Privacy Pools: Where Will They Go After Vitalik's New Paper and Tornado Cash?
Author: Kaori, BlockBeats
Editor: Jaleel, BlockBeats
When it comes to privacy and its relation to human nature, although blockchain data is open, transparent, and traceable, we seem to have found a utopia of freedom and equality. On the other hand, how to protect transactions or personal privacy has become an unavoidable issue. Based on the need for privacy protection, the more difficult problem is that we still live in a centralized and regulated digital society. How to make privacy and regulation coexist on public blockchains will be a long journey.
Last week, Vitalik and four other authors published a paper titled "Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium", which has sparked widespread discussion.
Related reading: "Vitalik's latest paper: How privacy pool protocols protect user privacy and meet compliance requirements".
When it comes to on-chain privacy protection, we have to mention Tornado Cash. The authors also claim that this paper aims to solve the problem that Tornado Cash cannot distinguish between illegal users and normal users, but it actually avoids legal debates about who is right and who is wrong, and proposes a new technical solution called Privacy Pools based on existing privacy protocol technologies such as Tornado Cash.
Privacy Pools wants to solve the problem of whether privacy and regulation can really coexist on public blockchains.
Privacy Pools How to prove that money is "clean"
As a neutral infrastructure, the core idea of Privacy Pools is to allow users to publish zkSNARK proofs to prove that their funds come from known legitimate sources or not from illegal sources, without publicly disclosing the entire transaction process.
That is to say, by using Privacy Pools, you can prove in a way that anyone can verify that your deposit is legal and not from illegal funds. Then provide this proof, and you don't have to disclose your exact deposit information, thus protecting transaction privacy.
With the zkSNARK proof supporting this model, the specific implementation of Privacy Pools requires another core configuration - the Association Set.
The so-called association set is generated by the association set provider (ASP) following certain rules, such as the rule of "inclusion" - "all deposits from trusted trading platforms", while the rules of other association sets are "exclusion" - "all deposits except those marked as risky". Then, users only need to prove their membership in the association set without publicly revealing which association set they have chosen. They only need to make a commitment to indicate compliance without fully disclosing their transactions.
When a user deposits funds into Privacy Pools, each deposit is assigned a unique secret/coin ID. When making a withdrawal, the user specifies an associated set that is linked to their deposit. By providing a nullifier, the user can prove that the deposit exists and is located within the selected set without revealing the specific deposit. In special cases, the user can also provide more direct proof to the counterparty to demonstrate the specific deposit.
Privacy Pools' associated set has another noteworthy feature. Ordinary users are incentivized to prove that they belong to a legal associated set in order to "prove their innocence." However, illegal users are unable to provide this proof, achieving a "separation of powers."
Vitalik provided a vivid and graphic explanation of one of the use cases in his paper, which is excerpted here for readers to understand.
Assuming there are five users: Alice, Bob, Carl, David, and Eve. The first four are honest, while Eve is a known thief. Although Eve's true identity may be unknown, the public knows that funds received by the address labeled "Eve" have been stolen.
Each user can choose an associated set when withdrawing funds, and this associated set must include their own deposit. This means that when selecting an associated set, each user cannot exclude their own deposit.
For the four users Alice, Bob, Carl, and David, they can choose an association set that does not include the known bad actor Eve in order to avoid being associated with her. This way, they can prove that they are not associated with Eve.
However, Eve faces a problem - he cannot choose an association set that only includes himself, as this would immediately reveal him as a bad actor. In an attempt to hide his bad behavior, Eve may choose an association set that includes all five users, hoping to confuse the situation.
Due to the fact that the other four users have chosen association sets that do not include Eve, her attempts have become futile as people can determine through process of elimination that Eve is the malicious actor.
The result is that by selecting the associated set, Alice, Bob, Carl, and David can prove that they have no association with the known bad actor Eve. Eve cannot hide his bad behavior because his associated set includes everyone.
This figure in the paper further illustrates the difference between these two proofs. The membership proof includes a specific deposit set, while the associated set of the exclusion proof includes all deposits except for a specific deposit set.
In theory, Privacy Pools "still allows" North Korean hackers or any illegal users to use the protocol, but they are unable to generate high-quality whitelist proofs like Eve, although they may still generate low-quality or outdated proofs to temporarily confuse regulators, making it easier for regulators to locate illegal users than before.
关联集的是与非
The associated set is a binary operation of "and" or "or".
The emergence of Association Sets allows users to prove their membership in the set rather than proving the direct connection between withdrawals and deposits. However, there are many doubts and debates in the community about whether Association Sets can really protect users' privacy.
AX1 editor-in-chief VL (@VladislavLiu) said that illegal "users can still use low-quality whitelist certificates to deceive the system. The paper suggests using third-party whitelist providers (i.e. associated set providers), but this brings another set of worms. What if these providers are not good enough? Or what if they are damaged?"
Who is qualified to provide these associated sets? The paper provides several solutions, but in reality, no organization or institution has yet come forward to say that they can. This is the problem that Privacy Pools will soon face, as well as the challenge faced by anyone who wants to obtain blockchain privacy rights. Trust or distrust, compromise or no compromise, or indifference, treating privacy as nothing.
「Tornado Cash」 VS 「Privacy Pools」
Since Privacy Pools are an improvement on Tornado Cash, let's take a look at the differences between the two.
The main idea of Tornado Cash is to mix a large number of deposit and withdrawal behaviors together. After depositing tokens into Tornado, depositors prove that they have made a deposit with a ZK Proof and then withdraw using a new address, thereby cutting off the association between the deposit and withdrawal addresses. As a result, only deposits and withdrawals can be seen on the chain, and the corresponding relationship between the two cannot be seen, making it anonymous.
Related reading: "The Most Ingenious ZK Application: Reviewing the Principles and Business Logic of Tornado Cash".
The key issue with Tornado Cash is that legitimate users find it difficult to dissociate themselves from the criminal activity that the protocol attracts. If the proof is irrelevant, users must rely on Tornado Cash's centralized servers. Users need to provide specific information about their withdrawals to the server, which uses its own database to check which deposit corresponds to the withdrawal and then generates the proof. However, as mentioned earlier, Privacy Pools place legitimate users' transactions in a whitelist through the use of associated sets, making it impossible for illegal users to prove that their transactions belong to this associated set, thereby distinguishing between legitimate and illegal users.
That is to say, Tornado Cash uses a universal anonymity set - all deposits and withdrawals are mixed in one pool. Privacy Pools use customizable anonymity sets - users can choose the deposit and withdrawal methods they want to mix according to their preferences and needs.
Twitter user @0xArhat created a table comparing the two from multiple perspectives such as flexibility, disclosure, and privacy level.
Privacy Pools allows for customizing the content of associated sets, which enables customization and updates of associated sets based on different jurisdictions or changing rules and requirements of entities. Each associated set has its own fund pool and proof rules, thus avoiding fund pollution. However, all deposits of Tornado Cash are placed in one fund pool, which makes it easy for anonymous violations to occur.
Privacy Pools also incentivize users to behave honestly in terms of compliance and reputation, while Tornado Cash operates on a trustless and permissionless basis, which naturally attracts the "favor" of illegal actors.
These are some of the settings envisioned by the authors of the paper that can spare Privacy Pools from the fate of Tornado Cash, enabling regulation and privacy to coexist. To achieve this, it is necessary to completely have privacy without permission, sacrifice a little privacy, and add some "flexibility".
KOL Eva Beylin (@evabeylin) stated that Privacy Pools can not only excel in transaction privacy, but also contribute to various aspects such as DAO governance (membership), node reputation, and KYC compliance. The unintentional addition of Privacy Pools may have a better future than Tornado Cash.
How to use Privacy Pools
Currently, Privacy Pools is still in the testing phase and users can test the protocol using the Optimism Goerli testnet.
1. Create Note Wallet.
2. Generate a mnemonic phrase and securely store it.
3、Set Password
4. Download the Secrets file and upload the .json file when logging in.
5. The registration process has ended. When logging in, click "Select File" and upload the downloaded JSON file. Then enter the password.
Privacy is not a crime, privacy is a right
The experience of Tornado Cash founder has dealt a blow to the belief of "code is speech", and the emergence of Privacy Pools has once again raised questions about the decentralization of blockchain. For example, using Privacy Pools proves whether the source of funds has violated the original purpose of protecting privacy. However, in order to comply with regulations, concessions must be made to strike a balance between the two, as more and more people realize that complete anonymity is no longer feasible in today's world.
At the end of the day, there is a natural conflict between complete privacy and regulatory compliance. We cannot ignore this issue, but we can choose to find a balance. Privacy Pools may not be the solution for everyone, but it is indeed a solution for many people.
Where is that balance point? It requires not only industry builders to think about, but also legislators and law enforcement officers, because if you define privacy as a crime, then only criminals have privacy.
Reference content:
1.https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4563364
3.https://www.techflowpost.com/article/detail_13920.html
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
