CONSENSUS PROTOCOLS & BLOCKCHAINS. Techruption Lecture March 16 th, 2017 Maarten Everts (TNO & University of Twente)

Transcription

1 CONSENSUS PROTOCOLS & BLOCKCHAINS Techruption Lecture March 16 th, 2017 Maarten Everts (TNO & University of Twente)

2 2 Consensus protocols & blockchain

3 3 Consensus protocols & blockchain

4 4 Consensus protocols & blockchain

5 A shared truth /database/ledger 5 WP3 - Smart Contracts

6 6 WP3 - Smart Contracts Smart contract

7 CONCEPTUAL OVERVIEW BCT Application layer Transaction layer Consensus layer Network (P2P) layer Applications that use BCT (user-facing). Logic to decide whether transactions are valid. Algorithms and protocols to agree which transactions to add. Responsible for broadcasting information among nodes. 7 Consensus protocols & blockchain

8 CONCEPTUAL OVERVIEW BCT Application layer Applications that use BCT (user-facing). Transaction layer Smart contract Smart contract VM Logic to decide whether transactions are valid. Consensus layer Network (P2P) layer Algorithms and protocols to agree which transactions to add. Responsible for broadcasting information among nodes. 8 Consensus protocols & blockchain

9 CONCEPTUAL OVERVIEW BCT Application layer Applications that use BCT (user-facing). Transaction layer Smart contract Smart contract VM Logic to decide whether transactions are valid. Consensus layer Network (P2P) layer Algorithms and protocols to agree which transactions to add. Responsible for broadcasting information among nodes. 9 Consensus protocols & blockchain

10 Consensus layer Permissioned PBFT & family Permissionless proof-of-work 1 tendermint proof-of-stake 3 10 Consensus protocols & blockchain 2

11 CONSENSUS

12 tx tx tx tx tx tx Consensus: agreement on the order of the transactions in the ledger (database). tx tx tx tx tx tx 12 Consensus protocols & blockchain

13 13 Consensus protocols & blockchain Consensus: agreement on the order of the transactions in the ledger (database).

14 Consensus: agreement on the order of the transactions in the ledger (database). What if some network connections are cut? 14 Consensus protocols & blockchain

15 Consensus: agreement on the order of the transactions in the ledger (database). What if some of the communication channels are controlled by an attacker? 15 Consensus protocols & blockchain

16 Consensus: agreement on the order of the transactions in the ledger (database). What if some nodes are disconnected or crash? 16 Consensus protocols & blockchain

17 Consensus: agreement on the order of the transactions in the ledger (database). What if some nodes turn evil or are taken over by an attacker? 17 Consensus protocols & blockchain

18 DESIRABLE PROPERTIES FOR CONSENSUS Safety Nothing bad happens Liveness Something good will happen 18 Consensus protocols & blockchain

19 CONSENSUS TIMING MODELS Asynchronous Synchronous Eventually synchronous Each message that is sent is will eventually be delivered Any message sent at time T is delivered by time T+Δ Message sent at time T is delivered by time MAX(T+Δ,GST+Δ) for some unknown time GST (global stabilization time) 19 Consensus protocols & blockchain From: Andrew Miller, Cryptocurrency Security course

20 CONSENSUS FAULT MODELS Up to f nodes may fail. Honest/correct nodes Crash failures Byzantine failures

21 BYZANTINE GENERALS PROBLEM n generals want to agree on battle plan f of the generals are traitors n 3f Consensus protocols & blockchain Lamport et al, 1982

22 Timeline consensus research 22 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

23 Timeline consensus research 23 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

24 Timeline consensus research 24 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

25 consistency C Brewer s CAP theorem: pick two. A availability P partition-resiliance 25 Consensus protocols & blockchain

26 PROOF-OF-WORK

27 Ironically, with the current state of research, consensus in Bitcoin works better in practice than in theory. That is, we observe consensus working, but have not developed the theory to fully explain why it works. From: Bitcoin and Cryptocurrency Technologies, Narayanan et al. (2016) 27 Consensus protocols & blockchain

28 BLOCKCHAIN PLATFORMS USING PROOF-OF-WORK

29 A node can decide the content of the next block if it is the first to solve a specific puzzle. Block content (transactions) Block header Prev: H( ) Transactions: H( ) Nonce:. Prev: H( ) Transactions: H( ) Nonce: Puzzle properties: Easy to verify Difficult to compute Parameterizable difficulty 29 Consensus protocols & blockchain Potential next block

30 Anyone with (enough) computing power can participate: permissionless A node can decide the content of the next block if it is the first to solve a specific puzzle. Block content (transactions) Block header Prev: H( ) Transactions: H( ) Nonce:. Prev: H( ) Transactions: H( ) Nonce: In bitcoin: H( ) < threshold hash that starts with a number of zeros 30 Consensus protocols & blockchain Potential next block

31 mining Finding a block: simply trying many, many different Nonce values. Prev: H( ) Transactions: H( ) Nonce: Potential next block H( ) < threshold Threshold depends on difficulty, which adapts over time. Chance of finding a block: linear with amount of computing power. 31 Consensus protocols & blockchain

32 Chain with most work is considered authoritative. Probabilistic! 32 Consensus protocols & blockchain

33 33 Consensus protocols & blockchain

34 CPU GPU FPGA ASIC Gold pan Sluice box Placer mining Pit mining 34 Consensus protocols & blockchain From: Bitcoin and Cryptocurrency Technologies, Narayanan et al.

35 MINING CENTRALIZATION: POOLS 35 Consensus protocols & blockchain From:

36 PROOF-OF-WORK ENERGY CONSUMPTION Bitcoin hashrate: TH/s ASIC efficiency: 0.15 J/GH % of world energy consumption Price for censorship resistance? 36 Consensus protocols & blockchain From:

37 CONSENSUS, MINING, AND GAME THEORY Application layer Incentives Transaction layer Consensus layer Topic for a separate lecture? Network (P2P) layer 37 Consensus protocols & blockchain

38 RETHINKING PROOF-OF-WORK Puzzle properties: Easy to verify Difficult to compute Parameterizable difficulty Energy usage Proof-of-useful-work Proof-of-human-work Proof-of-space Proof-of-stake Centralization Non-outsourceable puzzles ASIC-resistant puzzles primecoin litecoin 38 Consensus protocols & blockchain

39 TOPICS NOT COVERED Confirmation speed & finality Consensus and hard & soft forks GHOST approach Ethereum s uncle blocks Attacks on proof-of-work 39 Consensus protocols & blockchain

40 PROOF-OF-STAKE

41 Peercoin Nxt Tezos

42 solution exchange Miner reward equipment energy From:

43 Stake/bond Miner (forger) reward From:

44 GENERAL IDEA Voting power ~ amount of stake Many variants, basic idea: H previous block id address timestamp < balance threshold 44 Consensus protocols & blockchain

45 POS POTENTIAL ADVANTAGES Less energy use Stakeholder incentives Centralization less of an issue (having an ASIC is no advantage) 51% attack potentially harder 45 Consensus protocols & blockchain

46 POS POTENTIAL ADVANTAGES Less energy use Stakeholder incentives Centralization less of an issue (having an ASIC is no advantage) 51% attack potentially harder However 46 Consensus protocols & blockchain

47 NOTHING AT STAKE PROBLEM Proof-of-work: miners need to choose which fork to divert resources to. 47 Consensus protocols & blockchain

48 NOTHING AT STAKE PROBLEM Proof-of-stake: mining a block is cheap, a miner can bet on multiple forks! 48 Consensus protocols & blockchain

49 NOTHING AT STAKE PROBLEM Proof-of-stake: mining a block is cheap, a miner can bet on multiple forks! No convergence/ consensus! + potential for double spending 49 Consensus protocols & blockchain

50 CHEAP HISTORY REWRITING 50 Consensus protocols & blockchain

51 CHEAP HISTORY REWRITING alternative history! 51 Consensus protocols & blockchain

52 CHECKPOINTS 52 Consensus protocols & blockchain

53 NOTHING AT STAKE COUNTER MEASURES Two blocks mined & signed by one entity (same stake used twice) Found two signatures for same block height? Claim reward + signer gets penalized. 53 Consensus protocols & blockchain See also: proposed slasher algorithm (ethereum)

54 PROOF-OF-STAKE R&D Academic work Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol - Aggelos Kiayias, Alexander Russell, Bernardo David and Roman Oliynykov (2016) IACR eprint: Snow White: Provably Secure Proofs of Stake - Iddo Bentov, Rafael Pass and Elaine Shi (2016) IACR eprint: Casper 54 Consensus protocols & blockchain

55 PERMISSIONED CONSENSUS ALGORITHMS

56 PERMISSIONED BLOCKCHAINS Quorum

57 Timeline consensus research 57 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

58 Timeline consensus research 58 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

59 Timeline consensus research 59 Consensus protocols & blockchain From: Cryptocurrencies crash course, Aljosha Judmayer

60 SETTING Permissioned: all participants are known. All nodes communicate with all other nodes 60 Consensus protocols & blockchain

61 SETTING Typical approach: Nodes elect a leader. 61 Consensus protocols & blockchain

62 RAFT 62 Consensus protocols & blockchain

63 RAFT 63 Consensus protocols & blockchain

64 PBFT First practical byzantine fault tolerant consensus protocol (1999) State machine replication Weakly synchronous Communication complexity of O n 2 Make scaling to many nodes hard! 64 Consensus protocols & blockchain

65 From: Cryptocurrencies crash course, Aljosha Judmayer PoW BFT Node identity Open/permisionless Permissioned Consensus finality No (probabilistic) Yes Scalability (#nodes) Thousands Limited (n 20?) Scalability (#clients) Thousands Thousands Performance (throughput) Limited Excellent Performance (latency) High Low Power consumption High Standard Tolerated power of adversary 25% computing power 33% voting power Correctness proofs? Yes 65 Consensus protocols & blockchain

66 RECENT RESEARCH: HONEY BADGER BFT PBFT has network timing assumptions, Honey Badger BFT does not (asynchronous) Robust, always makes progress (liveness) Well suited for distributed ledgers/blockchains Advanced cryptography Tested over Tor The Honey Badger of BFT Protocols - Andrew Miller, Yu Xia, Kyle Croman, Elaine Shi,and Dawn Song, CCS 2016 IACR eprint: Code available on Github: 66 Consensus protocols & blockchain

67 HYBRID APPROACHES Proof-of-work process to select committee High throughput transaction consensus by committee with PBFT-like algorithm. 67 Consensus protocols & blockchain

68 CHOOSING A CONSENSUS MECHANISM No trust Fully trusted 68 Consensus protocols & blockchain

69 CHOOSING A CONSENSUS MECHANISM No trust Fully trusted Latency? Finality? #nodes? Throughput? 69 Consensus protocols & blockchain

70 CONCEPTUAL OVERVIEW BCT Application layer Applications that use BCT (user-facing). Transaction layer Smart contract Smart contract VM Logic to decide whether transactions are valid. Consensus layer Network (P2P) layer Algorithms and protocols to agree which transactions to add. Responsible for broadcasting information among nodes. 70 Consensus protocols & blockchain

71 Consensus layer Permissioned PBFT & family Permissionless proof-of-work 1 tendermint proof-of-stake 3 71 Consensus protocols & blockchain 2

72 CONSENSUS ALGORITHMS Maarten Everts

73 FURTHER READING The Quest for Scalable Blockchain Fabric: Proof-of-Work vs. BFT Replication - Marko Vukolic Secure High-Rate Transaction Processing in Bitcoin - Yonatan Sompolinsky and Aviv Zohar

74 ACKNOWLEDGEMENTS & SOURCES Background images: Inspiration and images: 74 Consensus protocols & blockchain