Blockchain: Past, Present and Future

Transcription

1 Blockchain: Past, Present and Future P ROF. D R. IR. BART PRENEEL FIRST NAME.LASTNAME@ESAT. KU LEUVEN.BE IMEC-COSIC KU LEUVEN, B ELG I U M ETSI SECURITY WEEK THE VALUE OF DISTRIBUTED LEDGER TECHNOLOGY 14 JUNE

2 Outline Secure logging Secure transactions Secure execution: contracts Adding privacy Permissioned systems Do I need a blockchain? 2

3 Currencies = maintaining memory 3

4 Hash functions (1975): one-way easy to compute but hard to invert This is an input to a cryptographic hash function. The input is a very long string, that is reduced by the hash function to a string of fixed length. There are additional security conditions: it should be very hard to find an input hashing to a given value (a preimage) or to find two colliding inputs (a collision). f RIPEMD-160 SHA-256 SHA-512 SHA-3 1A3FD4128A198FB3CA

5 Digital signatures (1975): equivalent to manual signature Donald agrees to pay to Hillary 100 Bitcoins on Feb Public key Private key 5

6 Merkle Tree (1979) Using a hash function f to authenticate a set of messages through a logarithmic number of values x 12 x 5678 Applications: digital signatures, revocation root 6

7 Timestamping (1990) Collect documents and hash them with a Merkle tree Chain these trees together with a hash chain Publish intermediate values on a regular basis 0 f f f t1 t2 t3 hash chain 7

8 Timestamping: Surety Technologies ( 1994) Belgian TIMESEC project ( ) Estonia: Cybernetica 8

9 Distributed logging + Privacy 9

10 What is Bitcoin? (2008) E-currency with distributed generation and verification of money Transactions irreversible inexpensive over anonymous peer-to-peer network broadcast within seconds and verified within 10 to 60 minutes by inclusion in hash chain double spending prevention using a public decentralized ledger (chaining mechanism) Pseudonymous Money is linked to public key can generate arbitrary key pairs and move money around But in many cases identification is possible 10

11 Why does Bitcoin have value? The worth of a thing is the price it will bring 11

12 Market price in USD (market cap 111B$) 1 Bitcoin = $ ( at 17:00) Mount Gox China + Korea ban 2011 bubble Cyprus crisis 12

13 Market price in USD (market cap 111B$) 1 Bitcoin = $ ( at 17:00) Coinbase has grown from 5.5M to 20+M clients since Jan China + Korea ban Latest hack 13

14 Bitcoin Transaction: send money from one public key (address) to another one 50 BTC Transaction A In Out 8 BTC Transaction C In Out 10 BTC Out 42 BTC In Out 7 BTC 10 BTC Transaction B In Out 15 BTC Out 6 BTC 5 BTC In Slide credit: F. Vercauteren 14

15 Block Chain: a public decentralized ledger Bitcoin transactions Block 1 Block 2 Block 3 0 nonce1 nonce2 nonce3 f f f small small small block chain (170 Gbyte) t1 t2 t3 Also include in every block timestamp and difficulty level of puzzle 15

16 Block # first transaction in a block is a coinbase transaction: transfers reward + all transaction fees to the miner 16

17 Mining Rewards Total number of Bitcoins is limited to 21 million, each divided in 8 decimal places leading to units Figure by Chris Pacia 17

18 Mining has become industrial Slide credit: Joseph Bonneau 18

19 Mining equipment on Amazon (Feb. 2017) Sept 2017: $4500 Oct 2017: $3500 Nov 2017: $4098 Dec 2017: $5899 Jun 2018: $

20 Cost of Leaderless Consensus Distributed consensus protocol: whichever coalition deploys most hash power, has control of the block chain hash/second is a significant cost. not performing any useful task! Electricity + Networking costs: W/GH/s or 8000 cent per KWh: 1 block costs 25-50K$ electricity (12.5 BTC = +/-80K$) 0.3% of global electricity consumption; 1 transaction uses power of 35 US households in a day Profit calculator: Energy estimates: 20

21 Number of Transactions Per Day 2-4 transactions/s Peak: 7 transactions/s large share goes to a few addresses Alipay peak /s Visa peak /s Western Union peak: 750/s 21

22 Cost per Transaction transaction fee/block: 1-2 BTC average cost per transaction 5-140$ transaction fees: 1-4% of volume Visa fees: 2-5% Western Union fees: 2-10% 22

23 Alt CoinsToday: 700+ currencies derived from Bitcoin (see Slide credit: F. Vercauteren 23

24 Adding privacy Dash: $2040M Monero: $1934M Zcash: $ 780M Verge: $ 400M PIVX: $ 150M Zcoin: $ 100M 24

25 Total market cap 272 B$ 25

26 Ethereum (ETH) White paper 2013, live July 2015 Smart contract (scripting) functionality: deterministic exchange mechanisms controlled by digital means that can carry out the direct transaction of value between untrusted agents E.g. self-contained fair casinos, currency swaps Decentralized Turing-complete virtual machine Currency is called ether internal transaction pricing with gas (anti-ddos and spam) Ethereum forks 2016: DAO hack led to ETC fork (Ethereum classic) Q4/2016: 2 additional forks Quorum: permissioned ledger developed by Morgan-Stanley on top of Ethereum 26

27 Ethereum (ETH) (compared to Bitcoin) block time of 12 s (600 s) memory hard algorithm based on Keccak-256 almost SHA-3 (SHA-256 on ASICs) 70 transactions per block ( ) smart contracts (limited scripting) more complex reward scheme, linear volume (decreasing to limit of 21 million BTC) reward 5 ETH per block (12.5 BTC per block but decreasing) uncles get reward so no pools (orphans get no reward) proof-of-work may evolve to proof of stake (no plans) 1 ETH = wei (1 BTC = 10 8 satoshi) 27

28 Ethereum (ETH) graphs 1 ETH = $ 280 THash/sec Market cap 47 B$ 28

29 Some observations on Bitcoin Bitcoin community aspires to be mainstream but behaves as rebels this is not sustainable Volatile Paying and secure storage somewhat complex No peace of mind for users: if you are hacked, tough luck All miners are in China Incentives system complex Not clear that the system will survive, but some ideas will for sure

30 Open issues Resistance to attacks Sybil attack: attacker controls many nodes in network, can refuse relaying or favouring his own blocks Selfish mining attack Bribery Is Bitcoin incentive compatible? Convergence Fairness Liveliness Some proof exist in simplified models 30

31 Open issues Block chain technology for non-currency applications: Namecoin: key-value registration and transfer platform, used for domain names etc Ethereum: contract processing and execution platform using Turing-complete language Diamonds Can we avoid the enormous computational cost? Proof of stake: Algorand, Ethereum, Ourobouros Praos Is a zero-governance currency possible? Bitcoin needs governance for hard upgrades 31

32 Business Financial world dislikes distributed control full transparency unclear governance (or anarchy) uncontrolled money supply Restrict: write, verify or read (fully private block chain) 32

33 Distributed Ledger: a range of solutions Public Blockchain No central point of control by individuals, corporations or governments Permissionless to participate Concensus based on proof ow work Examples: Bitcoin Ethereum Consortium/Hybrid Blockchain Controlled by more than two individuals, corporations or governments Permission on participation from consortium necessary Arbitrary consensus mechanism Readability of the blockchain can be public or restricted to the consortium Example: RSCOIN (UCLondon) Full private Blockchain Controlled by one individual, corporation or government (no consensus needed) Permission on participation from owner necessary Readability of the blockchain can be public or restricted to one 33

34 Shared Replicated Permissioned Ledger Consensus, provenance, immutability, finality Party A s Records Counter-party Bank records records Ledger Ledger Party C s Records Auditor records Ledger Party B s Records Ledger Source 34

35 Shared Ledger Permissioned Smart Contracts Security and Privacy Consensus Smart contracts: $300M by 2023 (CACG 32%) 35

36 Do You Need a Blockchain? (Wüst-Gervais, 2017) 36

37 Conclusion: Blockchain Exciting new technology for distributed consensus most components are 25 years old Majority of applications only use the old components But still strong interest in re-engineering business models Novel ways to deploy crypto to achieve resilience, security and privacy 37

38 Pointers Nathaniel Popper, Digital Gold, Harper, 2015 Arvind Narayanan, Joseph Bonneau, Edward Felten, Andrew Miller, Steven Goldfeder. Bitcon and cryptocurrency technologies, Princeton University Press, 2016 A. Biryukov, D. Khovratovich, I. Pustogarov: Deanonymisation of Clients in Bitcoin P2P Network. ACM Conference on Computer and Communications Security 2014: S. Meiklejohn, M. Pomarole, G. Jordan, K. Levchenko, D. McCoy, G.M. Voelker, S. Savage: A fistful of bitcoins: characterizing payments among men with no names. Internet Measurement Conference 2013: R. Zhang, B. Preneel, "On the Necessity of a Prescribed Block Validity Consensus: Analyzing Bitcoin Unlimited Mining Protocol," In International Conference on emerging Networking EXperiments and Technologies - CoNEXT 2017, ACM, 12 pages, 2017 R. Zhang, B. Preneel, "Publish or Perish: A Backward-Compatible Defense against Selfish Mining in Bitcoin," In Topics in Cryptology - CT- RSA 2017, The Cryptographers' Track at the RSA Conference, LNCSm Springer-Verlag, 16 pages, 2017 Financial Cryptography conference series 38

39 Questions? 39

40 Bart Preneel, imec-cosic KU Leuven ADDRESS: WEBSITE: TWITTER: TELEPHONE: Kasteelpark Arenberg 10, 3000 Leuven ECRYPT CSA 40