Alternative Consensus

Transcription

1 Alternative Consensus Rethinking Bitcoin-like Consensus Design Hong-Sheng Zhou Virginia Commonwealth University

2 Outline Towards a unified view of blockchain design A design example: 2-hop blockchain A design technique: Constructing blockchains via blockchain(s)

3 Talks so far Joe Andrew Vassilis Aggelos Jon

4 Motivation(s)

5 We don't want to put all eggs in one basket.

6 We don't want to put all eggs in one basket.

7 Good people worry about the future.

8 Good people worry about the future. anonymous

9 Can we do a better job than Nakamoto?

10 Nakamoto s design Most of tools were known Public keys as identities Time stamping Hash chain Incentives Proof-of-work

11 Nakamoto s design Most of tools were known Public keys as identities Time stamping Hash chain Incentives Arvind Narayanan s talk at NSF Proof-of-work

12 Nakamoto s design Amazing design Put them together Cute points Open (via PoW); easy to join/leave Suitable incentives Adaptive difficulty adjustment Scalable to a huge network of nodes; very lightweight communication

13 Nakamoto s design

14 Nakamoto s design the blockchain is backed up by a huge network of compu7ng power; censorship resilient; very trustworthy

15 Nakamoto s design the blockchain is backed up by a huge network of compu7ng power; censorship resilient; very trustworthy The flip side: lots of electricity has been invested in this system; not environment friendly

16 Nakamoto s design Cute points Open (via PoW) Suitable incentives Adaptive difficulty adjustment Scalable to a huge network of nodes; very lightweight communication

17 Nakamoto s design Cute points Open (via PoW) tricky; overlooked Suitable incentives Jon s talk Adaptive difficulty adjustment Aggelos s talk: [GKL16] Scalable to a huge network of nodes; very lightweight communication tricky; overlooked

18 Nakamoto s design

19 Nakamoto s design Hash

20 Nakamoto s design Hash

21 Nakamoto s design Hash

22 Nakamoto s design Alterna7ve View

23 Nakamoto s design Alterna7ve View (inspired by ideas in [Garay, Kiayias, Z., CSF10])

24 Nakamoto Blockchain: Alterna7ve View

25 Nakamoto Blockchain: Alterna7ve View

26 Nakamoto Blockchain: Alterna7ve View

27 Hash Nakamoto Blockchain: Alterna7ve View

28 Nakamoto Blockchain: Alterna7ve View Hash

29 Nakamoto Blockchain: Alterna7ve View Hash

30 Beacon- based Blockchain F Hash

31 F

32 Beacon- based Blockchain use the NIST beacon F1 Sign

33 Beacon- based Blockchain consider an environment friendly beacon functionality F2 Sign

34 Conven7onal MPC- based Blockchain run a conventional secure Multi- Party Computation (MPC) protocol Sign

35 our goal is to obtain a large- scale blockchain. Warning: Conven7onal MPC cannot scale. Conven7onal MPC- based Blockchain run a conventional secure Multi- Party Computation (MPC) protocol Sign

36 Broadcast Channel Broadcast Flooding

37 Broadcast Channel Broadcast Flooding

38 Broadcast Channel Broadcast Flooding

39 Broadcast Channel Broadcast Flooding

40 Broadcast Channel Broadcast Flooding

41 Broadcast Channel Broadcast Flooding

42 Broadcast Channel Broadcast Flooding Communication Complexity for 1 Message is Θ(n).

43 Lightweight communication protocols: constant c messages are broadcast; communication complexity is Θ(n). can scale to a huge network Heavy communication protocols: such as voting needs; Θ(n) messages are broadcast; communication complexity is Θ(n 2 ). It is not scalable.

44 Conven7onal MPC- based Blockchain our goal is to obtain a large- scale blockchain. Warning: Conven7onal MPC cannot scale. Communica7on complexity (n^2) run a conventional secure Multi- Party Computation (MPC) protocol Sign

45 only lightweight blockchains scale expect a lightweight protocol Sign

46 consider an environment friendly beacon functionality F2 Sign

47 if we can design a lightweight protocol F2 which achieves an environment friendly beacon functionality then we could make a better blockchain than Nakamoto's

48 However.main obstacle: splitting attack

49 spliung avack on a class of lightweight protocols Sign

50 spliung avack on a class of lightweight protocols Sign

51 spliung avack on a class of lightweight protocols Sign

52 spliung avack on a class of lightweight protocols Sign

53 spliung avack on a class of lightweight protocols Sign Sign

54 spliung avack on a class of lightweight protocols Sign Sign

55 spliung avack on a class of lightweight protocols Sign Sign

56 spliung avack on a class of lightweight protocols

57 spliung avack on a class of lightweight protocols

58 spliung avack on a class of lightweight protocols length ~ the resource existing players

59 spliung avack on a class of lightweight protocols not a concern length ~ the resource existing players

60 spliung avack on a class of lightweight protocols new players

61 spliung avack on a class of lightweight protocols a big concern new players

62 However.main obstacle: splitting attack Is that possible to fix the issue?

63 However.main obstacle: splitting attack Is that possible to fix the issue? Yes. players run a voting.

64 However.main obstacle: splitting attack Is that possible to fix the issue? Yes. players run a voting. Voting is a conventional MPC, which cannot scale to a large network of nodes.

65 However.main obstacle: splitting attack Is that possible to fix the issue?

66 However.main obstacle: splitting attack Is that possible to fix the issue? Yes. via external checkpoints

67 However.main obstacle: splitting attack Is that possible to fix the issue? Yes. via external checkpoints this violates the decentralization.

68 if we can design a lightweight protocol F2 which achieves an environment friendly beacon functionality then we could make a better blockchain than Nakamoto's

69 a class of lightweight protocols DO NOT work if we can design a lightweight protocol F2 which achieves an environment friendly beacon functionality then we could make a better blockchain than Nakamoto's

70 Open Question Proof-of-stake blockchain open Internet-scale provably secure

71 However.main obstacle: splitting attack Is Nakamoto s design OK?

72 spliung avack on Nakamoto s design? Hash

73 spliung avack on Nakamoto s design? length ~ the resource existing players

74 spliung avack on Nakamoto s design? length ~ the resource new players

75

76

77 However.main obstacle: splitting attack Is Nakamoto s design OK? Yes.

78 However.main obstacle: splitting attack Any other solutions against splitting attack?

79 trusted hardware based blockchains Sign

80 However.main obstacle: splitting attack Is this hardware based solution good?

81 However.main obstacle: splitting attack Is this hardware based solution good? No. Trapdoor available to a single party

82 Open Question hardware-based blockchain trapdoor-resilient

83 However.main obstacle: splitting attack Any other solutions against splitting attack? Yes. Proof of X X={Work, Storage, Human-work, }

84 However.main obstacle: splitting attack Any other solutions against splitting attack? Yes. Proof of X X={Work, Storage, Human-work, } useful work, combining work with storage, memory hard PoW

85 However.main obstacle: splitting attack Any other solutions against splitting attack? Yes. Proof of X X={Work, Storage, Human-work, } useful work, combining work with storage, memory hard PoW Are they good?

86 References Modeling idea: Garay, Kiayias, Z., CSF 10 Proof-of-Stake: Orborous; Snow White; Proof-of-X: PoET; SpaceMint; PermaCoin; PrimeCoin; PoST; memory hard PoW;

87 A Design Example: 2-hop Blockchain

88 so far a unified view for constructing (a class of) open blockchains has been developed existing proof-of-stake based open blockchains cannot scale to a large number of nodes

89 PoW/PoS- based Blockchain

90 PoW/PoS- based Blockchain

91 PoW/PoS- based Blockchain

92 PoW/PoS- based Blockchain

93 PoW/PoS- based Blockchain

94 PoW/PoS- based Blockchain

95 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T

96 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T

97 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B2 ṽk 2) < T

98 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B2 ṽk 2) < T

99 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B 2 B 2 nonce 2 ) < T H(B2 ṽk 2) < T

100 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B 2 B 2 nonce 2 ) < T H(B2 ṽk 2) < T

101 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B 2 B 2 nonce 2 ) < T H(B2 ṽk 2) < T H(B3 ṽk 3) < T

102 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B 2 B 2 nonce 2 ) < T H(B2 ṽk 2) < T H(B3 ṽk 3) < T

103 2-hop blockchain [Duong,Fan,Z.,16]... B 1 B 0 B 1 B 2 B 3 B 4 B 5... B 1 B2 B3 B4... time Figure 1: 2-hop blockchain structure Here, dot arrows denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the proofof-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain. H(B 1 B 1 nonce 1 ) < T H(B 2 B 2 nonce 2 ) < T H(B2 ṽk 2) < T H(B3 ṽk 3) < T

104 PoW/PoS- based Blockchain

105

106

107 ˆ < ˆ

108 2-hop Blockchain Scalable to a huge network of nodes [Duong,Fan,Z.,16] provably secure

109 V.0 2-hop Blockchain Scalable to a huge network of nodes [Duong,Fan,Z.,16] provably secure

110 51% Honest Mining Power Assumption could be challenged What about dedicated hardware? 黑科技 each new technique may have two sides a breakthrough in certain area may be a big disaster in other areas

111 51% Honest Mining Power Assumption could be challenged June 12, 2014 GHash.IO large mining pool crisis

112 All top mining pools are in China! They might collude for whatever reason

113 V.1 TwinsChain Scalable to a huge network of nodes [Chepurnoy,Duong,Fan,Z.,16] provably secure adaptive difficulty adjustment implementation

114 adaptive difficulty adjustment B 1 2 B 1 3 B 2 2 B 2 3 B 3 2 B B 1 B 0 B 1 B 2 B 3... B 1 B2... time Figure 2: TwinsChain blockchain structure Here, dot arrows (that link to the previous successful block and aempting blocks) denote the rst hops, and solid arrows denote the second hops. Green blocks B i s denote the successful proof-of-work blocks, B j i s denote the aempting proof-of-work blocks, and red blocks B i s denote the corresponding proof-of-stake blocks. Note that the blue blocks are from the mature blockchain.

115

116 how much is needed to mess up our system? The simulation results show that even with 70% of total mining power an adversary also needs for about 20% of total stake to generate abetter chain than honest party's. Given Bitcoin capitalization of $11.5 billion, 20% of stake is about $2.3 billion.

117 V.2 TwinsChain Scalable to a huge network of nodes [Chepurnoy,Duong,Fan,Z.,16] provably secure adaptive difficulty adjustment implementation incentives Mode switching Stress test

118 A Design Technique: Constructing blockchains via blockchains

119 i-hop Blockchain i=1, other than Bitcoin i=2, i=3,.

120 References BitcoinNG; Hybrid consensus; Elastico; ByzCoin; 2-hop blockchain;

121 Take home A unified view A design example A design technique

122 Take home A unified view A design example A design technique Thanks