Unlock Web2 Data with TLSNotary: Hands-On Workshop | Devcon SEA

Pro privac expor intruction Ser that you think you're supposed to be connected to how about now there we go so transport layer security TLS is a old protocol it's ubiquitous it's all over the Internet basically everything supports it if you're not using it you probably should be um and the important thing is is that yeah all all websites already support it and uh so yeah basically it's a a protocol between your computer and a website that you're connecting to it's using cryptography so you can query uh data from a website and uh know that you're talking to the website you expect and your Communications are protected but one thing that it can't do for you is you can't query data from a website and then present it to another party there's reasons for this that I won't really go into but you can just know safely that it's not possible to just take a TLS transcript and send it to someone else uh they won't know whether or not the data is actually authentic um but you know TLS there are signatures there there's cryptography there and maybe we can plug into it and somehow leverage it for what we want to do which is to allow people to privately proed data to a third party I'm not sure if you've come across this jargon before there's multiple different terms multiple different approaches for generally the same thing npct TLS CK TLS web proofs TLS middle boxes Windows proxy they're all essentially trying to do the same thing uh we even implemented MPC TLS uh and this it leverages multiparty computation and zero knowledge proofs in order to allow approver to privately uh disclose data to a verifier in aitous Secure way and then there's other approaches like a proxy approach which kind of switches up the the topology here which puts the verifier in between the prover and the website but um oh right what one thing to note here is that both these approaches both the MPC TLS approach and the ZK TLS proxy mode whatever you want to call it these are both designated verifier protocols which means that uh it's really between two parties and the only party who really receives cryptographic assurances is the verifier that's actually running the protocol itself sorry for everyone that wants to do things on chain this does not give you trustless oracles but it does give you a trustless offchain designated verifier protocol and uh yeah all approaches kind of all go towards the same affordances which is that it allows you to basically compose with any application if there is data on the internet which is queriable using TLS you can trustless compose with it and without asking for permission so all servers are already running TLS so you can basically take our protocol wire it into your application and now Pro uh users can just prove arbitrary data to you in a privacy Preserve Manner and just to uh yeah elaborate on the Privacy part there user can query data from from some arbitrary data source and present it to your application while redacting their secrets such as their uh cookies and their htb request they can redact data in the response and uh we're probably not going to get into it today but you can also do zero knowledge proofs over the top of that data such as hiding your address but proving you know you're not in the United States and then the classic example of proving that you're above some age without revealing your exact birth date and yeah so those are the general affordances that uh these protocols provide uh TLS notary is free open source uh the core protocol is written in Rust we have typescript windings um we're going to demo a browser extension SL plugin system which is just one way of Distributing uh the TLs notary protocol and uh yeah it's Apache MIT dual license that your option do what whatever you want with B yeah so that's an introduction to generally what tus notary is and what it does and yeah let's just hop straight into into building something so uh good afternoon I'm hendrik also from the TS notary team and uh this is our schedule for the workshop today um we are plenty of members the TS notary team so if you have questions there's stanner Ryan uh who else do I see uh Thomas in the back Chris and then sukino and senu so just if you run into any questions uh just ask so we'll we just had this uh great introduction to TA notary we'll start with uh coding part one so that will be mainly on your own machine uh everything offline so that we don't run into any uh network problems and then we'll do some uh experiments with TS notary where you work together with your neighbor so uh just distribute the roles um and then we'll ALS we uh switch to the browser extension where we do will do a demo first and then tokino will give an overview of how the all browser setup works then we'll switch to coding part two where we'll uh build our own plugins and then we'll do a short uh an extra slide with uh some uh uh where we go into the future of TS notary and discuss what comes up next and then there's uh some playtime where we invite you to build your own plugins or uh build on top of tus notary and we're here to help you and then we also are very open to hear uh all your questions so um some tips and tricks for the workshop so don't rush through all the items uh we have time um there is a um a hackmd document it allows for adding comments so if you run into any uh in the things that don't make sense or you see typos or whatever just comment so that we can improve it for next time uh also check the Wi-Fi so there is a local Wi-Fi network here uh that allows us to connect to each other so make sure you're on the uh yeah I can't read the name but I think it's a classroom network uh the network uh the password is also over there uh also for the web devs that uh will do a little bit of rust but it's only reading rust code so don't be intimidated uh that you should be fine and also as I said the TS notary team is here so if you have questions uh just ask them so um if you go to this URL you will find the uh classroom notes and yeah if you have uh any issues just uh call us and then we will help so maybe a quick overview of what we will do there so we will start with the most basic setup of TS notary where we just have a server approver and a verifier where everything is on the same uh networks on your local computer so we'll start with uh starting all the um the necessary services and then the approver will do the request to the web server with the corporation of the verifier this will return in an attestation we will do then do create a presentation where we redact some information and then the verifier will verify the info and then the second part we will work with a neutral uh notary so where the roles of the verifying parts are uh split up so this is all in Rust and then in the third part of the example we will run the approver in the browser um and then in the notes you will see that then we will also distribute the roles so you could run the approver and your neighbor could be the test server and another neighbor could be the the verifier um should be fun any questions so far so the question was which repository for the first item so that's the tlsn Repository uh sorry so if you didn't bring your laptop this will be a very boring Workshop I'm afraid um so maybe then just chat with uh some of us uh and ask us your questions e for [Music] I [Music] ch [Music] y [Music] I haven't talk about any any stuff stuff [Music] okay if you have an error message running the last command command don't stress that's for further in the workshop so the prerequisites is mainly uh to have all the dependencies on your uh laptop um so that you can go through the the following steps [Music] dep e [Music] a you [Music] [Music] if you run into a rust C error check your car uh your rust compiler version and then just to rust up update to uh get the latest rust compiler [Music] that's let [Music] J [Music] we you [Music] e e [Music] for let [Music] oh [Music] back e e so they couldn't install the [Music] pvk for e for [Music] that's [Music] know [Music] has that [Music] right for for [Music] 2 [Music] is e [Music] so for [Music] for for [Music] to for [Music] for for e [Music] e for I for is for [Music] for [Music] so how are we doing is did everybody get through the solo tasks are there already teams doing uh notorized solo two hands is steams okay I'll give you more time real quick if you run into anyone with the so we had a few people three so far only that have had issues with X and GS yeah and we couldn't figure out what it was what so X GS is not installed we're being Reed it can't run the install scrip okay so they're having to build it from scratch or just topn on okay well we'll do that to expl yeah but yeah me Tak just spent like the last 20 minutes try figure out why okay yeah CU yeah it's like why is it every bur fine but then like three people I thought it was something missing in our scripts no something in and something there's a like the first line of the install script is a API call okay e e [Music] okay I un e [Music] time [Music] can I have your attention for a second so if you we made a mistake in the notes so if you get to testing the browser extension and uh you do get an error me message in the notary uh because so far for the rest examples we were on the dev Branch but the browser extension is still on the stable version so before you run um the browser extension switch to the alpha 7 branch in the tlsn repository and then restart the notary but um in alpha 8 we added this feature where you can disable TLS from the comment line uh in uh in eight so in the def version that is possible but on seven not so you need to edit a config file uh so go to notary server config config.yml and so set this line uh to false before you start uh the notary okay spe you [Music] e e oh [Music] uh yeah Lo e any that e uh we're getting a little bit behind schedule so I'll give you five more minutes and then we will switch to demo mode and then I will show um the uh connect API and then we'll do uh the toos part e [Music] see for [Music] f for you not [Music] I have a I have a half an hour has his slid so uh to save some time I will uh show you what the web app demo looks like and then afterwards toino will show you how it actually works in the internals so we have built this demo app for TS notary where um we built this app where we ask user to prove that he has a Twitter profile then our back end checks that attestation and then in the end we uh reward the visitor uh with a PO app so if you didn't go through it yet uh you can do it later and earn your PO app so it's we this app first invites you to install the the um extension but I already have it on my computer uh next step is to install a plugin to the extension to connect to the actual uh Twitter demo uh of course we don't want to just install random plugins so we always ask the user do you agree with uh installing this into the TS notary extension and so this also gives an indication of what the plug-in will do so it shows you that it will uh run requests to the proxy um access api. x.com and then it will uh do requests to this URL so there's nothing uh strange going on behind the scenes uh and then of course it also needs to acquire some more information um now the plug-in is installed when you do run plugin uh again you need permission to do it uh and when you click it you go through the steps but I think most of you already went through the steps um so uh if we switch back to this demo app then now the app is also listed to whether the attestation is uh ready so yeah so once the attestation is available the uh back end will then verify the proof and uh then as a reward you can uh claim the poep but tukino do you uh explain what was actually going on here hi good afternoon um so you already saw a demo of the browser extension and plugins um to kind of give a brief overview of the extension um what it is is it basically cash all the headers and all the cookies from your browsing history and then on request it will you it will provide that to the plugin and um create this notarization um so you guys saw the demo and um we created a connect API um for the browser extensions um you can check out the documentations but on a very high level um it is the equivalent of the window. etherum object but for TRS notary so similar to how metas and other extension um water extension inject a provider to window um we also in insert a um provider to window.

tosn and from there you can use that to interact with the extensions um and do stuff so it's pretty simple to use it um I'm going to walk through a a few um like use case um when your app first load you can listen to your event called TSN load it and then once it's ready um window. tosn will be ready and you can grab that you can then call the connect um function um it will pop up a um permission window approval window asking um for permission to connect to this website and once connected basically they'll be able to um request for notarizations and ask for notarization history and stuff like that um after that um this is if you like let's say if you want to create a um attestation for some website in this case I'm using swappy dode as a example um you can do it with the client object that you just created um by connecting to the extensions um s very similar to how you make a fetch request with um with some extra metadata um you can you know create any attestation for for this API and once you create the attestation you can also use get history to get like the attestation that you just created um so all this method is designed to help app developer to easily interact with the extension to create proof um RI proof and you know be able to do stuff that you need to do um in your app so um we also develop a plug-in system um that allow you to um create a plugin to prove whatever rep data you want um when you prove a rep um data from a rep API usually the flow goes like um give me cookies of this website and give me headers of this website I will then use that information to um piece together the request parameter and then I will submit this reest parameter to the notary or to the interactive verifier and then stock the notarization process um so all these steps are um uh you're able to do all these steps in the plug-in systems um with the API that we provided um I'm going to go through really quickly how the what the API looks like um you can also go to the um documentation site down below we have a um boiler plate repository that you can um check out to see how plugins are written a lot of you are already um have already checked it out the plugin um center around this like config do Json object um the main idea is we don't want to just inject all cook keys to any Plugin or headers to any plugin so you have to ask specifically for permissions um in this case the plugin is requesting for all cookies from api. x.com all headers from api. x.

com um we also enforc um what host function you're asking for you need permission for right now we only have two host function one to redirect the current browsing Tab and the other to send a notary request um at some point we'll probably have more um and then the fourth permission here is the type of request that a plugin can make um basically we don't want the plug-in to be able to send any request to any host like they could just send your cook key to some host um that's why we put this enforcement here you the plugin will only be able to send a get request to API . x.com blah blah blah and after that you describe from in the config what your plug-in does title description does a metad data the steps um array here describe how many steps this plug-in will have and what each step does uh the action there correspond to a function name that you create in the um in the plug-in code so for for example the first step is course start and here is a very simple stock method basically it checks to see if you're on x.com if not redirect to x.com and then the second step is basically getting cookies from x.

com getting all the headers making sure you have the required cookies and headers and then piece together the parameters that you um that you need to make the notary request and the the final step here is sending it to the notary to make an authorization request um there is a another method that is ref uh referenced here called get secret response um basically what that does is if you don't want to reveal um everything to the notary you can call this you can create this method to selectively disclose what you want to disclose to a notary in this case um I am only disclosing my Twitter screen name to the notary and nothing else no cookies no headers um this will pause the response and make sure that it's only revealing what I want and once it happen this is um what the plug-in step a um UI look like in the future we'll add more API to allow more customization on the UI level but for now um if you describe what the what your steps look like it will be render um in this manner go through step by step and then at the end create theorization um I think OHS oh yeah and if you are trying to compile or build a plugin um you might want you might have already went into this issue where xterm.js is not found um we forgot to put um put that in the documentation but basically xstm is what we use to build the plugin system and in order to install xterm.js you basically have you you just go to um X system sljs js- pdk not SDK pdk and then one the install script there um after that you have fmjs and be able to build Scripts cool anyone have questions three so compiling the plugins shouldn't take long and then we switch to the part with what's coming up next for TS snow tree [Music] okay if we're going to kind of speed through the plug-in part here uh yeah let's just talk about what's next for TS notary um so alpha 8 coming soon I'm surprised that not more people asked me when Quicks and when a decode um they're coming so quick silver certainly an alpha 8 off decode that depends uh Quicksilver have higher priority it's essentially performance Improvement so some of you might notice that it takes you know multiple seconds for this to run and to end uh Quicksilver is going to be a pretty massive performance Improvement and reduction of communication between the approver and verifier uh there's still lots of work to do and this is one of them uh and yeah we we'll be posting some benchmarks with that with that release they should be pretty nice uh yeah going into next year uh there's a couple nice to Habs just TS 1.3 support uh TS notary right now only supports 1.2 uh for most people that doesn't mean anything uh but TLS 1.

3 is kind of like the most recent version of TLS and 1.2 in the future may get deprecated so we want to be ahead of that but yeah the theme for 2025 is going to be toward stabilization we kind of want to finish if that's possible the the the core Library the core implementation um work to get the underlying uh MPC Library uh audited and then start working up into the TS notary stack and get different uh parts of the codebase audited um we're going to be working on security proofs for the different different uh for the various different cryptographic instructions in protocol uh proofs already actually kind of exist paddle Labs with their garbled than proof paper actually covered a lot of uh what we're doing but we kind of want to replicate those results ourselves and and and present them uh so yeah 2025 is going to be uh well of course after shipping the performance improvements of quicksilver it's going to just be like let's try to stop changing things as much and just kind of focus on getting it towards stabilization so we can remove the for uh research purposes only disclaimer on the repository which is on like 99% of crypto projects um yeah so any just Q&A on uh future PLS notary other than when Quicksilver and when off you raise your hand your by server you referring to notary so the question is is our notary fully trustless um so it depends on what exactly you're talking about there so a notary is going to be issuing an add a station to some to the data right so the appr is connecting to the notary they're proving information to the notary the notary is putting a signature on it and saying I ran this protocol correctly now theover takes that at a station and presents it to another party there is a trust assumption there that that third party verifier is essentially trusting that the notary ran this protocol correctly and that they didn't just forge this atest station without doing anything so in that sense there's trust but is there trust between the prover and the notary itself no uh so there's nothing that the notary a malicious notary can do in order to like for example leak the user Secrets they don't really see anything they're just signing kind of like blind commitments to the data itself so from a privacy perspective no there's there's no trust assumption now a lot of offchain applications don't actually need a notary a notary is really only needed if you want to like maximum privacy this party doesn't know anything and it's just attesting to uh data that it doesn't see um you could actually just remove that step and the approver can just selectively disclose directly to a verifier that's willing to run the TS notary protocol and in that sense like the whole protocol end to end and the Integrity of the data is like quote unquote trustless um like I mentioned in in in the introduction the protocol is designated verifier so a lot of people want to build applications on chain and uh in that configuration you're kind of just stuck with this trusted third party uh at at a station so like in short it depends but in terms of uh security for the user uh we we worked hard to make sure that no there's no trust assumption there it's it's cryptographic assurances for the privacy of the data can you repeat the question perhap okay maybe I I'll try to rephrase this can you construct or how do you I guess minimize trust if using TS notary to construct an oracle protocol yeah that's a good question uh there's a few different folks that are looking into this uh one of the issues is that again the protocol is designated verifier so you can't have multiple parties attesting to the same connection so approver will need to prove to I guess each Oracle node in independently and then they'll all have to come to consensus on some fact that the prover is trying to prove uh as opposed to all essentially just providing a signature on a single transcript um there's a subtlety there and that every time that you query the server it's going to the transcript is going to be slightly different somehow there'll be some sort of entropy in it um so the question of how to like constructed trust minimized uh Oracle protocol is uh difficult uh the the ideal solution is to make TLS notary support multiple notaries in the NPC TLS protocol the issue with that is that uh there don't there aren't really any MPC protocols that exist in which that would be practical the compute and the and the bandwidth costs of the protocol just like blow up if you try to add additional parties so we're kind of stuck with this two-party setting um so yeah trust minimization is really just going to come down to can you construct a clever consensus protocol with multiple notaries and and you're really just getting into like Oracle design and things like that uh we're kind of punting that problem to people uh that are focused on Oracle protocols whereas tless notary is kind of just a A Primitive that you can use to construct it um but yeah it's an active area of research for many people is how to take these ZK TLS um libraries and and do that and and It's Tricky more questions so feel free to finish the uh Workshop uh later at your own pace if you run into any problems uh just uh ask your questions on our Discord uh there's only friendy people there willing to help and how do we switch it just scan you as a register as a question you can see the question okay we're figuring out how to get to the questions in the Defcon tool how's it compared with other TLS protocols like Deco reclaim Etc uh in subtle ways they're all essentially trying to achieve the same thing which is how do you get how do you modify TLS in order to get um a protocol that proves Integrity of data from some uh some source so Deco I believe the original paper actually describe both the MPC approach and the proxy approach uh I'm not sure where they're at with implementation I think that they have a perfect concept or or at least like a sandboxed uh early release that they just put out but I need to kind of follow up and see what they're doing uh in terms of implementation yeah I I believe that uh Deco is doing the MPC TLS approach as well but that might be outdated information uh reclaim is also um essentially doing the same thing you TLs but they're taking like this proxy mode approach um there there are privacy and security kind of trade-offs to consider there it would probably take me a full presentation a full 30 maybe 45 minutes to go into all those differences but in terms of affordances uh they're all essentially trying to do the same thing with various different performance and privacy tradeoffs that's kind of a Dodge of a of an answer but that's the best I can do right now all right I think we can wrap it up thanks for coming everyone [Applause]