Lawrence Kirk - Extropy - Ethereum London

[Music] okay yeah thanks Wendy for inviting me thank you all for coming out I'm not gonna talk for long so no you'll want to go and try out token card in the pub so okay so it's need to just mention what I'm I am i run a consultancy in oxford called extra P we do butch and development security etcetera what might be more interesting for you is that we also along with a partner run a number of workshops for developers so pretty much every weekend now where we're running some workshops in this certainly through interested in certain noise proofs we did a proof workshop last weekend and we planned to hold these pretty much every month so if you're interested in any of those they're all free and as some of you in the audience have already been to some of them so just get in touch with me or check out the website and sign up for those okay it's not about me so this is a talk about a constantius mechanism and it was developed along with this company saying I was working for them they're a Berlin startup so I work with them for a couple of years so she's not new I'm afraid but because the last meets up you had Silvio McCauley from Al Gore and talking about how a grant works and because there's concerns to make and borrow mechanism borrows a lot from I grant I thought it might be interesting for you to see what we have done with it so we we wrote a paper about this if you're interested you can look it up eyes on the Royal Society open science website so it started off because the this year obtained he was very much in favor of proof of work but one of the problems that people have with it especially because we were looking at the time at small devices that we wanted to run nodes on one of the problems with proof of work is it's that the amount of energy I mean he really may be slightly out of date now thinks is true a few weeks ago but Bitcoin network was taking the same amount of energy years he by is Becca stone so looking at how could we could we develop a different mechanism that would use less energy because we were targeting small devices we were targeting devices to put into vehicles so we were trying to find something we would use less energy and we came up with this thing called proof of Conal work I don't know where the name came from exactly it was the CEO who thought of that but it had to be called proof of something and then the rest followed and we came up with a two-stage mechanism and I should point out this is really this is for private networks this is not for of public network this is for private networks on etherium and it's a two-stage mechanism we start off with a whitelist of nodes who are interested in mining and from that we select a committee and then from the committee we then select a winner who will produce the next block the selection of the committee is done via cryptographic sortition which is the file we got from our grant the selection of the winner from that committee is then just basic proof of work so quite a simple idea the cryptographic sortition I the features you need for that is that the nodes need to know themselves whether they have been selected on for the committee so this runs for every block there's a new selection of a committee so the nodes need to be able to determine themselves whether they have been selected and then the other nodes in the network when they verifying the blocks need to be able to verify that the the the miner that produced the block was actually on the committee and this also then involves some kind of identity so we need some private keys involved here or some identifier for the denote this is based on some work again and we've got this to mark around verifiable random functions nice nice things where you take a key a secret key and a seed I put it through your function and it gives you some random outputs but also proof of that output and then other other nodes can take the random output and the proof and the the public key corresponding to the secret key check it and decide whether that was actually the correct output on the function so quite straightforward this is what used by Al Gore and so their their algorithm for doing sortition is this so quite complex but they take the there you go the seed and then the roll also and the secret key so the roll is because their permission things differently and produce a hash this is the random output and proof they then also wait the the the chance of getting into the committee is also waited to do with the number of tokens you own I know when the from a talk last meetup people some people didn't kind of like this idea and wanted more the idea of kind of one account one vote or something but it's quite difficult to to do this in a way that is civil attack resistant anyway so this is the the algorithm for from Al Gore and so this is much more complex than the one that we went with this is a slide that was saying produced to explain what we were doing and there's a slight mistake on it this is not quite true here but I think the basically I do is very easy to follow so we're producing blocks each block has a seed we produced this this function and do the sortition and there is a mixture of some public some public information and some private information so you're getting private keys from the various nodes here mixed with the public information of the block seed and from that we can do the sortition function to decide whether each one of these modes will be selected to be on the committee so we've culled the ones green here that were selected and the one in the purple has not been selected and then we go to the next block and we just repeat the same will be the same process the actual formula we use and there are various options for this what we have done we take this seed from the previous block so our here represents the block height and then from that we can you can do it in two ways you can either sign that to get your seed for the current block the other thing you could do is to just do a high here if you're doing a hash that's quite nice because it makes it deterministic so if you imagine you're a node using this this protocol what you could do is you could work out going forward just by hashing going through hashing the seeds repeatedly you could work out there makes a thousand blocks what the seeds are going to be and then you could work out using your own private key whether you will be selected for the committee and if you're not going to be selected for another 500 blocks say then you could go offline and then one of them come back when you are going to be selected and take part if you do it by signing that makes it perhaps a little me harder to attack so a malicious attacker would have to would not know in advance what the seeds are going to be then the actual sortition itself it's is quite simple really and here represents a target committee size and this is the the total number of nodes that are in the wireless so we're just taking a percentage of the whitelist size and saying we're going to have that that's going to be our threshold so say you've got 16 nodes altogether on your whitelist and you want to target committee size of 8 then you want you're going to get 50% here and then we take the seed for this block add block height we just sign that with our private key so that's where our private information comes in and then we apply a hash function to that and then normalize this between 0 and 1 and then test out against the threshold so that's quite quite simple quite straightforward then it means this then that yeah that just tells you if you if you lower than that amount then you remember the Committee and you can then go and do the proof of work and produce the next block is that all ok other block change design differently similar things where say with net they've done it they here they have kind of a reputation function involved as well but a similar kind of thing I know this is a sortation is quite a generally useful beautiful ography and so other people have used it nice things about this the the terms of scalability we're always talking about a percentage of the wireless size so you can adjust this and if you have suddenly want to increase the number of nodes in your your network you can still keep the committee size the same size if you like or you can adjust it how you like and the the actual time to reach consensus does not it's not influenced by the committee size RIA it's just the difficulty of the proof of work and that so the committee size doesn't affect the total amount of energy where we're going to be using I'm sorry it does please total mine change but that doesn't increase the consensus times right if you now let's see well we're still using proof of work so the same rules apply so many organizations of the chain can occur but if you're thinking about security although those you can get reorganizations you could start minding your own blocks but you still have to take into account the committee membership if you're doing that so it's not just a question of solving proof of work you also have to do the committee membership part as well so the security of this this effectively gives you increased security for a small committee size so you're getting this kind of security of the whole this whitelist but you're actually only doing proof of work on the nodes that are in the committee so you're getting more security for less energy from this if you're wanting to attack this you would need to try to figure out what which nodes you know you know Copts know is gonna have to figure out which nodes they're going to be on the committee for which blocks and so it makes the malicious attackers job quite a bit harder the original design we had for this was a little bit more complex so we initially had some anomaly detection as well so we had the idea of adding some AI into this so there would be a a neural network would have been trained to look for anomalies and that will be running on a node and that would be checking the network for anomalous so for malicious behavior and also for things like the the the difficulty of proof of work so if we needed to increase or decrease that and that could then interact with the the parameters of the blockchain to to change that so either you know increase are difficult to say or if you found there was some malicious behavior going on you could eventually throw people out to the whitelist so original design had this and also this anomaly detection followed a similar pattern so the mode chosen to do the anomaly detection would be chosen as following the same process we did we started to do this and then it got quite complex you have to kind of synchronize the kind of the two processes a bit and also the clients we were talking to I really just wanted this this simple version and weren't really interested in the ir part as well so that god got put on hold you probably have thought of some problems about this i'll mention a couple but then you can come up with some more one that we see it's possible to get a community size of zero so if you only have a few nodes in your network it's possible that the the cryptographic sortition will come back and none of the the noise will have been selected for the committee and which point your network just stops you can't proceed you can't produce new block and produce a new seed so that's it and that is quite a problem no and I mean doesn't if you have you we do we did have a client who just wanted a hundred percent of their nodes involved in the committee each time yeah yeah you could have larger than the target size yeah definitely yeah yeah so yeah criticized is a problem also there's the the problem that we were looking at this on private networks and look particularly the consortium who may be running their own servers I'm running their own nodes each of which will have a hash and hashing power and they probably are thinking that everybody's hashing power is roughly equivalent for doing the proof of work but somebody for their malicious could actually farm out the proof of work to some server there's got a lot of hashing power and then if they're selected onto the committee they can pretty much guarantee every time they're going to win the proof of work right so that is another potential problem whitelist governance as well we just took a very simple thing to start with where if you're on the whitelist you can then add other nodes we started looking at how to set up layers of nodes and allow some kind of voting's so maybe using quadratic voting so that people could form a consensus on which knows may be malicious and then throw them off after a certain time but I guess quite quick gets quite complicated eventually the other that the ideas we had as well was instead of using proof of work we thought about using maybe a proof of elapsed time and we could use some trusted hardware with that you could also use proof of authority so you could just select your committee and then just say take it in turns to to mine a block and then you're not using any energy you have the problem there with liveness I guess because you you not necessarily guaranteed that the people are going to be selected on the committee or the ones they're going to be doing it next so at least with proof of work you know that I started getting involved but whatever this was you know these are all options for the future so our initial client we took a fork of death in November 2017 just after there's a hard fork we added this consensus mechanism in we reduce the the size of the dag down to 64 Meg's because we were targeting small devices so this was particularly we were looking at putting these on raspberry PI's we put in on a PI 3 and on a PI zero we were trying to move it down onto two microcontrollers as well so we really needed to reduce the the memory footprint that was needed another problem we had was that because this is on a private network and on a public network you get the minor of a block we'll put their address in the block because they're expecting a block block reward and they're not going to put somebody else's address in there otherwise they will lose out on a private network and in this case where it's permissioned you could have a someone producing a block who is not on the whitelist or and but on the committee putting somebody else's address into the block and pretending that they produce the block and then get a block getting accepted so we had to change the block header and actually get the - to sign the blocks before they were sent out so that we could prove that the the minor the correct minor did Ashley a producer block a little bit of benchmarking we did recently not many nodes and a small committee size we we started at probably average amount this is on a private network got up to about 600 actions per second at one point then we had another client who was running this and increase the block size got at over a thousand transactions per second so we increased reasonably it's really just a question of lowering the difficulty so we got the difficulty as we reduced the difficulty obviously the block time drops so we were doing this about you know one second maybe but then you get the problem of getting lots of uncles because of network latency so happy medium was about three to five seconds for a block time and then it was just a question of increasing the block size just to get more transactions in which which worked reasonably well I think our signing mechanism took too long and that was slowing things down as well so we need to work on that all of this is open source so the the paper has been published describing the algorithm that gets it version is also open source now I'm starting work on a parity implementation so it's going to do what versioning Rost instead but yeah it's all open source if you want to try it out get involved with it future yeah we'll try parrot aversion maybe we'll try and introduce this anomaly detection again although it gets quite complex it's quite a lot involved there we thought about doing some yeah using zero knowledge because this this is act of signing and doing all the validation can get quite intensive and so if you're ending up with a large block chain it may be advantageous to rather than happen to repeat this computation you can do something to that similar to a coda are doing where you're they're using recursive snarks to validate blob chains very very quickly so may try to do something with that just to cut down on the time that we we need to take in in all of our verification okay that's the end of my talk this my contact details there if you want to get in touch to ask more questions or you can ask questions now just this we wrote this for private networks and I I don't I mean we can't really whitelist things very easily on a public permissionless network so yeah if you you could have every one but then you get the idea if someone's malicious then how do you how do you get rid of them trying to produce blocks or trying to turn the committee's excluded from the committee well they can just donate their hash power to a committee member who they yeah yeah so that's why I was saying we need to look at we need to get the governance working and look at the anomaly detection to do that so that you can stop people so hopefully that will we want in him an anomaly detection to try to detect that behavior and try to work out if the same accounts are always producing the the blocks then maybe you would try to lower their their reputations the network the nodes need to trust each other just some extent yeah yeah well you need some mechanism to try and enforce that yeah so we do have a client who'd use this and have built an application on top of this and it's a consortium I don't if I can say who the other they're like the largest largest shipping and haulage companies and are using this for supply chain so yes I think it's about to go in production soon so hopefully hopefully well yeah don't send me yeah so we initially have a list of addresses in the Genesis block and we have some more contract new Genesis block with a with some addresses in there and that's the initial modes that are on the whitelist and then you need some sort of Governors to then change that and add note in the right yeah exactly so when you set up the network you know you create Genesis block and you put the the notes that you want in there so how are we getting around some of the issues we identified and how are we creating things for the client so yeah we need to really develop this further so you know we produced this this first version which I think we're the security of it wasn't great because it still does have some potential problems and so we need to look more into the particular things like the governance and anomaly detection to get around this yeah I thought you heard yet yeah yes I mean this is just something we you know we wanted to try this supposed to be from quite a while ago really we like proof of work so I think we feel very secure about having that still in there and cryptographic sortition seems a very neat solution so you seemed a good a good fit but yeah we could you could put proof or 30 in there but then you do get the problem I guess of the liveness that you may end up with you may end up choosing her and no that's not actually going to do anything and produce the next block although we also have the problem is there a committee size so where I've seen it used now sometimes I think it's perhaps you're overused but where I've seen it uses a particular width consortium where they have some companies come together they kind of they may be competitors they want some to share some information they don't really trust each other completely so this is a way for them to do that okay this is a way for them to do that and to be confident in how the information you know whatever they're sharing how they're going to be confident about that or how that the transactions are verified it doesn't always make sense particularly we've had instances where this between one company who decided to set up a network and to me that doesn't make so much sense although I also have known companies who don't trust their department so they effectively you've got a kind of consortium of departments so they're all a little bit just crossing each other so yeah yeah so no we haven't cuz we started this you know back in about 18 months ago before I think so yeah if we can get yeah if we can get the funding to do it yeah I'm not sure how I mean this is still well you know we're still looking at proof well I'm not sure we going to work with TM goes for into you know took my zero and things I don't know they're sort of proof of elapsed time as well so yeah it's nice idea I guess you might have I don't know yeah I I'm just thinking about this private private change I I mean the the guys at a theory I must you know somewhat cleverer than me that I wouldn't want to you know even think about I'm sure that anything a properly yet [Applause]