[REDACTED] 2024 | Chain Signatures Workshop From Architecture to Implementation

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:00

   uh hello everyone uh my name is Shi I work in the train signatures team uh so this talk will mostly about the technical perspective like why we wanted to build it uh how it works in the back end and uh what you can build with it um so to start I want to talk about the motivation like why we wanted to do it so um I want you to imagine that you are a developer at a sweatcoin so sweatcoin is a big D app on near that has millions of users let's just imagine

2. 0:30

   you work for that kind of app and then what you want to do right now is you want to onboard all those users onto some other D app on other chains so for example forecaster on base right so how would you actually try to do it okay so this is me trying to do it so I think first step is I will try to create uh an account for the user on base and obviously I need to worry about the private keys right like whether I should keep it or I should ask users to keep it and the next thing is I want to

3. 1:05

   figure out where the gas come from for base right so when we think about gas then there involves another creation of account on E and then there's swaps there's bridging so we all know that that there is a lot of trouble involved like when we think about creating accounts where does the private key go right if the user lose their private key everything is kind of burned to ashes and then the second thing is uh when we

4. 1:29

   go through the swaps bridging your assets can be stuck your assets can be delayed a lot of things can happen so when you're a developer and you're trying to make that happen in the background a lot of things can just go sou so that whole thing is kind of why we wanted to build chain signatures so with chain signature it can just be as simple as that you just know that your user has a near account and the next thing you know is that that user has some address on each of the chains that they can interact with

5. 2:00

   so for example in this case your spat user will have a derived address on base and then they can just directly start using forecaster and the key magic behind making that happen is actually this so with chain Signature One near account can control one on one address on each of the chains so this is like two fold the first fold is there is a unique mapping between the near account and the address you get on each of the chains and the second fold is this near account

6. 2:32

   is actually able to control all these addresses with without actually having access to the private key of those addresses and this talk will mostly focus on how we make that happen so before we go into the technical details I want to talk about the high level architecture it's actually pretty simple it's just two things so first is a chain signature smart contract the next is a set of

7. 2:58

   nodes that are supporting the contract so the way you or any developer interact with this system is just by calling the contract and the most important function in this whole thing is the sign function so as you can see what goes into it is a payload which is typically the transaction payload that you want to do on other chains and then the path which is the derivation path typically it kind

8. 3:21

   of signals which chain you're going for and then a key virsion which is something built inside of us so this is how you you're going to interact with the system and at a high level what's going to happen is whenever you do this sign call the set of nodes that are supporting the contract as we see in this slide will coordinate with with each other and then they will generate the signature and then return it back to

9. 3:44

   you so now you might be wondering okay why is this uh system about this sign function why is this sign function important so I think that's like the key question we want to answer uh and I will try to do it in this talk but before we go there I want to introduce a central concept of this whole system which is the root key so this root key is kind of at the center of making everything happen so it's at the center of how we derive all these addresses from near accounts and it's also at the the center

10. 4:16

    of how we enable the near account to actually control these addresses so I want to start with how this key is generated so when we first initialize the smart contract uh what happens is this setup of nodes that are supporting the contract they will coordinate with each other and kind of go into a computation protocol what they end up with is each of the node will have a private key share located locally on the

11. 4:42

    Node and the next thing they do is they we will kind of assemble these root private key shares into a root public key and we will expose it in the contract so which means that you can see it just by calling a private key function on a chain signature contract so one thing I want to point out is you can see in this whole picture that there is no private key anywhere we are not trying to assemble the root private key

12. 5:06

    share into the root private key that's for essential security reasons and I will get to that later okay now I have talked about uh where did we get the root key and now I want to talk about why is it important like how is it important in deriving the addresses for the near account so the key thing here is actually when we try to derive the address for each of the near account we're actually calling this derive key function and as as you can see what goes into it is the public key

13. 5:38

    which will be the root public key of the chain signature system and the Epsilon which is derived by a presser ID which is basically the near account that's calling the contract and the derivation path which is a string so we further summarize in this slide which is like when we try to derive these addresses on other chains what we take is is the root public key of this the chain signature system the near

14. 6:03

    account and the path so that is why chain signature needs to be involved in this derivation so that your derivation of the address is unique and deterministic and basically if you're not doing that through the chain signature system or you're not using the chain signature root key for this derivation your derived address will be different and it's going to be wrong okay so that is how we get this unique mapping between near account and addresses on other chains and the next

15. 6:35

    qu question we want to explain is okay we know that these users they can derive these addresses but then but then how do they actually use these addresses because they don't have the keys right so before we go into the detail there I want you to imagine that you create your own account on let's say base right so if you did create your own account what's going to happen it's that you're

16. 6:58

    going to be given a set seed phrase and then you're going to be given a private key and when you are trying to do any kind of interaction with any kind of D apps on the base chain what happens is you use that private key to authorize all the transactions which is basically that you're trying to sign all the transactions with your private key so now we come into the case where this address is derived and remember previously we said that the way we

17. 7:29

    derive these addresses by this derive key function and what goes into it is the root public key and your near account and then we get a unique address and then we take a closer look at this code we see that there is this derived secret key function that go hand in hand with the derived key function so what goes into this derived secret key function is actually the root private key of the system so if we actually get

18. 7:54

    the root private key in there we can get the private key of the derived address so that is this is very important because it established the link between this derived address and between the root key and the root private key and this kind of explains why this root private key can sign for for users so this summarizes what exactly what we talked about if we have the root private key and the near account theoretically we can derive the secret

19. 8:24

    key however as I have mentioned we are not assembling the private key from the private key shares we only have the private key shares so this path of directly deriving the secret key in order to uh authorized transactions is just not going to work so how are we going to actually control these addresses right there is no private key so when we think about that that problem we further take a step

20. 8:54

    back and think about what's the most important thing when we say I have ownership of this this base account so when when I say I have ownership of this base account what I mean is I can actually do all the transactions I can decide whether I want to say yes or no to a transaction right so the key here is not whether you have the private key the key here is you are able to sign all the

21. 9:17

    transactions so what if although we don't directly have access to the private key of that derived address we can still somehow sign it so this is exactly what chain signature is able to do what is what it does is it uses the root private key shares and it's somehow able to sign for all the transactions on behalf of the derived addresses and I would explain kind of high level how we use these private key shares to to generate a signature in the next

22. 9:48

    slide so let's now uh we have talked about that the architecture of the system is smart contract and a set set of nodes that are supporting it so that's let's say there are three nodes in the system so each of each of the node will have one root private key share so whenever a sign function call comes into the system it will also come come in with the near account that's calling it which is the account here and also the path so what will happen on these back and nodes is each of them

23. 10:21

    together with their private key Share value will go into a protocol and then what what I mean by a protocol is basically they will do some computation locally and then kind of exchange that value with one another and do some further computation use using those value and like a couple of rounds and back and forth and then when they got got some value out of that protocol they further compute uh with the account they

24. 10:45

    got from the sign request and the path and now what they get is a derived PR signature the reason why I call it derived signature is it is corresponding to the derived address that this user is targeting so it's Unique to the near account and the path that's calling it so basically if the near account that's calling this this sign function is different it's going to be a different

25. 11:06

    derived pre signature so now each of the node has a pre uh derived PR signature for this sign request the next step is each of them will take the payload of the transaction and then they will generate a signature share on each of the node and the last step of make like combining everything together is that we will like combine all these signature shares and then it will form a complete

26. 11:33

    signature for this transaction okay so now we have explained how chain signature was able to have this unique mapping between near account and derive addresses and also how near near account was able to sign transaction on behalf of these accounts so now we want to put it together so how does this one near account Act actually do something on base right so it's act as simple as two steps so the first step

27. 12:05

    is with your near account you call the sign function on the Chain signature contract with the transaction payload that you wish to sign on other other chains it can be base it can be anything else and the ne the second step is you kind of you combine that transaction with the signature which comes into a sign transaction and you send it to base and completes your transaction okay so that kind of wraps up the high level explanation of technically how we make uh a near account able to sign

28. 12:38

    transaction on other chains and control other accounts on other chains and but I also want to spend a couple of minutes talking about why our system is secure so I think the key thing I I want to point out is with ch with chain signature if you're developing on it you don't have to worry about your user keys so i' as I've men mentioned if we don't have chain signature if if you as the sweat developer if you want to onboard your user onto any other D app on other

29. 13:07

    chains what you need to do is you need to create accounts for them and then you need to safekeep their keys but with chain signature you don't even have to worry about that there is no way anyone can just steal the user keys because as we have mentioned the users keys are derived basically from the root key and since I have mentioned that our root private key is never a assembled in

30. 13:30

    anywhere we only have the private key shares so there's no way for anyone to say okay I'll just steal the user's keys or even I'll just steal the root private key it's not available anywhere in our system and furthermore we also keep it more secure by kind of keeping the root private key share values hidden so as I have mentioned previously in this kind of protocol right we see that the root private key

31. 14:00

    share values actually does into that does need to enter into some kind of protocol but even in those cases the nodes they will never exchange the root private key shares directly with one another when they whenever they want to send any kind of value to each other that value must be a computed value of the root private key share so that comput computed key value can think of it as some kind of function applied over the private key Share value and that function would always be an irreversible

32. 14:32

    function so when I say irreversible I mean it's kind of like a hash function where if you have the input it's very easy to get the output but if you have the output it's kind of impossible for you to deduce what goes into it so this is how we we are able to hide the root private key shares from the network and from one node and another the last thing I want to mention about our system is we can actually guarantee a very high optim time uh the reason why we can do it is we are

33. 15:02

    employing this T out of n signing so when I say t out of n uh the example is like for example on our production mainnet we now have eight notes that's talking with the contract so on mainnet we are using five out of eight signing which means at any time as long as there are five notes that are alive online we can still respond to the sign requests so this means that our system can tolerate up to three notes being offline

34. 15:27

    and then if anyone tries to attack the system and take it down they need to at least take down four notes which becomes kind of at least on non-trivial okay that's all I want to talk about about about our architecture and I also want to spend the last few minutes talking about what people are building on us so there are smaller projects and there are bigger projects uh I want to start with smaller projects I think uh this one coming from keom called multi-chain trial accounts is especially interesting uh what they're

35. 15:59

    try the use case they're trying to Target is imagine that you're are building a d app and then you want to give each you their uh one $10 to try things out on your app but what user typically ends up doing is they just they just rug the account right they take the money out and they're not using your your app in any way so what multi-chain trial accounts try to do is they will Whit list the allowed actions

36. 16:22

    on all these kind of D apps and then if the user was trying to do something else they will just directly ban it and the way key was using chain signature was that with chain signature they are able to list all the DFS of all the chains in one smart contract and then they're able to use chain signature chain signature to do the cross chain stuff so I think that's a very interesting case because

37. 16:44

    it's a small one it's not like a 100 people building for two years but it's super useful and it it's a very good example of replacing the heavy LIF lifting with uh chain signatures so I think that's a very good place where people can start and think about what US Cas there are and onto the bigger projects we have defuse which is like a marketplace where people can trade keys with assets and the infinex which is a secure noncustodial cross chain wallet

38. 17:11

    it came from K who is the co-founder of synthetex and also sweat wallet who's trying to onboard their users onto DFS on other chains okay uh so much for the talk of like this is our QR code for the developer Channel and you can also add me and then these are some examples to follow thank you