Recently I have been diving into MPC, FHE, TEE and ZK and wanted to consolidate my learnings under one wider category of Privacy Enhancing technologies (PETs).

I got into web3 due to the appeal of the cypherpunk movement and financial decentralization but with the recent interest of AI and open communication being punished (i.e. Telegram), there is an increasing need for privacy and using PETs to make the world more equitable.

In this article, I cover what are PETs ,its history, evolution, different PET categories (MPC, FHE, TEE & ZK) and their significance to web3’s industry. Now let’s dive into the world of PETs 🐶

Note: Most likely have missed various protocols on the ecosystem map so feel free to comment new entries here.

WTF are PETs

PETs are a class of cryptographic techniques and approaches designed to protect sensitive data and maintain user privacy in digital environments. These technologies aim to minimize data exposure while still allowing for useful computations and interactions. At its core, it is about using/computing the data without compromising individual privacy.

History of PETs

Cryptography and PETs rose to popularity in the late 1980s and are not a novel concept. The foundations of modern cryptography and privacy-enhancing technologies were laid during this period, coinciding with the early days of computer networking and the Internet age.

The 1970s saw a paradigm shift from traditional symmetric key cryptography to public key cryptography, which became a cornerstone for many future PETs. This era was marked by groundbreaking research that addressed fundamental questions about secure communication in the digital age.

Notable publications that led the foundation this era include:

• New directions in cryptography by Diffie, W. and Hellman, M.E. (1976)

• A method for obtaining digital signatures and public-key cryptosystems by Rivest, R.L., Shamir, A., and Adleman, L (1977)

• Secure communications over insecure channels by Merkle, R.C (1978)

• Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms by David Chaum (1981)

• Garbled Circuits by Andrew Yao (1986)

These names are now very well-known in the cryptography space and regarded for introducing key developments to public key cryptography, digital signatures, secure key exchange and anonymous communication. These advancements were not just theoretical; they were driven by pressing practical concerns and lead to further questions:

• Data Protection: How do we store personal information safely

• Anonymous communications: How do we create communication systems without revealing identities.

• Electronic Payments: How do we create a digital payments system with privacy.

Yao's garbled circuits also deserve special attention as they introduced a novel approach to secure computation:

• Circuit Garbling: The function is converted into a boolean circuit and "garbled" by encrypting the truth tables

• Oblivious Transfer: Enables secure input sharing between parties

• Evaluation: The garbled circuit can be evaluated without revealing intermediate values

• Applications: Used in modern privacy-preserving machine learning, secure auctions, and private set intersection

As I was reading further into these publications and David Chaum’s work, this quote stood out to me.

New and more serious dangers derive from computerised pattern recognition techniques: even a small group using them and tapping into data gathered in everyday consumer transactions could secretly conduct mass surveillance, inferring individuals’ lifestyles, activities, and associations. The automation of payment and other consumer transactions is expanding these dangers to an unprecedented extent”

And fast forward 4 decades and our data has/continues to be sold to the bigger corporations for various motives. Our communication platforms are heavily monitored and company CEOs like Pavel Durov are being arrested due to Telegram’s lack of moderation and for creating a breeding ground for fraud and other criminal activity.

The electronic payments question seems to have advanced in the form of Bitcoin and the wider blockchain ecosystem which is a huge light to the darkness but we can do better as a collective. The wider PET ecosystem and web3 are exploring to see if we can further extend this and solve private data protection, storage and communication.

Evolution of PETs

So where is the industry at with the evolution of PET technology?

I would compare the stage of PET evolution to Charmander -→ Charizard:

• 1980s - 2000s Research and discovery

• 2000s - 2020s: Focused on optimizing protocols. First work on languages and compilers.

• Present: Production Ready PET usage.

So now let’s dive into the different types of PETs.

Multi-party computation (MPC)

MPC involves cryptography that distributes a computation across multiple parties where no individual party can see the other parties’ data. This allows for collaborative computation on sensitive data without revealing the raw inputs. The principles of MPC ensure privacy + computation. Privacy refers to no party knowing the other’s input and computation being the information is pieced correctly.

The most common example/problem used to explain MPC is the Millionaires Problem. Two millionaires, Alice (a) and Bob (b), are interested to know which of them is richer ( a > b) but don’t want to reveal their figures. [ADD MORE]

MPC protocols typically use different techniques (possibly in combination)  to achieve these goals:

1. Secret Sharing: Information is split into shares, where each share alone is meaningless, but when combined, reconstruct the original data. Common methods include:

   • Shamir's Secret Sharing: Uses polynomial interpolation to split secrets.

   • Additive Secret Sharing: Splits a secret into random shares that sum to the original value.

2. Garbled Circuits: A method where one party creates an encrypted version of a boolean circuit representing the computation, while the other party evaluates it without learning intermediate values.

3. Oblivious Transfer:  A protocol where a sender transfers one of potentially many pieces of information to a receiver, but remains oblivious as to which piece was transferred.

4. Threshold Cryptography: Cryptographic operations that require multiple parties to cooperate, preventing any single party from having full control.

With relation to the web3 / crypto ecosystem, MPC is a complement to how blockchains currently operate. Blockchain allows for transparency and in the easiest terms, an open ledger / growing spreadsheet of transactions but everything is out in the open. MPC augments this with privacy preserving features with the concept of “secretizing” layers of the blockchain.

Please note, I have intentionally sectioned MPC Wallet infrastructure as a subcategory of MPC Wallets. More information can be found here.

Fully Homomorphic Encryption (FHE)

Homomorphic encryption is a type of encryption that allows computations to be performed on encrypted data without decrypting it first. This allows sensitive data to be processed and analyzed while remaining encrypted, ensuring privacy and security. In the current landscape, data is often transmitted between various parties, such as users, services, and cloud servers. During this process, the data needs to be decrypted, which exposes the raw data and makes it vulnerable to potential unauthorized access, breaches, or misuse. It's during computation that data needs to be decrypted. Data can be transferred in encrypted form using https.

The historic of FHE is as follows as:

• 1970s: RSA Breakthrough: Researchers discovered RSA ciphertexts were malleable, allowing operations on encrypted data to create new valid ciphertexts without decryption

• Early Progress: Development of Partially Homomorphic Encryption (PHE) schemes like ElGamal and Paillier, enabling specific operations on encrypted data

• 2004: LWE Innovation: Oded Regev introduced Learning With Errors (LWE) problem, creating a secure foundation for encryption using controlled noise as a security feature

• 2008: Gentry's Breakthrough: Craig Gentry solved the noise management challenge during encrypted computations through bootstrapping - cleaning up noise while data stays encrypted

• Present Day: Advanced systems now combine leveled homomorphic encryption with bootstrapping for efficiency, following: encrypt -> (level operations -> bootstrapping) repeated as needed -> decrypt

This has now evolved to several several types of homomorphic encryption:

• Partially Homomorphic Encryption (PHE):  Limited set of homomorphic operations, such as addition or multiplication, but not both simultaneously.

• Somewhat Homomorphic Encryption (SHE): Supports both addition and multiplication but for a limited number of operations.

• Leveled Fully Homomorphic Encryption (LHE): Supports additions and multiplications for a larger number of operations that is configurable during the key generation process (more operations can be supported by making the ciphertexts longer).

• Fully Homomorphic Encryption (FHE):  Unlimited number of homomorphic operations (both addition and multiplication)

• Fully Homomorphic Encryption (FHE) + Levels: FHE + predetermined number of operations to be performed before the noise becomes too large (Levels) which results in unlimited FHE operations with better performance.

We can take the example of patient healthcare data that needs to be analyzed by a research institution. With FHE, the research institution can perform the analysis with the encrypted patient data whilst protecting the medical information in the process.

Key features of FHE include:

• Computation on Encrypted Data: Allows for statistical analysis, machine learning, and data aggregation while maintaining complete encryption of the underlying data.

• Privacy: Data remains encrypted during processing, protecting it from unauthorized access and maintaining the confidentiality of individuals or entities associated with the data.

• Semantic Security: A cryptographic property ensuring that no partial information about the plaintext can be reliably extracted from the ciphertext, even with access to auxiliary information. For example, if an attacker knows a ciphertext contains either "yes" or "no", they cannot determine which one it is with probability better than random guessing.

• Noise Management: Ability to control and reduce the accumulation of noise during homomorphic operations, ensuring that the ciphertext remains decryptable after multiple computations. This is crucial as each operation introduces mathematical "noise" that must be managed to maintain correctness.

In the context of web3, FHE provides enhanced privacy, security and computation on top of blockchains. Sensitive data can be securely stored and processed on-chain, enabling privacy-preserving smart contracts and dApps.

Trusted Execution Environments (TEEs)

TEEs offer a secure hardware environment/enclave where an application can store and use private information. They are an isolated execution environment of a computer that allows for generating digital signatures and performing sensitive computations. It is even isolated from the main OS to ensure this protection. The cryptographic keys and code are hosted in the TEE and it stays in the TEE which reduces the attack vector of exposure.

Key features of TEEs include:

• Secure Boot: Ensures that only authorized software can run in the TEE, verifying the integrity of the code before execution.

• Memory Encryption: All data stored in the TEE's memory is encrypted, protecting against physical attacks and cold boot attacks.

• Secure I/O: Provides a protected path for input and output, preventing eavesdropping on sensitive data like passwords or biometric information.

• Attestation: Allows the TEE to prove its identity and the integrity of its software to remote parties, enabling trust in distributed systems.

• Secure Storage: Offers encrypted storage for sensitive data, with keys that are bound to the specific hardware and cannot be extracted.

Intel SGX (Software Guard Extensions) is the most popular solution in the blockchain space. It uses the above features to provide confidentiality, integrity and attestation. This can then be applied for things such as:

• Private key protection

• Execute confidential smart contracts

• Privacy-preserving oracles

• Secure off-chai n computations

It's worth noting that while TEEs provide strong security guarantees, manufacturers could create back doors so there still needs to be further research on open source TEE initiatives.

Zero Knowledge (ZK)

Zero Knowledge (ZK) is a cryptographic technique that allows one party to prove something to another without revealing any additional information. This is useful in scenarios like authentication, verifying credentials, and private computations. For example, you can prove that you meet a certain condition (like having a specific nationality) without revealing any of the details behind it.

Key features of ZK:

• Completeness: Statement is true and honest verifier will accept

• Soundness: If Statement is false, no cheating can occur

• Zero Knowledge: Verifier knows nothing except truth of statement

Types of ZK:

• ZK-SNARKs: Succinct and non-interactive proofs that are efficient but require a trusted setup.

• ZK-STARKs: Transparent and scalable proofs that don’t require a trusted setup, offering better security at the cost of larger proof sizes.

• Bulletproofs: Compact proofs optimized for range proofs and confidential transactions, balancing efficiency with privacy.

In Web3, ZK helps power privacy-preserving transactions by allowing the validation of actions—such as transferring assets—without exposing sensitive data like sender, recipient, or transaction amounts. It also enables secure, private voting systems, auctions, and identity verification.

Note: the ZK ecosystem is quite large and there are some projects I may not have been aware of. Also my weakest section so feel free to provide further context.

Differences of PETs

Great, you’ve understood the overview of different PETs and how they interplay with the web3 ecosystem but how do they differentiate?

I will use the example of a Decentralized Exchange + respective versions using MPC, FHE, TEE and ZK.

MPCDex:

• Would be able to enable private order matching without revealing individual orders

• Encrypt order amongst multiple nodes

• Orders are matched

• Computation is revealed but orders remain private

• Benefits

  • Works great in decentralizing the computation and complex order logic.

• Challenges

  • Multiple rounds of communication and

  • Requires pre-processing which might slow down the online MPC computation

FHEDex

• Submit homomorphically encrypted orders and DEX matches computation on encrypted orders

• Results returned to users who can decrypt the matching orders

• Benefits

  • Privacy does not depend on node collusion assumptions

• Challenges

  • May be quite computationally complex

TEEDex

• Users encrypt order with enclave public key

• Enclave decrypts and processes in protected environment

• Results are released outside of enclave

• Benefits

  • Pretty fast in computation

• Challenges

  • Relies on hardware manufacturer trust

  • Potential side channel attacks

ZKDex

*Note: Pure ZK proofs alone can't perform this cross-user comparison while maintaining privacy*

Instead of revealing the order details, users submit an encrypted order along with a ZK proof of the order's validity. The DEX executes the trade by verifying the proof, without disclosing any sensitive information about the order.

• Benefits

  • Privacy Guarantees

  • Profs can be verified on-chain

• Challenges

  • Generating proofs might be computationally intensive

  • Large trader logic could add computational overhead

A table summary of it is below:

Note: This is not a complete accurate comparison but serves as a guide for comparisons.

Interoperability of PETs

So do these systems work independently of each other or can they complement each other?

This is a question that comes up a lot when using PET technologies. There are benefits but also challenges that come from incorporating different approaches. Borrowed from Ethan Buchman’s talk from Modular Summit  + AdenDRInWeb3’s thread on different PET comparisons, there are several combinations that are being explored in the space:

• TEE + ZKP: Efficient verification of secure enclave computations

• TEE + MPC: High-bandwidth, secure multi-party systems

• FHE + MPC: Enhanced security for MPC protocols

• Others…

This is a part that I would like to research and understand better. If we can explore different combinations without compromising too many tradeoffs, this will strengthen the adoption for PETs.

Future of PETs

PETs are awesome and are leading the path for a privacy preserving future. Further progress in each category will continue to happen and there will be a combination of these PETs as they progress. They work great independently but will most likely borrow from one another to get more efficient. I find this quote I came across from AdenDRInWeb3 on X, a good summary for this:

The future of privacy tech lies not in a single solution, but in a versatile toolkit addressing diverse challenges. Interdisciplinary collaboration may yield the most promising advances…

We need to live in a world but our data is not compromised and held together by integrity and privacy. Cryptography solves this via PETs.

Hopefully you enjoyed this piece and let me know if you have any feedback. I’m reachable via X/Twitter.

Thank you to Miguel + Jose for their reviews on this.

Resources

These resources (blogs , papers and podcasts) helped me understand these concepts better.

History of Bitcoin and Decentralization

• Before Bitcoin Pt.1 — 70s “Public Key Saga” by Pet3r Pan

• Before Bitcoin Pt.2 — 80s “The Origins of Decentralization” by Pet3r Pan

• Before Bitcoin Pt.3 — 90s “Cryptowars” by Pet3r Pan

• Before Bitcoin: Pt.4 — 00s “New Millenium” by Pet3r Pan

Technical Papers

• New directions in cryptography by Diffie, W. and Hellman, M.E. (1976)

• A method for obtaining digital signatures and public-key cryptosystems by Rivest, R.L., Shamir, A., and Adleman, L (1977)

• Secure communications over insecure channels by Merkle, R.C (1978)

• Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms by David Chaum (1981)

• Garbled Circuits by Andrew Yao (1986)

FHE

• 

  Poopman (💩🧱✨)

  @poopmandefi

  

  FHE opens up the possibility of computing on encrypted data without the need to decrypt it.
  
  When combined with blockchain, MPC, ZKP (Scalability), FHE provides the necessary confidentiality and enables a variety of onchain usecases.
  
  A digestible overview of the state of FHE

  

  520

  12:00 AM • Jun 9, 2024

• Podcast

  • FHEOnChain

ZK

• Podcast

  • ZeroKnowledge FM

TEE

• How to Win Friends and TEE-Influence People - Modular Summit - Ethan Buchman (Cosmos)

• What is a Trusted Execution Environment (TEE) - Halborn

Threads

• Privacy Tech Overview: ZK, FHE, MPC, and TEEs by AdenDRinWeb3

• A thread on accountability in Multi-Party Computation (MPC) by Wei Dai

• FHE trust-minimized applications by Wei Dai

I also replaced the word “wallets” with passports for this article. I believe protocols such as Ethereum Name Service (ENS), Lens Protocol, Disco and Safe extend web3 wallet infrastructure with identity, social interactions and security to a more general purpose utility compared to a traditional blockchain address.

Wallets have evolved over the past few years and are no longer just transaction and balance lists. Gaby Goldberg put it very well in her post “Stop Calling it a Wallet”. We should recognise the changing landscape and adjust our language accordingly to reflect this behaviour.

I believe the stack will become more modular and easier for wallet developers to build upon with more speed and security. This will help unlock more use cases and improvements to the passport experience. This includes the current hype around Account Abstraction and Wallet-to-Wallet communication which were the highlights at the inaugural WalletCon.

Let's dive into the web3 passport stack.

Current Passport Landscape

The current landscape of passports can be referenced via WalletConnect’s Explorer where over 250 wallets have been registered. JerichoGG/Valha’s wallet landscape article is also useful to understand the different category verticals.

Nichanan from 1kx has also written two great articles on the ecosystem regarding WalletConnect which powers a lot of web3 mobile dapp and wallet infrastructure as well as her in-depth article about different types of passports in the space (conventional / smart contract / Multi Party Computation (MPC)).

In order to understand the various components of passports, I also recommend downloading and playing with mobile passports such as Zerion, Rainbow, Omni or TrustWallet.

TLDR: Passports have evolved to become more than transaction and balance lists.

Passport Stack

The following are common components and tooling that I’ve seen in passports. I have used the Zerion mobile passport to demonstrate most of the stack.

Onboarding

• Seed Phrases: Save or backup your web3 ‘password’

• Authentication: Connecting to your web3 account via WalletConnect.

Actions (Read and Write)

• Financial Reading: Transaction List and Multi-chain balances

• Financial Write: Swaps, OnRamp, Staking, Bridges and transfer limits

• NFT Read and Write: Display, Trade and more.

• Namespaces / Identity: Domain name (i.e. ENS / Lens) and Decentralized Identity

• Blockchain Interactions: RPCs

• Browser: The Fat Wallet Thesis

• Networks: Chain switching and Multi-chain UX

• Data: Human readable data and API Endpoints

Other

• Security: Hardware security, Multi-signature wallets and social recovery

• Social: Read, Write and Follow

• Communication: Chat and Push Notifications

• Multi Party Computation (MPC): Social Login

• Account Abstraction: Improved passport UX with paymasters and batched transactions

• Transaction Security: Domain Binding, transfer limits and transaction simulations

Onboarding

Seed Phrases

This is the hardest part for individuals entering the web3 space. They are usually greeted via a welcome screen to save and store a 24 word seed phrase. It is very different user behavior to signing up with email or logging in with Google. I have seen some passports with great education onboarding but others make the mistake of assuming the user knows what a seed phrase is. Using Account Abstraction and MPC infrastructure, this will help improve the process. More in a section below.

Currently I have seen various onboarding approaches with respect to the user experience and the learning curve / barrier to entry for new people entering the space.

Authentication

There are two ways of authentication:

• dApp to Wallet (the most common pattern)

• Wallet to Wallet (bring your own wallet)

dApp to Wallet

Communication protocols such as WalletConnect facilitate the connection and authentication between dApps and mobile passports.

The standard flow is to:

1. Have an Ethereum Account on your mobile passport

2. Connect to a decentralized application (dApp) by providing permissions and signing that with your private key. This is usually represented as a QRCode via WalletConnect.

3. You are now connected. You can perform signing and transactions between the two applications.

Wallet to Wallet

Most passports allow individuals to another one. Think of it as bringing your own cell phone to a sim card plan. As seen in the above image where you can “Import existing wallets”. This allows you to connect all your wallets into one which is quite a useful solution.

Actions (Read and Write)

These actions demonstrate the various activities users may make within their passports. They might make simple transactions, swaps, view their NFTs or add social recovery. This vertical is where the usage of passports will continue to grow then.

Financial Reading: Transaction List and Multi-chain balances

This is where most mobile passports started. Onboard via a seed phrase and then show them how much money they have in their respective accounts. It usually consists of a graph of the portfolio and the tokens tied to the account. Initially it was reserved for just ETH balances but as the multi-chain EVM world grew, more data across chains such as BSC, AVA, FTM etc became accessible.

Most passports have this feature as it is a fundamental piece of how passports were architected in the beginning and using infrastructure such as Zerion API can easily help with transaction history and portfolio data.

Financial Write: Swaps, OnRamp, Staking and Bridges

With the advent of Uniswap and DeFi summer, various financial writing actions were introduced. This was translated to the mobile passport experience.

Swaps: This was demonstrated with introduction of Uniswap where you have two assets you want to change (i.e. ETH to USDC). 0xSwap API is a useful API that facilitates and finds the optimal route for swapping via the various decentralized exchanges (DEXs) that exist.

OnRamps: This is the module powered by the likes of MoonPay, OnRamper and Ramp Network which allows people to purchase crypto with their ApplePay or Credit Card. This is a very great experience and is quite seamless. Financial asset access such as crypto should be as easy as paying for groceries via ApplePay.

Bridges: With the advent of other Ethereum Virtual Machine (EVM) chains and other Layer 1 and 2’s, people wanted to easily swap one asset onto another network. I.e. ETH to Polygon Network. This ties in the mult-chain balance component where individuals may have assets across multiple networks. Zerion is powered via Socket which is an interoperability stack that helps developers build cross-chain apps. Lifi is also another great developer experience where passports can integrate their SDK and can easily bridge and access DEX aggregators across multiple networks. More info in the Networks Section.

Trade / Transfer Limits: This is a simple but interesting feature but some passports recognise the need to not overtrade on mobile phones as it is not the most secure so provide transfer and trade limits which is quite useful for the onboarding process

Staking: The action to stake a token into a liquidity pool was introduced during Defi Summer and this is another common action people may take in order to receive tokens in return for their risk. Coinbase Wallet shows simple steps and suggestions for users to stake their tokens in order to earn X APY or via their CbETH for Lido. Also a special mention to Valha.xyz who are creating an Defi API that aggregates staking and more financial actions into one resource.

NFT Read and Write

With the NFT boom, passports started by displaying NFTs so users could visualize the items they have in their address and swap them. I imagine more innovation will occur within this domain with the growing intersection of NFT and finance (i.e. NFT lending). At the moment, it still feels like the 2018+ era with transaction lists on mobile where NFT’s are solely displayed with a transfer functionality. Protocols such as Reservior are useful to power such solutions.

Namespaces / Identity: Domain name and Decentralized Identity

This is one of the main reasons why passports > wallets. Our real life passports represent a certain identity associated with a nation and this is what name resolvers such as ENS, Lens and Decentralized Identifiers (DIDs) via Disco enable. You can register tom.eth or tom.lens which creates a relationship with that ‘nation’ we call Ethereum and Lens Protocol. ENS has existed for quite some time in the ecosystem, however the best example is by Rainbow where I can purchase and register my ENS name in several minutes and see what I registered.

Additionally the innovation with DIDs and Verifiable Credentials by harmonizing on-chain and off-chain activity into “data backpacks” is really interesting. They extend what we know of just tying ourselves to an ENS domain and enable people to store and carry data they want to share to third parties (i.e. like a backpack or a passport). Check out companies such as Disco and Webacy. Also highly recommend checking out Evin’s talk at EthDenver below.

Blockchain Interactions: RPCs

Infura, Alchemy, QuickNode and Pokt are the main players that serve users to make Remote Procedure Calls (RPC) / requests to respective blockchains and this is the underlying technology that enables blockchain methods and actions to be processed.

Browser: The Fat Wallet Thesis

The Fat Wallet Thesis is the thesis that wallets could be the main accrual platform to help users interact with the blockchain. As Jeremy from Lightspeed wrote, “the majority of customers and assets will gravitate towards the most useful and trusted tools.” In web2 analogy, it is akin to travelers using aggregator sites like booking.com since flights, hotels and car rentals are all under one site. Coinbase and Metamask have the largest web3 userbase however there is room for a passport to become an aggregator like booking.com.

However, there has been significant progress in using an in-passport browser to interact with the blockchain. At WalletCon, Zerion explained that 50% of their transactions actually occur within their in-built dApp browser which was quite impressive. Let’s see if the Fat Wallet Thesis prevails.

Networks: Chain switching and multi-chain UX

Within each blockchain ecosystem, there are several flagship mobile passports in the space:

• Ethereum / EVM: Rainbow, Trust, Zerion, Metamask, Argent

• Solana: Phantom

• Cosmos: Keeplr

• Polkadot / Substrate: Talisman

As the mobile passport development improves and becomes more interoperable (actually possible at the moment), I can envision a passport who manages several L1’s/L2’s in one of their passports will be able to have a significant market share. I.e. A mobile passport that can handle Ethereum, Solana and Cosmos which has great marketing across all chains. Phantom seems quite well positioned here at the moment.

Data: Human readable data and API Endpoints

With the large amount of data that exists on various blockchains, for each mobile passport developer to index and write their own methods to call data is arduous. Therefore a lot of the underlying data you see in mobile passports are powered via Debank, Zerion and Covalent. This is a hidden but core piece of infrastructure.

Other

Security: Hardware wallet security, multi-signature wallets and social recovery

Security is of paramount importance in the web3 ecosystem and key management is a very high priority for individual users. In the onboarding process, I demonstrated the various steps necessary to create a passport and then ‘back it up’. However if you lose your phone and your seed phrase you are in trouble. Hardware passports are more robust as you keep them in a secure physical place. Ledger is a leader in space and has done a very great job with mobile compatibility. Several of their physical products work well with bluetooth and I can sign a transaction via my mobile. Stacks will also be an interesting product and one to keep an eye out for.

Multi-signature wallets are another alternative to create ‘safer’ passports. They are smart contract wallets that allow N amount of parties to govern the actions of a passport. The gold standard of this is driven by Safe (formerly known as Gnosis Safe). A notable mention is given to Tribes who facilitate the creation of social Safe multi-signature wallets which is quite cool.

Social Recovery is also another interesting security feature. The concept is driven via “guardians’ where you can delegate N amount of friends to help you recover your passport account if you ever lost it. Argent are the main pioneers in the space that brought this concept to web3 and is possible via their mobile passport.

Social: Read, Write and Follow

The rise of web3 social has been very interesting. The introduction of decentralized social networks such as Lens Protocol, Farcaster and xBackPack represent a new shift in the way we interact and port our social identities. Various mobile passports have started to integrate these social networks as features within their application. This use case will continue to expand.

Communication

This is a very hot topic at the moment and no one has really cracked the messaging component. Protocols such as WalletConnect, XMTP, Push, Notifi and Wherever are moving the needle in the space where address to address messaging can occur alongside notifications.

We are on the cusp of seeing new web3 inboxes integrated into passport communication. This could entail protocols messaging their users, providing exclusive on-chain suggestions and deals or re-imagining concepts like the aforementioned Tribes passport.

It represents the re-invention of message communication in this new domain called web3. However we will need to be careful with spam prevention and phishing through these messaging protocols and platforms.

Account Abstraction

Another hottest topic in the passport space is Account Abstraction (AA). It is similar to Gnosis and Argent and is a smart contract wallet that delegates the creation and management of the transactions. Several features such as paymasters, social recovery and atomic/batch user operations are enabled by AA.

There are now several Account Abstraction passports such as SoulWallet and PatchWallet being built in the space so it will be interesting to see their products and how that will influence the onboarding and key experience on mobile.

Notable infrastructure projects powering the space include Stackup, ZeroDev, Biconomy, EtherSpot and Safe. Check out this thread reply by Alexander Chopan for other AA projects.

MPC Wallets

MPC (Multi-party computation) crypto passports are a type of digital passport that uses sophisticated cryptographic technology to secure cryptocurrency assets. The private key is divided into multiple pieces, which are distributed among several parties. These parties work together using a mathematical algorithm to reconstruct the private key when it’s needed to sign a transaction. This approach eliminates the risk of a single point of failure and reduces the chances of the private key being stolen or compromised. It has been around for a few years but this technology is now being brought mainstream via projects such as Web3Auth, Intu, Lit Protocol.

Transaction Security

With various phishing methods, many people have been caught signing transactions or approvals to malicious sites and contracts which can drain their account. Domain binding browser extensions such as Fire and transaction simulations via Tenderly and Blocknative allow users to verify that the signing experience is coming from safe sites / contrasts which is a very positive step. More of these safety experiences will definitely move into the mobile passport experience.

Transfer Limits are also a simple but interesting feature. Some passports recognise the need to not overtrade on mobile phones as it is not the most secure so provide transfer and trade limits which is quite useful for the passport experience.

What does this mean for the future?

It requires both users and passport developers to realize what pieces of this passport stack they want to incorporate or interact with. Will passports decide to integrate every part of the passport stack or focus on a few with a great experience. Will certain passports do well for NFTs and DeFi? Time will tell.

Personally I am looking to see if a wallet can conquer the fat wallet thesis, how far web3 identity will be extended with DIDs and how account abstraction passports will be built with features such as paymasters. With regards to developer tooling, I also believe that more innovation and effort will be made to support this growing mobile passport stack.

Hopefully you enjoyed this piece and let me know if you have any feedback. Am reachable via Twitter

Thank you to Pedro, Abi, Sophie, Mikey and Nich for their feedback and suggestions.