SlideShare una empresa de Scribd logo

Proof of Assets for Crypto Custodians by Jake Craige

•
•
J
jakecraige

Giving up control of your keys to a crypto custodian comes with a lot of risk, you have to trust that they continue to have access to your funds and are representing your balance accurately. With new research from the past few years, these institutions now have options available on how they can prove this, potentially in zero-knowledge, to their customers. Join Jake Craige, a Senior Engineer the Coinbase Crypto Engineering team to cover two protocols: Proof of Reserves and Provisions: Proof of Solvency. We’ll cover how they work, the trade-offs they have, and how practical they are (or are not) for institutions to implement today.

Ingeniería
1 de 82
Descargar para leer sin conexión
Proof of Assets For Crypto Custodians @jakecraige Crypto Engineering May 10, 2019
Prove what? • We have access to the private keys which control our funds • We have more assets than liabilities (customer balances)
Terminology ! Crypto Custodian ! Proof of Reserves (or Assets) ! Proof of Liabilities ! Proof of Solvency
History
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Bitcoin Whitepaper October 2008
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Bitcoin Whitepaper October 2008
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015 MProve Paper December 2018
History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015 MProve Paper December 2018 Proof of Reserves February 2019
Our Options • Public Audit • Blockstream Proof of Reserves • Provisions: Proof of Solvency
Public Audit
Public Audit • Proof of Reserves • Sign a message with every address that has a balance • Send messages to auditor • Auditor verifies signature and balance on chain • Proof of Liabilities • Provide list of all customer identifiers and balances • Proof of Solvency • Auditor verifies sum of reserves is greater or equal to liabilities and publishes report
Maxwell Proof of Liabilities
Maxwell Proof of Liabilities • Proposed in 2013 from Greg Maxwell & Peter Todd • Allows custodians to build a proof that includes all customer balances where the customer can validate they are included in the proof.
Maxwell Proof of Liabilities
Proof of Reserves
Proof of Reserves • Proposal and tool released on February 4, 2019 by Blockstream • BIP-127: Simple Proof-of-Reserves Transactions • An unspendable transaction is the proof • Bitcoin Only
Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs
Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs Outputs
Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs amount: 3 Outputs
Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs amount: 3 prev hash: hash amount: 0 Outputs SHA-256("Proof-of-Reserves: Custom Message")
Proof of Reserves • BIP defines a standard that can be interoperable across wallets • No privacy. All outputs you own are revealed. • No proof of liabilities. The specification only covers reserves.* • Proof size is O(n) in the number of inputs *You could combine this with Maxwell’s Proof of Liabilities to have this
Provisions: Proof of Solvency
Provisions: Proof of Solvency • Paper published October 26, 2015 by Dagher et al • No production implementations • Uses ZK-proofs for privacy • Usable for any asset
Provisions: Proof of Solvency • Proof of Assets • Proof of Liabilities • Proof of Solvency • • Optional • Proof of Non-Collusion • Proof of Surplus Zassets − Zliabilitities = 0
Provisions: Proof of Assets • Commitment to each public key and balance • Uses an anonymity set for privacy • Uses interactive sigma proofs • Made non-interactive with Fiat-Shamir transform • Proof size is O(n) in the number of public keys
Provisions: Proof of Assets ZK commitment to balance and knowledge of private key
Provisions: Proof of Assets ZK commitment to balance and knowledge of private key Generators g, h ∈ 𝔾
Provisions: Proof of Assets y = gx ZK commitment to balance and knowledge of private key Public Key Generators g, h ∈ 𝔾
Provisions: Proof of Assets y = gx s ∈ {0,1} ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Generators g, h ∈ 𝔾
Provisions: Proof of Assets b = gbal(y) y = gx s ∈ {0,1} ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Generators g, h ∈ 𝔾
Provisions: Proof of Assets b = gbal(y) p = bs ⋅ hv y = gx s ∈ {0,1} v ←$ ℤq ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Pedersen Commitment Generators g, h ∈ 𝔾
Provisions: Proof of Assets b = gbal(y) p = bs ⋅ hv y = gx s ∈ {0,1} v ←$ ℤq ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Pedersen Commitment Generators g, h ∈ 𝔾 Published Values y, p
Interactive Sigma Proof Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq Interactive Sigma Proof Prover Provisions: Proof of Assets Verification of balance commitment Verifier Prover Verifier
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq Interactive Sigma Proof Prover Verifier Provisions: Proof of Assets Verification of balance commitment Prover Verifier
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v Interactive Sigma Proof Prover Verifier Prover Provisions: Proof of Assets Verification of balance commitment Verifier
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 Interactive Sigma Proof Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1brs ⋅ hrv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 = bcs ⋅ hcv ⋅ bu1 ⋅ hu2 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 = bcs ⋅ hcv ⋅ bu1 ⋅ hu2 = bu1+cs ⋅ hu2+cv brs ⋅ hrv bu1+cs ⋅ hu2+cv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
Provisions: Proof of Liabilities • Commitment to each customer identifier and balance with range proof for positive amounts • Customer requests secret values from custodian and can verify their balance is in the proof. • Auditor* checks that sum of customer commitments is accurate • Proof size is O(n) in the number of customers *Can be anyone but likely some service due to the size of the proof
Provisions: Proof of Liabilities ZK commitment to balance
Provisions: Proof of Liabilities ZK commitment to balance Account Balance = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k BinBalance Balance
Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits zk = gxk ⋅ hrk = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk rk ←$ ℤq R = b−1 ∑ k=0 rk ⋅ 2k
Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits zk = gxk ⋅ hrk = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq R = b−1 ∑ k=0 rk ⋅ 2k
Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits Customer Identifier zk = gxk ⋅ hrk CID = H(username||n) = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq n ←$ {0,1}512 R = b−1 ∑ k=0 rk ⋅ 2k
Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits Published Values Customer Identifier zk = gxk ⋅ hrk CID = H(username||n) = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq n ←$ {0,1}512 ⟨CID, z0, …, zb−q⟩ R = b−1 ∑ k=0 rk ⋅ 2k
Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover (R, v, Balance)
Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n)
Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR
Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR Calculate prover commitment zp = b−1 ∏ k=0 z(2k ) k
Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR Calculate prover commitment zp = b−1 ∏ k=0 z(2k ) k Verify equality zc = zp
Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 zc
Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k zc
Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k zc
Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k = g∑ b−1 k=0 xk⋅2k ⋅ h∑ b−1 k=0 rk⋅2k zc
Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k = g∑ b−1 k=0 xk⋅2k ⋅ h∑ b−1 k=0 rk⋅2k = gBalance hR zc
ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = 0 Provisions: Proof of Solvency ZK commitment to total assets
Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi)Zassets
Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi) = ∏ bsi i ⋅ hvi = ∏ gbal(yi)⋅si ⋅ hvi Zassets
Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi) = gAssets h∑ n i=1 vi = ∏ bsi i ⋅ hvi = ∏ gbal(yi)⋅si ⋅ hvi Zassets
Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi Liabilities = c ∑ i=1 BalanceiZliabilities
Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 BalanceiZliabilities
Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 Balancei = g∑ c i=1 Balanceih∑ c i=1 Ri Zliabilities
Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 Balancei = g∑ c i=1 Balanceih∑ c i=1 Ri = gLiabilities h∑ c i=1 Ri Zliabilities
ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities Provisions: Proof of Solvency ZK commitment to assets - liabilities
ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = gAssets ⋅ h∑ c i=1 vi ⋅ (gLiabilities h∑ c i=1 Ri)−1 Provisions: Proof of Solvency ZK commitment to assets - liabilities
ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = gAssets−Liabilities ⋅ h∑ c i=1 vi−∑ c i=1 Ri Provisions: Proof of Solvency ZK commitment to assets - liabilities = g0 ⋅ h∑ c i=1 vi−∑ c i=1 Ri = gAssets ⋅ h∑ c i=1 vi ⋅ (gLiabilities h∑ c i=1 Ri)−1
= g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities
= g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge
= g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier checks proof of knowledge … Schnorr Proof Verification
= g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities ZvSolvency = c ∏ i=1 zi − n ∏ i=1 pi = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier computes solvency Verifier checks proof of knowledge … Schnorr Proof Verification
= g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities ZvSolvency = c ∏ i=1 zi − n ∏ i=1 pi = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier computes solvency Verifier verifies prover computation ZSolvency = ZvSolvency Verifier checks proof of knowledge … Schnorr Proof Verification
Provisions: Summary • Scales linearly with respect to the proof size, construction and verification time. Protocol is easily parallelizable. • Does not reveal any information about addresses, total assets or customer balances. • If the public key has not been published on chain by including it in the anonymity set you would reveal it. • Generation & verification requires balance at a block hash oracle • No proposed standard that would be interoperable across companies
Open Questions • Committing to an address instead of public key • Proving cold storage assets • Optimizing proof size, generation and verification
In Summary
Thanks! Jake Craige // @jakecraige We’re hiring! coinbase.com/careers • Maxwell Proof of Liabilities • https://web.archive.org/web/20171124195504/https://iwilcox.me.uk/2014/proving-bitcoin-reserves • Proof of Reserves • https://blockstream.com/2019/02/04/en-standardizing-bitcoin-proof-of-reserves/ • Provisions • https://eprint.iacr.org/2015/1008 • Demo Site: https://provisions.glitch.me • Rust Implementation: https://github.com/jakecraige/provisions • MProve • https://eprint.iacr.org/2018/1210

Recomendados

COMBINATIONAL CIRCUITS
COMBINATIONAL CIRCUITSCOMBINATIONAL CIRCUITS
COMBINATIONAL CIRCUITS
GopinathD17
 
Droid on Chain - Berry Ventura Lev, Kik
Droid on Chain - Berry Ventura Lev, KikDroid on Chain - Berry Ventura Lev, Kik
Droid on Chain - Berry Ventura Lev, Kik
DroidConTLV
 
Partition-Tolerant Distributed Publish/Subscribe System
Partition-Tolerant Distributed Publish/Subscribe SystemPartition-Tolerant Distributed Publish/Subscribe System
Partition-Tolerant Distributed Publish/Subscribe System
Vaidas Brundza
 
Dataflow Analysis
Dataflow AnalysisDataflow Analysis
Dataflow Analysis
Eelco Visser
 
Foundations for New Champlain Bridge Corridor Project
Foundations for New Champlain Bridge Corridor ProjectFoundations for New Champlain Bridge Corridor Project
Foundations for New Champlain Bridge Corridor Project
Daksh Raj Chopra
 
Grincon U.S. 2019 RSA Accumulators
Grincon U.S. 2019 RSA AccumulatorsGrincon U.S. 2019 RSA Accumulators
Grincon U.S. 2019 RSA Accumulators
Karen Hsu
 
Compliance monitoring of multi-perspective declarative process models
Compliance monitoring of multi-perspective declarative process modelsCompliance monitoring of multi-perspective declarative process models
Compliance monitoring of multi-perspective declarative process models
Faculty of Computer Science - Free University of Bozen-Bolzano
 
Data Binding in qooxdoo
Data Binding in qooxdooData Binding in qooxdoo
Data Binding in qooxdoo
Martin Wittemann
 

Recomendados

COMBINATIONAL CIRCUITS
COMBINATIONAL CIRCUITSCOMBINATIONAL CIRCUITS
COMBINATIONAL CIRCUITS
GopinathD17
 
Droid on Chain - Berry Ventura Lev, Kik
Droid on Chain - Berry Ventura Lev, KikDroid on Chain - Berry Ventura Lev, Kik
Droid on Chain - Berry Ventura Lev, Kik
DroidConTLV
 
Partition-Tolerant Distributed Publish/Subscribe System
Partition-Tolerant Distributed Publish/Subscribe SystemPartition-Tolerant Distributed Publish/Subscribe System
Partition-Tolerant Distributed Publish/Subscribe System
Vaidas Brundza
 
Dataflow Analysis
Dataflow AnalysisDataflow Analysis
Dataflow Analysis
Eelco Visser
 
Foundations for New Champlain Bridge Corridor Project
Foundations for New Champlain Bridge Corridor ProjectFoundations for New Champlain Bridge Corridor Project
Foundations for New Champlain Bridge Corridor Project
Daksh Raj Chopra
 
Grincon U.S. 2019 RSA Accumulators
Grincon U.S. 2019 RSA AccumulatorsGrincon U.S. 2019 RSA Accumulators
Grincon U.S. 2019 RSA Accumulators
Karen Hsu
 
Compliance monitoring of multi-perspective declarative process models
Compliance monitoring of multi-perspective declarative process modelsCompliance monitoring of multi-perspective declarative process models
Compliance monitoring of multi-perspective declarative process models
Faculty of Computer Science - Free University of Bozen-Bolzano
 
Data Binding in qooxdoo
Data Binding in qooxdooData Binding in qooxdoo
Data Binding in qooxdoo
Martin Wittemann
 
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
dollysharma2066
 
Double Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torqueDouble Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torque
BhangaleSonal
 
chapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringchapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineering
mulugeta48
 
KubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghlyKubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghly
sanyuktamishra911
 
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoorTop Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
dharasingh5698
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ssuser89054b
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.ppt
NANDHAKUMARA10
 
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Arindam Chakraborty, Ph.D., P.E. (CA, TX)
 
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
Call Girls in Nagpur High Profile Call Girls
 
Unit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdfUnit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdf
RagavanV2
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
Kamal Acharya
 
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
tanu pandey
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
roncy bisnoi
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdf
Kamal Acharya
 
Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control
 
Thermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptThermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . ppt
DineshKumar4165
 
UNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its PerformanceUNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its Performance
sivaprakash250
 
Employee leave management system project.
Employee leave management system project.Employee leave management system project.
Employee leave management system project.
Kamal Acharya
 
2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 

Más contenido relacionado

Último

FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
dollysharma2066
 
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoorTop Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
dharasingh5698
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ssuser89054b
 
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Arindam Chakraborty, Ph.D., P.E. (CA, TX)
 
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
Call Girls in Nagpur High Profile Call Girls
 
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
tanu pandey
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
roncy bisnoi
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdf
Kamal Acharya
 

Último (20)

FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
FULL ENJOY Call Girls In Mahipalpur Delhi Contact Us 8377877756
 
Double Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torqueDouble Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torque
 
chapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringchapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineering
 
KubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghlyKubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghly
 
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoorTop Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
Top Rated Call Girls In chittoor 📱 {7001035870} VIP Escorts chittoor
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.ppt
 
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
 
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
(INDIRA) Call Girl Bhosari Call Now 8617697112 Bhosari Escorts 24x7
 
Unit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdfUnit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdf
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
 
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdf
 
Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024
 
Thermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptThermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . ppt
 
UNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its PerformanceUNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its Performance
 
Employee leave management system project.
Employee leave management system project.Employee leave management system project.
Employee leave management system project.
 

Destacado

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 

Destacado (20)

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity - Best PracticesTime Management & Productivity - Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 

Proof of Assets for Crypto Custodians by Jake Craige

  • 1. Proof of Assets For Crypto Custodians @jakecraige Crypto Engineering May 10, 2019
  • 2. Prove what? • We have access to the private keys which control our funds • We have more assets than liabilities (customer balances)
  • 3. Terminology ! Crypto Custodian ! Proof of Reserves (or Assets) ! Proof of Liabilities ! Proof of Solvency
  • 5. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Bitcoin Whitepaper October 2008
  • 6. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Bitcoin Whitepaper October 2008
  • 7. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008
  • 8. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015
  • 9. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015 MProve Paper December 2018
  • 10. History 2008 20192013 2014 2015 20182009-2012 2016-2017 Maxwell & Todd discuss on IRC March 2013 Wilcox publishes details on blog May 2013 Mt. Gox suspends withdrawals February 2014 Bitcoin Whitepaper October 2008 Provisions Paper August 2015 MProve Paper December 2018 Proof of Reserves February 2019
  • 11. Our Options • Public Audit • Blockstream Proof of Reserves • Provisions: Proof of Solvency
  • 13. Public Audit • Proof of Reserves • Sign a message with every address that has a balance • Send messages to auditor • Auditor verifies signature and balance on chain • Proof of Liabilities • Provide list of all customer identifiers and balances • Proof of Solvency • Auditor verifies sum of reserves is greater or equal to liabilities and publishes report
  • 14. Maxwell Proof of Liabilities
  • 15. Maxwell Proof of Liabilities • Proposed in 2013 from Greg Maxwell & Peter Todd • Allows custodians to build a proof that includes all customer balances where the customer can validate they are included in the proof.
  • 16. Maxwell Proof of Liabilities
  • 18. Proof of Reserves • Proposal and tool released on February 4, 2019 by Blockstream • BIP-127: Simple Proof-of-Reserves Transactions • An unspendable transaction is the proof • Bitcoin Only
  • 19. Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs
  • 20. Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs Outputs
  • 21. Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs amount: 3 Outputs
  • 22. Proof of Reserves tx hash: abc amount: 1 tx hash: def amount: 2 Unspent Outputs prev hash: abc amount: 1 prev hash: def amount: 2 Inputs amount: 3 prev hash: hash amount: 0 Outputs SHA-256("Proof-of-Reserves: Custom Message")
  • 23. Proof of Reserves • BIP defines a standard that can be interoperable across wallets • No privacy. All outputs you own are revealed. • No proof of liabilities. The specification only covers reserves.* • Proof size is O(n) in the number of inputs *You could combine this with Maxwell’s Proof of Liabilities to have this
  • 25. Provisions: Proof of Solvency • Paper published October 26, 2015 by Dagher et al • No production implementations • Uses ZK-proofs for privacy • Usable for any asset
  • 26. Provisions: Proof of Solvency • Proof of Assets • Proof of Liabilities • Proof of Solvency • • Optional • Proof of Non-Collusion • Proof of Surplus Zassets − Zliabilitities = 0
  • 27. Provisions: Proof of Assets • Commitment to each public key and balance • Uses an anonymity set for privacy • Uses interactive sigma proofs • Made non-interactive with Fiat-Shamir transform • Proof size is O(n) in the number of public keys
  • 28. Provisions: Proof of Assets ZK commitment to balance and knowledge of private key
  • 29. Provisions: Proof of Assets ZK commitment to balance and knowledge of private key Generators g, h ∈ 𝔾
  • 30. Provisions: Proof of Assets y = gx ZK commitment to balance and knowledge of private key Public Key Generators g, h ∈ 𝔾
  • 31. Provisions: Proof of Assets y = gx s ∈ {0,1} ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Generators g, h ∈ 𝔾
  • 32. Provisions: Proof of Assets b = gbal(y) y = gx s ∈ {0,1} ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Generators g, h ∈ 𝔾
  • 33. Provisions: Proof of Assets b = gbal(y) p = bs ⋅ hv y = gx s ∈ {0,1} v ←$ ℤq ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Pedersen Commitment Generators g, h ∈ 𝔾
  • 34. Provisions: Proof of Assets b = gbal(y) p = bs ⋅ hv y = gx s ∈ {0,1} v ←$ ℤq ZK commitment to balance and knowledge of private key Public Key Knowledge of Private Key Balance Commitment Pedersen Commitment Generators g, h ∈ 𝔾 Published Values y, p
  • 35. Interactive Sigma Proof Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment
  • 36. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq Interactive Sigma Proof Prover Provisions: Proof of Assets Verification of balance commitment Verifier Prover Verifier
  • 37. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq Interactive Sigma Proof Prover Verifier Provisions: Proof of Assets Verification of balance commitment Prover Verifier
  • 38. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v Interactive Sigma Proof Prover Verifier Prover Provisions: Proof of Assets Verification of balance commitment Verifier
  • 39. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 Interactive Sigma Proof Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment
  • 40. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1brs ⋅ hrv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 41. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 42. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 43. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 44. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 = bcs ⋅ hcv ⋅ bu1 ⋅ hu2 brs ⋅ hrv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 45. a1 = bu1 ⋅ hu2 u1, u2 ←$ ℤq c ←$ ℤq rs = u1 + c ⋅ s rv = u2 + c ⋅ v brs ⋅ hrv = pc ⋅ a1 = pc ⋅ a1 = pc ⋅ a1 = (bs ⋅ hv )c ⋅ a1 = bcs ⋅ hcv ⋅ a1 = bcs ⋅ hcv ⋅ bu1 ⋅ hu2 = bu1+cs ⋅ hu2+cv brs ⋅ hrv bu1+cs ⋅ hu2+cv bu1+cs ⋅ hu2+cv Interactive Sigma Proof Verification Prover Verifier Prover Verifier Provisions: Proof of Assets Verification of balance commitment p = bs ⋅ hv Known = b, a1, c, rs, rv, p
  • 46. Provisions: Proof of Liabilities • Commitment to each customer identifier and balance with range proof for positive amounts • Customer requests secret values from custodian and can verify their balance is in the proof. • Auditor* checks that sum of customer commitments is accurate • Proof size is O(n) in the number of customers *Can be anyone but likely some service due to the size of the proof
  • 47. Provisions: Proof of Liabilities ZK commitment to balance
  • 48. Provisions: Proof of Liabilities ZK commitment to balance Account Balance = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k BinBalance Balance
  • 49. Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits zk = gxk ⋅ hrk = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk rk ←$ ℤq R = b−1 ∑ k=0 rk ⋅ 2k
  • 50. Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits zk = gxk ⋅ hrk = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq R = b−1 ∑ k=0 rk ⋅ 2k
  • 51. Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits Customer Identifier zk = gxk ⋅ hrk CID = H(username||n) = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq n ←$ {0,1}512 R = b−1 ∑ k=0 rk ⋅ 2k
  • 52. Provisions: Proof of Liabilities ZK commitment to balance Account Balance Binary Commitment to Bits Published Values Customer Identifier zk = gxk ⋅ hrk CID = H(username||n) = ⟨x0, x1, …, xb−1⟩ = b−1 ∑ k=0 xk ⋅ 2k for each bit BinBalance Balance xk Commitment to Balance z = b−1 ∏ k=1 z(2k) k rk ←$ ℤq n ←$ {0,1}512 ⟨CID, z0, …, zb−q⟩ R = b−1 ∑ k=0 rk ⋅ 2k
  • 53. Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover (R, v, Balance)
  • 54. Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n)
  • 55. Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR
  • 56. Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR Calculate prover commitment zp = b−1 ∏ k=0 z(2k ) k
  • 57. Provisions: Proof of Liabilities Customer verification of balance commitment Request from prover Compute CID and verify it is in published data (R, v, Balance) CID = H(username||n) Compute balance commitment zc = gBalance ⋅ hR Calculate prover commitment zp = b−1 ∏ k=0 z(2k ) k Verify equality zc = zp
  • 58. Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 zc
  • 59. Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k zc
  • 60. Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k zc
  • 61. Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k = g∑ b−1 k=0 xk⋅2k ⋅ h∑ b−1 k=0 rk⋅2k zc
  • 62. Provisions: Proof of Liabilities Customer verification of balance commitment (R, v, Balance) CID = H(username||n) zc = gBalance ⋅ hR zp = b−1 ∏ k=0 z(2k ) k zc = zp = zp Verification Known = R, v, balance, zk, …, zb−1 gBalance hR = b−1 ∏ k=0 z(2k ) k = ∏ (gxk ⋅ hrk)(2k ) = ∏ gxk⋅2k ⋅ hrk⋅2k = g∑ b−1 k=0 xk⋅2k ⋅ h∑ b−1 k=0 rk⋅2k = gBalance hR zc
  • 63. ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = 0 Provisions: Proof of Solvency ZK commitment to total assets
  • 64. Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi)Zassets
  • 65. Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi) = ∏ bsi i ⋅ hvi = ∏ gbal(yi)⋅si ⋅ hvi Zassets
  • 66. Provisions: Proof of Solvency = n ∏ i=1 pi ZK commitment to total assets Assets = n ∑ i=1 si ⋅ bal(yi) = gAssets h∑ n i=1 vi = ∏ bsi i ⋅ hvi = ∏ gbal(yi)⋅si ⋅ hvi Zassets
  • 67. Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi Liabilities = c ∑ i=1 BalanceiZliabilities
  • 68. Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 BalanceiZliabilities
  • 69. Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 Balancei = g∑ c i=1 Balanceih∑ c i=1 Ri Zliabilities
  • 70. Provisions: Proof of Solvency ZK commitment to total liabilities = c ∏ i=1 zi = c ∏ i=1 gBalanceihRi Liabilities = c ∑ i=1 Balancei = g∑ c i=1 Balanceih∑ c i=1 Ri = gLiabilities h∑ c i=1 Ri Zliabilities
  • 71. ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities Provisions: Proof of Solvency ZK commitment to assets - liabilities
  • 72. ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = gAssets ⋅ h∑ c i=1 vi ⋅ (gLiabilities h∑ c i=1 Ri)−1 Provisions: Proof of Solvency ZK commitment to assets - liabilities
  • 73. ZAssets ⋅ ZLiabilitities −1 = ZAssets−Liabilities = gAssets−Liabilities ⋅ h∑ c i=1 vi−∑ c i=1 Ri Provisions: Proof of Solvency ZK commitment to assets - liabilities = g0 ⋅ h∑ c i=1 vi−∑ c i=1 Ri = gAssets ⋅ h∑ c i=1 vi ⋅ (gLiabilities h∑ c i=1 Ri)−1
  • 74. = g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities
  • 75. = g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge
  • 76. = g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier checks proof of knowledge … Schnorr Proof Verification
  • 77. = g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities ZvSolvency = c ∏ i=1 zi − n ∏ i=1 pi = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier computes solvency Verifier checks proof of knowledge … Schnorr Proof Verification
  • 78. = g0 ⋅ hsumv−sumr Provisions: Proof of Solvency ZK commitment to assets - liabilities ZvSolvency = c ∏ i=1 zi − n ∏ i=1 pi = hsumv−sumr = hexcessZSolvencyProver creates proof of knowledge Verifier computes solvency Verifier verifies prover computation ZSolvency = ZvSolvency Verifier checks proof of knowledge … Schnorr Proof Verification
  • 79. Provisions: Summary • Scales linearly with respect to the proof size, construction and verification time. Protocol is easily parallelizable. • Does not reveal any information about addresses, total assets or customer balances. • If the public key has not been published on chain by including it in the anonymity set you would reveal it. • Generation & verification requires balance at a block hash oracle • No proposed standard that would be interoperable across companies
  • 80. Open Questions • Committing to an address instead of public key • Proving cold storage assets • Optimizing proof size, generation and verification
  • 82. Thanks! Jake Craige // @jakecraige We’re hiring! coinbase.com/careers • Maxwell Proof of Liabilities • https://web.archive.org/web/20171124195504/https://iwilcox.me.uk/2014/proving-bitcoin-reserves • Proof of Reserves • https://blockstream.com/2019/02/04/en-standardizing-bitcoin-proof-of-reserves/ • Provisions • https://eprint.iacr.org/2015/1008 • Demo Site: https://provisions.glitch.me • Rust Implementation: https://github.com/jakecraige/provisions • MProve • https://eprint.iacr.org/2018/1210