Sebastien Guillemot

CTO @midnightfdn.
Current focus: ZK (lattice,folding,Starstream), consume apps and chain abstraction. drep1kyppjlhz4lawh4g0ewx2d8a5l20t4yclfnppnuvdkmt7vccg836

[Sebastien Guillemot @SebastienGllmt]

@apruden08 Sent you a DM in case you get anything in a shareable state!

[Sebastien Guillemot @SebastienGllmt]

@ESCOweb3 @Ledger I don't think anything they said was wrong. I was just pointing out an optimization

[Sebastien Guillemot @SebastienGllmt]

@P3b7_ Yes, that's exactly what you want

The master private key (known only by the true wallet owner) is used to derive (in a ZK circuit) down to the affected address
This proves they know the parent hardened private key for a leaked address key

This skips the expensive BIP39 step

[Sebastien Guillemot @SebastienGllmt]

The recovery phrase is used to generate a "master key" (called m) with a one-way function (see BIP39 / CIP3 for more info)

Afterwards, BIP32/CIP1852 is used to derive child keys

Only the address key (the last one) leaked, so proving ownership of the master key is sufficient

[TxPipe @txpipe_tools]

Given the current week, it felt timely to do a refresher on the details of how Cardano wallet key generation works.

So we double-checked the different specs and summarized what we found in this thread.

From raw randomness to a shareable address 🧵

[Sebastien Guillemot @SebastienGllmt]

@AshiyaPool @IOHK_Charles @Quantumplation Unfortunately you can't use biometrics to solve this

In wallets, biometrics usually encrypt the master key, but you still have to prove (ex: ZKP) the master key is the correct key for the funds

In biometrics 2FA you'd be right, but that's not the case in non-custodial wallets

[Sebastien Guillemot @SebastienGllmt]

@adamKDean Fortunately, you don't need to derive another address index to sign. The account key is a valid key (just drop the chaincode), so you can sign with it directly

[Sebastien Guillemot @SebastienGllmt]

Thread: how can SecondFi users prove they owned the original wallet?

Here are two options I think are both likely viable:

[Sebastien Guillemot @SebastienGllmt]

@VEGAS_ADA_Pool Yes, recovery phrase → master key is one-way

You cannot reverse key → recovery phrase

That's what I mention below
https://t.co/TJ91jPHndt

[Sebastien Guillemot @SebastienGllmt]

Option 1 is the very conservative approach:

Key idea: deriving a secret key from a recovery phrase is a one-way operation

Therefore, even if your secret key is compromised, you can prove you're the owner of the wallet by creating a ZK proof that you know it's recovery phrase

[Sebastien Guillemot @SebastienGllmt]

@PhilippeVleLong Just by knowing the private key of an address,

- You don't know private keys higher up the hierarchy (cip1852)
- You don't know the recovery phrase (bip39)

[Sebastien Guillemot @SebastienGllmt]

@PhilippeVleLong No, the output would likely be the public address (you're proving you know a recovery phrase (input) for an address (output))

The fact that you've generated a proof shows that you know the private key (no need to output it)

[Sebastien Guillemot @SebastienGllmt]

@PhilippeVleLong This is what privacy-preserving ZK proofs give you

You can prove the result of a computation without making its inputs public

For example, in Midnight, input arguments to a smart contract are private by default

[Sebastien Guillemot @SebastienGllmt]

@ShawnHuolihan Yes, that's correct

Option #1 is just much more engineering work compared to option #2

[Sebastien Guillemot @SebastienGllmt]

@Bastian_SHARE I'm not in contact with the team, so I can't say anything definitely. Their codebase is not the same I worked on many years ago

Currently, it sounds like if you've signed a transaction using their app this year, you may be affected

[Sebastien Guillemot @SebastienGllmt]

@maxalexweber Of course, they could put all the custodian's funds in a smart contract and do the recovery process onchain if they want to

but that's not the approach they're taking at the moment

[Sebastien Guillemot @SebastienGllmt]

@maxalexweber Recovery from the custodian is an offchain process, so you don't need to settle anything on Midnight's chain

You can leverage Midnight's cryptography if you want, but not need to settle it onchain as an offchain generated proof is sufficient

[Sebastien Guillemot @SebastienGllmt]

@Rizzabeast Fortunately, yes you can in this case!

Option #1 (prove you know the recovery phrase) is doable even if your master key is compromised

Option #2 should also work in SecondFi's case (where only the address key is compromised)

[Sebastien Guillemot @SebastienGllmt]

@Rizzabeast A KYC route would require massive coordination with exchanges, and would only help you for wallets directly funded from exchanges (not true for a lot of them)

Proving you own the wallet is the only generically viable route

[Sebastien Guillemot @SebastienGllmt]

So it's possible SecondFi only requires proof that you know the private key for the account's public key (very easy: just sign a message with it)

this means the recovery process may not be complicated cryptographically speaking (ofc, cryptography isn't the only hard part)

[Sebastien Guillemot @SebastienGllmt]

That means you can prove you own the wallet by sharing a key above it in the hierarchy

Address key leaked (like SecondFi)? You can just prove you know the account's key