AmericanFortress 執行長 Mehow：公鏈合規隱私的缺失基礎元件

0:00區塊鏈缺失的基礎元件

0:00今天我們要聊的是區塊鏈世界一直缺少的那個基礎元件，這個問題從 Satoshi 時代就存在了。假設有人要轉加密貨幣給我，我給了對方一個地址，但我怎麼知道真的是他轉的？那個人真的擁有那個私鑰嗎？其實沒人知道，這一直是個問題。So we're going to talk about the missing primitive in all of blockchain, something you guys have been dealing with since the dawn of Satoshi. If somebody sends me crypto, right, I give them an address. How do I know that they really sent it? That it was really actually them? Was that person that sent the money, was their private keys? No one knows. That's been a problem since we got started, right?

0:36這也是為什麼 Binance 會被告，因為他們沒辦法有效防止洗錢，因為根本沒辦法確認資金來源。另一個缺失的基礎元件是隱私。區塊鏈預設一切公開，但傳統金融體系都是預設隱私，不只你知道誰轉錢給你，其他人都不知道。So this is why Binance got sued. They didn't do enough to prevent the money laundering because there was no way to actually tell. Right. So, what's the other missing primitive? The other missing primitive would be that there is no privacy. So by default, like, everything is public, whereas in every other financial system, everything is private. Not only do you know who sent the money, but no one else knows who sent you the money.

1:05在加密貨幣世界，大家都說是『偽匿名』，但其實只要你是機構，大家都知道你從哪個錢包轉了多少錢到哪裡。這不是我們想要的特性。可是你如果真的去做隱私，通常會被抓去關。最近雖然有點緩和，但需求越來越大，法規卻越來越嚴。And when you send money, somebody the whole world doesn't know. Right, in crypto, it's like pseudo-anonymous. A lot of the times, especially if you're an institution, everybody knows, oh yeah, Binance moved this much from this wallet to that wallet, right? So this is not a desirable property. But if you try to build privacy, you generally go to jail. And just recently, we kind of got a reprieve from this, which is cool, but we expect it to just continue, right? Demand is bigger than ever, but the rules are getting worse, right?

1:36隱私幣與合規困境

1:36舉例來說，大家都知道 Tornado Cash，開發者被抓去關又放出來。Zcash 這種隱私幣在南韓、阿聯酋都買不到，明年歐洲也幾乎全面禁了。但我們還是很想要隱私，所以我們嘗試做出合規的隱私方案，今天就來聊聊這些努力。Like as an example, I mean, you guys know Tornado Cash. The Tornado Cash developers went to jail, then they got out. Meanwhile, Zcash, which is probably the most popular privacy project alongside Canton and crypto, you can't get it in South Korea, you can't get it in the UAE, and next year you won't be able to get it at all, essentially in Europe because it's all banned, right? So. But we'd like to have the privacy, right? So we've made some attempts at trying to create compliance, so I'm going to talk about those.

2:05目前要確認誰轉錢給你，大概只有兩種方式：Satoshi test 跟 viewing key。Satoshi test 就是你要證明某個地址是你的，通常是網站要求你從那個地址轉一個特定數量的 satoshi。可是這流程很容易被騙，只要有 KYC 過的好人跟壞人合作，壞人就能用好人的地址過測試，這也是 Binance 被告的核心原因。So currently, the one way to sort of know who sent you the money, the best approximation we have, is two things. One is the Satoshi test, and the other one is the viewing key. So what's the Satoshi test? How many of you guys have had to do Satoshi tests? Okay, so about half the crowd, right? You guys know what the process is. You go to a website, you want to deposit some funds. They want to verify that the address that the money is coming from actually belongs to you, so they do a Satoshi test. So they say, All right, send us, you know, exactly 1, 2, 3.5 satoshis from this particular address. But then you want to do it from a bunch of different addresses because you got crypto all over the place, and you got to repeat this process. Now, how easy is this process to fool? It's trivial to fool. In fact, this was the cornerstone of the lawsuit against Binance, because what was happening there is they would take somebody that got KYC'd, and that person was totally clean and passed all the sumsub whatnot, and then they were dealing with, you know, a bad actor. And then they would say, All right, so what's your address, sir? And then—The good actor would call the bad actor and be like, What's our address? Right? Provide that address to the exchange, and now the exchange would be like, Okay, we want a Satoshi test from that address. No problem. I just call up my bad actor. They do the Satoshi test. So Satoshi tests are completely broken, right?

3:24Satoshi test 不只流程很麻煩、容易被騙，而且沒有任何身份資料，完全是偽匿名。這還會破壞隱私，因為一旦你用某個地址做過 Satoshi test，對方就知道那是你，之後你用那個地址的所有操作都被追蹤。另一個方法是 viewing key，大家都說有 viewing key 就能合規，但其實 viewing key 會把你的隱私全都暴露，還是沒辦法真正證明是誰轉的錢，最後還是只能『相信我啦』的帳本，這只有加密貨幣世界才會這樣。Not only is the process broken because it requires communication, you have to do one address at a time. It's trivially fooled. There's no identity data attached to that actual Satoshi test. Like, who sent the satoshi? You don't know. It's some other wallet, right? Pseudonymous. There's no payload, that's what I mean, and it's broken by quantum, and it also breaks the privacy. Now, once you've been Satoshi tested once for that address, those people know probably it's you. So what else are you doing with that address? What other deposits are you sending and receiving, right? So no privacy. Now, the other one is the viewing key. So what's the viewing key? Well, if you try to use privacy and then you try to be compliant, everybody's answer is, we got viewing keys. Whether they're user-controlled or they're controlled by a system, the viewing keys, what that does is you're revealing, like, what's happening inside that privacy engine, and you could ultimately tie it back to the [unclear] test, and now you have a broken thing with another broken thing, and—It's even worse, right? So you don't want to reveal your stuff forever. But even if you do this, you still have an answer who sent the money. It's all trust me bro accounting. So what kind of financial system in the world uses trust me bro accounting? Only crypto.

4:38打造合規又隱私的支付系統

4:38如果我們能神奇地解決這兩個問題，做出一個合規又隱私、而且超好用的系統，那就太棒了。其實我們真的做到了，這就是 American Fortress。我們做出了一個簡單、隱私、安全，而且不需要 viewing key 就能自帶證明的支付系統，接下來我會跟大家解釋怎麼運作。That's it, right? So if we were to magically somehow fix these two problems and make a compliant and also private system was super easy to use. We'd be in nirvana of sorts, right? So I'm going to posit that we built that, and that's called American Fortress. It's a payment that is simple, private, safe, and carries its own proof without viewing keys. I'm going to explain to you guys how it works, and we'll go from there.

5:02我們設計了兩個全新的基礎元件，放在一起就很神奇。第一個叫 Send to Name，這是一個通用的 stealth address 系統。你有一個用戶名稱，比如我的是 Mihal，這個 fortress name 可以公開貼在 IG，任何支援的錢包都能直接轉給你。我們已經有 beta 版錢包，未來也會有更多錢包支援，像是 MetaMask Snap。So first of all, we have a couple new primitives that have never really been done in crypto. And when you put these two primitives together, you get something super magical, right? So the first one is called Send to Name. This is a universal stealth address system. So in our system, you have a username. Like my username is Mihal. That fortress name I can publish on Instagram and just say, Send me crypto with any compatible wallet, which is also American Fortress wallet, which you can get the beta at our website already. But it'll also be a bunch of other wallets. We're building a MetaMask Snap, for example. So we expect that a lot of the industry will have this extra feature.

5:36這聽起來有點像 ENS，但其實更進階。每個人之間的 stealth address 都是獨立計算的，比如 Josh 轉給我，是地址 A，另一個人轉給我，是地址 B，只有收款人和付款人知道自己的地址範圍。我們稱這種設計為『公開名稱、私密交易』，你可以公開你的名稱收款，但沒人知道你實際收了多少錢。And initially it feels like ENS, like you bought a name or you got a free name and now you can just receive money. But it's actually not that simple. What happens is there is a stealth address computed between the two counterparties. So if Josh over here is sending me money, that'll go to address A. If some other user is sending me money, that'll go to address B. And it's always unique between the users. No one knows what the addresses are except the recipient and the sender, and the recipient and the sender only know their own address space. So we call this public names, private transactions, because you can just give out some of your name and just receive all the crypto, and no one knows how much you received, even you're using transparent to transaction. A transparent-to-transparent transactions on a public chain.

6:21零知識證明解決身份問題

6:21這樣雖然解決了隱私，但還沒解決『到底是誰轉錢給你』這個問題。為此我們又設計了一個新基礎元件，叫做零知識種子來源證明（Zero-Knowledge Proof of Seed Provenance），我們開玩笑叫 ZK Pospieszalski，因為 POSP 是我姓的前四個字母。我們有 16 項專利，這個證明可以讓你證明你擁有某個地址，但不用暴露你的種子。So that's cool, but I haven't actually proved to you the second problem. The second problem is who sent the money, right? So this is another new primitive that we created called a zero-knowledge proof of seed provenance, jokingly called the ZK Pospieszalski because POSP is the first four letters of my last name and I'm Michal Pospieszalski, but you can just call me Michal. What does this proof do? Well, you have a seed, right? And then there is a derivation through some hardened steps to create your chain addresses. And I don't have the time to, like, go super into the super geeky math. I did come up with a lot of this stuff. We have 16 patents in this space. What this does is lets you prove that you own this address without revealing your seed.

7:05在我們系統裡，Send to Name 也用到這個機制。每一筆交易，UI 會顯示 Alice 轉給 Bob，就像是加密貨幣界的私密 PayPal。有了這兩個新基礎元件，就可以做出很多很酷的功能。So in our system, we have a similar mechanism for how the names, the send to names. So when you're a user, not only are you sending to someone, that someone is receiving money from you. So in our UI, you get nonstop Alice sent to Bob. Every single transaction is like private PayPal for all of crypto. Once you have those two primitives, now you can get really crazy. Now you can do some really magical things.

7:29SafeSend：跨鏈隱私與合規

7:29我們第一個推出的功能叫 SafeSend，這就像是全鏈版的 Zcash。我們會部署到所有主流鏈，像 Solana、Bitcoin、Ethereum、Arbitrum、ZeroG 等等。SafeSend 的隱私池會強制驗證零知識種子來源證明，所以即使你在隱私池裡轉帳，收款人也有密碼學證明知道是你轉的錢，完全不需要 viewing key。So the first magical thing we're doing is called SafeSend. SafeSend is like Zcash for all of crypto. We're deploying it to all chains. So imagine you just have the same privacy whatever chain you want to use. So at launch, we got Solana and Bitcoin and Ethereum and Arbitrum and ZeroG and a lot of chains that are, you know, fairly popular and—It's the same mechanism, right? But why is it different than, say, why doesn't it have the same problem of you need viewing keys? Well, because our SafeSend, that confidentiality pool, enforces that zero-knowledge proof of seed provenance. So what you have is even though you're sending from Alice to Bob and you're Alice, in the privacy pool, Bob has cryptographic proof that you sent the money. With no viewing keys, so it's cryptographically the same. So now every recipient already knows who sent the money, right? But there's more.

8:25這樣每個收款人都知道是誰轉錢給他，但還有一個問題：Alice 到底是誰？我們跟全球最大的 KYC 服務商之一合作，10 月 12 號會有新聞稿。用戶可以在錢包或 SDK 裡取得自己的密碼學身份憑證，這些憑證完全屬於你。你可以選擇要揭露多少資訊，比如只說我是 Mihow，或是加上駕照、護照，或只證明我超過 18 歲、是美國居民，其他都不公開。Now it's great in your log, it says, Oh yeah, Alice sent me money. That's cool. But who is Alice, right? Remember, the original problem I posited is who sent the money, right? So. We have a fix for that. We are partnering with one of the biggest KYC providers on Earth. I can't name them yet until October 12th, but look for the press release from American Fortress and the big KYC provider that all of you have already used. But in our system, you as a user can go in the wallet or inside the SDK, inside another wallet that's using our tech, obtain cryptographic credentials of who you are, and those become yours. And now, because of this primitive where Alice is talking to Bob, we, by the way, have also the ability to, in an encrypted chat, communicate between the two parties. So not only know who sent the money, but you can talk to them, and you can prove who you are to them.

9:18沒錯，合作對象就是 Sumsub。我們會推出跟 Sumsub 整合的功能，讓你可以選擇跟誰分享你的身份憑證。這是全球第一個後量子、去中心化的 Sumsub 方案，讓你可以做到錢包對錢包的完美 KYC。還有第三方證明技術，可以讓你對第三方證明錢包沒說謊。So, oh wait, whoops. Well, they're up there already. I'm sorry, it's Sumsub. So we're doing a release with Sumsub. Where you'll be able to share your cryptographic credentials with who you choose. Now, why is that cool? Well, what happens now is anytime you share your credentials with someone, they know that you sent the money, but not just it was Alice. It's like, Mihow, Mihow from Wyoming, you know? And you can choose, like, what level of disclosure you do. You can say, Oh, I'm just Mihow. From Wyoming, or, and here's my driver's license or my passport, I can say I'm over 18 and I'm just a resident of the United States and otherwise I'm anonymous. So there's blinded claims in that as well. So this is the first post-quantum decentralized version of Sumsub you can get on Earth. So now you have the ability to have perfect KYC wallet to wallet, right? So. And you can reveal there's a third-party proof tech we have on top of this where you can prove to third parties what happened, that your wallet's not lying, okay?

10:19量子安全與多鏈身份證明

10:19這一切很神奇，為什麼我是第一個跟大家分享這些？再給大家一個 bonus。這個零知識來源證明除了讓隱私合規，還能讓所有加密貨幣都量子安全。你現有的地址不用換，只要加上這個證明，鏈上就能直接驗證你擁有這個地址，跟 ECDSA 簽章一樣，但我們的方法已經是量子安全。So this is sort of magical because, like, why am I the first guy telling you this? And I'll give you a little bonus because I see I have four minutes. I got through all that in 12 minutes, so I'm happy. So I'll give you even more, more value. That zero-knowledge proof of provenance. Creates compliant privacy, but there is another thing that it does. It can make all of crypto quantum proof. Your existing addresses. Remember the thing I just described. There is a zero-knowledge proof that proves that you own an address. So that's equivalent to signing ECDSA. It's just a different way of doing it. It just so happens that our way is already quantum proof. So now you don't need to migrate addresses at all. The chain just adds this extra proof, and now magically everything works.

11:24還有一個功能，如果你能證明一個地址是你的，也能證明多個地址都是你的。這樣 DeFi 就能完全杜絕洗錢，因為 DeFi 可以強制驗證來源、找零、目的地址都是同一個人，驗證只要 250 毫秒，甚至跨鏈都可以。這些我已經研究四年了，因為是隱私領域，一開始很低調，怕被抓。直到去年隱私議題突破，才開始有更多進展。Oh, wait, wait, there's one more thing it does. I almost forgot. If you can prove that one address is yours, you can prove that any number of addresses are yours. So now we can have DeFi that doesn't commit money laundering at all, because the DeFi can enforce the proof that takes 250 milliseconds to verify, and you can prove that your change address, your source of funds address, and your destination address are all yours, even though if they're on different chains. So why am I the first person telling you this? Well, I've been working on this problem for four years. And because it's privacy, it was a sort of secret project, and, you know, I didn't want to go to jail. But a year ago, privacy broke through, and we really, really, you know, got a lot more traction.

12:03突破研究與未來展望

12:03幾年前我們開始研究怎麼讓這個東西更快。當時有其他量子密碼學研究者發表論文，做出類似的零知識來源證明，但他們算一個證明要 35 分鐘，還是在很強的伺服器上，手機上可能要幾小時。我們現在已經做到 3 秒，下一版會進步到 1 秒以內。這樣手機隨時都能算出證明，完全不會洩漏隱私。You know, years ago, we started working on how to get this thing to work faster. And there was some research already done by other people in this space, and they were quantum researchers, and they published a paper about four years ago that did that zero-knowledge proof of provenance for purposes of quantum tech. Now, we started around the same time, but we wanted to get it for compliance and all these other things that we're doing. The problem was when they did it, it took 35 minutes to compute one proof. So obviously, if you have to wait, and that was on a pretty beefy server. So like on a phone, that would be hours, right, just to compute the single zero-knowledge proof. And we got it to work in three seconds. And the next version is sub-second. So now your phone can just always compute these proofs and therefore prove to other people who you are without revealing your privacy at all.

12:54我是 Mihal，來自 American Fortress，這就是區塊鏈缺失的基礎元件：如何在公鏈上實現合規隱私。And that's it. I'm Mihal from American Fortress, and that is the missing primitive: how to get compliant privacy on public blockchains.