2019-bankademia.tex (37529B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 9 \usetheme{boxes} 10 \setbeamertemplate{navigation symbols}{} 11 \usepackage{xcolor} 12 \usepackage{tikz,eurosym} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 16 % CSS 17 \lstdefinelanguage{CSS}{ 18 basicstyle=\ttfamily\scriptsize, 19 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 20 sensitive=true, 21 morecomment=[l]{//}, 22 morecomment=[s]{/*}{*/}, 23 morestring=[b]', 24 morestring=[b]", 25 alsoletter={:}, 26 alsodigit={-} 27 } 28 29 % JavaScript 30 \lstdefinelanguage{JavaScript}{ 31 basicstyle=\ttfamily\scriptsize, 32 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 33 morecomment=[s]{/*}{*/}, 34 morecomment=[l]//, 35 morestring=[b]", 36 morestring=[b]' 37 } 38 39 \lstdefinelanguage{HTML5}{ 40 basicstyle=\ttfamily\scriptsize, 41 language=html, 42 sensitive=true, 43 alsoletter={<>=-}, 44 morecomment=[s]{<!-}{-->}, 45 tag=[s], 46 otherkeywords={ 47 % General 48 >, 49 % Standard tags 50 <!DOCTYPE, 51 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 52 % body 53 </body, <body, 54 % Divs 55 </div, <div, </div>, 56 % Paragraphs 57 </p, <p, </p>, 58 % scripts 59 </script, <script, 60 % More tags... 61 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 62 }, 63 ndkeywords={ 64 % General 65 =, 66 % HTML attributes 67 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 68 % SVG attributes 69 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 70 % CSS properties 71 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 72 % CSS3 properties 73 transform:, -moz-transform:, -webkit-transform:, 74 animation:, -webkit-animation:, 75 transition:, transition-duration:, transition-property:, transition-timing-function:, 76 } 77 } 78 79 \lstdefinelanguage{JavaScript}{ 80 basicstyle=\ttfamily\scriptsize, 81 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 82 keywordstyle=\color{blue}\bfseries, 83 ndkeywords={class, export, boolean, throw, implements, import, this}, 84 ndkeywordstyle=\color{darkgray}\bfseries, 85 identifierstyle=\color{black}, 86 sensitive=false, 87 comment=[l]{//}, 88 morecomment=[s]{/*}{*/}, 89 commentstyle=\color{purple}\ttfamily, 90 stringstyle=\color{red}\ttfamily, 91 morestring=[b]', 92 morestring=[b]" 93 } 94 95 \usetikzlibrary{shapes,arrows} 96 \usetikzlibrary{positioning} 97 \usetikzlibrary{calc} 98 99 \title{Surviving Private Key Compromise in Electronic Payment Systems} 100 %\subtitle{} 101 102 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=0.5cm]{gnu.png} \includegraphics[width=3cm]{bfh.png}\hfill} 103 %\setbeamercovered{transparent=1} 104 105 \author[C. Grothoff]{J. Burdges, F. Dold, {\bf C. Grothoff}, M. Stanisci} 106 \date{\today} 107 \institute{The GNU Project} 108 109 110 \begin{document} 111 112 \justifying 113 114 \begin{frame} 115 \begin{center} 116 {\bf Surviving Private Key Compromise in Electronic Payment Systems} 117 118 \vfill 119 120 \LARGE {\bf GNU} 121 122 \vfill 123 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 124 \includegraphics[width=0.66\textwidth]{taler-logo-2018.pdf} 125 \vfill 126 \vfill 127 \end{center} 128 \begin{textblock*}{4cm}(.5cm,6.5cm) % {block width} (coords) 129 {\Large {\bf \url{taler.net}} \\ 130 IRC{\bf \#taler} \\ 131 {\small (on freenode)} \\ 132 twitter@taler \\ 133 mail@taler.net } 134 \end{textblock*} 135 136 % Substitute based on who is giving the talk! 137 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 138 {\hfill {\Large {\bf Florian Dold \&} \\ 139 \hfill {\bf Christian Grothoff}} \\ 140 \hfill \{dold,grothoff\}@taler.net } 141 \end{textblock*} 142 143 \end{frame} 144 145 146 \section{payto://} 147 148 149 \begin{frame}{Prelude: \texttt{draft-dold-payto}} 150 \vfill 151 \begin{center} 152 {\huge payto://} 153 \end{center} 154 \vfill 155 {\small See also: \\ 156 \url{https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml}} 157 \vfill 158 159 \end{frame} 160 161 \begin{frame}{} 162 \vfill 163 \includegraphics[width=0.5\textwidth]{einzahlschein-ch.jpeg} 164 \hfill 165 \includegraphics[width=0.4\textwidth]{de-ueberweisungsformular.png} 166 \vfill 167 \end{frame} 168 169 170 % FIXME: Start with payto:// (warm-up!) 171 172 \begin{frame}[fragile]{\texttt{payto:} Uniform Identifiers for Payments and Accounts} 173 \vfill 174 Like \texttt{mailto:}, but for bank accounts instead of email accounts! 175 \vfill 176 \begin{verbatim} 177 payto://<PAYMENT-METHOD>/<ACCOUNT-NR> 178 ?subject=InvoiceNr42 179 &amount=EUR:12.50 180 \end{verbatim} 181 \vfill 182 Default action: Open app to review and confirm payment. 183 \vfill 184 \end{frame} 185 186 \begin{frame}[fragile]{Benefits of Payto} 187 \begin{itemize} 188 \item Standardized way to represent financial resources (bank account, bitcoin wallet) 189 and payments to them 190 \item Useful on the client-side on the Web and for FinTech backend applications 191 \item Payment methods (such as IBAN, ACH, Bitcoin) are registered with 192 IANA and allow extra options 193 \end{itemize} 194 \end{frame} 195 196 197 \begin{frame}{GNU Taler} 198 \vfill 199 \begin{center} 200 {\huge {\bf Digital} cash, made \textbf{socially responsible}.} 201 \end{center} 202 \vfill 203 \begin{center} 204 \includegraphics[scale=1.5]{taler-logo-2018.pdf} 205 \end{center} 206 \vfill 207 \begin{center} 208 Privacy-Preserving, Practical, Taxable, Free Software, Efficient 209 \end{center} 210 \vfill 211 \vfill 212 \ % 213 \end{frame} 214 215 216 \section{What is Taler?} 217 \begin{frame}{What is Taler?} 218 \vfill 219 \begin{center} 220 Taler is an electronic instant payment system suitable for a CBEC. 221 \end{center} 222 \begin{itemize} 223 \item Uses electronic coins stored in {\bf wallets} on customer's device 224 \item Like {\bf cash} 225 \item Pay in {\bf existing currencies} (i.e. EUR, USD, BTC) 226 \end{itemize} 227 \vfill 228 \end{frame} 229 230 231 \begin{frame} 232 \frametitle{Taler Overview} 233 \begin{center} 234 \begin{tikzpicture} 235 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 236 \node (origin) at (0,0) {}; 237 \node (exchange) [def,above=of origin,draw]{Exchange}; 238 \node (customer) [def, draw, below left=of origin] {Customer}; 239 \node (merchant) [def, draw, below right=of origin] {Merchant}; 240 \node (auditor) [def, draw, above right=of origin]{Auditor}; 241 242 \tikzstyle{C} = [color=black, line width=1pt] 243 244 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 245 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 246 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 247 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 248 249 \end{tikzpicture} 250 \end{center} 251 \end{frame} 252 253 254 \begin{frame} 255 \frametitle{Architecture of Taler} 256 \begin{center} 257 \includegraphics[width=0.9\textwidth]{operations.png} 258 259 $\Rightarrow$ Convenient, taxable, privacy-enhancing, \& resource friendly! 260 \end{center} 261 \end{frame} 262 263 264 \begin{frame}{How does it work?} 265 We use a few ancient constructions: 266 \begin{itemize} 267 \item Cryptographic hash function (1989) 268 \item Blind signature (1983) 269 \item Schnorr signature (1989) 270 \item Diffie-Hellman key exchange (1976) 271 \item Cut-and-choose zero-knowledge proof (1985) 272 \end{itemize} 273 But of course we use modern instantiations. 274 \end{frame} 275 276 277 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 278 \begin{minipage}{6cm} 279 \begin{enumerate} 280 \item Pick random primes $p,q$. 281 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 282 \item Pick small $e < \phi(n)$ such that 283 $d := e^{-1} \mod \phi(n)$ exists. 284 \item Publish public key $(e,n)$. 285 \end{enumerate} 286 \end{minipage} 287 \begin{minipage}{6cm} 288 \begin{tikzpicture} 289 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 290 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 291 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 292 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 293 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 294 295 \tikzstyle{C} = [color=black, line width=1pt] 296 297 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 298 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 299 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 300 \end{tikzpicture} 301 % \includegraphics[width=0.4\textwidth]{seal.pdf} 302 \end{minipage} 303 \end{frame} 304 305 306 \begin{frame}{Merchant: Create a signing key (EdDSA)} 307 \begin{minipage}{6cm} 308 \begin{itemize} 309 \item pick random $m \mod o$ as private key 310 \item $M = mG$ public key 311 \end{itemize} 312 \end{minipage} 313 \begin{minipage}{6cm} 314 \begin{tikzpicture} 315 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 316 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 317 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 318 \node (seal) [draw=none, below=of m]{M}; 319 \tikzstyle{C} = [color=black, line width=1pt] 320 321 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 322 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 323 \end{tikzpicture} 324 \end{minipage} 325 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 326 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 327 \end{frame} 328 329 330 \begin{frame}{Customer: Create a planchet (EdDSA)} 331 \begin{minipage}{8cm} 332 \begin{itemize} 333 \item Pick random $c \mod o$ private key 334 \item $C = cG$ public key 335 \end{itemize} 336 \end{minipage} 337 \begin{minipage}{4cm} 338 \begin{tikzpicture} 339 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 340 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 341 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 342 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 343 \tikzstyle{C} = [color=black, line width=1pt] 344 345 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 346 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 347 \end{tikzpicture} 348 \end{minipage} 349 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 350 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 351 \end{frame} 352 353 354 \begin{frame}{Customer: Blind planchet (RSA)} 355 \begin{minipage}{6cm} 356 \begin{enumerate} 357 \item Obtain public key $(e,n)$ 358 \item Compute $f := FDH(C)$, $f < n$. 359 \item Pick blinding factor $b \in \mathbb Z_n$ 360 \item Transmit $f' := f b^e \mod n$ 361 \end{enumerate} 362 \end{minipage} 363 \begin{minipage}{6cm} 364 \begin{tikzpicture} 365 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 366 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 367 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 368 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 369 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 370 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 371 \tikzstyle{C} = [color=black, line width=1pt] 372 373 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 374 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 375 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 376 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 377 \end{tikzpicture} 378 \end{minipage} 379 \end{frame} 380 381 382 \begin{frame}{Exchange: Blind sign (RSA)} 383 \begin{minipage}{6cm} 384 \begin{enumerate} 385 \item Receive $f'$. 386 \item Compute $s' := f'^d \mod n$. 387 \item Send signature $s'$. 388 \end{enumerate} 389 \end{minipage} 390 \begin{minipage}{6cm} 391 \begin{tikzpicture} 392 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 393 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 394 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 395 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 396 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 397 \tikzstyle{C} = [color=black, line width=1pt] 398 399 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 400 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 401 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 402 \end{tikzpicture} 403 \end{minipage} 404 \end{frame} 405 406 407 \begin{frame}{Customer: Unblind coin (RSA)} 408 \begin{minipage}{6cm} 409 \begin{enumerate} 410 \item Receive $s'$. 411 \item Compute $s := s' b^{-1} \mod n$ % \\ 412 % ($(f')^d = (f b^e)^d = f^d b$). 413 \end{enumerate} 414 \end{minipage} 415 \begin{minipage}{6cm} 416 \begin{tikzpicture} 417 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 418 \node (b) [def, draw=none] at (0,0) {$b$}; 419 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 420 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 421 \tikzstyle{C} = [color=black, line width=1pt] 422 423 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 424 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 425 \end{tikzpicture} 426 \end{minipage} 427 \end{frame} 428 429 430 \begin{frame}{Customer: Build shopping cart} 431 \begin{center} 432 \begin{tikzpicture} 433 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 434 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 435 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 436 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 437 \tikzstyle{C} = [color=black, line width=1pt]; 438 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 439 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 440 \end{tikzpicture} 441 \end{center} 442 \end{frame} 443 444 445 \begin{frame}{Merchant: Propose contract (EdDSA)} 446 \begin{minipage}{6cm} 447 \begin{enumerate} 448 \item Complete proposal $D$. 449 \item Send $D$, $EdDSA_m(D)$ 450 \end{enumerate} 451 \end{minipage} 452 \begin{minipage}{6cm} 453 \begin{tikzpicture} 454 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 455 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 456 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 457 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 458 \tikzstyle{C} = [color=black, line width=1pt]; 459 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 460 \tikzstyle{C} = [color=black, line width=1pt] 461 462 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 463 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 464 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 465 \end{tikzpicture} 466 \end{minipage} 467 \end{frame} 468 469 470 \begin{frame}{Customer: Spend coin (EdDSA)} 471 \begin{minipage}{6cm} 472 \begin{enumerate} 473 \item Receive proposal $D$, $EdDSA_m(D)$. 474 \item Send $s$, $C$, $EdDSA_c(D)$ 475 \end{enumerate} 476 \end{minipage} 477 \begin{minipage}{6cm} 478 \begin{tikzpicture} 479 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 480 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 481 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 482 \node (c) [def, draw=none, above=of contract] {$c$}; 483 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 484 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 485 \tikzstyle{C} = [color=black, line width=1pt] 486 487 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 488 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 489 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 490 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 491 \end{tikzpicture} 492 \end{minipage} 493 \end{frame} 494 495 496 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 497 \begin{minipage}{6cm} 498 \begin{equation*} 499 s^e \stackrel{?}{\equiv} FDH(C) \mod n 500 \end{equation*} 501 \end{minipage} 502 \begin{minipage}{6cm} 503 \begin{minipage}{0.2\textwidth} 504 \includegraphics[width=\textwidth]{coin.pdf} 505 \end{minipage} 506 $\stackrel{?}{\Leftrightarrow}$ 507 \begin{minipage}{0.2\textwidth} 508 \includegraphics[width=\textwidth]{seal.pdf} 509 \end{minipage} 510 \end{minipage} 511 \end{frame} 512 513 514 \begin{frame}{Warranting deposit safety} 515 Exchange has {\em another} online signing key $W = wG$: 516 \begin{center} 517 Sends $E$, $EdDSA_w(M,H(D),FDH(C))$ to the merchant. 518 \end{center} 519 This signature means that $M$ was the {\em first} to deposit 520 $C$ and that the exchange thus must pay $M$. 521 \begin{center} 522 Without this, an evil exchange could renege on the deposit 523 confirmation and claim double-spending if a coin were 524 deposited twice, and then not pay either merchant! 525 \end{center} 526 \end{frame} 527 528 529 \begin{frame}{Online keys} 530 \begin{itemize} 531 \item The exchange needs $d$ and $w$ to be available for online signing. 532 \item The corresponding public keys $W$ and $(e,n)$ are certified using 533 Taler's public key infrastructure (which uses offline-only keys). 534 \end{itemize} 535 \begin{center} 536 \includegraphics[width=0.5\textwidth]{taler-diagram-signatures.png} 537 \end{center} 538 \vfill 539 \begin{center} 540 {\bf What happens if those private keys are compromised?} 541 \end{center} 542 \vfill 543 \end{frame} 544 545 546 \begin{frame}{Denomination key $(e,n)$ compromise} 547 \begin{itemize} 548 \item An attacker who learns $d$ can sign an arbitrary number of illicit coins 549 into existence and deposit them. 550 \item Auditor and exchange can detect this once the total number of deposits 551 (illicit and legitimate) exceeds the number of legitimate coins the 552 exchange created. 553 \item At this point, $(e,n)$ is {\em revoked}. Users of {\em unspent} 554 legitimate coins reveal $b$ from their withdrawal operation and 555 obtain a {\em refund}. 556 \item The financial loss of the exchange is {\em bounded} by the number of 557 legitimate coins signed with $d$. 558 \item[$\Rightarrow$] Taler frequently rotates denomination signing keys and 559 deletes $d$ after the signing period of the respective key expires. 560 \end{itemize} 561 \begin{center} 562 \includegraphics[width=0.5\textwidth]{taler-diagram-denom-expiration.png} 563 \end{center} 564 \end{frame} 565 566 567 \begin{frame}{Online signing key $W$ compromise} 568 \begin{itemize} 569 \item An attacker who learns $w$ can sign deposit confirmations. 570 \item Attacker sets up two (or more) merchants and customer(s) which double-spend 571 legitimate coins at both merchants. 572 \item The merchants only deposit each coin once at the exchange and get paid once. 573 \item The attacker then uses $w$ to fake deposit confirmations for the double-spent 574 transactions. 575 \item The attacker uses the faked deposit confirmations to complain to the auditor 576 that the exchange did not honor the (faked) deposit confirmations. 577 \end{itemize} 578 The auditor can then detect the double-spending, but cannot tell who is to blame, 579 and (likely) would presume an evil exchange, forcing it to pay both merchants. 580 \end{frame} 581 582 583 \begin{frame}{Detecting online signing key $W$ compromise} 584 \begin{itemize} 585 \item Merchants are required to {\em probabilistically} report 586 signed deposit confirmations to the auditor. 587 \item Auditor can thus detect exchanges not reporting signed 588 deposit confirmations. 589 \item[$\Rightarrow$] Exchange can rekey if illicit key use is detected, 590 then only has to honor deposit confirmations it already provided 591 to the auditor {\em and} those without proof of double-spending 592 {\em and} those merchants reported to the auditor. 593 \item[$\Rightarrow$] Merchants that do not participate in reporting 594 to the auditor risk their deposit permissions being voided in 595 cases of an exchange's private key being compromised. 596 \end{itemize} 597 \end{frame} 598 599 600 \begin{frame}{Summary and further reading} 601 \begin{itemize} 602 \item We can design protocols that fail {\em soft}. 603 \item GNU Taler's design limits financial damage 604 even in the case private keys are compromised. 605 \item GNU Taler does more: 606 \begin{itemize} 607 \item Gives change, can provide refunds 608 \item Integrates nicely with HTTP, handles network failures 609 \item High performance 610 \item Free Software 611 \item Formal security proofs 612 \end{itemize} 613 \begin{center} 614 \includegraphics[width=0.5\textwidth]{provable-security.png} 615 \end{center} 616 \item More information at \url{https://taler.net/}. 617 \end{itemize} 618 \end{frame} 619 620 621 622 \begin{frame}{How to support?} 623 \begin{itemize} 624 \item GNU, TUM, INRIA and BFH are {\em not} banks. 625 \item We created Taler Systems SA for commercial support and development of GNU Taler. 626 \item We are in discussions with central banks, commercial banks, suppliers, merchants and various 627 Free Software projects to get GNU Taler into operation. 628 \item More banking partners and venture capital would be welcome. 629 \end{itemize} 630 \begin{center} 631 Talk to us! 632 \end{center} 633 \end{frame} 634 635 636 \begin{frame} 637 \frametitle{Do you have any questions?} 638 \vfill 639 References: 640 {\tiny 641 \begin{enumerate} 642 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 643 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 644 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 645 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 646 {\em Enabling Secure Web Payments with GNU Taler}. 647 {\bf SPACE 2016}.} 648 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 649 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 650 Available upon request. 2016.} 651 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 652 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 653 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 654 \item{David Chaum, Amos Fiat and Moni Naor. 655 {\em Untraceable electronic cash}. 656 {\bf Proceedings on Advances in Cryptology, 1990}.} 657 \item{Phillip Rogaway. 658 {\em The Moral Character of Cryptographic Work}. 659 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 660 \item{Florian Dold. 661 {\em The GNU Taler System: Practical and Provably Secure Electronic Payments}. 662 {\bf PhD thesis. University of Rennes 1}, 2019.} \label{bib:dold} 663 \end{enumerate} 664 } 665 \end{frame} 666 667 668 669 670 \end{document} 671 672 673 674 675 \begin{frame}{Taler {\tt /withdraw/sign}} 676 % Customer withdrawing coins with blind signatures 677 % \bigskip 678 \begin{figure}[th] 679 \begin{minipage}[b]{0.45\linewidth} 680 \begin{center} 681 \begin{tikzpicture}[scale = 0.4, 682 transform shape, 683 msglabel/.style = { text = Black, yshift = .3cm, 684 sloped, midway }, 685 okmsg/.style = { ->, color = MidnightBlue, thick, 686 >=stealth }, 687 rstmsg/.style = { ->, color = BrickRed, thick, 688 >=stealth } 689 ] 690 \node[draw = MidnightBlue, 691 fill = CornflowerBlue, 692 minimum width = .3cm, 693 minimum height = 10cm 694 ] (h1) at (-4, 0) {}; 695 \node[draw = MidnightBlue, 696 fill = CornflowerBlue, 697 minimum width = .3cm, 698 minimum height = 10cm 699 ] (h2) at (4, 0) {}; 700 \node[above = 0cm of h1] {Wallet}; 701 \node[above = 0cm of h2] {Exchange}; 702 703 \path[->, color = MidnightBlue, very thick, >=stealth] 704 (-5, 4.5) edge 705 node[rotate=90, text = Black, yshift = .3cm] {Time} 706 (-5, -4.5); 707 \path[okmsg, dashed] 708 ($(h1.east)+(0, 4.0)+(0, -1.0)$) edge 709 node[msglabel] {SEPA(RK,A)} 710 ($(h2.west)+(0, 3.5)+(0, -1.0)$); 711 \path[okmsg] 712 ($(h1.east)+(0, -1.0)$) edge 713 node[msglabel] {POST {\tt /withdraw/sign} $S_{RK}(DK, B_b(C))$} 714 ($(h2.west)+(0, -1.5)$); 715 \path[okmsg] 716 ($(h2.west)+(0, -2.0)$) edge 717 node[msglabel] {200 OK: $S_{DK}(B_b(C))$)} 718 ($(h1.east)+(0, -2.5)$); 719 \path[rstmsg] 720 ($(h2.west)+(0, -3.5)$) edge 721 node[msglabel] {402 PAYMENT REQUIRED: $S_{RK}(DK, B_b(C))$)} 722 ($(h1.east)+(0, -4)$); 723 \node at (5.3, 0) {}; 724 \end{tikzpicture} 725 \end{center} 726 Result: $\langle c, S_{DK}(C) \rangle$. 727 \end{minipage} 728 \hspace{0.5cm} 729 \begin{minipage}[b]{0.45\linewidth} 730 \tiny 731 \begin{description} 732 \item[$A$] Some amount, $A \ge A_{DK}$ 733 \item[$RK$] Reserve key 734 \item[$DK$] Denomination key 735 \item[$b$] Blinding factor 736 \item[$B_b()$] RSA-FDH blinding % DK supressed 737 \item[$C$] Coin public key $C := cG$ 738 \item[$S_{RK}()$] EdDSA signature 739 \item[$S_{DK}()$] RSA-FDH signature 740 \end{description} 741 \end{minipage} 742 \end{figure} 743 \end{frame} 744 745 746 \begin{frame}[t]{Taler {\tt /deposit}} 747 Merchant and exchange see only the public coin $\langle C, S_{DK}(C) \rangle$. 748 \bigskip 749 \begin{figure}[th] 750 \begin{minipage}[b]{0.45\linewidth} 751 \begin{center} 752 \begin{tikzpicture}[scale = 0.4, 753 transform shape, 754 msglabel/.style = { text = Black, yshift = .3cm, 755 sloped, midway }, 756 okmsg/.style = { ->, color = MidnightBlue, thick, 757 >=stealth }, 758 rstmsg/.style = { ->, color = BrickRed, thick, 759 >=stealth } 760 ] 761 \node[draw = MidnightBlue, 762 fill = CornflowerBlue, 763 minimum width = .3cm, 764 minimum height = 10cm 765 ] (h1) at (-4, 0) {}; 766 \node[draw = MidnightBlue, 767 fill = CornflowerBlue, 768 minimum width = .3cm, 769 minimum height = 10cm 770 ] (h2) at (4, 0) {}; 771 \node[above = 0cm of h1] {Merchant}; 772 \node[above = 0cm of h2] {Exchange}; 773 774 \path[->, color = MidnightBlue, very thick, >=stealth] 775 (-5, 4.5) edge 776 node[rotate=90, text = Black, yshift = .3cm] {Time} 777 (-5, -4.5); 778 \path[->, color = MidnightBlue, thick, >=stealth] 779 ($(h1.east)+(0,3)$) edge 780 node[text = Black, yshift = .3cm, sloped] {POST {\tt /deposit} $S_{DK}(C), S_{c}(D)$} 781 ($(h2.west)+(0,2)$); 782 \path[->, color = MidnightBlue, thick, >=stealth] 783 ($(h2.west)+(0,0.5)$) edge 784 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(S_{c}(D))$} 785 ($(h1.east)+(0,-0.5)$); 786 \path[rstmsg] 787 ($(h2.west)+(0, -2.5)$) edge 788 node[msglabel] {409 CONFLICT: $S_{c}(D')$} 789 ($(h1.east)+(0, -3.5)$); 790 \node at (5.3, 0) {}; 791 \end{tikzpicture} 792 \end{center} 793 \end{minipage} 794 \hspace{0.5cm} 795 \begin{minipage}[b]{0.45\linewidth} 796 \tiny 797 \begin{description} 798 \item[$DK$] Denomination key 799 \item[$S_{DK}()$] RSA-FDH signature using $DK$ 800 \item[$c$] Private coin key, $C := cG$. 801 \item[$S_{C}()$] EdDSA signature using $c$ 802 \item[$D$] Deposit details 803 \item[$SK$] Exchange's signing key 804 \item[$S_{SK}()$] EdDSA signature using $SK$ 805 \item[$D'$] Conficting deposit details $D' \not= D$ 806 \end{description} 807 \end{minipage} 808 \end{figure} 809 \end{frame} 810 811 812 \begin{frame}{Taler {\tt /refresh/melt}} 813 \begin{figure}[th] 814 \begin{minipage}[b]{0.45\linewidth} 815 \begin{center} 816 \begin{tikzpicture}[scale = 0.4, 817 transform shape, 818 msglabel/.style = { text = Black, yshift = .3cm, 819 sloped, midway }, 820 okmsg/.style = { ->, color = MidnightBlue, thick, 821 >=stealth }, 822 rstmsg/.style = { ->, color = BrickRed, thick, 823 >=stealth } 824 ] 825 \node[draw = MidnightBlue, 826 fill = CornflowerBlue, 827 minimum width = .3cm, 828 minimum height = 10cm 829 ] (h1) at (-4, 0) {}; 830 \node[draw = MidnightBlue, 831 fill = CornflowerBlue, 832 minimum width = .3cm, 833 minimum height = 10cm 834 ] (h2) at (4, 0) {}; 835 \node[above = 0cm of h1] {Customer}; 836 \node[above = 0cm of h2] {Exchange}; 837 838 \path[->, color = MidnightBlue, very thick, >=stealth] 839 (-5, 4.5) edge 840 node[rotate=90, text = Black, yshift = .3cm] {Time} 841 (-5, -4.5); 842 \path[->, color = MidnightBlue, thick, >=stealth] 843 ($(h1.east)+(0,3)$) edge 844 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/melt} $S_{DK}(C), S_c({\cal DK}, {\cal T},{\cal B})$} 845 ($(h2.west)+(0,2)$); 846 \path[->, color = MidnightBlue, thick, >=stealth] 847 ($(h2.west)+(0,0.5)$) edge 848 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(H({\cal T}, {\cal B}),\gamma)$} 849 ($(h1.east)+(0,-0.5)$); 850 \path[rstmsg] 851 ($(h2.west)+(0, -2.5)$) edge 852 node[msglabel] {409 CONFLICT: $S_{C}(X), \ldots$} 853 ($(h1.east)+(0, -3.5)$); 854 \node at (5.3, 0) {}; 855 \end{tikzpicture} 856 \end{center} 857 \end{minipage} 858 \hspace{0.5cm} 859 \begin{minipage}[b]{0.45\linewidth} 860 \tiny 861 \begin{description} 862 \item[$\kappa$] System-wide security parameter, usually 3. 863 \\ \smallskip 864 \item[$\cal DK$] $:= [DK^{(i)}]_i$ \\ List of denomination keys \\ 865 $D + \sum_i A_{DK^{(i)}} < A_{DK}$ 866 \item[$t_j$] Random scalar for $j<\kappa$ 867 \item[${\cal T}$] $:= [T_j]_\kappa$ where $T_j = t_j G$ 868 \item[$k_j$] $:= c T_j = t_j C$ is an ECDHE 869 \item[$b_j^{(i)}$] $:= KDF_b(k_j,i)$ % blinding factor 870 \item[$c_j^{(i)}$] $:= KDF_c(k_j,i)$ % coin secret keys 871 \item[$C_j^{(i)}$] $: = c_j^{(i)} G$ % new coin publics % keys 872 \item[${\cal B}$] $:= [H( \beta_j )]_\kappa$ where \\ 873 $\beta_j := \left[ B_{b_j^{(i)}}(C_j^{(i)}) \right]_i$ 874 \\ \smallskip 875 \item[$\gamma$] Random value in $[0,\kappa)$ 876 % \\ \smallskip 877 % \item[$X$] Deposit or refresh 878 \end{description} 879 \end{minipage} 880 \end{figure} 881 \end{frame} 882 883 884 \begin{frame}{Taler {\tt /refresh/reveal}} 885 \begin{figure}[th] 886 \begin{minipage}[b]{0.45\linewidth} 887 \begin{center} 888 \begin{tikzpicture}[scale = 0.4, 889 transform shape, 890 msglabel/.style = { text = Black, yshift = .3cm, 891 sloped, midway }, 892 okmsg/.style = { ->, color = MidnightBlue, thick, 893 >=stealth }, 894 rstmsg/.style = { ->, color = BrickRed, thick, 895 >=stealth } 896 ] 897 \node[draw = MidnightBlue, 898 fill = CornflowerBlue, 899 minimum width = .3cm, 900 minimum height = 10cm 901 ] (h1) at (-4, 0) {}; 902 \node[draw = MidnightBlue, 903 fill = CornflowerBlue, 904 minimum width = .3cm, 905 minimum height = 10cm 906 ] (h2) at (4, 0) {}; 907 \node[above = 0cm of h1] {Customer}; 908 \node[above = 0cm of h2] {Exchange}; 909 910 \path[->, color = MidnightBlue, very thick, >=stealth] 911 (-5, 4.5) edge 912 node[rotate=90, text = Black, yshift = .3cm] {Time} 913 (-5, -4.5); 914 \path[->, color = MidnightBlue, thick, >=stealth] 915 ($(h1.east)+(0,3)$) edge 916 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/reveal} $H({\cal T}, {\cal B}), {\tilde{\cal T}}, \beta_\gamma$} 917 ($(h2.west)+(0,2)$); 918 \path[->, color = MidnightBlue, thick, >=stealth] 919 ($(h2.west)+(0,0.5)$) edge 920 node[text = Black, yshift = .3cm, sloped] {200 OK: $\cal S$} 921 ($(h1.east)+(0,-0.5)$); 922 \path[rstmsg] 923 ($(h2.west)+(0, -2.5)$) edge 924 node[msglabel] {400 BAD REQUEST: $Z$} 925 ($(h1.east)+(0, -3.5)$); 926 \node at (5.3, 0) {}; 927 \end{tikzpicture} 928 \end{center} 929 \end{minipage} 930 \hspace{0.5cm} 931 \begin{minipage}[b]{0.45\linewidth} 932 \tiny 933 \begin{description} 934 \item[$\cal DK$] $:= [DK^{(i)}]_i$ 935 \item[$t_j$] .. \\ \smallskip 936 937 \item[$\tilde{\cal T}$] $:= [t_j | j \in \kappa, j \neq \gamma]$ \\ \smallskip 938 939 \item[$k_\gamma$] $:= c T_\gamma = t_\gamma C$ 940 \item[$b_\gamma^{(i)}$] $:= KDF_b(k_\gamma,i)$ 941 \item[$c_\gamma^{(i)}$] $:= KDF_c(k_\gamma,i)$ 942 \item[$C_\gamma^{(i)}$] $: = c_\gamma^{(i)} G$ 943 944 \item[$B_\gamma^{(i)}$] $:= B_{b_\gamma^{(i)}}(C_\gamma^{(i)})$ 945 \item[$\beta_\gamma$] $:= \big[ B_\gamma^{(i)} \big]_i$ 946 \item[$\cal S$] $:= \left[ S_{DK^{(i)}}( B_\gamma^{(i)} ) \right]_i$ \\ \smallskip 947 948 \item[$Z$] Cut-and-choose missmatch information 949 \end{description} 950 \end{minipage} 951 \end{figure} 952 \end{frame} 953 954 955 \begin{frame}{Taler {\tt /refresh/link}} 956 \begin{figure}[th] 957 \begin{minipage}[b]{0.45\linewidth} 958 \begin{center} 959 \begin{tikzpicture}[scale = 0.4, 960 transform shape, 961 msglabel/.style = { text = Black, yshift = .3cm, 962 sloped, midway }, 963 okmsg/.style = { ->, color = MidnightBlue, thick, 964 >=stealth }, 965 rstmsg/.style = { ->, color = BrickRed, thick, 966 >=stealth } 967 ] 968 \node[draw = MidnightBlue, 969 fill = CornflowerBlue, 970 minimum width = .3cm, 971 minimum height = 10cm 972 ] (h1) at (-4, 0) {}; 973 \node[draw = MidnightBlue, 974 fill = CornflowerBlue, 975 minimum width = .3cm, 976 minimum height = 10cm 977 ] (h2) at (4, 0) {}; 978 \node[above = 0cm of h1] {Customer}; 979 \node[above = 0cm of h2] {Exchagne}; 980 981 \path[->, color = MidnightBlue, very thick, >=stealth] 982 (-5, 4.5) edge 983 node[rotate=90, text = Black, yshift = .3cm] {Time} 984 (-5, -4.5); 985 \path[->, color = MidnightBlue, thick, >=stealth] 986 ($(h1.east)+(0,3)$) edge 987 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/link} $C$} 988 ($(h2.west)+(0,2)$); 989 \path[->, color = MidnightBlue, thick, >=stealth] 990 ($(h2.west)+(0,0.5)$) edge 991 node[text = Black, yshift = .3cm, sloped] {200 OK: $T_\gamma$} 992 ($(h1.east)+(0,-0.5)$); 993 \path[rstmsg] 994 ($(h2.west)+(0, -2.5)$) edge 995 node[msglabel] {404 NOT FOUND} 996 ($(h1.east)+(0, -3.5)$); 997 \node at (5.3, 0) {}; 998 \end{tikzpicture} 999 \end{center} 1000 \end{minipage} 1001 \hspace{0.5cm} 1002 \begin{minipage}[b]{0.45\linewidth} 1003 \tiny 1004 \begin{description} 1005 \item[$C$] Old coind public key \\ \smallskip 1006 \item[$T_\gamma$] Linkage data $\cal L$ at $\gamma$ 1007 \end{description} 1008 \end{minipage} 1009 \end{figure} 1010 \end{frame} 1011 1012 1013 \begin{frame}{Operational security} 1014 \begin{center} 1015 \resizebox{\textwidth}{!}{ 1016 \begin{tikzpicture}[ 1017 font=\sffamily, 1018 every matrix/.style={ampersand replacement=\&,column sep=2cm,row sep=2cm}, 1019 source/.style={draw,thick,rounded corners,fill=green!20,inner sep=.3cm}, 1020 process/.style={draw,thick,circle,fill=blue!20}, 1021 sink/.style={source,fill=green!20}, 1022 datastore/.style={draw,very thick,shape=datastore,inner sep=.3cm}, 1023 dots/.style={gray,scale=2}, 1024 to/.style={->,>=stealth',shorten >=1pt,semithick,font=\sffamily\footnotesize}, 1025 every node/.style={align=center}] 1026 1027 % Position the nodes using a matrix layout 1028 \matrix{ 1029 \node[source] (wallet) {Wallet}; 1030 \& \node[process] (browser) {Browser}; 1031 \& \node[process] (shop) {Web shop}; 1032 \& \node[sink] (backend) {Taler backend}; \\ 1033 }; 1034 1035 % Draw the arrows between the nodes and label them. 1036 \draw[to] (browser) to[bend right=50] node[midway,above] {(4) signed contract} 1037 node[midway,below] {(signal)} (wallet); 1038 \draw[to] (wallet) to[bend right=50] node[midway,above] {(signal)} 1039 node[midway,below] {(5) signed coins} (browser); 1040 \draw[<->] (browser) -- node[midway,above] {(3,6) custom} 1041 node[midway,below] {(HTTPS)} (shop); 1042 \draw[to] (shop) to[bend right=50] node[midway,above] {(HTTPS)} 1043 node[midway,below] {(1) proposed contract / (7) signed coins} (backend); 1044 \draw[to] (backend) to[bend right=50] node[midway,above] {(2) signed contract / (8) confirmation} 1045 node[midway,below] {(HTTPS)} (shop); 1046 \end{tikzpicture} 1047 } 1048 \end{center} 1049 \end{frame}