EthCC 2: Vincent Danos

it'll be miracles so this is a talk about an example of a protocol that we're going to run the partially of change and the you know the purple is useful you know it's a general principle but here I'm gonna stick to that PDP example and I guess the general idea is that you're trying to keep the costs of running the protocol at the lowest possible provided all players in the idea is to it's very similar to the token in sense that there will be players and if there will be a change to resolve potential completes but the way it's design is that if there is no conflict which or some kind of risk profile then you pay nothing and it's a very easy fastest luck all right so yeah it's a two-player contract and the idea is that one player has data and another player wants to buy it so the players selling the data will be us as far as selling or server and he has served that piece of data item that a wants to a at the price that is the grid horn and on the condition which will be materialized by a predicate P and I struggle a little later what that relegated me so now it'll be abstract so this is not a matching algorithm so the server and the buyer already know what they want to do we've already narrowed down the definition of the sweat that they want to achieve between them so it's all just about how you're going to settle that swap cheaply and fairly of course we don't trust any party so there's a problem because if a pays first then it may be that a never gets the data and conversely if a sends the data in an optimistic way then maybe that the buyer actually never sends back the money so we have to do something about this so it's about skilling but it's economic skilling so it's interesting so let me elaborate on this for a minute so we have a free player game to implement two-player game the third player is not really a player it's a smart contract like in the top before and I'm going to call that math contract M and M is the trusted third party which runs on the chain and will be able to solve the challenges from either players if there are any so there are two constraints here one is that the trusted third party is not any trusted third that it's not very confidential see everything it does so we have to design around this trying to be careful that for example the data is not written on the chain the purpose right if it was made public there will be no point to try to sell it anymore and it's also expensive like I said so it should be used sparingly so d is that the honest path of interaction should cast nothing i refined that that so when is that a useful way to think about things beyond that particle example of someone selling data to someone else well the idea is that it's for a certain type of risk profile yeah you can run a contract of chains so the story goes if the players have a type at risk so you know they don't trust each other that's one thing but they also rather unlikely to cheat each other all the time maybe most of the time it's fine and then every now and then there's an attempt at a big fraud so this this is this type of you know business like risk profile that were thinking of and in that case trading of simplicity for Ana staff against custom complexity for deviations from the honest path is the good way to frame so one way to say this again is to say that the cost of repairing which we need because we can trust players we'll be high only if there is need to repair [Music] so what so now I'm going to lists properties that we want of our protocol before we resolve the problem so we want the PDP to be fair or atomic like long terms that means that one but he gets what he or she wants if and only if the other one does there is no of course no guarantee that the protocol will go through but if it does it will be in a fair fashion a second should be dedicated so that's on the seller side you don't want everyone to know to learn the data only the one that's only the the one player who's actually buying it and the data should be correct according to the predicate P and finally and this is the perhaps the fun part the protocol sound which means that for every negative or deviating an inclusive trace which deviates from the honest path there should be a unique culprit which is identified by the and that's party with the cheating party he is going to have to bear the curse of everything in the protocol [Music] detailed and the honor staff is a dominant strategy for both players and ends for the aggregate a rational adversary will not all right so now I tell you what the model is so we suppose that both parties have been interacted authenticated channel between them who is which is not true young we assume this we supposed as a contract sitting on chain that we're going to describe below so for to the description of the protocol are we used solid hours for any communication from the players to the contract and I will use that one's for us chain communications and there will be no communications from the contract to the players there will be just money transfers from the contract to the pointers I will also assume that the contract is an unbounded session counter because I have to be replay attacks multi-session attacks so have session numbers Jewish unique special numbers and I will also assume so that's not it's not actually implemented in oh darling where you can assimilate that I will also assume that the contract and set like a Tron demon so that means that the contract himself awake every Delta blocks and inspect if something has happened you know you can simulate this by triggering the that will the transaction but it's easier used as a primitive like that and I'm going to constantly just meaning the the mother contract is going to constantly set timeouts for obvious reasons all right so the protocol breaks down in four parts very small parts each of them so there is an economic problem this is where you know people put their money and we're going to see it in a second then there is enough chain communication that then there is Unchained commitment from the seller so this is this is an isometric protocol seller is actually behaving differently than buyer I've not given some much thought about whether we did the other way or will be interesting exercise and finally does the epilogue which is the time the buyer is given also the seller commits on the chain to tea and then the pie is given pay Alice is given a chance to challenge whether the data that the seller gave of chain to alice is actually correct or this is the epilogue it's a challenge response protocol so in the little depiction that I'm going to use the transitions of the protocol are labeled by value transfers I think the new notation is pretty intuitive and and I put a little Delta I timeouts on the mother contract each time the mother contracts and sets up the new timeout so mostly we look at the protocol from the point of view of the smart contract because the smart contract is calling the shots is making the decision is validating challenges or not and so it's a good way to think about the problem from the truth point of view because the mother contract does not see what's obtained so you have to not believe that something that should happen [Music] all right so let's look at the economic Rambo so that's easy the principle is that both play both parties provisions for being sued by the other party so the idea is that you know if you sell me something like switches worth one euro and I have to spend ten euros to see you or to challenge you because you need give me the one thing I wanted to buy then there's a problem right it's not worth my time online money over to see you for to get to get back my 1 euro so one trivial way to correct orders is to ask people to provision for being sued by the other party so that's what we do so both players do this the mother contract increments the session counter to protect the session as I said and sets a first timeout waiting on the the other player provisioning as well and then when the other player has provision than the mother contracts that's the second time out waiting for the commit move over the next day it looks like this the two steps commute but let's say Alice start by saying I want to buy this thing so on the arrow to the mother contract you see that the mother contract in the second step triggers a turnout to the clock starts running waiting for the next move and Alice actually provisions she associates is the amount of money else the seller will need to see you Alice if there is a problem so I'll discuss what that amount is of course it's not known in advance right because castes are stochastic will return to this and a is the agreed on price for the piece of data that eventually change to just a setup to the transaction so all the Epsilon's and the deltas is for deployment if you want will be considered to be negligible but I still want to trace them to check the economics of the of the various interaction powers so the mother contractor says this sets the timeout if s plays its own provisioning the club segments between the interaction between players and waiting for the next interaction [Music] so I've changed now I've chained what happened is that the seller sends the encrypted data did not send the data is that that would be trusting Alice too much so he sent the encrypted data and you send the in session identifier and you encrypt everything everything with a one-time key and yeah is that the seller I'm going to reveal this unchain and you have are the only person having the encrypted data so you'll be so I do this with my one-time key and they're not and then there's a key step which may not be which comes from working out the truth which is that Alice half Jane has to return an authenticated acknowledgement of receipt of the encrypted data when we'll see why it's important is actually critical so Alice returns earth chain to the seller a something that later can be used as a proof that Alice has received the actual piece of data that the server sent so this is the way it works I'm gonna call Emma the authenticated encrypted data which is time-stamped and so now let's see why is it so important that Alice sends back this receipt so remember the mother contract does not see the off chain moves so we need to protect Ali's the buyer from the sellers keeping sending absolutely nothing and just putting a random key on the chain at the next step so it has to be that the seller can only proceed if Alice has said okay I received something so that's first the first thing but then Julie we need to protect the seller against Ally if something so this will be taking care of one interaction path which is a challenge of alleys about the lack of data there will be another one which is about the quality of data you'll see ok so now we finally go to something is happening it's interesting to see that sofa in the protocol nothing had happened players as provision they may have or may not have talked of chain but no no player and actually to the point Alice has not learned anything about what she wants to buy yet which means that the timeouts can timeout in peace because nothing has happened information noise so now it's time for us to commit so as we said as publishes on chain something that's visible from all players and then the mother contract says sets up the timeout and that's a different analogy to turn out post that commitment from the seller and it's a timeout that can be much longer depending on the application which is the time we give to Alice to post a challenge to the interaction or to challenge that the path followed by the players was honest here I'm using honest in a technical way right means just as in the protocol right it you may be honest and not technically honest because you're just you know making a mistake or something so this is the commitment so you authenticate of course the key and the key means nothing to anyone except maybe for Alice if she actually received a message as was encrypted with that key everyone sees it and we've said all that and now we entered the interesting phase which is the epilogue it remains just one move for Alice to play in the game tree and so it breaks down in four possible cases either a agrees everything is fine so concretely it means that she now sees the key on the chain she has a piece of data that was sent to her so she can decrypt test the validity according to the predicate convinced herself that everything is fine and then post on the chain okay one bit of information and fine oh if a is not fine a can challenge so as we said you can challenge because you did not receive the data so you look up the chain which means concretely that you did not acknowledge receipt of the data right you may have received the data actually we'll never know but if you did not acknowledge the receipt then the server ass was stupid because he was not honest in technical sense it did not wait for your acknowledgment so by now if you have the data everything is fine you have not sent your receipt and the keys on the chain it's easy to not pay you have the data and you just say I didn't receive it and there's nothing anyone can do about it the mother contract cannot save you so you know that's just the seller being reckless not kosher is not following the protection offered by the protocol so you can so let's return to the enumeration so you can say I did not receive anything your Alice here or you can say I receive something but it's not proper so you can challenge the quality of the data and of course you can always not do anything at all and this is why the timeout delta2 is in place which will entitle us to get the money after delta two blocks have elapsed so let's look at them one by one so this is a agreeing and at the so you know you send this thing I agree and then the reaction of the mother contract is to transfer the funds so you give back the provisions to both players CA goes to us no no one should anyone so that's fine we get back the suing money M pays back the money that a provisions to be sued by us and then a which is the price of the data goes to the seller and as if you look at the balance of things you see that a has played - a s has received a and the mother contract has received epsilon and so the aggregate transaction for the players from the point of view of the game where we're emulating on the chain is minus epsilon so it's it cost me nothing to be honest I mean just just the way completely it cost to say yes and to post a key okay so interesting now suppose a challenger has all on the data so on the data not being of the proper quality so so if the challenge is valid then you fully reform a which means not only does Alice get back her money but Alice also gets back the money that was spent to challenge and that comes from the provision of the other player so that's cool and if you look at the aggregate balance of this this is not as good right we have to pay now so the culprit half pay has paid in which you can see because you has lost minus CA the calculus paid but from the overall system the contract has spent more money for than in the preceding case so as we said you pay when something something goes wrong but the but the yet you know this penalty or additional cost is incurred by the culprit so it's cannot fair and more to the point it's a disincentive to deviate so the point here is that there is no reason as should send corrupt data because it will not achieve what he wants presumably which is to sell so that no money and we'll have in addition to pay for being sued right this is the beginning of the argument of the dominant strategy okay so this was a challenges on data in a valid way now if the challenge is invalid then you imagine what we do we do the opposite so now it is a which pays for the cost of suing and the the balance from us is that he gets the money so in that case maybe the data is not actually correct there's no way to tell but what we can say is that if the data was incorrect then Alice was conceived because she didn't post a cry challenge right so same principle alright now what is what does mean that the data is valid here we have to say something right it's a computation which is concretely written in the contract so the obviously valid it is computed by the mother contract so if X is the challenge posted by Alice then first of all we have to check that the challenge is well-formed so we have to check that it's of the forms secret key of s apply to X and T what is the proper session identifier and so we extract the S which is the the payload of that challenge and now we pass this to the predicate so we applied the okay so what does mean the mother contract has seen that K right because K is the key that was posted by us well past that point in the in the execution in our path so the mother contract has a key there's no clue about the key actually was the key that were used to encode acts the Congo so it just applies that key that symmetric key and then check with the validity predicate whether that has the proper expected poverty return to at that point what are the concrete probability we want but this is the chain of checks that the validity challenge in triggers okay so that predicate once we've correctly opened the cargo and then we check the validity of something with the key submitted by us could be for example an obligation of results so it could be that Delta 2 is quite long and we extracted let's say a prediction so the data maybe says something about the future event based on that future even I'm betting I'm a and then even actually happens and I used some kind of Oracle compare the actual outcome to the predicted outcome and depending on the contract that's on a contract basis I may take the decision that this is invalid right so that the prediction was far away from the the actual outcome and so you know something I'm not going to pay or something it could be a a swap with another chain that's a Bitcoin chain where the piece of data is actually a transaction which moves bitcoins from the seller or anyone actually a proper transaction that moves to an addressed or submitted by Alice in the very first step and then the checking here is toward or the invalidity test here is to for Alice to fail to inject her transaction and in the sidechain but and to exhibit a proof the a failure by fishing in the transaction pool on the other side a double span by the seller so here it's actually the negation of validity which is provable it's by counter example you see that transaction was not correct because here's another one and it's a double spending which means so when I said the timeout could be long the turnout has the length of the time it takes for Alice to all the reasonable time it takes because it's stochastic for Alice to actually mount a challenge if Alice was cheated so it all depends on the in the case another remark here which kind of frames when you would you like to use this kind of technique is that the data can be absolutely gigantic it doesn't matter because it's moved off chain but when you start challenging what you actually challenged with if it was a giant file then that would cost a lot which means that the see the the provisioning for suing so the CA which is a provision by s to be challenged would be at least the costs of the memory footprint of the data on the chain so it would be a little bizarre you know it would be like give me that movie I pay you five euros but to for me to do this you have to provision I don't know 1000 either why not you know if you're if you're certain that you you're not going to be dishonest so you have to be careful and so if you know it as I said the Gianna stuff is dominant so if if Ali's falsely challenges in a case like this Alice will have to pay this enormous amount of money so maybe it's not this type of application that we have in mind but it works so now it remains to check the challenges on low data so you know maybe I'm going to go over this quickly so this we actually talked about this already so it could be that S didn't actually send anything of chain so in that case Alice will challenge and now it's a response either the seller says no no I did send this and proof is that you acknowledge that and he is it so the mother contract can perfectly check that proof it's easy it's sign so that's what's written here and you need a little Delta fraternity to let the seller respond to that challenge and if the challenge is proper in meaning the seller is absolutely no way to counterclaim then [Music] then the money at least will be refunded whether she actually received the data or not that's the remark we made before but but if she did and she can challenge successfully this means just tells the seller is an idiot ok so ok this is just the thing I said and this is the other thing so now a bit of commands to conclude so about the economic dominance of being honest so we see that the agreeing is for for Alice's or always a dominant economic elite the dominant strategy for example if we compare with not responding at all we see that in the latter case Alice pays the cost of the seller triggering the timeout so it's of no interest to Alice and it doesn't change anything for the for the server so a is incentivized to keep on the rational the honest path which is rational so we have all these properties that are repeat here the the most notably the fact that being honest is economically dominant which is interesting with parameters which we talked about already there's a problem of estimating fees which is not reduced here fees can be varying because you know the system is congested and blah blah so you know that as well as I do and now I want to conclude with that funny little slide which I call players versus the chain so Anna's path is dominant for the players which is good but it's actually terrible for the chain because the chain actually makes money when players misbehave so [Music] you know it makes money out of bad behavior but by by this don't get paranoid principle you only actually pay the chain the miners who have the stakeholders only if the players misbehave so there's a kind of a DS alignment between the money the China wants to make if you wish and the money the players wants to make so but you know nevertheless you can hope that having loads of well-oiled no zero contention smart contracts where every player is happy we like cumulate into tiny little epsilon that will amount to more money than just profiting off bad players and that's it thank you for your attention