Decentralized HTTPS Gateway

Developers CIPs
1

Hello everyone,

In my quest to fully understand Cardano I’ve come up with some issues, as well as a possible fix. Please forgive me if these issues were addressed at the conference last month, or elsewhere in the forum (I couldn’t find exactly what I’m proposing here). Please also forgive my potentially faulty understanding of the Cardano ecosystem, as well as my abuse of the ‘O()’ notation :p.

Perceived problem(s)

  1. I assume Daedalus uses one of the IOHK nodes for tx-submission/chain-sync. This isn’t really decentralized.
  2. Similarly I assume Yoroi uses a not-so-decentral Emurgo server.
  3. I assume Daedalus uses the unencrypted Cardano node-to-node TCP-based communication protocols. Without a VPN, ISPs/governments could easily trace these txs back to individual users.
  4. The node-to-node TCP protocols seem unsuitable for large-scale use by client-like nodes (i.e. ‘leechers’ in p2p terminology). The network guidelines state that each full node should maintain O(10) hot connections. With around O(1000) publicly discoverable full nodes, only O(10000) simultaneous node-to-node connections are possible. These connections seem to be designed to be long-lived (>1s). Cardano goals are clearly far greater than O(10000) global client requests per second, and it would be nice to serve those in a decentralized fashion.
  5. Cardano on-chain ‘smart contracts’ (i.e. validator scripts) aren’t really smart. They require significant amounts of off-chain programming to be able to do anything useful. Sometimes the relationship between the off-chain code and the wallet is quite intricate (see example at the bottom of this post).
  6. Cardano DApp off-chain code seems to require running a full node. Average Cardano DApp users won’t want to install that themselves, so they will use DApps hosted by some third-party. This isn’t really decentralized and makes the ‘D’ in ‘DApp’ a misnomer.

Solution

Each stake pool could opt to host a REST API ‘gateway’ over HTTPS. The address and port of the gateway could be included in the stake pool registration metadata.

The gateway would be similar to cardano-http-bridge (is this still maintained?).
In addition to cardano-http-bridge endpoints, the following endpoints are nice-to-have:

  • An endpoint to list only block ids that are relevant to specific addresses
  • An endpoint to list block ids containing stake pool registration info

The gateway would be trustless, and, combined with Mithril, wallets using these two extra endpoints would be fast, validating only the blocks relevant to the wallet user.

To avoid resource consumption attacks, the gateway could restrict access to users who prove they have some minimum stake with the given stake pool. Upon authentication, this proof could be included as a token in the header of each HTTP request. Tokens could be shared with friends to provide a bootstrapping mechanism. The gateway access control would need to perform throttling for every authenticated user.

Stake pool operators could use the HTTPS gateway service to attract new stake holders. Stake holders valuing increased decentralization would prefer delegating to stake pools that provide this service.

How this solves problems 1 and 2

I assume both Daedalus/Yoroi will implement HD multi-pool staking at some point. After initial bootstrapping, these wallets will thus have a range of gateway servers to choose from for tx-submission/chain-sync.

How this solves problem 3

HTTPS is encrypted by definition. The tx-submission request could even be given an additional layer of privacy by specifying a submission delay and a node hop count. This would make it nearly impossible for ISPs/governments to infer the indentity of a user based on the tx time, without the need for a VPN.

How this solves problem 4

Most client requests will be polling for chain updates. With a good caching architecture each gateway should easily be able to handle >1000 of these requests per second.

How this solves problems 5 and 6

Interfacing with a REST API is extremely simple, and everything can be done with in-browser javascript. This would be a huge improvement of the Cardano developer experience, and a large number of developers would easily be able to create serverless single-page wallets, integrated with some core DApps.

I think wallet development would become a much more interesting and competitive space, and much easier to audit (assuming use of a standard cryptography library). Currently I need to rely on the developers of a small number of hard-to-audit wallets (Yoroi, Daedelus, …) to integrate the DApps in the convenient way I want.

The wallets could be hosted via IPFS, making the wallet software itself decentralized and uncensorable. The gateway could even enforce this kind of decentralization by disallowing request origins that are not ipfs:// addresses. Of course I assume here that mainstream browsers will implement the IPFS protocol in the (near) future.

A number of core DApps could be integrated in these decentralized wallets (eg. the ‘last will and testament’ smart contract example below). I predict these wallets would end up looking like modern bank websites, easing mainstream adoption due to the similarity. They could also be installed on mobile devices as PWAs, making them uncensorable by app stores.

Example of intricate relationship between off-chain code and wallet: last will and testament

Let’s say I want to implement a ‘last will and testament’ smart contract.
It would allow my heirs to transfer my assets after a certain time of inactivity (eg. 2 years).
It also provides a fallback in case I lose my wallet key.

In Cardano the on-chain validation scripts can’t detect wallet inactivity though. So instead, when ‘installing’ the ‘smart contract’, I would send the assets to an address of a time-lock script. This time-lock script would release the funds to my heirs after 2 years.

If the off-chain code detects activity before the 2 years are over, it would send the assets into a new time-lock script, effectively extending the deadline. (Alternatively the assets could be resent to the same script address using a different Datum).

To prevent excessive tx fees, the off-chain code would only do this update every 12 months.

I can think of two reasons why this contract should be managed by the wallet itself.

1. Simple spending of assets locked in the contract

I want to be able to spend the inheritable assets at any time. This means that these assets would preferably still need to be managed by my wallet.

It would be inconvenient and wasteful to do this via a third-party DApp. The assets would need to be sent back to an address controlled by the wallet before being spent. As a consequence a wallet that is 100% covered by a third-party ‘last will and testament’ would effectively double my tx fees. Alternatively the DApp would have to provide wallet-like functionality and be able to generate the spending txs I want.

(I doubt any DApp-connector will ever be smart enough to detect that assets are locked in a contract that also allows the owner to simply spend them, and thus spend them using a single tx.)

2. Detecting activity and automatically extending the time-lock

Detecting activity and automatically extending the time-lock is trivial when the ‘last-will and testament’ is managed by a wallet.

But a third-party DApp would require me remembering to log into their service. Or alternatively the DApp would need to poll the blockchain for txs emanating from my staking addresses, and then send me a reminder. Next I would have to submit the time-lock extension manually.

If I live for another 30+ years, will the DApp server still be running then? Will I remember to keep doing this manual operation every year? Will email even still exist? (though messaging could be done via Cardano I guess)

4 Likes
2

This could lead to some interesting discussion. Adding a few notes below to get started.

Relay nodes can be deployed for passive participation in the network to increase decentralization without needing to run a stake pool. There of course is no financial incentive for doing this but over time discovery should be improved in the network and wallet applications to allow greater decentralization.

While SPO require a block producing node and multiple relays some applications may opt to deploy their own relay nodes. I have considered doing this for my project even though it will be decentralized in name only as the burden of requiring users to run a local node or making a decentralized gateway is not worth it for a small self funded project like mine.

Currently Daedalus includes a full relay node so it uses that locally running node to submit and verify transactions. It’s topology can be configured easily but by default it uses IOHK relays for synching the local node.

I believe Yoroi is using centralized Emurgo servers to interact with blockchain relays. Someone can correct me if that is no longer the case. Technically lite wallets could implement a topology discovery algorithm that uses decentralized relay nodes only. For many lite wallets the architecture trade off favors ease of use over decentralization.

Please note while HTTPS traffic is encrypted (TLS/SSL) it does not alleviate the need for a VPN if privacy and security are concerns due to the way routing works. Without a VPN (preferably on your router) your ISP, government, and others will track you even when making HTTPS web requests. If you wear stylish tinfoil hats a VPN proxy into TOR from a live OS image would be the only way to conduct online transactions.

For regular folks the convenience of centralized services and living in a country that isn’t anti-crypto is sufficient. For example I am not using a VPN right now and could easily be tracked as participating on Cardano forums from Arizona despite HTTPS. HTTPS only encrypts the contents of the payload for this reply which ironically will then be publicly displayed anyway.

1 Like
3

Relay nodes can be deployed for passive participation in the network to increase decentralization without needing to run a stake pool. There of course is no financial incentive for doing this but over time discovery should be improved in the network and wallet applications to allow greater decentralization.

I believe the vast majority of future wallet application instances will be mobile based. I’m unsure if the IPv6 promise of ‘restoring end-to-end connectivity’ will be upheld for mobile users though. So they might not be able to contribute positively to the Cardano network. Some kind of client-server architecture might function better for them.

Currently Daedalus includes a full relay node so it uses that locally running node to submit and verify transactions. It’s topology can be configured easily but by default it uses IOHK relays for synching the local node.

So Daedalus could easily be upgraded to auto-configure a random topology by searching the ledger for stake pools and relays?

Please note while HTTPS traffic is encrypted (TLS/SSL) it does not alleviate the need for a VPN if privacy and security are concerns due to the way routing works. Without a VPN (preferably on your router) your ISP, government, and others will track you even when making HTTPS web requests. If you wear stylish tinfoil hats a VPN proxy into TOR from a live OS image would be the only way to conduct online transactions.

I’m not so worried about ISPs/governments finding out I’m using the Cardano network. I am though worried about them finding out the specifics of my financial transactions, and I think it would be more convenient to shield them using HTTPS than using a VPN.

For regular folks the convenience of centralized services and living in a country that isn’t anti-crypto is sufficient. For example I am not using a VPN right now and could easily be tracked as participating on Cardano forums from Arizona despite HTTPS. HTTPS only encrypts the contents of the payload for this reply which ironically will then be publicly displayed anyway.

I think it helps to provide some context for my seemingly paranoid stance wrt. decentralization and privacy. Warning: the following part is a bit political :stuck_out_tongue:

Absurdistan

Note that when talking about taxes here, I’m actually referring to transaction taxes. So not property taxes, trade tariffs, taxes on externalities, motor vehicle taxes, and other taxes that in general reflect fairly the cost of a public good (and coincidentally are difficult to evade with or without crypto).

I recently emigrated from a country in Europe and moved to Latin America. I’m what they call a ‘fiscal-refugee’. I will refer to my previous home as ‘Absurdistan’. The fiscal measures taken in Absurdistan were becoming more and more extreme every election cycle and it felt too risky to stay there:

  • People employed in the private sector, with above average wages, receive less than 40% of their pre-tax wage (+ don’t forget the high VAT when they actually want to spend their income)
  • The communist party now has >10% of the vote and some of its members are proposing crazy things like a 100% inheritance tax
  • Any ‘right-wing’ party in Absurdistan is still pretty left by international comparison
  • People who even dare discuss abolishing social security are deemed heretics
  • The recent Euro CBDC proposal reads like George Orwell’s 1984. Every transaction would be tracked and potentially taxed or even blocked. I’m actually not surprised when I see the list of proposal authors: I know their kind quite well. They earn very respectable incomes with their government jobs, and have nothing to lose in high tax situations. They are infatuated by a socialist mindset. I’m sure they are using ‘organised crime’ as a sophism to combat tax evasion
  • Tax evasion is illegal, but now even tax avoiders are being portrayed as criminals
  • Banking privacy has been completely irradicated. Banks have essentially become government institutions, threatening to block your account if you don’t comply with all the labor/tax rules
  • A little more than 50% of the democratic vote in Absurdistan is in the hands of people who live off of some sort of government income. These people have no incentive to vote to decrease government spending. The result is that Absurdistan’s tax burden will always converge to the Laffer curve optimum (i.e. they will milk whatever they can milk). Please look up ‘Laffer curve’ on wikipedia if you don’t yet know what that is.

Now imagine a situation in which Absurdistan’s citizens start using a kind of anonymous ‘e-cash’. They suddenly have something that is as private as traditional cash, and as convenient as bank accounts (or more). They might’ve voted for more government expenditure, but none of the ordinary citizens actually wants to pay the necessary taxes, and this ‘e-cash’ finally gives them that freedom.

The citizens that have remote desk jobs and a slightly nomadic mindset could even do all this legally (and since the pandemic started there are a lot more of them). They can simply renounce their citizenship and hop to another country every 3 month interval using tourist visas. Right now that’s not really a solution because banks require you to have a domicile/tax-id-number. But large-scale adoption of an ‘e-cash’ is exactly the missing link that would give digital nomads the freedom to do all this legally. The enterprises employing them would just have to relocate to a jurisdiction like the UAE.

Now lets go back to the Laffer curve. What do you think is going to happen to the optimum in this situation? It could drop by quite a bit right? Maybe more than 10% in a short span of time? I’d say that’s pretty painful for Absurdistan’s government budget, already stretched by pandemic subsidies, 2008 bank bailouts and an aging population ready to receive their government pensions. Knowing the political class quite well I’d bet the government will react strongly. And because most of this applies to most countries in the EU, the EU might react strongly.

So for me this is the worst case scenario that this future ‘e-cash’ needs to be resistant against: a full-on, hard-core EU, doing everything in its power to block ‘e-cash’ use by its citizens and enterprises. The USA, even though a little more ‘freedom-loving’, could be just as bad. Now imagine all OECD countries united against ‘e-cash’ and crypto…

Cardano (almost) hits the sweet spot

Before discovering Cardano I didn’t think any crypto network could become the fabled protocol for exchanging ‘e-cash’. Bitcoin and Ethereum always felt very hackish and unsuitable for mainstream use. But Cardano hits the sweet spot for me. I love the way UTXOs have been combined with DPoS, and I love the prominent ‘decentral’ narrative of Cardano. These are also precisely the defenses we need to protect the future crypto economy from worst case scenarios like the one described above.

VPN and a local gateway are a hassle

Now I know I have the ability to install/create the tools to use Cardano in the private/decentral/DApp-integrated way I would like (VPN + local-http-gateway + browser-based-wallet-interface), and that a CIP like this isn’t strictly necessary for my personal use-case. But I think an HTTP gateway hosted by each SPO could really accelerate Cardano adoption, while improving privacy/decentralization, without burdening common users with the hassle of a VPN or a local gateway.

4

I completely understand.

The inflation, tax, cost of living, and absurdity is at an all time high over here as well. I am not going to get into it because this is not the forum for that but suffice to say many of your observations apply elsewhere as well.

Also note most blockchains use a public ledger, including Cardano, so all transactions are actually inherently very traceable. Government obviously didn’t get the memo on that feature yet because fully embracing a deflationary cryptocurrency could actually kill two birds with one stone. End of life on cash transactions would simultaneously cripple illicit and criminal markets while combating the inflation of the last 50 years!

5

Also note most blockchains use a public ledger, including Cardano, so all transactions are actually inherently very traceable.

That’s a good point, how private can Cardano really be if all transactions are public? I think the analogy between traditional cash and UTXOs can help to understand this.

When I withdraw cash from an ATM, the banks/governments technically know the serial numbers of the bills I withdrew. Then those bills are sent on a long journey through our economies. At some point the future holders of those bills prefer private bank money instead, or they think the bills are too ugly to be used further and exchange them for fresh bills. Here the journey ends.

For each bill the banks/governments technically know who was the first and last person to hold it. But they have no idea what happened in between.

UTXOs are kind of similar. For example most people get their ADA on an exchange like Binance and then send them onto their private wallets. This is analogous to an ATM withdrawal of traditional cash. Governments are technically fully aware of your ADA assets if you acquired them like this. They know you control the associated payment addresses (and you sadly won’t be able to evade capital gains tax when cashing out of crypto :grimacing:).

But if you received your ADA from another Cardano user, and after a while you send it on to yet another Cardano user etc., governments will never be able to find out you held that ADA. They can only determine the first and last holder of a certain UTXO. The chain of payment addresses is analogous to serial numbers of traditional cash.

The ledger of course holds more information than mere payment addresses. It also holds transaction times and stake addresses. But these wouldn’t necessarily be a privacy issue if people use HD multi-pool staking wallets, and they have the ability to specify transaction delays.

Please understand that the privacy analogy with traditional cash is only valid if anonymity on the UTXO’s journey is preserved. That’s why client tx-submission must be encrypted. And, for most users, it is more convenient to do that with HTTPS than with a VPN.

PS: I hope my original message doesn’t get diluted by our lengthy discussion of my privacy concerns with Daedalus tx-submission. Please feel free to change the subject a bit by touching on one of the other points :slightly_smiling_face:

6

Hi Christian

I really liked your post. Would be possible to have a chat over zoom/teams etc or Email?
Ringtingting@gmail.com

Regards neik