No content

Agenda - Privacy Enhancing Technologies(PETs) - UTXO vs Account - LINE Blockchain Solution - Future plans

Why should the transaction be hidden?

Why should the transaction be hidden? For the protection of personal information For the security of wholesale* transactions of trusted institutions * wholesale: The sale of products, often in large quantities, to retailers or other merchants.

What techniques can hide tx? PETs(Privacy Enhancing Technologies)

Privacy Enhancing Technologies Unlinking Hiding Segregating Project Stella, Feb 2020, https://www.ecb.europa.eu/paym/intro/publications/pdf/ecb.miptopical200212.en.pdf

Segregating - Ledger segregating - Offchain payment channel Image reference: https://www.ecb.europa.eu/paym/intro/publications/pdf/ecb.miptopical200212.en.pdf B C Ledger subset Entity A (Sender) Entity B (Receiver) Entity C (Unauthorised third party) Transaction

Segregating Image reference: https://tsmatz.wordpress.com/2020/03/23/corda-tutorial-on-azure/ Ledger segregating Alice Bob Peter Richard Alice’s View Richard’s View Offchain payment channel Image reference: https://www.researchgate.net/figure/State-Channel-Paiern_fig4_325439030 blockchain On-chain State channel Settle transaction Off-chain

Segregating Image reference: https://tsmatz.wordpress.com/2020/03/23/corda-tutorial-on-azure/ Ledger segregating Alice Bob Peter Richard Alice’s View Richard’s View Offchain payment channel Image reference: https://www.researchgate.net/figure/State-Channel-Paiern_fig4_325439030 blockchain On-chain State channel Settle transaction Off-chain

Unlinking - One-time address - Mixing - Ring Signature B C Ledger Entity A (Sender) Entity B (Receiver) Entity C (Unauthorised third party) Transaction Image reference: https://www.ecb.europa.eu/paym/intro/publications/pdf/ecb.miptopical200212.en.pdf

Unlinking One-time address Mixing Ring signature Source of image: https://www.ecb.europa.eu/paym/intro/ publications/pdf/ecb.miptopical200212.en.pdf Signer Non signer Non signer Non signer Ring signature PK1 PK2 PK3 PK4 Account 1 Account 2 Account 3 Account 4

Unlinking One-time address Mixing Ring signature Source of image: https://www.ecb.europa.eu/paym/intro/ publications/pdf/ecb.miptopical200212.en.pdf Signer Non signer Non signer Non signer Ring signature PK1 PK2 PK3 PK4 Account 1 Account 2 Account 3 Account 4

Unlinking One-time address Mixing Ring signature Source of image: https://www.ecb.europa.eu/paym/intro/ publications/pdf/ecb.miptopical200212.en.pdf Signer Non signer Non signer Non signer Ring signature PK1 PK2 PK3 PK4 Account 1 Account 2 Account 3 Account 4

Hiding - Pedersen commitment - Zero knowledge Proof - Homomorphic encryption Ledger Entity A (Sender) Entity B (Receiver) Entity C (Unauthorised third party) Transaction Image reference: https://www.ecb.europa.eu/paym/intro/publications/pdf/ecb.miptopical200212.en.pdf

Hiding Pedersen commitment image reference: https://blog.csdn.net/mutourend/article/ details/93739575 Bob $PNNJUNFOU D S 4FDSFU Alice Blockchain Challenge 1. commit 2. Reveal 3. unlock & check Bob Alice W W $PNNJUNFOU WW $PNNJUNFOU D S $PNNJUNFOU D S Zero knowledge proof Image reference: https://blog.sigmadex.org/understanding- zero-knowledge-proof/ 4FDSFU 4FDSFU 1SPPG 1SPPG Prover Verifier Homomorphic encryption Image reference: https://www.researchgate.net/figure/In-a- fully-homomorphic-encryption-scheme-operations-on- ciphertext-space-are-mirrored-in_fig1_323598036 + = 9 : ; + = + = 1VCMJDLFZFODSZQU 1SJWBUFLFZEFDSZQU

Hiding Pedersen commitment image reference: https://blog.csdn.net/mutourend/article/ details/93739575 Bob $PNNJUNFOU D S 4FDSFU Alice Blockchain Challenge 1. commit 2. Reveal 3. unlock & check Bob Alice W W $PNNJUNFOU WW $PNNJUNFOU D S $PNNJUNFOU D S Zero knowledge proof Image reference: https://blog.sigmadex.org/understanding- zero-knowledge-proof/ 4FDSFU 4FDSFU 1SPPG 1SPPG Prover Verifier Homomorphic encryption Image reference: https://www.researchgate.net/figure/In-a- fully-homomorphic-encryption-scheme-operations-on- ciphertext-space-are-mirrored-in_fig1_323598036 + = 9 : ; + = + = 1VCMJDLFZFODSZQU 1SJWBUFLFZEFDSZQU

Hiding Pedersen commitment image reference: https://blog.csdn.net/mutourend/article/ details/93739575 Bob $PNNJUNFOU D S 4FDSFU Alice Blockchain Challenge 1. commit 2. Reveal 3. unlock & check Bob Alice W W $PNNJUNFOU WW $PNNJUNFOU D S $PNNJUNFOU D S Zero knowledge proof Image reference: https://blog.sigmadex.org/understanding- zero-knowledge-proof/ 4FDSFU 4FDSFU 1SPPG 1SPPG Prover Verifier Homomorphic encryption Image reference: https://www.researchgate.net/figure/In-a- fully-homomorphic-encryption-scheme-operations-on- ciphertext-space-are-mirrored-in_fig1_323598036 + = 9 : ; + = + = 1VCMJDLFZFODSZQU 1SJWBUFLFZEFDSZQU

PETs Summary Category PETs Transaction Information Sender Receiver Amount Segregating Ledger Segregating Hidden Hidden Payment channel network Public Hidden* Unlinking One-time address Hidden Public Mixing Hidden Public Ring signature Hidden Public Hidden Hiding Pedersen commitment Public Hidden Zero knowledge proof Hidden Hidden Homomorphic encryption Public Hidden * Only the net transacted amount can be viewed and interpreted. Project Stella, Feb 2020, https://www.ecb.europa.eu/paym/intro/publications/pdf/ecb.miptopical200212.en.pdf

UTXO vs Account

UTXO - UTXO object - ownership - usage status - balance - Proof of ownership of UTXO - Directed acyclic graphs(DAG) - Like cash - High privacy - Excellent scalability Image reference: https://www.techscience.com/csse/v36n3/41264/html 0VUQVU *OQVU 0VUQVU 0VUQVU 0VUQVU Tx k Tx k+1 *OQVU 0VUQVU 0VUQVU Tx k+2 *OQVU 0VUQVU 0VUQVU *OQVU 0VUQVU 0VUQVU *OQVU Tx k+3 Tx n *OQVU 0VUQVU . . . 1 BTC 0.2 BTC 0.6 BTC 0.15 BTC 0.1 BTC 0.5 BTC UTXO

Account - Account state - { account: balance } - Proof of Account balance - Like bank account balance - Simple to understand - Efficiency Account A, 500 Account B, 1000 Account A, 400 Account B, 1100 5Y"#

UTXO vs Account UTXO Account Tx structure • input, output, lock and unlocking script • sender, receiver, amount, signature Validation • validate check UTXO is unspent and is from the sender • Check that the sender's balance is sufficient and the signature is valid Recording the state • The movement of asset is Directed acyclic graph(DAG) • key and value database of network states Advantages • Parallel processing possible • easy to implement sharding • excellent anonymity/security • Easy to develop smart contract • Easy to create transaction history for a single user Disadvantage • Smart contract design is complex • Need to prepare a plan to prevent double payment • Difficulty in parallel processing

Secret Tx on UTXO and Account Image reference: https://academy.horizen.io/technology/expert/utxo-vs-account-model/ 6590 6590 6590 6590 6590 6590 6590 6590 6590 "DDPVOU" #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU$ #BMBODFU 4UBUFO 4UBUF O 4UBUF O 4UBUF O "DDPVOU.PEFM 6590.PEFM %BUBCBTFPGOFUXPSLTUBUFT %JSFDUFEHSBQIPGBTTFUT 6590 T NPWJOHCFUXFFOVTFST "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU

Secret Tx on UTXO and Account Image reference: https://academy.horizen.io/technology/expert/utxo-vs-account-model/ 6590 6590 6590 6590 6590 6590 6590 6590 6590 "DDPVOU" #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU$ #BMBODFU 4UBUFO 4UBUF O 4UBUF O 4UBUF O "DDPVOU.PEFM 6590.PEFM %BUBCBTFPGOFUXPSLTUBUFT %JSFDUFEHSBQIPGBTTFUT 6590 T NPWJOHCFUXFFOVTFST "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU

Secret Tx on UTXO and Account Image reference: https://academy.horizen.io/technology/expert/utxo-vs-account-model/ 6590 6590 6590 6590 6590 6590 6590 6590 6590 "DDPVOU" #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU "DDPVOU$ #BMBODFU 4UBUFO 4UBUF O 4UBUF O 4UBUF O "DDPVOU.PEFM 6590.PEFM %BUBCBTFPGOFUXPSLTUBUFT %JSFDUFEHSBQIPGBTTFUT 6590 T NPWJOHCFUXFFOVTFST "DDPVOU" #BMBODFU "DDPVOU# #BMBODFU

LINE Blockchain Solution

Requirement of LINE Blockchain 1. Both public and secure transfer must be possible. 3. The secure transfer must be secured by the sender, receiver, and amount. 2. All public and secure transfers must be public on a single ledger. 4. Secure transfer need to be auditable by auditor.

Which PETs meet the requirements? 1. Both public and secure transfer must be possible. 3. The secure transfer must be secured by the sender, receiver, and amount. Category PETs Transaction Information Sender Receiver Amount Segregating Ledger Segregating Hidden Hidden Payment channel network Public Hidden* Unlinking One-time address Hidden Public Mixing Hidden Public Ring signature Hidden Public Hidden Hiding Pedersen commitment Public Hidden Zero knowledge proof Hidden Hidden Homomorphic encryption Public Hidden Requirements 4. Secure transfer need to be auditable by auditor. 2. All public and secure transfers must be public on a single ledger.

Which PETs meet the requirements? 1. Both public and secure transfer must be possible. 3. The secure transfer must be secured by the sender, receiver, and amount. Category PETs Transaction Information Sender Receiver Amount Segregating Ledger Segregating Hidden Hidden Payment channel network Public Hidden* Unlinking One-time address Hidden Public Mixing Hidden Public Ring signature Hidden Public Hidden Hiding Pedersen commitment Public Hidden Zero knowledge proof Hidden Hidden Homomorphic encryption Public Hidden Requirements 4. Secure transfer need to be auditable by auditor. 2. All public and secure transfers must be public on a single ledger.

Which PETs meet the requirements? 1. Both public and secure transfer must be possible. 3. The secure transfer must be secured by the sender, receiver, and amount. Category PETs Transaction Information Sender Receiver Amount Segregating Ledger Segregating Hidden Hidden Payment channel network Public Hidden* Unlinking One-time address Hidden Public Mixing Hidden Public Ring signature Hidden Public Hidden Hiding Pedersen commitment Public Hidden Zero knowledge proof Hidden Hidden Homomorphic encryption Public Hidden Requirements 4. Secure transfer need to be auditable by auditor. 2. All public and secure transfers must be public on a single ledger.

3FQFBU/UJNFT Zero knowledge proof Source of image: https://simple.wikipedia.org/wiki/Zero-knowledge_proof A B Alice Bob " 0, Bob Alice Alice A B Bob

Using ZKP on an Account based Public Balances Account Model

Using ZKP on an Account based Secret Balances Encrypted UTXO Model Public Balances Account Model Hybrid Model

Audit for secure transfer PXOFS WBMVF SBOE4FFE VOTQFOU JOQVUT PVUQVUT UTXO FODSZQUFECPEZ VOTQFOU JOQVUT PVUQVUT Encrypted UTXO Encryption Key Auditor Viewing Key PXOFS WBMVF SBOE4FFE

Main function of LINE Blockchain secure transfer Add secure transfer and All secure transfer are handled with ZKP. Transactions between secret and public balances. Secure transfer is UTXO model, public transfer is Account model. Encrypt UTXO of secure transfer with one-time encryption key.

How secure transfer work Account Encrypted UTXO Account Encrypted UTXO HidingTransaction RevealingTransaction SecretTransaction Transaction

- Sender and amount are disclosed - Receiver is private - Sender signature required - Receiver and encrypted UTXO attestation with ZKP - The public balance is burned - Mint new UTXO and used as input for secret UTXO HidingTransaction FODSZQUFECPEZ PXOFS WBMVF secret UTXO Account value Secure transfer public balance → secret balance Transaction • Sender • Amount • Receiver • Input UTXO • Output UTXO • ZKP Proof • signature

- Sender and amount are disclosed - Receiver is private - Sender signature required - Receiver and encrypted UTXO attestation with ZKP - The public balance is burned - Mint new UTXO and used as input for secret UTXO HidingTransaction PXOFS TFOEFS WBMVF CMPDLIFJHIU mint UTXO FODSZQUFECPEZ PXOFS WBMVF secret UTXO Account value Burn Account value Secure transfer public balance → secret balance

- Receiver and amount are disclosed - Sender is private - Sender and encrypted UTXO attestation with ZKP - The secret balance is burned - New account value is created and added to the receiver’s balance RevealingTransaction Secure transfer secret balance → public balance Account value + A value secret UTXO FODSZQUFECPEZ PXOFS "WBMVF Transaction • Sender • Amount • Receiver • Input UTXO • Output UTXO • ZKP Proof

- Receiver and amount are disclosed - Sender is private - Sender and encrypted UTXO attestation with ZKP - The secret balance is burned - New account value is created and added to the receiver’s balance RevealingTransaction Secure transfer secret balance → public balance PXOFS SFDFJWFS "WBMVF CMPDLIFJHIU burn UTXO Account value + A value secret UTXO FODSZQUFECPEZ PXOFS "WBMVF Mint Account value

- Receiver and amount are disclosed - Sender is private - Sender and encrypted UTXO attestation with ZKP - The secret balance is burned - New account value is created and added to the receiver’s balance RevealingTransaction Secure transfer secret balance → public balance PXOFS SFDFJWFS #WBMVF CMPDLIFJHIU burn UTXO Account value + B value secret UTXO FODSZQUFECPEZ PXOFS "WBMVF secret UTXO FODSZQUFECPEZ PXOFS "# WBMVF Mint Account value

- Sender, receiver and amount are private - Sender and input/output UTXO attestation with ZKP SecretTransaction Secure transfer secret balance → secret balance Transaction • Sender • Amount • Receiver • Input UTXO • Output UTXO • ZKP Proof

- Sender, receiver and amount are private - Sender and input/output UTXO attestation with ZKP SecretTransaction secret UTXO secret UTXO FODSZQUFECPEZ PXOFS "WBMVF FODSZQUFECPEZ PXOFS #WBMVF secret UTXO FODSZQUFECPEZ PXOFS $WBMVF Secure transfer secret balance → secret balance

SecretTransaction secret UTXO FODSZQUFECPEZ PXOFS "#ʜO WBMVF secret UTXO FODSZQUFECPEZ PXOFS "WBMVF secret UTXO FODSZQUFECPEZ PXOFS #WBMVF secret UTXO FODSZQUFECPEZ PXOFS OWBMVF . . . Secure transfer secret balance → secret balance - Sender, receiver and amount are private - Sender and input/output UTXO attestation with ZKP

Secret balance audit - Auditor requests viewing key from owner. - Audit UTXO with viewing key - Other encrypted UTXOs can’t be decrypted - UTXO is encrypted with one-time encryption key TFDSFU 6590 TFDSFU 6590 TFDSFU 6590 TFDSFU 6590 Owner Auditor 1. Request Viewing Key 2. audit UTXO x

Secure transfer Summary Account Encrypted UTXO Account Encrypted UTXO HidingTransaction RevealingTransaction SecretTransaction Transaction

Secure transfer Summary Account Encrypted UTXO Account Encrypted UTXO HidingTransaction RevealingTransaction SecretTransaction Transaction MintSecureUTXO

Future plans

Future plans - Improve secure transfer auditing through MPC* - Secret balance calculation with homomorphic encryption - NFT TFDVSFUSBOTGFS * MPC: Multi-Party computation

Thank you