1
00:00:00,480 --> 00:00:04,220
which is on Bitcoin Monero Atomic Swaps.

2
00:00:04,220 --> 00:00:07,560
I know this is a very hot level of research going on recently.

3
00:00:07,560 --> 00:00:09,080
There's a ton of interest.

4
00:00:09,260 --> 00:00:12,740
So , ZKAO, OK, you got the screen share going here.

5
00:00:12,740 --> 00:00:14,420
Hi, can you hear me?

6
00:00:14,420 --> 00:00:15,960
We can hear you, yes.

7
00:00:15,960 --> 00:00:23,240
I'm going to, since everything seems to be working on our end, I'm just going to hop off and just let you take it from here.

8
00:00:23,240 --> 00:00:24,160
How about that?

9
00:00:24,960 --> 00:00:25,460
Oh, yeah.

10
00:00:25,460 --> 00:00:28,680
So, basically, I would like to do it more interactively.

11
00:00:28,680 --> 00:00:34,720
So, feel very welcome to ask questions or ask questions that people drop on the chat.

12
00:00:35,440 --> 00:00:52,640
So, basically, in 2017, we were in CCC and we were discussing and we found it would be very interesting to create a project to swap Bitcoin for Monero in a trustless manner, atomically.

13
00:00:52,640 --> 00:01:14,920
And it was just because it sounded very, very interesting and my colleague Hashed couldn't get his head out of that and we ended up working on this project much more than we initially expected.

14
00:01:14,920 --> 00:01:31,040
So, one of the things that cryptocurrencies bring is this permissionless way of exchanging money online, for example, on the internet.

15
00:01:31,820 --> 00:01:39,280
Before, all the electronic money was intermediated.

16
00:01:40,780 --> 00:01:42,900
Can you actually see my screen?

17
00:01:44,140 --> 00:01:47,160
Yes, I can see your screen, yes.

18
00:01:51,480 --> 00:02:05,120
And there is an issue with this because we have cash in society and cash is a bearer, peer-to-peer, permissionless and privacy-preserving form of money.

19
00:02:05,520 --> 00:02:13,360
And who has it can spend it, has the right to spend it by having physical possession, peer-to-peer.

20
00:02:13,360 --> 00:02:17,520
You can just meet someone and give it to this person directly.

21
00:02:17,680 --> 00:02:20,620
If it's peer-to-peer, it's also permissionless.

22
00:02:20,620 --> 00:02:24,220
Nobody is on the way to intercept this transaction.

23
00:02:24,300 --> 00:02:33,480
And privacy-preserving, you can be locked in a room, give cash to someone and nobody else needs to know about it.

24
00:02:34,280 --> 00:02:35,780
And cash is legal.

25
00:02:35,780 --> 00:02:52,360
So, we should not downgrade our online money by accepting a totally transparent financial system like Bitcoin.

26
00:02:52,360 --> 00:03:03,560
We have to have ways to be able to exercise privacy by, for example, swapping Bitcoin into Monero and going into some private wall.

27
00:03:03,560 --> 00:03:07,180
But you should do that in a permissionless manner.

28
00:03:07,180 --> 00:03:09,960
Like, you should not ask permission to go private.

29
00:03:10,440 --> 00:03:20,560
So, it looks like from this definition of cash, Monero is cash and Bitcoin is almost.

30
00:03:20,560 --> 00:03:23,080
Bitcoin has this property of permissionless.

31
00:03:23,080 --> 00:03:30,300
So, you could spend your money in the wrong way and nobody could prevent you from doing that.

32
00:03:30,300 --> 00:03:39,420
However, because it's not privacy-preserving, people can watch what you're doing with your money and they might go after you because of that.

33
00:03:39,420 --> 00:03:43,020
So, this is very problematic in an open society.

34
00:03:46,820 --> 00:03:52,580
So, the way we see atomic swaps is more like a cash-to-cash exchange.

35
00:03:52,580 --> 00:04:01,700
So, you have euros and you meet someone who has US dollar, you agree on an exchange rate and you exchange it in private.

36
00:04:01,700 --> 00:04:04,600
Nobody else needs to get involved in this exchange.

37
00:04:04,840 --> 00:04:07,380
Only the people in the exchange.

38
00:04:07,540 --> 00:04:11,860
And we think that atomic swaps are very similar to this.

39
00:04:11,860 --> 00:04:14,720
So , it's a cash-to-cash exchange.

40
00:04:15,120 --> 00:04:21,320
And in the same way that you wouldn't want to...

41
00:04:21,320 --> 00:04:29,920
If someone tries to buy your motor for $2,000, you might take cash and not worry too much about it.

42
00:04:29,920 --> 00:04:44,760
But if you are trying to sell your house and somebody shows up with a million in cash, you are going to worry about it because you would want to know where it came from and if it's not counterfeit.

43
00:04:44,760 --> 00:04:52,020
So, there is like this natural tendency of people to judge the quality of what they're getting in exchange.

44
00:04:52,420 --> 00:04:58,340
So, like in the crypto space, now people are responsible for taking care of their private keys.

45
00:04:58,340 --> 00:05:05,420
They could also be responsible for not engaging into suspicious-looking transactions.

46
00:05:05,420 --> 00:05:10,700
Like if a transaction is too good to be true, it's probably not true.

47
00:05:11,000 --> 00:05:18,200
So, one thing that Monero would gain...

48
00:05:18,200 --> 00:05:28,080
So, Bitcoin users for sure would gain a lot of privacy by being able to switch to Monero in a trustless and permissionless manner.

49
00:05:28,080 --> 00:05:31,540
But what Monero gains from Bitcoin is its liquidity.

50
00:05:31,540 --> 00:05:37,480
It has like a hundred times higher market cap and it's much more easily accessible.

51
00:05:37,480 --> 00:05:40,800
So , Bitcoin is easy to get.

52
00:05:40,800 --> 00:05:51,040
And if you have a network that you can get Monero, exchange Monero atomically, then you could go into Monero for that path.

53
00:05:51,520 --> 00:05:56,200
So, it's very interesting to have permissionless entry into a privacy currency.

54
00:05:57,740 --> 00:06:03,360
It's not nice to have to ask for permission to go private.

55
00:06:03,980 --> 00:06:16,200
So, with this, I'm going to go and I'm going to try to go through the protocol in the form of a diagram.

56
00:06:18,160 --> 00:06:20,320
So, here first I'm going to show...

57
00:06:20,320 --> 00:06:22,220
This is the paper that includes...

58
00:06:22,220 --> 00:06:24,900
It's the complete paper after the research.

59
00:06:24,900 --> 00:06:38,200
So, this research started literally like three years ago and Hashed really did a good job and you can find the summary here.

60
00:06:38,860 --> 00:06:41,900
And so, I will...

61
00:06:42,640 --> 00:06:48,900
I think the easiest way to understand the atomic swap is to play for the protocol.

62
00:06:48,900 --> 00:06:52,660
And we have a representation of the protocol as a patronet.

63
00:06:52,660 --> 00:06:54,480
Can you guys tell me if you can see?

64
00:06:54,480 --> 00:06:59,200
If I zoom out, can you still see like this?

65
00:07:00,160 --> 00:07:03,120
Yes, we're largely able to see.

66
00:07:03,140 --> 00:07:05,600
I'm getting a good quality coming in from you.

67
00:07:05,600 --> 00:07:09,400
So, the people watching the stream should still be able to read the text.

68
00:07:09,600 --> 00:07:10,960
Okay, that's great.

69
00:07:10,960 --> 00:07:13,040
Okay, so I'm going to just show like this.

70
00:07:13,040 --> 00:07:15,520
So, here we have

71
00:07:19,480 --> 00:07:21,760
basically a protocol representation.

72
00:07:21,760 --> 00:07:29,640
So, here you have Bob who starts with Bitcoin in his private wallet and Alice that starts with Monero on her private wallet.

73
00:07:30,080 --> 00:07:39,440
And what if the protocol goes through like Alice should end up with Bitcoin and Bob should end up with Monero on their private wallets.

74
00:07:39,800 --> 00:07:50,580
And I'm going to play the protocol and slowly I'm going to explain more and more what each transaction does and how they're looking like.

75
00:07:50,580 --> 00:07:59,000
So, basically all the logic will happen on the Bitcoin side because Monero doesn't just fix keys.

76
00:07:59,000 --> 00:08:06,440
So , how we do it is like you do a whole game theory on the Bitcoin side.

77
00:08:06,440 --> 00:08:13,520
So, like Bob with Bitcoin is going to need the protocol by creating two transactions.

78
00:08:13,880 --> 00:08:22,300
A softlock transaction that's going to be the transaction that locks the Monero, the Bitcoin that is going to be sent to Alice.

79
00:08:22,300 --> 00:08:29,360
So, the locked Bitcoin is going to end up with this script on this output.

80
00:08:32,120 --> 00:08:40,500
And a transaction that is a refund transaction and Bob already partially signs it and sends it to Alice.

81
00:08:41,000 --> 00:08:49,380
And this refund transaction is going to spend the softlock output and give the money back to Bob, basically.

82
00:08:49,380 --> 00:08:51,660
So, this is a refund path.

83
00:08:51,660 --> 00:09:01,200
So, Alice checks the information that Bob gives and Alice signs the refund transaction because all the information is correct.

84
00:09:01,700 --> 00:09:20,960
And having the refund, Bob can safely lock the money on this softlock contract and publish it to the blockchain, wait for it to be mined, and the money is going to be on this very special output here.

85
00:09:22,600 --> 00:09:25,200
Nothing happened on the Monero chain yet.

86
00:09:27,020 --> 00:09:32,120
Alice has to lock her money as well.

87
00:09:32,380 --> 00:09:39,480
And Alice is going to feel convinced she should do it because she can see that the locked Bitcoin is locked in the correct address.

88
00:09:39,480 --> 00:09:51,800
So, basically, Alice locks her Monero in this special address.

89
00:09:51,800 --> 00:09:55,800
This address is derived by both Alice and Bob.

90
00:09:56,760 --> 00:10:00,680
Actually, none of them control this address.

91
00:10:01,360 --> 00:10:04,680
They only know half of the private keys.

92
00:10:04,680 --> 00:10:12,520
So, what is interesting now is that whoever learns the other half of the private key gets the Bitcoin.

93
00:10:12,520 --> 00:10:13,940
Gets the Monero, sorry.

94
00:10:13,940 --> 00:10:18,220
And it's either going to be a refund or a complete stop.

95
00:10:18,220 --> 00:10:23,240
So, at this point, Alice can't do anything.

96
00:10:23,240 --> 00:10:27,100
Bob has to reveal a special secret.

97
00:10:27,100 --> 00:10:29,080
This is just a synchronization secret.

98
00:10:29,080 --> 00:10:35,940
It's like the authorization of Bob to let Alice move on the protocol.

99
00:10:37,660 --> 00:10:40,280
So, Bob shares the secret.

100
00:10:40,280 --> 00:10:44,000
This secret is needed to unlock this output.

101
00:10:44,000 --> 00:10:49,140
So, this output needs this secret, synchronization secret.

102
00:10:49,340 --> 00:10:52,660
It needs Alice.

103
00:10:53,840 --> 00:11:02,440
This Alice half key is the private span key that is locking this output here.

104
00:11:02,880 --> 00:11:05,020
So, Bob has half of it.

105
00:11:05,020 --> 00:11:06,480
Alice has the other half.

106
00:11:06,480 --> 00:11:12,740
So, basically, in order for Alice to span this output, she's going to have to reveal this key.

107
00:11:13,180 --> 00:11:15,540
How does she reveal this key?

108
00:11:15,540 --> 00:11:17,540
It's through this...

109
00:11:18,280 --> 00:11:27,480
So, basically, we use this ECDSA adapter signature, which is basically like Alice's...

110
00:11:28,000 --> 00:11:34,200
Bob gives Alice an encrypted transaction that in order for her to...

111
00:11:34,200 --> 00:11:41,540
an encrypted signature and in order for her to decrypt the signature and use it here, she has to...

112
00:11:43,160 --> 00:11:47,620
when she decrypts it, she leaks this key, basically.

113
00:11:47,980 --> 00:11:50,360
Because if you have the decrypted...

114
00:11:50,360 --> 00:11:55,440
if Bob has the decrypted and the encrypted version of the signature, he can recover easily this key.

115
00:11:55,900 --> 00:12:04,140
So, basically, you force Alice to reveal this key and Alice gets the Bitcoin in her private wallet.

116
00:12:04,140 --> 00:12:11,340
Now, this key that got leaked can be used by Bob to claim his monero on the other side.

117
00:12:11,620 --> 00:12:18,520
So, that's how the protocol would run in the successful case.

118
00:12:18,720 --> 00:12:22,740
But, of course, there are tons of cases that are not the successful case.

119
00:12:23,360 --> 00:12:29,780
And , for example, I went back in time a little bit.

120
00:12:31,560 --> 00:12:33,780
For example, here, like...

121
00:12:35,260 --> 00:12:41,840
basically, Bob decides that he doesn't give the secret to authorize Alice to continue running the protocol.

122
00:12:41,940 --> 00:12:43,480
So, he doesn't trigger this.

123
00:12:43,480 --> 00:12:44,380
What can Alice do?

124
00:12:44,380 --> 00:12:50,780
The only thing she can do is, like, after a timeout, this is a...

125
00:12:51,340 --> 00:12:54,860
she can publish the refund transaction.

126
00:12:55,520 --> 00:12:56,440
Okay, now let's try...

127
00:12:56,440 --> 00:12:58,960
now we're going to understand a little bit the refund transaction.

128
00:12:58,960 --> 00:13:06,560
So, Alice published this refund transaction because Bob wasn't responsive.

129
00:13:07,260 --> 00:13:09,040
He wasn't triggering this one.

130
00:13:09,040 --> 00:13:19,880
And so, like, right now, if Bob does not become responsive, Alice is going to be able to take this path and take the Bitcoin.

131
00:13:21,260 --> 00:13:27,300
But, if Bob can, he should become responsive, otherwise he's going to lose his money.

132
00:13:27,300 --> 00:13:32,660
And he's going to try to consume this output.

133
00:13:32,660 --> 00:13:37,570
And, again, this is, like, the same scheme as before with adapter signature.

134
00:13:37,860 --> 00:13:49,700
And this key is going to get leaked by Bob decrypting Alice's signature that is needed on this transaction.

135
00:13:50,640 --> 00:14:03,910
And it's interesting now that because Bob leaked his monero key, Alice can claim her refund on the monero chain like this.

136
00:14:04,850 --> 00:14:12,270
So , this is very interesting because, like, we managed to...

137
00:14:12,270 --> 00:14:22,850
like, although we don't have any time lock or any scripting capability here, we managed to gain liveness by forcing Bob to act.

138
00:14:22,850 --> 00:14:25,590
So, we forced Bob to leak this key.

139
00:14:25,770 --> 00:14:39,610
And so, basically, we managed to make this protocol live just on the Bitcoin, with Game Theory on the Bitcoin side.

140
00:14:40,350 --> 00:14:45,170
And, yeah, so many things can happen here.

141
00:14:45,170 --> 00:14:47,330
Like, even things that should never happen.

142
00:14:47,330 --> 00:14:51,310
For example, let's go back in time.

143
00:14:52,190 --> 00:14:53,170
Should never happen?

144
00:14:53,170 --> 00:14:53,310
Not.

145
00:14:53,310 --> 00:14:58,670
It should happen on the protocol, but in practice it will not happen because of Game Theory.

146
00:15:00,730 --> 00:15:02,250
So, let's see.

147
00:15:02,250 --> 00:15:18,680
For example, if you would allow Alice not to lock her monero, if Alice just refuses to...

148
00:15:18,680 --> 00:15:27,300
So, Bitcoin is locked and Alice doesn't lock her monero.

149
00:15:28,140 --> 00:15:32,900
Then, like, Bob goes, OK, I'm going to claim the refund after time lock.

150
00:15:34,840 --> 00:15:36,760
And now, what if...

151
00:15:37,380 --> 00:15:41,120
So, there's this path, for example, here that Alice can spend the refund.

152
00:15:41,300 --> 00:15:46,480
So, if this would happen, Alice would end up with both Bitcoin and monero.

153
00:15:46,480 --> 00:15:49,680
And that's totally not an atomic swap.

154
00:15:49,680 --> 00:15:55,560
So, but this path is very important for the Game Theory that we explained before.

155
00:15:55,560 --> 00:15:58,680
It's to force Bob to react.

156
00:15:58,680 --> 00:16:14,700
So, in practice, this path would never happen because Bob can directly move the Bitcoin from this output into his private wallet by publishing this transaction and this transaction together.

157
00:16:14,700 --> 00:16:21,620
And this transaction, he could pay tons of fees to make it pay for the child.

158
00:16:21,620 --> 00:16:23,220
The parent pays for the child.

159
00:16:23,480 --> 00:16:31,440
Yeah, so, we are pretty convinced that...

160
00:16:32,360 --> 00:16:56,520
So, like, by basically embedding, like, the monero private spend keys as the encryption keys for, like, some Bitcoin signatures is a very, very interesting way to basically leak keys that can be used on the other chain.

161
00:16:56,520 --> 00:17:12,920
And with the trick that Sarag presented before, I explained before in previous talk, you can, like, because monero and Bitcoin use different curves, so you can prove that that key is actually the same on both sides.

162
00:17:13,280 --> 00:17:17,500
So, we're pretty convinced that the protocol is complete.

163
00:17:18,720 --> 00:17:27,140
Yeah, so, if you guys have any, like, questions specific to the protocol, I think it would be very interesting, especially now that we can try to play it.

164
00:17:29,300 --> 00:17:31,180
Sure, thank you so much.

165
00:17:31,180 --> 00:17:36,900
First, I just want to point out that, you know, I'm paying attention to the YouTube, I'm paying attention to Discord.

166
00:17:36,900 --> 00:17:43,000
Sarang Notor is still on, so if he does have any questions, of course, Sarang, hop on in.

167
00:17:43,000 --> 00:17:45,180
I guess, first question.

168
00:17:46,740 --> 00:17:49,960
So, you've architected the general process for how it works.

169
00:17:49,960 --> 00:17:55,520
What is the next step to implement this into, you know, a functional system?

170
00:17:55,600 --> 00:17:57,380
What does that look like?

171
00:17:58,260 --> 00:18:15,240
Oh, so, like, we have to first start organizing ourselves to see how big of a project this can be, in terms of how many people should work on it.

172
00:18:15,240 --> 00:18:26,800
Like, we are currently, like, three people, and maybe we want to work with more people on this project if it happens.

173
00:18:26,800 --> 00:18:43,020
Like, basically, we're still, like, in the phase of trying to write some timeline of a project, like some deliverables that we know are necessary, let's say, prerequisites for achieving the final goal.

174
00:18:43,020 --> 00:19:04,020
And, yeah, so basically, I think in the next months or so, I think we're going to basically present this to the community and make a CCS proposal, and depending on how it goes, then we decide how much...

175
00:19:05,100 --> 00:19:07,820
I will see how much effort we can put into it.

176
00:19:08,220 --> 00:19:11,340
So, but there's a lot of things to be done.

177
00:19:12,060 --> 00:19:13,100
Understood.

178
00:19:15,300 --> 00:19:26,120
On the GitHub page that you shared, and I also sent this on YouTube for people to see, I'll post it in Discord also, is this diagram available there, too?

179
00:19:27,040 --> 00:19:33,400
Oh, the issue with this diagram is that it uses, like, some weird software to play it.

180
00:19:34,320 --> 00:19:40,040
And, yeah, like, today, my housemate took, like, two hours to get it to work.

181
00:19:41,700 --> 00:19:52,900
So, well, we can... the description, it's easy to give, but this software is, like, very weird.

182
00:19:53,360 --> 00:19:55,620
Great SPN editor.

183
00:19:55,620 --> 00:19:58,120
But I could share the diagrams, but...

184
00:19:58,120 --> 00:20:03,540
Yeah, I can't say I've heard of this before, but even, like, a PDF export or something.

185
00:20:04,040 --> 00:20:06,280
Oh, yeah, that's for sure.

186
00:20:07,560 --> 00:20:08,760
That's easier.

187
00:20:09,240 --> 00:20:15,200
So, I think that, yeah, we can share the subgraphs, for sure, like this, but it's...

188
00:20:15,200 --> 00:20:22,100
We want to eventually make a playable JavaScript thing out of this, but we have to do it by hand.

189
00:20:24,620 --> 00:20:25,240
Yeah.

190
00:20:25,320 --> 00:20:26,260
Okay, understood.

191
00:20:26,260 --> 00:20:31,040
It is really cool to see a walkthrough of this, because I know that you publish some stuff on GitHub.

192
00:20:31,040 --> 00:20:35,600
I personally haven't really looked through it in full detail, just I don't have those skills personally.

193
00:20:35,600 --> 00:20:38,400
I know other people in the community are excited and have looked at it.

194
00:20:38,400 --> 00:20:44,760
So, it is cool to be able to sit down and have this walked through right in front of me.

195
00:20:44,760 --> 00:20:50,240
I think it's a very good initial starting point to get some of the ideas in here.

196
00:20:50,600 --> 00:20:51,360
Sorry.

197
00:20:52,120 --> 00:20:52,640
No, go ahead.

198
00:20:52,640 --> 00:20:53,540
Sorry, sorry.

199
00:20:53,660 --> 00:20:54,620
You go ahead.

200
00:20:56,260 --> 00:20:58,880
So, I think it's...

201
00:20:58,880 --> 00:21:07,060
So, this kind of diagram helps you bind together all the information, because you have all these Bitcoin transactions.

202
00:21:07,260 --> 00:21:13,280
And it's a little hard to see what are the requirements of them and things like that.

203
00:21:13,280 --> 00:21:22,600
And here, it becomes like, oh, you see the function, and you see the function of a transaction.

204
00:21:22,600 --> 00:21:32,960
It's like, oh, this transaction is making him leak that key, or it's forcing him to act quick before that path becomes available.

205
00:21:32,960 --> 00:21:38,080
And I think this is where this kind of diagram...

206
00:21:38,080 --> 00:21:39,160
It's called Petronas.

207
00:21:39,160 --> 00:21:42,300
They bind everything together, and it's much easier to go through it.

208
00:21:42,300 --> 00:21:44,320
And this is actually a form of diagram.

209
00:21:44,360 --> 00:21:46,460
It's not just a graph.

210
00:21:50,730 --> 00:21:51,210
So...

211
00:21:51,210 --> 00:21:53,290
I did have one question.

212
00:21:55,910 --> 00:21:58,010
99.9% sure I know the answer.

213
00:21:58,010 --> 00:22:04,830
But I think it's helpful to ask anyway, just to clarify, especially for anyone else who maybe hasn't read your PDF yet.

214
00:22:05,590 --> 00:22:11,910
This doesn't require any particular protocol changes to either the Bitcoin or the Monero side.

215
00:22:11,910 --> 00:22:12,850
Is that right?

216
00:22:12,850 --> 00:22:14,850
Yes, that's right.

217
00:22:14,850 --> 00:22:24,670
I seem to remember seeing a couple of questions just in other media that basically seem to imply, like, when would a network upgrade enable this?

218
00:22:24,670 --> 00:22:30,210
Just to be clear, there wouldn't need to be network upgrades to enable this.

219
00:22:30,210 --> 00:22:32,690
I mean, in theory, people could be doing this right now.

220
00:22:32,690 --> 00:22:36,430
Although, it seems very unlikely without software support, right?

221
00:22:36,870 --> 00:22:37,350
Yeah.

222
00:22:37,770 --> 00:22:41,690
So, for sure, we don't need anything right now.

223
00:22:41,690 --> 00:22:46,470
Even the ECDSA has been done already.

224
00:22:46,470 --> 00:22:49,450
We were totally unaware of this work.

225
00:22:49,550 --> 00:22:54,810
But it looks like very high quality, so I think we can just use it.

226
00:22:56,750 --> 00:23:01,870
So, basically, we just use a normal key in Monero.

227
00:23:01,870 --> 00:23:03,290
And in Bitcoin, it's scripts.

228
00:23:03,290 --> 00:23:08,510
There is fingerprinting from the Bitcoin script.

229
00:23:08,510 --> 00:23:14,530
So, people are going to be able to possibly tell that, oh, this was probably an atomic swap.

230
00:23:14,650 --> 00:23:17,670
Like, this follows, like, that protocol there.

231
00:23:17,730 --> 00:23:31,450
So, however, after taproot, softfork, I think it's vip341, like, we could hide this protocol in the success cases if people all agree on it.

232
00:23:31,450 --> 00:23:33,570
So, then it would be pretty interesting.

233
00:23:33,610 --> 00:23:38,390
Because then we wouldn't have any trace left on the Bitcoin blockchain about the swap.

234
00:23:38,610 --> 00:23:44,210
Okay, sorry, just to be clear, you may have said this and maybe I just wasn't listening closely enough.

235
00:23:44,230 --> 00:23:58,910
So, as far as the softfork is concerned, are you saying that's a softfork in Monero or Bitcoin to enable that, where in the best of cases, if it goes through and there are no contentious problems, that it would be much more difficult to mark the Bitcoin as related to a swap?

236
00:23:58,910 --> 00:24:02,970
Sorry, so softfork, is that related to Monero or Bitcoin?

237
00:24:03,250 --> 00:24:03,990
Bitcoin.

238
00:24:03,990 --> 00:24:05,650
Sorry, this is Bitcoin.

239
00:24:05,650 --> 00:24:09,750
It's like the, it's the bip-schnorr, bip-taproot, tap-script.

240
00:24:09,750 --> 00:24:18,910
It's like, so it's if, when Bitcoin gets schnorr, Bitcoin is going to get taproot as well.

241
00:24:19,830 --> 00:24:22,950
So, it's, that's what I'm talking about.

242
00:24:22,950 --> 00:24:27,310
So, but before, you can look at it and say, oh, that could be an atomic swap.

243
00:24:27,330 --> 00:24:29,790
After that, then you can't say anything.

244
00:24:30,370 --> 00:24:32,110
So, it's very interesting.

245
00:24:32,450 --> 00:24:33,810
Okay, very interesting.

246
00:24:33,990 --> 00:24:38,550
That'll help prevent surveillance software from just marking it all as higher risk.

247
00:24:39,850 --> 00:24:40,650
Yeah.

248
00:24:48,310 --> 00:24:49,470
Okay, this is the last question.

249
00:24:49,470 --> 00:24:55,350
Just putting it out there for those that are watching this on YouTube or anything, if you have any questions, now's a great chance to answer them.

250
00:24:55,350 --> 00:24:56,970
We have just a few minutes left.

251
00:24:57,190 --> 00:24:59,770
Although, it doesn't seem like this research team is going anywhere.

252
00:24:59,770 --> 00:25:01,410
It looks like they're just getting started.

253
00:25:01,590 --> 00:25:03,490
They have their work cut out for themselves.

254
00:25:06,670 --> 00:25:09,870
But it is exciting to hear about it.

255
00:25:11,010 --> 00:25:12,210
Really no questions coming in.

256
00:25:12,210 --> 00:25:14,610
Serene, did you have anything else that you wanted to get at?

257
00:25:15,090 --> 00:25:16,490
He may have walked away.

258
00:25:17,170 --> 00:25:18,310
No, no, no, I'm here.

259
00:25:18,310 --> 00:25:20,690
No, I think this is, I think this is extremely exciting.

260
00:25:20,690 --> 00:25:30,410
I think, I think there's still, you know, questions to ask about, you know, especially with, you know, what was brought up about, you know, possible fingerprinting, I think is very important.

261
00:25:30,430 --> 00:25:37,330
You know, I think making sure that it's clearly understood what the privacy implications are about how the transactions are initialized.

262
00:25:37,570 --> 00:25:42,210
Initially, and there have been some talk on the research lab channel about this too.

263
00:25:42,670 --> 00:25:52,570
But, you know, I mean, this is great, you know, previously when it was first brought up, it was kind of this, you know, if only we had, you know, proven systems that could show this particular quality, and we're like, yeah, wouldn't that be great.

264
00:25:52,570 --> 00:25:56,970
And now it turns out like this adapter signature and cross group stuff can be done.

265
00:25:57,130 --> 00:25:58,870
So I guess very exciting.

266
00:25:59,830 --> 00:26:09,130
Yeah, I have to say when I first saw the pitch of like Monero Bitcoin atomic swaps, I just assumed it was someone trying to pitch like a centralized exchange that they were just calling a swap.

267
00:26:09,950 --> 00:26:13,170
And then I had to do a little bit further to be like, oh, actually, these people are not kidding around.

268
00:26:13,170 --> 00:26:16,590
This is actually something that's, that's not just...

269
00:26:16,590 --> 00:26:25,890
Yeah, we started at CCC and we were just like, how do we make Bitcoin private?

270
00:26:27,370 --> 00:26:34,670
And I guess one last question that I have that's, you know, that is mentioned in the paper.

271
00:26:35,090 --> 00:26:37,730
Yeah, I think it's actually mentioned pretty clearly in the paper too.

272
00:26:37,730 --> 00:26:41,630
That this is not just limited to Monero or to Bitcoin.

273
00:26:41,810 --> 00:26:52,390
In the paper, I know you and your colleagues talk about kind of pretty specifically what the requirements are for each of the different kind of types of chains and protocols.

274
00:26:52,390 --> 00:26:53,290
Is that right?

275
00:26:54,370 --> 00:26:56,790
Yeah, like, basically, like, think about it.

276
00:26:56,790 --> 00:26:59,410
How much are we using of Monero here?

277
00:26:59,410 --> 00:27:03,070
Like, it's just a normal address.

278
00:27:03,070 --> 00:27:05,690
So it's like, there's nothing special there.

279
00:27:05,690 --> 00:27:13,610
So anything that has as much capability as Monero can be one side of the Bitcoin trade.

280
00:27:13,610 --> 00:27:18,530
But so like, if you go, so Bitcoin is already very capable.

281
00:27:18,530 --> 00:27:23,710
So if you go to things that are more capable than Bitcoin, then it's like, gets even easier.

282
00:27:23,710 --> 00:27:36,370
But of course, then you get more fingerprinting, like, even like, so you have like, like much deeper traces of what you've been doing left on chain.

283
00:27:36,370 --> 00:27:57,750
So yeah, like, so for sure, like, and I think the trick of the cross group equality that that makes like the bridge between any elliptic curve, I think, like, so then like, you can just basically cross across any, any chain, basically, if you can, if you can produce these groups.

284
00:27:57,750 --> 00:28:13,350
So I think it's, it's, it's pretty, like the protocol itself, because we can play like the game theory only once on one side, it shows it that it's possible to build stuff with very limited resources, I think protocols should be very minimal.

285
00:28:13,350 --> 00:28:27,350
And, and, and like, we cannot use complicated primitives, or let's say complicated systems to deal with simple things like, like accounting.

286
00:28:29,270 --> 00:28:35,010
And it sounds like on the Bitcoin side, at least, maybe the big limitation right now is just ECDSA.

287
00:28:35,010 --> 00:28:35,610
Is that right?

288
00:28:36,610 --> 00:28:40,050
Oh, yeah, that makes things like ugly and hard.

289
00:28:40,710 --> 00:28:47,450
Like, like, yeah, to do that, the adopter signature on Schnorr would be trivial.

290
00:28:48,250 --> 00:28:50,010
For example.

291
00:28:53,270 --> 00:28:54,170
Cool.

292
00:28:54,170 --> 00:28:56,890
Thanks for the questions.

293
00:28:57,470 --> 00:28:58,170
Thank you.

294
00:28:58,170 --> 00:29:03,010
I know we were brought in here at the last minute to do something, but it was definitely worth it.

295
00:29:03,010 --> 00:29:05,730
It was great to have you included at DEF CON.