Dankrad Feist | VDFs Workshop: VDFs Applications | CrossLink Taipei 2019

hi everyone my name is like a quest I'm a researcher at the foundation and I'm going to speak about applications of VDS Jannik yeah it's more more than just lotteries as you will see in this talk and so to start like quick yeah repetition about my family functions I really like this illustration by Justin Drake basically what does very I would say function me it's a function so you have an input and a unique output you want to be a delay function so there's actually another input that is sets a difficulty that it essentially determines how long it will take to compute this function and it's verifiable which means it also produces a proof that the result was corrected and was computed correctly and this proof is much faster to verify then it takes to compute the original function right so one of the of course like most stalk about applications of VDS is to use them as a source of randomness so to go over this basically in the real world like a group of people that wants to generate some randomness and what they can do is they will come together going through roll some dice and then they do something with the reason things to say take the sum of all of the role of modulus X or something and ok but the problem with that is if they do that maybe one of them will look at the other people's dice beforehand and they will like modify how they throw their die and then she didn't change the result so we modified this protocol by making it an attack tool so they can't see the other ones dice and then at some point we turn the light on but now it's too late to change the roll of dice and then like then we have randomness where maybe they could have tried to cheat rolling the dice but they wouldn't be able to know how they would influence - exactly and basically when we use videos for randomness we should think of then transporting astrometric of turning on the light into the world into the digital world of objects basically VDS stopped people from turning on the light already and so this is what what we do anything on 2.0 where we need this good reliable source of randomness in the blockchain to face it to make sure of state work but also to make shoddy work where the right now which is this comment revealed scheme and we use the output of that scheme for them for the PDF and after that basically we have some pathway because like maybe it's not immediately filled on chain but then you can use this at randomness and I use this to select the next proposals and you know that you have like a reliable scheme to get randomness going forever now to talk more about other possible applications of us we have to introduce this concept of the so-called Amex so when we when we talk about VDS basically we always think it's as primitive that gives us like a certain time like time delay before which it can be evaluated well how do we know what that time actually is so what we do is we pour a lot of money into basic development and think now we have the fastest possible but of course as much if someone is willing to invest a lot of ton of money into developing a faster way we almost certainly know there will be some acceleration possible and basically a max is our best guess of what is the best thing that given like the best technology in the world right now could be possible churchy yeah the acceleration that could be possible but and so basically when I started thinking about applications for at the start we think of VDS being a cryptographic primitive right so it's this the kind of things that we know as hash functions digital signatures and zeros proofs that basically they're designed to like hold even versus the strongest possible assess we design these things the such strong security mountains that we think not even my huge governmental organization like the NSA would be able to actually break them and then on the other side here we have support of direct economic property primitives such as true work proof of stake other things that are more recent like Tommy curated registries and so on for which we know actually that they don't have these guarantees they are not like they are not to graduate lease a their only copy of economically safe so they then could actually be broken if someone is willing to put a lot of time and a ton of money into it into breaking those and so these are kind of like a new primitive that's kind of different and like who you think about with yes we actually might have to think change our way of thinking because if we set the amounts that we're going to talk about high enough then they were like a cryptographic primitive like if we set 200 and we develop a really good ASIC is very very unlikely that someone will be able to develop something faster than however once we go more into the direction of lower MX which some applications need they basically rely on nobody being able to compute it much faster than yes then we award the range of critical economic primitives okay so the next application I want to talk about it is preventing so-called long-range attacks so proof stake has this problem that that's called weak subjectivity so you know a proof-of-work you can always find the valid change just from knowing the Genesis block and following the chain it has the most work done on it so this property does not hold anymore in general improve of state because you validate as can swap in and out and once one third of the validators have changed or exited these valid tests are actually not found economically anymore and so now they can go back and say well my private key is not worth anything so I can just assign some message in the past it's not going to burden you and if not accumulated they can go back to the past to say oh at this point we even we're two thirds majority so we cannot start a new chain there we have nothing to do is because we don't have any stainless system as it currently exists anymore now the interesting thing is that VDS actually even the way in which employed in lithium 2.0 are going to mitigate this problem somewhat because if they start thought about doing us here like when they exited now when they want to build a new chain that change them to Messiah and so to miss all the vdf work that's going to that's that's gone into the other chain and rebuilding that will take a very very long time and so basically you can see that you can compute that yeah like the the extension of the weak subjectivity period is related to the Amex in the sky so like basically you need this extra time like instead of being able to start an attack immediately when you have some majority in the past you first have to catch up with the card chain on the media for you note that this is only true if you only start the attack like core stock if you from the beginning you want to attack it you could start at that point and start immediately building your vdf checks then this mitigation okay so another application that's quite interesting is also like one of the projects from the media Alliance is the proof of the Sibelius touch yeah so gia wants to build a currency based on consensus so like without registration and state but they want to build it on the amount of hottest space that you have on your computer and so the way they do that is that they have developed as proof of space that by which you can prove that you have a certain amount of hottest effects because they basically have a computation when you need to store huge tables and you have if you have installed them then like it would be a huge amount of computation to and recreate that now they just face to face those tuplespace they will need an immediate in between so like basically whenever someone has found a good proof of space they will need [Music] but okay so so basically between those groups of space we need to space that blocks out and they have basically is concept of two different kind of kinds of participants the network ones are the farmers those are basically the ones investing the work and in between you have time mozzarella PDF that guarantee is the spacing between the blocks and the block type the spacing that they provide those tiny Lords basically computed from the hash of the previous row space and that basically means that if someone has a really good fruit space which is secular to a varied or block hash thing and that would be picked up by the time we posted time law because they can compute the video program and basically if they have protection between then you could write like if you have if you even have a small amount of space and you could just like change change your input and tweak it until you get a good proof on your next selection and you could potentially and very quickly give them enough computation power you could know the different change as you're insane somewhat similar ideas behind fire point in this case it's called proof of space-time in what they want to build as a network that actually stores useful data and so instead of like this proof space they approve replication that actually shows that you store some data that can actually be useful in this case and then in order to create the proof of space-time what you do is you run this in sequence with PDF and each PDF output will feature here the next replication so that the aggregate of one of these shows that you have stored a file or number of replications of a fighting over a certain amount of time so in the end you would probably run like zero knowledge proof like a snack type of argument under student equity a super very short yet proof that you have stored a spy right here's one interesting idea on random orchard so that when you have when you have objects like you have this problem that people want to get their bits in at the very last moment because it's better for them not not to reveal what and the actual value of something is and so they always makes until the very last possible moment to get their bit and yeah HD snipe it away from the other participants of the option and so widening kind of all concept remembers where so-called can options that work by having like a candle burning in the room where they are chess program and when that candle has brought out the Ottomans and so it's hard to move when exactly it stops so that changes like yeah the dominant strategy in the options so that you want to get your bid in early because otherwise you're just not getting anything that one and basically the media fear replaces the candle so the vdf itself and the output of the vdf would be used to say when the period stock so it fixed it bit period and then retroactively you second candle actually this is when it stopped and since nobody knows where it is you better get you a bit in the beginning idea is like if you want to prevent it from turning into centralized exchanges this is by the inductive protocol so here here's the problem so you have like you have this percent less exchange you have like a make order that's put in it's this block H naught and then if someone wants to make a trade in the straight in it might be like a large trade or something that tells someone else like an attacker that oh actually I should like I this first because the prices to rise so they put in a competing order and and yeah basically like since it's on a blockchain like as long as it hasn't been included on in a block it's not determined which one we're going first and in the theorem for me the one that bit more gas would get in first and so they take the front one in front I could just ensured that he would be the first one to include their order which is kind of incentive satisfactory so here is one neat idea on how to remedy was basically as soon as you know you want to put in your order is that running a PDF and to regularly update the order with the current output of you vdf and basically the contract accepts whichever order has more video and that basically well I mean if the video is some more type at least that would ensure that the original order would get in where's the other way I would not take brassicas right here's another neat idea that is about zero knowledge proof so basically we can design zeros truths that can expire so we basically can build in the property that we want the zero knowledge proof to show and that we have like dinosaur computation but we only want that proof to be valid for certain amount of time and the way it could do that is by designing zero as proof that alternatively accepts the witness or correct PDF output and then when I give you proof there's no way for you to tell which of the two I have so that means that after after this sort of PDF time has expired it's possible for anyone to just have the proof and it doesn't actually prove anything anymore time of puzzles are another sort of application that doesn't actually directly based on the verifiable delay function parameter but both are based like basically the most sort of what most of the currently used PDF primitives also work very well for ten more puzzles and the hardware that is going to be performing the act is actually going to be useful for time lock rattles exactly and as as a des and so that's also possible application which we can use for a different flavor of expansion urge proof in this case let's say you want is very much proof where instead we want that it's not the softness that expires as previously but it is the zero knowledge property that expired so after a while the witness that have put it as owners proof actually gets reveal and how can you do that so here is that yeah one input that is the witness and then you prove to the proof yeah you give it also the correct time locked witness and then asically up basically you have two that would be a public input and then you anyone could later like lock that soft that time got passes you have the correct solution to that witness yes so as a summary like there there's like a very active field and finding those applications for verified linear functions we've seen quite a few year they yeah what basically is right now kind of the problem is that we have we have scores like very like applications that mostly rely on like relatively relaxed Emacs assumptions like randomness is also actually when you look at it and gradually ready to go analyst property and then many of the others the applications are more growing more than economic direction so they weak subjectivity mitigation yes you can do it on like even on a large name X but that would not have a very big effect that would only 10% if it's named X of say and similar for all the others like if you have a high name acts then those properties are not so interesting so basically what we need now is like to make it a good future economic primitive it would be great if we had better incentives around because right now this is what nobody has fully figured out how do we make sure that the best vdf actually will be developed in public and everyone will have access to them rather than then fully being developed by Sony what's the attacker system and in order to do that we need some continuous incentivization in the protocol for faster videos and yet the main difficulty with that is that this kind of a winner takes it all primitive like usually it's only the fastest one wins anything we're saying with other proof work type primitives you keep like everyone gets their water proportional to what to destined yeah thank you we have time for questions you [Applause] [Music] [Applause] you