Alternatives to Blockchains. Sarah Meiklejohn (University College London)

Transcription

1 Alternatives to Blockchains Sarah Meiklejohn (University College London)

2 fully decentralized cryptocurrencies 2

3 fully decentralized cryptocurrencies tx tx(addra addrb) 2

4 fully decentralized cryptocurrencies tx tx(addra addrb) mining (generate transaction ledger) (generate monetary supply) 2

5 fully decentralized cryptocurrencies tx tx(addra addrb) mining (generate transaction ledger) (generate monetary supply) append-only transparent pseudonyms 2

6 issues with Bitcoin lack of fungibility 3

7 issues with Bitcoin lack of fungibility hashing rates are out of control 4

8 1.5 EH/s (1.5 x H/s)! 5

9 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability 6

10 1.5 EH/s (1.5 x H/s) to achieve 7 tx/s! 7

11 70GB and no end in sight! 8

12 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection 9

13 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives 10

14 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives 11

15 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives 11

16 alternate storage Lightning Network truncate after a certain amount of time? 12

17 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives 13

18 alternate proof of 14

19 proof of stake use of computational resources represents stake in system other forms of stake? (icon by lastspark for the noun project) 15

20 proof of stake use of computational resources represents stake in system other forms of stake? old coins proof of coin age tx proof of burn (icon by lastspark for the noun project) 15

21 proof of stake use of computational resources represents stake in system other forms of stake? old coins proof of coin age tx proof of burn tx tx coins coins coins coins tx tx proof of use (icon by lastspark for the noun project) 15

22 proof of stake use of computational resources represents stake in system other forms of stake? old coins tx proof of burn proof of coin age tx tx coins coins coins coins tx tx proof of use tx <time-lock coins> tx <vote on blocks> security-deposit PoS (icon by lastspark for the noun project) 15

23 proof of stake use of computational resources represents stake in system other forms of stake? old coins tx proof of burn proof of coin age tx tx coins coins coins coins tx tx proof of use tx <time-lock coins> tx <vote on blocks> security-deposit PoS are these secure? how can we tell? (icon by lastspark for the noun project) 15

24 proof of stake (icon by lastspark for the noun project) 16

25 proof of stake? (icon by lastspark for the noun project) 16

26 proof of stake? in proof-of-work, cost means you choose (icon by lastspark for the noun project) 16

27 proof of stake in proof-of-work, cost means you choose (icon by lastspark for the noun project) 16

28 proof of stake in proof-of-work, cost means you choose (icon by lastspark for the noun project) 16

29 proof of stake nothing at stake in proof-of-work, cost means you choose (icon by lastspark for the noun project) 16

30 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment (icon by lastspark for the noun project) 16

31 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment (icon by lastspark for the noun project) 16

32 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

33 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

34 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

35 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

36 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

37 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment stake grinding how do miners get chosen? in proof-of-work, can t influence this decision (icon by lastspark for the noun project) 16

38 proof of stake nothing at stake in proof-of-work, cost means you choose in proof-of-stake, address with punishment stake grinding how do miners get chosen? in proof-of-work, can t influence this decision in proof-of-stake, address with stake modifiers (icon by lastspark for the noun project) 16

39 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives 17

40 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives not suitable for many applications! 17

41 issues with Bitcoin lack of fungibility hashing rates are out of control lack of scalability lack of consumer protection attacks on mining / misaligned incentives not suitable for many applications! 18

42 RSCoin [DM NDSS 16] RSCoin monetary supply decentral central central ledger decentral distribute central transparent? y y n pseudonyms? y y n computation high! low low 19

43 user (generate transaction ledger) bank (generate monetary supply) 20

44 user bank 21

45 user who are the s? (anyone bank authorizes) bank 21

46 how do s collect txs? user who are the s? (anyone bank authorizes) bank 21

47 (chained transactions) lower-level blocks how do s collect txs? user who are the s? (anyone bank authorizes) bank 21

48 (chained transactions) lower-level blocks how do s collect txs? user consensus? who are the s? (anyone bank authorizes) bank 21

49 (chained transactions) lower-level blocks how do s collect txs? user consensus? who are the s? (anyone bank authorizes) bank higher-level blocks (transactions + coingen + authorization) 21

50 (chained transactions) lower-level blocks how do s collect txs? user consensus? who are the s? (anyone bank authorizes) bank higher-level blocks (transactions + coingen + authorization) 21

51 consensus tx 4 service 2 2 tx user tx 2 3 tx: simple adaptation of Two-Phase Commit (2PC) 22

52 service user tx:

53 service user tx: 1 2 t r a n s a c t i o n s 23

54 service user tx: 1 2 t r a n s a c t i o n s 23

55 service user tx: 1 2 t r a n s a c t i o n s 23

56 service : user tx: 1 2 t r a n s a c t i o n s 23

57 service : 2 : user tx: 1 2 t r a n s a c t i o n s 23

58 1 service user 1 1 tx:

59 s check for double spending service user 1 1 tx: using lists of unspent transaction outputs (utxo) 24

60 signed yes vote service user tx:

61 service 2 2 tx user tx: bundle of evidence contains yes votes from majority of s in shard 26

62 s check validity of bundle by checking for signatures from authorized s service 2 2 tx user tx: bundle of evidence contains yes votes from majority of s in shard 26

63 and if satisfied they add transaction to be committed and send back receipt tx 4 service 2 2 tx user tx 2 3 tx:

64 consensus features conceptually simple scalable! T = set of txs generated per second Q = # s per shard M = # s comm. per per sec = tx T 2(mtx+1)Q M scales infinitely as more s are added! 28

65 compared to Bitcoin s 7 each new adds 75 tx/sec 29

66 (chained transactions) lower-level blocks how do s collect txs? user who are the s? (anyone bank authorizes) consensus? (2PC) bank higher-level blocks (transactions + coingen + authorization) 30

67 (contacted based on shard) how do s user (chained transactions) collect txs? lower-level blocks who are the s? (anyone bank authorizes) consensus? bank (2PC) higher-level blocks (transactions + coingen + authorization) 30

68 user bank -collate transactions -allocate fees (-add coin generation) -audit s -authorize s 31

69 user bank 32

70 user 33

71 Certificate Transparency CA (icon by parkjisun for the noun project) 34

72 Certificate Transparency website CA (icon by parkjisun for the noun project) 34

73 Certificate Transparency website CA client (icon by parkjisun for the noun project) 34

74 Certificate Transparency website CA client (icon by parkjisun for the noun project) 34

75 Certificate Transparency website CA client goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 34

76 website CA auditor client (icon by parkjisun for the noun project) 35

77 website CA inclusion proof auditor client (icon by parkjisun for the noun project) 35

78 website CA inclusion proof auditor client auditors (efficiently) determine if certificates are in the log (icon by parkjisun for the noun project) 35

79 website CA monitor auditor client (icon by parkjisun for the noun project) 36

80 website CA monitor auditor client (icon by parkjisun for the noun project) 36

81 website CA monitor auditor client monitors (inefficiently) detect bad certificates in the log (icon by parkjisun for the noun project) 36

82 website CA monitor auditor client (icon by parkjisun for the noun project) 37

83 website CA monitor auditor client gossip (icon by parkjisun for the noun project) 37

84 website CA monitor auditor client gossip auditors and monitors ensure consistent view of log (icon by parkjisun for the noun project) 37

85 goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

86 auditor inclusion proof client auditors (efficiently) determine if certificates are in the log goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

87 auditor inclusion proof client auditors (efficiently) determine if certificates are in the log monitor auditor gossip + auditors and monitors ensure consistent view of log goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

88 auditor inclusion proof client auditors (efficiently) determine if certificates are in the log monitor auditor gossip + auditors and monitors ensure consistent view of log certificate is in monitor s view of the log goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

89 auditor inclusion proof client auditors (efficiently) determine if certificates are in the log monitor auditor gossip + auditors and monitors ensure consistent view of log certificate is in monitor s view of the log monitor + monitors (inefficiently) detect bad certificates in the log goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

90 auditor inclusion proof client auditors (efficiently) determine if certificates are in the log monitor auditor gossip + auditors and monitors ensure consistent view of log certificate is in monitor s view of the log monitor + monitors (inefficiently) detect bad certificates in the log goal: don t let clients accept bad certificates (icon by parkjisun for the noun project) 38

91 opaque centralized transparent decentralized 39

92 opaque centralized transparent decentralized 39

93 opaque centralized transparent decentralized 39

94 RSCoin opaque centralized transparent decentralized 39

95 RSCoin opaque centralized transparent decentralized 39

96 ? RSCoin opaque centralized? transparent decentralized 39

97 RSCoin opaque centralized transparent decentralized 40

98 RSCoin opaque centralized transparent decentralized what is this distance? can we quantify it? 40

99 absolute better consumer protection? accountable better fairness? non-existent RSCoin opaque centralized transparent decentralized what is this distance? can we quantify it? what security properties are even provided? 40

100 absolute better consumer protection? accountable better fairness? non-existent opaque centralized RSCoin Thanks for listening! transparent decentralized what is this distance? can we quantify it? what security properties are even provided? 40