ETHParis: Perun - Virtual State Channels

hello enemy hi hello everybody I'm Sebastian damla from Peru networks we are a research group within the Technical University of Darmstadt and we are researching state channels so why state channels this is the blockchain and blog trains do not scale very well we have the fixed block size we have a fixed average block time and as we know for example from the cryptic read his example block chains do not scale very well and as we can also see here we also have a high impending transaction count in Bitcoin we only get 7 transactions per second III and 15 not very good so a couple of solutions are increasing the block size changing the parameters showering is another solution and we are looking at off chain solutions here so there's plasma there's the K snarks and starts also coming up for scaling solutions and this talk will focus on state channels as a solution for scaling so for going off chain we have the following goals we won't have instant transaction processing so the parties can just have a two party protocol at which transaction is final we don't want to have Unchained transactions for each sub transaction we only have a transaction for opening and closing the channels we still want to have of course the same security guarantees and it also develops increased privacy I want to start with the easiest example which is a payment channel in a payment channel both parties they fund a contract a payment channel on the blockchain then their money's locked they do all the off chain payments can be like as many payments as they like and at the end of it they can pay out and what the block tendencies is only the net balance of all the payments right who knows payment channels or state channels in general who knows about the concept that's good quite a few people ok so I can go through this very quick I guess so that's just a basic payment channel protocol so Alice sends an opening request for payment she'll this is like a pseudo payment channel contract so she sends an opening request and also states how much she would like Bob to invest in the channel as she always s she has sent the request and she's this crest is already like acknowledged now either Bob does not reply within the timeout and then she can just refund it but let's now assume that Bob did reply within the timeout and then Bob funds it as well I'd know they have that payment channel open now that would exchange messages the messages contains the whole state so the state here would be the balance of Alan's the balance of Bob and a version counter the version counter is very important for disputes and now Alice sends for example the first payment of free ether to Bob by sending an updated state of to eight and her signatures Sigma a one Bob confirms every message that he received his signature and of course also Bob had said messages to Alice in which case he would send signatures and Alice would and sign back the new state now we look at a closing protocol where Bob is malicious so Bob wants to send the closing request with an obsolete state so let's assume they had a transactions in total the latest balance was 6 for the balance before that was 1:9 so this one is much better for Bob here six he has sorry that one was better for Alice she has 6 pop only 4 and here this one's better for Bob because he has nine and he submits version 7 without else knowing initially and when he see when he sends that looked at at this point the ledger only knows 5 ether that was the initial balance right so now the ledger knows Alice has 1 ether Bob 9 so that's the state that he submitted and now Alice has a timeout that's very important for for like having always a timer period in which the other party can react if there's wrong if the wrong state was submitted so now there's a timeout of 60 minutes in which Alice can react of course she does react she sends a new state this smart country can check that aid in this case is higher than 7 so this state will actually be initiated and at that point they can both withdraw their latest state now we want to do this more general which means we have like some game for example chess and they want to play chess and whoever wins the game wins the amount that was locked inside the chess contract for that we instead of like generalizing this idea again and again to payment channels we develop a concept which is called a state channel contract in this country does something similar to the payment contract that you saw before so it also keeps track of the money that was inside of it but now what you can do is you can sort of speak deploy again off chain and then play it and only at the end of it you can then close the state channel contract and you can actually have several games within the same stage and a contract also in parallel and yeah so those are the functionalities you can create it you can add a contract once a contract within the state channel note that there's no interaction with the with the blockchain you can execute actions within the state channel and then you can also close it so optimistically optimistically means no party misbehaves and adheres to the protocol in this case you can oh sorry you can do this on chain you can this you have to do this online obviously because it's a state channel contract but the the playing and executing is happening off chain for adding a contract let's say Alice and Bob have in the state general contract I've invested XA and xB that's like 10 and 10 and now you have like a sub contract in which both want to invest 1 so they want to play chess and the winner gets two in order to do this Alice she like sets up the initial state of the game chess she sends her signature and Bob's confirms with his signature now what happens is the game is instantiated within the state channel contract and from the so to speak the the wrapped the wrapped state general contract as like one fund less that is free-floating so to speak and it is locked up in that contract now they can play it and see you so this is like some pseudocode that shows how you could implement that so you have a state channel contract with users Alison pop a user actually is an address and a balance right I mean you also have an ID of the state contract that it doesn't matter right now and then only in the dispute case this one should actually also be read so only in a dispute case which you submit a state like an instance of the game of any contract to the state channel contract and then you could you could register it by which the instance is inserted into the map and then you could execute new actions that is like force playing on the contract because one party doesn't reply anymore so an instance of a contract is the code of the contract which in a theorem could for example be just the address and you could even use counterfactual instantiation to use the new skinny trade to so you you write a contract you know if you were to deploy the contract you know the address of it this would then be the code reference and the state is just like a serialize state of the app and you have a version counter and the version count is very important it has the same function as in the payment shown before so the state itself the contract say it's it always has to have likely user a left and right user the the reason this is not Alice and Bob translated because when we talk about state real networks we have so-called virtual channels where we have two channels within with the same contract and then you have a left and right user where user switches roles so and you also have the locked amount that was like the two ether for example in the chess game and then you have some app storage that's just epic and the state machine I mean this is just one way of implementing it is you have a you have a you can have a state machine in a contract the contract itself for example could not have any storage but you always submit for example the the init function could be like the constructor you submit some arguments and what you get back is a state that this constructor would cause and you can also execute the contract on that state mention the action and the arguments to that action and the terminal would just be like a boolean telling you is the contract finished or not and this is very important for state channel closing because if you want to close the state channel all the contracts that are just currently being run in the state channel should not should already in terminal yes so what happens now there's a dispute in a in a state channel so let's assume a situation in which Alice and Bob played I moves of it chess game she knows she now found out how she can set pop-up to checkmate and she signs the new state I +1 signs it sends it to Bob Bob doesn't react and and now she can register the latest state I on the state channel contract remember there was the registry function from before because before that all the gaming was just happening within Alice at Bob there was no interaction even with a with the state channel contract it was all just happening between Alice and Bob but now because Bob deviates from the protocol Alice has to register the state on the state channel contract Bob just like in the payment channel an example can try to submit in earlier state for example chess won but of course the state contract knows that I is higher than one so he does not accept it and I is the latest state now she can make like a forced move yeah so so now she can do like a move on this contract say move the King to g2 and that would set up checkmate and that that's the that's move playing on the letter channel now now we come to networks so for example you have Alice has a state channel with Ingrid during a using a state contract on the blockchain now we also have Bob with Ingrid a state channel with another state channel contract and now Alice and Bob want to open the state channel they could use they what they could just do obviously is just deploy another state in a contract on the blockchain right just like I was in Ingrid or Ingrid and Bob but what is much nicer is to create a so-called virtual Channel and the virtual channel is like reapplying this idea of a state channel contract recursively to run this contract in this and this channel and they are like mirror images of each other but where where the roles are swapped so in an optimistic case all this is happening off chain right because now you are already you're working in the state channel already which is not we just not require any interaction with the blockchain so this is all happening off chain in an optimistic case so how does it work if we want to create one they first initiate two instances of a virtual channel contract which will state general contract but of course because it's like mirror image of each other Ingrid would play the role of Bob in the left contract and Ingrid would play the role of Ellis in the right contract no they could deploy those contracts in their respective state channels and the whistle channels open and now they can use it for applying any contracts within of it now you can apply this concept recursively so you now you have two contracts two virtual channels here and now you can do like another virtual channel over sorry over the virtual channels you can even apply this to build multi-party state channels which means on the ledger you have two party state channels and then you deploy to those state channels so-called multi-party contracts and then you have true multi-party state channels you can even add someone not participate in like in a black black box form combine those different ideas so to have a virtual channel between Alice and Bob for example and here Charlie would only be an intermediate was it even Charlie I don't know no that was Ingrid I guess so here would be Ingrid and and then you you can run a multi-party state channel on a combination of virtual channels and state channels and this is an overview of all the work that we did so we can do I mean this has already been done and this were a couple of papers published at at those conferences here so you have virtual channels for payments in the in the in the original parent paper but it was just an published this year in the first paper that got accepted we had virtual channels but within the virtual channel you would only only run one contract but you could run several contracts in the state channel and then very recently we also submitted a paper actually it got accepted to Europe crypt on virtual multiple state channels the approach generally here is the modern cryptography approach so you define security protocols you just define the security of the protocols that you want to have you modeled the adversary and stuff like this and then you design the protocols and then you prove the security and this is usually an iterative process right because you don't really get a protocol right in the beginning so you prove the security of the protocol and then do it again and again yes so I mean we have seen many examples of ad-hoc secure designs by I also like very smart people but because they didn't really try to prove the security of it eventually there was like a bug in the protocol itself and I mean you also probably hear about the Z cache protocol problem that was released a few weeks ago and that was just one example of that that they were proving the security of the protocol after the fact that they implemented it and suddenly there was a huge bug in it there we are we are collaborating with Bosch on an on an implementation so what they've already done so far is a is a basic note software that still like the pair room note here and here the notes are connected on the one hand to an ethereal client so they can interact with a blockchain and they also have a web sockets between them so they can interact with each other and for the futures plan that they also have the G RPC interface but which for example edge devices or user interfaces could connect to yes the virtual channels will come in their next iteration and the get up release in the second quarter of 2019 and this is our roadmap so we applied to the German government for a fund to to get funding for five developers and then we'll also be hiring so if anyone is interested in like developing crazy cryptography and and building smart contract and the infrastructure for a theorem for the future contact us will be based in Frankfurt in dabshe at the beginning yes so the first goal is a go node for letter state channels it should have ng OPC interface then we'll follow the virtual channels it's also called meta channel as you will hear bye-bye young and then in the talk in one hour on handle factual this should worked and in a haptic in a hop Network I mean if you remember the slide before with Ingrid in the middle this is kind of a hop so you have many users connected to the hub and then over the app you can open a virtual channel and then follow multi-party state channels which is still active research how to do this in an efficient way and finally you can do cross blockchain virtual channels possibly with program that's pretty easy because it's also running theorem but you could also do it on fabric and that was a backup slide and that's my last slide thank you questions yeah please it's I'm not saying it's like super super complicated like not solved but like we want to focus on building a state channel network in a single blockchain realm first and then we want to expand it because I mean in a cross blockchain what you really have is you have like an intermediary that is connected to two block chains right then you have for example an intermediary that is acting in both chains then you could over this intermediary do a cross block chain channel yeah I mean how let's say new I mean we are very closely collaborating for example with counterfactual with with Liam and it might just be that we use the same protocol release so that we have actually compatible note software we are like talking about it right now we hope that we can find common ground so we have common protocols that we implement but like I said we want to focus I mean that's that's our vision for the next year that we want to do like a note software and go that can work for IOT devices or something and for example counterfactual is concentrated on unfocused on like a web like web like for example Mirrormask apps where you can use state channels within it but yeah but I'm not saying that it's like very separate from each other it could actually be actually be incompatible are you mean like in general why why is that interesting state channels from a business perspective you mean oh yeah okay so so the one easy answer to this is in this first year we are going just to build an open-source implementation because we think it's an awesome technology and we just want to want to have it built so there's not a like a big business perspective on that and in the beginning we really just want to have something running and and done but I think for the future you could also imagine like for and housing l4 and blockchain Kahn sources they would be interested in doing that like we have in the background we are talking to a couple of consortiums for example for energy blockchain networks for smart grids and that kind of stuff for them it would be very interesting to have smart to to have state channels for example to have to enable microtones actions you can also have micro transactions between for example cars at stations like like electricity stations you know kind of micro transactions even offline using virtual channels so there's even an interest in the in the industry to implement this yet we're just starting yet there's not a note yet if you want to look at a pretty far project already I'm counterfactual is there just I think it's basically already available and get up I think there's not a matter there's not a lot of documentation but the implementation is quite far already there you could use it for example for for in browser and applications already and like I said so Leon is going to give a talk on that in 40 minutes to be honest I I'm not very deep into connect so before I say half but Mario's his is from my team he maybe have a has a better answer yeah all the cool stuff oh yeah you told me they'd like bowled it down to a very very basic thing which was yeah one thing to add to that is this is one of the well I don't want to say problems but the protocols if you read the papers the protocols were designed and written up in a fashion that is that makes it provable in a like in a cryptographic modeling framework so the protocols were not written and designed in a way to make it implementable but to make them provable so this is something that you will realize if you read the papers and this is also a process that we're going through now to kind of look how we can transform the protocols still being provable or like make them more implementable yep all right any any more questions intermediaries I mean I just have the general answer than anyone else can give like enlightening you can do fees you can you can easily implement fees and model fees and this in this in this scenario so what you would do if you remember there was this one slide with the I don't want to like scroll vector and there was this one slide with a with a virtual channel with the intermediary Ingrid and then you have those two sub contracts where Ingrid takes the role of Alice and the one channel and Bob in the other Channel and then what you could do is design the the contracts and both that there's some fee left right so at the end they cannot pay out the full amount that they paid in but only a the amount minus a fee yeah so that can be easily extended in that way but that's like the I think the general concept that you can do in any state channel networks to easily include fees yeah [Music] yes yes yes in the recursive virtual channel model yes it's it's like it grows linearly yeah yeah because if you if you actually thing was that the yeah here so if you have a you have like a channel over another channel and then you have a dispute and then you would try to solve the dispute over this channel and if that doesn't work Bob is also malicious and you try to resolve the disputes and the corresponding channels here and those state channels and if that doesn't work you finally go with the chain and this of course every time you have a new timeout so the timeout adds up linearly but this is like an old approach where you have this call so called indirect dispute and in the newest paper there's also a model with a so-called dispute board and then whenever there's a dispute you can go directly on chain to resolve the dispute and the dispute bots we only have a constant time constant time out for waiting and this is then also much more similar to counterfactual we'll also have some kind of a dispute or yeah that's the direct dispute with the dispute yep thank you [Applause]