2023-vv.tex (137403B)
1 \pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames},handout 3 ]{beamer} 4 \usepackage{amsmath} 5 \usepackage{multimedia} 6 \usepackage[utf8]{inputenc} 7 \usepackage{framed,color,ragged2e} 8 \usepackage[absolute,overlay]{textpos} 9 \definecolor{shadecolor}{rgb}{0.8,0.8,0.8} 10 \usetheme{boxes} 11 \setbeamertemplate{navigation symbols}{} 12 \usepackage{xcolor} 13 \usepackage[normalem]{ulem} 14 \usepackage{listings} 15 \usepackage{adjustbox} 16 \usepackage{array} 17 \usepackage{bbding} 18 \usepackage{relsize} 19 \usepackage{graphicx} 20 \usepackage{tikz,eurosym,calc} 21 \usetikzlibrary{tikzmark} 22 \usetikzlibrary{shapes,arrows,arrows.meta} 23 \usetikzlibrary{positioning,fit,patterns} 24 \usetikzlibrary{calc} 25 26 % CSS 27 \lstdefinelanguage{CSS}{ 28 basicstyle=\ttfamily\scriptsize, 29 keywords={color,background-image:,margin,padding,font,weight,display,position,top,left,right,bottom,list,style,border,size,white,space,min,width, transition:, transform:, transition-property, transition-duration, transition-timing-function}, 30 sensitive=true, 31 morecomment=[l]{//}, 32 morecomment=[s]{/*}{*/}, 33 morestring=[b]', 34 morestring=[b]", 35 alsoletter={:}, 36 alsodigit={-} 37 } 38 39 % JavaScript 40 \lstdefinelanguage{JavaScript}{ 41 basicstyle=\ttfamily\scriptsize, 42 morekeywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break}, 43 morecomment=[s]{/*}{*/}, 44 morecomment=[l]//, 45 morestring=[b]", 46 morestring=[b]' 47 } 48 49 \lstdefinelanguage{HTML5}{ 50 basicstyle=\ttfamily\scriptsize, 51 language=html, 52 sensitive=true, 53 alsoletter={<>=-}, 54 morecomment=[s]{<!-}{-->}, 55 tag=[s], 56 otherkeywords={ 57 % General 58 >, 59 % Standard tags 60 <!DOCTYPE, 61 </html, <html, <head, <title, </title, <style, </style, <link, </head, <meta, />, 62 % body 63 </body, <body, 64 % Divs 65 </div, <div, </div>, 66 % Paragraphs 67 </p, <p, </p>, 68 % scripts 69 </script, <script, 70 % More tags... 71 <canvas, /canvas>, <svg, <rect, <animateTransform, </rect>, </svg>, <video, <source, <iframe, </iframe>, </video>, <image, </image> 72 }, 73 ndkeywords={ 74 % General 75 =, 76 % HTML attributes 77 charset=, src=, id=, width=, height=, style=, type=, rel=, href=, 78 % SVG attributes 79 fill=, attributeName=, begin=, dur=, from=, to=, poster=, controls=, x=, y=, repeatCount=, xlink:href=, 80 % CSS properties 81 margin:, padding:, background-image:, border:, top:, left:, position:, width:, height:, 82 % CSS3 properties 83 transform:, -moz-transform:, -webkit-transform:, 84 animation:, -webkit-animation:, 85 transition:, transition-duration:, transition-property:, transition-timing-function:, 86 } 87 } 88 89 \lstdefinelanguage{JavaScript}{ 90 basicstyle=\ttfamily\scriptsize, 91 keywords={typeof, new, true, false, catch, function, return, null, catch, switch, var, if, in, while, do, else, case, break, for}, 92 keywordstyle=\color{blue}\bfseries, 93 ndkeywords={class, export, boolean, throw, implements, import, this}, 94 ndkeywordstyle=\color{darkgray}\bfseries, 95 identifierstyle=\color{black}, 96 sensitive=false, 97 comment=[l]{//}, 98 morecomment=[s]{/*}{*/}, 99 commentstyle=\color{purple}\ttfamily, 100 stringstyle=\color{red}\ttfamily, 101 morestring=[b]', 102 morestring=[b]" 103 } 104 105 \def\checkmark{\tikz\fill[scale=0.4](0,.35) -- (.25,0) -- (1,.7) -- (.25,.15) -- cycle;} 106 107 108 \setbeamersize{description width=1em} 109 110 \definecolor{blue}{rgb}{0,0,0.7} 111 \newcommand{\orange}[1]{{\color{orange}#1}} 112 \newcommand{\blue}[1]{{\color{blue}#1}} 113 \newcommand{\red}[1]{{\color{red}#1}} 114 \newcommand{\Guardian}{\mathcal{G}} 115 \newcommand{\Child}{\mathcal{C}} 116 \newcommand{\Customer}{\mathcal{C}} 117 \newcommand{\Merchant}{\mathcal{M}} 118 \newcommand{\Exchange}{\mathcal{E}} 119 120 \newcommand{\Commit}{\mathsf{Commit}} 121 \newcommand{\Attest}{\mathsf{Attest}} 122 \newcommand{\Verify}{\mathsf{Verify}} 123 \newcommand{\Derive}{\mathsf{Derive}} 124 \newcommand{\DeriveCompare}{\mathsf{DeriveCompare_\kappa}} 125 \newcommand{\Compare}{\mathsf{Compare}} 126 \newcommand{\AgeVer}{\mathsf{AgeVer}} 127 128 \newcommand{\HashF}{\mathsf{H}} 129 \newcommand{\Hash}{\mathsf{H}} 130 \newcommand{\Block}{\mathbb{B}} 131 \newcommand{\Pub}{\mathsf{Pub}} 132 \newcommand{\Sign}{\mathsf{Sig}} 133 \newcommand{\Ver}{\mathsf{Ver}} 134 \newcommand{\Encoding}{\mathsf{Encoding}} 135 \newcommand{\ECDSA}{\mathsf{ECDSA}} 136 \newcommand{\Null}{\mathcal{O}} 137 \newcommand{\EC}{\mathrm{ec}} 138 \newcommand{\Curve}{\mathsf{Curve25519}} 139 \newcommand{\SHA}{\mathsf{SHA256}} 140 \newcommand{\SHAF}{\mathsf{SHA252}} 141 \newcommand{\FDH}{\mathsf{FDH}} 142 143 \newcommand{\negl}{\epsilon} 144 145 \newcommand{\rand}{\mathsf{rand}} 146 \newcommand{\age}{\mathsf{a}} 147 \newcommand{\Age}{\mathsf{M}} 148 \newcommand{\bage}{\mathsf{b}} 149 \newcommand{\minage}{\mathsf{m}} 150 \newcommand{\attest}{\mathsf{T}} 151 \newcommand{\commitment}{\mathsf{Q}} 152 \newcommand{\pruf}{\mathsf{P}} 153 \newcommand{\Vcommitment}{\vec{\mathsf{Q}}} 154 \newcommand{\Vpruf}{\vec{\mathsf{P}}} 155 \newcommand{\blinding}{\beta} 156 157 \newcommand{\ZN}{\mathbb{Z}_N} 158 \newcommand{\Z}{\mathbb{Z}} 159 \newcommand{\N}{\mathbb{N}} 160 \newcommand{\A}{\mathbb{A}} 161 \newcommand{\E}{\mathbb{E}} 162 \newcommand{\F}{\mathbb{F}} 163 \newcommand{\seck}{\mathsf{s}} 164 \newcommand{\pubk}{\mathsf{P}} 165 \renewcommand{\H}{\mathbb{H}} 166 \newcommand{\K}{\mathbb{K}} 167 \newcommand{\Proofs}{\mathbb{P}} 168 \newcommand{\Commitments}{\mathbb{O}} 169 \newcommand{\Attests}{\mathbb{T}} 170 \newcommand{\Blindings}{\mathbb{B}} 171 \newcommand{\Nil}{\perp} 172 173 \newcommand{\p}{\mathsf{p}} 174 \newcommand{\com}{\mathsf{com}} 175 \newcommand{\prf}{\mathsf{prf}} 176 177 \newcommand{\Adv}{\mathcal{A}} 178 \newcommand{\PPT}{\mathfrak{A}} 179 \newcommand{\Probability}{\mathrm{Pr}} 180 \newcommand{\Algorithm}{f} 181 \renewcommand{\Game}[1]{G_\Adv^\mathsf{#1}} 182 183 \DeclareMathOperator{\Image}{Im} 184 \DeclareMathOperator{\Mod}{mod} 185 186 \newcommand{\Encode}[1]{\overbracket[0.5pt][2pt]{\,#1\,}} 187 \newcommand{\Decode}[1]{\underbracket[0.5pt][3pt]{\,#1\,}} 188 \newcommand{\FDHg}[1]{[#1]_g\,} 189 \newcommand{\logg}{{\breve{g}}} 190 191 192 \newcommand{\drawfrom}{\xleftarrow{\$}} 193 \newcommand\Exists{% 194 \mathop{\lower0.75ex\hbox{\ensuremath{% 195 \mathlarger{\mathlarger{\mathlarger{\mathlarger{\exists}}}}}}}% 196 \limits} 197 198 \newcommand\Forall{% 199 \mathop{\lower0.75ex\hbox{\ensuremath{% 200 \mathlarger{\mathlarger{\mathlarger{\mathlarger{\forall}}}}}}}% 201 \limits} 202 203 204 \title{GNU Taler} 205 %\subtitle{} 206 207 \setbeamertemplate{navigation symbols}{\includegraphics[width=1cm]{inria.pdf} \includegraphics[width=1cm]{bfh.png} \includegraphics[width=1.6cm]{fub.pdf} \includegraphics[width=0.4cm]{ashoka.png} \includegraphics[width=0.4cm]{gnu.png} \includegraphics[width=1cm]{taler-logo-2021-inkscape.pdf} \hfill} 208 %\setbeamercovered{transparent=1} 209 210 \author[C. Grothoff]{J. Burdges, {\bf F. Dold, C. Grothoff, M. Stanisci}} 211 \date{\today} 212 \institute{Taler Systems SA \& The GNU Project} 213 214 215 \begin{document} 216 217 \justifying 218 219 \begin{frame} 220 \begin{center} 221 \LARGE {\bf GNU} \\ 222 \vspace{0.3cm} 223 % \includegraphics[width=0.66\textwidth]{logo-2017-fr.pdf} 224 \includegraphics[width=0.66\textwidth]{taler-logo-2021-inkscape.pdf} 225 \vfill 226 \end{center} 227 \begin{textblock*}{6cm}(.5cm,7.7cm) % {block width} (coords) 228 {\Large {\bf \href{https://taler.net/}{taler.net}} \\ 229 \href{https://twitter.com/taler}{taler@twitter} \\ 230 \href{https://taler-systems.com/}{taler-systems.com}} 231 \end{textblock*} 232 233 % Substitute based on who is giving the talk! 234 \begin{textblock*}{8cm}(4.7cm,6.7cm) % {block width} (coords) 235 {\hfill {{\bf Dr. Emmanuel Benoist} \\ 236 \hfill {\bf Dr. Florian Dold} \\ 237 \hfill {\bf Dr. Andreas Habegger} \\ 238 \hfill {\bf Dr. Christian Grothoff} \\ } 239 \hfill \{benoist,dold,habegger,grothoff\}@taler.net } 240 \end{textblock*} 241 242 \end{frame} 243 244 \begin{frame}{GNU Taler} 245 \vfill 246 \begin{center} 247 {\huge {\bf Digital} cash, made \textbf{socially responsible}.} 248 \end{center} 249 \vfill 250 \begin{center} 251 \includegraphics[scale=0.3]{taler-logo-2021-inkscape.pdf} 252 \end{center} 253 \vfill 254 \begin{center} 255 Privacy-Preserving, Practical, Taxable, Free Software, Efficient 256 \end{center} 257 \vfill 258 \vfill 259 \ % 260 \end{frame} 261 262 263 \begin{frame}{Agenda} 264 \tableofcontents 265 \end{frame} 266 267 268 \section{Introduction} 269 270 \begin{frame} 271 \vfill 272 \begin{center} 273 {\bf Part I: Introduction} 274 \end{center} 275 \vfill 276 \end{frame} 277 278 279 \section{What is Taler?} 280 \begin{frame}{What is Taler?} 281 \framesubtitle{\url{https://taler.net/en/features.html}} \noindent 282 Taler is 283 \vfill 284 \begin{itemize} 285 \item a Free/Libre software \emph{payment system} infrastructure project 286 \item ... with a surrounding software ecosystem 287 \item ... and a company (Taler Systems S.A.) and community that wants to deploy it 288 as widely as possible. 289 \end{itemize} 290 \vfill 291 \noindent 292 However, Taler is 293 \begin{itemize} 294 \item \emph{not} a currency 295 \item \emph{not} a long-term store of value 296 \item \emph{not} a network or instance of a system 297 \item \emph{not} decentralized 298 % \item \emph{not} based on proof-of-work or proof-of-stake 299 \item combinable with a DLT back-end if requested 300 \end{itemize} 301 \end{frame} 302 303 304 \begin{frame}{Design principles} 305 \framesubtitle{https://taler.net/en/principles.html} 306 GNU Taler must ... 307 \begin{enumerate} 308 \item {... be implemented as {\bf free software} (but {\em available} under a commercial license).} 309 \item {... protect the {\bf privacy of buyers}.} 310 \item {... must enable the state to {\bf tax income} and crack down on 311 illegal business activities.} 312 \item {... prevent payment fraud.} 313 \item {... only {\bf disclose the minimal amount of information 314 necessary}.} 315 \item {... be usable.} 316 \item {... be efficient.} 317 \item {... avoid single points of failure.} 318 \item {... foster {\bf competition} in associated services.} 319 \end{enumerate} 320 \end{frame} 321 322 323 \begin{frame} 324 \frametitle{Taler Overview} 325 \begin{center} 326 \begin{tikzpicture} 327 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 328 \node (origin) at (0,0) {}; 329 \node (exchange) [def,above=of origin,draw]{Exchange}; 330 \node (customer) [def, draw, below left=of origin] {Customer}; 331 \node (merchant) [def, draw, below right=of origin] {Merchant}; 332 \node (auditor) [def, draw, above right=of origin]{Auditor}; 333 % \node (regulator) [def, draw, above=of auditor]{CSSF}; 334 335 \tikzstyle{C} = [color=black, line width=1pt] 336 337 \draw [<-, C] (customer) -- (exchange) node [midway, above, sloped] (TextNode) {withdraw coins}; 338 \draw [<-, C] (exchange) -- (merchant) node [midway, above, sloped] (TextNode) {deposit coins}; 339 \draw [<-, C] (merchant) -- (customer) node [midway, above, sloped] (TextNode) {spend coins}; 340 \draw [<-, C] (exchange) -- (auditor) node [midway, above, sloped] (TextNode) {verify}; 341 % \draw [<-, C] (regulator) -- (auditor) node [midway, above, sloped] (TextNode) {report}; 342 343 \end{tikzpicture} 344 \end{center} 345 \end{frame} 346 347 348 \begin{frame}{Architecture of Taler} 349 \begin{center} 350 \includegraphics[width=1\textwidth]{operations.png} 351 \end{center} 352 \end{frame} 353 354 355 \begin{frame}{Consumer Impact of Taler} 356 \begin{itemize} 357 \item {\bf Convenient:} pay with one click instantly --– in Euro, 358 Dollar, Swiss Franc or Bitcoin 359 \item {\bf Friction-free security:} Payments do not require sign-up, 360 login or multi-factor authentication 361 \item {\bf Privacy-preserving:} payment requires/shares no personal information 362 \item {\bf Bank account:} not required 363 \end{itemize} 364 \end{frame} 365 366 367 \begin{frame}{Merchant Impact of Taler} 368 \begin{itemize} 369 \item {\bf Instant clearance:} one-click transactions and instant clearance at par 370 \item {\bf Easy \& compliant:} GDPR \& PCI-DSS compliance-free and without any effort 371 \item {\bf Major profit increase:} efficient protocol $+$ no fraud $=$ extremely low costs 372 \item {\bf 1-click checkout:} without Amazon and without false 373 positives in fraud detection 374 \end{itemize} 375 \end{frame} 376 377 378 \begin{frame}{Roadmap: Wallet} 379 \begin{itemize} 380 \item Better wallet state machine (abort handling, etc.) 381 \item Wallet DB performance 382 \item iOS release 383 \item Later: backup/recovery 384 \end{itemize} 385 \end{frame} 386 387 \begin{frame}{Roadmap: Exchange} 388 \begin{itemize} 389 \item Swiss-specific AML/KYC implementation (attributes, VQF forms) 390 \item Code clean up (database batch insert) 391 \item Age-restriction based on KYC data ({\bf experimental}) 392 \end{itemize} 393 \end{frame} 394 395 396 \begin{frame}{Roadmap: Merchant} 397 \begin{itemize} 398 \item Integration at WOZ 399 \item Code clean up / internal review 400 \item Support for Adobe e-commerce ({\bf not critical}) 401 \end{itemize} 402 \end{frame} 403 404 405 \begin{frame}{Roadmap: libeufin} 406 \begin{itemize} 407 \item Currency conversion for regional currencies 408 \item Support for PostFinance EBICS dialect 409 \item Account management for regional currencies 410 \item Database future-proofing 411 \item Code clean up / internal review 412 \end{itemize} 413 \end{frame} 414 415 416 \begin{frame}{Roadmap: System} 417 \begin{itemize} 418 \item Testing of AML/KYC integration in UX 419 \item Pipelines to package binaries for more platforms (incl. non-IA64) 420 \item Develop user guides (\url{https://taler-ops.ch/}, Netzbon) 421 \item Review technical documentation 422 \item Test system recovery procedures 423 \end{itemize} 424 \end{frame} 425 426 427 \begin{frame}{Roadmap: Business} 428 \begin{itemize} 429 \item Prepare application materials for VQF 430 \item Open bank account for sandbox 431 \item Deploy in Basel (Netzbon) 432 \item Validate compliance of implemented AML/KYC processes 433 \end{itemize} 434 \end{frame} 435 436 437 \begin{frame}{Launch Timeline (optimistic)} 438 \begin{description} 439 \item[2022] Internal deployment at BFH 440 \item[Q1'2023] Deployment using Bitcoin at BFH (running, but not yet announced) 441 \item[Q4'2023] Deployment of local currency Netzbon in Basel 442 \item[Q1'2024] Public deployment of eCHF stablecoin in Switzerland 443 \item[2024] German bank executes ``new product process'' for launch in Eurozone 444 \end{description} 445 \end{frame} 446 447 448 \begin{frame}{Usability of Taler} 449 \vfill 450 \begin{center} 451 \url{https://demo.taler.net/} 452 \end{center} 453 \begin{enumerate} 454 \item Install browser extension. 455 \item Visit the {\tt bank.demo.taler.net} to withdraw coins. 456 \item Visit the {\tt shop.demo.taler.net} to spend coins. 457 \end{enumerate} 458 \vfill 459 \end{frame} 460 461 462 \section{Component Zoo} 463 464 \begin{frame} 465 \vfill 466 \begin{center} 467 {\bf Part II: Component Zoo} 468 \end{center} 469 \vfill 470 \end{frame} 471 472 473 \begin{frame}{The Taler Software Ecosystem: Overview} 474 \framesubtitle{\url{https://taler.net/en/docs.html}} 475 Taler is based on modular components that work together to provide a 476 complete payment system: 477 \vfill 478 \begin{itemize} 479 \item {\bf Exchange:} Service provider for digital cash 480 \begin{itemize} 481 \item Core exchange software (cryptography, database) 482 \item Air-gapped key management, real-time {\bf auditing} 483 \item {\bf LibEuFin}: Modular integration with banking systems 484 \end{itemize} 485 \item {\bf Merchant:} Integration service for existing businesses 486 \begin{itemize} 487 \item Core merchant backend software (cryptography, database) 488 \item {\bf Back-office interface} for staff 489 \item {\bf Frontend integration} (E-commerce, Point-of-sale) 490 \end{itemize} 491 \item {\bf Wallet:} Consumer-controlled applications for e-cash 492 \begin{itemize} 493 \item Multi-platform wallet software (for browsers \& mobile phones) 494 \item Wallet backup storage providers ({\bf sync}) 495 \item {\bf Anastasis}: Recovery of lost wallets based on secret splitting 496 \end{itemize} 497 \end{itemize} 498 \end{frame} 499 500 501 \begin{frame}{Taler Exchange} 502 The {\bf Exchange} is the core logic of the payment system. 503 504 \begin{itemize} 505 \item One exchange at minimum must be operated per currency 506 \item Offers a REST API for merchants and customers 507 \item Uses several helper processes for configuration and to 508 interact with RTGS and cryptography 509 \item KYC support via OAuth 2.0, KycAID or Persona APIs 510 \item Implemented in C on top of GNU libmicrohttpd 511 \end{itemize} 512 Scalability: 28'500 transactions/second measured % in BS-thesis 513 in 2022 using two servers on Grid5000. Likely several times 514 higher today (but we did not re-measure recently). 515 \end{frame} 516 517 518 \begin{frame}{Taler Merchant} 519 The {\bf Merchant} is the software run by merchants to accept\\ 520 GNU Taler payments. 521 522 \begin{minipage}{6cm} 523 \begin{itemize} 524 \item REST API for integration with e-commerce 525 \item SPA provides Web interface for administration 526 \item Features include: 527 \begin{itemize} 528 \item Multi-tenant support 529 \item Refunds 530 \item Tipping (Website pays visitor) 531 \item Webhooks 532 \item Inventory management (optional) 533 \end{itemize} 534 \item Implemented in C on top of GNU libmicrohttpd 535 \end{itemize} 536 \end{minipage} 537 \begin{minipage}{5cm} 538 \includegraphics[width=5cm]{screenshots/merchant-spa-settings} 539 \end{minipage} 540 \end{frame} 541 542 543 \begin{frame}{Taler Wallet} 544 The {\bf Wallet} is the software run by consumers to store 545 their digital cash and authorize transactions. 546 547 \begin{minipage}{8cm} 548 \begin{itemize} 549 \item {\bf wallet-core} is the logic shared by all interfaces 550 \item Applications exist for Android, F-Droid, 551 WebExtension (Chrome, Chromium, Firefox, etc.), iOS ({\bf WiP}) 552 \item Features include: 553 \begin{itemize} 554 \item Multi-currency support 555 \item Wallet-to-wallet payments (NFC or QR code) 556 \item CRDT-like data model 557 \end{itemize} 558 \item {\bf wallet-core} implemented in TypeScript 559 \end{itemize} 560 Can be integrated into other Apps if desired. 561 \end{minipage} 562 \begin{minipage}{3cm} 563 \includegraphics[width=3cm]{screenshots/Screenshot_20230225-103520.png} 564 \end{minipage} 565 \end{frame} 566 567 568 \begin{frame}{Taler Auditor} 569 The {\bf Auditor} is the software run by an independent auditor 570 to validate the operation of an Exchange. 571 572 \begin{itemize} 573 \item REST API for additional report inputs by merchants (optional) 574 \item Secure database replication logic 575 \item Implemented in C on top of GNU libmicrohttpd 576 \end{itemize} 577 \end{frame} 578 579 580 \begin{frame}{Pretix Taler payment plugin} 581 \begin{center} 582 \includegraphics[width=0.5\textwidth]{screenshots/pretix.png} 583 \end{center} 584 585 Pretix is a ticket sales system. 586 587 \begin{itemize} 588 \item Pretix payment plugin enables payments via GNU Taler 589 \item Developed by Pretix.eu for \EUR{3,000} on behalf of Taler Systems SA 590 \end{itemize} 591 \end{frame} 592 593 594 \begin{frame}{WooCommerce Taler payment plugin} 595 \begin{minipage}{6cm} 596 \begin{itemize} 597 \item WooCommerce is an e-commerce plugin for WordPress. 598 \item WooCommerce payment plugin enables payments via GNU Taler 599 \item Features include: 600 \begin{itemize} 601 \item Trivial configuration 602 \item Support for refunds 603 \item Full internationalization 604 \end{itemize} 605 \item WooCommerce and its plugins are implemented in PHP 606 \end{itemize} 607 \end{minipage} 608 \begin{minipage}{5cm} 609 \includegraphics[width=4cm]{screenshots/woocommerce-cart.png} 610 \includegraphics[width=4cm]{screenshots/woocommerce-settings.png} 611 \end{minipage} 612 \end{frame} 613 614 615 \begin{frame}{Point-of-Sale App for Android} 616 617 \begin{minipage}{7cm} 618 \begin{itemize} 619 \item Allows merchant to generate orders against Taler backend 620 and display QR code to enable customer to pay in person 621 \item Patterned after ViewTouch restaurant UI 622 \item Features include: 623 \begin{itemize} 624 \item Internet-based configuration 625 \item Products sorted by categories 626 \item Easy undo of every operation 627 \item Manages multiple concurrent orders 628 \end{itemize} 629 \item The Point-of-Sale App is implemented in Kotlin 630 \end{itemize} 631 \end{minipage} 632 \begin{minipage}{4cm} 633 \includegraphics[width=4cm]{screenshots/Screenshot_20230224-194112.jpg} 634 \includegraphics[width=4cm]{screenshots/Screenshot_20230224-194119.jpg} 635 \includegraphics[width=4cm]{screenshots/Screenshot_20230224-195348.jpg} 636 \end{minipage} 637 \end{frame} 638 639 640 \begin{frame}{LibEuFin} 641 LibEuFin is a standalone project that provides adapters to bank account 642 access APIs. 643 644 \begin{itemize} 645 \item LibEuFin provides both a generic access layer and an 646 implementation of the Wire Gateway for the exchange 647 \item Supports EBICS 2.5 648 \item other APIs such as FinTS or PSD2-style XS2A APIs can be added 649 without requiring changes to the Exchange 650 \item tested with German bank GLS business account and real Euros 651 \end{itemize} 652 \vfill 653 \begin{itemize} 654 \item \texttt{libeufin-nexus} is the main service 655 \item Almost all configuration (except DB credentials) 656 is stored in the database and managed via a RESTful HTTP API 657 \item \texttt{libeufin-sandbox} implements a toy EBICS host for protocol 658 testing 659 \item \texttt{libeufin-cli} is client for the HTTP API (only implements a subset 660 of available functionality) 661 \end{itemize} 662 \end{frame} 663 664 665 \begin{frame}{Cashier App for Android} 666 \begin{minipage}{4cm} 667 \begin{itemize} 668 \item Enables BFH staff to convert cash to e-cash 669 \item Staff has special bank accounts with limited funds 670 \item Students can pay staff in cash to receive e-cash 671 \item The Cashier App is implemented in Kotlin 672 \end{itemize} 673 \end{minipage} 674 \begin{minipage}{3cm} 675 \includegraphics[width=3cm]{screenshots/Screenshot_20230225-103315.png} 676 \end{minipage} 677 \begin{minipage}{3cm} 678 \includegraphics[width=3cm]{screenshots/Screenshot_20230225-103325.png} 679 \end{minipage} 680 \end{frame} 681 682 683 \begin{frame}{Depolymerization} 684 Depolymerization is a bridge between GNU Taler and blockchains, 685 making Taler a layer 2 system for crypto-currencies (like Lightning). 686 687 \begin{itemize} 688 \item Currently implemented for Bitcoin and Ethereum 689 crypto-currencies, with the DLTs as the ``RTGS'' 690 \item Provides same API to Exchange as LibEuFin 691 % \item Transaction rate and speed limited by the underlying blockchain 692 \item Implemented in Rust 693 \end{itemize} 694 \begin{center} 695 \url{https://bitcoin.ice.bfh.ch/} 696 \end{center} 697 \end{frame} 698 699 700 \begin{frame}{TalDir (WiP)} 701 TalDir is an extension to the existing 702 peer-to-peer payment functionality. 703 704 \begin{itemize} 705 \item Registry to associate wallets with network addresses 706 \item Extensible to different types of network services: 707 \begin{itemize} 708 \item E-mail 709 \item SMS 710 \item Twitter 711 \item ... 712 \end{itemize} 713 \item Send payments or invoices to wallets associated with network address 714 \item Will {\bf not} require sending wallet to use same network service 715 \end{itemize} 716 \end{frame} 717 718 719 \section{Basic Cryptography} 720 721 \begin{frame} 722 \vfill 723 \begin{center} 724 {\bf Part III: Basic Cryptography} 725 \end{center} 726 \vfill 727 \end{frame} 728 729 730 731 732 \begin{frame}{How does it work?} 733 We use a few well established and tested constructions: 734 \begin{itemize} 735 \item Cryptographic hash function (1989) 736 \item Blind signature (1983) 737 \item Schnorr signature (1989) 738 \item Diffie-Hellman key exchange (1976) 739 \item Cut-and-choose zero-knowledge proof (1985) 740 \end{itemize} 741 But of course we use modern instantiations. 742 \end{frame} 743 744 745 \begin{frame}<1-| handout:0>{Definition: Taxability} 746 We say Taler is taxable because: 747 \begin{itemize} 748 \item Merchant's income is visible from deposits. 749 \item Hash of contract is part of deposit data. 750 \item State can trace income and enforce taxation. 751 \end{itemize}\pause 752 Limitations: 753 \begin{itemize} 754 \item withdraw loophole 755 \item {\em sharing} coins among family and friends 756 \end{itemize} 757 \end{frame} 758 759 760 \begin{frame}<1-| handout:0>{Exchange setup: Create a denomination key (RSA)} 761 \begin{minipage}{6cm} 762 \begin{enumerate} 763 \item Pick random primes $p,q$. 764 \item Compute $n := pq$, $\phi(n) = (p-1)(q-1)$ 765 \item Pick small $e < \phi(n)$ such that 766 $d := e^{-1} \mod \phi(n)$ exists. 767 \item Publish public key $(e,n)$. 768 \end{enumerate} 769 \end{minipage} 770 \begin{minipage}{6cm} 771 \begin{tikzpicture} 772 \tikzstyle{def} = [node distance=1em and 1em, inner sep=0em, outer sep=.3em]; 773 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 774 \node (primes) [draw=none, below = of origin] at (0,0) {$(p, q)$}; 775 \node (seal) [def, draw=none, below left=of primes]{\includegraphics[width=0.15\textwidth]{seal.pdf}}; 776 \node (hammer) [def, draw=none, below right=of primes]{\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 777 778 \tikzstyle{C} = [color=black, line width=1pt] 779 780 \draw [<-, C] (primes) -- (origin) node [midway, above, sloped] (TextNode) {}; 781 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 782 \draw [<-, C] (hammer) -- (primes) node [midway, above, sloped] (TextNode) {}; 783 \end{tikzpicture} 784 % \includegraphics[width=0.4\textwidth]{seal.pdf} 785 \end{minipage} 786 \end{frame} 787 788 789 \begin{frame}<1-| handout:0>{Merchant: Create a signing key (EdDSA)} 790 \begin{minipage}{6cm} 791 \begin{itemize} 792 \item pick random $m \mod o$ as private key 793 \item $M = mG$ public key 794 \end{itemize} 795 \end{minipage} 796 \begin{minipage}{6cm} 797 \begin{tikzpicture} 798 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 799 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 800 \node (m) [draw=none, below = of origin] at (0,0) {$m$}; 801 \node (seal) [draw=none, below=of m]{M}; 802 \tikzstyle{C} = [color=black, line width=1pt] 803 804 \draw [<-, C] (m) -- (origin) node [midway, above, sloped] (TextNode) {}; 805 \draw [<-, C] (seal) -- (primes) node [midway, above, sloped] (TextNode) {}; 806 \end{tikzpicture} 807 \end{minipage} 808 \parbox[t]{3cm}{{\bf Capability:} $m \Rightarrow$ } 809 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{merchant-sign.pdf}} 810 \end{frame} 811 812 813 \begin{frame}<1-| handout:0>{Customer: Create a planchet (EdDSA)} 814 \begin{minipage}{8cm} 815 \begin{itemize} 816 \item Pick random $c \mod o$ private key 817 \item $C = cG$ public key 818 \end{itemize} 819 \end{minipage} 820 \begin{minipage}{4cm} 821 \begin{tikzpicture} 822 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 823 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 824 \node (c) [draw=none, below = of origin] at (0,0) {$c$}; 825 \node (planchet) [draw=none, below=of c]{\includegraphics[width=0.4\textwidth]{planchet.pdf}}; 826 \tikzstyle{C} = [color=black, line width=1pt] 827 828 \draw [<-, C] (c) -- (origin) node [midway, above, sloped] (TextNode) {}; 829 \draw [<-, C] (planchet) -- (c) node [midway, above, sloped] (TextNode) {}; 830 \end{tikzpicture} 831 \end{minipage} 832 \parbox[t]{3cm}{{\bf Capability:} $c \Rightarrow$ } 833 \raisebox{\dimexpr-\height+\baselineskip}{\includegraphics[width=0.1\textwidth]{planchet-sign.pdf}} 834 \end{frame} 835 836 837 \begin{frame}<1-| handout:0>{Customer: Blind planchet (RSA)} 838 \begin{minipage}{6cm} 839 \begin{enumerate} 840 \item Obtain public key $(e,n)$ 841 \item Compute $f := FDH(C)$, $f < n$. 842 \item Pick blinding factor $b \in \mathbb Z_n$ 843 \item Transmit $f' := f b^e \mod n$ 844 \end{enumerate} 845 \end{minipage} 846 \begin{minipage}{6cm} 847 \begin{tikzpicture} 848 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 849 \node (origin) at (0,0) {\includegraphics[width=0.2\textwidth]{dice.pdf}}; 850 \node (b) [def, draw=none, below = of origin] at (0,-0.2) {$b$}; 851 \node (blinded) [def, draw=none, below right=of b]{\includegraphics[width=0.2\textwidth]{blinded.pdf}}; 852 \node (planchet) [def, draw=none, above right=of blinded]{\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 853 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 854 \tikzstyle{C} = [color=black, line width=1pt] 855 856 \draw [<-, C] (b) -- (origin) node [midway, above, sloped] (TextNode) {}; 857 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 858 \draw [<-, C] (blinded) -- (b) node [midway, above, sloped] (TextNode) {}; 859 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 860 \end{tikzpicture} 861 \end{minipage} 862 \end{frame} 863 864 865 \begin{frame}<1-| handout:0>{Exchange: Blind sign (RSA)} 866 \begin{minipage}{6cm} 867 \begin{enumerate} 868 \item Receive $f'$. 869 \item Compute $s' := f'^d \mod n$. 870 \item Send signature $s'$. 871 \end{enumerate} 872 \end{minipage} 873 \begin{minipage}{6cm} 874 \begin{tikzpicture} 875 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 876 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 877 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 878 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 879 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 880 \tikzstyle{C} = [color=black, line width=1pt] 881 882 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 883 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 884 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 885 \end{tikzpicture} 886 \end{minipage} 887 \end{frame} 888 889 890 \begin{frame}<1-| handout:0>{Customer: Unblind coin (RSA)} 891 \begin{minipage}{6cm} 892 \begin{enumerate} 893 \item Receive $s'$. 894 \item Compute $s := s' b^{-1} \mod n$ % \\ 895 % ($(f')^d = (f b^e)^d = f^d b$). 896 \end{enumerate} 897 \end{minipage} 898 \begin{minipage}{6cm} 899 \begin{tikzpicture} 900 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 901 \node (b) [def, draw=none] at (0,0) {$b$}; 902 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 903 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 904 \tikzstyle{C} = [color=black, line width=1pt] 905 906 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 907 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 908 \end{tikzpicture} 909 \end{minipage} 910 \end{frame} 911 912 \begin{frame}{Withdrawing coins on the Web} 913 \begin{center} 914 \includegraphics[height=0.9\textheight]{figs/taler-withdraw.pdf} 915 \end{center} 916 \end{frame} 917 918 919 \begin{frame}<1-| handout:0>{Customer: Build shopping cart} 920 \begin{center} 921 \begin{tikzpicture} 922 \tikzstyle{def} = [node distance= 1em and 1em, inner sep=0em, outer sep=.3em]; 923 \node (origin) at (0,0) {\includegraphics[width=0.18\textwidth]{shop.pdf}}; 924 \node (cart) [draw=none, below=of m]{\includegraphics[width=0.18\textwidth]{cart.pdf}}; 925 \node (merchant) [node distance=4em and 0.5em, draw, below =of cart]{Merchant}; 926 \tikzstyle{C} = [color=black, line width=1pt]; 927 \draw [<-, C] (cart) -- (origin) node [midway, above, sloped] (TextNode) {}; 928 \draw [<-, C] (merchant) -- (cart) node [midway, above, sloped] (TextNode) {{\small transmit}}; 929 \end{tikzpicture} 930 \end{center} 931 \end{frame} 932 933 934 \begin{frame}<1-| handout:0>{Merchant Integration: Payment Request} 935 % \begin{figure}[p!] 936 \lstset{language=HTML5} 937 \lstinputlisting{figs/taler-402.html} 938 % \caption{Sample HTTP response to prompt the wallet to show an offer.} 939 % \label{listing:http-contract} 940 % \end{figure} 941 942 % \begin{figure*}[p!] 943 % \lstset{language=HTML5} 944 % \lstinputlisting{figs/taler-contract.html} 945 % \caption{Sample JavaScript code to prompt the wallet to show an offer. 946 % Here, the contract is fetched on-demand from the server. 947 % The {\tt taler\_pay()} function needs to be invoked 948 % when the user triggers the checkout.} 949 % \label{listing:contract} 950 % \end{figure*} 951 \end{frame} 952 953 954 955 \begin{frame}<1-| handout:0>{Merchant: Propose contract (EdDSA)} 956 \begin{minipage}{6cm} 957 \begin{enumerate} 958 \item Complete proposal $D$. 959 \item Send $D$, $EdDSA_m(D)$ 960 \end{enumerate} 961 \end{minipage} 962 \begin{minipage}{6cm} 963 \begin{tikzpicture} 964 \tikzstyle{def} = [node distance=2em and 0.5em, inner sep=0em, outer sep=.3em]; 965 \node (cart) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{cart.pdf}}; 966 \node (proposal) [def, draw=none, below right=of cart]{\includegraphics[width=0.5\textwidth]{merchant_propose.pdf}}; 967 \node (customer) [node distance=4em and 0.5em, draw, below =of proposal]{Customer}; 968 \tikzstyle{C} = [color=black, line width=1pt]; 969 \node (sign) [def, draw=none, above right=of proposal] {$m$}; 970 \tikzstyle{C} = [color=black, line width=1pt] 971 972 \draw [<-, C] (proposal) -- (sign) node [midway, above, sloped] (TextNode) {}; 973 \draw [<-, C] (proposal) -- (cart) node [midway, above, sloped] (TextNode) {}; 974 \draw [<-, C] (customer) -- (proposal) node [midway, above, sloped] (TextNode) {{\small transmit}}; 975 \end{tikzpicture} 976 \end{minipage} 977 \end{frame} 978 979 980 \begin{frame}<1-| handout:0>{Customer: Spend coin (EdDSA)} 981 \begin{minipage}{6cm} 982 \begin{enumerate} 983 \item Receive proposal $D$, $EdDSA_m(D)$. 984 \item Send $s$, $C$, $EdDSA_c(D)$ 985 \end{enumerate} 986 \end{minipage} 987 \begin{minipage}{6cm} 988 \begin{tikzpicture} 989 \tikzstyle{def} = [node distance=2em and 0.4em, inner sep=0em, outer sep=.3em]; 990 \node (proposal) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{merchant_propose.pdf}}; 991 \node (contract) [def, draw=none, below right=of cart]{\includegraphics[width=0.3\textwidth]{contract.pdf}}; 992 \node (c) [def, draw=none, above=of contract] {$c$}; 993 \node (merchant) [node distance=4em and 0.5em, draw, below=of contract]{Merchant}; 994 \node (coin) [def, draw=none, right=of contract]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 995 \tikzstyle{C} = [color=black, line width=1pt] 996 997 \draw [<-, C] (contract) -- (c) node [midway, above, sloped] (TextNode) {}; 998 \draw [<-, C] (contract) -- (proposal) node [midway, above, sloped] (TextNode) {}; 999 \draw [<-, C] (merchant) -- (contract) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1000 \draw [<-, C] (merchant) -- (coin) node [midway, below, sloped] (TextNode) {{\small transmit}}; 1001 \end{tikzpicture} 1002 \end{minipage} 1003 \end{frame} 1004 1005 1006 \begin{frame}<1-| handout:0>{Merchant and Exchange: Verify coin (RSA)} 1007 \begin{minipage}{6cm} 1008 \begin{equation*} 1009 s^e \stackrel{?}{\equiv} FDH(C) \mod n 1010 \end{equation*} 1011 \end{minipage} 1012 \begin{minipage}{6cm} 1013 \begin{minipage}{0.2\textwidth} 1014 \includegraphics[width=\textwidth]{coin.pdf} 1015 \end{minipage} 1016 $\stackrel{?}{\Leftrightarrow}$ 1017 \begin{minipage}{0.2\textwidth} 1018 \includegraphics[width=\textwidth]{seal.pdf} 1019 \end{minipage} 1020 \end{minipage} 1021 \vfill 1022 The exchange does not only verify the signature, but also 1023 checks that the coin was not double-spent. 1024 \vfill 1025 \pause 1026 \begin{center} 1027 {\bf This step requires communication with the exchange.} 1028 \end{center} 1029 \vfill 1030 \end{frame} 1031 1032 1033 \begin{frame}{Payment processing with Taler} 1034 \begin{center} 1035 \includegraphics[height=0.9\textheight]{figs/taler-pay.pdf} 1036 \end{center} 1037 \end{frame} 1038 1039 1040 \section{Giving Change} 1041 1042 \begin{frame} 1043 \vfill 1044 \begin{center} 1045 {\bf Part IV: Giving Change} 1046 \end{center} 1047 \vfill 1048 \end{frame} 1049 1050 1051 \begin{frame}{Giving change} 1052 It would be inefficient to pay EUR 100 with 1 cent coins! 1053 \begin{itemize} 1054 \item Denomination key represents value of a coin. 1055 \item Exchange may offer various denominations for coins. 1056 \item Wallet may not have exact change! 1057 \item Usability requires ability to pay given sufficient total funds. 1058 \end{itemize}\pause 1059 Key goals: 1060 \begin{itemize} 1061 \item maintain unlinkability 1062 \item maintain taxability of transactions 1063 \end{itemize}\pause 1064 Method: 1065 \begin{itemize} 1066 \item Contract can specify to only pay {\em partial value} of a coin. 1067 \item Exchange allows wallet to obtain {\em unlinkable change} 1068 for remaining coin value. 1069 \end{itemize} 1070 \end{frame} 1071 1072 1073 \begin{frame}<1-| handout:0>{Diffie-Hellman (ECDH)} 1074 \begin{minipage}{8cm} 1075 \begin{enumerate} 1076 \item Create private keys $c,t \mod o$ 1077 \item Define $C = cG$ 1078 \item Define $T = tG$ 1079 \item Compute DH \\ $cT = c(tG) = t(cG) = tC$ 1080 \end{enumerate} 1081 \end{minipage} 1082 \begin{minipage}{6cm} 1083 \begin{tikzpicture} 1084 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1085 \node (t) [def, draw=none] at (0,0) {$t$}; 1086 \node (ct) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{dh.pdf}}; 1087 \node (c) [def, draw=none, above left= of ct] {$c$}; 1088 \tikzstyle{C} = [color=black, line width=1pt] 1089 1090 \draw [<-, C] (ct) -- (c) node [midway, above, sloped] (TextNode) {}; 1091 \draw [<-, C] (ct) -- (t) node [midway, above, sloped] (TextNode) {}; 1092 \end{tikzpicture} 1093 \end{minipage} 1094 \end{frame} 1095 1096 1097 \begin{frame}<1-| handout:0>{Strawman solution} 1098 \begin{minipage}{8cm} 1099 Given partially spent private coin key $c_{old}$: 1100 \begin{enumerate} 1101 % \item Let $C_{old} := c_{old}G$ (as before) 1102 \item Pick random $c_{new} \mod o$ private key 1103 \item $C_{new} = c_{new}G$ public key 1104 \item Pick random $b_{new}$ 1105 \item Compute $f_{new} := FDH(C_{new})$, $m < n$. 1106 \item Transmit $f'_{new} := f_{new} b_{new}^e \mod n$ 1107 \end{enumerate} 1108 ... and sign request for change with $c_{old}$. 1109 \end{minipage} 1110 \begin{minipage}{4cm} 1111 \begin{tikzpicture} 1112 \tikzstyle{def} = [node distance= 1.5em and 0.45em, inner sep=0em, outer sep=.3em]; 1113 \node (blinded) [def, draw=none]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1114 \node (planchet) [def, draw=none, above left= of blinded] {\includegraphics[width=0.15\textwidth]{planchet.pdf}}; 1115 \node (cnew) [def, draw=none, above= of planchet] {$c_{new}$}; 1116 \node (bnew) [def, draw=none, above right= of blinded] {$b_{new}$}; 1117 \node (dice1) [def, draw=none, above = of cnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1118 \node (dice2) [def, draw=none, above = of bnew]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1119 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1120 1121 \tikzstyle{C} = [color=black, line width=1pt] 1122 1123 \draw [<-, C] (cnew) -- (dice1) node [midway, above, sloped] (TextNode) {}; 1124 \draw [<-, C] (planchet) -- (cnew) node [midway, above, sloped] (TextNode) {}; 1125 \draw [<-, C] (bnew) -- (dice2) node [midway, above, sloped] (TextNode) {}; 1126 \draw [<-, C] (blinded) -- (planchet) node [midway, above, sloped] (TextNode) {}; 1127 \draw [<-, C] (blinded) -- (bnew) node [midway, above, sloped] (TextNode) {}; 1128 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1129 \end{tikzpicture} 1130 \end{minipage} 1131 \pause 1132 \vfill 1133 {\bf Problem: Owner of $c_{new}$ may differ from owner of $c_{old}$!} 1134 \end{frame} 1135 1136 1137 \begin{frame}<1-| handout:0>{Customer: Transfer key setup (ECDH)} 1138 \begin{minipage}{8cm} 1139 Given partially spent private coin key $c_{old}$: 1140 \begin{enumerate} 1141 \item Let $C_{old} := c_{old}G$ (as before) 1142 \item Create random private transfer key $t \mod o$ 1143 \item Compute $T := tG$ 1144 \item Compute $X := c_{old}(tG) = t(c_{old}G) = tC_{old}$ 1145 \item Derive $c_{new}$ and $b_{new}$ from $X$ 1146 \item Compute $C_{new} := c_{new}G$ 1147 \item Compute $f_{new} := FDH(C_{new})$ 1148 \item Transmit $f_{new}' := f_{new} b_{new}^e$ 1149 \end{enumerate} 1150 \end{minipage} 1151 \begin{minipage}{4cm} 1152 \begin{tikzpicture} 1153 \tikzstyle{def} = [node distance= 1.4em and 0.45em, inner sep=0em, outer sep=.3em]; 1154 \node (t) [def, draw=none] at (0,0) {$t$}; 1155 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1156 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1157 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1158 \node (cp) [def, draw=none, below left= of dh] {$c_{new}$}; 1159 \node (bp) [def, draw=none, below right= of dh] {$b_{new}$}; 1160 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1161 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1162 1163 \tikzstyle{C} = [color=black, line width=1pt] 1164 1165 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1166 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1167 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1168 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1169 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1170 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1171 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1172 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1173 \end{tikzpicture} 1174 \end{minipage} 1175 \end{frame} 1176 1177 1178 \begin{frame}<1-| handout:0>{Cut-and-Choose} 1179 \begin{minipage}{4cm} 1180 \begin{tikzpicture} 1181 \tikzstyle{def} = [node distance= 1.4em and 0.45em, inner sep=0em, outer sep=.3em]; 1182 \node (t) [def, draw=none] at (0,0) {$t_1$}; 1183 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1184 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1185 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1186 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1187 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1188 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1189 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1190 1191 \tikzstyle{C} = [color=black, line width=1pt] 1192 1193 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1194 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1195 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1196 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1197 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1198 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1199 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1200 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1201 \end{tikzpicture} 1202 \end{minipage} 1203 \begin{minipage}{4cm} 1204 \begin{tikzpicture} 1205 \tikzstyle{def} = [node distance= 1.4em and 0.45em, inner sep=0em, outer sep=.3em]; 1206 \node (t) [def, draw=none] at (0,0) {$t_2$}; 1207 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1208 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1209 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1210 \node (cp) [def, draw=none, below left= of dh] {$c_{new,2}$}; 1211 \node (bp) [def, draw=none, below right= of dh] {$b_{new,2}$}; 1212 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1213 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1214 1215 \tikzstyle{C} = [color=black, line width=1pt] 1216 1217 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1218 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1219 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1220 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1221 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1222 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1223 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1224 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1225 \end{tikzpicture} 1226 \end{minipage} 1227 \begin{minipage}{4cm} 1228 \begin{tikzpicture} 1229 \tikzstyle{def} = [node distance= 1.4em and 0.45em, inner sep=0em, outer sep=.3em]; 1230 \node (t) [def, draw=none] at (0,0) {$t_3$}; 1231 \node (dice) [def, draw=none, above = of t]{\includegraphics[width=0.2\textwidth]{dice.pdf}}; 1232 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1233 \node (d) [def, draw=none, above left= of dh] {$c_{old}$}; 1234 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1235 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1236 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1237 \node (exchange) [node distance=4em and 0.5em, draw, below =of blinded]{Exchange}; 1238 1239 \tikzstyle{C} = [color=black, line width=1pt] 1240 1241 \draw [<-, C] (t) -- (dice) node [midway, above, sloped] (TextNode) {}; 1242 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1243 \draw [<-, C] (dh) -- (t) node [midway, above, sloped] (TextNode) {}; 1244 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1245 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1246 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1247 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1248 \draw [<-, C] (exchange) -- (blinded) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1249 \end{tikzpicture} 1250 \end{minipage} 1251 \end{frame} 1252 1253 1254 \begin{frame}<1-| handout:0>{Exchange: Choose!} 1255 \begin{center} 1256 \item Exchange sends back random $\gamma \in \{ 1, 2, 3 \}$ to the customer. 1257 \end{center} 1258 \end{frame} 1259 1260 1261 \begin{frame}<1-| handout:0>{Customer: Reveal} 1262 \begin{enumerate} 1263 \item If $\gamma = 1$, send $t_2$, $t_3$ to exchange 1264 \item If $\gamma = 2$, send $t_1$, $t_3$ to exchange 1265 \item If $\gamma = 3$, send $t_1$, $t_2$ to exchange 1266 \end{enumerate} 1267 \end{frame} 1268 1269 1270 \begin{frame}<1-| handout:0>{Exchange: Verify ($\gamma = 2$)} 1271 \begin{minipage}{4cm} 1272 \begin{tikzpicture} 1273 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1274 \node (h) [def, draw=none] at (0,0) {$t_1$}; 1275 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1276 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1277 \node (cp) [def, draw=none, below left= of dh] {$c_{new,1}$}; 1278 \node (bp) [def, draw=none, below right= of dh] {$b_{new,1}$}; 1279 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1280 1281 \tikzstyle{C} = [color=black, line width=1pt] 1282 1283 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1284 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1285 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1286 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1287 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1288 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1289 \end{tikzpicture} 1290 \end{minipage} 1291 \begin{minipage}{4cm} 1292 \ 1293 \end{minipage} 1294 \begin{minipage}{4cm} 1295 \begin{tikzpicture} 1296 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1297 \node (h) [def, draw=none] at (0,0) {$t_3$}; 1298 \node (dh) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1299 \node (d) [def, draw=none, above left= of dh] {$C_{old}$}; 1300 \node (cp) [def, draw=none, below left= of dh] {$c_{new,3}$}; 1301 \node (bp) [def, draw=none, below right= of dh] {$b_{new,3}$}; 1302 \node (blinded) [def, draw=none, below right=of cp]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1303 1304 \tikzstyle{C} = [color=black, line width=1pt] 1305 1306 \draw [<-, C] (dh) -- (d) node [midway, above, sloped] (TextNode) {}; 1307 \draw [<-, C] (dh) -- (h) node [midway, above, sloped] (TextNode) {}; 1308 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1309 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1310 \draw [<-, C] (blinded) -- (cp) node [midway, above, sloped] (TextNode) {}; 1311 \draw [<-, C] (blinded) -- (bp) node [midway, above, sloped] (TextNode) {}; 1312 \end{tikzpicture} 1313 \end{minipage} 1314 \end{frame} 1315 1316 1317 \begin{frame}<1-| handout:0>{Exchange: Blind sign change (RSA)} 1318 \begin{minipage}{6cm} 1319 \begin{enumerate} 1320 \item Take $f_{new,\gamma}'$. 1321 \item Compute $s' := f_{new,\gamma}'^d \mod n$. 1322 \item Send signature $s'$. 1323 \end{enumerate} 1324 \end{minipage} 1325 \begin{minipage}{6cm} 1326 \begin{tikzpicture} 1327 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1328 \node (hammer) [def, draw=none] at (0,0) {\includegraphics[width=0.15\textwidth]{hammer.pdf}}; 1329 \node (signed) [def, draw=none, below left=of hammer]{\includegraphics[width=0.2\textwidth]{sign.pdf}}; 1330 \node (blinded) [def, draw=none, above left=of signed]{\includegraphics[width=0.15\textwidth]{blinded.pdf}}; 1331 \node (customer) [node distance=4em and 0.5em, draw, below =of signed]{Customer}; 1332 \tikzstyle{C} = [color=black, line width=1pt] 1333 1334 \draw [<-, C] (signed) -- (hammer) node [midway, above, sloped] (TextNode) {}; 1335 \draw [<-, C] (signed) -- (blinded) node [midway, above, sloped] (TextNode) {}; 1336 \draw [<-, C] (customer) -- (signed) node [midway, above, sloped] (TextNode) {{\small transmit}}; 1337 \end{tikzpicture} 1338 \end{minipage} 1339 \end{frame} 1340 1341 1342 \begin{frame}<1-| handout:0>{Customer: Unblind change (RSA)} 1343 \begin{minipage}{6cm} 1344 \begin{enumerate} 1345 \item Receive $s'$. 1346 \item Compute $s := s' b_{new,\gamma}^{-1} \mod n$. 1347 \end{enumerate} 1348 \end{minipage} 1349 \begin{minipage}{6cm} 1350 \begin{tikzpicture} 1351 \tikzstyle{def} = [node distance= 2em and 0.5em, inner sep=0em, outer sep=.3em]; 1352 \node (b) [def, draw=none] at (0,0) {$b_{new,\gamma}$}; 1353 \node (coin) [def, draw=none, below left=of b]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1354 \node (signed) [def, draw=none, above left=of coin]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1355 \tikzstyle{C} = [color=black, line width=1pt] 1356 1357 \draw [<-, C] (coin) -- (b) node [midway, above, sloped] (TextNode) {}; 1358 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1359 \end{tikzpicture} 1360 \end{minipage} 1361 \end{frame} 1362 1363 1364 \begin{frame}<1-| handout:0>{Exchange: Allow linking change} 1365 \begin{minipage}{7cm} 1366 \begin{center} 1367 Given $C_{old}$ 1368 1369 \vspace{1cm} 1370 1371 return $T_\gamma$, $s := s' b_{new,\gamma}^{-1} \mod n$. 1372 \end{center} 1373 \end{minipage} 1374 \begin{minipage}{5cm} 1375 \begin{tikzpicture} 1376 \tikzstyle{def} = [node distance= 3em and 0.5em, inner sep=0.5em, outer sep=.3em]; 1377 \node (co) [def, draw=none] at (0,0) {$C_{old}$}; 1378 \node (T) [def, draw=none, below left=of co]{$T_\gamma$}; 1379 \node (sign) [def, draw=none, below right=of co]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1380 \node (customer) [def, draw, below right=of T] {Customer}; 1381 1382 \tikzstyle{C} = [color=black, line width=1pt] 1383 1384 \draw [<-, C] (T) -- (co) node [midway, above, sloped] (TextNode) {}; 1385 \draw [<-, C] (sign) -- (co) node [midway, above, sloped] (TextNode) {}; 1386 \draw [<-, C] (customer) -- (T) node [midway, above, sloped] (TextNode) {link}; 1387 \draw [<-, C] (customer) -- (sign) node [midway, above, sloped] (TextNode) {link}; 1388 \end{tikzpicture} 1389 \end{minipage} 1390 \end{frame} 1391 1392 1393 \begin{frame}<1-| handout:0>{Customer: Link (threat!)} 1394 \begin{minipage}{6.3cm} 1395 \begin{enumerate} 1396 \item Have $c_{old}$. 1397 \item Obtain $T_\gamma$, $s$ from exchange 1398 \item Compute $X_\gamma = c_{old}T_\gamma$ 1399 \item Derive $c_{new,\gamma}$ and $b_{new,\gamma}$ from $X_\gamma$ 1400 \item Unblind $s := s' b_{new,\gamma}^{-1} \mod n$ 1401 \end{enumerate} 1402 1403 \end{minipage} 1404 \begin{minipage}{5.7cm} 1405 \begin{tikzpicture} 1406 \tikzstyle{def} = [node distance= 1.5em and 0.5em, inner sep=0em, outer sep=.3em]; 1407 \node (T) [def, draw=none] at (0,0) {$T_\gamma$}; 1408 \node (exchange) [def, inner sep=0.5em, draw, above left=of T] {Exchange}; 1409 \node (signed) [def, draw=none, below left=of T]{\includegraphics[width=0.15\textwidth]{sign.pdf}}; 1410 \node (dh) [def, draw=none, below right=of T]{\includegraphics[width=0.2\textwidth]{ct.pdf}}; 1411 \node (bp) [def, draw=none, below left= of dh] {$b_{new,\gamma}$}; 1412 \node (co) [def, draw=none, above right= of dh] {$c_{old}$}; 1413 \node (cp) [def, draw=none, below= of dh] {$c_{new,\gamma}$}; 1414 \node (coin) [def, draw=none, below left = of bp]{\includegraphics[width=0.2\textwidth]{coin.pdf}}; 1415 \node (psign) [def, node distance=2.5em and 0em, draw=none, below = of cp]{\includegraphics[width=0.2\textwidth]{planchet-sign.pdf}}; 1416 1417 \tikzstyle{C} = [color=black, line width=1pt] 1418 1419 \draw [<-, C] (dh) -- (co) node [midway, above, sloped] (TextNode) {}; 1420 \draw [<-, C] (dh) -- (T) node [midway, above, sloped] (TextNode) {}; 1421 \draw [<-, C] (cp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1422 \draw [<-, C] (bp) -- (dh) node [midway, above, sloped] (TextNode) {}; 1423 \draw [<-, C] (coin) -- (signed) node [midway, above, sloped] (TextNode) {}; 1424 \draw [<-, C] (coin) -- (bp) node [midway, above, sloped] (TextNode) {}; 1425 \draw [<-, C] (T) -- (exchange) node [midway, above, sloped] (TextNode) {link}; 1426 \draw [<-, C] (signed) -- (exchange) node [midway, below, sloped] (TextNode) {link}; 1427 \draw [<-, C, double] (psign) -- (cp) node [midway, below, sloped] (TextNode) {}; 1428 \end{tikzpicture} 1429 \end{minipage} 1430 \end{frame} 1431 1432 1433 \begin{frame}{Refresh protocol properties} 1434 \begin{itemize} 1435 \item Customer asks exchange to convert old coin to new coin 1436 \item Protocol ensures new coins can be recovered from old coin 1437 \item[$\Rightarrow$] New coins are owned by the same entity! 1438 \end{itemize} 1439 Thus, the refresh protocol allows: 1440 \begin{itemize} 1441 \item To give unlinkable change. 1442 \item To give refunds to an anonymous customer. 1443 \item To expire old keys and migrate coins to new ones. 1444 \item To handle protocol aborts. 1445 \end{itemize} 1446 \noindent 1447 % \begin{center} 1448 % { \bf Transactions via refresh are equivalent to {\em sharing} a wallet.} 1449 % \end{center} 1450 \end{frame} 1451 1452 1453 \section{Illustration of Programmable Money: Age Restrictions} 1454 1455 \begin{frame} 1456 \vfill 1457 \begin{center} 1458 \vfill 1459 {\bf Part V:} 1460 \vfill 1461 {\bf Illustration of Programmable Money} 1462 \vfill 1463 {\bf Zero-knowledge Age Restrictions} 1464 \vfill 1465 \end{center} 1466 \vfill 1467 \end{frame} 1468 1469 1470 \begin{frame}{Age restriction in e-commerce} 1471 1472 \begin{description} 1473 \item[Problem:]~\\[1em] 1474 Verification of minimum age requirements in e-commerce.\\[2em] 1475 1476 \item[Common solutions:] 1477 1478 \begin{tabular}{l<{\onslide<2->}c<{\onslide<3->}cr<{\onslide}} 1479 & \blue{Privacy} & \tikzmark{topau} \blue{Ext. authority}& \\[\medskipamount] 1480 1. ID Verification & bad & required & \\[\medskipamount] 1481 2. Restricted Accounts & bad & required & \\[\medskipamount] 1482 3. Attribute-based & good & required &\tikzmark{bottomau} \\[\medskipamount] 1483 \end{tabular} 1484 \end{description} 1485 1486 \uncover<4->{ 1487 \begin{tikzpicture}[overlay,remember picture] 1488 \draw[orange,thick,rounded corners] 1489 ($(pic cs:topau) +(0,0.5)$) rectangle ($(pic cs:bottomau) -(0.3, 0.2)$); 1490 \end{tikzpicture} 1491 \begin{center} 1492 \bf Principle of subsidiarity is violated 1493 \end{center} 1494 } 1495 \end{frame} 1496 1497 1498 \begin{frame}<1-| handout:0>{Principle of Subsidiarity} 1499 \begin{center} \Large 1500 Functions of government---such as granting and restricting 1501 rights---should be performed\\ 1502 {\it at the lowest level of authority possible},\\ 1503 as long as they can be performed {\it adequately}. 1504 \end{center} 1505 \vfill 1506 \uncover<2->{ 1507 For age-restriction, the lowest level of authority is:\\ 1508 \begin{center}\Large 1509 Parents, guardians and caretakers 1510 \end{center} 1511 } 1512 \end{frame} 1513 1514 1515 \begin{frame}{Age restriction design for GNU Taler} 1516 Design and implementation of an age restriction scheme\\ 1517 with the following goals: 1518 1519 \begin{enumerate} 1520 \item It ties age restriction to the \textbf{ability to pay} (not to ID's) 1521 \item maintains \textbf{anonymity of buyers} 1522 \item maintains \textbf{unlinkability of transactions} 1523 \item aligns with \textbf{principle of subsidiarity} 1524 \item is \textbf{practical and efficient} 1525 \end{enumerate} 1526 1527 \end{frame} 1528 1529 1530 \begin{frame}{Age restriction} 1531 \framesubtitle{Assumptions and scenario} 1532 1533 \begin{columns} 1534 \column{7.5cm} 1535 \begin{itemize} 1536 \item<1-> Assumption: Checking accounts are under control of eligible adults/guardians. 1537 \item<2-> \textit{Guardians} \textbf{commit} to an maximum age 1538 \item<3-> \textit{Minors} \textbf{attest} their adequate age 1539 \item<4-> \textit{Merchants} \textbf{verify} the attestations 1540 \item<5-> Minors \textbf{derive} age commitments from existing ones 1541 \item<6-> \textit{Exchanges} \textbf{compare} the derived age commitments 1542 \end{itemize} 1543 \column{5cm} 1544 \uncover<7-> 1545 { 1546 \begin{center} 1547 \fontsize{7pt}{7pt}\selectfont 1548 \begin{tikzpicture}[scale=.5] 1549 \node[circle,minimum size=15pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 1550 \node[circle,minimum size=15pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 1551 \node[circle,minimum size=15pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 1552 \node[circle,minimum size=15pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 1553 1554 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 1555 {$\Commit$} (Guardian); 1556 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 1557 {\blue{$\Attest$}} (Client); 1558 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 1559 {\blue{$\Verify$}} (Merchant); 1560 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 1561 {\orange{$\Derive$}} (Client); 1562 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 1563 {\orange{$\Compare$}} (Exchange); 1564 1565 \draw[orange,|->] (Client) to node[sloped,above,align=left] 1566 {\orange{\scriptsize }} (Exchange); 1567 \draw[blue,|->] (Client) to node[sloped, above] 1568 {\blue{\scriptsize }} (Merchant); 1569 \draw[,|->] (Guardian) to node[above,sloped,align=left] 1570 {{\scriptsize }} (Client); 1571 \end{tikzpicture} 1572 \end{center} 1573 } 1574 \end{columns} 1575 \vfill 1576 % \uncover<7->{Note: Scheme is independent of payment service protocol.} 1577 \end{frame} 1578 1579 1580 \begin{frame}<1-| handout:0>{Formal Function Signatures} 1581 \small 1582 Searching for functions \uncover<2->{with the following signatures} 1583 \begin{align*} 1584 &\bf \Commit\uncover<2->{: 1585 &(\age, \omega) &\mapsto (\commitment, \pruf) 1586 &\scriptstyle \N_\Age \times \Omega &\scriptstyle \to \Commitments\times\Proofs, 1587 } 1588 \\ 1589 &\bf \Attest\uncover<3->{: 1590 &(\minage, \commitment, \pruf) &\mapsto \attest 1591 &\scriptstyle \N_\Age\times\Commitments\times\Proofs &\scriptstyle \to \Attests \cup \{\Nil\}, 1592 } 1593 \\ 1594 &\bf \Verify\uncover<4->{: 1595 &(\minage, \commitment, \attest) &\mapsto b 1596 &\scriptstyle \N_\Age\times\Commitments\times\Attests &\scriptstyle \to \Z_2, 1597 } 1598 \\ 1599 &\bf \Derive\uncover<5->{: 1600 &(\commitment, \pruf, \omega) &\mapsto (\commitment', \pruf', \blinding) 1601 &\scriptstyle \Commitments\times\Proofs\times\Omega &\scriptstyle \to \Commitments\times\Proofs\times\Blindings, 1602 } 1603 \\ 1604 &\bf \Compare\uncover<6->{: 1605 &(\commitment, \commitment', \blinding) &\mapsto b 1606 &\scriptstyle \Commitments\times\Commitments\times\Blindings &\scriptstyle \to \Z_2, 1607 } 1608 \end{align*} 1609 \uncover<7->{ 1610 with $\Omega, \Proofs, \Commitments, \Attests, \Blindings$ 1611 sufficiently large sets.\\[1em] 1612 Basic and security requirements are defined later.\\[2em] 1613 } 1614 1615 \scriptsize 1616 \uncover<2->{ 1617 Mnemonics:\\ 1618 $\Commitments=$ \textit{c$\Commitments$mmitments}, 1619 $\commitment=$ \textit{Q-mitment} (commitment), 1620 $\Proofs=$ \textit{$\Proofs$roofs}, 1621 } 1622 \uncover<3->{ 1623 $\pruf=$ \textit{$\pruf$roof},\\ 1624 $\Attests=$ \textit{a$\Attests$testations}, 1625 $\attest=$ \textit{a$\attest$testation}, 1626 } 1627 \uncover<5->{ 1628 $\Blindings=$ \textit{$\Blindings$lindings}, 1629 $\blinding=$ \textit{$\blinding$linding}. 1630 } 1631 \end{frame} 1632 1633 \begin{frame}<1-| handout:0>{Age restriction} 1634 \framesubtitle{Naïve scheme} 1635 \begin{center} 1636 \begin{tikzpicture}[scale=.85] 1637 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 1638 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 1639 \node[circle,minimum size=20pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 1640 \node[circle,minimum size=20pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 1641 1642 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 1643 {$\Commit$} (Guardian); 1644 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 1645 {\blue{$\Attest$}} (Client); 1646 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 1647 {\blue{$\Verify$}} (Merchant); 1648 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 1649 {\orange{$\Derive$}} (Client); 1650 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 1651 {\orange{$\Compare$}} (Exchange); 1652 1653 \draw[orange,|->] (Client) to node[sloped,above,align=left] 1654 {\orange{\scriptsize }} (Exchange); 1655 \draw[blue,|->] (Client) to node[sloped, above] 1656 {\blue{\scriptsize }} (Merchant); 1657 \draw[,|->] (Guardian) to node[above,sloped,align=left] 1658 {{\scriptsize }} (Client); 1659 \end{tikzpicture} 1660 \end{center} 1661 \end{frame} 1662 1663 \begin{frame}<1-| handout:0>{Achieving Unlinkability} 1664 \begin{columns} 1665 \column{3cm} 1666 \begin{center} 1667 \fontsize{8pt}{9pt}\selectfont 1668 \begin{tikzpicture}[scale=.65] 1669 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 1670 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 1671 1672 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 1673 {\orange{$\footnotesize \Derive()$}} (Client); 1674 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 1675 {\orange{$\footnotesize \Compare()$}} (Exchange); 1676 1677 \draw[orange,|->] (Client) to node[sloped,above,align=left] 1678 {\orange{\tiny \uncover<2->{$(\commitment_i,\commitment_{i+1})$}}} (Exchange); 1679 \end{tikzpicture} 1680 \end{center} 1681 1682 \column{9cm} 1683 Simple use of $\Derive()$ and $\Compare()$ is problematic. 1684 1685 \begin{itemize} 1686 \item<2-> Calling $\Derive()$ iteratively generates sequence 1687 $(\commitment_0, \commitment_1, \dots)$ of commitments. 1688 \item<2-> Exchange calls $\Compare(\commitment_i, \commitment_{i+1}, .)$ 1689 \item[$\implies$]\uncover<3->{\bf Exchange identifies sequence} 1690 \item[$\implies$]\uncover<3->{\bf Unlinkability broken} 1691 \end{itemize} 1692 \end{columns} 1693 \end{frame} 1694 1695 \begin{frame}<1-| handout:0>{Achieving Unlinkability} 1696 Define cut\&choose protocol \orange{$\DeriveCompare$}, 1697 using $\Derive()$ and $\Compare()$.\\[0.5em] 1698 \uncover<2->{ 1699 Sketch: 1700 \small 1701 \begin{enumerate} 1702 \item $\Child$ derives commitments $(\commitment_1,\dots,\commitment_\kappa)$ 1703 from $\commitment_0$ \\ 1704 by calling $\Derive()$ with blindings $(\beta_1,\dots,\beta_\kappa)$ 1705 \item $\Child$ calculates $h_0:=H\left(H(\commitment_1, \beta_1)||\dots||H(\commitment_\kappa, \beta_\kappa)\right)$ 1706 \item $\Child$ sends $\commitment_0$ and $h_0$ to $\Exchange$ 1707 \item $\Exchange$ chooses $\gamma \in \{1,\dots,\kappa\}$ randomly 1708 \item $\Child$ reveals $h_\gamma:=H(\commitment_\gamma, \beta_\gamma)$ and all $(\commitment_i, \beta_i)$, except $(\commitment_\gamma, \beta_\gamma)$ 1709 \item $\Exchange$ compares $h_0$ and 1710 $H\left(H(\commitment_1, \beta_1)||...||h_\gamma||...||H(\commitment_\kappa, \beta_\kappa)\right)$\\ 1711 and evaluates $\Compare(\commitment_0, \commitment_i, \beta_i)$. 1712 \end{enumerate} 1713 \vfill 1714 Note: Scheme is similar to the {\it refresh} protocol in GNU Taler. 1715 } 1716 \end{frame} 1717 1718 \begin{frame}<1-| handout:0>{Achieving Unlinkability} 1719 With \orange{$\DeriveCompare$} 1720 \begin{itemize} 1721 \item $\Exchange$ learns nothing about $\commitment_\gamma$, 1722 \item trusts outcome with $\frac{\kappa-1}{\kappa}$ certainty, 1723 \item i.e. $\Child$ has $\frac{1}{\kappa}$ chance to cheat. 1724 \end{itemize} 1725 \vfill 1726 Note: Still need Derive and Compare to be defined. 1727 \end{frame} 1728 1729 \begin{frame}<1-| handout:0>{Refined scheme} 1730 1731 \begin{tikzpicture}[scale=.8] 1732 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 1733 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 1734 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 1735 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 1736 1737 \draw[orange,<->] (Client) to node[sloped,below,align=center] 1738 {\orange{$\DeriveCompare$}} (Exchange); 1739 \draw[blue,->] (Client) to node[sloped, below] 1740 {\blue{$(\attest_\minage, \commitment)$}} (Merchant); 1741 1742 \draw[->] (Guardian) to [out=150,in=70, loop] node[above] 1743 {$\Commit(\age)$} (Guardian); 1744 \draw[->] (Guardian) to node[below,sloped] 1745 {($\commitment$, $\pruf_\age$)} (Client); 1746 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 1747 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 1748 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 1749 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 1750 \end{tikzpicture} 1751 \end{frame} 1752 1753 % \begin{frame}{Achieving Unlinkability} 1754 % \scriptsize 1755 % $\DeriveCompare : \Commitments\times\Proofs\times\Omega \to \{0,1\}$\\ 1756 % \vfill 1757 % $\DeriveCompare(\commitment, \pruf, \omega) =$ 1758 % \begin{itemize} 1759 % \it 1760 % \itemsep0.5em 1761 % \item[$\Child$:] 1762 % \begin{enumerate} 1763 % \scriptsize 1764 % \itemsep0.3em 1765 % \item for all $i \in \{1,\dots,\kappa\}: 1766 % (\commitment_i,\pruf_i,\beta_i) \leftarrow \Derive(\commitment, \pruf, \omega + i)$ 1767 % \item $h \leftarrow \Hash\big(\Hash(\commitment_1,\beta_1)\parallel\dots\parallel\Hash(\commitment_\kappa,\beta_\kappa) \big)$ 1768 % \item send $(\commitment, h)$ to $\Exchange$ 1769 % \end{enumerate} 1770 % \item[$\Exchange$:] 1771 % \begin{enumerate} 1772 % \setcounter{enumi}{4} 1773 % \scriptsize 1774 % \itemsep0.3em 1775 % \item save $(\commitment, h)$ \label{st:hash} 1776 % \item $\gamma \drawfrom \{1,\dots ,\kappa\}$ 1777 % \item send $\gamma$ to $\Child$ 1778 % \end{enumerate} 1779 % \item[$\Child$:] 1780 % \begin{enumerate} 1781 % \setcounter{enumi}{7} 1782 % 1783 % \scriptsize 1784 % \itemsep0.3em 1785 % \item $h'_\gamma \leftarrow \Hash(\commitment_\gamma, \beta_\gamma)$ 1786 % \item $\mathbf{E}_\gamma \leftarrow \big[(\commitment_1,\beta_1),\dots, 1787 % (\commitment_{\gamma-1}, \beta_{\gamma-1}), 1788 % \Nil, 1789 % (\commitment_{\gamma+1}, \beta_{\gamma+1}), 1790 % \dots,(\commitment_\kappa, \beta_\kappa)\big]$ 1791 % \item send $(\mathbf{E}_\gamma, h'_\gamma)$ to $\Exchange$ 1792 % \end{enumerate} 1793 % \item[$\Exchange$:] 1794 % \begin{enumerate} 1795 % \setcounter{enumi}{10} 1796 % \scriptsize 1797 % \itemsep0.3em 1798 % \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}: h_i \leftarrow \Hash(\mathbf{E}_\gamma[i])$ 1799 % \item if $h \stackrel{?}{\neq} \HashF(h_1\|\dots\|h_{\gamma-1}\|h'_\gamma\|h_{\gamma+1}\|\dots\|h_{\kappa-1})$ return 0 1800 % \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}$: 1801 % if $0 \stackrel{?}{=} \Compare(\commitment,\commitment_i, \beta_i)$ return $0$ 1802 % \item return 1 1803 % \end{enumerate} 1804 % \end{itemize} 1805 % \end{frame} 1806 1807 \begin{frame}<1-| handout:0>{Basic Requirements} 1808 1809 Candidate functions 1810 \[ (\Commit, \Attest, \Verify, \Derive, \Compare) \] 1811 must first meet \textit{basic} requirements: 1812 1813 \begin{itemize} 1814 \item Existence of attestations 1815 \item Efficacy of attestations 1816 \item Derivability of commitments and attestations 1817 \end{itemize} 1818 \end{frame} 1819 1820 \begin{frame}<1-| handout:0>{Basic Requirements} 1821 \framesubtitle{Formal Details} 1822 1823 \begin{description} 1824 \item[Existence of attestations] 1825 {\scriptsize 1826 \begin{align*} 1827 \Forall_{\age\in\N_\Age \atop \omega \in \Omega}: 1828 \Commit(\age, \omega) =: (\commitment, \pruf) 1829 \implies 1830 \Attest(\minage, \commitment, \pruf) = 1831 \begin{cases} 1832 \attest \in \Attests, \text{ if } \minage \leq \age\\ 1833 \Nil \text{ otherwise} 1834 \end{cases} 1835 \end{align*}} 1836 \item[Efficacy of attestations] 1837 {\scriptsize 1838 \begin{align*} 1839 \Verify(\minage, \commitment, \attest) = \ 1840 \begin{cases} 1841 1, \text{if } \Exists_{\pruf \in \Proofs}: \Attest(\minage, \commitment, \pruf) = \attest\\ 1842 0 \text{ otherwise} 1843 \end{cases} 1844 \end{align*}} 1845 1846 {\scriptsize 1847 \begin{align*} 1848 \forall_{n \leq \age}: \Verify\big(n, \commitment, \Attest(n, \commitment, \pruf)\big) = 1. 1849 \end{align*}} 1850 \item[etc.] 1851 \end{description} 1852 \end{frame} 1853 1854 %\begin{frame}{Requirements} 1855 % \framesubtitle{Details} 1856 % 1857 % \begin{description} 1858 % \item[Derivability of commitments and proofs:]~\\[0.1em] 1859 % {\scriptsize 1860 % Let \begin{align*} 1861 % \age & \in\N_\Age,\,\, \omega_0, \omega_1 \in\Omega\\ 1862 % (\commitment_0, \pruf_0) & \leftarrow \Commit(\age, \omega_0),\\ 1863 % (\commitment_1, \pruf_1, \blinding) & \leftarrow \Derive(\commitment_0, \pruf_0, \omega_1). 1864 % \end{align*} 1865 % We require 1866 % \begin{align*} 1867 % \Compare(\commitment_0, \commitment_1, \blinding) = 1 \label{req:comparity} 1868 % \end{align*} 1869 % and for all $n\leq\age$: 1870 % \begin{align*} 1871 % \Verify(n, \commitment_1, \Attest(n, \commitment_1, \pruf_1)) &% 1872 % = 1873 % \Verify(n, \commitment_0, \Attest(n, \commitment_0, \pruf_0)) 1874 % \end{align*}} 1875 % \end{description} 1876 %\end{frame} 1877 1878 \begin{frame}<1-| handout:0>{Security Requirements} 1879 Candidate functions must also meet \textit{security} requirements. 1880 Those are defined via security games: 1881 \begin{itemize} 1882 \item Game: Age disclosure by commitment or attestation 1883 \item[$\leftrightarrow$] Requirement: Non-disclosure of age 1884 \vfill 1885 1886 \item Game: Forging attestation 1887 \item[$\leftrightarrow$] Requirement: Unforgeability of 1888 minimum age 1889 \vfill 1890 1891 \item Game: Distinguishing derived commitments and attestations 1892 \item[$\leftrightarrow$] Requirement: Unlinkability of 1893 commitments and attestations 1894 1895 \end{itemize} 1896 \vfill 1897 1898 Meeting the security requirements means that adversaries can win 1899 those games only with negligible advantage. 1900 \vfill 1901 Adversaries are arbitrary polynomial-time algorithms, acting on all 1902 relevant input. 1903 \end{frame} 1904 1905 \begin{frame}<1-| handout:0>{Security Requirements} 1906 \framesubtitle{Simplified Example} 1907 1908 \begin{description} 1909 \item[Game $\Game{FA}(\lambda)$---Forging an attest:]~\\ 1910 {\small 1911 \begin{enumerate} 1912 \item $ (\age, \omega) \drawfrom \N_{\Age-1}\times\Omega $ 1913 \item $ (\commitment, \pruf) \leftarrow \Commit(\age, \omega) $ 1914 \item $ (\minage, \attest) \leftarrow \Adv(\age, \commitment, \pruf)$ 1915 \item Return 0 if $\minage \leq \age$ 1916 \item Return $\Verify(\minage,\commitment,\attest)$ 1917 \end{enumerate} 1918 } 1919 \vfill 1920 \item[Requirement: Unforgeability of minimum age] 1921 {\small 1922 \begin{equation*} 1923 \Forall_{\Adv\in\PPT(\N_\Age\times\Commitments\times\Proofs\to \N_\Age\times\Attests)}: 1924 \Probability\Big[\Game{FA}(\lambda) = 1\Big] \le \negl(\lambda) 1925 \end{equation*} 1926 } 1927 \end{description} 1928 \end{frame} 1929 1930 1931 \begin{frame}<1-| handout:0>{Solution: Instantiation with ECDSA} 1932 % \framesubtitle{Definition of Commit} 1933 1934 \begin{description} 1935 \item[To Commit to age (group) $\age \in \{1,\dots,\Age\}$]~\\ 1936 \begin{enumerate} 1937 \item<2-> Guardian generates ECDSA-keypairs, one per age (group): 1938 \[\langle(q_1, p_1),\dots,(q_\Age,p_\Age)\rangle\] 1939 \item<3-> Guardian then \textbf{drops} all private keys 1940 $p_i$ for $i > \age$: 1941 \[\Big \langle(q_1, p_1),\dots, 1942 (q_\age, p_\age), 1943 (q_{\age +1}, \red{\Nil}),\dots, 1944 (q_\Age, \red{\Nil})\Big\rangle\] 1945 1946 \begin{itemize} 1947 \item $\Vcommitment := (q_1, \dots, q_\Age)$ is the \textit{Commitment}, 1948 \item $\Vpruf_\age := (p_1, \dots, p_\age, \Nil,\dots,\Nil)$ is the \textit{Proof} 1949 \end{itemize} 1950 \vfill 1951 \item<4-> Guardian gives child $\langle \Vcommitment, \Vpruf_\age \rangle$ 1952 \vfill 1953 \end{enumerate} 1954 \end{description} 1955 \end{frame} 1956 1957 \begin{frame}<1-| handout:0>{Instantiation with ECDSA} 1958 \framesubtitle{Definitions of Attest and Verify} 1959 1960 Child has 1961 \begin{itemize} 1962 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $, 1963 \item (some) private-keys $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 1964 \end{itemize} 1965 \begin{description} 1966 \item<2->[To \blue{Attest} a minimum age $\blue{\minage} \leq \age$:]~\\ 1967 Sign a message with ECDSA using private key $p_\blue{\minage}$ 1968 \end{description} 1969 1970 \vfill 1971 1972 \uncover<3->{ 1973 Merchant gets 1974 \begin{itemize} 1975 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $ 1976 \item Signature $\sigma$ 1977 \end{itemize} 1978 \begin{description} 1979 \item<4->[To \blue{Verify} a minimum age $\minage$:]~\\ 1980 Verify the ECDSA-Signature $\sigma$ with public key $q_\minage$. 1981 \end{description} 1982 } 1983 \vfill 1984 \end{frame} 1985 1986 \begin{frame}<1-| handout:0>{Instantiation with ECDSA} 1987 \framesubtitle{Definitions of Derive and Compare} 1988 Child has 1989 $\Vcommitment = (q_1, \dots, q_\Age) $ and 1990 $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 1991 \begin{description} 1992 \item<2->[To \blue{Derive} new $\Vcommitment'$ and $\Vpruf'$:] 1993 Choose random $\beta\in\Z_g$ and calculate 1994 \small 1995 \begin{align*} 1996 \Vcommitment' &:= \big(\beta * q_1,\ldots,\beta * q_\Age\big),\\ 1997 \Vpruf' &:= \big(\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil\big) 1998 \end{align*} 1999 Note: $ (\beta p_i)*G = \beta*(p_i*G) = \beta*q_i$\\ 2000 \scriptsize $\beta*q_i$ is scalar multiplication on the elliptic curve. 2001 \end{description} 2002 2003 \vfill 2004 \uncover<3->{ 2005 Exchange gets $\Vcommitment = (q_1,\dots,q_\Age)$, $\Vcommitment' = (q_1', \dots, q_\Age')$ and $\beta$ 2006 \begin{description} 2007 \item[To \blue{Compare}, calculate:] 2008 \small 2009 $(\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)$ 2010 \end{description} 2011 \vfill 2012 } 2013 \end{frame} 2014 2015 \begin{frame}<1-| handout:0>{Instantiation with ECDSA} 2016 2017 Functions 2018 (Commit, Attest, Verify, Derive, Compare)\\ 2019 as defined in the instantiation with ECDSA\\[0.5em] 2020 \begin{itemize} 2021 \item meet the basic requirements,\\[0.5em] 2022 \item also meet all security requirements.\\ 2023 Proofs by security reduction, details are in the paper. 2024 \end{itemize} 2025 2026 \end{frame} 2027 2028 2029 % \begin{frame}{Instantiation with ECDSA} 2030 % \framesubtitle{Full definitions} 2031 % \scriptsize 2032 % 2033 % \begin{align*} 2034 % \Commit_{E,\FDHg{\cdot}}(\age, \omega) &:= \Big\langle 2035 % \overbrace{(q_1,\ldots,q_\Age)}^{= \Vcommitment},\; 2036 % \overbrace{(p_1,\ldots,p_\age, \Nil,\ldots,\Nil)}^{= \Vpruf \text{, length }\Age} 2037 % \Big\rangle\\ 2038 % \Attest_{E,\HashF}(\bage, \Vcommitment, \Vpruf) &:= 2039 % \begin{cases} 2040 % \attest_\bage := \Sign_{E,\HashF}\big(\bage,\Vpruf[\bage]\big) & \text{if } \Vpruf[\bage] \stackrel{?}{\neq} \Nil\\ 2041 % \Nil & \text{otherwise} 2042 % \end{cases}\\ 2043 % % 2044 % \Verify_{E,\HashF}(\bage, \Vcommitment, \attest) &:= \Ver_{E,\HashF}(\bage, \Vcommitment[\bage], \attest)\\ 2045 % % 2046 % \Derive_{E, \FDHg{\cdot}}(\Vcommitment, \Vpruf, \omega) &:= 2047 % \Big\langle(\beta * q_1,\ldots,\beta * q_\Age), 2048 % (\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil), \beta \Big\rangle \\ 2049 % & \text{ with } \beta := \FDHg{\omega} \text{ and multiplication } \beta p_i \text{ modulo } g \nonumber\\ 2050 % % 2051 % \Compare_E(\Vcommitment, \Vcommitment', \beta) &:= 2052 % \begin{cases} 2053 % 1 & \text{if } (\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)\\ 2054 % 0 & \text{otherwise} 2055 % \end{cases} 2056 % \end{align*} 2057 % \end{frame} 2058 2059 2060 \begin{frame}<1-| handout:0>{Reminder: GNU Taler Fundamentals} 2061 \begin{center} 2062 \begin{tikzpicture}[scale=.55] 2063 \node[circle,fill=black!10] at (3, 4) (Exchange) {$\Exchange$}; 2064 \node[circle,fill=black!10] at (0, 0) (Customer) {$\Customer$}; 2065 \node[circle,fill=black!10] at (6, 0) (Merchant) {$\Merchant$}; 2066 2067 \draw[<->] (Customer) to [out=65,in=220] node[sloped,above] {\sf withdraw} (Exchange); 2068 \draw[<->] (Customer) to [out=45,in=240] node[sloped,below] {\sf refresh} (Exchange); 2069 \draw[<->] (Customer) to node[sloped, below] {\sf purchase} (Merchant); 2070 \draw[<->] (Merchant) to node[sloped, above] {\sf deposit} (Exchange); 2071 \end{tikzpicture} 2072 \end{center} 2073 2074 \vfill 2075 \begin{itemize} 2076 \item Coins are public-/private key-pairs $(C_p, c_s)$. 2077 \item Exchange blindly signs $\FDH(C_p)$ with denomination key $d_p$ 2078 \item Verification: 2079 \begin{eqnarray*} 2080 1 &\stackrel{?}{=}& 2081 \mathsf{SigCheck}\big(\FDH(C_p), D_p, \sigma_p\big) 2082 \end{eqnarray*} 2083 \scriptsize($D_p$ = public key of denomination and $\sigma_p$ = signature) 2084 2085 \end{itemize} 2086 \end{frame} 2087 2088 \begin{frame}<1-| handout:0>{Integration with GNU Taler} 2089 \framesubtitle{Binding age restriction to coins} 2090 2091 To bind an age commitment $\commitment$ to a coin $C_p$, instead of 2092 signing $\FDH(C_p)$, $\Exchange$ now blindly signs 2093 \begin{center} 2094 $\FDH(C_p, \orange{H(\commitment)})$ 2095 \end{center} 2096 2097 \vfill 2098 Verfication of a coin now requires $H(\commitment)$, too: 2099 \begin{center} 2100 $1 \stackrel{?}{=} 2101 \mathsf{SigCheck}\big(\FDH(C_p, \orange{H(\commitment)}), D_p, \sigma_p\big)$ 2102 \end{center} 2103 \vfill 2104 \end{frame} 2105 2106 \begin{frame}<1-| handout:0>{Integration with GNU Taler} 2107 \framesubtitle{Integrated schemes} 2108 \fontsize{8pt}{9pt}\selectfont 2109 \begin{tikzpicture}[scale=.9] 2110 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 2111 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 2112 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 2113 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 2114 2115 \draw[<->] (Guardian) to node[sloped,above,align=center] 2116 {{\sf withdraw}\orange{, using}\\ $\FDH(C_p\orange{, H(\commitment)})$} (Exchange); 2117 \draw[<->] (Client) to node[sloped,below,align=center] 2118 {{\sf refresh} \orange{ + }\\ \orange{$\DeriveCompare$}} (Exchange); 2119 \draw[<->] (Client) to node[sloped, below] 2120 {{\sf purchase} \blue{+ $(\attest_\minage, \commitment)$}} (Merchant); 2121 \draw[<->] (Merchant) to node[sloped, above] 2122 {{\sf deposit} \orange{+ $H(\commitment)$}} (Exchange); 2123 2124 \draw[->] (Guardian) to [out=70,in=150, loop] node[above] 2125 {$\Commit(\age)$} (Guardian); 2126 \draw[->] (Guardian) to node[below,sloped] 2127 {($\commitment$, $\pruf_\age$)} (Client); 2128 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 2129 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 2130 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 2131 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 2132 \end{tikzpicture} 2133 \end{frame} 2134 2135 2136 \begin{frame}<1-| handout:0>{Instantiation with Edx25519} 2137 Paper also formally defines another signature scheme: Edx25519.\\[1em] 2138 2139 \begin{itemize} 2140 \item Scheme already in use in GNUnet, 2141 \item based on EdDSA (Bernstein et al.), 2142 \item generates compatible signatures and 2143 \item allows for key derivation from both, private and public keys, independently. 2144 \end{itemize}~\\[1em] 2145 2146 Current implementation of age restriction in GNU Taler uses Edx25519. 2147 \end{frame} 2148 2149 2150 \begin{frame}{Age Restrictions based on KYC} 2151 % \item Our solution can in principle be used with any token-based payment scheme 2152 % \item GNU Taler best aligned with our design goals (security, privacy and efficiency) 2153 Subsidiarity requires bank accounts being owned by adults 2154 \begin{itemize} 2155 \item Scheme can be adapted to case where minors have bank accounts 2156 \begin{itemize} 2157 \item Assumption: banks provide minimum age 2158 information during bank 2159 transactions. 2160 \item Child and Exchange execute a variant of 2161 the cut\&choose protocol. 2162 \end{itemize} 2163 \end{itemize} 2164 \end{frame} 2165 2166 2167 \begin{frame}<1-| handout:0>{Related Work} 2168 \begin{itemize} 2169 \item Current privacy-perserving systems all based on attribute-based credentials (Koning et al., Schanzenbach et al., Camenisch et al., Au et al.) 2170 \item Attribute-based approach lacks support: 2171 \begin{itemize} 2172 \item Complex for consumers and retailers 2173 \item Requires trusted third authority 2174 \end{itemize} 2175 \vfill 2176 \item Other approaches tie age-restriction to ability to pay ("debit cards for kids") 2177 \begin{itemize} 2178 \item Advantage: mandatory to payment process 2179 \item Not privacy friendly 2180 \end{itemize} 2181 \end{itemize} 2182 \end{frame} 2183 2184 \begin{frame}{Conclusion} 2185 Age restriction is a technical, ethical and legal challenge. 2186 2187 Existing solutions are 2188 \begin{itemize} 2189 \item without strong protection of privacy or 2190 \item based on identity management systems (IMS) 2191 \end{itemize} 2192 \vfill 2193 2194 Our age restriction scheme offers a solution that is 2195 \begin{itemize} 2196 \item based on subsidiarity 2197 \item privacy-preserving 2198 \item efficient 2199 \item an alternative to IMS 2200 \end{itemize} 2201 Other types of programmability (escrow, auctions) are under development. 2202 \end{frame} 2203 2204 2205 \section{Measures against Advanced Attacks} 2206 2207 \begin{frame} 2208 \vfill 2209 \begin{center} 2210 {\bf Part VI: Measures against Advanced Attacks} 2211 \end{center} 2212 \vfill 2213 \end{frame} 2214 2215 2216 \begin{frame}{Warranting deposit safety} 2217 Exchange has online signing key $W = wG$: 2218 \begin{center} 2219 Sends $EdDSA_w(M,H(D),FDH(C))$ to the merchant. 2220 \end{center} 2221 This signature means that $M$ was the {\em first} to deposit 2222 $C$ and that the exchange thus must pay $M$. 2223 \vfill 2224 \begin{center} 2225 Without this, a malicious exchange could renege on the deposit 2226 confirmation and claim double-spending if a coin were 2227 deposited twice, and then not pay either merchant! 2228 \end{center} 2229 \end{frame} 2230 2231 2232 \begin{frame}{Key management} 2233 Taler has many types of keys: 2234 \begin{itemize} 2235 \item Coin keys 2236 \item Denomination keys 2237 \item Online message signing keys 2238 \item Offline key signing keys 2239 \item Merchant keys 2240 \item Auditor key 2241 \item Security module keys 2242 \item Transfer keys 2243 \item Wallet keys 2244 \item {\em TLS keys, DNSSEC keys} 2245 \end{itemize} 2246 \end{frame} 2247 2248 2249 \begin{frame}{Offline keys} 2250 Both exchange and auditor use offline keys. 2251 \begin{itemize} 2252 \item Those keys must be backed up and remain highly confidential! 2253 \item We recommend that computers that have ever had access to those 2254 keys to NEVER again go online. 2255 \item We recommend using a Raspberry Pi for offline key operations. 2256 Store it in a safe under multiple locks and keys. 2257 \item Apply full-disk encryption on offline-key signing systems. 2258 \item Have 3--5 full-disk backups of offline-key signing systems. 2259 \end{itemize} 2260 \begin{center} 2261 \includegraphics[scale=0.1]{pi.png} 2262 \end{center} 2263 \end{frame} 2264 2265 2266 \begin{frame}{Protecting online keys} 2267 The exchange needs keys to be available for online signing. 2268 \begin{itemize} 2269 \item {\tt taler-exchange-secmod-\{cs,eddsa,rsa\}} 2270 are the only processes that must have access to the private keys. 2271 \item The secmod processes should run under a different UID, but share 2272 the same GID with the exchange. 2273 \item The secmods generate the keys, allow {\tt taler-exchange-httpd} to sign with 2274 them, and eventually delete the private keys. 2275 \item Communication between secmods and {\tt taler-exchange-httpd} is via 2276 a UNIX domain socket. 2277 \item Online private keys are stored on disk (not in database!) and should 2278 NOT be backed up (RAID should suffice). If disk is lost, we can always 2279 create fresh replacement keys! 2280 \end{itemize} 2281 \end{frame} 2282 2283 2284 \begin{frame}{Online keys} 2285 \begin{center} 2286 \includegraphics[width=0.9\textwidth]{taler-diagram-signatures.png} 2287 \end{center} 2288 \end{frame} 2289 2290 \begin{frame}{Online keys} 2291 The exchange needs keys to be available for online signing: 2292 \begin{itemize} 2293 \item Knowledge of these private keys will allow an adversary to 2294 mint digital cash, possibly resulting in financial losses 2295 % (eventually, this will be detected by the auditor, but only 2296 % after some financial losses have been irrevocably incurred). 2297 \item The corresponding public keys are certified using 2298 Taler's public key infrastructure (which uses offline-only keys). 2299 \end{itemize} 2300 \vfill 2301 {\tt taler-exchange-offline} can also be used to {\bf revoke} the 2302 online signing keys, if we find they have been compromised. 2303 \vfill 2304 \end{frame} 2305 2306 2307 \begin{frame}{Online keys} 2308 \begin{itemize} 2309 \item The exchange needs $d$ and $w$ to be available for online signing. 2310 \item The corresponding public keys $W$ and $(e,n)$ are certified using 2311 Taler's public key infrastructure (which uses offline-only keys). 2312 \end{itemize} 2313 \vfill 2314 \begin{center} 2315 {\bf What happens if those private keys are compromised?} 2316 \end{center} 2317 \vfill 2318 \end{frame} 2319 2320 2321 \begin{frame}{Denomination key $(e,n)$ compromise} 2322 \begin{itemize} 2323 \item An attacker who learns $d$ can sign an arbitrary number of illicit coins 2324 into existence and deposit them. 2325 \item Auditor and exchange can detect this once the total number of deposits 2326 (illicit and legitimate) exceeds the number of legitimate coins the 2327 exchange created. 2328 \item At this point, $(e,n)$ is {\em revoked}. Users of {\em unspent} 2329 legitimate coins reveal $b$ from their withdrawal operation and 2330 obtain a {\em refund}. 2331 \item The financial loss of the exchange is {\em bounded} by the number of 2332 legitimate coins signed with $d$. 2333 \item[$\Rightarrow$] Taler frequently rotates denomination signing keys and 2334 deletes $d$ after the signing period of the respective key expires. 2335 \end{itemize} 2336 \begin{center} 2337 \includegraphics[width=0.5\textwidth]{taler-diagram-denom-expiration.png} 2338 \end{center} 2339 \end{frame} 2340 2341 2342 \begin{frame}{Online signing key $W$ compromise} 2343 \begin{itemize} 2344 \item An attacker who learns $w$ can sign deposit confirmations. 2345 \item Attacker sets up two (or more) merchants and customer(s) which double-spend 2346 legitimate coins at both merchants. 2347 \item The merchants only deposit each coin once at the exchange and get paid once. 2348 \item The attacker then uses $w$ to fake deposit confirmations for the double-spent 2349 transactions. 2350 \item The attacker uses the faked deposit confirmations to complain to the auditor 2351 that the exchange did not honor the (faked) deposit confirmations. 2352 \end{itemize} 2353 The auditor can then detect the double-spending, but cannot tell who is to blame, 2354 and (likely) would presume a malicious exchange, forcing it to pay both merchants. 2355 \end{frame} 2356 2357 2358 \begin{frame}{Detecting online signing key $W$ compromise} 2359 \begin{itemize} 2360 \item Merchants are required to {\em probabilistically} report 2361 signed deposit confirmations to the auditor. 2362 \item Auditor can thus detect exchanges not reporting signed 2363 deposit confirmations. 2364 \item[$\Rightarrow$] Exchange can rekey if illicit key use is detected, 2365 then only has to honor deposit confirmations it already provided 2366 to the auditor {\em and} those without proof of double-spending 2367 {\em and} those merchants reported to the auditor. 2368 \item[$\Rightarrow$] Merchants that do not participate in reporting 2369 to the auditor risk their deposit permissions being voided in 2370 cases of an exchange's private key being compromised. 2371 \end{itemize} 2372 \end{frame} 2373 2374 2375 \begin{frame}{Database} 2376 The exchange needs the database to detect double spending. 2377 \begin{itemize} 2378 \item Loss of the database will allow technically skilled people 2379 to double-spend their digital cash, possibly resulting in 2380 significant financial losses. 2381 \item The database contains total amounts customers withdrew and 2382 merchants received, so sensitive private banking data. It 2383 must thus not become public. 2384 \item The auditor must have a (current) copy. Asynchronous replication 2385 should be sufficient. This copy can also serve as an 2386 additional (off-site?) backup. 2387 \end{itemize} 2388 \begin{center} 2389 The database can also be replaced with a DLT if customer 2390 requires it. 2391 \end{center} 2392 \end{frame} 2393 2394 2395 \section{Component Architecture} 2396 2397 \begin{frame} 2398 \vfill 2399 \begin{center} 2400 {\bf Part VII: Component Architecture} 2401 \end{center} 2402 \vfill 2403 \end{frame} 2404 2405 2406 \begin{frame}[fragile]{Taler: Bank Perspective} 2407 \begin{adjustbox}{max totalsize={.9\textwidth}{.7\textheight},center} 2408 \begin{tikzpicture} 2409 \tikzstyle{def} = [node distance= 5em and 6.5em, inner sep=1em, outer sep=.3em]; 2410 \node (origin) at (0,0) {}; 2411 \node (exchange) [def,above=of origin,draw]{Exchange}; 2412 \node (nexus) [def, draw, below right=of exchange] {Nexus}; 2413 \node (corebanking) [def, draw, below left=of nexus] {Core Banking}; 2414 \node (nginx) [def, draw, above=of exchange]{Nginx}; 2415 \node (postgres) [def, draw, below left=of exchange]{Postgres}; 2416 \node (postgres-nexus) [def, draw, below right=of nexus]{Postgres}; 2417 2418 \tikzstyle{C} = [color=black, line width=1pt] 2419 2420 \draw [<-, C] (exchange) -- (nginx) node [midway, above, sloped] (TextNode) {REST API}; 2421 \draw [<-, C] (postgres) -- (exchange) node [midway, above, sloped] (TextNode) {SQL}; 2422 \draw [<-, C] (postgres-nexus) -- (nexus) node [midway, above, sloped] (TextNode) {SQL}; 2423 \draw [<-, C] (nexus) -- (exchange) node [midway, above, sloped] (TextNode) {Internal REST API}; 2424 \draw [<-, C] (corebanking) -- (nexus) node [midway, above, sloped] (TextNode) {EBICS/FinTS}; 2425 2426 \end{tikzpicture} 2427 \end{adjustbox} 2428 \end{frame} 2429 2430 2431 \begin{frame}{Taler: Exchange Architecture} 2432 \begin{center} 2433 \begin{tikzpicture} 2434 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 2435 \node (origin) at (0,0) {}; 2436 \node (httpd) [def,above=of origin,draw]{httpd}; 2437 \node (secmod-rsa) [def, draw, right=of httpd] {secmod-rsa}; 2438 \node (secmod-eddsa) [def, draw, left=of httpd] {secmod-eddsa}; 2439 \node (postgres) [def, draw, below=of httpd]{Postgres}; 2440 \node (aggregator) [def, draw, right=of postgres]{aggregator}; 2441 \node (transfer) [def, draw, below left=of postgres]{transfer}; 2442 \node (wirewatch) [def, draw, below right=of postgres]{wirewatch}; 2443 \node (nexus) [def, draw, below=of postgres]{Nexus}; 2444 2445 \tikzstyle{C} = [color=black, line width=1pt] 2446 2447 \draw [<->, C] (httpd) -- (postgres) node [midway, above, sloped] (TextNode) {}; 2448 \draw [<->, C] (httpd) -- (secmod-rsa) node [midway, above, sloped] (TextNode) {}; 2449 \draw [<->, C] (httpd) -- (secmod-eddsa) node [midway, above, sloped] (TextNode) {}; 2450 \draw [<->, C] (aggregator) -- (postgres) node [midway, above, sloped] (TextNode) {}; 2451 \draw [<->, C] (wirewatch) -- (postgres) node [midway, above, sloped] (TextNode) {}; 2452 \draw [<->, C] (transfer) -- (postgres) node [midway, above, sloped] (TextNode) {}; 2453 \draw [->, C] (transfer) -- (nexus) node [midway, above, sloped] (TextNode) {}; 2454 \draw [<-, C] (wirewatch) -- (nexus) node [midway, above, sloped] (TextNode) {}; 2455 \end{tikzpicture} 2456 \end{center} 2457 \end{frame} 2458 2459 2460 \begin{frame} 2461 \frametitle{Taler: Auditor Perspective} 2462 \begin{center} 2463 \begin{tikzpicture} 2464 \tikzstyle{def} = [node distance=2em and 2.5em, inner sep=1em, outer sep=.3em]; 2465 \node (origin) at (0,0) {}; 2466 \node (httpd) [def,above left=of origin,draw]{auditor-httpd}; 2467 \node (report) [def,above right=of origin,draw]{auditor-report}; 2468 \node (postgres-A) [def, draw, below=of origin] {Postgres (Auditor)}; 2469 \node (postgres-E) [def, draw, below=of postgres-A] {Postgres (Exchange)}; 2470 2471 \tikzstyle{C} = [color=black, line width=1pt] 2472 2473 \draw [->, C] (postgres-E) -- (postgres-A) node [midway, above, sloped] (TextNode) {sync}; 2474 \draw [<->, C] (httpd) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 2475 \draw [<->, C] (report) -- (postgres-A) node [midway, above, sloped] (TextNode) {}; 2476 \end{tikzpicture} 2477 \end{center} 2478 \end{frame} 2479 2480 2481 \begin{frame} 2482 \frametitle{Taler: Merchant Perspective} 2483 \begin{center} 2484 \begin{tikzpicture} 2485 \tikzstyle{def} = [node distance= 3.5em and 2em, inner sep=1em, outer sep=.3em]; 2486 \node (origin) at (0,0) {}; 2487 \node (backend) [def,above=of origin,draw]{{\tiny taler-merchant-httpd}}; 2488 \node (frontend) [def,above left=of backend,draw]{{\tiny E-commerce Frontend}}; 2489 \node (backoffice) [def,above right=of 2490 backend,draw]{\tiny Backoffice}; 2491 \node (postgres) [def, draw, below left=of backend] {\tiny Postgres}; 2492 \node (sqlite) [def, draw, below=of backend] {\tiny Sqlite}; 2493 \node (alt) [def, draw, below right=of backend] {...}; 2494 2495 \tikzstyle{C} = [color=black, line width=1pt] 2496 2497 \draw [->, C] (frontend) -- (backend) node [midway, above, sloped] 2498 (TextNode) {\tiny REST API}; 2499 \draw [->, C] (backoffice) -- (backend) node [midway, above, sloped] 2500 (TextNode) {\tiny REST API}; 2501 \draw [<->, C] (backend) -- (postgres) node [midway, above, sloped] 2502 (TextNode) {\tiny SQL}; 2503 \draw [<->, C] (backend) -- (sqlite) node [midway, above, sloped] 2504 (TextNode) {\tiny SQL}; 2505 \draw [<->, C] (backend) -- (alt) node [midway, above, sloped] 2506 (TextNode) {\tiny SQL}; 2507 \end{tikzpicture} 2508 \end{center} 2509 \end{frame} 2510 2511 2512 \begin{frame} 2513 \frametitle{Taler: Wallet Architecture} 2514 \begin{center} 2515 \begin{tikzpicture} 2516 \tikzstyle{def} = [node distance= 5em and 4.5em, inner sep=1em, outer sep=.3em]; 2517 \node (origin) at (0,0) {}; 2518 \node (gui) [def,above=of origin,draw]{wallet-gui}; 2519 \node (core) [def,below=of gui,draw]{wallet-core}; 2520 \node (sync) [def, draw, below left=of core] {Sync}; 2521 \node (taler) [def, draw, below right=of core] {Taler}; 2522 \node (anastasis) [def, draw, below=of core] {Anastasis}; 2523 2524 \tikzstyle{C} = [color=black, line width=1pt] 2525 \draw [<->, C] (gui) -- (core) node [midway, above, sloped] (TextNode) {}; 2526 \draw [<->, C] (core) -- (sync) node [midway, above, sloped] (TextNode) {Backup}; 2527 \draw [<->, C] (core) -- (taler) node [midway, above, sloped] (TextNode) {Payment}; 2528 \draw [<->, C] (core) -- (anastasis) node [midway, above, sloped] (TextNode) {Key Escrow}; 2529 \end{tikzpicture} 2530 \end{center} 2531 \end{frame} 2532 2533 2534 \begin{frame}[t]{Software architecture for the Taler Snack Machine} 2535 \framesubtitle{Code at \url{https://git.taler.net/taler-mdb}} 2536 \begin{figure} 2537 \centering 2538 \includegraphics[width=.9\textwidth]{software_stack} 2539 \end{figure} 2540 \end{frame} 2541 2542 2543 2544 \section{Integration considerations} 2545 2546 \begin{frame} 2547 \vfill 2548 \begin{center} 2549 {\bf Part VIII: Integration considerations} 2550 \end{center} 2551 \vfill 2552 \end{frame} 2553 2554 2555 \begin{frame}[fragile]{RFC 8905: \texttt{payto:} Uniform Identifiers for Payments and Accounts} 2556 \vfill 2557 Like \texttt{mailto:}, but for bank accounts instead of email accounts! 2558 \vfill 2559 \begin{verbatim} 2560 payto://<PAYMENT-METHOD>/<ACCOUNT-NR> 2561 ?subject=InvoiceNr42 2562 &amount=EUR:12.50 2563 \end{verbatim} 2564 \vfill 2565 Default action: Open app to review and confirm payment. 2566 \vfill 2567 \includegraphics[width=0.25\textwidth]{einzahlschein-ch.jpeg} 2568 \hfill 2569 \includegraphics[width=0.2\textwidth]{de-ueberweisungsformular.png} 2570 \vfill 2571 \end{frame} 2572 2573 2574 \begin{frame}[fragile]{Benefits of {\tt payto://}} 2575 \begin{itemize} 2576 \item Standardized way to represent financial resources (bank account, bitcoin wallet) 2577 and payments to them 2578 \item Useful on the client-side on the Web and for FinTech backend applications 2579 \item Payment methods (such as IBAN, ACH, Bitcoin) are registered with 2580 IANA and allow extra options 2581 \end{itemize} 2582 \begin{center} 2583 {\bf Taler wallet can generate payto://-URI for withdraw!} 2584 \end{center} 2585 \end{frame} 2586 2587 2588 \begin{frame}{Fully Offline Payments {\bf (WiP)}} 2589 \framesubtitle{\url{https://docs.taler.net/design-documents/030-offline-payments.html}} 2590 Many central banks today demand offline capabilities for digital payment solutions. 2591 \vfill 2592 \noindent 2593 Three possible approaches: 2594 \begin{enumerate} 2595 \item Trust-based offline payments (has counterparty and/or privacy risks) 2596 \item Full HSM Taler wallet (has hardware costs) 2597 \item Light-weight HSM balance register 2598 \end{enumerate} 2599 \vfill 2600 \end{frame} 2601 2602 2603 \begin{frame}{Partially Offline Payments with GNU Taler} 2604 We have filed for a patent to address situations where only the merchant is offline: 2605 \begin{enumerate} 2606 \item Customer pays by scanning static QR code and entering amount on mobile phone. 2607 \item Merchant confirms payment by checking simple unique numeric confirmation code. 2608 \item[$\Rightarrow$] Allows for very simple, cheap and secure merchant on-boarding. 2609 Makes integration with existing PoS vendors optional. 2610 \end{enumerate} 2611 \begin{center} 2612 {\bf Needed Point-of-sale hardware costs only $\approx$ \EUR{10}} 2613 \end{center} 2614 \vfill \pause 2615 Largely implemented, only UI support missing. Expected to ship in Q1'2023. 2616 \end{frame} 2617 2618 2619 \section{Blockchain Integration} 2620 2621 \begin{frame} 2622 \vfill 2623 \begin{center} 2624 {\bf Part IX: Blockchain Integration} 2625 \end{center} 2626 \vfill 2627 Antoine d’Aligny, Emmanuel Benoist and Christian Grothoff: ``{\em Project Depolymerization: Tokenization of Blockchains}''. {\bf 4th Conference on Blockchain Research \& Applications for Innovative Networks and Services}, 2022 2628 \vfill 2629 \end{frame} 2630 2631 2632 \begin{frame}{Blockchain based cryptocurrencies} 2633 \begin{tikzpicture}[remember picture,overlay] 2634 \node (N1)[above right=5mm and 25mm of current page.center] {\includegraphics[width=34mm]{media/news1.png}}; 2635 \node (N0)[below=-3mm of N1] {\includegraphics[width=34mm]{media/news0.png}}; 2636 \node (N2)[below left=-26mm and -2.5mm of N1] {\includegraphics[width=34mm]{media/news2.png}}; 2637 \end{tikzpicture} 2638 \begin{block}{Biggest cryptocurrencies} 2639 \begin{itemize} 2640 \item \textbf{BTC} Bitcoin 2641 \item \textbf{ETH} Ethereum 2642 \end{itemize} 2643 \end{block} 2644 \begin{block}{Common blockchain limitations} 2645 \begin{itemize} 2646 \item \textbf{Delay} block and confirmation delay 2647 \item \textbf{Cost} transaction fees 2648 \item \textbf{Scalability} limited amount of transaction per second 2649 \item \textbf{Ecological impact} computation redundancy 2650 \item \textbf{Privacy} 2651 \item \textbf{Regulatory risk} 2652 \end{itemize} 2653 \end{block} 2654 \end{frame} 2655 2656 \begin{frame}{Layer 2 solutions: Taler vs. Lightning} 2657 2658 \begin{minipage}{5.5cm} 2659 {\bf Taler:} 2660 \begin{itemize} 2661 \item[\checkmark] can be used with any currency or asset 2662 \item[\checkmark] can make payments instantly between any two parties 2663 \item[\checkmark] has income transparency and can accommodate KYC, AML and CFT 2664 \item[\checkmark] has cryptographic privacy protections 2665 \item[\checkmark] can be used immediately to make instant payments 2666 \item[\checkmark] uses one or more central exchange service providers 2667 \end{itemize} 2668 \end{minipage} 2669 \hfill 2670 \begin{minipage}{5.5cm} 2671 {\bf Lightning:} 2672 \begin{itemize} 2673 \item[$\times$] only works with Bitcoin 2674 \item[$\times$] requires payment route establishment, which can fail 2675 \item[$\times$] cannot enforce regulatory requirements 2676 \item[$\times$] requires money to be locked in payment channels 2677 \item[$\times$] requires expensive Bitcoin node or trusted service to transact 2678 \item[$\times$] claims to be decentralized, but uses few and centralized nodes in practice 2679 \end{itemize} 2680 \end{minipage} 2681 \end{frame} 2682 2683 \begin{frame}<1-| handout:0>{Taler}{Architecture} 2684 \begin{columns} 2685 \column{0.5\paperwidth} 2686 \begin{tikzpicture}[ 2687 rect/.style={circle, draw=black}, 2688 sym/.style={-stealth, shorten >= 2pt, shorten <= 2pt} 2689 ] 2690 % Taler payment system 2691 \node[rect](1) {Exchange}; 2692 \node[rect,below left=1.5cm and 0.7cm of 1](2) {Customer}; 2693 \node[rect,below right=1.5cm and 0.7cm of 1](3) {Merchant}; 2694 2695 \draw[sym] (1) -- node [midway, above, sloped] {\tiny Withdraw coins} (2); 2696 \draw[sym] (2) -- node [midway, above, sloped] {\tiny Spend coins} (3); 2697 \draw[sym] (3) -- node [midway, above, sloped] {\tiny Deposit coins} (1); 2698 2699 % Settlement layer 2700 \node[left=2cm of 1](E1){}; 2701 \node[right=2cm of 1](E2){}; 2702 \draw[sym] (E1) -- node [midway, above] {\tiny Deposit money} (1); 2703 \draw[sym] (1) -- node [midway, above] {\tiny Withdraw money} (E2); 2704 2705 % Auditor 2706 \node[above= of 1](A){Auditor}; 2707 \draw[sym] (A) -- node [midway, right] {\tiny Verify} (1); 2708 2709 % Separator 2710 \node[below=1mm of E1] (S1S) {}; 2711 \node[below=1mm of E2] (S1E) {}; 2712 \node[above=6mm of E1] (S2S) {}; 2713 \node[above=6mm of E2] (S2E) {}; 2714 2715 \draw[dotted] (S1S) -- (S1E); 2716 \draw[dotted] (S2S) -- (S2E); 2717 2718 \node[below right=-2mm and -1.5mm of S2S] {\tiny{\emph{Settlement Layer}}}; 2719 \node[below right=-2mm and -1.5mm of S1S] {\tiny{\emph{Taler payment system}}}; 2720 \end{tikzpicture} 2721 \column{0.47\paperwidth} 2722 \begin{block}{Settlement layer} 2723 \begin{itemize} 2724 \item RTGS $\equiv$ Blockchain! 2725 \end{itemize} 2726 \end{block} 2727 \begin{block}{Taler payment system} 2728 \begin{itemize} 2729 \item Realtime transactions, 1 RTT 2730 \item Scalable microtransactions 2731 \item Blind signatures (privacy) 2732 \end{itemize} 2733 \end{block} 2734 2735 \end{columns} 2736 \end{frame} 2737 2738 \begin{frame}{Taler}{Blockchain settlement layer} 2739 \begin{center} 2740 \begin{tikzpicture}[ 2741 rect/.style={rectangle, draw=black, minimum width=30mm}, 2742 sym/.style={stealth-stealth, shorten >= 2pt, shorten <= 2pt}, 2743 block/.style={rectangle,draw=black,fill=black!10,minimum size=7mm}, 2744 ] 2745 2746 %% Architecture 2747 \node(Tt){Taler}; 2748 \node[rect,below=0cm of Tt](Tc){Exchange}; 2749 \node[rect,fit={(Tt) (Tc)}](T){}; 2750 2751 \node[rect,below=7mm of Tc](D) {\textbf{Depolymerization}}; 2752 2753 \node[rect,below=7mm of D](Bc){Node}; 2754 \node[below=0cm of Bc](Bt){Blockchain}; 2755 \node[rect,fit={(Bt) (Bc)}](B){}; 2756 2757 \draw[sym] (T) -- (D); 2758 \draw[sym] (D) -- (B); 2759 2760 %% Blockchain 2761 \node[block,right=8mm of B] (1){}; 2762 \node[block,right=4mm of 1] (2){}; 2763 \node[block,right=4mm of 2] (3){}; 2764 \node[block,right=4mm of 3] (4){}; 2765 \node[block,right=4mm of 4] (5){}; 2766 \node[block,right=4mm of 5] (6){}; 2767 \draw[-stealth] (1) -- (2); 2768 \draw[-stealth] (2) -- (3); 2769 \draw[-stealth] (3) -- (4); 2770 \draw[-stealth] (4) -- (5); 2771 \draw[-stealth] (5) -- (6); 2772 2773 \node[left=4mm of 1] (S){}; 2774 \node[right=4mm of 6] (E){}; 2775 \draw[-stealth] (S) -- (1); 2776 \draw[-stealth] (6) -- (E); 2777 2778 %% Taler 2779 \node[block, below right=-7.5mm and 20.5mm of T] (off){Off-chain transactions}; 2780 \node[above=-0.5mm of off] {\includegraphics[height=7mm]{taler-logo-2021-inkscape.pdf}}; 2781 2782 %% Depolymerization 2783 \node[right=11mm of D] {\small{Credit}}; 2784 \node[right=50mm of D] {\small{Debit}}; 2785 \draw[dashed,-stealth] (1.north) |- (off.west); 2786 \draw[dashed,-stealth] (off.east) -| (6.north); 2787 \end{tikzpicture} 2788 \end{center} 2789 \end{frame} 2790 2791 \begin{frame}<1-| handout:0>{Challenges} 2792 \begin{block}{Taler Metadata} 2793 \begin{itemize} 2794 \item Metadata are required to link a wallet to credits and 2795 allow merchant to link deposits to debits 2796 \item Putting metadata in blockchain transactions can be tricky 2797 \end{itemize} 2798 \end{block} 2799 \begin{block}{Blockchain based cryptocurrencies} 2800 \begin{itemize} 2801 \item Blockchain transactions lack finality (fork) 2802 \item Transactions can be stuck for a long time (mempool) 2803 \end{itemize} 2804 \end{block} 2805 \end{frame} 2806 2807 \begin{frame}<1-| handout:0>{Blockchain challenges}{Chain reorganization} 2808 \begin{center} 2809 \begin{tikzpicture}[ 2810 block/.style={rectangle,draw=black,fill=black!10,minimum size=7mm}, 2811 ar/.style={-stealth} 2812 ] 2813 % Common 2814 \node[block](1){}; 2815 \node[block,right=5mm of 1](2){$D_0$}; 2816 \node[block,right=5mm of 2](3){}; 2817 \draw[ar] (1) -- (2); 2818 \draw[ar] (2) -- (3); 2819 2820 % Current 2821 \node [block,right=5mm of 3](4){}; 2822 \node[block,right=5mm of 4](5){}; 2823 \node[block,right=5mm of 5](6){$D_1$}; 2824 \draw[ar] (3) -- (4); 2825 \draw[ar] (4) -- (5); 2826 \draw[ar] (5) -- (6); 2827 2828 % Fork 2829 \node [block,above=7mm of 4](4p){}; 2830 \node[block,right=5mm of 4p](5p){$D_2$}; 2831 \node[block,right=5mm of 5p](6p){}; 2832 \node[block,right=5mm of 6p](7p){}; 2833 \draw[ar] (3.east) -- (4p.west); 2834 \draw[ar] (4p) -- (5p); 2835 \draw[ar] (5p) -- (6p); 2836 \draw[ar] (6p) -- (7p); 2837 2838 % Indication 2839 \node [right=5mm of 7p]{\emph{fork}}; 2840 \node [right=17mm of 6]{\emph{active}}; 2841 \end{tikzpicture} 2842 \end{center} 2843 A fork is when concurrent blockchain states coexist. Nodes will follow 2844 the longest chain, replacing recent blocks if necessary during a 2845 blockchain reorganization. If a deposit transaction disappears from the 2846 blockchain, an irrevocable withdraw transactions would no longer be backed 2847 by credit. 2848 \end{frame} 2849 2850 \begin{frame}<1-| handout:0>{Blockchain challenges}{Stuck transactions} 2851 We want confirmed debits within a limited time frame. 2852 \begin{figure} 2853 \centering 2854 \only<1> { 2855 \begin{tikzpicture}[ 2856 dot/.style={circle,fill,inner sep=1pt,} 2857 ] 2858 \node (I) {\includegraphics[width=\textwidth]{media/fee.png}}; 2859 \node [below left=-2.5mm and -1.5cm of I] (Tx) {\small Tx}; 2860 \node [dot,above=8.4mm of Tx](D) {}; 2861 \draw [dotted,thick] (Tx) -- (D); 2862 \node [left=-4.5cm of Tx] (C) {\small conf}; 2863 \node [dot,above=8.4mm of C](D1) {}; 2864 \draw [dotted,thick] (C) -- (D1); 2865 \end{tikzpicture} 2866 } 2867 \only<2> { 2868 \includegraphics[width=\textwidth]{media/fee_var.png} 2869 \caption{Bitcoin average transaction fee over 6 months {\tiny (ychart)}} 2870 } 2871 \end{figure} 2872 \only<1>{When we trigger a debit with a fee too small, it may not be 2873 confirmed in a timely fashion.} 2874 \only<2>{However, transaction fees are unpredictable.} 2875 \end{frame} 2876 2877 2878 \begin{frame}{Depolymerization}{Architecture} 2879 \begin{center} 2880 \begin{tikzpicture}[ 2881 rect/.style={rectangle, draw=black, minimum height=6mm, minimum width=28mm}, 2882 sym/.style={stealth-stealth, shorten >= 2pt, shorten <= 2pt} 2883 ] 2884 \node[rect](1) {Taler Exchange}; 2885 \node[rect,below=of 1](2) {Wire Gateway}; 2886 \node[rect,right=of 2](3) {PostgreSQL}; 2887 \node[rect,right=of 3](4) {DLT Adapter}; 2888 \node[rect,above=of 4](5) {DLT Full Node}; 2889 2890 \draw[sym] (1) -- node [midway,right] {\tiny HTTP} (2); 2891 \draw[sym] (2) -- node [midway,above] {\tiny SQL} (3); 2892 \draw[sym] (3) -- node [midway,above] {\tiny SQL} (4); 2893 \draw[sym] (4) -- node [midway,left ] {\tiny RPC} (5); 2894 2895 2896 \node[above= 2mm of 1]{\small{\emph{Wire Gateway API}}}; 2897 \node[above= 2mm of 5]{\small{\emph{DLT specific}}}; 2898 \node[above=22mm of 3](T) {}; 2899 \draw[dotted] (3) -- (T); 2900 \end{tikzpicture} 2901 \end{center} 2902 \begin{itemize} 2903 \item Common database to store transactions state and communicate 2904 with notifications 2905 \item Wire Gateway for Taler API compatibility 2906 \item DLT specific adapter 2907 \end{itemize} 2908 \end{frame} 2909 2910 \begin{frame}{Storing metadata}{Bitcoin} 2911 \begin{block}{Bitcoin - Credit} 2912 \begin{itemize} 2913 \item Transactions from code 2914 \item Only 32B + URI 2915 \item \textbf{OP\_RETURN} 2916 \end{itemize} 2917 \end{block} 2918 \begin{block}{Bitcoin - Debit} 2919 \begin{itemize} 2920 \item Transactions from common wallet software 2921 \item Only 32B 2922 \item \textbf{Fake Segwit Addresses} 2923 \end{itemize} 2924 \end{block} 2925 \end{frame} 2926 \begin{frame}{Storing metadata}{Ethereum} 2927 \begin{block}{Smart contracts} 2928 \begin{itemize} 2929 \item Logs in smart contract is the recommend way {\tiny (ethereum.org)} 2930 \item Expensive (additional storage and execution fees) 2931 \item Avoidable attack surface (error prone) 2932 \end{itemize} 2933 \end{block} 2934 \begin{block}{Custom input format} 2935 Use input data in transactions, usually used to call smart contract, to 2936 store our metadata. 2937 \end{block} 2938 \end{frame} 2939 2940 \begin{frame}{Handling blockchain reorganization} 2941 \begin{center} 2942 \begin{tikzpicture}[ 2943 block/.style={rectangle,draw=black,fill=black!10,minimum size=7mm}, 2944 conf/.style={draw=black!60!green,fill=black!60!green!10}, 2945 nconf/.style={dotted}, 2946 err/.style={draw=black!60!red,fill=black!60!red!10}, 2947 ar/.style={-stealth} 2948 ] 2949 % Common 2950 \node[block,conf](1){}; 2951 \node[block,conf,right=5mm of 1](2){$D_0$}; 2952 \node[block,conf,right=5mm of 2](3){}; 2953 \draw[ar] (1) -- (2); 2954 \draw[ar] (2) -- (3); 2955 2956 % Current 2957 \only<1>{ 2958 \node [block,nconf,right=5mm of 3](4){}; 2959 } 2960 \only<2->{ 2961 \node [block,conf,right=5mm of 3](4){\only<3>{$D_3$}}; 2962 } 2963 \node[block,nconf,right=5mm of 4](5){}; 2964 \node[block,nconf,right=5mm of 5](6){$D_1$}; 2965 \draw[ar] (3) -- (4); 2966 \draw[ar] (4) -- (5); 2967 \draw[ar] (5) -- (6); 2968 2969 % Fork 2970 \only<-2>{ 2971 \node [block,nconf,above=7mm of 4](4p){}; 2972 } 2973 \only<3>{ 2974 \node [block,dashed,err,above=7mm of 4](4p){$D_3'$}; 2975 } 2976 \node[block,nconf,right=5mm of 4p](5p){$D_2$}; 2977 \node[block,nconf,right=5mm of 5p](6p){}; 2978 \node[block,nconf,right=5mm of 6p](7p){}; 2979 \draw[ar] (3.east) -- (4p.west); 2980 \draw[ar] (4p) -- (5p); 2981 \draw[ar] (5p) -- (6p); 2982 \draw[ar] (6p) -- (7p); 2983 2984 % Indication 2985 \node [right=5mm of 7p]{\emph{fork}}; 2986 \node [right=17mm of 6]{\emph{active}}; 2987 \end{tikzpicture} 2988 \end{center} 2989 \only<1>{As small reorganizations are common, Satoshi already recommended to 2990 apply a confirmation delay to handle most disturbances and attacks.} 2991 \only<2>{If a reorganization longer than the confirmation delay happens, 2992 but it did not remove credits, Depolymerizer is safe and automatically 2993 resumes.} 2994 \only<3>{If a fork removed a confirmed debit, an attacker may create a 2995 conflicting transaction. Depolymerizer suspends operation until lost 2996 credits reappear.} 2997 \end{frame} 2998 2999 \begin{frame}{Adaptive confirmation} 3000 \begin{center} 3001 \begin{tikzpicture}[ 3002 block/.style={rectangle,draw=black,fill=black!10,minimum size=7mm}, 3003 conf/.style={draw=black!60!green,fill=black!60!green!10}, 3004 nconf/.style={dotted}, 3005 conft/.style={text=black!60!green}, 3006 confl/.style={draw=black!60!green}, 3007 ar/.style={-stealth} 3008 ] 3009 % Common 3010 \node(0){}; 3011 \node[block,conf,right=5mm of 0](1){}; 3012 \node[block,conf,right=5mm of 1](2){}; 3013 \draw[ar] (0) -- (1); 3014 \draw[ar] (1) -- (2); 3015 3016 % Current 3017 \node[block,conf,right=5mm of 2](3){}; 3018 \node[block,nconf,right=5mm of 3](4){}; 3019 \node[block,nconf,right=5mm of 4](5){}; 3020 \node[block,nconf,right=5mm of 5](6){}; 3021 \draw[ar] (2) -- (3); 3022 \draw[ar] (3) -- (4); 3023 \draw[ar] (4) -- (5); 3024 \draw[ar] (5) -- (6); 3025 3026 % Fork 3027 \node[block,nconf,above=7mm of 3](3p){}; 3028 \node[block,nconf,right=5mm of 3p](4p){}; 3029 \node[block,nconf,right=5mm of 4p](5p){}; 3030 \node[block,nconf,right=5mm of 5p](6p){}; 3031 \node[block,nconf,right=5mm of 6p](7p){}; 3032 \draw[ar] (2.east) -- (3p.west); 3033 \draw[ar] (3p) -- (4p); 3034 \draw[ar] (4p) -- (5p); 3035 \draw[ar] (5p) -- (6p); 3036 \draw[ar] (6p) -- (7p); 3037 3038 % Indication 3039 \node[right=5mm of 7p]{\emph{fork}}; 3040 \node[right=17mm of 6]{\emph{active}}; 3041 3042 % Confirmation 3043 \path (0) -- (1) node[conft,midway, below=6mm] (M) {Max}; 3044 \path (2) -- (3) node[conft,midway, below=6mm] (N) {New}; 3045 \path (3) -- (4) node[conft,midway, below=6mm] (I) {Initial}; 3046 \node[above=25mm of M] (Mp) {}; 3047 \node[above=25mm of N] (Np) {}; 3048 \node[above=25mm of I] (Ip) {}; 3049 \draw[confl,thick,dotted](M) -- (Mp); 3050 \draw[confl](N) -- (Np); 3051 \draw[confl,thick,dotted](I) -- (Ip); 3052 \end{tikzpicture} 3053 \end{center} 3054 If we experience a reorganization once, its likely for another 3055 reorganization of a similar scope to happen again. 3056 Depolymerizer learns from reorganizations by increasing its confirmation delay. 3057 \end{frame} 3058 3059 3060 3061 \begin{frame}<1-| handout:0>{DLT Adapter}{Architecture} 3062 \begin{block}{Event system} 3063 \begin{itemize} 3064 \item \textbf{Watcher} watch and notify for new blocks with credits 3065 \item \textbf{Wire Gateway} notify requested debits 3066 \item \textbf{Worker} operates on notifications updating state 3067 \end{itemize} 3068 \end{block} 3069 \end{frame} 3070 3071 3072 \begin{frame}<1-| handout:0>{DLT Adapter state machine} 3073 \begin{columns} 3074 \column{0.5\paperwidth} 3075 \begin{figure} 3076 \begin{tikzpicture}[ 3077 rect/.style={rectangle, draw=black, minimum height=6mm, minimum width=50mm}, 3078 ] 3079 3080 \node[rect](wo1) {Wait for notifications}; 3081 \node[rect, below=4mm of wo1](wo2) {Reconcile local DB with DLT}; 3082 \node[rect, below=4mm of wo2](wo3) {Trigger debits}; 3083 \node[rect, below=4mm of wo3](wo4) {Reissue stuck debits}; 3084 \node[rect, below=4mm of wo4](wo5) {Bounce malformed credits}; 3085 \draw[-stealth] (wo1) -- (wo2); 3086 \draw[-stealth] (wo2) -- (wo3); 3087 \draw[-stealth] (wo3) -- (wo4); 3088 \draw[-stealth] (wo4) -- (wo5); 3089 \draw[-stealth] (wo5) .. controls ([xshift=-0.4cm] wo5.west) and ([xshift=-0.4cm] wo1.west) .. (wo1); 3090 \end{tikzpicture} 3091 \caption{Worker loop} 3092 \end{figure} 3093 \column{0.47\paperwidth} 3094 \begin{block}{DLT reconcialisation} 3095 \begin{itemize} 3096 \item List new and removed transactions since last reconciliation 3097 \item Check for confirmed credits removal 3098 \item Register new credits 3099 \item Recover lost debits 3100 \end{itemize} 3101 \end{block} 3102 \end{columns} 3103 \end{frame} 3104 3105 \begin{frame}<1-| handout:0>{Related work} 3106 \begin{block}{Centralization - Coinbase off-chain sending} 3107 \begin{itemize} 3108 \item [$+$] Fast and cheap: off chain transaction 3109 \item [$-$] Trust in Coinbase: privacy, security \& transparency 3110 \end{itemize} 3111 \end{block} 3112 \begin{block}{Layering - Lightning Network} 3113 \begin{itemize} 3114 \item [$+$] Fast and cheap: off-chain transactions 3115 \item [$-$] Requires setting up bidirectional payment channels 3116 \item [$-$] Fraud attempts are mitigated via a complex penalty system 3117 \end{itemize} 3118 \end{block} 3119 \end{frame} 3120 3121 \begin{frame}{Project Depolymerization Summary} 3122 Taler can be used as a layer 2 for existing 3123 crypto-currencies and stablecoins with Depolymerizer: 3124 3125 \begin{itemize} 3126 \item [$-$] Trust exchange operator or auditors 3127 \item [$+$] Fast and cheap 3128 \item [$+$] Realtime: transactions with milliseconds of latency 3129 \item [$+$] Linear scalability 3130 \item [$+$] Ecological 3131 \item [$+$] Privacy when it can, transparency when it must (avoid tax evasion and money laundering) 3132 \end{itemize} 3133 %Future work: 3134 % \begin{itemize} 3135 % \item Universal auditability, using sharded transactions history 3136 % \item Smarter analysis, update confirmation delay based on currency network behavior 3137 % \item Multisig by multiple operator for transactions validation 3138 % \end{itemize} 3139 \end{frame} 3140 3141 3142 \section{Conclusion} 3143 3144 \begin{frame} 3145 \vfill 3146 \begin{center} 3147 {\bf Part X: Conclusion} 3148 \end{center} 3149 \vfill 3150 \end{frame} 3151 3152 3153 \begin{frame}{Trust Earned on Multiple Levels} 3154 \begin{itemize} 3155 \item Free/Libre software with published external code reviews. 3156 \item The Swiss National Bank published white paper: 3157 ``How to issue a CBDC'' on their website based on Taler technology. 3158 \item Taler endorsed by the Austrian National Bank in their Q2'2022 3159 publication as potential {\em Digital Euro} solution. 3160 \item The EU Commission has issued a Seal of Excellence to Taler 3161 Systems SA 3162 \item FINMA Switzerland had no objections to launch (planned for Q3'2023) 3163 \end{itemize} 3164 \end{frame} 3165 3166 3167 \begin{frame}{Features we did NOT discuss in-depth} 3168 \begin{description} 3169 \item[{\bf taler-exchange-secmod-cs:}] Clause-Schnorr blind signature support 3170 \item[{\bf Fakebank:}] high-performance in-memory RTGS emulator 3171 \item[{\bf libbrandt:}] Escrow-based programmability extensions (e.g. for auctions) 3172 \item[{\bf twister}:] Man-in-the-middle fault-injection for testing 3173 \item[{\bf mch}:] Taler for embedded devices ({\bf WiP}) 3174 \end{description} 3175 \end{frame} 3176 3177 3178 \begin{frame}{Feature comparison} 3179 \begin{center} \small 3180 \begin{tabular}{l||c|c|c|c|c} 3181 & Cash & Bitcoin & Zerocoin & Creditcard & GNU Taler \\ \hline \hline 3182 Online &$-$$-$$-$ & ++ & ++ & + & +++ \\ \hline 3183 Offline & +++ & $-$$-$ & $-$$-$ & + & ++ \\ \hline 3184 Trans. cost & + & $-$$-$$-$ & $-$$-$$-$ & $-$ & ++ \\ \hline 3185 Speed & + & $-$$-$$-$ & $-$$-$$-$ & o & ++ \\ \hline 3186 Taxation & $-$ & $-$$-$ & $-$$-$$-$ & +++ & +++ \\ \hline 3187 Payer-anon & ++ & o & ++ & $-$$-$$-$ & +++ \\ \hline 3188 Payee-anon & ++ & o & ++ & $-$$-$$-$ & $-$$-$$-$ \\ \hline 3189 Security & $-$ & o & o & $-$$-$ & ++ \\ \hline 3190 Conversion & +++ & $-$$-$$-$ & $-$$-$$-$ & +++ & +++ \\ \hline 3191 Libre & $-$ & +++ & +++ & $-$ $-$ $-$ & +++ \\ 3192 \end{tabular} 3193 \end{center} 3194 \end{frame} 3195 3196 3197 \begin{frame}<1-| handout:0>{Development Infrastructure} 3198 \begin{itemize} 3199 \item Borg: incremental backup 3200 \item Buildbot: CI/CD 3201 \item Davical: Caldav group calendar 3202 \item Docker: virtualization, packaging 3203 \item Git/Gitolite: distributed version control 3204 \item Mailman: public e-mail lists 3205 \item Mantis: bug tracker 3206 \item Mattermost: messaging, process management 3207 \item Sphinx: documentation generation (HTML, PDF, info, man) 3208 \item Weblate: collaborative AI-supported internationalization 3209 \end{itemize} 3210 \end{frame} 3211 3212 3213 \begin{frame}<1-| handout:0>{Development Tools} 3214 \begin{itemize} 3215 \item Coverity: static analysis (C/C++) 3216 \item GNU recutils: constant registration 3217 \item Twister: fault injection 3218 \item Valgrind: dynamic analysis (C/C++) 3219 \item zzuf: fuzzing 3220 \end{itemize} 3221 \end{frame} 3222 3223 3224 \begin{frame}<1-| handout:0>{Cryptographic dependencies} 3225 \begin{itemize} 3226 \item libargon2 3227 \item libgcrypt 3228 \item libsodium 3229 \end{itemize} 3230 \end{frame} 3231 3232 3233 \begin{frame}<1-| handout:0>{Additional dependencies} 3234 \begin{itemize} 3235 \item libsqlite3 3236 \item libpq / Postgres 3237 \item libjansson 3238 \item libcurl 3239 \item libunistring 3240 \item {\bf GNU libmicrohttpd} 3241 \item {\bf GNUnet} 3242 \end{itemize} 3243 \end{frame} 3244 3245 3246 \begin{frame}{Rights} 3247 \begin{itemize} 3248 \item GNUnet e.V. shared copyrights of their AGPLv3+ licensed code with Taler Systems SA 3249 \item Taler Systems SA holds copyrights to entire GNU Taler code base (AGPLv3+, GPLv3+, 3250 dual-licensing exclusive domain of Taler Systems SA) 3251 \item Taler Systems SA applied for patent on offline payment solution 3252 \item Taler Systems SA holds trademark on ``Taler''. 3253 \item FSF holds trademark on ``GNU'', we are authorized to use ``GNU Taler''. 3254 \item Taler Systems SA owns {\tt taler.net} and {\tt taler-systems.com}. 3255 \end{itemize} 3256 \end{frame} 3257 3258 3259 \begin{frame}{Summary of Taler Solution} 3260 3261 \begin{enumerate} 3262 \item {\bf Frictionless one click}, cash-like digital payments \& 3263 instant 3264 confirmation for all fiat- and crypto-currencies and for all users, 3265 unbanked, young and old. 3266 \item With {\bf income-transparency on the recipient side} is 3267 crime-preventing \& Taler coins are as secure as cash without 3268 counterfeits. No ID theft. 3269 \item {\bf Guaranteed privacy} for spender \& data minimization: payment 3270 requires/shares no personal information. 3271 \item {\bf No bank account needed} 3272 \item Highly efficient in power, processing \& storage, extremely low 3273 cost \& {\bf highly scalable} to 100’000 transactions/sec. 3274 \item Economically viable (sub-cent) instant {\bf micro-transactions} for 3275 e-commerce, Internet of Things, metaverse, machine2machine, $\ldots$ 3276 \end{enumerate} 3277 \end{frame} 3278 3279 \begin{frame}{Collaboration with SICPA \& INX} 3280 \framesubtitle{Discussion Proposal} 3281 Taler can provide: 3282 \begin{itemize} 3283 \item Exclusive license for Central banks 3284 \item Coordination of development efforts 3285 \item Priority support in maintenance \& roll-outs 3286 \end{itemize} 3287 \end{frame} 3288 3289 3290 3291 \begin{frame}{Do you have any questions?} 3292 \framesubtitle{\url{https://taler.net/en/bibliography.html}} 3293 \vfill 3294 References: 3295 {\tiny 3296 \begin{enumerate} 3297 \item{David Chaum, Christian Grothoff and Thomas Moser. 3298 {\em How to issue a central bank digital currency}. 3299 {\bf SNB Working Papers, 2021}.} 3300 \item{Martin Summer and Hannes Hermanky. 3301 {\em A digital euro and the future of cash}. 3302 {\bf Monetary Policy \& The Economy Q1-Q2/22}.} 3303 \item{Antoine d’Aligny, Emmanuel Benoist, Florian Dold, Christian Grothoff, Özgür Kesim and Martin Schanzenbach. 3304 {\em Who comes after us? The correct mindset for designing a Central Bank Digital Currency}. 3305 {\bf SUERF Policy Notes 279/2022}.} 3306 \item{Florian Dold. 3307 {\em GNU Taler}. 3308 {\bf University of Rennes 1, PhD Thesis, 2019}.} 3309 \item{Christian Grothoff and Alex Pentland. 3310 {\em Digital cash and privacy: What are the alternatives to Libra?}. 3311 {\bf MIT Media Lab, 2019}.} 3312 \item{Jeffrey Burdges, Florian Dold, Christian Grothoff and Marcello Stanisci. 3313 {\em Enabling Secure Web Payments with GNU Taler}. 3314 {\bf SPACE 2016}.} 3315 \item{Özgür Kesim, Christian Grothoff, Florian Dold and Martin Schanzenbach. 3316 {\em Zero-Knowledge Age Restriction for GNU Taler}. 3317 {\bf ESORICS, 2022}.} 3318 \item{Gian Demarmels and Lucien Heuzeveldt. 3319 {\em Adding Schnorr's Blind Signature in Taler}. 3320 {\bf BFH, Bachelor's Thesis, 2022}.} 3321 \item{Marco Boss. 3322 {\em GNU Taler Scalability}. 3323 {\bf BFH, Bachelor's Thesis, 2022}.} 3324 \end{enumerate} 3325 } 3326 \end{frame} 3327 3328 \end{document} 3329 3330 3331 3332 3333 \begin{frame}{Taler {\tt /withdraw/sign}} 3334 % Customer withdrawing coins with blind signatures 3335 % \bigskip 3336 \begin{figure}[th] 3337 \begin{minipage}[b]{0.45\linewidth} 3338 \begin{center} 3339 \begin{tikzpicture}[scale = 0.4, 3340 transform shape, 3341 msglabel/.style = { text = Black, yshift = .3cm, 3342 sloped, midway }, 3343 okmsg/.style = { ->, color = MidnightBlue, thick, 3344 >=stealth }, 3345 rstmsg/.style = { ->, color = BrickRed, thick, 3346 >=stealth } 3347 ] 3348 \node[draw = MidnightBlue, 3349 fill = CornflowerBlue, 3350 minimum width = .3cm, 3351 minimum height = 10cm 3352 ] (h1) at (-4, 0) {}; 3353 \node[draw = MidnightBlue, 3354 fill = CornflowerBlue, 3355 minimum width = .3cm, 3356 minimum height = 10cm 3357 ] (h2) at (4, 0) {}; 3358 \node[above = 0cm of h1] {Wallet}; 3359 \node[above = 0cm of h2] {Exchange}; 3360 3361 \path[->, color = MidnightBlue, very thick, >=stealth] 3362 (-5, 4.5) edge 3363 node[rotate=90, text = Black, yshift = .3cm] {Time} 3364 (-5, -4.5); 3365 \path[okmsg, dashed] 3366 ($(h1.east)+(0, 4.0)+(0, -1.0)$) edge 3367 node[msglabel] {SEPA(RK,A)} 3368 ($(h2.west)+(0, 3.5)+(0, -1.0)$); 3369 \path[okmsg] 3370 ($(h1.east)+(0, -1.0)$) edge 3371 node[msglabel] {POST {\tt /withdraw/sign} $S_{RK}(DK, B_b(C))$} 3372 ($(h2.west)+(0, -1.5)$); 3373 \path[okmsg] 3374 ($(h2.west)+(0, -2.0)$) edge 3375 node[msglabel] {200 OK: $S_{DK}(B_b(C))$)} 3376 ($(h1.east)+(0, -2.5)$); 3377 \path[rstmsg] 3378 ($(h2.west)+(0, -3.5)$) edge 3379 node[msglabel] {402 PAYMENT REQUIRED: $S_{RK}(DK, B_b(C))$)} 3380 ($(h1.east)+(0, -4)$); 3381 \node at (5.3, 0) {}; 3382 \end{tikzpicture} 3383 \end{center} 3384 Result: $\langle c, S_{DK}(C) \rangle$. 3385 \end{minipage} 3386 \hspace{0.5cm} 3387 \begin{minipage}[b]{0.45\linewidth} 3388 \tiny 3389 \begin{description} 3390 \item[$A$] Some amount, $A \ge A_{DK}$ 3391 \item[$RK$] Reserve key 3392 \item[$DK$] Denomination key 3393 \item[$b$] Blinding factor 3394 \item[$B_b()$] RSA-FDH blinding % DK supressed 3395 \item[$C$] Coin public key $C := cG$ 3396 \item[$S_{RK}()$] EdDSA signature 3397 \item[$S_{DK}()$] RSA-FDH signature 3398 \end{description} 3399 \end{minipage} 3400 \end{figure} 3401 \end{frame} 3402 3403 3404 \begin{frame}[t]{Taler {\tt /deposit}} 3405 Merchant and exchange see only the public coin $\langle C, S_{DK}(C) \rangle$. 3406 \bigskip 3407 \begin{figure}[th] 3408 \begin{minipage}[b]{0.45\linewidth} 3409 \begin{center} 3410 \begin{tikzpicture}[scale = 0.4, 3411 transform shape, 3412 msglabel/.style = { text = Black, yshift = .3cm, 3413 sloped, midway }, 3414 okmsg/.style = { ->, color = MidnightBlue, thick, 3415 >=stealth }, 3416 rstmsg/.style = { ->, color = BrickRed, thick, 3417 >=stealth } 3418 ] 3419 \node[draw = MidnightBlue, 3420 fill = CornflowerBlue, 3421 minimum width = .3cm, 3422 minimum height = 10cm 3423 ] (h1) at (-4, 0) {}; 3424 \node[draw = MidnightBlue, 3425 fill = CornflowerBlue, 3426 minimum width = .3cm, 3427 minimum height = 10cm 3428 ] (h2) at (4, 0) {}; 3429 \node[above = 0cm of h1] {Merchant}; 3430 \node[above = 0cm of h2] {Exchange}; 3431 3432 \path[->, color = MidnightBlue, very thick, >=stealth] 3433 (-5, 4.5) edge 3434 node[rotate=90, text = Black, yshift = .3cm] {Time} 3435 (-5, -4.5); 3436 \path[->, color = MidnightBlue, thick, >=stealth] 3437 ($(h1.east)+(0,3)$) edge 3438 node[text = Black, yshift = .3cm, sloped] {POST {\tt /deposit} $S_{DK}(C), S_{c}(D)$} 3439 ($(h2.west)+(0,2)$); 3440 \path[->, color = MidnightBlue, thick, >=stealth] 3441 ($(h2.west)+(0,0.5)$) edge 3442 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(S_{c}(D))$} 3443 ($(h1.east)+(0,-0.5)$); 3444 \path[rstmsg] 3445 ($(h2.west)+(0, -2.5)$) edge 3446 node[msglabel] {409 CONFLICT: $S_{c}(D')$} 3447 ($(h1.east)+(0, -3.5)$); 3448 \node at (5.3, 0) {}; 3449 \end{tikzpicture} 3450 \end{center} 3451 \end{minipage} 3452 \hspace{0.5cm} 3453 \begin{minipage}[b]{0.45\linewidth} 3454 \tiny 3455 \begin{description} 3456 \item[$DK$] Denomination key 3457 \item[$S_{DK}()$] RSA-FDH signature using $DK$ 3458 \item[$c$] Private coin key, $C := cG$. 3459 \item[$S_{C}()$] EdDSA signature using $c$ 3460 \item[$D$] Deposit details 3461 \item[$SK$] Exchange's signing key 3462 \item[$S_{SK}()$] EdDSA signature using $SK$ 3463 \item[$D'$] Conficting deposit details $D' \not= D$ 3464 \end{description} 3465 \end{minipage} 3466 \end{figure} 3467 \end{frame} 3468 3469 3470 \begin{frame}{Taler {\tt /refresh/melt}} 3471 \begin{figure}[th] 3472 \begin{minipage}[b]{0.45\linewidth} 3473 \begin{center} 3474 \begin{tikzpicture}[scale = 0.4, 3475 transform shape, 3476 msglabel/.style = { text = Black, yshift = .3cm, 3477 sloped, midway }, 3478 okmsg/.style = { ->, color = MidnightBlue, thick, 3479 >=stealth }, 3480 rstmsg/.style = { ->, color = BrickRed, thick, 3481 >=stealth } 3482 ] 3483 \node[draw = MidnightBlue, 3484 fill = CornflowerBlue, 3485 minimum width = .3cm, 3486 minimum height = 10cm 3487 ] (h1) at (-4, 0) {}; 3488 \node[draw = MidnightBlue, 3489 fill = CornflowerBlue, 3490 minimum width = .3cm, 3491 minimum height = 10cm 3492 ] (h2) at (4, 0) {}; 3493 \node[above = 0cm of h1] {Customer}; 3494 \node[above = 0cm of h2] {Exchange}; 3495 3496 \path[->, color = MidnightBlue, very thick, >=stealth] 3497 (-5, 4.5) edge 3498 node[rotate=90, text = Black, yshift = .3cm] {Time} 3499 (-5, -4.5); 3500 \path[->, color = MidnightBlue, thick, >=stealth] 3501 ($(h1.east)+(0,3)$) edge 3502 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/melt} $S_{DK}(C), S_c({\cal DK}, {\cal T},{\cal B})$} 3503 ($(h2.west)+(0,2)$); 3504 \path[->, color = MidnightBlue, thick, >=stealth] 3505 ($(h2.west)+(0,0.5)$) edge 3506 node[text = Black, yshift = .3cm, sloped] {200 OK: $S_{SK}(H({\cal T}, {\cal B}),\gamma)$} 3507 ($(h1.east)+(0,-0.5)$); 3508 \path[rstmsg] 3509 ($(h2.west)+(0, -2.5)$) edge 3510 node[msglabel] {409 CONFLICT: $S_{C}(X), \ldots$} 3511 ($(h1.east)+(0, -3.5)$); 3512 \node at (5.3, 0) {}; 3513 \end{tikzpicture} 3514 \end{center} 3515 \end{minipage} 3516 \hspace{0.5cm} 3517 \begin{minipage}[b]{0.45\linewidth} 3518 \tiny 3519 \begin{description} 3520 \item[$\kappa$] System-wide security parameter, usually 3. 3521 \\ \smallskip 3522 \item[$\cal DK$] $:= [DK^{(i)}]_i$ \\ List of denomination keys \\ 3523 $D + \sum_i A_{DK^{(i)}} < A_{DK}$ 3524 \item[$t_j$] Random scalar for $j<\kappa$ 3525 \item[${\cal T}$] $:= [T_j]_\kappa$ where $T_j = t_j G$ 3526 \item[$k_j$] $:= c T_j = t_j C$ is an ECDHE 3527 \item[$b_j^{(i)}$] $:= KDF_b(k_j,i)$ % blinding factor 3528 \item[$c_j^{(i)}$] $:= KDF_c(k_j,i)$ % coin secret keys 3529 \item[$C_j^{(i)}$] $: = c_j^{(i)} G$ % new coin publics % keys 3530 \item[${\cal B}$] $:= [H( \beta_j )]_\kappa$ where \\ 3531 $\beta_j := \left[ B_{b_j^{(i)}}(C_j^{(i)}) \right]_i$ 3532 \\ \smallskip 3533 \item[$\gamma$] Random value in $[0,\kappa)$ 3534 % \\ \smallskip 3535 % \item[$X$] Deposit or refresh 3536 \end{description} 3537 \end{minipage} 3538 \end{figure} 3539 \end{frame} 3540 3541 3542 \begin{frame}{Taler {\tt /refresh/reveal}} 3543 \begin{figure}[th] 3544 \begin{minipage}[b]{0.45\linewidth} 3545 \begin{center} 3546 \begin{tikzpicture}[scale = 0.4, 3547 transform shape, 3548 msglabel/.style = { text = Black, yshift = .3cm, 3549 sloped, midway }, 3550 okmsg/.style = { ->, color = MidnightBlue, thick, 3551 >=stealth }, 3552 rstmsg/.style = { ->, color = BrickRed, thick, 3553 >=stealth } 3554 ] 3555 \node[draw = MidnightBlue, 3556 fill = CornflowerBlue, 3557 minimum width = .3cm, 3558 minimum height = 10cm 3559 ] (h1) at (-4, 0) {}; 3560 \node[draw = MidnightBlue, 3561 fill = CornflowerBlue, 3562 minimum width = .3cm, 3563 minimum height = 10cm 3564 ] (h2) at (4, 0) {}; 3565 \node[above = 0cm of h1] {Customer}; 3566 \node[above = 0cm of h2] {Exchange}; 3567 3568 \path[->, color = MidnightBlue, very thick, >=stealth] 3569 (-5, 4.5) edge 3570 node[rotate=90, text = Black, yshift = .3cm] {Time} 3571 (-5, -4.5); 3572 \path[->, color = MidnightBlue, thick, >=stealth] 3573 ($(h1.east)+(0,3)$) edge 3574 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/reveal} $H({\cal T}, {\cal B}), {\tilde{\cal T}}, \beta_\gamma$} 3575 ($(h2.west)+(0,2)$); 3576 \path[->, color = MidnightBlue, thick, >=stealth] 3577 ($(h2.west)+(0,0.5)$) edge 3578 node[text = Black, yshift = .3cm, sloped] {200 OK: $\cal S$} 3579 ($(h1.east)+(0,-0.5)$); 3580 \path[rstmsg] 3581 ($(h2.west)+(0, -2.5)$) edge 3582 node[msglabel] {400 BAD REQUEST: $Z$} 3583 ($(h1.east)+(0, -3.5)$); 3584 \node at (5.3, 0) {}; 3585 \end{tikzpicture} 3586 \end{center} 3587 \end{minipage} 3588 \hspace{0.5cm} 3589 \begin{minipage}[b]{0.45\linewidth} 3590 \tiny 3591 \begin{description} 3592 \item[$\cal DK$] $:= [DK^{(i)}]_i$ 3593 \item[$t_j$] .. \\ \smallskip 3594 3595 \item[$\tilde{\cal T}$] $:= [t_j | j \in \kappa, j \neq \gamma]$ \\ \smallskip 3596 3597 \item[$k_\gamma$] $:= c T_\gamma = t_\gamma C$ 3598 \item[$b_\gamma^{(i)}$] $:= KDF_b(k_\gamma,i)$ 3599 \item[$c_\gamma^{(i)}$] $:= KDF_c(k_\gamma,i)$ 3600 \item[$C_\gamma^{(i)}$] $: = c_\gamma^{(i)} G$ 3601 3602 \item[$B_\gamma^{(i)}$] $:= B_{b_\gamma^{(i)}}(C_\gamma^{(i)})$ 3603 \item[$\beta_\gamma$] $:= \big[ B_\gamma^{(i)} \big]_i$ 3604 \item[$\cal S$] $:= \left[ S_{DK^{(i)}}( B_\gamma^{(i)} ) \right]_i$ \\ \smallskip 3605 3606 \item[$Z$] Cut-and-choose missmatch information 3607 \end{description} 3608 \end{minipage} 3609 \end{figure} 3610 \end{frame} 3611 3612 3613 \begin{frame}{Taler {\tt /refresh/link}} 3614 \begin{figure}[th] 3615 \begin{minipage}[b]{0.45\linewidth} 3616 \begin{center} 3617 \begin{tikzpicture}[scale = 0.4, 3618 transform shape, 3619 msglabel/.style = { text = Black, yshift = .3cm, 3620 sloped, midway }, 3621 okmsg/.style = { ->, color = MidnightBlue, thick, 3622 >=stealth }, 3623 rstmsg/.style = { ->, color = BrickRed, thick, 3624 >=stealth } 3625 ] 3626 \node[draw = MidnightBlue, 3627 fill = CornflowerBlue, 3628 minimum width = .3cm, 3629 minimum height = 10cm 3630 ] (h1) at (-4, 0) {}; 3631 \node[draw = MidnightBlue, 3632 fill = CornflowerBlue, 3633 minimum width = .3cm, 3634 minimum height = 10cm 3635 ] (h2) at (4, 0) {}; 3636 \node[above = 0cm of h1] {Customer}; 3637 \node[above = 0cm of h2] {Exchagne}; 3638 3639 \path[->, color = MidnightBlue, very thick, >=stealth] 3640 (-5, 4.5) edge 3641 node[rotate=90, text = Black, yshift = .3cm] {Time} 3642 (-5, -4.5); 3643 \path[->, color = MidnightBlue, thick, >=stealth] 3644 ($(h1.east)+(0,3)$) edge 3645 node[text = Black, yshift = .3cm, sloped] {POST {\tt /refresh/link} $C$} 3646 ($(h2.west)+(0,2)$); 3647 \path[->, color = MidnightBlue, thick, >=stealth] 3648 ($(h2.west)+(0,0.5)$) edge 3649 node[text = Black, yshift = .3cm, sloped] {200 OK: $T_\gamma$} 3650 ($(h1.east)+(0,-0.5)$); 3651 \path[rstmsg] 3652 ($(h2.west)+(0, -2.5)$) edge 3653 node[msglabel] {404 NOT FOUND} 3654 ($(h1.east)+(0, -3.5)$); 3655 \node at (5.3, 0) {}; 3656 \end{tikzpicture} 3657 \end{center} 3658 \end{minipage} 3659 \hspace{0.5cm} 3660 \begin{minipage}[b]{0.45\linewidth} 3661 \tiny 3662 \begin{description} 3663 \item[$C$] Old coind public key \\ \smallskip 3664 \item[$T_\gamma$] Linkage data $\cal L$ at $\gamma$ 3665 \end{description} 3666 \end{minipage} 3667 \end{figure} 3668 \end{frame} 3669 3670 3671 \begin{frame}{Operational security} 3672 \begin{center} 3673 \resizebox{\textwidth}{!}{ 3674 \begin{tikzpicture}[ 3675 font=\sffamily, 3676 every matrix/.style={ampersand replacement=\&,column sep=2cm,row sep=2cm}, 3677 source/.style={draw,thick,rounded corners,fill=green!20,inner sep=.3cm}, 3678 process/.style={draw,thick,circle,fill=blue!20}, 3679 sink/.style={source,fill=green!20}, 3680 datastore/.style={draw,very thick,shape=datastore,inner sep=.3cm}, 3681 dots/.style={gray,scale=2}, 3682 to/.style={->,>=stealth',shorten >=1pt,semithick,font=\sffamily\footnotesize}, 3683 every node/.style={align=center}] 3684 3685 % Position the nodes using a matrix layout 3686 \matrix{ 3687 \node[source] (wallet) {Wallet}; 3688 \& \node[process] (browser) {Browser}; 3689 \& \node[process] (shop) {Web shop}; 3690 \& \node[sink] (backend) {Taler backend}; \\ 3691 }; 3692 3693 % Draw the arrows between the nodes and label them. 3694 \draw[to] (browser) to[bend right=50] node[midway,above] {(4) signed contract} 3695 node[midway,below] {(signal)} (wallet); 3696 \draw[to] (wallet) to[bend right=50] node[midway,above] {(signal)} 3697 node[midway,below] {(5) signed coins} (browser); 3698 \draw[<->] (browser) -- node[midway,above] {(3,6) custom} 3699 node[midway,below] {(HTTPS)} (shop); 3700 \draw[to] (shop) to[bend right=50] node[midway,above] {(HTTPS)} 3701 node[midway,below] {(1) proposed contract / (7) signed coins} (backend); 3702 \draw[to] (backend) to[bend right=50] node[midway,above] {(2) signed contract / (8) confirmation} 3703 node[midway,below] {(HTTPS)} (shop); 3704 \end{tikzpicture} 3705 } 3706 \end{center} 3707 \end{frame} 3708 3709 3710 \begin{frame}{Use Cases: Refugee Camps} 3711 Today: 3712 \begin{itemize} 3713 \item Non-bankable 3714 \item Direct distribution of goods to population 3715 \item Limited economic activity in camps 3716 \item High level of economic dependence 3717 \end{itemize}\vfill\pause 3718 With GNU Taler: 3719 \begin{itemize} 3720 \item Local currency issued as basic income backed by aid 3721 \item Taxation possible based on economic status 3722 \item Local governance enabled by local taxes 3723 \item Increased economic independence and political participation 3724 \end{itemize} 3725 \end{frame} 3726 3727 3728 \begin{frame}{Use Case: Anti-Spam} 3729 \framesubtitle{Background: \url{https://pep.security/}} 3730 Today, p$\equiv$p provides authenticated encryption for e-mail: 3731 \begin{itemize} 3732 \item Free software 3733 \item Easy to use opportunistic encryption 3734 \item Available for Outlook, Android, Enigmail 3735 \item Spies \& spam filters can no longer inspect content 3736 \end{itemize}\vfill\pause 3737 With GNU Taler: 3738 \begin{itemize} 3739 \item Peer-to-peer payments via e-mail 3740 \item If unsolicited sender, hide messages from user \& 3741 automatically request payment from sender 3742 \item Sender can attach payment to be moved to inbox 3743 \item Receiver may grant refund to sender 3744 \end{itemize} 3745 \end{frame}