EthCC 2: Patrick McCorry

okay awesome okay so I'm just gonna begin now I believe as a full-screen hi guys my name is Patrick McCrory I'm currently an assistant professor at King's College London and today I'm gonna present the work we've been doing I guess this is sort of like this time last year I was working on this so before I begin who's a way of steer channels raise your hand of university a channel is half the room who knows about like off key and protocols like the Lightning Network even more okay let the roughest amount of people so all these Austrian protocols typically assume that every party is online and watching the blockchain almost done a great assumption so in this work what we want to do is help alleviate that problem so if you want to go offline you could hire a third party to watch the channel in your behalf so that's the point of Pisa and now that could've dumped easier with our sponsors the theorem foundation a theory Community Fund and the Research Institute I'm about my wonderful co-authors as well good so before I begin what does he see a channel the idea is fairly straightforward we have a group of parties and they can lock coins into the blockchain okay so I put in one coin Bob heads and want coin in arles picture one coin now these coins are locked up okay and they can only be spent if we all agree or if we closed a channel now then what we can do in this dear channel we could actually like install a smart contract so three of us agree we install this smart contract it could be a poker game and now we can start playing poker locally amongst ourselves without interacting with the global network the way we do that is every time there's a new move in the game everybody agrees to the new state of the application so what's really exciting you know we can run smart contracts for free with instant finality which is really fast nice tear channels should give you two guarantees the first is safety Early's pollen safety if I have ten coins in the channel in this off chiyan protocol I should always get the coins I deserve and it should also guarantee as aliveness if I am playing poker and I'm about to beat Bob you know I play my hand about the beat Bob and I'm gonna win $100 but all those new incentive the sign nasty adopt it because if he signs it is going to give away the coins than me and he doesn't want to do that so in a steer channel we have a guarantee that an application can always progress and always reach a terminal state so if I'm gonna be Bob I should be always guaranteed that I can play that move and always win the $100 so the two guarantees the steer channel should give us okay and that's how we get this guarantee okay so typically we assume the only way you could really be mollis is if you stop responding so this is the poker example that I just mentioned you know Allah's pleasure ha and Bob doesn't respond Bob doesn't sign this data update so how do we ensure Allah's can always play or move we do this using a dispute process okay every steer channel and in fact every Austrian protocol houses dispute process for Alice can basically say blockchain Bob isn't cooperating on a trigger dispute I want to send the evidence which is the latest state of the channel the latest state of the game and then force you know the next move so the blockchain becomes this arbitrator that can resolve the speech in our behalf so how does this work why I should mention as well for our Cydia channel what we actually have is so basically when we play poker I play my hand and everyone has to agree to that latest yet well we're actually signing is not the state itself but the hash of the state so all we need to Center the blockchain is a signature from both parties a hash of the poker game on the counter and whatever counter has the largest new volume is considered the latest state of the game so to do the dispute Alice will trigger this dispute on the blockchain now there'll be this fixed time period where any party can send evidence to the blockchain all is is obviously going to send the latest state of the game where she's just about to beat Bob after this fixed time period the blockchain can resolve the dispute and it will say well this was the latest theater the steel whatever still has the largest counter I will consider that the final on the latest it and of course that's gonna be the poker game where Alice is about to be Bob it will redeploy the poker game on the blockchain I'm making this finished playing poker of either block gin is normal now why am I talking about this dispute process you know why is this a big deal because now we run poker off chiyan we have to typically assume that both parties always remain online I'm fully synchronized with the network because they have the Watts out for disputes so I'm gonna give you an example of why we need to do this let's say Alice has played poker with Bob she's won five games last say she's won a million dollars she goes offline she goes to try the bad Lambo because he's no rich now after playing poker that's we all do of our poker winnings so when alice is offline I'm just gonna try to get his money back okay so off Jian we've all agreed that Alice has won 1 million dollars playing poker Bob's gonna try to reverse that how does he do that he's gonna trigger a dispute okay he's gonna tell the blockchain blockchain Alice is not cooperating with me then he's gonna send an older state of the game you know an older state that was previously agreed where he still has his money so you could imagine the very first state of the channel bob has a million dollars the final state of the channel Alice has a million dollars Bob stand in his very first state that was agreed so we're ignoring all the future students now the block teens taken away you know tick tick and of the expiry time you know if the dispute proves has expires he can then redeploy the poker game and then withdraw his a million dollars so the question is is Bob gonna get away with this well the dispute proofs has expired and Bob will get the coins or will always come back online send the latest state of the game and protect her you know protect her winnings obviously in this case he's gonna wake up steals and the latest state of the game CEO keeper million dollars also prevent Bob from you know stealing her money but this is important we call this an execution fork so these parties are playing poker off chin you know they round the entire game locally amongst themselves and they agree the latest state of the game was at all's Hardware million dollars with us local on their computers it's not on the global network at all so they do an execution fork Bob wants to convince the blockchain that an older state is the latest it and then just forked the execution using the blockchain vollis was offline then Bob would have taken them a million dollars then even though if Alice comes back online and she as a leader state it doesn't matter anymore because the contract no longer has there were million dollars so this is pretty annoying the always online assumption basically means if you're using an e of TM protocol not just the Eternals you have to remain online fully synchronized with the network under wats out for disputes if you go offline you could lose money so the question is can we help alleviate this new security requirement you know a sort of fundamental to layer 2 protocols we conquer rid of it but can we make it a bit easier for the user not to have to worry about it and this is where Pisa comes in Soapy's is a leaning tower you know it's highly reliable it's been leaning for like a thousand years hasn't fallen over yet but it's also facing the wrong direction it's supposed to be going to the moon you know but never I get a Photoshop so yeah anyway so the whole point of Pisa is that is this a countable third party who could be hired to watch the channel in your behalf so if Alice wants to go offline she could hire Pisa give Pisa the latest it and then if Bob tries to cheat Pisa could respond on her behalf you know it's a very straightforward idea how we could believe you at this problem now for Pisa we had four different security requirements that we wanted to satisfy or just requirements overall the first is their privacy you know what about us the Achon oh you know the poker game battleship game a payment channel I don't want to give all this information to the third party all I want to give the third party is you know the Haas for example so steer privacy means that the watcher has no idea what's happening inside your channel what's inside your channel should be private to you unless there's a dispute the second property is fair exchange if I hire this third party and I pay them as you get a signed receipt in return you know I should have some cryptographic devid ins that I've actually hired this third party to watch the channel on my behalf so we need a fair to use protocol there the third property is order ones storage you can imagine we have a payment channel we do thousands of payments back and forth between Alice and Bob the lobster doesn't want to store every state in your channel if I hire the peas at our it should only store one piece of information so every time you give it a new job peas will only store the latest status you know you give it it won't store every internal channel stint and finally recourse as a fan also deterrent if this accountable third party cheats uncle Lou's with Bob and steals your million dollars they use it off some mechanism to penalize the third party for cheating you like a service level agreement they break the service there should be some recourse for that okay so in our protocol there's two different smart contracts the first is this the Econo contract as I mentioned you know that could be a bottle ship game poker it could be a payment channel could be lightning we don't really care you know with some of cheem protocol and then over here we have the PISA contract itself and the PISA smart contract is really simple it only has two pieces of functionality one you know store a large deposit from a third party other than to just wait around for evidence if anyone can prove the third party has cheated evaluate the evidence penalize the third party that's all our smart contractors as fiery very straightforward how do we set up Pisa how could you guys tomorrow we'll start running a watching service I'm watched channels and other people's behalf you know that's our accountable third party he has a smiley face he's excited because he's gonna make and he sends a little deposit over to the PISA contract and now he's signed up everybody can see that he sticked coins on he's ready to watch your channel and he can be held accountable how do we achieve Stier privacy as in if I hire Pisa how am I guarantee the Pisa has no idea what's happening in my channel this actually comes down to how how you design you know payment channels and steer channels and Plasma you know this works for most of all team protocols in this case what we actually send you know Pisa is a signature from every party a hush of the state on the counter and that's based on how we designed this tier Channel and Russ really thankful is that after we did this work most tier channels today are copy not not copy and they're using this design so that's awesome that means Pisa works out of the box ok fair extremes and payment so how do we ensure we get a signed receipt that we've hired Pisa and at the same time Peters guarantee they always be paired so just to simplify the presentation payments are sent off to you we don't have to do an aunty entrons action the higher Pisa because that would defeat the entire purpose of layer two you know you could do this vApp Amon Network like lightly in a ridin or have a dedicated one-way payment channel and what's really beautiful about one-way payment channels they are the only payment channel with the following property where the sender deposits coins the sender can go offline and there at no country party risk it's the only payment China we can go offline and not have to worry about your coins being stolen so we can use one-way payment channels here as well which is really exciting some assumptions to simplify the presentation we assume pieces already aware of your off Gian protocol you know we know where the address is on some of the appointment has been pre agreed you know what is the payment amount how long should peas or watch your channel for good so the new appointments fairly straightforward the customer Bob Sands over you know the new job the latest state that they want to be watched Pisa will do some sanity checks PZ will say okay can I use this appointment to actually resolve a dispute on the you know Isis run it locally owned by my local smart contract I say yep this can always be used to resolve disputes and that's really important now Pisa will stand over a signed received it will contain the appointment information a special harsh that I want to describe now and of course they've signed it as well now what Pisa will do is generate a random number s okay l hashas and sand over the hash as part of the signed receipt okay so you can see there s is known the Pisa Bob only knows the hush now what we do is a very straightforward trick that's well known in the payment channel world we just do a conditional transfer where basically Bob says the Pisa Pisa if you reveal the pre image of hitch before time T you can get these coins okay so a Pisa has to do is reveal the secret s now once Pisa gets this conditional transfer it's always guaranteed that every deals ass it will always get the coins you know it's a conditional transfer now once I send ass over the Bob Bob has a signed receipt you know there's evidence that Peters willing to take the job and now with this secret S we consider it a ratified receipt it's proof that Pisa has been paired okay so it's only ratified of the secret is sent over the Bob so that's really exciting okay now the next question is what a bob and pisa collude the cheat Alice okay so what happens is our Bob triggers a dispute while Alice is offline he sends an older state where he's going to get the $1,000,000 you know takes away pisac publish a new state it doesn't Oh My gods to Liat execution fork occurs pisa did not see of the de Pizan bob colluded and they stole alice's money oops so the question is can almost do anything about this you know she comes back online she's angry bob cheated her she hired pisa pisa cheated her you know is there anything she can do about it now this is why it's accountable you know it's an accountable third party Alice has a dispute record on the blockchain that there was a dispute on theirs is signed and ratified receipt the PISA was hired to resolve you know there was a dispute that pisa could have resolved peasy agreed to do it but pisa never did it so now the previous has history of forward all astir sends this signed and ratified receipt to the pisa contract pisa looks up the dispute that is the dispute and then pisa basically does the following okay given this receipt given the dispute coupies a sea of the day yes their pisa sea of the day no because otherwise this dispute wouldn't exist so unfortunately pisa then gets penalized you know pisa has a tear sad face his entire security deposit has been burned has lost all of his money for doing this in a revenge is sweet now there is an alternative to this scheme where all's could be compensated and i can i'm sure that drink you in a if you want but if you compensate all this then you actually weaken the security deterrent so any protocol where there's a single entity with a central security deposit will always have this problem was actually really interesting to actually understand okay so summary for the properties we achieved will steer privacy fair exchange order one stories and recourse as a financial deterrent now as we're going to see there this is not the only work on watchers you know this is not the first protocol OMA there was a talk by Taj my monitor is stealing Bitcoin 2016 and this was designed for Bitcoin and for the Lightning Network and the only goal was that if I hire The Watcher there should be privacy I sent an encrypted blob if there's a dispute the watcher can decrypt it and send the job but the issue there is order and storage every time there's a channel update I have to send a new encrypted blob to the monitor worse the monitor-kun taxi verify this could be used to resolve a dispute so I could send the monitor new junk on the monitor hosta store it serious not very practical but it was the first attempt the next ones Watchtower so Watchtower has some similar elements the PISA which is really exciting you can verify the job there's order one storage but the issue is that is designed for Bitcoin with the l2 protocol but that requires a new consensus rule in Bitcoin so a company deployed today so that's really frustrating and Bitcoin today for the Lightning Network we're still stuck of order and storage for any watching solution now there's Pisa and the contribution for Pisa took me a while to really understand but it was the Farex Jia's protocol on this idea of you know pronounced a recourse and actually having some guarantee that this watcher is actually gonna watch for you now part of that is compatible with Bitcoin you know we can actually do that fair exchange protocol over Bitcoin and there be no issue of that so we actually improved the watchtower proposal in that sense now what I do want to highlight is peace is not just a research project we're building it you know it's gonna get built assuming layer 2 you actually takes off Peters should be hopefully available on Bitcoin a theory in plasma whatever is going to exist it's really useful for any layer 2 protocol now I typically get these comments when I talk about Pisa one criticism which is fair is that whatever you're only hiring one watcher you know what if this one Watchers isn't reliable and they're willing to have their deposit burn what we're investigating is his idea of an untrusted coordinator there's a coordinator in the middle you know who sends it basically gets the job from the customer on the job is sent up the Dan Watchers if they accept you have now hired K Watchers but they all you know you have to get caravan to agree before the jobs agreed so what's good you're not just hearing one watcher you're having multiple Watchers in a way where you do have to trust the coordinator the next question is how do you prove liabilities and assets you know what if Pease is watching 1 million dollars of assets well there's only a 10k security deposit there's some risk there you know p0 could collude and make more money than they deserve we're investigating this paper called proof of solvency with this really cool because you can actually prove your out your liabilities and assets so I could prove this someone that I'm not running a fraction of reserve that I'm not over liable you know I'm all right if I am over liable you can also work out by how much we're just screwed as well and finally we're not gonna have a side chin there is a competing I guess protocol this building Watchers and I'm not going to name them but they want to build a really crazy side chin and we don't need that we believe is too much engineering effort we're just gonna build a distributed watching service on the way we've designed that is that everything remains off chin we're basically using you know layer to payment channels and that's really exciting there's a super simple solution for actually building this so yeah that was my future working thoughts of how we were going to go forward with this so two years later you know watching services Austria forward steer channels are on the verge of practical and deployable you know being used today you're probably gonna hear a lot about that during the week there's about seven teams here you're all building steer channels module unicorns need no longer apply you know layer two works we can use their two today especially on aetherium so thanks for listening no this is some of the work we've done over the years sprites was one of the first tier cha know constructions where we actually showed people how do you build this tier channel the second one's Pisa was is what I presented today the accountable third party who can watch the channel in your behalf and kids soon was SD a channel I presented what was more exciting is that we actually built the ste a cha know we build a battleship game we should have auto ship before if he's heard of the battleship game the two-player okay no one else has heard of auto-ship to people bismi is a turn-based two-player game we built it I mean one of the workout the steer channels really work if you want to work if you want to you know read it and figure out yourself I highly recommend not paper you know there's some trade-offs when using steer channels and we also have a Twitter for piece of research if you want to follow piece of research and Twitter and needs more friends okay I think that's everything I don't think I have time for questions do i oh I can take one or two questions if you guys have a question yep there Oh kids soon to see a channel so if you want to build a poker game you could use kitsune this is the way to build an off chin player to you know steer channel Pisa it's just the third-party watcher that watches this dear child yeah yep yeah so this is quite a cool observation so I'm gonna highlight my disclaimer is that as this is the case for any protocol with a single security deposit for one party what could happen is that you're the customer I only care twenty coins to you you know very cheap you always get those twenty coins what I could then do is get my Siebel on sand 80 coins of my Siebel all the kid eighty coins in my Siebel if I cheat you get the twenty coins my Siebel gets eighty coins so I should have lost a hundred I lost twenty yeah this is important so this is why we want to look good you know the proof of solvency one we could hopefully prove that we are over collateralized or we could prove our fractional reserve I think in practice a lot of people are gonna accept a risk I mean this is these sort of protocols are all based on risk you know you have a million dollars in your channel you make it 10 K back or whatever if I cheat I think we're only gonna discover that when there's some price discovery mechanism I think I can't prove that theoretically you know that's human nature that's gonna be really exciting to see yeah any other questions okay cool GG guys