Designing a crypto security system at a Swiss bank - Michele Federici

This episode features a comprehensive interview with Michele Federici. Previously involved with Seba Bank (now Amina Bank), Michele discusses his journey from a childhood fascination with computers and security, influenced by his grandfather, to pioneering the development of ultra-secure crypto storage solutions. He shares anecdotes from his early engagement with Bitcoin, insights into the complexities of crypto custody, and detailed explanations of technical challenges encountered while securing cryptocurrencies. 

The conversation shifts to Federici's perspective on user interface improvements, self-custody solutions, and his vision for enhancing crypto security through innovative technologies like Multi-Party Computation (MPC) and zero-knowledge proofs. Towards the end, Federici provides personal insights on his inspirations, his first paycheck, and the non-financial best investment he's ever made — founding his company.

https://www.linkedin.com/in/michelefederici/

https://michelefederici.com

https://sig9.ch

Transcript

Michele: 0:06

And that was really cool, and it's still in use today, as far as I know. To give you like a quick overview on it, it basically consists in a, let's say a James Bond level vault. With a, with the iris scanners to get in. Sensor in the wall in case someone is drilling or trying to get in in some other ways. It's completely isolated from any radio signal. It's basically a big metal Faraday cage. And we also selected military grade hardware. Which was also which also had the requirement to not leak any data, especially on the radio frequency level. And finally, we developed our own super minimal and hardened operating system, which is, which was based on Linux and our wallet software.

Didier: 0:53

How was cryptosecurity really done in a Swiss bank from somebody who helped design the crypto security protocols at Simba bank. Michele Federici is the founder of SIG9 Security. Previously, he helped design the security at Seba Bank, now Amina Bank, and he also helped design security systems at a VC firm, and now advises companies on security design.. Michele also featured in a recent report by the Crypto Valley Association. So good afternoon, Michele.

Michele: 1:22

Hi Didier. Thanks for having me.

Didier: 1:24

To get started for people who don't know you, can you describe your background and what led you into designing security systems at at Sibabank?

Michele: 1:31

Yeah, sure, sure. So my, background is basically I was always a nerd guy since I was since I was a little kid. My, my grandfather was also a huge nerd. So he basically introduced me to the, you know, to the first computers and and we started together, you know, And and, and, and, yeah, so playing around with computers. Then I went to the university, I started getting more on on the real stuff. And I was always particularly interested in, in the security aspect of it. So, even when I approached the real world, started looking for projects that would put me in the position of working on safety critical software. So my first job, for example I, I worked on on payment gateways, traditional payment gateways. And then on my second job, when I was still in Italy, in Bologna, I started working for this biotech company that was producing this machine to try to test different cancer drugs. Before actually moving to the, Crypto Valley and start working on, blockchain projects full time, let's say,

Didier: 2:39

so in fact,, how did you discover crypto,

Michele: 2:42

so I am, to be honest, I don't remember, but it was, in the very, very early days of Bitcoin, I think I just I just found out, probably like the, Bitcoin forums. I started, you know, I was really fascinated by the idea of of having like a completely decentralized system, not under the control of governments and, and state and state countries. So I, I just started playing around with it at the time we were talking about, I think, 2011, it was really different from what we see today. Okay. But yeah, so I, I actually an interesting story. The first the first bitcoins I got, I mined them solo on on my desktop computer in about a week. So I mined an entire block. So it was still possible at the time to mine 50 bitcoin on on a desktop computer. And that was the Yeah, different times, definitely.

Didier: 3:37

And how many blocks do you think you mind.

Michele: 3:40

No, just one because basically it it took an entire at the time it took about a week with my, with my desktop computer. But it was completely unusable. And you know, my family wasn't super rich or whatever. So, you know, there was the only computer that we had in the family. So knocking it out for a, for a week yeah, they didn't really like the idea was, you know, electricity and everything a little bit paranoid about it. And also to be honest, it was just a, it was just a joke. I didn't really feel that Bitcoin was going to, to become what we know today. I think it was like 2. On, on super can I say like obscure exchanges at the time? And I was also very young, so it was just playing around. And I also took a big break in in the in the middle from playing around at that in that years and then to actually start working seriously or start believing in. Seriously in the, in the project

Didier: 4:37

Okay. And then you also worked, I think, at a VC firm. Was that before or after you worked at at Sibba Bank?

Michele: 4:43

I was after was after,

Didier: 4:45

and what were you doing there?

Michele: 4:46

In the, in the VC, The head of security,

Didier: 4:52

So you worked at Sibba Bank for what, two or three years, I

Michele: 4:55

Three years and a few months.

Didier: 4:58

Can you describe maybe the major security challenges for Swiss Bank relating to crypto?

Michele: 5:03

yeah, definitely. Definitely. So, I, I could maybe start by saying that managing custody is It is still perceived today as, as one of the trickiest matter in crypto, right? So, personally, I've always been all in, in self custody, but, but I also accept the reality that a lot of people simply don't want to handle that. On their own, or they're scared or they feel like they are not knowledgeable enough for doing it. So in those situations, I think you can only try to find someone reputable and skilled enough to build the proper solution and manage it for you. So I, so we saw a clear demand for that, and that's what we tried to target in Saba. We're talking about five years ago. So at the time, institutions were still not really involved so much in crypto or in, in Bitcoin at all. Or, or, or very little. But everyone started was starting to look in the direction, right? So Yeah, designing a big custody solution has a lot of criticalities. And you know, the, the idea of of Seba was to be the first global crypt regulated crypto bank. So also the regulators and Finma in particular were quite paranoid about it and they were monitoring, monitoring us very closely. So the biggest dilemma, I would say in crypto, but in IT and IT. Security in general, for me, it's always drawing the line to what's secure enough. And, also trying to avoid overengineering and over, overly complicated system because we, we need to always keep in mind that complexity is one of the biggest enemy of security. And even a very, very small error in crypto can always result in a catastrophe. It's actually an interesting story about it. When I was working in Saba and then developing, part of our Bitcoin wallet, I, I found a pretty bad bug in in, in Bitcoin Core itself, which was also like the perfect example of how a very, very small error can can lead to a catastrophe, which wasn't the case luckily, but yeah, it could, could have been the case, which you just don't know

Didier: 7:17

Yeah, exactly. Do you want to describe what it is you found and how you corrected it? So before we get into to the explanation, let me give a few definitions that might help people understand what Miguel is saying. Bitcoin core Bitcoin core is the name given to the original software version released by Satoshi in January, 2009. Satoshi released the white paper in In October, 2008, but he released the software version to implement. The white paper. In January, 2009. And that is called Bitcoin core. To show that he was not mining Bitcoin secretly before he released Bitcoin core, he included in the Genesis block, the famous Statement thing. That the bank of England was on the brink of another bailout. With the date of the, newspaper that had that headline. So that is a Bitcoin core. And for people who don't realize Bitcoin core is the main software version used in Bitcoin. The enlightening, there is no specific. Version released by the people who wrote the lightening white paper. Uh, the lightning white paper is a set of protocols, But there is no specific software version released by the authors of the white paper, Taj. And Andrew Poon relating to lightning. So there are several different applications of it. And all these, these applications don't necessarily all have the same features. Next to multisig, multisig and abbreviation. Then for multiple signatures. It means to sign a Bitcoin transaction. With a, of a multi-faith address, one needs multiple signatures. So for example, three out of five possible thing. That truth. I need to be provided, for the transaction to be valid. So it means that not one person controls the, those Bitcoin, but a combination of people. So for example, three out of five, and what is also important is that even though several people for example, in this case, three out of five, people need to find a signature. We need the public keys of all five signatories, Uh, SegWit SegWit stands for segregated witness. So what is segregated witness? a way to witness as a change in the architecture of transactions. It was introduced in 2017. It allows the signatures. To be in a separate attached data structure and not be computed. As part of the transaction hash or the transaction ID. segregated witness it's an opt in choice. Meaning, you can decide to use segregated witness if you want, but you don't have to, if you don't want to.

9:48

Legacy address. Legacy meaning the address structure before SegWit with introduced. And finally the definition of. Uh, public address and compressed or non compressed public address. So, First the public address that derives from a public key. So get a public address. In fact, first you start with. Private key, you take a private key, which is just a random number and you put it through. A specific equation called an elliptic curve function. And you get a public key and then to get to go from a public key to a public address. You put it through two more. Hash functions. But to obtain a compressed public key. The second step in the procedure is slightly different. The result is the compressed public key. You're going to get a key that's only 33 bytes Longworth and the uncompressed public key. The key will be 65 bytes long. A compressed public key is used in SegWit and an uncompressed public key is it's a legacy address. basically an address., format that existed before SegWit was implemented.

Michele: 10:55

yeah, sure. So, so basically we were we needed to re implement so Bitcoin Core is written in C but our tech stack in Ceiba was, we were using mostly Rust. Like everyone is trying to do now because, you know, it's memory safe. It's, it's, it's easier to, to use if there's a better ecosystem around it. So one of the challenge was again, we're talking about five years ago. So many of the tools that we see today were, were not available at the time. There's much more stuff today. So we had to implement some stuff on our own, and while I was I was writing a part of the code that was that needed to parse some of the Bitcoin transaction, I was trying to calculate some multi sig addresses but I was getting a different multi sig address than the one from Bitcoin, the one Bitcoin Core was, was giving me, with the exact same multi sig parameters. So let's say that me, you and another person is creating, we are creating a multistick together. You need to have the public key of all three. And then the software is giving you another address, which is basically, let's say, to simplify a combination of the three. But the one that, with the same parameters, the one I was getting from, from Bitcoin Core wasn't the same that I was getting in my software. Of course, I thought I was the problem. I thought my, my software was was bugged or something. But I, I kept looking at the, at the Bitcoin specification documents. I kept looking at my code and I couldn't find error, I couldn't find error. So, I started getting in touch with the core Bitcoin devs. And even in the beginning they also said, yeah, it's probably your code whatever, right? So it went on for a month and then after a month that I was still in the same situation said, Look, guys, I tried everything. It's not me. And finally, they, we did a test together and they realized that basically it was a bug introduced after Stegwit. So SegWit was was introducing some, some changes on, on how the, the, the, how can I say, like, how the, the public keys are managed. So before we were using what, was called uncompressed public keys and now we are using compressed public keys which were introducing in SegWit to, basically Occupy less spend less space on the blockchain itself and make the transactions cheaper on the fee side. And, and, and basically, like, if you, if you were creating a multi sig address and you wanted to have a new batch 32 address, so the latest latest versions of the Bitcoin addresses, you had to use only. Compressed public keys. I basically found out that there was a bug where in certain cases, if you were adding a mix between the compressed and uncompressed public keys, Instead of falling back to the previous, to the legacy address, it was just still giving you a segwit, a segwit address which was invalid. So basically, if anyone deposited money on that address, they were lost forever. It was pretty technical. I tried to break it down. But

Didier: 14:07

No, you explained it. Well, I got it. I hope the listeners will get it as well. so what was the work around for that?

Michele: 14:14

So basically that's actually like another funny thing. So there is no work around and the bug is kind of still there because it couldn't be fixed without an art fork. Because that could, that part of the code is in the, what is called consensus critical code, which requires an art fork to, to, for an actual fix. So, actually I proposed a solution, but then a core dev to that, proposed another one, which was more complete. So, it's it's solution was merged, not mine. Even if they added me anyway in the credits. So basically the, the solution was on the client side. So whenever you are, so it's, it's the, is the Bitcoin wallet that is not allowing you to do that. It's not the core consensus code. So you, we are basically blocking it on a higher level. See what I mean?

Didier: 15:04

Yeah, so if I understand, if I understood the problem correctly, in fact, the solution is that everybody who's MultiSig must have a, SegWit compatible Wallet that generates a compressed public key, is that correct

Michele: 15:19

Yeah. Or, or you can also use a mix of the two, but you, you need to be sure that the, the wallet is falling back to, so he's trying to generate a, a legacy address and not a segwit address. So it's, it's just you are just telling the wallet software. if one of the public keys are not compressed generate a legacy address. So if, if you are providing a mix of the two the, the, the wallet is a route automatically calculating a legacy address. I mean, this is just a technicality, actually. It's the fact that it's going to happen on a higher level and not on the consensus code. It's just it doesn't really matter. Let's say that there is a, there is an, there is an additional check that is forcing the wallet to generate a legacy address if at least one of the key is not compressed.

Didier: 16:11

okay, all right, yeah, so that was a, a sort of fun detour in your journey at SEBA. But yeah, generally speaking, maybe do you want to describe so, sort of give an overview of other challenges that you had at SEBA and, What are some of the challenges that are specific to crypto?

Michele: 16:31

I, I would say like, challenges specific to crypto. Well, the biggest ones for sure are performing properly secure key ceremonies and handling backups and then signing devices which is yeah, it's still kind of the, the first the first critical point in crypto, but it's still the critical point today. So, I think we still, to be honest, we still didn't find the, let's say the final approach or the final UX in this regard. But there are some, some interesting technologies today, which are which are going to probably improve on that sense, like, for example, multiparty computation. be used to achieve a very, very nice improvement in that sense, because they allow for flexible multi sig setups and more security in the sense that compared to Shamir's secret sharing, for example, there's no point in time where you need to recombine like all the keys together to do a signature, but you can do this as a intermediate. Intermediate signatures and and and yeah, so this is the

Didier: 17:41

Yeah, maybe let's take a step back. Do you want to maybe explain what a key ceremony is and when you use it and What it's, why it's important, what it's used for.

Michele: 17:50

Yeah, definitely. So, so key ceremonies are not not something specific to only cryptocurrencies and in crypto in general. So they are used for example, also for for how internet is run. Like when you have a domain name, let's say like, michaela.com the, the TLS certificate co connected to that to that domain and needs to be signed by a certificate authority. And there are few in the world. A few people in the world that are managing these keys and they are rotated from time to time. So there is like a big ceremony. I don't remember how often they do it, but it's everything is public. You can find by searching DNS route, route certificate ceremony. And, and and what is a key ceremony? A key ceremony is basically a procedure that you do to generate new cryptographic keys. And especially In a situation where you don't have full trust of the people around you. Of course, if I'm generating a key for myself, I'm not using the same procedure that I used in SabaBank, where you basically, no one could trust any other person involved. So the idea is, You set up an environment like physically and also on the software level where you try to reduce as much as possible, all the internal and external risks in, involved, in a cryptographic key generation process. So, for instance, in seba we had some strict rules about his ceremonies of, you know, you couldn't bring in any, any external electronic device. Some of the most important key ceremonies were actually run in a Faraday cage, so no radio frequency signal could get in or get out from the room. We were designing the protocols and the script in a way that no one was able to reconstruct any of the signals at any point in time either during or after the key ceremony. Okay. And yeah, then We had multiple roles. So basically, usually you have like a master of ceremony, which is reading the protocol. You have an operator, which is executing step by step and then you have one or more weakness for external auditors. Which are checking that everyone is doing, you know, his own role and he's not trying to cheat in any way.

Didier: 20:22

Okay. And in a bank, you're going to do a key ceremony with whom? With other exchanges? Who are

Michele: 20:28

No, no, no, you are you are doing a key ceremony. I mean, there are many, many key ceremonies. It could also be for example, a multi sig with other entities. But the, the main case was actually when we're generating the keys for, for wallets of our client. So, for instance, like, the cold storage. For the cold storage, I can explain a bit how, how that that was working. You needed to generate a set of keys. We had a segregated wallet, so basically each client had his own wallet. And and that was becoming basically the deposit wallet for for each of the clients.

Didier: 21:07

Okay. But you were doing this, what, internally on an HSM or how does this work? Okay.

Michele: 21:11

So, it depends. So, in Saber, we try to go in the direction of a hybrid and diversified approach, let's say. So, on one side, we integrated some existing custody products. Especially for the hot storage and some specific use case we didn't want or didn't have the capacity to build internally, also to not reinvent the wheel, you know, but at the same time, we wanted to design our input and develop our most important component, which was the cold storage, which was the crypto core of the bank, let's say, and that we didn't completely internally. And that was really cool, and it's still in use today, as far as I know. To give you like a quick overview on it, it basically consists in a, in a, let's say a James Bond level vault. With a, with the iris scanners to get in. Sensor in the wall in case someone is drilling or trying to get in in some other ways. It's completely isolated from any radio signal. It's basically a big metal Faraday cage. And we also selected military grade hardware. Which was also which also had the requirement to not leak any data, especially on the radio frequency level. And and finally, we developed our own super minimal and hardened operating system, which is, which, which was based on on on Linux and our wallet software. So, operators to do like a, to sign a transaction in the cold storage, operators need to be physically there and the signatures were done offline and broadcasted to the internet later. So after being signed, so when, when they cannot be. So yeah, that was like a cold storage, for example, is really different because you need you need way more levels on the or on the operation side because because you need to be fast. You need some of the signal to need to be automated. But cold storage is technically where you put most of your money and you are not accessing every day. You're accessing from time to time. You see what I mean?

Didier: 23:08

Okay, so you had a hybrid solution for that you say, with a lot of, okay, with a lot of security that you just sort of evoked. And there was a key exchange, there was a key ceremony at each time you created sort of a new wallet for each customer. Is there also a key ceremony? When you want to connect the wallet of the bank to exterior participants. I mean, like an exchange or something, or to another bank who you might trade with.

Michele: 23:36

Well, regarding exchanges, maybe the main, let's say ceremony, even if it's yeah, kind of a very limited one is for API keys. So if you are integrating, for example, with an external exchange there's a lot of power there. You basically usually need some API keys. And with those API keys, sometimes you can do basically anything. You can trade, you can sell, you can buy, you can withdraw. So. There's many implications in in, in generating the key in a safe way. Some websites usually they, you, you click like generate new key, they show once and then they don't show it anymore. Of course, we are talking about every we are talking about an online system now. Cold storage is a completely different concept because everything is designed to be offline. Everything that is offline is, yeah, is considered hot, so it's, it's way less secure by default. But, but still, of course, you need to, you need to manage, to handle carefully. Also the API keys and and also like the, the two FA for example, or the credential for the exchange account. So if they're also managing a similar way with the, with also different backups also the backers, we, we, we had multiple backs and backups in different geographical location in case, you know, like if you, if you keep everything in a single, in a single place it can blow up and you can lose everything it happened, for example. I think a couple of years ago, something like that, the one of the huge, the biggest data center in Europe blew up basically was was completely on fire and a lot of companies lost everything because maybe they also had backups, but they were in the same data center. So, so yeah, the, the geographical, the, the multiple geographical location is also a very important topic in in backups and, and the ceremony.

Didier: 25:28

Okay, okay. So, yeah, so just getting back, let's summarize maybe the high level security challenges related to crypto is one of the key exchange. Multiple backup sites and the quality of your backup. Sites, any, anything else you'd like to evoke?

Michele: 25:45

Well, the something that I'm focusing, I'm focusing a lot lately, and, I'm thinking, I'm thinking about it. It's it's the, how can I say, like the understandability of what we are saying. Signing. So especially like in in main blockchains like Ethereum, where you can do very complicated and combined operations by interacting with smart contracts. when this kind of blockchains were designed, nobody had the understandability, the human understandability of transaction in mind. So we, so basically like, for example, in the Ethereum case, if you have a smart contract deployed somewhere and the developer is not publishing on their own the, the ABI. So the definition of the function and everything, there is not much you can understand of what the smart contract is actually doing. We have some we have some nice solution that got very popular lately which is basically transaction simulation. So there are tools like N Vil, which is A-S-C-L-I tool, which allow you, which allow you to. To fork the chain in any point in time and locally, and then execute the transaction and see what and see the results of it, you know, locally without actually broadcasting in the network, that is like a very, very famous service, which is called tenderly, which is also doing the same, but online they have like a, A website where you can simulate transaction and also see the details of them.

Didier: 27:21

Okay. Any other problems that you think still need improvement?

Michele: 27:23

I know that I'm saying this after after talking a lot of technical details and maybe people will not understand me. But I think this is actually one of the biggest problem still today, UX. So a lot of people, a lot of friends which are not technical, they're still not using crypto because they are scared. They know that you can, you can, it's easy to lose, to lose everything. They know it's easy to steal. And also they don't understand what they are doing. So, now that we, we basically we've got main, we've got mainstream institutions are, are, are investing on it. And everyone is talking about it. I think we should really stop a bit and focus on on, you know, what user wants,

Didier: 28:08

Okay. So basically, do you think the ETF is there for a good solution?

Michele: 28:12

No, no, I'm not necessarily, not necessarily. No, but I, I'd love to see actually, like, you know, even a, a self custody solution, which is really easy and then makes you feel secure. I'm not saying that someone else needs to do it for you, you know,

Didier: 28:24

And you don't think they're easy enough now because I think most self custody solutions are quite easy now. Just people need maybe a bit of education. But what are you saying that most of your friends who are in crypto still find it a bit intimidating?

Michele: 28:37

I mean, not most of, I mean, probably today most of my friends are actually encrypt, but I have a lot of friends and, you know, family members which, you know, they still, and I, you know, I can see that, you know, like, a friend of mine, which is in, which is also in crypto since five years last year lost a few K in in, in crypto money because he made a mistake. He sent a, he sent a transaction on a, on a wrong Ethereum layer two by mistake. I mean, this is stuff that is still happening and it's still happening to, to technical people.

Didier: 29:09

Okay, alright, yeah. So, user interface probably needs to be more easy to use and probably need more Software solutions integrated directly into the software to correct any errors that the user might input accidentally, I suppose. That's I suppose those are improvements that still need to be brought to crypto, is what you're saying.

Michele: 29:30

That's another thing. If you were that I think it might be a nice a nice evolution in the future, I'm talking about this since a while now, but I still didn't, I still couldn't find a proper products convincing me. But I I, I feel like it would be nice in the future to have a sort of a very, very battle tested and simple way to, to handle keys in a sort of social recovery system. So basically reducing the likelihood of losing access to your funds exponentially. By by having ways to recover your keys through the combined action off a list of trusted people around you. So, so kind of, custody will still be, you know, self custody managed by yourself, but you will, you will have a second layer where. Your friends can still save your ass if you, if you, if you do some mistake. You see what I mean?

Didier: 30:26

Does this necessarily mean a multisig, or what do you

Michele: 30:29

Ah, not necessarily. I mean, I, I can probably see MPC being used in that context. Maybe, you know, it could be, I mean, in the Ethereum case, probably it can be managed by a by a smart contract where you know, I don't know. I mean, I know no one found a proper solution for it, as I mentioned. But I think that there must be a way where you have this smart contract wallet where you have your keys for it, but you're also adding a set of rules. To to move out the funds to a new wallet in case, you know, for example, you disappear or you, you don't you don't you don't do like an heartbeat after X amount of time, or because this stuff, this stuff that we can probably script, it's just that we, no one really focused on it yet.

Didier: 31:19

Okay, let me ask you a question, which is, goes against my philosophy, but I'll ask you anyway. Basically, I have the impression that what you just described is what banks do within an HSM. Not that I necessarily want to have People put their crypto in banks because I think that crypto's greatest quality is censorship resistant, and when you put your crypto back into a bank, you give, you give up censorship resistant. You've given the censorship quality back to the bank. But but I have the impression that the, the, the whole sort of protocols to protect you from a mistake is, is what gets programmed into an HSM in a bank. Is that correct?

Michele: 32:00

no, not really, actually. So, so there's two ways to, to, to, to look at it. So on one of the, one of the approach could be, as you said, basically to delegate the custody and giving away your rights, which is a. Which is very, very in contrast to, to the, to the ideology of crypto and no, that's definitely not, not what I, what I meant, what I, what I mean is that with cryptography. Even in a, in a self custody set up, so without giving away your keys or without giving it to an institution we could create setups and drive software. To, to still make you manage your keys, but also have a way with your friends actually, to, to recover this key. So what I meant about is kind of such a recovery. It's not you and the service or our institution or a company. I was thinking more like you and your family. You and your, because this is also like one of the, one of the underrated problem that we have in crypto today, people die and then they die with their keys sometimes, you know, and then if I, if I die tomorrow, hopefully not. But if I die tomorrow, I would love my, my fiance or my family to get my, to get my crypto and and it wasn't the case. So now I kind of created a setup to solve that, but, you know, it's, it's not the case by default. You see what I mean? Like, and HSM is this kind of a, also it's kind of a buzzword. It's, it's We can consider a lot of things to be HSM, like a credit card or the SIM card of the phone. So it's basically like an hardware which is designed to prevent you to extract the memory part of it. And so hardware wallets, like also the consumer ones so that's something that you can use also on your own and I'm talking about more on the software on a little higher level. So something that you use in your HSM or your wallet software. To regenerate the keys or move out the funds in case you are dead or, or you, you lost access to, to your wallet.

Didier: 34:12

Okay, and so far the the solutions if you've looked at are they ones that you've created yourself I mean people like rgb I think do solutions like that and there are other people who do or did you create your own or

Michele: 34:24

Even, yeah, I mean, I didn't, I didn't create my own, let's say I used some existing algorithms. Basically the way I went to, I went for is I it is, it's kind of very similar to an MPC solution basically. Yeah. So where you, you basically split, let's simplify, you split your keys. In a, in a certain amount of of shards and you require a certain number of shards together to reconstruct the key. But this could also be on, as I said before, on the smart contract level, it could be like, in a smart contract, in the memory part of, in the memory of the smart contract, you say, okay this public key with these other public key, with these other public key, which is, I don't know, my girlfriend, my father, and another person. Okay. Can unlock each amount of funds by doing this transaction together.

Didier: 35:19

Okay. So what innovations do you find the most promising to resolve these security and custody issues?

Michele: 35:25

so I, as I mentioned, I like the idea of MPC, even though there are not many implementation, open implementations yet, and that's still need for sure. A lot of battle testing. There is also, I find very, very fascinating also zero knowledge cryptography for, for privacy, but also for scalability in particular, because it promised to, allow people to, basically put off chain a lot of the calculation that today we're trying to do on the, on the blockchain itself and only write the proofs on the, on the chain. So, this would probably allow us to, to reduce a lot of the fees. Because they will use way less space on the chain and, and then to build way more complicated operationally complicated solutions. And that's something that we need because the blockchain needs some, some scalability. And of course, like AI also, everyone's talking about AI now. Maybe it's, it's overestimated, but for sure it will help a lot. I think in in stuff like code reviews. Finding, finding trivial bugs and then productivity in in general.

Didier: 36:33

Okay. Alright. So let's move on to some rapid fire questions. Something about you that your co workers don't knoW.

Michele: 36:43

Oh, I wasn't really ready for this, something that they don't know like on the work side a little more than the.

Didier: 36:53

Or like, say, something that you do in your free time that, or something that you did, that might surprise your, your co workers, your

Michele: 37:01

well, I can say I was for something that would be probably surprised today is that I won some some, even on the on the country level tries in so I was around, I was doing this type of run. Kind of a marathon when I was a little kid and I, and we also arrived second in in the Italian championship. It's like a couple of things. So it was and and yeah, probably they don't know. And probably they would laugh because today I'm not really like a kind of a sport person, but yeah, this is the first thing that came to my mind to be honest.

Didier: 37:36

Okay, good answer. Next question. How did you earn your first paycheck?

Michele: 37:39

My first paycheck. So, So I did a bit of everything, to be honest, because, you know, I wasn't, I'm not coming from a very, very wealthy family, let's say. So I also needed, so when I was a kid, I wanted more money. So I, maybe on the, on summer I was working, I don't know, I did the, it I work with with gardeners. I, when I moved to the university also to pay a bit of the expenses in the university itself. I, I worked in a flower shop, you know, that's my, actually, you know, my plan B is if, if I get really tired of it, I, I would love to buy, to buy a farm and do wine. I love wine I love to produce wine. And then, you know, so I'm also kind of a, a nature, nature guy. I say.

Didier: 38:31

Good. All right. Back to the other extreme from you liked wine, so let's go to the other extreme, back to programming. You mentioned artificial intelligence. What do you use ChatGPT 3 for?

Michele: 38:42

Yeah, so I, I am, so I'm using T since day one that came out, and it really blew my mind. To be honest, I wasn't expecting to see my lifetime, something like that. I'm using it for for like daily for a lot of different things, especially like, you know. Prototyping code, so like code snippets or fixing some code or refactoring code but also also correcting correcting writings like the text both in Italian and then in English. It, it works pretty well and it gives you like a lot of a lot of suggestion also for for preparing like, for example, speeches and then, and and slides. And asking general question, the only the only limitation that I have at the moment and that's why I'm looking for an alternative now is that I'm not writing anything sensitive, you know, so I'm if I don't want to share some some specific code or whatever. I'm not asking and instead I'm doing it on my own. I, every time I copy paste something, I, I try to delete the names and the, and the personal data. But I was actually in the last couple of days, I saw that a lot of other trained model were released from for example Google and other players, which you can run locally. So you don't have the problem anymore because you're not sending your your inquiry to your your question to to central server, but everything is local. So that's what also what I'm trying to do now to have one at least that they can run locally and they can ask whatever I want.

Didier: 40:20

Okay, let's do two more rapid fire questions. Somebody who inspires you?

Michele: 40:24

So there's a lot of people that inspire me. Maybe it's a lame lame answer, I don't know. But if, if the aliens would come to her tomorrow and ask me who I would select, I would probably go for for Elon Musk. Because I think he did something incredible, you know, if he you know, Ares is not perfect. He has a lot of, a lot of a lot of problems too, but he achieved many, many things all together that a lot of people thought they were impossible. And then, and now he's getting a lot of A lot of hate and and to be honest, I think, you know, it's, it's kind of a unique unique genius probably in our in our lifetime. Then there are many like hackers, like, you know, Mitnick just died unfortunately rest in peace, and then I have some minor minor hackers that I follow more on the local

Didier: 41:19

who was the hacker who just died? I didn't, I don't know him. Mitnix? Who, what did you say?

Michele: 41:23

yeah.

Didier: 41:24

Okay. Okay. I don't

Michele: 41:26

He was one of the most famous hackers. See, he's not also like, you know, a lot of people say that it's kind of an imposter. It wasn't as good as as he was trying to, to show. But, but he wrote, like, a couple of books which I read when I was a kid and just inspired me. Like, also John McCaffey was was a big fan. Also, like, another controversial guy, but but it was really, like, I don't know, it was just inspiring for me. I'm not saying I agree with everything

Didier: 41:51

okay, great. Thanks. And finally, one last rapid fire question. Uh, the best investment you've ever made you ever made. That was not financial.

Michele: 41:59

I would say founding my own my own company last year. Because, you know, you said not, not financial and, and it sounds financial, but actually it's not entirely because I realized that basically I, even if, so even in the, in the condition that I wasn't getting the same money that I was getting in my last salary, you know, I was an executive in kind of a well funded company. So I had a very, very good salary. But I was working a lot. I was really burned out and all the time. And you know, and now I can kind of manage my my time and and I can work for maybe a bit less money sometime, but but also, you know, working half of the time, spending my more more time with my family. And and yeah, I think that's that's really, really. Good for, for your mental health and then for for you know, for having like a better life in general,

Didier: 43:03

Okay. Great. So where can people find out more about you? You have your own company, which is Cigna, and so do you want to. Explain to us a little bit, what it does and work. And where people can find out more about your company or hook up with you.

Michele: 43:15

Definitely. So I so yeah, like a quick, quick description maybe on my, my company is so, SIGNINE is my, security consulting company, and it's also basically my self funding way to keep getting an inbound cashflow while I'm also slowly progressing on developing. Some, some, some internal products, which hopefully so hopefully in the future we will switch from from consulting to be a product company sooner or later, or also continue to do both. The idea is that, you know, I had this this couple of ideas. I can really speak too much about it, but of security tools, which I think are still missing in the, industry. And, and yeah, you know, I, without asking for external funding, which is always like, you know, tricky and and they also have, you know, certain conditions which might not be very, very favorable for you. In this way, I can, I can still handle everything on myself and and hopefully still deliver some related. So, so that's so people can find, they can find information on, on signal in, in in our website, signal dot E dot C. H. It's very basic website, but but, you know, they can always get in touch with me on you know, on LinkedIn. There is my, my personal website, nickelfederici. com or or, you know, github. I'm also hanging around in in Zurich I'm a part of some groups here, like, I'm often at meetups and conferences in the area. So I'm happy to, so if anyone wants to get in touch or also hang out in in around here, I'm, I'm happy to So feel free to, to get

Didier: 44:57

Okay, Michele. So, it was a pleasure to speak to you and I hope we'll be in touch again. And I'll leave the references to SIGNINE and to your LinkedIn and to your website. I'll leave those in the show notes. Okay. It was a pleasure to speak

Michele: 45:10

Thanks a lot. It was a, it was a pleasure also for me and so talk to you soon.

Didier: 45:14

If you want to follow other things I do, you can subscribe to my Substack newsletter called the Swiss Roads View The Butterfly Effect. There I discuss crypto, but I discuss other things like business, art, or whatever I feel like discussing at that moment. You will also be informed every time there's a new episode of the podcast. You can find the link on the internet at the Swiss Roads View The Butterfly Effect on substack. com.