[KeynoteSpeech] Evolution 2.0 of #Bitcoin layer with #AdamBack at #kbw2019 #Blockstream CEO

[Music] okay all right so good morning to people who got up this early so I'm going to talk about I start the beginning and talk about the way Bitcoin is organized and why it is organized the way it is and how that's evolved over time and how we can add new features to Bitcoin and how that's evolving so basically the outline is that we would we need the most Network protocols are based on layers and if you think about Bitcoin as the base layer it's kind of the tcp/ip and in networking terms there are multiple protocols optimized for different use cases based on IP so voice over IP a web traffic email traffic i.m traffic say they have different properties they make different trade-offs but they're all based on a reliable core protocol and in a tcp/ip case that basic IP protocol hasn't changed a lot in probably 30 or 40 years and so bitcoin is the intended to be the sort of reliable dependable base layer and the security anchor for a lot of layer 2 protocols to come so at present already probably three or four different variants of layer 2 that I'm going to talk about some more layer twos optimized for different use cases that can be built on top of Bitcoin so a quick recap of what interesting properties does Bitcoin have in terms of why we find it interesting and how it introduced the blockchain concept to the world say one of the things is that monetarily it's deterministic we know how many coins there will be approximately at any given time with the mining protocol and a very defined supply so there's no political committee or coin management group that's deciding how many coins that's mathematically defined from when it was released in early 2009 so I think that's one important property another one obviously is the security first that it's permissionless so that's one key thing about the internet that it is permissionless any developer can download software get ahold of a compiler and start writing applications so that's the way it is with Bitcoin and that's quite different to previous electronic financial systems needing an API from a bank or a much an integration from a credit card merchant provider was a quite permission type of thing whereas Bitcoin is very permissionless you can download some software receive some bitcoins write some applications on top of Bitcoin one key important part about the base layer is that it should be final so when you make a transaction the transaction should be finished and done so because of the way Bitcoin mining works it's not that instant it might take ten minutes it might take occasionally up to an hour to get one confirmation but over time it becomes increasingly final and that's important because all of the higher-level protocols depend on that security property say the layers above Bitcoin depend on the base layer for their security ultimately say you know talk about how Bitcoin is organized say the original source code release for Bitcoin was kind of monolithic you know it had components within it but the source wasn't that well modularized and there's been a lot of work on Bitcoin over the years since 2009 from hundreds of open-source developers working on the protocol and including a lot for moderate modularity improvements splitting things out into separate modules introducing features that help make layers secure and optimization of different parts of the systems so there are broadly two areas of the code one is the so-called consensus layer so this is the area where you would run into difficulty and risk a chain and act gentle chain fork if two implementations or two different versions of the same implementation differed in even the slightest way and so over time that's being increasing modularized because it's a particular risk point that a lot of attention has to be paid to if there are changes so that's the lip consensus module which is becoming a library so that other implementations can use it and also the way that Bitcoin changes have been introduced over the years has always been with an eye to backwards compatibility and so changes are introduced into Bitcoin via a so-called soft walk so it just means that an old wallet or an old full node can still function in the network and indeed you can just about run today the original version of Bitcoin and it will eventually catch up with a network it will just be very slow because there there are many optimizations that happened in the meantime they're also possible to add new algorithms and features so Bitcoin is organized as a the scripting system of Bitcoin is organized as a kind of opcode base spec machine or stack language and it's possible to add new objects to support new things they will talk about that scene it's important as well the system that you rely on be decentralized because centralized things are at risk of shutting down we should remember for example in peer-to-peer file sharing that Napster ended up being shut down and disbanded where decentralize things like BitTorrent kept trying and there are many examples of that so there were previous electronic cash systems and one of the speaker's here today is David Shan who actually invented some of the original electronic cash protocols and operated a company that had a more centralized architecture so Bitcoin differs from the previous generation electronic cash systems in being more decentralized and say better at surviving the longevity of a given company it's more of a fabric that anybody can use and better at providing finality because there's nobody in control that you can ask to undo a transaction or change something about the system and that that's counterintuitive but is some side effect of lots of cross checks and balances in the system so you know there are a large number of independent developers who cross checking each other's work but whatever software the developers write it doesn't have any force in the network unless the economic users choose to run it so that's kind of one economic check that people who are running full nodes just just power users or businesses like exchanges and payment processors will choose to upgrade or not and the upgrades are typically you know so far almost always being opted in unless as a bug to fix so that you can use a new feature if you want to you can upgrade if you want to if you don't upgrade you lose some incremental security assurance but it will still be compatible so as an example of a network of an upgrade that doesn't affect compatibility the there's a part of the Bitcoin protocol where you plug in a new node and it syncs so it fetches the full history of transactions since 2009 and as you can imagine that's quite a lot there it's on the order of 250 gigabytes today they're still fairly compact compared some other block chains because it's optimized for size and keeps States application state outside of the blockchain by design and that that system has been overhauled and rewritten four times each time becoming about ten times faster than the previous time there isn't that much left to optimize it won't get 10 times faster again so that's that's where that's got to but it's the illustration of the can I change process but there are other areas of the network protocol that are evolving so this is a recent work by Gregg Maxwell Parker to use some set reconciliation for lower bandwidth ways to pass transactions between nodes so bitcoin is a flood network when you when you make a transaction it gets broadcast through the network and so they tend to be redundancy in the internet working say certain reconciliation can reduce the sort of bandwidth waste that arises from sending the same transactions across the same link twice and because of that you can increase the connectivity which sort of improves the resilience of the network to different types of network attack at the same time was lower in bandwidth so this is something that may happen in the midterm future or maybe into the next year or something there have been a number of bits of library source code released and more recently a bit for this one another example something is happening at the moment there's no signatures so it's just a smaller signature it's more compact particularly for multiple multi signatures so signatures involving multiple parties it has advantages of a Bitcoin transaction is composed of coins and sometimes there are multiple coins that go into a transaction to make up the amount and so you can combine a signature across all of those inputs if they're from the same person it also has some privacy advantages so the with Bitcoin today it's sometimes possible to distinguish which what type of wallet created them so you can maybe distinguish a lightening channel set up from a multi-sig wallet from a single stick wallet and with no signatures in particular taproots some of that fingerprinting goes away and it actually improves scalability as well because all the blockchain sees is the default single signature and behind there in the case of an exception more details provided another interesting thing about introducing tional signatures is it shows that bitcoin is has a capability to add a new signature algorithm which may become important in the in some decades to come if and when powerful concept computers finally created it's a bit of an open question at the moment tends to be waves of sort of excitement about quantum computing but to date they've been very far short of being a threat to conventional digital signature cryptography that Bitcoin users say now on to the layering so there are various layers lightning was the first one at one of the most well-known and very actively developed at the moment there are many startups working on this including startups working on hardware wallets working on payment integration merchant adoptions so they payout in u.s. dollars euros etc and the user companion lightning it has you know it does rely on the Bitcoin main chain for security because if somebody tries to claim more money than they should you can contest it and so you can kind of use the main chain as the security assurance and normally you can operate entirely within the Lightning channel so it's just another way to store bitcoins that enables them to be moved off chain and if something goes wrong you can go on chain to claim the bitcoins that you're due so there is a slight shift in the security model because you have to notice that something was going wrong or delegate somebody else to notice that something's going wrong so that's what the reactive security model is about but the payoff is you get a much more scalable form of payment because very few of the transactions have to go on the chain and the chain is broadcast and expensive like it uses a lot of storage so as well as being about 250 gigabytes to download there are estimated be around a hundred thousand nodes around the world so it's a lot of bandwidth ultimately it's broadcast if we expect they're going to be adopted by many more millions of users then we need more scalable ways to use it and lightning is a great way to benefit from the Bitcoin base layer security and get more scalability it's also faster so transactions are immediately final sub second and typically cheaper as well and there are more more things happening with lightning so as a second version the people are working one now called l2 which adds place in and splice out which is basically a way to be more backwards and forwards compatible with non lightening wallets so on chain wallets and personally I would expect that mobile phone-based Bitcoin wallets would migrate to lightning mid term because it's just a better experience and can cope with the types of amounts that you would expect people to store and use on a mobile wallet so another kind of layer two is a side chain so it's a way to have another chain that's kind of like an altcoin but without any native coin so the only coins in it are bitcoins that go into it or potentially some kind of issued asset so some chains introduce user-defined assets like a tether u.s.

dollar coin or security token coins then there's a way to move money between the side chain and the main chain so you compact money peg bitcoins between the main Bitcoin chain and the side chain and then use the new features that you get from the side chain and a later time so a user who then holds the Bitcoin doesn't have to be the same user can peg it back out to the main chain so there's three examples here one they're very very entice one is a federated chain that's liquids merge mining is another way where Bitcoin miners can bind both chains and another one is drive chain and there are hybrids that do a bit of motor mining in a bit federates a red stock has their which is another side chain sewing a describe briefly the liquid watt liquid side chain which is a product by block stream it's for exchange traders and it's federated so the blocks are signed and not mined and they're signed by a federation so actually 2/3 of the members have to sign for a block to be valid and they do so with rack mount servers with HSMs in them that sit in their data center alongside their exchange equipment so it is a trade off but for exchange traders it's a it's a step up from single exchange custody and the liquid sidechain introduces a number of interesting features probably most famous being confidential transactions which adds a certain degree of privacy hides the values of the transactions and even the types of the transactions because there can be Bitcoin as well as tether and security tokens etc it has a built in atomic swap and some smart contract extensions so the liquid ecosystem has a lot of the building blocks you would expect wallets part of wallet support coming to different was provided by block stream third party wallet by renren there are 35 exchanges involved in the network - in Korea coin 1 and go PACs and it's a block Explorer and so if you're interested to try out confidential transactions you can download the green mobile wallet application on Android or iOS and try it out you can put Bitcoin in and make user to user payments with it so another older kind of layer - that hasn't actually been implemented but it's an interesting idea so it's just to show that there are different ways and a lot of scopes are add more types of layer 2 to the Bitcoin is a so-called private chain so it's basically the idea that you could have a chain which is just operate by surf servers as long as you had the ability to unilaterally withdraw from it so let's say there's a single server over here and it's signing blocks and you send it transactions and it puts them in blocks and it signs them and moving on to the next block you can run a full node you can look at the transactions and blocks that it's relaying and if it does something you don't like like it when it won't process your transaction or it tries to rewrite history you can just take your coins out and take them to the host chain so the host chain could be a side chain and there's the original idea but it could also be the Bitcoin maintained if the Bitcoin main chain had a couple of other new opcodes to support this unilateral withdrawal concept so unilateral withdrawal just means that if you want to take your coins out you just ask you just cert that these are your coins you show a previous block where you owned them in us in the so chain and then they're yours unless somebody contests it so other users of the so chain or sidechain operator can you know because it's a single server kind of so chain or a federated server they can contest it by proving that there was a later block where you transfer the coins somebody else and that would preclude you from requesting that it be sent out and this this kind of sidechain is basically you know the it could have it would typically be based on a you check so model so it's just another Bitcoin like chain and it could have different parameters it could be bigger it could be a little bit more centralized it could be faster so the layer two is still evolving so ribbon summon Samson who is a Korean some somebody lives in Korea and it works on Bitcoin I recently proposed something called a state chain which is a different configuration and somewhat similar to the private chain but build a ball with today's Bitcoin so you don't need any new features to do this one it has a unilateral withdrawal using some lightning-like features it has a trade-off that you can't split the coins apart so you put half a Bitcoin in it has to transfer around at that denomination so you have to kind of make change you know if you want to make a payment of a different amount you have to get paid back with a smaller coin whereas with the private chain they're varying sized Queens and they can make change on the side chain so it adds a possibility of blind signatures there is a bit of trust in the Federation to not conclude with users but other than that you know as long as a threshold of the cosinus of the sidechain or state chain are honest then they won't take your coins and if something goes wrong with the state chain you can take your coins out so it's a it's an interesting direction is it's just an idea stage it hasn't been another older one I think I first proposed this one in 2014 news extension blocks so it's a bit like a sidechain except that you're expecting that the main bitcoin chain should validate that the blocks on the sidechain the blocks on the extension block are valid and that's good in elevating the security of the extension block to the same as Bitcoin but it has a number of side effects say it does prevent coins you know it prevents problems on the main change so if you opt into the extension block you're the one taking the risk but it does import the potential for bugs particularly in non determinism so non sort of unpredictable behavior in the extension block into Bitcoin which could be quite bad as a side effect but in principle we could fix the determinism using a deterministic execution so you can verify the extension block logic in interpreted abstract virtual machine that is deterministic and an example of fact simplicity which I'll talk about in a minute the generally what makes it an attractive though still is that the it's effectively a block size increase so if you were going to increase the block size you could as easily do that in the main Bitcoin chain unless there was some reason to make a kind of compartment to try a feature that not everybody wants it to use so the kind of opt-in module so another idea proposed by Gregory Maxwell is to use the zoo knowledge proofs of execution so a more recent cryptographic invention called snarks and bulletproof Tsar another variant of that more recently so there you get some very new and novel mathematical concept of having proof that a program has run on some data and that proof can be relatively small like a digital signature and it proves that a program was run on the data that you haven't you've just seen the hash of the data and the new hash of sort of new block has been created and you can sort of verify that all the rules were followed in the transactions on this side chain it's an enormous computation for a snark or a bulletproof so there remain significant scalability challenges with it we need much much faster Starks or bullet proofs and stocks themselves introduce some novel security risks because they're very new in experiments of cryptography the bullet proofs use conventional cryptography but are not quite compact but it's an area of active research so at a point in which this kind of cryptography becomes efficiently enough it would could be pretty interesting so I would expect there will be more layer to things in the future and that's good because Bitcoin can benefit from different layer twos offering different advantages like better privacy or scalability in a different way to lightning so I'm gonna finish up with a lost topic which is a longer topic which is a general soft extensibility mechanism for Bitcoin and Bitcoin like blockchain so liquid being a Bitcoin like blockchain so it is a programming language quite low level programming language kind of like assembly level but with formal semantics and those formal semantics are designed to allow you to prove things about programs that prove they're correct or proof they always behave in the way you expect they behave so and because it's low-level there's a need to make a library of functions for high level things so the programs don't get too big so a jet is a kind of collection of library functions that have been pre implemented and validated this this is all work by Russell O'Connor originally dated back to 2012 and he's been working at block stream on this for a few years now and we've made some releases on it we're initially proposing to roll it out in liquids as a way to try it out and if that is interesting to people we might eventually propose it for Bitcoin and see what people think about it so it's an interpreted language there is an abstract machine that executes see some details about the machine the simplicity and there are three simplicity interpreters the one written in Cocke which is a general-purpose proof assistant is formally verified to execute simplicity programs correctly so it's not often you get an interpreter that you have a proof will always correctly execute all programs written in it's interpreted language and we also have a C implementation and there's a path to proving the formal correctness of the simplicity program I'll sorry the C implementation by using verifiable C improving it's equivalent to the coq implementation so simplicity is a mathematical type of language so it sounds difficult to think about how you would prove things but it's proven because it's very low-level and mathematical so they're just two pages of it these two pages are the full definition so it's done using kind of bit level operators and data structure concatenation and so forth so what could you do if you had simplicity available in Bitcoin today so we've talked about a couple of things here one of them were snore signatures you could implement Schnoor signatures as a simplicity program without requiring a soft fork and people could try it out we can make different versions of it and I mentioned lightning l2 which is a second version of lightning it needs another soft fork for something called no input with simplicity you wouldn't need that you could just implement it as is and it's also just a general more general programming model so you can write all kinds of things so a partially matched swap transaction non-interactive limit orders vaults are quite interesting so it's a way for you to store bitcoins such that you need notice to remove them from storage so improves the security because you can have bitcoins thoughts send a special transaction to the blockchain to notify the blockchain that you're about to take some coins out of the vaults and you have a week in which to cancel it and during that week other people who you can delegate to are able to cancel withdraw transactions so that protects you from first kinds of theft because third parties can notice your coins are moving or you can notice they're moving when you weren't intending them to move and cancel it and you can do all of these things with formal prove ability about constraints and invariants about the program so when is this happening so we did it develop a preview of simplicity last month and we're going to do a developer release with the Jets added to it so there's a library of common functions so the programs are smaller and we're targeting to make that available and liquid itself next year it's Bitcoin compatible so I may eventually become available in Bitcoin and become a general extensibility method for Bitcoin so I think that's interesting in making bitcoins sort of rate of change slower in a sense or at least it's sort of non backwards or it's it's sort of adding major new features process more automated say and another interesting thing is if you add let's say a noir signature using simplicity you could send a special opcode which but a special you TXO which held the simplicity implementation of version or signature and you could later make a soft fork with a faster C implementation and that would mean the software that hadn't upgraded would still have a full understanding it wouldn't be a soft walk it would just runs slightly slower say and then you could opt to upgrade to the C implementation which of the same feature which would be formally proven to be equivalent say that's it say thank you thank you you want to take any questions very quickly anybody's any questions anything click once twice okay thanks very much Adam thank you very much