signs coins it {\bf cannot recognise later}. 65 \item {\bf Pay.} The wallet spends coins directly with the merchant. No 66 account, no login, nothing reusable is disclosed. 67 \item {\bf Deposit.} The merchant deposits the coins with the exchange, 68 which detects any double-spend and credits the merchant's account. 69 \end{enumerate} 70 \vfill 71 \begin{center} 72 Double-spending is detected by the {\bf exchange}, not by the merchant 73 --- so the merchant never has to be trusted. 74 \end{center} 75 \end{frame} 76 77 78 % ---------------------------------------------------------------------- 79 \begin{frame}{Architecture} 80 \begin{center} 81 \includegraphics[height=5.6cm]{images/operations.png} 82 \end{center} 83 \end{frame} 84 85 86 % ---------------------------------------------------------------------- 87 \begin{frame}{The engine: blind signatures and refresh} 88 \begin{itemize} 89 \item {\bf Withdraw.} The wallet blinds a fresh coin key; the operator 90 signs it with a {\em denomination key} encoding the value. It sees the 91 account, never the coin. 92 \item {\bf Spend.} The wallet signs the contract with the coin key. The 93 merchant checks the operator's signature locally, in microseconds. 94 \item {\bf Change.} A partly spent coin is {\bf refreshed} into new 95 coins. The operator verifies that value is conserved and cannot link 96 new to old --- but the owner can, so change cannot move value 97 anonymously. 98 \end{itemize} 99 \vfill 100 \begin{center} 101 {\bf The operator verifies everything and links nothing.}\\[2pt] 102 {\small Every feature in this deck is built from that one property.} 103 \end{center} 104 \end{frame} 105 106 107 % ---------------------------------------------------------------------- 108 \begin{frame}{Asymmetric privacy} 109 \begin{minipage}{0.47\textwidth} 110 {\bf Payer} 111 \begin{itemize} 112 \item Unlinkable by construction 113 \item No identity in the payment 114 \item Carries nobody else's data 115 \end{itemize} 116 \end{minipage} 117 \hfill 118 \begin{minipage}{0.47\textwidth} 119 {\bf Payee} 120 \begin{itemize} 121 \item Always identified 122 \item Every receipt attributable 123 \item Income auditable and taxable 124 \end{itemize} 125 \end{minipage} 126 127 \vfill 128 KYC/AML applies where it works: at {\bf withdrawal} and {\bf deposit}, 129 inside the regulated perimeter. Anonymity is {\bf one-sided}: there is no 130 anonymous \emph{recipient}, so the laundering direction is closed. 131 \vfill 132 \begin{center} 133 {\small Cash protects the payer \emph{and} hides the merchant. This 134 protects the payer and {\bf exposes} the merchant --- which is also 135 welfare-optimal (Tinn, \emph{Management Science}, 2025).} 136 \end{center} 137 \end{frame} 138 139 140 % ---------------------------------------------------------------------- 141 \begin{frame}{Who gets what out of it} 142 \small 143 \begin{itemize} 144 \item {\bf Customer.} Purchase behaviour is private. No account, no 145 login, no sign-up --- so children, tourists and the unbanked are not 146 excluded by onboarding. Payment settles instantly, by QR code or NFC, 147 and is never rejected as suspected fraud. 148 \item {\bf Merchant.} No card data and no buyer information: GDPR and 149 PCI-DSS obligations largely fall away rather than being managed. No 150 chargeback fraud, and costs low enough for small vendors and for 151 micropayments. 152 \item {\bf Public authority.} Privacy is a property of the protocol, so 153 no operator can be compelled to run mass surveillance. Payees must 154 report income to receive it. Issuance, limits, fees and revocation 155 stay with the issuer. 156 \end{itemize} 157 \vfill 158 \begin{center} 159 {\small To note: lose the wallet and you lose the money, as with cash 160 --- but a {\bf thief gains nothing} from a stolen one.} 161 \end{center} 162 \end{frame} 163 164 165 % ---------------------------------------------------------------------- 166 \begin{frame}{One primitive, many products} 167 \framesubtitle{Change what the token certifies} 168 \footnotesize 169 \renewcommand{\arraystretch}{1.45} 170 \begin{center} 171 \begin{tabular}{@{}>{\raggedright\arraybackslash}p{5.2cm}@{\quad}>{\raggedright\arraybackslash}p{7.4cm}@{}} 172 {\bf The token certifies \dots} & {\bf \dots and you have} \\ 173 \hline 174 a value, in euro or franc & digital cash --- the base case \\ 175 a value, and an age bound & age-restricted purchase, without identity \\ 176 a right to use one merchant & unlinkable subscriptions and discounts \\ 177 an amount given to a charity & a tax-deductible donation receipt (Donau) \\ 178 a single HTTP request & pay-per-use web and agent access (Paivana) \\ 179 a value, shown without text & a wallet usable without reading or counting \\ 180 \end{tabular} 181 \end{center} 182 \vfill 183 \begin{center} 184 {\small Each one is the {\bf same protocol} with a different claim inside 185 the blind signature. None needs a new network.} 186 \end{center} 187 \end{frame} 188 189 190 % ---------------------------------------------------------------------- 191 \begin{frame}{Age restriction without identity} 192 \framesubtitle{ESORICS 2022 --- implemented and shipped} 193 \small 194 \begin{itemize} 195 \item A guardian withdraws coins {\bf committed to an age group}. 196 Restricting to group $m$ means {\bf withholding the private keys 197 above $m$}; the commitment is signed into the coin. 198 \item The minor proves ``at least $k$'' for any $k \le m$ by signing 199 with that key. The keys above $m$ cannot be derived. 200 \item The coin does not reveal that it is restricted, or to what. The 201 merchant learns {\bf one bit} --- not a birthdate, a document number 202 or a card. 203 \item The restriction {\bf survives change}: a cut-and-choose proof at 204 refresh leaves a cheating wallet a $1/\kappa$ chance. 205 \end{itemize} 206 \vfill 207 \begin{center} 208 {\small The restriction is tied to the {\bf ability to pay}, not to an 209 identity document --- so no attribute broker and no register of 210 minors. What is missing is {\bf legal recognition} of a cryptographic 211 attestation in place of an ID check.} 212 \end{center} 213 \end{frame} 214 215 216 % ---------------------------------------------------------------------- 217 \begin{frame}{Subscriptions and discounts, unlinkably} 218 \small 219 \begin{itemize} 220 \item A merchant defines a {\bf token family}. A contract may 221 {\bf require} tokens and {\bf issue} them: pay once and receive twelve 222 monthly access tokens; buy ten coffees and receive one free. 223 \item The wallet blinds a fresh key per token and the merchant 224 {\bf blind-signs} it, so at redemption the merchant {\bf cannot link 225 the use to the purchase that issued it}. Re-use is caught by a 226 {\bf spent-token registry}, not by identifying the holder. 227 \item Each token is one use: a year's subscription is twelve tokens. 228 \item {\bf Token fountains} hand promotional tokens to a whole group --- 229 a university to its students --- with no order, account or name per 230 recipient. 231 \end{itemize} 232 \vfill 233 \begin{center} 234 {\small Only the wallet and the merchant are involved --- no exchange, 235 no bank, no card scheme. Merged in the merchant backend and in the 236 published protocol; the wallet interface is still in progress.} 237 \end{center} 238 \end{frame} 239 240 241 % ---------------------------------------------------------------------- 242 \begin{frame}{Donau: private, deductible donations} 243 \small 244 \begin{itemize} 245 \item A donation today is either {\bf traceable and deductible}, or 246 {\bf private and not deductible}. 247 \item A {\bf Donation Authority}, run by or for the tax authority, 248 registers charities and their annual limits. The wallet collects 249 blind-signed receipts; the charity forwards blinded values it 250 {\bf cannot read}, and never learns who gave. 251 \item At year end the wallet exchanges them for {\bf one signed 252 statement} --- hashed donor identifier, total, year --- which goes 253 into the tax return as a QR code. 254 \item The authority learns what a donor gave {\bf in total} and what a 255 charity received {\bf in total}, never which donation was which, and 256 never the tax identifier itself. 257 \end{itemize} 258 \vfill 259 \begin{center} 260 {\small Auditable throughout: per-charity volume caps are enforced at 261 issuance. Implemented and packaged, merchant integration merged --- 262 but no tax authority operates one yet.} 263 \end{center} 264 \end{frame} 265 266 267 % ---------------------------------------------------------------------- 268 \begin{frame}{Paivana: paying per page, or as an agent} 269 \small 270 \begin{itemize} 271 \item The web has two working business models: {\bf subscription} and 272 {\bf surveillance advertising}. Micropayments failed because every 273 payment needed an account, and processing cost more than the article. 274 \item {\bf Paivana} is a reverse proxy placed in front of an existing 275 site. Prices are set per URL pattern, the site is not modified, and 276 the visitor pays for a {\bf time-bounded access token} --- no account, 277 no subscription, no registration. 278 \item The paywall response carries the price in a {\bf machine-readable 279 header}, so an AI agent can {\bf pay} for what it fetches, under a 280 budget its owner set, rather than scrape it. 281 \end{itemize} 282 \vfill 283 \begin{center} 284 A publisher is paid per read and learns nothing about the reader --- 285 and a crawler can be {\bf asked for money} instead of being blocked. 286 \end{center} 287 \end{frame} 288 289 290 % ---------------------------------------------------------------------- 291 \begin{frame}{Users who cannot read the amount} 292 \framesubtitle{Joint work with MyOralVillage} 293 \begin{minipage}{0.40\textwidth} 294 \begin{center} 295 \includegraphics[width=\textwidth]{images/taler-oim.png} 296 \end{center} 297 \end{minipage} 298 \hfill 299 \begin{minipage}{0.56\textwidth} 300 {\small 301 \begin{itemize} 302 \item Amounts are shown as {\bf countable denominations}, not 303 digits; every task is {\bf correctable}. 304 \item Freetown, 2025: {\bf 21} women, 6 languages. Only 4 had 305 finished primary school; only 6 could read a five-digit number. 306 \item After a 24-hour gap, 8 payment tasks, unaided: {\bf 16} 307 completed all 8 with no errors, {\bf 4} with retries and no help, 308 1 did not complete. 309 \end{itemize} 310 } 311 \end{minipage} 312 313 \vfill 314 \begin{center} 315 {\small A payment instrument that assumes numeracy excludes the people 316 who need it most. The {\bf same wallet} serves both.} 317 \end{center} 318 \end{frame} 319 320 321 % ---------------------------------------------------------------------- 322 \begin{frame}{Offline: what works, and what cannot} 323 \begin{itemize} 324 \item {\bf Deployed:} the {\bf merchant} offline, the customer online. 325 The terminal shows an identifier, the wallet pays over its own 326 connection, and a one-time code proves settlement to the terminal. 327 Vending machines and unattended points of sale. 328 \item {\bf Unsolved, by anyone:} both sides offline with a bearer 329 balance. Offline double-spending can be {\bf punished}, never 330 {\bf prevented}. 331 \item That leaves two options: trust tamper-resistant hardware 332 {\bf against its own owner}, or {\bf de-anonymise retroactively}. 333 There is no third. 334 \end{itemize} 335 \vfill 336 \begin{center} 337 {\small We do the other half of this work too: breaking the secure 338 elements such designs rely on, by side channel and fault injection.} 339 \end{center} 340 \end{frame} 341 342 343 % ---------------------------------------------------------------------- 344 \begin{frame}{Losing the phone} 345 \framesubtitle{GNU Anastasis} 346 \begin{itemize} 347 \item {\bf Anastasis} encrypts the wallet's root secret under a master 348 key and {\bf splits that key across independent escrow providers}. 349 \item The user sets the policy: which subsets must be satisfied, and by 350 which challenges --- a security question, an SMS, a video 351 identification, a transfer from a known account. 352 \item {\bf No single provider} can recover the key, and none learns what 353 it protects. Recovery works {\bf without} the user remembering 354 anything of high entropy. 355 \end{itemize} 356 \vfill 357 \begin{center} 358 Consumer protection by {\bf splitting trust}, rather than by 359 concentrating it in a custodian.\\[2pt] 360 {\small Implemented: provider backend, client libraries, command line 361 and graphical application.} 362 \end{center} 363 \end{frame} 364 365 366 % ---------------------------------------------------------------------- 367 \begin{frame}{Post-quantum: where we actually are} 368 \footnotesize 369 \begin{itemize} 370 \item Taler's public-key layer is {\bf entirely} factoring- and 371 discrete-logarithm-based --- ``very susceptible to attacks with a 372 quantum computer'', in our own analysis's words. 373 \item {\bf Two different clocks.} Forging coins needs a quantum computer 374 {\em at the time of the attack}. Unlinkability does not: refresh uses 375 Diffie--Hellman, so whoever obtains the operator's database later can 376 link refreshed coins {\bf retroactively}. That damage accrues today. 377 \item The obstacle is specific: refresh needs {\bf one key usable both 378 for signing and for key exchange}, and no proposed post-quantum 379 signature scheme has that property. 380 \item {\bf Ready in theory, not in implementation.} The running code is 381 pre-quantum, and no post-quantum blind signature is deployment-ready 382 --- the round-efficient candidate costs some {\bf 22\,kB} per 383 signature against 256 bytes today. Call it 18--24 months. 384 \end{itemize} 385 \end{frame} 386 387 388 % ---------------------------------------------------------------------- 389 \begin{frame}{Where it runs, and what is built} 390 \footnotesize 391 \begin{minipage}{0.48\textwidth} 392 {\bf Deployed} 393 \begin{itemize} 394 \item eNetzbon, the Basel regional currency, since 2024 395 \item eCHF from Taler Operations AG since 2025, under the Swiss 396 {\bf sandbox exemption}: {\bf not} FINMA-supervised, deposits 397 capped at CHF\,1\,m, anti-money-laundering through a recognised 398 self-regulatory body 399 \item First merchants accepting it since January 2026 400 \item Magnet Bank, Hungary: {\bf internal alpha}, no launch date 401 announced 402 \end{itemize} 403 \end{minipage} 404 \hfill 405 \begin{minipage}{0.48\textwidth} 406 {\bf Built} 407 \begin{itemize} 408 \item {\bf 28{,}500} payments per second, measured end to end on a 409 research cluster at reduced key sizes --- Switzerland's entire 410 retail volume is around 2{,}000 per second 411 \item EBICS and ISO\,20022 connectivity tested with five Swiss and 412 German banks; native adapters for Magnet Bank and Cyclos 413 \item Wallets for Android, iOS and the browser 414 \end{itemize} 415 \end{minipage} 416 417 \vfill 418 \begin{center} 419 {\footnotesize An integration means a Taler operator can {\bf bank 420 there}, not that the bank offers Taler. Two live deployments, both 421 Swiss; none yet in the euro area.} 422 \end{center} 423 \end{frame} 424 425 426 % ---------------------------------------------------------------------- 427 \begin{frame}{Roadmap and open problems} 428 \small 429 \begin{minipage}{0.47\textwidth} 430 {\bf In progress} 431 \begin{itemize} 432 \item Currency conversion via Interledger 433 \item Terminals, vending, doors, one-time-password hardware 434 \item Wallet recovery with Anastasis 435 \item KYC via national e-ID across Europe 436 \item Post-quantum protocol variant 437 \end{itemize} 438 \end{minipage} 439 \hfill 440 \begin{minipage}{0.47\textwidth} 441 {\bf Unsolved} 442 \begin{itemize} 443 \item Both parties offline with a bearer balance 444 \item Direct debit and pull payments 445 \item Practical post-quantum blind signatures 446 \item No euro-area deployment yet 447 \end{itemize} 448 \end{minipage} 449 \end{frame} 450 451 452 % ---------------------------------------------------------------------- 453 \begin{frame}{Where this touches your files} 454 \small 455 \begin{itemize} 456 \item {\bf Digital euro.} A design in which privacy is a property of the 457 protocol, not a restriction on who may query a database. We have a 458 second deck on that if you would rather have it. 459 \item {\bf Retail payments.} Instant clearance at par, no interchange to 460 divide, no payer credential for a merchant to lose. 461 \item {\bf Anti-money-laundering.} Anonymity on one side only. Every 462 euro enters and leaves through a regulated institution. 463 \item {\bf Age assurance.} A proof of ``at least 16'' that discloses 464 nothing else --- already implemented, pending legal recognition. 465 \item {\bf Data protection and sovereignty.} Data that is never created 466 cannot be breached or transferred; free software, published 467 specification, no single operator. 468 \end{itemize} 469 \end{frame} 470 471 472 % ---------------------------------------------------------------------- 473 \begin{frame}{Summary} 474 \begin{itemize} 475 \item One property --- {\bf the operator verifies everything and links 476 nothing} --- and every feature here falls out of it. 477 \item Privacy for the payer, identification of the payee: taxable, 478 auditable, and not a laundering instrument. 479 \item Age proofs, subscriptions, discounts, donation receipts, 480 pay-per-request web access, recovery after device loss: the 481 {\bf same protocol}, a different claim inside the signature. 482 \item Free software and a published specification, in production in 483 Switzerland --- and not yet in the euro area. 484 \end{itemize} 485 \end{frame} 486 487 488 % ---------------------------------------------------------------------- 489 \begin{frame}{Acknowledgements} 490 491 \begin{minipage}{0.45\textwidth} \ \\ 492 {\tiny Funded by the European Union (Project 101135475).} 493 494 \begin{center} 495 \includegraphics[width=0.5\textwidth]{images/bandera.jpg} 496 \end{center} 497 \end{minipage} 498 \hfill 499 \begin{minipage}{0.45\textwidth} 500 {\tiny Funded by SERI (HEU-Projekt 101135475-TALER).} 501 502 \begin{center} 503 \includegraphics[width=0.65\textwidth]{images/sbfi.jpg} 504 \end{center} 505 \end{minipage} 506 507 \vfill 508 509 {\tiny 510 511 Views and opinions expressed are however those of the author(s) only 512 and do not necessarily reflect those of the European Union. Neither the 513 European Union nor the granting authority can be held responsible for 514 them. 515 516 } 517 \end{frame} 518 519 \end{document}