Balancing Privacy and Accountability in Digital Payment Methods Using Zk-Snarks

1 Faculty of Electrical Engineering, Mathematics & Computer Science Balancing privacy and accountability in digital payment methods using zk-SNARKs Tariq Bontekoe M.Sc. Thesis October 2020 Supervisors: prof. dr. M. J. Uetz (UT) dr. M. H. Everts (TNO/UT) dr. B. Manthey (UT) dr. A. Peter (UT) Department Applied Mathematics Discrete Mathematics & Mathematical Programming Department Computer Science 4TU Cyber Security Faculty of Electrical Engineering, Mathematics and Computer Science University of Twente Preface This thesis concludes my seven years (and a month) as a student. During all these years I have certainly enjoyed myself and feel proud of everything I have done and achieved. Not only have I completed a bachelor’s in Applied Mathematics, I have also spent a year as a board member of my study association W.S.G. Abacus, spent a lot of time as a student assistant, and have made friends for life. I have really enjoyed creating this final project, in all its ups and downs, that concludes not only my master’s in Applied Mathematics but also that in Computer Science. This work was carried out at TNO in Groningen in the department Cyber Security & Ro- bustness. My time there has been amazing and the colleagues in the department have made that time even better. I am also happy to say that I will continue my time there soon. There are quite some people I should thank for helping my realise this thesis. First of all, my main supervisor Maarten who helped me with his constructive feedback, knowledge of blockchains and presence at both TNO and my university. I would also like to thank my other supervisors, Bodo and Andreas. They both provided me with useful feedback from their respective backgrounds, which helped my to formulate this thesis as lies before you. My graduation committee is completed by Marc and Jasper, whom I thank for spending their valuable time on reading this quite lengthy document. Finally, many thanks go out to Femmy for encouraging and supporting me during my ups and downs. I hope you enjoy reading my thesis. Tariq Bontekoe Leek, September 21, 2020 iii Summary In the last few years the bank card has overtaken cash as the most used payment method. This increased use has also given our banks larger amounts of information on our payment behaviour, whereabouts, and financial situation. In a world where the value of information has increased this puts clients in a weak position with respect to their banks. Legislation also requires banks to use this information to ensure that their clients do not use bank accounts for malicious activities. At the same time many people start to value their privacy more and more, leading to a conflict of interest. To solve this conflict we present a digital permissioned decentralised anonymous payment scheme. Our scheme provides anonimity for its users, whilst also allowing banks to adhere to current regulations without decreasing anonimity. zk-SNARKs form the basis for our anonimity and implement possibilities for banks to enforce certain regulations. Next to making payments from one user to another, our scheme also allows for banks to (dis)allow their clients access to the payment scheme. Next to his banks can impose a limit on the amount any client can spend anonymously in a certain amount of time. We also present the option for clients to apply a ‘timelock’ to the output value of a transaction, making the output value of a transaction unspendable for a certain amount of time. Finally, we introduce an additional group of actors in our anonymous payment scheme called judges. These judges have the ability to view encrypted transaction details of any transaction that does not adhere to the limits imposed by the scheme. The details can be viewed at any later point in time, as correctness of the values is guar- anteed by the verifiable encryption scheme. This thesis not only presents a construction of the payment scheme, but also provides proofs for correctness and security. Next to this, we discuss the performance of our proof of concept implementation. v Contents Preface iii Summary v List of acronyms xi 1 Introduction 1 1.1 Related work . .2 1.2 Research goal and questions . .4 1.3 Our contribution . .5 1.4 Thesis structure . .6 2 Preliminaries 7 2.1 Notation and terminology . .7 2.2 zk-SNARKs . 10 2.3 Verifiable encryption and SAVER . 13 2.4 Cryptographic building blocks . 15 2.5 Merkle trees . 19 3 Related work 21 3.1 Centralised anonymous e-cash . 21 3.2 Decentralised anonymous payment schemes . 23 3.3 Obfuscation based privacy coins . 24 3.4 Zerocoin and Zerocash . 26 4 Solution sketch 29 4.1 Requirements . 29 4.2 Overview . 31 4.3 Zerocash basis . 33 4.4 Towards an account-based model . 40 4.5 Access control . 43 4.6 Conversion to and from fiat currency . 45 vii 4.7 Transaction limit . 48 4.8 Auditability . 51 4.9 Timelocks . 55 5 Solution definition 57 5.1 Data structures . 57 5.2 Arithmetic circuits . 60 5.3 Algorithms . 61 6 Solution construction 65 6.1 Building blocks . 65 6.2 zk-SNARK statements . 68 6.3 Algorithms . 71 6.4 Completeness and security . 75 7 Implementation 77 7.1 Key management . 77 7.2 Instantiation of cryptographic building blocks . 79 7.3 Arithmetic circuit construction . 82 7.4 Performance . 84 8 Discussion and future work 89 8.1 Conclusion . 89 8.2 Discussion . 90 8.3 Future work . 91 References 93 Appendices A Building Blocks 99 A.1 Distributed ledgers and cryptocurrencies . 99 A.2 Proving of Knowledge . 103 A.3 Arithmetic circuits and QAPs . 105 A.4 Commitments . 106 B Security games and definitions 109 C Security proofs 115 C.1 Completeness . 116 C.2 Payment oracle . 119 C.3 Ledger indistinguishability . 122 C.4 Transaction non-malleability . 130 C.5 Balance . 134 C.6 Access control . 140 C.7 Spend limit . 141 C.8 Accountability . 144 C.9 Timelock . 145 List of acronyms AML anti-money laundering CDD customer due diligence CRH collision-resistant hash function EUF-CMA existential unforgeability against chosen message attack IK-CCA key indistinguishability under chosen ciphertext attack IND-CCA indistinguishability under chosen ciphertext attack I2P Invisible Internet Project KDF key derivation function KYC know your customer MAC message authentication code NIZK non-interactive zero-knowledge proof NP non-deterministic polynomial time PRF pseudo random function QAP quadratic arithmetic program RingCT ring confidential transactions R1CS rank-1 constraint system SAVER SNARK-friendly, additively-homomorphic, and verifiable encryption and decryption with rerandomization SNARG succinct non-interactive argument SNARK succinct non-interactive argument of knowledge SUF-CMA strong existential unforgeability against chosen message attack SUF-1CMA strong existential unforgeability against one-time chosen message attack UTXO unspent transaction output ZKP zero-knowledge proof zk-SNARK zero-knowledge succinct non-interactive argument of knowledge zk-STARK zero-knowledge succinct transparent argument of knowledge xi Chapter 1 Introduction While in the previous century most of our transactions were still made with cash, nowadays virtually no one carries cash around. Most people perform all their monetary transaction via their plastic bank card, mobile banking, or another form of digital transactions. Using these methods, the details of every single transaction are stored by a person’s bank. This gives the bank great insight in a client’s shopping behaviour, whereabouts, and financial situation. Even though this might be acceptable in some situations, it is not desirable as it gives banks a too strong position with respect to their clients. As a client, one might wonder if a bank actually requires all the information about every transaction. Moreover, it is generally not insightful to the client how his or her personal information is processed. Giving control of the data involved in monetary transaction back to the clients would clearly be beneficial to their privacy. A recent approach to return the power over financial transactions to the clients, without requiring them to pack their wallets with physical money, are so called cryptocurrencies. At the end of 2008 a person, or group of persons, published under the name of Satoshi Nakamoto a paper called: “Bitcoin: A Peer-to-Peer Electronic Cash System” [1]. A couple of months later, in January 2009, the first operational Bitcoin software was launched. The genesis (initial) block got mined and the foundation for many new and different decentralised ledger technologies was laid. In the years that followed, one after the other virtual coin was introduced, most of them having similar behaviour to Bitcoin. These coins however did not focus on user privacy. Their main goal was decentralisation of financial power. In most cases the privacy of users was virtually non-existent as every transaction is publicly available under a, generally traceable, pseudonym. Eventually, this lead to the introduction of so called privacy coins, i.e. cryptocurrencies that provide, up to some level, trans- actional privacy for its users. Unfortunately, these currencies are to some extent in conflict with current anti-money laundering (AML) regulations, which causes some governments to take actions against these privacy coins [2]–[5]. In this thesis a 1 2 C HAPTER 1 . I NTRODUCTION solution that solves the privacy problems with current (AML) regulations in mind is proposed. 1.1 Related work Before deciding on a solution direction for the problem as described above, we take a brief look at existing solutions for this and similar problems. In Section 3 we discuss these solutions in more detail. There are two main types of solution directions to be considered: centralised and decentralised. An early, well-known centralised solution for anonymous payments is Digicash [6].

Load more