Hiding Chains From Snipers Using Card Shuffling - George Kadianakis

okay hello everyone uh let me back up okay hello guys um thanks for coming to this talk in this very loud room i hope you can hear me okay people are going to be shouting i'm going to be shouting if you have any questions you can shout at me and we can do it in a bottom bit more like interactive way so today's talk is going to be about denial of service attacks against ethereum and i'm going to talk to you about um a few projects we've been working on my name is george ah yeah i should probably do it a full screen um [Music] what thank you justin okay so my name is george i work as a researcher on the ethereum foundation and this talk is going to be about the work we've been doing for the past five months um it's about protocols for defending against denial of service attacks on the beacon chain um maybe you think that denial of service attacks are boring and maybe you're right but i'll try to give you some like context on why they can be fun and why protocols to defend against them can be interesting so all right so ethereum is moving to proof of stake i think most of you know it and you know when we move to proof of stake everything is going to be beautiful gas fees are going to be zero everything is going to be perfect but um the threat of denial of service attacks still exists and this is because um let's talk like you know in proof of work when you make blocks to the internet you don't need to have like a a long lasting relationship with a chain you know you can just like be a miner sit on your computer mind mind push it out nobody needs to know anything about you although in proof-of-stake you have a much more like long-term relationship with with with the protocol and this means that your identity is public your ip is public this makes you much more vulnerable to attacks and the attacks we're going to talk about today is attacks on the block proposal so uh the queue you see there is basically people who have lined up to become the block proposers of the beacon chain so you know like we need to produce block every 12 seconds the way this works on the beacon chain is that we have some sort of election process um that looks a bit like this this might be the more complicated slide i have today uh it basically shows you that like every epoch every six minutes we sample 32 people we put them in a queue like this one and they propose blocks one by one so the identity of the proposers is public and you know who are going to be the next 32 proposers at any given point this is interesting because this allows an attacker to enumerate the proposers and like snipe them one by one effectively disabling the blockchain so you're going to be like you know why why why should i like why would anyone like disable the blockchain you know like apart from like batman and joker kind of situation where the person is insane why would anyone else do it and there are a couple of reasons you can like there are a couple of incentives you might have as an attacker to launch the analog service attacks against the blockchain um i'm gonna give you a few a basic one is you know like you're an attacker you short ethereum you denial of service the blockchain you go on twitter you say that ethereum is down you get money one is that the other attack is you're a miner you are doing mev scanning you see a very high value mev block you want it but someone else has it someone else is in the queue in front of you you kill that guy you take the mev um that's another way you can get money out of denial of service and there is more like intricate in protocol attacks you can do like you know buy us the randomness beacon you can do a bunch of stuff so i hope i motivated you enough to see some point in like defending against these attacks um and you know like the obvious way to defend against these attacks is to hide the proposer so you know in that queue before um ideally only the proposer themselves would know that they are there you know like so nobody knows who the next proposer is going to be but the proposer himself or herself knows that they're going to be the next proposer and when they propose they prove that this is the case so this is like the fundamental concept of single secret leader election protocols because they elect a single person secretly in an unchained verifiable way so in this talk i'm going to give you a bunch of approaches on how to build these protocols um [Music] to hide the proposers so specifically i'm going to start with a work we've been working it's not my work i've been working on this with the rest of the ethereum cryptography team it's called whisk and it's a election protocol based on shuffling [Music] and okay um so it's based on a paper by dan bonnet and other people who basically like introduced this idea of shuffling uh protocols um a few years ago i guess and we took that protocol we made it uh much more robust we put we wrote the code to implement it on the ethereum beacon chain uh we wrote the spec on how it's gonna work and we published it a few weeks ago uh for people to look at it so it has lots of crypto graphe i'm not gonna talk about cryptography in this talk i don't think this is like it's too loud but if you're interested uh please do find a whisk on his research and read more about it so the fundamental concept of whisk is this shuffling thing the shuffling thing is a is a is a concept from the like i don't know like the 70s i think when david chum introduced protocols to do anonymity on the internet and he created mixnets mixnets are like constructions through which your packets go through multiple hopes a bit like tor a bit like other anonymity systems and each each each each each node takes the packets puts them in a list and shuffles them and then after a bit releases them so it's been it's been happening since the 70s this idea of shuffling and the nice thing is that there have been cryptographic protocols to prove that the shuffling is correct so you know not someone can take the list of of messages and swap out a few messages they can cryptographically prove that they actually shuffle them correctly and randomize them and these are protocols that have people have been working for 30 years for the like for the realm of anonymity but this approach also uses them for the purpose of of of hiding proposals on the beacon chain so this is the main cryptographic like object of the proposal it's basically a commitment scheme k is a random value it's nice because if you if you if you if you i'm not going to go deep into this but the idea is that if you reveal k you can prove that you that you are the owner of this commitment but also anyone can take this thing and randomize it so that other people cannot like learn where it went you don't need to understand this so much but the idea is that everyone takes one of these commitments like all the validators of the beacon chain they put them in a bucket and then we shuffle the bucket for like a day shuffle it shuffle it shuffle it all the time and then by the end of the shuffling no one can learn which commitment of which validator is in which position basically and also using the cryptography i mentioned before you can prove that like the shuffles were honest and not some malicious person swapped out legit commitment for bad commitments so the idea is that at the end of like the shuffling phase you basically get like a little roll of tickets and each ticket represents a validator and you can open your ticket and prove that you are that person and and and and and propose a blog so this is like the super high level approach um [Music] and it works it definitely works uh we've written like the code that shows how it's done um one fundamental problem is that it has lots of cryptography that is not trivial like this proof the shuffling proof is a pretty complicated object i mean if you're like a zero knowledge expert it's not complicated it's something that you learn in the beginning of your journey as a serial knowledge person but still for anyone else it's pretty advanced math um and so the complexity of this of this cryptography is the main barrier to adopting this protocol um so there is that was risk i just told you whisk there is more approaches one can take to do this whole uh secret leader election thing uh polkadot has a different approach uh they call it sassafras is a tree uh the idea is that like um every validator makes tickets for themselves and then they publish it anonymously and then you sort those tickets and the winners propose the problem is the anonymous part relies on an anonymity network and this severely complicates the networking of of the system so you know like this approach is much simpler in terms of cryptography but much more complicated in terms of like networking so these are different trade-offs one can take to choose how to defend against denial of service attacks and there is a another approach which is what algorand does which is instead of doing a single leader election you do a multiple leader election so at any given point multiple people think that they're the proposers and they publish their blogs and then it's up to the network to decide who is the actual winner it works that also works but it also complicates the networking it also complicates the logic of choosing which block is the right one so this is another okay thank you thank you um all right so that's another approach so i just gave you like three approaches on how to do this thing um we're still investigating which one is better but like for the short term there is also like band-aid solutions we can we can deploy that are not like so complicated but can still get the job done the most basic approach is you know like you have each validator use a different ip for different things like when you when you propose a block you use a different ip than what else you did so that makes it harder to get denial of service so this like vpn like approach would be the band-aid solution we deploy for the short term until we build these more complex protocols so at this point we're like more on the contemplation stage we're looking at all the protocols we're trying to think like which protocol better suits our trade dose trying to optimize the shuffle proofs trying to see whether we can make do with different kind of proofs with simpler proofs uh and we're basically like in in an entire process of figuring out which protocol is best of us for us um and this sums up the talk um if you like it it has been pretty high level but still there is lots of underlying complexity that i didn't get into and if you're interested please feel free to send me an email or find me upstairs or any of that things thanks a lot [Applause] we do questions or we don't do that here okay if you have any questions feel free to shout them uh the question was what's the decision process for ethereum when these kind of things so it's it's ad hoc um like we published this proposal people come to us they say this is too complex we say you're right then we try to think of ways to make it less complex we try to think of other approaches um we're still like not in the stage where we put it on the road map we're still before that so we're still in the like optimizing trade dos thing i i i think like at some point we will have a simple enough protocol that we will get some rough consensus that this is what we're gonna go for and then like how we proceed after that it's still trying to fit it into the greater road map of proof of stake yes i got two now um something like a consensus algorithm like phantom opera where they do round robin [Music] round robin and uh each each validator is selected sequentially um you know we don't see it get um ddos that commonly um why doesn't that happen and forgive me i'm not a consensus guy so i'm not familiar with phantom opera as the idea but the question of why doesn't proof of stake get denial of service more frequently is a question for most proof of stake protocol since i think none of them maybe only algorithm is actually defending against these attacks so i don't know i think maybe you know the incentives for the like for ethereum for example maybe there is not enough stake in the like the marriage hasn't happened yet so there is not enough incentives for an attacker to do it or maybe they're focusing on other things or maybe um it's the kind of attack that if they pull it once then everyone is going to use vpns or something and i i honestly i don't know i hope it continues to be that way until we fix it but i don't know what yeah of course okay thanks a lot [Applause] you