2020-gnu.tex (66017B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \usepackage{amsmath} 4 \usepackage{multimedia} 5 \usepackage[utf8]{inputenc} 6 \usepackage{framed,color,ragged2e} 7 \usepackage[absolute,overlay]{textpos} 8 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 9 \usetheme{boxes} 10 \setbeamertemplate{navigation symbols}{} 11 \usepackage{xcolor} 12 \usepackage{tikz,eurosym} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 16 % CSS 17 \lstdefinelanguage{CSS}{ 18 basicstyle=\ttfamily\scriptsize, 19 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 20 sensitive=true, 21 morecomment=[l]{//}, 22 morecomment=[s]{/*}{*/}, 23 morestring=[b]', 24 morestring=[b]", 25 alsoletter={:}, 26 alsodigit={-} 27 } 28 29 % JavaScript 30 \lstdefinelanguage{JavaScript}{ 31 basicstyle=\ttfamily\scriptsize, 32 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 33 morecomment=[s]{/*}{*/}, 34 morecomment=[l]//, 35 morestring=[b]", 36 morestring=[b]' 37 } 38 39 \lstdefinelanguage{HTML5}{ 40 basicstyle=\ttfamily\scriptsize, 41 language=html, 42 sensitive=true, 43 alsoletter={<>=-}, 44 morecomment=[s]{<!-}{-->}, 45 tag=[s], 46 otherkeywords={ 47 % General 48 >, 49 % Standard tags 50 <!DOCTYPE, 51 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 52 % body 53 </body, <body, 54 % Divs 55 </div, <div, </div>, 56 % Paragraphs 57 </p, <p, </p>, 58 % scripts 59 </script, <script, 60 % More tags... 61 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 62 }, 63 ndkeywords={ 64 % General 65 =, 66 % HTML attributes 67 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 68 % SVG attributes 69 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 70 % CSS properties 71 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 72 % CSS3 properties 73 transform:, -moz-transform:, -webkit-transform:, 74 animation:, -webkit-animation:, 75 transition:, transition-duration:, transition-property:, transition-timing-function:, 76 } 77 } 78 79 \lstdefinelanguage{JavaScript}{ 80 basicstyle=\ttfamily\scriptsize, 81 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 82 keywordstyle=\color{blue}\bfseries, 83 ndkeywords={class, export, boolean, throw, implements, import, this}, 84 ndkeywordstyle=\color{darkgray}\bfseries, 85 identifierstyle=\color{black}, 86 sensitive=false, 87 comment=[l]{//}, 88 morecomment=[s]{/*}{*/}, 89 commentstyle=\color{purple}\ttfamily, 90 stringstyle=\color{red}\ttfamily, 91 morestring=[b]', 92 morestring=[b]" 93 } 94 95 \usetikzlibrary{shapes,arrows} 96 \usetikzlibrary{positioning} 97 \usetikzlibrary{calc} 98 99 \title{GNU Taler} 100 %\subtitle{} 101 102 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=0.5cm]{gnu.png} \includegraphics[width=0.5cm]{ashoka.png}\hfill} 103 %\setbeamercovered{transparent=1} 104 105 \author[C. Grothoff]{J. Burdges, F. Dold, {\bf C. Grothoff}, M. Stanisci} 106 \date{\today} 107 \institute{The GNU Project} 108 109 110 \begin{document} 111 112 \justifying 113 114 \begin{frame} 115 \begin{center} 116 \LARGE {\bf GNU} 117 118 \vfill 119 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 120 \includegraphics[width=0.66\textwidth]{taler-logo-2018.pdf} 121 \end{center} 122 \begin{textblock*}{4cm}(.5cm,6.5cm) % {block width} (coords) 123 {\Large {\bf \url{taler.net}} \\ 124 IRC{\bf \#taler} \\ 125 {\small (on freenode)} \\ 126 twitter@taler \\ 127 mail@taler.net } 128 \end{textblock*} 129 130 % Substitute based on who is giving the talk! 131 \begin{textblock*}{6cm}(6.7cm,7.7cm) % {block width} (coords) 132 {\hfill {\Large {\bf Florian Dold \&} \\ 133 \hfill {\bf Christian Grothoff}} \\ 134 \hfill \{dold,grothoff\}@taler.net } 135 \end{textblock*} 136 137 \end{frame} 138 139 140 \begin{frame}{A Social Problem} 141 % \vfill 142 This was a question posed to RAND researchers in 1971: 143 144 \begin{quote} 145 ``Suppose you were an advisor to the head of the KGB, the Soviet Secret Police. Suppose you are given the assignment of designing a system for the surveillance of all citizens and visitors within the boundaries of the USSR. The system is not to be too obtrusive or obvious. What would be your decision?'' 146 \end{quote} 147 %The result: an electronic funds transfer system that looks 148 %strikingly similar today's debit card system. 149 \pause 150 \begin{center} 151 \Large \textbf{Mastercard/Visa are too transparent.} 152 \end{center} 153 \vfill 154 \begin{center} 155 ``I think one of the big things that we need to do, is we need 156 to get a way from true-name payments on the Internet. The credit 157 card payment system is one of the worst things that happened for the 158 user, in terms of being able to divorce their access from their 159 identity.'' \hfill --Edward Snowden, IETF 93 (2015) 160 \end{center} 161 162 \end{frame} 163 164 165 \begin{frame}{Payment System Surveillance is Real} 166 \begin{center} 167 \includegraphics[width=\textwidth]{blog_nsa_swift.jpg} 168 \end{center} 169 \end{frame} 170 171 172 \begin{frame}{Credit Card Surveillance} 173 \begin{itemize} 174 \item When you pay by CC, the information includes your name 175 \item When you pay in person with CC, your location is also known 176 \item You often have no alternative payment methods available 177 \item You hardly ever can use someone else's CC 178 \item Anonymous prepaid cards are difficult to get and expensive 179 \item Payment information is typically stored for at least 6 years 180 \end{itemize} 181 \end{frame} 182 183 184 \section{The Bank's Problem} 185 \begin{frame}{The Bank's Problem} 186 187 3D secure (``verified by visa'') is a nightmare: 188 189 \begin{minipage}{5cm} 190 \begin{itemize} 191 \item Complicated process 192 \item Shifts liability to consumer 193 \item Significant latency 194 \item Can refuse valid requests 195 \item Legal vendors excluded 196 \item No privacy for buyers 197 \end{itemize} 198 \end{minipage} 199 \begin{minipage}{5cm} 200 \includegraphics[width=\textwidth]{illustrations/cc3ds.pdf} 201 \end{minipage} 202 \vfill 203 Online credit card payments will be replaced, but with what? 204 \end{frame} 205 206 207 \begin{frame}{The Bank's Problem} 208 \vfill 209 \begin{textblock*}{12cm}(0.5cm,1cm) % {block width} (coords) 210 \begin{itemize} 211 \item Global tech companies push oligopolies 212 \item Privacy and federated finance are at risk 213 % \item 30\% fees are conceivable 214 \item Economic sovereignty is in danger 215 \end{itemize} 216 \end{textblock*} 217 \begin{textblock*}{4cm}(3.5cm,5.2cm) % {block width} (coords) 218 {\includegraphics[width=\textwidth]{../investors/competitor-logos/amazon.png}} 219 \end{textblock*} 220 \begin{textblock*}{2cm}(7cm,3cm) % {block width} (coords) 221 {\includegraphics[width=\textwidth]{../investors/competitor-logos/alipay.jpeg}} 222 \end{textblock*} 223 \begin{textblock*}{2cm}(3cm,3.5cm) % {block width} (coords) 224 {\includegraphics[width=\textwidth]{../investors/competitor-logos/paypal.jpeg}} 225 \end{textblock*} 226 \begin{textblock*}{2cm}(9cm,5cm) % {block width} (coords) 227 {\includegraphics[width=\textwidth]{../investors/competitor-logos/applepay.jpeg}} 228 \end{textblock*} 229 \begin{textblock*}{2cm}(7.5cm,5.9cm) % {block width} (coords) 230 {\includegraphics[width=\textwidth]{../investors/competitor-logos/samsungpay.jpeg}} 231 \end{textblock*} 232 \begin{textblock*}{1cm}(9.5cm,6.3cm) % {block width} (coords) 233 {\includegraphics[width=\textwidth]{../investors/competitor-logos/android_pay.png}} 234 \end{textblock*} 235 \vfill 236 \end{frame} 237 238 239 \begin{frame}{Predicting the Future} 240 \begin{itemize} 241 \item Google, Apple or Facebook's Libra will be your bank and run your payment system 242 \item They target advertising based on your purchase history, location and 243 your ability to pay 244 \item They will provide more usable, faster and broadly available 245 payment solutions; our federated banking system will be history 246 % just like SMTP is now Gmail. 247 \item After dominating the payment sector, they will start to charge fees 248 befitting their oligopoly size 249 \item Competitors and vendors not aligning with their corporate ``values'' 250 will be excluded by terms of service and go bankrupt 251 \item The imperium will have another major tool for its financial warfare 252 \end{itemize} 253 \end{frame} 254 255 256 \begin{frame}{The Distraction: Bitcoin} 257 258 \begin{itemize} 259 \item Unregulated payment system and currency: 260 \item[] $\Rightarrow$ lack of regulation is a feature! 261 \item Implemented in free software 262 \item Decentralised peer-to-peer system \pause 263 \item Decentralised banking requires solving Byzantine consensus 264 \item Creative solution: tie initial accumulation to solving consensus \pause 265 \item[] $\Rightarrow$ Proof-of-work advances ledger 266 \item[] $\Rightarrow$ Very expensive banking 267 \end{itemize} 268 \end{frame} 269 270 271 \begin{frame} 272 \frametitle{\includegraphics[height=0.5cm]{pics/bitcoin.jpeg}?} 273 \centering 274 \noindent 275 \includegraphics[width=\textwidth]{pics/btc-transaction-cost.png} 276 277 Current average transaction value: $\approx$ 1000 USD 278 \end{frame} 279 280 281 \begin{frame} 282 \frametitle{\includegraphics[height=0.5cm]{pics/zerocoin.png}?} 283 284 Cryptography is rather primitive: 285 \begin{center} 286 {\bf All Bitcoin transactions are public and linkable!} 287 \end{center} 288 289 \begin{itemize} 290 \item[] $\Rightarrow$ no privacy guarantees 291 \item[] $\Rightarrow$ enhanced with ``laundering'' services 292 \end{itemize} 293 ZeroCoin, CryptoNote (Monero) and ZeroCash (ZCash) offer anonymity. 294 \end{frame} 295 296 297 298 299 \begin{frame} 300 \vfill 301 \begin{center} 302 {\bf Do you want to have a libertarian economy?} 303 \end{center} 304 \vfill 305 \begin{center} 306 {\bf Do you want to live under total surveillance?} 307 \end{center} 308 \vfill 309 \end{frame} 310 311 312 \begin{frame}{GNU Taler} 313 \vfill 314 \begin{center} 315 {\huge {\bf Digital} cash, made \textbf{socially responsible}.} 316 \end{center} 317 \vfill 318 \begin{center} 319 \includegraphics[scale=1.5]{taler-logo-2018.pdf} 320 \end{center} 321 \vfill 322 \begin{center} 323 Privacy-Preserving, Practical, Taxable, Free Software, Efficient 324 \end{center} 325 \vfill 326 \vfill 327 \ % 328 \end{frame} 329 330 331 \section{What is Taler?} 332 \begin{frame}{What is Taler?} 333 \vfill 334 \begin{center} 335 Taler is an electronic instant payment system. 336 \end{center} 337 \begin{itemize} 338 \item Uses electronic coins stored in {\bf wallets} on customer's device 339 \item Like {\bf cash} 340 \item Pay in {\bf existing currencies} (i.e. EUR, USD, BTC), \\ 341 or use it to create new {\bf regional currencies} 342 \end{itemize} 343 \vfill 344 \end{frame} 345 346 347 \begin{frame}{Design goals for the GNU Taler Payment System} 348 GNU Taler must ... 349 \begin{enumerate} 350 \item {... be implemented as {\bf free software}.} 351 \item {... protect the {\bf privacy of buyers}.} 352 \item {... must enable the state to {\bf tax income} and crack down on 353 illegal business activities.} 354 \item {... prevent payment fraud.} 355 \item {... only {\bf disclose the minimal amount of information 356 necessary}.} 357 \item {... be usable.} 358 \item {... be efficient.} 359 \item {... avoid single points of failure.} 360 \item {... foster {\bf competition}.} 361 \end{enumerate} 362 \end{frame} 363 364 365 \begin{frame} 366 \frametitle{Taler Overview} 367 \begin{center} 368 \begin{tikzpicture} 369 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 370 \node (origin) at (0,0) {}; 371 \node (exchange) [def,above=of origin,draw]{Exchange}; 372 \node (customer) [def, draw, below left=of origin] {Customer}; 373 \node (merchant) [def, draw, below right=of origin] {Merchant}; 374 \node (auditor) [def, draw, above right=of origin]{Auditor}; 375 376 \tikzstyle{C} = [color=black, line width=1pt] 377 378 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 379 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 380 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 381 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 382 383 \end{tikzpicture} 384 \end{center} 385 \end{frame} 386 387 388 \begin{frame}{Taler in Operation} 389 \pause 390 \centering 391 \includegraphics[width=\textwidth]{operations.png} 392 \end{frame} 393 394 395 \begin{frame}{Usability of Taler} 396 \vfill 397 \begin{center} 398 \url{https://demo.taler.net/} 399 \end{center} 400 \begin{enumerate} 401 \item Install browser extension. 402 \item Visit the {\tt bank.demo.taler.net} to withdraw coins. 403 \item Visit the {\tt shop.demo.taler.net} to spend coins. 404 \end{enumerate} 405 \vfill 406 \end{frame} 407 408 409 \begin{frame}{Use Case: Journalism} 410 Today: 411 \begin{itemize} 412 \item Corporate structure % ($\Rightarrow$ filter) 413 \item Advertising primary revenue % ($\Rightarrow$ dependence) 414 \item Tracking readers critical for business success 415 \item Journalism and marketing hard to distinguish 416 \end{itemize}\vfill\pause 417 With GNU Taler: 418 \begin{itemize} 419 \item One-click micropayments per article 420 \item Hosting requires no expertise % (no PCI DSS) 421 \item Reader-funded reporting separated from marketing 422 \item Readers can remain anonymous 423 \end{itemize} 424 \end{frame} 425 426 427 \begin{frame}{Use Case: Anti-Spam} 428 Today, p$\equiv$p provides authenticated encryption for e-mail: 429 \begin{itemize} 430 \item Free software 431 \item Easy to use opportunistic encryption 432 \item Available for Outlook, Android, Enigmail 433 \item Spies \& spam filters can no longer inspect content 434 \end{itemize}\vfill\pause 435 With GNU Taler: 436 \begin{itemize} 437 \item Peer-to-peer payments via e-mail 438 \item If unsolicited sender, hide messages from user \& 439 automatically request payment from sender 440 \item Sender can attach payment to be moved to inbox 441 \item Receiver may grant refund to sender 442 \end{itemize} 443 \end{frame} 444 445 446 \begin{frame} 447 \vfill 448 \begin{center} 449 {\bf Where might this get us exactly?} 450 \end{center} 451 \vfill 452 \end{frame} 453 454 455 \begin{frame}{Visions} 456 \begin{itemize} 457 \item Be paid to read advertising, starting with spam 458 \item Give welfare without intermediaries taking huge cuts 459 \item Forster regional trade via regional currencies 460 \item Eliminate corruption by making all income visible 461 \item Stop the mining by making crypto-currencies useless for 462 anything but crime 463 \end{itemize} 464 \end{frame} 465 466 467 468 \begin{frame} 469 \vfill 470 \begin{center} 471 {\bf What is there?} 472 \end{center} 473 \vfill 474 \end{frame} 475 476 477 \begin{frame}{Components} 478 \begin{itemize} 479 \item REST APIs, C APIs 480 \item Command-line, WebExtension (Firefox, Chrome, Chromium, Brave) and Android wallet 481 \item GLS bank integration (libeufin, WiP) 482 \item Escrow/backup solution (Anastasis, WiP) 483 \item Merchant backend \& backoffice (needs love) 484 \item WooCommerce plugin (needs update) 485 \item Taler-enabled vending machine (MDB) 486 \item Sample Web frontends 487 \item Twister 488 \end{itemize} 489 \end{frame} 490 491 492 \begin{frame} 493 \vfill 494 \begin{center} 495 {\bf How can you help?} 496 \end{center} 497 \vfill 498 \end{frame} 499 500 501 \begin{frame}{How to support?} 502 \begin{itemize} 503 \item Join: \href{https://lists.gnu.org/mailman/listinfo/taler}{taler@gnu.org}, \href{irc://irc.freenode.net/\#taler}{\#taler} 504 \item Testing: try it out, report issues (\url{https://bugs.gnunet.org/}) 505 \item Translation: translate Web site and software (GNU gettext) 506 \item Propaganda: spread the word (\url{https://git.taler.net/marketing.git}) 507 \item Documentation: explain things better (\url{https://docs.taler.net/}) 508 \item Integration: \url{https://git.taler.net/} 509 \item Security audits: study our code and design 510 \end{itemize} 511 \end{frame} 512 513 514 \begin{frame} 515 \vfill 516 \begin{center} 517 {\bf Technology deep dive} 518 \end{center} 519 \vfill 520 \end{frame} 521 522 523 \begin{frame}{Taxability} 524 We say Taler is taxable because: 525 \begin{itemize} 526 \item Merchant's income is visible from deposits. 527 \item Hash of contract is part of deposit data. 528 \item State can trace income and enforce taxation. 529 \end{itemize}\pause 530 Limitations: 531 \begin{itemize} 532 \item withdraw loophole 533 \item {\em sharing} coins among family and friends 534 \end{itemize} 535 \end{frame} 536 537 538 \begin{frame}{How does it work?} 539 We use a few ancient constructions: 540 \begin{itemize} 541 \item Cryptographic hash function (1989) 542 \item Blind signature (1983) 543 \item Schnorr signature (1989) 544 \item Diffie-Hellman key exchange (1976) 545 \item Cut-and-choose zero-knowledge proof (1985) 546 \end{itemize} 547 But of course we use modern instantiations. 548 \end{frame} 549 550 551 \begin{frame}{Exchange setup: Create a denomination key (RSA)} 552 \begin{minipage}{6cm} 553 \begin{enumerate} 554 \item Pick random primes $p,q$. 555 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 556 \item Pick small $e < \phi(n)$ such that 557 $d := e^{-1} \mod \phi(n)$ exists. 558 \item Publish public key $(e,n)$. 559 \end{enumerate} 560 \end{minipage} 561 \begin{minipage}{6cm} 562 \begin{tikzpicture} 563 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 564 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 565 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 566 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 567 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 568 569 \tikzstyle{C} = [color=black, line width=1pt] 570 571 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 572 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 573 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 574 \end{tikzpicture} 575 % \includegraphics[width=0.4\textwidth]{seal.pdf} 576 \end{minipage} 577 \end{frame} 578 579 580 \begin{frame}{Merchant: Create a signing key (EdDSA)} 581 \begin{minipage}{6cm} 582 \begin{itemize} 583 \item pick random $m \mod o$ as private key 584 \item $M = mG$ public key 585 \end{itemize} 586 \end{minipage} 587 \begin{minipage}{6cm} 588 \begin{tikzpicture} 589 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 590 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 591 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 592 \node (seal) [draw=none, below=of m]{M}; 593 \tikzstyle{C} = [color=black, line width=1pt] 594 595 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 596 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 597 \end{tikzpicture} 598 \end{minipage} 599 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 600 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 601 \end{frame} 602 603 604 \begin{frame}{Customer: Create a planchet (EdDSA)} 605 \begin{minipage}{8cm} 606 \begin{itemize} 607 \item Pick random $c \mod o$ private key 608 \item $C = cG$ public key 609 \end{itemize} 610 \end{minipage} 611 \begin{minipage}{4cm} 612 \begin{tikzpicture} 613 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 614 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 615 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 616 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 617 \tikzstyle{C} = [color=black, line width=1pt] 618 619 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 620 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 621 \end{tikzpicture} 622 \end{minipage} 623 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 624 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 625 \end{frame} 626 627 628 \begin{frame}{Customer: Blind planchet (RSA)} 629 \begin{minipage}{6cm} 630 \begin{enumerate} 631 \item Obtain public key $(e,n)$ 632 \item Compute $f := FDH(C)$, $f < n$. 633 \item Pick blinding factor $b \in \mathbb Z_n$ 634 \item Transmit $f' := f b^e \mod n$ 635 \end{enumerate} 636 \end{minipage} 637 \begin{minipage}{6cm} 638 \begin{tikzpicture} 639 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 640 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 641 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 642 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 643 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 644 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 645 \tikzstyle{C} = [color=black, line width=1pt] 646 647 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 648 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 649 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 650 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 651 \end{tikzpicture} 652 \end{minipage} 653 \end{frame} 654 655 656 \begin{frame}{Exchange: Blind sign (RSA)} 657 \begin{minipage}{6cm} 658 \begin{enumerate} 659 \item Receive $f'$. 660 \item Compute $s' := f'^d \mod n$. 661 \item Send signature $s'$. 662 \end{enumerate} 663 \end{minipage} 664 \begin{minipage}{6cm} 665 \begin{tikzpicture} 666 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 667 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 668 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 669 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 670 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 671 \tikzstyle{C} = [color=black, line width=1pt] 672 673 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 674 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 675 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 676 \end{tikzpicture} 677 \end{minipage} 678 \end{frame} 679 680 681 \begin{frame}{Customer: Unblind coin (RSA)} 682 \begin{minipage}{6cm} 683 \begin{enumerate} 684 \item Receive $s'$. 685 \item Compute $s := s' b^{-1} \mod n$ % \\ 686 % ($(f')^d = (f b^e)^d = f^d b$). 687 \end{enumerate} 688 \end{minipage} 689 \begin{minipage}{6cm} 690 \begin{tikzpicture} 691 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 692 \node (b) [def, draw=none] at (0,0) {$b$}; 693 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 694 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 695 \tikzstyle{C} = [color=black, line width=1pt] 696 697 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 698 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 699 \end{tikzpicture} 700 \end{minipage} 701 \end{frame} 702 703 704 \begin{frame}{Customer: Build shopping cart} 705 \begin{center} 706 \begin{tikzpicture} 707 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 708 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{shop.pdf}}; 709 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.2\textwidth]{cart.pdf}}; 710 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 711 \tikzstyle{C} = [color=black, line width=1pt]; 712 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 713 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 714 \end{tikzpicture} 715 \end{center} 716 \end{frame} 717 718 719 \begin{frame}{Merchant: Propose contract (EdDSA)} 720 \begin{minipage}{6cm} 721 \begin{enumerate} 722 \item Complete proposal $D$. 723 \item Send $D$, $EdDSA_m(D)$ 724 \end{enumerate} 725 \end{minipage} 726 \begin{minipage}{6cm} 727 \begin{tikzpicture} 728 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 729 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 730 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 731 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 732 \tikzstyle{C} = [color=black, line width=1pt]; 733 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 734 \tikzstyle{C} = [color=black, line width=1pt] 735 736 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 737 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 738 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 739 \end{tikzpicture} 740 \end{minipage} 741 \end{frame} 742 743 744 \begin{frame}{Customer: Spend coin (EdDSA)} 745 \begin{minipage}{6cm} 746 \begin{enumerate} 747 \item Receive proposal $D$, $EdDSA_m(D)$. 748 \item Send $s$, $C$, $EdDSA_c(D)$ 749 \end{enumerate} 750 \end{minipage} 751 \begin{minipage}{6cm} 752 \begin{tikzpicture} 753 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 754 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 755 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 756 \node (c) [def, draw=none, above=of contract] {$c$}; 757 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 758 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 759 \tikzstyle{C} = [color=black, line width=1pt] 760 761 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 762 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 763 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 764 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 765 \end{tikzpicture} 766 \end{minipage} 767 \end{frame} 768 769 770 \begin{frame}{Merchant and Exchange: Verify coin (RSA)} 771 \begin{minipage}{6cm} 772 \begin{equation*} 773 s^e \stackrel{?}{\equiv} FDH(C) \mod n 774 \end{equation*} 775 \end{minipage} 776 \begin{minipage}{6cm} 777 \begin{minipage}{0.2\textwidth} 778 \includegraphics[width=\textwidth]{coin.pdf} 779 \end{minipage} 780 $\stackrel{?}{\Leftrightarrow}$ 781 \begin{minipage}{0.2\textwidth} 782 \includegraphics[width=\textwidth]{seal.pdf} 783 \end{minipage} 784 \end{minipage} 785 \end{frame} 786 787 788 \begin{frame}{Giving change} 789 It would be inefficient to pay EUR 100 with 1 cent coins! 790 \begin{itemize} 791 \item Denomination key represents value of a coin. 792 \item Exchange may offer various denominations for coins. 793 \item Wallet may not have exact change! 794 \item Usability requires ability to pay given sufficient total funds. 795 \end{itemize}\pause 796 Key goals: 797 \begin{itemize} 798 \item maintain unlinkability 799 \item maintain taxability of transactions 800 \end{itemize}\pause 801 Method: 802 \begin{itemize} 803 \item Contract can specify to only pay {\em partial value} of a coin. 804 \item Exchange allows wallet to obtain {\em unlinkable change} 805 for remaining coin value. 806 \end{itemize} 807 \end{frame} 808 809 810 \begin{frame}{Diffie-Hellman (ECDH)} 811 \begin{minipage}{8cm} 812 \begin{enumerate} 813 \item Create private keys $c,t \mod o$ 814 \item Define $C = cG$ 815 \item Define $T = tG$ 816 \item Compute DH \\ $cT = c(tG) = t(cG) = tC$ 817 \end{enumerate} 818 \end{minipage} 819 \begin{minipage}{6cm} 820 \begin{tikzpicture} 821 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 822 \node (t) [def, draw=none] at (0,0) {$t$}; 823 \node (ct) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{dh.pdf}}; 824 \node (c) [def, draw=none, above left= of ct] {$c$}; 825 \tikzstyle{C} = [color=black, line width=1pt] 826 827 \draw [<-, C] (ct) -- (c) node [midway, above, sloped] (TextNode) {}; 828 \draw [<-, C] (ct) -- (t) node [midway, above, sloped] (TextNode) {}; 829 \end{tikzpicture} 830 \end{minipage} 831 \end{frame} 832 833 834 \begin{frame}{Strawman solution} 835 \begin{minipage}{8cm} 836 Given partially spent private coin key $c_{old}$: 837 \begin{enumerate} 838 % \item Let $C_{old} := c_{old}G$ (as before) 839 \item Pick random $c_{new} \mod o$ private key 840 \item $C_{new} = c_{new}G$ public key 841 \item Pick random $b_{new}$ 842 \item Compute $f_{new} := FDH(C_{new})$, $m < n$. 843 \item Transmit $f'_{new} := f_{new} b_{new}^e \mod n$ 844 \end{enumerate} 845 ... and sign request for change with $c_{old}$. 846 \end{minipage} 847 \begin{minipage}{4cm} 848 \begin{tikzpicture} 849 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 850 \node (blinded) [def, draw=none]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 851 \node (planchet) [def, draw=none, above left= of blinded] {\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 852 \node (cnew) [def, draw=none, above= of planchet] {$c_{new}$}; 853 \node (bnew) [def, draw=none, above right= of blinded] {$b_{new}$}; 854 \node (dice1) [def, draw=none, above = of cnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 855 \node (dice2) [def, draw=none, above = of bnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 856 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 857 858 \tikzstyle{C} = [color=black, line width=1pt] 859 860 \draw [<-, C] (cnew) -- (dice1) node [midway, above, sloped] (TextNode) {}; 861 \draw [<-, C] (planchet) -- (cnew) node [midway, above, sloped] (TextNode) {}; 862 \draw [<-, C] (bnew) -- (dice2) node [midway, above, sloped] (TextNode) {}; 863 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 864 \draw [<-, C] (blinded) -- (bnew) node [midway, above, sloped] (TextNode) {}; 865 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 866 \end{tikzpicture} 867 \end{minipage} 868 \pause 869 \vfill 870 {\bf Problem: Owner of $c_{new}$ may differ from owner of $c_{old}$!} 871 \end{frame} 872 873 874 \begin{frame}{Customer: Transfer key setup (ECDH)} 875 \begin{minipage}{8cm} 876 Given partially spent private coin key $c_{old}$: 877 \begin{enumerate} 878 \item Let $C_{old} := c_{old}G$ (as before) 879 \item Create random private transfer key $t \mod o$ 880 \item Compute $T := tG$ 881 \item Compute $X := c_{old}(tG) = t(c_{old}G) = tC_{old}$ 882 \item Derive $c_{new}$ and $b_{new}$ from $X$ 883 \item Compute $C_{new} := c_{new}G$ 884 \item Compute $f_{new} := FDH(C_{new})$ 885 \item Transmit $f_{new}' := f_{new} b_{new}^e$ 886 \end{enumerate} 887 \end{minipage} 888 \begin{minipage}{4cm} 889 \begin{tikzpicture} 890 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 891 \node (t) [def, draw=none] at (0,0) {$t$}; 892 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 893 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 894 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 895 \node (cp) [def, draw=none, below left= of dh] {$c_{new}$}; 896 \node (bp) [def, draw=none, below right= of dh] {$b_{new}$}; 897 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 898 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 899 900 \tikzstyle{C} = [color=black, line width=1pt] 901 902 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 903 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 904 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 905 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 906 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 907 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 908 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 909 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 910 \end{tikzpicture} 911 \end{minipage} 912 \end{frame} 913 914 915 \begin{frame}{Cut-and-Choose} 916 \begin{minipage}{4cm} 917 \begin{tikzpicture} 918 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 919 \node (t) [def, draw=none] at (0,0) {$t_1$}; 920 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 921 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 922 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 923 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 924 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 925 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 926 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 927 928 \tikzstyle{C} = [color=black, line width=1pt] 929 930 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 931 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 932 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 933 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 934 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 935 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 936 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 937 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 938 \end{tikzpicture} 939 \end{minipage} 940 \begin{minipage}{4cm} 941 \begin{tikzpicture} 942 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 943 \node (t) [def, draw=none] at (0,0) {$t_2$}; 944 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 945 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 946 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 947 \node (cp) [def, draw=none, below left= of dh] {$c_{new,2}$}; 948 \node (bp) [def, draw=none, below right= of dh] {$b_{new,2}$}; 949 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 950 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 951 952 \tikzstyle{C} = [color=black, line width=1pt] 953 954 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 955 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 956 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 957 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 958 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 959 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 960 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 961 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 962 \end{tikzpicture} 963 \end{minipage} 964 \begin{minipage}{4cm} 965 \begin{tikzpicture} 966 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 967 \node (t) [def, draw=none] at (0,0) {$t_3$}; 968 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 969 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 970 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 971 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 972 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 973 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 974 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 975 976 \tikzstyle{C} = [color=black, line width=1pt] 977 978 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 979 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 980 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 981 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 982 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 983 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 984 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 985 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 986 \end{tikzpicture} 987 \end{minipage} 988 \end{frame} 989 990 991 \begin{frame}{Exchange: Choose!} 992 \begin{center} 993 \item Exchange sends back random $\gamma \in \{ 1, 2, 3 \}$ to the customer. 994 \end{center} 995 \end{frame} 996 997 998 \begin{frame}{Customer: Reveal} 999 \begin{enumerate} 1000 \item If $\gamma = 1$, send $t_2$, $t_3$ to exchange 1001 \item If $\gamma = 2$, send $t_1$, $t_3$ to exchange 1002 \item If $\gamma = 3$, send $t_1$, $t_2$ to exchange 1003 \end{enumerate} 1004 \end{frame} 1005 1006 1007 \begin{frame}{Exchange: Verify ($\gamma = 2$)} 1008 \begin{minipage}{4cm} 1009 \begin{tikzpicture} 1010 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1011 \node (h) [def, draw=none] at (0,0) {$t_1$}; 1012 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1013 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1014 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1015 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1016 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1017 1018 \tikzstyle{C} = [color=black, line width=1pt] 1019 1020 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1021 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1022 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1023 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1024 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1025 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1026 \end{tikzpicture} 1027 \end{minipage} 1028 \begin{minipage}{4cm} 1029 \ 1030 \end{minipage} 1031 \begin{minipage}{4cm} 1032 \begin{tikzpicture} 1033 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1034 \node (h) [def, draw=none] at (0,0) {$t_3$}; 1035 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1036 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1037 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1038 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1039 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1040 1041 \tikzstyle{C} = [color=black, line width=1pt] 1042 1043 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1044 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1045 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1046 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1047 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1048 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1049 \end{tikzpicture} 1050 \end{minipage} 1051 \end{frame} 1052 1053 1054 \begin{frame}{Exchange: Blind sign change (RSA)} 1055 \begin{minipage}{6cm} 1056 \begin{enumerate} 1057 \item Take $f_{new,\gamma}'$. 1058 \item Compute $s' := f_{new,\gamma}'^d \mod n$. 1059 \item Send signature $s'$. 1060 \end{enumerate} 1061 \end{minipage} 1062 \begin{minipage}{6cm} 1063 \begin{tikzpicture} 1064 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1065 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 1066 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 1067 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1068 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 1069 \tikzstyle{C} = [color=black, line width=1pt] 1070 1071 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 1072 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 1073 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1074 \end{tikzpicture} 1075 \end{minipage} 1076 \end{frame} 1077 1078 1079 \begin{frame}{Customer: Unblind change (RSA)} 1080 \begin{minipage}{6cm} 1081 \begin{enumerate} 1082 \item Receive $s'$. 1083 \item Compute $s := s' b_{new,\gamma}^{-1} \mod n$. 1084 \end{enumerate} 1085 \end{minipage} 1086 \begin{minipage}{6cm} 1087 \begin{tikzpicture} 1088 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1089 \node (b) [def, draw=none] at (0,0) {$b_{new,\gamma}$}; 1090 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1091 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1092 \tikzstyle{C} = [color=black, line width=1pt] 1093 1094 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 1095 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1096 \end{tikzpicture} 1097 \end{minipage} 1098 \end{frame} 1099 1100 1101 \begin{frame}{Exchange: Allow linking change} 1102 \begin{minipage}{7cm} 1103 \begin{center} 1104 Given $C_{old}$ 1105 1106 \vspace{1cm} 1107 1108 return $T_\gamma$, $s := s' b_{new,\gamma}^{-1} \mod n$. 1109 \end{center} 1110 \end{minipage} 1111 \begin{minipage}{5cm} 1112 \begin{tikzpicture} 1113 \tikzstyle{def} = [node distance= 3em and 0.5em, inner sep=0.5em, outer sep=.3em]; 1114 \node (co) [def, draw=none] at (0,0) {$C_{old}$}; 1115 \node (T) [def, draw=none, below left=of co]{$T_\gamma$}; 1116 \node (sign) [def, draw=none, below right=of co]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1117 \node (customer) [def, draw, below right=of T] {Customer}; 1118 1119 \tikzstyle{C} = [color=black, line width=1pt] 1120 1121 \draw [<-, C] (T) -- (co) node [midway, above, sloped] (TextNode) {}; 1122 \draw [<-, C] (sign) -- (co) node [midway, above, sloped] (TextNode) {}; 1123 \draw [<-, C] (customer) -- (T) node [midway, above, sloped] (TextNode) {link}; 1124 \draw [<-, C] (customer) -- (sign) node [midway, above, sloped] (TextNode) {link}; 1125 \end{tikzpicture} 1126 \end{minipage} 1127 \end{frame} 1128 1129 1130 \begin{frame}{Customer: Link (threat!)} 1131 \begin{minipage}{6.3cm} 1132 \begin{enumerate} 1133 \item Have $c_{old}$. 1134 \item Obtain $T_\gamma$, $s$ from exchange 1135 \item Compute $X_\gamma = c_{old}T_\gamma$ 1136 \item Derive $c_{new,\gamma}$ and $b_{new,\gamma}$ from $X_\gamma$ 1137 \item Unblind $s := s' b_{new,\gamma}^{-1} \mod n$ 1138 \end{enumerate} 1139 1140 \end{minipage} 1141 \begin{minipage}{5.7cm} 1142 \begin{tikzpicture} 1143 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1144 \node (T) [def, draw=none] at (0,0) {$T_\gamma$}; 1145 \node (exchange) [def, inner sep=0.5em, draw, above left=of T] {Exchange}; 1146 \node (signed) [def, draw=none, below left=of T]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1147 \node (dh) [def, draw=none, below right=of T]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1148 \node (bp) [def, draw=none, below left= of dh] {$b_{new,\gamma}$}; 1149 \node (co) [def, draw=none, above right= of dh] {$c_{old}$}; 1150 \node (cp) [def, draw=none, below= of dh] {$c_{new,\gamma}$}; 1151 \node (coin) [def, draw=none, below left = of bp]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1152 \node (psign) [def, node distance=2.5em and 0em, draw=none, below = of cp]{\includegraphics[width=0.2\textwidth]{planchet-sign.pdf}}; 1153 1154 \tikzstyle{C} = [color=black, line width=1pt] 1155 1156 \draw [<-, C] (dh) -- (co) node [midway, above, sloped] (TextNode) {}; 1157 \draw [<-, C] (dh) -- (T) node [midway, above, sloped] (TextNode) {}; 1158 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1159 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1160 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1161 \draw [<-, C] (coin) -- (bp) node [midway, above, sloped] (TextNode) {}; 1162 \draw [<-, C] (T) -- (exchange) node [midway, above, sloped] (TextNode) {link}; 1163 \draw [<-, C] (signed) -- (exchange) node [midway, below, sloped] (TextNode) {link}; 1164 \draw [<-, C, double] (psign) -- (cp) node [midway, below, sloped] (TextNode) {}; 1165 \end{tikzpicture} 1166 \end{minipage} 1167 \end{frame} 1168 1169 1170 \begin{frame}{Refresh protocol summary} 1171 \begin{itemize} 1172 \item Customer asks exchange to convert old coin to new coin 1173 \item Protocol ensures new coins can be recovered from old coin 1174 \item[$\Rightarrow$] New coins are owned by the same entity! 1175 \end{itemize} 1176 Thus, the refresh protocol allows: 1177 \begin{itemize} 1178 \item To give unlinkable change. 1179 \item To give refunds to an anonymous customer. 1180 \item To expire old keys and migrate coins to new ones. 1181 \item To handle protocol aborts. 1182 \end{itemize} 1183 \noindent 1184 \begin{center} 1185 \bf 1186 Transactions via refresh are equivalent to {\em sharing} a wallet. 1187 \end{center} 1188 \end{frame} 1189 1190 1191 \begin{frame}{Warranting deposit safety} 1192 Exchange has {\em another} online signing key $W = wG$: 1193 \begin{center} 1194 Sends $E$, $EdDSA_w(M,H(D),FDH(C))$ to the merchant. 1195 \end{center} 1196 This signature means that $M$ was the {\em first} to deposit 1197 $C$ and that the exchange thus must pay $M$. 1198 \begin{center} 1199 Without this, an evil exchange could renege on the deposit 1200 confirmation and claim double-spending if a coin were 1201 deposited twice, and then not pay either merchant! 1202 \end{center} 1203 \end{frame} 1204 1205 1206 \begin{frame}{Online keys} 1207 \begin{itemize} 1208 \item The exchange needs $d$ and $w$ to be available for online signing. 1209 \item The corresponding public keys $W$ and $(e,n)$ are certified using 1210 Taler's public key infrastructure (which uses offline-only keys). 1211 \end{itemize} 1212 \begin{center} 1213 \includegraphics[width=0.5\textwidth]{taler-diagram-signatures.png} 1214 \end{center} 1215 \vfill 1216 \begin{center} 1217 {\bf What happens if those private keys are compromised?} 1218 \end{center} 1219 \vfill 1220 \end{frame} 1221 1222 1223 \begin{frame}{Denomination key $(e,n)$ compromise} 1224 \begin{itemize} 1225 \item An attacker who learns $d$ can sign an arbitrary number of illicit coins 1226 into existence and deposit them. 1227 \item Auditor and exchange can detect this once the total number of deposits 1228 (illicit and legitimate) exceeds the number of legitimate coins the 1229 exchange created. 1230 \item At this point, $(e,n)$ is {\em revoked}. Users of {\em unspent} 1231 legitimate coins reveal $b$ from their withdrawal operation and 1232 obtain a {\em refund}. 1233 \item The financial loss of the exchange is {\em bounded} by the number of 1234 legitimate coins signed with $d$. 1235 \item[$\Rightarrow$] Taler frequently rotates denomination signing keys and 1236 deletes $d$ after the signing period of the respective key expires. 1237 \end{itemize} 1238 \begin{center} 1239 \includegraphics[width=0.5\textwidth]{taler-diagram-denom-expiration.png} 1240 \end{center} 1241 \end{frame} 1242 1243 1244 \begin{frame}{Online signing key $W$ compromise} 1245 \begin{itemize} 1246 \item An attacker who learns $w$ can sign deposit confirmations. 1247 \item Attacker sets up two (or more) merchants and customer(s) which double-spend 1248 legitimate coins at both merchants. 1249 \item The merchants only deposit each coin once at the exchange and get paid once. 1250 \item The attacker then uses $w$ to fake deposit confirmations for the double-spent 1251 transactions. 1252 \item The attacker uses the faked deposit confirmations to complain to the auditor 1253 that the exchange did not honor the (faked) deposit confirmations. 1254 \end{itemize} 1255 The auditor can then detect the double-spending, but cannot tell who is to blame, 1256 and (likely) would presume an evil exchange, forcing it to pay both merchants. 1257 \end{frame} 1258 1259 1260 \begin{frame}{Detecting online signing key $W$ compromise} 1261 \begin{itemize} 1262 \item Merchants are required to {\em probabilistically} report 1263 signed deposit confirmations to the auditor. 1264 \item Auditor can thus detect exchanges not reporting signed 1265 deposit confirmations. 1266 \item[$\Rightarrow$] Exchange can rekey if illicit key use is detected, 1267 then only has to honor deposit confirmations it already provided 1268 to the auditor {\em and} those without proof of double-spending 1269 {\em and} those merchants reported to the auditor. 1270 \item[$\Rightarrow$] Merchants that do not participate in reporting 1271 to the auditor risk their deposit permissions being voided in 1272 cases of an exchange's private key being compromised. 1273 \end{itemize} 1274 \end{frame} 1275 1276 1277 \begin{frame}{Technology Summary} 1278 \begin{itemize} 1279 \item We can design protocols that fail {\em soft}. 1280 \item GNU Taler's design limits financial damage 1281 even in the case private keys are compromised. 1282 \item GNU Taler does more: 1283 \begin{itemize} 1284 \item Gives change, can provide refunds 1285 \item Integrates nicely with HTTP, handles network failures 1286 \item High performance 1287 \item Formal security proofs 1288 \end{itemize} 1289 \begin{center} 1290 \includegraphics[width=0.5\textwidth]{provable-security.png} 1291 \end{center} 1292 \item More information at \url{https://taler.net/}. 1293 \end{itemize} 1294 \end{frame} 1295 1296 1297 \section{Competitor analysis} 1298 \begin{frame}{Competitor comparison} 1299 \begin{center} \small 1300 \begin{tabular}{l||c|c|c|c|c} 1301 & Cash & Bitcoin & Zerocoin & Creditcard & GNU Taler \\ \hline \hline 1302 Online &$-$$-$$-$ & ++ & ++ & + & +++ \\ \hline 1303 Offline & +++ & $-$$-$ & $-$$-$ & + & $-$$-$ \\ \hline 1304 Trans. cost & + & $-$$-$$-$ & $-$$-$$-$ & $-$ & ++ \\ \hline 1305 Speed & + & $-$$-$$-$ & $-$$-$$-$ & o & ++ \\ \hline 1306 Taxation & $-$ & $-$$-$ & $-$$-$$-$ & +++ & +++ \\ \hline 1307 Payer-anon & ++ & o & ++ & $-$$-$$-$ & +++ \\ \hline 1308 Payee-anon & ++ & o & ++ & $-$$-$$-$ & $-$$-$$-$ \\ \hline 1309 Security & $-$ & o & o & $-$$-$ & ++ \\ \hline 1310 Conversion & +++ & $-$$-$$-$ & $-$$-$$-$ & +++ & +++ \\ \hline 1311 Libre & $-$ & +++ & +++ & $-$ $-$ $-$ & +++ \\ 1312 \end{tabular} 1313 \end{center} 1314 \end{frame} 1315 1316 1317 \begin{frame}{Conclusion} 1318 \begin{center} 1319 {\bf What can we do?} 1320 \end{center} 1321 \vfill 1322 \begin{itemize} 1323 \item{Suffer mass-surveillance enabled by credit card oligopolies with high fees, and} 1324 \item{Engage in arms race with deliberately unregulatable blockchains, and} 1325 \item{Enjoy the ``benefits'' of cash \\ 1326 \hfill \includegraphics[height=0.3\textheight]{atm-rupee.jpg} \hfill} 1327 \end{itemize} 1328 \vfill 1329 \begin{center} 1330 {\bf OR} 1331 \end{center} 1332 \vfill 1333 \begin{itemize} 1334 \item{Establish free software alternative balancing social goals!} 1335 \end{itemize} 1336 \vfill 1337 \end{frame} 1338 1339 1340 \begin{frame} 1341 \frametitle{Do you have any questions?} 1342 \vfill 1343 References: 1344 {\tiny 1345 \begin{enumerate} 1346 \item{Christian Grothoff, Bart Polot and Carlo von Loesch. 1347 {\em The Internet is broken: Idealistic Ideas for Building a GNU Network}. 1348 {\bf W3C/IAB Workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)}, 2014.} 1349 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 1350 {\em Enabling Secure Web Payments with GNU Taler}. 1351 {\bf SPACE 2016}.} 1352 \item{Florian Dold, Sree Harsha Totakura, Benedikt M\"uller, Jeffrey Burdges and Christian Grothoff. 1353 {\em Taler: Taxable Anonymous Libre Electronic Reserves}. 1354 Available upon request. 2016.} 1355 \item{Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. 1356 {\em Zerocash: Decentralized Anonymous Payments from Bitcoin}. 1357 {\bf IEEE Symposium on Security \& Privacy, 2016}.} 1358 \item{David Chaum, Amos Fiat and Moni Naor. 1359 {\em Untraceable electronic cash}. 1360 {\bf Proceedings on Advances in Cryptology, 1990}.} 1361 \item{Phillip Rogaway. 1362 {\em The Moral Character of Cryptographic Work}. 1363 {\bf Asiacrypt}, 2015.} \label{bib:rogaway} 1364 \end{enumerate} 1365 } 1366 \begin{center} 1367 {\bf Let money facilitate trade; but ensure capital serves society.} 1368 \end{center} 1369 \end{frame} 1370 1371 1372 1373 1374 \end{document} 1375 1376 1377 1378 1379 \begin{frame}{Taler {\tt /withdraw/sign}} 1380 % Customer withdrawing coins with blind signatures 1381 % \bigskip 1382 \begin{figure}[th] 1383 \begin{minipage}[b]{0.45\linewidth} 1384 \begin{center} 1385 \begin{tikzpicture}[scale = 0.4, 1386 transform shape, 1387 msglabel/.style = { text = Black, yshift = .3cm, 1388 sloped, midway }, 1389 okmsg/.style = { ->, color = MidnightBlue, thick, 1390 >=stealth }, 1391 rstmsg/.style = { ->, color = BrickRed, thick, 1392 >=stealth } 1393 ] 1394 \node[draw = MidnightBlue, 1395 fill = CornflowerBlue, 1396 minimum width = .3cm, 1397 minimum height = 10cm 1398 ] (h1) at (-4, 0) {}; 1399 \node[draw = MidnightBlue, 1400 fill = CornflowerBlue, 1401 minimum width = .3cm, 1402 minimum height = 10cm 1403 ] (h2) at (4, 0) {}; 1404 \node[above = 0cm of h1] {Wallet}; 1405 \node[above = 0cm of h2] {Exchange}; 1406 1407 \path[->, color = MidnightBlue, very thick, >=stealth] 1408 (-5, 4.5) edge 1409 node[rotate=90, text = Black, yshift = .3cm] {Time} 1410 (-5, -4.5); 1411 \path[okmsg, dashed] 1412 ($(h1.east)+(0, 4.0)+(0, -1.0)$) edge 1413 node[msglabel] {SEPA(RK,A)} 1414 ($(h2.west)+(0, 3.5)+(0, -1.0)$); 1415 \path[okmsg] 1416 ($(h1.east)+(0, -1.0)$) edge 1417 node[msglabel] {POST {\tt /withdraw/sign} $S_{RK}(DK, B_b(C))$} 1418 ($(h2.west)+(0, -1.5)$); 1419 \path[okmsg] 1420 ($(h2.west)+(0, -2.0)$) edge 1421 node[msglabel] {200 OK: $S_{DK}(B_b(C))$)} 1422 ($(h1.east)+(0, -2.5)$); 1423 \path[rstmsg] 1424 ($(h2.west)+(0, -3.5)$) edge 1425 node[msglabel] {402 PAYMENT REQUIRED: $S_{RK}(DK, B_b(C))$)} 1426 ($(h1.east)+(0, -4)$); 1427 \node at (5.3, 0) {}; 1428 \end{tikzpicture} 1429 \end{center} 1430 Result: $\langle c, S_{DK}(C) \rangle$. 1431 \end{minipage} 1432 \hspace{0.5cm} 1433 \begin{minipage}[b]{0.45\linewidth} 1434 \tiny 1435 \begin{description} 1436 \item[$A$] Some amount, $A \ge A_{DK}$ 1437 \item[$RK$] Reserve key 1438 \item[$DK$] Denomination key 1439 \item[$b$] Blinding factor 1440 \item[$B_b()$] RSA-FDH blinding % DK supressed 1441 \item[$C$] Coin public key $C := cG$ 1442 \item[$S_{RK}()$] EdDSA signature 1443 \item[$S_{DK}()$] RSA-FDH signature 1444 \end{description} 1445 \end{minipage} 1446 \end{figure} 1447 \end{frame} 1448 1449 1450 \begin{frame}[t]{Taler {\tt /deposit}} 1451 Merchant and exchange see only the public coin $\langle C, S_{DK}(C) \rangle$. 1452 \bigskip 1453 \begin{figure}[th] 1454 \begin{minipage}[b]{0.45\linewidth} 1455 \begin{center} 1456 \begin{tikzpicture}[scale = 0.4, 1457 transform shape, 1458 msglabel/.style = { text = Black, yshift = .3cm, 1459 sloped, midway }, 1460 okmsg/.style = { ->, color = MidnightBlue, thick, 1461 >=stealth }, 1462 rstmsg/.style = { ->, color = BrickRed, thick, 1463 >=stealth } 1464 ] 1465 \node[draw = MidnightBlue, 1466 fill = CornflowerBlue, 1467 minimum width = .3cm, 1468 minimum height = 10cm 1469 ] (h1) at (-4, 0) {}; 1470 \node[draw = MidnightBlue, 1471 fill = CornflowerBlue, 1472 minimum width = .3cm, 1473 minimum height = 10cm 1474 ] (h2) at (4, 0) {}; 1475 \node[above = 0cm of h1] {Merchant}; 1476 \node[above = 0cm of h2] {Exchange}; 1477 1478 \path[->, color = MidnightBlue, very thick, >=stealth] 1479 (-5, 4.5) edge 1480 node[rotate=90, text = Black, yshift = .3cm] {Time} 1481 (-5, -4.5); 1482 \path[->, color = MidnightBlue, thick, >=stealth] 1483 ($(h1.east)+(0,3)$) edge 1484 node[text = Black, yshift = .3cm, sloped] {POST {\tt /deposit} $S_{DK}(C), S_{c}(D)$} 1485 ($(h2.west)+(0,2)$); 1486 \path[->, color = MidnightBlue, thick, >=stealth] 1487 ($(h2.west)+(0,0.5)$) edge 1488 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(S_{c}(D))$} 1489 ($(h1.east)+(0,-0.5)$); 1490 \path[rstmsg] 1491 ($(h2.west)+(0, -2.5)$) edge 1492 node[msglabel] {409 CONFLICT: $S_{c}(D')$} 1493 ($(h1.east)+(0, -3.5)$); 1494 \node at (5.3, 0) {}; 1495 \end{tikzpicture} 1496 \end{center} 1497 \end{minipage} 1498 \hspace{0.5cm} 1499 \begin{minipage}[b]{0.45\linewidth} 1500 \tiny 1501 \begin{description} 1502 \item[$DK$] Denomination key 1503 \item[$S_{DK}()$] RSA-FDH signature using $DK$ 1504 \item[$c$] Private coin key, $C := cG$. 1505 \item[$S_{C}()$] EdDSA signature using $c$ 1506 \item[$D$] Deposit details 1507 \item[$SK$] Exchange's signing key 1508 \item[$S_{SK}()$] EdDSA signature using $SK$ 1509 \item[$D'$] Conficting deposit details $D' \not= D$ 1510 \end{description} 1511 \end{minipage} 1512 \end{figure} 1513 \end{frame} 1514 1515 1516 \begin{frame}{Taler {\tt /refresh/melt}} 1517 \begin{figure}[th] 1518 \begin{minipage}[b]{0.45\linewidth} 1519 \begin{center} 1520 \begin{tikzpicture}[scale = 0.4, 1521 transform shape, 1522 msglabel/.style = { text = Black, yshift = .3cm, 1523 sloped, midway }, 1524 okmsg/.style = { ->, color = MidnightBlue, thick, 1525 >=stealth }, 1526 rstmsg/.style = { ->, color = BrickRed, thick, 1527 >=stealth } 1528 ] 1529 \node[draw = MidnightBlue, 1530 fill = CornflowerBlue, 1531 minimum width = .3cm, 1532 minimum height = 10cm 1533 ] (h1) at (-4, 0) {}; 1534 \node[draw = MidnightBlue, 1535 fill = CornflowerBlue, 1536 minimum width = .3cm, 1537 minimum height = 10cm 1538 ] (h2) at (4, 0) {}; 1539 \node[above = 0cm of h1] {Customer}; 1540 \node[above = 0cm of h2] {Exchange}; 1541 1542 \path[->, color = MidnightBlue, very thick, >=stealth] 1543 (-5, 4.5) edge 1544 node[rotate=90, text = Black, yshift = .3cm] {Time} 1545 (-5, -4.5); 1546 \path[->, color = MidnightBlue, thick, >=stealth] 1547 ($(h1.east)+(0,3)$) edge 1548 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/melt} $S_{DK}(C), S_c({\cal DK}, {\cal T},{\cal B})$} 1549 ($(h2.west)+(0,2)$); 1550 \path[->, color = MidnightBlue, thick, >=stealth] 1551 ($(h2.west)+(0,0.5)$) edge 1552 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(H({\cal T}, {\cal B}),\gamma)$} 1553 ($(h1.east)+(0,-0.5)$); 1554 \path[rstmsg] 1555 ($(h2.west)+(0, -2.5)$) edge 1556 node[msglabel] {409 CONFLICT: $S_{C}(X), \ldots$} 1557 ($(h1.east)+(0, -3.5)$); 1558 \node at (5.3, 0) {}; 1559 \end{tikzpicture} 1560 \end{center} 1561 \end{minipage} 1562 \hspace{0.5cm} 1563 \begin{minipage}[b]{0.45\linewidth} 1564 \tiny 1565 \begin{description} 1566 \item[$\kappa$] System-wide security parameter, usually 3. 1567 \\ \smallskip 1568 \item[$\cal DK$] $:= [DK^{(i)}]_i$ \\ List of denomination keys \\ 1569 $D + \sum_i A_{DK^{(i)}} < A_{DK}$ 1570 \item[$t_j$] Random scalar for $j<\kappa$ 1571 \item[${\cal T}$] $:= [T_j]_\kappa$ where $T_j = t_j G$ 1572 \item[$k_j$] $:= c T_j = t_j C$ is an ECDHE 1573 \item[$b_j^{(i)}$] $:= KDF_b(k_j,i)$ % blinding factor 1574 \item[$c_j^{(i)}$] $:= KDF_c(k_j,i)$ % coin secret keys 1575 \item[$C_j^{(i)}$] $: = c_j^{(i)} G$ % new coin publics % keys 1576 \item[${\cal B}$] $:= [H( \beta_j )]_\kappa$ where \\ 1577 $\beta_j := \left[ B_{b_j^{(i)}}(C_j^{(i)}) \right]_i$ 1578 \\ \smallskip 1579 \item[$\gamma$] Random value in $[0,\kappa)$ 1580 % \\ \smallskip 1581 % \item[$X$] Deposit or refresh 1582 \end{description} 1583 \end{minipage} 1584 \end{figure} 1585 \end{frame} 1586 1587 1588 \begin{frame}{Taler {\tt /refresh/reveal}} 1589 \begin{figure}[th] 1590 \begin{minipage}[b]{0.45\linewidth} 1591 \begin{center} 1592 \begin{tikzpicture}[scale = 0.4, 1593 transform shape, 1594 msglabel/.style = { text = Black, yshift = .3cm, 1595 sloped, midway }, 1596 okmsg/.style = { ->, color = MidnightBlue, thick, 1597 >=stealth }, 1598 rstmsg/.style = { ->, color = BrickRed, thick, 1599 >=stealth } 1600 ] 1601 \node[draw = MidnightBlue, 1602 fill = CornflowerBlue, 1603 minimum width = .3cm, 1604 minimum height = 10cm 1605 ] (h1) at (-4, 0) {}; 1606 \node[draw = MidnightBlue, 1607 fill = CornflowerBlue, 1608 minimum width = .3cm, 1609 minimum height = 10cm 1610 ] (h2) at (4, 0) {}; 1611 \node[above = 0cm of h1] {Customer}; 1612 \node[above = 0cm of h2] {Exchange}; 1613 1614 \path[->, color = MidnightBlue, very thick, >=stealth] 1615 (-5, 4.5) edge 1616 node[rotate=90, text = Black, yshift = .3cm] {Time} 1617 (-5, -4.5); 1618 \path[->, color = MidnightBlue, thick, >=stealth] 1619 ($(h1.east)+(0,3)$) edge 1620 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/reveal} $H({\cal T}, {\cal B}), {\tilde{\cal T}}, \beta_\gamma$} 1621 ($(h2.west)+(0,2)$); 1622 \path[->, color = MidnightBlue, thick, >=stealth] 1623 ($(h2.west)+(0,0.5)$) edge 1624 node[text = Black, yshift = .3cm, sloped] {200 OK: $\cal S$} 1625 ($(h1.east)+(0,-0.5)$); 1626 \path[rstmsg] 1627 ($(h2.west)+(0, -2.5)$) edge 1628 node[msglabel] {400 BAD REQUEST: $Z$} 1629 ($(h1.east)+(0, -3.5)$); 1630 \node at (5.3, 0) {}; 1631 \end{tikzpicture} 1632 \end{center} 1633 \end{minipage} 1634 \hspace{0.5cm} 1635 \begin{minipage}[b]{0.45\linewidth} 1636 \tiny 1637 \begin{description} 1638 \item[$\cal DK$] $:= [DK^{(i)}]_i$ 1639 \item[$t_j$] .. \\ \smallskip 1640 1641 \item[$\tilde{\cal T}$] $:= [t_j | j \in \kappa, j \neq \gamma]$ \\ \smallskip 1642 1643 \item[$k_\gamma$] $:= c T_\gamma = t_\gamma C$ 1644 \item[$b_\gamma^{(i)}$] $:= KDF_b(k_\gamma,i)$ 1645 \item[$c_\gamma^{(i)}$] $:= KDF_c(k_\gamma,i)$ 1646 \item[$C_\gamma^{(i)}$] $: = c_\gamma^{(i)} G$ 1647 1648 \item[$B_\gamma^{(i)}$] $:= B_{b_\gamma^{(i)}}(C_\gamma^{(i)})$ 1649 \item[$\beta_\gamma$] $:= \big[ B_\gamma^{(i)} \big]_i$ 1650 \item[$\cal S$] $:= \left[ S_{DK^{(i)}}( B_\gamma^{(i)} ) \right]_i$ \\ \smallskip 1651 1652 \item[$Z$] Cut-and-choose missmatch information 1653 \end{description} 1654 \end{minipage} 1655 \end{figure} 1656 \end{frame} 1657 1658 1659 \begin{frame}{Taler {\tt /refresh/link}} 1660 \begin{figure}[th] 1661 \begin{minipage}[b]{0.45\linewidth} 1662 \begin{center} 1663 \begin{tikzpicture}[scale = 0.4, 1664 transform shape, 1665 msglabel/.style = { text = Black, yshift = .3cm, 1666 sloped, midway }, 1667 okmsg/.style = { ->, color = MidnightBlue, thick, 1668 >=stealth }, 1669 rstmsg/.style = { ->, color = BrickRed, thick, 1670 >=stealth } 1671 ] 1672 \node[draw = MidnightBlue, 1673 fill = CornflowerBlue, 1674 minimum width = .3cm, 1675 minimum height = 10cm 1676 ] (h1) at (-4, 0) {}; 1677 \node[draw = MidnightBlue, 1678 fill = CornflowerBlue, 1679 minimum width = .3cm, 1680 minimum height = 10cm 1681 ] (h2) at (4, 0) {}; 1682 \node[above = 0cm of h1] {Customer}; 1683 \node[above = 0cm of h2] {Exchagne}; 1684 1685 \path[->, color = MidnightBlue, very thick, >=stealth] 1686 (-5, 4.5) edge 1687 node[rotate=90, text = Black, yshift = .3cm] {Time} 1688 (-5, -4.5); 1689 \path[->, color = MidnightBlue, thick, >=stealth] 1690 ($(h1.east)+(0,3)$) edge 1691 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/link} $C$} 1692 ($(h2.west)+(0,2)$); 1693 \path[->, color = MidnightBlue, thick, >=stealth] 1694 ($(h2.west)+(0,0.5)$) edge 1695 node[text = Black, yshift = .3cm, sloped] {200 OK: $T_\gamma$} 1696 ($(h1.east)+(0,-0.5)$); 1697 \path[rstmsg] 1698 ($(h2.west)+(0, -2.5)$) edge 1699 node[msglabel] {404 NOT FOUND} 1700 ($(h1.east)+(0, -3.5)$); 1701 \node at (5.3, 0) {}; 1702 \end{tikzpicture} 1703 \end{center} 1704 \end{minipage} 1705 \hspace{0.5cm} 1706 \begin{minipage}[b]{0.45\linewidth} 1707 \tiny 1708 \begin{description} 1709 \item[$C$] Old coind public key \\ \smallskip 1710 \item[$T_\gamma$] Linkage data $\cal L$ at $\gamma$ 1711 \end{description} 1712 \end{minipage} 1713 \end{figure} 1714 \end{frame} 1715 1716 1717 \begin{frame}{Operational security} 1718 \begin{center} 1719 \resizebox{\textwidth}{!}{ 1720 \begin{tikzpicture}[ 1721 font=\sffamily, 1722 every matrix/.style={ampersand replacement=\&,column sep=2cm,row sep=2cm}, 1723 source/.style={draw,thick,rounded corners,fill=green!20,inner sep=.3cm}, 1724 process/.style={draw,thick,circle,fill=blue!20}, 1725 sink/.style={source,fill=green!20}, 1726 datastore/.style={draw,very thick,shape=datastore,inner sep=.3cm}, 1727 dots/.style={gray,scale=2}, 1728 to/.style={->,>=stealth',shorten >=1pt,semithick,font=\sffamily\footnotesize}, 1729 every node/.style={align=center}] 1730 1731 % Position the nodes using a matrix layout 1732 \matrix{ 1733 \node[source] (wallet) {Wallet}; 1734 \& \node[process] (browser) {Browser}; 1735 \& \node[process] (shop) {Web shop}; 1736 \& \node[sink] (backend) {Taler backend}; \\ 1737 }; 1738 1739 % Draw the arrows between the nodes and label them. 1740 \draw[to] (browser) to[bend right=50] node[midway,above] {(4) signed contract} 1741 node[midway,below] {(signal)} (wallet); 1742 \draw[to] (wallet) to[bend right=50] node[midway,above] {(signal)} 1743 node[midway,below] {(5) signed coins} (browser); 1744 \draw[<->] (browser) -- node[midway,above] {(3,6) custom} 1745 node[midway,below] {(HTTPS)} (shop); 1746 \draw[to] (shop) to[bend right=50] node[midway,above] {(HTTPS)} 1747 node[midway,below] {(1) proposed contract / (7) signed coins} (backend); 1748 \draw[to] (backend) to[bend right=50] node[midway,above] {(2) signed contract / (8) confirmation} 1749 node[midway,below] {(HTTPS)} (shop); 1750 \end{tikzpicture} 1751 } 1752 \end{center} 1753 \end{frame}