start	end	text
480	4220	which is on Bitcoin Monero Atomic Swaps.
4220	7560	I know this is a very hot level of research going on recently.
7560	9080	There's a ton of interest.
9260	12740	So, ZKAO, OK, you got the screen share going here.
12740	14420	Hi, can you hear me?
14420	15960	We can hear you, yes.
15960	19940	I'm going to, since everything seems to be working on our end,
19940	23240	I'm just going to hop off and just let you take it from here.
23240	24160	How about that?
24960	28680	Oh, yeah. So, basically, I would like to do it more interactively.
28680	32580	So, feel very welcome to ask questions or ask questions
32580	34720	that people drop on the chat.
35440	43600	So, basically, in 2017, we were in CCC and we were discussing
43600	46420	and we found it would be very interesting to create a project
46420	52640	to swap Bitcoin for Monero in a trustless manner, atomically.
52640	62140	And it was just because it sounded very, very interesting
62140	67800	and my colleague Hashed couldn't get his head out of that
67800	74920	and we ended up working on this project much more than we initially expected.
74920	87340	So, one of the things that cryptocurrencies bring is this permissionless way
87340	91040	of exchanging money online, for example, on the internet.
91820	99280	Before, all the electronic money was intermediated.
100780	102900	Can you actually see my screen?
104140	107160	Yes, I can see your screen, yes.
111480	118580	And there is an issue with this because we have cash in society
118580	125120	and cash is a bearer, peer-to-peer, permissionless and privacy-preserving form of money.
125520	130820	And who has it can spend it, has the right to spend it
130820	133360	by having physical possession, peer-to-peer.
133360	137520	You can just meet someone and give it to this person directly.
137680	140620	If it's peer-to-peer, it's also permissionless.
140620	144220	Nobody is on the way to intercept this transaction.
144300	149040	And privacy-preserving, you can be locked in a room,
149040	153480	give cash to someone and nobody else needs to know about it.
154280	155780	And cash is legal.
155780	164980	So, we should not downgrade our online money
164980	172360	by accepting a totally transparent financial system like Bitcoin.
172360	178920	We have to have ways to be able to exercise privacy by, for example,
178920	183560	swapping Bitcoin into Monero and going into some private wall.
183560	187180	But you should do that in a permissionless manner.
187180	189960	Like, you should not ask permission to go private.
190440	197600	So, it looks like from this definition of cash,
197600	200560	Monero is cash and Bitcoin is almost.
200560	203080	Bitcoin has this property of permissionless.
203080	207660	So, you could spend your money in the wrong way
207660	210300	and nobody could prevent you from doing that.
210300	212940	However, because it's not privacy-preserving,
213600	216400	people can watch what you're doing with your money
216400	219420	and they might go after you because of that.
219420	223020	So, this is very problematic in an open society.
226820	232580	So, the way we see atomic swaps is more like a cash-to-cash exchange.
232580	237760	So, you have euros and you meet someone who has US dollar,
237760	241700	you agree on an exchange rate and you exchange it in private.
241700	244600	Nobody else needs to get involved in this exchange.
244840	247380	Only the people in the exchange.
247540	251860	And we think that atomic swaps are very similar to this.
251860	254720	So, it's a cash-to-cash exchange.
255120	261320	And in the same way that you wouldn't want to...
261320	266720	If someone tries to buy your motor for $2,000,
266720	269920	you might take cash and not worry too much about it.
269920	271640	But if you are trying to sell your house
271640	274380	and somebody shows up with a million in cash,
274380	276480	you are going to worry about it
276480	279280	because you would want to know where it came from
279280	284760	and if it's not counterfeit.
284760	287620	So, there is like this natural tendency of people
287620	292020	to judge the quality of what they're getting in exchange.
292420	294260	So, like in the crypto space,
294260	298340	now people are responsible for taking care of their private keys.
298340	301620	They could also be responsible for not engaging
301620	305420	into suspicious-looking transactions.
305420	307440	Like if a transaction is too good to be true,
307440	310700	it's probably not true.
311000	318200	So, one thing that Monero would gain...
318200	321000	So, Bitcoin users for sure would gain a lot of privacy
321000	324400	by being able to switch to Monero
324400	328080	in a trustless and permissionless manner.
328080	331540	But what Monero gains from Bitcoin is its liquidity.
331540	334500	It has like a hundred times higher market cap
334500	337480	and it's much more easily accessible.
337480	340800	So, Bitcoin is easy to get.
340800	345360	And if you have a network that you can get Monero,
345360	347360	exchange Monero atomically,
347360	351040	then you could go into Monero for that path.
351520	354240	So, it's very interesting to have permissionless entry
354240	356200	into a privacy currency.
357740	361380	It's not nice to have to ask for permission
361380	363360	to go private.
363980	367080	So, with this, I'm going to go
367080	370340	and I'm going to try to go through the protocol
371300	376200	in the form of a diagram.
378160	380320	So, here first I'm going to show...
380320	382220	This is the paper that includes...
382220	384900	It's the complete paper after the research.
384900	389360	So, this research started literally like three years ago
391840	394880	and Hashed really did a good job
394880	398200	and you can find the summary here.
398860	401900	And so, I will...
402640	406720	I think the easiest way to understand the atomic swap
406720	408900	is to play for the protocol.
408900	411060	And we have a representation of the protocol
411060	412660	as a patronet.
412660	414480	Can you guys tell me if you can see?
414480	419200	If I zoom out, can you still see like this?
420160	423120	Yes, we're largely able to see.
423140	425600	I'm getting a good quality coming in from you.
425600	429400	So, the people watching the stream should still be able to read the text.
429600	430960	Okay, that's great.
430960	433040	Okay, so I'm going to just show like this.
433040	435520	So, here we have
439480	441760	basically a protocol representation.
441760	445520	So, here you have Bob who starts with Bitcoin in his private wallet
445520	449640	and Alice that starts with Monero on her private wallet.
450080	452940	And what if the protocol goes through
452940	455620	like Alice should end up with Bitcoin
455620	459440	and Bob should end up with Monero on their private wallets.
459800	461920	And I'm going to play the protocol
461920	464040	and slowly I'm going to explain more and more
464040	466380	what each transaction does
468520	470580	and how they're looking like.
470580	474060	So, basically all the logic will happen on the Bitcoin side
474580	479000	because Monero doesn't just fix keys.
479000	482300	So, how we do it
482300	486440	is like you do a whole game theory on the Bitcoin side.
486440	490120	So, like Bob with Bitcoin is going to need the protocol
490120	493520	by creating two transactions.
493880	496820	A softlock transaction that's going to be the transaction
496820	499260	that locks the Monero, the Bitcoin
499260	502300	that is going to be sent to Alice.
502300	505580	So, the locked Bitcoin is going to end up
506640	509360	with this script on this output.
512120	516040	And a transaction that is a refund transaction
516040	520500	and Bob already partially signs it and sends it to Alice.
521000	525100	And this refund transaction is going to spend the softlock output
525100	529380	and give the money back to Bob, basically.
529380	531660	So, this is a refund path.
531660	534600	So, Alice checks the information that Bob gives
534600	537800	and Alice signs the refund transaction
538600	541200	because all the information is correct.
541700	547380	And having the refund, Bob can safely lock the money
547380	548900	on this softlock contract
550660	553280	and publish it to the blockchain,
553280	555660	wait for it to be mined,
555660	560960	and the money is going to be on this very special output here.
562600	565200	Nothing happened on the Monero chain yet.
567020	572120	Alice has to lock her money as well.
572380	575140	And Alice is going to feel convinced she should do it
575140	577460	because she can see that the locked Bitcoin
577460	579480	is locked in the correct address.
579480	591800	So, basically, Alice locks her Monero in this special address.
591800	595800	This address is derived by both Alice and Bob.
596760	600680	Actually, none of them control this address.
601360	604680	They only know half of the private keys.
604680	607020	So, what is interesting now is that
607020	609980	whoever learns the other half of the private key
609980	612520	gets the Bitcoin.
612520	613940	Gets the Monero, sorry.
613940	618220	And it's either going to be a refund or a complete stop.
618220	623240	So, at this point, Alice can't do anything.
623240	627100	Bob has to reveal a special secret.
627100	629080	This is just a synchronization secret.
629080	631180	It's like the authorization of Bob
631180	635940	to let Alice move on the protocol.
637660	640280	So, Bob shares the secret.
640280	644000	This secret is needed to unlock this output.
644000	647300	So, this output needs this secret,
647300	649140	synchronization secret.
649340	652660	It needs Alice.
653840	658780	This Alice half key is the private span key
658780	662440	that is locking this output here.
662880	665020	So, Bob has half of it.
665020	666480	Alice has the other half.
666480	671080	So, basically, in order for Alice to span this output,
671080	672740	she's going to have to reveal this key.
673180	675540	How does she reveal this key?
675540	677540	It's through this...
678280	684200	So, basically, we use this ECDSA adapter signature,
684200	687480	which is basically like Alice's...
688000	691700	Bob gives Alice an encrypted transaction
691700	694200	that in order for her to...
694200	695540	an encrypted signature
695540	699540	and in order for her to decrypt the signature and use it here,
700420	701540	she has to...
703160	704960	when she decrypts it,
704960	707620	she leaks this key, basically.
707980	710360	Because if you have the decrypted...
710360	713340	if Bob has the decrypted and the encrypted version of the signature,
713340	715440	he can recover easily this key.
715900	719500	So, basically, you force Alice to reveal this key
720880	724140	and Alice gets the Bitcoin in her private wallet.
724140	727720	Now, this key that got leaked can be used by Bob
727720	731340	to claim his monero on the other side.
731620	738520	So, that's how the protocol would run in the successful case.
738720	742740	But, of course, there are tons of cases that are not the successful case.
743360	749780	And, for example, I went back in time a little bit.
751560	753780	For example, here, like...
755260	758580	basically, Bob decides that he doesn't give the secret
758580	761840	to authorize Alice to continue running the protocol.
761940	763480	So, he doesn't trigger this.
763480	764380	What can Alice do?
764380	768820	The only thing she can do is, like, after a timeout,
768820	770780	this is a...
771340	774860	she can publish the refund transaction.
775520	776440	Okay, now let's try...
776440	778960	now we're going to understand a little bit the refund transaction.
778960	783040	So, Alice published this refund transaction
784280	786560	because Bob wasn't responsive.
787260	789040	He wasn't triggering this one.
789040	794740	And so, like, right now, if Bob does not become responsive,
795700	799880	Alice is going to be able to take this path and take the Bitcoin.
801260	805740	But, if Bob can, he should become responsive,
805740	807300	otherwise he's going to lose his money.
807300	812660	And he's going to try to consume this output.
812660	816220	And, again, this is, like, the same scheme as before
816220	817570	with adapter signature.
817860	820260	And this key is going to get leaked
820260	827560	by Bob decrypting Alice's signature
827560	829700	that is needed on this transaction.
830640	835490	And it's interesting now that because Bob leaked his monero key,
836270	843910	Alice can claim her refund on the monero chain like this.
844850	852270	So, this is very interesting because, like, we managed to...
852270	856430	like, although we don't have any time lock or any scripting capability here,
856430	862850	we managed to gain liveness by forcing Bob to act.
862850	865590	So, we forced Bob to leak this key.
865770	875130	And so, basically, we managed to make this protocol live
875130	879610	just on the Bitcoin, with Game Theory on the Bitcoin side.
880350	885170	And, yeah, so many things can happen here.
885170	887330	Like, even things that should never happen.
887330	891310	For example, let's go back in time.
892190	893310	Should never happen? Not.
893310	897050	It should happen on the protocol, but in practice it will not happen
897050	898670	because of Game Theory.
900730	902250	So, let's see.
902250	913460	For example, if you would allow Alice not to lock her monero,
913460	918680	if Alice just refuses to...
918680	927300	So, Bitcoin is locked and Alice doesn't lock her monero.
928140	932900	Then, like, Bob goes, OK, I'm going to claim the refund after time lock.
934840	936760	And now, what if...
937380	941120	So, there's this path, for example, here that Alice can spend the refund.
941300	946480	So, if this would happen, Alice would end up with both Bitcoin and monero.
946480	949680	And that's totally not an atomic swap.
949680	955560	So, but this path is very important for the Game Theory that we explained before.
955560	958680	It's to force Bob to react.
958680	961120	So, in practice, this path would never happen
963320	969680	because Bob can directly move the Bitcoin from this output into his private wallet
969680	974700	by publishing this transaction and this transaction together.
974700	981620	And this transaction, he could pay tons of fees to make it pay for the child.
981620	983220	The parent pays for the child.
983480	991440	Yeah, so, we are pretty convinced that...
992360	1000860	So, like, by basically embedding, like, the monero private spend keys
1000860	1007260	as the encryption keys for, like, some Bitcoin signatures
1007260	1016520	is a very, very interesting way to basically leak keys that can be used on the other chain.
1016520	1024080	And with the trick that Sarag presented before, I explained before in previous talk,
1024080	1027800	you can, like, because monero and Bitcoin use different curves,
1027800	1032920	so you can prove that that key is actually the same on both sides.
1033280	1037500	So, we're pretty convinced that the protocol is complete.
1038720	1042580	Yeah, so, if you guys have any, like, questions specific to the protocol,
1042580	1047140	I think it would be very interesting, especially now that we can try to play it.
1049300	1051180	Sure, thank you so much.
1051180	1055340	First, I just want to point out that, you know, I'm paying attention to the YouTube,
1055340	1056900	I'm paying attention to Discord.
1056900	1063000	Sarang Notor is still on, so if he does have any questions, of course, Sarang, hop on in.
1063000	1065180	I guess, first question.
1066740	1069960	So, you've architected the general process for how it works.
1069960	1075520	What is the next step to implement this into, you know, a functional system?
1075600	1077380	What does that look like?
1078260	1092600	Oh, so, like, we have to first start organizing ourselves to see how big of a project this can be,
1092600	1095240	in terms of how many people should work on it.
1095240	1106800	Like, we are currently, like, three people, and maybe we want to work with more people on this project if it happens.
1106800	1114100	Like, basically, we're still, like, in the phase of trying to write some timeline of a project,
1114100	1123020	like some deliverables that we know are necessary, let's say, prerequisites for achieving the final goal.
1123020	1134060	And, yeah, so basically, I think in the next months or so, I think we're going to basically present this to the community
1134060	1144020	and make a CCS proposal, and depending on how it goes, then we decide how much...
1145100	1147820	I will see how much effort we can put into it.
1148220	1151340	So, but there's a lot of things to be done.
1152060	1153100	Understood.
1155300	1163400	On the GitHub page that you shared, and I also sent this on YouTube for people to see, I'll post it in Discord also,
1163400	1166120	is this diagram available there, too?
1167040	1173400	Oh, the issue with this diagram is that it uses, like, some weird software to play it.
1174320	1180040	And, yeah, like, today, my housemate took, like, two hours to get it to work.
1181700	1192900	So, well, we can... the description, it's easy to give, but this software is, like, very weird.
1193360	1198120	Great SPN editor. But I could share the diagrams, but...
1198120	1203540	Yeah, I can't say I've heard of this before, but even, like, a PDF export or something.
1204040	1206280	Oh, yeah, that's for sure.
1207560	1208760	That's easier.
1209240	1215200	So, I think that, yeah, we can share the subgraphs, for sure, like this, but it's...
1215200	1222100	We want to eventually make a playable JavaScript thing out of this, but we have to do it by hand.
1224620	1225240	Yeah.
1225320	1231040	Okay, understood. It is really cool to see a walkthrough of this, because I know that you publish some stuff on GitHub.
1231040	1235600	I personally haven't really looked through it in full detail, just I don't have those skills personally.
1235600	1238400	I know other people in the community are excited and have looked at it.
1238400	1244760	So, it is cool to be able to sit down and have this walked through right in front of me.
1244760	1250240	I think it's a very good initial starting point to get some of the ideas in here.
1250600	1251360	Sorry.
1252120	1252640	No, go ahead.
1252640	1253540	Sorry, sorry.
1253660	1254620	You go ahead.
1256260	1258880	So, I think it's...
1258880	1267060	So, this kind of diagram helps you bind together all the information, because you have all these Bitcoin transactions.
1267260	1273280	And it's a little hard to see what are the requirements of them and things like that.
1273280	1282600	And here, it becomes like, oh, you see the function, and you see the function of a transaction.
1282600	1292960	It's like, oh, this transaction is making him leak that key, or it's forcing him to act quick before that path becomes available.
1292960	1298080	And I think this is where this kind of diagram...
1298080	1299160	It's called Petronas.
1299160	1302300	They bind everything together, and it's much easier to go through it.
1302300	1304320	And this is actually a form of diagram.
1304360	1306460	It's not just a graph.
1310730	1311210	So...
1311210	1313290	I did have one question.
1315910	1318010	99.9% sure I know the answer.
1318010	1324830	But I think it's helpful to ask anyway, just to clarify, especially for anyone else who maybe hasn't read your PDF yet.
1325590	1331910	This doesn't require any particular protocol changes to either the Bitcoin or the Monero side.
1331910	1332850	Is that right?
1332850	1334850	Yes, that's right.
1334850	1344670	I seem to remember seeing a couple of questions just in other media that basically seem to imply, like, when would a network upgrade enable this?
1344670	1350210	Just to be clear, there wouldn't need to be network upgrades to enable this.
1350210	1352690	I mean, in theory, people could be doing this right now.
1352690	1356430	Although, it seems very unlikely without software support, right?
1356870	1357350	Yeah.
1357770	1361690	So, for sure, we don't need anything right now.
1361690	1366470	Even the ECDSA has been done already.
1366470	1369450	We were totally unaware of this work.
1369550	1374810	But it looks like very high quality, so I think we can just use it.
1376750	1381870	So, basically, we just use a normal key in Monero.
1381870	1383290	And in Bitcoin, it's scripts.
1383290	1388510	There is fingerprinting from the Bitcoin script.
1388510	1394530	So, people are going to be able to possibly tell that, oh, this was probably an atomic swap.
1394650	1397670	Like, this follows, like, that protocol there.
1397730	1411450	So, however, after taproot, softfork, I think it's vip341, like, we could hide this protocol in the success cases if people all agree on it.
1411450	1413570	So, then it would be pretty interesting.
1413610	1418390	Because then we wouldn't have any trace left on the Bitcoin blockchain about the swap.
1418610	1424210	Okay, sorry, just to be clear, you may have said this and maybe I just wasn't listening closely enough.
1424230	1438910	So, as far as the softfork is concerned, are you saying that's a softfork in Monero or Bitcoin to enable that, where in the best of cases, if it goes through and there are no contentious problems, that it would be much more difficult to mark the Bitcoin as related to a swap?
1438910	1442970	Sorry, so softfork, is that related to Monero or Bitcoin?
1443250	1449750	Bitcoin. Sorry, this is Bitcoin. It's like the, it's the bip-schnorr, bip-taproot, tap-script.
1449750	1458910	It's like, so it's if, when Bitcoin gets schnorr, Bitcoin is going to get taproot as well.
1459830	1462950	So, it's, that's what I'm talking about.
1462950	1472110	So, but before, you can look at it and say, oh, that could be an atomic swap. After that, then you can't say anything. So, it's very interesting.
1472450	1478550	Okay, very interesting. That'll help prevent surveillance software from just marking it all as higher risk.
1479850	1480650	Yeah.
1488310	1495350	Okay, this is the last question. Just putting it out there for those that are watching this on YouTube or anything, if you have any questions, now's a great chance to answer them.
1495350	1501410	We have just a few minutes left. Although, it doesn't seem like this research team is going anywhere. It looks like they're just getting started.
1501590	1503490	They have their work cut out for themselves.
1506670	1509870	But it is exciting to hear about it.
1511010	1514610	Really no questions coming in. Serene, did you have anything else that you wanted to get at?
1515090	1516490	He may have walked away.
1517170	1520690	No, no, no, I'm here. No, I think this is, I think this is extremely exciting.
1520690	1530410	I think, I think there's still, you know, questions to ask about, you know, especially with, you know, what was brought up about, you know, possible fingerprinting, I think is very important.
1530430	1537330	You know, I think making sure that it's clearly understood what the privacy implications are about how the transactions are initialized.
1537570	1542210	Initially, and there have been some talk on the research lab channel about this too.
1542670	1550590	But, you know, I mean, this is great, you know, previously when it was first brought up, it was kind of this, you know, if only we had, you know, proven systems that could show this particular
1550590	1558870	quality, and we're like, yeah, wouldn't that be great. And now it turns out like this adapter signature and cross group stuff can be done. So I guess very exciting.
1559830	1569130	Yeah, I have to say when I first saw the pitch of like Monero Bitcoin atomic swaps, I just assumed it was someone trying to pitch like a centralized exchange that they were just calling a swap.
1569950	1576590	And then I had to do a little bit further to be like, oh, actually, these people are not kidding around. This is actually something that's, that's not just...
1576590	1585890	Yeah, we started at CCC and we were just like, how do we make Bitcoin private?
1587370	1594670	And I guess one last question that I have that's, you know, that is mentioned in the paper.
1595090	1597730	Yeah, I think it's actually mentioned pretty clearly in the paper too.
1597730	1613290	That this is not just limited to Monero or to Bitcoin. In the paper, I know you and your colleagues talk about kind of pretty specifically what the requirements are for each of the different kind of types of chains and protocols. Is that right?
1614370	1623070	Yeah, like, basically, like, think about it. How much are we using of Monero here? Like, it's just a normal address.
1623070	1633610	So it's like, there's nothing special there. So anything that has as much capability as Monero can be one side of the Bitcoin trade.
1633610	1643710	But so like, if you go, so Bitcoin is already very capable. So if you go to things that are more capable than Bitcoin, then it's like, gets even easier.
1643710	1656370	But of course, then you get more fingerprinting, like, even like, so you have like, like much deeper traces of what you've been doing left on chain.
1656370	1677750	So yeah, like, so for sure, like, and I think the trick of the cross group equality that that makes like the bridge between any elliptic curve, I think, like, so then like, you can just basically cross across any, any chain, basically, if you can, if you can produce these groups.
1677750	1693350	So I think it's, it's, it's pretty, like the protocol itself, because we can play like the game theory only once on one side, it shows it that it's possible to build stuff with very limited resources, I think protocols should be very minimal.
1693350	1707350	And, and, and like, we cannot use complicated primitives, or let's say complicated systems to deal with simple things like, like accounting.
1709270	1715610	And it sounds like on the Bitcoin side, at least, maybe the big limitation right now is just ECDSA. Is that right?
1716610	1727450	Oh, yeah, that makes things like ugly and hard. Like, like, yeah, to do that, the adopter signature on Schnorr would be trivial.
1728250	1730010	For example.
1733270	1736890	Cool. Thanks for the questions.
1737470	1745730	Thank you. I know we were brought in here at the last minute to do something, but it was definitely worth it. It was great to have you included at DEF CON.